@openmixer/plugin-qualify 0.17.5 → 0.18.1

package/src/hosting-suitability.ts

@@ -30,6 +30,7 @@ import type {
   SoakReading,
   ThreadReading,
 } from "./measurement/format.js";
+import { memoryWithinBudget, type MemoryReadings } from "./memory-budget.js";
 
 /**
  * What a reason may interpolate: wire-serialisable scalars only. Structurally the same record as
@@ -71,6 +72,8 @@ export interface QualifiedPlugin {
   readonly lv2Features?: PluginLv2Features;
   /** The plugin's binary format, the scan's declared fact (CLAP spec §6); absent reads `lv2`. */
   readonly format?: "lv2" | "clap";
+  /** What one instance holds: per rate, or per rate AND quantum as {@link cpuCost} has it. A missing cell is unmeasured. */
+  readonly memory?: MemoryReadings;
   /** What the CLAP prober (`native/clap-qualify`) measured, for a `clap` plugin (CLAP spec §3). */
   readonly clap?: PluginClapMeasurement;
 }
@@ -78,14 +81,15 @@ export interface QualifiedPlugin {
 /** Where a plugin's audio is actually processed. */
 export type HostingPath = "in-process" | "isolated";
 
-/** The dimensions that decide a host. Six, folded worst-wins. */
+/** The dimensions that decide a host, folded worst-wins. */
 export type HostingDimension =
   | "stability"
   | "rtSafety"
   | "features"
   | "cost"
   | "latency"
-  | "topology";
+  | "topology"
+  | "memory";
 
 // The in-process feature list and the CLAP host extensions are the `openmixer-console` host
 // profile's; they live with the profiles (`host-profiles.ts`) and are re-exported here, where the
@@ -446,13 +450,15 @@ export function deadAgainstBest(levelDbfs: number, bestDbfs: number, policy: Hos
 }
 
 /** The classes of soak failure, as the strings `failures` is built from. */
-export type SoakFailureKind = "died" | "non-finite" | "dead" | "mostly-silent" | "startup-blast" | "timed-out";
+export type SoakFailureKind = "died" | "non-finite" | "dead" | "mostly-silent" | "startup-blast" | "timed-out" | "leaks";
 
 export interface SoakFailure {
   readonly rate: number;
   readonly kind: SoakFailureKind;
   /** Extra words for the string form, e.g. `20dBFS`. */
   readonly detail?: string;
+  /** For `leaks`: what the growth was and the ceiling it passed, which the reason carries. */
+  readonly params?: CodedRefusalParams;
 }
 
 /** A soak's reading: what voided it, if anything, and what it proved when nothing did. */
@@ -465,7 +471,7 @@ export interface SoakFindings {
    *  cut, a fact about the harness: it voids the soak but is never a failure of the plugin. */
   readonly failed: readonly SoakFailure[];
   readonly ratesTested: number;
-  /** The largest RSS growth across rates, for the record; not judged. */
+  /** The largest RSS growth across rates, warm-up included, for the record; `leaks` is what is judged. */
   readonly rssGrowthKb: number;
 }
 
@@ -473,6 +479,17 @@ export interface SoakFindings {
  *  settled above it cannot be the reference, or every sane rate reads dead against it. */
 const BLAST_DBFS = 6;
 
+/**
+ * The growth a rate's soak is still showing, in KB per minute of audio: from halfway past warm-up to its highest reading,
+ * so that a library that finishes loading a little late is not a leak and a leak of any size is. `undefined` when the soak
+ * did not reach those readings: not read as flat.
+ */
+export function soakGrowthKbPerMin(v: SoakAtRate): number | undefined {
+  const { rssMidKb, midSeconds, rssMaxKb, seconds } = v;
+  if (rssMidKb === undefined || midSeconds === undefined || rssMaxKb === undefined || seconds === undefined || seconds <= midSeconds) return undefined;
+  return (Math.max(rssMaxKb - rssMidKb, 0) * 60) / (seconds - midSeconds);
+}
+
 /**
  * Read a soak, rate by rate. A rate voids it if the plugin did not instantiate or died there,
  * emitted a non-finite window, settled dead against its own best rate ({@link deadAgainstBest};
@@ -516,7 +533,23 @@ export function soakFindings(soak: SoakReading | undefined, policy: HostingPolic
       continue;
     }
     const first = v.firstRmsDbfs ?? -99;
-    if (first > BLAST_DBFS) failed.push({ rate, kind: "startup-blast", detail: `${first.toFixed(0)}dBFS` });
+    if (first > BLAST_DBFS) {
+      failed.push({ rate, kind: "startup-blast", detail: `${first.toFixed(0)}dBFS` });
+      continue;
+    }
+    const growth = soakGrowthKbPerMin(v);
+    if (growth !== undefined && growth > policy.memoryGrowthKbPerMinCeiling) {
+      failed.push({
+        rate,
+        kind: "leaks",
+        detail: `${growth.toFixed(0)}KB/min`,
+        params: {
+          growthKbPerMin: Math.round(growth),
+          ceilingKbPerMin: policy.memoryGrowthKbPerMinCeiling,
+          ...(policy.memoryGrowthCeilingProvisional ? { provisional: "yes" as const } : {}),
+        },
+      });
+    }
   }
   const failures = failed.map((f) => `${f.kind}@${f.rate}${f.detail === undefined ? "" : `(${f.detail})`}`);
   return {
@@ -592,6 +625,7 @@ export function stabilityReasons(
       reason("stability", "objective", "unsuitable", HOSTING_CODE.stabilitySoakFailedAtRate, {
         failure: f.kind,
         rate: f.rate,
+        ...f.params,
       }),
     );
   }
@@ -650,9 +684,11 @@ export function rtSafetyReasons(
   if (m.variable === true) {
     return [reason("rtSafety", "objective", "unknown", HOSTING_CODE.rtSafetyNotReproducible)];
   }
+  // RT-unsafe is a hosting mode, never a refusal (#196): the plugin loads and runs in a worker of its own, never
+  // grouped with RT-safe plugins; conditional is isolated in the pin. Crashes, hangs and load failures stay unsuitable.
   if (rtSafetyViolating(m)) {
     return [
-      reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.rtSafetyViolations, {
+      reason("rtSafety", "objective", "conditional", HOSTING_CODE.rtSafetyViolations, {
         allocations: m.allocationsInRun ?? 0,
         syscalls: m.syscallsInRun ?? 0,
         locks: m.locksInRun ?? 0,
@@ -777,6 +813,60 @@ export function hostingCostReasons(
   return out;
 }
 
+/**
+ * What a host's memory budget makes of a plugin. A host with no budget declared reads nothing here. Every cell the host
+ * runs is read; the worst stands, so a plugin is never read as fitting on the cell that happened to be measured. A missing
+ * figure is `unknown`, never a fit. Under a provisional budget a plugin below the ceiling is `conditional` with a code of its
+ * own, since the number it was held to was not measured on that kind of host; one above it is `unsuitable` and says the
+ * ceiling is provisional.
+ */
+export function hostingMemoryReasons(
+  memory: MemoryReadings | undefined,
+  profile: HostProfile,
+  /** The live rate and quantum, for a host whose budget names no cells of its own; absent, the cell its cost is read at. */
+  live?: { readonly rate: number; readonly quantum?: number },
+): readonly HostingReason[] {
+  const budget = profile.cost.memory;
+  if (budget === undefined) return [];
+  const provisional: CodedRefusalParams = budget.provisional === true ? { provisional: "yes" } : {};
+  const cells = budget.cells ?? [{ rate: live?.rate ?? profile.cost.rate, quantum: live?.quantum ?? profile.cost.quantum }];
+  const reads = cells.map((c) => ({ ...c, read: memoryWithinBudget(memoryAt(memory, c.rate, c.quantum), budget) }));
+  const above = reads.find((r) => r.read.outcome === "above");
+  if (above !== undefined && above.read.outcome === "above") {
+    return [
+      reason("memory", "objective", "unsuitable", HOSTING_CODE.memoryAboveCeiling, {
+        rate: above.rate,
+        quantum: above.quantum,
+        figure: above.read.figure,
+        kb: above.read.kb,
+        ceilingKb: above.read.ceilingKb,
+        ...provisional,
+      }),
+    ];
+  }
+  const unmeasured = reads.find((r) => r.read.outcome === "unmeasured");
+  if (unmeasured !== undefined && unmeasured.read.outcome === "unmeasured") {
+    return [
+      reason("memory", "objective", "unknown", HOSTING_CODE.memoryUnmeasured, {
+        rate: unmeasured.rate,
+        quantum: unmeasured.quantum,
+        ...(unmeasured.read.unmeasuredReason === undefined ? {} : { unmeasuredReason: unmeasured.read.unmeasuredReason }),
+      }),
+    ];
+  }
+  const first = reads[0]!.read;
+  const params: CodedRefusalParams = first.outcome === "within" ? { perInstanceKb: first.perInstanceKb, firstInstanceKb: first.firstInstanceKb, ceilingKb: budget.perInstanceKb, consoleCeilingKb: budget.perConsoleKb } : {};
+  return budget.provisional === true
+    ? [reason("memory", "objective", "conditional", HOSTING_CODE.memoryWithinProvisionalCeiling, { ...params, ...provisional })]
+    : [reason("memory", "objective", "suitable", HOSTING_CODE.memoryWithinCeiling, params)];
+}
+
+/** The footprint at a rate and quantum: a grid's cell when the plugin has a grid, else its rate's. */
+function memoryAt(memory: MemoryReadings | undefined, rate: number, quantum: number) {
+  if (memory?.perRateQuantum !== undefined) return memory.perRateQuantum[costPointKey(rate, quantum)];
+  return memory?.perRate?.[String(rate)];
+}
+
 export function hostingLatencyReasons(
   descriptor: Pick<QualifiedPlugin, "latency">,
   handling: HostProfile["latency"] = "compensated",
@@ -924,7 +1014,8 @@ export function clapFeatureReasons(
 /**
  * The CLAP additions to `rtSafety` (CLAP spec §3): the interposer's counts are read by
  * `rtSafetyReasons` exactly as for an LV2; these are the two violations only a CLAP can commit
- * — a strict thread-check violation and a `CLAP_PROCESS_ERROR` — each `unsuitable`. A sweep
+ * — a strict thread-check violation (`conditional`: the plugin runs isolated, #196) and a `CLAP_PROCESS_ERROR`
+ * (`unsuitable`). A sweep
  * that made no `process()` call measured nothing.
  */
 export function clapRtReasons(clap: PluginClapMeasurement | undefined): readonly HostingReason[] {
@@ -933,7 +1024,7 @@ export function clapRtReasons(clap: PluginClapMeasurement | undefined): readonly
   }
   const out: HostingReason[] = [];
   if (clap.threadViolations > 0) {
-    out.push(reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.clapThreadViolation, { violations: clap.threadViolations }));
+    out.push(reason("rtSafety", "objective", "conditional", HOSTING_CODE.clapThreadViolation, { violations: clap.threadViolations }));
   }
   if (clap.processErrors > 0) {
     out.push(reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.clapProcessError, { errors: clap.processErrors }));
@@ -945,8 +1036,9 @@ export function clapRtReasons(clap: PluginClapMeasurement | undefined): readonly
  * The rtSafety reasons of the note sweep, for a plugin with `noteInputs` note inputs: none for a
  * plugin that takes no notes; `unknown` when it takes notes and was not played under the
  * interposer (an instrument is cheap and clean at rest, so the parameter sweep alone says nothing
- * about a voice); `unsuitable` on any allocation, lock or syscall while it was played, or a process
- * error; `suitable` on a clean count.
+ * about a voice); `conditional` (isolated in the pin: its own worker, never refused) on any
+ * allocation, lock or syscall while it was played; `unsuitable` on a process error only (a crash);
+ * `suitable` on a clean count.
  */
 export function noteSweepReasons(sweep: PluginNoteSweepMeasurement | undefined, noteInputs: number): readonly HostingReason[] {
   if (noteInputs === 0) return [];
@@ -957,7 +1049,7 @@ export function noteSweepReasons(sweep: PluginNoteSweepMeasurement | undefined,
   const out: HostingReason[] = [];
   if (sweep.allocationsInRun + sweep.locksInRun + sweep.syscallsInRun > 0) {
     out.push(
-      reason("rtSafety", "objective", "unsuitable", HOSTING_CODE.rtSafetyNotesViolations, {
+      reason("rtSafety", "objective", "conditional", HOSTING_CODE.rtSafetyNotesViolations, {
         allocations: sweep.allocationsInRun,
         syscalls: sweep.syscallsInRun,
         locks: sweep.locksInRun,
@@ -1002,6 +1094,7 @@ export function classifyPluginHosting(
         ...(profile.instruments ? noteSweepReasons(descriptor.rtSafety?.noteSweep, descriptor.clap?.noteInputs ?? (descriptor.hasMidiIn ? 1 : 0)) : []),
         ...clapFeatureReasons(descriptor.clap, profile, descriptor.hasMidiIn),
         ...hostingCostReasons(descriptor, options, policy),
+        ...hostingMemoryReasons(descriptor.memory, profile, options),
         ...clapLatencyReasons(descriptor.clap),
         ...clapTopologyReasons(descriptor.clap, profile.instruments),
       ]
@@ -1011,6 +1104,7 @@ export function classifyPluginHosting(
         ...(profile.instruments ? noteSweepReasons(descriptor.rtSafety?.noteSweep, descriptor.hasMidiIn ? 1 : 0) : []),
         ...featureReasons(descriptor.lv2Features, descriptor, profile.lv2Features, options.quantum !== undefined, profile.instruments),
         ...hostingCostReasons(descriptor, options, policy),
+        ...hostingMemoryReasons(descriptor.memory, profile, options),
         ...hostingLatencyReasons(descriptor, profile.latency),
         ...hostingTopologyReasons(descriptor, profile.instruments),
       ];

package/src/index.ts

@@ -10,6 +10,7 @@ export * from "./tool-paths.js";
 export * from "./rating.js";
 export * from "./host-profiles.js";
 export * from "./hosting-suitability.js";
+export * from "./memory-budget.js";
 export * from "./hosting-codes.js";
 export * from "./loader.js";
 export * from "./lv2-loader.js";
@@ -30,6 +31,8 @@ export * from "./probe-merge.js";
 export * from "./judge-cli.js";
 export * from "./whole-file.js";
 export * from "./qualify-sync.js";
+export * from "./qualify-rejudge.js";
+export * from "./qualify-adapter-pass.js";
 export * from "./distributed-records.js";
 export * from "./records-package.js";
 export * from "./host-admission.js";

package/src/measurement/format.ts

@@ -78,8 +78,10 @@ export const MEASUREMENT_FORMAT_MAJOR = 1;
  *  {@link RtSafetyMeasurement}, {@link FeaturesMeasurement} — which a 1.0 reader skips.
  *  `1.2` added the verdicts per host profile; `1.3` the {@link IntegrityMeasurement} block; `1.4` the notes
  *  an instrument's cost was measured with ({@link CostAtRate.voices}); `1.5` the note sweep an instrument's
- *  `run()` was counted under ({@link RtSafetyMeasurement.noteSweep}). */
-export const MEASUREMENT_FORMAT_MINOR = 5;
+ *  `run()` was counted under ({@link RtSafetyMeasurement.noteSweep}); `1.6` an instance's memory footprint
+ *  beside the cost reading ({@link CostAtRate.memory}), the soak's readings past warm-up
+ *  ({@link SoakAtRate.rssAfterWarmupKb}), and a host profile's memory budget ({@link HostBudget.memory}). */
+export const MEASUREMENT_FORMAT_MINOR = 6;
 
 /** The version string this build writes, e.g. `"1.0"`. */
 export const MEASUREMENT_FORMAT_VERSION = `${MEASUREMENT_FORMAT_MAJOR}.${MEASUREMENT_FORMAT_MINOR}`;
@@ -285,6 +287,28 @@ export interface VoicesHeld {
   readonly capacity?: number;
 }
 
+/**
+ * 1.6: what one instance holds at this rate: how far the resident set of a process of its own grew from before the
+ * plugin loaded, in KB, at each step of its life. Raw readings, never a conclusion: `memory-budget.ts` reads them against
+ * a budget. `secondInstanceKb` is what a second instance added once it had done the same, so what one instance costs is
+ * told from what every instance shares (a sample library, a wavetable, an IR). `notesHeldKb` and its `basis` are an
+ * instrument's, at the notes the cost arm holds.
+ *
+ * A figure not taken is absent, never 0; `unmeasuredReason` (an {@link ../vocabulary.UNMEASURED_TERMS} code) says why
+ * one that should be there is not, and may stand beside the figures that were taken.
+ */
+export interface MemoryFootprint {
+  readonly afterInstantiateKb?: number;
+  readonly afterActivateKb?: number;
+  /** Activated, after processing: what a long-running host carries. */
+  readonly atRestKb?: number;
+  readonly notesHeldKb?: number;
+  readonly secondInstanceKb?: number;
+  readonly basis?: VoiceBasis;
+  readonly unmeasuredReason?: string;
+  readonly unmeasuredDetail?: string;
+}
+
 /** One rate's cost reading. Per SAMPLE, so it is independent of the block size. */
 export interface CostAtRate {
   readonly nsPerSampleMedian: number;
@@ -303,6 +327,8 @@ export interface CostAtRate {
   readonly silentOutput?: boolean;
   /** 1.4: for an instrument, the notes held while it was timed. Absent for an effect. */
   readonly voices?: VoicesHeld;
+  /** 1.6: this instance's memory footprint at the same rate. */
+  readonly memory?: MemoryFootprint;
 }
 
 /** Everything one run learned about one plugin's CPU cost. */
@@ -368,6 +394,12 @@ export interface SoakAtRate {
   readonly rssStartKb?: number;
   readonly rssMaxKb?: number;
   readonly rssGrowthKb?: number;
+  /** 1.6: the resident set past the settling `firstRmsDbfs` skips, and the audio-seconds to reach it. */
+  readonly rssAfterWarmupKb?: number;
+  readonly warmupSeconds?: number;
+  /** 1.6: the resident set halfway from there to the end, so that growth which stopped is told from growth still climbing. */
+  readonly rssMidKb?: number;
+  readonly midSeconds?: number;
 }
 
 /** A continuous soak, per rate, with whether the controls were swept while it ran. */
@@ -501,6 +533,22 @@ export interface HostBudget {
   readonly coreFractionCeiling: number;
   readonly rate: number;
   readonly quantum: number;
+  /** 1.6: what this host gives its plugins' memory; absent is a host with no budget declared, never a budget of 0. */
+  readonly memory?: HostMemoryBudget;
+}
+
+/**
+ * 1.6: a host's memory budget, and where it is read. `perInstanceKb` bounds what one more instance costs;
+ * `perConsoleKb` bounds all the plugins of the host, so the most one plugin may take with what its instances share.
+ * `provisional` says the numbers were not measured on that kind of host: a verdict that rests on them says so and does
+ * not say the plugin fits. `cells` are the rates and quanta the host runs, each judged, where it runs more than the one
+ * its cost is read at.
+ */
+export interface HostMemoryBudget {
+  readonly perInstanceKb: number;
+  readonly perConsoleKb: number;
+  readonly provisional?: boolean;
+  readonly cells?: readonly { readonly rate: number; readonly quantum: number }[];
 }
 
 /**
@@ -554,6 +602,24 @@ const isPositive = (v: unknown): v is number => typeof v === "number" && Number.
  * typed; a missing or mistyped one is refused by name, and a host the reader was not told about
  * is never filled in from a default.
  */
+/** A budget, `undefined` for none declared, or the words of what is wrong with it. */
+function readHostMemoryBudget(value: unknown): HostMemoryBudget | undefined | string {
+  if (value === undefined) return undefined;
+  if (!isRecord(value)) return "cost.memory: an object, or absent";
+  if (!isPositive(value.perInstanceKb) || !isPositive(value.perConsoleKb)) return "cost.memory: perInstanceKb and perConsoleKb are positive numbers";
+  if (value.provisional !== undefined && typeof value.provisional !== "boolean") return "cost.memory.provisional: a boolean, or absent";
+  const cells = value.cells;
+  if (cells !== undefined && (!Array.isArray(cells) || cells.length === 0 || !cells.every((c) => isRecord(c) && Number.isInteger(c.rate) && Number.isInteger(c.quantum) && isPositive(c.rate) && isPositive(c.quantum)))) {
+    return "cost.memory.cells: rates and quanta as positive integers, or absent";
+  }
+  return {
+    perInstanceKb: value.perInstanceKb,
+    perConsoleKb: value.perConsoleKb,
+    ...optional("provisional", value.provisional as boolean | undefined),
+    ...optional("cells", (cells as readonly Record<string, number>[] | undefined)?.map((c) => ({ rate: c.rate!, quantum: c.quantum! }))),
+  };
+}
+
 export function readHostProfile(value: unknown): HostProfileRead {
   if (!isRecord(value)) return { ok: false, problem: "a host profile is a JSON object" };
   const { id, lv2Features, clapExtensions, instruments, cost, latency, isolation } = value;
@@ -569,6 +635,8 @@ export function readHostProfile(value: unknown): HostProfileRead {
   if (!Number.isInteger(cost.rate) || !Number.isInteger(cost.quantum)) {
     return { ok: false, problem: "cost: rate and quantum are integers" };
   }
+  const memory = readHostMemoryBudget(cost.memory);
+  if (typeof memory === "string") return { ok: false, problem: memory };
   if (!(HOST_LATENCY_HANDLING as readonly unknown[]).includes(latency)) {
     return { ok: false, problem: `latency: one of ${HOST_LATENCY_HANDLING.join(", ")}` };
   }
@@ -582,7 +650,7 @@ export function readHostProfile(value: unknown): HostProfileRead {
       lv2Features,
       clapExtensions,
       instruments,
-      cost: { coreFractionCeiling: cost.coreFractionCeiling, rate: cost.rate, quantum: cost.quantum },
+      cost: { coreFractionCeiling: cost.coreFractionCeiling, rate: cost.rate, quantum: cost.quantum, ...optional("memory", memory) },
       latency: latency as HostLatencyHandling,
       isolation: isolation as HostIsolation,
     },
@@ -851,6 +919,27 @@ function readLatency(value: unknown): LatencyMeasurement | undefined {
   };
 }
 
+/** A KB figure: finite and never negative. */
+function kilobytes(value: unknown): number | undefined {
+  const n = finiteNumber(value);
+  return n !== undefined && n >= 0 ? n : undefined;
+}
+
+/** A memory footprint, or `undefined` unless it carries at least one figure or a reason. */
+export function readMemoryFootprint(value: unknown): MemoryFootprint | undefined {
+  if (!isRecord(value)) return undefined;
+  const footprint: MemoryFootprint = {
+    ...optional("afterInstantiateKb", kilobytes(value.afterInstantiateKb)),
+    ...optional("afterActivateKb", kilobytes(value.afterActivateKb)),
+    ...optional("atRestKb", kilobytes(value.atRestKb)),
+    ...optional("notesHeldKb", kilobytes(value.notesHeldKb)),
+    ...optional("secondInstanceKb", kilobytes(value.secondInstanceKb)),
+    ...optional("basis", isVoiceBasis(value.basis) ? value.basis : undefined),
+    ...reasonOf(value),
+  };
+  return Object.keys(footprint).length > 0 ? footprint : undefined;
+}
+
 function readCostAtRate(value: unknown): CostAtRate | undefined {
   if (!isRecord(value)) return undefined;
   const nsPerSampleMedian = finiteNumber(value.nsPerSampleMedian);
@@ -875,6 +964,7 @@ function readCostAtRate(value: unknown): CostAtRate | undefined {
     ...optional("warmupNsPerSampleMedian", finiteNumber(value.warmupNsPerSampleMedian)),
     ...optional("silentOutput", booleanValue(value.silentOutput)),
     ...optional("voices", readVoicesHeld(value.voices)),
+    ...optional("memory", readMemoryFootprint(value.memory)),
   };
 }
 
@@ -957,6 +1047,10 @@ export function readSoakAtRate(value: unknown): SoakAtRate | undefined {
     ...optional("rssStartKb", finiteNumber(value.rssStartKb)),
     ...optional("rssMaxKb", finiteNumber(value.rssMaxKb)),
     ...optional("rssGrowthKb", finiteNumber(value.rssGrowthKb)),
+    ...optional("rssAfterWarmupKb", kilobytes(value.rssAfterWarmupKb)),
+    ...optional("warmupSeconds", finiteNumber(value.warmupSeconds)),
+    ...optional("rssMidKb", kilobytes(value.rssMidKb)),
+    ...optional("midSeconds", finiteNumber(value.midSeconds)),
   };
 }
 

package/src/measurement/plan.ts

@@ -38,7 +38,7 @@ export interface InstallationRates {
   readonly liveRate?: number;
   /** Rates the active device actually offers. Empty/absent = the console has not probed. */
   readonly supportedRates?: readonly number[];
-  /** Rates the operator asked for. Absent = "whatever this installation can use". */
+  /** Rates the caller asked for. Absent = "whatever this installation can use". */
   readonly requestedRates?: readonly number[];
 }
 
@@ -47,7 +47,7 @@ export interface RatePlan {
   /** Rates to measure, ascending. Empty when nothing could be resolved. */
   readonly rates: readonly number[];
   /**
-   * Rates the operator asked for that the installation does not offer. Reported, not
+   * Rates the caller asked for that the installation does not offer. Reported, not
    * measured — a figure at a rate the rig cannot run is a figure nobody will ever use, and
    * quietly measuring it would make the run longer for nothing.
    */
@@ -63,7 +63,7 @@ export interface RatePlan {
  * Resolve the rates a local run should measure at.
  *
  * The live rate is always included when known — a console must have figures for the rate it
- * is running at, whatever else the operator asked for. Beyond that: the requested rates
+ * is running at, whatever else the caller asked for. Beyond that: the requested rates
  * intersected with what the device offers, or, absent a request, the whole supported list.
  */
 export function ratesForInstallation(input: InstallationRates): RatePlan {

package/src/measurement-grid.ts

@@ -72,6 +72,11 @@ export function gridCells(
   return unique([...lead.filter((c) => inProduct.has(cellKey(c))), ...product]);
 }
 
+/** The cells a host is judged at: the one its cost is read at, then the others its memory budget says it runs. */
+export function hostCells(profile: { readonly cost: GridCell & { readonly memory?: { readonly cells?: readonly GridCell[] } } }): GridCell[] {
+  return unique([{ rate: profile.cost.rate, quantum: profile.cost.quantum }, ...(profile.cost.memory?.cells ?? [])]);
+}
+
 /** The first `budget` cells, or every one when the budget is absent or 0. */
 export function budgetCells(cells: readonly GridCell[], budget: number | undefined): GridCell[] {
   return budget === undefined || budget === 0 ? [...cells] : cells.slice(0, budget);

package/src/memory-bound.ts

@@ -17,9 +17,18 @@ import { MEMORY_BOUND_EXIT_STATUS, MEMORY_LIMIT_RAM_FRACTION } from "./qualify-d
 /** How the bound is applied: the runner's data limit on the child. */
 export const MEMORY_BOUND_MECHANISM = "rlimit-data";
 
+/** How the bound was applied when the runner set it as its cgroup's `memory.max`, which its document says. */
+export const MEMORY_CGROUP_MECHANISM = "cgroup-memory-max";
+
 /** The outcome of a run, and of each of its cells, that outgrew the bound. */
 export const PROBE_OOM = "probe.oom";
 
+/** The runner's own outcome for a child the kernel killed at its cgroup's `memory.max`. */
+export const PROBE_MEMORY_LIMIT = "probe.memory-limit";
+
+/** Whether an outcome says a run outgrew its memory limit, by either bound. */
+export const isOutOfMemory = (outcome: string): boolean => outcome === PROBE_OOM || outcome === PROBE_MEMORY_LIMIT;
+
 export interface MemoryBound {
   readonly bytes: number;
   readonly mechanism: typeof MEMORY_BOUND_MECHANISM;
@@ -50,6 +59,7 @@ export function memoryBoundOf(setting: number | "off" | undefined, ramBytes?: nu
 
 /** Whether a run under `bound` ended out of memory: the interposer's exit status, or a SIGKILL that was no deadline's. */
 export function outOfMemory(output: ProbeOutput, bound: MemoryBound | undefined): boolean {
+  if (output.run.outcome === PROBE_MEMORY_LIMIT || output.steps.some((s) => s.outcome === PROBE_MEMORY_LIMIT)) return true;
   if (bound === undefined) return false;
   return output.steps.some((s) => s.exitStatus === MEMORY_BOUND_EXIT_STATUS || (s.signal === "SIGKILL" && s.outcome === "probe.crashed"));
 }

package/src/memory-budget.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Pau Aliagas <linuxnow@gmail.com>
+/**
+ * What a measured footprint comes to, and whether it fits a host's budget. Pure: the readings come from the measurers, the
+ * budget from the host profile, and the verdict's reasons from `hosting-suitability.ts`.
+ *
+ * Two figures come out of a footprint. `firstInstanceKb` is the most one instance held at any step, with everything its
+ * instances share. `perInstanceKb` is what one more instance costs: the second instance's own part and its voices. A host's
+ * `perInstanceKb` bounds the second and its `perConsoleKb` the first, so a sampler with a large library shared between
+ * instances can fit a small host once and still be read correctly for two.
+ *
+ * Nothing absent reads as fitting: no figure, or a reason beside the figures, is `unmeasured`.
+ */
+import type { HostMemoryBudget, MemoryFootprint } from "./measurement/format.js";
+
+/** A plugin's footprints as a verdict reads them: per rate, or per rate and quantum (a probe output's grid). */
+export interface MemoryReadings {
+  readonly perRate?: Readonly<Record<string, MemoryFootprint>>;
+  readonly perRateQuantum?: Readonly<Record<string, MemoryFootprint>>;
+}
+
+/** The most one instance held at any step, with everything its instances share. `undefined` for no figure. */
+export function firstInstanceKb(f: MemoryFootprint): number | undefined {
+  const figures = [f.afterInstantiateKb, f.afterActivateKb, f.atRestKb, f.notesHeldKb].filter((v): v is number => v !== undefined);
+  return figures.length === 0 ? undefined : Math.max(...figures);
+}
+
+/**
+ * What one more instance costs: the second instance's own part and the voices of this one. With no second instance
+ * measured, the whole of the first, since nothing separates what it shares.
+ */
+export function perInstanceKb(f: MemoryFootprint): number | undefined {
+  const first = firstInstanceKb(f);
+  if (first === undefined) return undefined;
+  if (f.secondInstanceKb === undefined) return first;
+  const voices = f.notesHeldKb !== undefined && f.atRestKb !== undefined ? Math.max(f.notesHeldKb - f.atRestKb, 0) : 0;
+  return f.secondInstanceKb + voices;
+}
+
+export type MemoryBudgetRead =
+  | { readonly outcome: "within"; readonly perInstanceKb: number; readonly firstInstanceKb: number }
+  | { readonly outcome: "above"; readonly figure: "perInstance" | "firstInstance"; readonly kb: number; readonly ceilingKb: number }
+  | { readonly outcome: "unmeasured"; readonly unmeasuredReason?: string };
+
+/** A footprint against a budget. A missing figure is `"unmeasured"`, never a fit; a figure above a ceiling is above it whatever else is missing. */
+export function memoryWithinBudget(footprint: MemoryFootprint | undefined, budget: HostMemoryBudget): MemoryBudgetRead {
+  const first = footprint === undefined ? undefined : firstInstanceKb(footprint);
+  const per = footprint === undefined ? undefined : perInstanceKb(footprint);
+  if (first !== undefined && first > budget.perConsoleKb) return { outcome: "above", figure: "firstInstance", kb: first, ceilingKb: budget.perConsoleKb };
+  if (per !== undefined && per > budget.perInstanceKb) return { outcome: "above", figure: "perInstance", kb: per, ceilingKb: budget.perInstanceKb };
+  if (first === undefined || per === undefined || footprint?.unmeasuredReason !== undefined) {
+    return { outcome: "unmeasured", ...(footprint?.unmeasuredReason === undefined ? {} : { unmeasuredReason: footprint.unmeasuredReason }) };
+  }
+  return { outcome: "within", perInstanceKb: per, firstInstanceKb: first };
+}

package/src/probe-judge.ts

@@ -24,21 +24,23 @@ import {
   type ClapRtSafetyReading,
   type RtSafetyDocument,
 } from "./clap-qualify.js";
-import { gridCostReadings } from "./cost-fields.js";
+import { costPointKey, gridCostReadings } from "./cost-fields.js";
 import {
   hostingCostReasons,
+  hostingMemoryReasons,
   noteSweepReasons,
   rtSafetyReasons,
   contributedHostingRating,
   type HostingReason,
 } from "./hosting-suitability.js";
 import type { HostProfile } from "./host-profiles.js";
-import { admittedHostOf, type HostAdmission } from "./host-admission.js";
+import { runDecides, type HostAdmission } from "./host-admission.js";
 import { PROBE_NOT_ATTEMPTED, PROBE_OK, type ProbeGridPoint, type ProbeOutput } from "./probe-output.js";
 import type { QualifyVerdict } from "./qualify-cli.js";
 import { RATING_SEVERITY, worstRating, type SuitabilityRating } from "./rating.js";
 import type { IntegrityMeasurement, VoicesHeld } from "./measurement/format.js";
-import { PROBE_OOM } from "./memory-bound.js";
+import { isOutOfMemory } from "./memory-bound.js";
+import type { MemoryFootprint } from "./measurement/format.js";
 
 /** Facts of the descriptor, which the probe output repeats none of. */
 export interface JudgeFacts {
@@ -49,6 +51,11 @@ export interface JudgeFacts {
    * judged by it as well as by its declaration; one that has none is judged from its declaration alone.
    */
   readonly admissions?: Readonly<Record<string, HostAdmission>>;
+  /**
+   * The run each profile's verdict needs and the figures do not hold, by profile id (`qualify-rejudge.ts`): an `unknown`
+   * reason in that verdict, so that a verdict never claims a run nobody made.
+   */
+  readonly owed?: Readonly<Record<string, RecordReason>>;
 }
 
 /** A sum of one count over the points, or `undefined` when a point lacks it: a missing count is not zero. */
@@ -202,6 +209,13 @@ function decidingOf(reasons: readonly RecordReason[], rating: SuitabilityRating)
   return [...reasons].sort((a, b) => RATING_SEVERITY[b.rating] - RATING_SEVERITY[a.rating]).find((r) => r.rating === rating);
 }
 
+/** The footprints of the cells that ran to their end, as the verdict reads them. */
+function gridMemoryReadings(output: ProbeOutput): Record<string, MemoryFootprint> {
+  const out: Record<string, MemoryFootprint> = {};
+  for (const p of output.grid) if (p.outcome === PROBE_OK && p.memory !== undefined) out[costPointKey(p.rate, p.quantum)] = p.memory;
+  return out;
+}
+
 /** The grid point at a host's own cell, whatever its outcome; `undefined` when the grid does not hold that cell. */
 function cellOf(output: ProbeOutput, profile: HostProfile): ProbeGridPoint | undefined {
   return output.grid.find((p) => p.rate === profile.cost.rate && p.quantum === profile.cost.quantum);
@@ -235,10 +249,10 @@ function costOf(output: ProbeOutput, profile: HostProfile): HostJudgment["cost"]
  * first word; a grid point that failed under a run that says `probe.ok` is a document that contradicts
  * itself, and is read as the failure it records rather than as a pass that skipped the point.
  */
-function failedOutcome(output: ProbeOutput): string | undefined {
+export function failedOutcome(output: ProbeOutput): string | undefined {
   if (output.run.outcome !== PROBE_OK) return output.run.outcome;
   // a cell that outgrew the memory bound is a recorded outcome of that cell, judged per host below, not the run's end
-  return output.grid.find((p) => p.outcome !== PROBE_OK && p.outcome !== PROBE_NOT_ATTEMPTED && p.outcome !== PROBE_OOM)?.outcome;
+  return output.grid.find((p) => p.outcome !== PROBE_OK && p.outcome !== PROBE_NOT_ATTEMPTED && !isOutOfMemory(p.outcome))?.outcome;
 }
 
 /**
@@ -282,11 +296,15 @@ export function judgeProbeOutput(output: ProbeOutput, profiles: readonly HostPro
     }
     // the plugin did not run within the memory bound at this host's own rate and quantum: not hostable there as measured
     const cell = cellOf(output, profile);
-    if (cell?.outcome === PROBE_OOM) {
-      reasons = [...reasons, { dimension: "memory", rating: "unknown", code: PROBE_OOM, params: { rate: cell.rate, quantum: cell.quantum, ...memoryParams(cell) } }];
+    if (cell !== undefined && isOutOfMemory(cell.outcome)) {
+      reasons = [...reasons, { dimension: "memory", rating: "unknown", code: cell.outcome, params: { rate: cell.rate, quantum: cell.quantum, ...memoryParams(cell) } }];
+    } else {
+      // what this host's budget makes of the footprint, every cell it runs: part of the verdict, unlike the cost beside it
+      reasons = [...reasons, ...hostingMemoryReasons({ perRateQuantum: gridMemoryReadings(output) }, profile).map(asRecordReason)];
     }
     const admission = facts.admissions?.[profile.id];
-    if (admission !== undefined && admittedHostOf(profile) !== undefined) {
+    const ran = admission !== undefined && runDecides(profile, output.plugin.format, admission);
+    if (ran && admission !== undefined) {
       if (!admission.measured || !admission.admitted) {
         // the host could not be run, or the plugin did not survive it: the run decides, whatever the declaration says
         const code = admission.code ?? `${admission.host}.not-admitted`;
@@ -300,6 +318,8 @@ export function judgeProbeOutput(output: ProbeOutput, profiles: readonly HostPro
         };
       }
     }
+    const owed = facts.owed?.[profile.id];
+    if (owed !== undefined) reasons = [owed, ...reasons];
     const rating = worstRating(reasons.map((r) => r.rating));
     const deciding = decidingOf(reasons, rating);
     return {
@@ -312,7 +332,7 @@ export function judgeProbeOutput(output: ProbeOutput, profiles: readonly HostPro
         ...(deciding === undefined ? {} : { deciding: deciding.code }),
       },
       hosting: rating === "suitable" && profile.isolation === "in-process" ? "in-process" : "isolated",
-      arm: admission !== undefined && admittedHostOf(profile) !== undefined ? "run" : "declaration",
+      arm: ran ? "run" : "declaration",
       reasons,
       cost: costOf(output, profile),
     };