diff --git a/.gitignore b/.gitignore
index c6555c32f..ab7fd881b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -62,6 +62,10 @@ capacitor/ios/App/Pods/
 # the MAPBOX_TOKEN environment variable so the value lives in deployment settings
 # rather than in git history.
 public/api/maps/token.json
+# ★ AND the EXTENSIONLESS path — the client requests /api/maps/token (never .json), so
+# write-token.mjs emits BOTH. This line was missing when the bare file was added, which
+# would have made a live pk. token committable. Same secret, second path.
+public/api/maps/token
 
 # ── stale dev-time bundle copies inside the wrapper ───────────────────────────
 # The wrapper mounts bundles from ./doxa-maps/ at the served root now; these were
diff --git a/internal/write-token.mjs b/internal/write-token.mjs
index 49837a06d..e9b2f6332 100644
--- a/internal/write-token.mjs
+++ b/internal/write-token.mjs
@@ -51,4 +51,15 @@ if (token.startsWith('sk.')) {
 
 mkdirSync(OUT_DIR, { recursive: true })
 writeFileSync(OUT, JSON.stringify({ token, type: token.slice(0, 2) }) + '\n')
-console.log(`[write-token] wrote public/api/maps/token.json (${token.slice(0, 6)}…, type ${token.slice(0, 2)})`)
+
+// ★ WRITE THE EXTENSIONLESS PATH TOO — the client asks for `/api/maps/token`, NOT `token.json`.
+// MEASURED 2026-09-20: the generated leaf requests `/api/maps/token` FOUR times and `.json` never;
+// a static host returns 404 for the extensionless path and 200 for token.json. So the WRITER and the
+// CLIENT disagreed on the path and ladder rung 6 (same-origin) COULD NEVER HAVE RESOLVED — on the
+// web, in a dropped folder, or inside the Capacitor app. Two artifacts holding one fact with nothing
+// forcing agreement; the fix is to satisfy the CONSUMER'S path rather than ask it to change.
+// The extensionless copy is a BARE TOKEN STRING, not JSON: the client uses the response verbatim,
+// and handing it `{"token":"pk..."}` makes it complain the token lacks a `pk.` prefix (measured).
+// token.json stays for any consumer that wants the typed object.
+writeFileSync(join(OUT_DIR, 'token'), token)
+console.log(`[write-token] wrote public/api/maps/token.json + token (${token.slice(0, 6)}…, type ${token.slice(0, 2)})`)