jonatanritterandClaude Opus 4.8
3e3a1abc6f
CRITICAL (F2 review, Opus+Fable): the service decoupled emitente (free-form payload.emitente.cnpj) from the certificate (looked up by branch_ref) with nothing re-checking the equality the auto had structurally via Branch.cnpj. A caller passing emitente.cnpj=B with a branch whose certificate CNPJ=A got a signed, persisted ASSINADO document with chave/emit=B but signature=A, having burned a nNF. Adds EmitenteCertificateCnpjMismatchError, checked in the completeness block (before allocate_fiscal_number, so a mismatch never consumes a número), normalizing both sides (digits only) before comparing. Router maps it to 409 emitente_certificate_cnpj_mismatch; message never leaks the certificate's CNPJ. Test: tests/emission/test_emissao.py:: test_emitente_cnpj_divergente_do_certificado_e_409_e_nao_queima_numero -- uploads a cert for CNPJ A, POSTs emissão with the same branch_ref but emitente.cnpj=B, asserts 409 + no fiscal number consumed (a follow-up emission with the matching CNPJ gets the number that would have been burned). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>