[ymote]

Three commits, in the order they were done. The middle one closes the defects
§8 had recorded as found-and-not-fixed; the last one takes L0 from "renders the
blob it was seeded with" to "renders the live price".

The three recorded defects (9cf195c)

• A source and a card state may no longer share a name. Nothing leaked —
  the component read the source, which §5.3 permits — but which of the two a
  name resolved to depended on lookup order rather than on anything the card
  said.
• A declared source nothing reads is refused. It is a fetch the host performs
  on every refresh for data that reaches no pixel. Two shipped in the
  reference cards, not one: series and aqi both went unread the moment
  StockPlot and AqiContour began fetching their own data, and no test noticed
  either.
• A state write reports what it invalidated. dispatch_reporting returns a
  DispatchOutcome — what applied, which paths were written, which sources those
  made stale. stale_sources and source_plan already computed the answer and
  nothing joined them.

One subtlety, or the check rejects correct cards: resolving copy.x looks up
env.locale.lang implicitly, and no path in the card names it. A purely
syntactic scan called env.locale dead on two of the three reference cards.

And a test that had been passing for the wrong reason

a_source_argument_path_must_be_declared rejects a card carrying an undeclared
path in a source argument. Its fixture ended view root Rule(), so the source
went unread — and once unread sources were refused, the card was rejected for
that instead. The test passed with the rule it exists to protect switched off.

The mutation harness reported it unprotected the moment the new rule landed,
which is the entire reason that harness exists.

A source can be answered by the backend (db27733)

The stock detail worked only because the seeded blob already held a quote. It now
shows $200.75 on the 6T against the blob's $184.20, with the real company
name, change percent, high and low.

UiNode.bindings is what makes it possible: realization resolves quote.last to
a number, and from there nothing downstream can tell it came from a fetch. The
binding records the source and field per argument, alongside the resolved value,
so lowering can emit sys.stock("NVDA", "price") where the backend can answer and
the seeded number where it cannot.

Three findings, none of which a unit test could have produced:

• sys.stock accepts open and cannot answer it. It resolves
  regularMarketOpen, absent from the upstream response, while
  regularMarketDayHigh and …DayLow beside it are present. It rendered $—
  where the blob held a real opening price. A helper accepting a key is not
  evidence it can answer it — verified against a live response, not documentation.
• Most formats do not survive concatenation. money is a "$" prefix and
  signed_pct is what the VM already returns; signed_money puts the sign
  outside the currency symbol, and compact and ratio need the number. The
  fallback is the safe direction: a seeded value is stale but correct, a wrong
  concatenation is neither.
• Anything measuring text must measure what is DRAWN.
  "$" + sys.stock("NVDA", "price") is 33 characters that render as six. Sizing
  the hero by the emitted form dropped it 40pt → 24pt and shifted the whole card
  up — a layout bug with no layout cause.

A live card cannot be asserted by a whole-screen golden

The device harness now takes a static band per case. stock-detail declares the
Mkt Cap / P/E row, which sys.stock exposes neither of, so both stay seeded.
Everything outside the band is checked only for having rendered.

That is weaker than the old golden and true, where the old golden would have been
stronger and false — it would have been asserting a share price.

Cost, recorded rather than discovered later

§5.11 states it: source_plan and its dependency ordering have no consumer on a
backend that answers its own sources, and the translation between L0's capability
names and a backend's helper names lives in that backend's lowering.

Verification

• 842 workspace tests, 0 failures
• clippy --workspace --all-targets --all-features -D warnings: clean
• 19 mutation rules held, 0 unprotected, 0 unusable
• 4/4 device goldens on the OnePlus 6T; the tap loop green with live data

🤖 Generated with Claude Code

[r9s-codereview]

🤖 AI Code Review

Claude CLI exited with code 1:

✅ No significant issues found.

---

Tokens used: 0 | Powered by r9s.ai

[r9s-codereview]

🔐 Secrets Detected

This PR contains 2 potential secret(s) that must be removed before merging.

[r9s-codereview]

🟠 Secret Detected (credit_card_visa)

Visa Credit Card Number detected: LLM validation unavailable - flagging conservatively

Match preview: 4520****0000

Remediation: Please review manually and remove if this is a real secret

[r9s-codereview]

🟠 Secret Detected (credit_card_visa)

Visa Credit Card Number detected: LLM validation unavailable - flagging conservatively

Match preview: 4520****0000

Remediation: Please review manually and remove if this is a real secret