// Avoid `trim()`/`replace()` here: they allocate a second (potentially huge) string. // We only need a conservative decoded-size estimate to enforce budgets before ...