diff --git a/deployment/src-tauri/README.md b/deployment/src-tauri/README.md
index 18ed859b4..3694170a8 100644
--- a/deployment/src-tauri/README.md
+++ b/deployment/src-tauri/README.md
@@ -49,9 +49,9 @@ the Tauri origin** — exactly the surprise `capacitor.config.json` documents fo
 **The fix is a response header on the token host, not a change in `tauri.conf.json`.**
 
 Measured 2026-09-21: `https://doxa.life/api/maps/token` → **200**;
-`https://nuxtbase.app/api/maps/token` → **404**. A desktop build pointed at nuxtbase would launch
+the test host's `/api/maps/token` → **404**. A desktop build pointed at that host would launch
 with blank basemaps even though the window opens and the element mounts correctly. Separately, the
-Mapbox token is **URL-restricted**: with a `nuxtbase.app` Referer the style document returns 200 but
+Mapbox token is **URL-restricted**: with the test host as Referer the style document returns 200 but
 every **tile 403s**, while the same token with a `doxa.life` Referer returns 200. Verify the token
 path before blaming the shell.
 
diff --git a/deployment/wordpress/doxa-maps-embed/HOW-TO-TEST.md b/deployment/wordpress/doxa-maps-embed/HOW-TO-TEST.md
index f6428af7e..5c35681ba 100644
--- a/deployment/wordpress/doxa-maps-embed/HOW-TO-TEST.md
+++ b/deployment/wordpress/doxa-maps-embed/HOW-TO-TEST.md
@@ -28,7 +28,7 @@ Then in wp-admin (http://localhost:8888/wp-admin, admin/password):
 
 1. Plugins → activate **Doxa Maps Embed**.
 2. Settings → **Doxa Maps** → set the catalog base to a real served tree, e.g.
-   `https://doxa.life/js/doxa-maps` (or your own CDN / GitHub Pages / doxa-base Forgejo host).
+   `https://doxa.life/js/doxa-maps` (or your own CDN / GitHub Pages / a Forgejo host you run).
 3. Create a page and add the shortcode:
 
    ```
diff --git a/deployment/wordpress/tests/wp-embed-contract-test.php b/deployment/wordpress/tests/wp-embed-contract-test.php
index 7c018d261..ea279adf6 100644
--- a/deployment/wordpress/tests/wp-embed-contract-test.php
+++ b/deployment/wordpress/tests/wp-embed-contract-test.php
@@ -52,7 +52,7 @@ $out = do_shortcode_call('doxa_map', [
   'bundle'    => $target['bundle'],
   'element'   => $prof['element'],
   'profile'   => $prof['id'] ?? $prof['name'] ?? $target['bundle'],
-  'base'      => 'https://nuxtbase.app/plugin-assets/'.$tree,
+  'base'      => 'https://cdn.example.org/plugin-assets/'.$tree,
   'integrity' => $integrity,
 ]);
 global $SCRIPTS, $INLINE;
@@ -76,7 +76,7 @@ $cfg  = json_decode($json, true);
 $assert('profile-config is valid JSON', is_array($cfg), $json ? substr($json,0,60) : 'no match');
 // 3. the script src equals the manifest's catalog path for this bundle
 $src = reset($SCRIPTS)['src'] ?? '';
-$want = "https://nuxtbase.app/plugin-assets/{$tree}/{$target['bundle']}/{$target['bundle']}.js";
+$want = "https://cdn.example.org/plugin-assets/{$tree}/{$target['bundle']}/{$target['bundle']}.js";
 $assert('script src matches catalog path', $src === $want, $src);
 // 4. SRI: the filter must add integrity to the emitted <script> tag
 $handle = array_key_first($SCRIPTS);
@@ -86,7 +86,7 @@ $assert('crossorigin anonymous present', str_contains($tag, 'crossorigin="anonym
 // 5. a BAD integrity must be REJECTED (negative test — the format regex must actually fire)
 $SCRIPTS = [];
 $out2 = do_shortcode_call('doxa_map', ['bundle'=>$target['bundle'],'element'=>$prof['element'],
-  'profile'=>$prof['id']??$target['bundle'],'base'=>'https://nuxtbase.app/plugin-assets/'.$tree,
+  'profile'=>$prof['id']??$target['bundle'],'base'=>'https://cdn.example.org/plugin-assets/'.$tree,
   'integrity'=>'not-a-valid-hash!!']);
 $h2 = array_key_first($SCRIPTS);
 $tag2 = apply_filters('script_loader_tag', "<script src='x' id='$h2-js'></script>", $h2, 'x');