Previewed pages may fetch the local diagram bundle; everything else off-origin is still refused.
What's wrong with this entry?
The check that stops previewed pages reaching the network now explicitly allows the diagram bundle path, provided it has no query string and is on the preview server's own origin. Everything else is still refused with "Preview refuses network-reaching paths".
- The list of permitted remote path prefixes is now a plain array:
/css,/icon,/earlyaccess/,/s/,/l/,/ea/. - Preview remains gated overall; when the gate helper returns false the decision is a denial with reason "Preview gate closed at schema freeze".
["/css", "/icon", "/earlyaccess/", "/s/", "/l/", "/ea/"]
Strings lifted out of the shipped bundle, so the claim above can be checked against them.