I've now had some reports which lead me to believe there is a race condition here, which causes the client to attempt to open an invalid database (invalid due to some of the files involved in the full database copy having been deleted before the server could send them) and fail.
The intention was that this would be recovered by sending followup changesets to the client, which would be applied in turn and result in a valid database. However, the client attempts to open the database before these changesets have been applied, and fails, leaving an invalid database (and also blocking future replication attempts).
I'm attempting to fix this, but making a repeatable test for it is rather hard...
