The window's published flag is per stream, not per segment: the moment the first published segment arrived, everything already in the window, the streamer's pre-live preview segments included, was served to anyone and offered to the CDN. Going public now starts the window over at that first published segment. Reported by Greptile on #1282.