The dangerous implementation is not one that never works. It is one that works in a demo and loses its boundaries under real networks and real data volume. The browser provides selected relative paths and files; the receiver rebuilds the tree. The manifest carries normalized relative paths, type, size, digest, and task ID—never sender absolute paths.
File transfer must reconcile sender offsets, durable receiver writes, chunk integrity, and terminal state on both peers. A full progress bar may show queued bytes, not a complete usable file.
Engineering boundaries and tradeoffs
List non-negotiable invariants before selecting performance knobs. Tuning can roll out gradually; identity, permission, and terminal-state rules cannot drift at runtime.
- Normalize separators and reject absolute paths, empty components, dot-dot, and reserved device names.
- Show file count, total bytes, and conflict policy before the receiver accepts content.
- Track digest and ranges per file; aggregate folder status without erasing successful files after one failure.
Folder transfer is not a loop over files. A validated manifest with explicit conflicts and per-file recovery is what makes cross-platform reconstruction safe.
How it fails in production
Failure and success must share one state model. An error toast that neither releases resources nor propagates a terminal state leaves dirty work for the next recovery attempt.
- Case and reserved-character rules differ across systems, mapping two source files to one target.
- A malicious relative path escapes the chosen directory and overwrites unrelated files.
- Empty directories are absent from the manifest, so the resulting tree differs from the source.
Turn testing into a closed loop
Write the expected state trace before injecting faults. At every phase, reconcile user-visible outcome, both protocol endpoints, persistent records, and resource counts to prove the loop.
- Build manifest fixtures with reserved names, Unicode normalization, case collisions, and long paths.
- Interrupt any file and refresh both peers, verifying only incomplete files resume and aggregate status stays correct.
- Try dot-dot, absolute paths, and mixed separators; reject every unsafe entry before writing.
Completion is not one passing path. Every terminal state reconciles, automation stays below user intent, and every operational cost has an explicit ceiling.