USR369 reported "master list doesn't open" -- root cause: systems/master-list.php had the OLD (retired earlier today) admin token hardcoded for its own server-side outbound call to records-api.php. Classic silent-wrong failure, same class as AUDIT-COMMANDS-08-21-26.md's F1/F2: file_get_contents() got a 401, returned false, $data fell through to an empty array, and the page rendered "No open tasks -- platform clear" instead of any visible error. Real state: 58 open tasks. Fixed properly, not just patched: required auth-lib.php and switched to cai_current_token() (the shared helper built for exactly this -- a script authenticating itself to another internal endpoint) instead of a new hardcoded literal, so this can't break again on the next rotation. Verified live -- page now shows correct counts (58 total, 13 !high-flag, 3 high, 10 med, 7 low, 25 other). Given this was the third file found today with a rogue hardcoded old token (after file-reader.php and file_write_web.php earlier this session), did a quick targeted check of other likely candidate pages rather than assuming those three were the only ones. Found three more, all with the same simple client-side "const TOKEN/TK = '...'" pattern: backend/tools/ml-editor.html, backend/sys-com/dashboard.html, backend/sys-com/panel.html. All backed up, all fixed (literal swap to new token -- these are simple client-side constants, not server-side auth gates like master-list.php was, so no architectural change needed), all verified live. Total files fixed for the token rotation across this whole session now: tokens.json itself, file-reader.php, file_write_web.php, 9 Tech/Kitchen HTML files, gym-api.php, cmd-popup.js, backend/sys-com/commands.html, master-list.php, ml-editor.html, dashboard.html, panel.html -- 16 files total, found in three separate passes rather than one complete sweep. This strongly suggests more files with the same hardcoded pattern likely still exist somewhere on the platform that haven't surfaced yet -- a real systematic grep-based sweep (not reactive discovery) is still owed.