2 files changed, 24 insertions, 3 deletions
diff --git a/src/ark/manager.js b/src/ark/manager.js
index 03e8e18..e70acfb 100644
--- a/src/ark/manager.js
+++ b/src/ark/manager.js
@@ -115,7 +115,15 @@ export class ArkManager {
     // adopted from the pre-namespacing key) would show phantom balance and
     // try to resume actions this server has never heard of — so drop it.
     // Nothing is lost: the other ASP's state lives under its own key.
-    if (this.state.serverPubkey && this.state.serverPubkey !== this.info.serverPubkey) {
+    // Decisive check: whatever any stamp claims, a vtxo names its own
+    // cosigner. If these coins were signed by a different server they are not
+    // spendable here and must not be shown.
+    const coinOwner = (() => {
+      const v = (this.state.vtxos || []).find((x) => x.bytes);
+      try { return v ? decodeVtxo(hex.decode(v.bytes)).serverPubkey : null; } catch { return null; }
+    })();
+    if ((this.state.serverPubkey && this.state.serverPubkey !== this.info.serverPubkey)
+        || (coinOwner && coinOwner !== this.info.serverPubkey)) {
       this.state = EMPTY_STATE();
     }
     if (!this.state.serverPubkey) {
diff --git a/src/features/ark.js b/src/features/ark.js
index fd8fbaf..56ffc4c 100644
--- a/src/features/ark.js
+++ b/src/features/ark.js
@@ -207,9 +207,22 @@ export function arkFeature(ctx) {
       if (!d.arkState) return;
       const cfg = getArkConfig();
       if (!cfg) return;
-      // only merge a snapshot from the same ASP — another server's vtxos are
-      // not ours to show (older snapshots carry no tag; accept those)
       if (d.arkServer && d.arkServer !== wallet._arkNs(cfg.ark)) return;
+      // A snapshot from an older build carries no tag, so the tag alone can't
+      // be trusted — ask the vtxos who cosigned them. If they belong to a
+      // different ASP (or we can't yet prove they belong to this one), park
+      // the snapshot under its real owner instead of merging it in. Merging
+      // blind is exactly how another server's balance appears here.
+      const owner = d.arkState.serverPubkey || wallet._arkVtxoOwner(d.arkState);
+      const mine = (ark && ark.info && ark.info.serverPubkey)
+        || (wallet.loadArkState(cfg.ark) || {}).serverPubkey || null;
+      if (owner && owner !== mine) {
+        try {
+          localStorage.setItem(wallet._arkHoldKey(owner),
+            JSON.stringify({ ...d.arkState, serverPubkey: owner }));
+        } catch {}
+        return;
+      }
       const local = wallet.loadArkState(cfg.ark);
       const merged = mergeArkStates(local, d.arkState);
       wallet.saveArkState(merged, cfg.ark);