feat(exemplar): disk budget arithmetic inside 8 GiB

Implements the frozen #201 contract.

Q1 - 8 GiB budget table documented in CLAUDE.md (4.5 GiB main relational
tier, 1.5 GiB aggregate.db, 0.5 GiB DLQ, 0.5 GiB WAL/temp, 1 GiB mandatory
headroom) with per-component measured high-water gauges.

Q2 - EXEMPLAR_BYTES_GLOBAL_WINDOW default 8 MiB -> 3 MiB. New
EXEMPLAR_RETENTION_DAYS=2 drives a separate transactional purge of exemplar
traces, spans, logs, their FTS rows and expired weak references, running
ahead of the HOT_RETENTION_DAYS purge on the same hourly tick. Aggregate
retention stays 7 days.

Q3 - synthesized logs are metered: every one reserves
len(body)+len(attributesJSON)+logRowFixedBytes against the selected trace's
per-trace budget and the shared per-service/global window budgets, under
EXEMPLAR_SYNTH_LOGS_PER_SPAN=8 and EXEMPLAR_SYNTH_LOGS_PER_TRACE=64.
Refusals drop the log, count synth_per_span|synth_per_trace|budget_bytes,
and stamp the trace truncated.

Q4 - reservation lifecycle replaces immediate charging: reserve before row
construction, commit when the primary queue or DLQ accepts the batch,
release only when the row never reached a destination. Reserved bytes bind
the cap. Bytes accepted downstream are never refunded on selection
eviction; count slots still are.

Q5 - disk watchdog with staged shedding and hysteresis. statfs on
DATA_DISK_PATH is the enforcement source, ceiling = min(DATA_DISK_BUDGET_MB,
usable volume capacity). >=90% admits only error exemplars; >=95% disables
all raw admission and the exemplar DLQ fallback, purges the expired
exemplar tier, checkpoints the WAL and fails readiness. Recovery needs
<90% and <85% respectively. Raw shedding never fails a successful Export;
an authoritative aggregate commit hitting ENOSPC/SQLITE_FULL does, with
RESOURCE_EXHAUSTED.

Author: aksOps

CLAUDE.md

@@ -369,6 +369,10 @@ Key settings in `internal/config/config.go`:
 - `OTEL_EXPORTER_OTLP_ENDPOINT` — enables self-instrumentation (empty = off)
 - `DEFAULT_TENANT` (`default`) — assigned to rows ingested without explicit tenant
 - `HOT_RETENTION_DAYS` (7) — drives `RetentionScheduler`; range 1..36500
+- `EXEMPLAR_RETENTION_DAYS` (2) — separate, shorter retention for the raw exemplar tier in aggregate mode; validated 1..`HOT_RETENTION_DAYS`. See the Data Disk Budget section
+- `EXEMPLAR_BYTES_GLOBAL_WINDOW` (**3 MiB**, was 8 MiB) / `EXEMPLAR_BYTES_PER_SERVICE_WINDOW` (512 KiB) — instance-wide and per-service byte budget per 5-minute window
+- `EXEMPLAR_SYNTH_LOGS_PER_SPAN` (8), `EXEMPLAR_SYNTH_LOGS_PER_TRACE` (64) — count caps on logs synthesized from span events and span status
+- `DATA_DISK_BUDGET_MB` (8192), `DATA_DISK_PATH` (`./data`) — disk watchdog ceiling and the volume it `statfs`-es
 - `SAMPLING_RATE` (1.0), `SAMPLING_ALWAYS_ON_ERRORS` (true), `SAMPLING_LATENCY_THRESHOLD_MS` (500)
 - `METRIC_MAX_CARDINALITY` (10000), `METRIC_MAX_CARDINALITY_PER_TENANT` (0 = unlimited), `API_RATE_LIMIT_RPS` (100). The per-tenant cap is checked first; when set, a noisy tenant cannot exhaust the global pool. Overflow is labeled by tenant via `otelcontext_tsdb_cardinality_overflow_by_tenant_total{tenant_id}` (`__global__` sentinel when the global cap was the trigger).
 - `MCP_ENABLED` (true), `MCP_PATH` (/mcp)
@@ -449,6 +453,97 @@ Failure-mode gauges (prefix `OtelContext_`):
 - `retention_last_success_timestamp` — Unix seconds; alert when stale relative to the hourly tick
 - `retention_rows_purged_total`, `retention_purge_duration_seconds`, `retention_vacuum_duration_seconds` — throughput and latency
 
+### Data Disk Budget — 8 GiB (#201)
+
+The platform targets a single 8 GiB data volume. The budget is a promise about
+that volume, not about a table, so **enforcement reads `statfs` on
+`DATA_DISK_PATH`** — the only figure that also counts WAL frames, SQLite temp
+files, free pages the file has not handed back, and anything else sharing the
+volume. Per-component file sizes are attribution, never enforcement: a budget
+enforced against summed file sizes reports 60% while `write()` returns ENOSPC.
+
+| Tier | Allocation | Covers |
+|---|---|---|
+| Main relational tier | **4.5 GiB** | Raw trace/span/log exemplars, synthesized logs, investigations and other main-DB metadata, indexes, FTS5, database free pages |
+| `aggregate.db` | **1.5 GiB** | Aggregate buckets, delta log, baselines, identity tables, and their indexes |
+| DLQ | **0.5 GiB** | Existing `DLQ_MAX_DISK_MB` cap |
+| WAL/SHM + temp | **0.5 GiB** | `-wal`/`-shm` sidecars of both databases, SQLite temp files, TLS material, transient maintenance overhead |
+| Headroom | **1 GiB** | Mandatory and unused |
+
+**Unused allocation in one tier does not authorize another tier to consume the
+final 1 GiB.** The seven-day gate (#202) validates these numbers against
+measured high-water marks; it does not quietly reallocate them after a failure.
+
+Gauges: `otelcontext_disk_budget_bytes` (the effective ceiling — min of
+`DATA_DISK_BUDGET_MB` and the usable volume capacity),
+`otelcontext_disk_used_bytes`, `otelcontext_disk_used_ratio`,
+`otelcontext_disk_component_bytes{component}` and
+`otelcontext_disk_component_high_water_bytes{component}` for
+`main_db|aggregate_db|dlq|wal`, `otelcontext_disk_shedding_state`,
+`otelcontext_disk_shedding_transitions_total{from,to}`.
+
+#### Exemplar-tier retention
+
+`EXEMPLAR_RETENTION_DAYS=2` runs a **separate transactional purge** of exemplar
+traces, spans, logs, their FTS rows and expired weak references (spans whose
+trace row is gone), ahead of the `HOT_RETENTION_DAYS` purge on the same hourly
+tick. Trace and span deletes share one transaction per batch, so a reader never
+sees spans whose trace row has already gone. `logs_fts` is content-linked and
+trigger-synced, so index entries die with their rows. Aggregate retention stays
+seven days. Wired only in `AGGREGATE_MODE=aggregate`: in legacy and shadow the
+raw rows ARE the dataset and a two-day purge would be data loss.
+
+Arithmetic behind the 3 MiB default: two days = 576 five-minute windows;
+576 × 3 MiB = 1.69 GiB of charged payload; at the provisional 2× DB/index/FTS
+amplification ≈ 3.38 GiB, leaving ≈ 1.12 GiB of margin inside the 4.5 GiB main
+tier. 4 MiB/window consumes the whole tier under the same optimistic assumption
+— it stays configurable, it is not the default until #202 proves it fits.
+Throughput: `otelcontext_exemplar_rows_purged_total{table}`,
+`otelcontext_exemplar_purge_duration_seconds`.
+
+#### Synthesized-log metering
+
+Every log synthesized from a span event or span status reserves
+`len(body) + len(attributesJSON) + logRowFixedBytes` against its trace's
+per-trace budget AND the shared per-service/global window budgets, under
+`EXEMPLAR_SYNTH_LOGS_PER_SPAN` and `EXEMPLAR_SYNTH_LOGS_PER_TRACE`. They do
+**not** consume the ordinary log-exemplar quota — that budget is for logs a
+client actually sent — but they are not weightless either: a span carrying two
+hundred exception events used to write two hundred rows no budget had ever
+seen. Refusals drop the log, count
+`otelcontext_exemplar_dropped_total{signal="logs",reason}` with
+`synth_per_span|synth_per_trace|budget_bytes`, and stamp the trace `truncated`.
+
+#### Reservation lifecycle (no unconditional refunds)
+
+Bytes are **reserved** before a row is constructed, **committed** when the
+primary queue or the DLQ accepts the batch, and **released** only when the row
+is dropped before submission or permanently lost because both destinations
+refused it. Reserved bytes bind the cap exactly like committed ones. Once a
+submission is accepted the charge is **monotonic for that window**: displacing
+the trace later releases the count slot (a slot is a seat, not a byte) and
+never the bytes — refunding bytes already on disk is how a window writes past
+its cap. `Batch.Reservation` carries the charge to the submit boundary.
+
+#### Staged shedding, hysteresis, and the one ENOSPC exception
+
+| Volume usage | State | Behaviour |
+|---|---|---|
+| ≥ 90% | `errors_only` | Only error trace/log exemplars are admitted; healthy/slow/WARN raw retention off |
+| ≥ 95% | `raw_off` | ALL new raw exemplar admission off, exemplar DLQ fallback closed, immediate expired-exemplar purge + `wal_checkpoint(TRUNCATE)`, `/ready` → 503 |
+
+Hysteresis: recover from `raw_off` only below 90%, from `errors_only` only
+below 85%. A failed `statfs` HOLDS the current state — shedding because a
+syscall failed would be an outage caused by the safety mechanism.
+
+Raw shedding **never** turns a successful aggregate Export into a retryable
+failure. One exception: if the **authoritative** aggregate commit fails with
+`ENOSPC` or `SQLITE_FULL` (`aggregate.IsDiskFull`), the Export MUST fail with
+`RESOURCE_EXHAUSTED`/429 — under the durable-ACK contract a success response
+asserts the deltas are committed, and acknowledging data that was not stored is
+data loss with better branding. Shadow mode is unaffected: there the legacy raw
+path is still the source of truth.
+
 ## Security & Supply Chain
 
 OtelContext targets the OpenSSF Best Practices `passing` badge (project [12646](https://www.bestpractices.dev/en/projects/12646)) and ships a six-job OSS-CLI security stack, supplemented by **SonarCloud SAST as a required gate** (board reversal 2026-04-28). No CodeQL, no NVD-direct tooling. Cost: $0 for the OSS-CLI tier; SonarCloud is free for public repos.

internal/aggregate/diskfull.go

@@ -0,0 +1,60 @@
+package aggregate
+
+import (
+	"errors"
+	"io/fs"
+	"strings"
+	"syscall"
+)
+
+// Disk-exhaustion classification for the authoritative commit path (#201 Q5).
+//
+// Raw exemplar shedding is explicitly forbidden from turning a successful
+// aggregate Export into a retryable failure — the aggregate numbers are the
+// dataset, the exemplars are diagnostics, and refusing telemetry because a
+// diagnostic could not be stored is the wrong trade in every direction.
+//
+// There is exactly one exception, and it is not really about shedding: if the
+// AUTHORITATIVE aggregate commit itself fails because the device is out of
+// space, the Export must fail. Under the durable-ACK contract (#160) a success
+// response asserts the deltas are in a committed transaction. Answering OK for
+// data that hit ENOSPC is data loss with better branding, and the client's
+// retry is the only thing that can still save it.
+//
+// Detection is by error inspection rather than by asking the filesystem,
+// because the only reading that matters is the one the write actually got.
+
+// sqliteFullMessages are the message fragments SQLITE_FULL (13) and its ENOSPC
+// cousins surface through the pure-Go driver, which does not export a typed
+// error the way mattn/go-sqlite3 does. Matched case-insensitively.
+var sqliteFullMessages = []string{
+	"database or disk is full", // SQLITE_FULL
+	"no space left on device",  // ENOSPC surfaced as text
+	"disk is full",
+}
+
+// IsDiskFull reports whether err is a device-out-of-space failure.
+//
+// It checks the typed errno first (errors.Is unwraps *fs.PathError and any
+// wrapping the storage layer added) and falls back to the driver's message
+// text, which is the only channel the pure-Go SQLite driver offers for
+// SQLITE_FULL.
+func IsDiskFull(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, syscall.ENOSPC) || errors.Is(err, syscall.EDQUOT) {
+		return true
+	}
+	var pathErr *fs.PathError
+	if errors.As(err, &pathErr) && errors.Is(pathErr.Err, syscall.ENOSPC) {
+		return true
+	}
+	msg := strings.ToLower(err.Error())
+	for _, frag := range sqliteFullMessages {
+		if strings.Contains(msg, frag) {
+			return true
+		}
+	}
+	return false
+}

internal/aggregate/diskfull_test.go

@@ -0,0 +1,42 @@
+package aggregate
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"syscall"
+	"testing"
+)
+
+// The classifier decides whether a failed authoritative commit is a disk-full
+// failure, which is the one condition that MUST fail an Export (#201 Q5). A
+// false negative acknowledges data that was never stored.
+func TestIsDiskFull(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"unrelated", errors.New("constraint violation"), false},
+		{"bare ENOSPC", syscall.ENOSPC, true},
+		{"wrapped ENOSPC", fmt.Errorf("commit deltas: %w", syscall.ENOSPC), true},
+		{"path error", &fs.PathError{Op: "write", Path: "/data/aggregate.db", Err: syscall.ENOSPC}, true},
+		{"wrapped path error", fmt.Errorf("group commit: %w", &fs.PathError{Op: "write", Path: "/data/aggregate.db", Err: syscall.ENOSPC}), true},
+		{"quota exceeded", fmt.Errorf("write wal: %w", syscall.EDQUOT), true},
+		{"SQLITE_FULL text", errors.New("database or disk is full (13)"), true},
+		{"ENOSPC text", errors.New("write /data/aggregate.db-wal: no space left on device"), true},
+		{"mixed case", errors.New("SQL logic error: Database Or Disk Is Full"), true},
+		// Adjacent failures that are NOT disk-full: misclassifying them would
+		// turn an ordinary commit error into a different gRPC code.
+		{"disk io error", errors.New("disk I/O error"), false},
+		{"readonly", errors.New("attempt to write a readonly database"), false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsDiskFull(tc.err); got != tc.want {
+				t.Fatalf("IsDiskFull(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}

internal/api/health_disk_test.go

@@ -0,0 +1,46 @@
+package api
+
+import (
+	"net/http"
+	"testing"
+)
+
+// Readiness reflects disk pressure (#201 Q5). At raw-off the process still
+// serves reads and still accounts aggregates, but it can no longer retain the
+// diagnostics anyone comes here for; an orchestrator should stop aiming fresh
+// ingest at it. Errors-only is degraded coverage, not an unready process.
+//
+// readyChecks is shared with health_aggregate_test.go.
+func TestReadyReflectsDiskPressure(t *testing.T) {
+	s := newTestServer(t)
+
+	code, checks := readyChecks(t, s)
+	if checks["disk"] != "skipped" {
+		t.Fatalf("disk check = %q without a watchdog, want skipped", checks["disk"])
+	}
+	if code != http.StatusOK {
+		t.Fatalf("/ready = %d with no watchdog, want 200", code)
+	}
+
+	state, healthy := "none", true
+	s.SetDiskPressureProbe(func() (string, bool) { return state, healthy })
+
+	for _, tc := range []struct {
+		state   string
+		healthy bool
+		want    int
+	}{
+		{"none", true, http.StatusOK},
+		{"errors_only", true, http.StatusOK},
+		{"raw_off", false, http.StatusServiceUnavailable},
+	} {
+		state, healthy = tc.state, tc.healthy
+		code, checks = readyChecks(t, s)
+		if code != tc.want {
+			t.Errorf("/ready = %d at disk state %q, want %d", code, tc.state, tc.want)
+		}
+		if checks["disk"] != tc.state {
+			t.Errorf("disk check = %q, want %q", checks["disk"], tc.state)
+		}
+	}
+}

internal/api/health_handlers.go

@@ -100,6 +100,19 @@ func (s *Server) handleReady(w http.ResponseWriter, r *http.Request) {
 		checks["aggregate_store"] = "ok"
 	}
 
+	// Disk pressure. At >=95% of the enforcement ceiling the raw exemplar
+	// path is off entirely; readiness says so rather than letting an
+	// orchestrator keep aiming ingest at a nearly full volume.
+	if s.diskPressure == nil {
+		checks["disk"] = "skipped"
+	} else {
+		state, ok := s.diskPressure()
+		checks["disk"] = state
+		if !ok {
+			ready = false
+		}
+	}
+
 	status := http.StatusOK
 	if !ready {
 		status = http.StatusServiceUnavailable

internal/api/server.go

@@ -43,6 +43,14 @@ type Server struct {
 	// no orchestrator routes traffic to a process whose shards are only
 	// half-replayed (#173). nil means "no store configured" and is skipped.
 	aggregateRecovered func() bool
+
+	// diskPressure reports the disk watchdog's state (#201 Q5): a label for
+	// the readiness breakdown and whether the process should still be
+	// considered ready. At raw-off it is not — the platform still serves
+	// reads and still accounts aggregates, but it can no longer retain the
+	// diagnostics anyone comes here for, and an orchestrator should stop
+	// routing fresh ingest at it. nil means "no watchdog" and is skipped.
+	diskPressure func() (string, bool)
 }
 
 // NewServer creates a new API server.
@@ -102,6 +110,13 @@ func (s *Server) SetAggregateRecoveryProbe(fn func() bool) {
 	s.aggregateRecovered = fn
 }
 
+// SetDiskPressureProbe registers a callback returning the disk watchdog's
+// state label and whether readiness should pass. Pass nil (the default) when
+// no watchdog is configured.
+func (s *Server) SetDiskPressureProbe(fn func() (string, bool)) {
+	s.diskPressure = fn
+}
+
 // RegisterRoutes registers API endpoints on the provided mux.
 func (s *Server) RegisterRoutes(mux *http.ServeMux) {
 	// Metadata & Discovery

internal/config/config.go

@@ -432,6 +432,30 @@ type Config struct {
 	ExemplarLogsWarnPerServiceWindow  int     // Default 20
 	ExemplarMaxSpansPerTrace          int     // Default 500
 	ExemplarMaxBytesPerTrace          int     // Default 262144 (256 KiB)
+
+	// Exemplar-tier retention and synthesized-log metering (#201 Q2/Q3).
+	//
+	// ExemplarRetentionDays is SHORTER than HotRetentionDays on purpose: in
+	// aggregate mode the raw rows are exemplars attached to a seven-day
+	// aggregate dataset, and 576 five-minute windows (two days) at the 3 MiB
+	// global window budget is 1.69 GiB of charged payload — 3.38 GiB at the
+	// provisional 2x DB/index/FTS amplification, inside the 4.5 GiB main tier
+	// with ~1.12 GiB of margin. Seven days of the same rate does not fit.
+	ExemplarRetentionDays    int // Default 2, validated 1..HotRetentionDays
+	ExemplarSynthLogsPerSpan int // Default 8
+	// ExemplarSynthLogsPerTrace bounds the synthesized logs one retained trace
+	// may carry across all its spans.
+	ExemplarSynthLogsPerTrace int // Default 64
+
+	// Data-volume budget and disk watchdog (#201 Q1/Q5).
+	//
+	// DataDiskBudgetMB is the configured ceiling for everything this process
+	// writes: main relational tier, aggregate.db, DLQ, WAL/temp, and the
+	// mandatory unused headroom. Enforcement uses the LOWER of this and the
+	// usable volume capacity — a 4 GiB PVC does not become 8 GiB because the
+	// config says so.
+	DataDiskBudgetMB int    // Default 8192 (8 GiB)
+	DataDiskPath     string // Default ./data — any path on the data volume
 }
 
 func Load(customPath string) (*Config, error) {
@@ -608,17 +632,27 @@ func Load(customPath string) (*Config, error) {
 		AggregateMaxDimTuplesPerTenant: getEnvInt("AGGREGATE_MAX_DIM_TUPLES_PER_TENANT", 5000),
 		AggregateMaxDimTuples:          getEnvInt("AGGREGATE_MAX_DIM_TUPLES", 50000),
 		// Bounded exemplar retention (aggregate mode only)
-		ExemplarTracesPerServiceWindow:    getEnvInt("EXEMPLAR_TRACES_PER_SERVICE_WINDOW", 25),
-		ExemplarTracesGlobalWindow:        getEnvInt("EXEMPLAR_TRACES_GLOBAL_WINDOW", 1500),
-		ExemplarBytesPerServiceWindow:     getEnvInt("EXEMPLAR_BYTES_PER_SERVICE_WINDOW", 512*1024),
-		ExemplarBytesGlobalWindow:         getEnvInt("EXEMPLAR_BYTES_GLOBAL_WINDOW", 8*1024*1024),
+		ExemplarTracesPerServiceWindow: getEnvInt("EXEMPLAR_TRACES_PER_SERVICE_WINDOW", 25),
+		ExemplarTracesGlobalWindow:     getEnvInt("EXEMPLAR_TRACES_GLOBAL_WINDOW", 1500),
+		ExemplarBytesPerServiceWindow:  getEnvInt("EXEMPLAR_BYTES_PER_SERVICE_WINDOW", 512*1024),
+		// 3 MiB, not 4 (#201 Q2). 4 MiB/window consumes the entire 4.5 GiB
+		// main tier under the optimistic 2x amplification assumption and
+		// leaves no operational margin; it stays configurable, it is not the
+		// default until the seven-day gate (#202) proves it fits.
+		ExemplarBytesGlobalWindow:         getEnvInt("EXEMPLAR_BYTES_GLOBAL_WINDOW", 3*1024*1024),
 		ExemplarHealthyRate:               getEnvFloat("EXEMPLAR_HEALTHY_RATE", 0.005),
 		ExemplarStratumTopK:               getEnvInt("EXEMPLAR_STRATUM_TOP_K", 5),
 		ExemplarLogsErrorPerServiceWindow: getEnvInt("EXEMPLAR_LOGS_ERROR_PER_SERVICE_WINDOW", 50),
 		ExemplarLogsWarnEnabled:           getEnvBool("EXEMPLAR_LOGS_WARN_ENABLED", false),
 		ExemplarLogsWarnPerServiceWindow:  getEnvInt("EXEMPLAR_LOGS_WARN_PER_SERVICE_WINDOW", 20),
 		ExemplarMaxSpansPerTrace:          getEnvInt("EXEMPLAR_MAX_SPANS_PER_TRACE", 500),
 		ExemplarMaxBytesPerTrace:          getEnvInt("EXEMPLAR_MAX_BYTES_PER_TRACE", 256*1024),
+		ExemplarRetentionDays:             getEnvInt("EXEMPLAR_RETENTION_DAYS", 2),
+		ExemplarSynthLogsPerSpan:          getEnvInt("EXEMPLAR_SYNTH_LOGS_PER_SPAN", 8),
+		ExemplarSynthLogsPerTrace:         getEnvInt("EXEMPLAR_SYNTH_LOGS_PER_TRACE", 64),
+		// 8 GiB data budget (#201 Q1).
+		DataDiskBudgetMB: getEnvInt("DATA_DISK_BUDGET_MB", 8192),
+		DataDiskPath:     getEnv("DATA_DISK_PATH", "./data"),
 	}
 
 	// Parse AGGREGATE_METRIC_DIMS config
@@ -1049,6 +1083,21 @@ func (c *Config) Validate() error {
 	if c.ExemplarMaxBytesPerTrace < 1024 {
 		return fmt.Errorf("EXEMPLAR_MAX_BYTES_PER_TRACE must be >= 1024, got %d", c.ExemplarMaxBytesPerTrace)
 	}
+	if c.ExemplarRetentionDays < 1 || c.ExemplarRetentionDays > c.HotRetentionDays {
+		return fmt.Errorf("EXEMPLAR_RETENTION_DAYS must be between 1 and HOT_RETENTION_DAYS (%d), got %d: the exemplar tier is a shorter-lived subset of hot retention, never a longer-lived one", c.HotRetentionDays, c.ExemplarRetentionDays)
+	}
+	if c.ExemplarSynthLogsPerSpan < 1 {
+		return fmt.Errorf("EXEMPLAR_SYNTH_LOGS_PER_SPAN must be >= 1, got %d", c.ExemplarSynthLogsPerSpan)
+	}
+	if c.ExemplarSynthLogsPerTrace < c.ExemplarSynthLogsPerSpan {
+		return fmt.Errorf("EXEMPLAR_SYNTH_LOGS_PER_TRACE (%d) must be >= EXEMPLAR_SYNTH_LOGS_PER_SPAN (%d): a per-trace cap below the per-span cap makes the per-span cap unreachable", c.ExemplarSynthLogsPerTrace, c.ExemplarSynthLogsPerSpan)
+	}
+	if c.DataDiskBudgetMB < 64 {
+		return fmt.Errorf("DATA_DISK_BUDGET_MB must be >= 64, got %d", c.DataDiskBudgetMB)
+	}
+	if strings.TrimSpace(c.DataDiskPath) == "" {
+		return fmt.Errorf("DATA_DISK_PATH must not be empty")
+	}
 
 	// Sum-of-caps validation: sub-caps must fit under global cap
 	sumSubCaps := c.AggregateMaxSeriesMetrics + c.AggregateMaxSeriesTraces + c.AggregateMaxSeriesEdges + c.AggregateMaxSeriesLogs + c.AggregateMaxSeriesSystem