feat(shift): site-wide single-open shift + booth money-path gate

A shift becomes a SITE-WIDE accountability period — at most one open at a
time — so every taking is unambiguously attributed to one operator. Login
stays decoupled from shifts (an operator can log in off-shift to review).

Backend:
- ShiftService.currentOpenShift()/requireOpenShift(); open() refuses when ANY
  shift is open and throws ShiftAlreadyOpenError{heldBy} (self vs. other).
- requireShift preHandler gates /api/pay, /api/exit, /api/voucher,
  /api/barrier/reopen → 409 {code:"no_shift"}; read-only lookups stay open.
- GET /api/shift/current returns site-wide {open:{startedAt,operator},isMine}.
- GET /api/events?since=<iso> for per-shift log scoping (db: re-export gte).

Frontend:
- Header shift button: open / close-mine / disabled-when-another-holds-it.
- Pay/exit modal gate banner (one-click open; "held by X" when another's);
  pay/exit/voucher disabled until this operator's shift is open.
- Active-Sessions barrier re-open gated the same way.
- Live feed scoped to the open shift's window; shared useShift() Query
  invalidated over the WS on shift_open/shift_z_report/cash_movement.
- sq/en strings for the control + gate.

Wiki: shift.md (site-wide single-open + gate; superseded per-operator note),
booth-console.md (header control + gate), log entry.

Verified: site-wide invariant + heldBy + handover + chain integrity on a
fresh migrated DB (11/11); db/server/web build clean.

wiki/concepts/booth-console.md

@@ -63,6 +63,26 @@ a right column with the **live event ticker**. Submitting/clicking a ticket open
 modal** (entry/duration/total, tender, voucher checkbox, entry/exit snapshots). All live-refreshed via
 the WS.
 
+## The shift control (header) + the booth gate
+
+The header carries a single **shift button** that expresses the [[shift|site-wide single-open
+shift]] (added 2026-06-18):
+
+- **No shift open** → "Open shift" (green, enabled).
+- **My shift open** → "Close shift" (red, enabled — signs + prints the Z-report).
+- **Another operator's shift open** → **disabled**, titled with who holds it. You can neither open
+  yours nor close theirs until they hand over.
+
+State comes from one shared Query (`useShift()` → `GET /api/shift/current`, returning `{ open:
+{startedAt, operator} | null, isMine }`); the WS invalidates it on `shift_open` / `shift_z_report` /
+`cash_movement`, so the button (and the per-shift log scope) update live without polling.
+
+The **booth screen gates on this**: the pay/exit modal shows an "open a shift" banner (with a
+one-click *Open shift now*) and disables pay/exit/voucher until **this operator's** shift is open;
+the Active-Sessions "Open barrier" is disabled the same way. The server enforces it regardless
+(`requireShift` 409 `no_shift`) — the UI just front-runs the rejection. The live feed is **scoped to
+the open shift's window** (empty when no shift is open). See [[shift]] for the rule and the routes.
+
 ## Dev notes
 - Vite proxies `/api/ws` (`ws: true`) to the backend; the backend's Origin allowlist must include the
   dev SPA origin (`WS_ALLOWED_ORIGINS=http://localhost:5173`). In production Fastify serves the SPA

wiki/concepts/shift.md

@@ -2,7 +2,7 @@
 type: concept
 tags: [parking, domain, business, shifts, anti-fraud]
 sources: []
-updated: 2026-06-15
+updated: 2026-06-18
 status: open
 ---
 
@@ -21,6 +21,29 @@ is **no operator and no shift**; what replaces it is the pay station's **cash-co
 [[reconciliation]] — a separate concept, not a shift. So shifts are scoped to manned operation;
 don't force one model across both.
 
+## Site-wide single-open + the booth gate (decided + built 2026-06-18)
+
+A shift is a **site-wide accountability period**: at most **one shift may be open at a time** across
+the whole appliance. This is what makes a taking unambiguously attributable — every payment/exit
+falls inside exactly one operator's window. Consequences:
+
+- **Login ≠ shift.** An operator may log in **off-shift** (e.g. to review their own past activity);
+  logging in never opens a shift. Conversely a shift can't be opened by two people at once.
+- **Opening is refused when ANY shift is open** — whether the operator's own (double-open) or
+  *another* operator's (handover not done). `ShiftService.open()` checks `currentOpenShift()` (the
+  single site-wide open shift = most recent shift event on the whole chain is a `shift_open`), and
+  throws `ShiftAlreadyOpenError` carrying `heldBy` so the UI can name who holds it. Operator B can
+  only start once operator A closes — that's the handover.
+- **The booth money path is GATED on an open shift.** `/api/pay`, `/api/exit`, `/api/voucher`,
+  `/api/barrier/reopen` run a `requireShift` preHandler that 409s `{ code: "no_shift" }` when none
+  is open. Read-only lookups (`/api/session/:id`, `/api/sessions/active`, `/api/pay/quote`) stay
+  ungated so the modal can still *display* a session and prompt "open a shift". The server is the
+  enforcement point; the UI mirrors it (see [[booth-console]]).
+- **"Operate under someone else's shift" is deliberately disallowed.** B's takings would land in A's
+  Z-report and corrupt the attribution, so B is fully blocked until B's own shift is open.
+- **Logs are per-shift.** The booth live feed shows only events from the open shift's window
+  (`GET /api/events?since=<shiftStart>`); no shift open → no feed, just the "open a shift" prompt.
+
 ## A shift is NOT time-based
 
 It is delimited by **explicit operator action**, never by a clock:
@@ -56,8 +79,10 @@ no variance gate, no manager override.
 
 - A shift is **two signed ledger events**, no mutable table (decision): `shift_open` (new event
   type) at start, `shift_z_report` at close. The operator is the **logged-in user**, carried in the
-  event `identity`; a shift is **open** iff that operator's most recent shift event is a
-  `shift_open`. `ShiftService` (`apps/server/src/shift-service.ts`).
+  event `identity`. `ShiftService` (`apps/server/src/shift-service.ts`).
+  > **Superseded 2026-06-18:** open-ness is now judged **site-wide** (`currentOpenShift()` — the most
+  > recent shift event on the *whole* chain), not per-operator. See "Site-wide single-open" above.
+  > `openShiftFor(operator)` survives only for `close()` (you close your own shift).
 - **Close** sums `payment` events in `[startedAt, endedAt]` by tender (cash vs. card, by **payment
   time**), appends the signed `shift_z_report` (totals + counts + window), then **prints** via the
   new generic `PrinterDevice.printReport(title, lines)` (Rongta ESC/POS text) to a booth-receipt

wiki/log.md

@@ -796,3 +796,7 @@ Two languages via react-i18next, Albanian default/fallback. Language is a per-us
 ## [2026-06-18] lint | Reconcile wiki with the session's work
 
 Audited wiki vs. the session: three major builds (live WebSocket, frontend foundation, i18n) had NO log entry and NO concept page. Filed [[i18n]] (resolved a dangling code-comment link) and [[booth-console]] (operator-UI architecture: stack, /api/ws live feed, anti-CSWSH, booth screen). Updated stale [[react-vite-spa]] (the "plain React, no framework" claim is now qualified). Backfilled the three missing build log entries. Standing gaps flagged across pages: NO automated tests (front or back); ATECC608 not yet wired (software-HMAC signing is tamper-evident, not tamper-proof); pre-existing admin screens not on the terminal theme.
+
+## [2026-06-18] ingest | Shift gating — site-wide single-open, booth money-path gate, per-shift logs
+
+Built the shift-enforcement model. A shift is now **site-wide single-open** (was per-operator): `ShiftService.currentOpenShift()` reads the most recent shift event on the whole chain; `open()` refuses if ANY shift is open and throws `ShiftAlreadyOpenError{heldBy}`. Login stays decoupled from shifts (operator can log in off-shift to review). The booth money path is **gated**: `/api/pay`, `/api/exit`, `/api/voucher`, `/api/barrier/reopen` get a `requireShift` preHandler → 409 `{code:"no_shift"}`; read-only lookups stay open so the modal can display + prompt. `GET /api/shift/current` now returns the site-wide `{open:{startedAt,operator},isMine}`. Logs are **per-shift** via `GET /api/events?since=<shiftStart>`. UI: header shift button (open / close-mine / disabled-when-other), pay-modal gate banner with one-click open, gated Active-Sessions re-open, shift-scoped live feed; shared `useShift()` Query invalidated by the WS on shift/cash events. Updated [[shift]] (new "Site-wide single-open + booth gate" section; superseded the per-operator as-built note) and [[booth-console]] (header control + gate). Verified the invariant + chain integrity on a fresh migrated DB (11/11 assertions). Builds clean across db/server/web.