Keep a single preview variant and verify read lock boundaries

README.md

@@ -609,9 +609,8 @@ terminal status and authenticated canvas/asset rereads as completion evidence.
 ### Managed image previews
 
 Original asset bytes remain immutable and are used by the ordinary asset URL,
-downloads and AI inputs. Authenticated `GET .../assets/{id}?variant=preview&width=512`
-returns a bounded display rendition; widths are 256, 512, 1024 or 2048 (default
-512). Opaque previews use JPEG quality 82, transparency stays PNG, GIF preserves
+downloads and AI inputs. Authenticated `GET .../assets/{id}?variant=preview`
+returns one display rendition bounded to 1024 pixels on its longest edge. Opaque previews use JPEG quality 82, transparency stays PNG, GIF preserves
 the original animation, and JPEG EXIF orientation is applied. Small originals
 may be returned unchanged when this is more efficient. No preview URL belongs
 in node `data.src`: persist the original managed URL and optional original
@@ -620,7 +619,7 @@ in node `data.src`: persist the original managed URL and optional original
 Permissions are checked on every read, including cache hits. Originals are not
 replaced. Generation is serialized and the immutable encoded preview cache is
 bounded to 32 MiB / 128 entries. Current capabilities advertise `assets.previews`
-and `assets.preview_widths`. No database migration is needed. Asset reads and
+and `assets.preview_max_edge`. No database migration is needed. Asset reads and
 Canvas GET release their permission transaction before encoding/writing the
 response. Uploads release the initial workspace lock before receiving a large
 multipart body and recheck current write permission before committing.