fix(trades): handle takes left Canceled by the old optimistic cancel

lib/features/order/providers/trade_state_provider.dart

@@ -131,12 +131,61 @@ final tradeStatusLookupProvider =
       },
     );
 
-/// Reads the local user's role in a trade through the bridge; injectable so
-/// screens that must know whether they already participate can be tested
-/// without the Rust side.
-final tradeRoleLookupProvider = Provider<Future<TradeRole?> Function(String)>(
-  (ref) => (orderId) => orders_api.getTradeRole(orderId: orderId),
-);
+/// The local user's role in an order they still take part in
+/// ([participatingRole]), over the rows [tradeListReaderProvider] reads.
+/// Screens that must know whether they already participate override that
+/// reader, so this composition is what their tests exercise.
+///
+/// Null when the rows cannot be read at all, as the `get_trade_role` bridge
+/// call this replaced did with a database error: an unreadable store is no
+/// proof of participation, and the take screen calls this where a thrown
+/// future would strand it — unawaited in `initState`, and before the Take
+/// button leaves its idle state. A take the user does hold is still refused
+/// by the daemon, which the screen reports.
+final tradeRoleLookupProvider = Provider<Future<TradeRole?> Function(String)>((
+  ref,
+) {
+  final readTrades = ref.watch(tradeListReaderProvider);
+  return (orderId) async {
+    try {
+      return participatingRole(await readTrades(), orderId);
+    } catch (e, st) {
+      debugPrint('[tradeRoleLookup] reading the trades failed: $e\n$st');
+      return null;
+    }
+  };
+});
+
+/// The role of the user's trade on [orderId] among [trades], or null when
+/// they no longer take part in it: no row at all, or only a take that has
+/// ended ([isEndedTake]).
+///
+/// Every row for the order is read, not just one: a database from before
+/// takes replaced their order's earlier row can hold two, and a live one
+/// among them still makes the user a participant.
+TradeRole? participatingRole(Iterable<TradeInfo> trades, String orderId) {
+  for (final trade in trades) {
+    if (trade.order.id == orderId && !isEndedTake(trade)) return trade.role;
+  }
+  return null;
+}
+
+/// Whether [trade] is a take whose row has ended, which leaves the user
+/// nothing to follow on its order.
+///
+/// A trade that truly ended leaves its order in a status mostrod never takes
+/// it out of: a take needs `Pending`, and only a waiting state goes back to
+/// it. So once the order can be taken again, such a row is what a take that
+/// never went active left behind: older builds marked it `Canceled` as soon
+/// as its cancel went out. Holding on to it sent the user to that dead trade
+/// instead of letting them take the order again (#434). Rust already takes
+/// over such a row: the confirmed take replaces every earlier row of its
+/// order.
+///
+/// Never a maker's row: its order is theirs, and the take screen is not
+/// where they manage it.
+bool isEndedTake(TradeInfo trade) =>
+    !trade.order.isMine && isTerminalTradeStatus(trade.order.status);
 
 /// Takes an order through the bridge; injectable so the take screen's
 /// outcomes (loading, already taken, rejected) can be tested without Rust.
@@ -184,7 +233,7 @@ final tradeStatusProvider = StreamProvider.family
         ref,
         orderId,
         read: () => lookup(orderId),
-        isFinal: (status) => status != null && _isTerminal(status),
+        isFinal: (status) => status != null && isTerminalTradeStatus(status),
       ).where((status) => status != null).cast<OrderStatus>();
     });
 
@@ -205,8 +254,9 @@ final tradeUpdatesProvider = StreamProvider.autoDispose<TradeUpdate>((
   }
 });
 
-/// Whether the UI can stop polling. Escrow settlement still awaits payout.
-bool _isTerminal(OrderStatus s) => const {
+/// Whether a trade in [s] has ended: nothing moves it out again, so the UI
+/// can stop polling. Escrow settlement still awaits payout.
+bool isTerminalTradeStatus(OrderStatus s) => const {
   OrderStatus.success,
   OrderStatus.settledByAdmin,
   OrderStatus.completedByAdmin,
@@ -216,6 +266,33 @@ bool _isTerminal(OrderStatus s) => const {
   OrderStatus.canceledByAdmin,
 }.contains(s);
 
+/// The status a trade shows: its [row]'s persisted one, or the [live] one
+/// from [tradeStatusProvider], which reads the order book first.
+///
+/// The row wins in two cases:
+/// * **It has ended** ([isTerminalTradeStatus]). Whatever the book says about
+///   the order later is no longer this trade. The one way such a row can be
+///   wrong is the cancel's optimistic write on an active trade: a cooperative
+///   cancel the peer never accepts, on a trade that then completes.
+/// * **It is a take ([isTake]) and the book says `pending`.** A public
+///   `pending` means nobody holds the order, so it is never a take's status.
+///   Older builds marked a take `Canceled` as soon as its cancel went out,
+///   even before it went active; once the daemon put the order back in the
+///   book, that `pending` read as the user's own order, with a Cancel the
+///   daemon refuses (`IsNotYourOrder`). A take parked at `WaitingTakerBond`
+///   is another: publicly its order is still `pending`.
+///
+/// Otherwise the live status, or the row's while there is none yet.
+OrderStatus shownTradeStatus({
+  required OrderStatus row,
+  required OrderStatus? live,
+  required bool isTake,
+}) {
+  if (live == null || isTerminalTradeStatus(row)) return row;
+  if (isTake && live == OrderStatus.pending) return row;
+  return live;
+}
+
 /// Loads the buyer/seller role for a trade from the persistent DB.
 ///
 /// Returns `true` when the local user is the buyer, `false` for seller, or

lib/features/trades/providers/trade_rows_provider.dart

@@ -41,7 +41,8 @@ class TradeRow {
 
   final String orderId;
 
-  /// Live when the order is still moving, else the persisted status.
+  /// Live when the order is still moving, else the persisted status — see
+  /// [shownTradeStatus], which the trade screen shares.
   final rust_types.OrderStatus status;
   final TradeRowState state;
   final bool isSelling;
@@ -72,16 +73,6 @@ class TradeRow {
   final bool claimOnly;
 }
 
-const _terminal = {
-  rust_types.OrderStatus.success,
-  rust_types.OrderStatus.settledByAdmin,
-  rust_types.OrderStatus.completedByAdmin,
-  rust_types.OrderStatus.canceled,
-  rust_types.OrderStatus.expired,
-  rust_types.OrderStatus.cooperativelyCanceled,
-  rust_types.OrderStatus.canceledByAdmin,
-};
-
 const _successes = {
   rust_types.OrderStatus.success,
   rust_types.OrderStatus.settledByAdmin,
@@ -162,10 +153,14 @@ TradeRow _row(
 }) {
   final order = trade.order;
   final persisted = order.status;
-  final status =
-      _terminal.contains(persisted)
-          ? persisted
-          : ref.watch(tradeStatusProvider(order.id)).valueOrNull ?? persisted;
+  final status = shownTradeStatus(
+    row: persisted,
+    live:
+        isTerminalTradeStatus(persisted)
+            ? null
+            : ref.watch(tradeStatusProvider(order.id)).valueOrNull,
+    isTake: !order.isMine,
+  );
   final ratedByMe =
       trade.ratedAt != null ||
       (_successes.contains(status) && ref.watch(ratedByMeProvider(order.id)));

lib/features/trades/screens/trade_detail_screen.dart

@@ -41,7 +41,8 @@ import 'package:mostro/shared/widgets/mostro_reactive_button.dart';
 import 'package:mostro/src/rust/api/disputes.dart' as disputes_api;
 import 'package:mostro/src/rust/api/orders.dart' as orders_api;
 import 'package:mostro/src/rust/api/reputation.dart' as reputation_api;
-import 'package:mostro/src/rust/api/types.dart' show CooperativeCancelState;
+import 'package:mostro/src/rust/api/types.dart'
+    show CooperativeCancelState, TradeInfo;
 
 export 'package:mostro/features/trades/models/trade_status.dart';
 
@@ -218,9 +219,23 @@ class _TradeDetailScreenState extends ConsumerState<TradeDetailScreen> {
   /// await: the seller's payment can land while the cancel dialog is open.
   TradeStatus _liveStatus(TradeStatus fallback) {
     final live = ref.read(tradeStatusProvider(widget.orderId)).valueOrNull;
-    return live == null ? fallback : tradeStatusFromOrderStatus(live);
+    if (live == null) return fallback;
+    final trade = ref.read(tradeInfoProvider(widget.orderId)).valueOrNull;
+    return tradeStatusFromOrderStatus(_shown(live, trade));
   }
 
+  /// What [live] shows for this trade once its [trade] row is read in
+  /// ([shownTradeStatus]); [live] itself while the row has not loaded, or
+  /// when there is none.
+  static OrderStatus _shown(OrderStatus live, TradeInfo? trade) =>
+      trade == null
+          ? live
+          : shownTradeStatus(
+            row: trade.order.status,
+            live: live,
+            isTake: !trade.order.isMine,
+          );
+
   Future<void> _cancelOrder(TradeStatus status) async {
     final l10n = AppLocalizations.of(context);
     // A maker parked on their own deposit cannot cancel (the daemon refuses
@@ -247,15 +262,19 @@ class _TradeDetailScreenState extends ConsumerState<TradeDetailScreen> {
                     dialogRef
                         .watch(tradeStatusProvider(widget.orderId))
                         .valueOrNull;
+                final trade =
+                    dialogRef
+                        .watch(tradeInfoProvider(widget.orderId))
+                        .valueOrNull;
                 final now =
-                    live == null ? status : tradeStatusFromOrderStatus(live);
+                    live == null
+                        ? status
+                        : tradeStatusFromOrderStatus(_shown(live, trade));
                 // The counterparty's request can land while the dialog is
-                // open, and it changes no status: watch the row too.
+                // open, and it changes no status: the row watched above
+                // answers it.
                 final peerAsked =
-                    dialogRef
-                        .watch(tradeInfoProvider(widget.orderId))
-                        .valueOrNull
-                        ?.cooperativeCancelState ==
+                    trade?.cooperativeCancelState ==
                     CooperativeCancelState.requestedByPeer;
                 return Text(
                   _cancelDialogContent(l10n, now, peerAsked: peerAsked),
@@ -456,7 +475,20 @@ class _TradeDetailScreenState extends ConsumerState<TradeDetailScreen> {
       debugPrint('[TradeDetailScreen] trade status failed: ${live.error}');
     }
     if (!live.hasValue) return TradeStatus.loading;
-    final status = tradeStatusFromOrderStatus(live.value!);
+    final tradeAsync = ref.watch(tradeInfoProvider(widget.orderId));
+    // A public `pending` may be a take's leftover, and only the row tells
+    // them apart (#434). Until it answers, hold `loading` rather than offer
+    // the maker's view with a Cancel the daemon refuses. First read only: a
+    // refresh keeps the previous row, and the trades cache is invalidated on
+    // every trade update, so waiting for those would flash `loading`.
+    if (live.value == OrderStatus.pending &&
+        tradeAsync.isLoading &&
+        !tradeAsync.hasValue) {
+      return TradeStatus.loading;
+    }
+    final status = tradeStatusFromOrderStatus(
+      _shown(live.value!, tradeAsync.valueOrNull),
+    );
     if (status != TradeStatus.pendingRating) return status;
     final rating = ref.watch(tradeRatingProvider(widget.orderId));
     if (rating.isLoading && !rating.hasValue) return TradeStatus.loading;
@@ -490,13 +522,22 @@ class _TradeDetailScreenState extends ConsumerState<TradeDetailScreen> {
     // A step advanced by the relay: a nudge, the crossfades below, and a
     // fresh deadline — every step has its own expiration, owned by a
     // different party, so the clock loaded for the previous step is stale.
+    // Judged on what the screen shows: a book change the row outranks is
+    // not a step of this trade.
     ref.listen<AsyncValue<OrderStatus>>(tradeStatusProvider(widget.orderId), (
       previous,
       next,
     ) {
+      final row = ref.read(tradeInfoProvider(widget.orderId));
+      // Without the row a public `pending` cannot be told from the trade's
+      // own status, so a change into or out of it says nothing yet.
+      if (row.isLoading && !row.hasValue) return;
+      final trade = row.valueOrNull;
       final before = previous?.valueOrNull;
       final after = next.valueOrNull;
-      if (before != null && after != null && before != after) {
+      if (before != null &&
+          after != null &&
+          _shown(before, trade) != _shown(after, trade)) {
         HapticFeedback.mediumImpact();
         _loadExpiresAt();
       }

specs/004-mostro-p2p-client/contracts/orders.md

@@ -844,3 +844,24 @@ The seller pay-invoice flow uses two complementary providers from
   advancing past the pay-invoice screen; the NWC widget's local
   `onPaymentSuccess` callback only flips a spinner flag and does not
   navigate.
+
+`tradeStatusProvider` reads the order book first, and the book holds the
+order's public view. So the My Trades list and `TradeDetailScreen` show a
+trade through `shownTradeStatus`, where the trade row wins in two cases:
+
+- **The row has ended** (success or a cancelled family): whatever the book
+  says about the order afterwards is no longer this trade.
+- **A take, and the book says `pending`**: a public `pending` means nobody
+  holds the order, so it is never a take's status. That covers a take left
+  `Canceled` by builds that wrote the status before the daemon answered
+  (the daemon later put the order back in the book), and a take parked at
+  `WaitingTakerBond`, whose order is still `pending` in public.
+
+Every other live status wins over an open row.
+
+The take screen sends a user who already takes part in the order to the
+trade instead of offering to take it again (`tradeRoleLookupProvider`,
+`participatingRole`). A take whose row has ended does not count: once its
+order can be taken again, such a row can only be what a take that never
+went active left behind, and `take_order` replaces it with the new take's
+row. A maker's row always counts, and so does any row still open.