diigo-week: draft a potluck issue from a week of diigo bookmarks

An EmDash plugin (native, content:write only) with one admin page:
a diigo username and an ISO week. It reads diigo-cache's public page
(?in=<week>&by=created) as microformats, follows rel=next, and
creates a draft in issues shaped like seed/issues.json.

Transport is a DIIGO_CACHE service binding rather than ctx.http.fetch:
EmDash's SSRF guard refuses localhost, and the binding names one
worker. Logic lives in src/week.ts with the fetcher passed in; tests
read fixtures in diigo-cache's markup. The checklist's goal 2 now
names potluck; DiigoBridge waits.

Generated-by: Claude Opus 5.5

capsite-checklist.md

@@ -89,27 +89,14 @@ narrative.
         [the issues sketch](potluck/issues-sketch.md))? If the policy
         changes, stripping stored rows is a durable-state migration.
 
-  - [ ] **2. madmode reads the public cache**: public data, so no
-        capability, no cookie, no plugin sync job, no cron on madmode's
-        side. madmode fetches `GET /public/dckc-madmode` with
-        `Accept: application/json` (plus 1d's `in=`/`days=`/`q=`).
-        - [ ] 2-i. Transport: a service binding to diigo-cache when both
-              are deployed (no public hop, so no rate-limit exposure);
-              in dev, a base URL (`http://localhost:8787`).
-        - [ ] 2-ii. The JSON shape of the public page is a contract
-              between two workers: pin it in a diigo-cache test (and
-              madmode's reader tests against the same fixture).
-        - [ ] 2-iii. Decide `DiigoBridge`'s fate: madmode doesn't need it
-              (public reads need no cache id), so its "cache-id source"
-              TODO (`src/index.ts`, README "RPC use") is either dropped
-              with the entrypoint or kept for a private-reading caller.
-  - [ ] **3. `/bookmarks` renders real data** — titles, tags, dates at
-        http://localhost:4321/bookmarks, newest first.
-  - [ ] **4. The weekly page**: `/bookmarks/2026-W41` → the cache's
-        `in=2026-W41` (needs 1d and 1f). Decide (user's call): a raw
-        week list, or a draft post the user edits before publishing
-        (the PESOS practice is editorial; a tag like `#weekly` in `q`
-        is one cheap form of discretion).
+  - [ ] **2. potluck reads the public cache**: public data, so no capability, no cookie, no secret on potluck's side. The [diigo-week](diigo-week/README.md) plugin reads `GET /public/dckc-madmode?in=<week>&by=created` as microformats (an `h-feed` of `h-entry` bookmarks). Built 2026-10-09; not yet run in dev.
+        - [x] 2-i. Transport: the `DIIGO_CACHE` service binding in potluck's `wrangler.jsonc`, in dev too: the plugin's `ctx.http.fetch` refuses localhost (EmDash's SSRF guard), and a binding names one worker, not a host.
+        - [x] 2-ii. The page's microformats are the contract: diigo-cache's tests parse it with microformats-parser; diigo-week's tests read fixtures in the same markup.
+        - [ ] 2-iii. Decide `DiigoBridge`'s fate (postponed: nothing on this path uses it; it matters only for a caller that reads private items).
+        - [ ] 2-iv. Run it in dev: diigo-cache and potluck both up; Plugins → Draft from diigo → a draft issue. Open question: whether the service binding resolves across the two dev servers (the dev registry).
+  - [ ] ~~**3. `/bookmarks` renders real data**~~: superseded by potluck's issues (the madmode starter is gone).
+  - [ ] **4. The weekly draft**: decided (2026-10-09): a draft issue you edit before publishing, made by diigo-week. The slug comes from the title (`week-2026-w40`).
+
   - [ ] **5. Deployed end-to-end** (order matters):
         - [ ] 5-i. webapp: `cd webapp && npx wrangler deploy`
         - [ ] 5-ii. diigo-cache: rate-limit `/api` (and `/public/*`) first