The sky above is drawn, every frame, by a tiny WASM cell whose entire world is 15 drawing verbs plus the pointer. It cannot fetch, cannot read this page, cannot learn where you are. Your location comes from your browser's geolocation (only if you allow it) or your timezone — and even then only the host shell sees it; the cell cannot. The trusted host shell (this page) fetches your city's weather through a two-host allowlist (open-meteo) and hands the cell plain numbers — the cell never touches the network. The source is open on purpose: read it, even edit the seed to call fetch() — it is still refused.