@openmixer/plugin-qualify 0.16.0 → 0.17.0

package/src/distributed-records.ts

@@ -0,0 +1,251 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * The distributed layer: qualification records another device of the same machine class wrote for a plugin set,
+ * installed read-only under `<dir>/<host class>/<set>/` beside the set's `provenance.json`. plugin-qualify-sync reads
+ * it before measuring a plugin, and takes a plugin from it instead of measuring it only when every file the record
+ * names hashes, here, as it did where it was measured. The name of a plugin finds its record and never decides
+ * anything: a record is never trusted by name alone.
+ *
+ * What applies is copied into the device's own `qualification_dir`, the record with the set's provenance added and
+ * its probe output byte for byte, and the plugin's pin is the one that probe output holds. From then on the sync
+ * treats the plugin as one it measured.
+ */
+import { readFileSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import { clapPinUri, pinVerdictOf, type PinEntry } from "./pins-file.js";
+import { integrityOfProbeOutput } from "./probe-judge.js";
+import { readProbeOutput, sha256Hex } from "./probe-output.js";
+import { QUALIFICATION_RECORD_SCHEMA, type QualificationRecord, type RecordVerdict } from "./qualification-record.js";
+import type { FileDigest, SyncItem, SyncOutcome, SyncPlugin } from "./qualify-sync.js";
+import type { SuitabilityRating } from "./rating.js";
+import { writeFileWhole } from "./whole-file.js";
+
+/** Where a system's packages install the distributed records. */
+export const DISTRIBUTED_DIR_SYSTEM = "/usr/share/omx/qualification";
+
+/** The file of a set that says where its records come from. */
+export const DISTRIBUTED_PROVENANCE_FILE = "provenance.json";
+export const DISTRIBUTED_PROVENANCE_SCHEMA = "plugin-qualify.distributed-provenance/1";
+
+/** The first plugin-qualify that reads the layer: what a package of records depends on. */
+export const DISTRIBUTED_LAYER_SINCE = "0.17.0";
+
+/** Where the records of a set come from. The keys below are always there; the rest is what the builder was given. */
+export interface DistributedProvenance {
+  readonly schema: typeof DISTRIBUTED_PROVENANCE_SCHEMA;
+  readonly set: string;
+  readonly hostClass: string;
+  /** The package that installed the set. */
+  readonly package: { readonly name: string; readonly version: string };
+  /** The day the package was built (YYYY-MM-DD). */
+  readonly date: string;
+  readonly [key: string]: unknown;
+}
+
+/** The device tree's model file, where a board names itself. */
+export const BOARD_MODEL_FILE = "/proc/device-tree/model";
+
+/** The board's own model, or `undefined` on a machine without a device tree. */
+export function readBoardModel(): string | undefined {
+  try {
+    return readFileSync(BOARD_MODEL_FILE, "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+/** The host class of a board the layer knows by its device-tree model: `rpi5` for a Raspberry Pi 5 or its compute module. */
+export function hostClassOfBoard(model: string | undefined): string | undefined {
+  if (model === undefined) return undefined;
+  const m = /^Raspberry Pi (?:Compute Module )?(\d)(?:\s|$)/.exec(model.replace(/\0/g, "").trim());
+  return m === null ? undefined : `rpi${m[1]!}`;
+}
+
+/** One distributed record, read: where it is, what it says, and the set it came with. */
+export interface DistributedRecord {
+  readonly path: string;
+  readonly record: QualificationRecord;
+  readonly set: string;
+  readonly provenance: DistributedProvenance;
+}
+
+/** The layer as one run reads it: the records of the host class, by what finds them. */
+export interface DistributedLayer {
+  /** By the `.clap` path the record measured, made absolute. */
+  readonly clap: ReadonlyMap<string, readonly DistributedRecord[]>;
+  /** By the LV2 plugin's uri. */
+  readonly lv2: ReadonlyMap<string, readonly DistributedRecord[]>;
+  readonly sets: readonly string[];
+  readonly records: number;
+}
+
+export const EMPTY_LAYER: DistributedLayer = { clap: new Map(), lv2: new Map(), sets: [], records: 0 };
+
+const RECORD_SUFFIX = ".qualification.json";
+
+const names = (dir: string): string[] => {
+  try {
+    return readdirSync(dir).sort();
+  } catch {
+    return [];
+  }
+};
+
+/**
+ * The records of one host class under each directory, in the order given. A set without a provenance that reads, or
+ * whose provenance names another set or class, is not read; a record that does not read as a record of this schema is
+ * named and left out.
+ */
+export function readDistributedLayer(dirs: readonly string[], hostClass: string, log: (line: string) => void = () => {}): DistributedLayer {
+  const clap = new Map<string, DistributedRecord[]>();
+  const lv2 = new Map<string, DistributedRecord[]>();
+  const sets: string[] = [];
+  let records = 0;
+  const add = (map: Map<string, DistributedRecord[]>, key: string, r: DistributedRecord): void => {
+    map.set(key, [...(map.get(key) ?? []), r]);
+  };
+  for (const base of dirs) {
+    const classDir = join(base, hostClass);
+    for (const set of names(classDir)) {
+      const dir = join(classDir, set);
+      let provenance: DistributedProvenance;
+      try {
+        provenance = JSON.parse(readFileSync(join(dir, DISTRIBUTED_PROVENANCE_FILE), "utf8")) as DistributedProvenance;
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code === "ENOTDIR") continue;
+        log(`distributed: ${dir}: ${(e as NodeJS.ErrnoException).code === "ENOENT" ? `no ${DISTRIBUTED_PROVENANCE_FILE}` : `${DISTRIBUTED_PROVENANCE_FILE} does not read`}, not read`);
+        continue;
+      }
+      if (provenance.schema !== DISTRIBUTED_PROVENANCE_SCHEMA || provenance.set !== set || provenance.hostClass !== hostClass) {
+        log(`distributed: ${dir}: its ${DISTRIBUTED_PROVENANCE_FILE} is not of set ${set} and host class ${hostClass} (${DISTRIBUTED_PROVENANCE_SCHEMA}), not read`);
+        continue;
+      }
+      sets.push(set);
+      for (const name of names(dir)) {
+        if (!name.endsWith(RECORD_SUFFIX)) continue;
+        const path = join(dir, name);
+        let record: QualificationRecord;
+        try {
+          record = JSON.parse(readFileSync(path, "utf8")) as QualificationRecord;
+        } catch {
+          log(`distributed: ${path}: does not read, left out`);
+          continue;
+        }
+        if (record.schema !== QUALIFICATION_RECORD_SCHEMA || typeof record.binary?.path !== "string" || !Array.isArray(record.binary.files) || record.binary.files.length === 0) {
+          log(`distributed: ${path}: not a ${QUALIFICATION_RECORD_SCHEMA} with its binary's files, left out`);
+          continue;
+        }
+        const r: DistributedRecord = { path, record, set, provenance };
+        records++;
+        if (record.plugin.format === "clap") add(clap, resolve(record.binary.path), r);
+        else if (record.plugin.format === "lv2") add(lv2, record.plugin.id, r);
+      }
+    }
+  }
+  return { clap, lv2, sets, records };
+}
+
+/** The uri a record's plugin has on this machine: the installed `.clap`'s path and the id, or the LV2 uri. */
+export function distributedUri(item: SyncItem, r: DistributedRecord): string {
+  return item.format === "clap" ? clapPinUri(join(item.root, item.files[0]!), `urn:clap:${r.record.plugin.id}`) : r.record.plugin.id;
+}
+
+/** What the sync's own judgment would make of the record's verdict for the host, as `outcomeOf` reads a run. */
+function outcomeOfVerdict(v: RecordVerdict): SyncOutcome {
+  if (!v.measured) return v.deciding === "probe.crashed" ? "crashed" : v.deciding === "probe.timeout" ? "hung" : "unmeasured";
+  if (v.rating === "suitable" || v.rating === "conditional") return "qualified";
+  return v.rating === "unsuitable" ? "refused" : "unmeasured";
+}
+
+/** What the layer makes of one item. */
+export type DistributedMatch =
+  /** No distributed record names the plugin: it is measured, and nothing is said. */
+  | { readonly status: "none" }
+  /** Every reason a record found was not taken, one line each; the plugin is measured. */
+  | { readonly status: "ignored"; readonly lines: readonly string[] }
+  | { readonly status: "applies"; readonly set: string; readonly records: readonly DistributedRecord[]; readonly files: readonly string[] };
+
+/**
+ * Whether the item is taken from the layer. The records that find it are tried one set at a time, in the order the
+ * layer read them. Of a set, only the records whose every file is installed with the SHA-256 it recorded (computed
+ * here by `digest`) count: a record of other bytes is another build of the plugin and is passed over. The set applies
+ * when at least one record of these bytes holds a verdict for `host`, and none of those verdicts is one the source
+ * could not measure; a set with no record of these bytes is a binary that differs.
+ */
+export function matchDistributed(
+  layer: DistributedLayer,
+  item: SyncItem,
+  host: string,
+  digest: (files: readonly string[]) => readonly FileDigest[] | undefined,
+): DistributedMatch {
+  const found = item.format === "clap" ? layer.clap.get(resolve(join(item.root, item.files[0]!))) : layer.lv2.get(item.uri ?? "");
+  if (found === undefined || found.length === 0) return { status: "none" };
+  const lines: string[] = [];
+  const say = (line: string): void => {
+    if (!lines.includes(line)) lines.push(line);
+  };
+  for (const set of [...new Set(found.map((r) => r.set))]) {
+    // a set may hold records of earlier bytes of the plugin beside the ones of these: only the ones of these bytes count
+    const records = found.filter((r) => {
+      if (r.set !== set || r.record.plugin.format !== item.format) return false;
+      const wanted = r.record.binary.files;
+      const now = digest(wanted.map((f) => f.path));
+      return now !== undefined && wanted.every((f) => now.find((d) => d.path === f.path)?.sha256 === f.sha256);
+    });
+    if (records.length === 0) {
+      say(`distributed: ${distributedUri(item, found.find((r) => r.set === set)!)}: binary differs`);
+      continue;
+    }
+    const judged = records.filter((r) => r.record.verdicts.some((v) => v.host === host));
+    if (judged.length === 0) {
+      say(`distributed: ${distributedUri(item, records[0]!)}: no verdict for ${host} in ${set}`);
+      continue;
+    }
+    const unmeasured = judged.find((r) => outcomeOfVerdict(r.record.verdicts.find((v) => v.host === host)!) === "unmeasured");
+    if (unmeasured !== undefined) {
+      say(`distributed: ${distributedUri(item, unmeasured)}: unmeasured in ${set}, measured here`);
+      continue;
+    }
+    return { status: "applies", set, records, files: [...new Set(records.flatMap((r) => r.record.binary.files.map((f) => f.path)))] };
+  }
+  return { status: "ignored", lines };
+}
+
+/**
+ * The records of a match copied into `qualificationDir` and the plugins they make: the probe output first, byte for
+ * byte and read back through this version's reader, its SHA-256 the one the record names; then the record with the
+ * set's provenance added. A record whose probe output is missing, altered or unreadable throws, naming it, and the
+ * caller measures the plugin instead. Records of the other tier (no verdict for `host`) are copied and make no plugin,
+ * as the sweep writes them.
+ */
+export function applyDistributed(qualificationDir: string, item: SyncItem, match: Extract<DistributedMatch, { status: "applies" }>, host: string): SyncPlugin[] {
+  const copies = match.records.map((r) => {
+    const probeName = r.record.probe.file;
+    const probePath = join(r.path, "..", probeName);
+    let bytes: Buffer;
+    try {
+      bytes = readFileSync(probePath);
+    } catch (e) {
+      throw new Error(`${probeName}: ${(e as NodeJS.ErrnoException).code ?? String(e)}`);
+    }
+    if (sha256Hex(bytes) !== r.record.probe.sha256) throw new Error(`${probeName}: not the probe output the record names (its SHA-256 differs)`);
+    const read = readProbeOutput(bytes.toString("utf8"));
+    if (!read.ok) throw new Error(`${probeName}: ${read.code}: ${read.problem}`);
+    return { r, bytes, output: read.output };
+  });
+  const plugins: SyncPlugin[] = [];
+  for (const { r, bytes, output } of copies) {
+    writeFileWhole(join(qualificationDir, r.record.probe.file), bytes);
+    const recordPath = join(qualificationDir, r.path.slice(r.path.lastIndexOf("/") + 1));
+    writeFileWhole(recordPath, `${JSON.stringify({ ...r.record, provenance: r.provenance }, null, 2)}\n`);
+    const v = r.record.verdicts.find((x) => x.host === host);
+    if (v === undefined) continue;
+    const word = v.measured ? pinVerdictOf(v.rating as SuitabilityRating) : undefined;
+    const pin: PinEntry = { uri: distributedUri(item, r), integrity: integrityOfProbeOutput(output), ...(word === undefined ? {} : { verdict: word }) };
+    const outcome = outcomeOfVerdict(v);
+    plugins.push({ uri: pin.uri, outcome, ...(v.deciding === undefined ? {} : { code: v.deciding }), pin, record: recordPath });
+  }
+  return plugins;
+}

package/src/host-profiles.ts

@@ -24,6 +24,11 @@ import type { HostProfile } from "./measurement/format.js";
  * the console hands the same array to the in-process LV2 table at `omx_host_backend_configure`,
  * which builds one provider per URI and refuses a URI it cannot provide; there is no C copy (the
  * console's native test reads this export).
+ *
+ * Equal to omx-clap-core's `LV2_CORE_PROVIDED_INIT` (`lv2/core/lv2_core.h`), same URIs in the same
+ * order: the original seven, then the three rtmempool URIs (the header's `LV2_RTSAFE_MEMORY_POOL__Pool`,
+ * the `#Pool` spelling some TTLs require, and the deprecated v1 URI), the three state-path features,
+ * then uri-map and event (omx-clap-core #94).
  */
 export const OMX_INPROCESS_FEATURES: readonly string[] = [
   "http://lv2plug.in/ns/ext/urid#map",
@@ -33,6 +38,14 @@ export const OMX_INPROCESS_FEATURES: readonly string[] = [
   "http://lv2plug.in/ns/ext/worker#schedule",
   "http://lv2plug.in/ns/ext/state#loadDefaultState",
   "http://lv2plug.in/ns/ext/log#log",
+  "http://kxstudio.sf.net/ns/lv2ext/rtmempoolPool",
+  "http://kxstudio.sf.net/ns/lv2ext/rtmempool#Pool",
+  "http://home.gna.org/lv2dynparam/rtmempool/v1",
+  "http://lv2plug.in/ns/ext/state#makePath",
+  "http://lv2plug.in/ns/ext/state#mapPath",
+  "http://lv2plug.in/ns/ext/state#freePath",
+  "http://lv2plug.in/ns/ext/uri-map",
+  "http://lv2plug.in/ns/ext/event",
 ];
 
 /**

package/src/hosting-suitability.ts

@@ -133,6 +133,12 @@ const QUANTUM_PINNED_FEATURES: readonly string[] = [
   "http://lv2plug.in/ns/ext/buf-size#powerOf2BlockLength",
 ];
 
+/**
+ * Promises the adapter keeps independent of what the profile's in-process list offers: the
+ * adapter's ports are its own memory, so `lv2:inPlaceBroken` always holds (omx-clap-core #94).
+ */
+const ALWAYS_MET_FEATURES: readonly string[] = ["http://lv2plug.in/ns/lv2core#inPlaceBroken"];
+
 /** The verdict's message codes, declared in their union list file. */
 import { HOSTING_CODE } from "./hosting-codes.js";
 export { HOSTING_CODE };
@@ -685,7 +691,11 @@ export function featureReasons(
       );
     }
     const missing = required.filter(
-      (f) => !provided.includes(f) && !refused.includes(f) && !QUANTUM_PINNED_FEATURES.includes(f),
+      (f) =>
+        !provided.includes(f) &&
+        !refused.includes(f) &&
+        !QUANTUM_PINNED_FEATURES.includes(f) &&
+        !ALWAYS_MET_FEATURES.includes(f),
     );
     if (missing.length > 0) {
       out.push(

package/src/index.ts

@@ -24,9 +24,14 @@ export * from "./probe-output.js";
 export * from "./probe-judge.js";
 export * from "./qualification-record.js";
 export * from "./probe-runner.js";
+export * from "./measurement-grid.js";
+export * from "./memory-bound.js";
+export * from "./probe-merge.js";
 export * from "./judge-cli.js";
 export * from "./whole-file.js";
 export * from "./qualify-sync.js";
+export * from "./distributed-records.js";
+export * from "./records-package.js";
 export * from "./host-admission.js";
 export * from "./history-file.js";
 export * from "./history-adjust.js";

package/src/measurement-grid.ts

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * The measurement grid (#193): the cells, each one rate and one quantum, a plugin is measured at, and the runs of the
+ * probe runner that measure them. A host is judged at its own cell, so the grid a run takes is chosen from the hosts it
+ * judges; README "The measurement grid" states the three ways of choosing it and the order the cells are taken in.
+ *
+ * Pure: no file, no process. `probe-runner.ts` runs what `runnerInvocations` plans.
+ */
+import { GRID_CONTINUITY_QUANTUM } from "./qualify-declarations.js";
+
+/** One cell of the grid. */
+export interface GridCell {
+  readonly rate: number;
+  readonly quantum: number;
+}
+
+/** How the grid is chosen: the hosts' cells, the full product of the rates and quanta, or the cells named. */
+export type GridSpec = { readonly kind: "hosts" } | { readonly kind: "full" } | { readonly kind: "cells"; readonly cells: readonly GridCell[] };
+
+export const GRID_HOSTS: GridSpec = { kind: "hosts" };
+export const GRID_FULL: GridSpec = { kind: "full" };
+
+export const cellKey = (c: GridCell): string => `${String(c.rate)}/${String(c.quantum)}`;
+
+const positive = (t: string): number | undefined => {
+  const n = Number(t);
+  return /^\d+$/.test(t) && Number.isSafeInteger(n) && n > 0 ? n : undefined;
+};
+
+/** `hosts`, `full`, or `<rate>/<quantum>,...`; anything else is refused with what was wrong. */
+export function parseGridSpec(text: string): { ok: true; spec: GridSpec } | { ok: false; error: string } {
+  const t = text.trim();
+  if (t === "hosts") return { ok: true, spec: GRID_HOSTS };
+  if (t === "full") return { ok: true, spec: GRID_FULL };
+  const cells: GridCell[] = [];
+  for (const part of t.split(",").map((p) => p.trim())) {
+    const m = /^(\d+)\/(\d+)$/.exec(part);
+    const rate = m === null ? undefined : positive(m[1]!);
+    const quantum = m === null ? undefined : positive(m[2]!);
+    if (rate === undefined || quantum === undefined) {
+      return { ok: false, error: `the grid is hosts, full, or cells as <rate>/<quantum>, comma-separated; "${part}" is none of them` };
+    }
+    cells.push({ rate, quantum });
+  }
+  return { ok: true, spec: { kind: "cells", cells: unique(cells) } };
+}
+
+function unique(cells: readonly GridCell[]): GridCell[] {
+  const seen = new Set<string>();
+  return cells.filter((c) => (seen.has(cellKey(c)) ? false : (seen.add(cellKey(c)), true)));
+}
+
+const byRateThenQuantum = (a: GridCell, b: GridCell): number => a.rate - b.rate || a.quantum - b.quantum;
+
+/**
+ * The cells of a grid, in the order they are taken: for `hosts`, each host's own cell in the order the hosts are given,
+ * then `GRID_CONTINUITY_QUANTUM` at every rate; for `full`, those cells first as well, then the rest of the product by
+ * rate and quantum; for named cells, as named. A cell is listed once.
+ */
+export function gridCells(
+  spec: GridSpec,
+  context: { readonly rates: readonly number[]; readonly quanta: readonly number[]; readonly hosts: readonly GridCell[] },
+): GridCell[] {
+  if (spec.kind === "cells") return unique(spec.cells);
+  const continuity = [...context.rates].sort((a, b) => a - b).map((rate) => ({ rate, quantum: GRID_CONTINUITY_QUANTUM }));
+  const lead = unique([...context.hosts, ...continuity]);
+  if (spec.kind === "hosts") return lead;
+  const product = context.rates.flatMap((rate) => context.quanta.map((quantum) => ({ rate, quantum }))).sort(byRateThenQuantum);
+  const inProduct = new Set(product.map(cellKey));
+  // the full grid is the product: a host's cell outside --rates x --quanta is not part of it
+  return unique([...lead.filter((c) => inProduct.has(cellKey(c))), ...product]);
+}
+
+/** The first `budget` cells, or every one when the budget is absent or 0. */
+export function budgetCells(cells: readonly GridCell[], budget: number | undefined): GridCell[] {
+  return budget === undefined || budget === 0 ? [...cells] : cells.slice(0, budget);
+}
+
+/** One run of the probe runner: the rates it is given, its quantum, and the cells it stands for. */
+export interface RunnerInvocation {
+  readonly rates: readonly number[];
+  readonly quantum: number;
+  readonly cells: readonly GridCell[];
+}
+
+/**
+ * The runs that measure `cells`. A CLAP plugin is run once per quantum, at every rate of the grid at that quantum (the
+ * prober takes a list of rates and one block size). An LV2 plugin is run once per cell: plugin-hostd's runner measures
+ * an LV2 plugin at one rate a run, the highest of the rates it is given, so a list would measure only that one.
+ */
+export function runnerInvocations(format: string, cells: readonly GridCell[]): RunnerInvocation[] {
+  if (format !== "clap") return cells.map((c) => ({ rates: [c.rate], quantum: c.quantum, cells: [c] }));
+  const byQuantum = new Map<number, GridCell[]>();
+  for (const c of cells) byQuantum.set(c.quantum, [...(byQuantum.get(c.quantum) ?? []), c]);
+  return [...byQuantum.entries()].map(([quantum, at]) => ({ rates: [...new Set(at.map((c) => c.rate))].sort((a, b) => a - b), quantum, cells: at }));
+}

package/src/memory-bound.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * The memory bound of a run (#193). A sampler loading its library can take all of a small machine's memory; unbounded,
+ * the kernel's out-of-memory killer ends it (or something else) and the run is a crash nobody can tell from a bug. So
+ * every run is bounded: the runner's data limit (`--data-bytes`, `RLIMIT_DATA` on the measuring child), with the
+ * interposer told to exit `MEMORY_BOUND_EXIT_STATUS` the moment an allocation is refused under it.
+ *
+ * A run is out of memory when one of its steps says the child exited with that status, or was killed by a `SIGKILL`
+ * the runner did not send (its own deadline kill is `probe.timeout`, never `probe.crashed`): the kernel's killer.
+ */
+import { totalmem } from "node:os";
+
+import type { ProbeOutput } from "./probe-output.js";
+import { MEMORY_BOUND_EXIT_STATUS, MEMORY_LIMIT_RAM_FRACTION } from "./qualify-declarations.js";
+
+/** How the bound is applied: the runner's data limit on the child. */
+export const MEMORY_BOUND_MECHANISM = "rlimit-data";
+
+/** The outcome of a run, and of each of its cells, that outgrew the bound. */
+export const PROBE_OOM = "probe.oom";
+
+export interface MemoryBound {
+  readonly bytes: number;
+  readonly mechanism: typeof MEMORY_BOUND_MECHANISM;
+}
+
+const UNITS: Readonly<Record<string, number>> = { "": 1, K: 2 ** 10, M: 2 ** 20, G: 2 ** 30, T: 2 ** 40 };
+
+/** `off`, a number of bytes, or one with a K, M, G or T suffix (powers of two: K is 2 ** 10 bytes). */
+export function parseMemoryLimit(text: string): { ok: true; bytes: number | "off" } | { ok: false; error: string } {
+  const t = text.trim();
+  if (t === "off") return { ok: true, bytes: "off" };
+  const m = /^(\d+)([KMGT]?)(?:i?B)?$/i.exec(t);
+  const bytes = m === null ? NaN : Number(m[1]) * UNITS[m[2]!.toUpperCase()]!;
+  if (!Number.isSafeInteger(bytes) || bytes <= 0) return { ok: false, error: `the memory limit is off, or bytes as 2147483648, 2048M or 2G; "${t}" is neither` };
+  return { ok: true, bytes };
+}
+
+/** The default bound: `MEMORY_LIMIT_RAM_FRACTION` of the machine's RAM. */
+export function defaultMemoryLimit(ramBytes: number = totalmem()): number {
+  return Math.floor(ramBytes * MEMORY_LIMIT_RAM_FRACTION);
+}
+
+/** The bound a setting names: `undefined` (the default), `off`, or a size. */
+export function memoryBoundOf(setting: number | "off" | undefined, ramBytes?: number): MemoryBound | undefined {
+  if (setting === "off") return undefined;
+  return { bytes: setting ?? defaultMemoryLimit(ramBytes), mechanism: MEMORY_BOUND_MECHANISM };
+}
+
+/** Whether a run under `bound` ended out of memory: the interposer's exit status, or a SIGKILL that was no deadline's. */
+export function outOfMemory(output: ProbeOutput, bound: MemoryBound | undefined): boolean {
+  if (bound === undefined) return false;
+  return output.steps.some((s) => s.exitStatus === MEMORY_BOUND_EXIT_STATUS || (s.signal === "SIGKILL" && s.outcome === "probe.crashed"));
+}

package/src/probe-judge.ts

@@ -38,6 +38,7 @@ import { PROBE_NOT_ATTEMPTED, PROBE_OK, type ProbeGridPoint, type ProbeOutput }
 import type { QualifyVerdict } from "./qualify-cli.js";
 import { RATING_SEVERITY, worstRating, type SuitabilityRating } from "./rating.js";
 import type { IntegrityMeasurement, VoicesHeld } from "./measurement/format.js";
+import { PROBE_OOM } from "./memory-bound.js";
 
 /** Facts of the descriptor, which the probe output repeats none of. */
 export interface JudgeFacts {
@@ -197,8 +198,25 @@ function decidingOf(reasons: readonly RecordReason[], rating: SuitabilityRating)
   return [...reasons].sort((a, b) => RATING_SEVERITY[b.rating] - RATING_SEVERITY[a.rating]).find((r) => r.rating === rating);
 }
 
+/** The grid point at a host's own cell, whatever its outcome; `undefined` when the grid does not hold that cell. */
+function cellOf(output: ProbeOutput, profile: HostProfile): ProbeGridPoint | undefined {
+  return output.grid.find((p) => p.rate === profile.cost.rate && p.quantum === profile.cost.quantum);
+}
+
+const memoryParams = (p: ProbeGridPoint): Record<string, number | string> =>
+  p.memoryLimit === undefined ? {} : { memoryLimitBytes: p.memoryLimit.bytes, memoryLimitMechanism: p.memoryLimit.mechanism };
+
+/**
+ * The cost reasons at the host's rate and quantum. A cell that was measured is read against the host's budget; a cell
+ * whose run did not end well is `unknown` with that run's outcome (`probe.oom`, `probe.crashed`); only a cell the grid
+ * does not hold is `hosting.cost.unmeasured-at-rate-and-quantum`.
+ */
 function costOf(output: ProbeOutput, profile: HostProfile): HostJudgment["cost"] {
   const { rate, quantum } = profile.cost;
+  const cell = cellOf(output, profile);
+  if (cell !== undefined && cell.outcome !== PROBE_OK && cell.outcome !== PROBE_NOT_ATTEMPTED) {
+    return { rate, quantum, reasons: [{ dimension: "cost", rating: "unknown", code: cell.outcome, params: { rate, quantum, ...memoryParams(cell) } }] };
+  }
   const reasons = hostingCostReasons(
     { cpuCost: { perRateQuantum: gridCostReadings(output.grid, PROBE_OK) } },
     { rate, quantum, profile },
@@ -215,7 +233,8 @@ function costOf(output: ProbeOutput, profile: HostProfile): HostJudgment["cost"]
  */
 function failedOutcome(output: ProbeOutput): string | undefined {
   if (output.run.outcome !== PROBE_OK) return output.run.outcome;
-  return output.grid.find((p) => p.outcome !== PROBE_OK && p.outcome !== PROBE_NOT_ATTEMPTED)?.outcome;
+  // a cell that outgrew the memory bound is a recorded outcome of that cell, judged per host below, not the run's end
+  return output.grid.find((p) => p.outcome !== PROBE_OK && p.outcome !== PROBE_NOT_ATTEMPTED && p.outcome !== PROBE_OOM)?.outcome;
 }
 
 /**
@@ -257,6 +276,11 @@ export function judgeProbeOutput(output: ProbeOutput, profiles: readonly HostPro
       const notes = noteSweepOfProbeOutput(output, rt);
       reasons = [...rtSafetyReasons(rt), ...noteSweepReasons(notes, facts.noteInputs ?? (notes.applicable ? 1 : 0))].map(asRecordReason);
     }
+    // the plugin did not run within the memory bound at this host's own rate and quantum: not hostable there as measured
+    const cell = cellOf(output, profile);
+    if (cell?.outcome === PROBE_OOM) {
+      reasons = [...reasons, { dimension: "memory", rating: "unknown", code: PROBE_OOM, params: { rate: cell.rate, quantum: cell.quantum, ...memoryParams(cell) } }];
+    }
     const admission = facts.admissions?.[profile.id];
     if (admission !== undefined && admittedHostOf(profile) !== undefined) {
       if (!admission.measured || !admission.admitted) {

package/src/probe-merge.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * The runs of one plugin and one offer, made one probe output (#193). The grid takes several runs of the probe runner
+ * (one per quantum for a CLAP plugin, one per cell for an LV2 one); the judge and the record read one document. The
+ * merge is a translation, never a judgment:
+ *
+ * - the grid is every run's points, and, for a run that did not end `probe.ok`, a point at each of its cells that holds
+ *   none, carrying the run's outcome (and, for `probe.oom`, the bound it ran under), so no cell is silently absent;
+ * - the steps are every run's, in order; the run's time is the sum, and it is complete when every run was;
+ * - the run's outcome is the first that was not `probe.ok` among the runs that did not outgrow the bound; a run that
+ *   outgrew it leaves its cells `probe.oom` and the rest are still judged; when every run did, it is `probe.oom`;
+ * - `run.parts` names each run: its id, its outcome, its rates and quantum, its time.
+ *
+ * One run that ended well and needs nothing added is kept as the runner wrote it, byte for byte.
+ */
+import { outOfMemory, PROBE_OOM, type MemoryBound } from "./memory-bound.js";
+import { cellKey, type RunnerInvocation } from "./measurement-grid.js";
+import { PROBE_OK, readProbeOutput, type ProbeOutput } from "./probe-output.js";
+
+/** One run of the runner, as it was read. */
+export interface ProbeRunPart {
+  readonly bytes: Buffer;
+  readonly output: ProbeOutput;
+  readonly invocation: RunnerInvocation;
+}
+
+export class ProbeMergeError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ProbeMergeError";
+  }
+}
+
+type Json = Record<string, unknown>;
+
+export function mergeProbeRuns(parts: readonly ProbeRunPart[], bound: MemoryBound | undefined): { bytes: Buffer; output: ProbeOutput } {
+  if (parts.length === 0) throw new ProbeMergeError("no run to merge");
+  const outcomes = parts.map((p) => (outOfMemory(p.output, bound) ? PROBE_OOM : p.output.run.outcome));
+  const first = parts[0]!;
+  for (const p of parts.slice(1)) {
+    if (p.output.plugin.id !== first.output.plugin.id || p.output.binary.sha256 !== first.output.binary.sha256 || p.output.offer.id !== first.output.offer.id) {
+      throw new ProbeMergeError(
+        `the runs of ${first.output.plugin.id} measured different things (${p.output.plugin.id}, ${p.output.binary.sha256.slice(0, 12)}, offer ${p.output.offer.id}): the plugin's files changed between them`,
+      );
+    }
+  }
+  const missingCell = (p: ProbeRunPart): boolean => p.invocation.cells.some((c) => !p.output.grid.some((g) => g.rate === c.rate && g.quantum === c.quantum));
+  if (parts.length === 1 && outcomes[0] === first.output.run.outcome && (outcomes[0] === PROBE_OK || !missingCell(first))) {
+    return { bytes: first.bytes, output: first.output };
+  }
+
+  const docs = parts.map((p) => JSON.parse(p.bytes.toString("utf8")) as Json);
+  const merged = structuredClone(docs[0]!);
+  const grid: Json[] = [];
+  const seen = new Set<string>();
+  const steps: unknown[] = [];
+  parts.forEach((p, i) => {
+    for (const point of (docs[i]!["grid"] as Json[] | undefined) ?? []) {
+      const key = cellKey({ rate: point["rate"] as number, quantum: point["quantum"] as number });
+      if (seen.has(key)) continue;
+      seen.add(key);
+      grid.push(point);
+    }
+    if (outcomes[i] !== PROBE_OK) {
+      for (const c of p.invocation.cells) {
+        if (seen.has(cellKey(c))) continue;
+        seen.add(cellKey(c));
+        grid.push({ rate: c.rate, quantum: c.quantum, outcome: outcomes[i], ...(outcomes[i] === PROBE_OOM && bound !== undefined ? { memoryLimit: { bytes: bound.bytes, mechanism: bound.mechanism } } : {}) });
+      }
+    }
+    steps.push(...((docs[i]!["steps"] as unknown[] | undefined) ?? []));
+  });
+  const judged = outcomes.filter((o) => o !== PROBE_OOM);
+  const run = merged["run"] as Json;
+  merged["run"] = {
+    ...run,
+    elapsedMs: parts.reduce((sum, p) => sum + p.output.run.elapsedMs, 0),
+    complete: parts.every((p, i) => p.output.run.complete && outcomes[i] === PROBE_OK),
+    outcome: judged.length === 0 ? PROBE_OOM : (judged.find((o) => o !== PROBE_OK) ?? PROBE_OK),
+    parts: parts.map((p, i) => ({ id: p.output.run.id, outcome: outcomes[i], rates: p.invocation.rates, quantum: p.invocation.quantum, elapsedMs: p.output.run.elapsedMs })),
+  };
+  merged["steps"] = steps;
+  merged["grid"] = grid;
+  const bytes = Buffer.from(`${JSON.stringify(merged, null, 2)}\n`);
+  const read = readProbeOutput(bytes.toString("utf8"));
+  if (!read.ok) throw new ProbeMergeError(`the merged runs of ${first.output.plugin.id} do not read as a probe output (${read.code}): ${read.problem}`);
+  return { bytes, output: read.output };
+}

package/src/probe-output.ts

@@ -95,6 +95,8 @@ export interface ProbeGridPoint {
   readonly cost?: ProbeCost;
   readonly rtSafety?: ProbeRtSafety;
   readonly noteSweep?: ProbeNoteSweep;
+  /** A cell whose run outgrew the memory bound (`probe.oom`): the bound it ran under. */
+  readonly memoryLimit?: { readonly bytes: number; readonly mechanism: string };
 }
 
 export interface ProbeStep {
@@ -105,6 +107,9 @@ export interface ProbeStep {
   /** The hosting code the step carries when it says why a figure is absent (`hosting.latency.unmeasured`). */
   readonly hostingCode?: string;
   readonly detail?: string;
+  /** How the child ended, when this step is a child's end: its exit status, or the signal that killed it. */
+  readonly exitStatus?: number;
+  readonly signal?: string;
 }
 
 export interface ProbeIdleState {
@@ -301,9 +306,15 @@ function readPoint(v: unknown, i: number): ProbeGridPoint {
     ...(o["cost"] === undefined ? {} : { cost: readCost(o["cost"], `${where} cost`) }),
     ...(o["rtSafety"] === undefined ? {} : { rtSafety: readRtSafety(o["rtSafety"], `${where} rtSafety`) }),
     ...(o["noteSweep"] === undefined ? {} : { noteSweep: readNoteSweep(o["noteSweep"], `${where} noteSweep`) }),
+    ...(o["memoryLimit"] === undefined ? {} : { memoryLimit: readMemoryLimit(o["memoryLimit"], `${where} memoryLimit`) }),
   };
 }
 
+function readMemoryLimit(v: unknown, where: string): { bytes: number; mechanism: string } {
+  const o = record(v, where);
+  return { bytes: posInt(o, "bytes", where), mechanism: str(o, "mechanism", where) };
+}
+
 function readStep(v: unknown, i: number): ProbeStep {
   const where = `steps[${i}]`;
   const o = record(v, where);
@@ -314,6 +325,8 @@ function readStep(v: unknown, i: number): ProbeStep {
     ...optional("quantum", o["quantum"] === undefined ? undefined : posInt(o, "quantum", where)),
     ...optional("hostingCode", nonEmptyString(o["hostingCode"])),
     ...optional("detail", nonEmptyString(o["detail"])),
+    ...optional("exitStatus", typeof o["exitStatus"] === "number" && Number.isInteger(o["exitStatus"]) ? o["exitStatus"] : undefined),
+    ...optional("signal", nonEmptyString(o["signal"])),
   };
 }