Full-day session: security fix, T2521 fully closed, Master List standard shipped, David-name root cause fixed, SYNC bug confirmed and transferred to Server[40]

Security fence fix (K314): closed an open directory-listing gap on two backend directories. T2521 root-caused (Travel stuck-open bug traced to kill-switch.html bypassing the real close sequence) and fully resolved by session end via Server[40]'s fix. Extensive Master List editor work across many rounds of live user feedback: edit link, editable assignment, a new formal platform standard for active-row highlighting, a general From filter, a T# search that correctly searches regardless of status, and an open/done breakdown counter. Platform-wide removal of a personal name from 11 config files, a page, a dashboard comment, and 28 task records, tracing the actual root cause to the user's own Claude preferences rather than just patching symptoms repeatedly. Independently confirmed a live SYNC.php bug (silently closes/locks any session that calls it) and formally transferred the full investigation to Server[40] for a real fix, alongside an unresolved question about unexplained file writes under the Admin identity outside any tracked session.