docs: openUrl hardening after review (limits, listing passes, CORS tests)

CHANGELOG (M4 section), known-issues (wasm limits: maxFetch, the 1 GiB
decode limit, the 4 GiB file limit on wasm32, bodies cut off at their
length, listing passes, the cross-origin tests, and a pre-existing
nondeterministic error choice on cve-2025-2310.h5 that can fail the
native corpus comparison), the viewer README (options, how listing
costs, tests) and the M4 status in docs/design/range-reads.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/design/range-reads.md

@@ -548,7 +548,8 @@ fast path within benchmark noise.
     arithmetic and coalescing (runs of consecutive blocks, a one-block
     hole filled, at most 8 MiB per request) follow it; the cache is
     about 450 lines (with its documentation) in the wasm crate, with no
-    in-flight tracking or HTTP.
+    in-flight tracking or HTTP. (A hole already cached is not filled:
+    it would be fetched again.)
   - **The HTTP is JavaScript** (`crates/clawhdf5-wasm/js/remote.js`,
     shipped as a wasm-bindgen snippet): `fetch` with `Range`, six
     requests at a time, every answer checked (206, `Content-Range` when
@@ -570,6 +571,17 @@ fast path within benchmark noise.
     attributes and a 10-value window of the 25-million-value dataset
     took 5 requests, 6 MiB; with the corpus variable, 622 files agree
     with `open(bytes)`.
+  - After review (2026-09-27): a call may fetch at most `maxFetch`
+    (512 MiB, at most 1 GiB) and a longer single read is refused before
+    fetching; `read()` refuses a decode over 1 GiB; a file of 4 GiB or
+    more is refused at open on wasm32 (offsets become `usize`); every
+    response body is cut off at the length asked for. Parsers that walk
+    siblings (B-tree v1/v2 collectors, symbol table nodes, dense links,
+    the wasm listing's child headers) read the siblings after the first
+    failure before returning it, so a pass asks for a whole level's
+    missing blocks: listing 3000 datasets went from 185 passes to 6.
+    The 32-bit risk below is covered by a Node test that reads data at
+    3 GiB from a mock server and is refused a 4 GiB file.
 
 **M5 — SWMR and growth (later, separate design).** `Storage::len()` may grow;
 add `File::refresh()` that re-reads the superblock/EOF and invalidates cached