User → World → Page
Keep authority small and presentation composable.
User
A User is an authenticated identity, author and permission subject. Existing account credentials and identity-provider links must survive the platform migration. A widget is never an identity provider.
World
A World is the highest community container and its address. Membership supplies explicitly defined access to Pages; it does not imply permission to edit every project.
Page
A Page owns a permissioned service space: descriptors, ordered messages, collections, commands and consumer-content references. Chatrooms, projects, packs and games can expose different Page services without duplicating the social system.
A Page may be presented recursively. Showing a Page inside another Page does not copy its data or transfer its permissions.
Widget occurrence
The type/version registry selects a trusted implementation. Each occurrence owns its scroll position, open children, input and local draft. A shared Page session owns fetched data and subscriptions.
The initial registry runs bundled code only. User-authored executable widgets require a separate sandbox and capability design before admission.
Authored content and proxies
Original multimedia content uses .y2k distribution profiles. Compressed WebM playback, audio and transparent thumbnails are derivatives. A consumer preview must never automatically download the original animation or its uncompressed frames.
Search will index authorized proxy content and metadata. Private content must remain excluded or filtered according to current access; indexing does not make it public. Search integration is planned.