fix(ui): the wallet view renders a slot only the dashboard loader filled

[argszero]

Summary

#month-changes (wallet view) and #dash-month-changes (dashboard) are painted by the same renderMonthChanges(), and both read Live.dashboard. But that slot had exactly one writer — the dashboard's loader (loadDashboard) — while the wallet branch of renderView called loadWallet(), which only refreshes Live.wallet.

So whenever the session is established on the wallet view, nobody ever filled the slot and the block rendered net 0 plus "No changes this month" for good, while the very same /api/dashboard payload rendered correctly on the dashboard:

• hash #/wallet (left over from a 401 or a previous session), then log in;
• or, the everyday path: log out on the wallet page, then log back in.

(Refreshing with a live token hides it: boot calls renderView("dashboard") unconditionally from DOMContentLoaded, which fills the slot as a side effect. That is why it stayed latent.)

Related Issue

None (internal defect found by recon; no issue was opened for it).

Changes

• ui/js/app.js
  • refreshDashboard() is now the single writer of Live.dashboard (the C2131 discipline: a shared slot may have exactly one writer).
  • loadDashboard() and loadWallet() each await refreshDashboard(); — a view loads what it renders.
• src/state_gate.rs — new invariant every_view_branch_loads_each_slot_its_renderer_reads: for every Live slot S and every renderView branch B, if anyone in B's render closure (transitive calls of render…) reads Live.S, then someone in B's loader closure (transitive calls of load… ∪ the session-level loadSession closure) must write Live.S. Crediting loadSession covers the session-level slots (models, publicUrl) with zero exemption list.
  • the_slot_closure_scanners_have_teeth proves the discriminators on synthetic input: transitive closure across functions, identifier boundaries (Live.dashboardTrend is not Live.dashboard), // and /* */ comments must not create phantom reads, a loader that only writes its own slot must be red, and an indirect write through a helper must be green.
• ui/README.md — a new convention section ("渲染谁就装载谁"), including why a refresh does not reproduce it.
• ui/index.html — app.js cache-bust bumped to 20260915-8.

A/B evidence (in-place mutation, md5-verified restore):

tree	cargo test gate	jsdom probe
pre-change (91a2da1)	RED, exactly one failure: renderWallet() reads Live.dashboard … branch wallet	red on both defect legs
competing fix "prettier empty state"	RED	red (X1/X3/X4; the "no empty-state copy" check passes by construction)
competing fix "reuse Live.wallet's month_use/month_earn"	RED	red (all four)
this branch	green (8/8 gate tests)	53/53 expectations met, exit 0

The instrument (jsdom, real index.html + the four real scripts, only fetch stubbed, driving the real login form / real logout button / real navigation) declares each leg's expectation, so "the defect is visible as intended" and "the fix did not work" cannot be confused.

Tests

• cargo test 全部通过 (277 passed; state_gate 8/8)
• cargo fmt --check 通过
• 新增/更新了单元测试 (two new tests in src/state_gate.rs)

Checklist

• 分支命名符合约定 (fix/)
• Commit message 使用 Conventional Commits 格式
• 单一职责，改动最小化