Phone-first: 390px is the design width, not the fallback. It is also the one surface in this product that scrolls — the no-scroll law is written for an operator who must see a whole working state at once, and a customer reading a menu on a phone is not that. The discipline still binds: the same seven tones, tabular numerals, EGP once, AA contrast, 44px targets, reduced motion, and a visible focus ring.
Two ways: the code on the table, or signing in and being told where we think you are.
Takes about a minute. You can look at the menu without one.
The code's default screen is the menu for that seat. It works for somebody who has never used the app — sign-up happens after the scan, not before it, and browsing never requires an account.
Paid at the desk when you leave.
Adds it to your home screen. No store, nothing to download.
No code needed if we already know where you are. The install button is a control that says what it does — and on a phone where the browser will not offer the prompt, it explains the share-sheet path instead of pretending it can do it.
You just scanned Table 3.
Your order goes to Table 3 and the desk moves you across.
Your order goes to Table 3. You stay at PC-03 and your own clock keeps running.
Either way your order goes through. We will sort the seat out with you.
The order is never blocked. A customer with a phone in their hand and a staff member across the room will just shout the order instead, and a worked-around flow enforces nothing. Both answers are real, both are stated as outcomes, and exactly one flag reaches the desk.
Pay for everything together when you leave.
No pay button, and the absence is explained. The bill is settled at the desk. A disabled payment control with no reason would read as broken.
They join your table and order from their own phone.
Or they type this. It stops working when you pay.
This code is a key to your tab, so it behaves like one. It is tied to tonight, it rotates whenever you ask, it dies when you pay, and everyone who used it is listed here with a control to remove them.
Yours only. Rana and Tarek have their own.
Four steps in customer words. Never an internal state name, and never a settle step — money between the venue and the till is not the customer's screen.
Console room is full until about 22:30. Put your name down instead and we will message you.
Availability is the truth, per kind. A full room says when, and offers the waiting list rather than a dead button.
Come in any time and the desk will confirm it. After that you can book from anywhere.
It takes a minute and it is why a Friday night does not fill up with bookings nobody turns up for.
The waiting list works without it — you are here when you use it.
Gated, not hidden. The booking control is visible and disabled with the reason at it, and the path that does work is offered right underneath.
Roughly 15 minutes
Waiting since 20:52 · 2 people · any machine
We will call your name and message you. If you miss it we keep your place for ten minutes.
No hard feelings.
The queue is a place, not a table. Position, an honest estimate, and what happens if you miss the call — which is the thing people actually worry about.
| # | Rule | Why |
|---|---|---|
A1 | Shopping surfaces scroll. Account and tracking surfaces obey the no-scroll law. | The law is written for an operator who must see a whole working state at once. A menu on a phone is not that. |
A2 | Browsing never needs an account. Ordering does. | An account gate on the menu is a customer who walks to the counter instead. |
A3 | A seat disagreement never blocks an order. | Both answers are outcomes, and exactly one flag reaches the desk. |
A4 | Order state is in customer words, and the settle step is never shown. | Money between the venue and its till is not the customer's screen. |
A5 | The invite code is bound to one visit, rotates on request, and dies at settlement. | It is a key to somebody's tab, so it behaves like one — and everyone who used it is listed with a remove control. |
A6 | A customer only ever sees their own share. | Rana's tab is Rana's. The whole-table figure belongs to whoever booked it. |
A7 | The absent pay button is explained, not just missing. | A missing control reads as broken; a stated one reads as a rule. |
A8 | Phone verification gates remote booking and nothing else. | It gives the desk's in-person check a job worth doing, and it does not block the walk-in the table code exists to serve. |
A9 | The install control says what it does, and handles the browser that will not offer it. | Otherwise installing is folklore passed between customers. |
Right-to-left and Arabic stay in the system and are proven on the design-system page. Copy ships in English for v1, which is a ruling about words rather than about capability — the tokens, the logical properties and the Arabic face are all in place the day it is wanted.