@moretea-labs/forge 1.7.1 → 1.8.0

package/src/runtime/root/release-materialize.ts

@@ -6,6 +6,8 @@ import { runProcess } from '../../effects/process-runner';
 import { resolveBunExecutable } from '../shared/process-environment';
 import { CONTROL_PLANE_SCHEMA_VERSION } from '../control-plane/persistence/sqlite-store';
 import { loadRuntimeReleaseManifest, requireCompleteCompiledRuntimeReleaseManifest } from './release-manifest';
+import { assertRuntimeReleaseExecutionCanaries, type RuntimeReleaseExecutionCanaryCommand } from './release-execution-canary';
+export { assertRuntimeReleaseExecutionCanaries, type RuntimeReleaseExecutionCanaryDependencies } from './release-execution-canary';
 import { packageRuntimeFileIndex, stagePackageRuntimeSnapshot } from './package-runtime-release';
 
 /**
@@ -31,11 +33,14 @@ export interface StagedRuntimeRelease {
   manifestPath: string;
   releaseId: string;
   artifactIdentity: string;
+  runtimeBundleArtifactIdentity?: string;
   diagnosticArtifactIdentity?: string;
   browserNodeBridgeArtifactIdentity?: string;
   browserHandoffArtifactIdentity?: string;
   processRunnerArtifactIdentity?: string;
   checkRunnerArtifactIdentity?: string;
+  schedulerWorkerArtifactIdentity?: string;
+  periodicCleanupArtifactIdentity?: string;
   pluginActionSidecarArtifactIdentity?: string;
   externalPluginProbeArtifactIdentity?: string;
   codeGraphNodeArtifactIdentity?: string;
@@ -46,6 +51,7 @@ export interface StagedRuntimeRelease {
   macosCodeSigning?: MacOSRuntimeCodeSigning;
   manifestSha256: string;
   sourceCommit: string;
+  sourceRepositoryId?: string;
 }
 
 export interface RuntimeReleaseMaterializerDependencies {
@@ -54,6 +60,7 @@ export interface RuntimeReleaseMaterializerDependencies {
   signMacOSRuntime?: (input: { executable: string; controllerHome: string }) => MacOSRuntimeCodeSigning;
   uuid?: () => string;
   compileBinary?: (input: { sourceRoot: string; outputPath: string; entryPath?: string }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
+  bundleRuntime?: (input: { sourceRoot: string; outputPath: string; entryPath: string }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
   bundleNodeHost?: (input: { sourceRoot: string; outputPath: string; entryPath: string }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
   bundleProcessRunner?: (input: { sourceRoot: string; outputPath: string; entryPath: string }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
   materializeCodeGraphRuntime?: (input: {
@@ -72,6 +79,7 @@ export interface CandidateRuntimeStageReceiptV1 {
   artifactIdentity: string;
   manifestSha256: string;
   sourceCommit: string;
+  sourceRepositoryId: string;
 }
 
 export interface CandidateRuntimeReleaseStagerDependencies {
@@ -83,7 +91,9 @@ export interface CandidateRuntimeReleaseStagerDependencies {
     sourceRoot: string;
     controllerHome: string;
     expectedHead: string;
+    sourceRepositoryId: string;
   }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
+  runExecutionEntryCanary?: (input: RuntimeReleaseExecutionCanaryCommand) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
 }
 
 function gitText(root: string, args: string[]): string {
@@ -224,6 +234,7 @@ function parseCandidateStageReceipt(stdout: string): CandidateRuntimeStageReceip
     artifactIdentity: requireCandidateStageString(value.artifactIdentity, 'artifactIdentity'),
     manifestSha256: requireCandidateStageString(value.manifestSha256, 'manifestSha256'),
     sourceCommit: requireCandidateStageString(value.sourceCommit, 'sourceCommit'),
+    sourceRepositoryId: requireCandidateStageString(value.sourceRepositoryId, 'sourceRepositoryId'),
   };
   if (!/^sha256:[a-f0-9]{64}$/i.test(receipt.artifactIdentity)) {
     throw new Error('RUNTIME_RELEASE_CANDIDATE_RECEIPT_INVALID: artifactIdentity must be sha256:<64 hex>');
@@ -247,9 +258,12 @@ function parseCandidateStageReceipt(stdout: string): CandidateRuntimeStageReceip
 export function stageRuntimeReleaseFromCandidateSource(input: {
   controllerHome: string;
   sourceRoot: string;
+  sourceRepositoryId: string;
 }, dependencies: CandidateRuntimeReleaseStagerDependencies = {}): StagedRuntimeRelease {
   const controllerHome = resolve(input.controllerHome);
   const sourceRoot = resolve(input.sourceRoot);
+  const sourceRepositoryId = input.sourceRepositoryId.trim();
+  if (!sourceRepositoryId) throw new Error('RUNTIME_RELEASE_SOURCE_REPOSITORY_ID_REQUIRED');
   const expectedHead = gitText(sourceRoot, ['rev-parse', '--verify', 'HEAD']);
   if (!/^[a-f0-9]{40}$/i.test(expectedHead)) throw new Error('RUNTIME_RELEASE_SOURCE_COMMIT_INVALID');
   const dirtyBefore = gitText(sourceRoot, ['status', '--porcelain=v1', '--untracked-files=no']);
@@ -266,8 +280,9 @@ export function stageRuntimeReleaseFromCandidateSource(input: {
     '--controller-home', request.controllerHome,
     '--source-root', request.sourceRoot,
     '--expected-head', request.expectedHead,
+    '--source-repository-id', request.sourceRepositoryId,
   ], { cwd: request.sourceRoot, timeoutMs: 600_000, maxOutputBytes: 512 * 1024 }));
-  const executed = runCandidateStager({ bunExecutable, scriptPath, sourceRoot, controllerHome, expectedHead });
+  const executed = runCandidateStager({ bunExecutable, scriptPath, sourceRoot, controllerHome, expectedHead, sourceRepositoryId });
   if (!executed.ok) {
     throw new Error(`RUNTIME_RELEASE_CANDIDATE_STAGE_FAILED: ${executed.stderr || executed.stdout || executed.error}`.slice(0, 2_000));
   }
@@ -275,6 +290,9 @@ export function stageRuntimeReleaseFromCandidateSource(input: {
   if (receipt.sourceCommit !== expectedHead) {
     throw new Error(`RUNTIME_RELEASE_CANDIDATE_SOURCE_MISMATCH: expected ${expectedHead}, got ${receipt.sourceCommit}`);
   }
+  if (receipt.sourceRepositoryId !== sourceRepositoryId) {
+    throw new Error(`RUNTIME_RELEASE_CANDIDATE_SOURCE_REPOSITORY_MISMATCH: expected ${sourceRepositoryId}, got ${receipt.sourceRepositoryId}`);
+  }
 
   const headAfter = gitText(sourceRoot, ['rev-parse', '--verify', 'HEAD']);
   const dirtyAfter = gitText(sourceRoot, ['status', '--porcelain=v1', '--untracked-files=no']);
@@ -317,7 +335,9 @@ export function stageRuntimeReleaseFromCandidateSource(input: {
   requireCompleteCompiledRuntimeReleaseManifest(manifest);
   if (manifest.releaseId !== receipt.releaseId
     || manifest.artifactIdentity !== receipt.artifactIdentity
-    || manifest.sourceCommit !== receipt.sourceCommit) {
+    || manifest.sourceCommit !== receipt.sourceCommit
+    || manifest.sourceRepositoryId !== sourceRepositoryId
+    || receipt.sourceRepositoryId !== sourceRepositoryId) {
     throw new Error('RUNTIME_RELEASE_CANDIDATE_MANIFEST_RECEIPT_MISMATCH');
   }
   const platform = dependencies.platform ?? process.platform;
@@ -339,11 +359,14 @@ export function stageRuntimeReleaseFromCandidateSource(input: {
     manifestPath,
     releaseId: receipt.releaseId,
     artifactIdentity: receipt.artifactIdentity,
+    runtimeBundleArtifactIdentity: manifest.runtimeBundleArtifactIdentity,
     diagnosticArtifactIdentity: manifest.diagnosticArtifactIdentity,
     browserNodeBridgeArtifactIdentity: manifest.browserNodeBridgeArtifactIdentity,
     browserHandoffArtifactIdentity: manifest.browserHandoffArtifactIdentity,
     processRunnerArtifactIdentity: manifest.processRunnerArtifactIdentity,
     checkRunnerArtifactIdentity: manifest.checkRunnerArtifactIdentity,
+    schedulerWorkerArtifactIdentity: manifest.schedulerWorkerArtifactIdentity,
+    periodicCleanupArtifactIdentity: manifest.periodicCleanupArtifactIdentity,
     pluginActionSidecarArtifactIdentity: manifest.pluginActionSidecarArtifactIdentity,
     externalPluginProbeArtifactIdentity: manifest.externalPluginProbeArtifactIdentity,
     codeGraphNodeArtifactIdentity: manifest.codeGraphNodeArtifactIdentity,
@@ -354,8 +377,10 @@ export function stageRuntimeReleaseFromCandidateSource(input: {
     ...(macosCodeSigning ? { macosCodeSigning } : {}),
     manifestSha256: receipt.manifestSha256,
     sourceCommit: receipt.sourceCommit,
+    sourceRepositoryId,
   };
   assertRuntimeReleaseFiles(staged, dependencies);
+  assertRuntimeReleaseExecutionCanaries(manifestPath, controllerHome, dependencies);
   return staged;
 }
 
@@ -371,6 +396,18 @@ function defaultCompileBinary(input: { sourceRoot: string; outputPath: string; e
   ], { cwd: input.sourceRoot, timeoutMs: 300_000, maxOutputBytes: 512 * 1024 });
 }
 
+function defaultBundleRuntimeScript(input: { sourceRoot: string; outputPath: string; entryPath: string }): { ok: boolean; stderr?: string; stdout?: string; error?: string } {
+  const configured = process.env.FORGE_BUN_BIN?.trim();
+  const bun = configured || resolveBunExecutable(process.execPath, process.env);
+  return runProcess(bun, [
+    'build',
+    input.entryPath,
+    '--target=bun',
+    '--outfile',
+    input.outputPath,
+  ], { cwd: input.sourceRoot, timeoutMs: 300_000, maxOutputBytes: 512 * 1024 });
+}
+
 function defaultBundleNodeScript(input: { sourceRoot: string; outputPath: string; entryPath: string }): { ok: boolean; stderr?: string; stdout?: string; error?: string } {
   const configured = process.env.FORGE_BUN_BIN?.trim();
   const bun = configured || resolveBunExecutable(process.execPath, process.env);
@@ -412,8 +449,11 @@ function defaultMaterializeCodeGraphRuntime(input: {
 export function stageRuntimeRelease(input: {
   controllerHome: string;
   sourceRoot: string;
+  sourceRepositoryId?: string;
 }, dependencies: RuntimeReleaseMaterializerDependencies = {}): StagedRuntimeRelease {
   const sourceRoot = resolve(input.sourceRoot);
+  const sourceRepositoryId = input.sourceRepositoryId?.trim();
+  if (input.sourceRepositoryId !== undefined && !sourceRepositoryId) throw new Error('RUNTIME_RELEASE_SOURCE_REPOSITORY_ID_INVALID');
   const sourceCommit = gitText(sourceRoot, ['rev-parse', '--verify', 'HEAD']);
   if (!/^[a-f0-9]{40}$/i.test(sourceCommit)) throw new Error('RUNTIME_RELEASE_SOURCE_COMMIT_INVALID');
   // Immutable release source is the tracked working tree. Untracked files are
@@ -432,11 +472,24 @@ export function stageRuntimeRelease(input: {
   mkdirSync(staging, { recursive: true, mode: 0o700 });
   try {
     const compileBinary = dependencies.compileBinary ?? defaultCompileBinary;
+    const runtimeBundleEntrypoint = 'forge-runtime-bundle.js' as const;
+    const runtimeBundlePath = join(staging, runtimeBundleEntrypoint);
+    const runtimeBundle = (dependencies.bundleRuntime ?? defaultBundleRuntimeScript)({
+      sourceRoot,
+      outputPath: runtimeBundlePath,
+      entryPath: join(sourceRoot, 'src/runtime/root/entry.ts'),
+    });
+    if (!runtimeBundle.ok) {
+      throw new Error(`RUNTIME_RELEASE_BUNDLE_BUILD_FAILED: ${runtimeBundle.stderr || runtimeBundle.stdout || runtimeBundle.error}`.slice(0, 2_000));
+    }
+    chmodSync(runtimeBundlePath, 0o600);
+    const runtimeBundleArtifactIdentity = `sha256:${sha256(runtimeBundlePath)}`;
+
     const executable = join(staging, 'forge-runtime');
     const compile = compileBinary({
       sourceRoot,
       outputPath: executable,
-      entryPath: join(sourceRoot, 'src/runtime/root/entry.ts'),
+      entryPath: join(sourceRoot, 'src/runtime/root/release-loader.ts'),
     });
     if (!compile.ok) {
       throw new Error(`RUNTIME_RELEASE_BUILD_FAILED: ${compile.stderr || compile.stdout || compile.error}`.slice(0, 2_000));
@@ -493,7 +546,12 @@ export function stageRuntimeRelease(input: {
 
     const processRunnerEntrypoint = 'process-runner.js' as const;
     const processRunnerPath = join(staging, processRunnerEntrypoint);
-    const bundleProcessRunner = dependencies.bundleProcessRunner ?? defaultBundleNodeScript;
+    // Process Runner is part of the immutable execution surface and must not
+    // depend on a developer-installed Bun/Node interpreter after staging. Keep
+    // the historical .js manifest entrypoint name for compatibility, but emit
+    // a compiled executable by default. Tests/legacy callers may still inject
+    // bundleProcessRunner through the existing seam.
+    const bundleProcessRunner = dependencies.bundleProcessRunner ?? defaultCompileBinary;
     const processRunnerBundle = bundleProcessRunner({
       sourceRoot,
       outputPath: processRunnerPath,
@@ -518,6 +576,32 @@ export function stageRuntimeRelease(input: {
     chmodSync(checkRunnerPath, 0o700);
     const checkRunnerArtifactIdentity = `sha256:${sha256(checkRunnerPath)}`;
 
+    const schedulerWorkerEntrypoint = 'forge-scheduler-worker' as const;
+    const schedulerWorkerPath = join(staging, schedulerWorkerEntrypoint);
+    const schedulerWorkerCompile = compileBinary({
+      sourceRoot,
+      outputPath: schedulerWorkerPath,
+      entryPath: join(sourceRoot, 'src/runtime/control-plane/global-scheduler/scheduler-worker-entry.ts'),
+    });
+    if (!schedulerWorkerCompile.ok) {
+      throw new Error(`RUNTIME_RELEASE_SCHEDULER_WORKER_BUILD_FAILED: ${schedulerWorkerCompile.stderr || schedulerWorkerCompile.stdout || schedulerWorkerCompile.error}`.slice(0, 2_000));
+    }
+    chmodSync(schedulerWorkerPath, 0o700);
+    const schedulerWorkerArtifactIdentity = `sha256:${sha256(schedulerWorkerPath)}`;
+
+    const periodicCleanupEntrypoint = 'forge-periodic-cleanup' as const;
+    const periodicCleanupPath = join(staging, periodicCleanupEntrypoint);
+    const periodicCleanupCompile = compileBinary({
+      sourceRoot,
+      outputPath: periodicCleanupPath,
+      entryPath: join(sourceRoot, 'src/runtime/control-plane/global-scheduler/periodic-cleanup-entry.ts'),
+    });
+    if (!periodicCleanupCompile.ok) {
+      throw new Error(`RUNTIME_RELEASE_PERIODIC_CLEANUP_BUILD_FAILED: ${periodicCleanupCompile.stderr || periodicCleanupCompile.stdout || periodicCleanupCompile.error}`.slice(0, 2_000));
+    }
+    chmodSync(periodicCleanupPath, 0o700);
+    const periodicCleanupArtifactIdentity = `sha256:${sha256(periodicCleanupPath)}`;
+
     const pluginActionSidecarEntrypoint = 'forge-plugin-action-sidecar' as const;
     const pluginActionSidecarPath = join(staging, pluginActionSidecarEntrypoint);
     const pluginActionSidecarCompile = compileBinary({
@@ -588,6 +672,9 @@ export function stageRuntimeRelease(input: {
       releaseId,
       artifactIdentity,
       entrypoint: 'forge-runtime',
+      executionMode: 'standalone-binary',
+      runtimeBundleEntrypoint,
+      runtimeBundleArtifactIdentity,
       ...(normalizedMacOSCodeSigning ? { macosCodeSigning: normalizedMacOSCodeSigning } : {}),
       diagnosticEntrypoint: 'forge-cli',
       diagnosticArtifactIdentity,
@@ -599,6 +686,10 @@ export function stageRuntimeRelease(input: {
       processRunnerArtifactIdentity,
       checkRunnerEntrypoint,
       checkRunnerArtifactIdentity,
+      schedulerWorkerEntrypoint,
+      schedulerWorkerArtifactIdentity,
+      periodicCleanupEntrypoint,
+      periodicCleanupArtifactIdentity,
       pluginActionSidecarEntrypoint,
       pluginActionSidecarArtifactIdentity,
       externalPluginProbeEntrypoint,
@@ -621,6 +712,7 @@ export function stageRuntimeRelease(input: {
         maximum: CONTROL_PLANE_SCHEMA_VERSION,
       },
       workerProtocolVersion: 1,
+      ...(sourceRepositoryId ? { sourceRepositoryId } : {}),
       sourceCommit,
       releaseRevision: releaseId,
       cleanWorkspace: true,
@@ -635,12 +727,15 @@ export function stageRuntimeRelease(input: {
       manifestPath: join(releasePath, 'manifest.json'),
       releaseId,
       artifactIdentity,
+      runtimeBundleArtifactIdentity,
       ...(normalizedMacOSCodeSigning ? { macosCodeSigning: normalizedMacOSCodeSigning } : {}),
       diagnosticArtifactIdentity,
       browserNodeBridgeArtifactIdentity,
       browserHandoffArtifactIdentity,
       processRunnerArtifactIdentity,
       checkRunnerArtifactIdentity,
+      schedulerWorkerArtifactIdentity,
+      periodicCleanupArtifactIdentity,
       pluginActionSidecarArtifactIdentity,
       externalPluginProbeArtifactIdentity,
       codeGraphNodeArtifactIdentity,
@@ -650,6 +745,7 @@ export function stageRuntimeRelease(input: {
       controllerUiArtifactIdentity,
       manifestSha256: createHash('sha256').update(`${JSON.stringify(manifest, null, 2)}\n`).digest('hex'),
       sourceCommit,
+      ...(sourceRepositoryId ? { sourceRepositoryId } : {}),
     };
   } catch (error) {
     rmSync(staging, { recursive: true, force: true });
@@ -705,6 +801,7 @@ export function assertRuntimeReleaseFiles(release: StagedRuntimeRelease, depende
   assertRegularFile(runtimePath, 'RUNTIME_RELEASE_ENTRYPOINT_MISSING');
   assertExecutable(runtimePath);
   assertFileIdentity(runtimePath, release.artifactIdentity);
+  assertComponentFile({ path: join(release.releasePath, 'forge-runtime-bundle.js'), identity: release.runtimeBundleArtifactIdentity, missingCode: 'RUNTIME_RELEASE_BUNDLE_MISSING' });
   const platform = dependencies.platform ?? process.platform;
   if (platform === 'darwin' && release.macosCodeSigning) {
     const actual = (dependencies.inspectMacOSRuntime ?? inspectMacOSRuntimeCodeSigning)(runtimePath);
@@ -720,6 +817,8 @@ export function assertRuntimeReleaseFiles(release: StagedRuntimeRelease, depende
   assertComponentFile({ path: join(release.releasePath, 'browser-handoff-host.js'), identity: release.browserHandoffArtifactIdentity, missingCode: 'RUNTIME_RELEASE_BROWSER_HANDOFF_HOST_MISSING', executable: true });
   assertComponentFile({ path: join(release.releasePath, 'process-runner.js'), identity: release.processRunnerArtifactIdentity, missingCode: 'RUNTIME_RELEASE_PROCESS_RUNNER_MISSING', executable: true });
   assertComponentFile({ path: join(release.releasePath, 'forge-check-runner'), identity: release.checkRunnerArtifactIdentity, missingCode: 'RUNTIME_RELEASE_CHECK_RUNNER_MISSING', executable: true });
+  assertComponentFile({ path: join(release.releasePath, 'forge-scheduler-worker'), identity: release.schedulerWorkerArtifactIdentity, missingCode: 'RUNTIME_RELEASE_SCHEDULER_WORKER_MISSING', executable: true });
+  assertComponentFile({ path: join(release.releasePath, 'forge-periodic-cleanup'), identity: release.periodicCleanupArtifactIdentity, missingCode: 'RUNTIME_RELEASE_PERIODIC_CLEANUP_MISSING', executable: true });
   assertComponentFile({ path: join(release.releasePath, 'forge-plugin-action-sidecar'), identity: release.pluginActionSidecarArtifactIdentity, missingCode: 'RUNTIME_RELEASE_PLUGIN_ACTION_SIDECAR_MISSING', executable: true });
   assertComponentFile({ path: join(release.releasePath, 'external-unix-socket-probe.cjs'), identity: release.externalPluginProbeArtifactIdentity, missingCode: 'RUNTIME_RELEASE_EXTERNAL_PLUGIN_PROBE_MISSING', executable: true });
   assertComponentFile({ path: join(release.releasePath, 'codegraph-node'), identity: release.codeGraphNodeArtifactIdentity, missingCode: 'RUNTIME_RELEASE_CODEGRAPH_NODE_MISSING', executable: true });

package/src/runtime/root/release-store.ts

@@ -1,14 +1,16 @@
 import { createHash, randomUUID } from 'crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { ensureControllerHome } from '../../cli/repositories/controller-home';
 import {
   backupControlPlaneDatabase,
+  controlPlaneDatabasePath,
   restoreControlPlaneDatabase,
   type ControlPlaneDatabaseInspection,
 } from '../control-plane/persistence/sqlite-store';
 import { loadRuntimeReleaseManifest } from './release-manifest';
 import type { RuntimeReleaseManifest } from './types';
+import { assertStorageHeadroom } from '../shared/storage-capacity';
 
 /**
  * Local Controller Home recovery evidence. This database contains execution
@@ -52,6 +54,21 @@ const DEFAULT_DEPENDENCIES: RuntimeReleaseStoreDependencies = {
   restoreDatabase: restoreControlPlaneDatabase,
 };
 
+const RUNTIME_RELEASE_STATE_RESERVE_BYTES = 64 * 1024 * 1024;
+
+function fileSize(path: string): number {
+  try { return existsSync(path) ? statSync(path).size : 0; } catch { return 0; }
+}
+
+function assertDatabaseBackupHeadroom(controllerHome: string, operation: string, extraBytes = 0): void {
+  const databaseBytes = fileSize(controlPlaneDatabasePath(controllerHome));
+  assertStorageHeadroom(controllerHome, {
+    operation,
+    requiredBytes: databaseBytes + Math.max(0, extraBytes),
+    reserveBytes: RUNTIME_RELEASE_STATE_RESERVE_BYTES,
+  });
+}
+
 export function runtimeReleaseAuthorityPath(controllerHome: string): string {
   return join(ensureControllerHome(controllerHome), 'runtime', 'releases', 'authority.json');
 }
@@ -63,9 +80,15 @@ function backupPath(controllerHome: string, releaseId: string, operationId: stri
 }
 
 function atomicWrite(path: string, value: unknown): void {
+  const content = `${JSON.stringify(value, null, 2)}\n`;
+  assertStorageHeadroom(path, {
+    operation: 'runtime_release_authority_write',
+    requiredBytes: Buffer.byteLength(content),
+    reserveBytes: RUNTIME_RELEASE_STATE_RESERVE_BYTES,
+  });
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
   const temporary = `${path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  writeFileSync(temporary, content, { encoding: 'utf8', mode: 0o600 });
   renameSync(temporary, path);
 }
 
@@ -200,6 +223,7 @@ export function publishRuntimeRelease(
     });
   }
   if (sameRelease(current.active, candidate)) return current;
+  assertDatabaseBackupHeadroom(controllerHome, 'publish_runtime_release_database_backup');
   const backup = backupPath(controllerHome, current.active.releaseId, operationId);
   const inspection = dependencies.backupDatabase(controllerHome, backup);
   const committedAt = new Date().toISOString();
@@ -236,6 +260,11 @@ export function rollbackRuntimeRelease(
   const current = mutableRuntimeReleaseAuthority(controllerHome);
   const target = current?.previous;
   if (!current || !target?.databaseBackup) throw new Error('RUNTIME_PREVIOUS_RELEASE_UNAVAILABLE');
+  assertDatabaseBackupHeadroom(
+    controllerHome,
+    'rollback_runtime_release_database_transition',
+    fileSize(target.databaseBackup.path),
+  );
   const currentBackup = backupPath(controllerHome, current.active.releaseId, operationId);
   const currentInspection = dependencies.backupDatabase(controllerHome, currentBackup);
   dependencies.restoreDatabase(controllerHome, target.databaseBackup.path);