The dangerous implementation is not one that never works. It is one that works in a demo and loses its boundaries under real networks and real data volume. A refresh normally discards the File object, so reselection is a valid permission boundary. Name, size, and timestamp are hints; the original task’s content digest is the trustworthy identity.
File transfer must reconcile sender offsets, durable receiver writes, chunk integrity, and terminal state on both peers. A full progress bar may show queued bytes, not a complete usable file.
Engineering boundaries and tradeoffs
This capability crosses clients, networks, and servers, so a local optimization can create a system failure. Decisions must constrain both endpoints, persisted truth, and operating budgets together.
- Store size, modification time, full digest, and optional sampled fingerprint when the task is created.
- Reject obvious mismatches cheaply, then complete a strong digest check in a Worker.
- Preserve receiver ranges during verification; a wrong selection does not erase progress and may be retried.
Layered checks speed up rejection, but samples are only filters. A full digest bound to the original task is what makes reselection safe.
How it fails in production
An abnormal path is more than an error banner. It decides how in-flight work stops, how the peer learns the outcome, what residue remains, and whether the next operation inherits it.
- Name and size match even though an edited same-length file is not the original.
- A head-and-tail sample passes despite changed middle content and is incorrectly treated as final proof.
- A large digest runs without a visible phase, causing repeated refreshes because the page appears stuck.
Turn testing into a closed loop
Write the expected state trace before injecting faults. At every phase, reconcile user-visible outcome, both protocol endpoints, persistent records, and resource counts to prove the loop.
- Reselect files with same name and size, same name with different size, and matching timestamps but different bytes.
- Cancel or refresh at 1 percent, 50 percent, and just before digest completion without losing receiver ranges.
- Change unsampled bytes and prove the full digest remains the final gate before resume.
A capability becomes maintainable when it degrades safely, repetition adds no side effects, and its signals reveal a fault before user reports do.