A mental model is the story a person is running about how something works. It is usually wrong in some specific way, it is never written down, and it decides what they do next.
Kenneth Craik put the idea down in 1943: the mind builds a small working copy of the world and runs it forward to see what happens, and that is cheaper than trying things. The copy is assembled out of every other thing that ever behaved like this one. Nobody assembles it deliberately. Nobody can recite theirs.
The design consequence is one sentence long. A person is not operating your system. They are operating their model of it, and when the two disagree the system is right and the person is stuck, and being right is worth nothing at that moment.
So the six controls below are ordinary. A thermostat, a crossing button, a switch, a dialog, a back arrow, a delete. For each one you are asked what it will do before you touch it, and then you operate it and watch what it does. Your prediction is the whole measurement. What happens afterwards is not a test, it is the answer sheet.
Four of them offer three predictions and two offer a pair. Guessing at random gets 2.3 of the 6, which is the number your score has to be read against, and the page works out at the end whether anything you did was distinguishable from guessing. Usually it will not be. Six predictions is not a lot of predictions.
Six ordinary controls. For each one you say what you think it will do before you touch it, then you operate it and watch what it actually does. The prediction is the reading — six of them from one person, which the page is careful about at the end. It needs scripting to run, and scripting is off.
Why the prediction is the reading and the click is not
Once you have used a control you know what it does, and any measurement taken after that is a measurement of this page. The prediction is the only moment where the thing being read is what you brought with you. It is also the only moment that resembles the real situation, because in the real situation nobody has used the control yet either.
The controls that catch people are not badly made. Every one below is a reasonable implementation of a real constraint — a thermostat is a target because that is what a thermostat is, a photo waits thirty days because people delete things they wanted. The mismatch is not caused by the system being wrong. It is caused by the system being correct in a way nobody was told about, which is a much harder thing to find in your own product because you are the one who was told.
What it costs you
The wrong model does not feel like uncertainty. It feels like knowing. Somebody who thinks the dial is a valve turns it to 30 with complete confidence and no reason at all to ask you a question, which is why this failure does not arrive in your support inbox.
The model came from somewhere else and it is already installed. Thirty years of physical thermostats, twenty of desktop trash cans, however many crossing buttons. You are not writing on a blank surface, and the surface is not yours.
A label describes. It does not correct. Text under a control is read by people who already suspect they are wrong. Anyone whose model is confident and mistaken has stopped reading, because their model told them what the screen said before the screen did.
The cheap fix is usually feedback, not explanation. The crossing button that lights up when the request registers has not taught anybody how the junction works. It has just stopped them pressing it eleven more times, which was the entire cost.
I know the thermostat is a target. I have known it for years. It was 8° in the flat in January and I set it to 28, and I stood next to it for a bit.