Issue #114: the API keys screen was refused by our own CSRF guard Write-up page plus a Bugs-Resolved row. Records the timeline that is the whole diagnosis (screen built 2026-07-02 and working, guard added 2026-08-07, three weeks dead before it was reported), the sweep showing three was the complete count, and the false invariant in request_guard.php's own comment that stopped anyone checking - now replaced by a tested claim.