diff --git a/persistent-memory.md b/persistent-memory.md
index 8c09345..4f696c9 100644
--- a/persistent-memory.md
+++ b/persistent-memory.md
@@ -120,7 +120,7 @@ _As of 2026-10-04 ~0546 PT. The newest subsection is first; older subsections ca
 ### 2026-10-03/04: live now (as of 2026-10-04 ~0546 PT)
 
 - **pfi-ana-webhost DESTROYED 2026-10-04 ~1726 (Prime: retire, build fresh if ever needed)**: `qm destroy 110 --purge`; last image `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`. All FortiGate objects for it deleted (policy 18, VIPs, address, service, DHCP reservation; **38.120.12.45 now unmapped**), public + internal DNS records removed, inventory moved to `docs/retired/pfi-ana-webhost/`. ⭐ dragonfireacoustics.com = Cloudflare Pages in the CLIENT's account (source only on nh3-dev `~/development/adhoc/dragonfireacoustics-site`, no remote). **Supersedes the two 2026-09-17 dragonfire entries.**
-- **phasefinal.com on Cloudflare Pages since 2026-10-04 ~1720** (project `phasefinal`, our account `vh@phasefinal`): www + apex CNAME → `phasefinal.pages.dev`; nginx container on ana-docker retired. Privacy page hosting line rewritten (Prime-approved wording). `_headers` + `404.html` added. ⚠ **Apex no longer 301s to www** (both serve) and the migration used **jackdaw's** Pages token: **Prime to mint `infra-ops-pages-token`** (Account Pages Edit + zone phasefinal.com DNS Edit + Single Redirect Edit), then add the apex→www Redirect Rule. Deploy: `stacks/phasefinal-web/deploy-pages.sh`.
+- **phasefinal.com on Cloudflare Pages since 2026-10-04 ~1720** (project `phasefinal`, our account `vh@phasefinal`): www + apex CNAME → `phasefinal.pages.dev`; nginx container on ana-docker retired. Privacy page hosting line rewritten (Prime-approved wording). `_headers` + `404.html` added. Apex → www 301 restored as a zone Redirect Rule. Tokens: Prime vaulted an account **token-creator** (`nh3-dev/.config/cloudflare/infra-ops-token-creator`); infra-ops minted **`infra-ops-pages`** with it (vault `…/infra-ops-pages-token`: Pages Write + all-zones DNS/redirect/cache). Deploy: `stacks/phasefinal-web/deploy-pages.sh` (proven with the new token).
 - **VM 101 PFI-ANA-DC (pfi-pve) and VM 104 nh3-laser (nh3-pve) RETIRED from running (Prime 2026-10-04 1634: "we aren't running the DC or the remote laser")**: 101 shut down cleanly, both `onboot 0`, both excluded from their nightly vzdump (last backups kept). That also ends the PVE 9 Secure Boot/VirtIO backup warnings. ⚠ If either is ever started again: enroll the Microsoft 2023 certs first (`qm enroll-efi-keys`, BitLocker check).
 - **infra-ops login on pbs-ana + pbs-nh3** (Prime 2026-10-04): uid 850, fleet key, NOPASSWD + `log_output`, bootstrapped via guest agent; `servers/pbs-*/ssh-target` now infra-ops.
 - **PBS 3 → 4: DONE 2026-10-04 1144** (Prime via Miranda): pbs-nh3 then pbs-ana, both PBS 4.2.7 / Debian 13.7. VM backups first (pbs-ana had none anywhere), disk snapshots `pre-pbs4`, read-only datastores, detached dist-upgrades. Proven: v3→v4 sync, PVE 9→PBS 4 write (ct/113), v4→v4 sync. ⚠ My first prep killed apt mid-dpkg on both (qemu-guest-agent restarted itself under the in-band apt); repaired in ~5 min, PBS never stopped serving. **Open:** sfsrv-ana (PVE 8) 04:00 run on 10-05 is the one untested pair; drop `pre-pbs4` snapshots after it; vzdumps until ~10-11. → `docs/runbooks/pbs-pbs4-upgrade-plan.md`
diff --git a/stacks/phasefinal-web/README.md b/stacks/phasefinal-web/README.md
index cde145d..469f0c8 100644
--- a/stacks/phasefinal-web/README.md
+++ b/stacks/phasefinal-web/README.md
@@ -31,19 +31,16 @@ rather than broken, which is the failure mode you won't notice.
 stacks/phasefinal-web/deploy-pages.sh        # conf/site → Pages production (branch main)
 ```
 
-Needs a vaulted Cloudflare token with Account → Cloudflare Pages: Edit (see the script).
-⚠ The 2026-10-04 migration used jackdaw's token as a one-off; a dedicated
-`nh3-dev/.config/cloudflare/infra-ops-pages-token` is pending Prime. Check the result on
-the per-deploy preview URL wrangler prints before trusting the custom domains.
+Uses the account token `infra-ops-pages` (vault `nh3-dev/.config/cloudflare/infra-ops-pages-token`).
+Check the result on the per-deploy preview URL wrangler prints before trusting the custom domains.
 
 ## DNS and redirects
 
 `www.phasefinal.com` and `phasefinal.com` → CNAME `phasefinal.pages.dev`, Cloudflare-proxied
 (both are Pages custom domains). Cloudflare-proxied is also what provides the email-address
-obfuscation the contact block relies on. ⚠ **The apex no longer 301s to www**: Traefik used
-to do that, Pages `_redirects` cannot redirect between hostnames, and no vaulted token may
-create a zone Redirect Rule. Both hostnames serve the site until Prime mints a token with
-Single Redirect: Edit; then add the rule `phasefinal.com/* → https://www.phasefinal.com/${1}` (301).
+obfuscation the contact block relies on. **The apex 301s to www through a zone Redirect Rule**
+(`http_request_dynamic_redirect` entrypoint, path and query kept), since Pages `_redirects` cannot
+redirect between hostnames. Traefik did this before the move.
 
 ## Lesson from the ana-docker era (2026-08-29)
 
diff --git a/stacks/phasefinal-web/cloudflare/README.md b/stacks/phasefinal-web/cloudflare/README.md
index 67cde5d..8c90ff4 100644
--- a/stacks/phasefinal-web/cloudflare/README.md
+++ b/stacks/phasefinal-web/cloudflare/README.md
@@ -11,8 +11,9 @@ reviewable and reproducible rather than living only in someone's dashboard.
 | `phasefinal.com` | CNAME | `phasefinal.pages.dev` | yes |
 
 Since 2026-10-04 both are Cloudflare Pages custom domains (project `phasefinal`). They used to be
-A `38.120.12.44` → ana-docker's Traefik, which also 301'd the apex to www; that redirect is gone
-until a Redirect Rule can be created (see `../README.md`). The cache rule below still applies and
+A `38.120.12.44` → ana-docker's Traefik, which also 301'd the apex to www. That redirect is now a
+zone Redirect Rule (phase `http_request_dynamic_redirect`): `(http.host eq "phasefinal.com")` →
+301 `concat("https://www.phasefinal.com", http.request.uri.path)`, query string preserved. The cache rule below still applies and
 is harmless with Pages as the origin (it respects origin headers).
 
 ## Cache ruleset
diff --git a/stacks/phasefinal-web/deploy-pages.sh b/stacks/phasefinal-web/deploy-pages.sh
index f83619b..348dd6b 100755
--- a/stacks/phasefinal-web/deploy-pages.sh
+++ b/stacks/phasefinal-web/deploy-pages.sh
@@ -2,9 +2,8 @@
 # Deploy phasefinal.com to Cloudflare Pages (project `phasefinal`, account vh@phasefinal).
 #   stacks/phasefinal-web/deploy-pages.sh
 # The site is the static tree in conf/site/ (with its _headers and 404.html); there is no build step.
-# Token: a Cloudflare API token with Account → Cloudflare Pages: Edit, read from the vault.
-#   PAGES_TOKEN_KEY defaults to the dedicated infra-ops token (to be minted by Prime);
-#   the 2026-10-04 migration used nh3-dev/development/jackdaw/cloudflare-api-token as a one-off.
+# Token: the account token `infra-ops-pages` (Pages Write + zone DNS/redirect/cache), vaulted at
+#   nh3-dev/.config/cloudflare/infra-ops-pages-token. Override with PAGES_TOKEN_KEY.
 set -euo pipefail
 here=$(cd "$(dirname "$0")" && pwd)
 key=${PAGES_TOKEN_KEY:-nh3-dev/.config/cloudflare/infra-ops-pages-token}