diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..5a1b1a5
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,3 @@
+# Funding links shown in the repo's "Sponsor" button.
+# https://docs.github.com/sponsors/receiving-sponsorships-through-github-sponsors/displaying-a-sponsor-button-in-your-repository
+github: excom-dev
diff --git a/packages/docs-site/public/_headers b/packages/docs-site/public/_headers
index 339beed..b0c9fd8 100644
--- a/packages/docs-site/public/_headers
+++ b/packages/docs-site/public/_headers
@@ -2,6 +2,9 @@
 # Vary keeps the two encodings in separate cache entries.
 /*
   Vary: Accept-Encoding
+  Strict-Transport-Security: max-age=15552000
+  X-Frame-Options: SAMEORIGIN
+  Permissions-Policy: camera=(), microphone=(), geolocation=(self), payment=()
 
 /assets/*
   Cache-Control: public, max-age=31536000, immutable
diff --git a/packages/docs-site/public/_redirects b/packages/docs-site/public/_redirects
index 51b95be..97e6684 100644
--- a/packages/docs-site/public/_redirects
+++ b/packages/docs-site/public/_redirects
@@ -1,8 +1,9 @@
-# Quark loads @use modules via extensionless dynamic import() URLs.
+# Quark loads the two site TypeScript modules via extensionless import() URLs.
+# Never add a `/views/<app>/<app>` line: Pages strips `.html` (308 to the clean
+# URL), so it would also capture `/views/<app>/<app>.html`. Example-app modules
+# are imported with their `.js` extension instead.
 /shell                      /shell.js                      200
 /demo-utils                 /demo-utils.js                 200
-/views/cells-app/cells-app  /views/cells-app/cells-app.js  200
-/views/temperature-app/temperature-app  /views/temperature-app/temperature-app.js  200
 
 # Example-app playground preview documents (see sandbox.html).
 /sandbox/*     /sandbox          200
diff --git a/packages/docs-site/public/views/cells-app/cells-app.js b/packages/docs-site/public/views/cells-app/cells-app.js
index 1cc0365..dd40203 100644
--- a/packages/docs-site/public/views/cells-app/cells-app.js
+++ b/packages/docs-site/public/views/cells-app/cells-app.js
@@ -1,4 +1,4 @@
-/** Cells example helpers (`@use "/views/cells-app/cells-app"`). */
+/** Cells example helpers (`@use "/views/cells-app/cells-app.js"`). */
 
 /** `[0, 1, …, n - 1]`: Quark has no range literal (`iterate(range(100))`). */
 export const range = (n) => Array.from({ length: n }, (_, i) => i);
diff --git a/packages/docs-site/public/views/cells-app/cells-app.quark b/packages/docs-site/public/views/cells-app/cells-app.quark
index 87faed2..8ba25e9 100644
--- a/packages/docs-site/public/views/cells-app/cells-app.quark
+++ b/packages/docs-site/public/views/cells-app/cells-app.quark
@@ -1,7 +1,7 @@
 /* State: each <td data-formula> holds its cell's committed text; the form's
    data-revision counts commits. Only formula cells derive a value, and only
    when the revision changes. */
-@use "/views/cells-app/cells-app" as *;
+@use "/views/cells-app/cells-app.js" as *;
 
 :scope {
   $columns: " ABCDEFGHIJKLMNOPQRSTUVWXYZ".split("");
diff --git a/packages/heft-rig/scripts/vite-config.mjs b/packages/heft-rig/scripts/vite-config.mjs
index 3b5b8a7..1647c95 100644
--- a/packages/heft-rig/scripts/vite-config.mjs
+++ b/packages/heft-rig/scripts/vite-config.mjs
@@ -67,8 +67,11 @@ const slash = (p) => p.replace(/\\/g, "/");
 /**
  * Quark `@use` TypeScript modules: transform in dev, emit stable `[name].js`
  * at build. Plain JS under `public/` (`views/<app>/<app>.js`) needs no entry
- * — static files; extensionless Quark URLs resolve to `<path>.js`
- * (`quarkModuleRewritePlugin`; `_redirects` in production).
+ * — static files, imported with their `.js` extension. Extensionless Quark
+ * URLs resolve to `<path>.js` here (`quarkModuleRewritePlugin`), but
+ * production only rewrites the two modules above (`_redirects`): a
+ * `/views/<app>/<app>` line would also capture `/views/<app>/<app>.html`,
+ * which Cloudflare Pages 308s to that clean URL.
  */
 const SITE_QUARK_MODULES = {
   shell: "shell.ts",
diff --git a/rush.json b/rush.json
index 0ce12d1..a7472cc 100644
--- a/rush.json
+++ b/rush.json
@@ -8,6 +8,12 @@
   "nodeSupportedVersionRange": ">=18.15.0",
   "ensureConsistentVersions": true,
 
+  "repository": {
+    "url": "https://github.com/excom-dev/nucleus",
+    "defaultBranch": "main",
+    "defaultRemote": "origin"
+  },
+
   "projects": [
     {
       "packageName": "@excom/neutron",