docs: goal tree and rules track the 1c cache

- checklist: 1c (diigo-dump evolves into a bookmark cache) with its
  create-flow, id-wiring, and verification subgoals
- notes: diigo-cache replaces diigo-dump in What-we-built
- AGENTS: no worker secret since 1c; durable state — be LOUD and
  conservative about breaking changes to stored DB state; pointer to
  the workspace skills for commit trailers

Generated-by: opencode (GLM)
Generated-by: Claude Opus 5.5

capsite-notes.md

@@ -17,7 +17,9 @@ If it works out well, we should be able to expand to [bib sync #195](https://git
 - `webapp/` — site-agnostic Durable-Object factory for attenuated credentialed
   web clients (fluent client, ids are bearer capabilities);
   [webapp/README.md](webapp/README.md)
-- `diigo-dump/` — the webapp consumer: its mint call carries all diigo
+- `diigo-cache/` — the webapp consumer, evolved from the diigo-dump worker:
+  bookmark dumps cached in DO SQLite storage (private cache by unique id,
+  public-only cache by username-in-path); the mint call carries all diigo
   knowledge; the cookie lives in the DO's storage (see
   [the checklist's goal tree](capsite-checklist.md) for the verified/not-yet
   split)
@@ -74,7 +76,10 @@ authoritative. Current shape: the session cookie lives only in the webapp
 DO's storage; `madmode/.dev.vars` still holds placeholder
 `DIIGO_API_KEY` / `DIIGO_USERNAME` for the (dead) API-key path — both
 documented schemes return 401 unconditionally, verified against both known
-real keys (see checklist goal 2). Deployed secrets: `cd madmode && pnpm
+real keys (opencode session ses_eec320fe4ffehaMAn44U1nTKJU: `key=` param,
+`key`+`user=`, and HTTP Basic, on both /api/v2/bookmarks and /api/v2/notes,
+though the same creds downloaded 13.5k bookmarks in 2024–2025; diigo
+evidently revoked v2 key auth). Deployed secrets: `cd madmode && pnpm
 wrangler secret put <NAME>`; the sync rides the cookie path since the API
 path died.