fix(react): make the filename sanitizer do what its comments claim

Two places the code and its own documentation disagreed, both found by review.

RESERVED was `$`-anchored on the whole name while the comment above it said
"reserved names remain reserved with an extension — `CON.csv` is still `CON`".
Only a bare `CON` was caught; `CON.csv`, `nul.txt` and `COM1.csv` sailed
through. Device names are now matched against the stem before the first dot,
with `desktop.ini` / `thumbs.db` kept as whole-name matches since those are
files rather than devices. Reachable through the `fileName` escape hatch.

The byte clamp ran last, so a 180-byte cut landing on a `.` or `-` re-created
exactly the trailing punctuation the trim exists to remove — and Windows strips
a trailing dot, so the name on disk would differ again. Trimming now happens
after clamping.

Both mutation-proven: re-anchoring RESERVED and moving the clamp back to last
each turn the suite red.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: blove

packages/react/src/__tests__/save-file.test.ts

@@ -5,6 +5,7 @@ import {
   buildExportFileName,
   defaultSaveFile,
   exportTimestamp,
+  sanitizeStem,
   toCsvBlob,
 } from "../save-file";
 
@@ -351,3 +352,23 @@ describe("sanitizeStem is linear, not polynomial", () => {
     expect(elapsed).toBeLessThan(500);
   });
 });
+
+describe("save-file, the two comment/code disagreements", () => {
+  it("treats a reserved device name as reserved WITH an extension", () => {
+    // `CON.csv` resolves to \\.\CON on Windows. The regex was $-anchored on the
+    // whole string, so only a bare `CON` was caught while the comment claimed
+    // otherwise. Reachable through the `fileName` escape hatch.
+    expect(sanitizeStem("CON.csv")).toBe("_CON.csv");
+    expect(sanitizeStem("nul.txt")).toBe("_nul.txt");
+    // Not a device: only reserved as the whole name.
+    expect(sanitizeStem("console.csv")).toBe("console.csv");
+  });
+
+  it("does not leave trailing punctuation created by the byte clamp", () => {
+    // The clamp used to run last, so a cut landing on a "." restored exactly
+    // what the trim exists to remove.
+    const cut = sanitizeStem("a".repeat(179) + "." + "b".repeat(50));
+    expect(cut.endsWith(".")).toBe(false);
+    expect(cut.endsWith("-")).toBe(false);
+  });
+});

packages/react/src/save-file.ts

@@ -46,8 +46,22 @@ const ILLEGAL = /[<>:"/\\|?*\s\x00-\x1f\u202a-\u202e\u2066-\u2069]/g;
  * Chromium's own list is larger than Microsoft's and prefixes matches with `_`.
  * Doing it here keeps the name predictable across platforms.
  */
-const RESERVED =
-  /^(con|prn|aux|nul|com[1-9]|lpt[1-9]|clock\$|conin\$|conout\$|desktop\.ini|thumbs\.db)$/i;
+const RESERVED_DEVICE =
+  /^(con|prn|aux|nul|com[1-9]|lpt[1-9]|clock\$|conin\$|conout\$)$/i;
+
+/** Whole-name matches — these are only reserved as the complete filename. */
+const RESERVED_WHOLE = /^(desktop\.ini|thumbs\.db)$/i;
+
+/**
+ * A device name is reserved WITH an extension too — `CON.csv` resolves to
+ * `\\.\CON`, which is why Windows treats it as the device rather than a file.
+ * The comment above said so while the regex was `$`-anchored on the whole
+ * string, so only a bare `CON` was caught; `CON.csv` sailed through.
+ */
+function isReservedName(stem: string): boolean {
+  const beforeDot = stem.split(".")[0] as string;
+  return RESERVED_DEVICE.test(beforeDot) || RESERVED_WHOLE.test(stem);
+}
 
 /**
  * Bytes, not characters. Every mainstream filesystem caps a path component at
@@ -164,13 +178,16 @@ export function sanitizeStem(name: string): string {
     // anything that later parses the name.
     .replace(/\.{2,}/g, ".");
 
-  if (stem === "" || RESERVED.test(stem)) {
+  if (stem === "" || isReservedName(stem)) {
     // A name that sanitizes to nothing, or collides with a device name, gets a
     // deterministic stand-in rather than whatever the browser would have chosen.
     stem = stem === "" ? "export" : `_${stem}`;
   }
 
-  return clampBytes(stem, MAX_STEM_BYTES);
+  // Trim AFTER clamping. A 180-byte cut can land on a `.` or `-` and re-create
+  // exactly the trailing punctuation the first trim removed — and Windows
+  // strips a trailing dot, so the name on disk would differ again.
+  return trimDotsAndSpace(clampBytes(stem, MAX_STEM_BYTES));
 }
 
 /**