# Requirement change

Restaurants let us down. They run out of paneer, the fryer dies, the chef doesn't turn up. At the
moment the only way an order ever stops is the customer cancelling it, and we deliberately shut that
door the moment cooking starts — so right now, when the kitchen can't finish an order, our support
staff have no button at all. They have been cancelling on the customer's behalf, and now our refund
report can't tell "they changed their mind" from "we let them down". That has to stop.

So: **the restaurant can now say no**, and an order it says no to ends up somewhere of its own.

- **It is not a cancellation.** It is a new stage of its own, so that anyone reading an order can
  tell the two apart at a glance. An order that stopped this way has stopped for good — it goes
  nowhere afterwards.
- **The restaurant can say no later than the customer can.** The customer's window shuts when
  cooking starts; the restaurant's stays open right through cooking, because that is exactly when
  they find out they can't finish. It shuts the moment the bag is with the rider — once the food is
  on its way, this is a delivery problem and not a kitchen one.
- **It cannot happen twice**, and it cannot happen to an order that is already finished one way or
  the other. Asking again is an error, not a no-op — the same way cancelling twice is.
- **Charge nothing.** Same as a cancellation: the customer pays nothing. And the same as a
  cancellation, the receipt must still show what the food and the delivery *would* have cost,
  because support gets asked "what was it worth?" and finance gets asked "what did we write off?".
- **Tell the customer and tell the restaurant**, customer first, like everything else. The
  restaurant's own tablet has to stop showing a ticket nobody is going to cook.
- **We need to see where it went wrong.** When support opens one of these, the first question is
  always "how far had it got?" — had the restaurant even accepted it, or was it halfway through
  cooking? So whatever you keep about an order's life has to still answer that afterwards.
- Everything else is unchanged: it is timestamped like any other stage, a refusal notifies nobody
  and leaves no trace, and a notification channel falling over still doesn't undo anything.
