From 5daa4d6d0e1f8df2a0c940b996132056571d8f15 Mon Sep 17 00:00:00 2001
From: ymote <151983+ymote@users.noreply.github.com>
Date: Thu, 1 Oct 2026 08:58:31 -0700
Subject: [PATCH 1/3] glance: resolve sys.digest sources from the host's
 digests (ADR 0002 M4)

A glance card may declare `sys.digest(app:, id:)` (Octoscript #40); the
glance service fills it in when it realizes the card, from the toolbox run
results the host keeps for the calling app, instead of the card carrying
the findings as text.

- glance_digest.rs: reads `<apps root>/.host/toolbox/<app>/toolbox/runs/
  <template>/<run>.json` (host-owned, outside the app's jail, so an app
  cannot forge a digest) and returns one template-independent record:
  status, topic, language, summary, retrieved_at, count, points {id, text,
  label, cite, citations: [source index]}, sources {id, n, title, source,
  url, published_at}. A source is kept only if the run's host provenance
  lists its id with the same http(s) URL; a point only if it still cites a
  kept source; model text with a URL is dropped. Caps on the file (512 KiB)
  and every field. Missing, expired (48 h after the run), malformed or
  failed digests resolve to an empty record with $state failed.
- glance.rs: `app` must be the caller (its id or launcher id), never an
  argument's say-so; the resolved value and $status replace anything the
  publisher sent; a bound card expires no later than its digest; after a
  publish, each template folder keeps its 8 newest results plus every run
  a live card binds.
- news-brief.card: the M4 News digest card bound to `sys.digest(app:
  "os.news", id: "glance")`; OCTOSENSE_GLANCE_DEMO=digest publishes it.
- Octoscript #40 (sys.digest) is already in main's pins (Octoscript
  5991dfae, Octoscript-Makepad 8f103d0c); rebased onto main, the PR's own
  repin commits are dropped.
- Rebased onto main: composes with the in-card sys.chat (glance_chat.rs):
  digests resolve into the card's data first, then its chat is seeded and
  the card lowered; the card keeps both its digests and its L0 source.
- glance_digest::digest_root reads under the host storage's apps root
  (octosense_ai_host::toolbox_root), where the toolbox writes its runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../glance/fixtures/news-digest-run.json      | 123 ++++
 crates/shell/resources/glance/news-brief.card |  47 ++
 .../shell/resources/glance/news-digest.card   |   4 +-
 crates/shell/src/glance.rs                    | 200 ++++++-
 crates/shell/src/glance_digest.rs             | 531 ++++++++++++++++++
 crates/shell/src/lib.rs                       |   1 +
 phone/docs/makepad-fork.md                    |   2 +-
 7 files changed, 895 insertions(+), 13 deletions(-)
 create mode 100644 crates/shell/resources/glance/fixtures/news-digest-run.json
 create mode 100644 crates/shell/resources/glance/news-brief.card
 create mode 100644 crates/shell/src/glance_digest.rs

diff --git a/crates/shell/resources/glance/fixtures/news-digest-run.json b/crates/shell/resources/glance/fixtures/news-digest-run.json
new file mode 100644
index 00000000..f34499d8
--- /dev/null
+++ b/crates/shell/resources/glance/fixtures/news-digest-run.json
@@ -0,0 +1,123 @@
+{
+  "run_id": "glance",
+  "app_id": "os.news",
+  "template": {
+    "id": "news-digest",
+    "version": "1.1.0",
+    "digest": "92ab809c79d8b83c370efeb37b9a7c6de632d313c45456fd1e91e45c43261f02"
+  },
+  "status": "ready",
+  "data": {
+    "digest": {
+      "language": "en",
+      "points": [
+        {
+          "citations": [
+            "s72ee00603e06"
+          ],
+          "text": "Harbor City's council approved an order for 120 electric buses on Tuesday."
+        },
+        {
+          "citations": [
+            "s39327104dbcc"
+          ],
+          "text": "Ocho bibliotecas de Puerto Claro abrirán los domingos durante un programa piloto de tres meses."
+        },
+        {
+          "citations": [
+            "s3820b1dec583"
+          ],
+          "text": "Clearwater Utilities reported that a six-month sensor pilot detected 43 underground leaks across two districts."
+        }
+      ],
+      "summary": "Sources: Harbor City approves electric bus order; Ocho bibliotecas amplían su horario durante un piloto; Water utility reports early leak-detection results",
+      "task": "digest"
+    },
+    "language": "en",
+    "missing": 0,
+    "sources": [
+      {
+        "evidence_sha256": "d7006e8135e503bb16aedc89b4f5e6848da09c42d82097795a84fcbc609d8ba8",
+        "id": "s72ee00603e06",
+        "published_at": "2026-09-19T10:00:00Z",
+        "source": "Harbor Daily",
+        "title": "Harbor City approves electric bus order",
+        "url": "https://example.invalid/news/buses"
+      },
+      {
+        "evidence_sha256": "fb9bd23cf16648691f79ed6f64b5add1fb35506cf838dac8785f428be7c102bd",
+        "id": "s39327104dbcc",
+        "published_at": "2026-09-19T08:30:00Z",
+        "source": "Diario de Puerto Claro",
+        "title": "Ocho bibliotecas amplían su horario durante un piloto",
+        "url": "https://example.invalid/news/libraries"
+      },
+      {
+        "evidence_sha256": "1464f7fa5fe6edd95282a0f93cd0a62d0ad8cfcfb6d9271303d79bc3e0b6c2b1",
+        "id": "s3820b1dec583",
+        "published_at": "2026-09-18T16:00:00Z",
+        "source": "Clearwater Courier",
+        "title": "Water utility reports early leak-detection results",
+        "url": "https://example.invalid/news/water"
+      }
+    ],
+    "topic": "city infrastructure",
+    "unreadable": 0
+  },
+  "provenance": [
+    {
+      "id": "s72ee00603e06",
+      "url": "https://example.invalid/news/buses",
+      "title": "Harbor City approves electric bus order",
+      "source": "Harbor Daily",
+      "language": "en",
+      "published_at": "2026-09-19T10:00:00Z",
+      "retrieved_at": "2026-09-20T08:00:01Z",
+      "evidence_sha256": "d7006e8135e503bb16aedc89b4f5e6848da09c42d82097795a84fcbc609d8ba8",
+      "via": "article"
+    },
+    {
+      "id": "s39327104dbcc",
+      "url": "https://example.invalid/news/libraries",
+      "title": "Ocho bibliotecas amplían su horario durante un piloto",
+      "source": "Diario de Puerto Claro",
+      "language": "en",
+      "published_at": "2026-09-19T08:30:00Z",
+      "retrieved_at": "2026-09-20T08:00:02Z",
+      "evidence_sha256": "fb9bd23cf16648691f79ed6f64b5add1fb35506cf838dac8785f428be7c102bd",
+      "via": "article"
+    },
+    {
+      "id": "s3820b1dec583",
+      "url": "https://example.invalid/news/water",
+      "title": "Water utility reports early leak-detection results",
+      "source": "Clearwater Courier",
+      "language": "en",
+      "published_at": "2026-09-18T16:00:00Z",
+      "retrieved_at": "2026-09-20T08:00:03Z",
+      "evidence_sha256": "1464f7fa5fe6edd95282a0f93cd0a62d0ad8cfcfb6d9271303d79bc3e0b6c2b1",
+      "via": "article"
+    }
+  ],
+  "diagnostics": [],
+  "stats": {
+    "calls": 7,
+    "model_calls": 1,
+    "pages": 3,
+    "search_fetches": 2,
+    "denied": 0,
+    "failed": 0,
+    "peak_concurrency": 3,
+    "elapsed_ms": 412.0
+  },
+  "trace": [
+    {
+      "event": "start",
+      "call": 0,
+      "tool": "research.search",
+      "ms": 0.0
+    }
+  ],
+  "started_at": "2026-09-20T08:00:00Z",
+  "result_path": "toolbox/runs/news-digest/glance.json"
+}
diff --git a/crates/shell/resources/glance/news-brief.card b/crates/shell/resources/glance/news-brief.card
new file mode 100644
index 00000000..2fe3f7df
--- /dev/null
+++ b/crates/shell/resources/glance/news-brief.card
@@ -0,0 +1,47 @@
+# ledger news.brief@1.0.0
+# level:   L0
+# profile: ui/l0
+#
+# The News digest card on the glance screen (ADR 0002 M4). The card carries
+# no finding of its own: the summary, the points, their citations and every
+# source come from `sys.digest`, which the shell resolves from the digest it
+# holds for the publishing app (glance_digest.rs). News's agent runs the
+# `news-digest` workflow with the run id `glance`, so each run replaces the
+# digest this card binds, and republishes the card.
+
+source brief sys.digest(app: "os.news", id: "glance",
+                        fields: [topic, summary, points, sources,
+                                 id, text, cite, n, title, source])
+
+copy label   { class: vocabulary, en: "NEWS DIGEST", zh: "新闻摘要" }
+copy nothing { class: vocabulary, en: "No digest yet. News will brief you after its next read.", zh: "暂无摘要。新闻读完下一批后会为你汇总。" }
+copy sources { class: vocabulary, en: "SOURCES", zh: "来源" }
+
+view root  Surface(pad: .page) {
+             Col(gap: 6) {
+               Row(gap: 8) {
+                 TextCaption(text: copy.label, width: .fill)
+                 TextCaption(text: brief.topic)
+               }
+               when brief.$state == .failed { TextBody(text: copy.nothing, width: .fill) }
+               when brief.$state == .ready {
+                 Col(gap: 6) {
+                   TextBody(text: brief.summary, width: .fill)
+                   for p in brief.points key p.id {
+                     Row(gap: 8) {
+                       TextRow(text: p.text, width: .fill)
+                       TextCaption(text: p.cite)
+                     }
+                   }
+                   TextCaption(text: copy.sources)
+                   for s in brief.sources key s.id {
+                     Row(gap: 8) {
+                       TextCaption(text: s.n)
+                       TextCaption(text: s.source)
+                       TextCaption(text: s.title, width: .fill)
+                     }
+                   }
+                 }
+               }
+             }
+           }
diff --git a/crates/shell/resources/glance/news-digest.card b/crates/shell/resources/glance/news-digest.card
index b524793c..b0f0f234 100644
--- a/crates/shell/resources/glance/news-digest.card
+++ b/crates/shell/resources/glance/news-digest.card
@@ -5,8 +5,8 @@
 # The News digest on the glance screen (OctoSense #63): a test fixture the
 # shell publishes as `os.news` under OCTOSENSE_GLANCE_DEMO=1. Every value is
 # a source the publisher supplies in `data`; the card states nothing else.
-# The sources are the catalogued News digest helpers; the `sys.digest(app:)`
-# source ADR 0002 names is not in the pinned L0 catalog yet.
+# The sources are the catalogued News digest helpers, fed by the publisher;
+# news-brief.card is the same card bound to a host-held `sys.digest`.
 
 source status   sys.news_status(fields: [message, count])
 source stories  sys.news_digest(count: 3, fields: [id, title, publisher])
diff --git a/crates/shell/src/glance.rs b/crates/shell/src/glance.rs
index 9a0f0734..1dc23e94 100644
--- a/crates/shell/src/glance.rs
+++ b/crates/shell/src/glance.rs
@@ -28,7 +28,11 @@
 //!   no logic, as a card bundle is. A `sys.chat` source (an in-card chat
 //!   with the app's agent) must name the publishing app, and the host
 //!   answers it from its own transcript, whatever `data` says
-//!   (glance_chat.rs). An L2 `source` is refused: it cannot be
+//!   (glance_chat.rs). A `sys.digest(app:, id:)` source is not the
+//!   publisher's to supply either: the shell resolves it from the digests
+//!   it holds for the calling app, and a card naming another app is refused
+//!   (glance_digest.rs). A card bound to a current digest expires no later
+//!   than the digest does. An L2 `source` is refused: it cannot be
 //!   lowered, and a card that needs handlers and host requests is a
 //!   `script`.
 //! - `script`: a Splash program, the same thing a script app's `main.splash`
@@ -75,6 +79,7 @@
 //! ([`shown`]).
 use serde_json::{json, Value};
 use std::collections::VecDeque;
+use std::path::PathBuf;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, Mutex};
 
@@ -150,6 +155,9 @@ pub struct GlanceCard {
     /// The publisher is a contained app: its tile runs under that app's
     /// resolved policy. A native module's tile runs with no grants.
     pub contained: bool,
+    /// The digest run ids the card binds (`sys.digest`), kept from pruning
+    /// while the card is live.
+    pub digests: Vec<String>,
     /// For a `source` card, the L0 card and its data as published: the card
     /// window (glance_sheet.rs) carries out its taps against them and
     /// re-lowers. `None` for a `script` card.
@@ -174,6 +182,9 @@ impl GlanceCard {
 pub struct GlanceStore {
     cards: Vec<GlanceCard>,
     publishes: Vec<(String, VecDeque<u64>)>,
+    /// Where the host keeps each app's toolbox folder (`sys.digest`); no
+    /// digest resolves without one.
+    digest_root: Option<PathBuf>,
 }
 
 fn text<'a>(args: &'a Value, key: &str) -> Option<&'a str> {
@@ -195,7 +206,67 @@ pub fn check_level(source: &str) -> Result<(), String> {
     Ok(())
 }
 
+/// The card's `sys.digest` sources, resolved for `caller` into `data`: the
+/// value under the source's name and its lifecycle under `$status`, both
+/// replacing anything the publisher sent. Returns the bound run ids and the
+/// earliest expiry of a current digest.
+fn resolve_digests(caller: &Caller, source: &str, data: &mut Value, root: Option<&std::path::Path>, now_ms: u64) -> Result<(Vec<String>, Option<u64>), String> {
+    use octoscript_ui_l0::SourceArg;
+    let plan = octoscript_ui_l0::source_plan(source);
+    let mut ids = Vec::new();
+    let mut expires: Option<u64> = None;
+    for request in plan.requests.iter().filter(|r| r.helper == "sys.digest") {
+        let arg = |name: &str| request.args.iter().find(|(n, _)| n == name).map(|(_, a)| a);
+        match arg("app") {
+            Some(SourceArg::Text(app)) if app == caller.app() || app == caller.launch_id() => {}
+            _ => return Err(format!("a card binds only its own app's digests: `sys.digest(app:)` must be {:?}", caller.app())),
+        }
+        let id = match arg("id") {
+            Some(SourceArg::Text(id)) => id.clone(),
+            // An id kept in card state: its declared initial.
+            Some(SourceArg::Path(path)) => match path.strip_prefix("state.") {
+                Some(state) => octoscript_ui_l0::state_initials(source).get(state).and_then(Value::as_str).unwrap_or("").to_string(),
+                None => path.split('.').try_fold(&*data, |v, k| v.get(k)).and_then(Value::as_str).unwrap_or("").to_string(),
+            },
+            _ => String::new(),
+        };
+        let resolved = crate::glance_digest::resolve(root, caller.app(), &id, now_ms);
+        if let Some(at) = resolved.expires_ms {
+            expires = Some(expires.map_or(at, |e| e.min(at)));
+        }
+        if crate::glance_digest::valid_id(&id) && !ids.contains(&id) {
+            ids.push(id);
+        }
+        let Some(fields) = data.as_object_mut() else { return Err("data must be an object of source values".into()) };
+        // A dotted source name navigates the data, as realization reads it.
+        let mut segments: Vec<&str> = request.name.split('.').collect();
+        let last = segments.pop().unwrap_or_default();
+        let mut at = fields;
+        for segment in segments {
+            let slot = at.entry(segment.to_string()).or_insert_with(|| json!({}));
+            if !slot.is_object() {
+                *slot = json!({});
+            }
+            at = slot.as_object_mut().expect("an object");
+        }
+        at.insert(last.to_string(), resolved.value);
+        let status = data.as_object_mut().expect("an object").entry("$status").or_insert_with(|| json!({}));
+        if !status.is_object() {
+            *status = json!({});
+        }
+        status[request.name.as_str()] = json!(resolved.state);
+    }
+    Ok((ids, expires))
+}
+
 impl GlanceStore {
+    /// A store whose `sys.digest` sources resolve under `root`
+    /// (`<root>/<app>/toolbox/runs/…`, glance_digest.rs).
+    pub fn with_digest_root(mut self, root: Option<PathBuf>) -> Self {
+        self.digest_root = root;
+        self
+    }
+
     /// `glance.publish`, for `caller`, at `now_ms`.
     pub fn publish(&mut self, caller: &Caller, args: &Value, now_ms: u64) -> Result<Value, String> {
         self.expire(now_ms);
@@ -230,7 +301,7 @@ impl GlanceStore {
         if kind == "script" && args.get("data").is_some_and(|d| !d.is_null()) {
             return Err("data is for a source card; a script carries its own values".into());
         }
-        let data = args.get("data").cloned().unwrap_or_else(|| json!({}));
+        let mut data = args.get("data").cloned().unwrap_or_else(|| json!({}));
         if !data.is_object() {
             return Err("data must be an object of source values".into());
         }
@@ -266,27 +337,33 @@ impl GlanceStore {
         // Charged before the costly part (check, realize, lower), so a
         // stream of refused cards is bounded too.
         self.charge(&app, now_ms)?;
-        let body: Arc<str> = if kind == "script" {
-            source.into()
+        let (body, digests, digest_expires): (Arc<str>, Vec<String>, Option<u64>) = if kind == "script" {
+            (source.into(), Vec::new(), None)
         } else {
             check_level(source)?;
+            // A card's `sys.digest` values are the host's (glance_digest.rs),
+            // resolved into the data the card keeps.
+            let (digests, digest_expires) = resolve_digests(caller, source, &mut data, self.digest_root.as_deref(), now_ms)?;
             // A card's `sys.chat` is its own app's (glance_chat.rs), and its
             // transcript is the host's, never the data's.
             crate::glance_chat::check_publisher(source, &app)?;
             let seeded = crate::glance_chat::seed(&app, source, &data, &Default::default());
-            crate::glance_card::lower(source, &seeded)?.into()
+            (crate::glance_card::lower(source, &seeded)?.into(), digests, digest_expires)
         };
+        let binds_digests = !digests.is_empty();
         let card = GlanceCard {
             app: app.clone(),
             card_id: card_id.to_string(),
             title: title.to_string(),
             priority,
             published_ms: now_ms,
-            expires_ms: now_ms + expires_s * 1000,
+            // Never past the digest it shows.
+            expires_ms: digest_expires.map_or(now_ms + expires_s * 1000, |d| d.min(now_ms + expires_s * 1000)),
             open_app: caller.launch_id().to_string(),
             route,
             body,
             contained: matches!(caller, Caller::Contained { .. }),
+            digests,
             l0: (kind == "source").then(|| Arc::new(L0Source { source: source.to_string(), data })),
         };
         let expires_at = card.expires_ms;
@@ -300,9 +377,21 @@ impl GlanceStore {
                 self.cards.remove(i);
             }
         }
+        if binds_digests {
+            self.retain_digests(&app);
+        }
         Ok(json!({"card_id": card_id, "replaced": replacing.is_some(), "expires_at": expires_at}))
     }
 
+    /// Digest retention for `app` (glance_digest.rs): each template folder
+    /// keeps its newest results and every run a live card of the app binds.
+    /// Called after a publish that binds digests.
+    fn retain_digests(&self, app: &str) {
+        let Some(root) = &self.digest_root else { return };
+        let pinned: Vec<String> = self.cards.iter().filter(|c| c.app == app).flat_map(|c| c.digests.iter().cloned()).collect();
+        crate::glance_digest::retain(root, app, &pinned);
+    }
+
     /// Count one publish against `app`'s window, or refuse it.
     fn charge(&mut self, app: &str, now_ms: u64) -> Result<(), String> {
         let at = match self.publishes.iter().position(|(a, _)| a == app) {
@@ -477,7 +566,7 @@ pub fn now_ms() -> u64 {
 
 fn with_store<R>(f: impl FnOnce(&mut GlanceStore) -> R) -> R {
     let mut guard = STORE.lock().unwrap();
-    f(guard.get_or_insert_with(GlanceStore::default))
+    f(guard.get_or_insert_with(|| GlanceStore::default().with_digest_root(crate::glance_digest::digest_root())))
 }
 
 fn changed() {
@@ -718,12 +807,17 @@ const DEMO_NOTICES: &[(&str, &str, &str, &str)] = &[
     ("os.calendar", "standup", "Standup moved", "Tomorrow's standup is at 9:30 instead of 9:00."),
 ];
 
+/// The News digest card (M4), bound to the digest the shell holds for
+/// `os.news` under the run id `glance` (glance_digest.rs).
+pub const NEWS_BRIEF_CARD: &str = include_str!("../resources/glance/news-brief.card");
+
 /// `OCTOSENSE_GLANCE_DEMO`, once, at startup (a test path; nothing publishes
 /// these otherwise): `mail` publishes the fake Mail cards as `os.mail`, each
 /// with a notification; `many` adds notices from five more apps and the News
 /// digest (eight cards, seven notifications: the panel's overflow and the
-/// toasts' cap); any other value but `0` publishes the sample News digest
-/// as `os.news`.
+/// toasts' cap); `digest` publishes [`NEWS_BRIEF_CARD`] as `os.news`, bound
+/// to `<apps root>/.host/toolbox/os.news/toolbox/runs/*/glance.json`; any
+/// other value but `0` publishes the sample News digest as `os.news`.
 pub fn publish_demo_if_asked() {
     static ONCE: std::sync::Once = std::sync::Once::new();
     ONCE.call_once(|| {
@@ -750,7 +844,7 @@ pub fn publish_demo_if_asked() {
                 }
             }
         }
-        let (source, data) = demo_digest();
+        let (source, data) = if demo == "digest" { (NEWS_BRIEF_CARD.to_string(), json!({})) } else { demo_digest() };
         let args = json!({
             "card_id": "digest", "title": "News digest", "source": source, "data": data,
             "priority": 70, "open": {"app": "news"}
@@ -842,6 +936,92 @@ mod tests {
         }
     }
 
+    mod digest {
+        use super::*;
+        use crate::glance_digest::tests::{news_digest_result, now, root_with};
+
+        fn brief(card: &str) -> Value {
+            json!({"card_id": "brief", "title": "News digest", "source": card, "open": {"app": "news"}})
+        }
+
+        #[test]
+        fn a_digest_card_shows_the_digest_the_host_holds() {
+            let root = root_with("glance-bound", &[("os.news", "news-digest", news_digest_result())]);
+            let mut store = GlanceStore::default().with_digest_root(Some(root));
+            let mut args = brief(NEWS_BRIEF_CARD);
+            // The publisher cannot supply the digest: its value is replaced.
+            args["data"] = json!({"brief": {"summary": "Forged", "points": [], "sources": []}, "$status": {"brief": "ready"}});
+            let ok = store.publish(&news(), &args, now()).unwrap();
+            let card = &store.shown(now(), SHOWN_CARDS)[0];
+            for want in ["Harbor City's council approved an order for 120 electric buses on Tuesday.", "Clearwater Courier", "city infrastructure", "SOURCES"] {
+                assert!(card.body.contains(want), "{want:?} not in {}", card.body);
+            }
+            assert!(!card.body.contains("Forged") && !card.body.contains("No digest yet"), "{}", card.body);
+            assert_eq!(card.digests, ["glance"]);
+            // The card expires with the digest (48 h from the run), not 24 h
+            // from now, whichever is sooner.
+            let digest_expires = crate::glance_digest::parse_rfc3339_ms("2026-09-20T08:00:00Z").unwrap() + crate::glance_digest::MAX_AGE_MS;
+            assert_eq!(ok["expires_at"], json!((now() + EXPIRES_DEFAULT_S * 1000).min(digest_expires)));
+            let mut long = brief(NEWS_BRIEF_CARD);
+            long["expires"] = json!(EXPIRES_MAX_S);
+            assert_eq!(store.publish(&news(), &long, now()).unwrap()["expires_at"], json!(digest_expires));
+        }
+
+        #[test]
+        fn a_card_binds_only_its_own_apps_digests() {
+            let root = root_with("glance-own", &[("os.news", "news-digest", news_digest_result())]);
+            let mut store = GlanceStore::default().with_digest_root(Some(root));
+            let other = NEWS_BRIEF_CARD.replace("app: \"os.news\"", "app: \"os.mail\"");
+            let err = store.publish(&news(), &brief(&other), now()).unwrap_err();
+            assert!(err.contains("own app's digests"), "{err}");
+            // Maps naming itself gets its own (empty) folder, never News's.
+            let maps = Caller::granted("os.maps");
+            let mut args = brief(&NEWS_BRIEF_CARD.replace("app: \"os.news\"", "app: \"os.maps\""));
+            args["open"] = Value::Null;
+            store.publish(&maps, &args, now()).unwrap();
+            let card = &store.shown(now(), SHOWN_CARDS)[0];
+            assert!(card.body.contains("No digest yet") && !card.body.contains("Harbor"), "{}", card.body);
+            // The launcher id names the publisher too.
+            let short = NEWS_BRIEF_CARD.replace("app: \"os.news\"", "app: \"news\"");
+            store.publish(&news(), &brief(&short), now()).unwrap();
+            assert!(store.shown(now(), SHOWN_CARDS).iter().any(|c| c.app == "os.news" && c.body.contains("Harbor")));
+        }
+
+        #[test]
+        fn a_missing_or_expired_digest_renders_the_cards_own_absence() {
+            let mut store = GlanceStore::default();
+            store.publish(&news(), &brief(NEWS_BRIEF_CARD), now()).unwrap();
+            let card = &store.shown(now(), SHOWN_CARDS)[0];
+            assert!(card.body.contains("No digest yet"), "{}", card.body);
+            assert_eq!(card.expires_ms, now() + EXPIRES_DEFAULT_S * 1000);
+            let root = root_with("glance-expired", &[("os.news", "news-digest", news_digest_result())]);
+            let mut store = GlanceStore::default().with_digest_root(Some(root));
+            let late = now() + crate::glance_digest::MAX_AGE_MS;
+            store.publish(&news(), &brief(NEWS_BRIEF_CARD), late).unwrap();
+            assert!(store.shown(late, SHOWN_CARDS)[0].body.contains("No digest yet"));
+        }
+
+        #[test]
+        fn publishing_a_digest_card_prunes_old_runs_but_not_bound_ones() {
+            let mut runs = vec![("os.news", "news-digest", news_digest_result())];
+            for i in 0..crate::glance_digest::KEEP_PER_TEMPLATE + 2 {
+                let mut r = news_digest_result();
+                r["run_id"] = json!(format!("r{i:02}"));
+                runs.push(("os.news", "news-digest", r));
+            }
+            let root = root_with("glance-retain", &runs);
+            let dir = root.join("os.news/toolbox/runs/news-digest");
+            // `glance` is the oldest file, yet a live card binds it.
+            let old = std::time::UNIX_EPOCH + std::time::Duration::from_secs(1);
+            std::fs::File::options().write(true).open(dir.join("glance.json")).unwrap().set_modified(old).unwrap();
+            let mut store = GlanceStore::default().with_digest_root(Some(root));
+            store.publish(&news(), &brief(NEWS_BRIEF_CARD), now()).unwrap();
+            let left = std::fs::read_dir(&dir).unwrap().count();
+            assert_eq!(left, crate::glance_digest::KEEP_PER_TEMPLATE + 1);
+            assert!(dir.join("glance.json").exists());
+        }
+    }
+
     #[test]
     fn a_contained_app_needs_the_glance_capability_whoever_it_is() {
         let mut store = GlanceStore::default();
diff --git a/crates/shell/src/glance_digest.rs b/crates/shell/src/glance_digest.rs
new file mode 100644
index 00000000..dc3aaf61
--- /dev/null
+++ b/crates/shell/src/glance_digest.rs
@@ -0,0 +1,531 @@
+//! `sys.digest(app:, id:)` for glance cards (ADR 0002 §7.1, M4): a card binds
+//! to a digest the host holds for its own app, with provenance, instead of
+//! carrying the findings as text.
+//!
+//! **Where digests live.** A digest is a system-toolbox run result
+//! (`crates/toolbox`, `RunOptions::write_result`) at
+//! `<app folder>/toolbox/runs/<template>/<run>.json`. The app folder the
+//! shell gives the toolbox is host-owned: `<apps root>/.host/toolbox/<app id>`
+//! ([`digest_root`]), outside the app's jail (`<apps root>/<app id>`). A file
+//! the app could write itself would let it forge a digest, citations and all,
+//! so the resolver never reads from the jail. The shell reads the file; it
+//! takes no crate dependency on the toolbox, only on the minimal shape below.
+//!
+//! **Binding.** `app` must name the PUBLISHER, which is the caller
+//! (`glance::Caller`), never an argument: the app's id or its launcher id
+//! (`news` for `os.news`). A card naming another app is refused at publish.
+//! `id` is a run id, `[A-Za-z0-9_-]{1,64}`, looked up under each of the app's
+//! template folders (the newest file wins when two templates share an id).
+//! The file's own `app_id` and `run_id` must agree. An agent that republishes
+//! the same card after each run uses a fixed caller-chosen run id (`glance`),
+//! so the file is replaced in place and the card's source does not change.
+//!
+//! **The value.** One shape, whatever template produced the run
+//! (news-digest's `data.digest`, topic-brief's `data.brief`, …):
+//!
+//! ```text
+//! {status, topic, language, summary, retrieved_at, count,
+//!  points:  [{id, text, label, cite, citations: [source index]}],
+//!  sources: [{id, n, title, source, url, published_at}]}
+//! ```
+//!
+//! `status` is the run's (`ready`, `partial`, `failed`) or the resolver's
+//! (`missing`, `expired`); the card's `$state` is `.ready` for a ready or
+//! partial run and `.failed` otherwise, and a missing, expired or unreadable
+//! digest is an empty record, never an error that fails the card.
+//!
+//! **Provenance.** A source is kept only when the run's host-kept
+//! `provenance` lists its id with the same URL, and only an `http(s)` URL;
+//! a point is kept only when it still cites a kept source, and its
+//! `citations` become indexes into `sources` (`cite` is the same list,
+//! 1-based, as text: a card has no arithmetic). Model text (`summary`,
+//! `text`, `label`) never carries a URL: a point that does is dropped, a
+//! summary that does is emptied. Links come only from `sources[].url`.
+//!
+//! **Caps.** The file is read only up to [`FILE_MAX`]; [`POINTS_MAX`] points
+//! of [`TEXT_MAX`] characters, [`SOURCES_MAX`] sources, a [`SUMMARY_MAX`]
+//! summary; longer text is cut at a character boundary.
+//!
+//! **Expiry.** A digest is current for [`MAX_AGE_MS`] from the run's
+//! `started_at`; older, it resolves `expired`. A card bound to a current
+//! digest expires no later than the digest does.
+//!
+//! **Retention** ([`retain`]): after a card that binds digests is published,
+//! each of the app's template folders keeps its [`KEEP_PER_TEMPLATE`] newest
+//! results plus every run a live glance card of the app binds; the rest are
+//! deleted. Nothing else in the shell deletes run results.
+use serde_json::{json, Map, Value};
+use std::path::{Path, PathBuf};
+
+/// The largest run-result file read.
+pub const FILE_MAX: u64 = 512 * 1024;
+pub const SUMMARY_MAX: usize = 800;
+pub const POINTS_MAX: usize = 8;
+pub const TEXT_MAX: usize = 400;
+pub const LABEL_MAX: usize = 40;
+pub const SOURCES_MAX: usize = 8;
+pub const TITLE_MAX: usize = 200;
+pub const NAME_MAX: usize = 80;
+pub const URL_MAX: usize = 2048;
+pub const CITATIONS_MAX: usize = 8;
+/// Template folders scanned for one id.
+pub const TEMPLATES_MAX: usize = 64;
+/// How long a digest is current, from the run's start.
+pub const MAX_AGE_MS: u64 = 48 * 3600 * 1000;
+/// Results kept per template folder, besides those a live card binds.
+pub const KEEP_PER_TEMPLATE: usize = 8;
+
+/// A run id, as the toolbox validates it.
+pub fn valid_id(id: &str) -> bool {
+    !id.is_empty() && id.len() <= 64 && id.bytes().all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-'))
+}
+
+/// An app id that is safe as one path segment.
+fn valid_app(app: &str) -> bool {
+    !app.is_empty() && app.len() <= 64 && !app.starts_with('.') && app.bytes().all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-'))
+}
+
+/// Where the host keeps every app's toolbox folder: `<apps root>/.host/toolbox`
+/// (`octosense_ai_host::toolbox_root`), the folder the system toolbox writes
+/// its run results under (host_tools/toolbox.rs). None until the host's
+/// storage knows its apps root.
+pub fn digest_root() -> Option<PathBuf> {
+    crate::app_storage::host().map(|storage| octosense_ai_host::toolbox_root(storage.layout().apps_root()))
+}
+
+/// `<root>/<app>/toolbox/runs`.
+pub fn runs_dir(root: &Path, app: &str) -> Option<PathBuf> {
+    valid_app(app).then(|| root.join(app).join("toolbox").join("runs"))
+}
+
+/// A resolved digest: the value the card binds, and its lifecycle.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Resolved {
+    pub value: Value,
+    /// The `$status` token: `ready` or `failed`.
+    pub state: &'static str,
+    /// When the digest stops being current (ready digests only).
+    pub expires_ms: Option<u64>,
+}
+
+fn empty(status: &str) -> Resolved {
+    Resolved {
+        value: json!({"status": status, "topic": "", "language": "", "summary": "", "retrieved_at": "", "count": 0, "points": [], "sources": []}),
+        state: "failed",
+        expires_ms: None,
+    }
+}
+
+/// Resolve `app`'s digest `id` under `root` at `now_ms`. Never fails: a
+/// digest that is missing, expired, oversized or malformed is an empty
+/// record whose `status` says which.
+pub fn resolve(root: Option<&Path>, app: &str, id: &str, now_ms: u64) -> Resolved {
+    let Some(runs) = root.and_then(|r| runs_dir(r, app)) else {
+        return empty("missing");
+    };
+    if !valid_id(id) {
+        return empty("missing");
+    }
+    let Some(path) = find(&runs, id) else {
+        return empty("missing");
+    };
+    let Some(result) = read(&path) else {
+        return empty("failed");
+    };
+    if result.get("app_id").and_then(Value::as_str) != Some(app) || result.get("run_id").and_then(Value::as_str) != Some(id) {
+        return empty("failed");
+    }
+    let started = result.get("started_at").and_then(Value::as_str).and_then(parse_rfc3339_ms);
+    let Some(started) = started else {
+        return empty("failed");
+    };
+    let expires = started.saturating_add(MAX_AGE_MS);
+    if expires <= now_ms {
+        return empty("expired");
+    }
+    normalize(&result, expires)
+}
+
+/// The newest `<runs>/<template>/<id>.json`.
+fn find(runs: &Path, id: &str) -> Option<PathBuf> {
+    let name = format!("{id}.json");
+    let mut best: Option<(std::time::SystemTime, PathBuf)> = None;
+    for entry in std::fs::read_dir(runs).ok()?.flatten().take(TEMPLATES_MAX) {
+        let path = entry.path().join(&name);
+        // No symlinks: the file must be the host's own, where it says it is.
+        let Ok(meta) = std::fs::symlink_metadata(&path) else { continue };
+        if !meta.is_file() || !entry.file_type().is_ok_and(|t| t.is_dir()) {
+            continue;
+        }
+        let modified = meta.modified().unwrap_or(std::time::UNIX_EPOCH);
+        if best.as_ref().is_none_or(|(t, _)| modified > *t) {
+            best = Some((modified, path));
+        }
+    }
+    best.map(|(_, p)| p)
+}
+
+fn read(path: &Path) -> Option<Value> {
+    use std::io::Read;
+    let file = std::fs::File::open(path).ok()?;
+    if file.metadata().ok()?.len() > FILE_MAX {
+        return None;
+    }
+    let mut text = String::new();
+    file.take(FILE_MAX + 1).read_to_string(&mut text).ok()?;
+    serde_json::from_str(&text).ok()
+}
+
+fn contains_url(text: &str) -> bool {
+    let lower = text.to_ascii_lowercase();
+    lower.contains("http://") || lower.contains("https://") || lower.contains("www.")
+}
+
+fn cut(text: &str, max: usize) -> String {
+    let text = text.trim();
+    match text.char_indices().nth(max) {
+        Some((at, _)) => format!("{}…", text[..at].trim_end()),
+        None => text.to_string(),
+    }
+}
+
+fn string(value: &Value, key: &str) -> String {
+    value.get(key).and_then(Value::as_str).unwrap_or("").to_string()
+}
+
+/// The template-independent record from one run result.
+fn normalize(result: &Value, expires_ms: u64) -> Resolved {
+    let status = match result.get("status").and_then(Value::as_str) {
+        Some(s @ ("ready" | "partial" | "failed")) => s,
+        _ => return empty("failed"),
+    };
+    let data = result.get("data").cloned().unwrap_or(Value::Null);
+    // The template's findings: news-digest's `digest`, topic-brief's
+    // `brief`, or a template whose data is the findings itself.
+    let findings = ["digest", "brief"].iter().find_map(|k| data.get(*k).filter(|v| v.is_object())).cloned().unwrap_or_else(|| if data.get("points").is_some() { data.clone() } else { Value::Null });
+
+    // Host-kept provenance: id -> (url, retrieved_at).
+    let provenance: Vec<(String, String, String)> = result
+        .get("provenance")
+        .and_then(Value::as_array)
+        .map(|p| p.iter().map(|e| (string(e, "id"), string(e, "url"), string(e, "retrieved_at"))).collect())
+        .unwrap_or_default();
+
+    let mut sources: Vec<Value> = Vec::new();
+    let mut ids: Vec<String> = Vec::new();
+    let mut retrieved: Option<(u64, String)> = None;
+    for s in data.get("sources").and_then(Value::as_array).into_iter().flatten() {
+        if sources.len() >= SOURCES_MAX {
+            break;
+        }
+        let (id, url) = (string(s, "id"), string(s, "url"));
+        let lower = url.to_ascii_lowercase();
+        if id.is_empty() || url.len() > URL_MAX || !(lower.starts_with("https://") || lower.starts_with("http://")) || ids.contains(&id) {
+            continue;
+        }
+        let Some((_, _, at)) = provenance.iter().find(|(pid, purl, _)| *pid == id && *purl == url) else { continue };
+        if let Some(ms) = parse_rfc3339_ms(at) {
+            if retrieved.as_ref().is_none_or(|(best, _)| ms > *best) {
+                retrieved = Some((ms, at.clone()));
+            }
+        }
+        ids.push(id.clone());
+        sources.push(json!({
+            "id": id,
+            "n": sources.len().saturating_add(1).to_string(),
+            "title": cut(&string(s, "title"), TITLE_MAX),
+            "source": cut(&string(s, "source"), NAME_MAX),
+            "url": url,
+            "published_at": cut(&string(s, "published_at"), 40),
+        }));
+    }
+
+    let mut points: Vec<Value> = Vec::new();
+    for p in findings.get("points").and_then(Value::as_array).into_iter().flatten() {
+        if points.len() >= POINTS_MAX {
+            break;
+        }
+        let text = string(p, "text");
+        let label = string(p, "label");
+        if text.trim().is_empty() || contains_url(&text) || contains_url(&label) {
+            continue;
+        }
+        let mut citations: Vec<usize> = Vec::new();
+        for c in p.get("citations").and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_str) {
+            if let Some(i) = ids.iter().position(|id| id == c) {
+                if !citations.contains(&i) && citations.len() < CITATIONS_MAX {
+                    citations.push(i);
+                }
+            }
+        }
+        if citations.is_empty() {
+            continue; // an uncited point states something no source backs
+        }
+        let cite = citations.iter().map(|i| (i + 1).to_string()).collect::<Vec<_>>().join(", ");
+        points.push(json!({
+            "id": format!("p{}", points.len() + 1),
+            "text": cut(&text, TEXT_MAX),
+            "label": cut(&label, LABEL_MAX),
+            "cite": cite,
+            "citations": citations,
+        }));
+    }
+
+    let summary = string(&findings, "summary");
+    let summary = if contains_url(&summary) { String::new() } else { cut(&summary, SUMMARY_MAX) };
+    let language = Some(string(&findings, "language")).filter(|l| !l.is_empty()).unwrap_or_else(|| string(&data, "language"));
+    let retrieved_at = retrieved.map(|(_, at)| at).unwrap_or_else(|| string(result, "started_at"));
+    let topic = string(&data, "topic");
+    let mut value = Map::new();
+    value.insert("status".into(), json!(status));
+    value.insert("topic".into(), json!(if contains_url(&topic) { String::new() } else { cut(&topic, TITLE_MAX) }));
+    value.insert("language".into(), json!(cut(&language, 16)));
+    value.insert("summary".into(), json!(summary));
+    value.insert("retrieved_at".into(), json!(retrieved_at));
+    value.insert("count".into(), json!(points.len()));
+    value.insert("points".into(), Value::Array(points));
+    value.insert("sources".into(), Value::Array(sources));
+    Resolved {
+        value: Value::Object(value),
+        state: if status == "failed" { "failed" } else { "ready" },
+        expires_ms: (status != "failed").then_some(expires_ms),
+    }
+}
+
+/// Keep each of `app`'s template folders to its [`KEEP_PER_TEMPLATE`]
+/// newest results plus the `pinned` run ids; delete the rest. Returns how
+/// many files went.
+pub fn retain(root: &Path, app: &str, pinned: &[String]) -> usize {
+    let Some(runs) = runs_dir(root, app) else { return 0 };
+    let Ok(templates) = std::fs::read_dir(&runs) else { return 0 };
+    let mut removed = 0;
+    for template in templates.flatten().take(TEMPLATES_MAX) {
+        if !template.file_type().is_ok_and(|t| t.is_dir()) {
+            continue;
+        }
+        let Ok(files) = std::fs::read_dir(template.path()) else { continue };
+        let mut results: Vec<(std::time::SystemTime, String, PathBuf)> = files
+            .flatten()
+            .filter_map(|f| {
+                let path = f.path();
+                let id = path.file_name()?.to_str()?.strip_suffix(".json")?.to_string();
+                let meta = std::fs::symlink_metadata(&path).ok()?;
+                (meta.is_file() && valid_id(&id)).then(|| (meta.modified().unwrap_or(std::time::UNIX_EPOCH), id, path))
+            })
+            .collect();
+        results.sort_by(|a, b| b.0.cmp(&a.0).then_with(|| b.1.cmp(&a.1)));
+        for (_, id, path) in results.into_iter().skip(KEEP_PER_TEMPLATE) {
+            if !pinned.contains(&id) && std::fs::remove_file(&path).is_ok() {
+                removed += 1;
+            }
+        }
+    }
+    removed
+}
+
+/// Milliseconds since the epoch for an RFC 3339 time (`Z` or an offset;
+/// fractional seconds kept to the millisecond). None when malformed.
+pub fn parse_rfc3339_ms(text: &str) -> Option<u64> {
+    let b = text.as_bytes();
+    if b.len() < 20 || b[4] != b'-' || b[7] != b'-' || !matches!(b[10], b'T' | b't' | b' ') || b[13] != b':' || b[16] != b':' {
+        return None;
+    }
+    let num = |from: usize, to: usize| -> Option<i64> { text.get(from..to)?.parse::<i64>().ok() };
+    let (year, month, day) = (num(0, 4)?, num(5, 7)?, num(8, 10)?);
+    let (hour, minute, second) = (num(11, 13)?, num(14, 16)?, num(17, 19)?);
+    if !(1..=12).contains(&month) || !(1..=31).contains(&day) || hour > 23 || minute > 59 || second > 60 {
+        return None;
+    }
+    let mut rest = &text[19..];
+    let mut millis = 0i64;
+    if let Some(frac) = rest.strip_prefix('.') {
+        let digits = frac.bytes().take_while(u8::is_ascii_digit).count();
+        if digits == 0 {
+            return None;
+        }
+        let ms = format!("{:0<3}", &frac[..digits.min(3)]);
+        millis = ms.parse().ok()?;
+        rest = &frac[digits..];
+    }
+    let offset_s = match rest {
+        "Z" | "z" => 0,
+        _ if rest.len() == 6 && matches!(rest.as_bytes()[0], b'+' | b'-') && rest.as_bytes()[3] == b':' => {
+            let sign = if rest.starts_with('-') { -1 } else { 1 };
+            sign * (rest.get(1..3)?.parse::<i64>().ok()? * 3600 + rest.get(4..6)?.parse::<i64>().ok()? * 60)
+        }
+        _ => return None,
+    };
+    // Days from the civil date (Howard Hinnant's algorithm).
+    let y = if month <= 2 { year - 1 } else { year };
+    let era = y.div_euclid(400);
+    let yoe = y - era * 400;
+    let mp = (month + 9) % 12;
+    let doy = (153 * mp + 2) / 5 + day - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    let days = era * 146_097 + doe - 719_468;
+    let secs = days * 86_400 + hour * 3600 + minute * 60 + second - offset_s;
+    u64::try_from(secs * 1000 + millis).ok()
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    pub const NOW: &str = "2026-09-20T09:00:00Z";
+
+    /// A news-digest run result as the toolbox writes it (fixtures below).
+    pub fn news_digest_result() -> Value {
+        serde_json::from_str(include_str!("../resources/glance/fixtures/news-digest-run.json")).unwrap()
+    }
+
+    pub fn now() -> u64 {
+        parse_rfc3339_ms(NOW).unwrap()
+    }
+
+    /// A fresh digest root under the target dir, with `result` written as
+    /// `<app>/toolbox/runs/<template>/<run>.json`.
+    pub fn root_with(name: &str, results: &[(&str, &str, Value)]) -> PathBuf {
+        let root = std::env::temp_dir().join(format!("octosense-digest-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&root);
+        for (app, template, result) in results {
+            let dir = root.join(app).join("toolbox/runs").join(template);
+            std::fs::create_dir_all(&dir).unwrap();
+            let run = result["run_id"].as_str().unwrap();
+            std::fs::write(dir.join(format!("{run}.json")), serde_json::to_string_pretty(result).unwrap()).unwrap();
+        }
+        root
+    }
+
+    #[test]
+    fn a_news_digest_run_resolves_to_the_stable_shape() {
+        let root = root_with("shape", &[("os.news", "news-digest", news_digest_result())]);
+        let r = resolve(Some(&root), "os.news", "glance", now());
+        assert_eq!(r.state, "ready");
+        let v = &r.value;
+        assert_eq!(v["status"], "ready");
+        assert_eq!(v["topic"], "city infrastructure");
+        assert_eq!(v["language"], "en");
+        assert_eq!(v["count"], 3);
+        assert_eq!(v["retrieved_at"], "2026-09-20T08:00:03Z");
+        assert_eq!(v["sources"].as_array().unwrap().len(), 3);
+        assert_eq!(v["sources"][1], json!({"id": "s39327104dbcc", "n": "2", "title": "Ocho bibliotecas amplían su horario durante un piloto", "source": "Diario de Puerto Claro", "url": "https://example.invalid/news/libraries", "published_at": "2026-09-19T08:30:00Z"}));
+        assert_eq!(v["points"][0]["citations"], json!([0]));
+        assert_eq!(v["points"][2]["cite"], "3");
+        assert_eq!(v["points"][0]["id"], "p1");
+        // No evidence hash, provenance or trace reaches the card.
+        assert!(!v.to_string().contains("evidence_sha256") && !v.to_string().contains("trace"));
+        assert_eq!(r.expires_ms, Some(parse_rfc3339_ms("2026-09-20T08:00:00Z").unwrap() + MAX_AGE_MS));
+    }
+
+    #[test]
+    fn a_topic_brief_resolves_to_the_same_shape() {
+        let mut result = news_digest_result();
+        let digest = result["data"]["digest"].take();
+        let data = result["data"].as_object_mut().unwrap();
+        data.remove("digest");
+        data.insert("brief".into(), digest);
+        data.insert("queries".into(), json!([{"terms": "city infrastructure", "language": "en", "found": 3, "read": 3, "unreadable": 0}]));
+        result["template"]["id"] = json!("topic-brief");
+        let root = root_with("brief", &[("os.news", "topic-brief", result)]);
+        let r = resolve(Some(&root), "os.news", "glance", now());
+        assert_eq!((r.state, r.value["count"].as_u64()), ("ready", Some(3)));
+        let keys: Vec<&String> = r.value.as_object().unwrap().keys().collect();
+        assert_eq!(keys, ["count", "language", "points", "retrieved_at", "sources", "status", "summary", "topic"]);
+    }
+
+    #[test]
+    fn missing_expired_and_malformed_digests_are_empty_records() {
+        let root = root_with("absent", &[("os.news", "news-digest", news_digest_result())]);
+        for (app, id, status) in [("os.news", "nope", "missing"), ("os.mail", "glance", "missing"), ("os.news", "../x", "missing"), ("..", "glance", "missing"), ("os.news", "", "missing")] {
+            let r = resolve(Some(&root), app, id, now());
+            assert_eq!((r.state, r.value["status"].as_str()), ("failed", Some(status)), "{app} {id}");
+            assert_eq!(r.value["points"], json!([]));
+        }
+        assert_eq!(resolve(None, "os.news", "glance", now()).value["status"], "missing");
+        let late = parse_rfc3339_ms("2026-09-22T08:00:00Z").unwrap();
+        assert_eq!(resolve(Some(&root), "os.news", "glance", late).value["status"], "expired");
+        // A file that is not JSON, names another app or run, or is too big.
+        let mut other = news_digest_result();
+        other["app_id"] = json!("os.mail");
+        let root = root_with("malformed", &[("os.news", "news-digest", other)]);
+        assert_eq!(resolve(Some(&root), "os.news", "glance", now()).value["status"], "failed");
+        let dir = root.join("os.news/toolbox/runs/news-digest");
+        std::fs::write(dir.join("junk.json"), "{not json").unwrap();
+        assert_eq!(resolve(Some(&root), "os.news", "junk", now()).value["status"], "failed");
+        std::fs::write(dir.join("big.json"), " ".repeat(FILE_MAX as usize + 1)).unwrap();
+        assert_eq!(resolve(Some(&root), "os.news", "big", now()).value["status"], "failed");
+    }
+
+    #[test]
+    fn links_come_only_from_host_provenance_and_text_carries_none() {
+        let mut result = news_digest_result();
+        // A source whose URL the host never retrieved, one with a script URL.
+        result["data"]["sources"][0]["url"] = json!("https://evil.invalid/x");
+        result["data"]["sources"][2]["url"] = json!("javascript:alert(1)");
+        result["provenance"][2]["url"] = json!("javascript:alert(1)");
+        result["data"]["digest"]["points"][1]["text"] = json!("Read more at www.example.invalid");
+        result["data"]["digest"]["summary"] = json!("See https://example.invalid for more");
+        let root = root_with("links", &[("os.news", "news-digest", result)]);
+        let v = resolve(Some(&root), "os.news", "glance", now()).value;
+        let sources = v["sources"].as_array().unwrap();
+        assert_eq!(sources.len(), 1, "{v}");
+        assert_eq!((sources[0]["id"].as_str(), sources[0]["n"].as_str()), (Some("s39327104dbcc"), Some("1")));
+        // Point 1 cited a dropped source, point 2 carried a URL; neither stays.
+        assert_eq!(v["points"], json!([]));
+        assert_eq!(v["summary"], "");
+    }
+
+    #[test]
+    fn text_is_capped() {
+        let mut result = news_digest_result();
+        result["data"]["digest"]["summary"] = json!("s".repeat(SUMMARY_MAX * 2));
+        let point = result["data"]["digest"]["points"][0].clone();
+        let points: Vec<Value> = (0..POINTS_MAX + 4).map(|i| { let mut p = point.clone(); p["text"] = json!(format!("{i} {}", "é".repeat(TEXT_MAX))); p }).collect();
+        result["data"]["digest"]["points"] = json!(points);
+        let root = root_with("caps", &[("os.news", "news-digest", result)]);
+        let v = resolve(Some(&root), "os.news", "glance", now()).value;
+        assert_eq!(v["summary"].as_str().unwrap().chars().count(), SUMMARY_MAX + 1);
+        assert_eq!(v["points"].as_array().unwrap().len(), POINTS_MAX);
+        assert_eq!(v["points"][0]["text"].as_str().unwrap().chars().count(), TEXT_MAX + 1);
+    }
+
+    #[test]
+    fn a_failed_run_is_a_failed_state_with_what_it_has() {
+        let mut result = news_digest_result();
+        result["status"] = json!("failed");
+        result["data"] = Value::Null;
+        let root = root_with("failedrun", &[("os.news", "news-digest", result)]);
+        let r = resolve(Some(&root), "os.news", "glance", now());
+        assert_eq!((r.state, r.value["status"].as_str(), r.expires_ms), ("failed", Some("failed"), None));
+    }
+
+    #[test]
+    fn retention_keeps_the_newest_and_the_pinned() {
+        let root = root_with("retain", &[]);
+        let dir = root.join("os.news/toolbox/runs/news-digest");
+        std::fs::create_dir_all(&dir).unwrap();
+        let total = KEEP_PER_TEMPLATE + 4;
+        for i in 0..total {
+            let path = dir.join(format!("r{i:02}.json"));
+            std::fs::write(&path, "{}").unwrap();
+            let t = std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_000_000 + i as u64);
+            std::fs::File::options().write(true).open(&path).unwrap().set_modified(t).unwrap();
+        }
+        std::fs::write(dir.join("notes.txt"), "kept: not a result").unwrap();
+        assert_eq!(retain(&root, "os.news", &["r00".into()]), 3);
+        let mut left: Vec<String> = std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.file_name().to_string_lossy().into_owned()).collect();
+        left.sort();
+        assert_eq!(left.len(), KEEP_PER_TEMPLATE + 2);
+        assert!(left.contains(&"r00.json".into()) && left.contains(&"notes.txt".into()) && !left.contains(&"r01.json".into()));
+        assert_eq!(retain(&root, "../etc", &[]), 0);
+    }
+
+    #[test]
+    fn rfc3339_times_parse() {
+        assert_eq!(parse_rfc3339_ms("1970-01-01T00:00:00Z"), Some(0));
+        assert_eq!(parse_rfc3339_ms("2026-09-20T08:00:00.250Z"), Some(1_789_891_200_250));
+        assert_eq!(parse_rfc3339_ms("2026-09-20T10:00:00+02:00"), parse_rfc3339_ms("2026-09-20T08:00:00Z"));
+        assert_eq!(parse_rfc3339_ms("2026-02-30"), None);
+        assert_eq!(parse_rfc3339_ms("yesterday"), None);
+    }
+}
diff --git a/crates/shell/src/lib.rs b/crates/shell/src/lib.rs
index 1daf2ea9..67ceb668 100644
--- a/crates/shell/src/lib.rs
+++ b/crates/shell/src/lib.rs
@@ -74,6 +74,7 @@ pub mod ext;
 pub mod glance;
 pub mod glance_card;
 pub mod glance_chat;
+pub mod glance_digest;
 #[cfg(any(feature = "app-hub", native_mobile))]
 pub mod glance_notice;
 pub mod glance_panel;
diff --git a/phone/docs/makepad-fork.md b/phone/docs/makepad-fork.md
index cc003f8d..63312338 100644
--- a/phone/docs/makepad-fork.md
+++ b/phone/docs/makepad-fork.md
@@ -45,7 +45,7 @@ The revision is pinned as a chain, not in one place:
    PR #79, and OpenHarmony's keyboard, Studio, GL lifetimes and idle frames
    of PRs #84, #85 and #87–#89) and the
    Octoscript revision
-   (`5991dfa`). OctoSense, AppCard, Rinx and the ROM lock the same release.
+   (`5991dfa`, with the L0 `sys.digest` source of Octoscript #40). OctoSense, AppCard, Rinx and the ROM lock the same release.
 3. The manifests repeat the Makepad revision as `rev = "…"`: here in
    `Cargo.toml` and `apps/*/Cargo.toml`. Octoscript-Makepad's unmodified
    manifests retain their release pin. `[patch]` sections redirect every one

From 9886523f2e769f3c110a1a31fcc30f702bac8f32 Mon Sep 17 00:00:00 2001
From: ymote <151983+ymote@users.noreply.github.com>
Date: Fri, 2 Oct 2026 11:57:24 -0700
Subject: [PATCH 2/3] glance: a digest card's notification summarizes the
 host's digest

A card notification's second line (#290) falls back to the card's own
summary in its data. For a card bound to `sys.digest`, that data is the
host's digest (glance_digest.rs), so the line now reads the data the
store keeps rather than the arguments the publisher sent, which could
carry a summary the card itself refuses. A card without kept L0 data (a
script card) reads its arguments as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/shell/src/glance.rs | 40 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/crates/shell/src/glance.rs b/crates/shell/src/glance.rs
index 1dc23e94..82230006 100644
--- a/crates/shell/src/glance.rs
+++ b/crates/shell/src/glance.rs
@@ -392,6 +392,20 @@ impl GlanceStore {
         crate::glance_digest::retain(root, app, &pinned);
     }
 
+    /// [`note_summary`] for the card just published under `key`, read from
+    /// the card's data as the store keeps it: a `sys.digest` value there is
+    /// the host's (glance_digest.rs), never what the publisher sent.
+    fn note_summary_for(&self, key: &str, args: &Value) -> String {
+        match self.cards.iter().find(|c| c.key() == key).and_then(|c| c.l0.as_ref()) {
+            Some(l0) => {
+                let mut kept = args.clone();
+                kept["data"] = l0.data.clone();
+                note_summary(&kept)
+            }
+            None => note_summary(args),
+        }
+    }
+
     /// Count one publish against `app`'s window, or refuse it.
     fn charge(&mut self, app: &str, now_ms: u64) -> Result<(), String> {
         let at = match self.publishes.iter().position(|(a, _)| a == app) {
@@ -594,12 +608,14 @@ pub fn request(caller: &Caller, service: &str, args: &Value) -> Result<Value, St
     if result.is_ok() && method == "publish" && args.get("notify").and_then(Value::as_bool) == Some(true) {
         let card_id = args.get("card_id").and_then(Value::as_str).unwrap_or_default();
         let title = args.get("title").and_then(Value::as_str).unwrap_or_default().trim();
+        let key = format!("{}/{card_id}", caller.app());
+        let summary = with_store(|store| store.note_summary_for(&key, args));
         NOTES.lock().unwrap().push(GlanceNote {
-            key: format!("{}/{card_id}", caller.app()),
+            key,
             app: caller.app().to_string(),
             open_app: caller.launch_id().to_string(),
             title: title.to_string(),
-            summary: note_summary(args),
+            summary,
         });
     }
     if result.is_ok() && method != "list" {
@@ -967,6 +983,26 @@ mod tests {
             assert_eq!(store.publish(&news(), &long, now()).unwrap()["expires_at"], json!(digest_expires));
         }
 
+        /// A digest card's notification line is the digest's summary, read
+        /// from the card's data as kept, never a summary the publisher put
+        /// in `data`; its own `summary` argument still comes first.
+        #[test]
+        fn a_digest_cards_notification_summarizes_the_hosts_digest() {
+            let root = root_with("glance-note", &[("os.news", "news-digest", news_digest_result())]);
+            let mut store = GlanceStore::default().with_digest_root(Some(root));
+            let mut args = brief(NEWS_BRIEF_CARD);
+            args["data"] = json!({"brief": {"summary": "Forged"}});
+            args["notify"] = json!(true);
+            store.publish(&news(), &args, now()).unwrap();
+            assert_eq!(note_summary(&args), "Forged", "the raw arguments carry the forged summary");
+            let summary = store.note_summary_for("os.news/brief", &args);
+            assert!(summary.starts_with("Sources: Harbor City approves electric bus order"), "{summary}");
+            args["summary"] = json!("Your morning brief");
+            assert_eq!(store.note_summary_for("os.news/brief", &args), "Your morning brief");
+            // A card the store does not hold reads the arguments, as before.
+            assert_eq!(store.note_summary_for("os.news/other", &json!({"data": {"pkg": {"summary": "Out"}}})), "Out");
+        }
+
         #[test]
         fn a_card_binds_only_its_own_apps_digests() {
             let root = root_with("glance-own", &[("os.news", "news-digest", news_digest_result())]);

From 6106cc3168c2dd0077a48e896eed2a07b3419f46 Mon Sep 17 00:00:00 2001
From: ymote <151983+ymote@users.noreply.github.com>
Date: Fri, 2 Oct 2026 15:31:44 -0700
Subject: [PATCH 3/3] glance: the phone feed test's sample card binds no
 digests

GlanceCard gained `digests` in this branch. The phone feed test's `card`
helper in mobile_pages.rs, added on main after this branch forked, built a
GlanceCard without the field, so the shell's lib tests stopped compiling
once the branch was rebased onto main. The sample cards bind no digests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/shell/src/mobile_pages.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/shell/src/mobile_pages.rs b/crates/shell/src/mobile_pages.rs
index 4dac83ec..616fb7e3 100644
--- a/crates/shell/src/mobile_pages.rs
+++ b/crates/shell/src/mobile_pages.rs
@@ -978,7 +978,7 @@ mod tests {
     fn card(app: &str, id: &str, priority: i64, published_ms: u64) -> GlanceItem {
         GlanceItem::Card(GlanceCard {
             app: app.into(), card_id: id.into(), title: format!("{app}/{id}"), priority, published_ms, expires_ms: 0,
-            open_app: app.trim_start_matches("os.").into(), route: None, body: "".into(), contained: true, l0: None,
+            open_app: app.trim_start_matches("os.").into(), route: None, body: "".into(), contained: true, digests: Vec::new(), l0: None,
         })
     }