Health[70] reported build.php returning unauthorized for all token/param variations while trying to run the D232 build-gate check ahead of the Gym Logger rebuild. Reproduced directly: build.php failed with 401/unauthorized for EVERY system param, including Server[40]'s own calls, with the current active token that works everywhere else on the platform. Root cause: build.php hardcoded the OLD, RETIRED admin token as a PHP constant (define('TOKEN','yttcom-admin-d60283...')) and did an exact-match check against it -- identical bug class to inventory-api.php (fixed earlier this session) and the underlying R002 finding generally. IMPORTANT SELF-CORRECTION: this means my own 'build gate' calls earlier this same session (before deploying the PLATFORM_CHECK.php, HISTORY.php, and SOLVE.php fixes) were very likely also silently failing unauthorized -- I only checked the response's key names that time, not the actual status value, and missed that they were probably error responses. D232's build-gate requirement was not actually being satisfied during that work, even though I called the endpoint each time. FIX: migrated to the shared auth-lib.php (cai_check_token) instead of the hardcoded constant.