@cotal-ai/cli 0.51.0 → 0.52.0

package/dist/commands/up.js

@@ -35,6 +35,7 @@ export const upFlags = [
     { name: "host", type: "string", value: "<host>", description: "bind host override (an IP/hostname, not a URL; the URL is --server)" },
     { name: "space", type: "string", value: "<s>", description: "space name (default: the folder's)" },
     { name: "store-dir", type: "string", value: "<dir>", description: "JetStream store directory" },
+    { name: "max-file-store", type: "string", value: "<bytes>", description: "JetStream file storage cap in bytes (default: nats-server's dynamic cap). Fixed at broker start; recorded and kept across `down --preserve-state`" },
     { name: "channels", type: "string", value: "<path>", description: "channel-registry seed file (JSON; default .cotal/channels.json)" },
     { name: "tls-cert", type: "string", value: "<file>", description: "serve the broker over TLS with this certificate (requires --tls-key)" },
     { name: "tls-key", type: "string", value: "<file>", description: "the private key for --tls-cert" },
@@ -54,6 +55,7 @@ export const upFlags = [
     { name: "detach", type: "boolean", description: "run in the background (stop with `cotal down`)" },
     { name: "runtime", type: "string", value: "<name>", description: "agent runtime for the mesh manager (default pty; extension runtimes are explicit-only, see `cotal runtimes`); with -f overrides the manifest's runtime" },
     { name: "max-sessions", type: "string", value: "<n>", description: "live-session ceiling for the mesh manager (default 64; one session per console pane, so size for agents × panes). Recorded and reused by later manager launches" },
+    { name: "no-manager", type: "boolean", description: "broker-only boot: start the broker and, in auth mode, the delivery daemon, and no local manager (refuses on a mesh whose manager is live)" },
     { name: "file", type: "string", short: "f", value: "<cotal.yaml>", description: "launch a whole mesh from a manifest" },
     { name: "dry-run", type: "boolean", description: "with -f: print the plan, mutate nothing" },
 ];
@@ -145,6 +147,11 @@ async function runUp(args, inheritedLock, onAdopt) {
     // read. A rotation is a stopped, fresh boot; a half-finished maintenance attempt is neither.
     if (values["rotate-sys"] && (values.__restoreAttempt || values.__ordinaryResumeAttempt))
         throw new Error("--rotate-sys cannot run during a restore/resume re-entry - finish or roll back the maintenance attempt, then `cotal down` and `cotal up --rotate-sys`");
+    // Same seam, same reason: a restore/resume re-entry needs the manager to commit the preserved
+    // inventory (completeResumeActivation asks it for resumePreserved/commitResume/finalizeResume), so
+    // a broker-only ask there is a contradiction to refuse, never a flag to drop mid-recovery.
+    if (values["no-manager"] && (values.__restoreAttempt || values.__ordinaryResumeAttempt))
+        throw new Error("--no-manager cannot run during a restore/resume re-entry - the resume needs a manager to commit the preserved inventory; finish or roll back the maintenance attempt first");
     if (!values.__restoreAttempt && !values.__ordinaryResumeAttempt && !values.file) {
         const root = cotalRoot();
         // Same refusal for the AUTO-recovered journal, raised before the recovery is prepared and
@@ -152,6 +159,11 @@ async function runUp(args, inheritedLock, onAdopt) {
         // `up` that has already begun adopting a maintenance attempt.
         if (values["rotate-sys"] && readMaintenanceJournal(root))
             throw new Error("--rotate-sys is refused while this root has a maintenance attempt to recover - finish or roll back that attempt (`cotal up` alone recovers it), then `cotal down` and `cotal up --rotate-sys`");
+        // Raised here for the stronger reason the journal itself carries: a pending maintenance attempt
+        // means the store is mid-recovery, and a broker-only boot over it is wrong with or without the
+        // manager half. The manager half is why the FLAG specifically cannot apply.
+        if (values["no-manager"] && readMaintenanceJournal(root))
+            throw new Error("--no-manager is refused while this root has a maintenance attempt to recover - a resume needs a manager to commit the preserved inventory; recover it (`cotal up` alone) or roll it back first");
         const lock = acquireMaintenanceLock(root);
         let pending;
         let recoveredRestore;
@@ -205,6 +217,12 @@ async function runUp(args, inheritedLock, onAdopt) {
                 // Journal the CANONICAL identity-checked path, never the caller's spelling: a relative or
                 // symlinked spelling re-resolved later (other cwd, retargeted link) could open another store.
                 const resumeStore = journal.source.path;
+                // The cap is part of the preserved launch, like the store: a resume re-renders it, and a
+                // different --max-file-store is refused rather than silently resizing the preserved broker.
+                const resumeMaxFileStore = journaledMaxFileStore(launch.maxFileStore);
+                const requestedMaxFileStore = parsePositiveIntegerFlag("--max-file-store", values["max-file-store"]);
+                if (requestedMaxFileStore !== undefined && requestedMaxFileStore !== resumeMaxFileStore)
+                    throw new Error(`--max-file-store ${requestedMaxFileStore} is not the preserved launch cap (${resumeMaxFileStore ?? "unset"}); ordinary up resumes exactly the preserved cap - omit --max-file-store`);
                 if (values.runtime && runtimes[0] && values.runtime !== runtimes[0])
                     throw new Error(`--runtime ${values.runtime} contradicts the preserved agent runtime ${runtimes[0]}; omit it to resume the same principals`);
                 const resumeRuntime = values.runtime ?? runtimes[0] ?? "pty";
@@ -219,6 +237,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                     launch: {
                         server: resumeServer,
                         storeDir: resumeStore,
+                        ...(resumeMaxFileStore !== undefined ? { maxFileStore: resumeMaxFileStore } : {}),
                         runtime: resumeRuntime,
                         detached: Boolean(values.detach),
                         serverName,
@@ -238,6 +257,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                     mode: journal.mode,
                     server: resumeServer,
                     storeDir: resumeStore,
+                    ...(resumeMaxFileStore !== undefined ? { maxFileStore: resumeMaxFileStore } : {}),
                     runtime: resumeRuntime,
                     detached: Boolean(values.detach),
                     inventory: resume.inventory,
@@ -251,6 +271,10 @@ async function runUp(args, inheritedLock, onAdopt) {
                 const resume = readMaintenanceResumeDocument(root, journal.resume);
                 const launch = journal.ordinaryResume.launch;
                 const attemptId = journal.ordinaryResume.attemptId;
+                const recoveredMaxFileStore = journaledMaxFileStore(launch.maxFileStore);
+                const requestedMaxFileStore = parsePositiveIntegerFlag("--max-file-store", values["max-file-store"]);
+                if (requestedMaxFileStore !== undefined && requestedMaxFileStore !== recoveredMaxFileStore)
+                    throw new Error(`--max-file-store ${requestedMaxFileStore} is not the preserved launch cap (${recoveredMaxFileStore ?? "unset"}); resume attempt ${attemptId} re-renders exactly the preserved cap - omit --max-file-store`);
                 // Recovery re-asserts the source identity rather than trusting the journaled spelling.
                 assertStoreIdentity(journal.source);
                 // The bound listener decides re-entry: a live exact listener is ADOPTED, a provably dead
@@ -295,6 +319,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                     mode: journal.mode,
                     server: typeof launch.server === "string" ? launch.server : DEFAULT_SERVER,
                     storeDir: journal.source.path,
+                    ...(recoveredMaxFileStore !== undefined ? { maxFileStore: recoveredMaxFileStore } : {}),
                     runtime: typeof launch.runtime === "string" ? launch.runtime : "pty",
                     detached: launch.detached === true,
                     inventory: resume.inventory,
@@ -353,6 +378,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                             space: pending.space,
                             server: pending.server,
                             "store-dir": pending.storeDir,
+                            "max-file-store": pending.maxFileStore === undefined ? undefined : String(pending.maxFileStore),
                             runtime: pending.runtime,
                             detach: pending.detached,
                             open: pending.mode === "open",
@@ -382,8 +408,22 @@ async function runUp(args, inheritedLock, onAdopt) {
     if (values.idp && !wantUser && !values.file) {
         throw new Error('--idp is for user-auth spaces; pair it with --user-auth, or set broker.auth: "user" in a manifest');
     }
+    // BROKER-ONLY MODE (#1417). `--no-manager` names what it omits, and the two manager-shaping flags
+    // are refused beside it rather than silently dropped: a runtime selected or a ceiling recorded for
+    // a manager that will never start is a misunderstanding, and dropping it quietly is the exact
+    // silent-no-op shape this repo refuses everywhere else.
+    const noManager = Boolean(values["no-manager"]);
+    if (noManager && values.runtime)
+        throw new Error("--no-manager cannot be combined with --runtime - no manager starts, so there is no runtime to select; drop --runtime, or drop --no-manager");
+    if (noManager && values["max-sessions"])
+        throw new Error("--no-manager cannot be combined with --max-sessions - no manager starts, so there is no session ceiling to set; drop --max-sessions, or drop --no-manager");
     const publicExchange = publicExchangeArgs(values, wantUser);
     const maxSessions = parsePositiveIntegerFlag("--max-sessions", values["max-sessions"]);
+    const maxFileStore = parsePositiveIntegerFlag("--max-file-store", values["max-file-store"]);
+    // The manifest path renders its broker from the manifest, which has no store fields, so the flag
+    // would be accepted and never rendered. Refuse it rather than drop it.
+    if (maxFileStore !== undefined && values.file)
+        throw new Error("--max-file-store cannot be combined with --file/-f - a manifest launch does not render a store cap; drop --max-file-store, or start the mesh without -f");
     // An open mesh has no operator, no system account, and no $SYS creds, so there is nothing to
     // rotate; the request is a misunderstanding to name, never a silent no-op that reports success.
     if (values["rotate-sys"] && values.open) {
@@ -473,6 +513,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 idp: values.idp,
                 rotateSys: values["rotate-sys"],
                 maxSessions,
+                noManager,
             });
             return;
         }
@@ -491,6 +532,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 idp: values.idp,
                 rotateSys: values["rotate-sys"],
                 maxSessions,
+                noManager,
             });
         }
         finally {
@@ -628,6 +670,13 @@ async function runUp(args, inheritedLock, onAdopt) {
                     console.error(c.red(`✗ mesh "${held.space}" is already running at ${server} - a running broker can't change its transport; \`cotal down\` it first, then \`cotal up --tls-cert <cert> --tls-key <key>\``));
                     process.exit(1);
                 }
+                // The store cap is fixed when nats-server reads its config, and nats-server refuses a reload
+                // from its dynamic cap to an explicit one. This branch starts nothing, so a different cap can
+                // only be refused; the same cap is a no-op.
+                if (maxFileStore !== undefined && maxFileStore !== held.maxFileStore) {
+                    console.error(c.red(`✗ mesh "${held.space}" is already running at ${server} - a running broker can't change --max-file-store (it is fixed at start); \`cotal down\` it first, then \`cotal up --max-file-store ${maxFileStore}\``));
+                    process.exit(1);
+                }
                 // `--max-sessions` is fixed when the manager starts. A refresh reuses a live manager as-is
                 // (`ensureManager` returns immediately), then used to persist the requested ceiling anyway.
                 // That printed `✓ already running` over an unchanged plane and left MeshEntry lying about it.
@@ -640,6 +689,18 @@ async function runUp(args, inheritedLock, onAdopt) {
                         process.exit(1);
                     }
                 }
+                // `--no-manager` on a refresh whose manager is LIVE is the same class of refusal: this branch
+                // starts nothing, so the flag cannot apply, and silently keeping the manager would answer a
+                // broker-only ask with a full stack while silently stopping it would kill agents this command
+                // was never asked to touch. Same shape as `--runtime`/`--max-sessions` above: refuse, name the
+                // exact remedy. A refresh of a mesh whose manager is NOT live simply proceeds broker-only.
+                if (noManager) {
+                    const live = managerRecordState(undefined, undefined, held.space);
+                    if (live.state === "alive") {
+                        console.error(c.red(`✗ mesh "${held.space}" is already running at ${server} with a live manager - \`cotal up --no-manager\` will not keep or stop one; \`cotal down manager\` first, then \`cotal up --no-manager\``));
+                        process.exit(1);
+                    }
+                }
                 // Live INFO must agree with the recorded/requested transport. A bare refresh that greets
                 // "already running" over a plaintext listener while policy claims TLS is S5's second half —
                 // the refuse left a durable lie and this path used to reprint TLS success over cleartext.
@@ -751,6 +812,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                         runtime: values.runtime,
                         attachHost: attachHostFor(held.space, values.host),
                         maxSessions: maxSessionsFor(held.space, maxSessions),
+                        noManager,
                     });
                     if (!controlPlane)
                         process.exitCode = 1;
@@ -763,7 +825,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 // no transport decision to record — and `recordOurMesh` writes the entry whole, so omitting
                 // the field here would erase the requirement on every bare refresh, exactly the way dropping
                 // `attachHost` would silently demote the mesh to loopback.
-                recordOurMesh({ space: held.space, server, root, mode: held.mode, ...(held.tlsRequired !== undefined ? { tlsRequired: held.tlsRequired } : {}), ...(userAuth ? { userAuth } : {}), ...(heldAttachHost ? { attachHost: heldAttachHost } : {}), ...(heldMaxSessions !== undefined ? { maxSessions: heldMaxSessions } : {}), ts: new Date().toISOString() }, "refresh");
+                recordOurMesh({ space: held.space, server, root, mode: held.mode, ...(held.tlsRequired !== undefined ? { tlsRequired: held.tlsRequired } : {}), ...(userAuth ? { userAuth } : {}), ...(heldAttachHost ? { attachHost: heldAttachHost } : {}), ...(heldMaxSessions !== undefined ? { maxSessions: heldMaxSessions } : {}), ...(held.maxFileStore !== undefined ? { maxFileStore: held.maxFileStore } : {}), ts: new Date().toISOString() }, "refresh");
                 return;
             }
             const who = held ? `mesh "${held.space}" (${held.root})` : "a broker not started here";
@@ -795,6 +857,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 transport,
                 server,
                 storeDir: values["store-dir"],
+                maxFileStore,
                 space: values.space,
                 open: values.open,
                 userAuth: wantUser ? { idpUrl: values.idp } : undefined,
@@ -807,6 +870,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 host: values.host,
                 runtime: values.runtime,
                 maxSessions,
+                noManager,
                 resumeAttempt,
                 resumeCommitToken: restored?.managerCommit?.durableCommitToken ?? ordinaryAttempt?.managerCommit?.durableCommitToken,
                 ...(restored ? {
@@ -862,14 +926,14 @@ async function runUp(args, inheritedLock, onAdopt) {
         // Decided above the branch; the dial host is only settled here (a port collision may have moved
         // the server, and the hostname is what the certificate has to match).
         assertServesDialHost(transport, new URL(server).hostname);
-        const setup = useAuth ? await authSetup(storeDir, server, space, host, wantUser ? { idpUrl: values.idp } : undefined, transport, values["rotate-sys"]) : undefined;
+        const setup = useAuth ? await authSetup(storeDir, server, space, host, wantUser ? { idpUrl: values.idp } : undefined, transport, values["rotate-sys"], maxFileStore) : undefined;
         const port = Number(new URL(server).port) || 4222;
         const restored = resumeAttempt ? pendingRestores.get(resumeAttempt) : undefined;
         // Both modes go through a RENDERER, never bare CLI flags. Open mode used to start from
         // `-js -sd … -p … -a …`, which never called a renderer at all — so the required transport union
         // protected the auth path and was silent on the open one, and a cert/key pair passed to an
         // open-mode `up` would have been accepted while the listener came up in cleartext.
-        const confPath = setup ? setup.confPath : writeOpenBrokerConf(storeDir, { port, host, transport });
+        const confPath = setup ? setup.confPath : writeOpenBrokerConf(storeDir, { port, host, transport, maxFileStore });
         const natsArgs = [
             "-c", confPath,
             ...(restored ? ["--name", restored.serverName]
@@ -1001,6 +1065,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 // though the operator had chosen it.
                 ...(effectiveAttachHost ? { attachHost: effectiveAttachHost } : {}),
                 ...(effectiveMaxSessions !== undefined ? { maxSessions: effectiveMaxSessions } : {}),
+                ...(maxFileStore !== undefined ? { maxFileStore } : {}),
                 ts: new Date().toISOString(),
             }, "started");
             // Bring up the delivery daemon WITH the server (auth mode only — it self-gates on `.cotal/auth`).
@@ -1014,6 +1079,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 // is never a side effect of anything but the operator binding the mesh somewhere reachable.
                 attachHost: effectiveAttachHost,
                 maxSessions: effectiveMaxSessions,
+                noManager,
                 resumeAttempt,
                 resumeCommitToken: restored?.managerCommit?.durableCommitToken ?? ordinaryAttempt?.managerCommit?.durableCommitToken,
                 wsPort: setup?.wsPort, // P2 item 6: the console session client's broker ws port
@@ -1365,6 +1431,7 @@ async function resumeProvenOrdinaryListener(pending, heldLock) {
         ...(svc.userAuth ? { userAuth: svc.userAuth } : {}),
         ...(adoptAttachHost ? { attachHost: adoptAttachHost } : {}),
         ...(adoptMaxSessions !== undefined ? { maxSessions: adoptMaxSessions } : {}),
+        ...(pending.maxFileStore !== undefined ? { maxFileStore: pending.maxFileStore } : {}),
         ts: new Date().toISOString(),
     }, "started");
     const controlPlane = await startDeliveryWithBroker(pending.space, pending.server, adoptedTlsRequired(pending.root), {
@@ -1687,6 +1754,12 @@ async function upManifest(file, opts) {
     const open = m.broker?.auth === false; // default is auth
     const userAuth = m.broker?.auth === "user" ? { idpUrl: opts.idp ?? m.broker?.idp } : undefined; // flag > manifest
     const runtime = m.runtime ?? "pty";
+    // A manifest's agents are booted BY the manager `up -f` starts with the mesh, so `--no-manager`
+    // against a manifest declaring agents asks for a boot that cannot deliver its own plan. Refused
+    // before the dry-run print and before anything boots, with the two workable spellings named.
+    if (opts.noManager && eff.agents.length)
+        throw new Error(`--no-manager cannot launch this manifest: it declares ${eff.agents.length} agent(s), and a manifest's agents are booted by its manager (which --no-manager omits). Deploy it from a manager host with \`cotal spawn -f\`, or drop --no-manager.`);
+    const effectiveNoManager = Boolean(opts.noManager);
     // The open-mesh refusal must be RE-STATED here, not only against the CLI `--open` flag: on this
     // path openness comes from the MANIFEST (`broker.auth: false`), which the flag-level guard cannot
     // see. Without it, `cotal up -f open.yaml --rotate-sys` boots an open broker, exits 0 and rotates
@@ -1703,6 +1776,10 @@ async function upManifest(file, opts) {
         if (opts.transport.kind === "tls-required")
             announceTransport(opts.transport);
         console.log(renderUpPlan(eff, server));
+        // The omission is part of the plan (#1417): a dry run that lists a manager the real boot
+        // will not start is the exact "green-lit a launch the applying command refuses" failure.
+        if (effectiveNoManager)
+            console.log(c.dim("  no manager will start on this host (--no-manager): broker, channels and, in auth mode, the delivery daemon come up, and no agents launch from here"));
         return;
     }
     // Preflight an extension runtime before starting the broker. The detached manager re-execs this
@@ -1756,7 +1833,7 @@ async function upManifest(file, opts) {
     try {
         // `m.broker?.host`, not the defaulted `host`: same reason as the flag path — only a host the
         // manifest actually declared is an exposure decision worth persisting.
-        ({ pid, controlPlane, authService } = await startMeshDetached({ transport: opts.transport, server, space: m.space, open, userAuth, rotateSys: opts.rotateSys, host: m.broker?.host, seed: manifestToChannels(eff), runtime, launch: specPath, maxSessions: opts.maxSessions }));
+        ({ pid, controlPlane, authService } = await startMeshDetached({ transport: opts.transport, server, space: m.space, open, userAuth, rotateSys: opts.rotateSys, host: m.broker?.host, seed: manifestToChannels(eff), runtime, launch: specPath, maxSessions: opts.maxSessions, noManager: effectiveNoManager }));
     }
     catch (e) {
         console.error(c.red(`✗ ${e.message}`));
@@ -1767,7 +1844,12 @@ async function upManifest(file, opts) {
     console.log(c.dim(`  seeded ${m.channels.length} channel(s): ${m.channels.map((ch) => "#" + ch.name).join(", ")}`));
     // Never claim a launch the control plane can't deliver: the manager carries the launch spec, so a
     // degraded control plane (announced above) means the agents are NOT coming up.
-    if (controlPlane) {
+    if (effectiveNoManager) {
+        // Truthful summary for the broker-only boot (#1417): nothing was omitted by accident, and the
+        // agents this manifest declares (none — a declaring manifest is refused above) launch elsewhere.
+        console.log(c.dim(`  broker-only (--no-manager): no manager started on this host - run \`cotal supervise --space ${m.space} --server ${server}\` from a manager host to manage agents`));
+    }
+    else if (controlPlane) {
         // U6: on a user mesh the agents run under the OPERATOR's identity — say whose they are.
         console.log(c.green(`✓ launching ${eff.agents.length} agent(s)`) + c.dim(` via manager (${runtime})${owner ? ` as you (owner ${owner})` : ""} - see ${managerLogDisplayPath(m.space)}`));
     }
@@ -1780,7 +1862,7 @@ async function upManifest(file, opts) {
         console.log("\n" + inherited);
     if (eff.warnings.length)
         console.log("\n" + renderWarnings(eff.warnings));
-    console.log(c.dim(`\nWatch: \`cotal console --space ${m.space}\` or \`cotal web\`   ·   Tear down: \`cotal down\``));
+    console.log(c.dim(`\nWatch: \`cotal web\` (browser dashboard) or \`cotal console --space ${m.space}\` (terminal)   ·   Tear down: \`cotal down\``));
     // A declared-user-auth manifest whose auth service never became ready: the mesh is up + recorded
     // (re-`cotal up` heals), but this launch did not deliver a usable identity plane — exit non-zero
     // so CI/wrappers don't read success (the red consequence line printed at the failure above).
@@ -1885,11 +1967,11 @@ opts) {
     // effective server is finally known — a manifest may name a different host than the flags did, and
     // a certificate that is valid for one is not thereby valid for the other.
     const transport = assertServesDialHost(opts.transport, new URL(server).hostname);
-    const setup = useAuth ? await authSetup(storeDir, server, space, host, opts.userAuth, transport, opts.rotateSys) : undefined;
+    const setup = useAuth ? await authSetup(storeDir, server, space, host, opts.userAuth, transport, opts.rotateSys, opts.maxFileStore) : undefined;
     const port = Number(new URL(server).port) || 4222;
     // Same rule as the foreground path: every route to a listener names its transport (see
     // `writeOpenBrokerConf`). Detach must not be the mode where the fence quietly does not apply.
-    const confPath = setup ? setup.confPath : writeOpenBrokerConf(storeDir, { port, host, transport });
+    const confPath = setup ? setup.confPath : writeOpenBrokerConf(storeDir, { port, host, transport, maxFileStore: opts.maxFileStore });
     const args = [
         "-c", confPath,
         ...(opts.boundListener ? ["--name", opts.boundListener.serverName] : []),
@@ -1985,6 +2067,7 @@ opts) {
         // Persist only a real decision — declared now, or carried forward — never the loopback default.
         ...(effectiveAttachHost ? { attachHost: effectiveAttachHost } : {}),
         ...(effectiveMaxSessions !== undefined ? { maxSessions: effectiveMaxSessions } : {}),
+        ...(opts.maxFileStore !== undefined ? { maxFileStore: opts.maxFileStore } : {}),
         ts: new Date().toISOString(),
     }, "started");
     // Commit policy BEFORE delivery launch (S9). Listener is proved; refuse paths never reach here.
@@ -1997,6 +2080,7 @@ opts) {
         // See the foreground path: the broker's bind address is what makes attach reachable off-box.
         attachHost: effectiveAttachHost,
         maxSessions: effectiveMaxSessions,
+        noManager: opts.noManager,
         resumeAttempt: opts.resumeAttempt,
         resumeCommitToken: opts.resumeCommitToken,
         wsPort: setup?.wsPort, // P2 item 6: the console session client's broker ws port
@@ -2121,6 +2205,15 @@ export function attachHostFor(space, explicit) {
 export function maxSessionsFor(space, explicit) {
     return explicit ?? findMesh(space)?.maxSessions;
 }
+/** The store cap a preserved launch recorded: absent, or a positive integer byte count. Anything
+ *  else is a damaged journal, refused rather than rendered as the dynamic default. */
+function journaledMaxFileStore(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1)
+        throw new Error(`the preserved launch records an invalid maxFileStore (${JSON.stringify(value)}); refusing to guess the broker's store cap`);
+    return value;
+}
 /** {@link recordOurMesh} under a name that says it is a test seam: the origin rule it enforces is
  *  asserted directly by the registry smoke, since reaching each branch through a full `up` would
  *  need a live broker per case. */
@@ -2509,7 +2602,7 @@ function validateRecorded(transport, dialHost, opts = {}) {
  */
 function writeOpenBrokerConf(storeDir, opts) {
     const confPath = resolve(storeDir, "..", "server-open.conf");
-    writeFileSync(confPath, openServerConfig({ port: opts.port, host: opts.host, storeDir, transport: opts.transport }));
+    writeFileSync(confPath, openServerConfig({ port: opts.port, host: opts.host, storeDir, maxFileStore: opts.maxFileStore, transport: opts.transport }));
     return confPath;
 }
 async function authSetup(storeDir, server, space, host = "127.0.0.1", user, 
@@ -2518,7 +2611,7 @@ async function authSetup(storeDir, server, space, host = "127.0.0.1", user,
 // operator's `--tls-cert` sat validated and unused. A default here cannot be right, because the
 // safe value and the common value are different values — every caller knows its transport, and
 // the one that does not is the one that must not compile.
-transport, rotateSys = false) {
+transport, rotateSys = false, maxFileStore) {
     const dir = authDir(cotalRoot()); // the broker config (server.conf) still lands under the FS auth dir
     const store = workspaceSecretStore(cotalRoot());
     let auth = await getSpaceAuth(store, space);
@@ -2627,7 +2720,7 @@ transport, rotateSys = false) {
             : await resolveAuthProvider().preloadAccounts({ store, space: enabledSpace });
         extraAccounts.push(...accounts);
     }
-    writeFileSync(confPath, serverConfig(auth, spaces, { transport, port, storeDir, host, wsPort, wsHost: host, extraAccounts }));
+    writeFileSync(confPath, serverConfig(auth, spaces, { transport, port, storeDir, maxFileStore, host, wsPort, wsHost: host, extraAccounts }));
     // Ephemeral setup cred: used only to probe reachability, pre-create the space streams/buckets
     // (setupSpaceStreams) and seed the channel registry (seedChannelRegistry) — all within the
     // enumerated `provisioner` scope. No broad `manager` residual for the up path.