diff --git a/plugins/spatial-artifacts/server/db.ts b/plugins/spatial-artifacts/server/db.ts
index 7ac12b5..7672ccf 100644
--- a/plugins/spatial-artifacts/server/db.ts
+++ b/plugins/spatial-artifacts/server/db.ts
@@ -256,7 +256,7 @@ const next = (cur: Doc | undefined, w: Write, path: string): { path: string; nex
             if (n > 1 && !w.replace_all) {
                 return fail(
                     'edit_ambiguous',
-                    `old_str occurs ${n} times in field ${w.field}; pass replace_all or a longer old_str`,
+                    `old_str occurs ${n} times in field ${w.field}; set replace_all or use a longer old_str`,
                 );
             }
             const to = w.new_str;
diff --git a/plugins/spatial-artifacts/test/core.test.ts b/plugins/spatial-artifacts/test/core.test.ts
index b2cc7c6..e632cee 100644
--- a/plugins/spatial-artifacts/test/core.test.ts
+++ b/plugins/spatial-artifacts/test/core.test.ts
@@ -110,16 +110,16 @@ describe('daemon', () => {
     after(() => d.close());
 
     test('rejects foreign hosts, missing tokens and cross-origin writes', async () => {
-        assert.equal((await http(d.port, 'GET', '/code/artifacts', { host: `evil.invalid:${d.port}` })).status, 421);
+        assert.equal((await http(d.port, 'GET', '/code/artifacts', { host: `evil:${d.port}` })).status, 421);
         assert.equal((await http(d.port, 'GET', '/_agent/artifacts')).status, 401);
-        assert.equal((await shell('POST', `/api/a/${id}/comments`, { text: 'x' }, 'http://evil.invalid')).status, 403);
+        assert.equal((await shell('POST', `/api/a/${id}/comments`, { text: 'x' }, 'http://evil')).status, 403);
         const f = `${id}.localhost:${d.port}`;
         assert.equal(
             (
                 await http(d.port, 'POST', '/_frame/api/db', {
                     host: f,
                     body: { verb: 'get', args: {} },
-                    headers: { origin: 'http://evil.invalid' },
+                    headers: { origin: 'http://evil' },
                 })
             ).status,
             403,
@@ -549,7 +549,7 @@ describe('daemon', () => {
             true,
         );
         assert.equal((await shell('POST', `/api/a/${a.body.id}/pin`, { on: false })).body.pinned, false);
-        assert.equal((await shell('POST', `/api/a/${a.body.id}/pin`, { on: true }, 'http://evil.invalid')).status, 403);
+        assert.equal((await shell('POST', `/api/a/${a.body.id}/pin`, { on: true }, 'http://evil')).status, 403);
     });
 
     test('assets copy between artifacts server side under new ids', async () => {