fix: check invoice amounts against the order's signed terms

lib/data/models/session.dart

@@ -23,6 +23,56 @@ class Session {
   NostrKeyPairs? _adminSharedKey;
   String? disputeId;
 
+  /// The order amount in satoshis as it stood when this session committed to
+  /// the trade, or null when there was no resolved figure to pin.
+  ///
+  /// The settlement checks derive what a payment should be from the node's
+  /// kind-38383 order event and kind-38385 info event, both of which are
+  /// addressable and can be republished after the fact. Pinning the figures
+  /// the user actually agreed to holds the check to those terms rather than
+  /// to whatever the node last said.
+  ///
+  /// Null for a market-price or range order, whose sats figure the node only
+  /// resolves after the take — there is nothing to pin at the moment of
+  /// commitment, and those orders fall back to the live events.
+  late final int? pinnedAmountSats;
+
+  /// The node's fee rate when this session committed, on the same terms as
+  /// [pinnedAmountSats].
+  late final double? pinnedFeeRate;
+
+  /// The currency, fiat figure and premium this session committed to.
+  ///
+  /// The independent market quote is priced from these three, and all three
+  /// live in the same addressable kind-38383 event as the sats amount. Read
+  /// live, they let a node make a shaved settlement quote exactly: resolve
+  /// fewer sats than the trade was agreed at, then republish the premium so
+  /// the quote lands on the shaved figure. Pinned, the quote prices what the
+  /// user accepted.
+  ///
+  /// Null where there was nothing to pin — a session written before pinning
+  /// existed, or an order event that had not arrived at commitment.
+  late final String? pinnedFiatCode;
+  late final int? pinnedFiatAmount;
+  late final double? pinnedPremium;
+
+  /// Whether the terms were pinned when this session committed.
+  ///
+  /// Together with the figures above: all of it is written once, in the
+  /// constructor body, and never moved afterwards. That is what a pin is.
+  ///
+  /// Separates a session that pinned whatever there was to pin — possibly
+  /// nothing, for a market-price order with no resolved sats, or for a
+  /// commitment made before the info event arrived — from one written before
+  /// pinning existed at all. Only the second has any business reading a term
+  /// the node publishes later; for the first, an absent figure means the node
+  /// could not supply it at the moment of agreement, and letting it supply
+  /// one afterwards is the move pinning exists to stop.
+  ///
+  /// False for every session written by an earlier version, which keeps them
+  /// behaving as they did.
+  final bool termsPinned;
+
   /// Transient marker (never persisted): set while a maker-created order is in
   /// the anti-abuse bond limbo, so the shared pay-bond handler skips persisting
   /// the still-uncommitted session. Cleared and persisted on confirmation.
@@ -38,9 +88,37 @@ class Session {
     this.parentOrderId,
     this.role,
     this.disputeId,
+    int? pinnedAmountSats,
+    double? pinnedFeeRate,
+    String? pinnedFiatCode,
+    int? pinnedFiatAmount,
+    double? pinnedPremium,
+    this.termsPinned = false,
     Peer? peer,
     String? adminPubkey,
   }) {
+    // Normalized here rather than at each reader: a figure that cannot anchor
+    // anything is the same as no figure, and the checks that consult these
+    // fields have to agree on which is which.
+    this.pinnedAmountSats =
+        (pinnedAmountSats != null && pinnedAmountSats > 0)
+            ? pinnedAmountSats
+            : null;
+    this.pinnedFeeRate =
+        (pinnedFeeRate != null && pinnedFeeRate >= 0 && pinnedFeeRate.isFinite)
+            ? pinnedFeeRate
+            : null;
+    this.pinnedFiatCode =
+        (pinnedFiatCode != null && pinnedFiatCode.isNotEmpty)
+            ? pinnedFiatCode
+            : null;
+    this.pinnedFiatAmount =
+        (pinnedFiatAmount != null && pinnedFiatAmount > 0)
+            ? pinnedFiatAmount
+            : null;
+    this.pinnedPremium =
+        (pinnedPremium != null && pinnedPremium.isFinite) ? pinnedPremium : null;
+
     _peer = peer;
     if (peer != null) {
       _sharedKey = NostrUtils.computeSharedKey(
@@ -64,6 +142,12 @@ class Session {
         'peer': peer?.publicKey,
         'admin_peer': _adminPubkey,
         'dispute_id': disputeId,
+        'pinned_amount_sats': pinnedAmountSats,
+        'pinned_fee_rate': pinnedFeeRate,
+        'pinned_fiat_code': pinnedFiatCode,
+        'pinned_fiat_amount': pinnedFiatAmount,
+        'pinned_premium': pinnedPremium,
+        'terms_pinned': termsPinned,
       };
 
   factory Session.fromJson(Map<String, dynamic> json) {
@@ -181,6 +265,48 @@ class Session {
         disputeId = disputeIdValue;
       }
 
+      // Absent in sessions written before the terms were pinned, so a missing
+      // or unusable value reads as "nothing was pinned" rather than an error:
+      // those trades fall back to the live events, as they always did.
+      final pinnedAmountValue = json['pinned_amount_sats'];
+      int? pinnedAmountSats;
+      if (pinnedAmountValue is int) {
+        pinnedAmountSats = pinnedAmountValue;
+      } else if (pinnedAmountValue is String) {
+        pinnedAmountSats = int.tryParse(pinnedAmountValue);
+      }
+
+      final termsPinnedValue = json['terms_pinned'];
+      final termsPinned = termsPinnedValue is bool
+          ? termsPinnedValue
+          : termsPinnedValue is String
+              ? termsPinnedValue.toLowerCase() == 'true'
+              : false;
+
+      final pinnedFeeValue = json['pinned_fee_rate'];
+      double? pinnedFeeRate;
+      if (pinnedFeeValue is num) {
+        pinnedFeeRate = pinnedFeeValue.toDouble();
+      } else if (pinnedFeeValue is String) {
+        pinnedFeeRate = double.tryParse(pinnedFeeValue);
+      }
+
+      final pinnedFiatAmountValue = json['pinned_fiat_amount'];
+      int? pinnedFiatAmount;
+      if (pinnedFiatAmountValue is int) {
+        pinnedFiatAmount = pinnedFiatAmountValue;
+      } else if (pinnedFiatAmountValue is String) {
+        pinnedFiatAmount = int.tryParse(pinnedFiatAmountValue);
+      }
+
+      final pinnedPremiumValue = json['pinned_premium'];
+      double? pinnedPremium;
+      if (pinnedPremiumValue is num) {
+        pinnedPremium = pinnedPremiumValue.toDouble();
+      } else if (pinnedPremiumValue is String) {
+        pinnedPremium = double.tryParse(pinnedPremiumValue);
+      }
+
       return Session(
         masterKey: masterKeyValue,
         tradeKey: tradeKeyValue,
@@ -193,6 +319,12 @@ class Session {
         peer: peer,
         adminPubkey: adminPubkey,
         disputeId: disputeId,
+        pinnedAmountSats: pinnedAmountSats,
+        pinnedFeeRate: pinnedFeeRate,
+        pinnedFiatCode: json['pinned_fiat_code']?.toString(),
+        pinnedFiatAmount: pinnedFiatAmount,
+        pinnedPremium: pinnedPremium,
+        termsPinned: termsPinned,
       );
     } catch (e) {
       throw FormatException('Failed to parse Session from JSON: $e');

lib/features/order/notifiers/add_order_notifier.dart

@@ -8,6 +8,7 @@ import 'package:mostro_mobile/features/order/providers/order_notifier_provider.d
 import 'package:mostro_mobile/features/order/models/order_state.dart';
 import 'package:mostro_mobile/services/logger_service.dart';
 import 'package:mostro_mobile/services/mostro_service.dart';
+import 'package:mostro_mobile/features/order/providers/settlement_anchor_provider.dart';
 
 class AddOrderNotifier extends AbstractMostroNotifier {
   late final MostroService mostroService;
@@ -114,9 +115,23 @@ class AddOrderNotifier extends AbstractMostroNotifier {
     // reset runs, and if a restore is in progress we block until it releases.
     await ref.read(sessionLifecycleLockProvider).withSessionLock(() async {
       final sessionNotifier = ref.read(sessionNotifierProvider.notifier);
+      // Pin the terms this order is being created on. The maker's own figure
+      // is the agreement here, so it is the one the settlement is later held
+      // to rather than whatever the node ends up publishing. A market-price
+      // or range order carries no sats amount to pin.
+      // The maker's own figures are the agreement, so they are pinned from
+      // the order being submitted rather than read back off the event the
+      // node publishes for it. A range order carries no single fiat figure
+      // until a taker resolves the band.
+      final isRange = order.maxAmount != null;
       session = await sessionNotifier.newSession(
         requestId: requestId,
         role: order.kind == OrderType.buy ? Role.buyer : Role.seller,
+        pinnedAmountSats: order.amount > 0 ? order.amount : null,
+        pinnedFeeRate: ref.read(nodeFeeRateProvider),
+        pinnedFiatCode: order.fiatCode,
+        pinnedFiatAmount: isRange ? null : order.fiatAmount,
+        pinnedPremium: order.premium.toDouble(),
       );
 
       // Start 10s timeout cleanup timer for create orders

lib/features/order/notifiers/order_notifier.dart

@@ -7,9 +7,11 @@ import 'package:mostro_mobile/features/order/models/order_state.dart';
 import 'package:mostro_mobile/features/notifications/providers/notifications_provider.dart';
 import 'package:mostro_mobile/shared/providers.dart';
 import 'package:mostro_mobile/features/order/notifiers/abstract_mostro_notifier.dart';
+import 'package:mostro_mobile/features/order/providers/settlement_anchor_provider.dart';
 import 'package:mostro_mobile/services/logger_service.dart';
 import 'package:mostro_mobile/services/mostro_service.dart';
 import 'package:mostro_mobile/shared/utils/order_sync_helpers.dart';
+import 'package:mostro_mobile/shared/utils/pricing_terms.dart';
 
 class OrderNotifier extends AbstractMostroNotifier {
   late final MostroService mostroService;
@@ -148,9 +150,21 @@ class OrderNotifier extends AbstractMostroNotifier {
     // restore (TOCTOU-safe). See [SessionLifecycleLock].
     await ref.read(sessionLifecycleLockProvider).withSessionLock(() async {
       final sessionNotifier = ref.read(sessionNotifierProvider.notifier);
+      // Pin the terms being agreed to. Both inputs come from addressable
+      // events the node can republish, so reading them again later would let
+      // it move the figure this trade is checked against after the fact.
+      final pinnedAmountSats = ref.read(publishedOrderAmountProvider(orderId));
+      final pinnedFeeRate = ref.read(nodeFeeRateProvider);
+      final terms = pricingTermsOf(ref.read(eventProvider(orderId)));
+
       session = await sessionNotifier.newSession(
         orderId: orderId,
         role: Role.buyer,
+        pinnedAmountSats: pinnedAmountSats,
+        pinnedFeeRate: pinnedFeeRate,
+        pinnedFiatCode: terms?.fiatCode,
+        pinnedFiatAmount: terms?.fiatAmount,
+        pinnedPremium: terms?.premium,
       );
 
       // Drop any stale grace timer/flag from a previous cycle on this order so
@@ -174,9 +188,21 @@ class OrderNotifier extends AbstractMostroNotifier {
     // restore (TOCTOU-safe). See [SessionLifecycleLock].
     await ref.read(sessionLifecycleLockProvider).withSessionLock(() async {
       final sessionNotifier = ref.read(sessionNotifierProvider.notifier);
+      // Pin the terms being agreed to. Both inputs come from addressable
+      // events the node can republish, so reading them again later would let
+      // it move the figure this trade is checked against after the fact.
+      final pinnedAmountSats = ref.read(publishedOrderAmountProvider(orderId));
+      final pinnedFeeRate = ref.read(nodeFeeRateProvider);
+      final terms = pricingTermsOf(ref.read(eventProvider(orderId)));
+
       session = await sessionNotifier.newSession(
         orderId: orderId,
         role: Role.seller,
+        pinnedAmountSats: pinnedAmountSats,
+        pinnedFeeRate: pinnedFeeRate,
+        pinnedFiatCode: terms?.fiatCode,
+        pinnedFiatAmount: terms?.fiatAmount,
+        pinnedPremium: terms?.premium,
       );
 
       // Drop any stale grace timer/flag from a previous cycle on this order so