New COD orders
After a valid order commits, Vacto queues the opted-in Order received and COD confirmation jobs. Provider failure never rolls back the order. The message shows the order, totals, delivery summary, and Cash on delivery wording plus Confirm order and Request cancellation actions.
Seller confirmation policy
- Safe default: customer intent becomes Customer confirmed while the seller retains operational control.
- Optional: validated confirmation may move the order to Confirmed or Preparing.
- Always review: route the customer response to Seller review required.
- Cancellation safe default: seller review.
- Optional automatic cancellation applies only before preparation; Preparing, Shipped, Out for delivery, Delivered, and Returned are never auto-cancelled by the customer action.
Action security
- Email URLs carry only a cryptographically random token; the database stores its hash, store/order/action/channel scope, expected contact hash, expiry, use, and revocation.
- WhatsApp buttons carry a signed-event interactive payload tied to the expected customer contact and outbound context.
- Actions are idempotent and revoke incompatible pending actions.
- No predictable order ID or PII grants authority, and free text does not transition the order.
Online-paid orders
Payment confirmed is queued only after the authoritative server settlement service verifies and commits the provider result. Browser return values, a pending/inquiry-unverified response, a customer click, or a WhatsApp message can never set payment truth. Provider/webhook replay uses the settlement reference and communication idempotency key, producing one notification.
Status updates and cancellation
Confirmed, Preparing, Shipped, Out for delivery, Delivered, and Cancelled events map to separate opted-in rules. A validated cancellation request is recorded immediately; seller-approved or safe automatic cancellation calls the canonical compare-and-set/inventory service so stock restores once.