Both endpoints are now two lines over CheckinService, which owns the
Frontdesk Manager guard, the ticket lookup and the cancelled/already-in
checks. checkin_ticket no longer calls validate_ticket_for_checkin to
reuse them.

Errors carry their own copy: TicketNotFound (404), TicketCancelled and
AlreadyCheckedIn (409), replacing three generic 417s.

The scanner used to branch on substrings of the serialized error to pick a
toast. That contract is gone — it reads err.messages[0] like the rest of
the dashboard. One of its branches was already dead: nothing throws "not
confirmed and cannot be used for check-in".

Response gains one key: check_in_date is now always present, null before
check-in. The scanner already declared it optional. Everything else is
byte-identical, key order included.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

get_cached_doc already caches, so cached_property only adds a second layer
that can go stale within a request. Plain properties read through the
framework cache each time.

The existence check moves to the constructor, which is where it belongs
now that the property no longer runs it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Doctype controllers carry frappe's auto-generated field types, so the
properties can name them. Imported under TYPE_CHECKING: no runtime import,
so no risk of a cycle through buzz_event.py, which already imports from
buzz.api.forms.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The check-in refactor was only verified in-process: Python tests assert
the model, and payloads were diffed by importing old and new modules side
by side. Nothing exercised HTTP, the browser, or the components that read
the response.

Two things that only break in a browser are now covered: the response keys
TicketDetailsModal renders, and the client-side role gate, which reads the
User.roles child table out of get_user_info.

Seeding needed two new pieces. createUserWithRoles and saveLoginState let a
project run under an identity other than the shared one — check-in demands
Frontdesk Manager, which CI's System Manager user does not have. The
access-denied case gets its own roleless user rather than reusing
Administrator, who holds every role and would never see that screen.

Cleanup runs at the top of the setup, not in afterAll: the spec's context
carries the front-desk session, while the helpers sign writes with the
Administrator CSRF token.

extractTicketId moves out of QRScanner.vue into utils so it can be tested.
Camera capture stays uncovered; this is the only real logic behind it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The check-in assertion raced the request it was meant to observe. It
waited on the "Last Scan Result" panel, which is already on screen from
the preceding validate call, so the Event Check In query ran before
checkin_ticket had landed. CI was slow enough to expose it; locally it
always passed.

confirmCheckIn now waits for the response and for the modal to close,
which is a state only check-in produces.

Retries failed differently — the modal never opened — because the first
attempt had by then consumed the shared ticket, leaving the retry to scan
an already checked-in one. Each test creates its own ticket, so the pair
of check-in tests no longer depend on running in order and a retry starts
clean. The seeded ticket is gone; setup keeps the ticket type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>