Document how to host stellar.toml for testnet and mainnet

docs/platforms/anchor-platform/sep-guide/sep1/README.mdx

@@ -42,14 +42,65 @@ For a complete list of all available `stellar.toml` attributes, see the [SEP-1 s
 
 :::important
 
-**Production vs. Development**: You'll need separate `stellar.toml` files for testnet and mainnet:
+A `stellar.toml` describes one network. If you need a testnet file as well as a mainnet file, host each on its own host. See [Testnet and mainnet files](#testnet-and-mainnet-files) for when a testnet file is needed.
 
-- **Testnet**: Use `NETWORK_PASSPHRASE = "Test SDF Network ; September 2015"`
-- **Mainnet**: Use `NETWORK_PASSPHRASE = "Public Global Stellar Network ; September 2015"`
+:::
 
-Make sure your production file includes your actual Mainnet distribution accounts, signing keys, and production service URLs.
+## Testnet and mainnet files
 
-:::
+A domain serves one `stellar.toml`, at `/.well-known/stellar.toml`, and that file describes one network. Its `NETWORK_PASSPHRASE`, accounts, signing key, and service URLs all belong to either testnet or mainnet. One file cannot describe both.
+
+### Do you need a testnet file?
+
+Applications do not find your `stellar.toml` through the network. They read the `home_domain` of your issuing account and fetch `https://<home_domain>/.well-known/stellar.toml`. A wallet or SEP client on testnet starts from your **testnet** issuing account. If that account's `home_domain` serves your mainnet file, the client finds mainnet accounts and endpoints, and the testnet integration fails.
+
+Host a testnet file when another party needs to discover your testnet deployment: a wallet integrating against your testnet anchor, the [Demo Wallet][stellar-demo-wallet], or your own end-to-end tests. If you only call your testnet endpoints directly, you can skip it. [Stellar Lab][stellar-lab] does not read `stellar.toml`. It builds transactions and calls Horizon and RPC directly, so using Lab alone does not need a testnet file.
+
+### Use one host per network
+
+Give each network its own host and serve a separate file on each. A subdomain is the common pattern:
+
+| Network | Example host | `NETWORK_PASSPHRASE` |
+| --- | --- | --- |
+| Testnet | `testnet.example.com` | `Test SDF Network ; September 2015` |
+| Mainnet | `example.com` | `Public Global Stellar Network ; September 2015` |
+
+SDF's test anchor uses a dedicated testnet host: [testanchor.stellar.org/.well-known/stellar.toml](https://testanchor.stellar.org/.well-known/stellar.toml).
+
+Set the `home_domain` of your issuing account on each network to the host for that network: `testnet.example.com` on testnet and `example.com` on mainnet. The subdomain name is a convention, not a SEP-1 rule. Any host works as long as the issuing account's `home_domain` matches it.
+
+### What differs per network
+
+- `NETWORK_PASSPHRASE`.
+- `ACCOUNTS`. List the accounts of that network's deployment. Separate keys per network are common but not required. The same public key can exist on both networks.
+- `SIGNING_KEY`. Use the public key of the SEP-10 signing seed for that deployment.
+- `[[CURRENCIES]]` `issuer` addresses, if your testnet issuer uses a different key than your mainnet issuer. The asset `code` is usually the same.
+- Service URLs such as `WEB_AUTH_ENDPOINT`, `WEB_AUTH_FOR_CONTRACTS_ENDPOINT`, `TRANSFER_SERVER`, `TRANSFER_SERVER_SEP0024`, `DIRECT_PAYMENT_SERVER`, `KYC_SERVER`, and `ANCHOR_QUOTE_SERVER`. Point each at the deployment on that host.
+- `HORIZON_URL`, if you publish one.
+
+`[DOCUMENTATION]` and `[[PRINCIPALS]]` usually stay the same.
+
+With the Anchor Platform, each deployment serves its own file. Give the testnet deployment and the production deployment their own `SEP1_TOML_VALUE`, as described under [Configuration](#configuration).
+
+### Test discovery before mainnet
+
+1. Fetch the testnet file and check the response headers. You need a `200` status and the CORS header that SEP-1 requires:
+
+   ```bash
+   curl -s -D - -o /dev/null https://testnet.example.com/.well-known/stellar.toml
+   ```
+
+   Look for `Access-Control-Allow-Origin: *` in the output. This command sends a `GET` request and discards the body. Use `GET`, not `HEAD`: some servers, including the nginx example on the [asset publishing page](../../../../tokens/publishing-asset-info.mdx), add the CORS header only to `GET` responses.
+
+2. Confirm that your testnet issuing account points at that host:
+
+   ```bash
+   curl -s https://horizon-testnet.stellar.org/accounts/YOUR_ACCOUNT_ID | grep home_domain
+   ```
+
+3. Open the [Demo Wallet][stellar-demo-wallet], which runs on testnet by default, add your asset with your testnet home domain, and run the SEP flows you support. The Demo Wallet reads your `stellar.toml` the same way production wallets do.
+
+Repeat the first two checks against your mainnet host when you go live.
 
 ## Configuration
 

docs/tokens/publishing-asset-info.mdx

@@ -154,6 +154,10 @@ server {
 }
 ```
 
+### Testnet and mainnet
+
+A domain serves one `stellar.toml`, and that file describes one network. If you issue your asset on testnet first, host a second file on its own host, such as `testnet.yourdomain.com`, and set the home domain of your testnet issuing account to that host. Keep the mainnet file at `yourdomain.com`. See [Testnet and mainnet files](../platforms/anchor-platform/sep-guide/sep1/README.mdx#testnet-and-mainnet-files) for what differs between the two files and how to test discovery before mainnet.
+
 ## Sample code to set the home domain of your issuing account
 
 <CodeExample title="Set Home Domain">