Release v0.84.1 — v0.84.0 publication recovery (2026-06-10)

Pure release-tooling patch. The product is identical to v0.84.0 — see release-v0.84.0.md for the full “operator truth” audit remediation content, including the two BREAKING changes and their upgrade paths. This release exists because v0.84.0’s pipeline failed before publishing any artifact.

What happened to v0.84.0

The release pipeline failed twice — the initial run and a --failed job re-run on a fresh runner — with no space left on device in the docker job’s SBOM steps (run 27254938683: first the worker-image SBOM, then on re-run the API-image SBOM, failing even earlier). The job builds three Chromium-bearing images (~700 MB each) with mode=max local buildx cache staging, keeps all three in the daemon, and then syft tar-stages each image to /tmp for scanning. The workflow was byte-identical to v0.83.0’s green run three days earlier — a GitHub runner-image rollout shrank the free-disk margin underneath it, turning a marginal fit into a deterministic failure.

The CI gate, Windows installer, and eval-bundle jobs all passed; the three images were built and pushed by digest before the failure, but the scan / public-pull-verification / release / mirror jobs (all downstream of docker) never ran, so no release, mirror entry, or latest alias was published for v0.84.0. Tags are immutable here — the v0.84.0 tag is preserved at afd599f as unpublished, matching the v0.78.2/v0.78.3 precedent.

The fix (release.yml docker job)

1. Free runner disk space (job start): purge the preinstalled toolchains this job never uses — dotnet, Android, ghc/ghcup, CodeQL, boost, JVM, PowerShell — reclaiming ~25–30 GB.
2. Prune local build cache before SBOM generation: after the three pushes, the gha cache export is already uploaded; dropping the local buildx copy frees the headroom syft’s tar staging needs. Daemon images are deliberately kept so the SBOM steps don’t re-pull.
3. Both steps print df -h so the disk margin is visible in every future run instead of being discovered at failure time.

Validation

• Product content: identical to v0.84.0 (git diff v0.84.0..v0.84.1 is the version bump, this note, the CHANGELOG entry, and the release.yml disk steps only).
• v0.84.0’s own validation evidence (test counts, restore rehearsal, cross-tenant suite, website link verification) applies unchanged — see release-v0.84.0.md § Validation.
• CI-verified: the push-gated full matrix ran green on the v0.84.1 release SHA before tagging (release.yml’s check-ci gate enforces this).
• The fix itself is validated by this release’s green docker job — the first df -h outputs in the run log show the reclaimed margin.