@openmixer/plugin-qualify 0.17.4 → 0.18.0

package/src/clap-qualify.ts

@@ -36,7 +36,7 @@ import {
 import type { QualifyVerdict } from "./qualify-cli.js";
 import { RATING_SEVERITY, worstRating, type SuitabilityRating } from "./rating.js";
 import { halfPopulatedRefusal, locateNativeTools } from "./tool-paths.js";
-import { readIntegrity, type IntegrityMeasurement, type VoicesHeld } from "./measurement/format.js";
+import { readIntegrity, readMemoryFootprint, type IntegrityMeasurement, type MemoryFootprint, type VoicesHeld } from "./measurement/format.js";
 import { isVoiceBasis } from "./measurement/vocabulary.js";
 import { coreFraction } from "./cost-fields.js";
 
@@ -103,6 +103,8 @@ export interface ClapCostReading {
   /** The percentile `nsPerSampleP95` is taken at. */
   readonly percentile: number;
   readonly perRate: Readonly<Record<string, ClapCostAtRate>>;
+  /** What one instance held at each rate (`memory` on the prober's per-rate object), read apart from the timing. */
+  readonly memory?: Readonly<Record<string, MemoryFootprint>>;
 }
 
 /** One plugin's line from `clap-qualify`. */
@@ -285,9 +287,12 @@ function readCost(v: unknown): ClapCostReading {
   const perRateIn = v["perRate"];
   if (!isRecord(perRateIn)) return bad("cost has no perRate map");
   const perRate: Record<string, ClapCostAtRate> = {};
+  const memory: Record<string, MemoryFootprint> = {};
   for (const [rate, at] of Object.entries(perRateIn)) {
     if (!/^[1-9]\d*$/.test(rate)) return bad(`cost rate ${rate}`);
     perRate[rate] = readCostAtRate(at, `cost at ${rate}`, stimulus === "notes-held");
+    const footprint = isRecord(at) ? readMemoryFootprint(at["memory"]) : undefined;
+    if (footprint !== undefined) memory[rate] = footprint;
   }
   return {
     stimulus,
@@ -295,6 +300,7 @@ function readCost(v: unknown): ClapCostReading {
     warmupBlocks: count(v, "warmupBlocks", "cost"),
     percentile: figure(v, "percentile", "cost"),
     perRate,
+    ...(Object.keys(memory).length === 0 ? {} : { memory }),
   };
 }
 
@@ -338,6 +344,7 @@ export function qualifiedPluginOfClapLine(line: ClapQualifyLine, stability?: Plu
     clap,
     rtSafety: { ...rtSafety, noteSweep },
     cpuCost: { perRate: clapCostPerRate(line.cost) },
+    ...(line.cost?.memory === undefined ? {} : { memory: { perRate: line.cost.memory } }),
     ...(stability === undefined ? {} : { stability }),
   };
 }

package/src/direct-limit.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * The hard limit of a process plugin-qualify spawns directly. Through plugin-hostd's runner a measured child has `memory.max`;
+ * a direct spawn has no runner, so it gets `RLIMIT_AS`, which needs no privilege. It is off for a sanitizer build, which
+ * reserves far more address space than it uses and would fail at start under any limit worth having.
+ *
+ * Hitting the limit is an outcome: the interposer ends the child with `MEMORY_BOUND_EXIT_STATUS` on the first refused
+ * allocation when `MEMORY_BOUND_EXIT_ENV` is set ({@link addressSpaceLimited} sets it), and {@link directOutcome} names it.
+ */
+import { readFileSync } from "node:fs";
+import { totalmem } from "node:os";
+
+import { ADDRESS_SPACE_LIMIT_RAM_FRACTION, MEMORY_BOUND_EXIT_ENV, MEMORY_BOUND_EXIT_STATUS } from "./qualify-declarations.js";
+
+/** The outcome of a direct spawn that hit its limit. */
+export const MEMORY_LIMIT_EXCEEDED = "memory-limit-exceeded";
+export const ADDRESS_SPACE_MECHANISM = "rlimit-as";
+
+const SANITIZER_ENTRY = ["__asan_init", "__tsan_init", "__msan_init"];
+
+/** Whether the program is built with a sanitizer that reserves address space: its own init symbol is in the binary. */
+export function isSanitizerBuild(tool: string, read: (path: string) => Buffer = (p) => readFileSync(p)): boolean {
+  let bytes: Buffer;
+  try {
+    bytes = read(tool);
+  } catch {
+    return false;
+  }
+  return SANITIZER_ENTRY.some((s) => bytes.includes(s));
+}
+
+export interface DirectSpawn {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly env: Readonly<Record<string, string>>;
+  /** The limit it runs under, in bytes; absent for a sanitizer build. */
+  readonly limitBytes?: number;
+}
+
+/** The limit a direct spawn takes by default: `ADDRESS_SPACE_LIMIT_RAM_FRACTION` of the machine's RAM. */
+export const defaultAddressSpaceLimit = (ramBytes: number = totalmem()): number => Math.floor(ramBytes * ADDRESS_SPACE_LIMIT_RAM_FRACTION);
+
+/**
+ * How to spawn `tool` under the limit: the shell sets it and execs the program, since node has no way to set a child's
+ * rlimit. The program's own process stays the one spawned, so a signal or a timeout reaches it as before.
+ */
+export function addressSpaceLimited(
+  tool: string,
+  args: readonly string[],
+  limitBytes: number = defaultAddressSpaceLimit(),
+  sanitizer: boolean = isSanitizerBuild(tool),
+): DirectSpawn {
+  if (sanitizer) return { command: tool, args, env: {} };
+  const kb = Math.ceil(limitBytes / 2 ** 10);
+  return {
+    command: "/bin/sh",
+    args: ["-c", `ulimit -v ${String(kb)} && exec "$@"`, "sh", tool, ...args],
+    env: { [MEMORY_BOUND_EXIT_ENV]: "1" },
+    limitBytes,
+  };
+}
+
+/** What the end of a direct spawn under a limit comes to: the outcome and the limit when it hit it, else nothing. */
+export function directOutcome(status: number | null, spawn: DirectSpawn): { readonly outcome: string; readonly memoryLimit: { readonly bytes: number; readonly mechanism: string } } | undefined {
+  if (spawn.limitBytes === undefined || status !== MEMORY_BOUND_EXIT_STATUS) return undefined;
+  return { outcome: MEMORY_LIMIT_EXCEEDED, memoryLimit: { bytes: spawn.limitBytes, mechanism: ADDRESS_SPACE_MECHANISM } };
+}

package/src/host-admission.ts

@@ -24,11 +24,20 @@ export function admittedHostOf(profile: HostProfile): AdmittedHost | undefined {
 
 /**
  * plugin-hostd's LV2 adapter, omx-clap-host: an LV2 plugin is run under it once, as under mod-host, and the record
- * carries the outcome as its own step beside the verdicts (plugin-qualify#223), which it does not change: the
- * omx-clap-host verdict of an LV2 plugin stays the in-process measurement. It is what the removal of mod-host counts.
+ * carries the outcome as its own step (plugin-qualify#223). The run decides the omx-clap-host verdict of an LV2
+ * plugin, the isolated tier, as a mod-host run decides mod-host's; a CLAP plugin's stays the measurement.
  */
 export const ADAPTER_HOST = "omx-clap-host";
 
+/**
+ * Whether this run decides the profile's verdict for a plugin of this format. A mod-host or jalv run always does, an
+ * unmeasured one making the verdict unknown; the adapter's only when it measured, since the omx-clap-host verdict
+ * otherwise stands on the measurement.
+ */
+export function runDecides(profile: HostProfile, format: string, admission: HostAdmission): boolean {
+  return admittedHostOf(profile) !== undefined || (profile.id === ADAPTER_HOST && format === "lv2" && admission.measured);
+}
+
 /** What running the plugin under one host came to. */
 export interface HostAdmission {
   readonly host: AdmittedHost | typeof ADAPTER_HOST;
@@ -62,12 +71,16 @@ export interface ModHostStep {
 /** What `tools/mod-host-admit.mjs` printed. */
 export interface ModHostRun {
   readonly installed: boolean;
+  /** False when the host never took a connection (omx-clap-host with no JACK server): no plugin was loaded. */
+  readonly started?: boolean;
   readonly steps: readonly ModHostStep[];
 }
 
 /** The verdict of a run of a host that speaks mod-host's protocol: the first step that did not answer `resp 0` decides. */
 export function classifyProtocolRun(host: ProtocolHost, run: ModHostRun): HostAdmission {
   if (!run.installed) return notInstalled(host);
+  // the host never listened, so the plugin was never loaded: nothing was learned about it
+  if (run.started === false) return { host, measured: false, admitted: false, code: `${host}.not-started`, params: {} };
   for (const s of run.steps) {
     if (s.died !== undefined) {
       if (s.died.startsWith("SIG")) return refused(host, `signal-${s.died}`, { step: s.cmd });

package/src/host-profiles.ts

@@ -164,8 +164,24 @@ export const OMX_CLAP_HOST_PROFILE: HostProfile = {
   isolation: "shared-process",
 };
 
+/**
+ * A Raspberry Pi with 4 GB, and with 8 GB: what runs a plugin there is omx-clap-host under plugin-hostd, so the same
+ * extensions, instruments and isolation, on the rates, quanta and memory of the board. Its memory budget is provisional
+ * ({@link HOST_BUDGETS}), so a plugin under it is `conditional` until the numbers are measured on a Pi, and the reason says
+ * so. Judged at every cell the board runs.
+ */
+export const PI_4GB_PROFILE: HostProfile = { ...OMX_CLAP_HOST_PROFILE, id: "openmixer-pi-4gb", cost: HOST_BUDGETS["openmixer-pi-4gb"] };
+export const PI_8GB_PROFILE: HostProfile = { ...OMX_CLAP_HOST_PROFILE, id: "openmixer-pi-8gb", cost: HOST_BUDGETS["openmixer-pi-8gb"] };
+
 /** Every profile the tool ships, by id. */
-export const HOST_PROFILES: readonly HostProfile[] = [OPENMIXER_CONSOLE_PROFILE, JALV_PROFILE, MOD_HOST_PROFILE, OMX_CLAP_HOST_PROFILE];
+export const HOST_PROFILES: readonly HostProfile[] = [
+  OPENMIXER_CONSOLE_PROFILE,
+  JALV_PROFILE,
+  MOD_HOST_PROFILE,
+  OMX_CLAP_HOST_PROFILE,
+  PI_4GB_PROFILE,
+  PI_8GB_PROFILE,
+];
 
 /** A shipped profile by id, or `undefined`. */
 export function shippedHostProfile(id: string): HostProfile | undefined {

package/src/hosting-codes.generated.ts

@@ -32,6 +32,10 @@ export const HOSTING_CODE = Object.freeze({
   "latencyParameterDependent": "hosting.latency.parameter-dependent",
   "latencyResolved": "hosting.latency.resolved",
   "latencyUnmeasured": "hosting.latency.unmeasured",
+  "memoryAboveCeiling": "hosting.memory.above-ceiling",
+  "memoryUnmeasured": "hosting.memory.unmeasured",
+  "memoryWithinCeiling": "hosting.memory.within-ceiling",
+  "memoryWithinProvisionalCeiling": "hosting.memory.within-provisional-ceiling",
   "outputNonFinite": "hosting.output.non-finite",
   "overrideIsolated": "hosting.override.curator-isolated",
   "patchBusy": "hosting.patch.busy",
@@ -45,6 +49,9 @@ export const HOSTING_CODE = Object.freeze({
   "noRealisation": "hosting.no-realisation",
   "realisedInProcess": "hosting.realised.in-process",
   "unjudged": "hosting.unjudged",
+  "resourceHintsOutOfRange": "hosting.resource-hints.out-of-range",
+  "resourceHintsUnknownHint": "hosting.resource-hints.unknown-hint",
+  "resourceHintsWrongUnit": "hosting.resource-hints.wrong-unit",
   "rtSafetyClean": "hosting.rt-safety.clean-under-sweep",
   "rtSafetyNotReproducible": "hosting.rt-safety.not-reproducible",
   "rtSafetyNotesClean": "hosting.rt-safety.clean-under-notes",
@@ -81,4 +88,7 @@ export const HOSTING_CODE = Object.freeze({
   "topologyWiderThanStrip": "hosting.topology.wider-than-strip",
   "workerNonconforming": "hosting.worker.nonconforming",
   "idleHoldRefused": "hosting.idle.hold-refused",
+  "windowNoDisplay": "hosting.window.no-display",
+  "windowUnsupported": "hosting.window.unsupported",
+  "windowRefused": "hosting.window.refused",
 } as const);

package/src/hosting-suitability.ts

@@ -30,6 +30,7 @@ import type {
   SoakReading,
   ThreadReading,
 } from "./measurement/format.js";
+import { memoryWithinBudget, type MemoryReadings } from "./memory-budget.js";
 
 /**
  * What a reason may interpolate: wire-serialisable scalars only. Structurally the same record as
@@ -71,6 +72,8 @@ export interface QualifiedPlugin {
   readonly lv2Features?: PluginLv2Features;
   /** The plugin's binary format, the scan's declared fact (CLAP spec §6); absent reads `lv2`. */
   readonly format?: "lv2" | "clap";
+  /** What one instance holds: per rate, or per rate AND quantum as {@link cpuCost} has it. A missing cell is unmeasured. */
+  readonly memory?: MemoryReadings;
   /** What the CLAP prober (`native/clap-qualify`) measured, for a `clap` plugin (CLAP spec §3). */
   readonly clap?: PluginClapMeasurement;
 }
@@ -78,14 +81,15 @@ export interface QualifiedPlugin {
 /** Where a plugin's audio is actually processed. */
 export type HostingPath = "in-process" | "isolated";
 
-/** The dimensions that decide a host. Six, folded worst-wins. */
+/** The dimensions that decide a host, folded worst-wins. */
 export type HostingDimension =
   | "stability"
   | "rtSafety"
   | "features"
   | "cost"
   | "latency"
-  | "topology";
+  | "topology"
+  | "memory";
 
 // The in-process feature list and the CLAP host extensions are the `openmixer-console` host
 // profile's; they live with the profiles (`host-profiles.ts`) and are re-exported here, where the
@@ -446,13 +450,15 @@ export function deadAgainstBest(levelDbfs: number, bestDbfs: number, policy: Hos
 }
 
 /** The classes of soak failure, as the strings `failures` is built from. */
-export type SoakFailureKind = "died" | "non-finite" | "dead" | "mostly-silent" | "startup-blast" | "timed-out";
+export type SoakFailureKind = "died" | "non-finite" | "dead" | "mostly-silent" | "startup-blast" | "timed-out" | "leaks";
 
 export interface SoakFailure {
   readonly rate: number;
   readonly kind: SoakFailureKind;
   /** Extra words for the string form, e.g. `20dBFS`. */
   readonly detail?: string;
+  /** For `leaks`: what the growth was and the ceiling it passed, which the reason carries. */
+  readonly params?: CodedRefusalParams;
 }
 
 /** A soak's reading: what voided it, if anything, and what it proved when nothing did. */
@@ -465,7 +471,7 @@ export interface SoakFindings {
    *  cut, a fact about the harness: it voids the soak but is never a failure of the plugin. */
   readonly failed: readonly SoakFailure[];
   readonly ratesTested: number;
-  /** The largest RSS growth across rates, for the record; not judged. */
+  /** The largest RSS growth across rates, warm-up included, for the record; `leaks` is what is judged. */
   readonly rssGrowthKb: number;
 }
 
@@ -473,6 +479,17 @@ export interface SoakFindings {
  *  settled above it cannot be the reference, or every sane rate reads dead against it. */
 const BLAST_DBFS = 6;
 
+/**
+ * The growth a rate's soak is still showing, in KB per minute of audio: from halfway past warm-up to its highest reading,
+ * so that a library that finishes loading a little late is not a leak and a leak of any size is. `undefined` when the soak
+ * did not reach those readings: not read as flat.
+ */
+export function soakGrowthKbPerMin(v: SoakAtRate): number | undefined {
+  const { rssMidKb, midSeconds, rssMaxKb, seconds } = v;
+  if (rssMidKb === undefined || midSeconds === undefined || rssMaxKb === undefined || seconds === undefined || seconds <= midSeconds) return undefined;
+  return (Math.max(rssMaxKb - rssMidKb, 0) * 60) / (seconds - midSeconds);
+}
+
 /**
  * Read a soak, rate by rate. A rate voids it if the plugin did not instantiate or died there,
  * emitted a non-finite window, settled dead against its own best rate ({@link deadAgainstBest};
@@ -516,7 +533,23 @@ export function soakFindings(soak: SoakReading | undefined, policy: HostingPolic
       continue;
     }
     const first = v.firstRmsDbfs ?? -99;
-    if (first > BLAST_DBFS) failed.push({ rate, kind: "startup-blast", detail: `${first.toFixed(0)}dBFS` });
+    if (first > BLAST_DBFS) {
+      failed.push({ rate, kind: "startup-blast", detail: `${first.toFixed(0)}dBFS` });
+      continue;
+    }
+    const growth = soakGrowthKbPerMin(v);
+    if (growth !== undefined && growth > policy.memoryGrowthKbPerMinCeiling) {
+      failed.push({
+        rate,
+        kind: "leaks",
+        detail: `${growth.toFixed(0)}KB/min`,
+        params: {
+          growthKbPerMin: Math.round(growth),
+          ceilingKbPerMin: policy.memoryGrowthKbPerMinCeiling,
+          ...(policy.memoryGrowthCeilingProvisional ? { provisional: "yes" as const } : {}),
+        },
+      });
+    }
   }
   const failures = failed.map((f) => `${f.kind}@${f.rate}${f.detail === undefined ? "" : `(${f.detail})`}`);
   return {
@@ -592,6 +625,7 @@ export function stabilityReasons(
       reason("stability", "objective", "unsuitable", HOSTING_CODE.stabilitySoakFailedAtRate, {
         failure: f.kind,
         rate: f.rate,
+        ...f.params,
       }),
     );
   }
@@ -650,9 +684,11 @@ export function rtSafetyReasons(
   if (m.variable === true) {
     return [reason("rtSafety", "objective", "unknown", HOSTING_CODE.rtSafetyNotReproducible)];
   }
+  // RT-unsafe is a hosting mode, never a refusal (#196): the plugin loads and runs in a worker of its own, never
+  // grouped with RT-safe plugins; conditional is isolated in the pin. Crashes, hangs and load failures stay unsuitable.
   if (rtSafetyViolating(m)) {
     return [
-      reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.rtSafetyViolations, {
+      reason("rtSafety", "objective", "conditional", HOSTING_CODE.rtSafetyViolations, {
         allocations: m.allocationsInRun ?? 0,
         syscalls: m.syscallsInRun ?? 0,
         locks: m.locksInRun ?? 0,
@@ -777,6 +813,60 @@ export function hostingCostReasons(
   return out;
 }
 
+/**
+ * What a host's memory budget makes of a plugin. A host with no budget declared reads nothing here. Every cell the host
+ * runs is read; the worst stands, so a plugin is never read as fitting on the cell that happened to be measured. A missing
+ * figure is `unknown`, never a fit. Under a provisional budget a plugin below the ceiling is `conditional` with a code of its
+ * own, since the number it was held to was not measured on that kind of host; one above it is `unsuitable` and says the
+ * ceiling is provisional.
+ */
+export function hostingMemoryReasons(
+  memory: MemoryReadings | undefined,
+  profile: HostProfile,
+  /** The live rate and quantum, for a host whose budget names no cells of its own; absent, the cell its cost is read at. */
+  live?: { readonly rate: number; readonly quantum?: number },
+): readonly HostingReason[] {
+  const budget = profile.cost.memory;
+  if (budget === undefined) return [];
+  const provisional: CodedRefusalParams = budget.provisional === true ? { provisional: "yes" } : {};
+  const cells = budget.cells ?? [{ rate: live?.rate ?? profile.cost.rate, quantum: live?.quantum ?? profile.cost.quantum }];
+  const reads = cells.map((c) => ({ ...c, read: memoryWithinBudget(memoryAt(memory, c.rate, c.quantum), budget) }));
+  const above = reads.find((r) => r.read.outcome === "above");
+  if (above !== undefined && above.read.outcome === "above") {
+    return [
+      reason("memory", "objective", "unsuitable", HOSTING_CODE.memoryAboveCeiling, {
+        rate: above.rate,
+        quantum: above.quantum,
+        figure: above.read.figure,
+        kb: above.read.kb,
+        ceilingKb: above.read.ceilingKb,
+        ...provisional,
+      }),
+    ];
+  }
+  const unmeasured = reads.find((r) => r.read.outcome === "unmeasured");
+  if (unmeasured !== undefined && unmeasured.read.outcome === "unmeasured") {
+    return [
+      reason("memory", "objective", "unknown", HOSTING_CODE.memoryUnmeasured, {
+        rate: unmeasured.rate,
+        quantum: unmeasured.quantum,
+        ...(unmeasured.read.unmeasuredReason === undefined ? {} : { unmeasuredReason: unmeasured.read.unmeasuredReason }),
+      }),
+    ];
+  }
+  const first = reads[0]!.read;
+  const params: CodedRefusalParams = first.outcome === "within" ? { perInstanceKb: first.perInstanceKb, firstInstanceKb: first.firstInstanceKb, ceilingKb: budget.perInstanceKb, consoleCeilingKb: budget.perConsoleKb } : {};
+  return budget.provisional === true
+    ? [reason("memory", "objective", "conditional", HOSTING_CODE.memoryWithinProvisionalCeiling, { ...params, ...provisional })]
+    : [reason("memory", "objective", "suitable", HOSTING_CODE.memoryWithinCeiling, params)];
+}
+
+/** The footprint at a rate and quantum: a grid's cell when the plugin has a grid, else its rate's. */
+function memoryAt(memory: MemoryReadings | undefined, rate: number, quantum: number) {
+  if (memory?.perRateQuantum !== undefined) return memory.perRateQuantum[costPointKey(rate, quantum)];
+  return memory?.perRate?.[String(rate)];
+}
+
 export function hostingLatencyReasons(
   descriptor: Pick<QualifiedPlugin, "latency">,
   handling: HostProfile["latency"] = "compensated",
@@ -924,7 +1014,8 @@ export function clapFeatureReasons(
 /**
  * The CLAP additions to `rtSafety` (CLAP spec §3): the interposer's counts are read by
  * `rtSafetyReasons` exactly as for an LV2; these are the two violations only a CLAP can commit
- * — a strict thread-check violation and a `CLAP_PROCESS_ERROR` — each `unsuitable`. A sweep
+ * — a strict thread-check violation (`conditional`: the plugin runs isolated, #196) and a `CLAP_PROCESS_ERROR`
+ * (`unsuitable`). A sweep
  * that made no `process()` call measured nothing.
  */
 export function clapRtReasons(clap: PluginClapMeasurement | undefined): readonly HostingReason[] {
@@ -933,7 +1024,7 @@ export function clapRtReasons(clap: PluginClapMeasurement | undefined): readonly
   }
   const out: HostingReason[] = [];
   if (clap.threadViolations > 0) {
-    out.push(reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.clapThreadViolation, { violations: clap.threadViolations }));
+    out.push(reason("rtSafety", "objective", "conditional", HOSTING_CODE.clapThreadViolation, { violations: clap.threadViolations }));
   }
   if (clap.processErrors > 0) {
     out.push(reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.clapProcessError, { errors: clap.processErrors }));
@@ -945,8 +1036,9 @@ export function clapRtReasons(clap: PluginClapMeasurement | undefined): readonly
  * The rtSafety reasons of the note sweep, for a plugin with `noteInputs` note inputs: none for a
  * plugin that takes no notes; `unknown` when it takes notes and was not played under the
  * interposer (an instrument is cheap and clean at rest, so the parameter sweep alone says nothing
- * about a voice); `unsuitable` on any allocation, lock or syscall while it was played, or a process
- * error; `suitable` on a clean count.
+ * about a voice); `conditional` (isolated in the pin: its own worker, never refused) on any
+ * allocation, lock or syscall while it was played; `unsuitable` on a process error only (a crash);
+ * `suitable` on a clean count.
  */
 export function noteSweepReasons(sweep: PluginNoteSweepMeasurement | undefined, noteInputs: number): readonly HostingReason[] {
   if (noteInputs === 0) return [];
@@ -957,7 +1049,7 @@ export function noteSweepReasons(sweep: PluginNoteSweepMeasurement | undefined,
   const out: HostingReason[] = [];
   if (sweep.allocationsInRun + sweep.locksInRun + sweep.syscallsInRun > 0) {
     out.push(
-      reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.rtSafetyNotesViolations, {
+      reason("rtSafety", "objective", "conditional", HOSTING_CODE.rtSafetyNotesViolations, {
         allocations: sweep.allocationsInRun,
         syscalls: sweep.syscallsInRun,
         locks: sweep.locksInRun,
@@ -1002,6 +1094,7 @@ export function classifyPluginHosting(
         ...(profile.instruments ? noteSweepReasons(descriptor.rtSafety?.noteSweep, descriptor.clap?.noteInputs ?? (descriptor.hasMidiIn ? 1 : 0)) : []),
         ...clapFeatureReasons(descriptor.clap, profile, descriptor.hasMidiIn),
         ...hostingCostReasons(descriptor, options, policy),
+        ...hostingMemoryReasons(descriptor.memory, profile, options),
         ...clapLatencyReasons(descriptor.clap),
         ...clapTopologyReasons(descriptor.clap, profile.instruments),
       ]
@@ -1011,6 +1104,7 @@ export function classifyPluginHosting(
         ...(profile.instruments ? noteSweepReasons(descriptor.rtSafety?.noteSweep, descriptor.hasMidiIn ? 1 : 0) : []),
         ...featureReasons(descriptor.lv2Features, descriptor, profile.lv2Features, options.quantum !== undefined, profile.instruments),
         ...hostingCostReasons(descriptor, options, policy),
+        ...hostingMemoryReasons(descriptor.memory, profile, options),
         ...hostingLatencyReasons(descriptor, profile.latency),
         ...hostingTopologyReasons(descriptor, profile.instruments),
       ];

package/src/index.ts

@@ -10,6 +10,7 @@ export * from "./tool-paths.js";
 export * from "./rating.js";
 export * from "./host-profiles.js";
 export * from "./hosting-suitability.js";
+export * from "./memory-budget.js";
 export * from "./hosting-codes.js";
 export * from "./loader.js";
 export * from "./lv2-loader.js";

package/src/measurement/format.ts

@@ -78,8 +78,10 @@ export const MEASUREMENT_FORMAT_MAJOR = 1;
  *  {@link RtSafetyMeasurement}, {@link FeaturesMeasurement} — which a 1.0 reader skips.
  *  `1.2` added the verdicts per host profile; `1.3` the {@link IntegrityMeasurement} block; `1.4` the notes
  *  an instrument's cost was measured with ({@link CostAtRate.voices}); `1.5` the note sweep an instrument's
- *  `run()` was counted under ({@link RtSafetyMeasurement.noteSweep}). */
-export const MEASUREMENT_FORMAT_MINOR = 5;
+ *  `run()` was counted under ({@link RtSafetyMeasurement.noteSweep}); `1.6` an instance's memory footprint
+ *  beside the cost reading ({@link CostAtRate.memory}), the soak's readings past warm-up
+ *  ({@link SoakAtRate.rssAfterWarmupKb}), and a host profile's memory budget ({@link HostBudget.memory}). */
+export const MEASUREMENT_FORMAT_MINOR = 6;
 
 /** The version string this build writes, e.g. `"1.0"`. */
 export const MEASUREMENT_FORMAT_VERSION = `${MEASUREMENT_FORMAT_MAJOR}.${MEASUREMENT_FORMAT_MINOR}`;
@@ -285,6 +287,28 @@ export interface VoicesHeld {
   readonly capacity?: number;
 }
 
+/**
+ * 1.6: what one instance holds at this rate: how far the resident set of a process of its own grew from before the
+ * plugin loaded, in KB, at each step of its life. Raw readings, never a conclusion: `memory-budget.ts` reads them against
+ * a budget. `secondInstanceKb` is what a second instance added once it had done the same, so what one instance costs is
+ * told from what every instance shares (a sample library, a wavetable, an IR). `notesHeldKb` and its `basis` are an
+ * instrument's, at the notes the cost arm holds.
+ *
+ * A figure not taken is absent, never 0; `unmeasuredReason` (an {@link ../vocabulary.UNMEASURED_TERMS} code) says why
+ * one that should be there is not, and may stand beside the figures that were taken.
+ */
+export interface MemoryFootprint {
+  readonly afterInstantiateKb?: number;
+  readonly afterActivateKb?: number;
+  /** Activated, after processing: what a long-running host carries. */
+  readonly atRestKb?: number;
+  readonly notesHeldKb?: number;
+  readonly secondInstanceKb?: number;
+  readonly basis?: VoiceBasis;
+  readonly unmeasuredReason?: string;
+  readonly unmeasuredDetail?: string;
+}
+
 /** One rate's cost reading. Per SAMPLE, so it is independent of the block size. */
 export interface CostAtRate {
   readonly nsPerSampleMedian: number;
@@ -303,6 +327,8 @@ export interface CostAtRate {
   readonly silentOutput?: boolean;
   /** 1.4: for an instrument, the notes held while it was timed. Absent for an effect. */
   readonly voices?: VoicesHeld;
+  /** 1.6: this instance's memory footprint at the same rate. */
+  readonly memory?: MemoryFootprint;
 }
 
 /** Everything one run learned about one plugin's CPU cost. */
@@ -368,6 +394,12 @@ export interface SoakAtRate {
   readonly rssStartKb?: number;
   readonly rssMaxKb?: number;
   readonly rssGrowthKb?: number;
+  /** 1.6: the resident set past the settling `firstRmsDbfs` skips, and the audio-seconds to reach it. */
+  readonly rssAfterWarmupKb?: number;
+  readonly warmupSeconds?: number;
+  /** 1.6: the resident set halfway from there to the end, so that growth which stopped is told from growth still climbing. */
+  readonly rssMidKb?: number;
+  readonly midSeconds?: number;
 }
 
 /** A continuous soak, per rate, with whether the controls were swept while it ran. */
@@ -501,6 +533,22 @@ export interface HostBudget {
   readonly coreFractionCeiling: number;
   readonly rate: number;
   readonly quantum: number;
+  /** 1.6: what this host gives its plugins' memory; absent is a host with no budget declared, never a budget of 0. */
+  readonly memory?: HostMemoryBudget;
+}
+
+/**
+ * 1.6: a host's memory budget, and where it is read. `perInstanceKb` bounds what one more instance costs;
+ * `perConsoleKb` bounds all the plugins of the host, so the most one plugin may take with what its instances share.
+ * `provisional` says the numbers were not measured on that kind of host: a verdict that rests on them says so and does
+ * not say the plugin fits. `cells` are the rates and quanta the host runs, each judged, where it runs more than the one
+ * its cost is read at.
+ */
+export interface HostMemoryBudget {
+  readonly perInstanceKb: number;
+  readonly perConsoleKb: number;
+  readonly provisional?: boolean;
+  readonly cells?: readonly { readonly rate: number; readonly quantum: number }[];
 }
 
 /**
@@ -554,6 +602,24 @@ const isPositive = (v: unknown): v is number => typeof v === "number" && Number.
  * typed; a missing or mistyped one is refused by name, and a host the reader was not told about
  * is never filled in from a default.
  */
+/** A budget, `undefined` for none declared, or the words of what is wrong with it. */
+function readHostMemoryBudget(value: unknown): HostMemoryBudget | undefined | string {
+  if (value === undefined) return undefined;
+  if (!isRecord(value)) return "cost.memory: an object, or absent";
+  if (!isPositive(value.perInstanceKb) || !isPositive(value.perConsoleKb)) return "cost.memory: perInstanceKb and perConsoleKb are positive numbers";
+  if (value.provisional !== undefined && typeof value.provisional !== "boolean") return "cost.memory.provisional: a boolean, or absent";
+  const cells = value.cells;
+  if (cells !== undefined && (!Array.isArray(cells) || cells.length === 0 || !cells.every((c) => isRecord(c) && Number.isInteger(c.rate) && Number.isInteger(c.quantum) && isPositive(c.rate) && isPositive(c.quantum)))) {
+    return "cost.memory.cells: rates and quanta as positive integers, or absent";
+  }
+  return {
+    perInstanceKb: value.perInstanceKb,
+    perConsoleKb: value.perConsoleKb,
+    ...optional("provisional", value.provisional as boolean | undefined),
+    ...optional("cells", (cells as readonly Record<string, number>[] | undefined)?.map((c) => ({ rate: c.rate!, quantum: c.quantum! }))),
+  };
+}
+
 export function readHostProfile(value: unknown): HostProfileRead {
   if (!isRecord(value)) return { ok: false, problem: "a host profile is a JSON object" };
   const { id, lv2Features, clapExtensions, instruments, cost, latency, isolation } = value;
@@ -569,6 +635,8 @@ export function readHostProfile(value: unknown): HostProfileRead {
   if (!Number.isInteger(cost.rate) || !Number.isInteger(cost.quantum)) {
     return { ok: false, problem: "cost: rate and quantum are integers" };
   }
+  const memory = readHostMemoryBudget(cost.memory);
+  if (typeof memory === "string") return { ok: false, problem: memory };
   if (!(HOST_LATENCY_HANDLING as readonly unknown[]).includes(latency)) {
     return { ok: false, problem: `latency: one of ${HOST_LATENCY_HANDLING.join(", ")}` };
   }
@@ -582,7 +650,7 @@ export function readHostProfile(value: unknown): HostProfileRead {
       lv2Features,
       clapExtensions,
       instruments,
-      cost: { coreFractionCeiling: cost.coreFractionCeiling, rate: cost.rate, quantum: cost.quantum },
+      cost: { coreFractionCeiling: cost.coreFractionCeiling, rate: cost.rate, quantum: cost.quantum, ...optional("memory", memory) },
       latency: latency as HostLatencyHandling,
       isolation: isolation as HostIsolation,
     },
@@ -851,6 +919,27 @@ function readLatency(value: unknown): LatencyMeasurement | undefined {
   };
 }
 
+/** A KB figure: finite and never negative. */
+function kilobytes(value: unknown): number | undefined {
+  const n = finiteNumber(value);
+  return n !== undefined && n >= 0 ? n : undefined;
+}
+
+/** A memory footprint, or `undefined` unless it carries at least one figure or a reason. */
+export function readMemoryFootprint(value: unknown): MemoryFootprint | undefined {
+  if (!isRecord(value)) return undefined;
+  const footprint: MemoryFootprint = {
+    ...optional("afterInstantiateKb", kilobytes(value.afterInstantiateKb)),
+    ...optional("afterActivateKb", kilobytes(value.afterActivateKb)),
+    ...optional("atRestKb", kilobytes(value.atRestKb)),
+    ...optional("notesHeldKb", kilobytes(value.notesHeldKb)),
+    ...optional("secondInstanceKb", kilobytes(value.secondInstanceKb)),
+    ...optional("basis", isVoiceBasis(value.basis) ? value.basis : undefined),
+    ...reasonOf(value),
+  };
+  return Object.keys(footprint).length > 0 ? footprint : undefined;
+}
+
 function readCostAtRate(value: unknown): CostAtRate | undefined {
   if (!isRecord(value)) return undefined;
   const nsPerSampleMedian = finiteNumber(value.nsPerSampleMedian);
@@ -875,6 +964,7 @@ function readCostAtRate(value: unknown): CostAtRate | undefined {
     ...optional("warmupNsPerSampleMedian", finiteNumber(value.warmupNsPerSampleMedian)),
     ...optional("silentOutput", booleanValue(value.silentOutput)),
     ...optional("voices", readVoicesHeld(value.voices)),
+    ...optional("memory", readMemoryFootprint(value.memory)),
   };
 }
 
@@ -957,6 +1047,10 @@ export function readSoakAtRate(value: unknown): SoakAtRate | undefined {
     ...optional("rssStartKb", finiteNumber(value.rssStartKb)),
     ...optional("rssMaxKb", finiteNumber(value.rssMaxKb)),
     ...optional("rssGrowthKb", finiteNumber(value.rssGrowthKb)),
+    ...optional("rssAfterWarmupKb", kilobytes(value.rssAfterWarmupKb)),
+    ...optional("warmupSeconds", finiteNumber(value.warmupSeconds)),
+    ...optional("rssMidKb", kilobytes(value.rssMidKb)),
+    ...optional("midSeconds", finiteNumber(value.midSeconds)),
   };
 }
 

package/src/measurement/plan.ts

@@ -38,7 +38,7 @@ export interface InstallationRates {
   readonly liveRate?: number;
   /** Rates the active device actually offers. Empty/absent = the console has not probed. */
   readonly supportedRates?: readonly number[];
-  /** Rates the operator asked for. Absent = "whatever this installation can use". */
+  /** Rates the caller asked for. Absent = "whatever this installation can use". */
   readonly requestedRates?: readonly number[];
 }
 
@@ -47,7 +47,7 @@ export interface RatePlan {
   /** Rates to measure, ascending. Empty when nothing could be resolved. */
   readonly rates: readonly number[];
   /**
-   * Rates the operator asked for that the installation does not offer. Reported, not
+   * Rates the caller asked for that the installation does not offer. Reported, not
    * measured — a figure at a rate the rig cannot run is a figure nobody will ever use, and
    * quietly measuring it would make the run longer for nothing.
    */
@@ -63,7 +63,7 @@ export interface RatePlan {
  * Resolve the rates a local run should measure at.
  *
  * The live rate is always included when known — a console must have figures for the rate it
- * is running at, whatever else the operator asked for. Beyond that: the requested rates
+ * is running at, whatever else the caller asked for. Beyond that: the requested rates
  * intersected with what the device offers, or, absent a request, the whole supported list.
  */
 export function ratesForInstallation(input: InstallationRates): RatePlan {