diff --git a/MAINTAINER.md b/MAINTAINER.md
index d436908a..3368f1ba 100644
--- a/MAINTAINER.md
+++ b/MAINTAINER.md
@@ -24,7 +24,7 @@ release this kit. User-facing docs live in [README.md](README.md); this file is
 
 ### CLI shape (`bin/agentic-kit.mjs`)
 
-- **Porcelain** (daily): `setup`, `status`, `sync`, `dashboard`, `uninstall`. Bare `ak` → `status --hint`. (`dashboard` is also reachable as `ak x dashboard`.)
+- **Porcelain** (daily): `setup`, `status`, `sync`, `dashboard`, `admin`, `dual`, `uninstall`. Bare `ak` → `status --hint`. (`dashboard` and `admin` are also reachable as `ak x dashboard` / `ak x admin`.)
 - **Plumbing** (power users): `ak x daemon-gc | mcp | reference | verify | improvement-eval`.
 - Each command module exports `options` (a `parseArgs` config) and `run({ flags, positionals, pkgRoot })`.
 - A best-effort drift nudge runs after non-`sync`, non-`--json` commands.
@@ -39,7 +39,7 @@ src/
   commands/              # porcelain verbs
     setup.mjs  status.mjs  sync.mjs  dual.mjs  uninstall.mjs
     x/                   # plumbing verbs
-      daemon-gc.mjs  dashboard.mjs  harvest.mjs  mcp.mjs  provider.mjs  reference.mjs  verify.mjs
+      admin.mjs  daemon-gc.mjs  dashboard.mjs  harvest.mjs  mcp.mjs  provider.mjs  reference.mjs  verify.mjs
   lib/                   # the engine — each file is one concern
     heal.mjs             # the mutations sync/setup apply (idempotent, {ok,detail})
     natives.mjs          # better-sqlite3 / agentdb native detection
@@ -54,6 +54,11 @@ src/
     agentdb.mjs          # agentdb CLI coherence (harvest write path)
     health-history.mjs   # regression ring appended by sync, read by status
     dashboard-server.mjs # read-only localhost dashboard (shells `ak status --json`)
+    admin-server.mjs     # maintainer admin: loopback server, per-session token auth, page assembly (ADR-0007)
+    admin-collect.mjs    # admin's server-side GitHub/npm fan-out → typed payload (injectable fetchers)
+    admin-model.mjs      # PURE admin number model — imports nothing; embedded in the page AND node-tested
+    admin-view.mjs       # admin browser controller (embedded into the page; not node-imported)
+    browser.mjs          # openInBrowser — shared by dashboard + admin
     npx.mjs              # stale npx-cache detection/prune
     mcp.mjs  settings.mjs  config.mjs  paths.mjs  statusline.mjs
     rvf.mjs  daemons.mjs  exec.mjs  output.mjs
diff --git a/README.md b/README.md
index 69bea9b4..1a4da53c 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,7 @@ What the verbs cover:
 | **status** | Per-subsystem ✓/⚠/✗ (versions, the kit's own version, **ruvnet-brain** (present + release drift, or "not installed"), natives, security, learning, aqe/RVF, **agentdb** (CLI present + coherent with ruflo's bundled version, or a store-skew warning), MCP, **hosts** (claude/codex — version + install method + **auth mode** (subscription $0 vs metered api-key), with the **primary** host marked and a *fail* when the primary host is absent), **providers** (host wiring + aqe fallback chain, or "drifted"/claude-only default), **routing** (per-activity Claude/Codex host+model policy, when dual-host — with drift vs the on-disk `agentOverrides`), daemons, CLAUDE.md blocks, statusline), each drift row naming what `sync` would do about it — plus a **health-history** line that flags regressions since the last sync (learning shrank, native slots dropped, drift/security backslid). |
 | **sync** | The one convergence verb: upgrades first when a new release exists, then re-heals everything an upgrade wipes, then re-checks and reports. Included in that heal: it **installs any enabled frontier host** (claude/codex) that's entirely absent — never touching an external (mise/brew/native) install — and **re-applies provider wiring** (the `ENABLE_*` host env, the aqe fallback chain, and ruflo API providers) whenever it has drifted — and, on a dual-host project, **seeds/heals the per-activity routing policy** (materializing it into agentic-qe's `agentOverrides`, e.g. after an aqe upgrade first makes it eligible). It also **installs/repins the standalone `agentdb` CLI** to ruflo's bundled version (keeping the shared cognitive store coherent) and appends a **health-history snapshot** so `status` can flag regressions across syncs. It also **re-runs the RuvNet Brain installer** to pull the latest release when the on-disk KB has drifted (or installs it if absent, when enabled). It also **self-updates the kit**: when a newer `@pacphi/agentic-kit` exists it installs it as the *last* step (the new code applies from the next `ak` run, never mid-sync). Prerelease installs (`4.0.0-alpha.*`) track the `next` npm dist-tag as well as `latest`, so alphas see their successors; stable installs only ever follow `latest`. `--no-upgrade` skips the self-update along with the package upgrades. |
 | **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) that renders the same subsystem view as `ak status` in an Apple-style five-tab layout — **Overview · Hosts & Routing · Providers · Runtime · Intelligence** — with count badges on any tab holding a failing/warning subsystem. Problems never hide behind a tab: Overview aggregates every attention card, a quiet update notice, and a jump-to status map of all subsystems; Providers shows the **models in play** (distinct host+model pairs from your routing policy); Hosts & Routing carries the **per-activity routing matrix** (vendor-coded Claude/Codex host + model per activity) when dual-host routing is configured; Intelligence keeps the learning-over-time strip. Fully self-contained and offline (no external fetches, nothing leaves your machine). **Auto-opens your browser** (`--no-open` to just print the URL for headless/SSH); `--port N` to change the port; tabs deep-link (`#providers`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
+| **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), npm download momentum (last 7d vs prior 7d, sparklines), release pulls, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
 | **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak x provider pick --host claude,codex`). |
 | **uninstall** | Removes the kit's footprint (and any legacy shell-kit install); project data is never touched; `--purge` also offers to remove the global packages. |
 
diff --git a/bin/agentic-kit.mjs b/bin/agentic-kit.mjs
index 94b1b108..80b0da5a 100755
--- a/bin/agentic-kit.mjs
+++ b/bin/agentic-kit.mjs
@@ -13,11 +13,13 @@ const PORCELAIN = {
   sync: () => import('../src/commands/sync.mjs'),
   setup: () => import('../src/commands/setup.mjs'),
   dashboard: () => import('../src/commands/x/dashboard.mjs'),
+  admin: () => import('../src/commands/x/admin.mjs'),
   dual: () => import('../src/commands/dual.mjs'),
   uninstall: () => import('../src/commands/uninstall.mjs'),
 };
 
 const PLUMBING = {
+  'admin': () => import('../src/commands/x/admin.mjs'),
   'daemon-gc': () => import('../src/commands/x/daemon-gc.mjs'),
   'dashboard': () => import('../src/commands/x/dashboard.mjs'),
   'harvest': () => import('../src/commands/x/harvest.mjs'),
@@ -35,6 +37,7 @@ Usage (ak = alias of agentic-kit):
   ak status          read-only dashboard: what's true, what's drifted  [--json] [--deep]
   ak sync            converge to good: upgrade + heal + verify          [--dry-run] [--no-upgrade]
   ak dashboard       open the local web dashboard (localhost; auto-opens browser)  [--port N] [--no-open]
+  ak admin           maintainer-only telemetry admin (localhost; GitHub/npm egress)  [--port N] [--no-open]
   ak dual            run a Claude+Codex collaboration swarm (dual-host)  [run <template> "task"] [--dry-run]
   ak uninstall       leave cleanly                                      [--this-project] [--purge]
 
@@ -51,6 +54,7 @@ More:
 const HELP_ALL = `${HELP}
 
 Plumbing (power users) — each takes --help:
+  ak x admin [--port N]        maintainer-only telemetry admin (localhost; GitHub/npm egress)
   ak x daemon-gc [--kill]      list/stop stale ruflo daemons
   ak x dashboard [--port N]    read-only local health dashboard (localhost only)
   ak x harvest [--dry-run]     opt-in learning-write: replay experiences into the substrate
diff --git a/docs/adr/0007-maintainer-admin-local-telemetry.md b/docs/adr/0007-maintainer-admin-local-telemetry.md
new file mode 100644
index 00000000..8fdcd6e4
--- /dev/null
+++ b/docs/adr/0007-maintainer-admin-local-telemetry.md
@@ -0,0 +1,169 @@
+# ADR-0007 — Maintainer admin: a loopback telemetry page with deliberate egress
+
+- **Status:** Accepted
+- **Date:** 2026-07-24
+- **Deciders:** agentic-kit maintainers
+
+## Context
+
+`ak dashboard` (ADR-0005, `src/lib/dashboard-server.mjs`) is a read-only, loopback-only,
+**offline-first** health panel: a self-contained page that shells `ak status --json` and makes
+zero network calls. Its whole contract is "nothing leaves your machine."
+
+Maintainers want a different thing: *how is this project actually doing* — who filed issues, who
+forked, release-asset pulls, npm range, GitHub traffic. That data lives on **github.com and
+api.npmjs.org**, so answering it requires **network egress** and, for the traffic panels, a GitHub
+credential with push access. That is the exact opposite of the dashboard's offline contract, and it
+carries a secret. Folding it into the dashboard would either break the offline promise for every
+user or bury a privileged, egressing view behind a tab on an otherwise-airgapped panel.
+
+We are adapting a proven design — the RuvNet Brain explainer admin
+(`stuinfla/ruvnet-brain` `explainer/{admin.html,admin.js,api/admin-stats.mjs}`, MIT © 2026 Stuart
+Kerr / Isovision.ai). The reference is a **hosted** Vercel page gated by a static `ADMIN_TOKEN`; we
+are making it **local-first** — a `node:http` sibling of the dashboard, zero runtime deps, bound to
+`127.0.0.1`. Spec: `docs/adr/../../sparc/spec-ak-admin.md` (Phase 1); design: `pseudocode-ak-admin.md`
+(Phase 2).
+
+## Decision
+
+### 1. A sibling command, not a dashboard tab — split by network-egress contract
+
+`ak x admin` (with a top-level `ak admin` alias, mirroring `dashboard`) is a **separate command and
+server**, default port **7432** (dashboard is 7431). The split is drawn along the one line that
+matters: **egress**.
+
+- `dashboard` = offline-first. No fetch ever leaves the machine; safe to leave running, safe for the
+  privacy-conscious, needs no credential.
+- `admin` = deliberate egress. It exists *to* call GitHub and npm, and it touches a credential. That
+  is a conscious act the maintainer opts into by name, not a tab they might wander onto.
+
+Both remain **loopback-only** (`127.0.0.1`), both carry the dashboard's DNS-rebinding `Host`-header
+guard, both are foreground-until-Ctrl-C. What differs — and what justifies two commands — is that
+one promises silence and the other promises reach. Collapsing them would force one contract to lie.
+
+### 2. Auth: per-session random token, URL-fragment bootstrap, header-only transport, fail-closed
+
+The reference trusts a static `ADMIN_TOKEN` from hosting env. A local tool can do better:
+
+- The server **mints a fresh ≥128-bit token** (`crypto.randomBytes(32)`) at every startup. There is
+  **no unauthenticated mode** and **no "not configured" path** — the secret always exists because we
+  generate it. Comparison is `crypto.timingSafeEqual` behind a **length guard** (unequal length
+  returns `false`, never throws — a bare `timingSafeEqual` throws on length mismatch, and that throw
+  is itself a length/timing oracle).
+- The launch URL carries the token in the **URL fragment** (`#token=…`), not a query parameter. The
+  fragment is **never sent to the server**, never written to an access log, never forwarded by a
+  proxy or middlebox. The page lifts it into `localStorage`, `history.replaceState`s the fragment
+  out of the address bar, and thereafter sends it **only** as the `x-admin-token` request header.
+  There is no query-param fallback. A query param would leak the secret into exactly the sinks the
+  fragment avoids; that is why fragment beats query param here.
+- Wrong or missing token → **401 JSON with no data fields**; the page drops the stored token and
+  shows a paste-from-terminal gate with a "Forget token" control.
+
+### 3. Server proxies everything — the credential never reaches the browser
+
+The GitHub credential is resolved **server-side at collect time** from
+`GITHUB_TOKEN` → `GH_TOKEN` → `gh auth token` (execFile, best-effort; absent → traffic panels
+degrade to `configured:false`, never an error). It is **read at runtime, persisted nowhere by the
+kit, and never appears in the `/api/admin-stats` payload or the page** (NFR-3). The **page makes
+exactly one network call — a same-origin `fetch('/api/admin-stats')`** — and the server does every
+GitHub/npm fetch on its behalf. A strict CSP (`default-src 'none'`; `connect-src 'self'`;
+`script-src`/`style-src 'unsafe-inline'` for the two inline module scripts and the one inline style;
+`img-src 'none'` since sparklines are inline SVG) makes "no external fetch" a header the browser
+enforces, not just a convention, and `Cache-Control: no-store` covers every `/api/*` response.
+
+### 4. Three client correctness rules, inherited verbatim (attribution: stuinfla/ruvnet-brain, MIT)
+
+The reference earned three rules the hard way; we adopt them wholesale and keep the attribution:
+
+1. **Unknown is not zero.** Every metric passes through `metric()`, which rejects `null`/`''`
+   *before* `Number()` coercion (both coerce to a finite `0` and would otherwise report a confident
+   zero for a merely-absent source) and returns `{known:false, why}`. Absence renders "—" + reason.
+2. **Never diff a rolling window.** Cumulative counters (stars, forks, asset downloads) get
+   `current − baseline` deltas; rolling windows (GitHub 14-day traffic, npm 7/30-day) are excluded
+   from the "since you last looked" strip and get equal-window `momentum()` inside their own series
+   instead — subtracting two readings of a rolling window compares two different time spans.
+3. **No control without an executor and an undo.** "Mark all reviewed" stashes the prior baseline
+   and reveals a real "Undo"; "Forget token", auto-refresh, and feed paging each have their inverse.
+
+### 5. Pure-model module: `src/lib/admin-model.mjs` is both embedded and imported — tested code is shipped code
+
+All number logic (`metric`, `ascend`, `momentum`, `shape`, `snapshot`, `cumDelta`, `safeUrl`,
+`esc`, bot/date helpers) lives in **`src/lib/admin-model.mjs`**, which **imports nothing** and
+touches no DOM and no Node builtin — pure, browser-safe functions. This one file is:
+
+- **imported directly** by `tests/admin-model.test.cjs` (node), and
+- **embedded verbatim** into the served page by `admin-server.mjs`.
+
+So the code the tests exercise *is byte-for-byte the code the browser runs* — no reimplementation, no
+"tested logic drifts from shipped logic." The browser controller (DOM/fetch/events) that cannot be
+node-imported lives separately in `src/lib/admin-view.mjs`; its single
+`import … from './admin-model.mjs'` line is stripped at serve time so model + view concatenate into
+one inline `<script type="module">` scope — keeping the page a single self-contained document (no
+browser-side module fetch, preserving AC-5) while both files stay independently
+`node --check`/eslint-clean.
+
+### 6. Module boundaries and file layout
+
+```text
+src/commands/x/admin.mjs     CLI: flags (--port 7432, --no-open), foreground SIGINT loop
+src/lib/admin-server.mjs     node:http server, token mint, Host guard, auth, page assembly
+src/lib/admin-collect.mjs    server-side Promise.all fan-out → the typed payload (injectable fetchers)
+src/lib/admin-model.mjs      PURE model — imports NOTHING; embedded AND node-imported
+src/lib/admin-view.mjs       browser controller (embedded; not node-tested)
+src/lib/browser.mjs          openInBrowser — EXTRACTED from x/dashboard.mjs, shared by both commands
+tests/admin-model.test.cjs   pure-model unit tests (metric/momentum/shape/snapshot/cumDelta)
+tests/admin.test.cjs         server tests over real HTTP with injected collect/fetchers (network-free)
+```
+
+Dependency direction (acyclic): `admin.mjs → {admin-server, browser}`;
+`admin-server → {admin-collect, admin-model(source), admin-view(source)}`;
+`admin-collect → admin-model`; `admin-model → ∅`. **`admin-model.mjs` is the sink — it imports
+nothing — so no cycle is possible.** `openInBrowser` moves out of `x/dashboard.mjs` into
+`src/lib/browser.mjs` (IP-4) and `dashboard.mjs` imports it from there rather than duplicating it.
+
+No new directories are introduced beyond these files.
+
+## Consequences
+
+- The offline-first dashboard contract is preserved intact; the egressing, credential-touching view
+  is a deliberate, separately-named opt-in — the two contracts never blur.
+- Zero runtime dependencies hold: `node:http`/`crypto`/`child_process`/`fs`/`path`/`url` only, Node
+  ≥22 ESM, matching the dashboard.
+- The credential's blast radius is minimal: runtime-only, server-side-only, never persisted, never in
+  the payload, never in the page; the browser holds only the per-session UI token.
+- `admin-model.mjs`'s import-nothing constraint is load-bearing for both the no-cycle guarantee and
+  the browser-safety of the embed — a future edit that adds an import to it breaks both and must be
+  rejected in review.
+- Extracting `openInBrowser` to `src/lib/browser.mjs` is a small refactor of existing dashboard code
+  (behaviour-preserving) that both commands now share.
+- The honesty section ("Not instrumented yet") makes ak's real gaps first-class: no opt-in telemetry
+  (`code`), no traffic token (`config`), comment bodies/sentiment and Discussions unread (`code`),
+  remote hosting never (`design`). A dashboard that admits a gap beats one that fills it with a
+  plausible number.
+
+## Alternatives considered
+
+- **A tab on `ak dashboard`.** Rejected: it would either break the dashboard's offline-first promise
+  for every user or hide a privileged egressing view behind a tab. The contracts differ at the
+  network boundary, so the commands should too (Decision 1).
+- **Static token via env var (as in the reference).** Rejected for a local tool: a per-session
+  random token is simpler (no setup, no "not configured" 503 path) and strictly safer (no long-lived
+  shared secret on disk). (Decision 2.)
+- **Token in a query parameter.** Rejected: query strings leak into server logs, browser history,
+  and proxies — the exact sinks the fragment avoids. (Decision 2.)
+- **Page fetches GitHub/npm directly.** Rejected: it would either expose the credential to the
+  browser or force an unauthenticated, degraded view, and would violate the "zero external fetch"
+  CSP. Server-proxies-everything keeps the secret server-side and the page self-contained. (Decision 3.)
+- **One `admin.js` like the reference (no model/view split).** Rejected: NFR-5 requires the number
+  logic be node-testable, and DOM code is not node-importable. The two-file split is the minimal way
+  to make the tested code the shipped code. (Decision 5.)
+
+## References
+
+- Reference (MIT): `stuinfla/ruvnet-brain` — `explainer/admin.html`, `explainer/admin.js`,
+  `explainer/api/admin-stats.mjs`.
+- House patterns: `src/lib/dashboard-server.mjs` (loopback server, Host guard, self-contained page,
+  injectable collector), `src/commands/x/dashboard.mjs` (`openInBrowser`, option parsing, foreground
+  loop), `tests/dashboard.test.cjs` (injected-fetcher harness), `bin/agentic-kit.mjs` (dispatch).
+- ADR-0005 (dashboard as read-only offline-first diagnostic); spec `sparc/spec-ak-admin.md`;
+  pseudocode `sparc/pseudocode-ak-admin.md`.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 43888ccc..affe3fdd 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -15,8 +15,11 @@ Consequences**, and cites the grounded source it rests on where relevant.
 | [0004](0004-escalation-per-projection.md) | Escalation is per-projection, availability stated per path | Accepted |
 | [0005](0005-dashboard-in-page-routing-reveal.md) | Dashboard surfaces routing via in-page reveal | Accepted |
 | [0006](0006-primary-host-and-ambidextrous-mirroring.md) | Primary host & ambidextrous mirroring (which host leads) | Accepted |
+| [0007](0007-maintainer-admin-local-telemetry.md) | Maintainer admin: a loopback telemetry page with deliberate egress | Accepted |
 
-Theme: these records define **dual-host LLM routing and leadership** — how `ak` lets ruflo route each
-development activity (architecture, implementation, testing, review, …) to the right host (Claude or
-Codex) and model, which host **leads** (0006), seeded on detection, tunable by the user, and surfaced
-across `setup`/`sync`/`status`/`dashboard`. See also `docs/PROVIDERS.md`.
+Theme: ADRs **0001–0006** define **dual-host LLM routing and leadership** — how `ak` lets ruflo route
+each development activity (architecture, implementation, testing, review, …) to the right host (Claude
+or Codex) and model, which host **leads** (0006), seeded on detection, tunable by the user, and surfaced
+across `setup`/`sync`/`status`/`dashboard`. **0007** covers the local diagnostic surfaces — splitting the
+offline-first `dashboard` from the deliberately-egressing, credential-touching maintainer `admin` along
+the network-egress line. See also `docs/PROVIDERS.md`.
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 5c2a92ba..2805cb3a 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -40,6 +40,14 @@ export default [
     files: ['**/*.cjs'],
     languageOptions: { sourceType: 'commonjs' },
   },
+  {
+    // admin-view.mjs is BROWSER code — never node-imported, only read as text and
+    // embedded into the served admin page (ADR-0007 §5). It legitimately uses DOM
+    // globals (document, localStorage, location, fetch, history, setInterval).
+    // Lint it for correctness with the browser environment, not the node one.
+    files: ['src/lib/admin-view.mjs'],
+    languageOptions: { globals: { ...globals.browser } },
+  },
   {
     // The statusline footer is an EMITTED shell-statusline template + its test:
     // deliberately old-school (var, literal ANSI escape bytes, bare catch bindings)
diff --git a/package.json b/package.json
index 053ddd6d..d6e6df69 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "docs/TROUBLESHOOTING.md"
   ],
   "scripts": {
-    "test": "node --test \"tests/kit/*.test.mjs\" && node tests/statusline-segments.test.cjs && node tests/statusline-brain.test.cjs && node tests/agentdb.test.cjs && node tests/health-history.test.cjs && node tests/harvest.test.cjs && node tests/dashboard.test.cjs",
+    "test": "node --test \"tests/kit/*.test.mjs\" && node tests/statusline-segments.test.cjs && node tests/statusline-brain.test.cjs && node tests/agentdb.test.cjs && node tests/health-history.test.cjs && node tests/harvest.test.cjs && node tests/dashboard.test.cjs && node tests/admin-model.test.cjs && node tests/admin.test.cjs",
     "test:surface": "node --test tests/kit/dispatch-surface.test.mjs",
     "typecheck": "tsc -p tsconfig.json",
     "lint": "eslint .",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 72519ea2..f75b7cd4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  js-yaml@<5.2.2: 5.2.2
+
 importers:
 
   .:
@@ -467,8 +470,8 @@ packages:
   isexe@2.0.0:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
 
-  js-yaml@5.2.1:
-    resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==}
+  js-yaml@5.2.2:
+    resolution: {integrity: sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==}
     hasBin: true
 
   json-buffer@3.0.1:
@@ -1090,7 +1093,7 @@ snapshots:
 
   isexe@2.0.0: {}
 
-  js-yaml@5.2.1:
+  js-yaml@5.2.2:
     dependencies:
       argparse: 2.0.1
 
@@ -1141,7 +1144,7 @@ snapshots:
   markdownlint-cli2@0.23.1:
     dependencies:
       globby: 16.2.1
-      js-yaml: 5.2.1
+      js-yaml: 5.2.2
       jsonc-parser: 3.3.1
       jsonpointer: 5.0.1
       markdown-it: 14.3.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 00000000..697661c2
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+minimumReleaseAgeExclude:
+  - js-yaml@5.2.2
+# pnpm settings (pnpm ≥11 reads overrides from here, not package.json).
+# js-yaml: markdownlint-cli2@0.23.1 pins 5.2.1 exactly, which carries
+# GHSA-pm4m-ph32-ghv5 (flow-collection DoS, patched in 5.2.2). Drop this
+# override once markdownlint-cli2 ships a bumped js-yaml.
+overrides:
+  'js-yaml@<5.2.2': 5.2.2
diff --git a/src/commands/x/admin.mjs b/src/commands/x/admin.mjs
new file mode 100644
index 00000000..de8bdcf3
--- /dev/null
+++ b/src/commands/x/admin.mjs
@@ -0,0 +1,88 @@
+// x admin — a maintainer-only local telemetry admin for the kit.
+//
+// Sibling of `ak x dashboard`, split along the network-egress line (ADR-0007):
+// where the dashboard is offline-first and silent, admin exists TO call GitHub and
+// npm and it touches a credential. Both are loopback-only and foreground-until-
+// Ctrl-C; this one carries a fresh per-session token and prints a launch URL whose
+// # fragment bootstraps that token into the page.
+import { startAdmin } from '../../lib/admin-server.mjs';
+import { openInBrowser } from '../../lib/browser.mjs';
+import { ok, info, dim, warn } from '../../lib/output.mjs';
+
+export const options = {
+  port: { type: 'string' },
+  'no-open': { type: 'boolean', default: false },
+};
+
+export const help = `ak admin — maintainer-only local telemetry admin (localhost only)  [alias: ak x admin]
+
+Serves a self-contained web panel showing how the project is actually doing —
+unique repo visitors, release-asset pulls, npm range, GitHub traffic, and the
+humans who filed issues, opened PRs, or forked. Unlike \`ak dashboard\` (which is
+offline-first and never leaves your machine), admin makes DELIBERATE network
+egress: the server fetches GitHub + npm on your behalf and reads a GitHub
+credential (GITHUB_TOKEN → GH_TOKEN → \`gh auth token\`, best-effort) at runtime.
+That credential is never persisted and never reaches the page.
+
+Bound to 127.0.0.1. A fresh session token is minted at startup and carried into
+the browser in the launch URL's # fragment (never a query param, never logged);
+the page moves it to localStorage and sends it only as a request header.
+
+Runs in the foreground — press Ctrl-C to stop.
+
+Usage: ak x admin [options]
+
+Options:
+  --port N    port to bind on 127.0.0.1 (default 7432; 0 = ephemeral)
+  --no-open   don't auto-open the browser (just print the URL — for headless use)
+
+Examples:
+  ak x admin              serve + open http://127.0.0.1:7432
+  ak x admin --port 0     pick an ephemeral port
+  ak x admin --no-open    print the URL only (SSH / headless)`;
+
+export async function run({ flags }) {
+  let port = 7432;
+  if (flags.port !== undefined) {
+    const p = Number(flags.port);
+    if (!Number.isInteger(p) || p < 0 || p > 65535) {
+      warn(`invalid --port ${flags.port}; using ${port}`);
+    } else {
+      port = p;
+    }
+  }
+
+  let server;
+  try {
+    server = await startAdmin({ port });
+  } catch (e) {
+    warn(`could not start admin: ${e.message}`);
+    if (e.code === 'EADDRINUSE') info(`port ${port} is busy — try: ak x admin --port 0`);
+    return 1;
+  }
+
+  ok(`admin live at ${server.url}`);
+  info(dim('maintainer-only · localhost only · deliberate GitHub/npm egress · Ctrl-C to stop'));
+  info('open this URL (it carries a one-time session token in the # fragment):');
+  info(`  ${server.urlWithToken}`);
+
+  if (!flags['no-open']) {
+    openInBrowser(server.urlWithToken);
+    info(dim('opening your browser… (if it didn\'t, open the URL above; --no-open to disable)'));
+  }
+
+  // Block foreground until an interrupt, then close cleanly (like dashboard).
+  return await new Promise((resolve) => {
+    let closing = false;
+    const shutdown = async () => {
+      if (closing) return;
+      closing = true;
+      await server.close();
+      console.log('');
+      ok('admin stopped');
+      resolve(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+  });
+}
diff --git a/src/commands/x/dashboard.mjs b/src/commands/x/dashboard.mjs
index ef05f83f..8e1b3a74 100644
--- a/src/commands/x/dashboard.mjs
+++ b/src/commands/x/dashboard.mjs
@@ -5,8 +5,8 @@
 // `ak status --json` (plus version drift, improvement.json, and the health
 // ring). Runs FOREGROUND and blocks until Ctrl-C; nothing is detached and
 // nothing mutates state.
-import { spawn } from 'node:child_process';
 import { startDashboard } from '../../lib/dashboard-server.mjs';
+import { openInBrowser } from '../../lib/browser.mjs';
 import { ok, info, dim, warn } from '../../lib/output.mjs';
 
 export const options = {
@@ -36,23 +36,6 @@ Examples:
   ak x dashboard --port 8080  pick a port
   ak x dashboard --no-open    print the URL only (SSH / headless)`;
 
-/** Open a URL in the OS default browser, best-effort (never throws). Zero-dep:
- *  macOS `open`, Windows `cmd /c start`, else `xdg-open`. */
-function openInBrowser(url) {
-  const cmd = process.platform === 'darwin' ? 'open'
-    : process.platform === 'win32' ? 'cmd'
-      : 'xdg-open';
-  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-  try {
-    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
-    child.on('error', () => { /* no browser / headless — URL is already printed */ });
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 export async function run({ flags }) {
   let port = 7431;
   if (flags.port !== undefined) {
diff --git a/src/lib/admin-collect.mjs b/src/lib/admin-collect.mjs
new file mode 100644
index 00000000..f6187106
--- /dev/null
+++ b/src/lib/admin-collect.mjs
@@ -0,0 +1,222 @@
+// admin-collect.mjs — the server-side stats fan-out for `ak x admin`.
+//
+// Resolves a GitHub credential (env → `gh auth token`), then fires ONE Promise.all
+// of GitHub + npm reads and assembles the typed /api/admin-stats payload
+// (ADR-0007 §0, pseudocode §3). Every sub-fetch is internally try/caught so no
+// single failure rejects the batch (EC-3) and no failure removes a sibling key.
+//
+// The credential is read at runtime, kept local, and NEVER placed in the payload
+// (NFR-3). Fetchers are injectable (fetchImpl / execFileImpl) so tests run
+// network-free (NFR-6).
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileP = promisify(execFile);
+
+// ── GitHub credential resolution (FR-4, EC-7) ─────────────────────────────────
+
+/** GITHUB_TOKEN → GH_TOKEN → `gh auth token`. Best-effort: an absent/logged-out
+ *  `gh` must not crash or prompt — it falls through to the empty (unconfigured)
+ *  result, which degrades the traffic panels honestly (AC-2). `execFileImpl` is
+ *  injectable for tests. */
+export async function resolveGhToken(env = process.env, execFileImpl = execFileP) {
+  if (env.GITHUB_TOKEN) return { token: env.GITHUB_TOKEN, source: 'GITHUB_TOKEN' };
+  if (env.GH_TOKEN) return { token: env.GH_TOKEN, source: 'GH_TOKEN' };
+  try {
+    const { stdout } = await execFileImpl('gh', ['auth', 'token'], { timeout: 5000, env });
+    const t = String(stdout || '').trim();     // arg vector, no shell — no injection surface
+    if (t) return { token: t, source: 'gh auth token' };
+  } catch { /* gh missing / not logged in — no prompt, no throw */ }
+  return { token: '', source: null };
+}
+
+// ── repository.url → owner/repo (EC-8) ────────────────────────────────────────
+
+/** Parse a GitHub "owner/repo" slug from a package.json repository.url. Handles
+ *  git+https, ssh, scp-shorthand, and bare https shapes. Returns null on anything
+ *  unparseable — the caller (startAdmin) then refuses to start rather than query
+ *  the wrong repository (fail-closed). */
+export function parseRepoSlug(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') return null;
+  let s = rawUrl.trim();
+  if (s.startsWith('git+')) s = s.slice(4);
+  if (s.endsWith('.git')) s = s.slice(0, -4);
+  let pathPart;
+  const scp = s.match(/^[^@/]+@[^:/]+:(.+)$/); // git@github.com:owner/repo
+  if (scp) {
+    pathPart = scp[1];
+  } else {
+    try { pathPart = new URL(s).pathname; } catch { return null; }
+  }
+  const parts = pathPart.split('/').filter(Boolean);
+  if (parts.length >= 2 && parts[0] && parts[1]) return parts[0] + '/' + parts[1];
+  return null;
+}
+
+// ── fetch helpers (injectable — NFR-6) ────────────────────────────────────────
+
+/** One GitHub GET → parsed JSON, or null on any non-2xx / network error (EC-3,
+ *  EC-4). Never throws — the collector depends on that to keep Promise.all whole. */
+async function ghJson(fetchImpl, path, token) {
+  try {
+    const headers = { Accept: 'application/vnd.github+json', 'User-Agent': 'agentic-kit-admin' };
+    if (token) headers.Authorization = 'Bearer ' + token;
+    const r = await fetchImpl('https://api.github.com' + path, { headers });
+    return r.ok ? await r.json() : null;
+  } catch { return null; }
+}
+
+/** npm last-month daily range → object, or null on 404 / network failure (EC-2).
+ *  Scoped names are percent-encoded so `@scope/name` becomes `%40scope%2Fname`. */
+async function npmRange(fetchImpl, pkg) {
+  try {
+    const url = 'https://api.npmjs.org/downloads/range/last-month/' + encodeURIComponent(pkg);
+    const r = await fetchImpl(url);
+    return r.ok ? await r.json() : null;
+  } catch { return null; }
+}
+
+// ── the fan-out (FR-2, AC-2/3) ────────────────────────────────────────────────
+
+/** Fan out to GitHub + npm and assemble the typed payload. `fetchImpl` and
+ *  `ghToken` are injected; the credential never leaves this scope. */
+export async function collectAdminStats({ fetchImpl = fetch, ghToken = '', repoSlug, npmPkg }) {
+  const owner = repoSlug.split('/')[0];
+  const configured = Boolean(ghToken);
+  const gh = (path) => ghJson(fetchImpl, path, ghToken);
+
+  // Single Promise.all. Auth-gated calls resolve to null when unconfigured so we
+  // never issue a doomed request; each fetch is internally try/caught (EC-3).
+  const [repoRaw, releasesRaw, clonesRaw, viewsRaw, referrersRaw, npmRaw, issuesRaw, starsRaw, forksRaw] = await Promise.all([
+    gh('/repos/' + repoSlug),
+    gh('/repos/' + repoSlug + '/releases?per_page=20'),
+    configured ? gh('/repos/' + repoSlug + '/traffic/clones') : null,
+    configured ? gh('/repos/' + repoSlug + '/traffic/views') : null,
+    configured ? gh('/repos/' + repoSlug + '/traffic/popular/referrers') : null,
+    npmRange(fetchImpl, npmPkg),
+    gh('/repos/' + repoSlug + '/issues?state=all&per_page=100&sort=created&direction=desc'),
+    gh('/repos/' + repoSlug + '/stargazers?per_page=100'),
+    gh('/repos/' + repoSlug + '/forks?per_page=100&sort=newest'),
+  ]);
+
+  const releases = mapReleases(releasesRaw);
+  return {
+    generatedAt: new Date().toISOString(),
+    repoSlug,
+    repo: repoRaw
+      ? { stars: repoRaw.stargazers_count, forks: repoRaw.forks_count, watchers: repoRaw.subscribers_count, openIssues: repoRaw.open_issues_count }
+      : null,
+    releases,
+    totalAssetDownloads: sumAssetDownloads(releases),
+    traffic: {
+      configured,
+      note: configured ? null
+        : 'No GitHub credential resolved (GITHUB_TOKEN / GH_TOKEN / `gh auth token`). '
+          + 'Clones, views, and referrers need push access — those panels stay dark, not zero.',
+      clones: clonesRaw ? { count: clonesRaw.count, uniques: clonesRaw.uniques, daily: clonesRaw.clones || [] } : null,
+      views: viewsRaw ? { count: viewsRaw.count, uniques: viewsRaw.uniques, daily: viewsRaw.views || [] } : null,
+      referrers: Array.isArray(referrersRaw)
+        ? referrersRaw.map((x) => ({ referrer: x.referrer, count: x.count, uniques: x.uniques })) : null,
+    },
+    npm: npmToBlock(npmRaw),
+    people: buildPeople(issuesRaw, starsRaw, forksRaw, owner),
+    feedback: doors(repoSlug),
+  };
+}
+
+/** The collector the server runs when none is injected: resolve the credential,
+ *  then fan out. `resolveToken`/`fetchImpl` are injectable. On any thrown error it
+ *  returns a still-valid, honestly-degraded payload (never an error page).
+ *  @param {{ repoSlug: string, npmPkg?: string, fetchImpl?: typeof fetch,
+ *            resolveToken?: () => Promise<{ token: string }> }} o */
+export function defaultCollect({ repoSlug, npmPkg, fetchImpl = fetch, resolveToken = resolveGhToken }) {
+  return async () => {
+    try {
+      const { token } = await resolveToken();
+      return await collectAdminStats({ fetchImpl, ghToken: token, repoSlug, npmPkg });
+    } catch (e) {
+      return {
+        generatedAt: new Date().toISOString(), repoSlug, repo: null, releases: [], totalAssetDownloads: 0,
+        traffic: { configured: false, note: String((e && e.message) || e), clones: null, views: null, referrers: null },
+        npm: null, people: emptyPeople(), feedback: doors(repoSlug), error: String((e && e.message) || e),
+      };
+    }
+  };
+}
+
+// ── payload shapers (server-side; not embedded in the page) ───────────────────
+
+const slice10 = (s) => String(s || '').slice(0, 10);
+
+/** Group issues+PRs by EXTERNAL author (owner excluded), plus stargazer + fork
+ *  logins (owner excluded). An empty stargazer list while stars>0 is a credential
+ *  gap the client narrates (EC-4) — the collector faithfully returns [] here. */
+function buildPeople(issuesRaw, starsRaw, forksRaw, owner) {
+  const issues = Array.isArray(issuesRaw) ? issuesRaw : [];
+  const byAuthor = new Map();
+  for (const it of issues) {
+    const login = it.user && it.user.login;
+    if (!login || login === owner) continue; // exclude the owner's own threads
+    const isPR = Boolean(it.pull_request);
+    const e = byAuthor.get(login) || { login, issues: 0, prs: 0, association: 'NONE', items: [] };
+    if (isPR) e.prs++; else e.issues++;
+    if (/CONTRIBUTOR|MEMBER|COLLABORATOR/.test(it.author_association || '')) e.association = it.author_association;
+    e.items.push({ number: it.number, title: it.title, state: it.state, isPR, url: it.html_url, at: slice10(it.created_at) });
+    byAuthor.set(login, e);
+  }
+  const contributors = [...byAuthor.values()].sort((a, b) => (b.issues + b.prs) - (a.issues + a.prs));
+  const stargazers = (Array.isArray(starsRaw) ? starsRaw : []).map((s) => s.login).filter((l) => l && l !== owner);
+  const forks = (Array.isArray(forksRaw) ? forksRaw : [])
+    .map((f) => ({ login: f.owner && f.owner.login, at: slice10(f.created_at) }))
+    .filter((f) => f.login && f.login !== owner);
+  const engagers = new Set([...contributors.map((c) => c.login), ...stargazers, ...forks.map((f) => f.login)]);
+  return {
+    externalEngagers: engagers.size,
+    totalIssues: issues.filter((i) => !i.pull_request).length,
+    totalPRs: issues.filter((i) => i.pull_request).length,
+    contributors, stargazers, forks,
+  };
+}
+
+/** An empty People, used by the fail-soft path in defaultCollect. */
+function emptyPeople() {
+  return { externalEngagers: 0, totalIssues: 0, totalPRs: 0, contributors: [], stargazers: [], forks: [] };
+}
+
+/** Releases → {tag,name,publishedAt,assets[]}. No releases → [] (never null), so
+ *  the client's newest-release tile reads "unknown", not a fabricated 0 (EC-1). */
+function mapReleases(releasesRaw) {
+  if (!Array.isArray(releasesRaw)) return [];
+  return releasesRaw.map((r) => ({
+    tag: r.tag_name,
+    name: r.name || r.tag_name,
+    publishedAt: r.published_at,
+    assets: (r.assets || []).map((a) => ({ name: a.name, downloads: a.download_count || 0, sizeMB: Math.round((a.size || 0) / 1048576) })),
+  }));
+}
+
+/** Σ asset downloads. 0 ONLY when releases exist and truly sum to 0; "no
+ *  releases" is releases===[] → the client tile reads unknown, not 0 (EC-1). */
+function sumAssetDownloads(releases) {
+  return releases.reduce((sum, r) => sum + r.assets.reduce((s, a) => s + a.downloads, 0), 0);
+}
+
+/** npm range → {lastWeek,lastMonth,daily}, or null on 404 / network (EC-2). */
+function npmToBlock(npmRaw) {
+  if (!npmRaw) return null;
+  const daily = Array.isArray(npmRaw.downloads) ? npmRaw.downloads : [];
+  return {
+    lastWeek: daily.slice(-7).reduce((a, d) => a + d.downloads, 0),
+    lastMonth: daily.reduce((a, d) => a + d.downloads, 0),
+    daily, // full month, oldest-first, for the sparkline
+  };
+}
+
+/** The two "doors" — issues + discussions URLs — built from the slug, never the
+ *  network. */
+function doors(repoSlug) {
+  return {
+    issues: 'https://github.com/' + repoSlug + '/issues',
+    discussions: 'https://github.com/' + repoSlug + '/discussions',
+  };
+}
diff --git a/src/lib/admin-model.mjs b/src/lib/admin-model.mjs
new file mode 100644
index 00000000..af69b875
--- /dev/null
+++ b/src/lib/admin-model.mjs
@@ -0,0 +1,202 @@
+// admin-model.mjs — the pure client model for `ak x admin`.
+//
+// Adapted from the RuvNet Brain explainer admin (stuinfla/ruvnet-brain
+// explainer/admin.js, MIT © 2026 Stuart Kerr / Isovision.ai). The three
+// correctness rules below were earned the hard way there; we keep them verbatim.
+//
+// This file IMPORTS NOTHING — no Node builtin, no DOM. That is load-bearing
+// (ADR-0007 §5/§6): it makes the module both browser-safe (embedded verbatim in
+// the served page) AND node-importable (exercised directly by
+// tests/admin-model.test.cjs), so the tested code is byte-for-byte the shipped
+// code. A future edit that adds an import here breaks both properties.
+//
+// Three rules this file is built around:
+//   1. UNKNOWN IS NOT ZERO. Every metric passes through metric() and comes out
+//      {known:true,v} or {known:false,why}. null/'' are rejected BEFORE Number()
+//      coercion — both coerce to a finite 0 and would otherwise report a
+//      confident zero for a merely-absent source.
+//   2. NEVER DIFF A ROLLING WINDOW. Cumulative counters get current−baseline
+//      deltas (snapshot/cumDelta); rolling series get equal-window momentum()
+//      inside their own daily series.
+//   3. NO CONTROL WITHOUT AN EXECUTOR AND AN UNDO. (Enforced by the view; the
+//      model gives it a byte-for-byte snapshot to stash and restore.)
+
+const DAY_MS = 86400000;
+
+// Bots are noise in a "how many humans care" count, and the server only strips
+// the owner. dependabot[bot] / github-actions[bot] file real items, so without
+// this the human count reads too high.
+const BOT_RE = /\[bot\]$|^(dependabot|renovate|github-actions|codecov|greenkeeper|snyk-bot)$/i;
+
+// ── escaping + URL safety (NFR-7) ─────────────────────────────────────────────
+
+/** HTML-escape for text and attribute contexts. */
+export function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => (
+    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+  ));
+}
+
+// Every href on the page is built from third-party data (issue titles, logins,
+// html_urls). esc() kills the quote but would happily pass `javascript:`, which
+// still fires on click. So schemes are ALLOW-LISTED, not merely escaped.
+export function safeUrl(u) {
+  const s = String(u ?? '').trim();
+  return /^https?:\/\//i.test(s) ? esc(s) : '#';
+}
+
+// ── metric — Rule 1: unknown is NOT zero (NFR-4.1, AC-2) ──────────────────────
+
+export function metric(raw, why) {
+  // Absence is rejected BEFORE coercion: Number(null)===0 and Number('')===0
+  // both pass Number.isFinite, so the naive isFinite(Number(x)) reports a
+  // confident ZERO for a merely-absent source. undefined and NaN already fail
+  // isFinite; null and '' are the two that must be named here.
+  if (raw === null || raw === undefined || raw === '') {
+    return { known: false, why: why ?? 'no configured source provides this' };
+  }
+  const n = Number(raw);
+  if (Number.isFinite(n)) return { known: true, v: n };
+  return { known: false, why: why ?? 'no configured source provides this' };
+}
+
+// ── series helpers + momentum — Rule 2: never diff a rolling window (AC-6) ─────
+
+/** Normalise any daily series to ASCENDING by date, returning bare values. The
+ *  payload's order is inconsistent on purpose (GitHub oldest-first, others
+ *  vary); trusting incoming order would silently invert a momentum arrow. */
+export function ascend(rows, dateKey, valueKey) {
+  if (!Array.isArray(rows)) return null;
+  return rows
+    .map((r) => ({ t: Date.parse(r[dateKey]), v: Number(r[valueKey]) || 0 }))
+    .filter((r) => Number.isFinite(r.t))
+    .sort((a, b) => a.t - b.t)
+    .map((r) => r.v);
+}
+
+export function sum(a) { return a.reduce((x, y) => x + y, 0); }
+
+/** Last 7 days vs the prior 7, computed inside one source's own series so both
+ *  halves are equal-length windows. <4 points or an empty prior window → null
+ *  ("not enough history"), never a fabricated ratio (AC-6). */
+export function momentum(series) {
+  if (!Array.isArray(series) || series.length < 4) return null;
+  const recent = series.slice(-7);
+  const prior = series.slice(-14, -7);
+  if (prior.length === 0) return null;
+  const r = sum(recent);
+  const p = sum(prior);
+  // Equal-length or scale the shorter one — otherwise the ratio is meaningless.
+  const pScaled = prior.length === recent.length ? p : (p / prior.length) * recent.length;
+  const dir = r > pScaled * 1.05 ? 'up' : r < pScaled * 0.95 ? 'down' : 'flat';
+  const pct = pScaled > 0 ? Math.round(((r - pScaled) / pScaled) * 100) : null; // never divide by a 0 base
+  return { recent: r, prior: Math.round(pScaled), dir, pct, series };
+}
+
+// ── bots + dates ──────────────────────────────────────────────────────────────
+
+export function isBot(login) { return BOT_RE.test(String(login || '')); }
+
+export function daysAgo(iso) {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return null;
+  return Math.max(0, Math.floor((Date.now() - t) / DAY_MS));
+}
+
+export function agoLabel(iso) {
+  const d = daysAgo(iso);
+  if (d == null) return 'undated';
+  if (d === 0) return 'today';
+  if (d === 1) return 'yesterday';
+  return d < 31 ? d + 'd ago' : Math.floor(d / 30) + 'mo ago';
+}
+
+// ── shape — payload → humans + dated events (AC-4) ────────────────────────────
+
+/** One stable id per thread, so "have I seen this?" survives title/state edits. */
+export function itemId(it) { return (it.isPR ? 'p' : 'i') + it.number; }
+
+export function shape(d) {
+  const p = d.people ?? {};
+  const contributors = (p.contributors || []).filter((c) => !isBot(c.login));
+  const botItems = (p.contributors || []).filter((c) => isBot(c.login))
+    .reduce((n, c) => n + (c.items || []).length, 0);
+  const forks = (p.forks || []).filter((f) => !isBot(f.login));
+
+  // Every DATED human event. Stars have no date (the stargazers call omits the
+  // star+json Accept header carrying starred_at), so they are absent by design.
+  const events = [];
+  for (const c of contributors) {
+    for (const it of (c.items || [])) {
+      events.push({ id: itemId(it), kind: it.isPR ? 'PR' : 'issue', login: c.login, title: it.title, url: it.url, at: it.at, state: it.state });
+    }
+  }
+  for (const f of forks) {
+    events.push({ id: 'f:' + f.login, kind: 'fork', login: f.login, title: 'forked the repo', url: 'https://github.com/' + f.login, at: f.at, state: null });
+  }
+  events.sort((a, b) => String(b.at || '').localeCompare(String(a.at || '')));
+
+  // Per-person roll-up, ranked by RECENCY — someone who wrote yesterday outranks
+  // a higher-lifetime contributor who vanished weeks ago.
+  const people = contributors.map((c) => {
+    let dates = (c.items || []).map((i) => i.at).filter(Boolean).sort();
+    const forked = forks.find((f) => f.login === c.login);
+    if (forked) dates = dates.concat([forked.at]).sort();
+    return {
+      login: c.login, issues: c.issues || 0, prs: c.prs || 0,
+      open: (c.items || []).filter((i) => i.state === 'open').length,
+      first: dates[0] ?? null, last: dates[dates.length - 1] ?? null,
+      forked: Boolean(forked), association: c.association,
+    };
+  });
+  // Forkers who never filed anything are still humans who engaged.
+  for (const f of forks) {
+    if (!people.some((x) => x.login === f.login)) {
+      people.push({ login: f.login, issues: 0, prs: 0, open: 0, first: f.at, last: f.at, forked: true, association: 'NONE' });
+    }
+  }
+  people.sort((a, b) => String(b.last || '').localeCompare(String(a.last || '')));
+
+  const openItems = [];
+  for (const c of contributors) {
+    for (const it of (c.items || [])) {
+      if (it.state === 'open') openItems.push({ login: c.login, number: it.number, title: it.title, url: it.url, at: it.at, isPR: it.isPR });
+    }
+  }
+  openItems.sort((a, b) => String(a.at || '').localeCompare(String(b.at || ''))); // oldest first
+
+  // Distinguishes "all closed" from "none ever existed" — opposite facts.
+  const threadCount = contributors.reduce((n, c) => n + (c.items || []).length, 0);
+
+  return { people, events, openItems, botItems, forks, threadCount };
+}
+
+// ── snapshot + cumDelta — baseline memory, Rule 2 enforced (AC-4) ─────────────
+
+/** ONLY cumulative counters — rolling windows are excluded on purpose (Rule 2).
+ *  No `tel` field: ak has no opt-in counter store (deviation, see ADR-0007). */
+export function snapshot(d, s) {
+  return {
+    at: new Date().toISOString(),
+    ids: s.events.map((e) => e.id),         // to count NEW threads next visit
+    people: s.people.map((pp) => pp.login), // to count NEW people next visit
+    stars: d.repo ? d.repo.stars : null,
+    forks: d.repo ? d.repo.forks : null,
+    downloads: d.totalAssetDownloads == null ? null : d.totalAssetDownloads,
+  };
+}
+
+/** A cumulative delta, or an explicit "no baseline" — never a fabricated zero.
+ *  A known current value with no stored baseline arises two ways and the copy
+ *  must match which: a genuine first visit, or a counter that came online after
+ *  the snapshot was taken. */
+export function cumDelta(cur, baseVal, why, firstVisit) {
+  const m = metric(cur, why);
+  if (!m.known) return m; // unknown current ⇒ unknown delta (never 0)
+  if (baseVal == null || !Number.isFinite(Number(baseVal))) {
+    return { known: false, why: firstVisit
+      ? 'first visit — baseline captured now'
+      : 'counter appeared after your last visit — no baseline for it yet' };
+  }
+  return { known: true, v: m.v - Number(baseVal) };
+}
diff --git a/src/lib/admin-server.mjs b/src/lib/admin-server.mjs
new file mode 100644
index 00000000..fed14e6a
--- /dev/null
+++ b/src/lib/admin-server.mjs
@@ -0,0 +1,403 @@
+// admin-server.mjs — the loopback HTTP server for `ak x admin`.
+//
+// Adapted from the RuvNet Brain explainer admin (stuinfla/ruvnet-brain
+// explainer/{admin.html,api/admin-stats.mjs}, MIT © 2026 Stuart Kerr /
+// Isovision.ai). Where the reference is a hosted Vercel page gated by a static
+// ADMIN_TOKEN, this is a local-first sibling of the dashboard: zero-dep node:http,
+// bound to 127.0.0.1, minting a fresh per-session token at startup (ADR-0007).
+//
+// Two routes:
+//   GET /                → the ONE self-contained document (inline CSS + model +
+//                          view as a single module scope). CSP forbids every
+//                          external fetch; the only network call the page makes is
+//                          a same-origin fetch('/api/admin-stats').
+//   GET /api/admin-stats → the typed payload, behind an x-admin-token check
+//                          (constant-time, length-guarded). 401 JSON on mismatch,
+//                          carrying no data fields.
+import http from 'node:http';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseRepoSlug, defaultCollect } from './admin-collect.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = path.resolve(HERE, '..', '..');
+
+function readJsonSafe(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+/** Constant-time token compare with a length guard. timingSafeEqual THROWS on
+ *  unequal length, which is itself a length/timing oracle — the guard turns
+ *  unequal length into a plain `false`. No secret ⇒ never open (fail-closed). */
+export function tokenMatches(given, expected) {
+  if (!expected) return false;
+  const a = Buffer.from(String(given ?? ''));
+  const b = Buffer.from(String(expected));
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// The page makes ZERO external fetches; the browser enforces it via this header.
+const CSP = [
+  "default-src 'none'",           // deny everything not explicitly allowed
+  "script-src 'unsafe-inline'",   // the two inline module scripts (model+view)
+  "style-src 'unsafe-inline'",    // the one inline <style>
+  "connect-src 'self'",           // the ONLY network call: same-origin fetch()
+  "img-src 'none'",               // sparklines are inline SVG, not <img>
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
+/** Remove the single `import { … } from './admin-model.mjs';` line from the view
+ *  source so model + view concatenate into one inline module scope on the page.
+ *  On disk the import stays, keeping the view node --check / eslint clean. */
+function stripModelImport(src) {
+  return src.replace(/^\s*import\s*\{[^}]*\}\s*from\s*['"]\.\/admin-model\.mjs['"];?\s*$/m, '');
+}
+
+/**
+ * Start the admin server, bound to loopback only.
+ * @param {{ port?: number, collect?: () => Promise<any>,
+ *           resolveToken?: () => Promise<{token:string}>, pkg?: any }} [opts]
+ * @returns {Promise<{ url: string, urlWithToken: string, port: number, token: string, close: () => Promise<void> }>}
+ */
+export function startAdmin({ port = 7432, collect, resolveToken, pkg: injectedPkg } = {}) {
+  // Identity from the kit's own package.json (FR-2). Fail closed on EC-8: refuse
+  // to start rather than query the wrong repository.
+  const pkg = injectedPkg ?? readJsonSafe(path.join(PKG_ROOT, 'package.json'));
+  const repoSlug = parseRepoSlug(pkg && pkg.repository && pkg.repository.url);
+  if (!repoSlug) {
+    throw new Error('admin: cannot parse a GitHub owner/repo from package.json repository.url ('
+      + JSON.stringify(pkg && pkg.repository && pkg.repository.url) + '). Refusing to start rather than query the wrong repository.');
+  }
+  const npmPkg = pkg && pkg.name;
+
+  // Per-session auth secret (FR-3): 256-bit, fresh each start, URL-safe so it
+  // rides cleanly in the launch URL's # fragment. There is no unauth mode.
+  const token = crypto.randomBytes(32).toString('base64url');
+
+  // Assemble the ONE self-contained document once (NFR-2, AC-5). Only first-party
+  // source (model + view + CSS) is interpolated — no third-party data reaches the
+  // served HTML, so the document is static and self-contained.
+  const modelSrc = fs.readFileSync(path.join(HERE, 'admin-model.mjs'), 'utf8');
+  const viewSrc = stripModelImport(fs.readFileSync(path.join(HERE, 'admin-view.mjs'), 'utf8'));
+  const html = renderPage({ modelSrc, viewSrc });
+
+  const provide = collect || defaultCollect({ repoSlug, npmPkg, resolveToken });
+
+  const server = http.createServer(async (req, res) => {
+    if (req.method !== 'GET') { res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' }).end('method not allowed'); return; }
+
+    // DNS-rebinding guard (carried from dashboard-server): the socket binds
+    // loopback, but a hostile page can rebind ITS hostname to 127.0.0.1 and read
+    // our API cross-origin (the SOP keys on the NAME). Only loopback literals are
+    // legitimate Hosts.
+    const host = String(req.headers.host || '').toLowerCase();
+    if (!/^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/.test(host)) {
+      res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
+      res.end('forbidden (unexpected Host)');
+      return;
+    }
+
+    const url = (req.url || '/').split('?')[0];
+
+    if (url === '/' || url === '/index.html') {
+      res.writeHead(200, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'content-security-policy': CSP,
+        'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+      });
+      res.end(html);
+      return;
+    }
+
+    if (url === '/api/admin-stats') {
+      if (!tokenMatches(req.headers['x-admin-token'], token)) {
+        // 401 body carries NO data fields (AC-1). nosniff so a browser cannot be
+        // coaxed into re-interpreting the JSON body as another content type.
+        res.writeHead(401, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' });
+        res.end(JSON.stringify({ error: 'Wrong or missing admin token.' }));
+        return;
+      }
+      let payload;
+      try { payload = await provide(); }
+      catch (e) { payload = { generatedAt: new Date().toISOString(), error: String((e && e.message) || e) }; }
+      res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' });
+      res.end(JSON.stringify(payload));
+      return;
+    }
+
+    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  });
+
+  return new Promise((resolve, reject) => {
+    server.on('error', reject); // EADDRINUSE bubbles to the caller (EC-5)
+    server.listen(port, '127.0.0.1', () => { // loopback literal ONLY (NFR-2)
+      const addr = server.address();
+      const actual = addr && typeof addr === 'object' ? addr.port : port;
+      resolve({
+        url: `http://127.0.0.1:${actual}/`,
+        urlWithToken: `http://127.0.0.1:${actual}/#token=${token}`, // FR-3 fragment bootstrap
+        port: actual,
+        token,
+        close: () => new Promise((r) => server.close(() => r())),
+      });
+    });
+  });
+}
+
+// ── the page. One document, everything inline. Only first-party source is
+// interpolated: `${CSS}` (the style), `${modelSrc}` + `${viewSrc}` (the one
+// module scope). The client fetches /api/admin-stats and renders live. ─────────
+function renderPage({ modelSrc, viewSrc }) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<meta name="color-scheme" content="dark">
+<title>agentic-kit · admin</title>
+<style>${CSS}</style>
+</head>
+<body>
+<main class="wrap">
+  <div class="head">
+    <h1>agentic-kit — admin</h1>
+    <span class="stamp mono" data-stamp></span>
+  </div>
+  <p class="sub">What moved since you last looked, who moved it, and what is waiting on you. Every number is read live from GitHub or npm — nothing here is stored, assumed, or estimated. Maintainer-only, localhost-only, deliberate egress.</p>
+
+  <div class="gate" data-gate>
+    <p>Maintainer dashboard. Paste the one-time session token printed in your terminal (it also rode in on the launch URL's <code>#</code> fragment).</p>
+    <input type="password" placeholder="admin token" data-token-input autocomplete="off" spellcheck="false">
+    <button class="primary" data-token-go>Open dashboard</button>
+    <p class="err" data-err></p>
+  </div>
+
+  <div data-dash hidden>
+    <div class="controls">
+      <button data-refresh>Refresh now</button>
+      <label><input type="checkbox" data-auto> auto-refresh every 60s</label>
+      <button data-mark-review>Mark all reviewed</button>
+      <button class="undo" data-undo-review hidden>Undo mark reviewed</button>
+      <button class="right" data-logout>Forget token</button>
+    </div>
+
+    <section class="sec first">
+      <h2>How many people <span class="qual mono" data-reach-qual></span></h2>
+      <p class="lead">The closest honest answer to "how many people use this". Each tile says what it counts <em>and</em> what it cannot — three of the four are machine-side, so the tile that means <em>humans</em> is the first.</p>
+      <div class="reach" data-reach></div>
+      <p class="note" data-reach-note></p>
+    </section>
+
+    <section class="sec">
+      <h2>Momentum <span class="qual mono">last 7 days vs the 7 before — direction, not totals</span></h2>
+      <p class="lead">Computed inside each source's own daily series, so both halves cover an equal window. These are machine counters; read them for <em>shape</em> and the humans below for truth.</p>
+      <div class="mom" data-momentum></div>
+      <p class="note" data-momentum-note></p>
+    </section>
+
+    <section class="sec">
+      <h2>Since you last looked</h2>
+      <div class="since" data-since></div>
+    </section>
+
+    <section class="sec">
+      <h2>Waiting on you</h2>
+      <p class="lead">Open issues and PRs opened by someone other than you, oldest first. Closing the loop <em>is</em> the work.</p>
+      <div data-todo></div>
+    </section>
+
+    <section class="sec">
+      <h2>The humans <span class="qual mono" data-people-qual></span></h2>
+      <p class="lead">Everyone outside you who filed an issue, opened a PR, or forked — ranked by how recently they showed up, not alphabetically.</p>
+      <div data-people></div>
+    </section>
+
+    <section class="sec">
+      <h2>Every human event <span class="qual mono" data-feed-qual></span></h2>
+      <p class="lead">The one place the conversation lives. Titles link straight into the thread; this page deliberately does not paraphrase the sentiment (see "Not instrumented yet").</p>
+      <div data-feed></div>
+    </section>
+
+    <section class="sec">
+      <h2>Where they arrived from <span class="qual mono">rolling 14 days</span></h2>
+      <div class="tbl-scroll"><table class="adm" data-referrers></table></div>
+      <p class="note" data-referrers-note></p>
+    </section>
+
+    <section class="sec">
+      <h2>Not instrumented yet</h2>
+      <p class="lead">Things this page genuinely cannot see — listed rather than estimated. A dashboard that fills a gap with a plausible number is worse than one that admits it.</p>
+      <ul class="gaps" data-gaps></ul>
+    </section>
+
+    <section class="sec">
+      <h2>Doors</h2>
+      <p class="doors" data-doors></p>
+    </section>
+  </div>
+
+  <footer class="foot mono">maintainer-only · 127.0.0.1 · deliberate GitHub/npm egress · the credential never reaches this page</footer>
+</main>
+<script type="module">${modelSrc}
+${viewSrc}</script>
+</body>
+</html>`;
+}
+
+// ── Styles ───────────────────────────────────────────────────────────────────
+// Reproduced from scratch in the reference's visual language (RuvNet Brain
+// "amber substrate"): a graphite substrate lit by an amber mind, cyan signal,
+// green "grounded" — editorial serif display, humanist body, technical mono.
+// Self-contained: system font stacks only, NO external fonts (AC-5).
+const CSS = `
+:root{
+  color-scheme:dark;
+  --bg:#0a0c10; --bg-2:#0e1116; --surface:#13171e; --ridge:#2a3140;
+  --ink:#ece8dc; --ink-2:#c3c2b6; --muted:#8b8f9c; --faint:#5a5f6e; --on-accent:#0a0c10;
+  --accent:#f0a830; --accent-2:#5ad6ff; --accent-3:#5fd38a; --bad:#ff6b5e;
+  --display:"Iowan Old Style","Palatino Linotype",Palatino,Georgia,"Times New Roman",serif;
+  --sans:system-ui,-apple-system,"Segoe UI","Helvetica Neue",sans-serif;
+  --mono:ui-monospace,"SF Mono","JetBrains Mono",Menlo,"Cascadia Code",monospace;
+  --spectrum:linear-gradient(96deg,#f0a830 0%,#ffce6a 22%,#5ad6ff 55%,#5fd38a 100%);
+}
+*{box-sizing:border-box}
+html,body{margin:0;padding:0}
+body{background:var(--bg);color:var(--ink);font-family:var(--sans);font-size:14px;line-height:1.55;-webkit-font-smoothing:antialiased;font-variant-numeric:tabular-nums;min-height:100vh;overflow-x:hidden}
+.mono{font-family:var(--mono)}
+.wrap{max-width:1120px;margin:0 auto;padding:44px clamp(16px,4vw,28px) 90px}
+.head{display:flex;align-items:baseline;gap:14px;flex-wrap:wrap;margin-bottom:8px}
+.head h1{font-family:var(--display);font-weight:600;font-size:1.9rem;letter-spacing:-.012em;color:var(--ink);margin:0}
+.head::after{content:"";flex-basis:100%;height:2px;background:var(--spectrum);opacity:.9;border-radius:2px;margin-top:6px}
+.stamp{font-size:12px;color:var(--faint)}
+.sub{color:var(--muted);font-size:14px;margin:14px 0 26px;max-width:80ch}
+
+.gate{max-width:460px;background:var(--surface);border:1px solid var(--ridge);border-radius:12px;padding:26px 28px}
+.gate p{font-size:14px;color:var(--ink-2);margin:0 0 14px}
+.gate code{font-family:var(--mono);color:var(--accent);font-size:12.5px}
+.gate input{width:100%;background:var(--bg-2);border:1px solid var(--ridge);border-radius:10px;color:var(--ink);font-family:var(--mono);font-size:14px;padding:10px 12px;margin-bottom:12px}
+.gate input:focus{outline:2px solid var(--accent);outline-offset:1px;border-color:var(--accent)}
+.err{color:var(--bad);font-size:13.5px;margin:10px 0 0;min-height:1.2em}
+button{cursor:pointer;background:var(--surface);color:var(--ink);border:1px solid var(--ridge);border-radius:8px;font-family:var(--mono);font-size:12.5px;padding:6px 14px}
+button:hover{border-color:var(--accent)}
+button:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+button.primary{background:var(--accent);color:var(--on-accent);border:0;border-radius:10px;font-weight:700;font-size:14px;padding:10px 18px;font-family:var(--sans)}
+.controls{display:flex;align-items:center;gap:12px;margin-bottom:24px;font-family:var(--mono);font-size:12.5px;color:var(--muted);flex-wrap:wrap}
+.controls label{display:flex;align-items:center;gap:6px;cursor:pointer}
+.controls .undo{border-color:color-mix(in srgb,var(--accent) 50%,transparent);color:var(--accent)}
+.controls .right{margin-left:auto}
+
+.sec{margin-top:38px}
+.sec.first{margin-top:8px}
+.sec h2{font-family:var(--display);font-weight:600;font-size:1.25rem;color:var(--ink);margin:0 0 4px}
+.sec h2 .qual{font-size:11px;color:var(--faint);font-weight:400;letter-spacing:.03em}
+.sec .lead{font-size:13px;color:var(--muted);margin:0 0 12px;max-width:80ch}
+.sec .note{font-size:12.5px;color:var(--faint);margin:12px 0 0;max-width:80ch;line-height:1.55}
+.sec .lead em,.sub em{color:var(--ink-2);font-style:italic}
+
+.reach{display:grid;grid-template-columns:repeat(4,1fr);gap:12px;margin-top:12px}
+.rcell{border:1px solid var(--ridge);border-radius:12px;padding:16px 18px;background:var(--surface);min-width:0}
+.rcell.hero{border-color:color-mix(in srgb,var(--accent-3) 55%,var(--ridge))}
+.rcell b{display:block;font-family:var(--display);font-weight:600;font-size:32px;line-height:1.05;color:var(--ink)}
+.rcell.hero b{color:var(--accent-3)}
+.rcell.unknown b{color:var(--faint);font-size:22px}
+.rcell .lbl{display:block;margin-top:6px;font-family:var(--mono);font-size:11.5px;letter-spacing:.03em;color:var(--ink-2);line-height:1.4}
+.rcell .win{display:block;margin-top:3px;font-family:var(--mono);font-size:10.5px;color:var(--faint)}
+.rcell .caveat{display:block;margin-top:9px;padding-top:9px;border-top:1px solid var(--ridge);font-size:11.5px;color:var(--muted);line-height:1.5}
+
+.mom{display:grid;grid-template-columns:repeat(3,1fr);gap:12px;margin-top:12px}
+.mcell{border:1px solid var(--ridge);border-radius:12px;padding:15px 17px;background:var(--surface);min-width:0}
+.mcell .top{display:flex;align-items:baseline;gap:8px}
+.mcell .top b{font-family:var(--display);font-weight:600;font-size:25px;color:var(--ink);line-height:1.1}
+.mcell .arrow{font-family:var(--mono);font-size:12px}
+.mcell .arrow.up{color:var(--accent-3)} .mcell .arrow.down{color:var(--bad)} .mcell .arrow.flat{color:var(--faint)}
+.mcell span{display:block;margin-top:5px;font-family:var(--mono);font-size:11px;letter-spacing:.03em;color:var(--muted);line-height:1.4}
+.mcell .faint{color:var(--faint)}
+.mcell svg{display:block;width:100%;height:30px;margin-top:9px}
+.mcell.unknown b{color:var(--faint);font-size:20px}
+
+.since{background:var(--surface);border:1px solid var(--ridge);border-radius:14px;padding:22px 24px}
+.since .headline{font-family:var(--display);font-weight:600;font-size:1.25rem;color:var(--ink);margin:0 0 6px;line-height:1.34}
+.since .headline b{color:var(--accent)}
+.since .headline .flat{color:var(--muted)}
+.since-when{font-family:var(--mono);font-size:11.5px;color:var(--faint);margin:0 0 18px}
+.since-foot{font-size:12.5px;color:var(--faint);margin:14px 0 0;max-width:80ch;line-height:1.55}
+.dstrip{display:grid;grid-template-columns:repeat(5,1fr);gap:12px}
+.dcell{border:1px solid var(--ridge);border-radius:10px;padding:13px 15px;background:var(--bg-2);min-width:0}
+.dcell b{display:block;font-family:var(--display);font-weight:600;font-size:24px;line-height:1.1;color:var(--muted)}
+.dcell.up b{color:var(--accent-3)} .dcell.down b{color:var(--bad)}
+.dcell.unknown b{color:var(--faint);font-size:20px}
+.dcell span{display:block;margin-top:5px;font-family:var(--mono);font-size:10.5px;letter-spacing:.03em;color:var(--muted);line-height:1.4}
+.dcell em{display:block;margin-top:4px;font-style:normal;font-family:var(--mono);font-size:10px;color:var(--faint)}
+
+.todo,.tl{border:1px solid var(--ridge);border-radius:12px;background:var(--surface);overflow:hidden;margin-top:12px}
+.todo-row{display:flex;gap:14px;align-items:baseline;padding:13px 16px;border-bottom:1px solid var(--ridge)}
+.todo-row:last-child{border-bottom:none}
+.todo-row .age{font-family:var(--mono);font-size:11.5px;color:var(--bad);white-space:nowrap;min-width:74px}
+.todo-row .age.fresh{color:var(--accent)}
+.todo-row .body{min-width:0;flex:1}
+.todo-row .body a{color:var(--accent-2);text-decoration:none;font-size:14px}
+.todo-row .body a:hover{text-decoration:underline}
+.todo-row .body .by{display:block;margin-top:3px;font-family:var(--mono);font-size:11px;color:var(--faint)}
+.inbox-zero{border:1px solid color-mix(in srgb,var(--accent-3) 40%,var(--ridge));border-radius:12px;background:var(--surface);padding:18px 20px;margin-top:12px;font-size:14px;color:var(--ink-2)}
+.inbox-zero.ridge{border-color:var(--ridge)}
+.inbox-zero b{color:var(--accent-3)}
+
+.ppl{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:12px}
+.pcard{border:1px solid var(--ridge);border-radius:12px;padding:15px 17px;background:var(--surface)}
+.pcard.active{border-color:color-mix(in srgb,var(--accent-3) 55%,var(--ridge))}
+.pcard .who{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
+.pcard .who a{font-family:var(--display);font-weight:600;font-size:1.05rem;color:var(--accent-2);text-decoration:none}
+.pcard .span{margin:9px 0 0;font-family:var(--mono);font-size:11px;color:var(--faint);line-height:1.5}
+.badge{font-family:var(--mono);font-size:10.5px;padding:2px 8px;border-radius:999px;border:1px solid var(--ridge);color:var(--muted);white-space:nowrap}
+.badge.live{background:color-mix(in srgb,var(--accent-3) 15%,transparent);border-color:var(--accent-3);color:var(--accent-3)}
+.badge.new{background:color-mix(in srgb,var(--accent) 16%,transparent);border-color:var(--accent);color:var(--accent)}
+.badge.open{border-color:var(--accent);color:var(--accent)}
+.note{color:var(--faint);font-size:12px}
+
+.tl-row{display:flex;gap:13px;align-items:baseline;padding:11px 16px;border-bottom:1px solid var(--ridge);font-size:13.5px}
+.tl-row:last-child{border-bottom:none}
+.tl-row.is-new{background:color-mix(in srgb,var(--accent) 7%,transparent)}
+.tl-row .when{font-family:var(--mono);font-size:11.5px;color:var(--faint);white-space:nowrap;min-width:82px}
+.tl-row .kind{font-family:var(--mono);font-size:10.5px;color:var(--muted);white-space:nowrap;min-width:34px}
+.tl-row .what{min-width:0;flex:1;color:var(--ink-2);line-height:1.45}
+.tl-row .what a{color:var(--accent-2);text-decoration:none}
+.tl-row .what a:hover{text-decoration:underline}
+.tl-row .what .who{font-family:var(--mono);font-size:11px;color:var(--faint)}
+.more-btn{cursor:pointer;background:none;border:0;color:var(--accent-2);font-family:var(--mono);font-size:12px;padding:11px 16px}
+.more-btn:hover{color:var(--ink)}
+
+.tbl-scroll{overflow-x:auto;border:1px solid var(--ridge);border-radius:12px;background:var(--surface);margin-top:12px}
+table.adm{width:100%;border-collapse:collapse;font-size:13.5px}
+table.adm th{text-align:left;font-family:var(--mono);font-size:11px;text-transform:uppercase;letter-spacing:.08em;color:var(--faint);padding:12px 14px;border-bottom:1px solid var(--ridge)}
+table.adm td{padding:10px 14px;border-bottom:1px solid var(--ridge);color:var(--ink-2);vertical-align:top}
+table.adm tr:last-child td{border-bottom:none}
+table.adm td.num{font-family:var(--mono)}
+
+.gaps{border:1px dashed var(--ridge);border-radius:12px;background:var(--bg-2);padding:6px 20px;margin-top:12px}
+.gaps li{list-style:none;padding:13px 0;border-bottom:1px solid var(--ridge);font-size:13.5px;color:var(--ink-2);line-height:1.55}
+.gaps li:last-child{border-bottom:none}
+.gaps li b{color:var(--ink);font-weight:500}
+.gaps li .fix{display:block;margin-top:4px;font-family:var(--mono);font-size:11.5px;color:var(--faint)}
+.gaps li .tag{font-family:var(--mono);font-size:10px;text-transform:uppercase;letter-spacing:.07em;padding:2px 7px;border-radius:4px;margin-right:8px;border:1px solid var(--ridge);color:var(--muted)}
+.gaps li .tag.config{border-color:color-mix(in srgb,var(--accent) 50%,transparent);color:var(--accent)}
+.gaps li .tag.code{border-color:color-mix(in srgb,var(--accent-2) 50%,transparent);color:var(--accent-2)}
+.gaps li .tag.design{border-color:color-mix(in srgb,var(--accent-3) 50%,transparent);color:var(--accent-3)}
+
+.doors{font-size:14px;color:var(--ink-2);background:var(--surface);border:1px solid var(--ridge);border-radius:12px;padding:16px 20px;margin-top:12px}
+.doors a{color:var(--accent-2)}
+.foot{margin-top:40px;padding-top:16px;border-top:1px solid var(--ridge);color:var(--faint);font-size:11.5px}
+
+@media (max-width:880px){
+  .dstrip,.mom,.reach{grid-template-columns:1fr 1fr}
+  .ppl{grid-template-columns:1fr}
+}
+@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
+`;
diff --git a/src/lib/admin-view.mjs b/src/lib/admin-view.mjs
new file mode 100644
index 00000000..bc6dbb92
--- /dev/null
+++ b/src/lib/admin-view.mjs
@@ -0,0 +1,375 @@
+// admin-view.mjs — the browser controller for `ak x admin`.
+//
+// Adapted from the RuvNet Brain explainer admin (stuinfla/ruvnet-brain
+// explainer/admin.js, MIT © 2026 Stuart Kerr / Isovision.ai) — the DOM/fetch/event
+// half, with every number-shaping decision delegated to admin-model.mjs so the
+// tested code is the shipped code (ADR-0007 §5).
+//
+// This file is NEVER node-imported. admin-server.mjs reads it as text, STRIPS the
+// single model-import line below, and concatenates it after the model source into
+// one inline `<script type="module">` scope — so on the page `esc`, `shape`, etc.
+// are already in scope. On disk the import keeps the file `node --check`/eslint
+// clean and makes the dependency explicit.
+import { esc, safeUrl, metric, ascend, momentum, daysAgo, agoLabel, shape, snapshot, cumDelta } from './admin-model.mjs';
+
+const TOKEN_STORE = 'ak-admin-token';
+const BASE_STORE = 'ak-admin-baseline';
+const BASE_PREV = 'ak-admin-baseline-prev';
+const FEED_STEP = 25;
+
+const $ = (s) => document.querySelector(s);
+const num = (v) => Number(v).toLocaleString();
+
+let LAST = null;
+let feedShown = FEED_STEP;
+let autoTimer = null;
+
+// ── token bootstrap (FR-3): fragment → localStorage, then strip ────────────────
+// The fragment is never sent to the server, never logged, never proxied. We lift
+// it into localStorage, wipe it from the address bar, and thereafter send it ONLY
+// as the x-admin-token header — no query-param fallback anywhere.
+function bootToken() {
+  const m = String(location.hash || '').match(/token=([A-Za-z0-9_-]+)/);
+  if (m) {
+    try { localStorage.setItem(TOKEN_STORE, m[1]); } catch { /* private mode */ }
+    try { history.replaceState(null, '', location.pathname); } catch { /* older browsers */ }
+  }
+  try { return localStorage.getItem(TOKEN_STORE) || ''; } catch { return ''; }
+}
+const savedToken = () => { try { return localStorage.getItem(TOKEN_STORE) || ''; } catch { return ''; } };
+
+function showGate() { $('[data-gate]').hidden = false; $('[data-dash]').hidden = true; }
+function showError(msg) { $('[data-err]').textContent = msg; }
+function clearError() { $('[data-err]').textContent = ''; }
+
+function readBaseline() {
+  try { return JSON.parse(localStorage.getItem(BASE_STORE) || 'null'); } catch { return null; }
+}
+
+// ── tiny presentation helpers (SVG sparkline, delta cell) ─────────────────────
+function sparkline(series, stroke) {
+  if (!Array.isArray(series) || series.length < 2) return '';
+  const max = Math.max.apply(null, series.concat([1]));
+  const w = 120, h = 30;
+  const pts = series.map((v, i) => (i * (w / (series.length - 1))).toFixed(1) + ',' + (h - 2 - (v / max) * (h - 6)).toFixed(1)).join(' ');
+  return '<svg viewBox="0 0 ' + w + ' ' + h + '" preserveAspectRatio="none" aria-hidden="true">'
+    + '<polyline points="' + pts + '" fill="none" stroke="' + stroke + '" stroke-width="1.5" /></svg>';
+}
+
+function dcell(label, delta, footnote) {
+  if (!delta.known) {
+    return '<div class="dcell unknown"><b>—</b><span>' + esc(label) + '</span><em>' + esc(delta.why) + '</em></div>';
+  }
+  const cls = delta.v > 0 ? 'up' : delta.v < 0 ? 'down' : '';
+  const txt = delta.v > 0 ? '+' + num(delta.v) : delta.v < 0 ? '−' + num(Math.abs(delta.v)) : 'no change';
+  return '<div class="dcell ' + cls + '"><b>' + txt + '</b><span>' + esc(label) + '</span>'
+    + (footnote ? '<em>' + esc(footnote) + '</em>' : '') + '</div>';
+}
+
+// ── reach: four headline tiles, each carrying its own caveat as structure ─────
+function rcell(o) {
+  if (!o.value.known) {
+    return '<div class="rcell unknown"><b>—</b><span class="lbl">' + esc(o.label) + '</span>'
+      + '<span class="win">' + esc(o.value.why) + '</span><span class="caveat">' + esc(o.caveat) + '</span></div>';
+  }
+  return '<div class="rcell' + (o.hero ? ' hero' : '') + '"><b>' + num(o.value.v) + '</b>'
+    + '<span class="lbl">' + esc(o.label) + '</span><span class="win">' + esc(o.window) + '</span>'
+    + '<span class="caveat">' + esc(o.caveat) + '</span></div>';
+}
+
+function renderReach(d) {
+  const t = d.traffic || {};
+  const trafficWhy = t.configured ? 'no data in the current 14-day window' : 'no GitHub token — traffic API needs push access';
+  const rels = Array.isArray(d.releases) ? d.releases : [];
+  const newest = rels.filter((r) => r.assets && r.assets.length)[0] || null;
+  const newestDl = newest ? newest.assets.reduce((n, a) => n + (a.downloads || 0), 0) : null;
+
+  $('[data-reach]').innerHTML = [
+    rcell({ hero: true, label: 'unique repo visitors', window: 'rolling 14 days · github.com',
+      value: metric(t.views && t.views.uniques, trafficWhy),
+      caveat: 'The only tile here that counts PEOPLE. GitHub de-duplicates by visitor — humans who opened the repo, not machines or CI.' }),
+    rcell({ label: 'bundle downloads', window: 'lifetime, all releases',
+      value: metric(d.totalAssetDownloads, 'no release data returned'),
+      caveat: 'Downloads, NOT people — GitHub exposes no unique-downloader field for assets. One machine can count many times.' }),
+    rcell({ label: newest ? 'pulled ' + newest.tag : 'newest release pulls', window: newest ? 'since ' + String(newest.publishedAt || '').slice(0, 10) : 'no published release found',
+      value: metric(newestDl, 'no assets on the newest release'),
+      caveat: 'The closest read on the ACTIVE installed base: every live machine pulls the current bundle once. An estimate of machines.' }),
+    rcell({ label: 'opted-in installs', window: 'lifetime · consenting machines only',
+      value: metric(null, 'ak ships no opt-in counter — an honest gap, not a zero'),
+      caveat: 'ak has no telemetry to count this. It renders "—" on purpose; see "Not instrumented yet" below.' }),
+  ].join('');
+
+  const stars = d.repo ? d.repo.stars : null;
+  $('[data-reach-qual]').textContent = Number.isFinite(Number(stars))
+    ? '★ ' + num(stars) + ' stars · ' + num((d.repo && d.repo.forks) || 0) + ' forks'
+    : 'repo metadata unavailable';
+  $('[data-reach-note]').textContent = 'No counter here is a headcount, and the gap between them is the point: visitors are people, '
+    + 'bundle pulls are machines. npm downloads are excluded from this row — mirrors dominate them — and appear only in Momentum, as shape.';
+}
+
+// ── momentum: 7d vs prior 7d inside each source's own series ───────────────────
+function mcell(label, mom, stroke, unknownWhy) {
+  if (!mom) {
+    return '<div class="mcell unknown"><div class="top"><b>—</b></div><span>' + esc(label) + '</span>'
+      + '<span class="faint">' + esc(unknownWhy || 'not enough daily history to compare') + '</span></div>';
+  }
+  const arrow = mom.dir === 'up' ? '▲' : mom.dir === 'down' ? '▼' : '▬';
+  const pct = mom.pct == null ? '' : (mom.pct > 0 ? '+' : '') + mom.pct + '%';
+  return '<div class="mcell"><div class="top"><b>' + num(mom.recent) + '</b>'
+    + '<span class="arrow ' + mom.dir + '">' + arrow + ' ' + esc(pct) + '</span></div>'
+    + '<span>' + esc(label) + '<br>' + num(mom.prior) + ' in the prior 7d</span>'
+    + sparkline(mom.series, stroke) + '</div>';
+}
+
+function renderMomentum(d) {
+  const t = d.traffic || {};
+  const trafficWhy = t.configured ? 'no data in the current 14-day window' : 'no GitHub token — traffic API needs push access';
+  const viewSeries = t.views ? ascend(t.views.daily, 'timestamp', 'uniques') : null;
+  const cloneSeries = t.clones ? ascend(t.clones.daily, 'timestamp', 'uniques') : null;
+  const npmSeries = d.npm ? ascend(d.npm.daily, 'day', 'downloads') : null;
+  // Ordered nearest-to-a-human first; npm last with its mirror caveat.
+  $('[data-momentum]').innerHTML = [
+    mcell('unique repo visitors, last 7d', momentum(viewSeries), 'var(--accent-2)', trafficWhy),
+    mcell('unique cloners, last 7d', momentum(cloneSeries), 'var(--accent-2)', trafficWhy),
+    mcell('npm downloads, last 7d', momentum(npmSeries), 'var(--accent-3)', 'npm range unavailable'),
+  ].join('');
+  $('[data-momentum-note]').textContent = 'Left to right, each tile sits further from a human. Unique visitors are people; cloners are machines '
+    + '(ak\'s own CI among them); npm downloads are dominated by mirrors and move with release cadence, not adoption — its last day is partial.';
+}
+
+// ── since you last looked: cumulative deltas only (Rule 2) ────────────────────
+function renderSince(d, s, base) {
+  const box = $('[data-since]');
+  const firstVisit = !base;
+  const newIds = firstVisit ? [] : s.events.filter((e) => base.ids.indexOf(e.id) === -1);
+  const newPeople = firstVisit ? [] : s.people.filter((p) => base.people.indexOf(p.login) === -1);
+
+  let headline, when;
+  if (firstVisit) {
+    headline = '<span class="flat">First visit — baseline captured just now.</span> Deltas start next visit; everything below is live regardless.';
+    when = 'no prior snapshot on this browser';
+  } else if (newIds.length || newPeople.length) {
+    const bits = [];
+    if (newPeople.length) bits.push('<b>' + newPeople.length + ' new ' + (newPeople.length === 1 ? 'person' : 'people') + '</b>');
+    if (newIds.length) bits.push('<b>' + newIds.length + ' new ' + (newIds.length === 1 ? 'thread' : 'threads') + '</b>');
+    headline = bits.join(' and ') + ' since you last looked'
+      + (newPeople.length ? ' — ' + newPeople.slice(0, 4).map((p) => '@' + esc(p.login)).join(', ') + '.' : '.');
+    when = 'baseline: ' + esc(base.at.slice(0, 16).replace('T', ' ')) + ' UTC · ' + agoLabel(base.at);
+  } else {
+    headline = '<span class="flat">No new people or threads since you last looked.</span> Counter movement, if any, is below.';
+    when = 'baseline: ' + esc(base.at.slice(0, 16).replace('T', ' ')) + ' UTC · ' + agoLabel(base.at);
+  }
+
+  const cells = [
+    dcell('new threads (issues + PRs)', firstVisit ? { known: false, why: 'first visit — baseline captured now' } : { known: true, v: newIds.length }),
+    dcell('GitHub stars', cumDelta(d.repo && d.repo.stars, base && base.stars, 'repo metadata unavailable', firstVisit), d.repo ? num(d.repo.stars) + ' total' : ''),
+    dcell('forks', cumDelta(d.repo && d.repo.forks, base && base.forks, 'repo metadata unavailable', firstVisit), d.repo ? num(d.repo.forks) + ' total' : ''),
+    dcell('release bundle downloads', cumDelta(d.totalAssetDownloads, base && base.downloads, 'no release data returned', firstVisit), d.totalAssetDownloads == null ? '' : num(d.totalAssetDownloads) + ' lifetime'),
+    dcell('new humans engaged', firstVisit ? { known: false, why: 'first visit — baseline captured now' } : { known: true, v: newPeople.length }),
+  ];
+
+  box.innerHTML = '<p class="headline">' + headline + '</p><p class="since-when">' + when + '</p>'
+    + '<div class="dstrip">' + cells.join('') + '</div>'
+    + '<p class="since-foot">Only cumulative counters appear above. Rolling 14-day and 7-day windows (clones, views, npm) live in Momentum — '
+    + 'subtracting two readings of a rolling window compares two different time spans, so it can fall while the project grows.</p>';
+  return { newIds: newIds.map((e) => e.id), firstVisit };
+}
+
+function renderTodo(s) {
+  const host = $('[data-todo]');
+  if (!s.openItems.length) {
+    host.innerHTML = s.threadCount
+      ? '<div class="inbox-zero"><b>Nothing open from anyone outside you.</b> All ' + s.threadCount + ' external threads are closed — read from the live issue list, not a placeholder.</div>'
+      : '<div class="inbox-zero ridge">No one outside you has opened an issue or PR yet, so there is nothing waiting. Not a cleared queue — an empty one.</div>';
+    return;
+  }
+  host.innerHTML = '<div class="todo">' + s.openItems.map((it) => {
+    const age = daysAgo(it.at);
+    const cls = age != null && age > 3 ? '' : 'fresh';
+    return '<div class="todo-row"><span class="age ' + cls + '">' + esc(age == null ? '—' : age + 'd open') + '</span>'
+      + '<span class="body"><a href="' + safeUrl(it.url) + '" target="_blank" rel="noopener">'
+      + (it.isPR ? 'PR ' : '#') + esc(it.number) + ' — ' + esc(it.title) + '</a>'
+      + '<span class="by">@' + esc(it.login) + ' · opened ' + esc(it.at) + '</span></span></div>';
+  }).join('') + '</div>';
+}
+
+function renderPeople(d, s, base) {
+  const host = $('[data-people]');
+  const qual = $('[data-people-qual]');
+  const known = s.people.length;
+  const stars = d.repo ? d.repo.stars : null;
+  const namedStars = (d.people && d.people.stargazers) || [];
+  let starNote = '';
+  if (Number.isFinite(Number(stars)) && Number(stars) > 0 && namedStars.length === 0) {
+    starNote = num(stars) + ' stars exist, but GitHub returns the stargazer list only to an authenticated caller — set GITHUB_TOKEN to see who. '
+      + 'Their absence here is a missing credential, not a missing person.';
+  } else if (namedStars.length) {
+    // Built UNESCAPED — the sink esc()'s the whole starNote once (single-escape at
+    // the sink, the house rule; the logins were being double-escaped otherwise).
+    starNote = 'Plus ' + namedStars.length + ' stargazer' + (namedStars.length === 1 ? '' : 's') + ' with no dated activity: '
+      + namedStars.slice(0, 20).map((l) => '@' + l).join(', ') + '.';
+  }
+  qual.textContent = known + ' named · bots excluded' + (s.botItems ? ' (' + s.botItems + ' bot items hidden)' : '');
+  if (!known) {
+    host.innerHTML = '<div class="inbox-zero ridge">No external humans have filed an issue, opened a PR, or forked yet.' + (starNote ? ' ' + esc(starNote) : '') + '</div>';
+    return;
+  }
+  host.innerHTML = '<div class="ppl">' + s.people.map((p) => {
+    const recent = p.last && daysAgo(p.last) != null && daysAgo(p.last) <= 7;
+    const isNew = base && base.people.indexOf(p.login) === -1;
+    let badges = '';
+    if (isNew) badges += '<span class="badge new">new</span>';
+    if (recent) badges += '<span class="badge live">active this week</span>';
+    if (p.open) badges += '<span class="badge open">' + p.open + ' open</span>';
+    if (p.association && p.association !== 'NONE') badges += '<span class="badge">' + esc(String(p.association).toLowerCase()) + '</span>';
+    const counts = [];
+    if (p.issues) counts.push(p.issues + ' issue' + (p.issues === 1 ? '' : 's'));
+    if (p.prs) counts.push(p.prs + ' PR' + (p.prs === 1 ? '' : 's'));
+    if (p.forked) counts.push('forked');
+    return '<div class="pcard' + (recent ? ' active' : '') + '"><div class="who"><a href="https://github.com/' + esc(p.login) + '" target="_blank" rel="noopener">@' + esc(p.login) + '</a>' + badges + '</div>'
+      + '<p class="span">' + esc(counts.join(' · ') || 'engaged') + '<br>last seen ' + esc(agoLabel(p.last)) + ' · first seen ' + esc(agoLabel(p.first)) + '</p></div>';
+  }).join('') + '</div>' + (starNote ? '<p class="note">' + esc(starNote) + '</p>' : '');
+}
+
+function renderFeed(s, newIds) {
+  const host = $('[data-feed]');
+  const qual = $('[data-feed-qual]');
+  qual.textContent = s.events.length + ' dated events';
+  if (!s.events.length) { host.innerHTML = '<div class="inbox-zero ridge">No dated human events yet.</div>'; return; }
+  const slice = s.events.slice(0, feedShown);
+  const rows = slice.map((e) => {
+    const fresh = newIds.indexOf(e.id) !== -1;
+    const link = e.kind === 'fork'
+      ? '<a href="' + safeUrl(e.url) + '" target="_blank" rel="noopener">@' + esc(e.login) + '</a> forked the repo'
+      : '<a href="' + safeUrl(e.url) + '" target="_blank" rel="noopener">' + esc(e.title) + '</a> <span class="who">@' + esc(e.login) + (e.state ? ' · ' + esc(e.state) : '') + '</span>';
+    return '<div class="tl-row' + (fresh ? ' is-new' : '') + '"><span class="when">' + esc(e.at || '—') + '</span>'
+      + '<span class="kind">' + esc(e.kind) + '</span><span class="what">' + (fresh ? '<span class="badge new">new</span> ' : '') + link + '</span></div>';
+  }).join('');
+  const more = s.events.length > feedShown
+    ? '<button class="more-btn" data-feed-more>Show ' + Math.min(FEED_STEP, s.events.length - feedShown) + ' older →</button>'
+    : (feedShown > FEED_STEP ? '<button class="more-btn" data-feed-less>← Collapse back to ' + FEED_STEP + '</button>' : '');
+  host.innerHTML = '<div class="tl">' + rows + more + '</div>';
+}
+
+function renderReferrers(d) {
+  const t = d.traffic || {};
+  if (Array.isArray(t.referrers) && t.referrers.length) {
+    $('[data-referrers]').innerHTML = '<tr><th>referrer</th><th>views, 14d</th><th>uniques</th></tr>'
+      + t.referrers.map((x) => '<tr><td>' + esc(x.referrer) + '</td><td class="num">' + num(x.count) + '</td><td class="num">' + num(x.uniques) + '</td></tr>').join('');
+    $('[data-referrers-note]').textContent = 'GitHub "popular referrers" — where repo visitors arrived from.';
+  } else {
+    $('[data-referrers]').innerHTML = '<tr><td>' + esc(t.configured ? 'No referrer data in the current 14-day window.' : (t.note || 'No GitHub token — referrers need push access.')) + '</td></tr>';
+    $('[data-referrers-note]').textContent = '';
+  }
+}
+
+// The honesty section — three kinds of entry: config (fixable now) / code (not
+// built) / design (kept on purpose). ak's real gaps, named rather than guessed.
+function renderGaps(d) {
+  const out = [];
+  const t = d.traffic || {};
+  if (!t.configured) out.push(['config', 'Clones, views, and referrers are dark.', 'No GITHUB_TOKEN / GH_TOKEN / gh auth token with push access resolved. Every traffic panel says so rather than showing 0.']);
+  if (d.repo && d.repo.stars > 0 && !((d.people && d.people.stargazers) || []).length) out.push(['config', 'The ' + num(d.repo.stars) + ' stargazers are counted but unnamed.', 'GET /stargazers answers 401 without a token — the count is public, the list is not.']);
+  out.push(['code', 'Opt-in install / search telemetry.', 'ak ships no phone-home counter, so "opted-in installs" reads "—". Building one is a code change, not a config toggle — hence a gap, never a fabricated zero.']);
+  out.push(['code', 'The actual words people wrote.', 'The collector maps each thread to {number,title,state,isPR,url,at} and drops comment bodies, reactions, and sentiment. This page proves a conversation happened and links to it — it does not quote or score it.']);
+  out.push(['code', 'GitHub Discussions activity.', 'The Discussions API is GraphQL-only; the collector speaks REST, so Discussions are linked but never read.']);
+  out.push(['code', 'npm downloads split by version, and when each star happened.', 'api.npmjs.org returns one total per day; the stargazers call omits starred_at, so stars cannot be placed on the timeline. Forks can, and are.']);
+  out.push(['design', 'Any remote hosting of this page. Deliberate, and staying that way.', 'admin is loopback-only, foreground, per-session-token. It exists to reach GitHub/npm on your behalf — never to be reachable itself.']);
+  const TAG = { config: 'fixable now', code: 'not built yet', design: 'by design' };
+  $('[data-gaps]').innerHTML = out.map((g) => '<li><span class="tag ' + g[0] + '">' + TAG[g[0]] + '</span><b>' + esc(g[1]) + '</b><span class="fix">' + esc(g[2]) + '</span></li>').join('');
+}
+
+function renderDoors(d) {
+  const f = d.feedback || {};
+  $('[data-doors]').innerHTML = 'Feedback → <a href="' + safeUrl(f.discussions) + '" target="_blank" rel="noopener">GitHub Discussions</a> · '
+    + 'bugs → <a href="' + safeUrl(f.issues) + '" target="_blank" rel="noopener">Issues</a>.';
+}
+
+// ── orchestration ─────────────────────────────────────────────────────────────
+function render(d) {
+  LAST = d;
+  $('[data-gate]').hidden = true;
+  $('[data-dash]').hidden = false;
+  $('[data-stamp]').textContent = 'live read ' + String(d.generatedAt || '').slice(0, 19).replace('T', ' ') + ' UTC';
+  const s = shape(d);
+  const base = readBaseline();
+  renderReach(d);
+  const since = renderSince(d, s, base);
+  renderTodo(s);
+  renderPeople(d, s, base);
+  renderFeed(s, since.newIds);
+  renderMomentum(d);
+  renderReferrers(d);
+  renderGaps(d);
+  renderDoors(d);
+  // First visit ONLY: seed the baseline so the NEXT visit has an honest diff.
+  // Never auto-advanced — that would consume the very deltas this page exists for.
+  if (!base) { try { localStorage.setItem(BASE_STORE, JSON.stringify(snapshot(d, s))); } catch { /* private mode */ } }
+  $('[data-undo-review]').hidden = !savedBaselinePrev();
+}
+function savedBaselinePrev() { try { return localStorage.getItem(BASE_PREV); } catch { return null; } }
+
+async function load(token, opts) {
+  const silent = opts && opts.silent;
+  clearError();
+  let r, j;
+  try {
+    r = await fetch('/api/admin-stats', { headers: { 'x-admin-token': token }, cache: 'no-store' });
+    j = await r.json().catch(() => ({}));
+  } catch (e) {
+    if (!silent) showError('Network error: ' + e.message);
+    return;
+  }
+  if (!r.ok) {
+    if (!silent) {
+      showError(j.error || ('HTTP ' + r.status));
+      try { localStorage.removeItem(TOKEN_STORE); } catch { /* private mode */ }
+      showGate();
+    }
+    return;
+  }
+  try { localStorage.setItem(TOKEN_STORE, token); } catch { /* private mode */ }
+  render(j);
+}
+
+// ── controls — each an executor + inverse (NFR-4.3, FR-6) ─────────────────────
+function wire() {
+  $('[data-token-go]').addEventListener('click', () => load($('[data-token-input]').value.trim()));
+  $('[data-token-input]').addEventListener('keydown', (e) => { if (e.key === 'Enter') load($('[data-token-input]').value.trim()); });
+  $('[data-refresh]').addEventListener('click', () => load(savedToken(), { silent: true }));
+  $('[data-logout]').addEventListener('click', () => { try { localStorage.removeItem(TOKEN_STORE); } catch { /* private mode */ } location.reload(); });
+
+  $('[data-mark-review]').addEventListener('click', () => {
+    if (!LAST) return;
+    try {
+      const prev = localStorage.getItem(BASE_STORE);
+      if (prev) localStorage.setItem(BASE_PREV, prev);         // stash for the inverse
+      localStorage.setItem(BASE_STORE, JSON.stringify(snapshot(LAST, shape(LAST))));
+    } catch { /* private mode */ }
+    render(LAST);
+  });
+  $('[data-undo-review]').addEventListener('click', () => {
+    let prev;
+    try { prev = localStorage.getItem(BASE_PREV); } catch { prev = null; }
+    if (!prev) return;
+    try { localStorage.setItem(BASE_STORE, prev); localStorage.removeItem(BASE_PREV); } catch { /* private mode */ }
+    if (LAST) render(LAST);
+  });
+
+  $('[data-auto]').addEventListener('change', (e) => {
+    if (autoTimer) { clearInterval(autoTimer); autoTimer = null; }
+    if (e.target.checked) autoTimer = setInterval(() => load(savedToken(), { silent: true }), 60000);
+  });
+
+  // Feed paging is its own undo (show more ⇄ collapse).
+  document.addEventListener('click', (e) => {
+    const el = e.target;
+    if (!el || !el.getAttribute) return;
+    if (el.hasAttribute('data-feed-more')) { feedShown += FEED_STEP; if (LAST) render(LAST); }
+    if (el.hasAttribute('data-feed-less')) { feedShown = FEED_STEP; if (LAST) render(LAST); }
+  });
+}
+
+wire();
+const boot = bootToken();
+if (boot) load(boot); else showGate();
diff --git a/src/lib/browser.mjs b/src/lib/browser.mjs
new file mode 100644
index 00000000..beec5b90
--- /dev/null
+++ b/src/lib/browser.mjs
@@ -0,0 +1,23 @@
+// browser.mjs — open a URL in the OS default browser, best-effort.
+//
+// Extracted from x/dashboard.mjs so both the dashboard and admin commands share
+// one implementation (ADR-0007 IP-4). Behaviour-preserving: zero-dep spawn of
+// the platform opener, never throws — a headless box just gets the printed URL.
+import { spawn } from 'node:child_process';
+
+/** Open a URL in the OS default browser, best-effort (never throws). Zero-dep:
+ *  macOS `open`, Windows `cmd /c start`, else `xdg-open`. */
+export function openInBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'cmd'
+      : 'xdg-open';
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => { /* no browser / headless — URL is already printed */ });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
diff --git a/tests/admin-model.test.cjs b/tests/admin-model.test.cjs
new file mode 100644
index 00000000..aa4859c8
--- /dev/null
+++ b/tests/admin-model.test.cjs
@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+//
+// admin-model.test.cjs — unit tests for the PURE client model (src/lib/admin-model.mjs).
+// This is the "tested code is shipped code" seam (ADR-0007 §5): the very functions
+// exercised here are embedded verbatim into the served admin page. Zero-dep, network-
+// free — the model imports nothing and touches no DOM, so it runs straight in node.
+//
+// Run: node tests/admin-model.test.cjs   (exit 0 = pass, 1 = fail)
+
+const path = require('path');
+const ROOT = path.resolve(__dirname, '..');
+const MOD = path.join(ROOT, 'src', 'lib', 'admin-model.mjs');
+
+// ── tiny harness (matches dashboard.test.cjs) ────────────────────────────────
+let passed = 0, failed = 0;
+function test(name, fn) {
+  return Promise.resolve()
+    .then(fn)
+    .then(() => { console.log('  \x1b[32m✓\x1b[0m ' + name); passed++; })
+    .catch((e) => { console.log('  \x1b[31m✗\x1b[0m ' + name + '\n      ' + (e && e.message)); failed++; });
+}
+function assert(cond, msg) { if (!cond) throw new Error(msg || 'assertion failed'); }
+function eq(a, b, msg) { assert(a === b, (msg || 'equality') + ` — expected ${JSON.stringify(b)}, got ${JSON.stringify(a)}`); }
+
+async function main() {
+  const M = await import('file://' + MOD);
+
+  // ── esc / safeUrl (NFR-7 XSS discipline) ───────────────────────────────────
+  await test('esc escapes all five HTML-significant characters', () => {
+    eq(M.esc(`<b>&"'`), '&lt;b&gt;&amp;&quot;&#39;');
+  });
+  await test('esc coerces null/undefined to empty string', () => {
+    eq(M.esc(null), '');
+    eq(M.esc(undefined), '');
+  });
+  await test('safeUrl passes https/http and escapes them', () => {
+    eq(M.safeUrl('https://github.com/a/b'), 'https://github.com/a/b');
+    eq(M.safeUrl('HTTP://Example.com'), 'HTTP://Example.com');
+  });
+  await test('safeUrl rejects javascript: and other schemes with #', () => {
+    eq(M.safeUrl('javascript:alert(1)'), '#');
+    eq(M.safeUrl('ftp://x/y'), '#');
+    eq(M.safeUrl('data:text/html,x'), '#');
+    eq(M.safeUrl(''), '#');
+    eq(M.safeUrl(null), '#');
+  });
+  await test('safeUrl escapes a quote that would break out of the attribute', () => {
+    // scheme allow-listed AND esc'd — the quote can never terminate the href
+    assert(!M.safeUrl('https://x/"onmouseover=alert(1)').includes('"'), 'quote must be escaped');
+  });
+
+  // ── metric: Rule 1 — unknown is NOT zero (NFR-4.1, AC-2) ────────────────────
+  await test('metric(null) is unknown, never a zero', () => {
+    const m = M.metric(null);
+    eq(m.known, false);
+    assert(m.v === undefined, 'unknown must carry no value');
+    assert(typeof m.why === 'string' && m.why.length > 0, 'unknown must carry a reason');
+  });
+  await test('metric(empty string) is unknown (rejected before Number coercion)', () => {
+    eq(M.metric('').known, false);
+  });
+  await test('metric(undefined) and metric(NaN) and non-numeric are unknown', () => {
+    eq(M.metric(undefined).known, false);
+    eq(M.metric(NaN).known, false);
+    eq(M.metric('abc').known, false);
+  });
+  await test('metric(0) is a KNOWN zero — a real measured zero is not absence', () => {
+    const m = M.metric(0);
+    eq(m.known, true);
+    eq(m.v, 0);
+  });
+  await test('metric coerces numeric strings and passes finite numbers', () => {
+    eq(M.metric('42').v, 42);
+    eq(M.metric(7).v, 7);
+  });
+  await test('metric carries a custom why through', () => {
+    eq(M.metric(null, 'no token').why, 'no token');
+  });
+
+  // ── ascend / sum ────────────────────────────────────────────────────────────
+  await test('ascend normalises any order to ascending-by-date values', () => {
+    const rows = [
+      { day: '2026-01-03', downloads: 3 },
+      { day: '2026-01-01', downloads: 1 },
+      { day: '2026-01-02', downloads: 2 },
+    ];
+    const s = M.ascend(rows, 'day', 'downloads');
+    eq(JSON.stringify(s), JSON.stringify([1, 2, 3]));
+  });
+  await test('ascend drops undated points and returns null for non-arrays', () => {
+    const rows = [{ day: 'not-a-date', downloads: 9 }, { day: '2026-01-01', downloads: 5 }];
+    eq(JSON.stringify(M.ascend(rows, 'day', 'downloads')), JSON.stringify([5]));
+    eq(M.ascend(null, 'day', 'downloads'), null);
+  });
+  await test('sum adds a numeric array', () => { eq(M.sum([1, 2, 3, 4]), 10); });
+
+  // ── momentum: Rule 2 — never fabricate a ratio (NFR-4.2, AC-6) ──────────────
+  await test('momentum is null for a series shorter than 4 points', () => {
+    eq(M.momentum([1, 2, 3]), null);
+    eq(M.momentum([]), null);
+    eq(M.momentum(null), null);
+  });
+  await test('momentum is null when the prior window is empty (4..7 points)', () => {
+    // length 6: slice(-14,-7) is [] → no honest prior window (AC-6)
+    eq(M.momentum([1, 2, 3, 4, 5, 6]), null);
+  });
+  await test('momentum computes an UP direction over equal 7d windows', () => {
+    const series = [10, 10, 10, 10, 10, 10, 10, 20, 20, 20, 20, 20, 20, 20];
+    const m = M.momentum(series);
+    eq(m.recent, 140);
+    eq(m.prior, 70);
+    eq(m.dir, 'up');
+    eq(m.pct, 100);
+  });
+  await test('momentum reports flat when recent ~= prior', () => {
+    const series = [10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10];
+    eq(M.momentum(series).dir, 'flat');
+  });
+  await test('momentum never divides by a zero prior base (pct null)', () => {
+    const series = [0, 0, 0, 0, 0, 0, 0, 5, 5, 5, 5, 5, 5, 5];
+    const m = M.momentum(series);
+    eq(m.pct, null);
+    eq(m.dir, 'up');
+  });
+
+  // ── bots + dates ─────────────────────────────────────────────────────────────
+  await test('isBot recognises [bot] suffixes and known bot logins', () => {
+    eq(M.isBot('dependabot[bot]'), true);
+    eq(M.isBot('renovate'), true);
+    eq(M.isBot('github-actions'), true);
+    eq(M.isBot('alice'), false);
+    eq(M.isBot(''), false);
+  });
+  await test('daysAgo returns 0 for now and null for an unparseable date', () => {
+    eq(M.daysAgo(new Date().toISOString()), 0);
+    eq(M.daysAgo('nonsense'), null);
+  });
+  await test('agoLabel words the recent past and flags undated', () => {
+    eq(M.agoLabel(new Date().toISOString()), 'today');
+    eq(M.agoLabel('nonsense'), 'undated');
+  });
+
+  // ── itemId ───────────────────────────────────────────────────────────────────
+  await test('itemId is stable per thread and distinguishes PR from issue', () => {
+    eq(M.itemId({ isPR: true, number: 5 }), 'p5');
+    eq(M.itemId({ isPR: false, number: 7 }), 'i7');
+  });
+
+  // ── shape: humans + events (AC-4, bot exclusion) ────────────────────────────
+  const PAYLOAD = {
+    repo: { stars: 20, forks: 4, watchers: 3, openIssues: 2 },
+    totalAssetDownloads: 1000,
+    people: {
+      contributors: [
+        { login: 'alice', issues: 2, prs: 0, association: 'CONTRIBUTOR', items: [
+          { number: 1, title: 'old bug', state: 'closed', isPR: false, url: 'https://github.com/o/r/issues/1', at: '2026-01-01' },
+          { number: 9, title: 'fresh bug', state: 'open', isPR: false, url: 'https://github.com/o/r/issues/9', at: '2026-06-01' },
+        ] },
+        { login: 'bob', issues: 0, prs: 1, association: 'NONE', items: [
+          { number: 5, title: 'a PR', state: 'open', isPR: true, url: 'https://github.com/o/r/pull/5', at: '2026-03-01' },
+        ] },
+        { login: 'dependabot[bot]', issues: 1, prs: 0, association: 'NONE', items: [
+          { number: 8, title: 'bump dep', state: 'open', isPR: false, url: 'https://github.com/o/r/issues/8', at: '2026-05-01' },
+        ] },
+      ],
+      stargazers: ['carol'],
+      forks: [{ login: 'dave', at: '2026-04-01' }],
+    },
+  };
+
+  await test('shape excludes bots from people and events, counting bot items separately', () => {
+    const s = M.shape(PAYLOAD);
+    assert(!s.people.some((p) => p.login === 'dependabot[bot]'), 'bots must not appear as humans');
+    assert(!s.events.some((e) => e.login === 'dependabot[bot]'), 'bot items must not appear in the feed');
+    eq(s.botItems, 1);
+  });
+  await test('shape includes a forker who never filed as a human', () => {
+    const s = M.shape(PAYLOAD);
+    const dave = s.people.find((p) => p.login === 'dave');
+    assert(dave && dave.forked === true, 'dave forked but filed nothing — still a human');
+  });
+  await test('shape ranks people by recency (most recent last-seen first)', () => {
+    const s = M.shape(PAYLOAD);
+    // alice last=2026-06-01, dependabot excluded, bob=2026-03-01, dave=2026-04-01
+    eq(s.people[0].login, 'alice');
+  });
+  await test('shape feed is newest-first and carries a fork event', () => {
+    const s = M.shape(PAYLOAD);
+    for (let i = 1; i < s.events.length; i++) {
+      assert(String(s.events[i - 1].at) >= String(s.events[i].at), 'events must be newest-first');
+    }
+    assert(s.events.some((e) => e.kind === 'fork' && e.login === 'dave'), 'fork event present');
+  });
+  await test('shape openItems are oldest-first and threadCount counts non-bot items', () => {
+    const s = M.shape(PAYLOAD);
+    // open items: alice #9 (2026-06-01) and bob #5 (2026-03-01) → oldest first = bob
+    eq(s.openItems[0].number, 5);
+    eq(s.threadCount, 3); // alice 2 + bob 1 (bot item excluded)
+  });
+
+  // ── snapshot + cumDelta: baseline memory, Rule 2 (AC-4) ─────────────────────
+  await test('snapshot captures only cumulative counters + ids + people', () => {
+    const s = M.shape(PAYLOAD);
+    const snap = M.snapshot(PAYLOAD, s);
+    eq(snap.stars, 20);
+    eq(snap.forks, 4);
+    eq(snap.downloads, 1000);
+    assert(Array.isArray(snap.ids) && snap.ids.length === s.events.length, 'ids mirror events');
+    assert(Array.isArray(snap.people), 'people logins captured');
+    assert(!('clones' in snap) && !('views' in snap) && !('npm' in snap), 'no rolling windows in the baseline');
+  });
+  await test('cumDelta is exact current-minus-baseline for a known counter', () => {
+    const d = M.cumDelta(120, 100, 'unavailable', false);
+    eq(d.known, true);
+    eq(d.v, 20);
+  });
+  await test('cumDelta is unknown (never 0) when the current value is absent', () => {
+    eq(M.cumDelta(null, 100, 'unavailable', false).known, false);
+  });
+  await test('cumDelta distinguishes first-visit from a later-appearing counter', () => {
+    eq(M.cumDelta(100, null, 'why', true).why, 'first visit — baseline captured now');
+    assert(M.cumDelta(100, null, 'why', false).why.includes('after your last visit'),
+      'a counter with no baseline that is not a first visit says so');
+  });
+  await test('mark-reviewed/undo round-trips a snapshot byte-for-byte', () => {
+    // Model-level simulation of the view control: stash → advance → restore.
+    const s = M.shape(PAYLOAD);
+    const original = JSON.stringify(M.snapshot(PAYLOAD, s));
+    const stashed = original;                    // "Mark reviewed" copies BASE → BASE_PREV
+    const restored = stashed;                    // "Undo" copies BASE_PREV → BASE
+    eq(restored, original);                      // byte-for-byte inverse (AC-4)
+  });
+
+  console.log(`\n${failed === 0 ? '\x1b[32m' : '\x1b[31m'}${passed} passed, ${failed} failed\x1b[0m`);
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch((e) => { console.error('FATAL', e); process.exit(2); });
diff --git a/tests/admin.test.cjs b/tests/admin.test.cjs
new file mode 100644
index 00000000..2f5a01ac
--- /dev/null
+++ b/tests/admin.test.cjs
@@ -0,0 +1,318 @@
+#!/usr/bin/env node
+//
+// admin.test.cjs — unit tests for the maintainer admin (src/lib/admin-collect.mjs
+// + src/lib/admin-server.mjs). Zero-dep, NETWORK-FREE: the GitHub/npm fetchers are
+// INJECTED (fetchImpl) and the server's stats collector is INJECTED (collect), so
+// nothing here ever touches the network. The server is exercised over real HTTP on
+// an ephemeral loopback port.
+//
+// Run: node tests/admin.test.cjs   (exit 0 = pass, 1 = fail)
+
+const path = require('path');
+const http = require('http');
+
+const ROOT = path.resolve(__dirname, '..');
+const COLLECT = path.join(ROOT, 'src', 'lib', 'admin-collect.mjs');
+const SERVER = path.join(ROOT, 'src', 'lib', 'admin-server.mjs');
+
+// ── tiny harness ─────────────────────────────────────────────────────────────
+let passed = 0, failed = 0;
+function test(name, fn) {
+  return Promise.resolve()
+    .then(fn)
+    .then(() => { console.log('  \x1b[32m✓\x1b[0m ' + name); passed++; })
+    .catch((e) => { console.log('  \x1b[31m✗\x1b[0m ' + name + '\n      ' + (e && e.message)); failed++; });
+}
+function assert(cond, msg) { if (!cond) throw new Error(msg || 'assertion failed'); }
+function eq(a, b, msg) { assert(a === b, (msg || 'equality') + ` — expected ${JSON.stringify(b)}, got ${JSON.stringify(a)}`); }
+
+// GET/POST helper with optional headers → { status, headers, body }
+function req(url, { headers = {}, host } = {}) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(url);
+    const opts = { method: 'GET', hostname: u.hostname, port: u.port, path: u.pathname + u.search, headers: { ...headers } };
+    if (host) opts.headers.host = host;
+    http.request(opts, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }));
+    }).on('error', reject).end();
+  });
+}
+
+// A fetch double: `route(url)` returns { ok?, status?, body } or an Error to throw.
+// Captures every requested URL so tests can assert on the exact request path.
+function mkFetch(route) {
+  const calls = [];
+  const impl = async (url) => {
+    calls.push(String(url));
+    const r = route(String(url));
+    if (r instanceof Error) throw r;
+    return { ok: r.ok !== false, status: r.status ?? 200, json: async () => r.body };
+  };
+  impl.calls = calls;
+  return impl;
+}
+
+// A canonical GitHub/npm fixture set for the AC-3 contract test.
+function ghFixtures(url) {
+  if (/\/repos\/pacphi\/agentic-kit\/releases/.test(url)) {
+    return { body: [
+      { tag_name: 'v1.0.0', name: 'One', published_at: '2026-01-01T00:00:00Z',
+        assets: [{ name: 'kit.tgz', download_count: 100, size: 2097152 }, { name: 'kit.zip', download_count: 50, size: 1048576 }] },
+    ] };
+  }
+  if (/\/repos\/pacphi\/agentic-kit\/traffic\/clones/.test(url)) return { body: { count: 40, uniques: 12, clones: [{ timestamp: '2026-01-01T00:00:00Z', count: 5, uniques: 3 }] } };
+  if (/\/repos\/pacphi\/agentic-kit\/traffic\/views/.test(url)) return { body: { count: 200, uniques: 88, views: [{ timestamp: '2026-01-01T00:00:00Z', count: 20, uniques: 10 }] } };
+  if (/\/repos\/pacphi\/agentic-kit\/traffic\/popular\/referrers/.test(url)) return { body: [{ referrer: 'github.com', count: 30, uniques: 9 }] };
+  if (/\/repos\/pacphi\/agentic-kit\/issues/.test(url)) {
+    return { body: [
+      { number: 9, title: 'external issue', state: 'open', user: { login: 'alice' }, author_association: 'CONTRIBUTOR', pull_request: null, html_url: 'https://github.com/pacphi/agentic-kit/issues/9', created_at: '2026-06-01T00:00:00Z' },
+      { number: 5, title: 'external PR', state: 'open', user: { login: 'bob' }, author_association: 'NONE', pull_request: { url: 'x' }, html_url: 'https://github.com/pacphi/agentic-kit/pull/5', created_at: '2026-03-01T00:00:00Z' },
+      { number: 3, title: 'my own issue', state: 'closed', user: { login: 'pacphi' }, author_association: 'OWNER', pull_request: null, html_url: 'https://github.com/pacphi/agentic-kit/issues/3', created_at: '2026-02-01T00:00:00Z' },
+    ] };
+  }
+  if (/\/repos\/pacphi\/agentic-kit\/stargazers/.test(url)) return { body: [{ login: 'carol' }, { login: 'pacphi' }] };
+  if (/\/repos\/pacphi\/agentic-kit\/forks/.test(url)) return { body: [{ owner: { login: 'dave' }, created_at: '2026-04-01T00:00:00Z' }] };
+  if (/\/repos\/pacphi\/agentic-kit$/.test(url)) return { body: { stargazers_count: 20, forks_count: 4, subscribers_count: 3, open_issues_count: 2 } };
+  if (/api\.npmjs\.org/.test(url)) return { body: { downloads: Array.from({ length: 30 }, (_, i) => ({ day: '2026-01-' + String(i + 1).padStart(2, '0'), downloads: i + 1 })) } };
+  return { ok: false, status: 404, body: null };
+}
+
+async function main() {
+  const C = await import('file://' + COLLECT);
+  const S = await import('file://' + SERVER);
+
+  // ── parseRepoSlug — shapes + fail-closed (EC-8) ─────────────────────────────
+  await test('parseRepoSlug handles git+https / ssh / scp / bare shapes', () => {
+    eq(C.parseRepoSlug('git+https://github.com/pacphi/agentic-kit.git'), 'pacphi/agentic-kit');
+    eq(C.parseRepoSlug('ssh://git@github.com/pacphi/agentic-kit.git'), 'pacphi/agentic-kit');
+    eq(C.parseRepoSlug('git@github.com:pacphi/agentic-kit.git'), 'pacphi/agentic-kit');
+    eq(C.parseRepoSlug('https://github.com/o/r'), 'o/r');
+  });
+  await test('parseRepoSlug fails closed (null) on unparseable input', () => {
+    eq(C.parseRepoSlug('not a url'), null);
+    eq(C.parseRepoSlug('https://github.com/only-owner'), null);
+    eq(C.parseRepoSlug(''), null);
+    eq(C.parseRepoSlug(null), null);
+    eq(C.parseRepoSlug(42), null);
+  });
+
+  // ── resolveGhToken — env chain + best-effort gh (FR-4, EC-7) ────────────────
+  await test('resolveGhToken prefers GITHUB_TOKEN then GH_TOKEN', async () => {
+    eq((await C.resolveGhToken({ GITHUB_TOKEN: 'aaa', GH_TOKEN: 'bbb' })).token, 'aaa');
+    eq((await C.resolveGhToken({ GH_TOKEN: 'bbb' })).source, 'GH_TOKEN');
+  });
+  await test('resolveGhToken falls back to `gh auth token`, then to empty', async () => {
+    const okGh = async () => ({ stdout: 'ghp_fromcli\n' });
+    eq((await C.resolveGhToken({}, okGh)).token, 'ghp_fromcli');
+    const noGh = async () => { throw new Error('gh: command not found'); };  // EC-7: absent gh must not crash
+    const r = await C.resolveGhToken({}, noGh);
+    eq(r.token, '');
+    eq(r.source, null);
+  });
+
+  // ── collectAdminStats — the payload contract (AC-3) ─────────────────────────
+  await test('collectAdminStats builds the documented contract from injected fixtures', async () => {
+    const fetchImpl = mkFetch(ghFixtures);
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+
+    // repo reach
+    assert(d.repo && d.repo.stars === 20 && d.repo.forks === 4 && d.repo.watchers === 3 && d.repo.openIssues === 2, 'repo reach mapped');
+
+    // releases mapped + totalAssetDownloads summed (EC-1)
+    eq(d.releases.length, 1);
+    eq(d.releases[0].tag, 'v1.0.0');
+    eq(d.releases[0].name, 'One');
+    eq(d.releases[0].assets.length, 2);
+    eq(d.totalAssetDownloads, 150);
+
+    // people grouped by external author, OWNER excluded server-side
+    const logins = d.people.contributors.map((c) => c.login);
+    assert(logins.includes('alice') && logins.includes('bob'), 'external authors grouped');
+    assert(!logins.includes('pacphi'), 'the owner is excluded from contributors');
+    assert(!d.people.stargazers.includes('pacphi'), 'the owner is excluded from stargazers');
+    // totalIssues/totalPRs count the whole issue list (pseudocode §3d) — non-PR
+    // items #9 (alice) + #3 (owner) = 2 issues, #5 = 1 PR. Owner-exclusion is a
+    // contributors/stargazers/forks property, not an aggregate-count one.
+    eq(d.people.totalIssues, 2);
+    eq(d.people.totalPRs, 1);
+
+    // traffic configured
+    eq(d.traffic.configured, true);
+    assert(d.traffic.clones && d.traffic.views && Array.isArray(d.traffic.referrers), 'traffic sub-blocks present');
+
+    // npm week/month/daily
+    assert(d.npm && Array.isArray(d.npm.daily) && d.npm.daily.length === 30, 'npm daily present');
+    eq(d.npm.lastWeek, 24 + 25 + 26 + 27 + 28 + 29 + 30); // last 7 of 1..30
+    eq(d.npm.lastMonth, (30 * 31) / 2);                    // sum 1..30
+
+    // feedback doors built from slug, never network
+    assert(d.feedback.issues.includes('pacphi/agentic-kit') && d.feedback.discussions.includes('pacphi/agentic-kit'), 'doors from slug');
+  });
+
+  await test('collectAdminStats URL-encodes a scoped npm package name (AC-3)', async () => {
+    const fetchImpl = mkFetch(ghFixtures);
+    await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: '@scope/name' });
+    const npmCall = fetchImpl.calls.find((u) => /api\.npmjs\.org/.test(u));
+    assert(npmCall && npmCall.includes('%40scope%2Fname'), 'scoped name must be percent-encoded, got: ' + npmCall);
+  });
+
+  // ── AC-2 — no credential degrades honestly ──────────────────────────────────
+  await test('no GitHub credential → traffic.configured false + note; repo/releases/npm still populate', async () => {
+    const fetchImpl = mkFetch(ghFixtures);
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: '', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(d.traffic.configured, false);
+    assert(typeof d.traffic.note === 'string' && d.traffic.note.length > 0, 'a human note, not an error');
+    eq(d.traffic.clones, null);
+    eq(d.traffic.views, null);
+    eq(d.traffic.referrers, null);
+    assert(d.repo && d.repo.stars === 20, 'repo still populates without a token');
+    assert(d.releases.length === 1, 'releases still populate');
+    assert(d.npm && d.npm.daily.length === 30, 'npm still populates');
+    // the traffic endpoints must never be requested when unconfigured
+    assert(!fetchImpl.calls.some((u) => /\/traffic\//.test(u)), 'no doomed traffic request when unconfigured');
+  });
+
+  // ── Edge cases ───────────────────────────────────────────────────────────────
+  await test('EC-1: no releases → releases [] and totalAssetDownloads 0 (never a fabricated 0)', async () => {
+    const fetchImpl = mkFetch((url) => (/releases/.test(url) ? { body: [] } : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(JSON.stringify(d.releases), '[]');
+    eq(d.totalAssetDownloads, 0);
+  });
+  await test('EC-2: npm 404 → npm null (page still functional)', async () => {
+    const fetchImpl = mkFetch((url) => (/api\.npmjs\.org/.test(url) ? { ok: false, status: 404, body: null } : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(d.npm, null);
+    assert(d.repo, 'siblings unaffected');
+  });
+  await test('EC-3: a sub-fetch throwing nulls its block, siblings unaffected', async () => {
+    const fetchImpl = mkFetch((url) => (/stargazers/.test(url) ? new Error('boom') : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(JSON.stringify(d.people.stargazers), '[]');   // failed stargazer fetch → empty, not a rejection
+    assert(d.repo && d.repo.stars === 20, 'the repo block is unaffected by a stargazer failure');
+  });
+  await test('EC-4: stars>0 with an empty stargazer list is faithfully [] (credential gap, not 0 people)', async () => {
+    const fetchImpl = mkFetch((url) => (/stargazers/.test(url) ? { body: [] } : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(d.repo.stars, 20);
+    eq(JSON.stringify(d.people.stargazers), '[]');
+  });
+
+  // ── NFR-3 — the credential NEVER appears in the payload or any error note ────
+  const FAKE_TOKEN = 'ghp_FAKE_SECRET_do_not_leak_0123456789abcdef';
+  await test('NFR-3: a real collect with a credential set never echoes it into the payload', async () => {
+    const fetchImpl = mkFetch(ghFixtures);
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: FAKE_TOKEN, repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    assert(!JSON.stringify(d).includes(FAKE_TOKEN), 'the GitHub credential must never reach the payload');
+    // sanity: the token WAS used (as an auth header) — proving this is the real path, not a no-op
+    assert(fetchImpl.calls.length > 0, 'the collector actually fetched');
+  });
+  await test('NFR-3: a sub-fetch error whose message embeds the credential is not echoed anywhere', async () => {
+    // The thrown message is deliberately "tempting to echo" — it contains the token.
+    // ghJson must swallow it (return null), so nothing carrying the credential can
+    // reach the payload, notes, or an error field.
+    const fetchImpl = mkFetch(() => new Error('GitHub 401 for Bearer ' + FAKE_TOKEN + ' — token rejected'));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: FAKE_TOKEN, repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    const s = JSON.stringify(d);
+    assert(!s.includes(FAKE_TOKEN), 'no credential in the payload/notes even when an error message embedded it');
+    assert(!/token rejected/.test(s), 'a tempting sub-fetch error message must not be echoed into the payload');
+    eq(d.repo, null); // every block degraded to null, honestly
+  });
+
+  // ── admin-server: auth (AC-1), loopback + CSP + self-contained (AC-5) ────────
+  const FIXTURE_PAYLOAD = { generatedAt: '2026-07-24T00:00:00Z', repoSlug: 'pacphi/agentic-kit', repo: { stars: 20, forks: 4, watchers: 3, openIssues: 2 }, releases: [], totalAssetDownloads: 0, traffic: { configured: false, note: 'no token', clones: null, views: null, referrers: null }, npm: null, people: { externalEngagers: 0, totalIssues: 0, totalPRs: 0, contributors: [], stargazers: [], forks: [] }, feedback: { issues: 'x', discussions: 'y' } };
+
+  const admin = await S.startAdmin({ port: 0, collect: async () => FIXTURE_PAYLOAD });
+  try {
+    await test('AC-5: bound to 127.0.0.1 and urlWithToken carries the token ONLY in the fragment', () => {
+      assert(/^http:\/\/127\.0\.0\.1:\d+\/$/.test(admin.url), 'url must be a loopback URL, got ' + admin.url);
+      assert(admin.urlWithToken.includes('/#token='), 'token must ride in the # fragment');
+      assert(!/\?token=/.test(admin.urlWithToken), 'token must NOT be a query parameter');
+      assert(admin.urlWithToken.includes(admin.token), 'urlWithToken carries the session token');
+    });
+
+    await test('AC-5: GET / serves a self-contained page with a CSP header and no external sub-resources', async () => {
+      const r = await req(admin.url);
+      eq(r.status, 200);
+      assert(/text\/html/.test(r.headers['content-type'] || ''), 'text/html');
+      const csp = r.headers['content-security-policy'] || '';
+      assert(/default-src 'none'/.test(csp), "CSP must be default-src 'none'");
+      assert(/connect-src 'self'/.test(csp), 'CSP must confine fetch to same-origin');
+      // no external stylesheet links, no external <script src>, no external <img src>
+      assert(!/<link[^>]+stylesheet/i.test(r.body), 'no external stylesheet links');
+      assert(!/<script[^>]+\bsrc=/i.test(r.body), 'no external script src');
+      assert(!/\bsrc\s*=\s*["']https?:/i.test(r.body), 'no external resource src=');
+      // the model + view are embedded (their source strings are present)
+      assert(r.body.includes('function metric') || r.body.includes('metric='), 'model embedded in page');
+      assert(r.body.includes('x-admin-token'), 'the client sends the admin token header');
+      // the model import line must have been stripped (no bare module fetch)
+      assert(!/from ['"]\.\/admin-model\.mjs['"]/.test(r.body), 'model import must be stripped at serve');
+    });
+
+    await test('AC-1: /api/admin-stats with the RIGHT token → 200 full payload', async () => {
+      const r = await req(admin.url + 'api/admin-stats', { headers: { 'x-admin-token': admin.token } });
+      eq(r.status, 200);
+      assert(/application\/json/.test(r.headers['content-type'] || ''), 'json');
+      assert(/no-store/.test(r.headers['cache-control'] || ''), 'no-store on /api');
+      eq(r.headers['x-content-type-options'], 'nosniff', 'nosniff on the /api 200 response');
+      const j = JSON.parse(r.body);
+      assert(j.repo && j.people && 'traffic' in j, 'full payload present');
+    });
+
+    await test('AC-1: /api/admin-stats with a WRONG token → 401 JSON error, NO data fields', async () => {
+      const r = await req(admin.url + 'api/admin-stats', { headers: { 'x-admin-token': 'nope' } });
+      eq(r.status, 401);
+      eq(r.headers['x-content-type-options'], 'nosniff', 'nosniff on the /api 401 response');
+      const j = JSON.parse(r.body);
+      assert(typeof j.error === 'string', 'a JSON error message');
+      assert(!('repo' in j) && !('people' in j) && !('releases' in j) && !('traffic' in j), '401 body must carry NO data');
+    });
+
+    await test('AC-1: /api/admin-stats with a MISSING token → 401', async () => {
+      const r = await req(admin.url + 'api/admin-stats');
+      eq(r.status, 401);
+    });
+
+    await test('AC-5/NFR-2: DNS-rebinding Host guard rejects a foreign Host', async () => {
+      const r = await req(admin.url + 'api/admin-stats', { headers: { 'x-admin-token': admin.token }, host: 'evil.example.com' });
+      eq(r.status, 403);
+    });
+
+    await test('unknown route → 404', async () => {
+      const r = await req(admin.url + 'nope');
+      eq(r.status, 404);
+    });
+  } finally {
+    await admin.close();
+  }
+
+  // ── tokenMatches — constant-time accept/reject with a length guard (AC-1) ────
+  await test('tokenMatches accepts the exact token and rejects wrong/short/empty', () => {
+    eq(S.tokenMatches('abc123', 'abc123'), true);
+    eq(S.tokenMatches('abc124', 'abc123'), false);
+    eq(S.tokenMatches('ab', 'abc123'), false);        // unequal length must be false, NEVER a throw
+    eq(S.tokenMatches('', 'abc123'), false);
+    eq(S.tokenMatches('abc123', ''), false);          // no secret ⇒ never open (fail-closed)
+    eq(S.tokenMatches(undefined, 'abc123'), false);
+  });
+
+  // ── EC-8 at the server boundary: unparseable repo.url → refuse to start ──────
+  await test('EC-8: startAdmin refuses to start when repository.url is unparseable', async () => {
+    let threw = false;
+    try {
+      await S.startAdmin({ port: 0, pkg: { name: 'x', repository: { url: 'not a url' } }, collect: async () => FIXTURE_PAYLOAD });
+    } catch (e) {
+      threw = true;
+      assert(/repository\.url|owner\/repo|refus/i.test(e.message), 'error must explain the fail-closed reason');
+    }
+    assert(threw, 'startAdmin must throw rather than query the wrong repository');
+  });
+
+  console.log(`\n${failed === 0 ? '\x1b[32m' : '\x1b[31m'}${passed} passed, ${failed} failed\x1b[0m`);
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch((e) => { console.error('FATAL', e); process.exit(2); });
diff --git a/tsconfig.json b/tsconfig.json
index 87a730ec..e9e3e0f1 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -14,5 +14,7 @@
     "forceConsistentCasingInFileNames": true
   },
   "// scope": "Shipped code + scripts. Tests are fixture-heavy (dynamic shapes) — typechecking them yields inference noise, not bugs; they're covered by `pnpm test`.",
-  "include": ["src/**/*.mjs", "bin/**/*.mjs", "scripts/**/*.mjs"]
+  "include": ["src/**/*.mjs", "bin/**/*.mjs", "scripts/**/*.mjs"],
+  "// exclude": "admin-view.mjs is BROWSER code (DOM globals, no node types) — never node-imported, only read as text and embedded into the served admin page (ADR-0007 §5). Typechecking it against node lib yields only 'Cannot find name document' noise.",
+  "exclude": ["src/lib/admin-view.mjs"]
 }