capsite: toybox user stories and goals (T1-T3)

toybox-stories.md: the weekly roundup (#23), album-to-album sync
(endojs/playground#16), and drag-to-archive.org (#118), with the needs
they share. The checklist gains the toybox tree: a changed signal (T1),
Blockly composition by petname (T2), and confined code in Dynamic
Workers (T3).

Generated-by: Claude Opus 5.5

capsite-checklist.md

@@ -138,6 +138,30 @@ narrative.
         running webapp as the primary worker so its own port serves the
         form directly; revisit as the UI grows.
   - [ ] @endo/errors for structured error details (needs node_modules).
+- [ ] **toybox: typed pieces that fit together, peer to peer** (working
+      name; tinker toys per the madmode.com home page). Kinds are typed
+      interfaces, à la Genode session interfaces, but wired by
+      introduction (E's Granovetter diagram), not a parent tree; named by
+      petnames; each piece guards its own resources. Why:
+      [the toybox user stories](toybox-stories.md).
+  - [ ] **T1. Changed signal**: a reader can subscribe to "this cache
+        changed" instead of polling (Genode's ROM-session sigh is the
+        model: public cache ≈ ROM, `/_publish` ≈ report). Fires on 1f's
+        head refresh when it upserts anything new. Shape TBD: a Cap'n Web
+        callback stub the cache holds (live only), or a durable
+        subscription it calls back via a webkey (survives eviction).
+  - [ ] **T2. Compose with [Blockly](https://developers.google.com/blockly)**:
+        connector checks (`setCheck(kind)`) are the shapes; a workspace
+        is a set of introductions. **Blocks refer to capabilities by
+        petname**, never by key: workspace JSON is shareable; the keys
+        live with whatever runs it.
+  - [ ] **T3. Run compositions in [Dynamic Workers](https://developers.cloudflare.com/dynamic-workers/)**:
+        code from anywhere: Blockly's JS generator, code written by
+        agents, by hand. Confinement makes codegen safe: the Worker
+        Loader isolate's `env` holds only the stubs its petnames resolve
+        to, with `globalOutbound: null`, so the code's authority is
+        exactly what it was handed. (Ordinary Workers forbid `eval`;
+        lifting that is the point of the Worker Loader.)
 
 ## How to run (continuation prompts)
 
@@ -196,6 +220,7 @@ to every goal in this tree.
 
 ## Pointers
 
+- [the toybox user stories](toybox-stories.md) — what the pieces are for
 - [the zotero goal tree](zotero-checklist.md) and
   [the social.coop goal tree](social-coop-checklist.md) — the next caches
 - [the capsite notes](capsite-notes.md) — the original goal and the EmDash