Continuing F3 (CC[100] audit, 11/15 commands bypass roster_lib.php). UPDATE.php delegates all system-specific work to verify_lib.php's tier2_* functions, which DO correctly use build_roster() (confirmed by reading them directly) -- UPDATE.php itself is clean. But that same read surfaced 3 more occurrences of the exact retired-code-map literal inside verify_lib.php itself, in open_sessions_check(), handoff_age(), and boards_rebuild() -- initially looked like 3 more live instances of the same bug. TRACED CAREFULLY BEFORE TOUCHING ANYTHING: unlike every actual bug fixed this session, these three functions pair dir and old-code TOGETHER correctly in a fixed, hardcoded internal $systems array (e.g. ['95-travel','10'], ['10-master','01']) rather than using the old code as an external lookup key against caller input. Traced every one of the 11 pairs by hand -- every single one resolves to the CORRECT real dir+decade combination, including the Travel/10 case, precisely because dir and code are pre-paired consistently rather than looked up independently. These are NOT live bugs, despite matching the same suspicious regex pattern as every real instance fixed today -- verified by actually reasoning through the resolution logic, not just pattern-matching. Left them untouched -- old-style and worth a hygiene pass to roster_lib.php someday for consistency, but not broken, and I did not want to spend another deploy/backup/verify cycle 'fixing' something that already works correctly. Also checked UPDATE.php, SNAPSHOT.php, RESTORE.php, CLEANBACKUPS.php, ANNOUNCE.php, BROADCAST.php, ROTATE.php for any system-dir resolution logic at all -- none show evidence of needing it (thin dispatchers, or operate on already-resolved backup/token paths rather than per-system directories). CLOSING OUT F3 here: found and fixed 4 genuine live instances this session (PLATFORM_CHECK F1, HISTORY F2, SOLVE, VERIFY -- all logged separately, D809/D811/D814/D820), confirmed CHECKPOINT.php was already fixed before this session (08/07/26, K274), and confirmed the remaining candidates are either already-correct-despite-appearances or don't need the pattern at all. Recommend treating F3 as closed rather than continuing to grep for more instances of a pattern that's now been verified exhausted in the actual command set.