Isolate blocking file access with bounded owned workers #790

Problem and scope

At main 2f6bb46, server/file-view.ts uses synchronous stat/open/read for file classification and server/files.ts performs synchronous directory walks. A filesystem call on a stalled mount can block the server thread before a client-side preview deadline can help. #785 bounds the browser's response read; it does not isolate server filesystem operations.

I have a local process-isolation implementation to extract, but its private dashboard routes are outside this proposal. This issue asks for agreement on a small portable server contract before a standalone implementation PR. It is not a claim that a public production outage or an exploit has been reproduced.

Proposed contract

• A child process owns blocking stat, sniff, directory listing/search and file-open operations. The app event loop never performs those operations for these routes.
• At most four active children globally per server; an operation has a three-second deadline covering startup and response headers. Saturation returns a bounded service-unavailable response, without an unbounded waiting queue.
• The three-second deadline bounds HTTP waiting and requests cancellation of only the operation’s owned child. It cannot guarantee kernel I/O termination or reaping within three seconds. A slot stays reserved until that child actually exits and is reaped; unreaped children still count toward the four-child cap, so further requests return 503. Reaped failures release descriptors and slots. A JS Promise timeout around synchronous filesystem work is insufficient.
• After headers, file content streams with backpressure and a bounded transport buffer. It is not copied wholesale into memory or JSON. A slow download is not killed by the metadata deadline once streaming began; disconnect or a separate idle policy ends its owned operation.
• Preserve the existing relative/absolute/~/ path resolution and ambiguous-name response, MIME/kind rules including SVG-as-image, authentication, remote-PC binding, download disposition, HEAD/Range/media seeking, no-store and the file CSP. Do not relax HTML/SVG origin sandboxing.
• Avoid personal launcher/dashboard APIs, machine paths and system configuration. Check macOS/Linux/Windows child startup and teardown before making it the default.

Verification before implementation can be ready

Use owned synthetic fixtures for a child stalled before headers, a real blocked open where supported, and a stream stalled after headers. Keep health/session/WebSocket requests responsive during the block; assert the four-child cap, 503 on saturation, a three-second HTTP/cancellation-request deadline, descriptor/slot recovery for a reappable fixture, retained slots and 503 for unreaped children, no late publication after abort and range/HEAD correctness. Run existing file/server/browser tests with the same authentication/CSP and remote owner. Report unsupported platform probes and uninterruptible-I/O/reap limitations rather than claiming them passed.

Related local client contribution: #785. This proposal does not depend on HTML/Markdown preview feature PRs #651 or #616. No implementation is included here and no public or installed runtime is changed.