[ymote]

Adds sys.digest(app:, id:, fields:) to the L0 source catalog. It's the host-resolved source that OctoSense ADR 0002 §7 ("Cards", item 1) and milestone M4 describe. With it, a glance card binds to a digest the host holds for its own app, with provenance, and doesn't carry the findings as text.

What changes

• Catalog (catalog::SOURCES, ANSWERS, docs/ui-l0-constructors.toml): args app, id, fields. It returns one record whose shape doesn't depend on the template that produced the digest:
  • status: ready, partial, failed, missing or expired
  • topic, language, summary, retrieved_at, count
  • points: rows {id, text, label, cite, citations}. citations are indexes into sources, and cite is the same list as 1-based text.
  • sources: rows {id, n, title, source, url, published_at}
  • Row fields are pooled with the record's in fields:, the same way sys.weather's days are.
• Checker: app is required and must be a literal app id. The host compares it with the publishing app, which is the caller and never an argument, so a card can't compute it. id is required. It can be a literal in the run-id charset [A-Za-z0-9_-]{1,64} (so it can't be a path to a file) or a path into state.
• Host-answered only (§5.11): makepad::vm_call returns None. every_offered_field_has_a_translation now has a HOST_ONLY list and asserts that such a capability never gains a lowering.
• Read-only: it isn't in MUTABLE.
• Docs: new profile §5.14 covers whose digest a card can read, the shape, that links come only from sources, and that a missing or expired digest resolves to an empty record with $state .failed.

The OctoSense glance service implements the resolver, together with retention, expiry and size caps, in a follow-up draft PR that pins this branch.

Tests

• cargo test -p octoscript-ui-l0 passes. New tests/digest.rs and fixture digest.card cover admission, the source plan, realization with a ready digest and a missing one, the argument rules (required, literal app, no traversal, id from state), read-only status, and that there's no backend call.
• cargo clippy -p octoscript-ui-l0 --all-targets --all-features -- -D warnings and cargo fmt --check are clean.

🤖 Generated with Claude Code