@openmixer/plugin-qualify 0.17.4 → 0.18.0

package/src/measurement-grid.ts

@@ -72,6 +72,11 @@ export function gridCells(
   return unique([...lead.filter((c) => inProduct.has(cellKey(c))), ...product]);
 }
 
+/** The cells a host is judged at: the one its cost is read at, then the others its memory budget says it runs. */
+export function hostCells(profile: { readonly cost: GridCell & { readonly memory?: { readonly cells?: readonly GridCell[] } } }): GridCell[] {
+  return unique([{ rate: profile.cost.rate, quantum: profile.cost.quantum }, ...(profile.cost.memory?.cells ?? [])]);
+}
+
 /** The first `budget` cells, or every one when the budget is absent or 0. */
 export function budgetCells(cells: readonly GridCell[], budget: number | undefined): GridCell[] {
   return budget === undefined || budget === 0 ? [...cells] : cells.slice(0, budget);

package/src/memory-bound.ts

@@ -17,9 +17,18 @@ import { MEMORY_BOUND_EXIT_STATUS, MEMORY_LIMIT_RAM_FRACTION } from "./qualify-d
 /** How the bound is applied: the runner's data limit on the child. */
 export const MEMORY_BOUND_MECHANISM = "rlimit-data";
 
+/** How the bound was applied when the runner set it as its cgroup's `memory.max`, which its document says. */
+export const MEMORY_CGROUP_MECHANISM = "cgroup-memory-max";
+
 /** The outcome of a run, and of each of its cells, that outgrew the bound. */
 export const PROBE_OOM = "probe.oom";
 
+/** The runner's own outcome for a child the kernel killed at its cgroup's `memory.max`. */
+export const PROBE_MEMORY_LIMIT = "probe.memory-limit";
+
+/** Whether an outcome says a run outgrew its memory limit, by either bound. */
+export const isOutOfMemory = (outcome: string): boolean => outcome === PROBE_OOM || outcome === PROBE_MEMORY_LIMIT;
+
 export interface MemoryBound {
   readonly bytes: number;
   readonly mechanism: typeof MEMORY_BOUND_MECHANISM;
@@ -50,6 +59,7 @@ export function memoryBoundOf(setting: number | "off" | undefined, ramBytes?: nu
 
 /** Whether a run under `bound` ended out of memory: the interposer's exit status, or a SIGKILL that was no deadline's. */
 export function outOfMemory(output: ProbeOutput, bound: MemoryBound | undefined): boolean {
+  if (output.run.outcome === PROBE_MEMORY_LIMIT || output.steps.some((s) => s.outcome === PROBE_MEMORY_LIMIT)) return true;
   if (bound === undefined) return false;
   return output.steps.some((s) => s.exitStatus === MEMORY_BOUND_EXIT_STATUS || (s.signal === "SIGKILL" && s.outcome === "probe.crashed"));
 }

package/src/memory-budget.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * What a measured footprint comes to, and whether it fits a host's budget. Pure: the readings come from the measurers, the
+ * budget from the host profile, and the verdict's reasons from `hosting-suitability.ts`.
+ *
+ * Two figures come out of a footprint. `firstInstanceKb` is the most one instance held at any step, with everything its
+ * instances share. `perInstanceKb` is what one more instance costs: the second instance's own part and its voices. A host's
+ * `perInstanceKb` bounds the second and its `perConsoleKb` the first, so a sampler with a large library shared between
+ * instances can fit a small host once and still be read correctly for two.
+ *
+ * Nothing absent reads as fitting: no figure, or a reason beside the figures, is `unmeasured`.
+ */
+import type { HostMemoryBudget, MemoryFootprint } from "./measurement/format.js";
+
+/** A plugin's footprints as a verdict reads them: per rate, or per rate and quantum (a probe output's grid). */
+export interface MemoryReadings {
+  readonly perRate?: Readonly<Record<string, MemoryFootprint>>;
+  readonly perRateQuantum?: Readonly<Record<string, MemoryFootprint>>;
+}
+
+/** The most one instance held at any step, with everything its instances share. `undefined` for no figure. */
+export function firstInstanceKb(f: MemoryFootprint): number | undefined {
+  const figures = [f.afterInstantiateKb, f.afterActivateKb, f.atRestKb, f.notesHeldKb].filter((v): v is number => v !== undefined);
+  return figures.length === 0 ? undefined : Math.max(...figures);
+}
+
+/**
+ * What one more instance costs: the second instance's own part and the voices of this one. With no second instance
+ * measured, the whole of the first, since nothing separates what it shares.
+ */
+export function perInstanceKb(f: MemoryFootprint): number | undefined {
+  const first = firstInstanceKb(f);
+  if (first === undefined) return undefined;
+  if (f.secondInstanceKb === undefined) return first;
+  const voices = f.notesHeldKb !== undefined && f.atRestKb !== undefined ? Math.max(f.notesHeldKb - f.atRestKb, 0) : 0;
+  return f.secondInstanceKb + voices;
+}
+
+export type MemoryBudgetRead =
+  | { readonly outcome: "within"; readonly perInstanceKb: number; readonly firstInstanceKb: number }
+  | { readonly outcome: "above"; readonly figure: "perInstance" | "firstInstance"; readonly kb: number; readonly ceilingKb: number }
+  | { readonly outcome: "unmeasured"; readonly unmeasuredReason?: string };
+
+/** A footprint against a budget. A missing figure is `"unmeasured"`, never a fit; a figure above a ceiling is above it whatever else is missing. */
+export function memoryWithinBudget(footprint: MemoryFootprint | undefined, budget: HostMemoryBudget): MemoryBudgetRead {
+  const first = footprint === undefined ? undefined : firstInstanceKb(footprint);
+  const per = footprint === undefined ? undefined : perInstanceKb(footprint);
+  if (first !== undefined && first > budget.perConsoleKb) return { outcome: "above", figure: "firstInstance", kb: first, ceilingKb: budget.perConsoleKb };
+  if (per !== undefined && per > budget.perInstanceKb) return { outcome: "above", figure: "perInstance", kb: per, ceilingKb: budget.perInstanceKb };
+  if (first === undefined || per === undefined || footprint?.unmeasuredReason !== undefined) {
+    return { outcome: "unmeasured", ...(footprint?.unmeasuredReason === undefined ? {} : { unmeasuredReason: footprint.unmeasuredReason }) };
+  }
+  return { outcome: "within", perInstanceKb: per, firstInstanceKb: first };
+}

package/src/probe-judge.ts

@@ -24,21 +24,23 @@ import {
   type ClapRtSafetyReading,
   type RtSafetyDocument,
 } from "./clap-qualify.js";
-import { gridCostReadings } from "./cost-fields.js";
+import { costPointKey, gridCostReadings } from "./cost-fields.js";
 import {
   hostingCostReasons,
+  hostingMemoryReasons,
   noteSweepReasons,
   rtSafetyReasons,
   contributedHostingRating,
   type HostingReason,
 } from "./hosting-suitability.js";
 import type { HostProfile } from "./host-profiles.js";
-import { admittedHostOf, type HostAdmission } from "./host-admission.js";
+import { runDecides, type HostAdmission } from "./host-admission.js";
 import { PROBE_NOT_ATTEMPTED, PROBE_OK, type ProbeGridPoint, type ProbeOutput } from "./probe-output.js";
 import type { QualifyVerdict } from "./qualify-cli.js";
 import { RATING_SEVERITY, worstRating, type SuitabilityRating } from "./rating.js";
 import type { IntegrityMeasurement, VoicesHeld } from "./measurement/format.js";
-import { PROBE_OOM } from "./memory-bound.js";
+import { isOutOfMemory } from "./memory-bound.js";
+import type { MemoryFootprint } from "./measurement/format.js";
 
 /** Facts of the descriptor, which the probe output repeats none of. */
 export interface JudgeFacts {
@@ -202,6 +204,13 @@ function decidingOf(reasons: readonly RecordReason[], rating: SuitabilityRating)
   return [...reasons].sort((a, b) => RATING_SEVERITY[b.rating] - RATING_SEVERITY[a.rating]).find((r) => r.rating === rating);
 }
 
+/** The footprints of the cells that ran to their end, as the verdict reads them. */
+function gridMemoryReadings(output: ProbeOutput): Record<string, MemoryFootprint> {
+  const out: Record<string, MemoryFootprint> = {};
+  for (const p of output.grid) if (p.outcome === PROBE_OK && p.memory !== undefined) out[costPointKey(p.rate, p.quantum)] = p.memory;
+  return out;
+}
+
 /** The grid point at a host's own cell, whatever its outcome; `undefined` when the grid does not hold that cell. */
 function cellOf(output: ProbeOutput, profile: HostProfile): ProbeGridPoint | undefined {
   return output.grid.find((p) => p.rate === profile.cost.rate && p.quantum === profile.cost.quantum);
@@ -238,7 +247,7 @@ function costOf(output: ProbeOutput, profile: HostProfile): HostJudgment["cost"]
 function failedOutcome(output: ProbeOutput): string | undefined {
   if (output.run.outcome !== PROBE_OK) return output.run.outcome;
   // a cell that outgrew the memory bound is a recorded outcome of that cell, judged per host below, not the run's end
-  return output.grid.find((p) => p.outcome !== PROBE_OK && p.outcome !== PROBE_NOT_ATTEMPTED && p.outcome !== PROBE_OOM)?.outcome;
+  return output.grid.find((p) => p.outcome !== PROBE_OK && p.outcome !== PROBE_NOT_ATTEMPTED && !isOutOfMemory(p.outcome))?.outcome;
 }
 
 /**
@@ -282,11 +291,15 @@ export function judgeProbeOutput(output: ProbeOutput, profiles: readonly HostPro
     }
     // the plugin did not run within the memory bound at this host's own rate and quantum: not hostable there as measured
     const cell = cellOf(output, profile);
-    if (cell?.outcome === PROBE_OOM) {
-      reasons = [...reasons, { dimension: "memory", rating: "unknown", code: PROBE_OOM, params: { rate: cell.rate, quantum: cell.quantum, ...memoryParams(cell) } }];
+    if (cell !== undefined && isOutOfMemory(cell.outcome)) {
+      reasons = [...reasons, { dimension: "memory", rating: "unknown", code: cell.outcome, params: { rate: cell.rate, quantum: cell.quantum, ...memoryParams(cell) } }];
+    } else {
+      // what this host's budget makes of the footprint, every cell it runs: part of the verdict, unlike the cost beside it
+      reasons = [...reasons, ...hostingMemoryReasons({ perRateQuantum: gridMemoryReadings(output) }, profile).map(asRecordReason)];
     }
     const admission = facts.admissions?.[profile.id];
-    if (admission !== undefined && admittedHostOf(profile) !== undefined) {
+    const ran = admission !== undefined && runDecides(profile, output.plugin.format, admission);
+    if (ran && admission !== undefined) {
       if (!admission.measured || !admission.admitted) {
         // the host could not be run, or the plugin did not survive it: the run decides, whatever the declaration says
         const code = admission.code ?? `${admission.host}.not-admitted`;
@@ -312,7 +325,7 @@ export function judgeProbeOutput(output: ProbeOutput, profiles: readonly HostPro
         ...(deciding === undefined ? {} : { deciding: deciding.code }),
       },
       hosting: rating === "suitable" && profile.isolation === "in-process" ? "in-process" : "isolated",
-      arm: admission !== undefined && admittedHostOf(profile) !== undefined ? "run" : "declaration",
+      arm: ran ? "run" : "declaration",
       reasons,
       cost: costOf(output, profile),
     };

package/src/probe-merge.ts

@@ -14,7 +14,7 @@
  *
  * One run that ended well and needs nothing added is kept as the runner wrote it, byte for byte.
  */
-import { outOfMemory, PROBE_OOM, type MemoryBound } from "./memory-bound.js";
+import { isOutOfMemory, MEMORY_CGROUP_MECHANISM, outOfMemory, PROBE_MEMORY_LIMIT, PROBE_OOM, type MemoryBound } from "./memory-bound.js";
 import { cellKey, type RunnerInvocation } from "./measurement-grid.js";
 import { PROBE_OK, readProbeOutput, type ProbeOutput } from "./probe-output.js";
 
@@ -36,7 +36,8 @@ type Json = Record<string, unknown>;
 
 export function mergeProbeRuns(parts: readonly ProbeRunPart[], bound: MemoryBound | undefined): { bytes: Buffer; output: ProbeOutput } {
   if (parts.length === 0) throw new ProbeMergeError("no run to merge");
-  const outcomes = parts.map((p) => (outOfMemory(p.output, bound) ? PROBE_OOM : p.output.run.outcome));
+  // the runner's own outcome when it says it (the kernel killed the child at memory.max), else what its exit means under the data limit
+  const outcomes = parts.map((p) => (p.output.run.outcome === PROBE_MEMORY_LIMIT ? PROBE_MEMORY_LIMIT : outOfMemory(p.output, bound) ? PROBE_OOM : p.output.run.outcome));
   const first = parts[0]!;
   for (const p of parts.slice(1)) {
     if (p.output.plugin.id !== first.output.plugin.id || p.output.binary.sha256 !== first.output.binary.sha256 || p.output.offer.id !== first.output.offer.id) {
@@ -66,18 +67,18 @@ export function mergeProbeRuns(parts: readonly ProbeRunPart[], bound: MemoryBoun
       for (const c of p.invocation.cells) {
         if (seen.has(cellKey(c))) continue;
         seen.add(cellKey(c));
-        grid.push({ rate: c.rate, quantum: c.quantum, outcome: outcomes[i], ...(outcomes[i] === PROBE_OOM && bound !== undefined ? { memoryLimit: { bytes: bound.bytes, mechanism: bound.mechanism } } : {}) });
+        grid.push({ rate: c.rate, quantum: c.quantum, outcome: outcomes[i], ...(isOutOfMemory(outcomes[i]!) && bound !== undefined ? { memoryLimit: { bytes: bound.bytes, mechanism: outcomes[i] === PROBE_MEMORY_LIMIT ? MEMORY_CGROUP_MECHANISM : bound.mechanism } } : {}) });
       }
     }
     steps.push(...((docs[i]!["steps"] as unknown[] | undefined) ?? []));
   });
-  const judged = outcomes.filter((o) => o !== PROBE_OOM);
+  const judged = outcomes.filter((o) => !isOutOfMemory(o));
   const run = merged["run"] as Json;
   merged["run"] = {
     ...run,
     elapsedMs: parts.reduce((sum, p) => sum + p.output.run.elapsedMs, 0),
     complete: parts.every((p, i) => p.output.run.complete && outcomes[i] === PROBE_OK),
-    outcome: judged.length === 0 ? PROBE_OOM : (judged.find((o) => o !== PROBE_OK) ?? PROBE_OK),
+    outcome: judged.length === 0 ? outcomes[0]! : (judged.find((o) => o !== PROBE_OK) ?? PROBE_OK),
     parts: parts.map((p, i) => ({ id: p.output.run.id, outcome: outcomes[i], rates: p.invocation.rates, quantum: p.invocation.quantum, elapsedMs: p.output.run.elapsedMs })),
   };
   merged["steps"] = steps;

package/src/probe-output-fixtures.ts

@@ -11,11 +11,20 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import type { ClapQualifyLine } from "./clap-qualify.js";
-import { OMX_CLAP_HOST_EXTENSIONS } from "./host-profiles.js";
+import { OMX_CLAP_HOST_EXTENSIONS, type HostProfile } from "./host-profiles.js";
 import { readProbeOutput, type ProbeOutput } from "./probe-output.js";
 
 const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "..", "fixtures", "probe-output");
 
+/**
+ * The same host with no memory budget: for the tests of what a probe output says about everything else, on documents
+ * that do not hold a footprint at the host's own cell.
+ */
+export function withoutMemoryBudget<T extends HostProfile>(profile: T): T {
+  const { memory: _memory, ...cost } = profile.cost;
+  return { ...profile, cost };
+}
+
 export function fixtureText(name: string): string {
   return readFileSync(join(FIXTURES, `${name}.json`), "utf8");
 }

package/src/probe-output.ts

@@ -20,7 +20,7 @@
 import { createHash } from "node:crypto";
 
 import { finiteNumber, isRecord, nonEmptyString, optional } from "./measurement/guards.js";
-import { readVoicesHeld, type VoicesHeld } from "./measurement/format.js";
+import { readMemoryFootprint, readVoicesHeld, type MemoryFootprint, type VoicesHeld } from "./measurement/format.js";
 
 export const PROBE_OUTPUT_FORMAT = "plugin-hostd.probe-output";
 /** The one major this reader knows. A minor of it only adds fields. */
@@ -96,7 +96,9 @@ export interface ProbeGridPoint {
   readonly cost?: ProbeCost;
   readonly rtSafety?: ProbeRtSafety;
   readonly noteSweep?: ProbeNoteSweep;
-  /** A cell whose run outgrew the memory bound (`probe.oom`): the bound it ran under. */
+  /** What one instance holds at this rate and quantum, as the prober read it; absent when it took none. */
+  readonly memory?: MemoryFootprint;
+  /** A cell whose run outgrew the memory bound (`probe.oom`, `probe.memory-limit`): the bound it ran under. */
   readonly memoryLimit?: { readonly bytes: number; readonly mechanism: string };
 }
 
@@ -310,6 +312,7 @@ function readPoint(v: unknown, i: number): ProbeGridPoint {
     ...(o["cost"] === undefined ? {} : { cost: readCost(o["cost"], `${where} cost`) }),
     ...(o["rtSafety"] === undefined ? {} : { rtSafety: readRtSafety(o["rtSafety"], `${where} rtSafety`) }),
     ...(o["noteSweep"] === undefined ? {} : { noteSweep: readNoteSweep(o["noteSweep"], `${where} noteSweep`) }),
+    ...optional("memory", readMemoryFootprint(o["memory"])),
     ...(o["memoryLimit"] === undefined ? {} : { memoryLimit: readMemoryLimit(o["memoryLimit"], `${where} memoryLimit`) }),
   };
 }

package/src/probe-runner.ts

@@ -22,10 +22,10 @@ import type { HostProfile } from "./host-profiles.js";
 import { OPENMIXER_CONSOLE_PROFILE, shippedHostProfile } from "./host-profiles.js";
 import { IN_PROCESS_TIER_HOST, ISOLATED_TIER_HOST } from "./qualification-record.js";
 import type { PluginTarget } from "./loader.js";
-import { SPAWNED_ADMISSIONS, admitPlugin, admitUnderAdapter, admittedHostOf, type AdmissionRuns, type HostAdmission } from "./host-admission.js";
+import { ADAPTER_HOST, SPAWNED_ADMISSIONS, admitPlugin, admitUnderAdapter, admittedHostOf, type AdmissionRuns, type HostAdmission } from "./host-admission.js";
 import { judgeProbeOutput, judgmentVerdicts, type Judgment } from "./probe-judge.js";
 import { readProbeOutput, type ProbeOutput } from "./probe-output.js";
-import { budgetCells, gridCells, runnerInvocations, type GridCell, type GridSpec, type RunnerInvocation } from "./measurement-grid.js";
+import { budgetCells, gridCells, hostCells, runnerInvocations, type GridCell, type GridSpec, type RunnerInvocation } from "./measurement-grid.js";
 import type { MemoryBound } from "./memory-bound.js";
 import { mergeProbeRuns, ProbeMergeError } from "./probe-merge.js";
 import type { QualifyVerdict } from "./qualify-cli.js";
@@ -292,12 +292,14 @@ export function qualifyTargets(
     const cells =
       options.grid === undefined
         ? options.cells
-        : gridCells(options.grid, { rates: options.rates, quanta: options.quanta ?? QUALIFY_QUANTA, hosts: judgedProfiles.map((p) => ({ rate: p.cost.rate, quantum: p.cost.quantum })) });
+        : gridCells(options.grid, { rates: options.rates, quanta: options.quanta ?? QUALIFY_QUANTA, hosts: judgedProfiles.flatMap(hostCells) });
     const measured = cells === undefined ? {} : { cells: budgetCells(cells, options.cellsPerPluginBudget) };
     // an LV2 plugin is run under each measured host once, whichever probe output it is judged with
     const admissions: Record<string, HostAdmission> = {};
     // an LV2 plugin is also run once under plugin-hostd's LV2 adapter, recorded beside the verdicts (#223)
     const adapter = target.format === "lv2" ? admitUnderAdapter(target.uri, admissionRuns, admissionEnv) : undefined;
+    // and that run decides its omx-clap-host verdict, the isolated tier
+    if (adapter !== undefined) admissions[ADAPTER_HOST] = adapter;
     if (target.format === "lv2") {
       for (const profile of judgedProfiles) {
         const host = admittedHostOf(profile);

package/src/qualification-record.ts

@@ -13,6 +13,8 @@
  * Not yet in the record: the fingerprint of the descriptor's controls, since the descriptor is
  * written by the scan (stage 5) and plugin-qualify does not read one yet.
  */
+import type { MemoryFootprint } from "./measurement/format.js";
+import { firstInstanceKb, perInstanceKb } from "./memory-budget.js";
 import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
@@ -59,8 +61,11 @@ export interface RecordTiers {
   readonly dimmed?: string;
 }
 
-/** The profile each format's isolated tier is judged under. */
-export const ISOLATED_TIER_HOST: Readonly<Record<string, string>> = { lv2: "mod-host", clap: "omx-clap-host" };
+/**
+ * The profile each format's isolated tier is judged under: omx-clap-host for both, an LV2 plugin through plugin-hostd's
+ * LV2 adapter, whose run decides that verdict (`host-admission.ts`). mod-host is judged only when a run asks for it.
+ */
+export const ISOLATED_TIER_HOST: Readonly<Record<string, string>> = { lv2: "omx-clap-host", clap: "omx-clap-host" };
 export const IN_PROCESS_TIER_HOST = "openmixer-console";
 
 /** A latency or cost figure the run could not take: which one, at what rate and quantum, and the code that says why. */
@@ -100,13 +105,26 @@ export interface UnmeasuredLatency {
 }
 
 /** A grid point as the record writes it: every cell carries `latency`, the figures or why there are none (#201). */
-export type RecordGridPoint = Omit<ProbeGridPoint, "latency"> & {
+export type RecordGridPoint = Omit<ProbeGridPoint, "latency" | "memory"> & {
+  /** The footprint as measured, with what it comes to: what a client adding the plugin reads (`memory-budget.ts`). */
+  readonly memory?: MemoryFootprint & { readonly firstInstanceKb?: number; readonly perInstanceKb?: number };
   readonly latency: (Omit<NonNullable<ProbeGridPoint["latency"]>, "measuredFrames"> & { readonly measuredFrames: number }) | UnmeasuredLatency;
 };
 
 const UNMEASURED_WORDS: ReadonlySet<string> = new Set(Object.values(MEASUREMENT_UNMEASURED_REASONS).map((r) => r.word));
 const word = (key: keyof typeof MEASUREMENT_UNMEASURED_REASONS): string => MEASUREMENT_UNMEASURED_REASONS[key].word;
 
+/** The same, for the test. */
+export const memoryOfCellForTest = (p: ProbeGridPoint): Pick<RecordGridPoint, "memory"> => memoryOfCell(p);
+
+/** A cell's footprint with what it comes to; only a footprint with no reason beside it comes to anything a client may add up. */
+function memoryOfCell(p: ProbeGridPoint): Pick<RecordGridPoint, "memory"> {
+  if (p.memory === undefined) return {};
+  const first = p.memory.unmeasuredReason === undefined ? firstInstanceKb(p.memory) : undefined;
+  const per = p.memory.unmeasuredReason === undefined ? perInstanceKb(p.memory) : undefined;
+  return { memory: { ...p.memory, ...(first === undefined ? {} : { firstInstanceKb: first }), ...(per === undefined ? {} : { perInstanceKb: per }) } };
+}
+
 /** The unmeasured word of a cell whose run did not end well, by its outcome code. */
 const OUTCOME_WORD: Readonly<Record<string, string>> = {
   "probe.crashed": word("probeCrashed"),
@@ -283,7 +301,7 @@ export function buildQualificationRecord(
     tiers: tiersOf(judgment),
     cost: judgment.hosts.map((h) => ({ host: h.verdict.host, ...h.cost })),
     measurements: {
-      grid: o.grid.map((p) => ({ ...p, latency: latencyOfCell(o, p) })),
+      grid: o.grid.map((p) => ({ ...p, ...memoryOfCell(p), latency: latencyOfCell(o, p) })),
       ...(o.behaviour === undefined ? {} : { behaviour: o.behaviour }),
       ...(unmeasuredFigures(o).length === 0 ? {} : { unmeasured: unmeasuredFigures(o) }),
     },

package/src/qualify-declarations.ts

@@ -147,6 +147,12 @@ export const GRID_CONTINUITY_QUANTUM = CLAP_SWEEP_FRAMES;
  * same two (src/memory-bound.test.ts holds them together).
  */
 export const MEMORY_LIMIT_RAM_FRACTION = 0.5;
+/**
+ * The address space (`RLIMIT_AS`) of a process plugin-qualify spawns directly, with no runner to give it a cgroup: all the
+ * machine's RAM. Address space is what a plugin reserves, not what it touches, so this is the far bound of a direct
+ * run, not its budget. Off for a sanitizer build, which reserves far more address space than it uses.
+ */
+export const ADDRESS_SPACE_LIMIT_RAM_FRACTION = 1;
 export const MEMORY_BOUND_EXIT_ENV = "OMX_RT_OOM_EXIT";
 export const MEMORY_BOUND_EXIT_STATUS = 121;
 
@@ -208,10 +214,16 @@ export const DESCRIPTOR_CODE_DIR_UNWRITABLE = "qualify.descriptor.dir-unwritable
 
 /** Every threshold, so none is baked into the code. */
 export interface HostingPolicy {
-  /** Minimum instantiate/destroy lifecycles. The operator's §14.4 ruling: 1000. */
+  /** Minimum instantiate/destroy lifecycles. §14.4 sets it: 1000. */
   readonly cycleFloor: number;
   /** Minimum continuous soak, seconds. Default 3 h — the operator's longest show. */
   readonly soakSeconds: number;
+  /**
+   * The memory growth a soak may show past warm-up, in KB per minute of audio. 10 MB/min ships provisional and is
+   * tightened from measurements; a verdict that rests on it says so.
+   */
+  readonly memoryGrowthKbPerMinCeiling: number;
+  readonly memoryGrowthCeilingProvisional: boolean;
   /** Above this ratio a plugin is spiky: in-process a spike is the whole desk's xrun. */
   readonly costTailRatioCeiling: number;
   /** A soak rate whose settled output sits this far under the plugin's own best rate is
@@ -222,7 +234,7 @@ export interface HostingPolicy {
 }
 
 /**
- * Defaults. The cycle floor is the operator's ruling of 2026-09-05 (§14.4, option c) and the
+ * Defaults. The cycle floor is the decision of 2026-09-05 (§14.4, option c) and the
  * soak is §3's default show length. The per-instance cost ceiling is the HOST's budget and
  * lives in {@link HOST_BUDGETS} (plugin-qualify §3a), not here.
  */
@@ -231,6 +243,8 @@ export const DEFAULT_HOSTING_POLICY: HostingPolicy = {
   soakSeconds: 3 * 60 * 60,
   costTailRatioCeiling: 4,
   soakDeadDropDb: 40,
+  memoryGrowthKbPerMinCeiling: 10240,
+  memoryGrowthCeilingProvisional: true,
 };
 
 /** What a host spends on one plugin instance — the
@@ -247,10 +261,42 @@ export type { HostBudget };
  * `omx-clap-host` runs its plugins one JACK client each, called in turn on the server's one cycle,
  * so it gets mod-host's share and pair.
  */
+const GIB_KB = 1024 * 1024;
+
+/**
+ * The desk's memory budget: half of its 30 GiB for the plugins of a console, the rest the engine's and the system's;
+ * one instance's share is what the probe bounds a run by, 4 GiB.
+ */
+const DESK_MEMORY = { perInstanceKb: 4 * GIB_KB, perConsoleKb: 16 * GIB_KB };
+
+/**
+ * What a Raspberry Pi gives its plugins' memory, by the board's RAM: all but 1 GiB for the system and Zynthian's own
+ * UI, and an instance's share an eighth of that. Provisional until measured on a Pi: the stress runs show a 4 GiB Pi 5 stopping
+ * at 400 MB free, and no plugin's footprint has been read there yet.
+ */
+const piMemory = (ramGib: number): NonNullable<HostBudget["memory"]> => ({
+  perInstanceKb: ((ramGib - 1) * GIB_KB) / 8,
+  perConsoleKb: (ramGib - 1) * GIB_KB,
+  provisional: true,
+  cells: PI_CELLS,
+});
+
+/**
+ * The cells a Raspberry Pi runs: zynthian-sys's JACK settings, 48000/128 on a Pi 5 with the V5 kit and 48000/256 on a Pi 4 and
+ * the other kits, the one a Pi 5 with no kit card also ran its stress and first boot at. The Zynthian benchmark's matrix sweeps
+ * more cells; these two are what a Pi is set to.
+ */
+const PI_CELLS = [
+  { rate: MEASURE_BASE_RATE, quantum: 128 },
+  { rate: MEASURE_BASE_RATE, quantum: 256 },
+];
+
 export const HOST_BUDGETS = {
-  "openmixer-console": { coreFractionCeiling: 0.05, rate: COST_REFERENCE_RATE, quantum: QUANTUM_FRAMES },
+  "openmixer-console": { coreFractionCeiling: 0.05, rate: COST_REFERENCE_RATE, quantum: QUANTUM_FRAMES, memory: DESK_MEMORY },
   jalv: { coreFractionCeiling: 0.25, rate: MEASURE_BASE_RATE, quantum: 256 },
   "mod-host": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128 },
   "omx-clap-host": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128 },
+  "openmixer-pi-4gb": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128, memory: piMemory(4) },
+  "openmixer-pi-8gb": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128, memory: piMemory(8) },
 } as const satisfies Readonly<Record<string, HostBudget>>;