Never render another ASP's Ark state before connecting

The previous fix still let a phantom balance through: loadArkState fell back
to the pre-namespacing key when a namespace was empty, and the UI renders
from that before any server is contacted — so the guard, which runs on
connect, never got a say.

loadArkState now returns only the namespaced state. Legacy state is claimed
through adoptArkState(serverPubkey), which proves ownership first: from the
state's own stamp, or failing that by decoding a vtxo, whose wire format
names its cosigner. No network call, and it cannot guess wrong. On a match
the state moves into the namespace and the legacy key is retired; on a
mismatch it is left untouched for its real owner.

Co-Authored-By: Claude Fable 5 <[email protected]>

1 files changed, 7 insertions, 0 deletions

diff --git a/src/ark/manager.js b/src/ark/manager.js
index 4814a26..03e8e18 100644
--- a/src/ark/manager.js
+++ b/src/ark/manager.js
@@ -103,6 +103,13 @@ export class ArkManager {
     this.psa = hs?.psa;
     this.serverPub = hex.decode(this.info.serverPubkey);
 
+    // Pre-namespacing state can now be proven to belong to this server (the
+    // vtxo wire format names its cosigner), so claim it before deciding.
+    if (!this.state.serverPubkey && this.storage.adopt) {
+      const adopted = this.storage.adopt(this.info.serverPubkey);
+      if (adopted) this.state = adopted;
+    }
+
     // A vtxo is only meaningful against the server that cosigned it. State
     // carried over from a different ASP (a provider switch, or a snapshot
     // adopted from the pre-namespacing key) would show phantom balance and