From 1727f1424183910119bbc138d4460b64baf8f696 Mon Sep 17 00:00:00 2001
From: doxa-maps-88655c70
 <88627970+doxa-maps-88655c70@users.noreply.github.com>
Date: Sun, 20 Sep 2026 09:34:22 +0000
Subject: [PATCH] deploy-3 is now verified on a foreign host, not only
 same-root

---
 README.md                             | 2 +-
 docs/README-SECTION-3-cli-commands.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 78ef6c396..6a0d6baae 100644
--- a/README.md
+++ b/README.md
@@ -168,7 +168,7 @@ Quick reference:
 |---|---------------|---------------|------------|
 | 1 | **iframe embed** | Bun | `bun install` → `bun run build` → `bun run serve` (or drop `public/doxa-maps/` on any host) |
 | 2 | **Mobile (Android)** | Bun alone for `check:mobile`; Android SDK + `adb` + JDK 17 for the APK | `bun run check:mobile` (contract check, no toolchain) → `bun run phone` (full APK path) |
-| 3 | **Direct-JS / dashboard** | Bun | `bun run build`, then paste the `<script src> + integrity` snippet from `manifest.json`. *Proven for a page served from the SAME tree root; a foreign-origin partner embed also needs `assetsBase` + `apiBaseUrl` in the profile-config* |
+| 3 | **Direct-JS / dashboard** | Bun | `bun run build`, then paste the `<script src> + integrity` snippet from `manifest.json`. *Proven same-root AND on a foreign host page: the snippet now carries `assetsBase` + the `MAP_APP_API_URL` global; fill the `YOUR_*` placeholders* |
 | 4 | **WordPress** | Bun | `bun run build`, then install the `wordpress/doxa-maps-embed/` PHP plugin (shortcode + Gutenberg block) *(built + contract-proven via `bun run check:wp-embed`; not yet shot on a live WP install)* |
 | 5 | **Desktop (Tauri)** | Rust + Tauri CLI *(not yet scaffolded)* | *aspirational — no Tauri code exists yet* |
 
diff --git a/docs/README-SECTION-3-cli-commands.md b/docs/README-SECTION-3-cli-commands.md
index 7da1c30e7..b218e7526 100644
--- a/docs/README-SECTION-3-cli-commands.md
+++ b/docs/README-SECTION-3-cli-commands.md
@@ -45,7 +45,7 @@ The scripts these commands are grounded in (from this branch's `package.json`):
 |---|---------------|-------------------------|------------|
 | 1 | **iframe embed** | Bun | `bun install` → `bun run build` → `bun run serve` (or drop `public/doxa-maps/` on any host) |
 | 2 | **Mobile app (Android)** | Bun ALONE for `check:mobile`; + Android SDK · `adb` on PATH · JDK 17 (Gradle) for the APK | `bun run check:mobile` (sync + webDir assertion, NO toolchain needed) · `bun run phone` (= `apk:debug` + `apk:install` to a device/emulator) |
-| 3 | **Direct-JS / dashboard** | Bun | `bun run build`, then paste the `<script src> + integrity` (SRI) snippet from `manifest.json`. *Proven SAME-ROOT; a foreign-origin partner embed also needs `assetsBase` + `apiBaseUrl`* |
+| 3 | **Direct-JS / dashboard** | Bun | `bun run build`, then paste the `<script src> + integrity` (SRI) snippet from `manifest.json`. *Proven same-root AND foreign-host (verified 2026-09-20: gl + attribution, 0 errors, 0 404s). Fill the `YOUR_*` placeholders the snippet ships with* |
 | 4 | **WordPress** | Bun (+ `php` CLI to run the contract gate) | `bun run build`, then either paste the iframe/script snippet into a **Custom HTML** block, **or** install `wordpress/doxa-maps-embed/` (shortcode + Gutenberg block). `bun run check:wp-embed` verifies the emitted markup. *(Contract-proven; not yet shot on a live WP install.)* |
 | 5 | **Desktop (Tauri)** | Rust toolchain + Tauri CLI *(not yet scaffolded)* | **Deferred POC** — no command exists on this branch yet. |