Public and private previews
The source project controls its preview. An embed never overrides that choice.
Public
Anyone can read the prepared preview without joining the source World or signing in. It can be embedded in another server if that destination permits the post and widget. Public preview access never grants editing, original-file downloads or access to the project chat.
Private
Only people with current source Page access can read the preview. Private is the default. A private preview can be presented within its source, but cannot be distributed to another Page, even by someone who can read it.
Source ownership
Source managers change public/private policy explicitly. A widget reference contains no privacy override or permission token. Switching back to private blocks further unauthorized requests; bytes someone already received cannot be recalled.
Posting still requires destination write permission. Preview read access, editing and original-file access are separate decisions.
Compressed content only
The consumer path accepts SHA-verified prepared indexes, bounded transparent WebP thumbnails and one compressed WebM for the whole animation. It rejects original project files, per-shot movies and unverified audio. There is no automatic original-file fallback or artificial preview expiry.
Implementation boundary
The local service includes the consumer metadata route, logical asset resolver, streaming range delivery and manager-only policy command. Acceptance runs against disposable local D1/R2 fixtures. No live project has been made public by this work.
ShotTimelineV1, StoryboardTimelineV1 and AudioTimelineV1 now use the shared animator renderer and detached player in local chat acceptance. Visible instances share a prepared-content cache; hidden instances release their renderer and preserve their camera. The attachment picker checks public/private policy, and the server rechecks it when posting. Manager-facing preview publication now lives in Settings: navigation in the nav column, the access form in the main area. A bounded project search finds readable previews across Worlds and disables private sharing outside the source Page. These controls are locally verified; the live media binding remains pending. The ten foundation widgets retain normal Page permissions.