Full session arc: Phase 1 (auth-lib.php+tokens.json+.htaccess lockdown), then Phase 2 across systems/commands/ (all 40 real files), backend/ (33 files, discovered via RESTORE.php's action=list directory browsing since no grep exists), systems/*/data/api.php (all 11), community/{comms,jurisdiction,kb_api}.php, save.php, session_open.php, transfers/index.php, and root file-reader.php. Final master sweep: 91/91 files clean, 0 errors. Deliberately did NOT migrate file_write_web.php -- its own header explicitly documents 'Admin token only, hardcoded, no cai_auth dependency' as an intentional design choice (it is the recovery tool of last resort; making it depend on auth-lib.php would create a real bootstrapping risk if auth-lib.php itself ever broke). Left as-is, matching its own stated intent, not an oversight. Real bugs found and fixed along the way, unrelated to tokens: (1) verify_lib.php initially broke platform-wide-crashing-adjacent via ML.php 500ing when a naive migration removed a TOKEN constant still referenced elsewhere in the file -- caught immediately, all files re-migrated with a safer redefine-in-place recipe that preserves every downstream reference; (2) backend/records/db/tasks-api.php had a genuine pre-existing SQL bug (unquoted !high/!med/!low literals) causing a 500 on any priority-sorted task list call, fixed and verified; (3) found backend/config/platform.php, a dead file built 07/13/26 explicitly as the intended single token source but never actually required by anything -- fixed it to read from the real shared source too. One process slip: TASKGATE.php's 20-minute backup-gate window lapsed twice mid-session (once for TASKGATE.php itself, once for save.php/session_open.php), meaning those files were deployed before a fresh pre-edit backup existed -- caught each time within the same session, backups retroactively captured, all confirmed working via live tests regardless. One real mistake: a test call against HANDOFF.php used system=10 not realizing that file maps by OLD system code (10=Travel) not decade -- overwrote a deprecated, unread stub file in Travel's gov dir with test content, caught immediately, verified Travel's real handoff-95.md was untouched, restored the stub to a proper deprecated marker. Also took a fresh full-platform snapshot mid-session (platform_snapshot_08_18_26_727pm.zip, 3027 files) as a real restore point before continuing into backend/.