Tech[30] reported (msg 1118) that frontend/30-Tech/apps/inventory.html hardcodes the OLD admin token in client-side JS. Investigating the backend counterpart, systems/30-tech/apps/Inventory/inventory-api.php also hardcoded the same old token server-side as an exact-match check ($TOK = '...'; if($token !== $TOK)...) -- meaning this endpoint was blindly rejecting every current, valid token/session and only ever accepted that one specific retired value, i.e. the same class of silent breakage as the build.php-unauthorized-for-all-variations report (msg 1122) from the same rotation event, just not yet reported for this specific endpoint. FIX: migrated to the shared backend/config/auth-lib.php (require_once + cai_require_token($token)) -- same lib Master[10]'s R002 fix already uses platform-wide, accepts either a current active token from tokens.json or an authenticated session cookie. LANE BOUNDARY RESPECTED: the matching frontend fix (removing the hardcoded token from inventory.html, switching to the session-cookie+login-redirect pattern) is Builder[20]'s lane per REFERENCE-40.md's non-negotiable HTML/frontend rule -- drafted the patch but staged it at backend/tmp/inventory_html_PATCHED_08-22-26.html and handed it to Builder[20] via inbox rather than deploying it myself.