diff --git a/capsite-notes.md b/capsite-notes.md
index 6cb4136..61ed757 100644
--- a/capsite-notes.md
+++ b/capsite-notes.md
@@ -32,6 +32,56 @@ If it works out well, we should be able to expand to [bib sync #195](https://git
     serves a public JSON route, and has a Block Kit admin page ("Sync now" button + table).
 - Site `/bookmarks` page renders the collected bookmarks (linked from the primary menu).
 
+## diigo-cache UX map (2026-10-07)
+
+What a person can do, where, and with what authority. Input to aligning
+the admin UX with the RPC interface (checklist: the store refactor and
+"align admin UX and RPC").
+
+```mermaid
+flowchart LR
+  home["/ home<br/>(no authority)"]
+  connect["/_connect<br/>mint form"]
+  wire["wire step<br/>(webapp id)"]
+  created["cache created<br/>(cache id)"]
+  login["/cache/ login<br/>(password manager)"]
+  admin["webkey page<br/>/cache/ + key in fragment"]
+  public["/public/username<br/>(anyone)"]
+
+  home -->|create| connect
+  connect -->|"POST /_mint (cookie)"| wire
+  home -->|"POST /_wire (webapp id)"| created
+  wire -->|"POST /_wire"| created
+  created -->|"POST /_publish (cache id)"| created
+  created -->|"open this cache"| admin
+  home -->|"open a cache"| login
+  login -->|"cache id"| admin
+  home -->|"dump: POST / (cache id + page)"| home
+  admin -->|"api.cache(key) …"| admin
+  created -->|"link (public mode)"| public
+```
+
+| action | where | transport | authority |
+|---|---|---|---|
+| mint the diigo session | `/_connect` | HTTP `POST /_mint` (relays webapp's form) | the cookie |
+| wire a cache (private/public) | wire step, home | HTTP `POST /_wire` | webapp id |
+| save the ids | created page | browser (copy, password manager) | — |
+| publish later | created page | HTTP `POST /_publish` ⚠ | cache id |
+| dump a page (raw rows) | home | HTTP `POST /` ⚠ | cache id |
+| fingerprint, has-public | webkey page | RPC `fingerprint()`, `hasPublic()` | cache key |
+| fill / stop / status | webkey page | RPC `startFill()`, `stopFill()`, `fillStatus()` | cache key |
+| …of the public companion | webkey page | RPC `publicCache().…` | cache key |
+| invalidate the last N days | webkey page | RPC `invalidateRecent(days)` | cache key |
+| read public bookmarks | `/public/<u>` | HTTP GET (HTML or JSON) ⚠ | none |
+| bulk dump for another worker | — | service binding `DiigoBridge.dumpNdjson` | worker config |
+
+⚠ misalignments:
+- publish and dump are admin actions held by the cache key, but live on
+  HTTP form routes rather than the RPC facet the webkey page uses
+- the public page can write: a miss fills from diigo through the owner's
+  session (to become read-only: the reader facet only)
+- the webkey page has no dump or publish; the home page has no fill
+
 ## Native-plugin wiring (the part that took a while)
 
 `emdash()`'s `plugins: []` takes **descriptors**, not plugin objects — the Astro