Better insight: The rolling token wasn’t random. It was SHA256(seed + timestamp)[:4] with a 30-second window.