Clarify sharing targets and deployment source history

content/(publish)/git.mdx

@@ -9,6 +9,12 @@ After this page you can publish with `git push`, connect a GitHub repository so
 
 Two lanes. The Spacefast remote needs no external host and no app install. A GitHub connection keeps your repository where it is and reacts to its webhooks.
 
+## Source and deployment files
+
+`sf publish dist --prebuilt` uploads the files in `dist`, not the editable project that produced them. A version's Git commit metadata records where a build came from; it does not mean your source or Git history was uploaded.
+
+Keep the editable project in Git. Connect its repository or push it to the Spacefast remote below. Add and commit the source files before pushing. A Git push transfers the committed history on the branch you push; it excludes files you have not committed. Keep an independent copy of your source and history for recovery. Rolling back a deployment restores published files, not deleted source files or branches.
+
 ## Push to a Spacefast remote
 
 Spacefast hosts a Git endpoint. `sf git origin` mints a signed remote and installs it.

content/(serve)/access.mdx

@@ -54,7 +54,7 @@ A second control, **What visitors can do**, sets the role that option grants. Ev
 ## Make a Space public
 
 ```bash
-sf share grant --to public --role viewer --path '/**' --space my-site
+sf share grant --to public --role viewer --path '/**' --target live --space my-site
 ```
 
 Scope it instead of opening everything:
@@ -67,6 +67,14 @@ sf share grant --to public --role viewer --path '/docs/**' --exclude '/docs/inte
 
 A public grant cannot carry publish or manage capabilities.
 
+Grants default to `live`. Opening the live site does not open branch previews or version URLs. To make immutable version URLs public too, add a grant for `all-versions`:
+
+```bash
+sf share grant --to public --role viewer --path '/**' --target all-versions --space my-site
+```
+
+Use `version:<id>` to open only one version. Branch previews need a `branch:<name>` grant; `all-versions` does not cover them or the live site. A team grant admits the owning team; it cannot name another team you belong to.
+
 ## Share links
 
 A share link is a durable URL that opens exactly the paths you scoped it to, with no account needed. The secret rides in the query string, so the link is the page: