Customer to shop lane
This is the FAEDA daily usage engine: families discover nearby trusted shops, shops respond with real availability, and every order, payment, delivery, settlement, and complaint remains gated by proof.
14
journey gates
18
truth objects
0
fake wallet
Operating rule
Customer can discover, request, accept, and track. Shop can publish, respond, prepare, and support. Final order, payment, inventory, rider proof, ledger, settlement, and review trust stay behind their own gates.
Customer sees
Sees nearby trusted shops, categories, availability hints, delivery/pickup labels, and safe demo status.
Shop owns
Owns shop profile, location, hours, delivery radius, verification badge, photos, and QR entry point.
Blocked here
No private shop ledger, supplier cost, customer personal data, or final stock claim is exposed here.
Customer sees
Checks who the shop is, what proof exists, how complaints work, and whether it is FAEDA-reviewed.
Shop owns
Owns verification documents, service areas, owner contact readiness, categories, staff handoff, and trust status.
Blocked here
A pretty profile does not create verified inventory, payment authority, or settlement authority.
Customer sees
Sees understandable product names, units, variants, and safe public listing information.
Shop owns
Connects its listing to master product identity, source confidence, price display, and availability boundary.
Blocked here
Master product, shop listing, vendor availability, manufacturer product, and demand signal stay separate.
Customer sees
Sees what may be available today, estimated price, pickup/delivery possibility, and last updated time.
Shop owns
Updates available quantity band, price snapshot, substitute options, freshness note, and response SLA.
Blocked here
Availability is not a final reservation until the reservation gate approves it.
Customer sees
Builds a personal or family basket, repeats essentials, or joins a group order like pizza day or grocery day.
Shop owns
Receives grouped demand pressure, item mix, delivery slot preference, and minimum quantity opportunity.
Blocked here
Basket intent does not create final order, payment, ledger, inventory movement, or rider dispatch.
Customer sees
Asks for price, quantity, delivery slot, substitution, bundle, or pickup confirmation.
Shop owns
Reviews demand, checks availability, suggests substitute, and prepares a seller response packet.
Blocked here
Inquiry is not checkout, PO, invoice, payment, or legally final acceptance.
Customer sees
Receives a clear response: available, partial, substitute, wait time, price line, and validity window.
Shop owns
Owns response accuracy, expiry, fulfillment note, packaging note, and handoff condition.
Blocked here
Quote response does not auto-create order or payment.
Customer sees
Customer does not hear raw seller voice; they only see reviewed, customer-safe wording after confirmation gates.
Shop owns
Can speak a fast reply, review transcript, detect intent, filter private/payment/final claims, and save a draft for Reply Builder.
Blocked here
Voice mode cannot send a message, final quote, order, stock hold, payment, dispatch, wallet, ledger, trust, or settlement action.
Customer sees
Customer does not see local seller drafts until online retry passes the proper backend gates.
Shop owns
Can save reply/evidence/stock notes locally and mark records retry-ready when internet returns.
Blocked here
Offline Mode cannot sync as truth, send reply, confirm order, reserve stock, move inventory, dispatch rider, capture payment, post ledger, release settlement, or change trust.
Customer sees
Customer private data stays masked even when shop has multiple staff members handling the request.
Shop owns
Owner, cashier, packer, and handover person each get a limited work lane with visible/hidden permission rules.
Blocked here
Staff Mode cannot create real auth users, bypass permissions, mark paid, release settlement, move inventory, complete delivery, or expose customer-private data.
Customer sees
Family-private notes, customer wallet data, exact contact, health details, unrelated orders, and admin/internal notes stay hidden while the seller handles the request.
Shop owns
Checks seller, cashier, packer, handover, offline, voice, inbox, and reply surfaces for forbidden data exposure before deeper runtime confidence.
Blocked here
Privacy QA cannot create permissions, sessions, messages, orders, payments, inventory movement, dispatch, ledger, settlement, trust changes, or customer-visible actions.
Customer sees
Customer gets a safer review path when a shop is stuck, stock looks fake, listing is wrong, seller is inactive, or a dispute appears.
Shop owns
Creates a FAEDA Team review packet for stuck shop, fake stock, wrong listing, inactive seller, or dispute without exposing private customer data.
Blocked here
Admin escalation cannot punish, delist, refund, replace, notify, call, mark stock fake, move money, move inventory, post ledger, release settlement, or change trust.
Customer sees
Nearby customers can see today's street-vendor items, live/low/sold-out status, and reserve, pickup, or rider intent.
Shop owns
Street vendor can one-tap daily items, mark sold-out, show approximate nearby status, and save a local daily packet.
Blocked here
Street Vendor Variant cannot create final order, payment, exact GPS release, dispatch, rider assignment, stock ledger, settlement, penalty, or trust change.
Customer sees
Customer can see home-chef menu slots, prep time, limited quantity, hygiene/freshness notes, and pre-order intent.
Shop owns
Home chef can set menu state, slot, prep time, limited quantity, freshness note, and pre-order/pickup/rider intent.
Blocked here
Home Chef Variant cannot create final order, payment, kitchen verification, exact home location release, rider assignment, inventory ledger, settlement, food-safety certification, or trust change.
Customer sees
Customer can see safe pharmacy wording: prescription proof needed, expiry/batch proof, availability status, and substitution warning.
Shop owns
Pharmacy seller can set prescription proof status, medicine availability, expiry proof, substitution mode, and safe customer note.
Blocked here
Pharmacy Variant cannot diagnose, prescribe, advise dosage, approve dispensing, finalize order, collect payment, dispatch rider, move inventory, post ledger, release settlement, certify medicine quality, or change trust.
Customer sees
Customer can see service slot, visit fee, job proof rules, approval state, and issue handling before a home visit is trusted.
Shop owns
Service provider can set booking slot, visit fee mode, job proof checklist, customer approval state, and issue path.
Blocked here
Service Provider Variant cannot create final booking, release exact home location, assign worker, collect payment, close job, post ledger, release settlement, punish provider, or change trust.
Customer sees
Customer can safely see checked/listed labels, response speed, issue resolution status, and proof-ready wording.
Shop owns
Seller previews exactly what is public and what remains hidden before trust labels are published.
Blocked here
Public Trust Screen cannot verify seller, change ranking, publish hidden score, expose complaints, collect payment, close disputes, release settlement, or mutate trust.
Customer sees
Customer benefits indirectly because seller screens are checked for mobile fit, plain wording, and safe trust language before demo.
Shop owns
Seller app surfaces are reviewed for no footer, no heavy wording, no internal team language, no overlap, and touch-safe controls.
Blocked here
Seller App QA Gate cannot publish, block, rank, verify, collect payment, close issues, release settlement, or change trust.
Customer sees
Customer can see the whole safe journey: request, seller reply, accept, preparation, rider pickup, receive proof, and settlement pending.
Shop owns
Seller can demo the full phone-first chain without claiming final order, payment, stock movement, ledger, payout, or trust mutation.
Blocked here
End-to-End Demo cannot create live order, payment, rider job, inventory movement, ledger posting, payout, refund, issue closure, or trust change.
Customer sees
Customer flow becomes safer later because seller preview data is mapped to scoped future API contracts before runtime is built.
Shop owns
Seller preview packets are mapped to future DTOs, permissions, events, storage migration rules, and no-runtime locks.
Blocked here
Backend Readiness Map cannot call server APIs, create database rows, create orders, move stock, post ledger, release settlement, or change trust.
Customer sees
Customer benefits later when proven shops get better billing, stock, daily record, loyalty, and purchase planning discipline.
Shop owns
Seller evidence is checked for POS-lite, inventory-lite, roznamcha, loyalty, purchase planning, and paid Pro review readiness.
Blocked here
Upgrade Signal cannot charge seller, change plan, unlock live tools, create subscription, issue invoice, or change permission.
Customer sees
Reviews items, quantities, price lines, delivery preference, and terms before confirming.
Shop owns
Sees a structured demand packet and prepares for availability confirmation if approved.
Blocked here
Order draft is still pre-runtime: no invoice, payment, delivery, inventory, or settlement is created.
Customer sees
Sees confirmed, shortage, or substitute outcome with exact quantity, price candidate, expiry, and readiness.
Shop owns
Confirms exact availability, shortage, substitute, pickup readiness, and delivery readiness without mutating ledger stock.
Blocked here
Availability confirmation cannot deduct inventory, create payment, dispatch, ledger, wallet, or payout.
Customer sees
Creates COD or Upaisa/SBP partner-powered payment intent after availability evidence without a fake wallet claim.
Shop owns
Sees payable visibility, COD expectation, hold reason, failed state, and partner-powered evidence status later.
Blocked here
Payment intent cannot execute partner payment, claim callback, create wallet balance, release settlement, or post ledger.
Customer sees
Sees pickup actor, pickup proof requirement, ETA, masked contact, delivery route, and failed-attempt reason after dispatch authority.
Shop owns
Prepares package, pickup window, route readiness, proof requirement, and failed-attempt response without executing delivery.
Blocked here
Rider/helper execution and delivery proof are later gates; delivery proof cannot mutate finance by itself.
Customer sees
Confirms receipt with OTP/photo/QR, timestamp, actor, location hint, and customer confirmation.
Shop owns
Sees proof that links back to the source order and dispatch plan, but cannot use it to mutate finance or final trust by itself.
Blocked here
Proof opens the issue window; it does not complete delivery, move inventory, post ledger, release settlement, or pay riders.
Customer sees
No extra customer data is exposed. This is the shopkeeper-side receipt status mirror.
Shop owns
Sees receipt proof state, OTP/photo/QR reference, timestamp/actor, issue window, and safe area hint only.
Blocked here
Seller cannot release payment, ledger, settlement, payout, wallet, partner callback, final trust, refund, replacement, or penalty from this view.
Customer sees
Customer COD/payment data stays limited to safe evidence labels.
Shop owns
Sees COD expected, collected claim, rider deposit proof pending/submitted, dispute, and reconciliation evidence.
Blocked here
Seller cannot mark paid, post ledger, release settlement, approve rider deposit, change balances, or claim wallet truth.
Customer sees
Partner payment evidence stays masked and partner-powered; no FAEDA wallet claim is shown.
Shop owns
Sees pending, proof success, failed, reversed, held, and disputed partner evidence states.
Blocked here
Seller cannot mark paid, trust callbacks, post ledger, release settlement, create wallet balance, or call partner APIs.
Customer sees
No customer private finance is shown. This is shopkeeper-side balance visibility only.
Shop owns
Sees pending, held, approved, paid-evidence, and disputed balances from accounting truth labels only.
Blocked here
Seller cannot release payout, create wallet balance, post ledger, mark paid, close reconciliation, or release settlement.
Customer sees
Customer private data remains masked. Seller sees only the safe issue packet needed to respond.
Shop owns
Handles missing item, wrong item, damaged/stale item, late delivery, overcharge, behavior issue, fake availability, or payment issue as review evidence.
Blocked here
Seller cannot close complaint, issue refund/replacement, reverse payout, penalize rider/customer, change trust, post ledger, or move inventory.
Customer sees
Customer sees only a safe response later; raw seller files, internal notes, and private data stay hidden.
Shop owns
Attaches or references packing proof, bill proof, stock proof, handover proof, and a customer-safe response note.
Blocked here
Seller cannot close issue, approve refund/replacement, reverse payout, create wallet credit, post ledger, change trust, or move inventory.
Customer sees
Customer receives only a safe proposal later; seller cannot force refund, replacement, penalty, or closure.
Shop owns
Proposes replacement, accepts refund review, disputes claim, offers partial remedy, or waits for approval after evidence reply.
Blocked here
Seller cannot execute refund/replacement, move wallet money, reverse payout, release settlement, post ledger, deduct inventory, change trust, or close complaint.
Customer sees
Customer data stays aggregated and masked; no private family details appear in seller reporting.
Shop owns
Sees daily requests, accepted, rejected, completed, missed demand, issue count, repeat demand, and top products.
Blocked here
Report cannot become revenue, tax, ledger, wallet, settlement, payout, inventory, trust, or purchase-order truth.
Customer sees
Customer requests stay aggregated and private; the seller sees demand patterns, not family identities.
Shop owns
Reviews products customers wanted but the shop could not provide, with reason tags, urgency, source lane, and safe next action.
Blocked here
Missed demand cannot create supplier need, RFQ, PO, B2B lead, stock, inventory movement, price promise, or source commitment.
Customer sees
Customer demand remains aggregated and private; no customer identity or exact address appears in seller inventory planning.
Shop owns
Sees fast items, low stock, unavailable items, today price hints, reorder hints, source confidence, freshness checks, and safe next actions.
Blocked here
Inventory Lite cannot create full ERP inventory, GRN, stock ledger, RFQ, PO, supplier order, B2B lead, price commitment, wallet, settlement, or public listing.
Customer sees
Customer identity remains masked; only aggregate restock demand and source-direction evidence are used.
Shop owns
Prepares restock need lines, quantity bands, source lanes, urgency, confidence, and owner-review checklist from inventory and missed-demand evidence.
Blocked here
Supplier Need cannot contact suppliers, create RFQ, supplier quote, purchase intent, PO, supplier order, B2B lead, inventory movement, GRN, invoice, wallet, or payment.
Customer sees
Customer demand remains anonymous and aggregated; the lead packet cannot reveal family identity, address, phone, or payment data.
Shop owns
Turns supplier-need evidence into lead candidates for wholesaler, distributor, manufacturer, farmer, or specialist lanes with readiness and contact policy.
Blocked here
B2B Lead cannot contact sources, create RFQ, supplier quote, purchase intent, PO, supplier order, payment, invoice, GRN, inventory movement, public listing, or settlement.
Customer sees
Customer sees a public shop entry link with FAEDA-controlled labels and request/check-availability language only.
Shop owns
Previews QR, public shop link, WhatsApp share text, allowed labels, blocked claims, and share modes.
Blocked here
QR control cannot publish unapproved verification, guarantee stock, lock price, enable checkout, claim wallet/payment, create order, move inventory, expose customer data, or alter ranking.
Customer sees
Opens missing, wrong, damaged/stale, late, overcharge, rider behavior, shop/provider behavior, fake listing, or payment issue with proof links.
Shop owns
Sees issue reason, receipt/delivery/payment evidence, requested outcome, and support owner without private cost or unrelated customer data.
Blocked here
No auto refund, replacement, penalty, payout reversal, wallet credit, public blame, or final trust penalty.
Customer sees
Sees whether the remedy path is replacement or refund, which proof gates are required, and when closure certificate review is ready.
Shop owns
Confirms replacement stock or watches finance/payment gates proceed without gaining authority to refund, reverse payout, mutate stock, or close the case silently.
Blocked here
No money movement without maker-checker, partner draft, callback intake, settlement/ledger posting, and closure certificate review.
Data objects
FAEDA should never compress these into one messy product or order table. Each object has its own owner, permission, and audit path.
CustomerProfile
Customer identity, phone, language, privacy state, and customer-scoped permissions.
HouseholdConsent
Family or household access rules, shared basket consent, and contact preferences.
ShopProfile
Shop identity, location, owner proof, working hours, delivery radius, and public trust status.
ShopVerification
Geo proof, photos, field reviewer, documents, and review history.
MasterProduct
Universal product identity: category, unit, variant, attributes, and search names.
ShopListing
What this shop sells publicly, separate from manufacturer output and warehouse stock.
PriceSnapshot
Displayed price, expiry, update source, promo condition, and audit note.
DemandSignal
Search, repeat request, group-buy interest, basket trend, and unmet demand.
InquiryDraft
Customer question before quote, order, reservation, payment, or delivery.
SellerResponse
Shop answer with availability, substitute, validity window, and fulfillment note.
OrderDraft
Customer intent packet before final runtime order creation.
AvailabilityPacket
Seller confirmation with exact quantity, price, expiry, shortage, substitute, and pickup/delivery readiness.
PaymentIntentDraft
Licensed partner payment instruction candidate, not wallet truth.
DispatchPacket
Pickup/delivery plan, rider/provider choice, SLA, and handover requirements.
HandoverProof
OTP, photo, timestamp, actor, location, and exception state.
CustomerStatement
Customer-safe invoice and statement view, separate from internal ledger.
ComplaintTicket
Issue reason, evidence, ownership, SLA, correction, and closure proof.
RemedyClosureCertificate
Replacement/refund branch, proof gates, callback state, ledger dependency, reopen triggers, and closure review.
ReviewTrustSignal
Public feedback after abuse checks and privacy masking.
family demand
Family profile, language, privacy, and consent-safe sharing
Nearby search by category, item, budget, freshness, and trusted shop
Smart reorder for repeat essentials like milk, bread, eggs, medicine, and groceries
Group buying for mohallah events, pizza day, grocery day, wedding prep, school snacks, and bulk savings
Budget-aware basket with substitutes and affordability warning
Safe payment labels: partner-powered, COD, pending, held, disputed, approved, or unavailable
Delivery tracking with rider proof and customer-visible exception reasons
Complaint, return, correction, and review path without exposing internal data
seller operations
Shop onboarding, QR code, public link, geo proof, photos, category, and verification state
Source-linked catalog, master product mapping, daily availability, and price expiry
Seller response SLA: accept, reject, substitute, partial fulfill, or ask customer to revise
Pickup and delivery readiness: packing, handover, opening hours, and rider coordination
COD/deposit visibility, pending settlement, held amount, dispute reason, and partner callback evidence
Customer service queue: late order, wrong item, damaged item, missing item, refund request, or review issue
Offline/SMS fallback for low-internet shops without bypassing backend authority
Business Pro upgrade path: POS-lite, inventory-lite, roznamcha, loyalty, and purchase planning
Trust guardrails
Customer can discover, ask, accept, and track; backend still decides authority.
Shop can respond and prepare; it cannot silently mutate customer money, ledger, or final stock.
No fake FAEDA wallet claim. Payment language stays licensed-partner powered.
No customer-private household data is shown to shops.
No shop sees supplier cost, hidden margin, admin notes, or unrelated customer records.
No final inventory movement until the correct inventory gate approves it.
No settlement release without partner callback, reconciliation, exception check, and maker-checker approval.
Reviews and complaints need abuse controls, evidence, privacy masking, and closure status.
Money boundary
Customer-shop screens can show pending, held, disputed, approved, or paid status only from partner evidence, reconciliation, ledger posting, and human approval gates.