Apply image preview limits to detected format instead of extension

docs/ROADMAP.md

@@ -53,6 +53,11 @@ release. Keep their evidence and unchecked production gates intact.
   see [incremental semantic design](INCREMENTAL-SEMANTIC.md).
 
 ## 3. Desktop
+- [x] Image preview pixel ceilings use actual decoded format; a real PNG renamed
+  `.jpg` cannot receive the larger JPEG allowance (Windows CPU regression).
+- [ ] Replace lifetime-growing native media asset grants with bounded preview
+  access, including range limits, stale-source handling and selection/reload tests.
+  Do not use permanent forbidden patterns as revocation.
 - [x] Official single-instance transport with isolated explicit profiles;
   Windows CPU duplicate launch exits without a second query worker.
   See [launch evidence](SINGLE-INSTANCE.md); visual focus and other OS checks remain open.