Bumps androidx.core:core-ktx from 1.17.0 to 1.19.0.

---
updated-dependencies:
- dependency-name: androidx.core:core-ktx
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps androidx.navigation:navigation-fragment-ktx from 2.9.6 to 2.10.0.

---
updated-dependencies:
- dependency-name: androidx.navigation:navigation-fragment-ktx
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps androidx.navigation:navigation-ui-ktx from 2.9.6 to 2.10.0.

---
updated-dependencies:
- dependency-name: androidx.navigation:navigation-ui-ktx
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 8.13 to 9.7.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](https://github.com/gradle/gradle/compare/v8.13.0...v9.7.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps androidx.appcompat:appcompat from 1.7.1 to 1.8.0.

---
updated-dependencies:
- dependency-name: androidx.appcompat:appcompat
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps androidx.constraintlayout:constraintlayout from 2.2.1 to 2.2.2.

---
updated-dependencies:
- dependency-name: androidx.constraintlayout:constraintlayout
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: nullun <git@nullun.com>

Co-authored-by: nullun <git@nullun.com>

**S7.** The S6 fix mirrored `_assert_group_is_clean` into the browser, and the
mirror was faithful and insufficient. That guard checks hygiene - rekey, close,
group fee - and hygiene is not what a hostile conversion violates. A plain
asset transfer of the whole balance to a stranger carries no close, no rekey
and an ordinary fee, and passed the mirror completely.

The contract does not check `aamt` or `arcv` either, and does not need to: on a
routed group the rest of it checks - the input proven spent, the co-signed
floor, the pinned pools - and none of that runs unless the router is called. So
the mirror had copied the cheap outer shell and left out the part doing the
work. The two exempt entry points say the same thing from the other side:
`pool_budget` and `verify_discount` skip the hygiene guard precisely because
they ride alongside a route, so hygiene alone was never the safety argument.

`routedGroupProblems` now also requires a call to the router whose ARC-4
selector is not one of those two - "calls the router" would have passed
`[pool_budget, transfer-to-attacker]`, which calls the router and is checked by
nothing. The app id comes from `data-router-app`, handed down by the view and
overridable by a setting, with the same number in the widget as a fallback so a
missing attribute cannot switch the rule off. Not from the plan response: an id
the engine supplied would make the check agree with whatever the engine wanted,
which is S2 for the third time. The two excluded selectors are recomputed from
the method signatures by verify-sweep.sh rather than trusted as constants.

All four router groups in the audit's evidence carry non-exempt selectors, so
the rule accepts every conversion that has actually executed.

It also caught a test that had gone quiet. "Accepting implies no transaction
closes or rekeys" became vacuous the moment this landed - no corpus transaction
is an application call, so every generated group was refused for that reason
and the implication was never exercised. It now prefixes a real route call and
asserts that something really was accepted.

**S2 recommendation 2.** The row showed unit, id, badge, value and reason and
never the address the tokens went to, so on the one disposition that gives
something away the destination was the single fact the reader was not shown.
`destinationLabel` is the pure half, tested; `renderLine` only appends it. A
close says plainly that nothing leaves, because a blank cell there reads as a
missing fact rather than as reassurance. The audit is explicit that this
complements the chain lookup rather than replacing it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XqeQenXa9oWnLCWEvuiy8B