Answer CodeRabbit's review: 0 🔴, 1 🟡; only a catchable out-of-memory throw is engine-limit, and isolation from heap exhaustion takes a separate process, not a worker

CHANGELOG.md

@@ -10,8 +10,8 @@
 - **Breaking:** the markdown readers refuse a value that is not a string with the new code
   `not-a-string`; `MIGRATION.md` lists what each value did before.
 - **Breaking:** every call returns the new code `engine-limit` where a conversion passes the
-  JavaScript engine's longest array, `Map` or `Set`, or runs it out of memory, and, on
+  JavaScript engine's longest array, `Map` or `Set`, or meets an out-of-memory throw the call can
-  JavaScriptCore, its longest string. A retry may succeed. Every other refusal stays deterministic.
+  catch, and, on JavaScriptCore, its longest string. A retry may succeed. Every other refusal stays deterministic.
 - **Breaking:** an attribute value that is not a plain object, array or JSON primitive, such as a
   `Date`, `Map`, typed array or class instance, makes `isAdfDocument` return `false` and the
   converters refuse it as `not-an-adf-document`. Before, the converters wrote it as `{}` or its own

MIGRATION.md

@@ -114,4 +114,4 @@ the parser refused with one of the four now reads, or refuses with the code the
 | `null`, `undefined` or a non-empty array, on parse | throws a `TypeError` | `not-a-string` |
 | a `String` object, on parse | the document its text spells | `not-a-string`; pass `String(value)` |
 | any other value that is not a string, such as a number or `{}`, on parse | an empty document | `not-a-string` |
-| a conversion past the JavaScript engine's longest array, `Map` or `Set`, or that the engine reports as out of memory, and on JavaScriptCore one past its longest string | throws | `engine-limit`; retry it once |
+| a conversion past the JavaScript engine's longest array, `Map` or `Set`, or meeting an out-of-memory throw the call can catch, and on JavaScriptCore one past its longest string | throws | `engine-limit`; retry it once |

README.md

@@ -412,10 +412,10 @@ typed on `ConvertError` takes both.
 A call reports the first refusal in document order and stops, so a document with several surfaces
 them one per call. Every refusal but `engine-limit` is deterministic — there is no I/O anywhere —
 so a retry returns the identical error: fix the input, or set the document aside. `engine-limit`
-can mean memory ran short: retry it once, and treat a repeat as lasting. On V8 (Node, Deno,
+can mean memory ran short: retry it once, and treat a repeat as lasting. Only an out-of-memory
-Chrome), running out of JavaScript heap ends the process. In Node, convert input of unbounded size
+throw the call can catch becomes `engine-limit`: on V8 (Node, Deno, Chrome), running out of
-in a `worker_threads` worker given `resourceLimits`: running out of heap there ends only that
+JavaScript heap ends the process. Convert input of unbounded size in a separate process with its
-worker.
+own memory limit where that must not take yours down.
 
 ### Parsing