Implementation plan for #93 (kept as a comment so the original issue input remains fixed):

1. Keep internal/adminhttp as transport/security only. Add versioned public DTOs there and inject one read-only snapshot provider from the coordinator; no CLI/MCP subprocesses and no provider/network calls.
2. Build the snapshot in internal/servicectl from the in-process JobManager, MaintenanceManager, capability registry, and read-only cache access. Absolute cache paths and config references stay daemon-local; browser identities are cache UUID/path fingerprints.
3. Model service/readiness, caches/repositories, five coverage lanes, jobs, policy, diagnostics, and capabilities as separate typed cohorts. A current lane state, active contention, scheduled retry, and last stage error remain independent fields.
4. Serve coarse snapshot plus filtered cache/repository/job/maintenance/diagnostic/capability resources. Job history is deterministic and cursor/limit bounded.
5. Add a controller-owned bounded event ring. SSE uses opaque monotonic cursors, retained replay, keepalives, and an explicit snapshot_required event when a cursor is outside the replay window. Events are compact invalidations/progress summaries, never raw logs.
6. Contract tests will cover stable JSON shape, sorting/filtering/paging, public-safe serialization, observation side-effect freedom, SSE replay/expiry, auth, and existing Host/Origin boundaries.

The existing UI shell will switch from the temporary readiness DTO to the coarse snapshot and consume invalidation events without changing the selected visual direction.

Implemented in !97.

The slice now provides:

• a deterministic admin.v1 coarse snapshot plus versioned cache, repository, job, maintenance, diagnostics, and capability resources;
• six UI-facing cohorts through composed product DTOs rather than CLI/SQLite mirrors;
• independent head, tail, secondary, projection/content-generation, and RAG lanes;
• current RAG truth kept independent from contention, scheduled retry, and last-stage error;
• opaque cache_ref and one-way fingerprints, typed sanitized errors, no absolute paths/raw logs/raw cached bodies;
• bounded job filters/paging and structured sanitized progress;
• bounded SSE with opaque cursor, retained replay, Last-Event-ID reconnect, session expiry, and snapshot_required for expired/future cursors;
• aggregate source-kind counts so periodic observation does not load cached source bodies/aliases;
• the existing Svelte shell wired to snapshot + SSE while preserving System-default Light/Dark/System theming.

Verification:

• go test ./...
• go test -race ./internal/adminhttp ./internal/servicectl
• go vet ./...
• git diff --check
• frontend typecheck/unit/Playwright smoke
• deterministic embedded asset rebuild
• live local Playwright QA for one-time session exchange, snapshot contract, SSE, reload continuity, and path redaction

No tag/release and no routine source install were produced; this is one slice of the larger admin epic.