[ishaansathaye]

Connect the public demo to https://doke.ishaan.sh/ and record the hosting setup in the guide. The Pages domain association and proxied DNS record are active, with valid HTTPS.

Cloudflare automatically appends an analytics beacon on the custom domain, which the existing Content Security Policy blocks. Add Cache-Control: public, max-age=0, must-revalidate, no-transform to the packaged response headers so Cloudflare preserves the reviewed HTML. App rendering and simulation code are unchanged.

Validation:

• Portable package generated successfully; the only changed application file is _headers compared with the current production manifest.
• git diff --check and staged secret scan passed.
• Published successfully to the existing Pages project. The custom domain is active with valid HTTPS and HTTP 200.
• Verified live Cache-Control: public, max-age=0, must-revalidate, no-transform; HTML, JavaScript, timing data, Wasm, and atlas metadata match the deployment manifest exactly.
• Independent review approved the change; existing security headers are preserved.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.