Two threads closed out: (1) FIX-LOG.md/fix-log.html v3 -- multi-system + Name-of-Task field, corrected a false-completion record (K390), fixed a line-ending insertion bug (D790). (2) Real session-cookie/password auth for browser tool pages after a hardcoded-token complaint -- login.php, additive auth-lib.php session support, migrated file_write_web.php off a hardcoded admin token (D791). Ran JANUS mid-close-prep (FINISHED, verified by reading the write back). T-JANUS-DESIGN closed (superseded -- JANUS is live). T-CUSTOMVAL-STD filed, still open, to_system needs fixing next touch.

fix-log.html: multi-system chip picker + Name-of-Task field, 6-field FIX-LOG format, backward-compat parser for 4/5/6-field legacy lines. Fixed \r\n line-ending insertion bug (entries were landing at file-end, not after header) -- proved via standalone Node test against real file content. Corrected a false 'Finished' status on a FIX-LOG entry that neither CC nor this session wrote (K390). Auth: built login.php, extended auth-lib.php additively (session OR token, verified every existing caller unaffected), migrated file_write_web.php off a hardcoded admin token onto the shared auth source -- found that hardcoding as a real gap while wiring the fix, same class as prior K372/K373 incidents. Full cookie-only E2E verified live (login -> read -> write -> page load, zero tokens in any request). Caught and corrected my own near-miss mid-session: briefly concluded file_write_web.php had been reverted by someone else, based on a stale header comment; a live functional test proved otherwise before I reported anything wrong.