Block structural errors first
Duplicate outputs and common invalid names become blocking errors before rename execution, reducing surprises after a batch is downloaded.
What does FileNest actually check before a batch runs?
This evidence does not use 'safe' as a slogan. It separates the checkable safeguards in the current production renamer and image batch flow: what can be reviewed first, what blocks execution, what is only advisory, whether source files are overwritten, and how output-name collisions are handled.
Pinned production source
10 checkable production behaviors
Re-reviewed from the batch-renaming, image-conversion and output-naming source pinned to the reviewed commit. The review continues to cover Pro CSV mapping integrity for batch renaming: CSV is parsed locally with a strict field-state parser; unclosed quotes, illegal quotes inside unquoted fields, illegal characters after a closing quote, incomplete rows, and conflicting targets for the same source filename are rejected before entering mapping state; header detection requires an explicit source/target column pair so ordinary filenames are not treated as headers; non-empty mapping values preserve their original characters instead of being trimmed into different filenames; and when Keep original extension is enabled, CSV targets change only the filename stem, with target extensions taking effect only when that option is off. This review adds the confirmed-preview execution snapshot: after the device-workset gate passes and download is confirmed, the renamer copies that run's file/newName pairs and accounting metadata before synchronously locking the workset; ZIP contents, success accounting and download records all use the same snapshot, and the workset unlocks only after packaging finishes. Pre-execution preview, duplicate-output blocking and original-file protection remain verified. Existing image source previews, active-batch locking, settings undo/redo and output naming remain unchanged. This records safeguards that can be checked in the current implementation without stretching UI protections or device-capacity heuristics into a zero-risk guarantee.
Pinned production commit: 467e9d6b; 5 production source files referenced.Old-name → new-name preview before execution
The rename workspace computes and displays the original filename, proposed filename, warnings and errors for each file so the batch can be reviewed before ZIP creation. Once download is confirmed, that run's file/newName pairs are copied into the execution snapshot and the workset is locked until ZIP packaging finishes; ZIP contents, success counts and download records use the same snapshot so mid-run UI changes cannot split the reviewed preview from the delivered archive.
Source: components/RenamerTool.tsx
CSV mappings are fully validated before entering rename preview
CSV mappings are parsed locally in the browser. An unclosed quote, an illegal quote inside an unquoted field, illegal characters after a closing quote, a row missing either mapping column, or conflicting target names for the same source filename rejects that import instead of putting partial bad data into mapping state. The first row is treated as a header only when both supported source and target header names match, and non-empty mapping keys and values are not rewritten by trimming legitimate leading or trailing spaces.
Source: components/RenamerTool.tsx · lib/renamer-csv-map.ts
Duplicate output names block the batch
Proposed output names are checked case-insensitively for duplicates. A collision becomes a blocking error instead of waiting until ZIP creation to reveal the conflict.
Source: components/RenamerTool.tsx
Common unsafe filename conditions are blocking
Current checks cover empty names, slash/backslash, control characters, common reserved symbols, trailing spaces or periods, Windows reserved names, and output names beyond the current 180-character limit.
Source: components/RenamerTool.tsx
One explicit toggle controls extension behavior
When Keep original extension is enabled, both ordinary rules and CSV mappings use the source file extension; a different extension in the CSV target cannot silently replace it. When the option is off, the CSV target extension may take effect. If a source with an extension ultimately produces an extensionless output, the workspace still warns because extension removal can be intentional.
Source: components/RenamerTool.tsx · lib/renamer-csv-map.ts
Blocking errors disable execution
When the rename batch contains blocking errors, the action that creates the downloadable ZIP remains disabled until the naming conflict or invalid output is resolved.
Source: components/RenamerTool.tsx
ZIP creation blocks above the device-safe workset
The renamer selects a conservative one-run ZIP source-byte window from device memory, CPU and coarse-pointer hints. Above that window the files remain available for preview, ordering and rule edits, but JSZip packaging does not start; the 500-file count limit is unchanged.
Source: components/RenamerTool.tsx · lib/renamer-zip-capacity.ts
Renaming creates a new ZIP without overwriting originals
Execution uses the existing browser File objects and writes them into a new ZIP under the proposed names. FileNest does not directly overwrite or delete the source files on the user's device.
Source: components/RenamerTool.tsx
Batch images expose per-file source thumbnails
Each admitted source image gets one browser Object URL. Multi-image batches show clickable thumbnails so every source can be inspected before processing, and the URLs are released on removal, clear or workspace unmount. Undo/redo restores image-setting snapshots only and does not replace these source file objects.
Source: components/ImageConverterTool.tsx
Image output name collisions get deterministic suffixes
Image outputs use a case-insensitive set of names already used in the batch. Collisions are resolved deterministically as name (2), name (3), and so on to avoid same-name results in the ZIP.
Source: components/ImageConverterTool.tsx · lib/file-names.ts
Why preview first
Why this matters more than a one-click batch promise
Human intent still needs review
Extension changes and sequence choices may be intentional, so the preview does not pretend software can decide every project-specific naming meaning.
Keep sources separate from outputs
Renamed results go into a new ZIP instead of directly rewriting or deleting source files on the user's device.
Scope limits
What this evidence does not guarantee
- This evidence currently covers preview, naming, original-file protections and the rename ZIP workset gate in batch renaming and image batches; it does not claim every FileNest tool uses the identical safety flow.
- Filename validation catches structural collisions and common invalid names, but it cannot decide whether project-specific naming semantics are correct, such as whether a sequence matches the user's real intent.
- The standard browser File object does not reliably expose a full local path, so Pro CSV mappings match by filename. If one selection contains same-named files from different folders, CSV cannot assign different targets to those same-named files. Existing output-collision validation still blocks duplicate output names, but path-level distinctions require processing those files in separate batches.
- Extension loss is advisory rather than a hard block because a user may intentionally change an extension; human review before execution still matters.
- Image thumbnails preview the source files added to the batch. They are not a pixel-level pre-execution guarantee of every conversion, compression or enhancement result.
- Image undo/redo history is bounded, in-session settings history. It does not store source-image copies and is not a cross-device or cross-session version history.
- The ZIP workset window is a conservative heuristic based on device hints available to the browser, not a precise memory measurement or a guarantee that every browser will succeed inside the window. Actual packaging can still vary with the device, file compressibility and browser implementation.
- This is a snapshot pinned to the reviewed commit. If a current tool page conflicts with older evidence, prefer the current tool page and update this report.