[i-shutov]

Baseline and isolation

Independent B lane B06, base main 8764a732b9a846a6ba1f111c9b656781195a6412. At start, #25/#26/#27/#28 were open. PR #24, themes #16 and B03/B04 were already merged. B05 #25 caps compressed PNG and Poppler timeouts; this PR independently caps decoded image dimensions and does not touch B05 pdf_navigation.rs.

Implementation

• New src/preview_image.rs: PNG-only validation of signature/IHDR, 64 MiB compressed budget, 8192 px max edge, 8,388,608 px max image; strict image-rs width/height limits and best-effort 96 MiB decoder allocation hint.
• All three egui preview decode sites now use one bounded helper: XeLaTeX page 1, Poppler page navigation, and Figure fonts proof. Error text is surfaced, previous navigated page remains intact. TeX/PDF untouched.
• Four Rust unit regressions: valid PNG exact pixel values, high-ratio decompression-bomb header/zero dimensions, corrupt/truncated IHDR, byte+pixel boundaries.
• New B06-specific plans/, insights/, and QA_PREVIEW_IMAGE_LIMITS.md with physical platform smoke matrix.

Evidence / no false PASS

• Exact-base compare: 5 changed files, all B scope + B06-namespaced plans/insights. No core API, extensions or neighbor files.
• Local Rust, rustfmt and GUI tests: NOT_RUN (no cargo/rustc/native Windows/macOS GUI here). GitHub Actions exact-head PENDING until verified.
• Windows 10 x64 and physical Apple Silicon macOS GUI/Retina/IME/native dialogs/screenshots NOT_RUN. Windows Server CI does not substitute.
• GPU texture copies and process RSS are not strictly capped. image-rs max_alloc is best-effort. Large figures can be rejected; exact PDF export remains authoritative.

Follow-up

Inspect exact SHA GitHub Actions; fix only this branch if red. After hosted CI evidence, ask QA to execute B06 physical smoke with screenshots/hash ledger. Independently mergeable with #25 (disjoint file paths).

CI checkpoint at exact B06 SHA f76eef6012b7889e6139f199c5eb0e7be3d9d6ce (2026-10-31)

Observed D QA matrix #41184179011: Linux fmt/workspace tests/Clippy completed/success, real XeLaTeX CLI jobs on Linux, hosted macOS 15 and Windows Server 2022 completed/success; native Rust jobs on hosted Windows/macOS still running/queued at this checkpoint. Figure-font gate #41184178997 completed/success. Standard CI #41184178998: XeLaTeX Linux fixture job completed/success, Windows/macOS Rust jobs in progress. No overall B06 CI PASS is asserted while pending jobs remain. Physical Win10 and physical Mac ARM screenshots are NOT_RUN.