<ul><li>CRITICAL: Fixed widgets/index.php — DashboardController, TOKEN, and ICON_LOADER JS variables were completely undefined. The file declared controller and csrf_token but all click handlers for Enable/Disable/Delete Widgets and Add Widget used the undefined aliases — every click threw a ReferenceError and all AJAX was dead. Added var DashboardController = controller; var TOKEN = csrf_token; var ICON_LOADER after the existing declarations.</li><li>CRITICAL: Fixed __TOKEN in widgets/index.php — __TOKEN is only defined in define_common.php if _CSRF session key already exists; changed to ->csrf_token() to guarantee a valid token is always generated.</li><li>CRITICAL: Fixed same __TOKEN issue in widgets/manage_widget.php and widgets_per_module.php — both files used __TOKEN for their csrf_token variable which could produce empty/invalid tokens, breaking all their AJAX calls.</li><li>HIGH: Added error: handler to loadWidgetsClassifications AJAX — swal loading spinner could get stuck open on network failure with no user feedback.</li><li>HIGH: Fixed unsafe response[0].widget_list_id access in loadWidgetsList — throws TypeError if response is empty array; added $.isArray() and length check before accessing index 0.</li><li>MEDIUM: Fixed alert-primary class (Bootstrap 4) in widgets/index.php and video.php empty-state messages — UBOLD4 uses Bootstrap 3 where alert-primary does not exist; changed to alert-info.</li><li>MEDIUM: Added ob_start()/ob_end_clean() to DashboardController.php — prevents any future PHP errors from the require chain corrupting JSON responses for all Dashboard actions including all onboarding module actions.</li></ul>