Repository navigation
docker: say what the compile guard can and cannot tell about a limit stop - #775
Conversation
…stop The compile guard types its own stops (the wall deadline, the diagnostic budget and refused settings) and leaves every other nonzero compiler status as exit 3. State what that means for a stop caused by a limit that the host applies outside the three settings, such as a file-size, open-file or process-count limit. A measured run of the 1.10.0 image's compiler (g++ 14.2.0, Debian 13, arm64) shows the driver ending with exit 4 for a file-size limit and with exit 1 for an open-file, process-count or address-space limit, the status of a syntax error; none of them reaches the entrypoint as a signal. The status therefore names no cause and the entrypoint infers none. The exit table row for 3 says so as well. Documentation only. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Documents that a compile stopped by a host-applied limit outside the three typed compile guards (file-size, open-file, process-count, address-space) is an ordinary compile failure, exit 3, with no cause inferred. The README explains that the entrypoint decodes only the compiler driver's wait status and never reads compiler output, and that on the 1.10.0 image's g++ these stops surfaced as exit 4 or exit 1, never as a signal, so they look like any other failure. It also updates the exit-code table so the 3 row notes this case. Telling such a stop apart needs evidence from whoever enforces the limit.
No blocking issues surfaced.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 21 functions depend on the 21 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 21 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 21 function(s) in the blast radius were not formally verified this run
Summary
Documentation only. The README of the container harness lists what the compile guard types (its three settings: the wall deadline, the address-space limit and the diagnostic budget) but not what a compile stopped by any other limit looks like to the entrypoint. This adds that statement, with the statuses measured on the published image's compiler.
What changed
docker/README.md: one paragraph at the end of "Opt-in compile guards", and the exit table's row for3now says that a stop by a limit the host applied is included and that no cause is inferred.Measurement behind the paragraph
A real g++ was launched the way the entrypoint's guard launches the compiler (child limits installed before exec, stdout and stderr piped, new session) inside the image
ghcr.io/pineforge-4pass/pineforge-release:latestof 2026-11-07 (engine and codegen 1.10.0; g++ 14.2.0, Debian 13, arm64), once as the image's default user and once as uid 65534. Each run has eleven cases. With no limit the compile returns 0 and a syntax error returns 1. A file-size limit of 16 KiB returns 4 (the driver reports the death of its helper itself: "g++: internal compiler error: File size limit exceeded"). Open-file limits of 4 and 12, a process limit of 1 and an address-space limit of 64 MiB all return 1, the status of a syntax error. The loose caps (64 MiB file size, 1024 open files, 256 MiB and 8 GiB of address space) return 0, so each failure is the cap's. Every result is an exit status; none is a signal. The compiler's text does name the cause in each case, but the status does not, and the entrypoint does not read the text for one. An Ubuntu 24.04 g++ 13.3.0 gave the same statuses.Checks
Documentation only (the repository's docs-only classifier agrees). On the head, run on a Linux arm64 host: the documentation lint, the file:line anchor gate (2,346 of 2,346 resolve), the public-role-words gate, the doc-revert gate and the tests of these gates all pass.
What is not covered
🤖 Generated with Claude Code