Warn user when a deprecated arkd signer key is detected in use after cutoff

[arkana-ai-bot]

Problem

When arkd rotates its signer key and sets a cutoff date, addresses derived from the old key become invalid after that date. Funds sent there get stuck: cooperative boarding is rejected by the server, and unilateral recovery only unlocks after boardingExitDelay (currently 90 days on mainnet).

Real case: a user had a pool auto-paying to their old boarding address. After the June 22 rotation (cutoff July 4), 3 UTXOs accumulated on the deprecated address with no UI warning. The user had no way to know anything was wrong.

Requested behaviour

After cutoff, whenever the wallet detects an address (Ark offchain address or boarding/onchain address) derived from a deprecated signer key:

• Show a persistent warning on the receive screen
• Explain that the address is no longer valid for new deposits
• Show the correct current address (new signer key)
• Optionally: detect UTXOs already received at the deprecated address and surface a recovery prompt

Context

• Deprecated keys + cutoff dates are exposed via GetInfo → deprecated_signer_pub_keys
• arkd rejects boarding inputs post-cutoff with "is a deprecated key since [date]" (internal/core/application/utils.go → validateVtxoScriptForSigners())
• Boarding script: DefaultVtxoScript(userKey, serverSignerKey, boardingExitDelay) — unilateral exit via timelock becomes available after boardingExitDelay

[arkana-ai-bot]

Classification: Enhancement — user funds safety warning

Good news: the data is already in the wallet. aspInfo.deprecatedSigners is populated from GetInfo as part of the AspProvider in src/providers/asp.tsx. The ArkInfo SDK type includes this field; no new API call is needed.

Where the fix lives (receive-screen warning):

The receive screen already has everything it needs:

// src/screens/Wallet/Receive/QrCode.tsx
const { aspInfo } = useContext(AspContext)   // ← already imported

A check of the form aspInfo.deprecatedSigners.some(d => d.pubkey === aspInfo.signerPubkey && d.expiredAt <= Date.now()) is sufficient to gate a persistent banner above the QR code. The banner should show the current (aspInfo.signerPubkey-derived) address alongside the warning.

Where the fix lives (stuck-VTXO detection):

src/lib/asp.ts fetches VTXOs and boarding UTXOs. Cross-referencing each VTXO's boarding script against aspInfo.deprecatedSigners (and the cutoff date) identifies UTXOs that can no longer board cooperatively, and can surface a recovery prompt from the same provider.

Relevant files:

• src/providers/asp.tsx — AspProvider, source of deprecatedSigners
• src/lib/asp.ts — emptyAspInfo (shows the field shape), VTXO fetching
• src/screens/Wallet/Receive/QrCode.tsx — receive screen, primary warning surface
• src/screens/Settings/Advanced.tsx — may be a secondary place for a deprecation notice

Flagging for human review: involves boarding VTXO scripts and signer key rotation logic.