Bound native media preview capabilities and source range reads

docs/MEDIA-PREVIEW.md

@@ -0,0 +1,45 @@
+# Bounded native media previews
+
+Structural tests passed; published Windows 0.1.2 still uses the
+earlier asset protocol. Native playback and other OS checks remain open.
+
+The replacement `searchi-media` protocol uses random opaque capabilities instead
+of returning filesystem paths. The registry retains at most sixteen grants;
+older addresses expire as new previews are prepared. At most two requests are
+admitted before scheduling work. Audio/video responses use bounded 1-MiB byte
+ranges instead of allocating an entire recording. Images retain a 64-MiB input
+limit and format-specific pixel ceilings. Ordinary opening/revealing uses the
+separate index-validated native opener.
+
+Each grant is bound to an opened file, canonical path, size, timestamp, platform
+file identity and durable indexed media-change revision. Requests revalidate
+these properties and reject expired, deleted, replaced or invalidated sources.
+The frontend accepts only 32 lowercase hexadecimal capability identifiers.
+Arbitrary paths, remote URLs, query strings and traversal are not preview grants.
+The generic Tauri asset protocol is disabled in the new configuration.
+Index-change notifications also advance the preview selection identity, so a
+same-path image/recording reloads rather than retaining previously decoded media.
+
+This does not hash every recording on every request. A same-size/mtime in-place
+write may remain undetected until a filesystem hint or byte-verifying rescan
+advances the indexed revision. Source reads and filesystem/index changes are
+not one atomic transaction. Do not claim complete byte freshness or native
+playback compatibility from these structural checks.
+
+Required validation includes capability eviction, missing/unindexed/replaced
+files, durable same-stat invalidation, byte-range edge cases, large recordings,
+request admission, MIME behavior, native image/audio/video playback and seeking,
+and preview reload after index changes. Record executed checks before closing
+the corresponding roadmap item.
+
+Windows CPU validation: all 45 native tests passed, including nine actual
+temporary-file/protocol cases covering 8-MiB no-range recordings with 1-MiB
+responses, full HEAD metadata, seek byte equality, grant eviction, admission,
+invalid paths, deletion, unindexed files, same-size/time replacement identity,
+durable same-stat hint invalidation and actual renamed PNG format/MIME.
+All 59 frontend tests passed, including opaque-token rejection and same-path
+index-refresh invalidation. Format checking and production frontend build passed.
+These checks do not prove WebView playback or macOS/Linux protocol behavior.
+The locked native suite, strict all-target Clippy and Rust formatting checks
+passed after the final native edits. No model inference or GPU test was needed
+for these protocol regressions.

docs/ROADMAP.md

@@ -55,9 +55,12 @@ release. Keep their evidence and unchecked production gates intact.
 ## 3. Desktop
 - [x] Image preview pixel ceilings use actual decoded format; a real PNG renamed
   `.jpg` cannot receive the larger JPEG allowance (Windows CPU regression).
-- [ ] Replace lifetime-growing native media asset grants with bounded preview
+- [x] Replace lifetime-growing native media asset grants with bounded preview
   access, including range limits, stale-source handling and selection/reload tests.
   Do not use permanent forbidden patterns as revocation.
+- [ ] Validate native custom-protocol image/audio/video playback and seeking on
+  release platforms; structural Windows CPU tests alone do not close this gate.
+  See [preview contract and evidence](MEDIA-PREVIEW.md).
 - [x] Official single-instance transport with isolated explicit profiles;
   Windows CPU duplicate launch exits without a second query worker.
   See [launch evidence](SINGLE-INSTANCE.md); visual focus and other OS checks remain open.