diff --git a/CHANGELOG.md b/CHANGELOG.md
index 636bbbd..cf00f9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,19 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+## [0.87.0] - 2026-11-02
+
+Needs DirXMLDev 0.64.0.
+
+### Added
+
+- **Trace size limits in deploys** (DirXMLDev 0.64.0). The tree now records each driver's trace size
+  limit, and a new driver is created with it and with the trace level and file the tree saw. On the
+  Deploy step, **write the tree's trace size limits over the vault's** also writes the limit on existing
+  drivers. Without it the vault keeps its own and the plan notes the difference. It never restarts a
+  driver, and a limit difference never stops a production deploy as drift. The agent tools `plan_deploy`
+  and `deploy` take `traceSizeLimit`.
+
 ## [0.86.0] - 2026-11-02
 
 Needs DirXMLDev 0.63.0.
diff --git a/docs/agents.md b/docs/agents.md
index 64d031c..fa3fb4f 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -136,7 +136,7 @@ refused instead of overwriting someone else's change. Example arguments:
 | `environments` | | the project's environments, their tier (dev, test, prd), whether you are connected |
 | `compare` | **`env`**; `drivers`: a list of the tree's driver names (all when omitted) | the tree against the vault: what a deploy would write |
 | `compare_environments` | **`env`**, **`with`** | two vaults side by side: what only one holds, values that differ, likely renames, likely causes |
-| `plan_deploy` | **`env`**; `drivers`; `restart`: `true` (default) restarts drivers a change needs restarted; `secrets`: `none` (default), `missing` or `all` | a deploy step by step, and what stands in its way |
+| `plan_deploy` | **`env`**; `drivers`; `restart`: `true` (default) restarts drivers a change needs restarted; `secrets`: `none` (default), `missing` or `all`; `traceSizeLimit`: `true` writes the tree's trace size limit over an existing driver's (default `false`: the vault keeps its own) | a deploy step by step, and what stands in its way |
 | `driver_status` | **`env`**; `driver` | the drivers' state, or one driver's |
 | `trace` | **`env`**, **`driver`** | a driver's recent trace |
 | `snapshots` | **`env`** | the snapshots earlier deploys took (what a rollback puts back) |
@@ -147,7 +147,7 @@ you in the chat**. The agent must not fill it in itself.
 
 | Tool | Arguments | What it does |
 |---|---|---|
-| `deploy` | **`env`**, **`confirm`**; `drivers`, `restart`, `secrets` as for `plan_deploy` | deploys, after a snapshot |
+| `deploy` | **`env`**, **`confirm`**; `drivers`, `restart`, `secrets`, `traceSizeLimit` as for `plan_deploy` | deploys, after a snapshot |
 | `rollback` | **`env`**, **`snapshot`** (as `snapshots` lists it), **`confirm`** | puts a snapshot back |
 | `driver_lifecycle` | **`env`**, **`driver`**, **`action`**: `start`, `stop` or `restart`; **`confirm`** | starts, stops or restarts a driver |
 
diff --git a/docs/features.md b/docs/features.md
index 2e4938a..91c6a34 100644
--- a/docs/features.md
+++ b/docs/features.md
@@ -167,8 +167,10 @@ Every view of the page, by area, in every install; the items marked *local and s
   - *Deploy*: the plan step by step with nothing written, then the deploy itself (snapshot,
     write, restart, verify) once you type the environment's name; the secrets mode (leave alone,
     set the named passwords the vault lacks, re-set every provided secret), *allow missing
-    secrets* for a first deploy, and *delete from the vault* for a driver the comparison reports
-    as only there (stopped first; the snapshot keeps it). Against production the plan runs the
+    secrets* for a first deploy, *write the tree's trace size limits over the vault's* (a new driver
+    always gets the tree's limit, trace level and file; an existing driver keeps the vault's limit
+    unless this is ticked, and the plan notes a difference either way), and *delete from the vault*
+    for a driver the comparison reports as only there (stopped first; the snapshot keeps it). Against production the plan runs the
     production checks too, before anything is typed, and says what stands in the way in plain
     words with a button for the way on: *Push*, *Get latest main*, or *Capture <environment>'s
     current state* when its state isn't on record or has changed outside the tree. A capture reads
diff --git a/pom.xml b/pom.xml
index 49e7042..b0ef0f8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
 
     <groupId>com.pointblue.dirxml</groupId>
     <artifactId>dirxml-dev-web</artifactId>
-    <version>0.86.0</version>
+    <version>0.87.0</version>
     <licenses>
         <license>
             <name>MIT License</name>
@@ -23,7 +23,7 @@
         <!-- The DirXMLDev release this server is written against. Install it once with
              `mvn -o install -DskipTests` in the DirXMLDev checkout; bin/idmweb then runs
              against that checkout's classes, engine jars and simulator. -->
-        <dirxmldev.version>0.63.0</dirxmldev.version>
+        <dirxmldev.version>0.64.0</dirxmldev.version>
         <simulator.version>1.7.0</simulator.version>
         <!-- the DirXML Trace Viewer's library: parser, highlighter, LDAP trace source (its release attaches the jar) -->
         <!-- Directory Console's shared libraries (console-auth: OIDC sign-in, TLS trust). Install with
diff --git a/src/main/java/com/pointblue/dirxml/web/Api.java b/src/main/java/com/pointblue/dirxml/web/Api.java
index a8d26eb..4df3ae3 100644
--- a/src/main/java/com/pointblue/dirxml/web/Api.java
+++ b/src/main/java/com/pointblue/dirxml/web/Api.java
@@ -991,6 +991,7 @@ private static VaultService.DeployChoices deployChoices(Map<String, Object> req,
         c.restart = restart;
         c.secretsMode = Json.asString(req.get("secrets"));
         c.allowMissingSecrets = Boolean.TRUE.equals(req.get("allowMissingSecrets"));
+        c.traceSizeLimit = Boolean.TRUE.equals(req.get("traceSizeLimit"));
         java.util.List<String> del = new java.util.ArrayList<>();
         Object d = req.get("deleteDrivers");
         if (d instanceof java.util.List<?> list) {
diff --git a/src/main/java/com/pointblue/dirxml/web/Mcp.java b/src/main/java/com/pointblue/dirxml/web/Mcp.java
index 98e3979..8ceccdb 100644
--- a/src/main/java/com/pointblue/dirxml/web/Mcp.java
+++ b/src/main/java/com/pointblue/dirxml/web/Mcp.java
@@ -499,7 +499,8 @@ private void define() {
         tool("plan_deploy", "What a deploy to an environment would do, step by step, and what stands in its way (validation, production's rules). Nothing is written. Show this to the person before deploy.",
             props("env", str("environment name"), "drivers", strs("only these drivers; the whole driver set when omitted"),
                 "restart", bool("restart drivers a change needs restarted (default true)"),
-                "secrets", str("none (default), missing, or all")),
+                "secrets", str("none (default), missing, or all"),
+                "traceSizeLimit", bool("also write the tree's trace size limit over an existing driver's (default false: the vault keeps its own; a new driver always gets the tree's)")),
             List.of("env"), false, a -> new Request("POST", "/api/vault/plan", vaultBody(a)));
         tool("driver_status", "The drivers' state in an environment (running, stopped), or one driver's.",
             props("env", str("environment name"), "driver", str("one driver (optional)")), List.of("env"), false,
@@ -519,7 +520,8 @@ private void define() {
         tool("deploy", "Deploy the tree to an environment. Only after plan_deploy has been shown to the person and they typed the environment's name in chat as confirm. The server refuses otherwise.",
             props("env", str("environment name"), "drivers", strs("only these drivers; the whole driver set when omitted"),
                 "confirm", str("the environment's name, typed by the person"), "restart", bool("restart drivers a change needs restarted (default true)"),
-                "secrets", str("none (default), missing, or all")),
+                "secrets", str("none (default), missing, or all"),
+                "traceSizeLimit", bool("also write the tree's trace size limit over an existing driver's (default false: the vault keeps its own; a new driver always gets the tree's)")),
             List.of("env", "confirm"), true, a -> {
                 Map<String, Object> b = vaultBody(a);
                 b.put("confirm", a.s("confirm"));
@@ -549,6 +551,7 @@ private static Map<String, Object> vaultBody(Args a) {
         b.put("drivers", a.list("drivers"));
         b.put("restart", !Boolean.FALSE.equals(a.m.get("restart")));
         b.put("secrets", a.s("secrets") == null ? "none" : a.s("secrets"));
+        b.put("traceSizeLimit", Boolean.TRUE.equals(a.m.get("traceSizeLimit")));
         return b;
     }
 
diff --git a/src/main/java/com/pointblue/dirxml/web/Serve.java b/src/main/java/com/pointblue/dirxml/web/Serve.java
index 2337e4d..6906dd2 100644
--- a/src/main/java/com/pointblue/dirxml/web/Serve.java
+++ b/src/main/java/com/pointblue/dirxml/web/Serve.java
@@ -14,7 +14,7 @@
  */
 public final class Serve {
 
-    public static final String VERSION = "0.86.0";
+    public static final String VERSION = "0.87.0";
 
     private Serve() {
     }
diff --git a/src/main/java/com/pointblue/dirxml/web/VaultService.java b/src/main/java/com/pointblue/dirxml/web/VaultService.java
index 974c00f..509d084 100644
--- a/src/main/java/com/pointblue/dirxml/web/VaultService.java
+++ b/src/main/java/com/pointblue/dirxml/web/VaultService.java
@@ -214,6 +214,8 @@ public static final class DeployChoices {
         public Map<String, String> driverServers = Map.of();
         /** {@code --capture-drift}: a production environment whose current state is unknown has it captured first (#67). */
         public boolean captureDrift;
+        /** {@code --trace-size-limit}: write the tree's trace size limit over an existing driver's (a new driver always gets it). */
+        public boolean traceSizeLimit;
     }
 
     public Map<String, Object> plan(String envName, List<String> drivers, boolean restart, String secretsMode) throws IOException {
@@ -403,6 +405,7 @@ private Deployer.Options options(String envName, List<String> drivers, DeployCho
         o.deleteDrivers = c.deleteDrivers == null ? List.of() : c.deleteDrivers;
         o.driverServers = c.driverServers == null ? Map.of() : c.driverServers;
         o.captureDrift = c.captureDrift;
+        o.traceSizeLimit = c.traceSizeLimit;
         return o;
     }
 
diff --git a/web/src/components/VaultView.tsx b/web/src/components/VaultView.tsx
index 57f405b..528a760 100644
--- a/web/src/components/VaultView.tsx
+++ b/web/src/components/VaultView.tsx
@@ -465,6 +465,7 @@ function Compare({ env, drivers, revision, onOpen, onFix }: { env: string; drive
   const [restart, setRestart] = useState(true);
   const [secrets, setSecrets] = useState<"none" | "missing" | "all">("none");
   const [allowMissing, setAllowMissing] = useState(false);
+  const [traceSizeLimit, setTraceSizeLimit] = useState(false);
   const [pulling, setPulling] = useState(false);
   // #136: a capture of the environment's state, and the steps on from it
   const [captured, setCaptured] = useState<DeployResult | null>(null);
@@ -476,7 +477,7 @@ function Compare({ env, drivers, revision, onOpen, onFix }: { env: string; drive
   const [rollbackOf, setRollbackOf] = useState<VaultSnapshot | null>(null);
   const [rollbackConfirm, setRollbackConfirm] = useState("");
   const [rollbackResult, setRollbackResult] = useState<DeployResult | null>(null);
-  const choices = { restart, secrets, allowMissingSecrets: allowMissing, deleteDrivers, driverServers, captureDrift: false };
+  const choices = { restart, secrets, allowMissingSecrets: allowMissing, deleteDrivers, driverServers, captureDrift: false, traceSizeLimit };
   const loadSnapshots = () =>
     api.vault
       .snapshots(env)
@@ -852,6 +853,9 @@ function Compare({ env, drivers, revision, onOpen, onFix }: { env: string; drive
               <label className="checkchip" title="A first deploy of a driver refuses when a secret it needs is not provided; allow it to create the driver stopped and list what to set">
                 <input type="checkbox" checked={allowMissing} onChange={(e) => setAllowMissing(e.target.checked)} data-testid="vault-allow-missing" /> allow missing secrets on a first deploy
               </label>
+              <label className="checkchip" title="A new driver always gets the tree's trace size limit. An existing driver keeps the vault's unless this is ticked; the plan notes a difference either way. Never restarts a driver">
+                <input type="checkbox" checked={traceSizeLimit} onChange={(e) => setTraceSizeLimit(e.target.checked)} data-testid="vault-trace-size-limit" /> write the tree's trace size limits over the vault's
+              </label>
               <button className={plan && !planOutdated ? "" : "primary"} onClick={makePlan} disabled={busy !== null || stale || running} data-testid="vault-plan">
                 {plan ? "Plan again" : "Plan the deploy"}
               </button>
diff --git a/web/src/types.ts b/web/src/types.ts
index ff0a546..4d3ca55 100644
--- a/web/src/types.ts
+++ b/web/src/types.ts
@@ -446,6 +446,8 @@ export interface DeployChoices {
   driverServers?: Record<string, string>;
   /** A production environment's unknown or drifted state captured first as an as-found branch (vault.deploy --capture-drift). */
   captureDrift?: boolean;
+  /** Also write the tree's trace size limit over an existing driver's (vault.deploy --trace-size-limit); a new driver always gets it. */
+  traceSizeLimit?: boolean;
 }
 
 /** The vault's state taken into the workspace's tree (#67): a dry run's per-file diff, or what an apply wrote. */