feat(bookmarks): the sidebar page is a bookmark list, and stops shipping as evidence

[guan4tou2]

The ruling 8b left open, decided against the code rather than against the word on the sidebar. The answer is not "make quickmarks append-only too" — it is that the table was never a record, and the product has been claiming it was.

Six columns, no operator_id, no engagement_id, no hash. Every feature on its page is a bookmark feature: a CDP poll for the focused tab, title/URL autofill, open-in-browser, a dot whose colour is a hash of the title. Its own shipped copy reads "Click + Capture to bookmark the current browser state", and ARCHITECTURE.md already classified it "Bookmarks. Not chained."

So mutability was never the false part. These three were:

1. The sidebar called it 標記 while every gesture an operator would call dropping a mark — ⌘⇧M, the title-bar button, the tray, both HUD buttons, the timeline right-click — writes a chained marker event and never touches this table. The page's empty state told them to press ⌘⇧M, a key that cannot produce a row on it.
2. It shipped as evidence: written into the bundle unconditionally beside events.jsonl, in a bundle whose README classifies two files and never names it, and which the bundled verifier never opens. Sharpest case: the scope-filtered export ran events through the filter and these rows around it, so a file labelled scope-filtered carried URLs for hosts the operator had deliberately excluded.
3. 8b's shipped ruling says url is an immutable marker field, and no marker had a url.

Markers now carry url — filled once from the browser connector, editable, and deliberately not amendable, because it is where the mark points (the web analogue of atTimestamp). That makes 8b true; 8b moves from partial to done.

Why not append-only. Triggers on a table with no hash, no signature, no place in the chain or the anchor, and no verifier that reads it buy the feeling of immutability and none of the checking — DELETE FROM quickmarks still works. And they would remove the only removal path there is: createQuickMark runs no redaction and sanitize reads events only, so a password pasted into a note is unmaskable in both directions and the hard delete is the operator's sole remedy. Append-only would keep that credential forever — and until this PR it also shipped it.

Deferred, recorded: the internal identifiers (findings.ts, FindingsView, quickmarks:* IPC, the REST route, the CLI verb, the read:findings plugin capability) keep their old names. Renaming them needs aliases so third-party plugin manifests and installed integrations survive — a rename-only PR. The SQL table name stays for the same reason.

Verification: npm run typecheck clean · npm test 1055 passed (98 files) · npm run build · playwright 89 passed, 1 skipped.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: b8608703-ab39-4fce-9c0b-9852b38751c9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}