@@ -2,6 +2,7 @@ import type { CleanupJobPayload } from '@/lib/billing/cleanup-dispatcher'
 import {
   DEFAULT_DELETE_CHUNK_SIZE,
   DEFAULT_MAX_BATCHES_PER_TABLE,
+  type RowBudget,
 } from '@/lib/cleanup/batch-delete'
 import { isolateOwnerFailure } from '@/lib/file-retention/failure'
 import { prepareLegacyFileArchiveCleanup } from '@/lib/file-retention/legacy-archive'
@@ -43,13 +44,14 @@ const OWNER_ADAPTERS: FileOwnerAdapters<RetentionAdapter> = {
   },
   project: {
     async versions(ids, { budgets, label }, limit) {
-      let deleted = 0
+      const budget: RowBudget = { remaining: limit }
       for (const id of ids) {
-        if (deleted >= limit) break
-        deleted += await isolateOwnerFailure(Boolean(budgets), { label, projectId: id }, () =>
-          cleanupProjectFileVersions(id, limit - deleted)
+        if (budget.remaining <= 0) break
+        await isolateOwnerFailure(Boolean(budgets), { label, projectId: id }, () =>
+          cleanupProjectFileVersions(id, budget)
         )
       }
+      const deleted = limit - budget.remaining
       return { deleted, attempted: deleted }
     },
     async archive(ids, { budgets, label }) {
 
@@ -23,6 +23,7 @@ import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/featur
 import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
+import { compareStrings } from '@sim/utils/string'
 import { and, eq, inArray, sql } from 'drizzle-orm'
 import postgres from 'postgres'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -35,6 +36,7 @@ import { type CleanupJobPayload, runCleanupWithLimits } from '@/lib/billing/clea
 import { changeWorkspaceStoragePayerInTx } from '@/lib/billing/storage/payer-transfer'
 import { createCleanupBudgets } from '@/lib/cleanup/limits'
 import { beginFileArchiveCleanup, cleanupFileVersions } from '@/lib/file-retention'
+import { FILES_PER_QUERY } from '@/lib/file-retention/versions'
 import { authorizeProject } from '@/lib/projects/application/authorization'
 import { projectOperations } from '@/lib/projects/application/operations'
 import { lockWorkspaceProject } from '@/lib/projects/membership'
@@ -345,6 +347,50 @@ describe('Project file retention follows the current payer in PostgreSQL', () =>
     }
   )
 
+  check(
+    'a Project that fails after committing a version batch still spends the shared run limit',
+    async () => {
+      const [first, second] = [await fixture(), await fixture()].sort((a, b) =>
+        a.projectId < b.projectId ? -1 : 1
+      )
+      // One more file than a batch reads, so the first batch commits and the second one fails.
+      const files = await Promise.all(
+        Array.from({ length: FILES_PER_QUERY + 1 }, () => seedFile(first, 60 * 24))
+      )
+      const failingFileId = files
+        .map(({ fileId }) => fileId)
+        .sort(compareStrings)
+        .at(-1)
+      const survivor = await seedFile(second, 60 * 24)
+      const trigger = `version_retention_failure_${generateId().replaceAll('-', '')}`
+      await db.execute(
+        sql.raw(`CREATE FUNCTION ${trigger}() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN
+        IF OLD.file_id = '${failingFileId}' THEN RAISE EXCEPTION 'version retention failure fixture'; END IF; RETURN OLD; END $$`)
+      )
+      await db.execute(
+        sql.raw(
+          `CREATE TRIGGER ${trigger} BEFORE DELETE ON workspace_file_version FOR EACH ROW EXECUTE FUNCTION ${trigger}()`
+        )
+      )
+      const committedByFirst = FILES_PER_QUERY * 2
+      try {
+        const deleted = await cleanupFileVersions(
+          [
+            { entityType: 'project', entityId: first.projectId },
+            { entityType: 'project', entityId: second.projectId },
+          ],
+          { plan: 'free', cutoff: new Date(), label: 'failed-owner-spends-limit' },
+          committedByFirst + 1
+        )
+        expect(deleted).toBe(committedByFirst + 1)
+        expect(await versions(survivor.fileId)).toHaveLength(11)
+      } finally {
+        await db.execute(sql.raw(`DROP TRIGGER ${trigger} ON workspace_file_version`))
+        await db.execute(sql.raw(`DROP FUNCTION ${trigger}()`))
+      }
+    }
+  )
+
   check(
     'omits empty Projects and batches retained Projects with the same cleanup policy',
     async () => {
 
@@ -64,14 +64,18 @@ function projectFiles(projectId: string) {
   return fileOwnerCondition({ entityType: 'project', entityId: projectId })
 }
 
-/** Releases only superseded history, retaining the current head and the newest nine predecessors. */
+/**
+ * Releases only superseded history, retaining the current head and the newest nine predecessors.
+ * Each committed batch is charged to `budget` as it commits, so a later failure cannot erase
+ * progress the shared run limit has to count.
+ */
 export async function cleanupProjectFileVersions(
   projectId: string,
-  limit: number
+  budget: RowBudget
 ): Promise<number> {
   let released = 0
   let afterId = ''
-  while (released < limit) {
+  while (budget.remaining > 0) {
     const batch = await cleanupDb.transaction(async (tx) => {
       const policy = await prepareRetention(tx, projectId, 'cleanup-file-versions')
       if (!policy) return null
@@ -115,7 +119,7 @@ export async function cleanupProjectFileVersions(
         )
         .orderBy(asc(workspaceFiles.id))
         .for('update')
-      const versionLimit = Math.min(DEFAULT_DELETE_CHUNK_SIZE, limit - released)
+      const versionLimit = Math.min(DEFAULT_DELETE_CHUNK_SIZE, budget.remaining)
       const expired = await selectExpiredFileVersions(
         tx,
         candidates.map(({ id }) => id),
@@ -130,6 +134,7 @@ export async function cleanupProjectFileVersions(
       }
     })
     if (!batch) break
+    consumeRowBudget(budget, batch.removed)
     afterId = batch.lastId
     released += batch.removed
   }