pos changes

lib/presentation/pos/providers/cart_controller.dart

@@ -208,10 +208,19 @@ class CartController extends StateNotifier<Cart> {
     setQuantity(productId, line.quantity + by);
   }
 
+  /// Steps a line down, never off the bill.
+  ///
+  /// Floors at one deliberately. Taking the last unit away is a removal, and
+  /// removals go through the PIN gate on the close button — a stepper that
+  /// quietly reached zero was a way around it.
   void decrement(String productId, {double by = 1}) {
     final line = state.lineFor(productId);
     if (line == null) return;
-    setQuantity(productId, line.quantity - by);
+
+    final next = line.quantity - by;
+    if (next < 1) return;
+
+    setQuantity(productId, next);
   }
 
   void removeLine(String productId) {

lib/presentation/pos/providers/navigation_provider.dart

@@ -1,6 +1,8 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
+import '../../auth/providers/auth_controller.dart';
+
 /// The modules a cashier needs. Deliberately excludes analytics — this
 /// terminal is for billing, not back-office reporting.
 enum PosModule {
@@ -41,4 +43,37 @@ enum NavSection {
       PosModule.values.where((m) => m.section == this).toList();
 }
 
+/// What a cashier session may open.
+///
+/// Billing, and nothing else — not the catalogue, the promos, the sync log or
+/// the terminal's configuration. The sidebar is hidden in cashier mode anyway,
+/// so this is the belt to that braces: a module reached some other way (a scan
+/// handler, a deep link, a stale value left in [activeModuleProvider] from the
+/// admin's session) still cannot render.
+const cashierModules = <PosModule>[PosModule.pos];
+
 final activeModuleProvider = StateProvider<PosModule>((ref) => PosModule.pos);
+
+/// The modules the current session is allowed to reach.
+final visibleModulesProvider = Provider<List<PosModule>>((ref) {
+  return ref.watch(isCashierModeProvider) ? cashierModules : PosModule.values;
+});
+
+/// [activeModuleProvider], clamped to what this session may open.
+///
+/// Read this rather than the raw value anywhere a module decides what gets
+/// built. An admin who leaves the shell on Settings and hands the till to a
+/// cashier would otherwise reopen it on Settings.
+final resolvedModuleProvider = Provider<PosModule>((ref) {
+  final active = ref.watch(activeModuleProvider);
+  final visible = ref.watch(visibleModulesProvider);
+  return visible.contains(active) ? active : PosModule.pos;
+});
+
+/// Sections that still have at least one module this session may open.
+final visibleSectionsProvider = Provider<List<NavSection>>((ref) {
+  final visible = ref.watch(visibleModulesProvider);
+  return NavSection.values
+      .where((s) => s.modules.any(visible.contains))
+      .toList();
+});