Host guide

A host runs the floor. You take phone and walk-in bookings, record arrivals, seat parties and clear tables, work the same-day waitlist and keep the guest notes the service team relies on. The role is granted per venue — you hold it for the venues you were invited to and nothing else.

How you get the role

An owner, org admin or manager of the venue invites you by email (Organizations, teams & invitations). A manager can grant only HOST, DOOR and READ_ONLY; anything above that needs the ownership tier. Re-assigning your role replaces your single membership row — it never duplicates — and the change takes effect on your next request, because the server re-reads live membership on every call. Want to try the role first? The live demo has a Host card that signs you into a seeded demo venue instantly.

Sign-in and first screen

Sign in at /app/login with email and password; if the account has two-step verification, a 6-digit code (or a recovery code) is asked on top. You land on Your venues at /app, one card per venue you belong to — each showing your role and the venue’s publication status — and follow Today’s service → into the venue.

The Today board

The venue board is your home for the shift: the day’s Bookings list (venue-local start time, guest, party size, status, confirmation code, tables and the running “Arrived x/y” count) and Floor right now with every seated table and its state. The board refreshes itself every 15 seconds while the page is visible. Times are always the venue’s own — the header names the business date and time zone.

Booking a walk-in or phone party

Add booking opens the intake form: pick the service and party size, press Show slots, choose a time and press Book the walk-in. Slots that are inside the booking-notice window are tagged “short notice” — a guest standing in front of you satisfies the notice rule online booking cannot. Email is optional: a walk-in without an email stays an honest anonymous booking, nothing is invented. Full walkthrough: Walk-ins & staff intake.

Reservation detail

Open any booking from the board to act on it. Each action is its own form, and buttons disable while submitting:

• Record arrival — enter “Guests at the door” (partial arrivals are normal; record 3 of 6 now and the rest later).
• Seat the party — “Seat at planned tables” once the party is in.
• Complete & clear — “Record departure, release tables”.
• Cancel reservation — requires a reason, and quotes the cancellation terms the booking was made under.
• No-show — “Available after the service grace window”.

If the booking changed under you, the form answers “Stale form — reload the page.” The floor mechanics are documented in Arrivals, seating & visits.

The operator panels

The task surfaces at /app/panels are the internal operator forms — the same server commands, exposed as plain forms:

• Arrivals / seating / clear — the same three actions with request keys for idempotent retries. Corrections to an arrival count are manager-only; a host’s submit is refused with PERMISSION_DENIED.
• Service view / walk-in / move table — the whole day on one screen with revision-based auto-refresh, and Move party to move a booking to other tables (an approved combination is named, not chosen ad hoc).
• Check-in passes / scanner — press Issue pass for a confirmed booking. A pass rotates: issuing a new one kills the previous, so only the latest pass is live. Passes scan from 60 minutes before the booked start until the planned end, judged against the live booking — if the booking was rescheduled beyond that window, print a fresh pass. The pass secret is shown once and never logged.
• Queue / ready offer — the waitlist: Offer table (5-minute hold), Accept an offer (a filled guest queue secret always wins over staff acceptance), Withdraw offer, Sweep expired offers. A duplicate contact answers “This contact is already in the queue for today.” See Waitlist.
• Guest links and portal — Issue link mints the guest’s management link; the fragment is shown exactly once and issuing again rotates it, killing the old link and every session it opened.

Guest notes you can trust

Host search in Guest notes, tags and history shows note categories (such as ALLERGY or DIETARY) and tags — never note bodies. Adding a note (categories GENERAL, DIETARY, ACCESSIBILITY, ALLERGY; up to 1000 characters) is host work; bodies are encrypted at rest and audited by field name only. Recording consent evidence is append-only and never grants marketing consent implicitly. Details: Guest profiles & notes.

Messages and the service sheet

• Message evidence lists delivery outcomes per venue with masked recipients; retrying a failed message and previewing a template are manager acts. During the pilot no email actually sends — jobs dead-letter visibly with PROVIDER_NOT_CONFIGURED, which you will see as FAILED outcomes. See Messages, confirmations & reminders.
• Service sheet — you can queue the printable floor sheet (guest names and decrypted notes) for the current venue-local service date only; the bound is re-checked again at download. Treat it as the private document it is. See Service sheet & CSV exports.

What a host cannot do

Every one of these refuses with PERMISSION_DENIED (403):

• Decide requests. Approving or declining request-mode bookings is a manager-and-up act (reservations.approve) — see Request-approval bookings.
• Correct a recorded arrival. Changing an arrived count after the fact needs checkin.correct, which hosts do not hold.
• See money. Payment status, finance transaction ledgers and refund tools refuse host sessions outright — Refunds belongs to finance and above.
• Move guest data in bulk. CSV import and venue-wide export need manager authority (CSV import).
• Run privacy cases. Opening, verifying or executing a privacy case is manager-and-up (Privacy, retention & deletion).
• Manage the venue or the team. No venue settings, floor-plan editing, schedule or policy publishing, staff invitations, reminder settings or publication requests.
• Run reports. Aggregate reports refuse hosts — the service sheet is your export (Reports & metrics).

A venue you are not a member of does not answer “no permission” — it reads as a plain 404, exactly like a venue that does not exist.