diff --git a/projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-29 22-50-21 UTC [6c1785ad56].md b/projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-29 22-50-21 UTC [6c1785ad56].md
new file mode 100644
index 0000000..d58d83b
--- /dev/null
+++ b/projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-29 22-50-21 UTC [6c1785ad56].md	
@@ -0,0 +1,50 @@
+---
+title: Checkpoint 2026-09-29 22:50:21 UTC [6c1785ad56]
+type: checkpoint
+permalink: main/projects/25464650-ed5d-440e-b362-190f2852d451/checkpoint-2026-09-29-22-50-21-utc-6c1785ad56
+stable_id: ea17e326-a067-4528-a017-7acb5d9473d5
+scope: project
+memory_type: checkpoint
+project_id: 25464650-ed5d-440e-b362-190f2852d451
+usage_profile_id: 0c9feb46-d06e-43cd-9ef0-c5813c84a998
+status: active
+revision: 1
+request_id: a1-admin-auth-e10716a-20260930
+created_at: '2026-09-29T22:50:21.537811+00:00'
+updated_at: '2026-09-29T22:50:21.537811+00:00'
+tags:
+- ready-to-merge
+- a1
+- line-A
+- feat/a1-admin-auth
+---
+
+## A1 完成（线 A）ready-to-merge
+
+- **分支**：feat/a1-admin-auth
+- **工作树**：E:/code/NixMsg-wt/a（toplevel 非主工作区）
+- **基于**：origin/main @ 22c56d1
+- **提交**：e10716a feat: 实现管理鉴权、API 令牌与操作日志
+- **推送**：origin/feat/a1-admin-auth（普通推送，未推 main）
+- **验证**：工作树内 task check 通过（web build、embeddist、golangci-lint 0、go test 含 admin/httpx）
+
+## 交付
+- internal/httpx：JSON 信封、ClientIP/IsHTTPS（trusted_proxies）
+- internal/admin：可挂载 Handler；Cookie 会话 nixmsg_admin；X-Nixmsg-Request CSRF；Bearer API 令牌；login/logout/me/password；tokens CRUD（仅 Cookie）；操作日志 slog；其余路由鉴权后 501
+- 测试注入 StubHashPool；MemoryLoginLocks + RandomAPITokens（P3 未合入）
+- DEVIATIONS「后台接口 A」A1 五条
+
+## 挂载
+```go
+h := admin.New(admin.Deps{DB, Hash, Tokens, Locks, ...})
+mux.Handle("/api/admin/", h)
+```
+
+## 未实现路由（501）
+overview、endpoints*、registration、groups*、messages*、settings
+
+## 没做
+未改 cmd/listener/protocol；未接线 serve
+
+## 给下个会话
+可 ff-merge；合入后需在 serve/wire 挂载并注入 P3 真实 Hash/Locks/APITokens；勿强推 main
\ No newline at end of file