feat(client): save files under a name every platform can write

A node serves the name its disk gave a file; the client now makes it
portable at save time (single file, zip entries, zip name) and says so
on the transfer row. Same rule as paths.sanitize_for_download, held by a
parity test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index c89be6d..f152883 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -2982,6 +2982,15 @@ requirements, not compatibility notes.
 | **Watcher reliability** | Change notification drops events under load on Windows, and inotify is unreliable on a FUSE mount. **Periodic reconciliation is mandatory on both platforms** |
 | **No symlinks, no POSIX permissions** | Simplifications: nothing to defend against, and the node runs as the user anyway |
 
+**The client makes a name writable when it saves, and says so.** A node serves
+the name its disk gave the file and never rewrites it — that is the string that
+opens it — so a single file, a zip's entries and the zip's own name are passed
+through `portable-name.js` at the moment of saving (reserved characters become
+`_`, a trailing dot or space goes, a reserved stem gains `_`), and the transfer's
+row names the original when it changed. The rule is `paths.sanitize_for_download`,
+and the two are held byte-identical by a parity test. Two different names can
+still become one — a zip keeps both entries under it.
+
 **Case folding is for comparisons the code makes itself** — index identity,
 collision reporting, root names, nesting checks. It is *not* needed for the
 no-overwrite rule, where the filesystem's own case-insensitive `stat()` already