diff --git a/packages/paperclip-runner/scripts/controlled-evals/build-runtime.mjs b/packages/paperclip-runner/scripts/controlled-evals/build-runtime.mjs
index b7b690fc931..4fdffefca17 100644
--- a/packages/paperclip-runner/scripts/controlled-evals/build-runtime.mjs
+++ b/packages/paperclip-runner/scripts/controlled-evals/build-runtime.mjs
@@ -74,7 +74,7 @@ export async function buildControllerRuntime({ outputDirectory, sourceRevision }
       if (entry.isDirectory()) await inventory(path);
       else if (entry.isFile()) {
         const bytes = await readFile(path); totalBytes += bytes.length;
-        if (totalBytes > RUNTIME_MAX_BYTES || Object.keys(files).length >= RUNTIME_MAX_FILES) throw new Error('Controller runtime exceeds its artifact allowance');
+        if (totalBytes > RUNTIME_MAX_BYTES || Object.keys(files).length >= RUNTIME_MAX_FILES - 1) throw new Error('Controller runtime exceeds its artifact allowance');
         files[relative(output, path).split('\\').join('/')] = { sha256: sha256(bytes), sizeBytes: bytes.length };
       } else throw new Error('Controller runtime contains a nonregular file');
     }
@@ -82,6 +82,7 @@ export async function buildControllerRuntime({ outputDirectory, sourceRevision }
   await inventory(output);
   const receipt = { schema: 'paperclip.runner-eval.controller-runtime/v1', sourceRevision, nodeMajor: 24, inputs, packageInputs, totalBytes, files };
   const receiptBytes = JSON.stringify(receipt, null, 2) + '\n';
+  if (totalBytes + Buffer.byteLength(receiptBytes) > RUNTIME_MAX_BYTES) throw new Error('Controller runtime receipt exceeds its artifact allowance');
   await writeFile(join(output, 'runtime.json'), receiptBytes, { flag: 'wx', mode: 0o600 });
   return { ...receipt, receiptSha256: sha256(receiptBytes) };
 }
diff --git a/packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs b/packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs
index 5d5164d191c..c88ad62abcf 100644
--- a/packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs
+++ b/packages/paperclip-runner/scripts/controlled-evals/verify-runtime.mjs
@@ -32,9 +32,9 @@ export async function verifyControllerRuntime({ directory, sourceRevision, recei
   if (sha256(receiptBytes) !== receiptSha256) throw new Error('Runtime receipt digest mismatch');
   const receipt = JSON.parse(receiptBytes.toString('utf8'));
   if (receipt.schema !== 'paperclip.runner-eval.controller-runtime/v1' || receipt.sourceRevision !== sourceRevision
-      || receipt.nodeMajor !== 24 || !Number.isSafeInteger(receipt.totalBytes) || receipt.totalBytes < 1 || receipt.totalBytes > RUNTIME_MAX_BYTES
+      || receipt.nodeMajor !== 24 || !Number.isSafeInteger(receipt.totalBytes) || receipt.totalBytes < 1 || receipt.totalBytes + receiptBytes.length > RUNTIME_MAX_BYTES
       || !receipt.files || typeof receipt.files !== 'object' || Array.isArray(receipt.files)
-      || !Object.keys(receipt.files).length || Object.keys(receipt.files).length > RUNTIME_MAX_FILES) throw new Error('Invalid runtime receipt');
+      || !Object.keys(receipt.files).length || Object.keys(receipt.files).length >= RUNTIME_MAX_FILES) throw new Error('Invalid runtime receipt');
   const pending = new Map(Object.entries(receipt.files));
   let bytes = 0, entries = 0;
   async function inspect(path, prefix = '') {