[i-shutov]

Actual native code, isolated fix

Base exact main c5c8c1576b6288e1d125d558d0d4872b321efb86 (B06 merged), head 0ee560ce7214e430cbaff66be3de3f017029473f. First-page preview (tikzarium-core/src/preview.rs) still used blocking Command::status() without timeout and unbounded fs::read of raster PNG, not covered by B05's separate page navigation or B06's decode preflight.

Fixed code: direct spawned pdftoppm with 45s timeout, try_wait/kill+wait; no shell and no pipes; 64MiB compressed file metadata plus capped read. Produces explicit PreviewError::Timeout or OversizedPng, preserves original TeX and actual compiled XeLaTeX PDF. Existing BuildService treats optional preview failure as visible error, valid PDF remains exportable. No A-owned runner changes, no GUI/themes/extension changes.

New Rust unit QA: size/missing-tool portable; Unix fake process exact-PDF-preservation, renderer exit and hung worker kill. Existing GitHub full workspace CI runs these on hosted OSes, but no local cargo; exact-head CI PENDING until observed. Physical Windows 10 x64 and Mac M1/M4 GUI NOT_RUN; report/plan/insight/change log included. 45s is timeout, not instantaneous cancellation; Poppler own RSS not OS-sandboxed. No change to extensions/PACKAGE_MATRIX.csv because package compatibility unchanged.

Do not merge until exact-head hosted CI green and cross-lane source QA reviewed. Related #25 B05 and #29 B06 separate, no duplicate edits.

Integrator 2026-10-31: exact-base reconciliation (no merge claim)

• Reconciled the previously green exact I07 implementation df337508002449d68e7e073abd232528b50f4154 with current main 0aa78ae22df0ae84705ba461f017fce256325875 without rewriting the core preview source. Confirmed previous main and original I07 base had identical preview.rs blob SHA 528a33fa2fbda0b5a040e3130192a816f5770254; copied tested I07 preview blob b9146d2a6bc1e654b586d4a5be4d0d9ecac54458. All non-I07 main paths retained. CHANGELOG I07 section prepended while preserving all later main release notes.
• New merge commit on this PR branch: 4de29eda59b89400b574d0cf8cf97a76d734d203, parents df337508… and 0aa78ae…, tree e3419f6ef9abb76dbec66a5351b13fb1c64664a6. Fast-forward expected-head lease succeeded. main was NOT modified by this reconciliation.
• Prior exact I07 head had Rust 41186913825 3/3, D QA 41186913852 6/6, font 41186913826 1/1 PASS. New reconciled HEAD workflows CI 41188004763, D QA 41188004747, fonts 41188004774 QUEUED; do not merge until actual exact-head results and updated main lease. Physical Win10/M1/M4 NOT_RUN.

[i-shutov]

Integration coordination: direct #36 merge against N1 main ca90c2ee685e0c997d2d90a3ac60dab9e31fdb87 was rejected by GitHub (405 actual conflicts); no force merge occurred. I opened #47 from exactly that main (head c71c85bd6926a71a7014787e2ce4829b55e4dbab) with the original source preview.rs/five tests and QA files, and a non-destructive CHANGELOG reconciliation. Main's original preview.rs blob matched #36 pre-change SHA. Exact-head #47 Rust/D/N1/font CI is now queued; do not re-merge #36 independently. Once #47 is verified and merged with expected head lease, close #36 as superseded; preserve physical Win10/M1/M4 NOT_RUN.

[i-shutov]

Superseded by integrated #47, merged as a7f98c6bcac85628d10fd60a959f6f8b1d93cb82. Verified the production crates/tikzarium-core/src/preview.rs Git blob is identical across this PR HEAD 4de29eda59b89400b574d0cf8cf97a76d734d203, #47 HEAD c71c85bd6926a71a7014787e2ce4829b55e4dbab, and merged main: b9146d2a6bc1e654b586d4a5be4d0d9ecac54458. Five related preview tests were ported. #47 exact-head Rust/D QA/font/N1 proof all passed before merge; merged main push CI remains separately pending. Closing obsolete branch without force merge; native physical Win10/M1/M4 remains NOT_RUN.