fix: check invoice amounts against the order's signed terms

lib/features/order/providers/settlement_anchor_provider.dart

@@ -0,0 +1,82 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:mostro_mobile/data/models/nostr_event.dart';
+import 'package:mostro_mobile/features/mostro/mostro_instance.dart';
+import 'package:mostro_mobile/services/logger_service.dart';
+import 'package:mostro_mobile/shared/providers/order_repository_provider.dart';
+import 'package:mostro_mobile/shared/utils/settlement_amounts.dart';
+
+/// The order amount the node has published for [orderId], in satoshis.
+///
+/// Read off the kind-38383 order event rather than the direct message that
+/// asks for the payment. Both come from the node, but only one of them is the
+/// order the user chose: the event is addressable and public, and it is what
+/// the take screen showed. A market-price order carries no amount until it is
+/// taken, and the node republishes the event with the resolved figure as part
+/// of that flow, so by the time either side is asked to act the amount is
+/// there.
+///
+/// Null when no event has arrived, or when it carries no usable amount.
+final signedOrderAmountProvider = Provider.family<int?, String>((ref, orderId) {
+  final event = ref.watch(eventProvider(orderId));
+  if (event == null) return null;
+
+  final amount = int.tryParse(event.amount ?? '');
+  if (amount == null || amount <= 0) return null;
+  return amount;
+});
+
+/// The node's fee rate, from its kind-38385 info event.
+///
+/// Null when the info event has not arrived or does not carry the tag. The
+/// getter parses eagerly and throws on a missing tag, which is fine for the
+/// About screen it was written for and not for a payment check.
+final nodeFeeRateProvider = Provider<double?>((ref) {
+  final info = ref.read(orderRepositoryProvider).mostroInstance;
+  if (info == null) return null;
+  try {
+    return info.fee;
+  } catch (e) {
+    logger.w('Node info event carries no usable fee rate: $e');
+    return null;
+  }
+});
+
+/// What the seller's hold invoice for [orderId] should ask for, derived from
+/// the signed order amount and the signed fee rate.
+///
+/// Null when either input is missing. A caller that gets null has not learned
+/// that the payment is wrong — only that it cannot re-derive what it should
+/// be, and should fall back to the weaker check it can still make.
+final anchoredSellerAmountProvider =
+    Provider.family<int?, String>((ref, orderId) {
+  final amountSats = ref.watch(signedOrderAmountProvider(orderId));
+  final feeRate = ref.watch(nodeFeeRateProvider);
+  if (amountSats == null || feeRate == null) return null;
+
+  return SettlementAmounts.sellerPays(
+    amountSats: amountSats,
+    feeRate: feeRate,
+  );
+});
+
+/// What the buyer's payout invoice for [orderId] should ask for, derived from
+/// the signed order amount and the signed fee rate.
+///
+/// The figure is the order amount less the buyer's half of the fee, so it is
+/// never the amount shown on the order — a client comparing against that
+/// would refuse every correct payout.
+///
+/// Null on the same terms as [anchoredSellerAmountProvider]: the caller has
+/// learned nothing about whether the request is right, only that it cannot
+/// re-derive what it should be.
+final anchoredBuyerAmountProvider =
+    Provider.family<int?, String>((ref, orderId) {
+  final amountSats = ref.watch(signedOrderAmountProvider(orderId));
+  final feeRate = ref.watch(nodeFeeRateProvider);
+  if (amountSats == null || feeRate == null) return null;
+
+  return SettlementAmounts.buyerReceives(
+    amountSats: amountSats,
+    feeRate: feeRate,
+  );
+});

lib/features/order/screens/add_lightning_invoice_screen.dart

@@ -2,6 +2,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
 import 'package:mostro_mobile/core/app_theme.dart';
+import 'package:mostro_mobile/features/order/providers/settlement_anchor_provider.dart';
 import 'package:mostro_mobile/features/order/providers/order_notifier_provider.dart';
 import 'package:mostro_mobile/features/order/widgets/order_app_bar.dart';
 import 'package:mostro_mobile/features/wallet/providers/nwc_provider.dart';
@@ -80,6 +81,17 @@ class _AddLightningInvoiceScreenState
           reputation: orderState.peerReputation,
         );
 
+        // What this order should pay out, re-derived from the terms the node
+        // signed: the amount in its kind-38383 order event, less the buyer's
+        // half of the fee rate in its kind-38385 one. The figure above came
+        // from the message asking for the invoice, and an invoice minted for
+        // it is what the trade settles at.
+        //
+        // Null means the events have not both arrived, not that the request
+        // is wrong, so the screen only refuses on an actual disagreement.
+        final expectedSats = ref.watch(anchoredBuyerAmountProvider(orderId));
+        final blocked = expectedSats != null && amount != expectedSats;
+
         final nwcState = ref.watch(nwcProvider);
         final isNwcConnected = nwcState.status == NwcStatus.connected;
         final showLnAddressConfirmation =
@@ -99,27 +111,33 @@ class _AddLightningInvoiceScreenState
               16,
               16 + MediaQuery.of(context).viewPadding.bottom,
             ),
-            child: showLnAddressConfirmation
-                ? _buildLnAddressConfirmation(header: header)
-                : showNwcInvoice
-                    ? _buildNwcInvoiceFlow(header: header)
-                    : AddLightningInvoiceWidget(
-                        controller: invoiceController,
-                        onSubmit: () async {
-                          final invoice = invoiceController.text.trim();
-                          if (invoice.isNotEmpty) {
-                            await _submitInvoice(invoice, amount);
-                          }
-                        },
-                        onCancel: () async {
-                          await _cancelOrder();
-                        },
-                        amount: amount ?? 0,
-                        fiatAmount: fiatAmount,
-                        fiatCode: fiatCode,
-                        orderId: orderIdValue,
-                        header: header,
-                      ),
+            child: blocked
+                ? _buildBlockedFlow(
+                    header: header,
+                    requestedSats: amount ?? 0,
+                    expectedSats: expectedSats,
+                  )
+                : showLnAddressConfirmation
+                    ? _buildLnAddressConfirmation(header: header)
+                    : showNwcInvoice
+                        ? _buildNwcInvoiceFlow(header: header)
+                        : AddLightningInvoiceWidget(
+                            controller: invoiceController,
+                            onSubmit: () async {
+                              final invoice = invoiceController.text.trim();
+                              if (invoice.isNotEmpty) {
+                                await _submitInvoice(invoice, amount);
+                              }
+                            },
+                            onCancel: () async {
+                              await _cancelOrder();
+                            },
+                            amount: amount ?? 0,
+                            fiatAmount: fiatAmount,
+                            fiatCode: fiatCode,
+                            orderId: orderIdValue,
+                            header: header,
+                          ),
           ),
         );
       },
@@ -192,6 +210,75 @@ class _AddLightningInvoiceScreenState
     );
   }
 
+  /// Shown instead of every invoice flow when the amount asked for is not the
+  /// amount this order should pay out.
+  ///
+  /// A refusal rather than a warning: an invoice minted here is what the
+  /// trade settles at, and there is no confirming a figure the signed terms
+  /// contradict.
+  Widget _buildBlockedFlow({
+    required Widget header,
+    required int requestedSats,
+    required int expectedSats,
+  }) {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        header,
+        const SizedBox(height: 24),
+        Container(
+          padding: const EdgeInsets.all(16),
+          decoration: BoxDecoration(
+            color: AppTheme.statusError.withValues(alpha: 0.1),
+            borderRadius: BorderRadius.circular(8),
+            border: Border.all(
+              color: AppTheme.statusError.withValues(alpha: 0.3),
+            ),
+          ),
+          child: Row(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              const Icon(
+                Icons.warning_amber_rounded,
+                color: AppTheme.statusError,
+                size: 20,
+              ),
+              const SizedBox(width: 12),
+              Expanded(
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    Text(
+                      S.of(context)!.invoiceRequestMismatchTitle,
+                      style: const TextStyle(
+                        color: AppTheme.statusError,
+                        fontSize: 15,
+                        fontWeight: FontWeight.w600,
+                      ),
+                    ),
+                    const SizedBox(height: 6),
+                    Text(
+                      S.of(context)!.invoiceRequestMismatchBody(
+                            requestedSats.toString(),
+                            expectedSats.toString(),
+                          ),
+                      style: const TextStyle(
+                        color: AppTheme.textSecondary,
+                        fontSize: 13,
+                      ),
+                    ),
+                  ],
+                ),
+              ),
+            ],
+          ),
+        ),
+        const Spacer(),
+        _buildCancelButton(),
+      ],
+    );
+  }
+
   Widget _buildCancelButton() {
     return Row(
       mainAxisAlignment: MainAxisAlignment.center,