fix: order message history by event time and drop late setup messages

CLAUDE.md

@@ -50,10 +50,11 @@ When implementing or debugging protocol-related features (order flows, actions,
 ### Nostr Integration
 - **NostrService** (`services/nostr_service.dart`) manages relay connections and messaging
 - All Nostr protocol interactions go through this service
+- **Message ordering**: an order's history is ordered by `MostroMessage.eventCreatedAt` (the daemon's `created_at`, set in `MostroService._processEvent`) via `MostroMessage.compareByEventTime`; `timestamp` is the local receive time, used only as tie-break and for the recency gate for notifications. Relays replay pending events newest-first, decryption is concurrent and the wire `created_at` has one-second resolution, so receive order is not trade order. `OrderState.updateWith` additionally drops any message that would move the order back to an earlier lifecycle phase (`isStaleTransition` over `phaseRank`, the only allowed backwards move being the `new-order` republish to pending after a taker timeout), so a late copy can never move a trade back to a phase without fiat-sent/release/chat buttons or reopen a terminal one (regression tests: `test/features/order/notifiers/order_notifier_replay_order_test.dart`, `test/features/order/models/order_state_late_setup_message_test.dart`)
 - **MostroFSM** (`core/mostro_fsm.dart`) defines a transition matrix but is **not wired in** — nothing imports it
   - Order status is actually derived by `OrderState._getStatusFromAction` (`features/order/models/order_state.dart`), which maps actions to statuses without consulting the matrix
   - Do not read `mostro_fsm.dart` as an active validation layer. Its role axis models who performs an action, not the local user's role in the trade (the app never assigns `Role.admin` to a session), so wiring it as-is would reject legitimate admin resolutions
-  - The only transition guard that runs today is the dispute-evidence check on `admin-*` actions in `OrderState.updateWith`
+  - The only transition guards that run today live in `OrderState.updateWith`: the dispute-evidence check on `admin-*` actions and the backwards-phase drop (`isStaleTransition`)
 
 ### Navigation and UI
 - **GoRouter** for navigation (configured in `core/app_routes.dart`)

lib/data/models/mostro_message.dart

@@ -15,17 +15,43 @@ class MostroMessage<T extends Payload> {
   final Action action;
   int? tradeIndex;
   T? _payload;
+
+  /// Local receive time in milliseconds, stamped by storage on first write.
+  /// Drives the recency gate for notifications and navigation.
   int? timestamp;
 
+  /// The daemon's `created_at` for the event that carried this message, in
+  /// milliseconds. Null for messages written before it was recorded and for
+  /// locally synthesized ones (restore, outbound copies).
+  int? eventCreatedAt;
+
   MostroMessage({
     required this.action,
     this.requestId,
     this.id,
     T? payload,
     this.tradeIndex,
     this.timestamp,
+    this.eventCreatedAt,
   }) : _payload = payload;
 
+  /// Position of this message in the order's history.
+  ///
+  /// Mostrod's own event time is authoritative: relays replay pending events
+  /// newest-first and the decrypt pipeline is concurrent, so the receive time
+  /// alone puts an earlier message after a later one, and the order state
+  /// (and with it the trade buttons) ends up on a phase the trade already left.
+  /// The receive time is the fallback for legacy rows and the tie-break. The
+  /// wire `created_at` has one-second resolution, so two events from the same
+  /// second still fall back to receive order; `OrderState.isStaleTransition`
+  /// is what keeps such a tie from moving the order backwards.
+  static int compareByEventTime(MostroMessage a, MostroMessage b) {
+    final byEvent = (a.eventCreatedAt ?? a.timestamp ?? 0)
+        .compareTo(b.eventCreatedAt ?? b.timestamp ?? 0);
+    if (byEvent != 0) return byEvent;
+    return (a.timestamp ?? 0).compareTo(b.timestamp ?? 0);
+  }
+
   Map<String, dynamic> toJson({int? version}) {
     Map<String, dynamic> json = {
       // The message version is derived from the wire transport: 1 for gift wrap
@@ -47,6 +73,7 @@ class MostroMessage<T extends Payload> {
 
   factory MostroMessage.fromJson(Map<String, dynamic> json) {
     final timestamp = json['timestamp'];
+    final eventCreatedAt = json['event_created_at'];
     // IMPORTANT : Use 'order', 'restore' or 'cant-do' key as per protocol
     json = json['order'] ?? json['restore'] ?? json['cant-do'] ?? json;
     final num requestId = json['request_id'] ?? 0;
@@ -60,6 +87,7 @@ class MostroMessage<T extends Payload> {
           ? Payload.fromJson(json['payload']) as T?
           : null,
       timestamp: timestamp,
+      eventCreatedAt: eventCreatedAt,
     );
   }
 

lib/data/repositories/mostro_storage.dart

@@ -54,7 +54,7 @@ class MostroStorage extends BaseStorage<MostroMessage> {
     if (orderId == null) return;
     final list = _byOrder.putIfAbsent(orderId, () => <MostroMessage>[]);
     list.add(message);
-    list.sort((a, b) => (b.timestamp ?? 0).compareTo(a.timestamp ?? 0));
+    list.sort((a, b) => MostroMessage.compareByEventTime(b, a));
     if (notify) _notifyOrder(orderId);
   }
 
@@ -117,6 +117,7 @@ class MostroStorage extends BaseStorage<MostroMessage> {
       final Map<String, dynamic> dbMap = message.toJson();
       message.timestamp ??= DateTime.now().millisecondsSinceEpoch;
       dbMap['timestamp'] = message.timestamp;
+      dbMap['event_created_at'] = message.eventCreatedAt;
 
       await store.record(id).put(db, dbMap);
       _indexAdd(message);
@@ -197,15 +198,13 @@ class MostroStorage extends BaseStorage<MostroMessage> {
         .toList();
   }
 
-  /// Filter messages by payload type
+  /// Latest message for [orderId] whose payload is a [T], by event time.
   Future<MostroMessage?> getLatestMessageOfTypeById<T extends Payload>(
     String orderId,
   ) async {
-    final messages = await getMessagesForId(orderId);
-    for (final message in messages.reversed) {
-      if (message.payload is T) {
-        return message;
-      }
+    await _ensureIndex();
+    for (final message in _byOrder[orderId] ?? const <MostroMessage>[]) {
+      if (message.payload is T) return message;
     }
     return null;
   }

lib/features/order/models/order_state.dart

@@ -232,6 +232,22 @@ class OrderState {
     // DEBUG: Log status mapping
     logger.d('Status mapping: $effectiveAction → $newStatus');
 
+    // A message that would move the order back to a phase it already left is
+    // a late delivery, not a transition: relays replay pending events
+    // newest-first, decryption is concurrent and the wire `created_at` has
+    // one-second resolution, so `waiting-seller-to-pay` can be applied after
+    // `hold-invoice-payment-accepted`, or `fiat-sent-ok` after `released`.
+    // Taking it would land on a phase whose action table has no fiat-sent,
+    // release or chat button, which is how trades looked stuck until a
+    // dispute reset the row.
+    if (isStaleTransition(effectiveAction, newStatus)) {
+      logger.w(
+        'Ignoring late ${message.action} for order ${message.id}: '
+        'it would move the order from $status back to $newStatus',
+      );
+      return this;
+    }
+
     // A pending order has no counterpart: when Mostro republishes it after the
     // taker times out, the previous taker's snapshot must not be carried into
     // the next take and shown as if it belonged to whoever takes it next.
@@ -402,6 +418,48 @@ class OrderState {
     return newState;
   }
 
+  /// Position of a status along the trade lifecycle. Statuses that can
+  /// legitimately follow each other in either direction share a rank: a
+  /// cooperative cancel can be started from fiat-sent or during a dispute and
+  /// the trade can still reach fiat-sent while the cancel is pending; a
+  /// payout can fail and be retried while the hold invoice stays settled.
+  /// Every terminal status sits at the top so nothing reopens it.
+  static int phaseRank(Status status) => switch (status) {
+        Status.pending => 0,
+        Status.waitingTakerBond ||
+        Status.waitingPayment ||
+        Status.waitingBuyerInvoice ||
+        Status.inProgress =>
+          1,
+        Status.active => 2,
+        Status.fiatSent || Status.cooperativelyCanceled || Status.dispute => 3,
+        Status.settledHoldInvoice || Status.paymentFailed => 4,
+        Status.success => 5,
+        Status.canceled ||
+        Status.canceledByAdmin ||
+        Status.settledByAdmin ||
+        Status.completedByAdmin ||
+        Status.expired =>
+          6,
+      };
+
+  /// Whether applying [action] with [newStatus] would move the order back to
+  /// a phase it already left.
+  ///
+  /// The one backwards move the protocol makes is the republish after a taker
+  /// timeout: Mostro sends `new-order` with a pending payload to the maker
+  /// while the order waits for the taker's invoice or payment. Nothing else
+  /// goes backwards, so any other such message is a late copy.
+  bool isStaleTransition(Action action, Status newStatus) {
+    final current = phaseRank(status);
+    final next = phaseRank(newStatus);
+    if (next >= current) return false;
+    final isRepublish = action == Action.newOrder &&
+        newStatus == Status.pending &&
+        current <= phaseRank(Status.waitingPayment);
+    return !isRepublish;
+  }
+
   /// Maps actions to their corresponding statuses based on mostrod DM messages
   Status _getStatusFromAction(Action action, Status? payloadStatus) {
     switch (action) {

lib/features/order/notifiers/order_notifier.dart

@@ -79,19 +79,16 @@ class OrderNotifier extends AbstractMostroNotifier {
       _isSyncing = true;
 
       final storage = ref.read(mostroStorageProvider);
-      final messages = await storage.getAllMessagesForOrderId(orderId);
+      // The index hands out an unmodifiable view: sort a copy.
+      final messages = (await storage.getAllMessagesForOrderId(orderId))
+          .toList()
+        ..sort(MostroMessage.compareByEventTime);
       if (messages.isEmpty) {
         logger.w('No messages found for order $orderId');
         succeeded = true;
         return;
       }
 
-      messages.sort((a, b) {
-        final timestampA = a.timestamp ?? 0;
-        final timestampB = b.timestamp ?? 0;
-        return timestampA.compareTo(timestampB);
-      });
-
       OrderState currentState = state;
 
       for (final message in messages) {

lib/features/trades/state_message_finder.dart

@@ -52,9 +52,9 @@ class StateMessageFinder {
       return const _LookupResult(null, skippedFutureMessage: false);
     }
 
-    // Sort messages by timestamp (newest first)
+    // Sort messages by event time (newest first)
     final sortedMessages = List<MostroMessage>.from(validMessages)
-      ..sort((a, b) => (b.timestamp ?? 0).compareTo(a.timestamp ?? 0));
+      ..sort((a, b) => MostroMessage.compareByEventTime(b, a));
 
     final cutoff = now.add(futureTimestampTolerance);
     var skippedFutureMessage = false;

lib/features/trades/widgets/mostro_message_detail_widget.dart

@@ -91,9 +91,8 @@ class MostroMessageDetail extends ConsumerWidget {
   }
 
   actions.Action? _previousNonBondAction(List<MostroMessage> messages) {
-    final sorted = [...messages]..sort(
-        (a, b) => (b.timestamp ?? 0).compareTo(a.timestamp ?? 0),
-      );
+    final sorted = [...messages]
+      ..sort((a, b) => MostroMessage.compareByEventTime(b, a));
     for (final msg in sorted) {
       final a = msg.action;
       if (a == actions.Action.addBondInvoice) continue;

lib/services/mostro_service.dart

@@ -222,16 +222,20 @@ class MostroService {
       // decrypts straight to the tuple. Both converge on jsonDecode below.
       String? content;
       String? decryptedId;
+      DateTime? eventCreatedAt;
       if (event.kind == 14) {
         content = await NostrUtils.decryptNIP44DirectEvent(
           event,
           privateKey,
           expectedAuthor: _settings.mostroPublicKey,
         );
+        eventCreatedAt = event.createdAt;
       } else {
         final decryptedEvent = await event.unWrap(privateKey);
         content = decryptedEvent.content;
         decryptedId = decryptedEvent.id;
+        // The wrap's created_at is randomized; the rumor's is the real one.
+        eventCreatedAt = decryptedEvent.createdAt ?? event.createdAt;
       }
 
       if (content == null) {
@@ -264,6 +268,9 @@ class MostroService {
       }
 
       final msg = MostroMessage.fromJson(result[0]);
+      // Ordering key for the order's history: the daemon's event time, not
+      // the moment this client happened to decrypt it.
+      msg.eventCreatedAt = eventCreatedAt?.millisecondsSinceEpoch;
 
       final messageStorage = ref.read(mostroStorageProvider);
 

test/data/repositories/mostro_storage_event_time_test.dart

@@ -0,0 +1,115 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:mostro_mobile/data/models/enums/action.dart';
+import 'package:mostro_mobile/data/models/enums/order_type.dart';
+import 'package:mostro_mobile/data/models/enums/status.dart';
+import 'package:mostro_mobile/data/models/order.dart';
+import 'package:mostro_mobile/data/models/mostro_message.dart';
+import 'package:mostro_mobile/data/repositories/mostro_storage.dart';
+import 'package:sembast/sembast_memory.dart';
+
+/// The history used to be ordered by the local receive time stamped at write.
+/// Relays replay pending events newest-first and the decrypt pipeline is
+/// concurrent, so an earlier message could be written after a later one and
+/// become the "latest" message the order state is derived from.
+void main() {
+  late MostroStorage storage;
+
+  setUp(() async {
+    final db =
+        await newDatabaseFactoryMemory().openDatabase('event_time_test.db');
+    storage = MostroStorage(db: db);
+  });
+
+  MostroMessage message(Action action, {int? eventCreatedAt}) => MostroMessage(
+        action: action,
+        id: 'order-a',
+        eventCreatedAt: eventCreatedAt,
+      );
+
+  test('the latest message follows the event time, not the write order',
+      () async {
+    // Arrange: the newer event is decrypted and written first.
+    await storage.addMessage(
+      'newer',
+      message(Action.holdInvoicePaymentAccepted, eventCreatedAt: 2000),
+    );
+    await storage.addMessage(
+      'older',
+      message(Action.waitingSellerToPay, eventCreatedAt: 1000),
+    );
+
+    // Act
+    final history = await storage.getAllMessagesForOrderId('order-a');
+    final latest = await storage.getLatestMessageById('order-a');
+
+    // Assert
+    expect(history.map((m) => m.action),
+        [Action.holdInvoicePaymentAccepted, Action.waitingSellerToPay]);
+    expect(latest?.action, Action.holdInvoicePaymentAccepted);
+  });
+
+  test('legacy rows without an event time keep their receive-time order',
+      () async {
+    final first = message(Action.newOrder)..timestamp = 1000;
+    final second = message(Action.payInvoice)..timestamp = 2000;
+    await storage.addMessage('k1', first);
+    await storage.addMessage('k2', second);
+
+    final history = await storage.getAllMessagesForOrderId('order-a');
+
+    expect(history.map((m) => m.action), [Action.payInvoice, Action.newOrder]);
+  });
+
+  _typedLookup();
+
+  test('the event time survives a round trip through the database', () async {
+    await storage.addMessage(
+      'k1',
+      message(Action.waitingSellerToPay, eventCreatedAt: 1234),
+    );
+    final reopened = MostroStorage(db: storage.db);
+
+    final history = await reopened.getAllMessagesForOrderId('order-a');
+
+    expect(history.single.eventCreatedAt, 1234);
+  });
+}
+
+void _typedLookup() {
+  test('the typed latest lookup follows the event time too', () async {
+    final db =
+        await newDatabaseFactoryMemory().openDatabase('typed_lookup_test.db');
+    final storage = MostroStorage(db: db);
+    Order order(Status status) => Order(
+          id: 'order-a',
+          kind: OrderType.sell,
+          status: status,
+          fiatCode: 'VES',
+          fiatAmount: 100,
+          paymentMethod: 'face to face',
+        );
+
+    await storage.addMessage(
+      'newer',
+      MostroMessage<Order>(
+        action: Action.holdInvoicePaymentAccepted,
+        id: 'order-a',
+        eventCreatedAt: 2000,
+        payload: order(Status.active),
+      ),
+    );
+    await storage.addMessage(
+      'older',
+      MostroMessage<Order>(
+        action: Action.waitingSellerToPay,
+        id: 'order-a',
+        eventCreatedAt: 1000,
+        payload: order(Status.waitingPayment),
+      ),
+    );
+
+    final latest = await storage.getLatestMessageOfTypeById<Order>('order-a');
+
+    expect(latest?.getPayload<Order>()?.status, Status.active);
+  });
+}