Keep Ark state per ASP, not just per wallet

Switching providers showed the previous server's balance and tried to resume
its in-flight board ("1 deposit confirming" against a server that had never
heard of it). A vtxo is only meaningful against the ASP that cosigned it, so
state must be scoped to both the wallet and the server.

- ark state keys gain a namespace derived from the ASP endpoint, so switching
  providers switches state and switching back restores it
- state is stamped with the server pubkey; on connect a mismatch is discarded
  rather than displayed. This also self-corrects the one-time adoption of
  pre-namespacing state, which can only guess which ASP it belonged to
- mergeArkStates refuses to fuse two servers' states, and the nostr sync
  snapshot carries (and filters on) the ASP it came from, so a device on a
  different provider can't inject foreign vtxos

Nothing is deleted: each ASP's state lives under its own key, and the legacy
key is left in place for whichever server rightfully claims it.

Co-Authored-By: Claude Fable 5 <[email protected]>

1 files changed, 14 insertions, 0 deletions

diff --git a/src/ark/manager.js b/src/ark/manager.js
index fc6262d..4814a26 100644
--- a/src/ark/manager.js
+++ b/src/ark/manager.js
@@ -54,6 +54,7 @@ import { validateVtxo, VtxoValidationError } from './validate.js';
 
 const EMPTY_STATE = () => ({
   v: 1,
+  serverPubkey: null, // which ASP this state belongs to (guarded in init)
   mailboxCheckpoint: 0,
   nextKeyIndex: 1, // 0 is the receive-address key
   vtxos: [],       // { id, bytes, keyIndex, amountSat, expiryHeight, state }
@@ -101,6 +102,19 @@ export class ArkManager {
     const hs = await handshake(this.arkUrl).catch(() => null);
     this.psa = hs?.psa;
     this.serverPub = hex.decode(this.info.serverPubkey);
+
+    // A vtxo is only meaningful against the server that cosigned it. State
+    // carried over from a different ASP (a provider switch, or a snapshot
+    // adopted from the pre-namespacing key) would show phantom balance and
+    // try to resume actions this server has never heard of — so drop it.
+    // Nothing is lost: the other ASP's state lives under its own key.
+    if (this.state.serverPubkey && this.state.serverPubkey !== this.info.serverPubkey) {
+      this.state = EMPTY_STATE();
+    }
+    if (!this.state.serverPubkey) {
+      this.state.serverPubkey = this.info.serverPubkey;
+      this._save();
+    }
     return this;
   }