Internal one-shot worker for heap- and time-bounded host computation.
Results use a process alias so timeout cleanup can invalidate and drain a
late reply before returning to the caller. Callers that are themselves
disposable workers may opt into :cancel_with_caller; the bounded worker is
then covered by a monitor-based guard so caller death terminates blocked work
without changing the caller's exit-trapping semantics. The guard retains only
process identities; the callback closure enters the heap-limited worker
directly, and startup coordination consumes the same absolute deadline as
callback execution. A caller may also supply a :cancel_with process; its
termination cancels the worker without coupling the two owners.
Summary
Functions
Classifies the result of a bounded provider callback that answers :ok.
Classifies a bounded provider callback that may answer with one payload.
Runs a zero-arity function in a monitored process under explicit limits.
Functions
@spec classify_callback(term()) :: :ok | :timed_out | {:error, atom() | {atom(), pos_integer()} | struct()}
Classifies the result of a bounded provider callback that answers :ok.
Both callers of this — the audited-local and unverified phase-7 steps, and the
connectivity probe — must translate a callback's outcome the same way, and the
rule is load-bearing rather than cosmetic: an exhausted budget is reported as
the bare :timed_out atom rather than through the {:error, reason}
translation, so a callback returning the timeout reason itself cannot forge
the code its caller mints for a real timeout. Anything unrecognised fails
closed. Drift between two copies of that would be a defect in the one that
drifted, so there is one copy.
A reason may also carry one positive integer position — the line of a
declared input file the callback refused. The other closed exception is a
cost-reservation pricing miss, which may carry only an adapter-attested
public model selector or nil. A wider grammar would let a callback hand its
caller an arbitrary payload.
@spec classify_payload_callback(term()) :: :ok | {:ok, term()} | :timed_out | {:error, atom() | {atom(), pos_integer()} | struct()}
Classifies a bounded provider callback that may answer with one payload.
The connectivity probe's shipped callback reports what its request spent, so
a success may carry a term beside :ok. Only that one shape is added: every
other outcome, a bare :ok included, is translated by classify_callback/1,
so the failure rule above stays the single copy both callers share. The
payload is opaque here and stays untrusted — the caller closes its shape
before publishing it, on the same terms as the position above.
@spec run( (-> term()), keyword() ) :: {:ok, term()} | {:error, :timeout | :cancelled | :heap_exceeded | :worker_failed}
Runs a zero-arity function in a monitored process under explicit limits.