@openmixer/plugin-qualify 0.17.5 → 0.18.0

package/src/probe-merge.ts

@@ -14,7 +14,7 @@
  *
  * One run that ended well and needs nothing added is kept as the runner wrote it, byte for byte.
  */
-import { outOfMemory, PROBE_OOM, type MemoryBound } from "./memory-bound.js";
+import { isOutOfMemory, MEMORY_CGROUP_MECHANISM, outOfMemory, PROBE_MEMORY_LIMIT, PROBE_OOM, type MemoryBound } from "./memory-bound.js";
 import { cellKey, type RunnerInvocation } from "./measurement-grid.js";
 import { PROBE_OK, readProbeOutput, type ProbeOutput } from "./probe-output.js";
 
@@ -36,7 +36,8 @@ type Json = Record<string, unknown>;
 
 export function mergeProbeRuns(parts: readonly ProbeRunPart[], bound: MemoryBound | undefined): { bytes: Buffer; output: ProbeOutput } {
   if (parts.length === 0) throw new ProbeMergeError("no run to merge");
-  const outcomes = parts.map((p) => (outOfMemory(p.output, bound) ? PROBE_OOM : p.output.run.outcome));
+  // the runner's own outcome when it says it (the kernel killed the child at memory.max), else what its exit means under the data limit
+  const outcomes = parts.map((p) => (p.output.run.outcome === PROBE_MEMORY_LIMIT ? PROBE_MEMORY_LIMIT : outOfMemory(p.output, bound) ? PROBE_OOM : p.output.run.outcome));
   const first = parts[0]!;
   for (const p of parts.slice(1)) {
     if (p.output.plugin.id !== first.output.plugin.id || p.output.binary.sha256 !== first.output.binary.sha256 || p.output.offer.id !== first.output.offer.id) {
@@ -66,18 +67,18 @@ export function mergeProbeRuns(parts: readonly ProbeRunPart[], bound: MemoryBoun
       for (const c of p.invocation.cells) {
         if (seen.has(cellKey(c))) continue;
         seen.add(cellKey(c));
-        grid.push({ rate: c.rate, quantum: c.quantum, outcome: outcomes[i], ...(outcomes[i] === PROBE_OOM && bound !== undefined ? { memoryLimit: { bytes: bound.bytes, mechanism: bound.mechanism } } : {}) });
+        grid.push({ rate: c.rate, quantum: c.quantum, outcome: outcomes[i], ...(isOutOfMemory(outcomes[i]!) && bound !== undefined ? { memoryLimit: { bytes: bound.bytes, mechanism: outcomes[i] === PROBE_MEMORY_LIMIT ? MEMORY_CGROUP_MECHANISM : bound.mechanism } } : {}) });
       }
     }
     steps.push(...((docs[i]!["steps"] as unknown[] | undefined) ?? []));
   });
-  const judged = outcomes.filter((o) => o !== PROBE_OOM);
+  const judged = outcomes.filter((o) => !isOutOfMemory(o));
   const run = merged["run"] as Json;
   merged["run"] = {
     ...run,
     elapsedMs: parts.reduce((sum, p) => sum + p.output.run.elapsedMs, 0),
     complete: parts.every((p, i) => p.output.run.complete && outcomes[i] === PROBE_OK),
-    outcome: judged.length === 0 ? PROBE_OOM : (judged.find((o) => o !== PROBE_OK) ?? PROBE_OK),
+    outcome: judged.length === 0 ? outcomes[0]! : (judged.find((o) => o !== PROBE_OK) ?? PROBE_OK),
     parts: parts.map((p, i) => ({ id: p.output.run.id, outcome: outcomes[i], rates: p.invocation.rates, quantum: p.invocation.quantum, elapsedMs: p.output.run.elapsedMs })),
   };
   merged["steps"] = steps;

package/src/probe-output-fixtures.ts

@@ -11,11 +11,20 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import type { ClapQualifyLine } from "./clap-qualify.js";
-import { OMX_CLAP_HOST_EXTENSIONS } from "./host-profiles.js";
+import { OMX_CLAP_HOST_EXTENSIONS, type HostProfile } from "./host-profiles.js";
 import { readProbeOutput, type ProbeOutput } from "./probe-output.js";
 
 const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "..", "fixtures", "probe-output");
 
+/**
+ * The same host with no memory budget: for the tests of what a probe output says about everything else, on documents
+ * that do not hold a footprint at the host's own cell.
+ */
+export function withoutMemoryBudget<T extends HostProfile>(profile: T): T {
+  const { memory: _memory, ...cost } = profile.cost;
+  return { ...profile, cost };
+}
+
 export function fixtureText(name: string): string {
   return readFileSync(join(FIXTURES, `${name}.json`), "utf8");
 }

package/src/probe-output.ts

@@ -20,7 +20,7 @@
 import { createHash } from "node:crypto";
 
 import { finiteNumber, isRecord, nonEmptyString, optional } from "./measurement/guards.js";
-import { readVoicesHeld, type VoicesHeld } from "./measurement/format.js";
+import { readMemoryFootprint, readVoicesHeld, type MemoryFootprint, type VoicesHeld } from "./measurement/format.js";
 
 export const PROBE_OUTPUT_FORMAT = "plugin-hostd.probe-output";
 /** The one major this reader knows. A minor of it only adds fields. */
@@ -96,7 +96,9 @@ export interface ProbeGridPoint {
   readonly cost?: ProbeCost;
   readonly rtSafety?: ProbeRtSafety;
   readonly noteSweep?: ProbeNoteSweep;
-  /** A cell whose run outgrew the memory bound (`probe.oom`): the bound it ran under. */
+  /** What one instance holds at this rate and quantum, as the prober read it; absent when it took none. */
+  readonly memory?: MemoryFootprint;
+  /** A cell whose run outgrew the memory bound (`probe.oom`, `probe.memory-limit`): the bound it ran under. */
   readonly memoryLimit?: { readonly bytes: number; readonly mechanism: string };
 }
 
@@ -310,6 +312,7 @@ function readPoint(v: unknown, i: number): ProbeGridPoint {
     ...(o["cost"] === undefined ? {} : { cost: readCost(o["cost"], `${where} cost`) }),
     ...(o["rtSafety"] === undefined ? {} : { rtSafety: readRtSafety(o["rtSafety"], `${where} rtSafety`) }),
     ...(o["noteSweep"] === undefined ? {} : { noteSweep: readNoteSweep(o["noteSweep"], `${where} noteSweep`) }),
+    ...optional("memory", readMemoryFootprint(o["memory"])),
     ...(o["memoryLimit"] === undefined ? {} : { memoryLimit: readMemoryLimit(o["memoryLimit"], `${where} memoryLimit`) }),
   };
 }

package/src/probe-runner.ts

@@ -22,10 +22,10 @@ import type { HostProfile } from "./host-profiles.js";
 import { OPENMIXER_CONSOLE_PROFILE, shippedHostProfile } from "./host-profiles.js";
 import { IN_PROCESS_TIER_HOST, ISOLATED_TIER_HOST } from "./qualification-record.js";
 import type { PluginTarget } from "./loader.js";
-import { SPAWNED_ADMISSIONS, admitPlugin, admitUnderAdapter, admittedHostOf, type AdmissionRuns, type HostAdmission } from "./host-admission.js";
+import { ADAPTER_HOST, SPAWNED_ADMISSIONS, admitPlugin, admitUnderAdapter, admittedHostOf, type AdmissionRuns, type HostAdmission } from "./host-admission.js";
 import { judgeProbeOutput, judgmentVerdicts, type Judgment } from "./probe-judge.js";
 import { readProbeOutput, type ProbeOutput } from "./probe-output.js";
-import { budgetCells, gridCells, runnerInvocations, type GridCell, type GridSpec, type RunnerInvocation } from "./measurement-grid.js";
+import { budgetCells, gridCells, hostCells, runnerInvocations, type GridCell, type GridSpec, type RunnerInvocation } from "./measurement-grid.js";
 import type { MemoryBound } from "./memory-bound.js";
 import { mergeProbeRuns, ProbeMergeError } from "./probe-merge.js";
 import type { QualifyVerdict } from "./qualify-cli.js";
@@ -292,12 +292,14 @@ export function qualifyTargets(
     const cells =
       options.grid === undefined
         ? options.cells
-        : gridCells(options.grid, { rates: options.rates, quanta: options.quanta ?? QUALIFY_QUANTA, hosts: judgedProfiles.map((p) => ({ rate: p.cost.rate, quantum: p.cost.quantum })) });
+        : gridCells(options.grid, { rates: options.rates, quanta: options.quanta ?? QUALIFY_QUANTA, hosts: judgedProfiles.flatMap(hostCells) });
     const measured = cells === undefined ? {} : { cells: budgetCells(cells, options.cellsPerPluginBudget) };
     // an LV2 plugin is run under each measured host once, whichever probe output it is judged with
     const admissions: Record<string, HostAdmission> = {};
     // an LV2 plugin is also run once under plugin-hostd's LV2 adapter, recorded beside the verdicts (#223)
     const adapter = target.format === "lv2" ? admitUnderAdapter(target.uri, admissionRuns, admissionEnv) : undefined;
+    // and that run decides its omx-clap-host verdict, the isolated tier
+    if (adapter !== undefined) admissions[ADAPTER_HOST] = adapter;
     if (target.format === "lv2") {
       for (const profile of judgedProfiles) {
         const host = admittedHostOf(profile);

package/src/qualification-record.ts

@@ -13,6 +13,8 @@
  * Not yet in the record: the fingerprint of the descriptor's controls, since the descriptor is
  * written by the scan (stage 5) and plugin-qualify does not read one yet.
  */
+import type { MemoryFootprint } from "./measurement/format.js";
+import { firstInstanceKb, perInstanceKb } from "./memory-budget.js";
 import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
@@ -59,8 +61,11 @@ export interface RecordTiers {
   readonly dimmed?: string;
 }
 
-/** The profile each format's isolated tier is judged under. */
-export const ISOLATED_TIER_HOST: Readonly<Record<string, string>> = { lv2: "mod-host", clap: "omx-clap-host" };
+/**
+ * The profile each format's isolated tier is judged under: omx-clap-host for both, an LV2 plugin through plugin-hostd's
+ * LV2 adapter, whose run decides that verdict (`host-admission.ts`). mod-host is judged only when a run asks for it.
+ */
+export const ISOLATED_TIER_HOST: Readonly<Record<string, string>> = { lv2: "omx-clap-host", clap: "omx-clap-host" };
 export const IN_PROCESS_TIER_HOST = "openmixer-console";
 
 /** A latency or cost figure the run could not take: which one, at what rate and quantum, and the code that says why. */
@@ -100,13 +105,26 @@ export interface UnmeasuredLatency {
 }
 
 /** A grid point as the record writes it: every cell carries `latency`, the figures or why there are none (#201). */
-export type RecordGridPoint = Omit<ProbeGridPoint, "latency"> & {
+export type RecordGridPoint = Omit<ProbeGridPoint, "latency" | "memory"> & {
+  /** The footprint as measured, with what it comes to: what a client adding the plugin reads (`memory-budget.ts`). */
+  readonly memory?: MemoryFootprint & { readonly firstInstanceKb?: number; readonly perInstanceKb?: number };
   readonly latency: (Omit<NonNullable<ProbeGridPoint["latency"]>, "measuredFrames"> & { readonly measuredFrames: number }) | UnmeasuredLatency;
 };
 
 const UNMEASURED_WORDS: ReadonlySet<string> = new Set(Object.values(MEASUREMENT_UNMEASURED_REASONS).map((r) => r.word));
 const word = (key: keyof typeof MEASUREMENT_UNMEASURED_REASONS): string => MEASUREMENT_UNMEASURED_REASONS[key].word;
 
+/** The same, for the test. */
+export const memoryOfCellForTest = (p: ProbeGridPoint): Pick<RecordGridPoint, "memory"> => memoryOfCell(p);
+
+/** A cell's footprint with what it comes to; only a footprint with no reason beside it comes to anything a client may add up. */
+function memoryOfCell(p: ProbeGridPoint): Pick<RecordGridPoint, "memory"> {
+  if (p.memory === undefined) return {};
+  const first = p.memory.unmeasuredReason === undefined ? firstInstanceKb(p.memory) : undefined;
+  const per = p.memory.unmeasuredReason === undefined ? perInstanceKb(p.memory) : undefined;
+  return { memory: { ...p.memory, ...(first === undefined ? {} : { firstInstanceKb: first }), ...(per === undefined ? {} : { perInstanceKb: per }) } };
+}
+
 /** The unmeasured word of a cell whose run did not end well, by its outcome code. */
 const OUTCOME_WORD: Readonly<Record<string, string>> = {
   "probe.crashed": word("probeCrashed"),
@@ -283,7 +301,7 @@ export function buildQualificationRecord(
     tiers: tiersOf(judgment),
     cost: judgment.hosts.map((h) => ({ host: h.verdict.host, ...h.cost })),
     measurements: {
-      grid: o.grid.map((p) => ({ ...p, latency: latencyOfCell(o, p) })),
+      grid: o.grid.map((p) => ({ ...p, ...memoryOfCell(p), latency: latencyOfCell(o, p) })),
       ...(o.behaviour === undefined ? {} : { behaviour: o.behaviour }),
       ...(unmeasuredFigures(o).length === 0 ? {} : { unmeasured: unmeasuredFigures(o) }),
     },

package/src/qualify-declarations.ts

@@ -147,6 +147,12 @@ export const GRID_CONTINUITY_QUANTUM = CLAP_SWEEP_FRAMES;
  * same two (src/memory-bound.test.ts holds them together).
  */
 export const MEMORY_LIMIT_RAM_FRACTION = 0.5;
+/**
+ * The address space (`RLIMIT_AS`) of a process plugin-qualify spawns directly, with no runner to give it a cgroup: all the
+ * machine's RAM. Address space is what a plugin reserves, not what it touches, so this is the far bound of a direct
+ * run, not its budget. Off for a sanitizer build, which reserves far more address space than it uses.
+ */
+export const ADDRESS_SPACE_LIMIT_RAM_FRACTION = 1;
 export const MEMORY_BOUND_EXIT_ENV = "OMX_RT_OOM_EXIT";
 export const MEMORY_BOUND_EXIT_STATUS = 121;
 
@@ -208,10 +214,16 @@ export const DESCRIPTOR_CODE_DIR_UNWRITABLE = "qualify.descriptor.dir-unwritable
 
 /** Every threshold, so none is baked into the code. */
 export interface HostingPolicy {
-  /** Minimum instantiate/destroy lifecycles. The operator's §14.4 ruling: 1000. */
+  /** Minimum instantiate/destroy lifecycles. §14.4 sets it: 1000. */
   readonly cycleFloor: number;
   /** Minimum continuous soak, seconds. Default 3 h — the operator's longest show. */
   readonly soakSeconds: number;
+  /**
+   * The memory growth a soak may show past warm-up, in KB per minute of audio. 10 MB/min ships provisional and is
+   * tightened from measurements; a verdict that rests on it says so.
+   */
+  readonly memoryGrowthKbPerMinCeiling: number;
+  readonly memoryGrowthCeilingProvisional: boolean;
   /** Above this ratio a plugin is spiky: in-process a spike is the whole desk's xrun. */
   readonly costTailRatioCeiling: number;
   /** A soak rate whose settled output sits this far under the plugin's own best rate is
@@ -222,7 +234,7 @@ export interface HostingPolicy {
 }
 
 /**
- * Defaults. The cycle floor is the operator's ruling of 2026-09-05 (§14.4, option c) and the
+ * Defaults. The cycle floor is the decision of 2026-09-05 (§14.4, option c) and the
  * soak is §3's default show length. The per-instance cost ceiling is the HOST's budget and
  * lives in {@link HOST_BUDGETS} (plugin-qualify §3a), not here.
  */
@@ -231,6 +243,8 @@ export const DEFAULT_HOSTING_POLICY: HostingPolicy = {
   soakSeconds: 3 * 60 * 60,
   costTailRatioCeiling: 4,
   soakDeadDropDb: 40,
+  memoryGrowthKbPerMinCeiling: 10240,
+  memoryGrowthCeilingProvisional: true,
 };
 
 /** What a host spends on one plugin instance — the
@@ -247,10 +261,42 @@ export type { HostBudget };
  * `omx-clap-host` runs its plugins one JACK client each, called in turn on the server's one cycle,
  * so it gets mod-host's share and pair.
  */
+const GIB_KB = 1024 * 1024;
+
+/**
+ * The desk's memory budget: half of its 30 GiB for the plugins of a console, the rest the engine's and the system's;
+ * one instance's share is what the probe bounds a run by, 4 GiB.
+ */
+const DESK_MEMORY = { perInstanceKb: 4 * GIB_KB, perConsoleKb: 16 * GIB_KB };
+
+/**
+ * What a Raspberry Pi gives its plugins' memory, by the board's RAM: all but 1 GiB for the system and Zynthian's own
+ * UI, and an instance's share an eighth of that. Provisional until measured on a Pi: the stress runs show a 4 GiB Pi 5 stopping
+ * at 400 MB free, and no plugin's footprint has been read there yet.
+ */
+const piMemory = (ramGib: number): NonNullable<HostBudget["memory"]> => ({
+  perInstanceKb: ((ramGib - 1) * GIB_KB) / 8,
+  perConsoleKb: (ramGib - 1) * GIB_KB,
+  provisional: true,
+  cells: PI_CELLS,
+});
+
+/**
+ * The cells a Raspberry Pi runs: zynthian-sys's JACK settings, 48000/128 on a Pi 5 with the V5 kit and 48000/256 on a Pi 4 and
+ * the other kits, the one a Pi 5 with no kit card also ran its stress and first boot at. The Zynthian benchmark's matrix sweeps
+ * more cells; these two are what a Pi is set to.
+ */
+const PI_CELLS = [
+  { rate: MEASURE_BASE_RATE, quantum: 128 },
+  { rate: MEASURE_BASE_RATE, quantum: 256 },
+];
+
 export const HOST_BUDGETS = {
-  "openmixer-console": { coreFractionCeiling: 0.05, rate: COST_REFERENCE_RATE, quantum: QUANTUM_FRAMES },
+  "openmixer-console": { coreFractionCeiling: 0.05, rate: COST_REFERENCE_RATE, quantum: QUANTUM_FRAMES, memory: DESK_MEMORY },
   jalv: { coreFractionCeiling: 0.25, rate: MEASURE_BASE_RATE, quantum: 256 },
   "mod-host": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128 },
   "omx-clap-host": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128 },
+  "openmixer-pi-4gb": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128, memory: piMemory(4) },
+  "openmixer-pi-8gb": { coreFractionCeiling: 0.05, rate: MEASURE_BASE_RATE, quantum: 128, memory: piMemory(8) },
 } as const satisfies Readonly<Record<string, HostBudget>>;
 

package/src/qualify-sync.ts

@@ -21,7 +21,7 @@ import { createHash } from "node:crypto";
 import { closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createConnection } from "node:net";
 import { homedir, tmpdir } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path";
 
 import { clapQualifyTools } from "./clap-qualify.js";
 import { DISTRIBUTED_DIR_SYSTEM, EMPTY_LAYER, applyDistributed, distributedUri, hostClassOfBoard, matchDistributed, readBoardModel, readDistributedLayer, type DistributedLayer } from "./distributed-records.js";
@@ -1126,6 +1126,15 @@ function addSummaries(a: SyncSummary, b: SyncSummary): SyncSummary {
   };
 }
 
+/** Whether this run's scan covers an entry: its root lies under one of the run's directories of its own format. */
+function scannedBy(settings: Pick<SyncSettings, "lv2Dirs" | "clapDirs">, entry: SyncEntry): boolean {
+  const root = resolve(entry.root);
+  return (entry.format === "clap" ? settings.clapDirs : settings.lv2Dirs).some((d) => {
+    const dir = resolve(d);
+    return root === dir || root.startsWith(dir.endsWith(sep) ? dir : dir + sep);
+  });
+}
+
 /**
  * One run: wait for quiet, qualify what is new or changed, drop what is gone, write the state, the records, the
  * descriptors and the pin file, and send the changed pins to a running daemon. The state and the pin file are written
@@ -1167,8 +1176,14 @@ async function runLocked(settings: SyncSettings, options: SyncRunOptions): Promi
       unreadable = problems.length > 0;
       const found = new Set(items.map((i) => i.key));
       const entries: Record<string, SyncEntry> = {};
-      for (const [key, entry] of Object.entries(state.entries)) if (found.has(key)) entries[key] = entry;
-      for (const key of Object.keys(state.entries)) if (!found.has(key)) log(`${key}: gone, its pin is dropped`);
+      for (const [key, entry] of Object.entries(state.entries)) {
+        if (found.has(key)) entries[key] = entry;
+        // a run scoped to some directories keeps what it did not scan: gone means not found where this run looked
+        else if (!scannedBy(settings, entry)) {
+          entries[key] = entry;
+          if (pass === 0) log(`${key}: not under a directory this run scans; its pin is kept`);
+        } else log(`${key}: gone, its pin is dropped`);
+      }
       for (const item of items) {
         const recorded = recordedAsIs(item, entries[item.key]);
         if (recorded.same && options.force !== true) {

package/tools/_declarations.py

@@ -17,6 +17,7 @@ OPERATIONAL_RATE_FLOOR = 48000
 QUALIFY_RATES = (44100, 48000, 96000, 192000)
 QUALIFY_QUANTA = (128, 256, 512, 1024)
 PLUGIN_TIMEOUT_S = 15
+ADDRESS_SPACE_LIMIT_RAM_FRACTION = 1
 BOOT_TIMEOUT_S = 120
 COST_TIMEOUT_S = 60
 DESCRIPTOR_DIR_KEY = "descriptor_dir"

package/tools/benchmark.py

@@ -42,6 +42,7 @@ Usage:
 import argparse
 import json
 import os
+import resource
 import select
 import shlex
 import subprocess
@@ -53,10 +54,13 @@ from collections import namedtuple
 # declarations (with the rate list and timeouts), generated from `src/qualify-declarations.ts` because this script cannot import
 # a TS module (2026-09-17 declare-derive audit, F8) — see `_declarations.py`'s own header for the
 # regenerate/verify commands.
-from _declarations import (BOOT_TIMEOUT_S, COST_REFERENCE_RATE, COST_TIMEOUT_S,
+from _declarations import (ADDRESS_SPACE_LIMIT_RAM_FRACTION, BOOT_TIMEOUT_S, COST_REFERENCE_RATE, COST_TIMEOUT_S,
                            MEASURE_BASE_RATE, OPERATIONAL_RATE_FLOOR, PLUGIN_TIMEOUT_S,
                            QUALIFY_RATES, QUANTUM_FRAMES)
 
+# the outcome of a worker past its address space, the same word as a direct spawn of plugin-qualify's (src/direct-limit.ts)
+MEMORY_LIMIT_EXCEEDED = "memory-limit-exceeded"
+
 try:  # numpy is only needed by the worker (and as a fast path in the pure helpers)
     import numpy as _np
 except ImportError:  # pragma: no cover - CI runs the pure tests without numpy
@@ -172,7 +176,7 @@ COST_TONE_AMP = 0.5
 # whose tail is genuinely fat — the one that xruns mid-show — while being a stable
 # statistic at this sample count.
 COST_PERCENTILE = 95.0
-# Cost is anchored at the rig's canonical rate: the headline figure the operator asked for is
+# Cost is anchored at the rig's canonical rate: the headline figure asked for is
 # "how many of these fit in one core at the rig's rate". `COST_REFERENCE_RATE` is imported above
 # from `_declarations.py` — the same fact `cpu-cost.ts` declares, not a second 96000 literal.
 # A cost probe runs many more blocks than a latency probe; give it room.
@@ -1908,6 +1912,8 @@ def worker_main(rate, block, measure=False, cost=False, cpu=None,
                         host, uri, declared, res["measuredFrames"], job["sweep"])
                     if swept:
                         res["sweep"] = swept
+            except MemoryError:
+                res = {"error": MEMORY_LIMIT_EXCEEDED}
             except Exception as e:  # noqa: BLE001 - report, don't die
                 res = {"error": f"probe error: {e}"}
             if "measuredFrames" in res:
@@ -1924,6 +1930,8 @@ def worker_main(rate, block, measure=False, cost=False, cpu=None,
         symbol = arg
         try:
             frames, reason = probe_one(host, uri, symbol)
+        except MemoryError:
+            frames, reason = None, MEMORY_LIMIT_EXCEEDED
         except Exception as e:  # noqa: BLE001 - report, don't die, on python-level errors
             frames, reason = None, f"probe error: {e}"
         if frames is None:
@@ -1935,6 +1943,20 @@ def worker_main(rate, block, measure=False, cost=False, cpu=None,
 # --- the parent: batch loop with crash containment -----------------------------
 
 
+def address_space_limit(ram_bytes=None):
+    """What the worker runs under: RLIMIT_AS at ADDRESS_SPACE_LIMIT_RAM_FRACTION of the machine's RAM, since a direct
+    spawn has no runner to give it a cgroup; set between fork and exec. A plugin past it fails its allocation, which the
+    worker reports as `MEMORY_LIMIT_EXCEEDED` when Python sees it and which crash containment takes when the plugin dies."""
+    if ram_bytes is None:
+        ram_bytes = os.sysconf("SC_PAGE_SIZE") * os.sysconf("SC_PHYS_PAGES")
+    limit = int(ram_bytes * ADDRESS_SPACE_LIMIT_RAM_FRACTION)
+
+    def apply():
+        resource.setrlimit(resource.RLIMIT_AS, (limit, limit))
+
+    return apply
+
+
 class _Worker:
     """Handle on one worker subprocess: spawn, job/reply exchange, kill."""
 
@@ -1942,6 +1964,7 @@ class _Worker:
         self.proc = subprocess.Popen(
             cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL, text=True, bufsize=1,
+            preexec_fn=address_space_limit(),
         )
         ready = self._read_line(boot_timeout)
         parsed = parse_worker_line(ready)

package/tools/gen-python-declarations.mjs

@@ -33,6 +33,7 @@ const PY_NAMES = [
   'QUALIFY_RATES',
   'QUALIFY_QUANTA',
   'PLUGIN_TIMEOUT_S',
+  'ADDRESS_SPACE_LIMIT_RAM_FRACTION',
   'BOOT_TIMEOUT_S',
   'COST_TIMEOUT_S',
   'DESCRIPTOR_DIR_KEY',

package/tools/lv2-measure.mjs

@@ -60,6 +60,7 @@ import {
   urisFromScan,
 } from "../dist/measurement/index.js";
 import { LV2_HOSTING_TIMEOUT_S, LV2_MEASURE_TOOL_NAME, RT_INTERPOSE_NAME } from "../dist/qualify-declarations.js";
+import { addressSpaceLimited, directOutcome } from "../dist/direct-limit.js";
 import { halfPopulatedRefusal, locateNativeTools } from "../dist/tool-paths.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -135,9 +136,10 @@ function runHosting(step, uris, onProgress) {
   const lines = [];
   onProgress(step, { kind: "phase", plugins: uris.length, rate: Number(step.args[0]) });
   for (const uri of uris) {
-    const r = spawnSync(step.command, [uri, ...step.args], {
+    const limited = addressSpaceLimited(step.command, [uri, ...step.args]);
+    const r = spawnSync(limited.command, [...limited.args], {
       encoding: "utf8",
-      env: { ...process.env, ...step.env },
+      env: { ...process.env, ...step.env, ...limited.env },
       stdio: ["ignore", "pipe", "inherit"],
       timeout: LV2_HOSTING_TIMEOUT_S * 1000,
       maxBuffer: 16 << 20,
@@ -149,9 +151,10 @@ function runHosting(step, uris, onProgress) {
       ...(r.error?.code === "ETIMEDOUT" ? { timedOut: true } : {}),
       stdout: r.stdout ?? "",
     });
-    process.stderr.write(`  ${uri}: exit ${line.exit}\n`);
+    const limitHit = directOutcome(r.status, limited);
+    process.stderr.write(`  ${uri}: exit ${line.exit}${limitHit === undefined ? "" : ` (${limitHit.outcome})`}\n`);
     onProgress(step, { kind: "plugin" });
-    lines.push(line);
+    lines.push(limitHit === undefined ? line : { ...line, ...limitHit });
   }
   writeFileSync(step.produces, lines.map((l) => `${JSON.stringify(l)}\n`).join(""));
   return lines;

package/tools/lv2_presets.py

@@ -16,7 +16,7 @@ body, and judges it against the plugin's own descriptor params:
   listed — refuse or report, never drop.
 
 Only the bundles lilv loads from LV2_PATH are read, which is what the scan reads: the presets a
-plugin ships, never one another host saved in a user's home (ruling 2). The output is sorted by
+plugin ships, never one another host saved in a user's home (decision 2). The output is sorted by
 preset URI and the values by symbol, so the same install yields the same bytes.
 """
 

package/tools/mod-host-admit.mjs

@@ -40,7 +40,8 @@ async function connect() {
 async function main() {
   if ((await Promise.race([spawnFailed, sleep(200).then(() => undefined)])) === "ENOENT") return { installed: false, steps: [] };
   const sock = await connect();
-  if (sock === undefined) return { installed: true, steps: [{ cmd: "add", died: hostEnd ?? "closed" }] };
+  // the host never listened (omx-clap-host with no JACK server): the plugin was never loaded
+  if (sock === undefined) return { installed: true, started: false, steps: [] };
   let buffer = "";
   let closed = false;
   sock.on("data", (d) => (buffer += d.toString()));