# Download and export file delivery

**Test family:** `DNL`

- **DNL-001** Content bytes, filename, extension, MIME, encoding, and content-disposition agree.
- **DNL-002** Empty/small/large files download completely; checksum or independent reopen verifies integrity.
- **DNL-003** Unauthorized, expired, deleted, archived, moved, and other-tenant file URLs fail without existence leakage.
- **DNL-004** Repeated/ranged/resumed download and connection interruption do not corrupt content.
- **DNL-005** Spreadsheet/CSV formula-like values are neutralized according to export threat model.
- **DNL-006** Export respects current filters/selection/sort/columns/time zone/locale exactly as stated.
- **DNL-007** Large asynchronous export shows queued/running/failed/expired states and notifies only authorized requester.

## Comprehensive per-item coverage

- **DNL-008** Create absent, empty, ordinary, boundary-size, and over-limit content; distinguish missing data, empty content, and intentionally blank content.
- **DNL-009** Use ASCII emoticons such as `:)`, `:-)`, `;)`, `:D`, `:(`, and `<3`; preserve them exactly or reject them with a specific product rule.
- **DNL-010** Use kaomoji and complex emoji including skin tones, flags, keycaps, variation selectors, and ZWJ sequences; preserve complete graphemes.
- **DNL-011** Use accents, decomposed forms, CJK, Arabic, Hebrew, mixed direction, confusables, and invisible characters; keep rendering and identity unambiguous.
- **DNL-012** Use long words, many short lines, one long line, tabs, mixed line endings, trailing spaces, and control characters through every supported transport.
- **DNL-013** Use inert HTML/script, Markdown, template, SQL, command, path, CSV-formula, header, and log-forging canaries; never execute content as control.
- **DNL-014** Compare typing, paste, rich paste, upload, import, API, mobile, automation, and migration paths; apply the same content contract.
- **DNL-015** Save, preview, reopen, edit, copy, quote, reply, forward, notify, search, index, export, and delete; preserve intended content and access.
- **DNL-016** Verify content encoding, charset declaration, BOM, compression, chunking, multipart boundaries, and transcoding do not corrupt data.
- **DNL-017** Attempt access as owner, collaborator, removed member, external guest, anonymous viewer, and another tenant; reauthorize every delivery path.
- **DNL-018** Change access after a link, preview, notification, or cached representation exists; revoke stale copies where the contract promises it.
- **DNL-019** Edit concurrently, retry after timeout, and resubmit the same content; avoid silent overwrite, duplicates, and reordered versions.
- **DNL-020** Force storage, scanner, renderer, indexer, notification, export, and downstream integration failures; expose partial state and recovery.
- **DNL-021** Test keyboard, screen reader, zoom, reflow, high contrast, reduced motion, captions/alternatives, and focus for creating and consuming content.
- **DNL-022** Translate UI and content, switch locale and direction, and render unsupported glyphs; preserve data even when fonts or layout degrade.
- **DNL-023** Measure create, upload, render, search, download, and delete latency at normal and supported boundary sizes.
- **DNL-024** Inspect URLs, metadata, filenames, previews, logs, telemetry, caches, backups, notifications, and exports for sensitive-content leakage.
- **DNL-025** Apply malware, abuse, spam, moderation, and policy handling without exposing scanner details or destroying innocent content silently.
- **DNL-026** Delete, restore, expire, retain, place on hold, export, and purge content; make user-visible state match storage and legal policy.
- **DNL-027** Verify hashes, sizes, versions, ownership, timestamps, and audit events across replicas and transformations so corruption is detectable.

[Back to Files, content, import/export, and messaging index](../../files-content-messaging.md)
