Per-view media credential for a call_recording share: re-validate the share and its gate, then 302 to a FRESH short-lived presigned R2 URL. The player shell served at /r/{token} points here, so the link a client holds is the revocable token while the bearer credential under it is minted per request (design: backend/external_share/recordings.py).

Lookup is get_share_gate_facts (side-effect-free, no rendered_html — the full frozen page must not ride along on every hit of an unauthenticated route), NOT load_share — the page render is the genuine first "open" and a media fetch must not stamp first_opened_at. Successful redirects DO record a view (throttled by record_view's per-viewer window): the media URL is copyable out of the shell, so media-only watchers must not be invisible to the view log and the first-open ping. Every failure mode is a uniform, no-store 404: an unauthenticated probe learns nothing about token existence, kind, gate mode, or revocation state.

Gate honoring mirrors the page: the gate cookie is path-scoped to /r/{token}, which RFC 6265 path-matching also sends to this sub-path.