A full update filesystem can reject the image copy before any image bytes land. Extend the existing actual Linux tmpfs campaign with independent 1 MiB and zero-byte cases. Both retain the signed source image, previous known-good image, accepted root/targets/release floors and unresolved selected slot; explicit fresh-process recovery, abandonment and a new healthy trial remain mandatory.
The private fixture marker and worker input bind the selected budget. Filesystem readback proves the actual free bytes before and after copying. Retained archives include the empty image file and its SHA-256 for the zero-byte case. The existing CI namespace job executes both cases and retains both campaigns separately.
Validation before draft:
- Minimum Bun 1.4.2 fixture-capability absence RED: the new budget argument/result were unavailable. This is feature absence, not a production regression.
- Pickier, application/runtime/test types, roadmap and parity pass.
- Both privileged integration cases correctly skip on this Mac. They supply no positive Linux qualification here.
- Docs build and rendered link/asset/fragment audit pass.
- The initial Linux run at
63f21d3failed an incorrect fixture expectation: an existing empty image correctly reportsunavailable, whereas the fixture expectedmismatch. Both independent reviewers identified it. Original job log and archive are retained; no production change was needed. - Corrected head
02dcbc0: both actual Linux zero/partial cases passed. Independent archive readback verified 124 file hashes, actual ENOSPC plus two SQLITE_FULL errors per case, exact 0-byte/1 MiB failed files, unchanged old known-good bytes and security floors, explicit recovery/abandonment, and different actual boot/session health for the fresh trial. - Independent final Spec and Standards reviews found no actionable defects. All five exact-head jobs pass in CI 39802940081. Published to origin/main at
02dcbc082dd70183362983d4cbebc97eee9f8535by normal fast-forward as Chris without coauthors. Broad runtime-update acceptance remains open in issue #42.
This qualifies ENOSPC before any image bytes are written. It does not claim a write syscall returning zero without an error, persistent-media durability, EDQUOT, EIO, sync failure or physical power-loss behavior. No production implementation or dependency changes. Physical deployment remains disabled and the broader issues remain open.