@tldraw/sync-core 5.5.0-next.a2698a88ecfb → 5.5.0-next.b6a9f7cd7be2

package/src/lib/ClientWebSocketAdapter.test.ts

@@ -1,4 +1,4 @@
-import { warnOnce } from '@tldraw/utils'
+import { promiseWithResolve, warnOnce } from '@tldraw/utils'
 import { TLRecord, sleep } from 'tldraw'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -12,6 +12,7 @@ vi.mock('@tldraw/utils', async (importOriginal) => {
 // NOTE: setupVitest.js replaces the global WebSocket with the 'ws' package's WebSocket,
 // matching the WebSocketServer the tests connect to.
 import { WebSocketServer, WebSocket as WsWebSocket } from 'ws'
+import { MAX_ASSEMBLED_MESSAGE_CHARS } from './chunk'
 import {
 	ACTIVE_MAX_DELAY,
 	ACTIVE_MIN_DELAY,
@@ -73,24 +74,38 @@ describe('ClientWebSocketAdapter', () => {
 		connectedServerSocket = socket
 	})
 
+	// Bound per test on an OS-assigned port. A fixed port raced against the previous test's
+	// server, which closes asynchronously, and intermittently failed with EADDRINUSE.
+	let port: number
+
 	let consoleWarnSpy: ReturnType<typeof vi.spyOn>
-	beforeEach(() => {
+	beforeEach(async () => {
 		consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-		adapter = new ClientWebSocketAdapter(() => 'ws://localhost:2233')
-		wsServer = new WebSocketServer({ port: 2233 })
+		wsServer = new WebSocketServer({ port: 0 })
+		// Attach before the adapter exists: the server is already listening by the time the
+		// adapter is constructed, so a handler added afterwards can miss the first connection.
 		wsServer.on('connection', connectMock as any)
+		await new Promise<void>((resolve, reject) => {
+			wsServer.once('listening', resolve)
+			wsServer.once('error', reject)
+		})
+		port = (wsServer.address() as { port: number }).port
+		adapter = new ClientWebSocketAdapter(() => `ws://localhost:${port}`)
 	})
 
 	afterEach(() => {
 		consoleWarnSpy.mockRestore()
 		adapter.close()
+		// Not awaited: the next test binds its own OS-assigned port, so a server still closing
+		// here can't collide with it. Awaiting would deliver in-flight messages to the socket
+		// adapter.close() just orphaned.
 		wsServer.close()
 		connectMock.mockClear()
 	})
 
 	describe('connection and initial state (CW1, CW2)', () => {
 		it('[CW2] starts with connectionStatus offline while the internal status is initial', () => {
-			const newAdapter = new ClientWebSocketAdapter(() => 'ws://localhost:2233')
+			const newAdapter = new ClientWebSocketAdapter(() => `ws://localhost:${port}`)
 			try {
 				expect(newAdapter._connectionStatus.get()).toBe('initial')
 				expect(newAdapter.connectionStatus).toBe('offline')
@@ -113,7 +128,7 @@ describe('ClientWebSocketAdapter', () => {
 			let uriCallCount = 0
 			const dynamicAdapter = new ClientWebSocketAdapter(() => {
 				uriCallCount++
-				return `ws://localhost:2233?attempt=${uriCallCount}`
+				return `ws://localhost:${port}?attempt=${uriCallCount}`
 			})
 			try {
 				await waitFor(() => dynamicAdapter._ws?.readyState === WebSocket.OPEN)
@@ -143,7 +158,7 @@ describe('ClientWebSocketAdapter', () => {
 				// no socket can be created until the promise resolves
 				expect(asyncAdapter._ws).toBeNull()
 
-				resolveUri!('ws://localhost:2233')
+				resolveUri!(`ws://localhost:${port}`)
 
 				await waitFor(() => asyncAdapter._ws?.readyState === WebSocket.OPEN)
 				expect(asyncAdapter.connectionStatus).toBe('online')
@@ -301,7 +316,7 @@ describe('ClientWebSocketAdapter', () => {
 
 	describe('URI conversion (CW1)', () => {
 		it('[CW1] converts http URIs to ws and connects', async () => {
-			const httpAdapter = new ClientWebSocketAdapter(() => 'http://localhost:2233')
+			const httpAdapter = new ClientWebSocketAdapter(() => `http://localhost:${port}`)
 			try {
 				await waitFor(() => httpAdapter._ws?.readyState === WebSocket.OPEN)
 				expect(httpAdapter._ws!.url).toMatch(/^ws:\/\//)
@@ -312,7 +327,7 @@ describe('ClientWebSocketAdapter', () => {
 		})
 
 		it('[CW1] converts https URIs to wss', async () => {
-			const httpsAdapter = new ClientWebSocketAdapter(() => 'https://localhost:2233')
+			const httpsAdapter = new ClientWebSocketAdapter(() => `https://localhost:${port}`)
 			try {
 				await waitFor(() => httpsAdapter._ws !== null)
 				expect(httpsAdapter._ws!.url).toMatch(/^wss:\/\//)
@@ -386,6 +401,32 @@ describe('ClientWebSocketAdapter', () => {
 			)
 		})
 
+		it('[CW6] refuses to send a message the server would reject as too large', async () => {
+			const onMessage = vi.fn()
+			connectMock.mockImplementationOnce((ws: any) => {
+				ws.on('message', onMessage)
+			})
+			await waitFor(() => adapter._ws?.readyState === WebSocket.OPEN)
+
+			const onStatusChange = vi.fn()
+			adapter.onStatusChange(onStatusChange)
+
+			const message = {
+				...connectMessage(),
+				largeData: 'x'.repeat(MAX_ASSEMBLED_MESSAGE_CHARS),
+			} as any
+			adapter.sendMessage(message)
+
+			// nothing goes on the wire: sending would only earn a close and a reconnect that
+			// re-sends the same message
+			expect(onMessage).not.toHaveBeenCalled()
+			expect(adapter.connectionStatus).toBe('error')
+			expect(onStatusChange).toHaveBeenCalledWith({
+				status: 'error',
+				reason: TLSyncErrorCloseEventReason.MESSAGE_TOO_LARGE,
+			})
+		})
+
 		it('[CW6] silently drops the message when there is no socket', async () => {
 			await waitFor(() => adapter._ws?.readyState === WebSocket.OPEN)
 
@@ -527,6 +568,46 @@ describe('ClientWebSocketAdapter', () => {
 			adapter.close()
 			expect(() => adapter.close()).not.toThrow()
 		})
+
+		it('[CW9][RM5] closing immediately does not start another getUri call', async () => {
+			const getUri = vi.fn(() => `ws://localhost:${port}`)
+			const testAdapter = new ClientWebSocketAdapter(getUri)
+			testAdapter.close()
+			const callsAtClose = getUri.mock.calls.length
+
+			await vi.advanceTimersByTimeAsync(INACTIVE_MAX_DELAY)
+
+			expect(getUri).toHaveBeenCalledTimes(callsAtClose)
+			expect(testAdapter._ws).toBeNull()
+		})
+
+		it('[CW9][RM5] close reports offline without notifying listeners or reconnecting', async () => {
+			let uriCallCount = 0
+			const testAdapter = new ClientWebSocketAdapter(() => {
+				uriCallCount++
+				return `ws://localhost:${port}`
+			})
+			const onStatusChange = vi.fn()
+			testAdapter.onStatusChange(onStatusChange)
+			await waitFor(() => testAdapter._ws?.readyState === WebSocket.OPEN)
+			const callsBeforeClose = uriCallCount
+			onStatusChange.mockClear()
+
+			testAdapter.close()
+			expect(testAdapter.connectionStatus).toBe('offline')
+			// let the socket's own close event land, then run out any (leaked) reconnect timer
+			vi.useRealTimers()
+			await sleep(50)
+			vi.useFakeTimers()
+			vi.advanceTimersByTime(INACTIVE_MAX_DELAY)
+			vi.useRealTimers()
+			await sleep(20)
+			vi.useFakeTimers()
+
+			expect(onStatusChange).not.toHaveBeenCalled()
+			expect(uriCallCount).toBe(callsBeforeClose)
+			expect(testAdapter._ws).toBeNull()
+		})
 	})
 
 	describe('orphaned sockets (CW10)', () => {
@@ -566,17 +647,26 @@ describe('ReconnectManager', () => {
 		connectedServerSocket = socket
 	})
 
+	// See the note on the other suite's port: bound per test on an OS-assigned port.
+	let port: number
+
 	let consoleWarnSpy: ReturnType<typeof vi.spyOn>
-	beforeEach(() => {
+	beforeEach(async () => {
 		consoleWarnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-		adapter = new ClientWebSocketAdapter(() => 'ws://localhost:2234')
-		wsServer = new WebSocketServer({ port: 2234 })
+		wsServer = new WebSocketServer({ port: 0 })
 		wsServer.on('connection', connectMock as any)
+		await new Promise<void>((resolve, reject) => {
+			wsServer.once('listening', resolve)
+			wsServer.once('error', reject)
+		})
+		port = (wsServer.address() as { port: number }).port
+		adapter = new ClientWebSocketAdapter(() => `ws://localhost:${port}`)
 	})
 
 	afterEach(() => {
 		consoleWarnSpy.mockRestore()
 		adapter.close()
+		// Not awaited - see the note on the other suite's teardown.
 		wsServer.close()
 		connectMock.mockClear()
 	})
@@ -591,7 +681,7 @@ describe('ReconnectManager', () => {
 	})
 
 	it('[RM1] reconnection delays back off exponentially, bounded by the active delays', () => {
-		const testAdapter = new ClientWebSocketAdapter(() => 'ws://localhost:2234')
+		const testAdapter = new ClientWebSocketAdapter(() => `ws://localhost:${port}`)
 		try {
 			const manager = testAdapter._reconnectManager
 			// make every disconnected() call take the "attempt now" branch
@@ -616,7 +706,7 @@ describe('ReconnectManager', () => {
 
 	it('[RM1] uses the inactive delay bounds when the tab is hidden', () => {
 		const hiddenMock = vi.spyOn(document, 'hidden', 'get').mockReturnValue(true)
-		const testAdapter = new ClientWebSocketAdapter(() => 'ws://localhost:2234')
+		const testAdapter = new ClientWebSocketAdapter(() => `ws://localhost:${port}`)
 		try {
 			const manager = testAdapter._reconnectManager
 			;(manager as any).lastAttemptStart = Date.now() - 1_000_000
@@ -710,7 +800,7 @@ describe('ReconnectManager', () => {
 		// it's necessary to close the socket, as otherwise the websocket might stay half-open
 		connectedServerSocket.close()
 		wsServer.close()
-		await waitFor(() => adapter._ws?.readyState !== WebSocket.OPEN)
+		await waitFor(() => adapter.connectionStatus === 'offline')
 		expect(adapter._reconnectManager.intendedDelay).toBeGreaterThanOrEqual(INACTIVE_MIN_DELAY)
 
 		hiddenMock.mockReturnValue(false)
@@ -776,8 +866,34 @@ describe('ReconnectManager', () => {
 		expect(adapter._ws).toBeNull()
 	})
 
+	it.each(['throws', 'rejects'])(
+		'[RM1][CW1] getUri that %s is retried on the backoff instead of stranding the connection',
+		async (failure) => {
+			const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+			let attempts = 0
+			const testAdapter = new ClientWebSocketAdapter(() => {
+				attempts++
+				if (attempts < 3) {
+					const error = new Error('token endpoint unavailable')
+					if (failure === 'throws') throw error
+					return Promise.reject(error)
+				}
+				return `ws://localhost:${port}`
+			})
+			try {
+				await waitFor(() => testAdapter._ws?.readyState === WebSocket.OPEN)
+				expect(attempts).toBe(3)
+				expect(consoleErrorSpy).toHaveBeenCalledTimes(2)
+				expect(testAdapter.connectionStatus).toBe('online')
+			} finally {
+				testAdapter.close()
+				consoleErrorSpy.mockRestore()
+			}
+		}
+	)
+
 	it('[RM5] close cancels timers and removes the reconnect event listeners', () => {
-		const testAdapter = new ClientWebSocketAdapter(() => 'ws://localhost:2234')
+		const testAdapter = new ClientWebSocketAdapter(() => `ws://localhost:${port}`)
 		const manager = testAdapter._reconnectManager
 
 		testAdapter.close()
@@ -794,3 +910,61 @@ describe('ReconnectManager', () => {
 		expect(() => manager.close()).not.toThrow()
 	})
 })
+
+describe('URI failure boundaries', () => {
+	// These tests never open a real socket - the adapter is closed first, or the socket is a
+	// mock - so the URI only has to parse. No server, hence no port to bind.
+	const UNUSED_URI = 'ws://localhost:1'
+
+	it.each(['resolves', 'rejects'])('ignores getUri that %s after close', async (outcome) => {
+		const uri = promiseWithResolve<string>()
+		const getUri = vi.fn(() => uri)
+		const testAdapter = new ClientWebSocketAdapter(getUri)
+		const onStatusChange = vi.fn()
+		testAdapter.onStatusChange(onStatusChange)
+		const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+		try {
+			await Promise.resolve()
+			testAdapter.close()
+			if (outcome === 'resolves') uri.resolve(UNUSED_URI)
+			else uri.reject(new Error('token endpoint unavailable'))
+			await vi.advanceTimersByTimeAsync(INACTIVE_MAX_DELAY)
+
+			expect(getUri).toHaveBeenCalledTimes(1)
+			expect(testAdapter._ws).toBeNull()
+			expect(testAdapter.connectionStatus).toBe('offline')
+			expect(onStatusChange).not.toHaveBeenCalled()
+			expect(consoleError).not.toHaveBeenCalled()
+		} finally {
+			testAdapter.close()
+			consoleError.mockRestore()
+		}
+	})
+
+	it.each([
+		{ uri: 'not a URL', openSocket: false, error: 'Invalid URL' },
+		{
+			uri: UNUSED_URI,
+			openSocket: true,
+			error: 'There should be no connection attempts while already connected',
+		},
+	])('does not treat $error as a getUri failure', async ({ uri, openSocket, error }) => {
+		let nextUri: string | Promise<string> = new Promise(() => {})
+		const testAdapter = new ClientWebSocketAdapter(() => nextUri)
+		const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+		try {
+			await Promise.resolve()
+			nextUri = uri
+			if (openSocket) testAdapter._ws = mockSocket(WebSocket.OPEN)
+
+			const manager = testAdapter._reconnectManager as unknown as {
+				scheduleAttempt(): Promise<void>
+			}
+			await expect(manager.scheduleAttempt()).rejects.toThrow(error)
+			expect(consoleError).not.toHaveBeenCalled()
+		} finally {
+			testAdapter.close()
+			consoleError.mockRestore()
+		}
+	})
+})

package/src/lib/ClientWebSocketAdapter.ts

@@ -1,7 +1,7 @@
 import { atom, Atom } from '@tldraw/state'
 import { TLRecord } from '@tldraw/tlschema'
 import { assert, warnOnce } from '@tldraw/utils'
-import { chunk } from './chunk'
+import { chunk, MAX_ASSEMBLED_MESSAGE_CHARS } from './chunk'
 import { TLSocketClientSentEvent, TLSocketServerSentEvent } from './protocol'
 import {
 	TLPersistentClientSocket,
@@ -93,8 +93,13 @@ export class ClientWebSocketAdapter implements TLPersistentClientSocket<
 	close() {
 		this.isDisposed = true
 		this._reconnectManager.close()
+		// orphan the socket before closing it (as _closeSocket does) so its onclose can't run
+		// _handleDisconnect after disposal — that would notify listeners and schedule a reconnect
+		const ws = this._ws
+		this._ws = null
 		//  WebSocket.close() is idempotent
-		this._ws?.close()
+		ws?.close()
+		this._connectionStatus.set('offline')
 	}
 
 	/**
@@ -240,8 +245,6 @@ export class ClientWebSocketAdapter implements TLPersistentClientSocket<
 		this._handleDisconnect('manual')
 	}
 
-	// TLPersistentClientSocket stuff
-
 	_connectionStatus: Atom<TLPersistentClientSocketStatus | 'initial'> = atom(
 		'websocket connection status',
 		'initial'
@@ -277,7 +280,20 @@ export class ClientWebSocketAdapter implements TLPersistentClientSocket<
 
 		if (!this._ws) return
 		if (this.connectionStatus === 'online') {
-			const chunks = chunk(JSON.stringify(msg))
+			const stringified = JSON.stringify(msg)
+			// The server rejects a session whose assembled message exceeds this, so sending would
+			// only earn a close and a reconnect that re-sends the same message. Fail here the way
+			// the server would, so onSyncError runs once instead of the client looping forever.
+			if (stringified.length > MAX_ASSEMBLED_MESSAGE_CHARS) {
+				this._handleDisconnect(
+					'closed',
+					TLSyncErrorCloseEventCode,
+					true,
+					TLSyncErrorCloseEventReason.MESSAGE_TOO_LARGE
+				)
+				return
+			}
+			const chunks = chunk(stringified)
 			for (const part of chunks) {
 				this._ws.send(part)
 			}
@@ -513,21 +529,33 @@ export class ReconnectManager {
 		}
 	}
 
-	private scheduleAttempt() {
+	private async scheduleAttempt() {
 		assert(this.state === 'pendingAttempt')
+		if (this.isDisposed) return
 		debug('scheduling a connection attempt')
-		Promise.resolve(this.getUri()).then((uri) => {
-			// this can happen if the promise gets resolved too late
+
+		let uri: string
+		try {
+			uri = await this.getUri()
+		} catch (error) {
+			// A failed auth-token fetch must retry instead of leaving us with no socket or timer.
 			if (this.state !== 'pendingAttempt' || this.isDisposed) return
-			assert(
-				this.socketAdapter._ws?.readyState !== WebSocket.OPEN,
-				'There should be no connection attempts while already connected'
-			)
+			console.error('Failed to get the websocket URI, retrying', error)
+			this.state = 'delay'
+			this.reconnectTimeout = setTimeout(() => this.disconnected(), this.intendedDelay)
+			return
+		}
 
-			this.lastAttemptStart = Date.now()
-			this.socketAdapter._setNewSocket(new WebSocket(httpToWs(uri)))
-			this.state = 'pendingAttemptResult'
-		})
+		// this can happen if the promise gets resolved too late
+		if (this.state !== 'pendingAttempt' || this.isDisposed) return
+		assert(
+			this.socketAdapter._ws?.readyState !== WebSocket.OPEN,
+			'There should be no connection attempts while already connected'
+		)
+
+		this.lastAttemptStart = Date.now()
+		this.socketAdapter._setNewSocket(new WebSocket(httpToWs(uri)))
+		this.state = 'pendingAttemptResult'
 	}
 
 	private getMaxDelay() {
@@ -641,6 +669,7 @@ export class ReconnectManager {
 		debug('ReconnectManager.disconnected')
 		// This either means we're freshly disconnected, or the last connection attempt failed;
 		// either way, time to try again.
+		if (this.isDisposed) return
 
 		// Guard against delayed notifications and recheck synchronously
 		if (

package/src/lib/InMemorySyncStorage.test.ts

@@ -51,6 +51,27 @@ describe('InMemorySyncStorage', () => {
 			expect(storage.getClock()).toBe(25)
 		})
 
+		it('[IM1] handles snapshots with far more records and tombstones than fit in a spread call', () => {
+			const documents = []
+			for (let i = 0; i < 150_000; i++) {
+				documents.push({
+					state: { ...contractRecords[0], id: `shape:${i}` } as TLRecord,
+					lastChangedClock: i,
+				})
+			}
+			const tombstones: Record<string, number> = {}
+			for (let i = 0; i < 150_000; i++) tombstones[`shape:gone-${i}`] = 150_000 + i
+			const storage = new InMemorySyncStorage<TLRecord>({
+				snapshot: makeContractSnapshot(contractRecords, {
+					documents,
+					tombstones,
+					documentClock: 0,
+					tombstoneHistoryStartsAtClock: 0,
+				}),
+			})
+			expect(storage.getClock()).toBe(299_999)
+		})
+
 		it('[IM2] clamps tombstoneHistoryStartsAtClock down to the document clock', () => {
 			const storage = new InMemorySyncStorage<TLRecord>({
 				snapshot: makeContractSnapshot(contractRecords, {

package/src/lib/InMemorySyncStorage.ts

@@ -153,27 +153,27 @@ export class InMemorySyncStorage<R extends UnknownRecord> implements TLSyncStora
 		onChange?(arg: TLSyncStorageOnChangeCallbackProps): unknown
 	} = {}) {
 		this.objectTypes = new Set(objectTypes ?? [])
-		const maxClockValue = Math.max(
-			0,
-			...Object.values(snapshot.tombstones ?? {}),
-			...Object.values(snapshot.documents.map((d) => d.lastChangedClock))
-		)
+		// a loop rather than `Math.max(0, ...clocks)`: spreading a large room's clocks as call
+		// arguments overflows the stack at roughly 100k+ records/tombstones
+		let maxClockValue = 0
 		// route snapshot entries into their partitions (a seed snapshot may carry object-lane
 		// records merged in, e.g. loaded from a separate persistence lane)
-		const toEntry = (
-			d: RoomSnapshot['documents'][number]
-		): [string, { state: R; lastChangedClock: number }] => [
-			d.state.id,
-			{ state: devFreeze(d.state) as R, lastChangedClock: d.lastChangedClock },
-		]
-		this.documents = new AtomMap(
-			'room documents',
-			snapshot.documents.filter((d) => !this.objectTypes.has(d.state.typeName)).map(toEntry)
-		)
-		this.objects = new AtomMap(
-			'room objects',
-			snapshot.documents.filter((d) => this.objectTypes.has(d.state.typeName)).map(toEntry)
-		)
+		const documentEntries: [string, { state: R; lastChangedClock: number }][] = []
+		const objectEntries: [string, { state: R; lastChangedClock: number }][] = []
+		for (const d of snapshot.documents) {
+			if (d.lastChangedClock > maxClockValue) maxClockValue = d.lastChangedClock
+			const entries = this.objectTypes.has(d.state.typeName) ? objectEntries : documentEntries
+			entries.push([
+				d.state.id,
+				{ state: devFreeze(d.state) as R, lastChangedClock: d.lastChangedClock },
+			])
+		}
+		const tombstoneEntries = objectMapEntries(snapshot.tombstones ?? {})
+		for (const [, clock] of tombstoneEntries) {
+			if (clock > maxClockValue) maxClockValue = clock
+		}
+		this.documents = new AtomMap('room documents', documentEntries)
+		this.objects = new AtomMap('room objects', objectEntries)
 		const documentClock = Math.max(maxClockValue, snapshot.documentClock ?? snapshot.clock ?? 0)
 
 		this.documentClock = atom('document clock', documentClock)
@@ -192,9 +192,7 @@ export class InMemorySyncStorage<R extends UnknownRecord> implements TLSyncStora
 			'room tombstones',
 			// If the tombstone history starts now (or we didn't have the
 			// tombstoneHistoryStartsAtClock) then there are no tombstones
-			tombstoneHistoryStartsAtClock === documentClock
-				? []
-				: objectMapEntries(snapshot.tombstones ?? {})
+			tombstoneHistoryStartsAtClock === documentClock ? [] : tombstoneEntries
 		)
 		if (onChange) {
 			this.onChange(onChange)

package/src/lib/SQLiteSyncStorage.test.ts

@@ -1,7 +1,7 @@
 import { DatabaseSync } from 'node:sqlite'
 import { DocumentRecordType, PageRecordType, TLDOCUMENT_ID, TLRecord } from '@tldraw/tlschema'
 import { ZERO_INDEX_KEY } from '@tldraw/utils'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import {
 	contractRecords,
 	contractSchema,
@@ -9,6 +9,7 @@ import {
 	makePage,
 	registerStorageContractTests,
 } from '../test/storageContractSuite'
+import { MAX_TOMBSTONES } from './InMemorySyncStorage'
 import { NodeSqliteWrapper } from './NodeSqliteWrapper'
 import { SQLiteSyncStorage } from './SQLiteSyncStorage'
 
@@ -263,4 +264,62 @@ describe('SQLiteSyncStorage', () => {
 			expect(row?.migrationVersion).toBe(3)
 		})
 	})
+
+	describe('tombstone pruning robustness', () => {
+		const makeTombstones = (count: number) => {
+			const tombstones: Record<string, number> = {}
+			for (let i = 0; i < count; i++) tombstones[`shape:doc${i}`] = i + 1
+			return tombstones
+		}
+		function makeOverfullStorage() {
+			const db = new DatabaseSync(':memory:')
+			const storage = new SQLiteSyncStorage<TLRecord>({
+				sql: new NodeSqliteWrapper(db),
+				snapshot: makeContractSnapshot(contractRecords, {
+					tombstones: makeTombstones(MAX_TOMBSTONES + 500),
+					documentClock: MAX_TOMBSTONES + 501,
+					tombstoneHistoryStartsAtClock: 0,
+				}),
+			})
+			return { db, storage, prune: (storage as any).pruneTombstones as { (): void; flush(): void } }
+		}
+
+		it('[SS18] a prune that fires after the database was closed does not throw', () => {
+			const { db, storage, prune } = makeOverfullStorage()
+			const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+			try {
+				// a delete schedules the throttled prune; the host then closes everything
+				storage.transaction((txn) => txn.delete(contractRecords[1].id))
+				db.close()
+				// the throttle timer fires later, from outside any caller that could catch it
+				expect(() => prune.flush()).not.toThrow()
+				expect(consoleSpy).toHaveBeenCalledWith('Failed to prune tombstones', expect.anything())
+			} finally {
+				consoleSpy.mockRestore()
+			}
+		})
+
+		it('[SS18] a prune whose delete fails leaves the history clock where it was', () => {
+			const { storage, prune } = makeOverfullStorage()
+			const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+			try {
+				const stmts = (storage as any).stmts
+				const originalRun = stmts.deleteTombstonesBefore.run
+				stmts.deleteTombstonesBefore.run = () => {
+					throw new Error('SQLITE_BUSY: database is locked')
+				}
+				prune()
+				expect(() => prune.flush()).not.toThrow()
+				stmts.deleteTombstonesBefore.run = originalRun
+
+				// neither half of the prune applied: the history start was not advanced past
+				// tombstones that still exist
+				const snapshot = storage.getSnapshot()
+				expect(snapshot.tombstoneHistoryStartsAtClock).toBe(0)
+				expect(Object.keys(snapshot.tombstones!).length).toBe(MAX_TOMBSTONES + 500)
+			} finally {
+				consoleSpy.mockRestore()
+			}
+		})
+	})
 })

package/src/lib/SQLiteSyncStorage.ts

@@ -394,7 +394,6 @@ export class SQLiteSyncStorage<R extends UnknownRecord> implements TLSyncStorage
 			const documentClock = snapshot.documentClock ?? snapshot.clock ?? 0
 			const tombstoneHistoryStartsAtClock = snapshot.tombstoneHistoryStartsAtClock ?? documentClock
 
-			// Clear existing data
 			this.sql.exec(`
 				DELETE FROM ${documentsTable};
 				DELETE FROM ${objectsTable};
@@ -410,14 +409,12 @@ export class SQLiteSyncStorage<R extends UnknownRecord> implements TLSyncStorage
 				table.insert.run(doc.state.id, encodeState(doc.state), doc.lastChangedClock)
 			}
 
-			// Insert tombstones
 			if (snapshot.tombstones) {
 				for (const [id, clock] of objectMapEntries(snapshot.tombstones)) {
 					this.stmts.insertTombstone.run(id, clock)
 				}
 			}
 
-			// Insert metadata row
 			this.stmts.updateMetadata.run(
 				documentClock,
 				tombstoneHistoryStartsAtClock,
@@ -513,18 +510,29 @@ export class SQLiteSyncStorage<R extends UnknownRecord> implements TLSyncStorage
 	/** @internal */
 	pruneTombstones = throttle(
 		() => {
-			const tombstoneCount = this.stmts.countTombstones.all()[0].count as number
-			if (tombstoneCount > MAX_TOMBSTONES) {
-				// Get all tombstones sorted by clock ascending (oldest first)
-				const tombstones = this.stmts.iterateTombstones.all()
-
-				const result = computeTombstonePruning({ tombstones, documentClock: this.getClock() })
-				if (result) {
-					this.stmts.setTombstoneHistoryStartsAtClock.run(result.newTombstoneHistoryStartsAtClock)
-					// Delete all tombstones with clock < newTombstoneHistoryStartsAtClock in one operation.
-					// This works because computeTombstonePruning ensures we never split a clock value.
-					this.stmts.deleteTombstonesBefore.run(result.newTombstoneHistoryStartsAtClock)
+			// Runs from a timer, so a host that closed the database right after the last delete
+			// (e.g. `room.close(); db.close()` in onSessionRemoved) would otherwise get an uncaught
+			// throw from here; pruning is best-effort and simply runs again on the next delete.
+			try {
+				const tombstoneCount = this.stmts.countTombstones.all()[0].count as number
+				if (tombstoneCount > MAX_TOMBSTONES) {
+					// Get all tombstones sorted by clock ascending (oldest first)
+					const tombstones = this.stmts.iterateTombstones.all()
+
+					const result = computeTombstonePruning({ tombstones, documentClock: this.getClock() })
+					if (result) {
+						this.sql.transaction(() => {
+							this.stmts.setTombstoneHistoryStartsAtClock.run(
+								result.newTombstoneHistoryStartsAtClock
+							)
+							// Delete all tombstones with clock < newTombstoneHistoryStartsAtClock in one operation.
+							// This works because computeTombstonePruning ensures we never split a clock value.
+							this.stmts.deleteTombstonesBefore.run(result.newTombstoneHistoryStartsAtClock)
+						})
+					}
 				}
+			} catch (e) {
+				console.error('Failed to prune tombstones', e)
 			}
 		},
 		1000,