feat(client): save files under a name every platform can write

A node serves the name its disk gave a file; the client now makes it
portable at save time (single file, zip entries, zip name) and says so
on the transfer row. Same rule as paths.sanitize_for_download, held by a
parity test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

15 files changed, 113 insertions, 6 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index bcd5999..875b1aa 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -303,6 +303,7 @@ function TransferRow({ it }) {
           </button>
         `}
       </div>
+      ${it.note && html`<div class="transfer-meta transfer-note">${it.note}</div>`}
       ${it.status === 'preparing'
         ? html`
           ${/* Not a progress bar at 0%: nothing is wrong and nothing is
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
index bdfba6e..255c162 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
@@ -3,6 +3,7 @@ import * as platform from './platform.js';
 import { t } from './i18n.js';
 import { ask } from './ask.js';
 import { ZipStream, entriesUnder } from './zipstream.js';
+import { portableName, portablePath } from './portable-name.js';
 
 const FILE_ICONS = {
   video: '\u{1F3AC}', audio: '\u{1F3B5}', image: '\u{1F5BC}',
@@ -428,6 +429,9 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
  */
 async function downloadEntry(transfers, transport, gek, entry) {
   const totalChunks = Math.ceil(entry.size / CHUNK_SIZE);
+  // Saved under a name every platform can write, and the row says so when that
+  // is not the node's (portable-name.js, docs/MESHBAY_DESIGN.md §10).
+  const saveName = portableName(entry.name);
   const openRef = { url: null };
   let target = null;
   // The in-memory fallback's accumulator, held out here so a pause does not
@@ -435,14 +439,15 @@ async function downloadEntry(transfers, transport, gek, entry) {
   const memoryChunks = new Array(totalChunks);
 
   transfers.start({
-    kind: 'download', name: entry.name, total: entry.size, transport,
+    kind: 'download', name: saveName, total: entry.size, transport,
+    note: saveName !== entry.name ? t('transfers.renamed', { name: entry.name }) : '',
 
     // The row exists from the click. Opening a target is what takes the time —
     // the streamed path waits for the worker (twice), a Save As dialog waits
     // for a person — and doing it before the row meant three clicks produced no
     // panel at all and then several rows at once.
     prepare: async () => {
-      target = await _openTargetInTurn(entry.name, entry.size);
+      target = await _openTargetInTurn(saveName, entry.size);
       // Dismissed: nothing was started, so nothing is left on screen.
       if (target === false) return false;
       // `pausable` travels with the target, because only the target knows. The
@@ -489,7 +494,7 @@ async function downloadEntry(transfers, transport, gek, entry) {
           transport, gek, entry.id, totalChunks, onChunk, null, signal,
           lease && lease.tr, from, memoryChunks);
         const blob = new Blob(chunks);
-        _saveBlob(blob, entry.name);
+        _saveBlob(blob, saveName);
         openRef.url = URL.createObjectURL(blob);
       }
     },
@@ -523,7 +528,10 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
     return;
   }
   const totalBytes = files.reduce((n, f) => n + (f.entry.size || 0), 0);
-  const suggested = (dir.split('/').pop() || 'files') + '.zip';
+  const suggested = portableName(dir.split('/').pop() || 'files') + '.zip';
+  // Every name in the archive is made writable everywhere, or a Windows
+  // extraction refuses it; the row says how many changed.
+  const renamed = files.filter(f => portablePath(f.name) !== f.name).length;
 
   // Checked here rather than by disabling the button: Files zips a whole
   // multi-directory selection in one click (`for (const d of selectedDirs)`),
@@ -548,6 +556,7 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
 
   transfers.start({
     kind: 'download', name: suggested, total: totalBytes, transport,
+    note: renamed ? t('transfers.renamed_n', { n: renamed }) : '',
 
     // Same order as downloadEntry: the row first, then the target, then the
     // slot. A folder of forty files is exactly where the wait is longest.
@@ -584,7 +593,7 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
         });
 
         for (const { entry, name } of files) {
-          await zip.begin(name, entry.size,
+          await zip.begin(portablePath(name), entry.size,
                           new Date((entry.added_at || 0) * 1000));
           // A zero-byte file has no chunk to ask for; the header and an empty
           // descriptor are the whole entry.
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index b84da2b..a83f44b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -1218,4 +1218,8 @@ export default {
   'admin.reports_review_threshold': "Mitglieder bis zur Prüfung",
   'admin.reports_auto_block': "Ohne Prüfung sperren (1 = ja, 0 = nein)",
   'admin.reports_save': "Meldeeinstellungen speichern",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Umbenannt: „{name}“ ist nicht auf jedem System ein gültiger Name",
+  'transfers.renamed_n': "Namen geändert, damit sie auf jedem System gültig sind: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 7cbd830..46c5094 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -1199,4 +1199,8 @@ export default {
   'admin.reports_review_threshold': "Members before review",
   'admin.reports_auto_block': "Block without review (1 = yes, 0 = no)",
   'admin.reports_save': "Save report settings",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Renamed: “{name}” is not a valid name on every system",
+  'transfers.renamed_n': "Names changed to be valid on every system: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 081b1f2..0d0e865 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -1212,4 +1212,8 @@ export default {
   'admin.reports_review_threshold': "Miembros antes de la revisión",
   'admin.reports_auto_block': "Bloquear sin revisión (1 = sí, 0 = no)",
   'admin.reports_save': "Guardar ajustes de denuncias",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Renombrado: «{name}» no es un nombre válido en todos los sistemas",
+  'transfers.renamed_n': "Nombres cambiados para ser válidos en todos los sistemas: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 04218d6..3c86cd7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -1227,4 +1227,8 @@ export default {
   'admin.reports_review_threshold': "Membres avant examen",
   'admin.reports_auto_block': "Bloquer sans examen (1 = oui, 0 = non)",
   'admin.reports_save': "Enregistrer les réglages de signalement",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Renommé : « {name} » n’est pas un nom valide sur tous les systèmes",
+  'transfers.renamed_n': "Noms modifiés pour être valides sur tous les systèmes : {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 857bbc2..3a74b4d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -1226,4 +1226,8 @@ export default {
   'admin.reports_review_threshold': "Membri prima dell’esame",
   'admin.reports_auto_block': "Blocca senza esame (1 = sì, 0 = no)",
   'admin.reports_save': "Salva impostazioni segnalazioni",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Rinominato: «{name}» non è un nome valido su tutti i sistemi",
+  'transfers.renamed_n': "Nomi modificati per essere validi su tutti i sistemi: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 2d9830b..e0c38de 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -1210,4 +1210,8 @@ export default {
   'admin.reports_review_threshold': "確認までのメンバー数",
   'admin.reports_auto_block': "確認せずにブロック（1 = はい、0 = いいえ）",
   'admin.reports_save': "報告の設定を保存",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "名前を変更しました：「{name}」はすべてのシステムで有効な名前ではありません",
+  'transfers.renamed_n': "すべてのシステムで有効になるよう変更した名前：{n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 8635995..83b9eed 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -1228,4 +1228,8 @@ export default {
   'admin.reports_review_threshold': "Leden vóór beoordeling",
   'admin.reports_auto_block': "Blokkeren zonder beoordeling (1 = ja, 0 = nee)",
   'admin.reports_save': "Meldingsinstellingen opslaan",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Hernoemd: ‘{name}’ is niet op elk systeem een geldige naam",
+  'transfers.renamed_n': "Namen aangepast zodat ze op elk systeem geldig zijn: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index f988e5e..3edba2d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -1254,4 +1254,8 @@ export default {
   'admin.reports_review_threshold': "Członkowie przed oceną",
   'admin.reports_auto_block': "Blokuj bez oceny (1 = tak, 0 = nie)",
   'admin.reports_save': "Zapisz ustawienia zgłoszeń",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Zmieniono nazwę: „{name}” nie jest prawidłową nazwą w każdym systemie",
+  'transfers.renamed_n': "Nazwy zmienione, by były prawidłowe w każdym systemie: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index d761dd3..3f44570 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -1213,4 +1213,8 @@ export default {
   'admin.reports_review_threshold': "Membros antes da análise",
   'admin.reports_auto_block': "Bloquear sem análise (1 = sim, 0 = não)",
   'admin.reports_save': "Salvar configurações de denúncias",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "Renomeado: “{name}” não é um nome válido em todos os sistemas",
+  'transfers.renamed_n': "Nomes alterados para serem válidos em todos os sistemas: {n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 0d9afab..1168460 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -1199,4 +1199,8 @@ export default {
   'admin.reports_review_threshold': "进入审核所需人数",
   'admin.reports_auto_block': "无需审核直接屏蔽（1 = 是，0 = 否）",
   'admin.reports_save': "保存举报设置",
+
+  // Names made writable everywhere when saved (portable-name.js)
+  'transfers.renamed': "已重命名：“{name}”并非在所有系统上都是有效的名称",
+  'transfers.renamed_n': "为在所有系统上有效而修改的名称：{n}",
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js b/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js
new file mode 100644
index 0000000..bb2438c
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js
@@ -0,0 +1,51 @@
+/**
+ * A name that can be written on every platform a member saves to
+ * (docs/MESHBAY_DESIGN.md §10).
+ *
+ * A node serves a file under the name its own disk gave it, and a name that is
+ * fine on ext4 can be impossible on Windows or on an exFAT drive: reserved
+ * characters, a trailing dot or space, `CON` or `aux.txt`. The node never
+ * rewrites a name — it is the string that opens the file — so the client does,
+ * at the moment it saves, and says so.
+ *
+ * The same rules as `meshbay_common.paths.sanitize_for_download`, and held to
+ * them by `test_portable_name_parity.py`: two copies of a rule that differ
+ * decide differently which files get renamed.
+ */
+
+const WINDOWS_RESERVED = new Set([
+  'CON', 'PRN', 'AUX', 'NUL',
+  ...[1, 2, 3, 4, 5, 6, 7, 8, 9].map((i) => `COM${i}`),
+  ...[1, 2, 3, 4, 5, 6, 7, 8, 9].map((i) => `LPT${i}`),
+]);
+
+const RESERVED_CHARS = new Set('<>:"/\\|?*');
+
+const reserved = (c) => RESERVED_CHARS.has(c) || c.charCodeAt(0) < 32;
+
+function isPortable(name) {
+  if (!name || name === '.' || name === '..') return false;
+  for (const c of name) if (reserved(c)) return false;
+  if (name.endsWith(' ') || name.endsWith('.')) return false;
+  return !WINDOWS_RESERVED.has(name.split('.', 1)[0].toUpperCase());
+}
+
+/** `name` if it can be written everywhere, otherwise the nearest name that can. */
+export function portableName(name, replacement = '_') {
+  const text = String(name ?? '');
+  if (isPortable(text)) return text;
+  let out = Array.from(text).map((c) => (reserved(c) ? replacement : c)).join('');
+  out = out.replace(/[ .]+$/, '');
+  const dot = out.indexOf('.');
+  let stem = dot === -1 ? out : out.slice(0, dot);
+  const rest = dot === -1 ? '' : out.slice(dot);
+  if (WINDOWS_RESERVED.has(stem.toUpperCase())) stem += replacement;
+  out = stem + rest;
+  return out || 'unnamed';
+}
+
+/** Every segment of a relative path made portable, keeping `/` between them. */
+export function portablePath(path) {
+  return String(path ?? '').split('/')
+    .map((segment) => (segment ? portableName(segment) : segment)).join('/');
+}
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index 7471e31..fc91596 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -2588,6 +2588,7 @@ a.transfer-name {
   margin-top: 3px;
 }
 .transfer-failed { color: var(--error); }
+.transfer-note { justify-content: flex-start; font-style: italic; }
 
 /* ── File selection ──────────────────────────────────────────────────────── */
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
index bde382f..0d012ed 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
@@ -73,6 +73,7 @@ export class TransferStore {
       queuedByOwnLimit: Boolean(
         it.lease && it.lease.cap && it.lease.used >= it.lease.cap),
       error: it.error || '',
+      note: it.note || '',
       speed: this._speed(it),
       // The ETA is drawn only once the window holds a few seconds of real
       // measurement -- see etaSeconds.
@@ -134,10 +135,14 @@ export class TransferStore {
    * there is somewhere to write — see file-utils.js's downloadEntry.
    */
   start({ kind, name, total = 0, transport = null, run, open = null,
-          lease = null, prepare = null, makeLease = null, pausable = false }) {
+          lease = null, prepare = null, makeLease = null, pausable = false,
+          note = '' }) {
     const item = {
       id: _nextId++,
       kind, name, total, transport, open, lease,
+      // One line said under the name for the life of the row — that a name was
+      // changed to be written here, for instance.
+      note,
       done: 0,
       // A transfer that has to wait for a slot starts as 'queued', not
       // 'running'. Two different things are true of it — nothing is moving, and