broker: check delivery size against the recipient's real wire at queue time (incl. fleet WorkerMissing path) #1960

Two queue-time size checks deferred from the #1930 review (cubic). Today neither lets an oversized body be written to a terminal: the worker's own injection gate rejects it with injection_too_large. But both reject late, after a launch or a retry the broker could have avoided.

1. The queue-time guard ignores the recipient's actual wire. queue_and_try_delivery_raw (crates/broker/src/runtime/delivery.rs) checks PTY bodies against MAX_BODY_BYTES (14,336 B). A recipient without bracketed paste only accepts effective_limit(Typed, pace): about 1,536 B including the envelope at the default 5 ms pace. A fleet spawn task or relay body between 1,536 and 14,336 bytes passes the CLI --task/--task-file check, the fleet pre-launch check and this guard. It then fails at injection with injection_too_large, which reports spawn_task_failed for the initial task on non-paste TUIs. Fixing it needs the latched bracketed-paste capability reported from the worker to the broker, or a conservative per-CLI default, so the broker can check against the real wire before launch. Review thread: Bundle: Software Garden fleet/PTY/subscription fixes (#1913, #1910, #1900, #1893) #1930 (comment)

2. Fleet WorkerMissing deliveries skip the queue-time check. They enter insert_and_attempt_delivery as a prebuilt RelayDelivery (crates/broker/src/runtime/fleet.rs), so they never pass the PTY or headless size guard in queue_and_try_delivery_raw. Moving the guard into insert_and_attempt_delivery changes what an Err means on that path (Relaycast ownership and redelivery of the withheld ack). That needs its own design and tests, so it was not folded into Bundle: Software Garden fleet/PTY/subscription fixes (#1913, #1910, #1900, #1893) #1930. Review thread: Bundle: Software Garden fleet/PTY/subscription fixes (#1913, #1910, #1900, #1893) #1930 (comment)

🤖 Generated with Claude Code