Release 0.5.0

.github/workflows/ci.yml

@@ -209,7 +209,10 @@ jobs:
             rpm -qp --qf '[%{FILEMODES:perms} %{FILENAMES}\n]' "$rpm" | grep -v -e '^d' -e '/\.build-id/' | cut -d' ' -f2 | sort > files.txt
             printf '%s\n' /usr/libexec/plugin-hostd/tests/fake-host /usr/share/licenses/plugin-hostd-tests/COPYING | sort > expected.txt
             diff -u expected.txt files.txt
-            rpm -qp --requires "$rpm" | grep -q '^plugin-hostd'
+            # tied to the same build: the requirement names the exact version-release and the isa of this very package
+            case "${{ matrix.arch }}" in x86_64) isa=x86-64 ;; aarch64) isa=aarch-64 ;; *) echo "no isa for ${{ matrix.arch }}"; exit 1 ;; esac
+            vr=$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$rpm")
+            rpm -qp --requires "$rpm" | grep -qxF "plugin-hostd($isa) = $vr"
           done
           ls rpms/plugin-hostd-tests-[0-9]*.${{ matrix.arch }}.rpm
           ls rpms/plugin-hostd-*.src.rpm
@@ -383,7 +386,8 @@ jobs:
 
   # docs/own-host.md, command by command, as a reader would type it: a clean Debian with nothing but what the page
   # lists, the published packages of the FreeMixer channel, on both architectures (arm64 is a native runner).
-  # A step of the page that stops working fails this job.
+  # A step of the page that stops working fails this job. The page's LV2 block runs an LV2 URI with
+  # `lv2_worker omx-clap-host`, and --audio then measures the gain of a sine that went through that instance.
   own-host-page:
     name: own-host page (${{ matrix.suite }}, ${{ matrix.arch }}), run as written in a clean container
     runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
@@ -411,13 +415,13 @@ jobs:
       - name: The reader stops on a wrong reply
         run: python3 tests/own_host_page.py selftest
 
-      - name: The page's commands
+      - name: The page's commands, the LV2 plugin included, and its audio
         run: |
           set -euo pipefail
           export XDG_RUNTIME_DIR=/tmp/xdg XDG_STATE_HOME=/tmp/state
           mkdir -p "$XDG_RUNTIME_DIR" "$XDG_STATE_HOME" /tmp/own-host
           cd /tmp/own-host
-          python3 "$GITHUB_WORKSPACE/tests/own_host_page.py" run
+          python3 "$GITHUB_WORKSPACE/tests/own_host_page.py" run --audio
           test "$(dpkg --print-architecture)" = "${{ matrix.arch }}"
 
   # The release workflow as a tag would run it, publishing nothing: both architectures build through the

.gitignore

@@ -16,3 +16,6 @@ tests/plugin-hostd-fixture.lv2/*.so
 tests/probe-child
 tests/lv2-probe-child
 tests/rt_interpose.so
+tests/gesture-alloc-test
+tests/lv2-alloc-test
+tests/lv2-alloc-lv2.o

Makefile

@@ -8,6 +8,8 @@ FAKE = tests/fake-host
 FORMAT_TEST = tests/format-test
 PIN_TEST = tests/pin-test
 RELAY_TEST = tests/relay-test
+GESTURE_ALLOC_TEST = tests/gesture-alloc-test
+LV2_ALLOC_TEST = tests/lv2-alloc-test
 PROBE = plugin-hostd-probe
 
 PKG_CONFIG ?= pkg-config
@@ -94,13 +96,15 @@ install: $(PROG) install_man install_protocol install_tests
 	install -m 755 $(PROBE) $(DESTDIR)$(BINDIR)
 
 # the declared protocol: the JSON for readers that are not C, which the package carries; the header, its pkg-config
-# file and the schema of the JSON, which the development package carries
+# file and the schema of the JSON, which the development package carries; and the pins_dir other packages drop their
+# pins in
 install_protocol:
 	install -d $(DESTDIR)$(DATADIR)/plugin-hostd
 	install -m 644 protocol/plugin-hostd.json $(DESTDIR)$(DATADIR)/plugin-hostd/protocol.json
 	install -m 644 protocol/mod-host.json $(DESTDIR)$(DATADIR)/plugin-hostd/mod-host.json
 	install -m 644 protocol/plugin-hostd.schema.json $(DESTDIR)$(DATADIR)/plugin-hostd/protocol.schema.json
 	install -m 644 protocol/probe-output.schema.json $(DESTDIR)$(DATADIR)/plugin-hostd/probe-output.schema.json
+	install -d $(DESTDIR)$(DATADIR)/plugin-hostd/pins.d
 	install -d $(DESTDIR)$(INCLUDEDIR)/plugin-hostd
 	install -m 644 include/plugin-hostd/protocol.h $(DESTDIR)$(INCLUDEDIR)/plugin-hostd/protocol.h
 	install -m 644 include/plugin-hostd/pin.h $(DESTDIR)$(INCLUDEDIR)/plugin-hostd/pin.h
@@ -126,11 +130,11 @@ private-refs:
 
 # clean rule
 clean:
-	@rm -f src/*.o $(PROG) $(PROBE) tests/probe-child tests/lv2-probe-child tests/rt_interpose.so $(FAKE) $(PIN_TEST) $(RELAY_TEST) tests/relay-test-relay.o $(FORMAT_TEST) $(GEN) tests/stress.clap tests/jack_levels tests/host_scenarios $(LV2_FIXTURE)
+	@rm -f src/*.o $(PROG) $(PROBE) tests/probe-child tests/lv2-probe-child tests/rt_interpose.so $(FAKE) $(PIN_TEST) $(RELAY_TEST) tests/relay-test-relay.o $(FORMAT_TEST) $(GESTURE_ALLOC_TEST) $(LV2_ALLOC_TEST) tests/lv2-alloc-lv2.o $(GEN) tests/stress.clap tests/jack_levels tests/host_scenarios $(LV2_FIXTURE)
 
 # the daemon against workers that are not plugin hosts at all (tests/fake-host speaks the same protocol and can be
 # made to die on cue): placement, forwarding, ledger, replay, attribution, the storm bound; no jack, no plugin
-test: test-pin test-relay test-format test-daemon check-generated check-schema test-probe-schema test-probe test-contract test-consumer test-perturbation check-readme check-own-host-page check-no-pins test-mod-host-json test-socket
+test: test-pin test-relay test-alloc test-format test-daemon check-generated check-schema test-probe-schema test-probe test-contract test-consumer test-perturbation check-readme check-own-host-page check-no-pins test-mod-host-json test-socket
 	MOD_HOST_DIR=$(MOD_HOST_DIR) python3 tests/verbs_contract.py
 
 # the same without the verb table, which is read from a mod-host checkout's README
@@ -172,6 +176,18 @@ test-relay: $(RELAY_TEST)
 $(RELAY_TEST): tests/relay_test.c src/relay.c src/relay.h include/plugin-hostd/protocol.h
 	$(CC) -Iinclude $(CFLAGS) -Werror -Drealloc=relay_test_realloc -c -o tests/relay-test-relay.o src/relay.c
 	$(CC) -Isrc $(CFLAGS) -Werror -o $@ tests/relay_test.c tests/relay-test-relay.o -pthread
+# the relay's gesture table and lv2.c's refusal and pick tables when memory runs out: each is built with its realloc
+# calls renamed, so the test picks the one that fails
+test-alloc: $(GESTURE_ALLOC_TEST) $(LV2_ALLOC_TEST)
+	./$(GESTURE_ALLOC_TEST)
+	./$(LV2_ALLOC_TEST)
+
+$(GESTURE_ALLOC_TEST): tests/gesture_alloc_test.c src/relay.c src/relay.h include/plugin-hostd/protocol.h
+	$(CC) -Iinclude -Isrc $(CFLAGS) -Werror -Drealloc=alloc_test_realloc -o $@ tests/gesture_alloc_test.c -pthread
+
+$(LV2_ALLOC_TEST): tests/lv2_alloc_test.c src/lv2.c src/formats.h
+	$(CC) $(INCS) -Isrc $(CFLAGS) -Werror -Drealloc=alloc_test_realloc -c -o tests/lv2-alloc-lv2.o src/lv2.c
+	$(CC) $(INCS) -Isrc $(CFLAGS) -Werror -o $@ tests/lv2_alloc_test.c tests/lv2-alloc-lv2.o
 
 tests/stress.clap: tests/stress_plugin.c
 	$(CC) $(CLAP_CFLAGS) $(CFLAGS) -Werror -shared -o $@ $<

README.md

@@ -103,9 +103,10 @@ The settings live in a file, `-c`, `$PLUGIN_HOSTD_CONF` or
 | `lv2_worker` | `mod-host` | who runs an LV2 plugin: mod-host (the mod_host program), omx-clap-host (the clap_host program, through its LV2 adapter, a plugin it cannot run refused with a code) or auto (the adapter first, mod-host for what it refuses, each such plugin in a worker of its own unless its add names a placement); lv2_worker_set overrides it for one plugin |
 | `lv2_path` | `$LV2_PATH`, else `/usr/lib64/lv2:/usr/lib/lv2:/usr/local/lib/lv2` | where bundles are searched |
 | `state_root` | `$XDG_RUNTIME_DIR`, else `/tmp` | the daemon's checkpoints and worker logs |
-| `pin_mode` | `first-use` | strict or first-use, while require_pins is 1: first-use records the pin of a plugin on its first add, strict admits only a plugin a controller or a pin_file pinned |
+| `pin_mode` | `first-use` | strict or first-use, while require_pins is 1: first-use records the pin of a plugin on its first add, strict admits only a plugin a controller, a pin_file or pins_dir pinned |
 | `pin_store` | `` | the file first-use pins are kept in; empty is $XDG_STATE_HOME/plugin-hostd/pins, else $HOME/.local/state/plugin-hostd/pins |
 | `pin_file` | `` | a file of pin lines loaded at start, as plugin-qualify --all --pins writes it; empty is none |
+| `pins_dir` | `/usr/share/plugin-hostd/pins.d` | the read-only pins of packages: every file in it whose name ends in .pins, read at start in name order, under the store, the pin_file and pin_set, except that a pin of verdict=refused there always holds; empty is none |
 | `ready_timeout_ms` | 5000 ms | a worker that does not accept in this long is a failed spawn |
 | `rpc_timeout_ms` | 5000 ms | a worker that does not answer in this long is killed |
 | `backoff_base_ms` | 250 ms | respawn backoff, doubling per death in the window |
@@ -158,10 +159,10 @@ Verbs the daemon adds
 | `policy_set` | `<format \| *> own \| pool:<name>` | `resp 0` | the placement of an add that says default |
 | `pool_config` | `<name> <max_instances>` | `resp 0` | the instances a pool holds before a sibling opens |
 | `worker_env` | `<format \| *> <cpu-list\|-> <nice\|->` | `resp 0` | the cpu list and the nice value of the workers of a format, at spawn and on the ones running |
-| `pin_set` | `<uri> <path>=<sha256>[,<path>=<sha256>...] <scheme>:<sha256> [verdict=<verdict>]` | `resp 0` | the pin of one plugin: the SHA-256 of every file the host loads for it, a path relative to the bundle (the directory of a single-file format's file), its layout fingerprint and, when it is known, the verdict of its qualification; it replaces an earlier pin of the uri. The pin store and a pin_file hold the same line, with or without the verb |
-| `pin_clear` | `<uri> \| all` | `resp 0` | forget the pin of one plugin, or of every one |
+| `pin_set` | `<uri> <path>=<sha256>[,<path>=<sha256>...] <scheme>:<sha256> [verdict=<verdict>]` | `resp 0` | the pin of one plugin: the SHA-256 of every file the host loads for it, a path relative to the bundle (the directory of a single-file format's file), its layout fingerprint and, when it is known, the verdict of its qualification; it replaces an earlier pin of the uri; -516 for a plugin whose pins_dir pin carries verdict=refused, which nothing overrides. The pin store, a pin_file and a pins_dir file hold the same line, with or without the verb |
+| `pin_clear` | `<uri> \| all` | `resp 0` | forget the pin of one plugin, or of every one; a pins_dir pin is read-only and holds again |
 | `lv2_worker_set` | `<uri> <mod-host \| omx-clap-host \| auto \| ->` | `resp 0` | the worker of one LV2 plugin, for its adds from now on: it overrides the lv2_worker setting, - takes the override back; -902 for a word that is none of these. Like policy_set it is the controller's, not in the ledger, gone with the daemon |
-| `pin_accept` | `<uri>` | `resp 0` | pin_mode first-use only: take the plugin's files as they are now as its pin, after a pin_changed event; the layout is learned again by the next add and the verdict is dropped; -508 when the plugin has no pin, -509 when its files cannot be collected, -902 under pin_mode strict |
+| `pin_accept` | `<uri>` | `resp 0` | pin_mode first-use only: take the plugin's files as they are now as its pin, after a pin_changed event; the layout is learned again by the next add and the verdict is dropped; -508 when the plugin has no pin, -509 when its files cannot be collected, -516 when its pins_dir pin carries verdict=refused, -902 under pin_mode strict |
 | `pin_layout` | `<instance>` | `resp 0 <scheme>:<sha256>` | sent by the daemon to a worker of a format that checks layouts, after it accepted the add of a plugin whose layout pin is still unknown: the layout the worker found after init, which the daemon records in the pin |
 | `pin_expect` | `<instance> <scheme>:<sha256>` | `resp 0` | sent by the daemon to a worker of a format that checks layouts, just before the instance's add: the layout pin that add checks after init and before activate; any other reply than resp 0 refuses the add with that code, and the add is never forwarded |
 
@@ -237,7 +238,8 @@ Error codes the daemon adds to mod-host's:
 | `-513` | `PHD_ERR_NO_NOTE_INPUT` | the instance's plugin takes no notes (an effect): its worker answers note_on, note_off and all_notes_off with this code |
 | `-514` | `PHD_ERR_NOTES_BY_JACK` | the instance's worker takes no notes on its socket (mod-host): the daemon answers the note verbs and note_input with this code, and the plugin is played through its jack MIDI input with connect |
 | `-515` | `PHD_ERR_NO_PRESET_LIST` | the instance's worker cannot list the plugin's presets (mod-host): the daemon answers preset_list and preset_get with this code; preset_load still takes a preset the controller knows |
-| `-516` | `PHD_ERR_PIN_REFUSED` | the plugin's pin carries verdict=refused: its files are the ones that failed qualification, so add is refused and no worker sees it, and a replayed add is refused the same way; files that differ from the pin answer (-509) first |
+| `-516` | `PHD_ERR_PIN_REFUSED` | the plugin's pin carries verdict=refused: its files are the ones that failed qualification, so add is refused and no worker sees it, and a replayed add is refused the same way; files that differ from the pin answer (-509) first. A pins_dir pin of that verdict is never overridden: pin_set and pin_accept of its plugin answer this code |
+| `-517` | `PHD_ERR_NOTE_QUEUE_FULL` | the instance's worker has no room for this note_on, note_off or all_notes_off before its next block: the line was not taken and nothing of it is kept; the controller may send it again |
 <!-- END GENERATED protocol:errors -->
 
 A worker's own refusal is returned as it said it. An `add` that killed its worker answers mod-host's `-102`.
@@ -246,6 +248,10 @@ A worker's own refusal is returned as it said it. An `add` that killed its worke
 driver it ran at 55, unasked), and a FIFO priority given to the whole process puts the plugin's own threads above
 it, where a busy thread starves the graph.
 
+A daemon without privilege cannot give a worker a nice lower than the worker has (a new worker has the daemon's own). The
+verb still answers `resp 0`, the worker keeps its nice, and the daemon logs `worker_env: worker <pid> keeps nice <n>, the
+nice <m> was not applied` on stderr.
+
 Like mod-host, the daemon serves one controller at a time, and `remove` of an instance it does not hold answers
 `resp 0`. With `-n` and no `-f` there is no feedback port (mod-host's own rule), and a controller need not open
 one; without `-n`, or with `-f`, the daemon waits for the controller to open both. A command that finds its
@@ -369,6 +375,24 @@ the instance runs takes effect at its next replay. Files that differ from the pi
 verdict was given for the pinned files only. A plugin that changed since it was pinned is refused (-509, or -510 from the worker), the
 `pin_changed <uri> files|layout` event names what changed, and `pin_accept <uri>` takes the new pin.
 
+Pins that ship with packages live in a read-only layer of their own, under the host's. At start the daemon reads
+every `*.pins` file of `pins_dir` (`/usr/share/plugin-hostd/pins.d` by default; empty is none), in byte order of
+their names, in the same line format. A package drops its own file there, so its plugins and their pins are replaced
+in one transaction and removed together; plugin-hostd owns the directory and another package may co-own it. The
+daemon never writes it. A pin from this layer is trusted as it is, in both pin modes. The rules:
+
+- A pins.d pin with `verdict=refused` always holds. The pin store, a `pin_file` and `pin_set` never override it:
+  `pin_set` and `pin_accept` of its uri answer `-516` (`PIN_REFUSED`), and a line of the store or of the `pin_file`
+  for it is kept but has no effect, which stderr says at start.
+- Any other pins.d pin is under the host's layer. A pin of the same uri in the store, the `pin_file` or from
+  `pin_set` holds over it, and `pin_accept` of a plugin whose files differ from its package pin records the new files
+  in the store, which then hold. `pin_clear` forgets the host's pin only: the package pin holds again.
+- When two pins.d files hold the same uri, a refusal wins; otherwise the file last in name order wins. Two lines of
+  one file follow the same rule, the later line in place of the later file.
+- A line outside the grammar, or longer than a pin line can be, is skipped and named on stderr; the rest of the file
+  is read. A file that cannot be read is named on stderr and skipped. A directory that is missing or empty holds no
+  pins and is no error.
+
 What cannot be pinned:
 
 <!-- BEGIN GENERATED protocol:pin-limits -->

debian/changelog

@@ -1,3 +1,47 @@
+plugin-hostd (0.5.0) unstable; urgency=medium
+
+  * plugin-hostd-probe runs LV2 plugins too: `run lv2:<uri>` measures a
+    plugin through plugin-qualify's lv2_measure, the pin pass and then the
+    measurement, each a child under the same limits and wall clock. The
+    bundle's files become the document's binary. A plugin of which nothing
+    can be pinned exits 2 with no document, and stderr starts with its
+    outcome code (probe.unpinnable).
+  * A pin whose verdict is refused refuses the add with the new code
+    PIN_REFUSED (-516), after the files are checked against the pin; an
+    instance whose pin turns refused is refused at its next replay.
+  * Packages ship pins: the new key pins_dir (default
+    /usr/share/plugin-hostd/pins.d, which the packages own) names a
+    directory whose *.pins files the daemon reads at start, in name order,
+    as a read-only layer under the host's pins. A refused pin there always
+    holds, and pin_set and pin_accept of its plugin answer -516; any other
+    package pin gives way to a host pin of the same plugin.
+  * New code NOTE_QUEUE_FULL (-517): the worker had no room for a note_on,
+    note_off or all_notes_off before its next block, and nothing of the line
+    was kept. The daemon passes it to the controller.
+  * Under lv2_worker auto, a plugin the LV2 adapter refused gets a worker of
+    its own unless the add names a placement, so a plugin that aborts on
+    mod-host no longer takes a pool's other instances with it. An add whose
+    worker dies on it also sends instance_verb_dropped, which names it.
+  * A worker whose feedback the relay cannot follow is not started: the add
+    answers -503. With no memory the relay closes a worker's socket instead
+    of leaving it unread, and its poll set no longer crashes the daemon. A
+    failed realloc no longer loses the relay's gesture table or the LV2
+    adapter's refusal and pick tables: only the one entry is dropped.
+  * A worker_env nice the daemon cannot apply is logged on stderr; the reply
+    stays resp 0.
+  * The probe runner's default rates and the protocol's parameter scales are
+    read from omx-contract's C header (ORACLE_FLOOR_RATES, PARAM_SCALES), so
+    the build now requires omx-contract-devel >= 2.16.0 (libomx-contract-dev
+    >= 2.16.0 on Debian). Nothing is linked.
+  * plugin-hostd-tests requires plugin-hostd of the same build, and CI
+    checks it. The packaging check refuses any ceiling on
+    omx-clap-host-tests ('<=', '=' or '<').
+  * The own-host page gains an LV2 block run through omx-clap-host, and CI
+    measures the audio through the plugin on Debian bookworm and trixie. The
+    LV2 adapter tests' refusal arms use a fixture the adapter still refuses.
+
+ -- Pau Aliagas <linuxnow@gmail.com>  Mon, 19 Oct 2026 00:00:00 +0000
+
 plugin-hostd (0.4.0) unstable; urgency=medium
 
   * New tool plugin-hostd-probe: it starts a program that loads a plugin

debian/control

@@ -38,7 +38,7 @@ Description: stand-in plugin worker to test a program that drives plugin-hostd
  be tested against a real daemon without a plugin, a JACK server or any
  audio. Run it with -L to print the layout it reports. It is installed in
  /usr/libexec/plugin-hostd/tests, away from the directories programs run
- from, and is of no use to anyone else.
+ from.
 
 Package: plugin-hostd-dev
 Section: libdevel

debian/plugin-hostd.dirs

@@ -0,0 +1 @@
+usr/share/plugin-hostd/pins.d

doc/plugin-hostd-probe.1

@@ -1,4 +1,4 @@
-.TH PLUGIN\-HOSTD\-PROBE 1 "October 2026" "plugin-hostd 0.4.0" "User Commands"
+.TH PLUGIN\-HOSTD\-PROBE 1 "October 2026" "plugin-hostd 0.5.0" "User Commands"
 .SH NAME
 plugin\-hostd\-probe \- run a plugin prober under limits and write what happened
 .SH SYNOPSIS