User → World → Page
Keep authority small and presentation composable.
User
A User is an authenticated identity, author and permission subject. Existing account credentials and identity-provider links must survive the platform migration. A widget is never an identity provider.
World
A World is the highest community container and its address. Membership supplies explicitly defined access to Pages; it does not imply permission to edit every project.
Page
A Page owns a permissioned service space: descriptors, ordered messages, collections, commands and consumer-content references. Chatrooms, projects, packs and games can expose different Page services without duplicating the social system.
A Page may be presented recursively. Showing a Page inside another Page does not copy its data or transfer its permissions.
Widget occurrence
The type/version registry selects a trusted implementation. Each occurrence owns its scroll position, open children, input and local draft. A shared Page session owns fetched data and subscriptions.
The initial registry runs bundled code only. User-authored executable widgets require a separate sandbox and capability design before admission.