From 95cec30ae6e06909e65085d1d630aa285e9679d0 Mon Sep 17 00:00:00 2001
From: Jerry Combs <jcombs@pointbluetech.com>
Date: Mon, 2 Nov 2026 17:09:30 -0600
Subject: [PATCH 1/2] Record a driver's trace size limit in the tree

DirXML-TraceSizeLimit is driver configuration: import-live, Designer projects and
exports record it as trace-size-limit in driver.xml. A new driver is created with
it; an existing driver keeps the vault's value unless vault.deploy
--trace-size-limit is given (the plan notes the difference otherwise). No restart,
never drift, and a tree without a limit asks for nothing. Also driver.set
--key trace-size-limit and the override key drivers/<d>.trace-size-limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  | 18 ++++++++++
 docs/commands.md                              |  9 ++---
 docs/console-gaps.md                          |  3 +-
 docs/tree-layout.md                           |  5 +--
 docs/vault-deploy.md                          | 10 +++++-
 .../dirxml/dev/ascode/AsCodeReader.java       |  1 +
 .../dirxml/dev/ascode/AsCodeWriter.java       |  1 +
 .../dirxml/dev/deploy/DeployCli.java          |  5 +--
 .../pointblue/dirxml/dev/deploy/Deployer.java | 12 +++++--
 .../dirxml/dev/deploy/EnvironmentCompare.java |  3 +-
 .../dirxml/dev/deploy/ModelDiff.java          |  8 ++++-
 .../dirxml/dev/deploy/Overrides.java          | 16 ++++++---
 .../com/pointblue/dirxml/dev/deploy/Plan.java | 25 ++++++++++++++
 .../dirxml/dev/deploy/VaultMapping.java       |  2 ++
 .../pointblue/dirxml/dev/edit/ConfigOps.java  | 11 +++++--
 .../pointblue/dirxml/dev/edit/DriverOps.java  |  1 +
 .../dirxml/dev/edit/OverrideOps.java          |  2 +-
 .../pointblue/dirxml/dev/edit/Registry.java   |  6 ++--
 .../pointblue/dirxml/dev/model/Driver.java    |  9 +++++
 .../dirxml/dev/source/ExportReader.java       |  7 ++++
 .../dirxml/dev/source/ExportWriter.java       |  5 +++
 .../dirxml/dev/source/LdifReader.java         |  1 +
 .../dirxml/dev/source/ProjectReader.java      |  5 +++
 .../dirxml/dev/source/ProjectWriter.java      |  9 +++++
 .../dev/ascode/AsCodeRoundTripTest.java       |  2 ++
 .../dirxml/dev/deploy/ModelDiffTest.java      | 16 +++++++++
 .../dirxml/dev/deploy/OverridesTest.java      | 19 +++++++++++
 .../pointblue/dirxml/dev/deploy/PlanTest.java | 33 +++++++++++++++++++
 .../dirxml/dev/source/ExportReaderTest.java   |  2 ++
 .../dirxml/dev/source/LdifReaderTest.java     |  2 ++
 .../dirxml/dev/source/ProjectReaderTest.java  |  3 ++
 31 files changed, 225 insertions(+), 26 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d7e9b453..d0158792 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,24 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+### Added
+
+- **A driver's trace size limit is in the tree.** `DirXML-TraceSizeLimit` is driver configuration, so
+  `import-live`, a Designer project and a Designer export now record it as `trace-size-limit` in
+  `driver.xml` (absent when the driver inherits the driver set's). A new driver is created with it. An
+  existing driver keeps the vault's value unless `vault.deploy --trace-size-limit` is given; without the
+  flag the plan notes the difference. The change never restarts a driver, because the engine reads trace
+  settings live, and it never counts as drift. A tree that doesn't record a limit asks for nothing, so
+  older trees diff as before. Also: `driver.set --key trace-size-limit`, the override key
+  `drivers/<driver>.trace-size-limit`, and `vault.compare-envs` values. The trace level and file stay
+  operational (`driver.trace`).
+
+### Changed
+
+- A deploy whose plan is empty but whose diff isn't (a difference the plan leaves alone and notes) now
+  ends with "nothing to deploy — the plan leaves the differences above as the notes say" instead of
+  claiming the vault matches the tree.
+
 ## [0.63.0] - 2026-11-02
 
 ### Fixed
diff --git a/docs/commands.md b/docs/commands.md
index 788c8f78..14a3686c 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -623,7 +623,7 @@ Deploys the tree to a vault in this order: validate, diff, plan, snapshot, write
 ```
 bin/idm vault.deploy <tree> --env <name> [--driver <name>…] --dry-run|--yes|--step [--confirm <name>]
         [--no-restart] [--secrets none|missing|all] [--allow-missing-secrets]
-        [--capture-drift] [--capture-only] [--base-branch <branch>]
+        [--capture-drift] [--capture-only] [--base-branch <branch>] [--trace-size-limit]
         [--driver-server <driver>=<serverDn>…] [--delete-driver <name>…] [--delete-all <kind>…] [--json]
 ```
 
@@ -642,6 +642,7 @@ bin/idm vault.deploy <tree> --env <name> [--driver <name>…] --dry-run|--yes|--
 | `--capture-drift` | no | when a `prd` vault differs from the last deploy on record, record its state as a commit on an `as-found/<env>/<time>` branch. The deploy is still refused: deploy again on top of it |
 | `--capture-only` | no | read the vault and capture its state only (`captured`, `verified` or `known`); no plan, no write, no `--yes` or `--confirm` needed. The tree must be in git |
 | `--base-branch` | no | a branch name; a `prd` deploy is refused unless the tree is on it |
+| `--trace-size-limit` | no | also write the tree's trace size limit (`trace-size-limit` in `driver.xml`) over an existing driver's. Default: a new driver gets the tree's, an existing driver keeps the vault's and the plan notes the difference. Never restarts a driver |
 | `--driver-server` | no, repeatable | `<driver>=<serverDn>`: the server a driver new to this environment runs on, when it is not the server the deploy connects through |
 | `--delete-driver` | no, repeatable | a driver in the vault but not in the tree, to delete with its subtree. It must be stopped; refused when it is still in the tree or not in the vault |
 | `--delete-all` | no, repeatable (one kind each) | allow deletes the mass-deletion guard would hold back for a kind: `entitlements`, `jobs`, `rbe-policies`, `templates`, `forms`, `prds`, `entities`, `choices`, `relationships`, `dm-configs`, `roles`, `resources`, `attestations`, `sods`, `role-configs`, `reports`, `nav-items`, `auth-types`, `web-app-configs`, `containers`, `others`. Another value is refused |
@@ -2692,7 +2693,7 @@ bin/idm driver.server.copy tree --from primary --to idm2 --driver "Active Direct
 
 ### `driver.set`
 
-Set a driver setting: shim-class, shim-auth-server, shim-auth-id, environments (the environments it is deployed to, comma-separated; --clear = every environment), planned (environments it is meant to reach but isn't promoted to yet), param:&lt;shim parameter&gt;, engine:&lt;engine control value&gt;.
+Set a driver setting: shim-class, shim-auth-server, shim-auth-id, trace-size-limit (the most its trace file grows to, as the vault holds it; --clear = the tree stops recording it and the vault keeps its own), environments (the environments it is deployed to, comma-separated; --clear = every environment), planned (environments it is meant to reach but isn't promoted to yet), param:&lt;shim parameter&gt;, engine:&lt;engine control value&gt;.
 
 ```
 bin/idm driver.set <tree> --driver <driver> --key <key> [--value <value>] [--clear] [--dry-run] [--force] [--json]
@@ -2702,7 +2703,7 @@ bin/idm driver.set <tree> --driver <driver> --key <key> [--value <value>] [--cle
 |---|---|---|
 | `<tree>` | yes | the IDM-as-code tree to change |
 | `--driver` | yes | driver name |
-| `--key` | yes | shim-class\|shim-auth-server\|shim-auth-id\|environments\|planned\|param:&lt;name&gt;\|engine:&lt;name&gt; |
+| `--key` | yes | shim-class\|shim-auth-server\|shim-auth-id\|trace-size-limit\|environments\|planned\|param:&lt;name&gt;\|engine:&lt;name&gt; |
 | `--value` | no | the value |
 | `--clear` | no, a flag | make the setting empty (an empty --value reads as missing on the command line) |
 
@@ -2792,7 +2793,7 @@ bin/idm override.set <tree> --env <env> --key <key> --value <value> [--dry-run]
 |---|---|---|
 | `<tree>` | yes | the IDM-as-code tree to change |
 | `--env` | yes | environment name |
-| `--key` | yes | drivers/&lt;driver&gt;.gcv.&lt;name&gt; \| .shim.&lt;name&gt; \| .ecv.&lt;name&gt; \| .shim-auth-server \| .shim-auth-id \| .name (the driver's name in that vault) \| driverset.gcv.&lt;name&gt; |
+| `--key` | yes | drivers/&lt;driver&gt;.gcv.&lt;name&gt; \| .shim.&lt;name&gt; \| .ecv.&lt;name&gt; \| .shim-auth-server \| .shim-auth-id \| .trace-size-limit \| .name (the driver's name in that vault) \| driverset.gcv.&lt;name&gt; |
 | `--value` | yes | the environment's value |
 
 ```bash
diff --git a/docs/console-gaps.md b/docs/console-gaps.md
index d799841f..a71fc90c 100644
--- a/docs/console-gaps.md
+++ b/docs/console-gaps.md
@@ -243,7 +243,8 @@ log entries kept (0 turns the set's logging off), `DirXML-LogEventsType` the pag
 without its own values uses the driver set's; `--inherit` clears a driver's four. The command shows all of
 this for a driver or the set and sets it live; `--level specific-events` needs `--events`. The trace
 settings were never in the tree (they are operational, `driver.trace`), and the log level follows them
-rather than the note's earlier idea of a tree attribute.
+rather than the note's earlier idea of a tree attribute. *(2026-11-02: the trace size limit is the
+exception — driver configuration, recorded in the tree; see vault-deploy.md, Decisions 6.)*
 
 **G11 `driver.secrets set|remove --kind named|shim-auth|remote-loader|key|keystore`.** The engine's
 `SetRemoteLoaderPassword`, `SetMutualAuthKeyPassword` and `SetMutualAuthKSPassword` (and their Clear
diff --git a/docs/tree-layout.md b/docs/tree-layout.md
index 5dec51c9..d4ef6e0e 100644
--- a/docs/tree-layout.md
+++ b/docs/tree-layout.md
@@ -80,7 +80,7 @@ servers".
 Values that differ per stage — one file per environment, `key = value`
 lines for GCVs, shim parameters, engine control values and the driver's
 connection settings (`drivers/<driver>.gcv.<name>`, `.ecv.<name>`,
-`.shim-auth-server`, `.shim-auth-id`,
+`.shim-auth-server`, `.shim-auth-id`, `.trace-size-limit`,
 `drivers/<driver>.shim.<name>`, `driverset.gcv.<name>`). The tree's own
 files keep the base value; a deploy to that environment applies its file. See
 [getting-started.md](getting-started.md) §3.1.
@@ -147,7 +147,8 @@ doesn't have.
 ### `drivers/<driver>/driver.xml`
 
 That driver's manifest: shim class, authentication server and id (not the
-password), which environments get it (`environments="QA, PROD"`, absent = every
+password), its trace size limit (`trace-size-limit`, the vault's
+`DirXML-TraceSizeLimit`; absent when it inherits the driver set's), which environments get it (`environments="QA, PROD"`, absent = every
 environment) and which it is planned for but not promoted to yet
 (`planned="PROD"`), which config files exist, every policy and resource, the
 entitlements, and the **linkage** — which object runs in which policy set, in
diff --git a/docs/vault-deploy.md b/docs/vault-deploy.md
index d7c2fa12..62b535cf 100644
--- a/docs/vault-deploy.md
+++ b/docs/vault-deploy.md
@@ -343,7 +343,7 @@ Since 0.46.0 (DirXMLDev-web #136):
 `key = value` line per value that differs from the tree's base. Keys:
 `drivers/<driver>.gcv.<name>`, `drivers/<driver>.shim.<name>`,
 `drivers/<driver>.ecv.<name>`, `drivers/<driver>.shim-auth-server`,
-`drivers/<driver>.shim-auth-id`, `driverset.gcv.<name>`
+`drivers/<driver>.shim-auth-id`, `drivers/<driver>.trace-size-limit`, `driverset.gcv.<name>`
 (docs/getting-started.md §3.1). Precedence for a shim auth id: the secrets
 file's `<driver>.shim-auth-id` beats the override, which beats the tree. Where
 it acts:
@@ -665,6 +665,14 @@ discipline), 5 and 7 are not.
    never touched on updates unless **forced** (`--secrets all|missing`,
    `vault.secrets --set`), verified by name where the vault allows, never
    printed, snapshotted or logged.
+6. ✅ **Confirmed 2026-11-02 (Jerry): the trace size limit is driver configuration.**
+   The tree records a driver's `DirXML-TraceSizeLimit` (`trace-size-limit` in
+   `driver.xml`). A new driver is created with it. Overwriting an existing driver's
+   value is optional: without `--trace-size-limit` the vault keeps its own and the
+   plan says so; with it, the plan writes the tree's. Either way no restart (the
+   engine reads trace settings live), and a difference is never drift. A tree that
+   doesn't record a limit asks for nothing. The trace level and file stay
+   operational (`driver.trace`).
 
 ## Incident 2026-09-16 — a stale tree emptied a kind (recovered from the snapshot)
 
diff --git a/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeReader.java b/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeReader.java
index f04e9d9a..3dbb1cde 100644
--- a/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeReader.java
@@ -88,6 +88,7 @@ private static Driver readDriver(Path dir) throws IOException {
         d.shimClass = attr(m, "shim-class");
         d.shimAuthServer = attr(m, "shim-auth-server");
         d.shimAuthId = attr(m, "shim-auth-id");
+        d.traceSizeLimit = attr(m, Driver.TRACE_SIZE_LIMIT);
         d.environments.addAll(com.pointblue.dirxml.dev.model.EnvironmentList.parse(attr(m, "environments")));
             d.planned.addAll(com.pointblue.dirxml.dev.model.EnvironmentList.parse(attr(m, "planned")));
         readMeta(m, d.meta);
diff --git a/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeWriter.java b/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeWriter.java
index 7fcc4db3..60111b42 100644
--- a/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeWriter.java
+++ b/src/main/java/com/pointblue/dirxml/dev/ascode/AsCodeWriter.java
@@ -121,6 +121,7 @@ private static void writeDriver(Driver d, Path dir) throws IOException {
         Manifest m = new Manifest("driver");
         m.attr("name", d.name).attr("dn", d.dn).attr("shim-class", d.shimClass)
          .attr("shim-auth-server", d.shimAuthServer).attr("shim-auth-id", d.shimAuthId)
+         .attr(Driver.TRACE_SIZE_LIMIT, d.traceSizeLimit)
          .attr("environments", com.pointblue.dirxml.dev.model.EnvironmentList.format(d.environments))
                 .attr("planned", com.pointblue.dirxml.dev.model.EnvironmentList.format(d.planned));
         m.meta(d.meta);
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/DeployCli.java b/src/main/java/com/pointblue/dirxml/dev/deploy/DeployCli.java
index 05a48c53..ff6ce65d 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/DeployCli.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/DeployCli.java
@@ -15,7 +15,7 @@
  *   vault.diff     <tree> --env <name> [--driver D…] [--json]
  *   vault.deploy   <tree> --env <name> [--driver D…] [--dry-run | --yes | --step] [--confirm <name>]
  *                  [--no-restart] [--secrets none|missing|all] [--allow-missing-secrets] [--capture-drift] [--capture-only] [--base-branch B] [--json]
- *                  [--delete-driver D…] [--delete-all entitlements|jobs|rbe-policies|templates|forms|prds|roles|entities|… …]
+ *                  [--trace-size-limit] [--delete-driver D…] [--delete-all entitlements|jobs|rbe-policies|templates|forms|prds|roles|entities|… …]
  *   vault.verify   <tree> --env <name> [--driver D…] [--json]
  *   vault.rollback --env <name> --snapshot <file> [--yes] [--json]
  *   vault.secrets  --env <name> --driver D --set <key> …
@@ -31,7 +31,7 @@ private DeployCli() {
         Map.entry("vault.diff", Args.Spec.of("", "env driver")),
         Map.entry("vault.verify", Args.Spec.of("", "env driver")),
         Map.entry("vault.compare-envs", Args.Spec.of("", "env with")),
-        Map.entry("vault.deploy", Args.Spec.of("dry-run yes step no-restart allow-missing-secrets capture-drift capture-only",
+        Map.entry("vault.deploy", Args.Spec.of("dry-run yes step no-restart allow-missing-secrets capture-drift capture-only trace-size-limit",
             "env driver confirm secrets base-branch driver-server delete-driver delete-all")),
         Map.entry("vault.rollback", Args.Spec.of("yes", "env snapshot confirm server")),
         Map.entry("vault.schema", Args.Spec.of("", "env")),
@@ -140,6 +140,7 @@ public static int run(String[] argv) throws Exception {
                 o.json = json;
                 o.deleteDrivers = opts.getOrDefault("delete-driver", List.of());
                 o.deleteAllKinds = opts.getOrDefault("delete-all", List.of());
+                o.traceSizeLimit = opts.containsKey("trace-size-limit");
                 Deployer.Result r = new Deployer(o).run();
                 System.out.print(json ? r.json() + "\n" : r.text());
                 return r.ok ? 0 : 1;
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/Deployer.java b/src/main/java/com/pointblue/dirxml/dev/deploy/Deployer.java
index 82f2c727..8bc174ad 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/Deployer.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/Deployer.java
@@ -72,6 +72,8 @@ public static final class Options {
         public Map<String, String> driverServers = Map.of();
         /** {@code --delete-all} kinds ({@code entitlements}, {@code forms}, {@code prds}), repeatable. */
         public List<String> deleteAllKinds = List.of();
+        /** {@code --trace-size-limit}: write the tree's trace size limit over an existing driver's (a new driver always gets it). */
+        public boolean traceSizeLimit;
         public int restartWaitSeconds = 180;
         /**
          * Hears each step as it happens, one line each ("snapshot: …", "write 3/9: modify cn=…", "restarting AD: waiting
@@ -325,7 +327,7 @@ public Result run() throws IOException {
                     }
                 }
             }
-            Plan plan = Plan.of(diff, to, dsDn, secrets, o.secretsMode, liveNamed, o.restart, o.tree, o.deleteDrivers, vault, o.deleteAllKinds, scope);
+            Plan plan = Plan.of(diff, to, dsDn, secrets, o.secretsMode, liveNamed, o.restart, o.tree, o.deleteDrivers, vault, o.deleteAllKinds, scope, o.traceSizeLimit);
             r.planText = validationNote + overrideNote + plan.text(env.name, dsDn);
             o.progress.accept("planned: " + plan.steps.size() + " write(s), " + (plan.restart.size() + plan.serverRestarts.size()) + " restart(s)");
             if (!plan.deleteDriverRefusals.isEmpty()) {
@@ -334,7 +336,9 @@ public Result run() throws IOException {
             }
             if (plan.isEmpty()) {
                 r.ok = true;
-                r.planText += "nothing to deploy — the vault matches the tree\n";
+                // a difference the plan leaves alone on purpose (its note says why) is not a match
+                r.planText += diff.isEmpty() ? "nothing to deploy — the vault matches the tree\n"
+                    : "nothing to deploy — the plan leaves the differences above as the notes say\n";
                 return r;
             }
             if (!plan.missingSecrets.isEmpty() && !o.allowMissingSecrets) {
@@ -531,7 +535,9 @@ private static ReadApplied readApplied(Path tree, Environments.Environment env)
     /** The tree (as {@code env} gets it) against the live vault, what the tree doesn't deploy there set aside either way. */
     private static ModelDiff driftOf(Path tree, Environments.Environment env, DriverSet live) throws IOException {
         ReadApplied r = readApplied(tree, env);
-        return r.applied().ignoreNotDeployed(ModelDiff.of(r.ds(), live));
+        // the vault's trace size limit is its own unless a deploy is told otherwise (--trace-size-limit): never drift
+        return r.applied().ignoreNotDeployed(ModelDiff.of(r.ds(), live))
+            .only(ch -> !(ch.kind == ModelDiff.Kind.DRIVER_SETTING && com.pointblue.dirxml.dev.model.Driver.TRACE_SIZE_LIMIT.equals(ch.what)));
     }
 
     /** Execute one step; records it in the result; throws on failure. */
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/EnvironmentCompare.java b/src/main/java/com/pointblue/dirxml/dev/deploy/EnvironmentCompare.java
index b6cea4cf..ee5f4f63 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/EnvironmentCompare.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/EnvironmentCompare.java
@@ -21,7 +21,7 @@
  * <ul>
  *   <li><b>values</b>: every scalar value an override can carry ({@code drivers/<d>.gcv.<n>} for the
  *       driver's own GCVs, {@code .shim.<n>}, {@code .ecv.<n>}, {@code .shim-auth-server},
- *       {@code .shim-auth-id}, {@code driverset.gcv.<n>}) that both hold and that differs, keyed as the
+ *       {@code .shim-auth-id}, {@code .trace-size-limit}, {@code driverset.gcv.<n>}) that both hold and that differs, keyed as the
  *       overrides file keys it;</li>
  *   <li><b>drift</b>: the diff of the first against the second after the first takes the second's value
  *       for each of those, so what remains is what a value can't explain: policies, filters, linkage,
@@ -484,6 +484,7 @@ public static Map<String, String> values(DriverSet ds) {
             definitions(d.config.get(Driver.ENGINE_CONTROL_VALUES), p + "ecv.", out);
             out.put(p + Driver.SHIM_AUTH_SERVER, d.shimAuthServer);
             out.put(p + Driver.SHIM_AUTH_ID, d.shimAuthId);
+            out.put(p + Driver.TRACE_SIZE_LIMIT, d.traceSizeLimit);
         }
         return out;
     }
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/ModelDiff.java b/src/main/java/com/pointblue/dirxml/dev/deploy/ModelDiff.java
index a7b3bcc5..06e92e4c 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/ModelDiff.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/ModelDiff.java
@@ -371,7 +371,9 @@ public List<String> affectedDrivers() {
             return new ArrayList<>(affected);
         }
         for (Change c : changes) {
-            if (c.driver != null && c.kind != Kind.DRIVER_ADDED && c.kind != Kind.DRIVER_REMOVED && !c.kind.noRestart()) {
+            // the engine reads a driver's trace settings live, as driver.trace set relies on: no restart for the size limit
+            boolean traceSize = c.kind == Kind.DRIVER_SETTING && Driver.TRACE_SIZE_LIMIT.equals(c.what);
+            if (c.driver != null && c.kind != Kind.DRIVER_ADDED && c.kind != Kind.DRIVER_REMOVED && !c.kind.noRestart() && !traceSize) {
                 affected.add(c.driver);
             }
         }
@@ -1207,6 +1209,10 @@ private static String describeKind(Artifact a) {
     private void diffDriverSettings(Driver a, Driver b) {
         settingChange(a, "shim-class", a.shimClass, b.shimClass);
         settingChange(a, "shim-auth-server", a.shimAuthServer, b.shimAuthServer);
+        if (b.traceSizeLimit != null) {
+            // a side that never recorded the limit (an older tree) asks for nothing
+            settingChange(a, Driver.TRACE_SIZE_LIMIT, a.traceSizeLimit, b.traceSizeLimit);
+        }
         if (a.shimAuthIdSecret || b.shimAuthIdSecret) {
             // the secrets file supplies the id: say that it differs, never what either side holds
             if (!Objects.equals(a.shimAuthId, b.shimAuthId)) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/Overrides.java b/src/main/java/com/pointblue/dirxml/dev/deploy/Overrides.java
index a9866a0e..fcae357a 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/Overrides.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/Overrides.java
@@ -108,7 +108,7 @@ public static Map<String, String> parse(String text) {
 
     public static String format(String env, Map<String, String> values) {
         StringBuilder sb = new StringBuilder("# Values for environment '" + env + "' that differ from the tree's base values.\n"
-            + "# key = value; keys: drivers/<driver>.gcv.<name>, .shim.<name>, .ecv.<name>, .shim-auth-server, .shim-auth-id, .name; driverset.gcv.<name>;\n"
+            + "# key = value; keys: drivers/<driver>.gcv.<name>, .shim.<name>, .ecv.<name>, .shim-auth-server, .shim-auth-id, .trace-size-limit, .name; driverset.gcv.<name>;\n"
             + "# servers.<tree server's name> = <this environment's server's DN> (and servers.<its server's name>.prefer = <tree server's name>)\n");
         for (Map.Entry<String, String> e : new TreeMap<>(values).entrySet()) {
             if (!e.getKey().startsWith("?")) {
@@ -186,6 +186,9 @@ public String value() {
             if (NAME.equals(setting)) {
                 return driver.name;
             }
+            if (Driver.TRACE_SIZE_LIMIT.equals(setting)) {
+                return driver.traceSizeLimit;
+            }
             return Driver.SHIM_AUTH_SERVER.equals(setting) ? driver.shimAuthServer : driver.shimAuthId;
         }
 
@@ -212,6 +215,8 @@ public void set(String value) {
             } else if (driver != null && !NAME.equals(setting)) {   // a name is applied by renaming, never set
                 if (Driver.SHIM_AUTH_SERVER.equals(setting)) {
                     driver.shimAuthServer = value;
+                } else if (Driver.TRACE_SIZE_LIMIT.equals(setting)) {
+                    driver.traceSizeLimit = value == null || value.isEmpty() ? null : value;
                 } else {
                     driver.shimAuthId = value;
                 }
@@ -250,7 +255,8 @@ public static Target resolve(DriverSet ds, String key) {
         }
         if (!key.startsWith("drivers/")) {
             return new Target(null, "a key starts with drivers/<driver>.gcv., drivers/<driver>.shim., drivers/<driver>.ecv., "
-                + "drivers/<driver>." + Driver.SHIM_AUTH_SERVER + ", drivers/<driver>." + Driver.SHIM_AUTH_ID + " or driverset.gcv.");
+                + "drivers/<driver>." + Driver.SHIM_AUTH_SERVER + ", drivers/<driver>." + Driver.SHIM_AUTH_ID + ", drivers/<driver>."
+                + Driver.TRACE_SIZE_LIMIT + " or driverset.gcv.");
         }
         String rest = key.substring("drivers/".length());
         // the name this environment's vault gives the driver: applied by renames(), after the values
@@ -259,8 +265,8 @@ public static Target resolve(DriverSet ds, String key) {
             Driver d = ds.driver(driverName);
             return d == null ? new Target(null, "no driver '" + driverName + "' in the tree") : Target.ofSetting(d, NAME);
         }
-        // the driver's own settings: drivers/<driver>.shim-auth-server, drivers/<driver>.shim-auth-id
-        for (String setting : List.of(Driver.SHIM_AUTH_SERVER, Driver.SHIM_AUTH_ID)) {
+        // the driver's own settings: drivers/<driver>.shim-auth-server, .shim-auth-id, .trace-size-limit
+        for (String setting : List.of(Driver.SHIM_AUTH_SERVER, Driver.SHIM_AUTH_ID, Driver.TRACE_SIZE_LIMIT)) {
             if (rest.endsWith("." + setting)) {
                 String driverName = rest.substring(0, rest.length() - setting.length() - 1);
                 Driver d = ds.driver(driverName);
@@ -279,7 +285,7 @@ public static Target resolve(DriverSet ds, String key) {
         }
         if (cut < 0) {
             return new Target(null, "a driver key is drivers/<driver>.gcv.<name>, .shim.<name>, .ecv.<name>, ."
-                + Driver.SHIM_AUTH_SERVER + " or ." + Driver.SHIM_AUTH_ID);
+                + Driver.SHIM_AUTH_SERVER + ", ." + Driver.SHIM_AUTH_ID + " or ." + Driver.TRACE_SIZE_LIMIT);
         }
         String driverName = rest.substring(0, cut);
         Driver d = ds.driver(driverName);
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/Plan.java b/src/main/java/com/pointblue/dirxml/dev/deploy/Plan.java
index 2b58be7e..2f79821c 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/Plan.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/Plan.java
@@ -176,6 +176,17 @@ public static Plan of(ModelDiff diff, DriverSet to, String dsDn, Secrets secrets
                           Map<String, List<String>> liveNamedPasswords, boolean restartRunning, java.nio.file.Path tree,
                           List<String> deleteDrivers, VaultAccess vault, List<String> deleteAllKinds,
                           java.util.Collection<String> onlyDrivers) {
+        return of(diff, to, dsDn, secrets, secretsMode, liveNamedPasswords, restartRunning, tree, deleteDrivers, vault, deleteAllKinds, onlyDrivers, false);
+    }
+
+    /**
+     * @param writeTraceSizeLimit {@code --trace-size-limit}: write the tree's trace size limit over an existing driver's.
+     *                            Without it the vault keeps its own (a note says so); a new driver always gets the tree's
+     */
+    public static Plan of(ModelDiff diff, DriverSet to, String dsDn, Secrets secrets, String secretsMode,
+                          Map<String, List<String>> liveNamedPasswords, boolean restartRunning, java.nio.file.Path tree,
+                          List<String> deleteDrivers, VaultAccess vault, List<String> deleteAllKinds,
+                          java.util.Collection<String> onlyDrivers, boolean writeTraceSizeLimit) {
         Plan p = new Plan();
         p.deleteAllKinds.addAll(deleteAllKinds);
         p.primaryServer = vault != null ? Servers.primary(vault) : to.meta.get(Servers.PRIMARY_META);
@@ -320,6 +331,20 @@ public static Plan of(ModelDiff diff, DriverSet to, String dsDn, Secrets secrets
                 case DRIVER_SETTING: {
                     Driver d = to.driver(c.driver);
                     String dn = VaultMapping.driverDn(dsDn, c.driver);
+                    if (Driver.TRACE_SIZE_LIMIT.equals(c.what)) {
+                        Driver was = diff.from().driver(c.driver);
+                        String held = was == null || was.traceSizeLimit == null ? "none (the driver set's)" : was.traceSizeLimit;
+                        if (!writeTraceSizeLimit) {
+                            p.notes.add("drivers/" + c.driver + ": trace size limit " + d.traceSizeLimit + " in the tree, " + held
+                                + " in the vault — left as the vault has it; --trace-size-limit writes the tree's");
+                            break;
+                        }
+                        p.touchedDns.add(dn);
+                        driverAttrs.add(new Step(Op.MODIFY, dn, VaultMapping.TRACE_SIZE_LIMIT, null,
+                            Map.of(VaultMapping.TRACE_SIZE_LIMIT, Vault.value(d.traceSizeLimit)),
+                            dn + "  " + VaultMapping.TRACE_SIZE_LIMIT + " = " + d.traceSizeLimit + " (was " + held + ")", c.path + "#" + c.what, c.driver));
+                        break;
+                    }
                     p.touchedDns.add(dn);
                     String attr = c.what.equals("shim-class") ? VaultMapping.JAVA_MODULE
                         : c.what.equals("shim-auth-server") ? VaultMapping.SHIM_AUTH_SERVER : VaultMapping.SHIM_AUTH_ID;
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java b/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java
index 51b7db64..c67a9322 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java
@@ -37,6 +37,7 @@ public final class VaultMapping {
     public static final String POLICIES = "DirXML-Policies";
     public static final String JAVA_MODULE = "DirXML-JavaModule";
     public static final String SHIM_AUTH_SERVER = "DirXML-ShimAuthServer";
+    public static final String TRACE_SIZE_LIMIT = "DirXML-TraceSizeLimit";
     public static final String SHIM_AUTH_ID = "DirXML-ShimAuthID";
     public static final String SHIM_AUTH_PASSWORD = "DirXML-ShimAuthPassword";
     public static final String SHIM_CONFIG_INFO = "DirXML-ShimConfigInfo";
@@ -239,6 +240,7 @@ public static Map<String, List<byte[]>> driverAttributes(Driver d) {
         put(m, JAVA_MODULE, d.shimClass);
         put(m, SHIM_AUTH_SERVER, d.shimAuthServer);
         put(m, SHIM_AUTH_ID, d.shimAuthId);
+        put(m, TRACE_SIZE_LIMIT, d.traceSizeLimit);
         blob(m, SHIM_CONFIG_INFO, d.config.get(Driver.SHIM_CONFIG_INFO));
         blob(m, CONFIG_VALUES, d.config.get(Driver.CONFIG_VALUES));
         blob(m, DRIVER_FILTER, d.config.get(Driver.DRIVER_FILTER));
diff --git a/src/main/java/com/pointblue/dirxml/dev/edit/ConfigOps.java b/src/main/java/com/pointblue/dirxml/dev/edit/ConfigOps.java
index 1a2f5040..dcb1129a 100644
--- a/src/main/java/com/pointblue/dirxml/dev/edit/ConfigOps.java
+++ b/src/main/java/com/pointblue/dirxml/dev/edit/ConfigOps.java
@@ -406,7 +406,7 @@ public void apply(DriverSet ds, Transaction tx) throws Refusal, IOException {
 
     // ---- driver.set -----------------------------------------------------------
 
-    /** {@code driver.set --key shim-class|shim-auth-server|shim-auth-id|param:<name>|engine:<name> --value v}. */
+    /** {@code driver.set --key shim-class|shim-auth-server|shim-auth-id|trace-size-limit|param:<name>|engine:<name> --value v}. */
     public static final class DriverSet_ implements Operation {
         private final String driver;
         private final String key;
@@ -436,6 +436,13 @@ public void apply(DriverSet ds, Transaction tx) throws Refusal, IOException {
                 case "shim-class": d.shimClass = value; return;
                 case "shim-auth-server": d.shimAuthServer = value; return;
                 case "shim-auth-id": d.shimAuthId = value; return;
+                case Driver.TRACE_SIZE_LIMIT:
+                    // the most the trace file grows to; --clear = the tree stops recording it (a deploy then leaves the vault's)
+                    if (!value.isEmpty() && !value.chars().allMatch(Character::isDigit)) {
+                        throw new Refusal("trace-size-limit is a whole number, as the vault holds it (e.g. 200000), not '" + value + "'");
+                    }
+                    d.traceSizeLimit = value.isEmpty() ? null : value;
+                    return;
                 case "environments":
                     // the environments this driver is deployed to, comma-separated; empty = every environment
                     d.environments.clear();
@@ -469,7 +476,7 @@ public void apply(DriverSet ds, Transaction tx) throws Refusal, IOException {
                 }
                 return;
             }
-            throw new Refusal("key must be shim-class|shim-auth-server|shim-auth-id|param:<name>|engine:<name>, not '" + key + "'");
+            throw new Refusal("key must be shim-class|shim-auth-server|shim-auth-id|trace-size-limit|param:<name>|engine:<name>, not '" + key + "'");
         }
 
         private static List<String> names(Element blob) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/edit/DriverOps.java b/src/main/java/com/pointblue/dirxml/dev/edit/DriverOps.java
index 904b113a..9932b001 100644
--- a/src/main/java/com/pointblue/dirxml/dev/edit/DriverOps.java
+++ b/src/main/java/com/pointblue/dirxml/dev/edit/DriverOps.java
@@ -196,6 +196,7 @@ static Driver clone(Driver from, String name, DriverSet ds) {
             d.shimClass = from.shimClass;
             d.shimAuthServer = from.shimAuthServer;
             d.shimAuthId = from.shimAuthId;
+            d.traceSizeLimit = from.traceSizeLimit;
             for (Map.Entry<String, Element> c : from.config.entrySet()) {
                 if (c.getValue() != null) {
                     d.config.put(c.getKey(), CanonicalXml.parse(CanonicalXml.serialize(c.getValue())).getDocumentElement());
diff --git a/src/main/java/com/pointblue/dirxml/dev/edit/OverrideOps.java b/src/main/java/com/pointblue/dirxml/dev/edit/OverrideOps.java
index 7558bbd2..2f554459 100644
--- a/src/main/java/com/pointblue/dirxml/dev/edit/OverrideOps.java
+++ b/src/main/java/com/pointblue/dirxml/dev/edit/OverrideOps.java
@@ -44,7 +44,7 @@ public String name() {
         public void apply(DriverSet ds, Transaction tx) throws Refusal, IOException {
             String e = envOrRefuse(env);
             if (key == null || key.isBlank()) {
-                throw new Refusal("--key is required (drivers/<driver>.gcv.<name>, .shim.<name>, .ecv.<name>, .shim-auth-server, .shim-auth-id, or driverset.gcv.<name>)");
+                throw new Refusal("--key is required (drivers/<driver>.gcv.<name>, .shim.<name>, .ecv.<name>, .shim-auth-server, .shim-auth-id, .trace-size-limit, or driverset.gcv.<name>)");
             }
             if (value == null) {
                 throw new Refusal("--value is required");
diff --git a/src/main/java/com/pointblue/dirxml/dev/edit/Registry.java b/src/main/java/com/pointblue/dirxml/dev/edit/Registry.java
index 6dadc485..aac66965 100644
--- a/src/main/java/com/pointblue/dirxml/dev/edit/Registry.java
+++ b/src/main/java/com/pointblue/dirxml/dev/edit/Registry.java
@@ -583,7 +583,7 @@ drv, opt("nds-class", "eDirectory class name"), opt("app-class", "application cl
         register("override.set", "set a value for one environment (overrides/<env>.properties); the tree keeps its base value",
             a -> new OverrideOps.Set(a.get("env"), a.get("key"), a.get("value")),
             req("env", "environment name"),
-            req("key", "drivers/<driver>.gcv.<name> | .shim.<name> | .ecv.<name> | .shim-auth-server | .shim-auth-id | .name (the driver's name in that vault) | driverset.gcv.<name>"),
+            req("key", "drivers/<driver>.gcv.<name> | .shim.<name> | .ecv.<name> | .shim-auth-server | .shim-auth-id | .trace-size-limit | .name (the driver's name in that vault) | driverset.gcv.<name>"),
             req("value", "the environment's value"));
         register("environments.set", "which environments get objects and which they are planned for (driver.xml / driverset.xml environments, planned); several objects at once, one tree path per line",
             a -> new EnvironmentOps.Set(a.get("paths"), a.containsKey("every") ? "" : a.get("environments"), a.containsKey("no-plan") ? "" : a.get("planned")),
@@ -607,9 +607,9 @@ drv, opt("nds-class", "eDirectory class name"), opt("app-class", "application cl
             req("to", "the server to copy to: its DN, its name, or primary"),
             opt("driver", "one driver (default: every driver)"),
             opt("only", "some of gcv,shim,ecv,auth-server,auth-id (default: all)"));
-        register("driver.set", "set a driver setting: shim-class, shim-auth-server, shim-auth-id, environments (the environments it is deployed to, comma-separated; --clear = every environment), planned (environments it is meant to reach but isn't promoted to yet), param:<shim parameter>, engine:<engine control value>",
+        register("driver.set", "set a driver setting: shim-class, shim-auth-server, shim-auth-id, trace-size-limit (the most its trace file grows to, as the vault holds it; --clear = the tree stops recording it and the vault keeps its own), environments (the environments it is deployed to, comma-separated; --clear = every environment), planned (environments it is meant to reach but isn't promoted to yet), param:<shim parameter>, engine:<engine control value>",
             a -> new ConfigOps.DriverSet_(a.get("driver"), a.get("key"), a.containsKey("clear") ? "" : a.get("value")),
-            drv, req("key", "shim-class|shim-auth-server|shim-auth-id|environments|planned|param:<name>|engine:<name>"), opt("value", "the value"),
+            drv, req("key", "shim-class|shim-auth-server|shim-auth-id|trace-size-limit|environments|planned|param:<name>|engine:<name>"), opt("value", "the value"),
             flag("clear", "flag: make the setting empty (an empty --value reads as missing on the command line)"));
         register("driver.setting.add", "add a shim parameter (param:<name>, into a section of the shim config) or an engine control value (engine:<name>): its definition with display name, type and value",
             a -> new ConfigOps.DriverSettingAdd(a.get("driver"), a.get("key"), a.get("type"), a.get("display"), a.get("value"), a.get("section"), a.get("description")),
diff --git a/src/main/java/com/pointblue/dirxml/dev/model/Driver.java b/src/main/java/com/pointblue/dirxml/dev/model/Driver.java
index eacee38a..1578edf8 100644
--- a/src/main/java/com/pointblue/dirxml/dev/model/Driver.java
+++ b/src/main/java/com/pointblue/dirxml/dev/model/Driver.java
@@ -24,6 +24,8 @@ public final class Driver {
     /** Keys of {@link #serverSettings} and the {@code drivers/<d>.<setting>} override keys: the driver's own never-sync settings. */
     public static final String SHIM_AUTH_SERVER = "shim-auth-server";
     public static final String SHIM_AUTH_ID = "shim-auth-id";
+    /** The {@code drivers/<d>.trace-size-limit} setting and its {@code driver.xml} attribute. */
+    public static final String TRACE_SIZE_LIMIT = "trace-size-limit";
 
     /** The tree's name; {@link DriverSet#renameDriver} changes it on a throwaway model (an environment that names the driver differently). */
     public String name;
@@ -31,6 +33,13 @@ public final class Driver {
     public String shimClass;
     public String shimAuthServer;
     public String shimAuthId;
+    /**
+     * The most the driver's trace file may grow to ({@code DirXML-TraceSizeLimit}, as the vault holds it); null when
+     * the driver inherits the driver set's or the tree never recorded it. A deploy writes it on a new driver, and on
+     * an existing one only with {@code --trace-size-limit}: the trace level and file stay operational
+     * ({@code driver.trace}).
+     */
+    public String traceSizeLimit;
     /** Raw config blobs by kind (see constants) — the primary server's, or the only server's. */
     public final Map<String, Element> config = new LinkedHashMap<>();
     /**
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java b/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java
index d669e9b6..deaf0e21 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java
@@ -53,6 +53,7 @@
  *     attributes/
  *       java-module[value]                              -&gt; Driver.shimClass
  *       shim-auth-server[value] shim-auth-id[value]      -&gt; Driver.shimAuthServer/shimAuthId
+ *       trace-size-limit[value] (not inherit="true")    -&gt; Driver.traceSizeLimit
  *                                                        (fallback: authentication-info/server,user)
  *       driver-filter-xml/filter                         -&gt; Driver.config[DRIVER_FILTER]
  *       global-config-values/configuration-values        the DRIVER's own GCVs -&gt; Driver.config[CONFIG_VALUES]
@@ -234,6 +235,12 @@ private static Driver readDriver(Element driverEl, String libraryContainerName,
             }
         }
 
+        // <trace-size-limit value=…/>, or inherit="true" for the driver set's
+        Element traceSize = directChild(attrs, "trace-size-limit");
+        if (traceSize != null && !"true".equalsIgnoreCase(traceSize.getAttribute("inherit"))) {
+            d.traceSizeLimit = nullIfEmpty(traceSize.getAttribute("value"));
+        }
+
         Element filter = Xds.firstByName(scanRoot, "filter");
         if (filter != null) {
             d.config.put(Driver.DRIVER_FILTER, filter);
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java b/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java
index 8d059c06..1655bb4b 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java
@@ -449,6 +449,11 @@ private static void writeCommonDriverAttrs(Document doc, Element attrs, Driver d
             e.setAttribute("value", d.shimAuthId);
             attrs.appendChild(e);
         }
+        if (d.traceSizeLimit != null) {
+            Element e = doc.createElement("trace-size-limit");
+            e.setAttribute("value", d.traceSizeLimit);
+            attrs.appendChild(e);
+        }
 
         Element filter = d.config.get(Driver.DRIVER_FILTER);
         if (filter != null) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java b/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java
index 3ed07f77..f4bcf7c7 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java
@@ -131,6 +131,7 @@ public static DriverSet fromEntries(Collection<Entry> entries, String sourceName
             d.shimClass = e.first("DirXML-JavaModule");
             d.shimAuthServer = e.first("DirXML-ShimAuthServer");
             d.shimAuthId = e.first("DirXML-ShimAuthID");
+            d.traceSizeLimit = e.first("DirXML-TraceSizeLimit");
             putConfig(d, Driver.SHIM_CONFIG_INFO, e.first("DirXML-ShimConfigInfo"));
             putConfig(d, Driver.CONFIG_VALUES, e.first("DirXML-ConfigValues"));
             putConfig(d, Driver.DRIVER_FILTER, e.first("DirXML-DriverFilter"));
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java b/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java
index 8f59bdbe..b8a9ae76 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java
@@ -767,6 +767,11 @@ private static Driver readDriver(Index idx, String drvId, DriverSet ds) {
         d.shimClass = attrValue(m, "DirXML-JavaModule");
         d.shimAuthServer = attrValue(m, "DirXML-ShimAuthServer");
         d.shimAuthId = attrValue(m, "DirXML-ShimAuthID");
+        // the driver's own trace size limit: Designer keeps the vault's attribute, with IdmParameter:InheritTraceSize false
+        String traceSize = attrValue(m, "DirXML-TraceSizeLimit");
+        if (traceSize != null && !traceSize.isEmpty() && !"true".equalsIgnoreCase(attrValue(m, "IdmParameter:InheritTraceSize"))) {
+            d.traceSizeLimit = traceSize;
+        }
 
         String shimConfigInfo = attrValue(m, "DirXML-ShimConfigInfo");
         if (shimConfigInfo != null && !shimConfigInfo.isBlank()) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java b/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java
index 0601734b..719a3c4f 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java
@@ -2745,6 +2745,11 @@ void applyDriverSetting(String driverName, String what, Driver treeDriver) {
                 case "shim-class": attrName = "DirXML-JavaModule"; value = treeDriver.shimClass; break;
                 case "shim-auth-server": attrName = "DirXML-ShimAuthServer"; value = treeDriver.shimAuthServer; break;
                 case "shim-auth-id": attrName = "DirXML-ShimAuthID"; value = treeDriver.shimAuthId; break;
+                case Driver.TRACE_SIZE_LIMIT:
+                    attrName = "DirXML-TraceSizeLimit";
+                    value = treeDriver.traceSizeLimit;
+                    setStringAttribute(driverId, "IdmParameter:InheritTraceSize", String.valueOf(value == null), "CString");
+                    break;
                 default: return;
             }
             setStringAttribute(driverId, attrName, value, "CString");
@@ -2988,6 +2993,10 @@ void applyDriverAdd(Driver treeDriver) throws IOException {
             if (treeDriver.shimAuthId != null) {
                 attrs.append(CObjectXml.attr("DirXML-ShimAuthID", treeDriver.shimAuthId, "CString"));
             }
+            if (treeDriver.traceSizeLimit != null) {
+                attrs.append(CObjectXml.attr("IdmParameter:InheritTraceSize", "false", "CString"));
+                attrs.append(CObjectXml.attr("DirXML-TraceSizeLimit", treeDriver.traceSizeLimit, "CString"));
+            }
             Element sci = treeDriver.config.get(Driver.SHIM_CONFIG_INFO);
             if (sci != null) {
                 attrs.append(CObjectXml.attr("DirXML-ShimConfigInfo", CanonicalXml.serialize(sci), "CString"));
diff --git a/src/test/java/com/pointblue/dirxml/dev/ascode/AsCodeRoundTripTest.java b/src/test/java/com/pointblue/dirxml/dev/ascode/AsCodeRoundTripTest.java
index 4bf1cb98..6910dd1d 100644
--- a/src/test/java/com/pointblue/dirxml/dev/ascode/AsCodeRoundTripTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/ascode/AsCodeRoundTripTest.java
@@ -75,6 +75,7 @@ static DriverSet sample() {
         d.shimClass = "com.novell.nds.dirxml.driver.ad.ADDriverShim";
         d.shimAuthServer = "ad.example.com";
         d.shimAuthId = "svc-idm";
+        d.traceSizeLimit = "200000";
         d.meta.put("pkg.version", "4.1.2");
         d.config.put(Driver.DRIVER_FILTER, xml("<filter><filter-class class-name=\"User\" publisher=\"sync\" subscriber=\"sync\">"
             + "<filter-attr attr-name=\"Surname\" publisher=\"sync\" subscriber=\"sync\"/></filter-class></filter>"));
@@ -130,6 +131,7 @@ public void writeIsIdempotentAndReadPreservesEverything() throws Exception {
         assertNotNull(d);
         assertEquals("com.novell.nds.dirxml.driver.ad.ADDriverShim", d.shimClass);
         assertEquals("svc-idm", d.shimAuthId);
+        assertEquals("200000", d.traceSizeLimit);
         assertEquals("4.1.2", d.meta.get("pkg.version"));
         assertTrue(d.config.containsKey(Driver.DRIVER_FILTER));
         assertTrue(d.config.containsKey(Driver.CONFIG_VALUES));
diff --git a/src/test/java/com/pointblue/dirxml/dev/deploy/ModelDiffTest.java b/src/test/java/com/pointblue/dirxml/dev/deploy/ModelDiffTest.java
index 5071cade..95269fe9 100644
--- a/src/test/java/com/pointblue/dirxml/dev/deploy/ModelDiffTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/deploy/ModelDiffTest.java
@@ -282,6 +282,22 @@ public void anIconChangeAffectsNoDriver() throws IOException {
 
     // ---- DRIVER_SETTING ----
 
+    /** A tree that never recorded a trace size limit asks for nothing; one that records it shows a different vault value. */
+    @Test
+    public void traceSizeLimitIsComparedOnlyWhenTheTreeRecordsOne() throws IOException {
+        DriverSet vault = ValidatorTest.clean();
+        vault.driver("AD").traceSizeLimit = "200000";
+        DriverSet tree = copy(vault);
+        tree.driver("AD").traceSizeLimit = null;
+        assertTrue(of(ModelDiff.of(vault, tree), Kind.DRIVER_SETTING).isEmpty());
+
+        tree.driver("AD").traceSizeLimit = "100000";
+        List<Change> settings = of(ModelDiff.of(vault, tree), Kind.DRIVER_SETTING);
+        assertEquals(1, settings.size());
+        assertEquals(Driver.TRACE_SIZE_LIMIT, settings.get(0).what);
+        assertTrue(settings.get(0).summary, settings.get(0).summary.contains("200000 -> 100000"));
+    }
+
     @Test
     public void driverSetting() throws IOException {
         DriverSet from = ValidatorTest.clean();
diff --git a/src/test/java/com/pointblue/dirxml/dev/deploy/OverridesTest.java b/src/test/java/com/pointblue/dirxml/dev/deploy/OverridesTest.java
index 18a7489e..608722be 100644
--- a/src/test/java/com/pointblue/dirxml/dev/deploy/OverridesTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/deploy/OverridesTest.java
@@ -175,6 +175,25 @@ private static DriverSet modelWithSettings() {
         return ds;
     }
 
+    /** An environment's own trace size limit: the override key sets it, and an empty value leaves the driver set's. */
+    @Test
+    public void traceSizeLimitIsOverridable() {
+        DriverSet ds = modelWithSettings();
+        ds.driver("AD Driver").traceSizeLimit = "100000";
+        ds.overrides.put("prd", new java.util.LinkedHashMap<>(Map.of("drivers/AD Driver.trace-size-limit", "500000")));
+        Overrides.Applied a = Overrides.apply(ds, "prd");
+        assertTrue(a.summary(), a.problems.isEmpty());
+        assertEquals("500000", ds.driver("AD Driver").traceSizeLimit);
+        assertEquals("500000", EnvironmentCompare.values(ds).get("drivers/AD Driver.trace-size-limit"));
+
+        DriverSet other = modelWithSettings();
+        other.driver("AD Driver").traceSizeLimit = "100000";
+        other.overrides.put("qa", new java.util.LinkedHashMap<>(Map.of("drivers/AD Driver.trace-size-limit", "")));
+        Overrides.Applied b = Overrides.apply(other, "qa");
+        assertTrue(b.summary(), b.problems.isEmpty());
+        assertNull(other.driver("AD Driver").traceSizeLimit);
+    }
+
     @Test
     public void driverSettingsAndEngineControlValuesAreOverridableToo() throws Exception {
         DriverSet ds = modelWithSettings();
diff --git a/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java b/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java
index ec617703..a3579a75 100644
--- a/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java
@@ -533,4 +533,37 @@ public void engineControlValuesAbsentFromTreeAreNotRemoved() throws IOException
         assertTrue(p.text("stg", DS), p.steps.stream().noneMatch(s -> VaultMapping.ENGINE_CONTROL_VALUES.equals(s.attr)));
         assertTrue(p.notes.toString(), p.notes.stream().anyMatch(n -> n.contains("engine control values")));
     }
+
+    /**
+     * The trace size limit is the driver's configuration: a new driver is created with the tree's, but an existing
+     * driver keeps the vault's unless the deploy is told to write it ({@code --trace-size-limit}).
+     */
+    @Test
+    public void traceSizeLimitIsWrittenOnANewDriverAndOnAnExistingOneOnlyWhenAsked() {
+        DriverSet from = VaultMappingTest.model();
+        from.driver("AD").traceSizeLimit = "200000";
+        DriverSet to = VaultMappingTest.model();
+        to.driver("AD").traceSizeLimit = "100000";
+        Driver n = new Driver("New");
+        n.shimClass = "com.example.Shim";
+        n.traceSizeLimit = "50000";
+        to.drivers.add(n);
+        ModelDiff diff = ModelDiff.of(from, to);
+
+        Plan kept = Plan.of(diff, to, DS, Secrets.none(), "none", Map.of(), true, null, List.of(), null, List.of(), List.of(), false);
+        Plan.Step add = kept.steps.stream().filter(s -> s.op == Plan.Op.ADD && "cn=New,cn=dvs,o=system".equals(s.dn)).findFirst().orElseThrow();
+        assertEquals("50000", new String(add.values.get(VaultMapping.TRACE_SIZE_LIMIT).get(0), StandardCharsets.UTF_8));
+        assertTrue(kept.text("stg", DS), kept.steps.stream()
+            .noneMatch(s -> s.op == Plan.Op.MODIFY && VaultMapping.TRACE_SIZE_LIMIT.equals(s.attr)));
+        assertTrue(kept.notes.toString(), kept.notes.stream()
+            .anyMatch(x -> x.contains("drivers/AD: trace size limit 100000 in the tree, 200000 in the vault") && x.contains("--trace-size-limit")));
+        assertFalse(kept.restart.contains("AD"));
+
+        Plan written = Plan.of(diff, to, DS, Secrets.none(), "none", Map.of(), true, null, List.of(), null, List.of(), List.of(), true);
+        Plan.Step w = written.steps.stream()
+            .filter(s -> s.op == Plan.Op.MODIFY && VaultMapping.TRACE_SIZE_LIMIT.equals(s.attr)).findFirst().orElseThrow();
+        assertEquals("cn=AD,cn=dvs,o=system", w.dn);
+        assertEquals("100000", new String(w.values.get(VaultMapping.TRACE_SIZE_LIMIT).get(0), StandardCharsets.UTF_8));
+        assertFalse("the engine reads trace settings live", written.restart.contains("AD"));
+    }
 }
diff --git a/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java b/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java
index c0c2f5dc..d4efa4dc 100644
--- a/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java
@@ -52,6 +52,7 @@ public class ExportReaderTest {
         + "    </policy-linkage>"
         + "    <shim-auth-id value=\"IDVAULTAPI\"/>"
         + "    <shim-auth-server value=\"https://rental2.ultipro.com\"/>"
+        + "    <trace-size-limit value=\"20000\"/>"
         + "    <shim-config-info-xml><driver-config name=\"REST Driver\">"
         + "      <driver-options><configuration-values><definitions/></configuration-values></driver-options>"
         + "    </driver-config></shim-config-info-xml>"
@@ -103,6 +104,7 @@ public void singleDriverFormCapturesShimAndConfigBlobs() {
         assertNotNull(ukg);
         assertEquals("com.pointbluetech.idm.ukg.driv.UKGDriverShim", ukg.shimClass);
         assertEquals("https://rental2.ultipro.com", ukg.shimAuthServer);
+        assertEquals("20000", ukg.traceSizeLimit);
         assertEquals("IDVAULTAPI", ukg.shimAuthId);
 
         assertTrue(ukg.config.containsKey(Driver.DRIVER_FILTER));
diff --git a/src/test/java/com/pointblue/dirxml/dev/source/LdifReaderTest.java b/src/test/java/com/pointblue/dirxml/dev/source/LdifReaderTest.java
index e25127af..d110d5e9 100644
--- a/src/test/java/com/pointblue/dirxml/dev/source/LdifReaderTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/source/LdifReaderTest.java
@@ -51,6 +51,7 @@ private static DriverSet sample() {
             entry(drv, "DirXML-Driver",
                 "DirXML-JavaModule", "com.novell.nds.dirxml.driver.ad.ADDriverShim",
                 "DirXML-ShimAuthServer", "ad.example.com", "DirXML-ShimAuthID", "svc",
+                "DirXML-TraceSizeLimit", "200000",
                 "DirXML-DriverFilter", "<filter/>",
                 "DirXML-pkgGUID", "PKG-1",
                 "DirXML-Policies", schema + "#0#0",
@@ -90,6 +91,7 @@ public void placesArtifactsByDnStructure() {
         assertNotNull(ad);
         assertEquals("com.novell.nds.dirxml.driver.ad.ADDriverShim", ad.shimClass);
         assertEquals("svc", ad.shimAuthId);
+        assertEquals("200000", ad.traceSizeLimit);
         assertTrue(ad.config.containsKey(Driver.DRIVER_FILTER));
         assertEquals("PKG-1", ad.meta.get("dirxml-pkgguid"));
         assertEquals(3, ad.policies.size());                 // sch_Map + startup + shutdown at driver scope
diff --git a/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java b/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java
index faab0f0e..d0fed96a 100644
--- a/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java
@@ -167,6 +167,8 @@ private Path buildProject() throws IOException {
         String driverAttrs = cstring("DirXML-JavaModule", "com.novell.nds.dirxml.driver.ad.ADDriverShim")
             + cstring("DirXML-ShimAuthServer", "ad.example.com")
             + cstring("DirXML-ShimAuthID", "svc")
+            + cstring("IdmParameter:InheritTraceSize", "false")
+            + cstring("DirXML-TraceSizeLimit", "100000")
             + cstring("DirXML-ShimConfigInfo", shimConfigInfo)
             + cstring("DirXML-EngineControlValues", engineControlValues)
             + "<attributes xsi:type=\"com.novell.designer.model:CHeavyData\" attrName=\"DirXML-ConfigValues\"/>"
@@ -264,6 +266,7 @@ public void driverCarriesShimAndConfigBlobsAndPackageMeta() throws IOException {
         assertNotNull(ad);
         assertEquals("com.novell.nds.dirxml.driver.ad.ADDriverShim", ad.shimClass);
         assertEquals("ad.example.com", ad.shimAuthServer);
+        assertEquals("100000", ad.traceSizeLimit);
         assertEquals("svc", ad.shimAuthId);
         assertEquals("cn=AD,cn=DS1,o=system", ad.dn);
         assertEquals("true", ad.meta.get("dn.synthesized"));

From 4ceb72992fadd6551ca094e7f2f43df80cae22a6 Mon Sep 17 00:00:00 2001
From: Jerry Combs <jcombs@pointbluetech.com>
Date: Mon, 2 Nov 2026 18:05:31 -0600
Subject: [PATCH 2/2] A new driver starts with its trace level and file

A deploy that creates a driver writes the DirXML-TraceLevel and DirXML-TraceFile
the tree recorded; on an existing driver they stay operational. Designer projects
and exports read and write the driver's own trace level and file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                         |  7 +++++--
 docs/tree-layout.md                                  |  3 ++-
 docs/vault-deploy.md                                 |  6 ++++--
 .../pointblue/dirxml/dev/deploy/VaultMapping.java    |  3 +++
 .../java/com/pointblue/dirxml/dev/model/Driver.java  |  6 ++++++
 .../pointblue/dirxml/dev/source/ExportReader.java    | 10 +++++++++-
 .../pointblue/dirxml/dev/source/ExportWriter.java    |  9 +++++++++
 .../com/pointblue/dirxml/dev/source/LdifReader.java  |  2 +-
 .../pointblue/dirxml/dev/source/ProjectReader.java   |  8 ++++++++
 .../pointblue/dirxml/dev/source/ProjectWriter.java   | 10 ++++++++++
 .../com/pointblue/dirxml/dev/deploy/PlanTest.java    | 12 ++++++++++--
 .../dirxml/dev/source/ExportReaderTest.java          |  4 ++++
 .../dirxml/dev/source/ProjectReaderTest.java         |  3 +++
 13 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d0158792..6b2c7f1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,8 +16,11 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
   flag the plan notes the difference. The change never restarts a driver, because the engine reads trace
   settings live, and it never counts as drift. A tree that doesn't record a limit asks for nothing, so
   older trees diff as before. Also: `driver.set --key trace-size-limit`, the override key
-  `drivers/<driver>.trace-size-limit`, and `vault.compare-envs` values. The trace level and file stay
-  operational (`driver.trace`).
+  `drivers/<driver>.trace-size-limit`, and `vault.compare-envs` values.
+- **A new driver starts with its trace level and file.** A deploy that creates a driver writes the
+  `DirXML-TraceLevel` and `DirXML-TraceFile` the tree recorded. On an existing driver they stay operational
+  (`driver.trace`), and are never compared or written. Designer projects and exports now read and write the
+  driver's own trace level and file too.
 
 ### Changed
 
diff --git a/docs/tree-layout.md b/docs/tree-layout.md
index d4ef6e0e..a7363e1f 100644
--- a/docs/tree-layout.md
+++ b/docs/tree-layout.md
@@ -148,7 +148,8 @@ doesn't have.
 
 That driver's manifest: shim class, authentication server and id (not the
 password), its trace size limit (`trace-size-limit`, the vault's
-`DirXML-TraceSizeLimit`; absent when it inherits the driver set's), which environments get it (`environments="QA, PROD"`, absent = every
+`DirXML-TraceSizeLimit`; absent when it inherits the driver set's), the trace level and file
+it was read with (`dirxml-tracelevel` / `dirxml-tracefile` meta: a new driver starts with them), which environments get it (`environments="QA, PROD"`, absent = every
 environment) and which it is planned for but not promoted to yet
 (`planned="PROD"`), which config files exist, every policy and resource, the
 entitlements, and the **linkage** — which object runs in which policy set, in
diff --git a/docs/vault-deploy.md b/docs/vault-deploy.md
index 62b535cf..0a874783 100644
--- a/docs/vault-deploy.md
+++ b/docs/vault-deploy.md
@@ -671,8 +671,10 @@ discipline), 5 and 7 are not.
    value is optional: without `--trace-size-limit` the vault keeps its own and the
    plan says so; with it, the plan writes the tree's. Either way no restart (the
    engine reads trace settings live), and a difference is never drift. A tree that
-   doesn't record a limit asks for nothing. The trace level and file stay
-   operational (`driver.trace`).
+   doesn't record a limit asks for nothing. A new driver also starts with the trace
+   level and file the tree saw (`dirxml-tracelevel` / `dirxml-tracefile` in
+   `driver.xml`); on an existing driver those stay operational (`driver.trace`),
+   never compared or written.
 
 ## Incident 2026-09-16 — a stale tree emptied a kind (recovered from the snapshot)
 
diff --git a/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java b/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java
index c67a9322..f20d5560 100644
--- a/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java
+++ b/src/main/java/com/pointblue/dirxml/dev/deploy/VaultMapping.java
@@ -241,6 +241,9 @@ public static Map<String, List<byte[]>> driverAttributes(Driver d) {
         put(m, SHIM_AUTH_SERVER, d.shimAuthServer);
         put(m, SHIM_AUTH_ID, d.shimAuthId);
         put(m, TRACE_SIZE_LIMIT, d.traceSizeLimit);
+        // the trace level and file the tree last saw: a new driver starts with them, an existing one keeps its own
+        put(m, Vault.TRACE_LEVEL, d.meta.get(Driver.META_TRACE_LEVEL));
+        put(m, Vault.TRACE_FILE, d.meta.get(Driver.META_TRACE_FILE));
         blob(m, SHIM_CONFIG_INFO, d.config.get(Driver.SHIM_CONFIG_INFO));
         blob(m, CONFIG_VALUES, d.config.get(Driver.CONFIG_VALUES));
         blob(m, DRIVER_FILTER, d.config.get(Driver.DRIVER_FILTER));
diff --git a/src/main/java/com/pointblue/dirxml/dev/model/Driver.java b/src/main/java/com/pointblue/dirxml/dev/model/Driver.java
index 1578edf8..897f330c 100644
--- a/src/main/java/com/pointblue/dirxml/dev/model/Driver.java
+++ b/src/main/java/com/pointblue/dirxml/dev/model/Driver.java
@@ -26,6 +26,12 @@ public final class Driver {
     public static final String SHIM_AUTH_ID = "shim-auth-id";
     /** The {@code drivers/<d>.trace-size-limit} setting and its {@code driver.xml} attribute. */
     public static final String TRACE_SIZE_LIMIT = "trace-size-limit";
+    /**
+     * Meta keys (the vault readers' lowercase attribute names) of the driver's trace level and file: operational
+     * ({@code driver.trace}), never compared, written only when a deploy creates the driver.
+     */
+    public static final String META_TRACE_LEVEL = "dirxml-tracelevel";
+    public static final String META_TRACE_FILE = "dirxml-tracefile";
 
     /** The tree's name; {@link DriverSet#renameDriver} changes it on a throwaway model (an environment that names the driver differently). */
     public String name;
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java b/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java
index deaf0e21..6304d8aa 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ExportReader.java
@@ -235,11 +235,19 @@ private static Driver readDriver(Element driverEl, String libraryContainerName,
             }
         }
 
-        // <trace-size-limit value=…/>, or inherit="true" for the driver set's
+        // <trace-size-limit value=…/>, or inherit="true" for the driver set's; the level and file the same way, as meta
         Element traceSize = directChild(attrs, "trace-size-limit");
         if (traceSize != null && !"true".equalsIgnoreCase(traceSize.getAttribute("inherit"))) {
             d.traceSizeLimit = nullIfEmpty(traceSize.getAttribute("value"));
         }
+        String[][] trace = { { "trace-level", Driver.META_TRACE_LEVEL }, { "trace-file", Driver.META_TRACE_FILE } };
+        for (String[] t : trace) {
+            Element te = directChild(attrs, t[0]);
+            String v = te == null || "true".equalsIgnoreCase(te.getAttribute("inherit")) ? null : nullIfEmpty(te.getAttribute("value"));
+            if (v != null) {
+                d.meta.put(t[1], v);
+            }
+        }
 
         Element filter = Xds.firstByName(scanRoot, "filter");
         if (filter != null) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java b/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java
index 1655bb4b..1075a2d2 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ExportWriter.java
@@ -454,6 +454,15 @@ private static void writeCommonDriverAttrs(Document doc, Element attrs, Driver d
             e.setAttribute("value", d.traceSizeLimit);
             attrs.appendChild(e);
         }
+        String[][] trace = { { "trace-level", Driver.META_TRACE_LEVEL }, { "trace-file", Driver.META_TRACE_FILE } };
+        for (String[] t : trace) {
+            String v = d.meta.get(t[1]);
+            if (v != null) {
+                Element e = doc.createElement(t[0]);
+                e.setAttribute("value", v);
+                attrs.appendChild(e);
+            }
+        }
 
         Element filter = d.config.get(Driver.DRIVER_FILTER);
         if (filter != null) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java b/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java
index f4bcf7c7..b94dfd64 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/LdifReader.java
@@ -751,7 +751,7 @@ private static void copyMeta(Entry e, Map<String, String> meta, String objectCla
                 continue;   // the package initial state is the tree's .package-baseline, not meta
             }
             if (a.startsWith("dirxml-pkg") || a.equals("dirxml-contenttype") || a.equals("dirxml-driverstartoption")
-                || a.equals("dirxml-tracelevel") || a.equals("dirxml-tracefile")) {
+                || a.equals(Driver.META_TRACE_LEVEL) || a.equals(Driver.META_TRACE_FILE)) {
                 String v = e.first(a);
                 if (v != null) {
                     meta.put(a, v);
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java b/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java
index b8a9ae76..06fb71ae 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ProjectReader.java
@@ -772,6 +772,14 @@ private static Driver readDriver(Index idx, String drvId, DriverSet ds) {
         if (traceSize != null && !traceSize.isEmpty() && !"true".equalsIgnoreCase(attrValue(m, "IdmParameter:InheritTraceSize"))) {
             d.traceSizeLimit = traceSize;
         }
+        String[][] trace = { { "DirXML-TraceLevel", "InheritTraceLevel", Driver.META_TRACE_LEVEL },
+            { "DirXML-TraceFile", "InheritTraceFile", Driver.META_TRACE_FILE } };
+        for (String[] t : trace) {
+            String v = attrValue(m, t[0]);
+            if (v != null && !v.isEmpty() && !"true".equalsIgnoreCase(attrValue(m, "IdmParameter:" + t[1]))) {
+                d.meta.put(t[2], v);
+            }
+        }
 
         String shimConfigInfo = attrValue(m, "DirXML-ShimConfigInfo");
         if (shimConfigInfo != null && !shimConfigInfo.isBlank()) {
diff --git a/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java b/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java
index 719a3c4f..aeeedea3 100644
--- a/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java
+++ b/src/main/java/com/pointblue/dirxml/dev/source/ProjectWriter.java
@@ -2997,6 +2997,16 @@ void applyDriverAdd(Driver treeDriver) throws IOException {
                 attrs.append(CObjectXml.attr("IdmParameter:InheritTraceSize", "false", "CString"));
                 attrs.append(CObjectXml.attr("DirXML-TraceSizeLimit", treeDriver.traceSizeLimit, "CString"));
             }
+            String traceLevel = treeDriver.meta.get(Driver.META_TRACE_LEVEL);
+            if (traceLevel != null) {
+                attrs.append(CObjectXml.attr("IdmParameter:InheritTraceLevel", "false", "CString"));
+                attrs.append(CObjectXml.attr("DirXML-TraceLevel", traceLevel, "CString"));
+            }
+            String traceFile = treeDriver.meta.get(Driver.META_TRACE_FILE);
+            if (traceFile != null) {
+                attrs.append(CObjectXml.attr("IdmParameter:InheritTraceFile", "false", "CString"));
+                attrs.append(CObjectXml.attr("DirXML-TraceFile", traceFile, "CString"));
+            }
             Element sci = treeDriver.config.get(Driver.SHIM_CONFIG_INFO);
             if (sci != null) {
                 attrs.append(CObjectXml.attr("DirXML-ShimConfigInfo", CanonicalXml.serialize(sci), "CString"));
diff --git a/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java b/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java
index a3579a75..b1559a27 100644
--- a/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/deploy/PlanTest.java
@@ -536,10 +536,11 @@ public void engineControlValuesAbsentFromTreeAreNotRemoved() throws IOException
 
     /**
      * The trace size limit is the driver's configuration: a new driver is created with the tree's, but an existing
-     * driver keeps the vault's unless the deploy is told to write it ({@code --trace-size-limit}).
+     * driver keeps the vault's unless the deploy is told to write it ({@code --trace-size-limit}). A new driver also
+     * starts with the trace level and file the tree saw; an existing driver's stay operational ({@code driver.trace}).
      */
     @Test
-    public void traceSizeLimitIsWrittenOnANewDriverAndOnAnExistingOneOnlyWhenAsked() {
+    public void traceSettingsAreWrittenOnANewDriverAndTheLimitOnAnExistingOneOnlyWhenAsked() {
         DriverSet from = VaultMappingTest.model();
         from.driver("AD").traceSizeLimit = "200000";
         DriverSet to = VaultMappingTest.model();
@@ -547,12 +548,19 @@ public void traceSizeLimitIsWrittenOnANewDriverAndOnAnExistingOneOnlyWhenAsked()
         Driver n = new Driver("New");
         n.shimClass = "com.example.Shim";
         n.traceSizeLimit = "50000";
+        n.meta.put(Driver.META_TRACE_LEVEL, "3");
+        n.meta.put(Driver.META_TRACE_FILE, "/var/log/idm/new.trace");
         to.drivers.add(n);
+        from.driver("AD").meta.put(Driver.META_TRACE_LEVEL, "0");
+        to.driver("AD").meta.put(Driver.META_TRACE_LEVEL, "5");   // an existing driver's trace level is operational: never written
         ModelDiff diff = ModelDiff.of(from, to);
 
         Plan kept = Plan.of(diff, to, DS, Secrets.none(), "none", Map.of(), true, null, List.of(), null, List.of(), List.of(), false);
         Plan.Step add = kept.steps.stream().filter(s -> s.op == Plan.Op.ADD && "cn=New,cn=dvs,o=system".equals(s.dn)).findFirst().orElseThrow();
         assertEquals("50000", new String(add.values.get(VaultMapping.TRACE_SIZE_LIMIT).get(0), StandardCharsets.UTF_8));
+        assertEquals("3", new String(add.values.get(Vault.TRACE_LEVEL).get(0), StandardCharsets.UTF_8));
+        assertEquals("/var/log/idm/new.trace", new String(add.values.get(Vault.TRACE_FILE).get(0), StandardCharsets.UTF_8));
+        assertTrue(kept.text("stg", DS), kept.steps.stream().noneMatch(s -> Vault.TRACE_LEVEL.equals(s.attr)));
         assertTrue(kept.text("stg", DS), kept.steps.stream()
             .noneMatch(s -> s.op == Plan.Op.MODIFY && VaultMapping.TRACE_SIZE_LIMIT.equals(s.attr)));
         assertTrue(kept.notes.toString(), kept.notes.stream()
diff --git a/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java b/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java
index d4efa4dc..4f46ccc8 100644
--- a/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/source/ExportReaderTest.java
@@ -53,6 +53,8 @@ public class ExportReaderTest {
         + "    <shim-auth-id value=\"IDVAULTAPI\"/>"
         + "    <shim-auth-server value=\"https://rental2.ultipro.com\"/>"
         + "    <trace-size-limit value=\"20000\"/>"
+        + "    <trace-level value=\"5\"/>"
+        + "    <trace-file inherit=\"true\"/>"
         + "    <shim-config-info-xml><driver-config name=\"REST Driver\">"
         + "      <driver-options><configuration-values><definitions/></configuration-values></driver-options>"
         + "    </driver-config></shim-config-info-xml>"
@@ -105,6 +107,8 @@ public void singleDriverFormCapturesShimAndConfigBlobs() {
         assertEquals("com.pointbluetech.idm.ukg.driv.UKGDriverShim", ukg.shimClass);
         assertEquals("https://rental2.ultipro.com", ukg.shimAuthServer);
         assertEquals("20000", ukg.traceSizeLimit);
+        assertEquals("5", ukg.meta.get(Driver.META_TRACE_LEVEL));
+        assertNull("inherited: not the driver's own", ukg.meta.get(Driver.META_TRACE_FILE));
         assertEquals("IDVAULTAPI", ukg.shimAuthId);
 
         assertTrue(ukg.config.containsKey(Driver.DRIVER_FILTER));
diff --git a/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java b/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java
index d0fed96a..5f7e99db 100644
--- a/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/source/ProjectReaderTest.java
@@ -169,6 +169,8 @@ private Path buildProject() throws IOException {
             + cstring("DirXML-ShimAuthID", "svc")
             + cstring("IdmParameter:InheritTraceSize", "false")
             + cstring("DirXML-TraceSizeLimit", "100000")
+            + cstring("IdmParameter:InheritTraceLevel", "false")
+            + cstring("DirXML-TraceLevel", "3")
             + cstring("DirXML-ShimConfigInfo", shimConfigInfo)
             + cstring("DirXML-EngineControlValues", engineControlValues)
             + "<attributes xsi:type=\"com.novell.designer.model:CHeavyData\" attrName=\"DirXML-ConfigValues\"/>"
@@ -267,6 +269,7 @@ public void driverCarriesShimAndConfigBlobsAndPackageMeta() throws IOException {
         assertEquals("com.novell.nds.dirxml.driver.ad.ADDriverShim", ad.shimClass);
         assertEquals("ad.example.com", ad.shimAuthServer);
         assertEquals("100000", ad.traceSizeLimit);
+        assertEquals("3", ad.meta.get(Driver.META_TRACE_LEVEL));
         assertEquals("svc", ad.shimAuthId);
         assertEquals("cn=AD,cn=DS1,o=system", ad.dn);
         assertEquals("true", ad.meta.get("dn.synthesized"));