Project Server: closed gov/, root+config/, toolbox/, and index.php areas. Discovered and fixed a platform-wide token-exposure/RCE chain mid-sweep -- toolbox/ gated on all 11 systems, restructuring-project/ secured, own hub page's hardcoded token removed, 3 inbox messages filed to Server/Master/Admin. Corrected WHITELIST-40.md (was protecting a dead DB and a file already trashed). Handled a database policy reversal -- restored 40-server-sys.db per USR369 direction that databases are never trashed. Wrote SOP-GOV-CORE-FILES.md as the new platform standard for protected gov/ files.

gov/ area closed (5 files retired, SOP-GOV-CORE-FILES.md written, v2-synced). root+config/ closed (5 files retired). toolbox/ closed (COMMANDS-40.php token bug fixed, 7th platform instance). index.php fixed (7 distinct bugs). WHITELIST-40.md corrected. Platform-wide security response: token-exposure/RCE chain found+fixed (toolbox gated x11, restructuring-project secured, 3 inbox messages filed 4282-4284, USR369 go-ahead relayed to Master 4285). Database policy reversal handled. Directory walkthrough with USR369 covering archive/backup/config/data/history/log/old-zips/toolbox all reviewed live.