Root cause: loadItems() built its fetch URL relying on the browser's session cookie for auth but never checked the response for an error before rendering -- any API error, including an expired/missing login session (Unauthorized), was silently rendered as an empty 'No open items.' list with zero indication anything was wrong. Reproduced live before fixing. Fix: loadItems() now checks isAuthError(d) first (redirects to login) and surfaces any other API error message directly in the popup body instead of hiding it as an empty list. Files touched: backend/sys-com/ml-popup.js.