diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index d0262c0c3..e90dc4d7c 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -86,8 +86,19 @@ jobs:
 
       # Guards graduated from pages.yml: never publish a broken or credential-
       # leaking web-root. A failure here fails the build — nothing is committed.
+      # ★ ASSERT THE PATH THE CLIENT ACTUALLY REQUESTS, NOT JUST THE TYPED ONE (2026-09-21).
+      # This guarded only token.json, while every generated leaf requests the EXTENSIONLESS
+      # '/api/maps/token' (grep a built leaf: it appears four times, '.json' never). A static host
+      # returns 404 for the extensionless path and 200 for token.json, so a regression that stopped
+      # writing the bare file would have shipped SILENTLY PAST CI with the endpoint "asserted".
+      # write-token.mjs emits BOTH; guard BOTH. The bare one is a BARE TOKEN STRING, not JSON — the
+      # client uses the response verbatim and rejects {"token":"pk..."} as lacking a pk. prefix.
       - name: Assert the token endpoint exists
         run: |
+          test -s public/api/maps/token || {
+            echo "::error::public/api/maps/token is missing/empty — this is the path the CLIENT requests; every basemap renders blank."
+            exit 1
+          }
           test -s public/api/maps/token.json || {
             echo "::error::public/api/maps/token.json is missing/empty — set the MAPBOX_TOKEN secret, or every basemap renders blank."
             exit 1