docs(sitemap): seed xiaohongshu phase 2 with login schema dogfood

[jackwener]

Summary

Phase 2 sitemap seed for xiaohongshu — 11 files / 909 lines under sitemaps/xiaohongshu/. Dogfoods the new login: block schema agreed in #OpenCLI:7bbdfcd2 (login + whoami design pin) before codex's command MVP ships, so the schema gets a real second use case beyond twitter / hackernews PoC.

Files

• SITE.md — frontmatter with new login: block (4-tier verify: adapter probe > read probe > cookie probe > DOM probe). login_url: https://www.xiaohongshu.com/login, cookie key web_session.
• apis.md — Pinia SSR store snapshot endpoints (HomeFeed_HydratedStore / NoteDetail_PiniaStore / UserNotes_PiniaStore).
• pitfalls.md — 8 site-specific gotchas (login wall / xsec_token / search API broken / creator host split / shadow DOM publish / security_block / hidden title decoy / homefeed XHR missing xsec_token).
• pages/ — _note_card (partial) + explore + note + profile + compose (creator host).
• workflows/ — search + publish + comment (last is DOM-only, no cookie-API adapter today).

Login schema dogfood

Workflow Recovery sections reference opencli xiaohongshu login with # pending: codex task #276 annotation. Once codex's command MVP ships, drop the # pending comments — no other change needed.

This is the new schema's second author-side instance (twitter / hackernews PoC was first). Surfaces:

• Is verify array (strong→weak 4 entries) ergonomic for authors? ✅ wrote it from scratch in one pass.
• Does # pending lint clean? Each pending site references the future command three places (SITE.md verify.command, pitfalls.md pitfall:login_wall_on_most_routes workaround, each workflow Recovery). Grep-able.

Cohesion bias on three files

pitfalls.md (4.7KB) / pages/compose.md (4.3KB) / workflows/publish.md (4.0KB) over the 800-token soft cap. Kept as single files per #1824 audit-flag-explanation loop:

• pitfalls.md: 8 xhs-specific gotchas, cross-referenced from every workflow + page. Splitting forces multi-file resolution per pitfall lookup.
• pages/compose.md: 5 actions on creator center publish form (upload / fill / topics / submit / save_draft). All operate on same page DOM, sharing visual anchors + scope rule. Splitting would duplicate anchors.
• workflows/publish.md: Single user-intent (image note publish), 8-step Fallback chain references creator host pitfalls. Splitting workflow by step breaks State signature continuity.

Test plan

• schema validator (when 质量官's audit lands) — frontmatter schema_version: 1.1 / auth_strategy: COOKIE_API / source: global consistent across all 11 files
• grep # pending: codex task #276 returns 3 hits per relevant file (SITE.md verify / pitfalls.md login_wall / workflows/{search,publish,comment,note}.md Recovery) — verify all references are grep-able when codex ships login MVP and we strip annotations
• cross-reference check: every pages/_note_card.md action reference resolves; every pitfalls.md ID referenced by workflow / page exists
• live verify against xhs after codex's login command MVP merges (opencli xiaohongshu whoami + run each workflow once)

Cc @opencli-质量官 @codex-coder @WAWQAQ — schema dogfood feedback welcome before login MVP lands.