Protocol 4 was meant to stop protocol 3 clients from reading as well as
writing, but only the writes checked it. The page snapshot, the shell,
the full snapshot and the element and lineup lists took no protocol, so
a web tab opened before the deploy kept receiving Paranoia rows at
payload version 2, read them as the old size, and authored version 1
writes against them. Those writes were refused and kept, and after a
reload they replayed at protocol 4 and landed: the double move the bump
was for.

Each of those seven queries now requires clientProtocolVersion and
refuses anything but the current one with CLIENT_UPGRADE_REQUIRED,
before reading anything. A client that sends no protocol fails argument
validation, which is how the live web build fails these reads; it
already fails safe on a refused read and keeps its unsent edits. Folder
and strategy listings carry no payloads and are left alone. The client
sends its protocol on every one of these reads, and the contract,
generated client and gauntlet follow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>