[lwwmanning]

This PR fixes four small problems on the docs and explore sites:

• explore had no security headers. It now sends a CSP. The CSP allows the wasm module, Google Fonts, the worker, and the https URLs that users open.
• On preview deployments, the Vercel toolbar was blocked. Previews now allow its sources. The production domains keep the strict policy.
• Docs search did not finish. The theme now marks its main content with role="main", which Sphinx search requires.
• Javadoc pages requested a font file that JDK 17 does not make. The docs build now removes that request.

I tested each change on preview deploys in a browser.

🤖 Generated with Claude Code

[codspeed]

Merging this PR will degrade performance by 3.4%

4 warnings

⚠️ Walltime results may be unreliable

Some benchmarks used the Walltime instrument outside CodSpeed Macro Runners, which can make the results inconsistent.

Learn more about Macro Runners

See affected benchmarks

⚠️ Unable to measure the execution of 1 benchmark

This benchmark measured no execution time, so its result is not comparable and counts as unchanged. This usually happens when the compiler removes the code under test.

Prevent compiler optimizations

See affected benchmarks

⚠️ 1 benchmark is dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
❌ 1 regressed benchmark
✅ 2272 untouched benchmarks
⏩ 370 skipped benchmarks¹
🗄️ 30 archived benchmarks run²

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	CPU Simulation	filter_powerlaw_by_correlated_runs[100000]	51.2 µs	61 µs	-15.96%
⚡	Walltime	lt_i64_nullable_avx512	8.1 µs	7.3 µs	+11.05%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing wm/web-fixes (0715c7d) with develop (40e0b1c)}

Footnotes

1. 370 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. 30 benchmarks were run, but are now archived. If they were deleted in another branch, consider rebasing to remove them from the report. Instead if they were added back, click here to restore them. ↩

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T05:39:49.208356Z	0715c7d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.