And some of us includes me. But at the point where you're able to handle all memory allocation failures usefully, you're almost certainly doing something non-t

And some of us includes me. But at the point where you're able to handle all memory allocation failures usefully, you're almost certainly doing something non-trivial to recover. For example aborting some requested transaction, pruning items from your program's caches, delaying a subtask to release its temporary memory, or compressing some structures. At that point there's nothing "trivially" safe about a memory allocation. Probably there are bugs in those recovery actions too. Even the obviously most simple recovery action of propagating an error return to abort a request: If that's a network request, just returning the error "sorry out of memory" is potentially going to fail. So you need recovery from the recovery path failing.