Everything this profile MAY SEE, across every workspace it can reach.

🔑 THE VAULT ASKS THE WRONG QUESTION TODAY. It answers "what did I put here" — the dashboard queries onchain_publish_events by contributors_jubjub_profile_ids array-contains me, so a teammate's piece in a workspace I fully share is invisible to me even though I can open it and play it through the workspace door. This endpoint answers "what may I see" instead, which is the question a shared workspace implies.

⚠️ THE ACCESS RULE IS NOT REIMPLEMENTED HERE. Every candidate workspace is put through check_workspace_access — the SAME function require_workspace_context and verify_workspace_permission use, and therefore the same one that already governs playback. A second copy of an access rule is how a leak happens: the copies drift, one of them forgets a case, and the forgetful one is the one serving media. There is exactly one rule and this calls it.

Candidates are gathered widely and then FILTERED by that rule, never trusted from the gathering step:

• workspaces owned by, or directly listing, this profile (list_by_profile — which covers owner + direct member only)
• workspaces linked to any team this profile belongs to, which list_by_profile does NOT return: that omission is precisely the gap being closed.

Membership is checked per workspace even for team-linked candidates, because team membership is necessary but not sufficient — the permission still has to hold.