@evolu/common 8.17.0 → 8.19.0

package/dist/src/local-first/Protocol.js

@@ -43,14 +43,24 @@
  * | - {@link NonNegativeInt}       | Number of ranges.         |
  * | - {@link Range}                |                           |
  *
+ * Range upper bounds must not decrease. The last range always has
+ * {@link InfiniteUpperBound}, which is not encoded. A message with decreasing
+ * bounds, or with a hasWriteKey or subscriptionFlag value not listed above, is
+ * rejected as {@link ProtocolInvalidDataError}. So is a request with a change
+ * shorter than 41 bytes, the smallest {@link EncryptedDbChange}. A client passes
+ * such a change to storage, which skips a change it cannot read.
+ *
  * ## WriteKey validation
  *
  * The initiator sends a hasWriteKey flag and optionally a WriteKey. The
  * WriteKey is required when sending messages as a secure token proving the
  * initiator can write changes. It's ok to not send a WriteKey if the initiator
  * is only syncing (read-only) and not sending messages. The non-initiator
- * validates the WriteKey immediately after parsing the initiator header, before
- * processing any messages or ranges.
+ * decodes the whole request first and then validates the WriteKey, before
+ * storing any messages or reconciling ranges. Only the subscriptionFlag takes
+ * effect before that, because subscribing needs no WriteKey: broadcasts carry
+ * only encrypted changes. So a request rejected with
+ * {@link ProtocolWriteKeyError} still changes its subscription.
  *
  * ## Synchronization
  *
@@ -64,9 +74,14 @@
  * if further sync is needed or possible, continuing until both sides are
  * synchronized.
  *
- * The **non-initiator always responds** to provide sync completion feedback,
- * even with empty messages containing only the header and no error. This allows
- * the initiator to detect when synchronization is complete.
+ * The **non-initiator answers every request it can decode** to provide sync
+ * completion feedback, even with empty messages containing only the header and
+ * no error. This allows the initiator to detect when synchronization is
+ * complete. A request it cannot decode, or one larger than the relay's
+ * `totalMaxSize`, gets no answer and has no effect.
+ *
+ * Ranges are compared by their {@link Fingerprint}, which anyone who can write
+ * for an owner can make collide. Its documentation describes the consequences.
  *
  * Both **Messages** and **Ranges** are optional, allowing each side to send,
  * sync, or only subscribe data as needed.
@@ -81,18 +96,35 @@
  *
  * ## Protocol errors
  *
- * The protocol uses error codes in the header to signal issues:
+ * A Response carries a {@link ProtocolErrorCode} in its header. The initiator
+ * reports every code except `NoError` as an error with the `OwnerId`:
  *
- * - {@link ProtocolWriteKeyError}: The provided WriteKey is invalid or missing.
- * - {@link ProtocolWriteError}: A serious relay-side write failure occurred.
+ * - {@link ProtocolWriteKeyError}: The WriteKey is invalid, or missing from a
+ *   request with messages.
+ * - {@link ProtocolWriteError}: The relay failed to store the messages or to
+ *   validate the WriteKey.
  * - {@link ProtocolQuotaError}: Storage or billing quota exceeded.
- * - {@link ProtocolSyncError}: A serious relay-side synchronization failure
- *   occurred.
- * - {@link ProtocolVersionError}: Protocol version mismatch.
- * - {@link ProtocolInvalidDataError}: The message is malformed or corrupted.
+ * - {@link ProtocolSyncError}: The relay's storage failed while it reconciled the
+ *   ranges.
+ *
+ * The initiator also reports {@link ProtocolVersionError}, with the `OwnerId`,
+ * for a reply of another version, and {@link ProtocolInvalidDataError}, without
+ * it, for a message it cannot decode, including one with an unknown code.
+ *
+ * A relay answers every request it can decode within its `totalMaxSize`. It
+ * decodes a whole request before acting on it, so for a malformed one it
+ * returns `ProtocolInvalidDataError` without subscribing, storing, or
+ * broadcasting anything, and sends no reply. When its storage throws while
+ * validating the WriteKey, for example because SQLite cannot store a new
+ * owner's key on a full disk, the relay logs the error and answers with
+ * `ProtocolWriteError`, like a failed write. Likewise, a client applies nothing
+ * from a message it cannot decode.
  *
- * All protocol errors except `ProtocolInvalidDataError` include the `OwnerId`
- * to allow clients to associate errors with the correct owner.
+ * {@link decryptAndDecodeDbChange} returns `ProtocolInvalidDataError`,
+ * {@link ProtocolTimestampMismatchError}, or
+ * {@link DecryptWithXChaCha20Poly1305Error} for a change it cannot read. These
+ * describe a change rather than a protocol message, and client storage skips
+ * such a change.
  *
  * ## Message size limit
  *
@@ -105,7 +137,10 @@
  *
  * Each mutation is limited to {@link maxMutationSize}, so every change fits one
  * message of {@link defaultProtocolMessageMaxSize} next to the largest ranges
- * section.
+ * section. Changes saved before that limit existed, and crafted changes a relay
+ * stores, can be larger. Sync skips a stored change that cannot fit an empty
+ * message after a pending Skip range, which is the message a later round is
+ * guaranteed to reach, and reports it as a {@link ProtocolChangeTooLargeError}.
  *
  * ## Why Binary?
  *
@@ -129,24 +164,18 @@
  *
  * ## Versioning
  *
- * Evolu Protocol uses explicit versioning to ensure compatibility between
- * clients and relays (or peers). Each protocol message begins with a version
- * number and an `ownerId` in its header.
+ * Every message of every protocol version begins with the version and the
+ * `OwnerId`, so a peer can route and report a message of any version. Nothing
+ * negotiates a version, and no side falls back to the other's.
  *
- * **How version negotiation works:**
- *
- * - The initiator (usually a client) sends a `ProtocolMessage` that includes its
- *   protocol version and the `ownerId`.
- * - The non-initiator (usually a relay or peer) checks the version.
- *
- *   - If the versions match, synchronization proceeds as normal.
- *   - If the versions do not match, the non-initiator responds with a message
- *       containing **its own protocol version and the same `ownerId`**.
- * - The initiator can then detect the version mismatch for that specific owner
- *   and handle it appropriately (e.g., prompt for an update or halt sync).
- *
- * Version negotiation is per-owner, allowing Evolu Protocol to evolve safely
- * over time and provide clear feedback about version mismatches.
+ * A non-initiator answers a request of another version with only its own
+ * version and that `OwnerId`. The initiator reports it as
+ * {@link ProtocolVersionError} for that owner, whose `isInitiator` tells which
+ * side is older, and stops syncing the owner through that relay. Clients from
+ * `@evolu/common` 8.0.0 before 8.11.0 drop that reply and stop syncing the
+ * owner through that relay without reporting anything, while 7.x clients report
+ * it as a `ProtocolVersionError`. So a relay that moves to another version must
+ * keep answering version 1 while such clients remain.
  *
  * ## Credible exit
  *
@@ -174,43 +203,50 @@
  *   indicators) to be forwarded by relays without storage overhead.
  */
 import { createMutableArray, isNonEmptyArray, } from "../Array.js";
-import { assert, assertNonEmptyArray, assertNonNullable, assertNotUndefined, assertSame, } from "../Assert.js";
+import { assert, assertNonEmptyArray, assertNonNullable } from "../Assert.js";
 import { BufferError, createBuffer, createRunLengthEncoder, decodeFlags, decodeJsonValue, decodeLength, decodeNonNegativeInt, decodeNumber, decodeRle, decodeString, encodeFlags, encodeJsonValue, encodeLength, encodeNonNegativeInt, encodeNumber, encodeString, } from "../Bytes.js";
-import { createPadmePadding, decryptWithXChaCha20Poly1305, EncryptionKey, encryptWithXChaCha20Poly1305, Entropy24, XChaCha20Poly1305Ciphertext, xChaCha20Poly1305NonceLength, } from "../Crypto.js";
+import { createPadmePadding, decryptWithXChaCha20Poly1305, EncryptionKey, encryptWithXChaCha20Poly1305, xChaCha20Poly1305NonceLength, } from "../Crypto.js";
 import { eqArrayNumber } from "../Eq.js";
+import { exhaustiveCheck } from "../Function.js";
 import { computeBalancedBuckets } from "../Number.js";
 import { createMutableRecord, objectToEntries } from "../Object.js";
 import { err, ok } from "../Result.js";
 import { AbortError } from "../Task.js";
 import { Millis } from "../Time.js";
-import { assertType, Base64Url, base64UrlToUint8Array, between, DateIso, FiniteNumber, Id, IdBytes, idBytesToId, idBytesTypeValueLength, idToIdBytes, Int, Json, jsonToJsonValue, NonNegativeInt, onePositiveInt, PositiveInt, uint8ArrayToBase64Url, zeroNonNegativeInt, } from "../Type.js";
+import { assertType, Base64Url, base64UrlToUint8Array, between, DateIso, Id, IdBytes, idBytesToId, idBytesTypeValueLength, idToIdBytes, Int, Json, jsonToJsonValue, NonNegativeInt, onePositiveInt, uint8ArrayToBase64Url, zeroNonNegativeInt, } from "../Type.js";
 import { OwnerId, OwnerIdBytes, ownerIdToOwnerIdBytes, OwnerWriteKey, ownerWriteKeyLength, } from "./Owner.js";
 import { DbChange, fingerprintSize, InfiniteUpperBound, RangeType, } from "./Storage.js";
-import { Counter, eqTimestamp, NodeId, nodeIdBytesLength, nodeIdBytesToNodeId, nodeIdToNodeIdBytes, Timestamp, TimestampBytes, timestampBytesLength, timestampBytesToTimestamp, timestampToTimestampBytes, } from "./Timestamp.js";
+import { Counter, eqTimestamp, NodeId, nodeIdBytesLength, nodeIdBytesToNodeId, nodeIdToNodeIdBytes, orderTimestamp, Timestamp, timestampBytesLength, timestampBytesToTimestamp, timestampToTimestampBytes, } from "./Timestamp.js";
 const minProtocolMessageMaxSize = 1_000_000;
 const maxProtocolMessageMaxSize = 100_000_000;
+const maxProtocolMessageRangesMaxSize = 100_000;
 /**
- * Protocol message maximum size.
+ * Protocol message maximum size, from 1MB to 100MB.
  *
- * Defines the upper limit for how large a single protocol message can be.
- * Implementations must enforce a maximum size between 1MB and 100MB to ensure
- * compatibility across all Evolu implementations (the maximum size of mutation
- * change is hardcoded and enforced hence the maximum size can't be smaller).
+ * A message never exceeds its maximum size, inclusive. Builders measure each
+ * write exactly and keep room to close the message (see
+ * {@link ProtocolMessageBuffer.tryWrite}), and sync sends what does not fit in
+ * later rounds.
  *
- * Larger maximum sizes can be configured by relays to reduce roundtrips. For
- * example, a dedicated relay with ample resources could configure a 100MB
- * maximum to minimize roundtrips for large syncs.
+ * Clients send at most {@link defaultProtocolMessageMaxSize} and enforce no
+ * receive limit. A relay can answer with larger messages, configured with the
+ * `totalMaxSize` option of {@link applyProtocolMessageAsRelay}, to reduce
+ * roundtrips for large syncs. Clients must not send larger messages, because
+ * relays accept at most the default: the Node.js relay closes the connection on
+ * a larger one, and relays up to `@evolu/nodejs` 4.0.0 crash on it.
  *
- * Only relays can safely configure larger sizes, as clients will handle them.
- * Increasing this value on the client side would break compatibility with
- * relays that enforce smaller limits.
+ * The default cannot be smaller either. Deployed clients send messages of that
+ * size, a change within {@link maxMutationSize} fits one message next to the
+ * largest ranges section, and changes saved before that limit existed, which
+ * can be nearly as large as a message, must stay servable.
  */
 export const ProtocolMessageMaxSize = /*#__PURE__*/ between(minProtocolMessageMaxSize, maxProtocolMessageMaxSize)(Int);
 /**
  * Default {@link ProtocolMessageMaxSize} (1MB).
  *
- * The standard size used across Evolu implementations. Relays with more
- * resources can configure larger sizes to reduce roundtrips.
+ * The standard size used across Evolu implementations. Clients send at most
+ * this size, and relays accept it. Relays with more resources can answer with
+ * larger messages to reduce roundtrips.
  */
 export const defaultProtocolMessageMaxSize = minProtocolMessageMaxSize;
 /**
@@ -222,9 +258,10 @@ export const defaultProtocolMessageMaxSize = minProtocolMessageMaxSize;
  *
  * The upper bound is set to ensure ranges fit within the default 1MB
  * {@link defaultProtocolMessageMaxSize}, maintaining compatibility between all
- * clients and relays.
+ * clients and relays. A received message whose ranges section exceeds twice the
+ * upper bound is rejected as {@link ProtocolInvalidDataError}.
  */
-export const ProtocolMessageRangesMaxSize = /*#__PURE__*/ between(3_000, 100_000)(Int);
+export const ProtocolMessageRangesMaxSize = /*#__PURE__*/ between(3_000, maxProtocolMessageRangesMaxSize)(Int);
 /**
  * Default {@link ProtocolMessageRangesMaxSize} (30KB).
  *
@@ -270,6 +307,14 @@ export const SubscriptionFlags = {
     /** Unsubscribe from updates for this owner. */
     Unsubscribe: 2,
 };
+/**
+ * The error code in the header of a Response.
+ *
+ * A client reports a code it does not know as {@link ProtocolInvalidDataError},
+ * which carries no `OwnerId`, and that relay's round for the owner ends. Every
+ * released client does this, so a relay can add a code under the same
+ * {@link protocolVersion} only where that outcome is acceptable.
+ */
 export const ProtocolErrorCode = {
     NoError: 0,
     /** A code for {@link ProtocolWriteKeyError}. */
@@ -284,9 +329,12 @@ export const ProtocolErrorCode = {
 /**
  * Creates a {@link ProtocolMessage} from CRDT messages.
  *
- * If the message size would exceed {@link defaultProtocolMessageMaxSize}, the
- * protocol ensures all messages will be sent in the next round(s) even over
- * unidirectional and stateless transports.
+ * The message holds the leading CRDT messages that fit `maxSize`, by default
+ * {@link defaultProtocolMessageMaxSize}, measured exactly. When one does not
+ * fit, it and the rest are left out, and the message ends with a range that
+ * makes the non-initiator answer with ranges. Sync then sends them in later
+ * rounds, even over unidirectional and stateless transports, because every
+ * change within {@link maxMutationSize} fits an empty message.
  */
 export const createProtocolMessageFromCrdtMessages = (deps) => (owner, messages, maxSize) => {
     const buffer = createProtocolMessageBuffer(owner.id, {
@@ -294,42 +342,37 @@ export const createProtocolMessageFromCrdtMessages = (deps) => (owner, messages,
         totalMaxSize: maxSize ?? defaultProtocolMessageMaxSize,
         writeKey: owner.writeKey,
     });
-    let notAllMessagesSent = false;
     for (const message of messages) {
         const change = encodeAndEncryptDbChange(deps)(message, owner.encryptionKey);
         const encryptedCrdtMessage = { timestamp: message.timestamp, change };
-        if (buffer.canAddMessage(encryptedCrdtMessage)) {
+        if (!buffer.tryWrite(() => {
             buffer.addMessage(encryptedCrdtMessage);
-        }
-        else {
-            notAllMessagesSent = true;
+        })) {
+            /**
+             * DEV: If not all messages fit due to size limits, we trigger a sync
+             * continuation by appending a Range with a random fingerprint. This
+             * ensures the receiver always responds with ranges, prompting another
+             * sync round.
+             *
+             * The ideal approach would be to send three ranges (skip, fingerprint,
+             * skip) where the fingerprint of unsent messages would act as narrow
+             * sync probe. I think we can send `zeroFingerprint` which can be
+             * interpreted as an indication that the other side should reply with
+             * {@link TimestampsRange}, so no need to restart syncing.
+             *
+             * For now, using a random fingerprint avoids extra complexity and is
+             * good enough for this case.
+             */
+            const randomFingerprint = deps.randomBytes.create(fingerprintSize);
+            // Every kept trial reserved space for this closing range.
+            buffer.addRange({
+                type: RangeType.Fingerprint,
+                upperBound: InfiniteUpperBound,
+                fingerprint: randomFingerprint,
+            });
             break;
         }
     }
-    if (notAllMessagesSent) {
-        /**
-         * DEV: If not all messages fit due to size limits, we trigger a sync
-         * continuation by appending a Range with a random fingerprint. This
-         * ensures the receiver always responds with ranges, prompting another
-         * sync round.
-         *
-         * The ideal approach would be to send three ranges (skip, fingerprint,
-         * skip) where the fingerprint of unsent messages would act as narrow sync
-         * probe. I think we can send `zeroFingerprint` which can be interpreted
-         * as an indication that the other side should reply with
-         * {@link TimestampsRange}, so no need to restart syncing.
-         *
-         * For now, using a random fingerprint avoids extra complexity and is good
-         * enough for this case.
-         */
-        const randomFingerprint = deps.randomBytes.create(fingerprintSize);
-        // There is always a space for Fingerprint with InfiniteUpperBound.
-        buffer.addRange({
-            type: RangeType.Fingerprint,
-            upperBound: InfiniteUpperBound,
-            fingerprint: randomFingerprint,
-        });
-    }
     return buffer.unwrap();
 };
 /**
@@ -382,16 +425,19 @@ export const createProtocolBroadcastMessagesFromCrdtMessages = (deps) => (owner,
             timestamp: message.timestamp,
             change: encodeAndEncryptDbChange(deps)(message, owner.encryptionKey),
         };
-        if (!buffer.canAddMessage(encryptedMessage)) {
-            const nextBuffer = createProtocolMessageBuffer(owner.id, {
-                messageType: MessageType.Broadcast,
-                totalMaxSize: maxSize,
-            });
-            assert(nextBuffer.canAddMessage(encryptedMessage), "the message is too big");
-            broadcasts.push(buffer.unwrap());
-            buffer = nextBuffer;
+        const frame = buffer;
+        if (frame.tryWrite(() => {
+            frame.addMessage(encryptedMessage);
+        })) {
+            continue;
         }
+        buffer = createProtocolMessageBuffer(owner.id, {
+            messageType: MessageType.Broadcast,
+            totalMaxSize: maxSize,
+        });
+        // Outside a trial, it asserts that the message fits an empty frame.
         buffer.addMessage(encryptedMessage);
+        broadcasts.push(frame.unwrap());
     }
     broadcasts.push(buffer.unwrap());
     assertNonEmptyArray(broadcasts);
@@ -405,7 +451,9 @@ export const createProtocolMessageForSync = (deps) => (ownerId, subscriptionFlag
     });
     const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
     const size = deps.storage.getSize(ownerIdBytes);
-    splitRange(deps)(ownerIdBytes, zeroNonNegativeInt, size, InfiniteUpperBound, buffer);
+    const ranges = readSplitRanges(deps)(ownerIdBytes, zeroNonNegativeInt, size, InfiniteUpperBound);
+    for (const range of ranges)
+        buffer.addRange(range);
     return buffer.unwrap();
 };
 export const createProtocolMessageForUnsubscribe = (ownerId) => createProtocolMessageBuffer(ownerId, {
@@ -418,7 +466,7 @@ export const createProtocolMessageBuffer = (ownerId, options) => {
         header: createBuffer(),
         messages: {
             timestamps: createTimestampsBuffer(),
-            dbChanges: createBuffer(),
+            dbChangeLengths: createBuffer(),
         },
         ranges: {
             timestamps: createTimestampsBuffer(),
@@ -443,66 +491,38 @@ export const createProtocolMessageBuffer = (ownerId, options) => {
     else if (options.messageType === MessageType.Response) {
         buffers.header.extend([options.errorCode]);
     }
+    // Changes are referenced, not copied, so a trial undoes messages by
+    // shortening this array, and unwrap copies each change once.
+    const dbChanges = [];
+    let dbChangesLength = 0;
     let isLastRangeInfinite = false;
-    const isWithinSizeLimits = () => getSize() <= totalMaxSize;
-    const getSize = () => PositiveInt.orThrow(getHeaderAndMessagesSize() + getRangesSize());
-    const getHeaderAndMessagesSize = () => buffers.header.getLength() +
+    let isInTrial = false;
+    // Writes outside a trial assert this, so an overflow fails where it happens.
+    // A frame must never exceed totalMaxSize: relays at @evolu/nodejs 4.0.0 or
+    // older crash on a frame one byte larger than their 1,000,000-byte limit.
+    const isWithinSizeLimits = () => getFrameSize() <= totalMaxSize;
+    // Lengths after a header that is never empty.
+    const getFrameSize = () => (buffers.header.getLength() +
         buffers.messages.timestamps.getLength() +
-        buffers.messages.dbChanges.getLength();
+        buffers.messages.dbChangeLengths.getLength() +
+        dbChangesLength +
+        getRangesSize());
+    // Without ranges, the ranges section is omitted, including its count.
     const getRangesSize = () => buffers.ranges.timestamps.getCount() > 0
         ? buffers.ranges.timestamps.getLength() +
             buffers.ranges.types.getLength() +
-            buffers.ranges.payloads.getLength() +
-            safeMargins.remainingRange
+            buffers.ranges.payloads.getLength()
         : 0;
-    /**
-     * We calculated worst-case sizes as closely as possible and added a small
-     * safety margin, since computing exact worst cases is difficult due to
-     * variable-length, run-length, and delta encoding.
-     *
-     * Runtime assertions (`assert`) are used to guarantee that size limits are
-     * never exceeded. If a limit is exceeded, the assertion will fail at the
-     * precise location, making it easy to identify and fix the issue.
-     *
-     * While it would be possible to avoid the safety margin by snapshotting
-     * buffer states and rolling back changes, this would likely impact
-     * performance. If someone has time and wants to experiment with this
-     * approach, contributions are welcome.
-     */
-    const safeMargins = {
-        // bytes: range type + possible increased count varint
-        remainingRange: fingerprintSize + 10,
-        // bytes: max millis + max count + NodeId
-        timestamp: 30,
-        // bytes: maximum encoded DbChange length varint
-        dbChangeLength: 8,
-        // bytes: worst case is around 650 bytes
-        splitRange: 800,
-        // bytes: range type + its upperBound + possible increased count varint
-        timestampsRange: 50,
-    };
-    const addMessageSafeMargin = safeMargins.timestamp +
-        safeMargins.dbChangeLength +
-        safeMargins.remainingRange;
+    // A trial makes the write, measures the exact frame, and undoes the write in
+    // constant time when the frame no longer fits, so it needs no worst-case
+    // margins and costs about as much as the write itself.
     return {
-        canAddMessage: (message) => getSize() + addMessageSafeMargin + message.change.length <= totalMaxSize,
         addMessage: (message) => {
             buffers.messages.timestamps.add(message.timestamp);
-            encodeLength(buffers.messages.dbChanges, message.change);
-            buffers.messages.dbChanges.extend(message.change);
-            assert(isWithinSizeLimits(), "the message is too big");
-        },
-        canSplitRange: () => getRangesSize() + safeMargins.splitRange <= rangesMaxSize,
-        canAddTimestampsRangeAndMessage: (timestamps, message) => {
-            const rangesNewSize = getRangesSize() + timestamps.getLength() + safeMargins.timestampsRange;
-            return (rangesNewSize <= rangesMaxSize &&
-                (message
-                    ? getHeaderAndMessagesSize() +
-                        rangesNewSize +
-                        addMessageSafeMargin +
-                        message.change.length <=
-                        totalMaxSize
-                    : true));
+            encodeLength(buffers.messages.dbChangeLengths, message.change);
+            dbChanges.push(message.change);
+            dbChangesLength += message.change.length;
+            assert(isInTrial || isWithinSizeLimits(), "the message is too big");
         },
         addRange: (range) => {
             assert(options.messageType !== MessageType.Broadcast, "Cannot add a range into broadcast message");
@@ -518,7 +538,7 @@ export const createProtocolMessageBuffer = (ownerId, options) => {
             else {
                 buffers.ranges.timestamps.addInfinite();
             }
-            encodeNonNegativeInt(buffers.ranges.types, NonNegativeInt.orThrow(range.type));
+            encodeNonNegativeInt(buffers.ranges.types, range.type);
             switch (range.type) {
                 case RangeType.Skip:
                     break;
@@ -530,22 +550,89 @@ export const createProtocolMessageBuffer = (ownerId, options) => {
                     break;
                 }
             }
-            assert(isWithinSizeLimits(), `the range ${range.type} is too big`);
+            assert(isInTrial || isWithinSizeLimits(), `the range ${range.type} is too big`);
+        },
+        tryWrite: (write, reserve = zeroNonNegativeInt) => {
+            const restoreMessageTimestamps = buffers.messages.timestamps.checkpoint();
+            const dbChangeLengthsLength = buffers.messages.dbChangeLengths.getLength();
+            const dbChangesCount = dbChanges.length;
+            const checkpointDbChangesLength = dbChangesLength;
+            const restoreRangeTimestamps = buffers.ranges.timestamps.checkpoint();
+            const typesLength = buffers.ranges.types.getLength();
+            const payloadsLength = buffers.ranges.payloads.getLength();
+            const wasLastRangeInfinite = isLastRangeInfinite;
+            const wasInTrial = isInTrial;
+            let isKept = false;
+            isInTrial = true;
+            try {
+                write();
+                // Fingerprint(InfiniteUpperBound) encodes no upper bound, only its
+                // type (1 byte) and fingerprint (12 bytes). The ranges count varint
+                // gains a byte when the new count is a power of 128. That includes
+                // 128^0 = 1, since the first range adds the count itself. So closing
+                // takes 13 or 14 bytes, and nothing for a Broadcast or a closed frame.
+                let newCount = buffers.ranges.timestamps.getCount() + 1;
+                while (newCount % 128 === 0)
+                    newCount /= 128;
+                const closingReserve = options.messageType === MessageType.Broadcast || isLastRangeInfinite
+                    ? 0
+                    : 1 + fingerprintSize + (newCount === 1 ? 1 : 0);
+                const reserves = closingReserve + reserve;
+                isKept =
+                    getFrameSize() + reserves <= totalMaxSize &&
+                        getRangesSize() + reserves <= rangesMaxSize;
+            }
+            finally {
+                isInTrial = wasInTrial;
+                if (!isKept) {
+                    restoreMessageTimestamps();
+                    buffers.messages.dbChangeLengths.truncate(dbChangeLengthsLength);
+                    dbChanges.length = dbChangesCount;
+                    dbChangesLength = checkpointDbChangesLength;
+                    restoreRangeTimestamps();
+                    buffers.ranges.types.truncate(typesLength);
+                    buffers.ranges.payloads.truncate(payloadsLength);
+                    isLastRangeInfinite = wasLastRangeInfinite;
+                }
+            }
+            return isKept;
         },
         unwrap: () => {
             if (buffers.ranges.timestamps.getCount() > 0) {
                 assert(isLastRangeInfinite, "The last range's upperBound must be InfiniteUpperBound");
             }
-            buffers.messages.timestamps.append(buffers.header);
-            buffers.header.extend(buffers.messages.dbChanges.unwrap());
+            const frame = new Uint8Array(getFrameSize());
+            frame.set(buffers.header.unwrap());
+            let offset = buffers.header.getLength();
+            // Written to a new buffer, so the builder is unchanged and unwrap can be
+            // called again.
+            const messageTimestamps = createBuffer();
+            buffers.messages.timestamps.append(messageTimestamps);
+            frame.set(messageTimestamps.unwrap(), offset);
+            offset += messageTimestamps.getLength();
+            // Each change follows its length, whose last varint byte is below 128.
+            const lengths = buffers.messages.dbChangeLengths.unwrap();
+            let lengthsOffset = 0;
+            for (const change of dbChanges) {
+                do {
+                    frame[offset++] = lengths[lengthsOffset];
+                } while (lengths[lengthsOffset++] >= 128);
+                frame.set(change, offset);
+                offset += change.length;
+            }
             if (buffers.ranges.timestamps.getCount() > 0) {
-                buffers.ranges.timestamps.append(buffers.header);
-                buffers.header.extend(buffers.ranges.types.unwrap());
-                buffers.header.extend(buffers.ranges.payloads.unwrap());
+                const ranges = createBuffer();
+                buffers.ranges.timestamps.append(ranges);
+                ranges.extend(buffers.ranges.types.unwrap());
+                ranges.extend(buffers.ranges.payloads.unwrap());
+                frame.set(ranges.unwrap(), offset);
+                offset += ranges.getLength();
             }
-            return buffers.header.unwrap();
+            // An overcounted size would end the frame with zero bytes peers accept.
+            assert(offset === frame.length, "the frame size is exact");
+            return frame;
         },
-        getSize,
+        getSize: getFrameSize,
     };
 };
 export const createTimestampsBuffer = () => {
@@ -590,252 +677,348 @@ export const createTimestampsBuffer = () => {
             buffer.extend(counterEncoder.unwrap());
             buffer.extend(nodeIdEncoder.unwrap());
         },
+        checkpoint: () => {
+            const checkpointCount = count;
+            const millisLength = millisBuffer.getLength();
+            const checkpointPreviousMillis = previousMillis;
+            const restoreCounters = counterEncoder.checkpoint();
+            const restoreNodeIds = nodeIdEncoder.checkpoint();
+            return () => {
+                count = checkpointCount;
+                syncCount();
+                millisBuffer.truncate(millisLength);
+                previousMillis = checkpointPreviousMillis;
+                restoreCounters();
+                restoreNodeIds();
+            };
+        },
     };
 };
 export const applyProtocolMessageAsClient = (inputMessage, options = {}) => async (run) => {
     const { storage } = run.deps;
-    try {
-        const input = createBuffer(inputMessage);
-        const [requestedVersion, ownerId] = decodeVersionAndOwner(input);
-        const version = options.version ?? protocolVersion;
-        if (requestedVersion !== version) {
-            return err({
-                type: "ProtocolVersionError",
-                version: requestedVersion,
-                isInitiator: version < requestedVersion,
-                ownerId,
-            });
-        }
-        const messageType = input.shift();
-        assert(messageType === MessageType.Response ||
-            messageType === MessageType.Broadcast, "Invalid MessageType");
-        if (messageType === MessageType.Response) {
-            const errorCode = input.shift();
-            if (errorCode !== ProtocolErrorCode.NoError) {
-                switch (errorCode) {
-                    case ProtocolErrorCode.WriteKeyError:
-                        return err({
-                            type: "ProtocolWriteKeyError",
-                            ownerId,
-                        });
-                    case ProtocolErrorCode.WriteError:
-                        return err({
-                            type: "ProtocolWriteError",
-                            ownerId,
-                        });
-                    case ProtocolErrorCode.QuotaError:
-                        return err({
-                            type: "ProtocolQuotaError",
-                            ownerId,
-                        });
-                    case ProtocolErrorCode.SyncError:
-                        return err({
-                            type: "ProtocolSyncError",
-                            ownerId,
-                        });
-                    default:
-                        throw new ProtocolDecodeError(`Invalid ProtocolErrorCode: ${errorCode}`);
-                }
-            }
-        }
-        const messages = decodeMessages(input);
-        const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
-        if (isNonEmptyArray(messages)) {
-            try {
-                const result = await run(storage.writeMessages(ownerIdBytes, messages));
-                if (!result.ok)
-                    return result;
-            }
-            catch (error) {
-                if (AbortError.is(error))
-                    throw error;
-                run.deps.console.error(error);
-                return ok({ type: "Failed", cause: "Write" });
-            }
-        }
-        if (messageType === MessageType.Broadcast) {
-            return ok({ type: "Broadcast" });
+    const version = options.version ?? protocolVersion;
+    const decoded = decodeProtocolMessage(inputMessage, version);
+    if (!decoded.ok)
+        return decoded;
+    const message = decoded.value;
+    if (message.type === "OtherVersion") {
+        return err({
+            type: "ProtocolVersionError",
+            version: message.version,
+            isInitiator: version < message.version,
+            ownerId: message.ownerId,
+        });
+    }
+    if (message.type === "Request") {
+        return err({
+            type: "ProtocolInvalidDataError",
+            data: inputMessage,
+            error: new ProtocolDecodeError("Expected a Response or a Broadcast"),
+        });
+    }
+    const { ownerId } = message;
+    if (message.type === "ErrorResponse") {
+        switch (message.errorCode) {
+            case ProtocolErrorCode.WriteKeyError:
+                return err({
+                    type: "ProtocolWriteKeyError",
+                    ownerId,
+                });
+            case ProtocolErrorCode.WriteError:
+                return err({
+                    type: "ProtocolWriteError",
+                    ownerId,
+                });
+            case ProtocolErrorCode.QuotaError:
+                return err({
+                    type: "ProtocolQuotaError",
+                    ownerId,
+                });
+            case ProtocolErrorCode.SyncError:
+                return err({
+                    type: "ProtocolSyncError",
+                    ownerId,
+                });
         }
-        // Now: No writeKey, no sync.
-        // TODO: Allow to sync SharedReadonlyOwner
-        // Without local changes, writeKey will not be required.
-        // With local changes, writeKey will be required and if not provided,
-        // the sync will stop.
-        const writeKey = options.writeKey;
-        if (writeKey == null) {
-            return ok({ type: "Readonly" });
+    }
+    const { messages } = message;
+    const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
+    if (isNonEmptyArray(messages)) {
+        try {
+            const result = await run(storage.writeMessages(ownerIdBytes, messages));
+            if (!result.ok)
+                return result;
         }
-        const ranges = decodeRanges(input);
-        if (!isNonEmptyArray(ranges)) {
-            return ok({ type: "Converged" });
+        catch (error) {
+            if (AbortError.is(error))
+                throw error;
+            run.deps.console.error(error);
+            return ok({ type: "Failed", cause: "Write" });
         }
-        const output = createProtocolMessageBuffer(ownerId, {
-            messageType: MessageType.Request,
-            writeKey,
-            rangesMaxSize: options.rangesMaxSize,
-        });
-        let broadcast;
-        const result = sync(run.deps)(ranges, output, ownerIdBytes, (message) => {
+    }
+    if (message.type === "Broadcast") {
+        return ok({ type: "Broadcast" });
+    }
+    // Now: No writeKey, no sync.
+    // TODO: Allow to sync SharedReadonlyOwner
+    // Without local changes, writeKey will not be required.
+    // With local changes, writeKey will be required and if not provided,
+    // the sync will stop.
+    const writeKey = options.writeKey;
+    if (writeKey == null) {
+        return ok({ type: "Readonly" });
+    }
+    const { ranges } = message;
+    if (!isNonEmptyArray(ranges)) {
+        return ok({ type: "Converged" });
+    }
+    const createOutput = () => createProtocolMessageBuffer(ownerId, {
+        messageType: MessageType.Request,
+        writeKey,
+        rangesMaxSize: options.rangesMaxSize,
+    });
+    const output = createOutput();
+    let broadcast;
+    const result = sync(run.deps)(ranges, output, ownerIdBytes, {
+        createEmptyOutput: createOutput,
+        onChangeTooLarge: options.onChangeTooLarge ?? run.deps.console.warn,
+        onMessage: (message) => {
             broadcast ??= createProtocolMessageBuffer(ownerId, {
                 messageType: MessageType.Broadcast,
             });
+            // The request holds the same messages after a larger header.
             broadcast.addMessage(message);
+        },
+    });
+    // A failure was logged by sync.
+    if (!result.ok)
+        return ok({ type: "Failed", cause: "Sync" });
+    if (!result.value)
+        return ok({ type: "Converged" });
+    return ok({
+        type: "Response",
+        message: output.unwrap(),
+        ...(broadcast && { broadcast: broadcast.unwrap() }),
+    });
+};
+export const applyProtocolMessageAsRelay = (inputMessage, options = {}, 
+/** For tests only. */
+version = protocolVersion) => async (run) => {
+    const { storage } = run.deps;
+    // The relay broadcasts a request's messages in a frame of totalMaxSize.
+    // That frame omits the request's write key, subscription flag, and ranges,
+    // so it holds the messages of any request up to that size.
+    if (inputMessage.length >
+        (options.totalMaxSize ?? defaultProtocolMessageMaxSize))
+        return err({
+            type: "ProtocolInvalidDataError",
+            data: inputMessage,
+            error: new ProtocolDecodeError("Request is too large"),
         });
-        // A failure was logged by sync.
-        if (!result.ok)
-            return ok({ type: "Failed", cause: "Sync" });
-        if (!result.value)
-            return ok({ type: "Converged" });
+    const decoded = decodeProtocolMessage(inputMessage, version);
+    if (!decoded.ok)
+        return decoded;
+    const request = decoded.value;
+    if (request.type === "OtherVersion") {
+        // Non-initiator responds with its version and ownerId.
+        const output = createBuffer();
+        encodeNonNegativeInt(output, version);
+        output.extend(ownerIdToOwnerIdBytes(request.ownerId));
         return ok({
             type: "Response",
             message: output.unwrap(),
-            ...(broadcast && { broadcast: broadcast.unwrap() }),
         });
     }
-    catch (error) {
-        if (AbortError.is(error))
-            throw error;
+    if (request.type !== "Request") {
         return err({
             type: "ProtocolInvalidDataError",
             data: inputMessage,
-            error,
+            error: new ProtocolDecodeError("Expected a Request"),
         });
     }
-};
-export const applyProtocolMessageAsRelay = (inputMessage, options = {}, 
-/** For tests only. */
-version = protocolVersion) => async (run) => {
-    const { storage } = run.deps;
-    try {
-        const input = createBuffer(inputMessage);
-        const [requestedVersion, ownerId] = decodeVersionAndOwner(input);
-        const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
-        if (requestedVersion !== version) {
-            // Non-initiator responds with its version and ownerId.
-            const output = createBuffer();
-            encodeNonNegativeInt(output, version);
-            output.extend(ownerIdBytes);
-            return ok({
-                type: "Response",
-                message: output.unwrap(),
-            });
+    const { ownerId, writeKey, messages, ranges } = request;
+    const ownerIdBytes = ownerIdToOwnerIdBytes(ownerId);
+    const createErrorResponse = (errorCode) => ({
+        type: "Response",
+        message: createProtocolMessageBuffer(ownerId, {
+            messageType: MessageType.Response,
+            errorCode,
+        }).unwrap(),
+    });
+    switch (request.subscriptionFlag) {
+        case SubscriptionFlags.Subscribe:
+            options.subscribe?.(ownerId);
+            break;
+        case SubscriptionFlags.Unsubscribe:
+            options.unsubscribe?.(ownerId);
+            break;
+        case SubscriptionFlags.None:
+            break;
+        default:
+            exhaustiveCheck(request.subscriptionFlag);
+    }
+    if (writeKey) {
+        let isValid;
+        try {
+            isValid = storage.validateWriteKey(ownerIdBytes, writeKey);
         }
-        const messageType = input.shift();
-        assertSame(messageType, MessageType.Request);
-        const hasWriteKey = input.shift();
-        let writeKey;
-        if (hasWriteKey === 1) {
-            writeKey = input.shiftN(ownerWriteKeyLength);
+        catch (error) {
+            // A relay storage stores the write key of a new owner, which SQLite
+            // can fail, for example on a full disk. A boolean has no room for the
+            // error, so it is answered like a failed write.
+            run.deps.console.error(error);
+            return ok(createErrorResponse(ProtocolErrorCode.WriteError));
         }
-        const subscriptionFlag = input.shift();
-        switch (subscriptionFlag) {
-            case SubscriptionFlags.Subscribe:
-                options.subscribe?.(ownerId);
-                break;
-            case SubscriptionFlags.Unsubscribe:
-                options.unsubscribe?.(ownerId);
-                break;
-            case SubscriptionFlags.None:
-                break;
+        if (!isValid) {
+            return ok(createErrorResponse(ProtocolErrorCode.WriteKeyError));
         }
-        if (writeKey) {
-            const isValid = storage.validateWriteKey(ownerIdBytes, writeKey);
-            if (!isValid) {
-                return ok({
-                    type: "Response",
-                    message: createProtocolMessageBuffer(ownerId, {
-                        messageType: MessageType.Response,
-                        errorCode: ProtocolErrorCode.WriteKeyError,
-                    }).unwrap(),
-                });
+    }
+    if (isNonEmptyArray(messages)) {
+        if (!writeKey) {
+            return ok(createErrorResponse(ProtocolErrorCode.WriteKeyError));
+        }
+        try {
+            const result = await run(storage.writeMessages(ownerIdBytes, messages));
+            if (!result.ok) {
+                // A storage returns a failed write without reporting it.
+                if (result.error.type === "UnknownError")
+                    run.deps.console.error(result.error);
+                return ok(createErrorResponse(result.error.type === "StorageQuotaError"
+                    ? ProtocolErrorCode.QuotaError
+                    : ProtocolErrorCode.WriteError));
             }
         }
-        const messages = decodeMessages(input);
-        if (isNonEmptyArray(messages)) {
-            if (!writeKey) {
+        catch (error) {
+            if (AbortError.is(error))
+                throw error;
+            run.deps.console.error(error);
+            return ok(createErrorResponse(ProtocolErrorCode.WriteError));
+        }
+        /**
+         * Broadcast messages to all subscribed owners for real-time
+         * synchronization between clients.
+         *
+         * Messages are only broadcasted after successful write to ensure devices
+         * that can still sync aren't affected by quota errors, and to prevent
+         * using a half-working relay service (broadcasting without persistence).
+         *
+         * When a relay's database is deleted or clients migrate to a new relay
+         * (without data migration), clients will sync their data to the relay,
+         * and the relay will broadcast those messages to other connected clients.
+         * Those clients may receive messages they already have, but this is safe
+         * because Evolu sync is idempotent. As the relay becomes more
+         * synchronized with clients over time, fewer duplicate messages will be
+         * broadcasted.
+         */
+        if (options.broadcast) {
+            const broadcastBuffer = createProtocolMessageBuffer(ownerId, {
+                messageType: MessageType.Broadcast,
+                totalMaxSize: options.totalMaxSize,
+                rangesMaxSize: options.rangesMaxSize,
+                version,
+            });
+            for (const message of messages) {
+                broadcastBuffer.addMessage(message);
+            }
+            options.broadcast(ownerId, broadcastBuffer.unwrap());
+        }
+    }
+    const createOutput = () => createProtocolMessageBuffer(ownerId, {
+        messageType: MessageType.Response,
+        errorCode: ProtocolErrorCode.NoError,
+        totalMaxSize: options.totalMaxSize,
+        rangesMaxSize: options.rangesMaxSize,
+    });
+    const output = createOutput();
+    // A relay answers every request it decodes, even with nothing to sync, so
+    // the initiator knows the sync is complete.
+    if (!isNonEmptyArray(ranges)) {
+        return ok({ type: "Response", message: output.unwrap() });
+    }
+    const result = sync(run.deps)(ranges, output, ownerIdBytes, {
+        createEmptyOutput: createOutput,
+        onChangeTooLarge: run.deps.console.warn,
+    });
+    // A relay answers every request it decodes, a failed reconciliation with
+    // its error code.
+    return ok(result.ok
+        ? { type: "Response", message: output.unwrap() }
+        : createErrorResponse(result.error));
+};
+/**
+ * Decodes a whole {@link ProtocolMessage}, so a malformed one is rejected before
+ * anything it carries is applied.
+ *
+ * Applying a message turns only a throw from here into
+ * {@link ProtocolInvalidDataError}. A throw after decoding is a defect.
+ */
+const decodeProtocolMessage = (inputMessage, version) => {
+    try {
+        const input = createBuffer(inputMessage);
+        const [messageVersion, ownerId] = decodeVersionAndOwner(input);
+        if (messageVersion !== version)
+            return ok({ type: "OtherVersion", version: messageVersion, ownerId });
+        switch (decodeMessageType(input)) {
+            case MessageType.Request: {
+                const hasWriteKey = input.shift();
+                if (hasWriteKey > 1)
+                    throw new ProtocolDecodeError(`Invalid hasWriteKey: ${hasWriteKey}`);
+                const writeKey = hasWriteKey === 1
+                    ? input.shiftN(ownerWriteKeyLength)
+                    : null;
+                const subscriptionFlag = input.shift();
+                switch (subscriptionFlag) {
+                    case SubscriptionFlags.None:
+                    case SubscriptionFlags.Subscribe:
+                    case SubscriptionFlags.Unsubscribe:
+                        break;
+                    default:
+                        throw new ProtocolDecodeError(`Invalid SubscriptionFlag: ${subscriptionFlag}`);
+                }
+                const messages = decodeMessages(input);
+                // Only a relay accepts a Request, so only the relay checks this.
+                // Deployed relays already store shorter changes, and a client skips a
+                // change it cannot read, whereas a check in decodeMessages would make
+                // it reject every response holding one.
+                for (const { change } of messages)
+                    if (change.length < minEncryptedDbChangeLength)
+                        throw new ProtocolDecodeError("EncryptedDbChange is too short");
+                const ranges = decodeRanges(input);
                 return ok({
-                    type: "Response",
-                    message: createProtocolMessageBuffer(ownerId, {
-                        messageType: MessageType.Response,
-                        errorCode: ProtocolErrorCode.WriteKeyError,
-                    }).unwrap(),
+                    type: "Request",
+                    ownerId,
+                    writeKey,
+                    subscriptionFlag,
+                    messages,
+                    ranges,
                 });
             }
-            try {
-                const result = await run(storage.writeMessages(ownerIdBytes, messages));
-                if (!result.ok) {
-                    const message = createProtocolMessageBuffer(ownerId, {
-                        messageType: MessageType.Response,
-                        errorCode: ProtocolErrorCode.QuotaError,
-                    }).unwrap();
-                    return ok({ type: "Response", message });
+            case MessageType.Response: {
+                const errorCode = input.shift();
+                switch (errorCode) {
+                    case ProtocolErrorCode.NoError: {
+                        const messages = decodeMessages(input);
+                        const ranges = decodeRanges(input);
+                        return ok({ type: "Response", ownerId, messages, ranges });
+                    }
+                    case ProtocolErrorCode.WriteKeyError:
+                    case ProtocolErrorCode.WriteError:
+                    case ProtocolErrorCode.QuotaError:
+                    case ProtocolErrorCode.SyncError:
+                        return ok({ type: "ErrorResponse", ownerId, errorCode });
+                    default:
+                        throw new ProtocolDecodeError(`Invalid ProtocolErrorCode: ${errorCode}`);
                 }
             }
-            catch (error) {
-                if (AbortError.is(error))
-                    throw error;
-                run.deps.console.error(error);
-                const message = createProtocolMessageBuffer(ownerId, {
-                    messageType: MessageType.Response,
-                    errorCode: ProtocolErrorCode.WriteError,
-                }).unwrap();
-                return ok({ type: "Response", message });
-            }
-            /**
-             * Broadcast messages to all subscribed owners for real-time
-             * synchronization between clients.
-             *
-             * Messages are only broadcasted after successful write to ensure
-             * devices that can still sync aren't affected by quota errors, and to
-             * prevent using a half-working relay service (broadcasting without
-             * persistence).
-             *
-             * When a relay's database is deleted or clients migrate to a new relay
-             * (without data migration), clients will sync their data to the relay,
-             * and the relay will broadcast those messages to other connected
-             * clients. Those clients may receive messages they already have, but
-             * this is safe because Evolu sync is idempotent. As the relay becomes
-             * more synchronized with clients over time, fewer duplicate messages
-             * will be broadcasted.
-             */
-            if (options.broadcast) {
-                const broadcastBuffer = createProtocolMessageBuffer(ownerId, {
-                    messageType: MessageType.Broadcast,
-                    totalMaxSize: options.totalMaxSize,
-                    rangesMaxSize: options.rangesMaxSize,
-                    version,
+            case MessageType.Broadcast:
+                return ok({
+                    type: "Broadcast",
+                    ownerId,
+                    messages: decodeMessages(input),
                 });
-                for (const message of messages) {
-                    broadcastBuffer.addMessage(message);
-                }
-                options.broadcast(ownerId, broadcastBuffer.unwrap());
-            }
-        }
-        const ranges = decodeRanges(input);
-        const output = createProtocolMessageBuffer(ownerId, {
-            messageType: MessageType.Response,
-            errorCode: ProtocolErrorCode.NoError,
-            totalMaxSize: options.totalMaxSize,
-            rangesMaxSize: options.rangesMaxSize,
-        });
-        // Non-initiators always respond to provide sync completion feedback,
-        // even when there's nothing to sync.
-        if (!isNonEmptyArray(ranges)) {
-            return ok({ type: "Response", message: output.unwrap() });
         }
-        const result = sync(run.deps)(ranges, output, ownerIdBytes);
-        const message = result.ok
-            ? output.unwrap()
-            : createProtocolMessageBuffer(ownerId, {
-                messageType: MessageType.Response,
-                errorCode: result.error,
-            }).unwrap();
-        // Non-initiators always respond to provide sync completion feedback,
-        return ok({ type: "Response", message });
     }
     catch (error) {
-        if (AbortError.is(error))
-            throw error;
         return err({
             type: "ProtocolInvalidDataError",
             data: inputMessage,
@@ -846,8 +1029,7 @@ version = protocolVersion) => async (run) => {
 const decodeVersionAndOwner = (input) => {
     // This structure must never change across protocol versions. The version
     // and owner ID must always be the first two fields in every protocol message
-    // to enable version negotiation and owner identification before any other
-    // processing occurs.
+    // to route and report a version mismatch before any other processing occurs.
     const version = decodeNonNegativeInt(input);
     const ownerId = decodeId(input);
     return [version, ownerId];
@@ -857,22 +1039,19 @@ const parseProtocolHeaderFromBuffer = (input) => {
     if (version !== protocolVersion) {
         return { type: "ProtocolHeader", version, ownerId };
     }
-    const messageTypeValue = input.shift();
-    let messageType;
-    switch (messageTypeValue) {
+    const messageType = decodeMessageType(input);
+    return { type: "ProtocolHeader", version, ownerId, messageType };
+};
+const decodeMessageType = (input) => {
+    const messageType = input.shift();
+    switch (messageType) {
         case MessageType.Request:
-            messageType = MessageType.Request;
-            break;
         case MessageType.Response:
-            messageType = MessageType.Response;
-            break;
         case MessageType.Broadcast:
-            messageType = MessageType.Broadcast;
-            break;
+            return messageType;
         default:
             throw new ProtocolDecodeError("Invalid MessageType");
     }
-    return { type: "ProtocolHeader", version, ownerId, messageType };
 };
 /**
  * Error thrown for internal protocol validation failures, such as invalid data
@@ -882,7 +1061,6 @@ class ProtocolDecodeError extends Error {
     constructor(message) {
         super(message);
         this.name = this.constructor.name;
-        Error.captureStackTrace(this, this.constructor);
     }
 }
 const decodeMessages = (buffer) => {
@@ -896,7 +1074,39 @@ const decodeMessages = (buffer) => {
     }
     return messages;
 };
-const sync = (deps) => (ranges, output, ownerIdBytes, onMessage) => {
+// The smallest envelope encodeAndEncryptDbChange can produce: the nonce, a
+// 1-byte ciphertext length, and the 16-byte Poly1305 tag. Every v1 client sends
+// at least 77 bytes. The relay quota counts change bytes, so a relay storing
+// shorter changes, zero-length ones above all, would store rows the quota does
+// not count.
+const minEncryptedDbChangeLength = xChaCha20Poly1305NonceLength + 1 + 16;
+/**
+ * Answers the ranges into `output`, returning whether it has anything to send.
+ *
+ * Every write except a closing one is a trial (see
+ * {@link ProtocolMessageBuffer.tryWrite}), so the frame always has room to close
+ * with one Fingerprint range with {@link InfiniteUpperBound}. When a write does
+ * not fit, that range closes the frame. Its fingerprint covers everything from
+ * the last upper bound the frame states, which every v1 peer assumes, and the
+ * peer reconciles it in the next round.
+ *
+ * A stored change that cannot fit an empty frame with this header, with only
+ * its own timestamp listed after a pending skip, is skipped, and
+ * `onChangeTooLarge` reports it as a {@link ProtocolChangeTooLargeError}. A
+ * later round is guaranteed to reach exactly that frame, so a change that fits
+ * it is sent eventually.
+ *
+ * An answer to a Timestamps range neither sends nor lists a skipped change, but
+ * a request or a split lists its timestamp, so a peer that lacks it may ask for
+ * it once per sync and gets an answer without it. Fingerprints keep disagreeing
+ * about it, so every sync narrows them to it, skips it again, and ends.
+ *
+ * A throw from storage, or from a split's checks of what storage returned, is
+ * logged and returns `SyncError`, except an AbortError from a split's reads,
+ * which is rethrown. Any other throw, such as from writing the frame,
+ * `onChangeTooLarge`, or `onMessage`, is a defect.
+ */
+const sync = (deps) => (ranges, output, ownerIdBytes, { createEmptyOutput, onChangeTooLarge, onMessage, }) => {
     const outputInitialSize = output.getSize();
     let storageSize;
     try {
@@ -908,11 +1118,18 @@ const sync = (deps) => (ranges, output, ownerIdBytes, onMessage) => {
     }
     let prevUpperBound = null;
     let prevIndex = zeroNonNegativeInt;
+    // The index of the last upper bound the frame states, 0 before any.
+    let statedIndex = zeroNonNegativeInt;
+    // Consecutive skipped ranges become one Skip range, written only before
+    // the next non-skip range.
     let skip = false;
     let nonSkipRangeAdded = false;
     const skipRange = (range) => {
         // The last range, if any non skip was added, must have InfiniteUpperBound.
         if (nonSkipRangeAdded && range.upperBound === InfiniteUpperBound) {
+            // A closing write. Like the closing Fingerprint range, it encodes no
+            // upper bound, and its type takes 1 byte of the 13 that every kept
+            // trial reserved beyond the ranges count.
             output.addRange({
                 type: RangeType.Skip,
                 upperBound: InfiniteUpperBound,
@@ -922,36 +1139,50 @@ const sync = (deps) => (ranges, output, ownerIdBytes, onMessage) => {
             skip = true;
         }
     };
-    const coalesceSkipsBeforeAdd = () => {
-        // Set to true because we are going to add a non skip range.
-        nonSkipRangeAdded = true;
-        if (skip) {
+    /**
+     * Tries to write a non-skip range ending at the index `upper` after the
+     * pending skip, if any.
+     */
+    const tryWriteRange = (upper, write) => {
+        const isKept = output.tryWrite(() => {
+            if (skip) {
+                assertNonNullable(prevUpperBound, "prevUpperBound is null");
+                output.addRange({
+                    type: RangeType.Skip,
+                    upperBound: prevUpperBound,
+                });
+            }
+            write();
+        });
+        if (isKept) {
             skip = false;
-            assertNonNullable(prevUpperBound, "prevUpperBound is null");
-            // There is always a space for a skip range before adding.
-            output.addRange({
-                type: RangeType.Skip,
-                upperBound: prevUpperBound,
-            });
+            nonSkipRangeAdded = true;
+            statedIndex = upper;
         }
+        return isKept;
     };
-    // When we don't have a space...
-    const addFingerprintForRemainingRange = (begin) => {
+    /**
+     * Closes the frame with a Fingerprint range with InfiniteUpperBound over
+     * the items from the last upper bound the frame states. A frame that cannot
+     * fit a range closes without writing the pending Skip range, because only
+     * this range has room reserved, so it covers the skipped items too.
+     */
+    const closeWithFingerprint = () => {
         let fingerprint;
         try {
-            fingerprint = deps.storage.fingerprint(ownerIdBytes, begin, storageSize);
+            fingerprint = deps.storage.fingerprint(ownerIdBytes, statedIndex, storageSize);
         }
         catch (error) {
             deps.console.error(error);
-            return false;
+            return err(ProtocolErrorCode.SyncError);
         }
-        // There is always a space for a ramaining range.
+        // A closing write. Every kept trial reserved room for it.
         output.addRange({
             type: RangeType.Fingerprint,
             upperBound: InfiniteUpperBound,
             fingerprint,
         });
-        return true;
+        return ok(true);
     };
     for (const range of ranges) {
         const currentUpperBound = range.upperBound;
@@ -980,24 +1211,24 @@ const sync = (deps) => (ranges, output, ownerIdBytes, onMessage) => {
                 }
                 if (eqArrayNumber(range.fingerprint, ourFingerprint)) {
                     skipRange(range);
+                    break;
                 }
-                else if (output.canSplitRange()) {
-                    coalesceSkipsBeforeAdd();
-                    try {
-                        splitRange(deps)(ownerIdBytes, lower, upper, currentUpperBound, output);
-                    }
-                    catch (error) {
-                        if (AbortError.is(error))
-                            throw error;
-                        deps.console.error(error);
-                        return err(ProtocolErrorCode.SyncError);
-                    }
+                let splitRanges;
+                try {
+                    splitRanges = readSplitRanges(deps)(ownerIdBytes, lower, upper, currentUpperBound);
                 }
-                else {
-                    return addFingerprintForRemainingRange(upper)
-                        ? ok(true)
-                        : err(ProtocolErrorCode.SyncError);
+                catch (error) {
+                    if (AbortError.is(error))
+                        throw error;
+                    deps.console.error(error);
+                    return err(ProtocolErrorCode.SyncError);
                 }
+                const isSplit = tryWriteRange(upper, () => {
+                    for (const splitRange of splitRanges)
+                        output.addRange(splitRange);
+                });
+                if (!isSplit)
+                    return closeWithFingerprint();
                 break;
             }
             case RangeType.Timestamps: {
@@ -1006,66 +1237,109 @@ const sync = (deps) => (ranges, output, ownerIdBytes, onMessage) => {
                 const ourTimestamps = createTimestampsBuffer();
                 let exceeded = false;
                 let iterateFailed = false;
+                // A pending skip stays pending until the range is written.
+                const isSkipPending = skip;
+                // Only a throw from the storage itself is a storage failure. A throw
+                // from the callback, such as from onChangeTooLarge or onMessage, is
+                // a defect, rethrown after iterating.
+                let callbackError = null;
                 try {
                     deps.storage.iterate(ownerIdBytes, lower, upper, (timestamp, index) => {
-                        const timestampString = timestamp.join();
-                        const timestampBinary = timestampBytesToTimestamp(timestamp);
-                        let message = null;
-                        if (timestampsWeNeed.has(timestampString)) {
-                            timestampsWeNeed.delete(timestampString);
-                        }
-                        else {
-                            try {
-                                message = {
-                                    timestamp: timestampBinary,
-                                    change: deps.storage.readDbChange(ownerIdBytes, timestamp),
-                                };
+                        try {
+                            const timestampString = timestamp.join();
+                            const timestampBinary = timestampBytesToTimestamp(timestamp);
+                            let message = null;
+                            if (timestampsWeNeed.has(timestampString)) {
+                                timestampsWeNeed.delete(timestampString);
                             }
-                            catch (error) {
-                                deps.console.error(error);
-                                iterateFailed = true;
-                                return false;
+                            else {
+                                try {
+                                    message = {
+                                        timestamp: timestampBinary,
+                                        change: deps.storage.readDbChange(ownerIdBytes, timestamp),
+                                    };
+                                }
+                                catch (error) {
+                                    deps.console.error(error);
+                                    iterateFailed = true;
+                                    return false;
+                                }
+                            }
+                            // One trial per timestamp: its entry in ourTimestamps and its
+                            // message if the peer lacks it, keeping room to write
+                            // ourTimestamps as a range after the pending skip.
+                            const restoreOurTimestamps = ourTimestamps.checkpoint();
+                            ourTimestamps.add(timestampBinary);
+                            if (output.tryWrite(() => {
+                                if (message)
+                                    output.addMessage(message);
+                            }, getTimestampsRangeReserve(ourTimestamps, isSkipPending))) {
+                                if (message)
+                                    onMessage?.(message);
+                                return true;
+                            }
+                            restoreOurTimestamps();
+                            if (message) {
+                                // Whether an empty frame can hold the message in the trial
+                                // a Timestamps range makes for it, with only its own
+                                // timestamp listed and a skip pending. A later round is
+                                // guaranteed to reach exactly that frame, so a message that
+                                // fits is sent eventually. A trial without a pending skip
+                                // reserves 22 bytes less, so a message up to 22 bytes too
+                                // large for this check may still be sent in such a frame.
+                                const emptyOutput = createEmptyOutput();
+                                const emptyOutputTimestamps = createTimestampsBuffer();
+                                emptyOutputTimestamps.add(message.timestamp);
+                                const fitsEmptyOutput = emptyOutput.tryWrite(() => {
+                                    emptyOutput.addMessage(message);
+                                }, getTimestampsRangeReserve(emptyOutputTimestamps, true));
+                                if (!fitsEmptyOutput) {
+                                    onChangeTooLarge({
+                                        type: "ProtocolChangeTooLargeError",
+                                        timestamp: timestampBinary,
+                                        size: message.change.length,
+                                    });
+                                    return true;
+                                }
                             }
-                        }
-                        if (!output.canAddTimestampsRangeAndMessage(ourTimestamps, message)) {
                             exceeded = true;
                             endBound = timestamp;
                             upper = index;
                             return false;
                         }
-                        ourTimestamps.add(timestampBinary);
-                        if (message) {
-                            output.addMessage(message);
-                            onMessage?.(message);
+                        catch (error) {
+                            callbackError = { error };
+                            return false;
                         }
-                        return true;
                     });
                 }
                 catch (error) {
                     deps.console.error(error);
-                    return err(ProtocolErrorCode.SyncError);
+                    iterateFailed = true;
                 }
+                if (callbackError)
+                    throw callbackError.error;
                 if (iterateFailed) {
                     return err(ProtocolErrorCode.SyncError);
                 }
-                const addRange = () => {
-                    coalesceSkipsBeforeAdd();
+                // When any timestamp was kept, its trial reserved room for this
+                // write. Otherwise the range may not fit, and the frame closes
+                // without it.
+                const tryWriteTimestampsRange = () => tryWriteRange(upper, () => {
                     output.addRange({
                         type: RangeType.Timestamps,
                         upperBound: endBound,
                         timestamps: ourTimestamps,
                     });
-                };
+                });
                 if (exceeded) {
-                    addRange();
-                    if (!addFingerprintForRemainingRange(upper)) {
-                        return err(ProtocolErrorCode.SyncError);
-                    }
-                    return ok(true);
+                    tryWriteTimestampsRange();
+                    return closeWithFingerprint();
                 }
                 // If we need something, we have to respond with our timestamps.
                 if (timestampsWeNeed.size > 0) {
-                    addRange();
+                    if (!tryWriteTimestampsRange())
+                        return closeWithFingerprint();
                 }
                 else {
                     skipRange(range);
@@ -1080,7 +1354,29 @@ const sync = (deps) => (ranges, output, ownerIdBytes, onMessage) => {
     const hasChange = output.getSize() > outputInitialSize;
     return ok(hasChange);
 };
-const splitRange = (deps) => (ownerId, lower, upper, upperBound, buffer) => {
+// The most a range adds to a frame beyond its payload. Its upper bound adds at
+// most 20 bytes to the ranges' timestamps: a millis delta varint of up to 7
+// bytes, as maxMillis has 48 bits; up to 4 for the counter, as a new run is a
+// varint of up to 3 bytes, Counter being at most 65,535, and a 1-byte run
+// length, while extending a run adds at most 1 byte; and up to 9 for the
+// NodeId, as a new run is 8 bytes and a 1-byte run length. Its type takes 1
+// byte, and the ranges count gains at most 1 byte.
+const maxRangeOverhead = 22;
+/**
+ * Returns the bytes a frame must keep to write `timestamps` as a Timestamps
+ * range, after a Skip range when one is pending. A Skip range has no payload,
+ * and the length of `timestamps` is exact.
+ */
+const getTimestampsRangeReserve = (timestamps, isSkipPending) => (timestamps.getLength() +
+    maxRangeOverhead +
+    (isSkipPending ? maxRangeOverhead : 0));
+/**
+ * Reads the ranges that split the items from `lower` to `upper`: one Timestamps
+ * range listing them when they are too few for buckets, otherwise Fingerprint
+ * ranges over the buckets. It only reads storage, so a throw is a storage
+ * failure.
+ */
+const readSplitRanges = (deps) => (ownerId, lower, upper, upperBound) => {
     const itemCount = NonNegativeInt.orThrow(upper - lower);
     const buckets = computeBalancedBuckets(itemCount);
     if (!buckets.ok) {
@@ -1093,30 +1389,43 @@ const splitRange = (deps) => (ownerId, lower, upper, upperBound, buffer) => {
             range.timestamps.add(timestampBytesToTimestamp(timestamp));
             return true;
         });
-        buffer.addRange(range);
-        return;
+        return [range];
     }
     // Check Storage.ts `fingerprint` and `fingerprintRanges` docs.
     const fingerprintRangesBuckets = lower === 0
         ? buckets.value
-        : [
-            lower,
-            ...buckets.value.map((b) => NonNegativeInt.orThrow(b + lower)),
-        ];
+        : [lower, ...buckets.value.map((b) => (b + lower))];
     const fingerprintRanges = deps.storage.fingerprintRanges(ownerId, fingerprintRangesBuckets, upperBound);
-    const rangesToUse = lower > 0 ? fingerprintRanges.slice(1) : fingerprintRanges;
-    for (const range of rangesToUse) {
-        buffer.addRange(range);
-    }
+    return lower > 0 ? fingerprintRanges.slice(1) : fingerprintRanges;
 };
+// Twice the largest rangesMaxSize rather than the receiver's own, because
+// deployed senders exceed theirs. Up to @evolu/common 8.17, sync answered each
+// Timestamps range that listed timestamps it lacked, while it held none in that
+// range, with an empty Timestamps range, without checking the size. Such an
+// echo reuses the peer's bounds with a 1-byte payload, so the echoes take less
+// than the peer's ranges that list timestamps, which the peer's size checks
+// kept within its rangesMaxSize. An empty list asks for nothing, so an echo is
+// never echoed again.
+const maxRangesSectionSize = 2 * maxProtocolMessageRangesMaxSize;
 const decodeRanges = (buffer) => {
+    // The ranges section ends the frame, so it is checked before any allocation.
+    if (buffer.getLength() > maxRangesSectionSize)
+        throw new ProtocolDecodeError(`Ranges section exceeds ${maxRangesSectionSize} bytes`);
     if (buffer.getLength() === 0)
         return [];
     const rangesCount = decodeNonNegativeInt(buffer);
     if (rangesCount === 0)
         return [];
-    const timestampsCount = NonNegativeInt.orThrow(rangesCount - 1);
+    const timestampsCount = (rangesCount - 1);
     const timestamps = decodeTimestamps(buffer, timestampsCount);
+    // Storage resolves each bound from the owner's first timestamp, so a lower
+    // bound would move back over ranges already answered. Equal bounds are
+    // valid: sync ends a range at the change that did not fit, which can be
+    // where the previous range ended. Timestamps listed in a range are not
+    // checked, because peers before @evolu/common 8.11 list some outside it.
+    for (let i = 1; i < timestamps.length; i++)
+        if (orderTimestamp(timestamps[i - 1], timestamps[i]) > 0)
+            throw new ProtocolDecodeError("Range upper bounds must be non-decreasing");
     const rangeTypes = createMutableArray(rangesCount);
     for (let i = 0; i < rangesCount; i++) {
         const rangeType = decodeNonNegativeInt(buffer);
@@ -1164,6 +1473,9 @@ const decodeRanges = (buffer) => {
 };
 const decodeTimestamps = (buffer, length) => {
     length ??= decodeNonNegativeInt(buffer);
+    // Every timestamp takes at least its 1-byte millis delta.
+    if (length > buffer.getLength())
+        throw new ProtocolDecodeError("Invalid timestamps count");
     let previousMillis = 0;
     const millises = createMutableArray(length);
     for (let i = 0; i < length; i++) {
@@ -1195,13 +1507,27 @@ const decodeId = (buffer) => {
     const bytes = buffer.shiftN(idBytesTypeValueLength);
     return idBytesToId(bytes);
 };
+/**
+ * The format version that starts every {@link EncryptedDbChange} plaintext.
+ *
+ * It is independent of {@link protocolVersion}, so a new protocol version that
+ * keeps this layout does not make decoders reject changes. 6.0.1-preview.35
+ * wrote 0 with this layout, so decoding accepts every version up to this one.
+ *
+ * Decoders in `@evolu/common` 8.17 and earlier ignore the version. A future
+ * layout must still make them fail, for example with a value they cannot
+ * decode, rather than let them decode wrong values.
+ */
+const encryptedDbChangeVersion = onePositiveInt;
 /**
  * Encodes and encrypts a {@link DbChange} using the provided owner's encryption
  * key. Returns an encrypted binary representation as {@link EncryptedDbChange}.
  *
- * The format includes the protocol version for backward compatibility and the
- * timestamp for tamper-proof verification that the timestamp matches the change
- * data.
+ * The plaintext starts with the format version of the change, which is
+ * independent of {@link protocolVersion}, and the timestamp, which proves that
+ * the change belongs to the timestamp it is sent with.
+ * {@link decryptAndDecodeDbChange} rejects a newer format version and accepts
+ * older ones.
  */
 export const encodeAndEncryptDbChange = (deps) => (message, key) => {
     const buffer = createBuffer();
@@ -1224,7 +1550,7 @@ export const encodeAndEncryptDbChange = (deps) => (message, key) => {
  * within it fits one protocol message.
  */
 export const encodeDbChange = (buffer, message) => {
-    encodeNonNegativeInt(buffer, protocolVersion);
+    encodeNonNegativeInt(buffer, encryptedDbChangeVersion);
     // Encode the timestamp to prevent tampering (e.g., a malicious relay
     // assigning this EncryptedDbChange to a different EncryptedCrdtMessage)
     buffer.extend(timestampToTimestampBytes(message.timestamp));
@@ -1239,8 +1565,9 @@ export const encodeDbChange = (buffer, message) => {
     const entries = objectToEntries(message.change.values);
     encodeLength(buffer, entries);
     for (const [column, value] of entries) {
-        assertNotUndefined(value);
         encodeString(buffer, column);
+        // DbChange validated every value as a SqliteValue; only its Partial record
+        // type admits undefined.
         encodeSqliteValue(buffer, value);
     }
 };
@@ -1248,20 +1575,23 @@ export const encodeDbChange = (buffer, message) => {
  * Decrypts and decodes an {@link EncryptedCrdtMessage} using the provided
  * owner's encryption key. Verifies that the embedded timestamp matches the
  * expected timestamp to ensure message integrity.
+ *
+ * A change with a newer format version than {@link encodeAndEncryptDbChange}
+ * writes is a {@link ProtocolInvalidDataError}.
  */
 export const decryptAndDecodeDbChange = (message, key) => {
     try {
         const buffer = createBuffer(message.change);
         const nonce = buffer.shiftN(xChaCha20Poly1305NonceLength);
         const ciphertext = buffer.shiftN(decodeLength(buffer));
-        const plaintextBytes = decryptWithXChaCha20Poly1305(XChaCha20Poly1305Ciphertext.orThrow(ciphertext), Entropy24.orThrow(nonce), key);
+        const plaintextBytes = decryptWithXChaCha20Poly1305(ciphertext, nonce, key);
         if (!plaintextBytes.ok)
             return plaintextBytes;
         buffer.reset();
         buffer.extend(plaintextBytes.value);
-        // Decode version (for future compatibility, not need yet)
-        decodeNonNegativeInt(buffer);
-        const timestamp = timestampBytesToTimestamp(TimestampBytes.orThrow(buffer.shiftN(timestampBytesLength)));
+        if (decodeNonNegativeInt(buffer) > encryptedDbChangeVersion)
+            throw new ProtocolDecodeError("Unsupported EncryptedDbChange version");
+        const timestamp = timestampBytesToTimestamp(buffer.shiftN(timestampBytesLength));
         if (!eqTimestamp(timestamp, message.timestamp)) {
             return err({
                 type: "ProtocolTimestampMismatchError",
@@ -1269,7 +1599,7 @@ export const decryptAndDecodeDbChange = (message, key) => {
                 timestamp,
             });
         }
-        const flags = decodeFlags(buffer, PositiveInt.orThrow(3));
+        const flags = decodeFlags(buffer, 3);
         const table = decodeString(buffer);
         const id = decodeId(buffer);
         const length = decodeLength(buffer);
@@ -1296,26 +1626,6 @@ export const decryptAndDecodeDbChange = (message, key) => {
         });
     }
 };
-/**
- * Decodes a ProtocolMessage into a readable JSON object for debugging.
- *
- * Note: This is a stub for future implementation. It should use:
- *
- * - DecodeVersionAndOwner
- * - DecodeError or decodeWriteKeys (depending on context)
- * - DecodeMessages
- * - DecodeRanges
- *
- * If you want to help, please contribute to this function.
- */
-export const decodeProtocolMessageToJson = (_protocolMessage, _isInitiator) => {
-    // TODO: Implement using
-    // - decodeVersionAndOwner
-    // -- decodeError or decodeWriteKeys (should be refactored out),
-    // -- decodeMessages, and decodeRanges.
-    // This is a stub for PRs and community contributions.
-    throw new Error("decodeProtocolMessageToJson is not implemented yet.");
-};
 // Small ints are encoded into ProtocolValueType, saving one byte per int.
 export const ProtocolValueType = {
     // 0-19 small ints
@@ -1363,7 +1673,7 @@ export const encodeSqliteValue = (buffer, value) => {
                 }
                 else {
                     encodeNonNegativeInt(buffer, ProtocolValueType.DateIsoWithNegativeTime);
-                    encodeNumber(buffer, FiniteNumber.orThrow(time));
+                    encodeNumber(buffer, time);
                 }
                 return;
             }
@@ -1376,7 +1686,7 @@ export const encodeSqliteValue = (buffer, value) => {
             const json = Json.from.parent(value);
             if (json.ok) {
                 const jsonValue = jsonToJsonValue(json.value);
-                jsonBuffer.reset();
+                const jsonBuffer = createBuffer();
                 try {
                     // Encoding first rejects nesting deeper than decoding allows, before
                     // the recursive JSON.stringify below could overflow the stack. Such
@@ -1398,9 +1708,6 @@ export const encodeSqliteValue = (buffer, value) => {
                     if (!(error instanceof BufferError))
                         throw error;
                 }
-                finally {
-                    jsonBuffer.reset();
-                }
             }
             const base64Url = Base64Url.from.parent(value);
             if (base64Url.ok) {
@@ -1410,6 +1717,10 @@ export const encodeSqliteValue = (buffer, value) => {
                 buffer.extend(bytes);
                 return;
             }
+            // encodeString replaces a lone surrogate with U+FFFD, so the bytes are
+            // always valid UTF-8. Encoding WTF-8 instead would make peers disagree:
+            // deployed decoders read a lone surrogate in WTF-8 as three U+FFFD,
+            // while a decoder that kept it would read the surrogate.
             encodeNonNegativeInt(buffer, ProtocolValueType.String);
             encodeString(buffer, value);
             return;
@@ -1485,5 +1796,4 @@ export const decodeSqliteValue = (buffer) => {
             throw new ProtocolDecodeError("invalid ProtocolValueType");
     }
 };
-const jsonBuffer = createBuffer();
 const isSmallInt = (value) => value >= 0 && value < 20;