Review suggested products before checkout
Customer App can conditionally show a review list of suggested products near a cart or checkout handoff. A displayed suggestion is not a direct cart add, availability guarantee, personalization receipt, or evidence that the current customer was authorized for every input used to produce it.
:::warning Important boundary
Selecting a suggestion opens Product Details for separate review. It does not add the product directly. Do not open a suggestion, return, or continue to Checkout to test whether cart or recommendation state settled.
:::
Suggestion modes are different
| Mode | Candidate source | Important boundary |
|---|---|---|
| Business-product mode | Reads products for the current business and retains suggestion-marked candidates | Business, order type, catalog, inventory, and cart context can change independently |
| Supplied-array mode | A caller passes a product array for local filtering and display | Caller authority, freshness, completeness, and server filtering are not proved |
| Cart-personalized mode | Source is capable of deriving suggestions from a cart/customer/history context | This mode is security-blocked until exact cart ownership and privacy controls are proven |
The current production caller of the cart-personalized mode is not established by the pinned evidence. Do not describe suggestions as based on purchase history, customer similarity, or personal preferences.
Caller and cart context must agree
A suggestion surface can receive business, cart, supplied products, current cart products, navigation callbacks, and checkout callbacks from different callers. Those inputs must all belong to the same authorized account, project, session, business, cart, order type, and revision.
Missing or inconsistent context can produce an error state, an empty list, an unfiltered fallback, a stale product, or a handoff for the wrong cart. A cart or business reference is not authorization to read customer history or infer private interests.
The visible page is review and handoff only
The full-page surface can show current cart contents, a suggested-product list, and actions that continue toward Checkout or return to browsing. Selecting a suggestion opens Product Details with a separate product/customization boundary.
| Visible action | What it can start | What it does not prove |
|---|---|---|
| Suggestion card | Product Details review | Product availability, valid options, or cart mutation |
| Checkout | Single-cart Checkout handoff or a caller-provided continuation | Cart readiness, payment, placement, or order creation |
| Add more products | Return to the prior browsing surface | That suggestion or cart state remained current |
| Back/close | Navigation away from the page | No read, inference, callback, or cart effect |
There is no direct-add action in the pinned visible suggested-product list.
Filtering and fallback boundaries
The source can filter candidates marked for upselling and remove products that already appear in the current cart. Some inventoried repeats are treated differently from other repeats. The UI can also apply another current-cart filter before rendering.
That filtering does not prove current menu availability, inventory, price, options, school/student policy, schedule, serviceability, or that a supplied array was authorized and complete. If a filtered or server result is missing, do not substitute an unreviewed caller array or broader catalog as equivalent.
Loading, empty, and error states are incomplete
The visible list renders only when loading has ended, no controller error is present, and retained candidates exist. The current full-page layout does not provide a dedicated loading, empty, or error explanation for every branch; cart/checkout actions can remain visible even with no suggestions.
| Observed state | Safe interpretation |
|---|---|
| No suggestion rows | Loading, error, empty, filtering, missing context, or no candidates can look similar |
| Cart summary visible first | Current local cart presentation only |
| Checkout button visible | Handoff remains available; suggestion readiness is not proved |
| Page closes after cart becomes empty | Focus/cart effect changed local navigation; no cart-history conclusion follows |
| Error without visible message | Recommendation and caller/cart context remain unresolved |
Absence of a suggestion is not evidence that a customer lacks history or that a product is unavailable.
Redirect and race conditions
A caller-side redirect can open the upselling page as soon as suggestion loading ends, including with an empty supplied array. Other effects react to cart loading, cart-product changes, focus, business context, and suggestion result length. Late or reordered results can therefore navigate, filter, or close a surface against a newer cart.
Every request, redirect, Product Details handoff, Checkout handoff, and empty- cart close must be bound to one current generation. Stale or foreign results must be ignored rather than applied to the new account, project, business, or cart.
Personalization and privacy
Cart contents, customer identity, product interactions, order history, and inferred preferences are private. A safe recommendation service must derive context only from an authorized current cart/customer, minimize history and returned product data, avoid sensitive inference, and provide a clear purpose and retention boundary.
This guide makes no claim that suggestions are personalized, popular, frequently bought, suitable, unbiased, complete, or based on current customer history. Visible copy suggesting what other users often include is not proof of the underlying method or authority.
Unknown outcomes and safe troubleshooting
| Situation | Safe response |
|---|---|
| Suggestions differ after returning | Treat the list and cart as different revisions; do not infer why |
| Product Details shows different availability | Use Product Details only as its current review state; do not assume the suggestion was valid |
| Cart becomes empty or changes | Keep the upselling and Checkout handoffs unresolved |
| No list or error is shown | Do not refresh, reopen, or change the cart to diagnose recommendation state |
| Checkout opens unexpectedly | Treat navigation as a handoff only; do not continue to payment as a test |
| Account, project, business, or cart changed | Reject prior suggestions and callbacks |
Support reports should use only a value-free state class such as “suggestion context unresolved.” Do not include cart contents, customer/history data, product or business details, account/cart/order identifiers, recommendation reasons, links, or private screenshots.
Accessibility
- The page needs explicit loading, empty, error, review-list, Product Details, Checkout, Add more, Back, stale, and unknown state semantics.
- Suggestion cards need accessible product-review intent; they must not be announced as direct Add controls.
- The horizontal list, cart summary, and footer actions need predictable focus order without relying on images, price, color, or position alone.
- At large text sizes, labels and handoff boundaries should reflow without hiding Checkout or return choices. Focus must not jump after late list or cart results.
- Screen-reader, keyboard, switch, safe-area, Back, and reduced-motion behavior require current-platform verification; this guide does not certify them.
Recertification triggers
Revalidate after changes to business-product, supplied-array, or cart- personalized modes; caller parameters; cart ownership; history derivation; candidate filtering; inventory or product details; loading/empty/error states; redirect timing; Product Details/Checkout/Back handoffs; cart-focus cleanup; account/project/session changes; privacy policy; or accessibility primitives.
Also recertify after changes to API deployment authority, authorization, minimization, inference purpose, retention, operation generation, stale-response cleanup, or downstream cart mutation settlement.