@cotal-ai/cli 0.57.0 → 0.58.0

package/dist/commands/up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAkBA,OAAO,EAOL,KAAK,eAAe,EAgBpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EA+BL,KAAK,SAAS,EAqBd,KAAK,eAAe,EAcrB,MAAM,qBAAqB,CAAC;AA0D7B,yGAAyG;AACzG,eAAO,MAAM,OAAO,EAAE,QAAQ,EA4B7B,CAAC;AAEF;;;qGAGqG;AACrG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAS3D;AAED;2FAC2F;AAC3F,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzF;AAg9DD,MAAM,WAAW,UAAU;IACzB;;;;;;;;;OASG;IACH,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B;;4FAEwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;qEACiE;IACjE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;wDACoD;IACpD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;yGACqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;kGAG8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;+EAC2E;IAC3E,aAAa,CAAC,EAAE;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC;IACF,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAGrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAuI5I;AAuFD;;;;;oGAKoG;AACpG,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAWD;;;+DAG+D;AAC/D;;;;;;;;;;GAUG;AACH,KAAK,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAExC;;mCAEmC;AACnC,eAAO,MAAM,oBAAoB,GAAI,GAAG,SAAS,EAAE,YAAY,UAAU,KAAG,IAAoC,CAAC"}
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAmBA,OAAO,EAOL,KAAK,eAAe,EAkBpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EA+BL,KAAK,SAAS,EAqBd,KAAK,eAAe,EAcrB,MAAM,qBAAqB,CAAC;AA0D7B,yGAAyG;AACzG,eAAO,MAAM,OAAO,EAAE,QAAQ,EA4B7B,CAAC;AAEF;;;qGAGqG;AACrG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAS3D;AAED;2FAC2F;AAC3F,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzF;AA8iED,MAAM,WAAW,UAAU;IACzB;;;;;;;;;OASG;IACH,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B;;4FAEwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;qEACiE;IACjE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;wDACoD;IACpD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;yGACqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;kGAG8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;+EAC2E;IAC3E,aAAa,CAAC,EAAE;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC;IACF,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAGrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAwJ5I;AAuFD;;;;;oGAKoG;AACpG,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAWD;;;+DAG+D;AAC/D;;;;;;;;;;GAUG;AACH,KAAK,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAExC;;mCAEmC;AACnC,eAAO,MAAM,oBAAoB,GAAI,GAAG,SAAS,EAAE,YAAY,UAAU,KAAG,IAAoC,CAAC"}

package/dist/commands/up.js

@@ -2,11 +2,11 @@ import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { createConnection, createServer } from "node:net";
 import { hostname } from "node:os";
-import { mkdirSync, writeFileSync, readFileSync, existsSync, openSync, statSync, readSync, closeSync, lstatSync, rmSync, realpathSync, } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, existsSync, openSync, statSync, readSync, closeSync, lstatSync, rmSync, realpathSync, readdirSync, } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { isReachable, DEFAULT_SERVER, createSpaceAuth, serverConfig, openServerConfig, validateTlsMaterial, mintCreds, mintLifecycleUid, DEV_OWNER, mintConnectionEvictorCreds, mintMembershipObserverCreds, newIdentity, setupSpaceStreams, reconcileSpaceTtls, standaloneConnectOpts, seedChannelRegistry, ensureDefaultDeliveryClass, mkSecretDir, writeSecretFile, } from "@cotal-ai/core";
+import { isReachable, DEFAULT_SERVER, createSpaceAuth, serverConfig, openServerConfig, validateTlsMaterial, mintCreds, mintLifecycleUid, DEV_OWNER, mintConnectionEvictorCreds, mintMembershipObserverCreds, newIdentity, setupSpaceStreams, reconcileSpaceTtls, standaloneConnectOpts, requireBrokerFloor, parseServerVersion, seedChannelRegistry, ensureDefaultDeliveryClass, mkSecretDir, writeSecretFile, } from "@cotal-ai/core";
 import { connect } from "@nats-io/transport-node";
-import { assertSingleSpaceBroker, assertUserAuthInfo, authDir, getSoleSpaceAuth, getSpaceAuth, hasUserAuthState, listSpaceAccounts, preloadSpaceAccounts, putSpaceAuth, clearCurrent, findMesh, getCurrent, loadMeshes, connectionEvictorCredsKey, membershipConfigPath, membershipObserverCredsKey, membershipRwCredsKey, MEMBERSHIP_CONFIG_KIND, MEMBERSHIP_RW_CREDS_KIND, parsePositiveIntegerFlag, recordMesh, meshesForRoot, removeMesh, rotateSystemCreds, setCurrent, staleSystemCreds, SYSTEM_CREDS_FILES, userAuthStateDir, userAuthSpacesOnDisk, workspaceSecretStore, acquireMaintenanceLock, assertStoreIdentity, assessRestoreClaim, beginOrdinaryResume, bindOrdinaryResumeListener, consumeRetiredMaintenance, markOrdinaryResumeActive, markOrdinaryResumeDegraded, replaceDeadOrdinaryResumeListener, localProcessOwnerStatus, readMaintenanceJournal, readMaintenanceResumeDocument, seatCheckpointDir, readStoreIdentity, recordOrdinaryResumeManagerCommit, releaseMaintenanceLock, retireOrdinaryResume, sameStoreIdentity, readBrokerPolicy, writeBrokerPolicy, removeIdentityPin, writeIdentityPin, localProcessPath, MANAGER_PIDFILE, assertManagerCanSpare, verifyIdentityPin, isLoopbackHost, } from "@cotal-ai/workspace";
+import { assertSingleSpaceBroker, assertUserAuthInfo, authDir, getSoleSpaceAuth, getSpaceAuth, hasUserAuthState, listSpaceAccounts, preloadSpaceAccounts, putSpaceAuth, clearCurrent, findMesh, getCurrent, loadMeshes, connectionEvictorCredsKey, membershipConfigPath, membershipObserverCredsKey, membershipRwCredsKey, MEMBERSHIP_CONFIG_KIND, MEMBERSHIP_RW_CREDS_KIND, parsePositiveIntegerFlag, recordMesh, meshesForRoot, removeMesh, rotateSystemCreds, setCurrent, staleSystemCreds, SYSTEM_CREDS_FILES, userAuthStateDir, userAuthSpacesOnDisk, workspaceSecretStore, acquireMaintenanceLock, assertStoreIdentity, assessRestoreClaim, beginOrdinaryResume, bindOrdinaryResumeListener, consumeRetiredMaintenance, markOrdinaryResumeActive, markOrdinaryResumeDegraded, replaceDeadOrdinaryResumeListener, localProcessOwnerStatus, readMaintenanceJournal, readMaintenanceResumeDocument, seatCheckpointDir, readStoreIdentity, recordOrdinaryResumeManagerCommit, releaseMaintenanceLock, retireOrdinaryResume, sameStoreIdentity, readBrokerPolicy, writeBrokerPolicy, removeIdentityPin, writePidPair, localProcessPath, MANAGER_PIDFILE, assertManagerCanSpare, verifyIdentityPin, isLoopbackHost, } from "@cotal-ai/workspace";
 import { ensureAuthService, resolveAuthProvider, stopAuthService } from "../lib/auth-proc.js";
 import { resolveSpace } from "../lib/status.js";
 import { c } from "../ui.js";
@@ -584,8 +584,6 @@ async function runUp(args, inheritedLock, onAdopt) {
         // Gated on the ATTEMPT, not on holding the lock. The lock is now always held, and this refuses
         // whenever a journal exists — which is precisely the state a resume re-entry is in, so gating
         // it on the lock would refuse the very resume the lock is here to protect.
-        if (!resumeAttempt)
-            assertOrdinaryUpAllowed(cotalRoot(), values["store-dir"] ? resolve(values["store-dir"]) : cotalPath("nats"));
         let server = values.server ?? DEFAULT_SERVER;
         const host = values.host ?? "127.0.0.1";
         // `--host` is the BIND address; `server` is the URL the readiness probe, the mesh registry, and
@@ -596,6 +594,46 @@ async function runUp(args, inheritedLock, onAdopt) {
         // pair rather than starting a broker nothing can reach.
         if (values.host)
             server = reconcileHostAndServer(values.host, values.server);
+        // A same-root repair reopens the store the mesh record names, ONCE, before the ordinary-up
+        // assertion below reads --store-dir (#2218): an ordinary `up` on a space whose broker died must
+        // not silently fall back to the root's default store while the record still names a custom one.
+        // Never runs during a resume attempt, which keeps its own store checks. The reachability probe
+        // here is reused as `listenerReachable` further down instead of probing twice.
+        let repairProbe;
+        if (!resumeAttempt) {
+            const repairSpace = values.space ?? resolveSpace(process.cwd());
+            const repairRoot = cotalRoot();
+            const heldForRepair = loadMeshes().find((m) => m.origin !== "manual" && m.origin !== "catalog" && m.server === server && m.root === repairRoot && m.space === repairSpace);
+            if (heldForRepair) {
+                repairProbe = await isReachable(server);
+                if (!repairProbe) {
+                    if (values["store-dir"] !== undefined) {
+                        const requestedStoreDir = resolve(values["store-dir"]);
+                        if (heldForRepair.storeDir !== undefined && requestedStoreDir !== heldForRepair.storeDir) {
+                            console.error(c.red(`✗ mesh "${repairSpace}" is recorded at ${server} with store ${heldForRepair.storeDir} - a stopped broker can't change --store-dir (it is fixed at start); repair it with \`cotal up --store-dir ${heldForRepair.storeDir}\`, or \`cotal down\` it first`));
+                            process.exit(1);
+                        }
+                    }
+                    else if (heldForRepair.storeDir !== undefined) {
+                        values["store-dir"] = heldForRepair.storeDir;
+                        console.log(c.dim(`reopening the recorded store ${heldForRepair.storeDir}`));
+                    }
+                    else {
+                        const defaultStore = cotalPath("nats");
+                        let hasEntries = false;
+                        try {
+                            hasEntries = readdirSync(join(defaultStore, "jetstream")).length > 0;
+                        }
+                        catch { /* absent: no jetstream dir yet */ }
+                        if (!hasEntries) {
+                            console.error(c.yellow(`! mesh "${repairSpace}" was recorded before the store directory was kept, so this repair opens ${defaultStore}; if the previous broker used --store-dir, stop this one with \`cotal down\` and repair with that flag (its Store Directory: line is in ${repairRoot}/.cotal/nats.log)`));
+                        }
+                    }
+                }
+            }
+        }
+        if (!resumeAttempt)
+            assertOrdinaryUpAllowed(cotalRoot(), values["store-dir"] ? resolve(values["store-dir"]) : cotalPath("nats"));
         const restoredAttempt = resumeAttempt ? pendingRestores.get(resumeAttempt) : undefined;
         if (restoredAttempt?.reentry) {
             if (!restoredAttempt.listenerProof)
@@ -622,7 +660,7 @@ async function runUp(args, inheritedLock, onAdopt) {
         }
         if (ordinaryAttempt?.journalState === "resume-committed")
             throw new Error(`resume attempt ${resumeAttempt} is manager-committed but has no adoptable bound listener; preserving the commit token and retained suppression`);
-        const listenerReachable = await isReachable(server);
+        const listenerReachable = repairProbe !== undefined ? repairProbe : await isReachable(server);
         if (resumeAttempt && listenerReachable)
             throw new Error(`resume attempt ${resumeAttempt} refuses the unproven occupied listener at ${server}`);
         if (listenerReachable) {
@@ -678,6 +716,13 @@ async function runUp(args, inheritedLock, onAdopt) {
                     console.error(c.red(`✗ mesh "${held.space}" is already running at ${server} - a running broker can't change --max-file-store (it is fixed at start); \`cotal down\` it first, then \`cotal up --max-file-store ${maxFileStore}\``));
                     process.exit(1);
                 }
+                // The store directory is fixed the same way: an explicit --store-dir on a live refresh can
+                // only be refused when it disagrees with what the running broker actually opened. Absent
+                // `held.storeDir` (a pre-field record) has nothing to compare against, so it is not checked.
+                if (values["store-dir"] !== undefined && held.storeDir !== undefined && resolve(values["store-dir"]) !== held.storeDir) {
+                    console.error(c.red(`✗ mesh "${held.space}" is already running at ${server} - a running broker can't change --store-dir (it is fixed at start); \`cotal down\` it first, then \`cotal up --store-dir ${resolve(values["store-dir"])}\``));
+                    process.exit(1);
+                }
                 // `--max-sessions` is fixed when the manager starts. A refresh reuses a live manager as-is
                 // (`ensureManager` returns immediately), then used to persist the requested ceiling anyway.
                 // That printed `✓ already running` over an unchanged plane and left MeshEntry lying about it.
@@ -746,6 +791,9 @@ async function runUp(args, inheritedLock, onAdopt) {
                         // a same-root caller holds the space's signing material either way.
                         reconcileCreds = await mintCreds(spaceAuth, newIdentity(), "provisioner");
                     }
+                    const v = await brokerVersion(server, reconcileCreds);
+                    if (belowPresenceSafeBroker(v))
+                        console.error(c.yellow(`! nats-server ${v} is below 2.14.5: its file-backed presence bucket can latch after a stall and close the mesh to new joins (#1356); put a nats-server 2.14.5 or newer on PATH (it wins over the bundled one)`));
                     for (const r of await reconcileSpaceTtls({ servers: server, space: held.space, creds: reconcileCreds }))
                         console.log(c.dim(`  reconciled ${r.stream} TTL ${r.fromMs === 0 ? "none" : `${r.fromMs}ms`} -> ${r.toMs}ms`));
                 }
@@ -826,7 +874,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 // no transport decision to record — and `recordOurMesh` writes the entry whole, so omitting
                 // the field here would erase the requirement on every bare refresh, exactly the way dropping
                 // `attachHost` would silently demote the mesh to loopback.
-                recordOurMesh({ space: held.space, server, root, mode: held.mode, ...(held.tlsRequired !== undefined ? { tlsRequired: held.tlsRequired } : {}), ...(userAuth ? { userAuth } : {}), ...(heldAttachHost ? { attachHost: heldAttachHost } : {}), ...(heldMaxSessions !== undefined ? { maxSessions: heldMaxSessions } : {}), ...(held.maxFileStore !== undefined ? { maxFileStore: held.maxFileStore } : {}), ts: new Date().toISOString() }, "refresh");
+                recordOurMesh({ space: held.space, server, root, mode: held.mode, ...(held.tlsRequired !== undefined ? { tlsRequired: held.tlsRequired } : {}), ...(userAuth ? { userAuth } : {}), ...(heldAttachHost ? { attachHost: heldAttachHost } : {}), ...(heldMaxSessions !== undefined ? { maxSessions: heldMaxSessions } : {}), ...(held.maxFileStore !== undefined ? { maxFileStore: held.maxFileStore } : {}), ...(held.storeDir !== undefined ? { storeDir: held.storeDir } : {}), ts: new Date().toISOString() }, "refresh");
                 return;
             }
             const who = held ? `mesh "${held.space}" (${held.root})` : "a broker not started here";
@@ -947,9 +995,9 @@ async function runUp(args, inheritedLock, onAdopt) {
         const listenerStartedAt = new Date().toISOString();
         const child = spawn(bin, natsArgs, { stdio: "inherit" });
         let activationFinished = !resumeAttempt;
-        if (child.pid)
-            writeFileSync(cotalPath("nats.pid"), String(child.pid));
-        writeIdentityPin(cotalPath("nats.pid"), child.pid ?? 0); // #969: pin pid to process start
+        if (!child.pid)
+            throw new Error("nats-server spawned with no pid");
+        writePidPair(cotalPath("nats.pid"), child.pid); // #969/#1238: publish the pair by rename, never torn
         if (restored && process.env.COTAL_SMOKE_EXIT_AFTER_RESTORE_LISTENER_SPAWN === "1")
             process.exit(87);
         if (restored)
@@ -1041,28 +1089,47 @@ async function runUp(args, inheritedLock, onAdopt) {
         process.on("SIGTERM", stop);
         // The broker is gone — drop it from the registry (and the `current` pointer if it was the default)
         // so a later `cotal spawn` doesn't try to join a dead mesh.
-        child.on("exit", async (code) => {
+        child.on("exit", async (code, signal) => {
             removeIdentityPin(cotalPath("nats.pid"));
             rmSync(cotalPath("nats.pid"), { force: true });
             // Logged, never silently swallowed; the daemon kill runs in stopDelivery's finally regardless.
             await stopDelivery(undefined, undefined, space).catch((e) => console.error(`! delivery teardown: ${e.message}`));
             await stopManager(undefined, undefined, undefined, space).catch((e) => console.error(`! manager teardown: ${e.message}`));
             await stopAuthService(space).catch((e) => console.error(`! auth teardown: ${e.message}`));
-            // Only unrecord if the registry still points at THIS broker. A newer broker for the same space
-            // (a concurrent `up`, or a different-port re-up that recorded after us) may have replaced our
-            // record — removing by name would clobber the live winner and hide it from the registry.
-            // …and only if it is still OUR kind of record. A concurrent `cotal meshes add --force` can
-            // replace it with a hand-registered one carrying the same server + root; that record outlives
-            // this broker by design (it is the operator's, and only they remove it), so unrecording it on
-            // our exit would delete a registration this process never owned.
-            const mine = findMesh(space);
-            if (mine && mine.origin !== "manual" && mine.server === server && mine.root === cotalRoot()) {
-                removeMesh(space);
-                if (getCurrent() === space)
-                    clearCurrent();
+            // Unrecording (and the exit code below) both depend on WHY the broker is gone. `stopping` is
+            // true only for the intended shutdown `stop()` drives (Ctrl-C, SIGTERM) — everything else here
+            // (a crash, an OOM kill, a signal from outside `up`) leaves the record and its store in place.
+            if (stopping) {
+                // Only unrecord if the registry still points at THIS broker. A newer broker for the same space
+                // (a concurrent `up`, or a different-port re-up that recorded after us) may have replaced our
+                // record — removing by name would clobber the live winner and hide it from the registry.
+                // …and only if it is still OUR kind of record. A concurrent `cotal meshes add --force` can
+                // replace it with a hand-registered one carrying the same server + root; that record outlives
+                // this broker by design (it is the operator's, and only they remove it), so unrecording it on
+                // our exit would delete a registration this process never owned.
+                const mine = findMesh(space);
+                if (mine && mine.origin !== "manual" && mine.server === server && mine.root === cotalRoot()) {
+                    removeMesh(space);
+                    if (getCurrent() === space)
+                        clearCurrent();
+                }
+                if (activationFinished)
+                    process.exit(code ?? 0);
+            }
+            else {
+                // The record is kept ON PURPOSE: it still names the store this broker opened, so a repair
+                // `up` reopens that SAME store instead of falling back to the root's default, and a
+                // supervising unit's restart takes the refresh path against the recorded store rather than
+                // racing a second broker into existence. Foreground stdio is inherited (its own log lines
+                // are already on this terminal, above), so there is no `.cotal/nats.log` to name here.
+                const detail = signal ? `signal ${signal}` : `code ${code}`;
+                console.error(c.red(`✗ nats-server exited unexpectedly (${detail}); the mesh "${space}" stays recorded (\`cotal meshes\` lists it offline); log: see the terminal output above; repair: \`cotal up --server ${server} --space ${space}\``));
+                // A foreground broker under `Restart=on-failure` must exit non-zero on a crash so the unit
+                // restarts it; exiting 0 here (as an unconditional `code ?? 0` used to) looked like a clean
+                // stop and left the unit sitting dead.
+                if (activationFinished)
+                    process.exit(code ?? 1);
             }
-            if (activationFinished)
-                process.exit(code ?? 0);
         });
         const ready = await waitReady(server, setup?.creds);
         if (!ready) {
@@ -1073,6 +1140,9 @@ async function runUp(args, inheritedLock, onAdopt) {
             markPendingResumeDegraded(resumeAttempt ?? "", reason, startupLock);
             throw new Error(reason);
         }
+        const v = await brokerVersion(server, setup?.creds);
+        if (belowPresenceSafeBroker(v))
+            console.error(c.yellow(`! nats-server ${v} is below 2.14.5: its file-backed presence bucket can latch after a stall and close the mesh to new joins (#1356); put a nats-server 2.14.5 or newer on PATH (it wins over the bundled one)`));
         if (restored)
             await provePreparedRestoreListener(restored);
         // Listener ready — commit the transport decision (S5: not before start).
@@ -1110,6 +1180,7 @@ async function runUp(args, inheritedLock, onAdopt) {
                 ...(effectiveAttachHost ? { attachHost: effectiveAttachHost } : {}),
                 ...(effectiveMaxSessions !== undefined ? { maxSessions: effectiveMaxSessions } : {}),
                 ...(maxFileStore !== undefined ? { maxFileStore } : {}),
+                storeDir,
                 ts: new Date().toISOString(),
             }, "started");
             // Bring up the delivery daemon WITH the server (auth mode only — it self-gates on `.cotal/auth`).
@@ -1476,6 +1547,7 @@ async function resumeProvenOrdinaryListener(pending, heldLock) {
         ...(adoptAttachHost ? { attachHost: adoptAttachHost } : {}),
         ...(adoptMaxSessions !== undefined ? { maxSessions: adoptMaxSessions } : {}),
         ...(pending.maxFileStore !== undefined ? { maxFileStore: pending.maxFileStore } : {}),
+        storeDir: resolve(pending.storeDir),
         ts: new Date().toISOString(),
     }, "started");
     const controlPlane = await startDeliveryWithBroker(pending.space, pending.server, adoptedTlsRequired(pending.root), {
@@ -1521,6 +1593,7 @@ async function resumeProvenRestoreListener(prepared, heldLock) {
         ...(svc.userAuth ? { userAuth: svc.userAuth } : {}),
         ...(restoreAttachHost ? { attachHost: restoreAttachHost } : {}),
         ...(restoreMaxSessions !== undefined ? { maxSessions: restoreMaxSessions } : {}),
+        storeDir: resolve(prepared.targetPath),
         ts: new Date().toISOString(),
     }, "started");
     const controlPlane = await startDeliveryWithBroker(prepared.space, prepared.server, adoptedTlsRequired(prepared.root), {
@@ -2041,8 +2114,9 @@ opts) {
     const child = spawn(bin, args, { detached: true, stdio: ["ignore", fd, fd] });
     closeSync(fd);
     if (opts.boundListener) {
-        writeFileSync(cotalPath("nats.pid"), String(child.pid));
-        writeIdentityPin(cotalPath("nats.pid"), child.pid ?? 0); // #969: pin pid to process start
+        if (!child.pid)
+            throw new Error("nats-server spawned with no pid");
+        writePidPair(cotalPath("nats.pid"), child.pid); // #969/#1238: publish the pair by rename, never torn
         if (process.env.COTAL_SMOKE_EXIT_AFTER_RESTORE_LISTENER_SPAWN === "1")
             process.exit(87);
         try {
@@ -2067,9 +2141,24 @@ opts) {
         rmSync(cotalPath("nats.pid"), { force: true });
         throw new Error(`nats-server did not become reachable at ${server} - see ${logPath}`);
     }
-    if (!opts.boundListener)
-        writeFileSync(cotalPath("nats.pid"), String(child.pid));
-    writeIdentityPin(cotalPath("nats.pid"), child.pid ?? 0); // #969: pin pid to process start
+    let brokerVer;
+    try {
+        brokerVer = await brokerVersion(server, setup?.creds);
+    }
+    catch (e) {
+        child.kill("SIGTERM");
+        if (opts.boundListener)
+            removeIdentityPin(cotalPath("nats.pid"));
+        rmSync(cotalPath("nats.pid"), { force: true });
+        throw e;
+    }
+    if (belowPresenceSafeBroker(brokerVer))
+        console.error(c.yellow(`! nats-server ${brokerVer} is below 2.14.5: its file-backed presence bucket can latch after a stall and close the mesh to new joins (#1356); put a nats-server 2.14.5 or newer on PATH (it wins over the bundled one)`));
+    if (!opts.boundListener) {
+        if (!child.pid)
+            throw new Error("nats-server spawned with no pid");
+        writePidPair(cotalPath("nats.pid"), child.pid); // #969/#1238: publish the pair by rename, never torn
+    }
     if (opts.boundListener)
         await opts.boundListener.verify();
     // POST-START MUST NOT LEAVE AN ORPHAN LISTENER.
@@ -2125,6 +2214,7 @@ opts) {
         ...(effectiveAttachHost ? { attachHost: effectiveAttachHost } : {}),
         ...(effectiveMaxSessions !== undefined ? { maxSessions: effectiveMaxSessions } : {}),
         ...(opts.maxFileStore !== undefined ? { maxFileStore: opts.maxFileStore } : {}),
+        storeDir,
         ts: new Date().toISOString(),
     }, "started");
     // Commit policy BEFORE delivery launch (S9). Listener is proved; refuse paths never reach here.
@@ -2356,6 +2446,31 @@ async function waitReady(server, creds) {
     }
     return false;
 }
+// SPEC §13.12: reads the connected broker's version, and refuses loud below the 2.12 floor
+// before any pidfile or provisioning touches it (the same gate `requireBrokerFloor` enforces
+// on every other control-surface connection).
+async function brokerVersion(server, creds) {
+    const nc = await connect({ servers: server, ...standaloneConnectOpts({ creds, tls: false }) });
+    try {
+        requireBrokerFloor(nc);
+        return nc.info?.version ?? "";
+    }
+    finally {
+        await nc.drain();
+    }
+}
+// #1356: the presence bucket's file-backed latch is fixed in nats-server 2.14.5. Below that,
+// `cotal up` warns (never refuses: 2.14.0 meets the SPEC §13.12 floor and is the bundled broker).
+function belowPresenceSafeBroker(version) {
+    const p = parseServerVersion(version);
+    if (!p)
+        return false;
+    if (p.major !== 2)
+        return p.major < 2;
+    if (p.minor !== 14)
+        return p.minor < 14;
+    return p.patch < 5;
+}
 /** Wildcard binds mean "every interface", so they are NOT an address a client can be told to dial:
  *  the probe/registry URL stays whatever it already is (loopback by default), which the wildcard
  *  bind necessarily covers. */