Field reference

Every field you can type, pick, paste or upload in DineGlobe is listed on this page, with its format, its exact limits, its default and who can use it. The limits live in strict server-side schemas: every action re-parses the whole input against the same bounds before any database work, so the browser is never the only validator. When a field fails, the server answers with the stable code VALIDATION and a per-field error map — guests see one plain sentence naming the first problem, while staff panels list each offending field with its own message.

The main production screens: create an account, sign in, your account and security, add a venue, and guest link entry. Several configuration and back-office capabilities have no production screen yet; they are operated from the internal panels at /app/panels, and the tables below say so explicitly.

Conventions

Strict schemas, enforced on the server

• Every service and action boundary parses input with a strict schema. Unknown keys are rejected, strings are trimmed before length checks, and email addresses are lowercased where they are stored.
• Almost nothing validates in the browser: staff panel forms set noValidate, and the server is the only validator. A few panel forms let the browser flag an empty required field, and the landing-page demo announces client-side labelled errors — advisory in every case.
• Malformed input never reaches the database. It becomes 400 VALIDATION with a fieldErrors map of field: [messages] pairs.

Error codes a field can produce

Code	Meaning
400 VALIDATION	Malformed input; carries per-field messages.
401 UNAUTHENTICATED / TOKEN_INVALID / MFA_REQUIRED	Not signed in; a one-time credential is unknown, expired or already used; or a verification code is required. One-time tokens always answer the same generic code — there is no hint which of the three it was.
403 PERMISSION_DENIED	Your role may not perform this action.
404 NOT_FOUND	Unknown — and a resource owned by another organization looks exactly the same.
409 CONFLICT	Someone else changed the row since you read it. Reload and retry.
422 RULE_VIOLATION	Well-formed input that breaks a service rule, such as overlapping schedule windows.
429 RATE_LIMITED	Too many attempts; wait and retry.
503 DEPENDENCY_UNAVAILABLE	A backing system is not reachable right now.

Who can edit what

OWNER and ORG_ADMIN hold every permission. MANAGER adds venue management, staff changes within limits, reservations including request approvals, arrival corrections, walk-ins, waitlist control, refund execution, imports and exports, privacy cases and reporting. HOST handles reservations, arrivals, walk-ins and waitlist, plus service-sheet reporting for the current service date. DOOR reads reservations and records arrivals. FINANCE executes refunds and reads reservations, downloads and reports. READ_ONLY reads only. Refund approval, billing, payment account connection and the audit log are owner-tier only. A manager may grant only HOST, DOOR or READ_ONLY. The five platform roles gate the admin surface and every platform action requires a session verified with a two-step code.

Panel scaffolding note

The internal panels at /app/panels carry visible Session id and Auth version fields on each form, standing in for the sign-in cookie the production console uses. Those two are test scaffolding, not product fields, and they are left out of every table below. Where a capability has no production screen yet, the table names the panel it lives on.

Shared vocabularies

Pattern	Applies to
^[a-z0-9]+(-[a-z0-9]+)*$, at most 96 characters	Public venue addresses; trimmed and lowercased first.
^[A-Z]{2}$	Country codes, uppercased first.
^[A-Z]{3}$	Currency codes.
IANA zone name	Must be UTC or contain /, and must resolve in the server’s time-zone database.
Locale tags	Venue and identity tags allow ^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$ shapes up to 35 characters (venue tags add BCP 47 restrictions); reviewed launch languages are en, ja and ar. Unknown locales fall back to English, disclosed as such.
`^([01]\d	2[0-3]):[0-5]\d$`
^\d{4}-\d{2}-\d{2}$	Business dates; a real calendar date is required, not just the shape.
^\+[1-9]\d{1,14}$	E.164 phone numbers on bookings, staff intake and imports. The waitlist accepts ^\+[1-9]\d{6,14}$.
`^(0	[1-9]\d{0,14})$`

Sign-in, registration & account security

Create an account — /app/register

Field	Where	Type/format	Rules & limits	Notes
Email	Registration form	Email address	Valid email, at most 254 characters after trim	Required. Your sign-in name, stored lowercased. A duplicate answers EMAIL_TAKEN (“An account with this email already exists.”).
Display name	Registration form	Text	1–160 characters after trim	Required. The name shown on the account.
Password	Registration form	Password	12–128 characters	Required. Stored only as an Argon2 hash; the rules are never echoed back at sign-in.

Registering never signs you in — success points you to sign in.

Sign in — /app/login

Field	Where	Type/format	Rules & limits	Notes
Email	Sign-in form	Email address	Schema requires a valid email; the form only asks that it be filled	Required.
Password	Sign-in form	Password	Any non-empty value — sign-in checks the guess, never the rules	Required. A wrong pair answers the same generic “Email or password is incorrect.” every time.
Authenticator code (or a recovery code)	Sign-in form, conditional	Text	Tried as a 6-digit code first, then as a recovery code (8–64 characters after trim)	Appears only when the account has a confirmed two-step factor; the input suggests one-time-code autofill. A mismatch answers “That code did not match. Enter your email, password and a new 6-digit code (or a recovery code).”

Every submit re-authenticates from scratch and mints a fresh session; a failed code step revokes the session that was just issued.

Two-step verification — /app/account

Field	Where	Type/format	Rules & limits	Notes
Start button	Two-step section	—	—	Starts enrollment. Returns the base32 secret and the otpauth URI as selectable text — V1 renders no QR image. Already-on accounts answer MFA_ALREADY_CONFIRMED.
6-digit code	Two-step section	Text	Exactly 6 digits (^\d{6}$); the input caps at 6 characters with a numeric keypad	Required to confirm the pending factor. On success 10 recovery codes are shown exactly once — only hashes are stored, so they cannot be shown again.
Device label	Sessions section	Text	At most 120 characters	Optional label recorded when a session is issued; shown per row on the sessions list.
Sign out (per row)	Sessions section	—	—	Revokes one of your own sessions. Another account’s session id reads as 404, never an error hint.

One-time tokens (verify email / reset password / link identity)

The token flow is exercised from the internal operator panel in the pilot — no email actually sends yet, so links are issued and consumed through the panel rather than an inbox.

Field	Where	Type/format	Rules & limits	Notes
Purpose	Token request form	Select	VERIFY_EMAIL, RESET_PASSWORD or LINK_IDENTITY	Required; defaults to VERIFY_EMAIL.
Email	Token request form	Email address	At most 254 characters	Required. The answer is always the same regardless of whether the account exists.
Token secret	Token consumption form	Text	16–256 characters; presented links carry a 43-character secret	Required. Unknown, expired and already-used tokens all answer the generic TOKEN_INVALID.
New password	Token consumption form	Password	12–128 characters	Legal only when consuming a RESET_PASSWORD token.

Organizations, teams & invitations

Create an organization

Field	Where	Type/format	Rules & limits	Notes
Name	Venue setup form (“Create a new organization…”) or panel	Text	1–160 characters after trim	Required. The creator becomes the organization-wide OWNER.

Memberships

Field	Where	Type/format	Rules & limits	Notes
Organization id	Panel	UUID	—	Required.
User id	Panel	UUID	—	Required. The member being granted, updated or removed.
Venue id	Panel	UUID	Optional; blank means an organization-wide row	Organization-wide rows are restricted to owner-tier roles by the database itself.
Role	Panel	Select	ORG_ADMIN, MANAGER, HOST, DOOR, FINANCE or READ_ONLY	Defaults to HOST on the panel. OWNER is only reachable through founding or ownership transfer. A manager may grant only HOST, DOOR or READ_ONLY; anything higher answers PERMISSION_DENIED.

Removing a membership uses the same three identifiers. Transferring ownership takes an organization id and the new owner’s user id: owner-tier only, self-transfer is refused, the target must already be a member, and the acting owner is demoted to ORG_ADMIN in the same step. The last owner cannot be removed — transfer first.

Invitations

Field	Where	Type/format	Rules & limits	Notes
Organization id	Panel	UUID	—	Required.
Invitee email	Panel	Email address	At most 254 characters	Required. The identity must already exist and be verified at acceptance time.
Role	Panel	Select	Full role enum	Defaults to HOST; manager-limited as above.
Venue id	Panel	UUID	Optional; blank means organization-wide	Scope of the granted row.
Invitation secret	Acceptance form	Text	16–256 characters; presented links carry a 43-character secret	One-time; hashed at rest. Unknown, expired, revoked and used invitations all answer the same generic TOKEN_INVALID. Invitations expire after 7 days.

Delivery is not wired to a real inbox in the pilot, so invitation secrets are handed over out of band.

Venue setup & the public address

See Venues, slugs & publication for the workflow around these fields.

Add a venue — /app/venues/new

Field	Where	Type/format	Rules & limits	Notes
Organization	Setup form	Select	First option “Create a new organization…”, otherwise your existing organizations	Defaults to creating a new one when you have none.
New organization name	Setup form	Text	At most 160 characters	Required exactly when “Create a new organization…” is selected.
Venue name	Setup form	Text	1–160 characters	Required. Display name.
Public address (slug)	Setup form	Text	Kebab-case, at most 96 characters, pattern ^[a-z0-9]+(-[a-z0-9]+)*$	Required. Becomes dineglobe.com/your-slug. Reserved first segments are refused (app, auth, api, my, b, about, features, capabilities, customers, contact, support, feature, customer, docs). A taken address answers SLUG_TAKEN with a numbered alternative.
City	Setup form	Text	1–120 characters	Required.
Country code	Setup form	Text	Exactly 2 letters A–Z, uppercased	Required. ISO 3166-1 code; feeds the country capability gates.
Street address	Setup form	Text	1–200 characters	Required.
Timezone (IANA)	Setup form	Text	Must resolve in the server’s zone database	Required. All business dates and slots resolve here.
Currency	Setup form	Text	Exactly 3 letters, uppercased	Required. One venue never mixes currencies.
Primary language	Setup form	Select	en, ja or ar	Defaults to en. The venue must later carry accepted-terms text in this language.

The venue is born DRAFT — private until publication is requested and approved. The underlying command accepts a few more fields that the setup form does not render (they are available to API and panel callers): region at most 120, addressLine2 at most 200, postalCode at most 32, latitude −90 to 90, longitude −180 to 180, supportedLocales up to 10, venueTypes up to 10 entries of 1–40 characters, publicPhone at most 32, publicEmail at most 254, and websiteUrl (HTTPS only).

Rename the public address — panel

Field	Where	Type/format	Rules & limits	Notes
New slug	Panel, venue registry	Text	Same slug rules as creation	Requires venues.manage. The previous address keeps redirecting (permanent redirect).

Request publication — panel

Field	Where	Type/format	Rules & limits	Notes
Venue id	Panel, publication review	UUID	—	The only input. Blocked readiness returns the exact missing requirements as field errors: default-locale-content (profile content in the default language), resource (at least one active resource), plus service and policy.

Approval is a platform-operator act (see Platform admin tools); the venue moves to PENDING_REVIEW and stays private until then. There is no venue profile text editor in V1 — the public page is composed server-side from approved data, and the only per-locale text you publish is the accepted-terms text under Booking policies.

Media uploads

Panel surface (DEV-010), permission venues.manage. Images are quarantined and re-encoded before they are ever served.

Field	Where	Type/format	Rules & limits	Notes
Venue id	Upload form	UUID	—	Required.
Purpose	Upload form	Select	gallery, cover, menu or document	Required; defaults to gallery.
Alternative text	Upload form	Text	At most 250 characters	Optional; the public alt text.
Filename	Upload form	Text	At most 255 characters	Optional. Provenance only — never used as a storage path.
Declared MIME type	Upload metadata	Select	image/jpeg, image/png or image/webp	A declaration only — the actual magic bytes decide.
Image file	Upload form	File	Real JPEG, PNG or WebP, at most 5 MB	Required. Anything else answers “Rejected: only real JPEG/PNG/WebP up to 5 MB is accepted.”

An assetId (UUID) names an asset for authorized download; retention cleanup is a button on the same panel.

Floor plan: areas, resources, layout & combinations

Panel surface (DEV-012/013), permission venues.manage. See Floor plan & resources for the workflow.

Areas

Field	Where	Type/format	Rules & limits	Notes
Venue id	Area form	UUID	—	Required.
Area id	Area form	UUID	Present = update that area	Optional.
Name	Area form	Text	1–80 characters	Required; must be unique in the venue (AREA_NAME_TAKEN).
Floor label	Area form	Text	1–40 characters	Optional.
Tags	Area form	Comma-separated text	At most 10 tags, each 1–40 characters	Optional free tags.
Sort order	Area form	Number	0–999	Optional display order.
Active	Area form	Checkbox	Boolean	Defaults to checked.

Resources (tables)

Field	Where	Type/format	Rules & limits	Notes
Area id	Resource form	UUID	Must belong to the same venue	Required — which area the table sits in.
Label	Resource form	Text	1–40 characters	Required; must be unique in the venue (RESOURCE_LABEL_TAKEN).
Type	Resource form	Select	TABLE, BOOTH, SEAT, BAR or PRIVATE_ROOM	Defaults to TABLE. No capacity pools in V1.
Min party / Max party	Resource form	Number	Each 1–50; maximum must be at least the minimum	Defaults to 2 and 4.
Accessible seating	Resource form	Checkbox	Boolean	Defaults to unchecked.
Online bookable	Resource form	Checkbox	Boolean	Defaults to checked — whether online intake may allocate this table.
Priority	Resource form	Number	0–999	Allocator rank; server default 100.
Active	Resource form	Checkbox	Boolean	Defaults to checked.

Layout placements

Field	Where	Type/format	Rules & limits	Notes
Layout version you loaded	Placement form	Number	At least 0	Required. This is the optimistic-concurrency token: saving against an old version answers LAYOUT_STALE (“The layout changed since you loaded it — refresh first.”). Recovery is re-reading the layout and resubmitting with the fresh version — there is no merge.
Resource id	Per placed item	UUID	Each resource may appear once per save	Required.
Shape	Per placed item	Select	rectangle or circle	Defaults to rectangle.
X / Y	Per placed item	Integer	0–1000	Position on the normalized 0–1000 canvas.
Width / Height	Per placed item	Integer	1–1000	Footprint size.
Rotation degrees	Per placed item	Integer	0–359	Optional; defaults to 0.

Combinations (approved multi-table joins)

Field	Where	Type/format	Rules & limits	Notes
Name	Combination form	Text	1–80 characters	Required.
Member resource ids	Combination form	Comma-separated UUIDs	Exactly 2–4 distinct resource ids of one venue; duplicates answer “Each resource may appear once in a combination.”	Required. Guests never define joins at booking time — only these approved combinations can be moved onto.
Min party / Max party	Combination form	Number	Each 1–200; maximum at least the minimum	Defaults to 5 and 12.
Priority	Combination form	Number	0–999	Default 100.
Active	Combination form	Checkbox	Boolean	Defaults to checked. A concurrent change answers CONFLICT.

Availability queries & best-fit selection

Panel surface (DEV-018); reads need reservations.read, selection happens inside the booking commands.

Field	Where	Type/format	Rules & limits	Notes
Venue id / Service id	Availability form	UUID	—	Required.
Business date	Availability form	Date	YYYY-MM-DD, real calendar date, venue-local	Required.
Party size	Availability form	Integer	1–200	Defaults to 4.
Preferred area id	Availability form	UUID	Optional	A ranking input, never a hard filter.
Duration minutes	Availability form	Integer	15–480	Optional; defaults to the offering’s duration.
Slot start (UTC)	Selection form	ISO datetime	One of the slots from the read	Required when claiming a slot.
Service revision from the read	Selection form	Text	`^(0	[1-9]\d*)$` — the revision printed by the read
Soft-pacing override reason	Selection form	Text	1–300 characters	Optional; manager only (re-authorized server-side). Non-managers get PERMISSION_DENIED.

Slots come back labelled AVAILABLE, NOTICE (inside the lead-time window), SOFT_PACED, HARD_CAPACITY or UNAVAILABLE.

Offerings

Panel surface (DEV-014), permission venues.manage. See Offerings & schedules.

Field	Where	Type/format	Rules & limits	Notes
Name	Offering form	Text	1–100 characters	Required, e.g. “Dinner”.
Approval mode	Offering form	Select	INSTANT or REQUEST	Defaults to INSTANT. REQUEST bookings wait for a venue decision.
Min party / Max party	Offering form	Integer	Each 1–200; maximum at least the minimum	Defaults to 1 and 8.
Default duration minutes	Offering form	Integer	15–480	Required; defaults to 90 in the form.
Notice minutes	Offering form	Integer	0–10080	Optional; label default 60. Slots inside the lead time render “too soon — call us” online.
Horizon days	Offering form	Integer	1–365	Optional; label default 90 — how far ahead guests may book.
Active	Offering form	Checkbox	Boolean	Defaults to checked.

Weekly schedules & date exceptions

Panel surface (DEV-014), permission venues.manage.

The weekly set

The whole week is published as one JSON array in a single schedules text area. Publishing reconciles the full set: rows keeping their scheduleId update in place, rows without one are created, and rows missing from the array are removed. Per-row fields:

Field (per row)	Type/format	Rules & limits	Notes
scheduleId	UUID	Present = update that row	Optional.
label	Text	1–80 characters; must be distinct within the offering	Required.
weekday	Integer	0–6, where 0 = Sunday	Required.
startsLocal / endsLocal	Text	Wall clock HH:mm, 24-hour, venue-local	Required.
endDayOffset	Integer	0 or 1; a same-day window must end after it starts, overnight windows use the explicit next-day end	Required.
slotMinutes	Integer	5–60 and a multiple of 5	Required slot interval.
preBufferMinutes / postBufferMinutes	Integer	0–240	Optional turnaround buffers.
maxArrivalsPerSlot / maxCoversPerSlot / hardConcurrentCovers	Integer	1–500, 1–2000 and 1–5000, all nullable	Accepted in the JSON only — no rendered inputs. Soft pacing caps and the hard ceiling; no user override at booking time.
durationBands	Versioned object	At most 10 bands of {minParty 1–200, maxParty 1–200, durationMinutes 15–480}; unknown fields reject	Optional party-specific durations. JSON only.
isActive	Boolean	—	Optional active flag.

Publishing also enforces the no-overlap rule across the whole cyclic week, including windows that wrap past midnight — a violation answers RULE_VIOLATION (“These weekly windows overlap — adjust the days or times.”). Each publish stores an immutable schedule version whose revision becomes the venue’s stale-read token.

Date exceptions

Field	Where	Type/format	Rules & limits	Notes
Schedule id	Exception form	UUID	Blank = a venue-wide closure (closures only in V1); overrides need a specific schedule and window	Conditional.
Business date	Exception form	Date	YYYY-MM-DD, real calendar date	Required; one exception per date (EXCEPTION_DATE_TAKEN).
Mode	Exception form	Select	CLOSED or OVERRIDE	Defaults to CLOSED.
Override startsLocal / endsLocal	Exception form	Text	Wall clock, with the same same-day/overnight consistency rule	OVERRIDE only.
Override endDayOffset	Exception form	Integer	0 or 1	Defaults to 0.
Override slotMinutes	Exception form	Integer	5–60, multiple of 5	Optional; falls back to the weekly value.
Reason	Exception form	Text	1–300 characters	Required; visible in the audit trail.

Precedence is closure, then override, then the weekly set. Daylight-saving shifts are handled honestly: wall times that do not exist are skipped, and fall-back repeats are flagged.

Booking policies

Panel surface (DEV-015), permission venues.manage. Policy versions are immutable — you edit by retiring a version and publishing a new one. See Booking policies & cancellation.

Field	Where	Type/format	Rules & limits	Notes
Service schedule id	Policy form	UUID	Blank = applies to the whole offering	Optional narrowing.
Min party / Max party	Policy form	Integer	Each 1–200; they must come as a pair with the maximum at least the minimum	Optional party-range scoping.
Payment mode	Policy form	Select	NONE or DEPOSIT	Defaults to NONE. Deposits are configuration only — collecting them stays closed in the pilot.
Amount basis	Policy form	Select	PER_BOOKING or PER_PERSON	Deposit policies only; per-person multiplies by party size.
Amount in integer minor units	Policy form	Integer	0–999999999999999; NONE forces 0, DEPOSIT forces at least 1	Deposit policies only.
Currency	Policy form	Text	^[A-Z]{3}$; must equal the venue currency	Optional; defaults to the venue currency.
Free cancellation minutes	Policy form	Integer	0–20160	Label default 1440 (24 hours) before the booked start.
Late retention bps / No-show retention bps	Policy form	Integer	0–10000	Basis points retained on a late cancellation or a no-show.
Grace minutes	Policy form	Integer	0–1440	Label default 15 — the controlled no-show grace window.
Accepted-terms texts (per language)	Policy form	JSON record	Each text 1–5000 characters, at most 20 languages, keys shaped like en or pt-BR	Required. The venue’s primary language must always be present. Guests see the text in their requested language, falling back to the venue default.

One more rule to know: a new policy may not overlap an active one unless it is strictly narrower (a specific schedule inside the offering-wide rule, a party range inside a wider one). This keeps resolution deterministic; violations answer RULE_VIOLATION. The resolved terms are frozen onto each booking, so later publishes never rewrite what a guest already accepted. Retiring takes the venue id, service id and the version number (at least 1).

Guest booking (public booking page)

The public flow at /{venue-address}/book. See Making a booking. No session is needed — the published listing is the gate.

Step 1 — find a table

Field	Where	Type/format	Rules & limits	Notes
Service	Find-a-table form	Select	Published services only	Defaults to the first service. Options show the party range.
Party size	Find-a-table form	Number	1–200	Defaults to 2.
Date	Find-a-table form	Date	YYYY-MM-DD; the input refuses dates before today, venue-local	Defaults to today.

Step 2 — the booking form

Field	Where	Type/format	Rules & limits	Notes
Choose a time	Booking form	Radio	One option per offered slot; slots inside the notice window are disabled and read “too soon — call us”	Required. Defaults to the first selectable slot.
Your name	Booking form	Text	1–160 characters	Required. Stored as typed — single-word names are fine.
Email	Booking form	Email	Valid address, at most 254 characters, lowercased	Required for online intake.
Phone	Booking form	Telephone	E.164 ^\+[1-9]\d{1,14}$, or empty	Optional.
Anything the venue should know?	Booking form	Text area	At most 1000 characters	Optional free-text note to the venue.

Two invisible fields ride along: an attempt id and a request key, minted when the form loads. A double click replays the same booking — it can never create two. Outcomes: an instant booking shows a large confirmation code; a request answers “Request sent — the venue will confirm by email.” (in the pilot, no email actually sends — the venue sees the request in its console). A service that requires a deposit answers honestly: “This service requires a deposit, which is not available online yet. Please book by phone.” If the booking terms change between loading and submitting, the server answers POLICY_STALE rather than booking against stale terms. Price, status and the confirmation code are owned by the server — they are not fields a guest can post.

Reservation actions in the console

Production screen: the reservation detail page at /app/venues/{venue-id}/reservations/{reservation-id} (reached from a venue’s board). Every action re-checks your role server-side.

Field	Where	Type/format	Rules & limits	Notes
Guests at the door	Record arrival form	Number	Integer 1–200	Defaults to 1. Managers, hosts and door staff.
Reason	Cancel form	Text	1–500 characters	Required — “A cancellation reason is required.”
Version (hidden)	Seat / complete / cancel / no-show forms	Number	At least 1	Rides each form. A stale value answers “Stale form — reload the page.”

Seat, complete-and-clear and no-show are button-only forms. No-show becomes available after the service grace window.

Request decisions, reschedules & staff cancels

Panel surfaces (DEV-020/021/022); decisions need reservations.approve (owner tier or manager), edits need host or above.

Approve or decline a request

Field	Where	Type/format	Rules & limits	Notes
Reservation id	Decision form	UUID	—	Required.
Row version from your last read	Decision form	Number	At least 1	Defaults to 1. A racing decision is a clean CONFLICT (“The reservation changed — reload and retry.”), never a double mutation.
Decision	Decision form	Select	APPROVE or DECLINE	Defaults to APPROVE. Approval re-checks availability first; a sold-out slot tells you to decline with a reason instead.
Decline reason	Decision form	Text	1–300 characters	Required when declining — the guest sees this text.

The expiry sweep takes a venue id only; a request expires at the earlier of its 24-hour review deadline and the service start.

Reschedule

Field	Where	Type/format	Rules & limits	Notes
Row version from your last read	Reschedule form	Number	At least 1	Required; mismatch answers CONFLICT.
Target business date	Reschedule form	Date	YYYY-MM-DD, real calendar date, venue-local	Required.
Target slot start (UTC)	Reschedule form	ISO instant	From an availability read	Required; a stale read refuses the same way booking does.
Service revision from the read	Reschedule form	Text	`^(0	[1-9]\d*)$`
New party size	Reschedule form	Integer	1–200	Defaults to 4 in the form.
Duration override in minutes	Reschedule form	Integer	15–480	Optional; blank keeps the current duration.
Preferred area id	Reschedule form	UUID	Optional	Ranking input.
Soft-pacing override reason	Reschedule form	Text	1–300 characters	Manager only, re-verified server-side.

Contact details never change through a reschedule, and any failure leaves the original booking untouched. An edit that would change the booked amount refuses with an explicit rebook-required outcome.

Cancel, no-show and reconfirmation

Field	Where	Type/format	Rules & limits	Notes
Idempotency request key	Cancel form	Text	1–100 characters	Required — and reused on retry, so a double submit cancels once.
Reason	Cancel form	Text	1–500 characters after trim	Required.
Reservation id + Row version	No-show and reconfirmation forms	Number	Version at least 1	No-show refuses before the grace window; reconfirmation request stamps the first ask, and recording requires that a request exists. Neither changes the booking’s status.

Walk-ins, the service view & table moves

Walk-in / phone intake — /app/venues/{venue-id}/new

Production screen; host and above. Staff intake skips the online notice rule — presence at the desk stands in for it.

Field	Where	Type/format	Rules & limits	Notes
Service / Party size	Step 1	Select / number	Party size bounded at 200	Required before slots are shown.
Choose a time	Step 2	Radio	Offered slots; short-notice slots are labelled “short notice” but stay selectable for staff	Required.
Party name	Step 2	Text	1–160 characters	Required.
Email	Step 2	Email	Valid address or empty	Optional. An empty email is an honest anonymous walk-in — no contact details are ever invented.

The accepted terms are resolved server-side for the exact slot at submit time; a terms publish between loading and submitting either books against the current version or answers POLICY_STALE.

Service view and moves — panel (DEV-024/025)

Field	Where	Type/format	Rules & limits	Notes
Business date	Service view	Date	YYYY-MM-DD	View needs door or above; polls by revision, and an unchanged floor answers cheaply.
Arriving count	Arrival form	Integer	1–200; blank means 1	Host or above.
Correct arrived count to	Arrival form	Integer	0–200; mutually exclusive with the count field	Manager correction.
Correction reason	Arrival form	Text	1–300 characters	Required whenever a correction is made. Corrections append a compensating event — the original is never rewritten.
Request key	Arrival form	Text	8–100 characters, letters, digits, :, _ or -; blank = fresh	Paste an old key to replay it safely.
Device id	Arrival form	Text	At most 80 characters	Optional; records which scanner committed.
Expected visit version	Seat / complete forms	Number	At least 1	Stale answers CONFLICT.
Target table ids	Move form	Comma-separated UUIDs	1–4 distinct ids; a multi-table target must exactly match an approved combination	Host or above.

The panel’s phone/walk-in booking form mirrors the production walk-in and adds an optional E.164 phone, the accepted policy version id and a request key.

Check-in passes & the scanner

Panel surface (DEV-026); issuance needs host or above, committing a scan needs door or above. See QR check-in passes.

Field	Where	Type/format	Rules & limits	Notes
Reservation id (issue)	Pass issuance	UUID	—	The only input. Issuing always rotates: the previous pass dies. The raw secret is shown once — only its digest is stored. There is no expiry field: a pass lives until the reservation ends, and scanning opens 60 minutes before the booked start.
Pass token	Scanner form	Text	1–200 characters — the QR payload	Required. Unknown, revoked and out-of-window passes answer with the exact scan window.
Venue id	Scanner form	UUID	—	Required; the scanner’s venue.
Arriving count	Scanner form	Integer	1 up to the remaining party size	Defaults to 1.
Request key	Scanner form	Text	8–100 characters, letters, digits, :, _ or -; blank = fresh	Makes an offline retry replay-safe.
Device id	Scanner form	Text	At most 80 characters	Optional; recorded with the scan and the audit event.

While the device is offline the scanner disables itself: check-ins are online-only, nothing is queued, and no success is ever shown without the server. A duplicate scan answers DUPLICATE with the current check-in state — never a second attendance. Arrival timestamps are server-stamped; a client cannot inject one.

Waitlist

Public join; host control. See Waitlist.

Field	Where	Type/format	Rules & limits	Notes
Venue id	Join queue form	UUID	—	Required. Public — no session.
Party name	Join queue form	Text	1–160 characters	Required.
Email	Join queue form	Email	At most 254 characters	One contact channel is required: “A queue party needs an email or a phone number.”
Phone, E.164	Join queue form	Telephone	^\+[1-9]\d{6,14}$	The other channel option.
Party size	Join queue form	Integer	1–200	Required.
Request key	Join queue form	Text	1–100 characters; blank = fresh	Idempotent join. The same contact twice answers WAITLIST_DUPLICATE (“This contact is already in the queue for today.”). Joining consumes no tables — nothing is held until an offer is made.

The join response quotes an approximate wait (always labelled as an estimate) and a one-time queue token shown once.

Field	Where	Type/format	Rules & limits	Notes
Entry id + Expected version	Offer table form	UUID / number	Version at least 1	Stale entry pictures refuse first.
Target table ids	Offer table form	Comma-separated UUIDs	1–4 distinct ids; any combination must be approved	Creates one short-held booking with a 5-minute acceptance window.
Offer id	Accept / withdraw forms	UUID	—	Acceptance converts the same record once — never a second booking. An expired offer answers WAITLIST_OFFER_EXPIRED and its table is released.
Queue session secret	Accept form	Text	43-character link secret — filled, the guest accepts; empty, staff session decides	Who accepts.
Request key	Offer / accept forms	Text	1–100 characters; blank = fresh	Idempotency.
Queue token secret	Token exchange	Text	43-character secret, shown once at join	One-time exchange for a 60-minute queue session.
Venue id	Sweep	UUID	—	Expires overdue offers.

Guest links & the guest portal

See Guest self-service links. The public surfaces are the /b pages; issuance currently happens on the internal panel.

Field	Where	Type/format	Rules & limits	Notes
Reservation id (issue)	Panel, guest links	UUID	—	Host and above. Issuance always rotates — the previous link fragment and every session it minted stop working. The fragment is shown once; its management token lives 24 hours.
Link fragment	/b	Text	Exactly 43 characters — the part after # in the link	One-time exchange for a 60-minute session scoped to your booking. Malformed or dead fragments all answer the same “This link has already been used, expired, or was replaced by a newer one.”
Email	“Lost your link?” form on /b	Email	At most 254 characters	Required.
Confirmation code	“Lost your link?” form on /b	Text	DG- followed by 8 characters; uppercased server-side	Required. The answer is always “If that email and code match a booking, a fresh link is on its way.” — the code alone never grants access; a match only queues a link to the address already on the booking. The recovery window is 60 minutes.
Reason	Portal cancel form	Text area	At most 500 characters	Optional, on the guest’s own booking page. Hidden booking id and version ride the form; a stale version answers “This booking changed — reload the page and try again.”
“Yes, I am coming”	Portal reconfirm	Button only	—	Version-guarded; appears only when the venue asked for reconfirmation.

Guest profiles, notes & consent

Panel surface (DEV-036); venue staff only. See Guest profiles & notes.

Field	Where	Type/format	Rules & limits	Notes
Venue id	Guest search	UUID	—	Required.
Search text	Guest search	Text	2–120 characters after trim	Matches an exact email (case-insensitive), an exact phone, or a name fragment. Results are redacted by role: service roles see visit counts and note categories, door staff see arrival counts, finance and read-only see identity fields only. Withheld fields are absent, not zero.
Guest profile id	Note form	UUID	—	Required.
Category	Note form	Select	GENERAL, DIETARY, ACCESSIBILITY or ALLERGY	The last three are restricted service data — every read is audited.
Note body	Note form	Text area	1–1000 characters after trim	Required; encrypted at rest.
Reservation id	Note form	UUID	Optional; must be one of this guest’s own visits	Links the note to a visit.
Purpose	Consent form	Select	BOOKING_SERVICE, MARKETING or PRIVACY_RIGHTS_REQUEST	Required. Marketing consent is never granted implicitly by a booking.
Channel / Source / Policy version ref	Consent form	Text	At most 20, 40 and 80 characters	Where, how, and under which policy text.
Granted	Consent form	Text	true or false	Grant or withdrawal. The ledger is append-only — records are never rewritten.
Evidence	Consent form	Text area	At most 2000 characters	Optional attestation; the raw text is hashed, never stored.
Guest profile id / Consumer user id	Consent form	UUID	At least one is required	The subject of the record.

Privacy cases, holds & retention

Panel surface (DEV-037); privacy.case.process (managers and the owner tier). See Privacy, retention & deletion.

Field	Where	Type/format	Rules & limits	Notes
Subject route	Open case	UUID	Exactly one of (venue id + guest profile id) or (consumer user id)	“Exactly one subject route is required…”
Request type	Open case	Select	ACCESS, CORRECTION or DELETION	Required.
Verification method	Open case / verify	Select	account_session, management_token, government_id_reviewed or payment_reference	Optional at intake (the case sits at RECEIVED); required to verify. A matching email alone verifies nothing. The response window is 30 days.
Case id	Verify / delete	UUID	Deletion requires a VERIFIED case	Deletion executes pseudonymization and tombstones — the minimum retained is justified by name.
Resource type	Hold form	Select	GUEST_PROFILE, GUEST_NOTE, RESERVATION, REFUND_INTENT, PAYMENT_ATTEMPT or CONSENT_RECORD	Legal-hold target; arbitrary tables are impossible.
Resource id / Reason / Review date	Hold form	UUID / text / ISO instant	Reason 1–500 characters; review date in the future	A hold is bounded by its review date, never a silent forever-switch. Release is an explicit one-time event.
Country	Retention schedule	Text	2 letters	Scope of the schedule.
Data class	Retention schedule	Select	guest_service_notes, guest_profile_contact or waitlist_contact (defaults 30 days, 24 months, 7 days)	Financial classes are deliberately absent — they are never swept.
Retention days	Retention schedule	Integer	0–36500	The approved schedule length.
Purpose	Retention schedule	Text	1–500 characters	Why the schedule exists.
Checkpoint	Ledger reapply	ISO instant	The restore source instant	Reasserts tombstones executed after the checkpoint before restored data serves anyone.

CSV import

Panel surface (DEV-038); data.import (managers and above). See CSV import. Staging is a dry run — nothing books until commit is its own explicit act.

Stage a dry run

Field	Where	Type/format	Rules & limits	Notes
Venue id / Service id	Stage form	UUID	—	Where the bookings would land.
Source name	Stage form	Text	1–64 characters, one word of letters, digits, dots and dashes (^[A-Za-z0-9][A-Za-z0-9._-]*$)	Required. Names the system the file came from and namespaces rerun detection.
IANA timezone	Stage form	Text	Valid IANA zone	How the file’s local times resolve.
Header mapping (7 fields)	Stage form	Text	Each 1–200 characters; 5 required, 2 optional	Binds each canonical column to a header of your choosing; unmapped columns are ignored. A missing required header answers IMPORT_HEADER_MISSING.
CSV text	Stage form	Text area	UTF-8, at most 10 MB, at most 10,000 rows, header row first	Refusals: too large, wrong encoding, malformed CSV, empty, too many rows.

CSV columns

Column	Required	Format & bounds	Row-level refusals
external_id	Yes	At most 120 characters	Missing id, too long, duplicated within the file, or already imported from the same source — a rerun can never book twice.
date	Yes	YYYY-MM-DD, real calendar date	Missing or invalid date.
time	Yes	HH:MM wall clock in the job timezone	Missing, invalid, a nonexistent daylight-saving time, an ambiguous repeat, a past start, off the published slot grid, a closed day, beyond the horizon, or an unavailable slot.
party_size	Yes	Integer 1–200	Missing or invalid.
display_name	Yes	1–160 characters	Missing or invalid.
email	No	Valid address, at most 254 characters, lowercased	Invalid email.
phone	No	E.164 ^\+[1-9]\d{1,14}$	Invalid phone.

There is deliberately no notes column — imported free-text notes would be sensitive, so notes ride the guest-notes contract instead. Commit takes the venue id and the import job id; it is checkpointed and stable across reruns, and every row books through the same live slot grid as staff intake.

Reports, exports & downloads

Panel surfaces (DEV-038/039/040). Report reads need reporting.read; downloads need exports.download. See Reports & metrics and Service sheet & CSV exports.

Metric report query

Field	Where	Type/format	Rules & limits	Notes
Venue id	Report form	UUID	—	Required.
Service date from / to	Report form	Date	Real YYYY-MM-DD; window at most 366 days	Required. Counts the venue-local business date of each booking — never the UTC moment the row was created.
Settled from / to	Report form	ISO instants	Both bounds or neither	Optional separate window over settlement times, so a report never silently mixes bases.
Currency	Report form	Text	^[A-Z]{3}$	Optional; narrows the money section. Currencies are never summed together.

Exports

Field	Where	Type/format	Rules & limits	Notes
Kind	Export form	Select	Service sheet PDF or operational metrics CSV	Service sheets are PII-bearing: hosts may name the current venue-local service date only, managers and owners any date, finance and read-only never.
Business date (sheets)	Export form	Date	Real YYYY-MM-DD	Required for service sheets.
Service from / to (metrics)	Export form	Date	Real dates, at most 366 days apart	Required pair for metrics exports.
Settled from / to, Currency	Export form	ISO instants / 3 letters	Optional; the settled pair must come as a pair	Same semantics as the report query.
Purpose	Export form	Text	1–200 characters	Required and audited exactly as typed.
Venue id + Export id	Download form	UUID	—	Re-authorizes live membership. Export artifacts expire 24 hours after they are requested; sheets cap at 2000 rows / 100 pages.

The venue bookings CSV export takes the venue id, the kind (FUTURE_BOOKINGS is the only value), a purpose and an optional from-date.

Payments

Panel surfaces (DEV-030…035). In this pilot no production payment provider is configured and the capability gates stay closed, so no charge is ever taken — see Payments (pilot posture).

Field	Where	Type/format	Rules & limits	Notes
Venue id (connect account)	Panel, owner/org-admin	UUID	—	Begins provider-hosted onboarding or refreshes capability truth. Paid intake is recomputed from provider facts: no account, disabled charges, currency mismatch or unapproved country all block.
Booking request key (checkout)	Panel, host and above	Text	1–100 characters — the booking’s own request key	Required. There is no success or paid field anywhere in checkout: a browser return proves nothing, and only provider reconciliation confirms money. The result reports status, an optional hosted URL, the amount, currency and hold expiry.
Raw event body (webhook)	Panel / API	Text	Raw bytes — the signature is verified over the raw body before any parsing	Session-less; a bad signature refuses everything.
Signature header	Panel / API	Text	t=…,v1=… form	Required.
Domain	Panel / API	Select	BOOKING_PAYMENT or SAAS_BILLING (the latter refused in V1)	Required. The parsed event allows only: provider account, event and object ids of 1–160 characters, an event type of 1–100, an optional amount in integer minor units, and an optional 3-letter currency. No status field exists, and unknown fields are not input. A duplicate delivery answers an idempotent DUPLICATE.
Venue id (+ attempt id)	Reconciliation	UUID	—	Outcomes: confirmed, compensation refund, or no effect. Replays apply zero new events.
Amount (minor units)	Refund request	Text	1–15 digits, in the captured payment’s currency — never converted	Finance or manager with fresh two-step verification (within the last 30 minutes). Returning more than remains answers REFUND_EXCEEDS_AVAILABLE.
Reason	Refund request	Text	1–500 characters after trim	Mandatory.
Request key	Refund request	Text	1–100 characters	Idempotent demand.
Refund intent id + Decision + Reason	Refund decision	UUID / select / text	APPROVED or DECLINED; reason 1–300 characters	Owner tier only, and the approver must be someone other than the requester — enforced even for owners. Both rows are immutable evidence.
Threshold (minor units)	Delegation threshold	Text	1–15 digits, or empty	Empty means fail closed: every refund needs owner approval. Below the threshold, managers and finance may execute.

Finance transaction filters take an optional settled-time pair (ISO instants, both or neither) and an optional currency — settlement dates, never service dates. A pending refund outranks every settled fraction in the badge ladder.

Subscription billing

Panel surface (DEV-041); billing.manage for changes, billing.read to view. See Subscription billing.

Field	Where	Type/format	Rules & limits	Notes
Venue id	Trial, stop renewal, view state, reconcile, intake probe	UUID	—	The only input on all five forms. Trials run 30 days with a 7-day grace period; a venue with no subscription row keeps full intake.
Raw event body	Billing ingest	Text	1–65,536 characters	Session-less; the signature is the authorization.
Signature	Billing ingest	Text	1–256 characters	Required. The event schema has no success, paid or status boolean — a browser return carries nothing billing can verify. Event fields: event id and type, occurrence time, and optional venue, provider subscription/customer/price/state, period end and invoice details (amount at most 15 digits, currency, status), each required only for the event types that need them.

When billing stops intake, everything else stays available: existing bookings, guest cancellation, refunds and exports.

Messaging & reminders

Panel surfaces (DEV-028/029); lists need reservations.read, changes need venues.manage. See Messages, confirmations & reminders. In this pilot no email actually sends and SMS is gated, so these fields configure honest intent — the gates still decide at dispatch.

Field	Where	Type/format	Rules & limits	Notes
Venue id	Delivery list / retry / preview	UUID	—	Delivery evidence is masked — full recipient addresses never render.
Job id	Retry form	UUID	—	Only a visibly FAILED message can be retried; anything else answers CONFLICT.
Purpose	Template preview	Select	The 12-value message catalogue (10 email and 2 SMS purposes)	Required. Booking purposes take a reservation id, waitlist purposes take a queue entry id; an optional language tag of 2–35 characters. Previews render from live facts and never send.
SMS switch	Reminder settings	Checkbox	Boolean	Defaults to unchecked. Saving the switch is not activation — country approval, a real provider and quota decide at dispatch.
Two-hour reminder	Reminder settings	Checkbox	Boolean	Defaults to unchecked. The 24-hour reminder is standard; reconfirmation pings are staff-requested and exempt from quiet hours.
Quiet hours start / end	Reminder settings	Text	Wall clock HH:MM, venue-local	Placeholders 22:00 and 08:00. Equal start and end means no quiet window; a due message inside the window is moved to the window’s end and disclosed as such.

Discovery & booking launchers

Panel surface (DEV-045). Published venues only.

Field	Where	Type/format	Rules & limits	Notes
Search text	Directory search	Text	1–100 characters	Optional, PII-free directory search.
City	Directory search	Text	1–120 characters	Optional filter.
Category	Directory search	Text	1–40 characters, lowercase letters, digits, _ or -, starting with a letter or digit	Read from the venue’s own category list; unknown values answer CATEGORY_INVALID.
Page / Page size	Directory search	Integer	1–1000 and 1–50	Defaults to 1 and 20.
Venue slug	Booking launcher / QR	Text	1–96 characters	Required. A malformed slug answers 404, not a validation error — the address either exists publicly or it does not.
Campaign source	Booking launcher	Text	1–64 characters, lowercase letters, digits, _ or -	Optional. A denylist refuses google-partner, google-verified, partner, verified and official-partner — the launcher never makes unsupported claims.

The landing demo

The live demo on the landing page signs you in to a seeded demo venue. See Try the live demo.

Field	Where	Type/format	Rules & limits	Notes
Role (hidden)	Demo role cards	Hidden input	HOST, DOOR, MANAGER or OWNER	Anything else is a validation refusal. Provisioning replaces any current console session — disclosed on the card.

The demo is bound to the fixed demo venue and rate-limited to 10 provisions per client IP per hour; beyond that you see “Too many demo sign-ins from this network — try again later.”

Platform admin tools

Panel surface (DEV-042). Every command here requires an active platform grant and a session verified with a two-step code. See Platform operator console.

Field	Where	Type/format	Rules & limits	Notes
Venue id + Decision + Reason	Publication decision	UUID / select / text	APPROVE or REJECT; reason 1–500 characters, mandatory on every platform action	Trust operator. Approve publishes; reject returns the venue to draft.
Country / Capability / Provider / Currency / Enabled / Evidence ref / Review date	Country capability write	Text / select / boolean	Country 2 letters; capability payment or sms; provider at most 24 characters; currency 3 letters; evidence 1–120 characters and mandatory for every write, disabling included — the row is the gate evidence	Trust operator. A sandbox or unconfigured provider can never back activation in production.
Venue id + Reason (+ Case ref)	Suspend / resume intake	UUID / text	Reason 1–500 characters	Suspending an already-suspended venue is an error. Existing bookings, cancellation, refunds and exports stay available.
Organization id / Venue id / Category / Summary	Open support case	UUID / text	Category 1–40 characters; summary 1–5000 characters	Support, trust, privacy and security roles.
State / Organization id / Limit	Case list	Select / UUID / integer	State OPEN, ESCALATED or RESOLVED; limit 1–100	Optional filters.
Case id + Reason / Outcome	Escalate / resolve	UUID / text	Reason 1–300, outcome 1–500 characters — both mandatory	Case readers only. Case views carry metadata and counts — no guest email, name, note body or booking line ever crosses this boundary.
User id / Role / Active / Reason	Platform role grant	UUID / select / boolean / text	Role is one of the five platform roles; reason 1–300 characters	Security role only.

Operations, quality & launch tools (internal)

Panel surfaces (DEV-046/049/050/051). These are internal operator tools, not product features; they are listed so nothing on them is a surprise. All require platform roles and two-step verification, except where noted.

Backup evidence

Field	Where	Type/format	Rules & limits	Notes
Kind	Evidence form	Select	BASE, WAL or UPLOADS	Defaults to BASE.
Completed at	Evidence form	ISO instant	May trail the clock by at most 5 minutes, never lead it	Optional; defaults to now.
WAL position	Evidence form	Text	^[0-9A-F]{1,8}/[0-9A-F]{1,8}$	BASE records only; a bad position answers WAL_LSN_INVALID.
Location reference	Evidence form	Text	1–300 characters, opaque, off-server	Required — where the backup lives.
Size bytes	Evidence form	Number	At least 0	Optional.

Release suite, risks and assessments

Field	Where	Type/format	Rules & limits	Notes
Environment	Run suite	Select	development, staging or production	Defaults to development; production runs require a valid assessment.
Check ids / Battery filter	Run suite	Arrays	1–40 ids of 1–60 characters; at most 40 test-file paths	Absent ids count as NOT_RUN and block; the battery filter accepts only integration test paths.
Risk fields	Record risk	Text / select	Source ids match `^(AC-F\d{2}-\d{2}	F\d{1,2}
Risk status update	Update risk	Select / text	OPEN, MITIGATED or RESOLVED; resolving requires a resolution note of 1–1000 characters	—
Assessment fields	Record assessment	Select / text / ISO	Kind: penetration test, security review, compliance audit or privacy assessment; status: valid, superseded or withdrawn; evidence 1–300 characters; valid-until must be after assessed-at	—

Workload run

The load harness accepts a label (at most 120 characters) and bounded knobs, each with a default: availability concurrency 1–60 (50), availability rounds 1–5 (3), booking count 1–48 (24), race requests 10–100 (100), first allocations 2–60 (30), arrival racers 2–8 (4), checkout callers 2–6 (3), and per-step budget overrides of 1 ms to 1 hour that may only tighten a budget, never widen it. Empty fields run the declared load.

Launch review

Field	Where	Type/format	Rules & limits	Notes
Label / Environment note	Review form	Text	1–120 and 1–300 characters	Required.
Per-gate decision (8 pinned gates)	Review form	Select	APPROVED or BLOCKED — every gate answered exactly once	Every gate defaults to BLOCKED; approval is explicit, never a form default. An approval requires an evidence reference; a block requires a note and an action. Evidence owner 1–160 characters, reference 1–300.
Country	Review form	Text	2 letters; at most 20 countries, no duplicate country-and-capability pair	Defaults to the pilot country.
Capability checkboxes	Review form	Checkboxes	free-booking, paid-booking, sms; at least one	Free booking starts checked; paid booking and SMS start unchecked — matching the closed gates.

The recorded decision follows the answers: zero blockers records an approved go-live; any blocked free-booking records a block; otherwise the unpaid-pilot posture is what gets recorded.

Display inputs: language, venue time & money

A small set of shared inputs drives rendering rather than forms — you never fill these by hand; they are listed so the shapes are documented. A language request accepts a tag of 1–35 characters but only the reviewed catalogue en, ja and ar is served; anything else falls back to English with a disclosed notice. Venue-time rendering takes a UTC instant, a time zone (1–64 characters) and a language, and discloses daylight-saving gaps and repeats. Wall-time resolution takes an explicit year (1900–2200), month, day, hour and minute. Money rendering takes an amount of 1–18 digits in integer minor units and a 3-letter currency — never a decimal fraction, never converted. Policy-text coverage checks take the per-language map (keys of 1–35 characters, values of 1–5000), the default language and up to 10 supported languages. One screen demonstrates these renderings and its demo arrival form writes nothing.

Fields that do not exist

These are recorded so no documentation (or expectation) invents them:

• No venue profile text editor and no per-language profile editor exist in V1 — the public page is composed from approved data, and per-language text exists only for accepted-terms policies.
• No expiry input on check-in pass issuance — a pass ends with its reservation.
• No area preference rendered on the public waitlist join form (the schema supports it; no form shows it).
• No currency input on the refund request form — the currency comes from the captured payment.
• No file picker for CSV import — the panel takes pasted CSV text; raw uploads are an API concern.
• No QR image for two-step enrollment — the secret is shown as selectable text.
• No status: "paid" or success boolean on any payment or billing input — money truth comes only from provider reconciliation.
• The schedule-only fields (duration bands, per-slot arrival and covers caps, the hard concurrent ceiling) have no rendered inputs — they are accepted in the published weekly JSON only.

If a field rejects your input

Check the field’s row above first — most refusals are a length, format or range you can see in the table. Then:

• The stable error codes and what each one means are listed on Error codes & fixes.
• Scenario-by-scenario recovery steps (“the slug is taken”, “the layout changed since I loaded it”, “my link no longer works”) live on Troubleshooting by scenario.
• For sign-in, two-step and session trouble, see Your account & security.