Module jobs 

Copy and move as background jobs: fs.op.start, fs.op.resolve, fs.op.cancel, with progress published as files:op events.

Each op runs on its own std thread, never on the async runtime: copying blocks for as long as the disk takes, and a conflict blocks until the user answers. At most JobConfig::max_concurrent ops work at once; the rest wait their turn, reported as running with no progress.

The rules every step follows, because each guards against losing data:

• A file is written under a temporary name in the destination folder and only then renamed into place, so a partial file never carries the real name, and canceling or failing removes it.
• Replace never truncates: a file over a file is a rename over it; any other replace first moves the old entry aside and puts it back if the new one can’t be put in its place.
• A move deletes a source only after its copy fully succeeded; a folder is removed only once everything inside it was moved.
• No step follows a link: links are copied as links, never walked.
• Nothing that exists is overwritten without an answer: every create is a create-new or a no-replace rename, so a name taken in the meantime is a fresh conflict, not a silent overwrite.

Spec: docs/specs/SPEC_FILE_BROWSER_PANE_2026_10_01.md §7.1, §7.2, §9.

Structs

EntrySide 🔒

One side of a conflict, as the prompt shows it: a local entry’s metadata or a host’s (host_jobs).

HostJob 🔒

A host transfer’s handle on its op: the same progress, failures, cancel and conflict questions as a local copy’s (host_jobs).

Job 🔒

JobConfig

Tunables, with test seams that production leaves unset.

Jobs

The ops in flight, and the slots they take turns on.

Measure 🔒

Entries and file bytes under a path, counted the same way as progress.

OpControl

One op’s controls, shared by its thread and the RPC handlers.

Plan 🔒

PlanItem 🔒

Question 🔒

Raced 🔒

The destination’s name was taken between the check and the write: look again (it is now a conflict, or a folder to merge into).

Registered 🔒

Removes an op from the registry when its thread ends.

Slot 🔒

One of the max_concurrent working slots.

Enums

CopyError 🔒

Ending 🔒

HostStop 🔒

How a host transfer stopped early.

How 🔒

How to put an entry at its destination.

Outcome 🔒

What became of one entry and everything under it.

Renamed 🔒

Constants

EVENT_FILES_OP

MPS event carrying an op’s progress. Scoped to block:<id>; payload FsOpEvent.

MAX_KEEP_BOTH 🔒

How many name (n) candidates keep-both tries before giving up.

MAX_RACE_RETRIES 🔒

How many times one item is retried when its destination keeps appearing between the check and the write.

PROGRESS_INTERVAL 🔒

running events are sent at most this often (spec §10: one patch per ~100 ms). Every other state goes out at once.

Statics

JOBS

The process-wide job registry behind the fs.op.* handlers. Process-wide rather than per connection, so a window reload doesn’t orphan an op.

Functions

broker_emitter

The Emit that publishes files:op to block:<block_id>.

describe 🔒

An I/O error as a sentence naming the item.

discard 🔒

Remove a temporary file this job wrote. Best effort: the failure that led here is the one worth reporting.

file_name_lossy 🔒

keep_both 🔒

Keep both: put at the first free name (2), name (3)… beside dest. Each attempt is itself the existence check (put must fail with AlreadyExists on a taken name), so a name taken by another writer between attempts moves on to the next number instead of overwriting.

lock 🔒

A lock recovered if a panic elsewhere poisoned it: every holder leaves the guarded state consistent, and a poisoned lock must not wedge every later op.

mtime_ms 🔒

Unix millis of a modification time, for the conflict prompt.

numbered_name 🔒

name (n).ext for a file, name (n) for a folder (whose dots aren’t an extension) or a name with no extension. Works on the raw name, so a name that isn’t valid Unicode keeps its bytes.

plan 🔒

sibling_temp 🔒

A hidden, unique name beside dest, in the same folder so a rename from it is never a cross-volume move.

verb 🔒

Type Aliases

ChunkHook 🔒

Called after each chunk of a file is written, with the bytes written so far. Tests use it to cancel mid-file.

Emit

Delivers an op’s events. In production, a files:op publish scoped to the block that started it.