Isolate CLI workers and module serialization

scripts/test_parallel_proactive_compile.sh

@@ -134,6 +134,15 @@ printf '0\n' >"$root/maximum"
 flock -u 7
 mapfile -t scanner_pids < <(awk -F '\t' -v site="$site/" '$3 ~ ("^" site "unit-[0-9]+[.]uce$") { count[$4]++ } END { for(pid in count) if(count[pid] >= 2) print pid }' "$shim_log" | sort -n)
 [[ "${#scanner_pids[@]}" -eq 2 ]] || { echo "controlled units were not split between both scanners" >&2; cat "$shim_log" >&2; exit 1; }
+assert_scanner_memory_bounded() {
+	for scanner_pid in "${scanner_pids[@]}"; do
+		retained_kb=$(awk '/^(VmRSS|VmSwap):/{total += $2} END{print total + 0}' "/proc/$scanner_pid/status")
+		# Scanner bookkeeping is small; 64 MiB leaves ample headroom while still
+		# catching the measured old 12-serialization retention (~73 MiB).
+		(( retained_kb < 65536 )) || { echo "proactive scanner retained serialized-module arenas: pid=$scanner_pid retained_kb=$retained_kb" >&2; exit 1; }
+	done
+}
+assert_scanner_memory_bounded
 blockers=()
 victims=()
 for scanner_pid in "${scanner_pids[@]}"; do
@@ -202,4 +211,8 @@ while [[ ! -s "$artifacts/priority.uce.cwasm" ]] && (( SECONDS < deadline )); do
 priority_nice=$(awk -F '\t' -v path="$site/priority.uce" '$3 == path { print $2; exit }' "$shim_log")
 [[ "$priority_nice" == "5" ]] || { echo "priority queue was not owned by the nice-5 compiler: $priority_nice" >&2; cat "$shim_log" >&2; exit 1; }
 
+# Recheck after dependency fanout, failure/retry, recovery, and priority work;
+# the historical leak accumulated in the long-lived scanners across phases.
+assert_scanner_memory_bounded
+
 printf '%s\n' 'parallel proactive compile passed'