The Browser Zero-Copy Boundary: Fewer Copies Is the Practical Goal

Before shipping it, separate protocol facts, product promises, and operating cost. Mixing those layers produces confident but incorrect decisions. A web page cannot hand a file descriptor to the network stack like sendfile. Practical zero-copy means fewer JavaScript heap duplicates through windowed slices, transferable buffers, prompt release, and no whole-file assembly.

File transfer must reconcile sender offsets, durable receiver writes, chunk integrity, and terminal state on both peers. A full progress bar may show queued bytes, not a complete usable file.

The parts that make the design practical

Write the following choices as reviewable rules instead of scattering them across callbacks and UI conditions. Explicit rules make scaling, compatibility, and diagnosis less dependent on guesswork.

• Use one byte budget for read-ahead and send windows so unacknowledged data cannot accumulate.
• Move ArrayBuffer ownership to Workers with transferables and never read detached buffers afterward.
• Persist chunks and hash incrementally without creating a second whole-file copy before completion.

The honest browser goal is a bounded, low-copy pipeline. If window size controls memory and cancellation releases every stage, very large files remain stable.

Keep false assumptions out of production

Boundaries turn hidden assumptions into incidents. Weak networks, refresh, concurrency, and capacity need combined coverage because retries can hide each one in isolation.

• Hashing, encryption, and send each slice the same chunk, multiplying peak memory.
• Code reuses a detached buffer after Worker transfer, intermittently sending empty data or throwing.
• Cancel stops the network loop while read queues and Workers retain large buffers.

What the release gate should inspect

Do not stop verification when the final action succeeds. Count side effects, measure wait time, inspect privacy, and prove the next run begins from a clean baseline.

1. Transfer a virtual file several times device memory and prove peak use follows window size, not file size.
2. Cancel at each pipeline stage, force GC where available, and inspect buffer, Worker, and transaction release.
3. Benchmark transferable versus copied messages across CPU, memory, and throughput before claiming a benefit.

The release bar is clear: users understand the current state, failures stop or recover, resources stay bounded, and operators can identify the phase from minimum necessary evidence.