pull down to refresh

maybe WASM sandboxing, or openbsd security model inspo