Dispensaries & Shopping Agent — Behavior Contract

What this feature is

Dispensaries is the user’s list of the shops they buy from. A user can save a shop by name — with address, phone, website, email, receipt domains and up to five menu URLs — favorite it, edit it, delete it, and open a detail screen showing what they have spent there and every order they have placed there. Shops also appear without being typed: saving an order or importing a Gmail receipt creates the shop automatically. The Shopping Agent is the Pro feature that reads a saved shop’s live menu. From a shop with menu URLs, the user confirms a scan on an explicit consent screen, watches its progress, and lands on a results screen where every product is either matched to a strain in the catalog or offered for research. On top of that menu, a per-shopper pass produces personalized picks from the user’s own favorites, dislikes and stash. The same matching engine backs the Safari extension, which highlights products on real dispensary sites.

How to read the contract

Every case ID below is a live test. Cases built during the feature-test programme carry their ID in the test title, so grep 'DSH-088' finds the assertion. Rows whose coverage predates the programme are cited by ID and file; the test is found by its plain-English name in that file. A few behaviors landed in wave 3 under a defect id rather than a case id — those cite BUG-nnn, which is likewise the literal prefix of the test title.

The behavior contract

Saving a shop

Behavior	Verified by	Tier(s)	Where (file basename)
A shop can be saved with nothing but a name, and every one of its seventeen fields is stored verbatim when supplied.	DSH-001, DSH-002	A	`dispensaries.test.ts`, `dispensaries.featuretests.test.ts`
Only the name is required in the add form, and a field left blank is sent as absent rather than as an empty string.	DSH-056	B	`addDispensary.helpers.test.ts`
The arguments the add form builds are accepted by the deployed validator exactly as built — the form and the backend cannot drift apart.	DSH-057	A	`dispensaries.featuretests.test.ts`
Invalid input is refused with the specific message the user is shown and nothing is written, and the form itself offers only backend-valid states, caps menu URLs at five, and rejects a malformed URL before sending.	DSH-005, DSH-006, DSH-061, DSH-062	A, B	`dispensaries.test.ts`, `dispensaries.featuretests.test.ts`, `dispensaryForm.featuretests.test.ts`
Every one of the twelve public dispensary functions rejects an unauthenticated call.	DSH-007	A	`dispensaries.featuretests.test.ts`

One shop, one identity

Behavior	Verified by	Tier(s)	Where (file basename)
Saving a name that already exists updates that shop instead of creating a second one, and case, surrounding whitespace and compatibility characters all collapse to a single shop.	DSH-003, DSH-004	A	`dispensaries.test.ts`
Punctuation at the edges of a name collapses too — an OCR’d `"SUNNYSIDE."` finds the saved `Sunnyside` — while interior punctuation is preserved, so “Rise & Shine” and “Green Thumb Co-op” stay distinct shops.	BUG-143	A	`dispensaries.featuretests.test.ts`
Re-keying stored identities is a dry-run-by-default migration that reports collisions instead of merging them, and running it twice changes nothing.	BUG-143	A	`dispensaries.featuretests.test.ts`
The identity-finalization gate reports “ready” only for a completed scan over unambiguous rows, and carries a collision found on any page into the final verdict.	DSH-040	A	`dispensaries.test.ts`

Finding a saved shop

Behavior	Verified by	Tier(s)	Where (file basename)
The shop list contains only the signed-in user’s shops and never an archived one, and one person can never read another person’s shops, favorites, stats or search results.	DSH-008, DSH-011	A	`dispensaries.featuretests.test.ts`, `dispensaries.test.ts`
Search matches name, city, address, website, email and saved receipt domains — not just the name — and a limit outside 1–100 is rejected rather than silently clamped.	DSH-010, DSH-012	A	`dispensaries.featuretests.test.ts`
Search examines the user’s whole shop list and stops at the requested number of matches, so a matching shop saved long ago is still findable.	DSH-013	A	`dispensaries.featuretests.test.ts`
Looking a shop up by exact name is scoped to the owner, returns nothing for a blank or unknown name, and deliberately still finds archived shops so a historical order can resolve its shop.	DSH-016, DSH-017	A	`dispensaries.featuretests.test.ts`
The list renders loading, populated and genuinely-empty as three distinct states, and an empty result during the auth handshake is never shown as “no shops”.	DSH-048, DSH-049	B	`Dispensaries.test.tsx`, `useDispensariesSubjectIsolation.test.tsx`
A search that matches nothing shows a no-results message, not the first-run empty state.	DSH-050	B	`Dispensaries.test.tsx`
Favoriting from the list applies immediately and reconciles with the server; a failed toggle reverts and tells the user.	DSH-051, DSH-052	B	`Dispensaries.test.tsx`

Editing, renaming and visiting

Behavior	Verified by	Tier(s)	Where (file basename)
Editing sends only the fields the user actually changed, and an edit with no changes sends no mutation at all.	DSH-058, DSH-059	B	`editDispensary.helpers.test.ts`, `Dispensaries.test.tsx`
Clearing a field in the form clears it on the shop rather than leaving the old value behind.	DSH-060	A	`dispensaries.featuretests.test.ts`
Renaming a shop updates the shop name on every past order in bounded batches however many there are, and a second rename abandons the first so orders never carry a name the shop no longer has.	DSH-021, DSH-022, DSH-023	A	`dispensaries.test.ts`, `dispensaries.featuretests.test.ts`
Renaming a shop onto another saved shop’s name is refused.	DSH-024	A	`dispensaries.test.ts`
Editing or favoriting an archived shop brings it back to the list.	DSH-025, DSH-026	A	`dispensaries.test.ts`
One person can never edit, favorite, delete or record a visit on another person’s shop, and recording a visit increments the count and stamps the time.	DSH-009, DSH-032	A	`dispensaries.featuretests.test.ts`, `dispensaries.test.ts`

Deleting a shop

Behavior	Verified by	Tier(s)	Where (file basename)
Deleting a shop with no orders removes it entirely; deleting one with orders archives it so the order history keeps its shop — and that holds for a shop with thousands of linked orders.	DSH-027, DSH-028, DSH-031	A	`dispensaries.test.ts`, `dispensaries.featuretests.test.ts`
Deleting also un-favorites, so an archived shop cannot reappear in the favorites strip.	DSH-030	A	`dispensaries.featuretests.test.ts`
Re-adding a shop that was archived restores the original row and re-syncs the order names onto it.	DSH-029	A	`dispensaries.test.ts`
The delete confirmation says what will actually happen, and double-tapping it deletes once.	DSH-053, DSH-054	B	`Dispensaries.test.tsx`
A shop that disappears underneath the detail screen bounces the user out, but the user’s own delete does not bounce them mid-animation.	DSH-065	B	`Dispensaries.test.tsx`
Deleting the account purges every saved shop and every stored scan result.	DSH-046	A	`dispensaries.featuretests.test.ts`

Shop detail, spend and order history

Behavior	Verified by	Tier(s)	Where (file basename)
A shop with no orders reports zeroed stats rather than failing, and money totals are rounded to cents.	DSH-018, DSH-019, DSH-020	A	`dispensaries.featuretests.test.ts`, `dispensaries.test.ts`
The order-history screen renders its five states distinctly — loading, empty, populated, loading-more and error.	DSH-067	B	`Dispensaries.test.tsx`
Paging the order history never duplicates a row across pages, asks for more only when more exists, and opening the full history twice in one tap-burst navigates once.	DSH-068, DSH-069	B	`dispensaryOrderHistory.helpers.test.ts`, `Dispensaries.test.tsx`
Directions open in the platform’s own maps app, and the long-press menu offers the same actions on iOS and on the fallback sheet.	DSH-055, DSH-066	B	`Dispensaries.test.tsx`, `dispensaryDetail.helpers.test.ts`

Receipt domains

Behavior	Verified by	Tier(s)	Where (file basename)
Receipt domains are normalized on save, replaceable and clearable, and a malformed domain is rejected on update as well as on create.	DSH-038, DSH-039	A	`dispensaries.test.ts`, `dispensaries.featuretests.test.ts`
A suggested receipt domain is never silently attached — the user has to confirm it, and a confirmed-but-unmerged suggestion either merges on submit or raises an error.	DSH-063, DSH-064	B	`dispensaryForm.helpers.test.ts`
The crowdsourced domain list is cached and fails soft: a failed fetch leaves the form usable rather than blocking it.	DSH-070	B	`dispensaryForm.featuretests.test.ts`
The public domain list is served from the safe RPC and falls back to the seeded list when that RPC errors, rather than returning an error to the app.	DSH-149, DSH-150	B	`index.test.ts`

Shops created for you

Behavior	Verified by	Tier(s)	Where (file basename)
Saving an order with a shop name reuses the existing shop when one matches — including on a case-only difference — and revives an archived one instead of duplicating it.	DSH-033, DSH-034, DSH-041, DSH-042	A	`dispensaries.test.ts`, `orderPostSave.test.ts`
An over-long shop name coming from an order is rejected before anything is written.	DSH-043	A	`dispensaries.featuretests.test.ts`
Two order saves naming the same new shop at the same time produce one shop, not two.	DSH-044	A	`dispensaries.featuretests.test.ts`
A shop created from a Gmail receipt is created with the sender’s domain already attached, so the next receipt from that sender matches it.	DSH-045	A	`dispensaries.featuretests.test.ts`
Auto-creation enriches only the fields the shop is missing — never overwriting what the user typed — and appends a new receipt domain deduped and capped at ten.	DSH-035, DSH-036, DSH-037	A	`dispensaries.featuretests.test.ts`

Behavior	Verified by	Tier(s)	Where (file basename)
The Shopping Agent entry screen separates shops that can be scanned from shops that still need menu URLs, and sends a user with no shops to Add Shop.	DSH-089, DSH-090	B	`ShoppingAgent.test.tsx`
No paid work happens before the user explicitly confirms. Opening the consent screen scans nothing.	DSH-093	B	`ShoppingAgentScanConsent.test.tsx`
Confirmation is single-shot: it produces exactly one normalized request, and remounting the screen never replays it.	DSH-094, DSH-099	B	`ShoppingAgentScanConsent.test.tsx`
Cancelling from the consent screen authorizes nothing.	DSH-098	B	`ShoppingAgentScanConsent.test.tsx`
A guest or free account never even mounts the paid action.	DSH-095	B	`ShoppingAgentScanConsent.test.tsx`
Menu URLs pointing at a different host than the shop, missing parameters, and more than five URLs are each refused with their own screen rather than scanned — and a URL containing a comma survives being passed between screens intact.	DSH-091, DSH-096, DSH-097, DSH-100	B	`ShoppingAgentScanConsent.test.tsx`, `scanConsent.test.ts`, `useShoppingAgent.shared.test.ts`, `useShoppingAgent.featuretests.test.ts`
All three screens in the scan lane — scanner, results and research — are gated behind the same Shopping Agent flag, so no sibling can be reached with the feature off.	BUG-113	B	`routeContracts.test.ts`

Running a scan

Behavior	Verified by	Tier(s)	Where (file basename)
The scan endpoint rejects over-limit and mixed-host URL sets, refuses a caller who names a different user, and refuses the legacy client-supplied trigger switch.	DSH-130, DSH-131	B	`shopping-security.test.ts`
A non-Pro caller is denied before any cache read, claim, meter or task trigger.	DSH-132	B	`shopping-security.test.ts`
A cache hit costs no claim, no meter, no token and no task run, and the task returns the cached menu without scraping anything.	DSH-133, DSH-153	B	`shopping-security.test.ts`, `shopping-menu-scan.featuretests.test.ts`
A second shopper arriving while an identical scan is in flight joins that run with a read-only token and starts no second run.	DSH-134, DSH-171	B, C	`shopping-security.test.ts`, `dispensaries.integration.test.ts`
The task payload carries the server-verified subject and a host derived from the URL, never anything the caller supplied.	DSH-135	B	`shopping-security.test.ts`
A contended claim waits for the winner and joins it, and one that never resolves returns a named pending error rather than hanging.	DSH-137, DSH-138	B	`shopping-routes.featuretests.test.ts`
An unavailable claim store fails with 503 before metering, and a rate-limited request, a trigger failure or a failed source-run registration all release the claim — a failed attempt never wedges the shop for the next shopper.	DSH-136, DSH-139, DSH-140, DSH-141	B	`shopping-security.test.ts`, `shopping-routes.featuretests.test.ts`
A finished run releases its lease and is never re-joined as if in progress: only that run can clear it, an unknown key reports absent, a lease with no run id yet returns a retry, a lease already owned by a successor is left alone, and an unauthenticated completion is refused.	DSH-143, DSH-144	B	`shopping-routes.featuretests.test.ts`
The API and the scan task compute the same cache key from the same real code, and asking for a cached scan that does not exist answers 404 rather than a server error.	DSH-142, DSH-145	B	`shopping-routes.featuretests.test.ts`
The task accepts the five-URL ceiling, rejects internal-network and other SSRF-shaped URLs, passes only unique normalized URLs onward, and re-filters its sitemap fallback through the same guard.	DSH-151, DSH-152, DSH-157	B	`shopping-menu-scan.security.test.ts`, `shopping-menu-scan.featuretests.test.ts`
The task emits every stage in order with progress that only moves forward, and the client’s stage map covers every stage it emits.	DSH-101, DSH-102, DSH-155	B	`useShoppingAgent.featuretests.test.ts`, `shopping-menu-scan.featuretests.test.ts`
A saved scan writes every expected column, the completion callback posts the cache key the API can clear, and a transient failure reporting completion is retried rather than treated as terminal.	DSH-154, DSH-158, DSH-191	B	`shopping-menu-scan.featuretests.test.ts`
A page with no menu yields an empty menu, never an invented one — zero products is reported as “no products”, not as a failure and not as fabricated items.	DSH-156, DSH-172	B, C	`shopping-menu-scan.featuretests.test.ts`, `dispensaries.integration.test.ts`
A missing scraper key fails the run loudly instead of reporting “no products found”, and a very long shop domain does not break the run’s tagging.	DSH-159, DSH-160	B	`shopping-menu-scan.featuretests.test.ts`
A progress stream that closes without a terminal event is reported as a connection error rather than left spinning and never silently reconnects, and a run past fifteen minutes is aborted and reported as an abort, not an error.	DSH-128, DSH-129	B	`runProgressStream.featuretests.test.ts`

Keeping and re-opening a scan’s results

Behavior	Verified by	Tier(s)	Where (file basename)
Results are saved before the user is navigated to them, and nothing private travels through the route.	DSH-103	B	`ShoppingResultRecovery.test.tsx`
A failed save can be retried with identical arguments and never re-runs the scan, while the same attempt id carrying different bytes is refused rather than overwriting.	DSH-071, DSH-072, DSH-104	A, B	`shoppingResults.test.ts`, `ShoppingResultRecovery.test.tsx`
A result can only be stored against a server-created, owned, unexpired, single-use run — a client cannot forge one.	DSH-073, DSH-083, DSH-178	A, C	`shoppingResults.test.ts`, `dispensaries.integration.test.ts`
Registering a source run is idempotent and rejects oversize or non-object bodies; the run is removed at its TTL, removal is idempotent, and a consumed run cannot be revived after expiry.	DSH-084, DSH-085, DSH-086, DSH-087	A	`dispensaries.featuretests.test.ts`
Generated attempt ids always satisfy the storage validator — a short random segment can never collide or be rejected.	DSH-190	A	`dispensaries.featuretests.test.ts`
Storage enforces its quotas without leaving partial rows: at most five active results, a byte ceiling, and a daily write quota whose rejection does not consume the source run.	DSH-074, DSH-075, DSH-177	A, C	`shoppingResults.test.ts`, `dispensaries.integration.test.ts`
Exactly 2 MiB across six chunks is accepted and one byte more is rejected, astral Unicode survives a chunk boundary, out-of-order chunks still reconstruct, and every corruption mode reports a corrupt result rather than partial data.	DSH-077, DSH-078, DSH-079, DSH-080	A	`shoppingResults.test.ts`
A result becomes unreadable at exactly four hours, and cleanup is idempotent.	DSH-081	A	`shoppingResults.test.ts`
One person can never read or delete another person’s result, and owner identity is recorded on both the header and every chunk.	DSH-076, DSH-082	A	`shoppingResults.test.ts`
The results screen renders its five recovery states distinctly, hides the previous owner’s result the instant the signed-in user changes, and handles the expiry boundary and foregrounding after it.	DSH-107, DSH-108, DSH-109	B	`ShoppingResultRecovery.test.tsx`, `shoppingResultRecovery.test.ts`
An oversize result, a quota-exceeded save, and a completed run that produced no output each leave an explained, escapable screen rather than a dead end.	DSH-105, DSH-106, DSH-127	B	`ShoppingAgent.test.tsx`

Behavior	Verified by	Tier(s)	Where (file basename)
A real pipeline payload round-trips through the storage envelope and back onto the results screen unchanged.	DSH-088, DSH-113	A, B	`dispensaries.featuretests.test.ts`, `shoppingAgentTransformer.featuretests.test.ts`
Results are readable whether the pipeline emitted camelCase run output or a snake_case cached menu row.	DSH-110, DSH-111	B	`shoppingAgentTransformer.featuretests.test.ts`
A low-confidence strain match is demoted to unmatched rather than presented as a match.	DSH-112	B	`shoppingAgentTransformer.featuretests.test.ts`
Several matched products that share no strain slug stay separate products instead of collapsing into one.	DSH-114	B	`useMenuProducts.featuretests.test.ts`
The product list dedupes repeated SKUs, sorting and filtering apply to what is actually there, category tabs are derived from this result rather than a fixed list, and empty sections render nothing instead of an empty shell.	DSH-115, DSH-116, DSH-117	B	`useMenuProducts.featuretests.test.ts`, `ShoppingAgent.test.tsx`
Tapping a matched product opens that strain, tapping an unmatched one confirms first and then offers research, and a recommendation with no matched strain is inert rather than navigating somewhere wrong.	DSH-118, DSH-119, DSH-120	B	`ShoppingAgent.test.tsx`
A product’s outbound link opens only `http`/`https`.	DSH-121	B	`productUrl.helpers.test.ts`

Personalized picks

Behavior	Verified by	Tier(s)	Where (file basename)
Menu data is per-domain and cached; personalization is per-user and never shared — the menu is loaded server-side from the stored scan, and a caller cannot submit products as “the menu”.	BUG-110	B	`shopping-routes.featuretests.test.ts`
Personalization requires a verified identity and Pro, and is metered at the last boundary before the model call, so every early return is free.	BUG-110	B	`shopping-routes.featuretests.test.ts`
An account with no history spends nothing and is reported as having nothing to personalize from rather than as still loading, and every list sent is bounded so a large account cannot send an unbounded prompt.	BUG-110	B	`shopping-routes.featuretests.test.ts`, `shoppingPersonalization.helpers.test.ts`
The prompt contains only the sections the shopper actually has and never invents a purchase date or a nameless stash line; an empty menu short-circuits without a model call; and a provider failure surfaces as a failure instead of as an empty set of picks.	BUG-110	B	`recommendations.test.ts`, `shoppingPersonalization.helpers.test.ts`, `shopping-routes.featuretests.test.ts`
A cache hit and a fresh scan reach personalization by the identical path, and a request that expires, is rate-limited or fails degrades to an unpersonalized results screen rather than an error screen.	BUG-081, BUG-110	B	`shoppingPersonalization.request.test.ts`, `shopping-routes.featuretests.test.ts`

Researching unmatched products

Behavior	Verified by	Tier(s)	Where (file basename)
“Research All” and “Select All” both respect the five-strain ceiling, and queueing confirms on success while leaving the screen in place on failure so nothing is lost.	DSH-122, DSH-123, DSH-124	B	`ShoppingAgent.test.tsx`
Selection dedupes names case-insensitively, while two genuinely different products with the same name stay separately selectable.	DSH-125, DSH-126	B	`discoverySelection.helpers.test.ts`

The Safari extension

Behavior	Verified by	Tier(s)	Where (file basename)
Product matching runs three tiers with a bounded fuzzy fallback, so a near-miss name still matches and a wild one does not.	DSH-147	B	`shopping-extension.test.ts`
The match endpoint is reachable only when its feature flag is on, and its per-IP rate limit refuses excess requests with a retry hint carried in both the body and the response header, which must agree.	DSH-146, DSH-148, BUG-155	B	`shopping-routes.featuretests.test.ts`
The extension’s sync lists contain only the signed-in user’s own strains.	DSH-184	C	`dispensaries.integration.test.ts`

What the live tier proves end-to-end

Tier C signs in as a real, disposable +clerk_test identity, drives the deployed staging Convex deployment and the production Hono API, and deletes everything it creates. The free lane spends nothing; the paid lane is opt-in.

The whole saved-shop lifecycle works on the deployed backend — create, read, favorite, edit, rename, archive-on-delete and re-add (DSH-161, DSH-164).
The deployed validators reject exactly what the client rejects, and duplicate prevention behaves on a real deployment as it does in memory (DSH-162, DSH-163).
One deployed identity cannot touch another’s shops, and the Revyl launch-smoke fixture seeds idempotently on staging (DSH-165, DSH-166).
The scan endpoint’s gates are real: an absent or unverified Clerk token is refused, and a free identity is stopped at the entitlement gate before any credit is spent — measured with a deliberately invalid body so the status names the gate reached (DSH-168, DSH-167).
A scan result’s storage lifecycle holds on the deployed backend — create, read, delete, the active-result quota, and a source-run binding that cannot be forged (DSH-176, DSH-177, DSH-178).
A real cold scan of a known-good menu completes and decodes on the results screen, a second identical scan is served from cache, two concurrent identical scans collapse into one run, a menu with no products yields an empty menu, and a failing scan surfaces an error and releases its lease (DSH-169, DSH-170, DSH-171, DSH-172, DSH-175).
Queueing discovery research reaches the real research pipeline (DSH-179), and a Gmail receipt really does create the shop it came from (DSH-181).

Deliberate gaps & conditions

The paid lane is opt-in and skipped by default. DSH-169–172, DSH-175 and DSH-179 each spend Firecrawl credits or real research runs and take minutes; they run only when TIER_C_PAID is set deliberately. A default Tier C run reports them as skipped, which is not evidence they pass.
Which gate the deployed API stops a Tier C identity at is probed, not pinned. That is a deployment fact that has already moved once — first the auth-realm split, then the subscription gate flipping from bypass to enforce — so DSH-167 measures it and reports it rather than asserting a status a config change would falsify.
Age-gated dispensary sites are not scanned in CI. DSH-173 and DSH-174 are deferred: they depend on a live third party, are non-deterministic, and the interactive scraping mode is materially more expensive.
/extension/match is not exercised on staging. DSH-183 would require flipping a feature flag on a deployment shared with every other suite, so the endpoint is proven at Tier B only.
Two behaviors are contracted here but proven in the Orders and Gmail suites to avoid asserting the same rule against two copies of it: order-driven shop auto-creation on staging (DSH-180 → ORD-205) and the live email-domain endpoint (DSH-182 → GML-226).
Two P3 rows are deliberately unbuilt: an over-long search query (DSH-014, one validator string) and “data export includes dispensaries” (DSH-047, already covered structurally by the export-policy test EXP-001).
The Shopping Agent is still flag-gated off in production builds. Everything above is proven, but the feature is reachable today only in development and on staging — which is why the live tier is the only place the end-to-end decode is observed.
The stored-result delete path has no UI. It is contracted and tested (DSH-076, DSH-176) but nothing in the app calls it; results expire instead.
Tier C skips cleanly without credentials, naming exactly what is missing, and is never part of pnpm test, pnpm check, or a cached Turbo run.

Where to extend

A new saved-shop or scan-storage rule gets its Tier A case in apps/mobile/convex/tests/dispensaries.featuretests.test.ts. A new form, hook or screen-state rule goes in the co-located *.featuretests.test.ts next to its helper (dispensaryForm, useShoppingAgent, shoppingAgentTransformer, useMenuProducts) or in apps/mobile/test/ui/features/Dispensaries.test.tsx / ShoppingAgent.test.tsx for rendering; API and pipeline rules go in apps/api/src/routes/shopping/__tests__/shopping-routes.featuretests.test.ts or packages/trigger/src/tasks/shopping-menu-scan.featuretests.test.ts. Reach for apps/mobile/test/integration/suites/dispensaries.integration.test.ts only when the claim is about the deployed backend — and put anything that spends money behind the paid-lane gate. Then add the row to the master matrix; see Mobile Feature Test Platform for naming, tags, and the tier decision.

Product Strategy

Roadmap

Testing & Quality

Notebooks

Core Features

AI & Media

Growth & Social

Personalization

Infrastructure & Costs

Pricing & Strategy

Dispensaries & Shopping Agent — Behavior Contract

What this feature is

How to read the contract

The behavior contract

Saving a shop

One shop, one identity

Finding a saved shop

Editing, renaming and visiting

Deleting a shop

Shop detail, spend and order history

Receipt domains

Shops created for you

Running a scan

Keeping and re-opening a scan’s results

Reading the menu

Personalized picks

Researching unmatched products

The Safari extension

What the live tier proves end-to-end

Deliberate gaps & conditions

Where to extend

​What this feature is

​How to read the contract

​The behavior contract

​Saving a shop

​One shop, one identity

​Finding a saved shop

​Editing, renaming and visiting

​Deleting a shop

​Shop detail, spend and order history

​Receipt domains

​Shops created for you

​Starting a scan — the consent boundary

​Running a scan

​Keeping and re-opening a scan’s results

​Reading the menu

​Personalized picks

​Researching unmatched products

​The Safari extension

​What the live tier proves end-to-end

​Deliberate gaps & conditions

​Where to extend

What this feature is

How to read the contract

The behavior contract

Saving a shop

One shop, one identity

Finding a saved shop

Editing, renaming and visiting

Deleting a shop

Shop detail, spend and order history

Receipt domains

Shops created for you

Starting a scan — the consent boundary

Running a scan

Keeping and re-opening a scan’s results

Reading the menu

Personalized picks

Researching unmatched products

The Safari extension

What the live tier proves end-to-end

Deliberate gaps & conditions

Where to extend