@evolu/common 8.17.0 → 8.18.0

package/src/local-first/Protocol.ts

@@ -43,14 +43,24 @@
  * | - {@link NonNegativeInt}       | Number of ranges.         |
  * | - {@link Range}                |                           |
  *
+ * Range upper bounds must not decrease. The last range always has
+ * {@link InfiniteUpperBound}, which is not encoded. A message with decreasing
+ * bounds, or with a hasWriteKey or subscriptionFlag value not listed above, is
+ * rejected as {@link ProtocolInvalidDataError}. So is a request with a change
+ * shorter than 41 bytes, the smallest {@link EncryptedDbChange}. A client passes
+ * such a change to storage, which skips a change it cannot read.
+ *
  * ## WriteKey validation
  *
  * The initiator sends a hasWriteKey flag and optionally a WriteKey. The
  * WriteKey is required when sending messages as a secure token proving the
  * initiator can write changes. It's ok to not send a WriteKey if the initiator
  * is only syncing (read-only) and not sending messages. The non-initiator
- * validates the WriteKey immediately after parsing the initiator header, before
- * processing any messages or ranges.
+ * decodes the whole request first and then validates the WriteKey, before
+ * storing any messages or reconciling ranges. Only the subscriptionFlag takes
+ * effect before that, because subscribing needs no WriteKey: broadcasts carry
+ * only encrypted changes. So a request rejected with
+ * {@link ProtocolWriteKeyError} still changes its subscription.
  *
  * ## Synchronization
  *
@@ -64,9 +74,14 @@
  * if further sync is needed or possible, continuing until both sides are
  * synchronized.
  *
- * The **non-initiator always responds** to provide sync completion feedback,
- * even with empty messages containing only the header and no error. This allows
- * the initiator to detect when synchronization is complete.
+ * The **non-initiator answers every request it can decode** to provide sync
+ * completion feedback, even with empty messages containing only the header and
+ * no error. This allows the initiator to detect when synchronization is
+ * complete. A request it cannot decode, or one larger than the relay's
+ * `totalMaxSize`, gets no answer and has no effect.
+ *
+ * Ranges are compared by their {@link Fingerprint}, which anyone who can write
+ * for an owner can make collide. Its documentation describes the consequences.
  *
  * Both **Messages** and **Ranges** are optional, allowing each side to send,
  * sync, or only subscribe data as needed.
@@ -81,18 +96,35 @@
  *
  * ## Protocol errors
  *
- * The protocol uses error codes in the header to signal issues:
+ * A Response carries a {@link ProtocolErrorCode} in its header. The initiator
+ * reports every code except `NoError` as an error with the `OwnerId`:
  *
- * - {@link ProtocolWriteKeyError}: The provided WriteKey is invalid or missing.
- * - {@link ProtocolWriteError}: A serious relay-side write failure occurred.
+ * - {@link ProtocolWriteKeyError}: The WriteKey is invalid, or missing from a
+ *   request with messages.
+ * - {@link ProtocolWriteError}: The relay failed to store the messages or to
+ *   validate the WriteKey.
  * - {@link ProtocolQuotaError}: Storage or billing quota exceeded.
- * - {@link ProtocolSyncError}: A serious relay-side synchronization failure
- *   occurred.
- * - {@link ProtocolVersionError}: Protocol version mismatch.
- * - {@link ProtocolInvalidDataError}: The message is malformed or corrupted.
+ * - {@link ProtocolSyncError}: The relay's storage failed while it reconciled the
+ *   ranges.
+ *
+ * The initiator also reports {@link ProtocolVersionError}, with the `OwnerId`,
+ * for a reply of another version, and {@link ProtocolInvalidDataError}, without
+ * it, for a message it cannot decode, including one with an unknown code.
  *
- * All protocol errors except `ProtocolInvalidDataError` include the `OwnerId`
- * to allow clients to associate errors with the correct owner.
+ * A relay answers every request it can decode within its `totalMaxSize`. It
+ * decodes a whole request before acting on it, so for a malformed one it
+ * returns `ProtocolInvalidDataError` without subscribing, storing, or
+ * broadcasting anything, and sends no reply. When its storage throws while
+ * validating the WriteKey, for example because SQLite cannot store a new
+ * owner's key on a full disk, the relay logs the error and answers with
+ * `ProtocolWriteError`, like a failed write. Likewise, a client applies nothing
+ * from a message it cannot decode.
+ *
+ * {@link decryptAndDecodeDbChange} returns `ProtocolInvalidDataError`,
+ * {@link ProtocolTimestampMismatchError}, or
+ * {@link DecryptWithXChaCha20Poly1305Error} for a change it cannot read. These
+ * describe a change rather than a protocol message, and client storage skips
+ * such a change.
  *
  * ## Message size limit
  *
@@ -105,7 +137,10 @@
  *
  * Each mutation is limited to {@link maxMutationSize}, so every change fits one
  * message of {@link defaultProtocolMessageMaxSize} next to the largest ranges
- * section.
+ * section. Changes saved before that limit existed, and crafted changes a relay
+ * stores, can be larger. Sync skips a stored change that cannot fit an empty
+ * message after a pending Skip range, which is the message a later round is
+ * guaranteed to reach, and reports it as a {@link ProtocolChangeTooLargeError}.
  *
  * ## Why Binary?
  *
@@ -129,24 +164,18 @@
  *
  * ## Versioning
  *
- * Evolu Protocol uses explicit versioning to ensure compatibility between
- * clients and relays (or peers). Each protocol message begins with a version
- * number and an `ownerId` in its header.
- *
- * **How version negotiation works:**
- *
- * - The initiator (usually a client) sends a `ProtocolMessage` that includes its
- *   protocol version and the `ownerId`.
- * - The non-initiator (usually a relay or peer) checks the version.
+ * Every message of every protocol version begins with the version and the
+ * `OwnerId`, so a peer can route and report a message of any version. Nothing
+ * negotiates a version, and no side falls back to the other's.
  *
- *   - If the versions match, synchronization proceeds as normal.
- *   - If the versions do not match, the non-initiator responds with a message
- *       containing **its own protocol version and the same `ownerId`**.
- * - The initiator can then detect the version mismatch for that specific owner
- *   and handle it appropriately (e.g., prompt for an update or halt sync).
- *
- * Version negotiation is per-owner, allowing Evolu Protocol to evolve safely
- * over time and provide clear feedback about version mismatches.
+ * A non-initiator answers a request of another version with only its own
+ * version and that `OwnerId`. The initiator reports it as
+ * {@link ProtocolVersionError} for that owner, whose `isInitiator` tells which
+ * side is older, and stops syncing the owner through that relay. Clients from
+ * `@evolu/common` 8.0.0 before 8.11.0 drop that reply and stop syncing the
+ * owner through that relay without reporting anything, while 7.x clients report
+ * it as a `ProtocolVersionError`. So a relay that moves to another version must
+ * keep answering version 1 while such clients remain.
  *
  * ## Credible exit
  *
@@ -180,13 +209,7 @@ import {
   isNonEmptyArray,
   type NonEmptyReadonlyArray,
 } from "../Array.ts";
-import {
-  assert,
-  assertNonEmptyArray,
-  assertNonNullable,
-  assertNotUndefined,
-  assertSame,
-} from "../Assert.ts";
+import { assert, assertNonEmptyArray, assertNonNullable } from "../Assert.ts";
 import type { Brand } from "../Brand.ts";
 import {
   type Buffer,
@@ -214,12 +237,13 @@ import {
   type DecryptWithXChaCha20Poly1305Error,
   EncryptionKey,
   encryptWithXChaCha20Poly1305,
-  Entropy24,
+  type Entropy24,
   type RandomBytesDep,
-  XChaCha20Poly1305Ciphertext,
+  type XChaCha20Poly1305Ciphertext,
   xChaCha20Poly1305NonceLength,
 } from "../Crypto.ts";
 import { eqArrayNumber } from "../Eq.ts";
+import { exhaustiveCheck } from "../Function.ts";
 import { computeBalancedBuckets } from "../Number.ts";
 import { createMutableRecord, objectToEntries } from "../Object.ts";
 import { err, ok, type Result } from "../Result.ts";
@@ -232,7 +256,7 @@ import {
   base64UrlToUint8Array,
   between,
   DateIso,
-  FiniteNumber,
+  type FiniteNumber,
   Id,
   IdBytes,
   idBytesToId,
@@ -243,7 +267,7 @@ import {
   jsonToJsonValue,
   NonNegativeInt,
   onePositiveInt,
-  PositiveInt,
+  type PositiveInt,
   type Typed,
   uint8ArrayToBase64Url,
   zeroNonNegativeInt,
@@ -285,8 +309,9 @@ import {
   nodeIdBytesLength,
   nodeIdBytesToNodeId,
   nodeIdToNodeIdBytes,
+  orderTimestamp,
   Timestamp,
-  TimestampBytes,
+  type TimestampBytes,
   timestampBytesLength,
   timestampBytesToTimestamp,
   timestampToTimestampBytes,
@@ -294,22 +319,27 @@ import {
 
 const minProtocolMessageMaxSize = 1_000_000;
 const maxProtocolMessageMaxSize = 100_000_000;
+const maxProtocolMessageRangesMaxSize = 100_000;
 
 /**
- * Protocol message maximum size.
+ * Protocol message maximum size, from 1MB to 100MB.
  *
- * Defines the upper limit for how large a single protocol message can be.
- * Implementations must enforce a maximum size between 1MB and 100MB to ensure
- * compatibility across all Evolu implementations (the maximum size of mutation
- * change is hardcoded and enforced hence the maximum size can't be smaller).
+ * A message never exceeds its maximum size, inclusive. Builders measure each
+ * write exactly and keep room to close the message (see
+ * {@link ProtocolMessageBuffer.tryWrite}), and sync sends what does not fit in
+ * later rounds.
  *
- * Larger maximum sizes can be configured by relays to reduce roundtrips. For
- * example, a dedicated relay with ample resources could configure a 100MB
- * maximum to minimize roundtrips for large syncs.
+ * Clients send at most {@link defaultProtocolMessageMaxSize} and enforce no
+ * receive limit. A relay can answer with larger messages, configured with the
+ * `totalMaxSize` option of {@link applyProtocolMessageAsRelay}, to reduce
+ * roundtrips for large syncs. Clients must not send larger messages, because
+ * relays accept at most the default: the Node.js relay closes the connection on
+ * a larger one, and relays up to `@evolu/nodejs` 4.0.0 crash on it.
  *
- * Only relays can safely configure larger sizes, as clients will handle them.
- * Increasing this value on the client side would break compatibility with
- * relays that enforce smaller limits.
+ * The default cannot be smaller either. Deployed clients send messages of that
+ * size, a change within {@link maxMutationSize} fits one message next to the
+ * largest ranges section, and changes saved before that limit existed, which
+ * can be nearly as large as a message, must stay servable.
  */
 export const ProtocolMessageMaxSize = /*#__PURE__*/ between(
   minProtocolMessageMaxSize,
@@ -321,8 +351,9 @@ export type ProtocolMessageMaxSize = typeof ProtocolMessageMaxSize.Output;
 /**
  * Default {@link ProtocolMessageMaxSize} (1MB).
  *
- * The standard size used across Evolu implementations. Relays with more
- * resources can configure larger sizes to reduce roundtrips.
+ * The standard size used across Evolu implementations. Clients send at most
+ * this size, and relays accept it. Relays with more resources can answer with
+ * larger messages to reduce roundtrips.
  */
 export const defaultProtocolMessageMaxSize =
   minProtocolMessageMaxSize as ProtocolMessageMaxSize;
@@ -336,11 +367,12 @@ export const defaultProtocolMessageMaxSize =
  *
  * The upper bound is set to ensure ranges fit within the default 1MB
  * {@link defaultProtocolMessageMaxSize}, maintaining compatibility between all
- * clients and relays.
+ * clients and relays. A received message whose ranges section exceeds twice the
+ * upper bound is rejected as {@link ProtocolInvalidDataError}.
  */
 export const ProtocolMessageRangesMaxSize = /*#__PURE__*/ between(
   3_000,
-  100_000,
+  maxProtocolMessageRangesMaxSize,
 )(Int);
 export type ProtocolMessageRangesMaxSize =
   typeof ProtocolMessageRangesMaxSize.Output;
@@ -419,6 +451,14 @@ export const SubscriptionFlags = {
 export type SubscriptionFlag =
   (typeof SubscriptionFlags)[keyof typeof SubscriptionFlags];
 
+/**
+ * The error code in the header of a Response.
+ *
+ * A client reports a code it does not know as {@link ProtocolInvalidDataError},
+ * which carries no `OwnerId`, and that relay's round for the owner ends. Every
+ * released client does this, so a relay can add a code under the same
+ * {@link protocolVersion} only where that outcome is acceptable.
+ */
 export const ProtocolErrorCode = {
   NoError: 0,
   /** A code for {@link ProtocolWriteKeyError}. */
@@ -431,7 +471,7 @@ export const ProtocolErrorCode = {
   SyncError: 4,
 } as const;
 
-type ProtocolErrorCode =
+export type ProtocolErrorCode =
   (typeof ProtocolErrorCode)[keyof typeof ProtocolErrorCode];
 
 export type ProtocolError =
@@ -454,7 +494,16 @@ export interface ProtocolVersionError
   readonly isInitiator: boolean;
 }
 
-/** Error for invalid or corrupted protocol message data. */
+/**
+ * Error for a malformed {@link ProtocolMessage} or {@link EncryptedDbChange},
+ * with its bytes as `data` and the decoding error as `error`.
+ *
+ * A protocol message is decoded whole before any of it is applied, so a
+ * malformed one has no effect, and a relay does not reply to it. A message of a
+ * type its receiver does not accept, such as a Request sent to a client, is
+ * malformed too. A throw while applying a decoded message is a defect, not this
+ * error.
+ */
 export interface ProtocolInvalidDataError extends Typed<"ProtocolInvalidDataError"> {
   readonly data: Uint8Array;
   readonly error: unknown;
@@ -507,12 +556,40 @@ export interface ProtocolTimestampMismatchError extends Typed<"ProtocolTimestamp
   readonly timestamp: Timestamp;
 }
 
+/**
+ * Error for a stored change that sync skipped because it cannot fit an empty
+ * {@link ProtocolMessage} after a pending Skip range, which is the message a
+ * later round is guaranteed to reach.
+ *
+ * Every change within {@link maxMutationSize} fits. Larger ones are changes
+ * saved before that limit existed and crafted changes a relay stores. A change
+ * up to 22 bytes too large for that message can still fit one without a pending
+ * skip, so sync may send it, sometimes after reporting it, but usually reports
+ * it in every sync like a larger one. With
+ * {@link defaultProtocolMessageMaxSize}, PADMÉ padding leaves no honest change
+ * size in that 22-byte window.
+ *
+ * An answer to a Timestamps range neither sends nor lists a skipped change, so
+ * range fingerprints keep disagreeing about it. A request or a split still
+ * lists its timestamp, so a peer that lacks it may ask for it once per sync and
+ * gets an answer without it. Every sync narrows the fingerprints to it, skips
+ * it again, and ends.
+ */
+export interface ProtocolChangeTooLargeError extends Typed<"ProtocolChangeTooLargeError"> {
+  readonly timestamp: Timestamp;
+  /** The length of the encrypted change in bytes. */
+  readonly size: PositiveInt;
+}
+
 /**
  * Creates a {@link ProtocolMessage} from CRDT messages.
  *
- * If the message size would exceed {@link defaultProtocolMessageMaxSize}, the
- * protocol ensures all messages will be sent in the next round(s) even over
- * unidirectional and stateless transports.
+ * The message holds the leading CRDT messages that fit `maxSize`, by default
+ * {@link defaultProtocolMessageMaxSize}, measured exactly. When one does not
+ * fit, it and the rest are left out, and the message ends with a range that
+ * makes the non-initiator answer with ranges. Sync then sends them in later
+ * rounds, even over unidirectional and stateless transports, because every
+ * change within {@link maxMutationSize} fits an empty message.
  */
 export const createProtocolMessageFromCrdtMessages =
   (deps: RandomBytesDep) =>
@@ -527,50 +604,46 @@ export const createProtocolMessageFromCrdtMessages =
       writeKey: owner.writeKey,
     });
 
-    let notAllMessagesSent = false;
-
     for (const message of messages) {
       const change = encodeAndEncryptDbChange(deps)(
         message,
         owner.encryptionKey,
       );
       const encryptedCrdtMessage = { timestamp: message.timestamp, change };
-      if (buffer.canAddMessage(encryptedCrdtMessage)) {
-        buffer.addMessage(encryptedCrdtMessage);
-      } else {
-        notAllMessagesSent = true;
+      if (
+        !buffer.tryWrite(() => {
+          buffer.addMessage(encryptedCrdtMessage);
+        })
+      ) {
+        /**
+         * DEV: If not all messages fit due to size limits, we trigger a sync
+         * continuation by appending a Range with a random fingerprint. This
+         * ensures the receiver always responds with ranges, prompting another
+         * sync round.
+         *
+         * The ideal approach would be to send three ranges (skip, fingerprint,
+         * skip) where the fingerprint of unsent messages would act as narrow
+         * sync probe. I think we can send `zeroFingerprint` which can be
+         * interpreted as an indication that the other side should reply with
+         * {@link TimestampsRange}, so no need to restart syncing.
+         *
+         * For now, using a random fingerprint avoids extra complexity and is
+         * good enough for this case.
+         */
+        const randomFingerprint = deps.randomBytes.create(
+          fingerprintSize,
+        ) as unknown as Fingerprint;
+
+        // Every kept trial reserved space for this closing range.
+        buffer.addRange({
+          type: RangeType.Fingerprint,
+          upperBound: InfiniteUpperBound,
+          fingerprint: randomFingerprint,
+        });
         break;
       }
     }
 
-    if (notAllMessagesSent) {
-      /**
-       * DEV: If not all messages fit due to size limits, we trigger a sync
-       * continuation by appending a Range with a random fingerprint. This
-       * ensures the receiver always responds with ranges, prompting another
-       * sync round.
-       *
-       * The ideal approach would be to send three ranges (skip, fingerprint,
-       * skip) where the fingerprint of unsent messages would act as narrow sync
-       * probe. I think we can send `zeroFingerprint` which can be interpreted
-       * as an indication that the other side should reply with
-       * {@link TimestampsRange}, so no need to restart syncing.
-       *
-       * For now, using a random fingerprint avoids extra complexity and is good
-       * enough for this case.
-       */
-      const randomFingerprint = deps.randomBytes.create(
-        fingerprintSize,
-      ) as unknown as Fingerprint;
-
-      // There is always a space for Fingerprint with InfiniteUpperBound.
-      buffer.addRange({
-        type: RangeType.Fingerprint,
-        upperBound: InfiniteUpperBound,
-        fingerprint: randomFingerprint,
-      });
-    }
-
     return buffer.unwrap();
   };
 
@@ -631,20 +704,22 @@ export const createProtocolBroadcastMessagesFromCrdtMessages =
         change: encodeAndEncryptDbChange(deps)(message, owner.encryptionKey),
       };
 
-      if (!buffer.canAddMessage(encryptedMessage)) {
-        const nextBuffer = createProtocolMessageBuffer(owner.id, {
-          messageType: MessageType.Broadcast,
-          totalMaxSize: maxSize,
-        });
-        assert(
-          nextBuffer.canAddMessage(encryptedMessage),
-          "the message is too big",
-        );
-        broadcasts.push(buffer.unwrap());
-        buffer = nextBuffer;
+      const frame = buffer;
+      if (
+        frame.tryWrite(() => {
+          frame.addMessage(encryptedMessage);
+        })
+      ) {
+        continue;
       }
 
+      buffer = createProtocolMessageBuffer(owner.id, {
+        messageType: MessageType.Broadcast,
+        totalMaxSize: maxSize,
+      });
+      // Outside a trial, it asserts that the message fits an empty frame.
       buffer.addMessage(encryptedMessage);
+      broadcasts.push(frame.unwrap());
     }
 
     broadcasts.push(buffer.unwrap());
@@ -664,13 +739,13 @@ export const createProtocolMessageForSync =
 
     const size = deps.storage.getSize(ownerIdBytes);
 
-    splitRange(deps)(
+    const ranges = readSplitRanges(deps)(
       ownerIdBytes,
       zeroNonNegativeInt,
       size,
       InfiniteUpperBound,
-      buffer,
     );
+    for (const range of ranges) buffer.addRange(range);
 
     return buffer.unwrap();
   };
@@ -686,24 +761,43 @@ export const createProtocolMessageForUnsubscribe = (
 /**
  * Mutable builder for constructing {@link ProtocolMessage} respecting size
  * limits.
+ *
+ * A frame never exceeds `totalMaxSize`. Make ordinary writes inside `tryWrite`,
+ * which keeps them only if the frame can still be closed. A write outside a
+ * trial is a closing write: `addMessage` and `addRange` assert that the frame
+ * fits `totalMaxSize`.
+ *
+ * The builder references each change, which `unwrap` copies into the frame it
+ * returns, so a change must not be modified while the builder is in use.
+ * `unwrap` leaves the builder unchanged, so it can be called again.
  */
 export interface ProtocolMessageBuffer {
-  readonly canAddMessage: (message: EncryptedCrdtMessage) => boolean;
-
   readonly addMessage: (message: EncryptedCrdtMessage) => void;
 
-  readonly canSplitRange: () => boolean;
-
-  readonly canAddTimestampsRangeAndMessage: (
-    timestamps: TimestampsBuffer,
-    message: EncryptedCrdtMessage | null,
-  ) => boolean;
-
   readonly addRange: (
     range: SkipRange | FingerprintRange | TimestampsRangeWithTimestampsBuffer,
   ) => void;
 
+  /**
+   * Runs `write` and keeps what it wrote only if the frame can still be closed,
+   * returning whether it was kept.
+   *
+   * The frame can be closed when its exact size plus the bytes needed to append
+   * one Fingerprint range with {@link InfiniteUpperBound} plus `reserve` is at
+   * most `totalMaxSize`, and its ranges section plus the same bytes is at most
+   * `rangesMaxSize`. Nothing is needed to close a broadcast, which holds no
+   * ranges, or a frame whose last range has InfiniteUpperBound. Use `reserve`
+   * for bytes the caller adds later, such as a range it is still collecting.
+   *
+   * When the frame cannot be closed, or `write` throws, everything `write`
+   * wrote is undone, so the frame is as if `write` never ran. Inside `write`,
+   * `addMessage` and `addRange` do not assert the size limit.
+   */
+  readonly tryWrite: (write: () => void, reserve?: NonNegativeInt) => boolean;
+
   readonly unwrap: () => ProtocolMessage;
+
+  /** Returns the exact encoded size of the frame. */
   readonly getSize: () => PositiveInt;
 }
 
@@ -738,7 +832,7 @@ export const createProtocolMessageBuffer = (
     header: createBuffer(),
     messages: {
       timestamps: createTimestampsBuffer(),
-      dbChanges: createBuffer(),
+      dbChangeLengths: createBuffer(),
     },
     ranges: {
       timestamps: createTimestampsBuffer(),
@@ -764,86 +858,44 @@ export const createProtocolMessageBuffer = (
     buffers.header.extend([options.errorCode]);
   }
 
+  // Changes are referenced, not copied, so a trial undoes messages by
+  // shortening this array, and unwrap copies each change once.
+  const dbChanges: Array<EncryptedDbChange> = [];
+  let dbChangesLength = 0;
   let isLastRangeInfinite = false;
-
-  const isWithinSizeLimits = () => getSize() <= totalMaxSize;
-
-  const getSize = () =>
-    PositiveInt.orThrow(getHeaderAndMessagesSize() + getRangesSize());
-
-  const getHeaderAndMessagesSize = () =>
-    buffers.header.getLength() +
-    buffers.messages.timestamps.getLength() +
-    buffers.messages.dbChanges.getLength();
-
+  let isInTrial = false;
+
+  // Writes outside a trial assert this, so an overflow fails where it happens.
+  // A frame must never exceed totalMaxSize: relays at @evolu/nodejs 4.0.0 or
+  // older crash on a frame one byte larger than their 1,000,000-byte limit.
+  const isWithinSizeLimits = () => getFrameSize() <= totalMaxSize;
+
+  // Lengths after a header that is never empty.
+  const getFrameSize = () =>
+    (buffers.header.getLength() +
+      buffers.messages.timestamps.getLength() +
+      buffers.messages.dbChangeLengths.getLength() +
+      dbChangesLength +
+      getRangesSize()) as PositiveInt;
+
+  // Without ranges, the ranges section is omitted, including its count.
   const getRangesSize = () =>
     buffers.ranges.timestamps.getCount() > 0
       ? buffers.ranges.timestamps.getLength() +
         buffers.ranges.types.getLength() +
-        buffers.ranges.payloads.getLength() +
-        safeMargins.remainingRange
+        buffers.ranges.payloads.getLength()
       : 0;
 
-  /**
-   * We calculated worst-case sizes as closely as possible and added a small
-   * safety margin, since computing exact worst cases is difficult due to
-   * variable-length, run-length, and delta encoding.
-   *
-   * Runtime assertions (`assert`) are used to guarantee that size limits are
-   * never exceeded. If a limit is exceeded, the assertion will fail at the
-   * precise location, making it easy to identify and fix the issue.
-   *
-   * While it would be possible to avoid the safety margin by snapshotting
-   * buffer states and rolling back changes, this would likely impact
-   * performance. If someone has time and wants to experiment with this
-   * approach, contributions are welcome.
-   */
-  const safeMargins = {
-    // bytes: range type + possible increased count varint
-    remainingRange: fingerprintSize + 10,
-    // bytes: max millis + max count + NodeId
-    timestamp: 30,
-    // bytes: maximum encoded DbChange length varint
-    dbChangeLength: 8,
-    // bytes: worst case is around 650 bytes
-    splitRange: 800,
-    // bytes: range type + its upperBound + possible increased count varint
-    timestampsRange: 50,
-  };
-
-  const addMessageSafeMargin =
-    safeMargins.timestamp +
-    safeMargins.dbChangeLength +
-    safeMargins.remainingRange;
-
+  // A trial makes the write, measures the exact frame, and undoes the write in
+  // constant time when the frame no longer fits, so it needs no worst-case
+  // margins and costs about as much as the write itself.
   return {
-    canAddMessage: (message) =>
-      getSize() + addMessageSafeMargin + message.change.length <= totalMaxSize,
-
     addMessage: (message) => {
       buffers.messages.timestamps.add(message.timestamp);
-      encodeLength(buffers.messages.dbChanges, message.change);
-      buffers.messages.dbChanges.extend(message.change);
-      assert(isWithinSizeLimits(), "the message is too big");
-    },
-
-    canSplitRange: () =>
-      getRangesSize() + safeMargins.splitRange <= rangesMaxSize,
-
-    canAddTimestampsRangeAndMessage: (timestamps, message) => {
-      const rangesNewSize =
-        getRangesSize() + timestamps.getLength() + safeMargins.timestampsRange;
-
-      return (
-        rangesNewSize <= rangesMaxSize &&
-        (message
-          ? getHeaderAndMessagesSize() +
-              rangesNewSize +
-              addMessageSafeMargin +
-              message.change.length <=
-            totalMaxSize
-          : true)
-      );
+      encodeLength(buffers.messages.dbChangeLengths, message.change);
+      dbChanges.push(message.change);
+      dbChangesLength += message.change.length;
+      assert(isInTrial || isWithinSizeLimits(), "the message is too big");
     },
 
     addRange: (range) => {
@@ -871,10 +923,7 @@ export const createProtocolMessageBuffer = (
         buffers.ranges.timestamps.addInfinite();
       }
 
-      encodeNonNegativeInt(
-        buffers.ranges.types,
-        NonNegativeInt.orThrow(range.type),
-      );
+      encodeNonNegativeInt(buffers.ranges.types, range.type as NonNegativeInt);
 
       switch (range.type) {
         case RangeType.Skip:
@@ -888,7 +937,57 @@ export const createProtocolMessageBuffer = (
         }
       }
 
-      assert(isWithinSizeLimits(), `the range ${range.type} is too big`);
+      assert(
+        isInTrial || isWithinSizeLimits(),
+        `the range ${range.type} is too big`,
+      );
+    },
+
+    tryWrite: (write, reserve = zeroNonNegativeInt) => {
+      const restoreMessageTimestamps = buffers.messages.timestamps.checkpoint();
+      const dbChangeLengthsLength =
+        buffers.messages.dbChangeLengths.getLength();
+      const dbChangesCount = dbChanges.length;
+      const checkpointDbChangesLength = dbChangesLength;
+      const restoreRangeTimestamps = buffers.ranges.timestamps.checkpoint();
+      const typesLength = buffers.ranges.types.getLength();
+      const payloadsLength = buffers.ranges.payloads.getLength();
+      const wasLastRangeInfinite = isLastRangeInfinite;
+      const wasInTrial = isInTrial;
+
+      let isKept = false;
+      isInTrial = true;
+      try {
+        write();
+        // Fingerprint(InfiniteUpperBound) encodes no upper bound, only its
+        // type (1 byte) and fingerprint (12 bytes). The ranges count varint
+        // gains a byte when the new count is a power of 128. That includes
+        // 128^0 = 1, since the first range adds the count itself. So closing
+        // takes 13 or 14 bytes, and nothing for a Broadcast or a closed frame.
+        let newCount = buffers.ranges.timestamps.getCount() + 1;
+        while (newCount % 128 === 0) newCount /= 128;
+        const closingReserve =
+          options.messageType === MessageType.Broadcast || isLastRangeInfinite
+            ? 0
+            : 1 + fingerprintSize + (newCount === 1 ? 1 : 0);
+        const reserves = closingReserve + reserve;
+        isKept =
+          getFrameSize() + reserves <= totalMaxSize &&
+          getRangesSize() + reserves <= rangesMaxSize;
+      } finally {
+        isInTrial = wasInTrial;
+        if (!isKept) {
+          restoreMessageTimestamps();
+          buffers.messages.dbChangeLengths.truncate(dbChangeLengthsLength);
+          dbChanges.length = dbChangesCount;
+          dbChangesLength = checkpointDbChangesLength;
+          restoreRangeTimestamps();
+          buffers.ranges.types.truncate(typesLength);
+          buffers.ranges.payloads.truncate(payloadsLength);
+          isLastRangeInfinite = wasLastRangeInfinite;
+        }
+      }
+      return isKept;
     },
 
     unwrap: () => {
@@ -899,19 +998,44 @@ export const createProtocolMessageBuffer = (
         );
       }
 
-      buffers.messages.timestamps.append(buffers.header);
-      buffers.header.extend(buffers.messages.dbChanges.unwrap());
+      const frame = new Uint8Array(getFrameSize());
+      frame.set(buffers.header.unwrap());
+      let offset: number = buffers.header.getLength();
+
+      // Written to a new buffer, so the builder is unchanged and unwrap can be
+      // called again.
+      const messageTimestamps = createBuffer();
+      buffers.messages.timestamps.append(messageTimestamps);
+      frame.set(messageTimestamps.unwrap(), offset);
+      offset += messageTimestamps.getLength();
+
+      // Each change follows its length, whose last varint byte is below 128.
+      const lengths = buffers.messages.dbChangeLengths.unwrap();
+      let lengthsOffset = 0;
+      for (const change of dbChanges) {
+        do {
+          frame[offset++] = lengths[lengthsOffset];
+        } while (lengths[lengthsOffset++] >= 128);
+        frame.set(change, offset);
+        offset += change.length;
+      }
 
       if (buffers.ranges.timestamps.getCount() > 0) {
-        buffers.ranges.timestamps.append(buffers.header);
-        buffers.header.extend(buffers.ranges.types.unwrap());
-        buffers.header.extend(buffers.ranges.payloads.unwrap());
+        const ranges = createBuffer();
+        buffers.ranges.timestamps.append(ranges);
+        ranges.extend(buffers.ranges.types.unwrap());
+        ranges.extend(buffers.ranges.payloads.unwrap());
+        frame.set(ranges.unwrap(), offset);
+        offset += ranges.getLength();
       }
 
-      return buffers.header.unwrap() as ProtocolMessage;
+      // An overcounted size would end the frame with zero bytes peers accept.
+      assert(offset === frame.length, "the frame size is exact");
+
+      return frame as ProtocolMessage;
     },
 
-    getSize,
+    getSize: getFrameSize,
   };
 };
 
@@ -926,6 +1050,15 @@ export interface TimestampsBuffer {
   readonly getCount: () => NonNegativeInt;
   readonly getLength: () => number;
   readonly append: (buffer: Buffer) => void;
+
+  /**
+   * Returns a function that restores the buffer, in constant time, to the state
+   * it had when this was called, discarding every timestamp added since.
+   *
+   * A restore function can be called repeatedly. It is valid until the buffer
+   * is restored to an earlier checkpoint.
+   */
+  readonly checkpoint: () => () => void;
 }
 
 export const createTimestampsBuffer = (): TimestampsBuffer => {
@@ -983,16 +1116,41 @@ export const createTimestampsBuffer = (): TimestampsBuffer => {
       buffer.extend(counterEncoder.unwrap());
       buffer.extend(nodeIdEncoder.unwrap());
     },
+
+    checkpoint: () => {
+      const checkpointCount = count;
+      const millisLength = millisBuffer.getLength();
+      const checkpointPreviousMillis = previousMillis;
+      const restoreCounters = counterEncoder.checkpoint();
+      const restoreNodeIds = nodeIdEncoder.checkpoint();
+
+      return () => {
+        count = checkpointCount;
+        syncCount();
+        millisBuffer.truncate(millisLength);
+        previousMillis = checkpointPreviousMillis;
+        restoreCounters();
+        restoreNodeIds();
+      };
+    },
   };
 };
 
 export interface ApplyProtocolMessageAsClientOptions {
-  writeKey?: OwnerWriteKey;
+  readonly writeKey?: OwnerWriteKey;
 
-  rangesMaxSize?: ProtocolMessageRangesMaxSize;
+  readonly rangesMaxSize?: ProtocolMessageRangesMaxSize;
+
+  /**
+   * Called for each stored change that sync skipped as a
+   * {@link ProtocolChangeTooLargeError}. Without it, the error is logged with
+   * `console.warn`. It must not throw, because a throw is a defect that aborts
+   * the Run.
+   */
+  readonly onChangeTooLarge?: (error: ProtocolChangeTooLargeError) => void;
 
   /** For tests only. */
-  version?: NonNegativeInt;
+  readonly version?: NonNegativeInt;
 }
 
 /**
@@ -1027,11 +1185,11 @@ export interface ApplyProtocolMessageAsClientReadonly extends Typed<"Readonly">
  * Result of {@link applyProtocolMessageAsClient}: the protocol logged an
  * exception thrown by calling the storage's `writeMessages` (`Write`) or a
  * failed range reconciliation (`Sync`) to the console. An exception while the
- * returned Task runs, as the built-in storages throw, is a defect that aborts
- * the Run instead. Expected write rejections return the original
- * {@link StorageWriteMessagesError} through {@link Result}. Reconciliation can
- * fail after messages have been committed; that failure does not roll back the
- * write.
+ * returned Task runs is a defect that aborts the Run instead. A rejected or
+ * failed write, which the built-in storages return when SQLite fails it, gives
+ * the original {@link StorageWriteMessagesError} through {@link Result}.
+ * Reconciliation can fail after messages have been committed; that failure does
+ * not roll back the write.
  */
 export interface ApplyProtocolMessageAsClientFailed extends Typed<"Failed"> {
   readonly cause: "Write" | "Sync";
@@ -1055,149 +1213,157 @@ export const applyProtocolMessageAsClient =
   > =>
   async (run) => {
     const { storage } = run.deps;
-    try {
-      const input = createBuffer(inputMessage);
-      const [requestedVersion, ownerId] = decodeVersionAndOwner(input);
-      const version = options.version ?? protocolVersion;
-
-      if (requestedVersion !== version) {
-        return err<ProtocolVersionError>({
-          type: "ProtocolVersionError",
-          version: requestedVersion,
-          isInitiator: version < requestedVersion,
-          ownerId,
-        });
-      }
+    const version = options.version ?? protocolVersion;
+    const decoded = decodeProtocolMessage(inputMessage, version);
+    if (!decoded.ok) return decoded;
+    const message = decoded.value;
+
+    if (message.type === "OtherVersion") {
+      return err<ProtocolVersionError>({
+        type: "ProtocolVersionError",
+        version: message.version,
+        isInitiator: version < message.version,
+        ownerId: message.ownerId,
+      });
+    }
 
-      const messageType = input.shift() as MessageType;
-      assert(
-        messageType === MessageType.Response ||
-          messageType === MessageType.Broadcast,
-        "Invalid MessageType",
-      );
+    if (message.type === "Request") {
+      return err<ProtocolInvalidDataError>({
+        type: "ProtocolInvalidDataError",
+        data: inputMessage,
+        error: new ProtocolDecodeError("Expected a Response or a Broadcast"),
+      });
+    }
 
-      if (messageType === MessageType.Response) {
-        const errorCode = input.shift();
-        if (errorCode !== ProtocolErrorCode.NoError) {
-          switch (errorCode) {
-            case ProtocolErrorCode.WriteKeyError:
-              return err<ProtocolWriteKeyError>({
-                type: "ProtocolWriteKeyError",
-                ownerId,
-              });
-            case ProtocolErrorCode.WriteError:
-              return err<ProtocolWriteError>({
-                type: "ProtocolWriteError",
-                ownerId,
-              });
-            case ProtocolErrorCode.QuotaError:
-              return err<ProtocolQuotaError>({
-                type: "ProtocolQuotaError",
-                ownerId,
-              });
-            case ProtocolErrorCode.SyncError:
-              return err<ProtocolSyncError>({
-                type: "ProtocolSyncError",
-                ownerId,
-              });
-            default:
-              throw new ProtocolDecodeError(
-                `Invalid ProtocolErrorCode: ${errorCode}`,
-              );
-          }
-        }
+    const { ownerId } = message;
+
+    if (message.type === "ErrorResponse") {
+      switch (message.errorCode) {
+        case ProtocolErrorCode.WriteKeyError:
+          return err<ProtocolWriteKeyError>({
+            type: "ProtocolWriteKeyError",
+            ownerId,
+          });
+        case ProtocolErrorCode.WriteError:
+          return err<ProtocolWriteError>({
+            type: "ProtocolWriteError",
+            ownerId,
+          });
+        case ProtocolErrorCode.QuotaError:
+          return err<ProtocolQuotaError>({
+            type: "ProtocolQuotaError",
+            ownerId,
+          });
+        case ProtocolErrorCode.SyncError:
+          return err<ProtocolSyncError>({
+            type: "ProtocolSyncError",
+            ownerId,
+          });
       }
+    }
 
-      const messages = decodeMessages(input);
-      const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
+    const { messages } = message;
+    const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
 
-      if (isNonEmptyArray(messages)) {
-        try {
-          const result = await run(
-            storage.writeMessages(ownerIdBytes, messages),
-          );
-          if (!result.ok) return result;
-        } catch (error) {
-          if (AbortError.is(error)) throw error;
-          run.deps.console.error(error);
-          return ok({ type: "Failed", cause: "Write" });
-        }
+    if (isNonEmptyArray(messages)) {
+      try {
+        const result = await run(storage.writeMessages(ownerIdBytes, messages));
+        if (!result.ok) return result;
+      } catch (error) {
+        if (AbortError.is(error)) throw error;
+        run.deps.console.error(error);
+        return ok({ type: "Failed", cause: "Write" });
       }
+    }
 
-      if (messageType === MessageType.Broadcast) {
-        return ok({ type: "Broadcast" });
-      }
+    if (message.type === "Broadcast") {
+      return ok({ type: "Broadcast" });
+    }
 
-      // Now: No writeKey, no sync.
-      // TODO: Allow to sync SharedReadonlyOwner
-      // Without local changes, writeKey will not be required.
-      // With local changes, writeKey will be required and if not provided,
-      // the sync will stop.
-      const writeKey = options.writeKey;
-      if (writeKey == null) {
-        return ok({ type: "Readonly" });
-      }
+    // Now: No writeKey, no sync.
+    // TODO: Allow to sync SharedReadonlyOwner
+    // Without local changes, writeKey will not be required.
+    // With local changes, writeKey will be required and if not provided,
+    // the sync will stop.
+    const writeKey = options.writeKey;
+    if (writeKey == null) {
+      return ok({ type: "Readonly" });
+    }
 
-      const ranges = decodeRanges(input);
+    const { ranges } = message;
 
-      if (!isNonEmptyArray(ranges)) {
-        return ok({ type: "Converged" });
-      }
+    if (!isNonEmptyArray(ranges)) {
+      return ok({ type: "Converged" });
+    }
 
-      const output = createProtocolMessageBuffer(ownerId, {
+    const createOutput = () =>
+      createProtocolMessageBuffer(ownerId, {
         messageType: MessageType.Request,
         writeKey,
         rangesMaxSize: options.rangesMaxSize,
       });
+    const output = createOutput();
 
-      let broadcast: ProtocolMessageBuffer | undefined;
-      const result = sync(run.deps)(ranges, output, ownerIdBytes, (message) => {
+    let broadcast: ProtocolMessageBuffer | undefined;
+    const result = sync(run.deps)(ranges, output, ownerIdBytes, {
+      createEmptyOutput: createOutput,
+      onChangeTooLarge: options.onChangeTooLarge ?? run.deps.console.warn,
+      onMessage: (message) => {
         broadcast ??= createProtocolMessageBuffer(ownerId, {
           messageType: MessageType.Broadcast,
         });
+        // The request holds the same messages after a larger header.
         broadcast.addMessage(message);
-      });
+      },
+    });
 
-      // A failure was logged by sync.
-      if (!result.ok) return ok({ type: "Failed", cause: "Sync" });
-      if (!result.value) return ok({ type: "Converged" });
+    // A failure was logged by sync.
+    if (!result.ok) return ok({ type: "Failed", cause: "Sync" });
+    if (!result.value) return ok({ type: "Converged" });
 
-      return ok({
-        type: "Response",
-        message: output.unwrap(),
-        ...(broadcast && { broadcast: broadcast.unwrap() }),
-      });
-    } catch (error) {
-      if (AbortError.is(error)) throw error;
-      return err<ProtocolInvalidDataError>({
-        type: "ProtocolInvalidDataError",
-        data: inputMessage,
-        error,
-      });
-    }
+    return ok({
+      type: "Response",
+      message: output.unwrap(),
+      ...(broadcast && { broadcast: broadcast.unwrap() }),
+    });
   };
 
+/**
+ * Options for {@link applyProtocolMessageAsRelay}. The callbacks must not throw,
+ * because a throw is a defect that aborts the Run.
+ */
 export interface ApplyProtocolMessageAsRelayOptions {
   /** To subscribe an owner for broadcasting. */
-  subscribe?: (ownerId: OwnerId) => void;
+  readonly subscribe?: (ownerId: OwnerId) => void;
 
   /** To unsubscribe an owner from broadcasting. */
-  unsubscribe?: (ownerId: OwnerId) => void;
+  readonly unsubscribe?: (ownerId: OwnerId) => void;
 
   /** To broadcast a protocol message to all subscribers. */
-  broadcast?: (ownerId: OwnerId, message: ProtocolMessage) => void;
+  readonly broadcast?: (ownerId: OwnerId, message: ProtocolMessage) => void;
 
-  totalMaxSize?: ProtocolMessageMaxSize;
-  rangesMaxSize?: ProtocolMessageRangesMaxSize;
+  /**
+   * The maximum size of the relay's responses and broadcasts, and of the
+   * requests it accepts. A larger request is a
+   * {@link ProtocolInvalidDataError}.
+   */
+  readonly totalMaxSize?: ProtocolMessageMaxSize;
+
+  readonly rangesMaxSize?: ProtocolMessageRangesMaxSize;
 }
 
 /**
  * Result type for {@link applyProtocolMessageAsRelay}.
  *
- * Unlike {@link ApplyProtocolMessageAsClientResult}, relays always respond with
- * a message to provide sync completion feedback. This ensures the initiator can
- * reliably detect when synchronization is complete, even when there's nothing
- * to sync. Clients may choose not to respond in certain cases (like when they
+ * Unlike {@link ApplyProtocolMessageAsClientResult}, a relay answers every
+ * request it can decode within its `totalMaxSize` to provide sync completion
+ * feedback. This ensures the initiator can reliably detect when synchronization
+ * is complete, even when there's nothing to sync. A storage that throws while
+ * validating the write key is answered with a `WriteError` code, like a failed
+ * write. For a larger request or one it cannot decode,
+ * {@link applyProtocolMessageAsRelay} returns {@link ProtocolInvalidDataError}
+ * before subscribing, storing, or broadcasting anything, and the relay sends
+ * nothing. Clients may choose not to respond in certain cases (like when they
  * receive broadcast messages or when they lack a write key for syncing).
  */
 export interface ApplyProtocolMessageAsRelayResult extends Typed<"Response"> {
@@ -1217,165 +1383,313 @@ export const applyProtocolMessageAsRelay =
   > =>
   async (run) => {
     const { storage } = run.deps;
-    try {
-      const input = createBuffer(inputMessage);
-      const [requestedVersion, ownerId] = decodeVersionAndOwner(input);
-      const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
-
-      if (requestedVersion !== version) {
-        // Non-initiator responds with its version and ownerId.
-        const output = createBuffer();
-        encodeNonNegativeInt(output, version);
-        output.extend(ownerIdBytes);
-        return ok({
-          type: "Response",
-          message: output.unwrap() as ProtocolMessage,
-        });
-      }
 
-      const messageType = input.shift() as MessageType;
-      assertSame(messageType, MessageType.Request);
+    // The relay broadcasts a request's messages in a frame of totalMaxSize.
+    // That frame omits the request's write key, subscription flag, and ranges,
+    // so it holds the messages of any request up to that size.
+    if (
+      inputMessage.length >
+      (options.totalMaxSize ?? defaultProtocolMessageMaxSize)
+    )
+      return err<ProtocolInvalidDataError>({
+        type: "ProtocolInvalidDataError",
+        data: inputMessage,
+        error: new ProtocolDecodeError("Request is too large"),
+      });
 
-      const hasWriteKey = input.shift();
-      let writeKey: OwnerWriteKey | undefined;
+    const decoded = decodeProtocolMessage(inputMessage, version);
+    if (!decoded.ok) return decoded;
+    const request = decoded.value;
 
-      if (hasWriteKey === 1) {
-        writeKey = input.shiftN(ownerWriteKeyLength) as OwnerWriteKey;
-      }
+    if (request.type === "OtherVersion") {
+      // Non-initiator responds with its version and ownerId.
+      const output = createBuffer();
+      encodeNonNegativeInt(output, version);
+      output.extend(ownerIdToOwnerIdBytes(request.ownerId));
+      return ok({
+        type: "Response",
+        message: output.unwrap() as ProtocolMessage,
+      });
+    }
 
-      const subscriptionFlag = input.shift() as SubscriptionFlag;
+    if (request.type !== "Request") {
+      return err<ProtocolInvalidDataError>({
+        type: "ProtocolInvalidDataError",
+        data: inputMessage,
+        error: new ProtocolDecodeError("Expected a Request"),
+      });
+    }
 
-      switch (subscriptionFlag) {
-        case SubscriptionFlags.Subscribe:
-          options.subscribe?.(ownerId);
-          break;
-        case SubscriptionFlags.Unsubscribe:
-          options.unsubscribe?.(ownerId);
-          break;
-        case SubscriptionFlags.None:
-          break;
-      }
+    const { ownerId, writeKey, messages, ranges } = request;
+    const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
 
-      if (writeKey) {
-        const isValid = storage.validateWriteKey(ownerIdBytes, writeKey);
-        if (!isValid) {
-          return ok({
-            type: "Response",
-            message: createProtocolMessageBuffer(ownerId, {
-              messageType: MessageType.Response,
-              errorCode: ProtocolErrorCode.WriteKeyError,
-            }).unwrap(),
-          });
-        }
-      }
+    const createErrorResponse = (
+      errorCode: ProtocolErrorCode,
+    ): ApplyProtocolMessageAsRelayResult => ({
+      type: "Response",
+      message: createProtocolMessageBuffer(ownerId, {
+        messageType: MessageType.Response,
+        errorCode,
+      }).unwrap(),
+    });
 
-      const messages = decodeMessages(input);
+    switch (request.subscriptionFlag) {
+      case SubscriptionFlags.Subscribe:
+        options.subscribe?.(ownerId);
+        break;
+      case SubscriptionFlags.Unsubscribe:
+        options.unsubscribe?.(ownerId);
+        break;
+      case SubscriptionFlags.None:
+        break;
+      default:
+        exhaustiveCheck(request.subscriptionFlag);
+    }
 
-      if (isNonEmptyArray(messages)) {
-        if (!writeKey) {
-          return ok({
-            type: "Response",
-            message: createProtocolMessageBuffer(ownerId, {
-              messageType: MessageType.Response,
-              errorCode: ProtocolErrorCode.WriteKeyError,
-            }).unwrap(),
-          });
-        }
+    if (writeKey) {
+      let isValid: boolean;
+      try {
+        isValid = storage.validateWriteKey(ownerIdBytes, writeKey);
+      } catch (error) {
+        // A relay storage stores the write key of a new owner, which SQLite
+        // can fail, for example on a full disk. A boolean has no room for the
+        // error, so it is answered like a failed write.
+        run.deps.console.error(error);
+        return ok(createErrorResponse(ProtocolErrorCode.WriteError));
+      }
+      if (!isValid) {
+        return ok(createErrorResponse(ProtocolErrorCode.WriteKeyError));
+      }
+    }
 
-        try {
-          const result = await run(
-            storage.writeMessages(ownerIdBytes, messages),
-          );
+    if (isNonEmptyArray(messages)) {
+      if (!writeKey) {
+        return ok(createErrorResponse(ProtocolErrorCode.WriteKeyError));
+      }
 
-          if (!result.ok) {
-            const message = createProtocolMessageBuffer(ownerId, {
-              messageType: MessageType.Response,
-              errorCode: ProtocolErrorCode.QuotaError,
-            }).unwrap();
-            return ok({ type: "Response", message });
-          }
-        } catch (error) {
-          if (AbortError.is(error)) throw error;
-          run.deps.console.error(error);
-          const message = createProtocolMessageBuffer(ownerId, {
-            messageType: MessageType.Response,
-            errorCode: ProtocolErrorCode.WriteError,
-          }).unwrap();
-          return ok({ type: "Response", message });
+      try {
+        const result = await run(storage.writeMessages(ownerIdBytes, messages));
+
+        if (!result.ok) {
+          // A storage returns a failed write without reporting it.
+          if (result.error.type === "UnknownError")
+            run.deps.console.error(result.error);
+          return ok(
+            createErrorResponse(
+              result.error.type === "StorageQuotaError"
+                ? ProtocolErrorCode.QuotaError
+                : ProtocolErrorCode.WriteError,
+            ),
+          );
         }
+      } catch (error) {
+        if (AbortError.is(error)) throw error;
+        run.deps.console.error(error);
+        return ok(createErrorResponse(ProtocolErrorCode.WriteError));
+      }
 
-        /**
-         * Broadcast messages to all subscribed owners for real-time
-         * synchronization between clients.
-         *
-         * Messages are only broadcasted after successful write to ensure
-         * devices that can still sync aren't affected by quota errors, and to
-         * prevent using a half-working relay service (broadcasting without
-         * persistence).
-         *
-         * When a relay's database is deleted or clients migrate to a new relay
-         * (without data migration), clients will sync their data to the relay,
-         * and the relay will broadcast those messages to other connected
-         * clients. Those clients may receive messages they already have, but
-         * this is safe because Evolu sync is idempotent. As the relay becomes
-         * more synchronized with clients over time, fewer duplicate messages
-         * will be broadcasted.
-         */
-        if (options.broadcast) {
-          const broadcastBuffer = createProtocolMessageBuffer(ownerId, {
-            messageType: MessageType.Broadcast,
-            totalMaxSize: options.totalMaxSize,
-            rangesMaxSize: options.rangesMaxSize,
-            version,
-          });
-          for (const message of messages) {
-            broadcastBuffer.addMessage(message);
-          }
-          options.broadcast(ownerId, broadcastBuffer.unwrap());
+      /**
+       * Broadcast messages to all subscribed owners for real-time
+       * synchronization between clients.
+       *
+       * Messages are only broadcasted after successful write to ensure devices
+       * that can still sync aren't affected by quota errors, and to prevent
+       * using a half-working relay service (broadcasting without persistence).
+       *
+       * When a relay's database is deleted or clients migrate to a new relay
+       * (without data migration), clients will sync their data to the relay,
+       * and the relay will broadcast those messages to other connected clients.
+       * Those clients may receive messages they already have, but this is safe
+       * because Evolu sync is idempotent. As the relay becomes more
+       * synchronized with clients over time, fewer duplicate messages will be
+       * broadcasted.
+       */
+      if (options.broadcast) {
+        const broadcastBuffer = createProtocolMessageBuffer(ownerId, {
+          messageType: MessageType.Broadcast,
+          totalMaxSize: options.totalMaxSize,
+          rangesMaxSize: options.rangesMaxSize,
+          version,
+        });
+        for (const message of messages) {
+          broadcastBuffer.addMessage(message);
         }
+        options.broadcast(ownerId, broadcastBuffer.unwrap());
       }
+    }
 
-      const ranges = decodeRanges(input);
-
-      const output = createProtocolMessageBuffer(ownerId, {
+    const createOutput = () =>
+      createProtocolMessageBuffer(ownerId, {
         messageType: MessageType.Response,
         errorCode: ProtocolErrorCode.NoError,
         totalMaxSize: options.totalMaxSize,
         rangesMaxSize: options.rangesMaxSize,
       });
+    const output = createOutput();
 
-      // Non-initiators always respond to provide sync completion feedback,
-      // even when there's nothing to sync.
-      if (!isNonEmptyArray(ranges)) {
-        return ok({ type: "Response", message: output.unwrap() });
-      }
+    // A relay answers every request it decodes, even with nothing to sync, so
+    // the initiator knows the sync is complete.
+    if (!isNonEmptyArray(ranges)) {
+      return ok({ type: "Response", message: output.unwrap() });
+    }
+
+    const result = sync(run.deps)(ranges, output, ownerIdBytes, {
+      createEmptyOutput: createOutput,
+      onChangeTooLarge: run.deps.console.warn,
+    });
 
-      const result = sync(run.deps)(ranges, output, ownerIdBytes);
+    // A relay answers every request it decodes, a failed reconciliation with
+    // its error code.
+    return ok(
+      result.ok
+        ? { type: "Response", message: output.unwrap() }
+        : createErrorResponse(result.error),
+    );
+  };
 
-      const message = result.ok
-        ? output.unwrap()
-        : createProtocolMessageBuffer(ownerId, {
-            messageType: MessageType.Response,
-            errorCode: result.error,
-          }).unwrap();
+/**
+ * Decodes a whole {@link ProtocolMessage}, so a malformed one is rejected before
+ * anything it carries is applied.
+ *
+ * Applying a message turns only a throw from here into
+ * {@link ProtocolInvalidDataError}. A throw after decoding is a defect.
+ */
+const decodeProtocolMessage = (
+  inputMessage: Uint8Array,
+  version: NonNegativeInt,
+): Result<DecodedProtocolMessage, ProtocolInvalidDataError> => {
+  try {
+    const input = createBuffer(inputMessage);
+    const [messageVersion, ownerId] = decodeVersionAndOwner(input);
+
+    if (messageVersion !== version)
+      return ok({ type: "OtherVersion", version: messageVersion, ownerId });
+
+    switch (decodeMessageType(input)) {
+      case MessageType.Request: {
+        const hasWriteKey = input.shift();
+        if (hasWriteKey > 1)
+          throw new ProtocolDecodeError(`Invalid hasWriteKey: ${hasWriteKey}`);
+        const writeKey =
+          hasWriteKey === 1
+            ? (input.shiftN(ownerWriteKeyLength) as OwnerWriteKey)
+            : null;
+
+        const subscriptionFlag: number = input.shift();
+        switch (subscriptionFlag) {
+          case SubscriptionFlags.None:
+          case SubscriptionFlags.Subscribe:
+          case SubscriptionFlags.Unsubscribe:
+            break;
+          default:
+            throw new ProtocolDecodeError(
+              `Invalid SubscriptionFlag: ${subscriptionFlag}`,
+            );
+        }
 
-      // Non-initiators always respond to provide sync completion feedback,
-      return ok({ type: "Response", message });
-    } catch (error) {
-      if (AbortError.is(error)) throw error;
-      return err<ProtocolInvalidDataError>({
-        type: "ProtocolInvalidDataError",
-        data: inputMessage,
-        error,
-      });
+        const messages = decodeMessages(input);
+
+        // Only a relay accepts a Request, so only the relay checks this.
+        // Deployed relays already store shorter changes, and a client skips a
+        // change it cannot read, whereas a check in decodeMessages would make
+        // it reject every response holding one.
+        for (const { change } of messages)
+          if (change.length < minEncryptedDbChangeLength)
+            throw new ProtocolDecodeError("EncryptedDbChange is too short");
+
+        const ranges = decodeRanges(input);
+
+        return ok({
+          type: "Request",
+          ownerId,
+          writeKey,
+          subscriptionFlag,
+          messages,
+          ranges,
+        });
+      }
+
+      case MessageType.Response: {
+        const errorCode: number = input.shift();
+        switch (errorCode) {
+          case ProtocolErrorCode.NoError: {
+            const messages = decodeMessages(input);
+            const ranges = decodeRanges(input);
+            return ok({ type: "Response", ownerId, messages, ranges });
+          }
+          case ProtocolErrorCode.WriteKeyError:
+          case ProtocolErrorCode.WriteError:
+          case ProtocolErrorCode.QuotaError:
+          case ProtocolErrorCode.SyncError:
+            return ok({ type: "ErrorResponse", ownerId, errorCode });
+          default:
+            throw new ProtocolDecodeError(
+              `Invalid ProtocolErrorCode: ${errorCode}`,
+            );
+        }
+      }
+
+      case MessageType.Broadcast:
+        return ok({
+          type: "Broadcast",
+          ownerId,
+          messages: decodeMessages(input),
+        });
     }
-  };
+  } catch (error) {
+    return err<ProtocolInvalidDataError>({
+      type: "ProtocolInvalidDataError",
+      data: inputMessage,
+      error,
+    });
+  }
+};
+
+type DecodedProtocolMessage =
+  | DecodedOtherVersionMessage
+  | DecodedRequest
+  | DecodedErrorResponse
+  | DecodedResponse
+  | DecodedBroadcast;
+
+/** A message of another version, whose layout after the owner is unknown. */
+interface DecodedOtherVersionMessage extends Typed<"OtherVersion"> {
+  readonly version: NonNegativeInt;
+  readonly ownerId: OwnerId;
+}
+
+interface DecodedRequest extends Typed<"Request"> {
+  readonly ownerId: OwnerId;
+  readonly writeKey: OwnerWriteKey | null;
+  readonly subscriptionFlag: SubscriptionFlag;
+  readonly messages: ReadonlyArray<EncryptedCrdtMessage>;
+  readonly ranges: ReadonlyArray<Range>;
+}
+
+/** A Response with an error code, after which nothing is decoded. */
+interface DecodedErrorResponse extends Typed<"ErrorResponse"> {
+  readonly ownerId: OwnerId;
+  readonly errorCode: Exclude<
+    ProtocolErrorCode,
+    typeof ProtocolErrorCode.NoError
+  >;
+}
+
+interface DecodedResponse extends Typed<"Response"> {
+  readonly ownerId: OwnerId;
+  readonly messages: ReadonlyArray<EncryptedCrdtMessage>;
+  readonly ranges: ReadonlyArray<Range>;
+}
+
+interface DecodedBroadcast extends Typed<"Broadcast"> {
+  readonly ownerId: OwnerId;
+  readonly messages: ReadonlyArray<EncryptedCrdtMessage>;
+}
 
 const decodeVersionAndOwner = (input: Buffer): [NonNegativeInt, OwnerId] => {
   // This structure must never change across protocol versions. The version
   // and owner ID must always be the first two fields in every protocol message
-  // to enable version negotiation and owner identification before any other
-  // processing occurs.
+  // to route and report a version mismatch before any other processing occurs.
   const version = decodeNonNegativeInt(input);
   const ownerId = decodeId(input) as OwnerId;
   return [version, ownerId];
@@ -1388,24 +1702,20 @@ const parseProtocolHeaderFromBuffer = (input: Buffer): ProtocolHeader => {
     return { type: "ProtocolHeader", version, ownerId };
   }
 
-  const messageTypeValue = input.shift();
-  let messageType: MessageType;
+  const messageType = decodeMessageType(input);
+  return { type: "ProtocolHeader", version, ownerId, messageType };
+};
 
-  switch (messageTypeValue) {
+const decodeMessageType = (input: Buffer): MessageType => {
+  const messageType: number = input.shift();
+  switch (messageType) {
     case MessageType.Request:
-      messageType = MessageType.Request;
-      break;
     case MessageType.Response:
-      messageType = MessageType.Response;
-      break;
     case MessageType.Broadcast:
-      messageType = MessageType.Broadcast;
-      break;
+      return messageType;
     default:
       throw new ProtocolDecodeError("Invalid MessageType");
   }
-
-  return { type: "ProtocolHeader", version, ownerId, messageType };
 };
 
 /**
@@ -1416,8 +1726,6 @@ class ProtocolDecodeError extends Error {
   constructor(message: string) {
     super(message);
     this.name = this.constructor.name;
-
-    Error.captureStackTrace(this, this.constructor);
   }
 }
 
@@ -1437,13 +1745,56 @@ const decodeMessages = (
   return messages;
 };
 
+// The smallest envelope encodeAndEncryptDbChange can produce: the nonce, a
+// 1-byte ciphertext length, and the 16-byte Poly1305 tag. Every v1 client sends
+// at least 77 bytes. The relay quota counts change bytes, so a relay storing
+// shorter changes, zero-length ones above all, would store rows the quota does
+// not count.
+const minEncryptedDbChangeLength = xChaCha20Poly1305NonceLength + 1 + 16;
+
+/**
+ * Answers the ranges into `output`, returning whether it has anything to send.
+ *
+ * Every write except a closing one is a trial (see
+ * {@link ProtocolMessageBuffer.tryWrite}), so the frame always has room to close
+ * with one Fingerprint range with {@link InfiniteUpperBound}. When a write does
+ * not fit, that range closes the frame. Its fingerprint covers everything from
+ * the last upper bound the frame states, which every v1 peer assumes, and the
+ * peer reconciles it in the next round.
+ *
+ * A stored change that cannot fit an empty frame with this header, with only
+ * its own timestamp listed after a pending skip, is skipped, and
+ * `onChangeTooLarge` reports it as a {@link ProtocolChangeTooLargeError}. A
+ * later round is guaranteed to reach exactly that frame, so a change that fits
+ * it is sent eventually.
+ *
+ * An answer to a Timestamps range neither sends nor lists a skipped change, but
+ * a request or a split lists its timestamp, so a peer that lacks it may ask for
+ * it once per sync and gets an answer without it. Fingerprints keep disagreeing
+ * about it, so every sync narrows them to it, skips it again, and ends.
+ *
+ * A throw from storage, or from a split's checks of what storage returned, is
+ * logged and returns `SyncError`, except an AbortError from a split's reads,
+ * which is rethrown. Any other throw, such as from writing the frame,
+ * `onChangeTooLarge`, or `onMessage`, is a defect.
+ */
 const sync =
   (deps: StorageDep & ConsoleDep) =>
   (
     ranges: NonEmptyReadonlyArray<Range>,
     output: ProtocolMessageBuffer,
     ownerIdBytes: OwnerIdBytes,
-    onMessage?: (message: EncryptedCrdtMessage) => void,
+    {
+      createEmptyOutput,
+      onChangeTooLarge,
+      onMessage,
+    }: {
+      /** Creates an empty frame with the header of `output`. */
+      createEmptyOutput: () => ProtocolMessageBuffer;
+      onChangeTooLarge: (error: ProtocolChangeTooLargeError) => void;
+      /** Called with each message `output` keeps. */
+      onMessage?: (message: EncryptedCrdtMessage) => void;
+    },
   ): Result<boolean, typeof ProtocolErrorCode.SyncError> => {
     const outputInitialSize = output.getSize();
     let storageSize: NonNegativeInt;
@@ -1456,7 +1807,11 @@ const sync =
 
     let prevUpperBound: RangeUpperBound | null = null;
     let prevIndex = zeroNonNegativeInt;
+    // The index of the last upper bound the frame states, 0 before any.
+    let statedIndex = zeroNonNegativeInt;
 
+    // Consecutive skipped ranges become one Skip range, written only before
+    // the next non-skip range.
     let skip = false;
     let nonSkipRangeAdded = false;
 
@@ -1465,6 +1820,9 @@ const sync =
     ) => {
       // The last range, if any non skip was added, must have InfiniteUpperBound.
       if (nonSkipRangeAdded && range.upperBound === InfiniteUpperBound) {
+        // A closing write. Like the closing Fingerprint range, it encodes no
+        // upper bound, and its type takes 1 byte of the 13 that every kept
+        // trial reserved beyond the ranges count.
         output.addRange({
           type: RangeType.Skip,
           upperBound: InfiniteUpperBound,
@@ -1474,42 +1832,60 @@ const sync =
       }
     };
 
-    const coalesceSkipsBeforeAdd = () => {
-      // Set to true because we are going to add a non skip range.
-      nonSkipRangeAdded = true;
-      if (skip) {
+    /**
+     * Tries to write a non-skip range ending at the index `upper` after the
+     * pending skip, if any.
+     */
+    const tryWriteRange = (
+      upper: NonNegativeInt,
+      write: () => void,
+    ): boolean => {
+      const isKept = output.tryWrite(() => {
+        if (skip) {
+          assertNonNullable(prevUpperBound, "prevUpperBound is null");
+          output.addRange({
+            type: RangeType.Skip,
+            upperBound: prevUpperBound,
+          });
+        }
+        write();
+      });
+      if (isKept) {
         skip = false;
-        assertNonNullable(prevUpperBound, "prevUpperBound is null");
-        // There is always a space for a skip range before adding.
-        output.addRange({
-          type: RangeType.Skip,
-          upperBound: prevUpperBound,
-        });
+        nonSkipRangeAdded = true;
+        statedIndex = upper;
       }
+      return isKept;
     };
 
-    // When we don't have a space...
-    const addFingerprintForRemainingRange = (
-      begin: NonNegativeInt,
-    ): boolean => {
+    /**
+     * Closes the frame with a Fingerprint range with InfiniteUpperBound over
+     * the items from the last upper bound the frame states. A frame that cannot
+     * fit a range closes without writing the pending Skip range, because only
+     * this range has room reserved, so it covers the skipped items too.
+     */
+    const closeWithFingerprint = (): Result<
+      true,
+      typeof ProtocolErrorCode.SyncError
+    > => {
       let fingerprint: Fingerprint;
       try {
         fingerprint = deps.storage.fingerprint(
           ownerIdBytes,
-          begin,
+          statedIndex,
           storageSize,
         );
       } catch (error) {
         deps.console.error(error);
-        return false;
+        return err(ProtocolErrorCode.SyncError);
       }
-      // There is always a space for a ramaining range.
+      // A closing write. Every kept trial reserved room for it.
       output.addRange({
         type: RangeType.Fingerprint,
         upperBound: InfiniteUpperBound,
         fingerprint,
       });
-      return true;
+      return ok(true);
     };
 
     for (const range of ranges) {
@@ -1550,26 +1926,28 @@ const sync =
 
           if (eqArrayNumber(range.fingerprint, ourFingerprint)) {
             skipRange(range);
-          } else if (output.canSplitRange()) {
-            coalesceSkipsBeforeAdd();
-            try {
-              splitRange(deps)(
-                ownerIdBytes,
-                lower,
-                upper,
-                currentUpperBound,
-                output,
-              );
-            } catch (error) {
-              if (AbortError.is(error)) throw error;
-              deps.console.error(error);
-              return err(ProtocolErrorCode.SyncError);
-            }
-          } else {
-            return addFingerprintForRemainingRange(upper)
-              ? ok(true)
-              : err(ProtocolErrorCode.SyncError);
+            break;
+          }
+
+          let splitRanges: ReadonlyArray<
+            FingerprintRange | TimestampsRangeWithTimestampsBuffer
+          >;
+          try {
+            splitRanges = readSplitRanges(deps)(
+              ownerIdBytes,
+              lower,
+              upper,
+              currentUpperBound,
+            );
+          } catch (error) {
+            if (AbortError.is(error)) throw error;
+            deps.console.error(error);
+            return err(ProtocolErrorCode.SyncError);
           }
+          const isSplit = tryWriteRange(upper, () => {
+            for (const splitRange of splitRanges) output.addRange(splitRange);
+          });
+          if (!isSplit) return closeWithFingerprint();
           break;
         }
 
@@ -1583,6 +1961,12 @@ const sync =
 
           let exceeded = false as boolean;
           let iterateFailed = false as boolean;
+          // A pending skip stays pending until the range is written.
+          const isSkipPending = skip;
+          // Only a throw from the storage itself is a storage failure. A throw
+          // from the callback, such as from onChangeTooLarge or onMessage, is
+          // a defect, rethrown after iterating.
+          let callbackError = null as { readonly error: unknown } | null;
 
           try {
             deps.storage.iterate(
@@ -1590,78 +1974,116 @@ const sync =
               lower,
               upper,
               (timestamp, index) => {
-                const timestampString = timestamp.join();
-                const timestampBinary = timestampBytesToTimestamp(timestamp);
-
-                let message: EncryptedCrdtMessage | null = null;
-
-                if (timestampsWeNeed.has(timestampString)) {
-                  timestampsWeNeed.delete(timestampString);
-                } else {
-                  try {
-                    message = {
-                      timestamp: timestampBinary,
-                      change: deps.storage.readDbChange(
-                        ownerIdBytes,
-                        timestamp,
-                      ),
-                    };
-                  } catch (error) {
-                    deps.console.error(error);
-                    iterateFailed = true;
-                    return false;
+                try {
+                  const timestampString = timestamp.join();
+                  const timestampBinary = timestampBytesToTimestamp(timestamp);
+
+                  let message: EncryptedCrdtMessage | null = null;
+
+                  if (timestampsWeNeed.has(timestampString)) {
+                    timestampsWeNeed.delete(timestampString);
+                  } else {
+                    try {
+                      message = {
+                        timestamp: timestampBinary,
+                        change: deps.storage.readDbChange(
+                          ownerIdBytes,
+                          timestamp,
+                        ),
+                      };
+                    } catch (error) {
+                      deps.console.error(error);
+                      iterateFailed = true;
+                      return false;
+                    }
+                  }
+
+                  // One trial per timestamp: its entry in ourTimestamps and its
+                  // message if the peer lacks it, keeping room to write
+                  // ourTimestamps as a range after the pending skip.
+                  const restoreOurTimestamps = ourTimestamps.checkpoint();
+                  ourTimestamps.add(timestampBinary);
+                  if (
+                    output.tryWrite(
+                      () => {
+                        if (message) output.addMessage(message);
+                      },
+                      getTimestampsRangeReserve(ourTimestamps, isSkipPending),
+                    )
+                  ) {
+                    if (message) onMessage?.(message);
+                    return true;
+                  }
+                  restoreOurTimestamps();
+
+                  if (message) {
+                    // Whether an empty frame can hold the message in the trial
+                    // a Timestamps range makes for it, with only its own
+                    // timestamp listed and a skip pending. A later round is
+                    // guaranteed to reach exactly that frame, so a message that
+                    // fits is sent eventually. A trial without a pending skip
+                    // reserves 22 bytes less, so a message up to 22 bytes too
+                    // large for this check may still be sent in such a frame.
+                    const emptyOutput = createEmptyOutput();
+                    const emptyOutputTimestamps = createTimestampsBuffer();
+                    emptyOutputTimestamps.add(message.timestamp);
+                    const fitsEmptyOutput = emptyOutput.tryWrite(
+                      () => {
+                        emptyOutput.addMessage(message);
+                      },
+                      getTimestampsRangeReserve(emptyOutputTimestamps, true),
+                    );
+                    if (!fitsEmptyOutput) {
+                      onChangeTooLarge({
+                        type: "ProtocolChangeTooLargeError",
+                        timestamp: timestampBinary,
+                        size: message.change.length as PositiveInt,
+                      });
+                      return true;
+                    }
                   }
-                }
 
-                if (
-                  !output.canAddTimestampsRangeAndMessage(
-                    ourTimestamps,
-                    message,
-                  )
-                ) {
                   exceeded = true;
                   endBound = timestamp;
                   upper = index;
                   return false;
+                } catch (error) {
+                  callbackError = { error };
+                  return false;
                 }
-
-                ourTimestamps.add(timestampBinary);
-                if (message) {
-                  output.addMessage(message);
-                  onMessage?.(message);
-                }
-                return true;
               },
             );
           } catch (error) {
             deps.console.error(error);
-            return err(ProtocolErrorCode.SyncError);
+            iterateFailed = true;
           }
 
+          if (callbackError) throw callbackError.error;
+
           if (iterateFailed) {
             return err(ProtocolErrorCode.SyncError);
           }
 
-          const addRange = () => {
-            coalesceSkipsBeforeAdd();
-            output.addRange({
-              type: RangeType.Timestamps,
-              upperBound: endBound,
-              timestamps: ourTimestamps,
+          // When any timestamp was kept, its trial reserved room for this
+          // write. Otherwise the range may not fit, and the frame closes
+          // without it.
+          const tryWriteTimestampsRange = () =>
+            tryWriteRange(upper, () => {
+              output.addRange({
+                type: RangeType.Timestamps,
+                upperBound: endBound,
+                timestamps: ourTimestamps,
+              });
             });
-          };
 
           if (exceeded) {
-            addRange();
-            if (!addFingerprintForRemainingRange(upper)) {
-              return err(ProtocolErrorCode.SyncError);
-            }
-            return ok(true);
+            tryWriteTimestampsRange();
+            return closeWithFingerprint();
           }
 
           // If we need something, we have to respond with our timestamps.
           if (timestampsWeNeed.size > 0) {
-            addRange();
+            if (!tryWriteTimestampsRange()) return closeWithFingerprint();
           } else {
             skipRange(range);
           }
@@ -1680,15 +2102,42 @@ const sync =
     return ok(hasChange);
   };
 
-const splitRange =
+// The most a range adds to a frame beyond its payload. Its upper bound adds at
+// most 20 bytes to the ranges' timestamps: a millis delta varint of up to 7
+// bytes, as maxMillis has 48 bits; up to 4 for the counter, as a new run is a
+// varint of up to 3 bytes, Counter being at most 65,535, and a 1-byte run
+// length, while extending a run adds at most 1 byte; and up to 9 for the
+// NodeId, as a new run is 8 bytes and a 1-byte run length. Its type takes 1
+// byte, and the ranges count gains at most 1 byte.
+const maxRangeOverhead = 22;
+
+/**
+ * Returns the bytes a frame must keep to write `timestamps` as a Timestamps
+ * range, after a Skip range when one is pending. A Skip range has no payload,
+ * and the length of `timestamps` is exact.
+ */
+const getTimestampsRangeReserve = (
+  timestamps: TimestampsBuffer,
+  isSkipPending: boolean,
+): NonNegativeInt =>
+  (timestamps.getLength() +
+    maxRangeOverhead +
+    (isSkipPending ? maxRangeOverhead : 0)) as NonNegativeInt;
+
+/**
+ * Reads the ranges that split the items from `lower` to `upper`: one Timestamps
+ * range listing them when they are too few for buckets, otherwise Fingerprint
+ * ranges over the buckets. It only reads storage, so a throw is a storage
+ * failure.
+ */
+const readSplitRanges =
   (deps: StorageDep) =>
   (
     ownerId: OwnerIdBytes,
     lower: NonNegativeInt,
     upper: NonNegativeInt,
     upperBound: RangeUpperBound,
-    buffer: ProtocolMessageBuffer,
-  ): void => {
+  ): ReadonlyArray<FingerprintRange | TimestampsRangeWithTimestampsBuffer> => {
     const itemCount = NonNegativeInt.orThrow(upper - lower);
     const buckets = computeBalancedBuckets(itemCount);
 
@@ -1704,18 +2153,14 @@ const splitRange =
         return true;
       });
 
-      buffer.addRange(range);
-      return;
+      return [range];
     }
 
     // Check Storage.ts `fingerprint` and `fingerprintRanges` docs.
     const fingerprintRangesBuckets =
       lower === 0
         ? buckets.value
-        : [
-            lower,
-            ...buckets.value.map((b) => NonNegativeInt.orThrow(b + lower)),
-          ];
+        : [lower, ...buckets.value.map((b) => (b + lower) as NonNegativeInt)];
 
     const fingerprintRanges = deps.storage.fingerprintRanges(
       ownerId,
@@ -1723,23 +2168,45 @@ const splitRange =
       upperBound,
     );
 
-    const rangesToUse =
-      lower > 0 ? fingerprintRanges.slice(1) : fingerprintRanges;
-
-    for (const range of rangesToUse) {
-      buffer.addRange(range);
-    }
+    return lower > 0 ? fingerprintRanges.slice(1) : fingerprintRanges;
   };
 
+// Twice the largest rangesMaxSize rather than the receiver's own, because
+// deployed senders exceed theirs. Up to @evolu/common 8.17, sync answered each
+// Timestamps range that listed timestamps it lacked, while it held none in that
+// range, with an empty Timestamps range, without checking the size. Such an
+// echo reuses the peer's bounds with a 1-byte payload, so the echoes take less
+// than the peer's ranges that list timestamps, which the peer's size checks
+// kept within its rangesMaxSize. An empty list asks for nothing, so an echo is
+// never echoed again.
+const maxRangesSectionSize = 2 * maxProtocolMessageRangesMaxSize;
+
 const decodeRanges = (buffer: Buffer): ReadonlyArray<Range> => {
+  // The ranges section ends the frame, so it is checked before any allocation.
+  if (buffer.getLength() > maxRangesSectionSize)
+    throw new ProtocolDecodeError(
+      `Ranges section exceeds ${maxRangesSectionSize} bytes`,
+    );
+
   if (buffer.getLength() === 0) return [];
 
   const rangesCount = decodeNonNegativeInt(buffer);
   if (rangesCount === 0) return [];
 
-  const timestampsCount = NonNegativeInt.orThrow(rangesCount - 1);
+  const timestampsCount = (rangesCount - 1) as NonNegativeInt;
   const timestamps = decodeTimestamps(buffer, timestampsCount);
 
+  // Storage resolves each bound from the owner's first timestamp, so a lower
+  // bound would move back over ranges already answered. Equal bounds are
+  // valid: sync ends a range at the change that did not fit, which can be
+  // where the previous range ended. Timestamps listed in a range are not
+  // checked, because peers before @evolu/common 8.11 list some outside it.
+  for (let i = 1; i < timestamps.length; i++)
+    if (orderTimestamp(timestamps[i - 1], timestamps[i]) > 0)
+      throw new ProtocolDecodeError(
+        "Range upper bounds must be non-decreasing",
+      );
+
   const rangeTypes = createMutableArray<RangeType>(rangesCount);
 
   for (let i = 0; i < rangesCount; i++) {
@@ -1802,6 +2269,9 @@ const decodeTimestamps = (
   length?: NonNegativeInt,
 ): ReadonlyArray<Timestamp> => {
   length ??= decodeNonNegativeInt(buffer);
+  // Every timestamp takes at least its 1-byte millis delta.
+  if (length > buffer.getLength())
+    throw new ProtocolDecodeError("Invalid timestamps count");
 
   let previousMillis = 0 as Millis;
 
@@ -1841,13 +2311,28 @@ const decodeId = (buffer: Buffer): Id => {
   return idBytesToId(bytes as IdBytes);
 };
 
+/**
+ * The format version that starts every {@link EncryptedDbChange} plaintext.
+ *
+ * It is independent of {@link protocolVersion}, so a new protocol version that
+ * keeps this layout does not make decoders reject changes. 6.0.1-preview.35
+ * wrote 0 with this layout, so decoding accepts every version up to this one.
+ *
+ * Decoders in `@evolu/common` 8.17 and earlier ignore the version. A future
+ * layout must still make them fail, for example with a value they cannot
+ * decode, rather than let them decode wrong values.
+ */
+const encryptedDbChangeVersion = onePositiveInt;
+
 /**
  * Encodes and encrypts a {@link DbChange} using the provided owner's encryption
  * key. Returns an encrypted binary representation as {@link EncryptedDbChange}.
  *
- * The format includes the protocol version for backward compatibility and the
- * timestamp for tamper-proof verification that the timestamp matches the change
- * data.
+ * The plaintext starts with the format version of the change, which is
+ * independent of {@link protocolVersion}, and the timestamp, which proves that
+ * the change belongs to the timestamp it is sent with.
+ * {@link decryptAndDecodeDbChange} rejects a newer format version and accepts
+ * older ones.
  */
 export const encodeAndEncryptDbChange =
   (deps: RandomBytesDep) =>
@@ -1881,7 +2366,7 @@ export const encodeAndEncryptDbChange =
  * within it fits one protocol message.
  */
 export const encodeDbChange = (buffer: Buffer, message: CrdtMessage): void => {
-  encodeNonNegativeInt(buffer, protocolVersion);
+  encodeNonNegativeInt(buffer, encryptedDbChangeVersion);
 
   // Encode the timestamp to prevent tampering (e.g., a malicious relay
   // assigning this EncryptedDbChange to a different EncryptedCrdtMessage)
@@ -1901,9 +2386,10 @@ export const encodeDbChange = (buffer: Buffer, message: CrdtMessage): void => {
 
   encodeLength(buffer, entries);
   for (const [column, value] of entries) {
-    assertNotUndefined(value);
     encodeString(buffer, column);
-    encodeSqliteValue(buffer, value);
+    // DbChange validated every value as a SqliteValue; only its Partial record
+    // type admits undefined.
+    encodeSqliteValue(buffer, value as SqliteValue);
   }
 };
 
@@ -1911,6 +2397,9 @@ export const encodeDbChange = (buffer: Buffer, message: CrdtMessage): void => {
  * Decrypts and decodes an {@link EncryptedCrdtMessage} using the provided
  * owner's encryption key. Verifies that the embedded timestamp matches the
  * expected timestamp to ensure message integrity.
+ *
+ * A change with a newer format version than {@link encodeAndEncryptDbChange}
+ * writes is a {@link ProtocolInvalidDataError}.
  */
 export const decryptAndDecodeDbChange = (
   message: EncryptedCrdtMessage,
@@ -1928,8 +2417,8 @@ export const decryptAndDecodeDbChange = (
     const ciphertext = buffer.shiftN(decodeLength(buffer));
 
     const plaintextBytes = decryptWithXChaCha20Poly1305(
-      XChaCha20Poly1305Ciphertext.orThrow(ciphertext),
-      Entropy24.orThrow(nonce),
+      ciphertext as XChaCha20Poly1305Ciphertext,
+      nonce as Entropy24,
       key,
     );
     if (!plaintextBytes.ok) return plaintextBytes;
@@ -1937,11 +2426,11 @@ export const decryptAndDecodeDbChange = (
     buffer.reset();
     buffer.extend(plaintextBytes.value);
 
-    // Decode version (for future compatibility, not need yet)
-    decodeNonNegativeInt(buffer);
+    if (decodeNonNegativeInt(buffer) > encryptedDbChangeVersion)
+      throw new ProtocolDecodeError("Unsupported EncryptedDbChange version");
 
     const timestamp = timestampBytesToTimestamp(
-      TimestampBytes.orThrow(buffer.shiftN(timestampBytesLength)),
+      buffer.shiftN(timestampBytesLength) as TimestampBytes,
     );
 
     if (!eqTimestamp(timestamp, message.timestamp)) {
@@ -1952,7 +2441,7 @@ export const decryptAndDecodeDbChange = (
       });
     }
 
-    const flags = decodeFlags(buffer, PositiveInt.orThrow(3));
+    const flags = decodeFlags(buffer, 3 as PositiveInt);
     const table = decodeString(buffer);
     const id = decodeId(buffer);
 
@@ -1983,30 +2472,6 @@ export const decryptAndDecodeDbChange = (
   }
 };
 
-/**
- * Decodes a ProtocolMessage into a readable JSON object for debugging.
- *
- * Note: This is a stub for future implementation. It should use:
- *
- * - DecodeVersionAndOwner
- * - DecodeError or decodeWriteKeys (depending on context)
- * - DecodeMessages
- * - DecodeRanges
- *
- * If you want to help, please contribute to this function.
- */
-export const decodeProtocolMessageToJson = (
-  _protocolMessage: ProtocolMessage,
-  _isInitiator: boolean,
-): unknown => {
-  // TODO: Implement using
-  // - decodeVersionAndOwner
-  // -- decodeError or decodeWriteKeys (should be refactored out),
-  // -- decodeMessages, and decodeRanges.
-  // This is a stub for PRs and community contributions.
-  throw new Error("decodeProtocolMessageToJson is not implemented yet.");
-};
-
 // Small ints are encoded into ProtocolValueType, saving one byte per int.
 export const ProtocolValueType = {
   // 0-19 small ints
@@ -2067,7 +2532,7 @@ export const encodeSqliteValue = (buffer: Buffer, value: SqliteValue): void => {
             buffer,
             ProtocolValueType.DateIsoWithNegativeTime,
           );
-          encodeNumber(buffer, FiniteNumber.orThrow(time));
+          encodeNumber(buffer, time as FiniteNumber);
         }
         return;
       }
@@ -2082,7 +2547,7 @@ export const encodeSqliteValue = (buffer: Buffer, value: SqliteValue): void => {
       const json = Json.from.parent(value);
       if (json.ok) {
         const jsonValue = jsonToJsonValue(json.value);
-        jsonBuffer.reset();
+        const jsonBuffer = createBuffer();
         try {
           // Encoding first rejects nesting deeper than decoding allows, before
           // the recursive JSON.stringify below could overflow the stack. Such
@@ -2101,8 +2566,6 @@ export const encodeSqliteValue = (buffer: Buffer, value: SqliteValue): void => {
           }
         } catch (error) {
           if (!(error instanceof BufferError)) throw error;
-        } finally {
-          jsonBuffer.reset();
         }
       }
 
@@ -2115,6 +2578,10 @@ export const encodeSqliteValue = (buffer: Buffer, value: SqliteValue): void => {
         return;
       }
 
+      // encodeString replaces a lone surrogate with U+FFFD, so the bytes are
+      // always valid UTF-8. Encoding WTF-8 instead would make peers disagree:
+      // deployed decoders read a lone surrogate in WTF-8 as three U+FFFD,
+      // while a decoder that kept it would read the surrogate.
       encodeNonNegativeInt(buffer, ProtocolValueType.String);
       encodeString(buffer, value);
       return;
@@ -2206,7 +2673,5 @@ export const decodeSqliteValue = (buffer: Buffer): SqliteValue => {
   }
 };
 
-const jsonBuffer = createBuffer();
-
 const isSmallInt: Predicate<number> = (value: number) =>
   value >= 0 && value < 20;