comms/api.php update_status already correctly blocks status=open writes when session_locked=1. DASHBOARD.php was patched 07/22/26 to always send force=1, permanently bypassing that protection. inbox-api.php automatically pings DASHBOARD.php on every action=drop, which fires on nearly every close report - meaning the reopen happens on every close via its own close report, not specifically when two systems are closed at the same time as originally suspected.