1 files changed, 21 insertions, 2 deletions
diff --git a/src/features/ark.js b/src/features/ark.js
index 5d3b293..f5ba9d8 100644
--- a/src/features/ark.js
+++ b/src/features/ark.js
@@ -77,11 +77,15 @@ if (typeof document !== 'undefined') {
   document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'hidden') flushAll(); });
 }
 
+// A read-only look at the stored state (stub wallets in tests have only loadArkState).
+const peekArk = (wallet, url) => (wallet.peekArkState ? wallet.peekArkState(url) : wallet.loadArkState(url));
+
 // Wallet storage/key helpers for this feature, installed onto the core
 // wallet instance so a build without the feature ships none of it.
 export function installArkWallet(wallet) {
   if (wallet.loadArkState) return; // already installed
   const store = arkStore(); // IndexedDB-backed, memory-fronted; opens now
+  const peekOwnerOk = new WeakSet(); // stored states whose owner check passed
   Object.assign(wallet, {
     _arkStore: store,
     // ---- Ark support -------------------------------------------------------
@@ -133,6 +137,21 @@ export function installArkWallet(wallet) {
         return st;
       } catch { return null; }
     },
+    // loadArkState for readers that only look (see ArkStore.peek): the stored
+    // object, no copy — never mutate it. Misfiled state goes through
+    // loadArkState's repair; each object's owner is decoded once.
+    peekArkState(url) {
+      try {
+        const st = store.peek(this._arkKey(url));
+        if (!st) return null;
+        if (!peekOwnerOk.has(st)) {
+          const owner = this._arkVtxoOwner(st);
+          if (owner && st.serverPubkey && owner !== st.serverPubkey) return this.loadArkState(url);
+          peekOwnerOk.add(st);
+        }
+        return st;
+      } catch { return null; }
+    },
     // Offer up pre-namespacing state, but only to the ASP that actually
     // cosigned it. Its owner is read from the state's own stamp, or failing
     // that decoded straight out of a vtxo — the vtxo wire format carries the
@@ -554,7 +573,7 @@ export function arkFeature(ctx) {
 
   function arkWanted() {
     const cfg = getArkConfig();
-    const st = cfg && wallet.loadArkState(cfg.ark);
+    const st = cfg && peekArk(wallet, cfg.ark);
     return !!(st && ((st.vtxos || []).length || (st.movements || []).length
       || (st.actions || []).some((a) => !['done', 'failed'].includes(a.step))));
   }
@@ -797,7 +816,7 @@ export function arkFeature(ctx) {
     // (send/exit) still requires the seed and is gated separately.
     const cfg = getArkConfig();
     if (!cfg) return null;
-    return wallet.loadArkState(cfg.ark);
+    return peekArk(wallet, cfg.ark);
   }
 
   // Which receives actually arrived over Lightning? A payment to the user's