Bound native media preview capabilities and source range reads

docs/ROADMAP.md

@@ -55,9 +55,12 @@ release. Keep their evidence and unchecked production gates intact.
 ## 3. Desktop
 - [x] Image preview pixel ceilings use actual decoded format; a real PNG renamed
   `.jpg` cannot receive the larger JPEG allowance (Windows CPU regression).
-- [ ] Replace lifetime-growing native media asset grants with bounded preview
+- [x] Replace lifetime-growing native media asset grants with bounded preview
   access, including range limits, stale-source handling and selection/reload tests.
   Do not use permanent forbidden patterns as revocation.
+- [ ] Validate native custom-protocol image/audio/video playback and seeking on
+  release platforms; structural Windows CPU tests alone do not close this gate.
+  See [preview contract and evidence](MEDIA-PREVIEW.md).
 - [x] Official single-instance transport with isolated explicit profiles;
   Windows CPU duplicate launch exits without a second query worker.
   See [launch evidence](SINGLE-INSTANCE.md); visual focus and other OS checks remain open.