edytor 0.1.0-next.21 → 0.1.0-next.23

package/dist/cloudflare/DocumentRoom.js

@@ -34,8 +34,9 @@
  *   what storage does not.
  * - every INTEGRATED update is appended to SQLite as one record split into
  *   rows ≤ `maxRowBytes` (2 MB row cap) in one `transactionSync`, then
- *   broadcast; after `compactAfter` update records the rows are merged
- *   (`mergeUpdates`) into one snapshot record, after the message is
+ *   broadcast; after `compactAfter` update records the rows are replaced
+ *   by one snapshot record of the live document's state (its healed
+ *   state, deleted content collected: P2), after the message is
  *   acknowledged — never inside the engine's `update` observer, where one
  *   throw would silence every later emit. Memory never runs ahead of
  *   storage: when an append fails, nothing is relayed or acknowledged, the
@@ -51,6 +52,11 @@
  *   left out of the ack), the rest applied. Compaction reclaims the
  *   waiting deletes of client ids no user registered and no socket holds;
  *   `dropWaitingDeletes()` every one.
+ * - storage format (P5): the generation record says `storage: 'v2'` —
+ *   snapshots in the v2 encoding, compressed in place after they are
+ *   stored (`compressLater`), inflated at start (`inflate`); update and
+ *   pending records stay v1. A container without `storage` (0.1.0-next.22)
+ *   is all v1, and its next compaction rewrites it.
  * - a Step2 serves the STORED state: the engine's pending structs (waiting
  *   for a dependency, never stored) are not served.
  * - a frame larger than `maxFrameBytes` (32 MiB) goes out as chunks the
@@ -92,8 +98,10 @@ import * as encoding from 'lib0-v14/encoding';
 import { Y } from '../crdt/engine.js';
 import * as E from '../crdt/index.js';
 import { READ_ONLY_DENIAL } from '../crdt/protocols/auth.js';
-import { isGenerationRecord } from '../crdt/protocols/envelope.js';
-import { CLOSE } from '../crdt/providers/room.js';
+import { isGenerationRecord, STORED_GENERATION_RECORD, storageOf } from '../crdt/protocols/envelope.js';
+import { gunzip, isGzip, packed } from '../crdt/storage.js';
+import { DEL_PREFIX, REGISTRY_KEY, WITHDRAW_PREFIX } from '../crdt/schema.js';
+import { ChunkLimitError, ChunkSequenceError, CLOSE } from '../crdt/providers/room.js';
 const crdt = E.bindCrdt(Y);
 const sync = crdt.sync;
 /** Under SQLite-backed Durable Objects' 2 MB row cap, with room for the other columns. */
@@ -102,6 +110,26 @@ export const DEFAULT_MAX_ROW_BYTES = 2_000_000 - 4096;
 export const DEFAULT_COMPACT_AFTER = 500;
 /** ms between the first unsaved change and `onSave`. */
 export const DEFAULT_SAVE_AFTER = 2000;
+/**
+ * Room quotas (H3), each refused with `4413` (`quota: <name>`). The
+ * document's size: what its records hold (uncompressed) and the updates the
+ * engine holds waiting — the live document holds about that, several
+ * times over in memory for text (an isolate has 128 MB). Raise or lower
+ * it for your documents.
+ */
+export const DEFAULT_MAX_DOCUMENT_BYTES = 64 * 1024 * 1024;
+/** The largest frame a socket may send, reassembled from chunks (the platform caps one message at 32 MiB). */
+export const DEFAULT_MAX_INBOUND_FRAME_BYTES = 64 * 1024 * 1024;
+/**
+ * Sync messages a socket may send per second, sustained; a burst of ten
+ * seconds' worth is allowed (a reconnect, a paste). Far above typing
+ * speed: a script should batch its edits into transactions.
+ */
+export const DEFAULT_MAX_UPDATES_PER_SECOND = 50;
+/** Seconds of the update rate a socket may spend at once. */
+const BURST_SECONDS = 10;
+/** The ceiling of a quota knob (a host may raise the defaults up to it). */
+const QUOTA_CEILING = 2 ** 40;
 /** Longest wait between the save alarms of a room that cannot read its rows. */
 const MAX_SAVE_RETRY = 5 * 60_000;
 /**
@@ -112,6 +140,8 @@ const MAX_SAVE_RETRY = 5 * 60_000;
 export const MAX_WAITING_DELETES = 1024;
 /** Refusals kept in `refusals` (the newest); `refusalCounts` counts every one. */
 export const MAX_REFUSALS = 100;
+/** The header `routeDocumentSocket` sets on an authorized `lastUpdated` probe (H12). */
+export const PROBE_HEADER = 'X-Edytor-Probe';
 /** The transaction origin of the room's own edits (`transact`, `onLoad` seeds). */
 export const ROOM_ORIGIN = Symbol('edytor-room');
 /**
@@ -125,6 +155,16 @@ export const IDENTITY_HEADERS = {
     replica: 'X-Edytor-Replica',
     access: 'X-Edytor-Access'
 };
+const now = () => typeof performance !== 'undefined' && typeof performance.now === 'function'
+    ? performance.now()
+    : Date.now();
+const timing = () => ({ count: 0, totalMs: 0, maxMs: 0, lastMs: 0 });
+const tally = (t, ms) => {
+    t.count++;
+    t.totalMs += ms;
+    t.maxMs = Math.max(t.maxMs, ms);
+    t.lastMs = ms;
+};
 /**
  * An upgrade accepted and closed at once, so the client reads `code`: a
  * browser sees an HTTP error at the upgrade only as `1006`, which a
@@ -145,10 +185,16 @@ class MalformedFrame extends Error {
 /** A SQLite fault outside the append path (the replica registry). */
 class StorageFault extends Error {
 }
-/** A stored record missing some of its rows: the container is corrupt, not the read. */
+/** A stored record missing some of its rows, or one that does not inflate: the container is corrupt, not the read. */
 class TornRecord extends Error {
+    constructor(detail = 'torn record') {
+        super(detail);
+    }
+}
+/** A compressed record this instance has not inflated (only `start` can): the next dial reads it again. */
+class CompressedRecord extends Error {
     constructor() {
-        super('torn record');
+        super('compressed record not inflated');
     }
 }
 /** Decode the client's bytes: a throw is theirs (`malformed`), not the room's. */
@@ -417,6 +463,28 @@ const unheldDeletes = ({ structs, ds }, stripped, doc) => {
     }
     return unheld;
 };
+/** The content `ds` deletes of what `doc` holds live (an item's length: characters, atoms). */
+const freedBy = (doc, ds) => {
+    let freed = 0;
+    for (const [client, ranges] of ds.clients) {
+        const structs = doc.store.clients.get(client) ?? [];
+        const stored = heldClock(doc, client);
+        for (const { clock, len } of ranges.getIds()) {
+            if (clock >= stored)
+                continue;
+            for (let i = Y.findIndexSS(structs, clock); i < structs.length; i++) {
+                const struct = structs[i];
+                if (struct.id.clock >= clock + len)
+                    break;
+                if (struct.deleted || struct instanceof Y.Skip)
+                    continue;
+                freed +=
+                    Math.min(clock + len, struct.id.clock + struct.length) - Math.max(clock, struct.id.clock);
+            }
+        }
+    }
+    return freed;
+};
 /** How many ranges `ids` holds. */
 const rangeCount = (ids) => {
     let count = 0;
@@ -449,6 +517,27 @@ const addIds = (into, from, keep = () => true) => {
     }
     return into;
 };
+/** Rows grouped into their records, in write order; a record missing rows throws. */
+const reassemble = (rows) => {
+    const byRecord = new Map();
+    for (const row of rows) {
+        const parts = byRecord.get(row.record) ?? [];
+        parts.push(row);
+        byRecord.set(row.record, parts);
+    }
+    return [...byRecord.values()].map((parts) => {
+        if (parts.length !== parts[0].parts)
+            throw new TornRecord();
+        parts.sort((a, b) => a.part - b.part);
+        const bytes = new Uint8Array(parts.reduce((n, p) => n + p.bytes.byteLength, 0));
+        let at = 0;
+        for (const part of parts) {
+            bytes.set(new Uint8Array(part.bytes), at);
+            at += part.bytes.byteLength;
+        }
+        return { kind: parts[0].kind, record: parts[0].record, bytes };
+    });
+};
 /** The deletes of the `pending` records among `records`. */
 const storedPending = (records) => {
     const pending = records.filter((record) => record.kind === 'pending');
@@ -504,19 +593,195 @@ const heldIds = (doc, ds, deleted = false) => {
  * that replaces it).
  */
 const heldDeletes = (doc, ds) => heldIds(doc, ds, true);
-/** A Step2 of what the room STORED: the engine's pending store (never stored) is left out. */
-const storedStep2 = (doc, sv) => {
+/**
+ * `read` with the engine's pending store set aside: what waits for a
+ * dependency (structs, deletes of items it lacks) is never part of the
+ * stored state — waiting deletes are stored apart, as `pending` records.
+ */
+const withoutPending = (doc, read) => {
     const { store } = doc;
     const held = [store.pendingStructs, store.pendingDs];
     store.pendingStructs = null;
     store.pendingDs = null;
     try {
-        return E.frame(E.messageSync, (e) => sync.writeSyncStep2(e, doc, sv));
+        return read();
     }
     finally {
         [store.pendingStructs, store.pendingDs] = held;
     }
 };
+/** A Step2 of what the room STORED: the engine's pending store (never stored) is left out. */
+const storedStep2 = (doc, sv) => withoutPending(doc, () => E.frame(E.messageSync, (e) => sync.writeSyncStep2(e, doc, sv)));
+/**
+ * The live document as one update (P2): its healed state — the engine
+ * merged what each keystroke wrote and collected deleted content, sparing
+ * the text a replica may copy again (`keepCopies`, P11) —, without what
+ * waits (`withoutPending`). Memory never runs ahead of storage, so it
+ * holds exactly what the stored records hold, collected.
+ */
+const liveState = (doc) => withoutPending(doc, () => Y.encodeStateAsUpdateV2(doc));
+/** A fresh room document: it keeps what an editing replica keeps (P11). */
+const roomDoc = () => {
+    const doc = crdt.createDoc();
+    crdt.doc.keepCopies(doc);
+    return doc;
+};
+/** Admit stored or loaded updates into a room document (`roomDoc`'s collection rules). */
+const admit = (updates, name) => crdt.admission.admitUpdate(updates, name, {
+    prepare: (doc) => crdt.doc.keepCopies(doc)
+});
+// ── Per-writer marks (H2) ──────────────────────────────────────────
+/** The writer `n` of a per-writer block mark key (`del.<n>`, `wd.<n>`), or `null`. */
+const markWriter = (key) => {
+    if (typeof key !== 'string')
+        return null;
+    const prefix = key.startsWith(DEL_PREFIX)
+        ? DEL_PREFIX
+        : key.startsWith(WITHDRAW_PREFIX)
+            ? WITHDRAW_PREFIX
+            : null;
+    const digits = prefix === null ? '' : key.slice(prefix.length);
+    return /^\d{1,16}$/.test(digits) ? Number(digits) : null;
+};
+/** A frame's structs by client, each run in clock order. */
+const runsOf = (structs) => {
+    const runs = new Map();
+    for (const struct of structs) {
+        const run = runs.get(struct.id.client) ?? [];
+        run.push(struct);
+        runs.set(struct.id.client, run);
+    }
+    return runs;
+};
+const isId = (value) => typeof value === 'object' &&
+    value !== null &&
+    typeof value.client === 'number' &&
+    typeof value.clock === 'number' &&
+    !('_item' in value);
+/**
+ * Where the item at `id` sits, held by the room or carried by the frame
+ * (`frame`): an encoded map entry with a left origin names neither key nor
+ * parent, so it is followed origin to origin to the one that does.
+ */
+const placeOf = (doc, frame, id) => {
+    const seen = new Set();
+    for (let at = id; at !== null;) {
+        const held = storedStruct(doc, at.client, at.clock);
+        if (held)
+            return held instanceof Y.Item ? { key: held.parentSub, parent: held.parent } : null;
+        const struct = structAt(frame.get(at.client) ?? [], at.clock);
+        if (!(struct instanceof Y.Item) || seen.has(struct))
+            return null;
+        seen.add(struct);
+        if (struct.parent !== null || struct.parentSub !== null) {
+            return { key: struct.parentSub, parent: struct.parent };
+        }
+        if (struct.rightOrigin !== null || struct.origin === null)
+            return null;
+        at = struct.origin;
+    }
+    return null;
+};
+/** Is `parent` (a {@link Place}'s) a block node: an entry of the block registry? */
+const isBlockNode = (doc, frame, parent) => {
+    const registry = doc.share.get(REGISTRY_KEY);
+    if (isId(parent)) {
+        const node = placeOf(doc, frame, parent);
+        return (node !== null &&
+            node.key !== null &&
+            (node.parent === registry || node.parent === REGISTRY_KEY));
+    }
+    const item = parent?._item;
+    return item?.parent === registry && registry !== undefined;
+};
+/**
+ * The clients of a frame (but `skip`) that write a per-writer block mark
+ * of another writer: a struct whose key is `del.<n>` or `wd.<n>` on a
+ * block node, from a client other than `n` (H2). Only `n` writes its mark.
+ */
+const forgedWriters = (doc, structs, skip) => {
+    const frame = runsOf(structs);
+    const forged = new Set();
+    for (const struct of structs) {
+        const { client, clock } = struct.id;
+        if (!(struct instanceof Y.Item) || skip.has(client) || forged.has(client))
+            continue;
+        if (storedStruct(doc, client, clock) !== null)
+            continue;
+        const place = placeOf(doc, frame, struct.id);
+        const writer = markWriter(place?.key);
+        if (writer !== null && writer !== client && isBlockNode(doc, frame, place.parent)) {
+            forged.add(client);
+        }
+    }
+    return forged;
+};
+/**
+ * Of a frame's deletes, those of live per-writer block marks whose writer
+ * the sender may not delete for (`mayDelete`): only `n`'s replicas delete
+ * `del.<n>`/`wd.<n>` (H2). A mark deleted with its block node (deleted, or
+ * deleted by the same frame) is not one.
+ */
+const forgedDeletes = (doc, ds, mayDelete) => {
+    const forged = Y.createIdSet();
+    const registry = doc.share.get(REGISTRY_KEY);
+    if (registry === undefined)
+        return forged;
+    for (const [client, ranges] of ds.clients) {
+        const structs = doc.store.clients.get(client) ?? [];
+        const held = heldClock(doc, client);
+        for (const { clock, len } of ranges.getIds()) {
+            if (clock >= held)
+                continue;
+            for (let i = Y.findIndexSS(structs, clock); i < structs.length; i++) {
+                const struct = structs[i];
+                if (struct.id.clock >= clock + len)
+                    break;
+                if (!(struct instanceof Y.Item) || struct.deleted)
+                    continue;
+                const writer = markWriter(struct.parentSub);
+                if (writer === null || mayDelete(writer))
+                    continue;
+                const node = struct.parent?._item;
+                if (!node || node.parent !== registry)
+                    continue;
+                if (node.deleted || ds.has(node.id.client, node.id.clock))
+                    continue;
+                const from = Math.max(clock, struct.id.clock);
+                forged.add(client, from, Math.min(clock + len, struct.id.clock + struct.length) - from);
+            }
+        }
+    }
+    return forged;
+};
+/** The ids of `next` that left their order relative to the others both lists hold (a longest increasing run kept). */
+const reordered = (previous, next) => {
+    const at = new Map(previous.map((id, i) => [id, i]));
+    const common = next.filter((id) => at.has(id));
+    // Longest increasing run of previous positions (patience sorting).
+    const tails = [];
+    const links = new Array(common.length).fill(-1);
+    const tailAt = [];
+    common.forEach((id, i) => {
+        const position = at.get(id);
+        let lo = 0;
+        let hi = tails.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (tails[mid] < position)
+                lo = mid + 1;
+            else
+                hi = mid;
+        }
+        tails[lo] = position;
+        tailAt[lo] = i;
+        links[i] = lo > 0 ? tailAt[lo - 1] : -1;
+    });
+    const kept = new Set();
+    for (let i = tails.length ? tailAt[tails.length - 1] : -1; i !== -1; i = links[i])
+        kept.add(i);
+    return common.filter((_, i) => !kept.has(i));
+};
 /** The tag of the document's sockets: other sockets of the object are left to you. */
 export const SOCKET_TAG = 'edytor';
 /** The 1011 close of a storage fault: the provider redials and resends. */
@@ -537,6 +802,9 @@ export class AttachedDocument {
     maxFrameBytes;
     compactAfter;
     saveAfter;
+    maxDocumentBytes;
+    maxInboundFrameBytes;
+    maxUpdatesPerSecond;
     live = null;
     /** Why the stored container was refused (another generation, a torn record, `onLoad`…). */
     failure = null;
@@ -550,6 +818,21 @@ export class AttachedDocument {
     origin = { kind: 'fresh' };
     nextRecord = 0;
     updates = 0;
+    /** What the records hold, uncompressed (the generation record aside): the document quota's measure. */
+    documentBytes = 0;
+    /** The counters `metrics()` reads (H14). */
+    counters = {
+        compaction: { ...timing(), lastBytes: 0 },
+        fold: timing(),
+        fanOut: { messages: 0, bytes: 0 },
+        since: Date.now()
+    };
+    /** The index `validate` reads (built at its first frame, for the live document). */
+    validation = null;
+    /** Each socket's update allowance (a token bucket; memory: a wake refills it). */
+    allowances = new WeakMap();
+    /** Each socket's chunked frame in flight (memory: a wake loses it, and the socket is faulted). */
+    chunkReaders = new WeakMap();
     /** A failed append: the live doc holds what storage does not, until it is rebuilt. */
     unstored = null;
     /** Inside `transact`, its commit included (a nested call is refused but while `fn` runs). */
@@ -558,6 +841,12 @@ export class AttachedDocument {
     running = false;
     /** Inside a client frame's apply, its events included: the frame's handler settles it. */
     handling = false;
+    /** How the container stores its snapshots (its generation record says; a fresh one: this build's). */
+    format = 'v2';
+    /** The snapshot compression in flight (`compressed()`). */
+    compressing = Promise.resolve();
+    /** The raw bytes of the compressed snapshot record (`records` reads it; only `start` can inflate). */
+    inflated = null;
     /** The waiting deletes stored as `pending` records (the engine may hold more, in memory). */
     storedWaiting = Y.createIdSet();
     /** The failure is the storage's (a failed read, `onLoad`'s store down): the next dial starts again. */
@@ -570,6 +859,7 @@ export class AttachedDocument {
     options;
     rowsTable;
     replicasTable;
+    metaTable;
     _lookups = null;
     constructor(ctx, options = {}) {
         this.ctx = ctx;
@@ -579,11 +869,15 @@ export class AttachedDocument {
         this.maxFrameBytes = knob(options.maxFrameBytes, E.MAX_FRAME_BYTES);
         this.compactAfter = knob(options.compactAfter, DEFAULT_COMPACT_AFTER, 1e9);
         this.saveAfter = knob(options.saveAfter, DEFAULT_SAVE_AFTER, 1e9);
+        this.maxDocumentBytes = knob(options.maxDocumentBytes, DEFAULT_MAX_DOCUMENT_BYTES, QUOTA_CEILING);
+        this.maxInboundFrameBytes = knob(options.maxInboundFrameBytes, DEFAULT_MAX_INBOUND_FRAME_BYTES, QUOTA_CEILING);
+        this.maxUpdatesPerSecond = knob(options.maxUpdatesPerSecond, DEFAULT_MAX_UPDATES_PER_SECOND, QUOTA_CEILING);
         const prefix = options.tablePrefix ?? 'edytor_';
         if (!/^\w*$/.test(prefix))
             throw new Error(`invalid table prefix ${prefix}`);
         this.rowsTable = `${prefix}rows`;
         this.replicasTable = `${prefix}replicas`;
+        this.metaTable = `${prefix}meta`;
         // The provider pings a silent socket: answer without waking the object.
         if (ctx.setWebSocketAutoResponse && !ctx.getWebSocketAutoResponse?.()) {
             ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(PING, PONG));
@@ -599,12 +893,40 @@ export class AttachedDocument {
             // A wake keeps a pending save: re-arming it would push `onSave` back at every wake.
             if (this.options.onSave)
                 this.saveScheduled = (await this.ctx.storage.getAlarm()) !== null;
+            await this.inflate();
             noTimers(() => this.load());
             if (this.origin.kind === 'fresh' && this.live !== null)
                 await this.seed();
         }
         catch (error) {
-            this.fail(error, true);
+            this.fail(error, !(error instanceof TornRecord));
+        }
+    }
+    /**
+     * Inflate a compressed snapshot record (P5) for `records`, which reads
+     * synchronously (a rebuild does): decompression is asynchronous, so
+     * only `start` can. One that does not inflate is a corrupt container.
+     */
+    async inflate() {
+        this.inflated = null;
+        let rows;
+        try {
+            rows = this.sql
+                .exec(`SELECT kind, record, part, parts, bytes FROM ${this.rowsTable} WHERE kind = 'snapshot' ORDER BY seq`)
+                .toArray();
+        }
+        catch {
+            return; // no table yet, or a failed read: `load` reports it
+        }
+        for (const { record, bytes } of reassemble(rows)) {
+            if (!isGzip(bytes))
+                continue;
+            try {
+                this.inflated = { record, bytes: (await gunzip(bytes)) };
+            }
+            catch (error) {
+                throw new TornRecord(`snapshot does not inflate: ${String(error)}`);
+            }
         }
     }
     /** A read of the rows or `onLoad` failed (storage was down): start again. */
@@ -777,6 +1099,7 @@ export class AttachedDocument {
             this.ctx.storage.transactionSync(() => {
                 this.sql.exec(`DELETE FROM ${this.rowsTable}`);
                 this.sql.exec(`DELETE FROM ${this.replicasTable}`);
+                this.sql.exec(`DELETE FROM ${this.metaTable}`);
             });
             this.presence.clear();
             await this.start();
@@ -816,20 +1139,19 @@ export class AttachedDocument {
                     scratch.destroy();
                     return update;
                 });
-                doc = crdt.admission.admitUpdate(loaded.update, `room ${this.ctx.id} onLoad`);
+                doc = admit(loaded.update, `room ${this.ctx.id} onLoad`);
                 replicas = loaded.replicas;
             }
             catch (error) {
                 return this.fail(error, false);
             }
             const waiting = pendingDeletes(doc);
-            const { pendingDs } = doc.store;
-            doc.store.pendingDs = null;
-            const snapshot = Y.encodeStateAsUpdate(doc);
-            doc.store.pendingDs = pendingDs;
+            const snapshot = liveState(doc);
+            let record = -1;
             try {
                 this.ctx.storage.transactionSync(() => {
-                    this.insert('snapshot', snapshot);
+                    record = this.insert('snapshot', snapshot);
+                    this.touch();
                     if (!waiting.isEmpty())
                         this.insert('pending', deletesUpdate(waiting));
                     // Without a registry, every id with content is left claimable (user
@@ -845,8 +1167,10 @@ export class AttachedDocument {
                 return this.fail(error, true);
             }
             this.live?.destroy();
+            this.format = STORED_GENERATION_RECORD.storage;
             this.adopt(doc);
             this.storedWaiting = waiting;
+            this.compressLater(record, snapshot);
         });
     }
     // ── Storage ──────────────────────────────────────────────────────────
@@ -871,6 +1195,7 @@ export class AttachedDocument {
 					bytes BLOB NOT NULL
 				)`);
             this.sql.exec(`CREATE TABLE IF NOT EXISTS ${this.replicasTable} (replica INTEGER PRIMARY KEY, user TEXT NOT NULL)`);
+            this.sql.exec(`CREATE TABLE IF NOT EXISTS ${this.metaTable} (key TEXT PRIMARY KEY, value INTEGER NOT NULL)`);
             this.nextRecord = 0;
             records = this.records();
         }
@@ -881,8 +1206,10 @@ export class AttachedDocument {
             if (records.length === 0) {
                 // A fresh room: the generation record is written with the first stored record.
                 this.origin = { kind: 'fresh' };
+                this.documentBytes = 0;
+                this.format = STORED_GENERATION_RECORD.storage;
                 this.storedWaiting = Y.createIdSet();
-                this.adopt(crdt.createDoc());
+                this.adopt(roomDoc());
                 return;
             }
             const [generation, ...rest] = records;
@@ -890,8 +1217,11 @@ export class AttachedDocument {
             if (generation.kind !== 'generation' || !isGenerationRecord(found)) {
                 throw new E.GenerationMismatchError(`room ${this.ctx.id}`, found);
             }
-            const merged = Y.mergeUpdates(rest.map((record) => record.bytes));
-            const doc = crdt.admission.admitUpdate(merged, `room ${this.ctx.id}`);
+            // Applied in one transaction, never merged first: a merge of the
+            // records keeps every keystroke's struct and the deleted content.
+            const doc = admit(rest.map((record) => (record.v2 ? { v2: record.bytes } : record.bytes)), `room ${this.ctx.id}`);
+            this.format = storageOf(found);
+            this.documentBytes = rest.reduce((n, record) => n + record.bytes.length, 0);
             this.adopt(doc);
             // Every delete the engine holds waiting came from the rows.
             this.storedWaiting = pendingDeletes(doc);
@@ -902,26 +1232,43 @@ export class AttachedDocument {
             this.fail(error, false);
         }
     }
-    /** Reassembled logical records in write order; a torn record throws. */
-    records() {
-        const byRecord = new Map();
-        for (const row of this.sql.exec(`SELECT kind, record, part, parts, bytes FROM ${this.rowsTable} ORDER BY seq`)) {
-            const parts = byRecord.get(row.record) ?? [];
-            parts.push(row);
-            byRecord.set(row.record, parts);
+    /** The bytes of the stored `pending` records (uncompressed, as every record but a snapshot). */
+    pendingBytes() {
+        return (this.sql
+            .exec(`SELECT SUM(length(bytes)) AS n FROM ${this.rowsTable} WHERE kind = 'pending'`)
+            .one().n ?? 0);
+    }
+    /**
+     * Reassembled logical records in write order (of one kind, with
+     * `only`); a torn record throws. A v2 container's snapshot is v2
+     * (`v2`), inflated when it is stored compressed (P5).
+     */
+    records(only) {
+        const rows = this.sql
+            .exec(`SELECT kind, record, part, parts, bytes FROM ${this.rowsTable}${only ? ' WHERE kind = ?' : ''} ORDER BY seq`, ...(only ? [only] : []))
+            .toArray();
+        for (const row of rows)
             this.nextRecord = Math.max(this.nextRecord, row.record + 1);
-        }
-        return [...byRecord.values()].map((parts) => {
-            if (parts.length !== parts[0].parts)
-                throw new TornRecord();
-            parts.sort((a, b) => a.part - b.part);
-            const bytes = new Uint8Array(parts.reduce((n, p) => n + p.bytes.byteLength, 0));
-            let at = 0;
-            for (const part of parts) {
-                bytes.set(new Uint8Array(part.bytes), at);
-                at += part.bytes.byteLength;
+        const records = reassemble(rows);
+        // The container's storage format, from its generation record.
+        let format = 'v1';
+        if (records[0]?.kind === 'generation') {
+            try {
+                const found = JSON.parse(new TextDecoder().decode(records[0].bytes));
+                if (isGenerationRecord(found))
+                    format = storageOf(found);
+            }
+            catch {
+                // `load` refuses it
             }
-            return { kind: parts[0].kind, bytes };
+        }
+        return records.map((record) => {
+            const v2 = format === 'v2' && record.kind === 'snapshot';
+            if (!v2 || !isGzip(record.bytes))
+                return { ...record, v2 };
+            if (this.inflated?.record !== record.record)
+                throw new CompressedRecord();
+            return { ...record, bytes: this.inflated.bytes, v2 };
         });
     }
     /**
@@ -931,17 +1278,70 @@ export class AttachedDocument {
      */
     insert(kind, bytes) {
         if (this.nextRecord === 0 && kind !== 'generation') {
-            this.insert('generation', encodeJSON(E.GENERATION_RECORD));
+            this.insert('generation', encodeJSON(STORED_GENERATION_RECORD));
         }
         const record = this.nextRecord++;
+        this.writeRecord(kind, record, bytes);
+        if (kind !== 'generation')
+            this.documentBytes += bytes.length;
+        return record;
+    }
+    /** Record `record`'s rows (at the row positions `seqs`, when given). */
+    writeRecord(kind, record, bytes, seqs) {
         const parts = Math.max(1, Math.ceil(bytes.length / this.maxRowBytes));
         for (let part = 0; part < parts; part++) {
-            this.sql.exec(`INSERT INTO ${this.rowsTable} (kind, record, part, parts, bytes) VALUES (?, ?, ?, ?, ?)`, kind, record, part, parts, bytes.slice(part * this.maxRowBytes, (part + 1) * this.maxRowBytes));
+            const row = bytes.slice(part * this.maxRowBytes, (part + 1) * this.maxRowBytes);
+            if (seqs) {
+                this.sql.exec(`INSERT INTO ${this.rowsTable} (seq, kind, record, part, parts, bytes) VALUES (?, ?, ?, ?, ?, ?)`, seqs[part], kind, record, part, parts, row);
+            }
+            else {
+                this.sql.exec(`INSERT INTO ${this.rowsTable} (kind, record, part, parts, bytes) VALUES (?, ?, ?, ?, ?)`, kind, record, part, parts, row);
+            }
         }
     }
+    /**
+     * Compress snapshot `record` in place once it is stored (P5): gzip is
+     * asynchronous, and the store-before-ack path is not. Its rows are
+     * rewritten (at their positions) only while it is still the stored
+     * snapshot and only when that shrinks it; the raw bytes stay in memory
+     * (`inflated`) for a rebuild's synchronous read. A platform without
+     * `CompressionStream` keeps it raw.
+     */
+    compressLater(record, raw) {
+        const job = packed(raw)
+            .then((bytes) => noTimers(() => {
+            if (bytes === raw)
+                return;
+            const rows = this.sql
+                .exec(`SELECT seq FROM ${this.rowsTable} WHERE record = ? AND kind = 'snapshot' ORDER BY part`, record)
+                .toArray();
+            // Replaced since (a compaction, a reset): nothing to do.
+            if (rows.length !== Math.max(1, Math.ceil(raw.length / this.maxRowBytes)))
+                return;
+            this.ctx.storage.transactionSync(() => {
+                this.sql.exec(`DELETE FROM ${this.rowsTable} WHERE record = ?`, record);
+                this.writeRecord('snapshot', record, bytes, rows.map((row) => row.seq));
+            });
+            this.inflated = { record, bytes: raw.slice() };
+        }))
+            .catch((error) => this.note({ reason: 'storage', detail: `compression: ${String(error)}` }));
+        this.compressing = job;
+        this.ctx.waitUntil?.(job);
+    }
+    /**
+     * Resolves once the snapshot compression in flight, if any, is stored
+     * (P5): a compaction stores its snapshot raw, then compresses it in
+     * place. Wait for it before reading the rows' sizes.
+     */
+    async compressed() {
+        await this.compressing;
+    }
     /**
      * Compaction: the rows become the generation record + one chunked
-     * snapshot, `mergeUpdates` of every stored record, atomically, + one
+     * snapshot of the live document's state (P2: the healed state, deleted
+     * content collected but the text a replica may copy again, P11 —
+     * never a merge of the records, which keeps every keystroke's struct
+     * and every deleted character), atomically, + one
      * `pending` record of the stored deletes still waiting. A waiting delete
      * of a client id no user registered and no socket holds is reclaimed,
      * in memory too: nothing can deliver its item (a made-up id) — the
@@ -955,8 +1355,12 @@ export class AttachedDocument {
         return noTimers(() => {
             this.heal();
             const doc = this.requireDoc();
-            const records = this.records().slice(1);
-            const merged = Y.mergeUpdates(records.filter((record) => record.kind !== 'pending').map((record) => record.bytes));
+            const started = now();
+            // Only the waiting deletes are read back: the snapshot is the live doc.
+            const pending = this.records('pending');
+            // The live state, never a merge of the records (P2): memory never
+            // runs ahead of storage, so it is what they hold, collected.
+            const snapshot = liveState(doc);
             const sockets = new Set();
             for (const ws of this.ctx.getWebSockets(SOCKET_TAG)) {
                 const replica = ws.deserializeAttachment()?.replica;
@@ -971,32 +1375,118 @@ export class AttachedDocument {
             // Waiting deletes stay apart (a discarded forgery drops them,
             // `settleDeletes`): the stored ones the engine still holds waiting.
             const all = pendingDeletes(doc);
-            const stored = storedPending(records);
+            const stored = storedPending(pending);
             const waiting = Y.diffIdSet(stored, Y.diffIdSet(stored, all));
             const still = addIds(Y.createIdSet(), waiting, (client) => known.has(client));
             // Memory never runs ahead of storage: the live state vector is the stored one.
             const kept = new Set([...stateVector(doc).keys(), ...sockets, ...still.clients.keys()]);
-            this.ctx.storage.transactionSync(() => {
-                this.sql.exec(`DELETE FROM ${this.rowsTable}`);
-                this.insert('generation', encodeJSON(E.GENERATION_RECORD));
-                this.insert('snapshot', merged);
-                if (!still.isEmpty())
-                    this.insert('pending', deletesUpdate(still));
-                for (const replica of registered) {
-                    if (!kept.has(replica)) {
-                        this.sql.exec(`DELETE FROM ${this.replicasTable} WHERE replica = ?`, replica);
+            let record = -1;
+            const measured = this.documentBytes;
+            try {
+                this.ctx.storage.transactionSync(() => {
+                    this.sql.exec(`DELETE FROM ${this.rowsTable}`);
+                    this.documentBytes = 0;
+                    // The container is now this build's format (a v1 one migrates here).
+                    this.insert('generation', encodeJSON(STORED_GENERATION_RECORD));
+                    record = this.insert('snapshot', snapshot);
+                    if (!still.isEmpty())
+                        this.insert('pending', deletesUpdate(still));
+                    for (const replica of registered) {
+                        if (!kept.has(replica)) {
+                            this.sql.exec(`DELETE FROM ${this.replicasTable} WHERE replica = ?`, replica);
+                        }
                     }
-                }
-            });
+                });
+            }
+            catch (error) {
+                this.documentBytes = measured;
+                throw error;
+            }
             this.updates = 0;
+            this.format = STORED_GENERATION_RECORD.storage;
             this.storedWaiting = still;
+            this.compressLater(record, snapshot);
             // Unknown ids' deletes go, the ones waiting in memory with a rewrite too.
             forgetWaiting(doc, addIds(Y.createIdSet(), all, (client) => !known.has(client)));
+            const rows = this.sql
+                .exec(`SELECT COUNT(*) AS n FROM ${this.rowsTable}`)
+                .one().n;
+            const ms = now() - started;
+            tally(this.counters.compaction, ms);
+            this.counters.compaction.lastBytes = snapshot.length;
+            this.log({
+                edytor: 'compaction',
+                ms,
+                bytes: snapshot.length,
+                records: still.isEmpty() ? 2 : 3,
+                rows
+            });
+            return { rows };
+        });
+    }
+    /** Record now as the last stored change (callers run it in the change's transaction). */
+    touch() {
+        this.sql.exec(`INSERT OR REPLACE INTO ${this.metaTable} (key, value) VALUES ('updated', ?)`, Date.now());
+    }
+    /**
+     * When the room last stored a change (ms since the epoch), or `null`
+     * for a room that stored none since 0.1.0-next.23 (H12). Cheap: one
+     * row, no document. `routeDocumentSocket` answers it over HTTP
+     * (`GET <room>?lastUpdated`), also over RPC.
+     */
+    lastUpdated() {
+        try {
+            return (this.sql
+                .exec(`SELECT value FROM ${this.metaTable} WHERE key = 'updated'`)
+                .toArray()[0]?.value ?? null);
+        }
+        catch {
+            return null; // no table yet
+        }
+    }
+    /** The room's counters (H14), also over RPC — see {@link RoomMetrics}. */
+    metrics() {
+        return noTimers(() => {
+            const stored = this.live === null ? null : this.storage();
             return {
-                rows: this.sql.exec(`SELECT COUNT(*) AS n FROM ${this.rowsTable}`).one().n
+                documentBytes: this.documentBytes,
+                storedBytes: stored?.bytes ?? 0,
+                records: stored?.records ?? 0,
+                rows: stored?.rows ?? 0,
+                updateRecords: this.updates,
+                waitingBytes: this.live?.store.pendingStructs?.update.length ?? 0,
+                sockets: this.ctx.getWebSockets(SOCKET_TAG).length,
+                compaction: { ...this.counters.compaction },
+                fold: { ...this.counters.fold },
+                fanOut: { ...this.counters.fanOut },
+                quotaHits: this.refusalCounts.quota ?? 0,
+                validationDenials: this.refusalCounts.denied ?? 0,
+                refusals: { ...this.refusalCounts },
+                since: this.counters.since
             };
         });
     }
+    /** What the rows take: bytes, logical records, rows. */
+    storage() {
+        return this.sql
+            .exec(`SELECT SUM(length(bytes)) AS bytes, COUNT(DISTINCT record) AS records, COUNT(*) AS rows FROM ${this.rowsTable}`)
+            .one();
+    }
+    /** Write one log entry (H14) — the `log` option's, `console.log` by default. */
+    log(entry) {
+        const log = this.options.log;
+        if (log === false)
+            return;
+        try {
+            if (log)
+                log(entry);
+            else
+                console.log(JSON.stringify(entry));
+        }
+        catch {
+            // a log never fails the room
+        }
+    }
     /**
      * Drop every waiting delete, stored or in memory (callable over RPC):
      * the way out when a writer filled {@link MAX_WAITING_DELETES} with
@@ -1010,9 +1500,11 @@ export class AttachedDocument {
             this.heal();
             const doc = this.requireDoc();
             const dropped = pendingDeletes(doc);
+            const pending = this.pendingBytes();
             this.ctx.storage.transactionSync(() => {
                 this.sql.exec(`DELETE FROM ${this.rowsTable} WHERE kind = 'pending'`);
             });
+            this.documentBytes -= pending;
             this.storedWaiting = Y.createIdSet();
             forgetWaiting(doc, dropped);
             this.scheduleSave();
@@ -1038,6 +1530,11 @@ export class AttachedDocument {
             reason: storage ? 'storage' : 'internal',
             detail: String(append ? this.unstored : error)
         });
+        this.log({
+            edytor: 'fault',
+            reason: storage ? 'storage' : 'internal',
+            detail: String(append ? this.unstored : error)
+        });
         // Only a registry fault leaves the live doc as stored.
         if (!registry && this.live !== null)
             this.rebuild();
@@ -1112,6 +1609,8 @@ export class AttachedDocument {
         return this.live;
     }
     adopt(doc) {
+        this.validation?.off();
+        this.validation = null;
         this._facade?.dispose();
         this._facade = null;
         this.live = doc;
@@ -1124,7 +1623,10 @@ export class AttachedDocument {
             if (this.unstored !== null)
                 return;
             try {
-                this.ctx.storage.transactionSync(() => this.insert('update', update));
+                this.ctx.storage.transactionSync(() => {
+                    this.insert('update', update);
+                    this.touch();
+                });
                 this.updates++;
                 this.broadcast(updateFrame(update), origin);
                 this.scheduleSave();
@@ -1230,6 +1732,14 @@ export class AttachedDocument {
     }
     // ── Hibernation WebSocket API ────────────────────────────────────────
     async fetch(request) {
+        // The `lastUpdated` probe (H12), forwarded by `routeDocumentSocket` once authorized.
+        if (request.headers.get(PROBE_HEADER) === 'lastUpdated') {
+            if (readIdentity(request.headers) === null) {
+                return new Response('verified identity required', { status: 401 });
+            }
+            await this.retryStart();
+            return Response.json({ lastUpdated: this.lastUpdated() });
+        }
         if (request.headers.get('Upgrade')?.toLowerCase() !== 'websocket') {
             return new Response('expected a websocket upgrade', { status: 426 });
         }
@@ -1297,36 +1807,139 @@ export class AttachedDocument {
             const attachment = ws.deserializeAttachment();
             if (!attachment?.user)
                 return this.refuse(ws, { reason: 'identity', detail: null });
-            const bytes = new Uint8Array(message);
-            const decoder = E.createDecoder(bytes);
-            // 1 · Admission: the generation word, before anything is decoded.
-            if (!E.readProtocolVersion(decoder)) {
-                return this.refuse(ws, { reason: 'generation', detail: bytes[0] });
+            this.onFrame(ws, attachment, doc, new Uint8Array(message));
+        });
+        return true;
+    }
+    /** One frame: whole as it came, or reassembled from its chunks. */
+    onFrame(ws, attachment, doc, bytes) {
+        // The frame quota (H3): never decoded past it.
+        if (bytes.length > this.maxInboundFrameBytes) {
+            return this.overQuota(ws, attachment.user, 'frame', {
+                bytes: bytes.length,
+                limit: this.maxInboundFrameBytes
+            });
+        }
+        const decoder = E.createDecoder(bytes);
+        // 1 · Admission: the generation word, before anything is decoded.
+        if (!E.readProtocolVersion(decoder)) {
+            return this.refuse(ws, { reason: 'generation', detail: bytes[0] });
+        }
+        try {
+            const type = decode(() => E.readVarUint(decoder));
+            if (type === E.messageChunk)
+                return this.onChunk(ws, attachment, doc, decoder);
+            if (type === E.messageSync)
+                return this.onSync(ws, attachment, doc, decoder);
+            if (type === E.messageAwareness) {
+                const entries = decode(() => E.readAwarenessEntries(E.readVarUint8Array(decoder)));
+                return this.onPresence(ws, attachment, doc, entries);
+            }
+            if (type === E.messageQueryAwareness) {
+                return this.send(ws, presenceFrame([...this.presence.values()]));
+            }
+            this.refuse(ws, { reason: 'malformed', detail: `message type ${type}` });
+        }
+        catch (error) {
+            // Only the client's bytes are its fault: the room's own faults close 1011.
+            if (error instanceof MalformedFrame) {
+                this.refuse(ws, { reason: 'malformed', detail: error.message });
+            }
+            else {
+                this.fault(ws, error);
             }
+        }
+    }
+    /**
+     * One chunk of a frame too large to send whole (H6: a provider's
+     * reconnect diff): buffered per socket, the whole frame handled once its
+     * sequence ends. A sequence announcing more than `maxInboundFrameBytes`
+     * is a frame quota refusal, before anything is buffered. A part with no
+     * sequence started — the room woke between two chunks and lost the
+     * buffer — faults the socket (1011): its provider redials and resends.
+     */
+    onChunk(ws, attachment, doc, decoder) {
+        let read = this.chunkReaders.get(ws);
+        if (read === undefined) {
+            read = E.createChunkReader(this.maxInboundFrameBytes);
+            this.chunkReaders.set(ws, read);
+        }
+        let whole;
+        try {
+            whole = read(decoder);
+        }
+        catch (error) {
+            this.chunkReaders.delete(ws);
+            if (error instanceof ChunkLimitError) {
+                return this.overQuota(ws, attachment.user, 'frame', {
+                    bytes: error.total,
+                    limit: error.limit
+                });
+            }
+            if (error instanceof ChunkSequenceError) {
+                this.note({ reason: 'internal', detail: `chunks: ${error.message}` });
+                this.depart(ws);
+                return this.close(ws, CLOSE.fault, 'chunk sequence lost');
+            }
+            throw new MalformedFrame(String(error));
+        }
+        if (whole !== null)
+            this.onFrame(ws, attachment, doc, whole);
+    }
+    /**
+     * A quota refused the socket's frame (H3): it is not applied, and the
+     * socket is closed `4413` (`quota: <name>`), a refusal its provider
+     * reports (`onSyncRefused`) and does not redial. Never a dropped frame
+     * on a live socket: the sender's later frames would build on it and
+     * wait in the room's memory for good, unstored and unacknowledged; and
+     * a redial would resend it and meet the same quota.
+     */
+    overQuota(ws, user, quota, detail) {
+        this.note({ reason: 'quota', detail: { user, quota, ...detail } });
+        this.log({ edytor: 'quota', user, quota });
+        this.chunkReaders.delete(ws);
+        this.depart(ws);
+        this.close(ws, CLOSE.quota, `quota: ${quota}`);
+    }
+    /**
+     * The update rate quota (H3): a token bucket per socket, refilled at
+     * `maxUpdatesPerSecond` up to ten seconds' worth. `false`: over it.
+     */
+    allow(ws) {
+        const now = Date.now();
+        const burst = this.maxUpdatesPerSecond * BURST_SECONDS;
+        const held = this.allowances.get(ws) ?? { tokens: burst, at: now };
+        const tokens = Math.min(burst, held.tokens + ((now - held.at) / 1000) * this.maxUpdatesPerSecond);
+        if (tokens < 1) {
+            this.allowances.set(ws, { tokens, at: now });
+            return false;
+        }
+        this.allowances.set(ws, { tokens: tokens - 1, at: now });
+        return true;
+    }
+    /**
+     * The document quota (H3): would `incoming` bytes take the document
+     * past `maxDocumentBytes`? Its measure is what its records hold and what
+     * the engine holds waiting; update records count until compaction
+     * collapses them, so it compacts first when they would.
+     */
+    overDocument(incoming, freed) {
+        // A frame that deletes at least what it adds always applies: a full
+        // document can still be trimmed.
+        if (incoming <= freed)
+            return false;
+        const usage = () => this.documentBytes + (this.live?.store.pendingStructs?.update.length ?? 0) + incoming - freed;
+        if (usage() <= this.maxDocumentBytes)
+            return false;
+        if (this.updates > 0) {
             try {
-                const type = decode(() => E.readVarUint(decoder));
-                if (type === E.messageSync)
-                    return this.onSync(ws, attachment, doc, decoder);
-                if (type === E.messageAwareness) {
-                    const entries = decode(() => E.readAwarenessEntries(E.readVarUint8Array(decoder)));
-                    return this.onPresence(ws, attachment, doc, entries);
-                }
-                if (type === E.messageQueryAwareness) {
-                    return this.send(ws, presenceFrame([...this.presence.values()]));
-                }
-                this.refuse(ws, { reason: 'malformed', detail: `message type ${type}` });
+                this.compact();
             }
             catch (error) {
-                // Only the client's bytes are its fault: the room's own faults close 1011.
-                if (error instanceof MalformedFrame) {
-                    this.refuse(ws, { reason: 'malformed', detail: error.message });
-                }
-                else {
-                    this.fault(ws, error);
-                }
+                this.note({ reason: 'storage', detail: `compaction: ${String(error)}` });
             }
-        });
-        return true;
+        }
+        return usage() > this.maxDocumentBytes;
     }
     webSocketClose(ws, code, reason) {
         if (!this.owns(ws))
@@ -1360,6 +1973,12 @@ export class AttachedDocument {
     }
     onSync(ws, attachment, doc, decoder) {
         const syncType = decode(() => E.readVarUint(decoder));
+        // The rate quota (H3) counts every sync message, a Step1 too (it costs a Step2).
+        if (!this.allow(ws)) {
+            return this.overQuota(ws, attachment.user, 'rate', {
+                perSecond: this.maxUpdatesPerSecond
+            });
+        }
         if (syncType === E.messageYjsSyncStep1) {
             const sv = decode(() => {
                 const sv = E.readVarUint8Array(decoder);
@@ -1375,6 +1994,16 @@ export class AttachedDocument {
             return this.refuse(ws, { reason: 'malformed', detail: `sync type ${syncType}` });
         }
         const update = decode(() => E.readVarUint8Array(decoder));
+        const started = now();
+        try {
+            this.onUpdate(ws, attachment, doc, update);
+        }
+        finally {
+            tally(this.counters.fold, now() - started);
+        }
+    }
+    /** A client's Step2 or Update: admitted, applied, stored, relayed, validated, acknowledged. */
+    onUpdate(ws, attachment, doc, update) {
         // 2 · Access: a read-only socket writes nothing (it stays, and is told).
         if (attachment.readOnly) {
             this.note({ reason: 'read-only', detail: attachment.user });
@@ -1383,28 +2012,73 @@ export class AttachedDocument {
         // 3 · Attribution: new structs only under client ids this user may
         // write under; another user's are stripped, the rest applied.
         const decoded = decode(() => Y.decodeUpdate(update));
+        // The document quota (H3), net of what the frame deletes.
+        if (decoded.structs.some((struct) => !(struct instanceof Y.Skip)) &&
+            this.overDocument(update.length, freedBy(doc, decoded.ds))) {
+            return this.overQuota(ws, attachment.user, 'document', {
+                bytes: this.documentBytes,
+                incoming: update.length,
+                limit: this.maxDocumentBytes
+            });
+        }
         const sv = stateVector(doc);
         const stripped = this.attribute(attachment, newWriters(decoded, sv), sv);
+        // Per-writer block marks (H2): only `n` writes or deletes `del.<n>` /
+        // `wd.<n>`. A client writing another's is stripped whole, as a client
+        // under another user's id is; a delete of another's mark is dropped.
+        const forgers = forgedWriters(doc, decoded.structs, stripped);
+        const owners = new Map();
+        const mayDelete = (writer) => {
+            if (writer === attachment.replica)
+                return true;
+            if (!owners.has(writer))
+                owners.set(writer, this.ownerOf(writer) === attachment.user);
+            return owners.get(writer);
+        };
+        const forgedMarks = decoded.ds.isEmpty()
+            ? Y.createIdSet()
+            : forgedDeletes(doc, decoded.ds, mayDelete);
+        if (forgers.size > 0 || !forgedMarks.isEmpty()) {
+            for (const client of forgers)
+                stripped.add(client);
+            this.note({
+                reason: 'mark',
+                detail: { user: attachment.user, writers: [...forgers], ranges: rangeCount(forgedMarks) }
+            });
+        }
         // Waiting deletes are capped: a frame that would pass the cap has them dropped.
         const waiting = pendingDeletes(doc);
         const unheld = decoded.ds.isEmpty() ? null : unheldDeletes(decoded, stripped, doc);
-        const dropped = unheld && rangeCount(waiting) + rangeCount(unheld) > MAX_WAITING_DELETES ? unheld : null;
-        if (dropped !== null) {
+        const overflow = unheld && rangeCount(waiting) + rangeCount(unheld) > MAX_WAITING_DELETES ? unheld : null;
+        if (overflow !== null) {
             this.note({
                 reason: 'waiting',
-                detail: { user: attachment.user, ranges: rangeCount(dropped) }
+                detail: { user: attachment.user, ranges: rangeCount(overflow) }
             });
         }
+        const dropped = overflow === null && forgedMarks.isEmpty()
+            ? null
+            : addIds(addIds(Y.createIdSet(), overflow ?? Y.createIdSet()), forgedMarks);
         const admitted = stripped.size === 0 && dropped === null
             ? update
             : withoutClients(decoded, stripped, doc, dropped ?? undefined);
+        // Validation (H2) reads the document as it was, and records the frame.
+        const validation = this.options.validate ? this.validating(doc, ws) : null;
         // 4 · Schema: the inbound refusal of a foreign stamp (the update's,
         // or a pending one it would release — discarded, the sender kept).
         // Integrating persists (the doc's update handler) before the ack.
         let failure = null;
-        const { applied, problem, discarded } = this.handle(() => sync.applyRemote(doc, admitted, ws, (error) => {
-            failure = error;
-        }));
+        validation?.history?.trackedOrigins.add(ws);
+        let outcome;
+        try {
+            outcome = this.handle(() => sync.applyRemote(doc, admitted, ws, (error) => {
+                failure = error;
+            }));
+        }
+        finally {
+            validation?.history?.trackedOrigins.delete(ws);
+        }
+        const { applied, problem, discarded } = outcome;
         if (this.unstored !== null)
             return this.fault(ws, this.unstored);
         if (problem !== null)
@@ -1421,6 +2095,11 @@ export class AttachedDocument {
             return this.fault(ws, this.unstored);
         if (discarded)
             this.note({ reason: 'schema', detail: { discarded } });
+        if (validation !== null) {
+            this.validateFrame(validation, attachment);
+            if (this.unstored !== null)
+                return this.fault(ws, this.unstored);
+        }
         // A dropped delete is not acknowledged: its sender stays unsaved.
         this.send(ws, savedFrame(doc, addIds(this.storedDeletes(doc, decoded.ds), released)));
         // Waiting writes the frame released are other sockets' (a relayer's
@@ -1431,6 +2110,164 @@ export class AttachedDocument {
         }
         this.compactIfDue();
     }
+    // ── Validation (H2) ──────────────────────────────────────────────
+    /** A shown block's state, read from the facade (`null`: it does not show). */
+    blockState(id) {
+        const facade = this.facade;
+        if (!facade.isVisibleBlock(id))
+            return null;
+        return {
+            id,
+            type: facade.blockTypeOf(id) ?? '',
+            data: (facade.blockDataOf(id) ?? {}),
+            content: facade.contentJSON(id),
+            parent: facade.parentOf(id)
+        };
+    }
+    /**
+     * The index `validate` reads, for `doc`, set to record the frame of
+     * `origin`: every shown block's state and each parent's children, built
+     * once and kept from every change report. Its history (once the
+     * document is initialized: a history first initializes its document)
+     * records the frame for its compensation.
+     */
+    validating(doc, origin) {
+        let v = this.validation;
+        if (v === null || v.doc !== doc) {
+            v?.off();
+            const facade = this.facade;
+            const states = new Map();
+            const children = new Map();
+            const walk = (parent) => {
+                const ids = facade.childrenIds(parent);
+                children.set(parent, ids);
+                for (const id of ids) {
+                    const state = this.blockState(id);
+                    if (state !== null)
+                        states.set(id, state);
+                    walk(id);
+                }
+            };
+            walk(null);
+            const created = {
+                doc,
+                states,
+                children,
+                history: null,
+                frame: null,
+                off: () => { }
+            };
+            created.off = facade.onChange((change) => this.indexChange(created, change));
+            v = this.validation = created;
+        }
+        if (v.history === null && crdt.doc.isInitialized(doc)) {
+            v.history = this.facade.createUndoManager({ captureTimeout: 0, trackedOrigins: new Set() });
+        }
+        v.frame = { origin, before: new Map(), touched: new Set(), data: false };
+        return v;
+    }
+    /** Keep the index from one change report, recording what the frame being validated touched. */
+    indexChange(v, change) {
+        const frame = v.frame?.origin === change.origin ? v.frame : null;
+        const touch = (id) => {
+            if (frame === null)
+                return;
+            if (!frame.before.has(id))
+                frame.before.set(id, v.states.get(id) ?? null);
+            frame.touched.add(id);
+        };
+        const drop = (id) => {
+            touch(id);
+            for (const child of v.children.get(id) ?? [])
+                drop(child);
+            v.children.delete(id);
+            v.states.delete(id);
+        };
+        const read = (id, moved) => {
+            const was = v.states.get(id);
+            const state = this.blockState(id);
+            if (state === null)
+                return drop(id);
+            if (!moved || was === undefined || was.parent !== state.parent)
+                touch(id);
+            v.states.set(id, state);
+        };
+        for (const id of change.removed)
+            drop(id);
+        const add = (block) => {
+            touch(block.id);
+            read(block.id, false);
+            v.children.set(block.id, this.facade.childrenIds(block.id));
+            block.children.forEach(add);
+        };
+        for (const block of change.added.values())
+            add(block);
+        for (const id of change.moved)
+            read(id, true);
+        for (const id of change.meta.keys())
+            read(id, false);
+        for (const id of change.content.keys())
+            read(id, false);
+        // A block moved among its siblings, not shifted by another's move.
+        for (const [parent, ids] of change.order) {
+            for (const id of reordered(v.children.get(parent) ?? [], ids))
+                touch(id);
+            v.children.set(parent, ids);
+        }
+        if (frame !== null && change.data !== undefined)
+            frame.data = true;
+    }
+    /**
+     * Ask `validate` about the frame just applied (H2); a denial is
+     * compensated by the room's own transaction: the history undo of that
+     * frame (`room.validate.inverse`), or, for the frame that initialized
+     * the document (no history recorded it), a delete of the blocks it
+     * added. Stored and sent to every socket, the sender's included.
+     */
+    validateFrame(v, attachment) {
+        const frame = v.frame;
+        v.frame = null;
+        if (frame === null || (frame.touched.size === 0 && !frame.data)) {
+            if (v.history)
+                this.facade.releaseHistory(v.history);
+            return;
+        }
+        const touched = [...frame.touched];
+        let allowed;
+        try {
+            allowed =
+                this.options.validate({
+                    user: attachment.user,
+                    replica: attachment.replica,
+                    touched,
+                    dataChanged: frame.data,
+                    before: (id) => frame.before.has(id) ? frame.before.get(id) : (v.states.get(id) ?? null),
+                    after: (id) => v.states.get(id) ?? null,
+                    facade: this.facade
+                }) !== false;
+        }
+        catch (error) {
+            this.note({ reason: 'internal', detail: `validate: ${String(error)}` });
+            allowed = false;
+        }
+        if (!allowed) {
+            this.note({ reason: 'denied', detail: { user: attachment.user, touched } });
+            this.log({ edytor: 'denied', user: attachment.user, touched: touched.length });
+            const history = v.history;
+            if (history !== null && history.undoStack.length > 0) {
+                history.undo();
+            }
+            else {
+                const added = touched.filter((id) => frame.before.get(id) === null && v.states.has(id));
+                const facade = this.facade;
+                if (added.length > 0) {
+                    facade.transact(() => facade.apply(facade.prepare.deleteBlocks(added)), ROOM_ORIGIN);
+                }
+            }
+        }
+        if (v.history)
+            this.facade.releaseHistory(v.history);
+    }
     /**
      * A delete of items the room does not hold (a relayer's delete of an
      * author's edit a restore lost) waits in the engine for them: it is
@@ -1460,16 +2297,21 @@ export class AttachedDocument {
         const added = Y.diffIdSet(discarded ? now : Y.diffIdSet(now, waiting), stay);
         const released = heldDeletes(doc, Y.diffIdSet(waiting, now));
         if (discarded || !added.isEmpty()) {
+            const before = this.documentBytes;
+            const pending = discarded ? this.pendingBytes() : 0;
             try {
                 this.ctx.storage.transactionSync(() => {
                     if (discarded)
                         this.sql.exec(`DELETE FROM ${this.rowsTable} WHERE kind = 'pending'`);
                     if (!added.isEmpty())
                         this.insert('pending', deletesUpdate(added));
+                    this.touch();
                 });
+                this.documentBytes -= pending;
                 this.updates++;
             }
             catch (error) {
+                this.documentBytes = before;
                 this.unstored = error;
                 return released;
             }
@@ -1569,6 +2411,8 @@ export class AttachedDocument {
             try {
                 for (const piece of pieces)
                     ws.send(piece);
+                this.counters.fanOut.messages += pieces.length;
+                this.counters.fanOut.bytes += bytes.length;
             }
             catch {
                 // a socket that died mid-broadcast gets its close event
@@ -1615,19 +2459,25 @@ export class DocumentRoom extends DurableObject {
         super(ctx, env);
         const knobs = env;
         const saves = this.onSave !== DocumentRoom.prototype.onSave;
+        const validates = this.validate !== DocumentRoom.prototype.validate;
         const semantics = () => this.semantics();
         this.room = new AttachedDocument(ctx, {
             maxRowBytes: Number(knobs.EDYTOR_MAX_ROW_BYTES),
             maxFrameBytes: Number(knobs.EDYTOR_MAX_FRAME_BYTES),
             compactAfter: Number(knobs.EDYTOR_COMPACT_AFTER),
             saveAfter: Number(knobs.EDYTOR_SAVE_AFTER),
+            maxDocumentBytes: Number(knobs.EDYTOR_MAX_DOCUMENT_BYTES),
+            maxInboundFrameBytes: Number(knobs.EDYTOR_MAX_INBOUND_FRAME_BYTES),
+            maxUpdatesPerSecond: Number(knobs.EDYTOR_MAX_UPDATES_PER_SECOND),
             tablePrefix: '',
             // A getter: a subclass's fields do not exist yet in this constructor.
             get semantics() {
                 return semantics();
             },
             onLoad: () => this.onLoad(),
-            onSave: saves ? (document) => this.onSave(document) : undefined
+            onSave: saves ? (document) => this.onSave(document) : undefined,
+            validate: validates ? (frame) => this.validate(frame) : undefined,
+            log: (entry) => this.log(entry)
         });
     }
     /** Retrieve — see {@link AttachDocumentOptions.onLoad}. */
@@ -1636,6 +2486,21 @@ export class DocumentRoom extends DurableObject {
     }
     /** Save — see {@link AttachDocumentOptions.onSave}. Not overridden: no alarm is ever set. */
     async onSave(_document) { }
+    /**
+     * Validate a client frame — see {@link AttachDocumentOptions.validate}:
+     * `false` denies it, and the room writes its inverse. Not overridden: no
+     * frame is validated, and no block index is kept.
+     */
+    validate(_frame) { }
+    /**
+     * One log entry (H14): `console.log` of it as JSON, unless the
+     * `EDYTOR_LOG` var is `off`. Override it to send entries elsewhere.
+     */
+    log(entry) {
+        if (String(this.env.EDYTOR_LOG ?? '') === 'off')
+            return;
+        console.log(JSON.stringify(entry));
+    }
     /**
      * Block roles — see {@link AttachDocumentOptions.semantics}. Read once,
      * at first use (after construction: it may return a subclass field).
@@ -1663,6 +2528,18 @@ export class DocumentRoom extends DurableObject {
     compact() {
         return this.room.compact();
     }
+    /** The room's counters, also over RPC — see {@link RoomMetrics}. */
+    metrics() {
+        return this.room.metrics();
+    }
+    /** When the room last stored a change, also over RPC — see {@link AttachedDocument.lastUpdated}. */
+    lastUpdated() {
+        return this.room.lastUpdated();
+    }
+    /** The snapshot compression in flight, also over RPC — see {@link AttachedDocument.compressed}. */
+    compressed() {
+        return this.room.compressed();
+    }
     /** Drop the stored waiting deletes, also over RPC — see {@link AttachedDocument.dropWaitingDeletes}. */
     dropWaitingDeletes() {
         return this.room.dropWaitingDeletes();