LogLevel::kFatal and the fatal logging macros unconditionally call std::abort(). FatalHandler runs before the abort, but it is process-global and cannot prevent termination.
This is unsafe for embedded and multi-tenant applications, where one failed Iceberg operation must not terminate the host process.
Logging should not control process lifetime. Recoverable failures should continue to use Status/Result, while termination for unrecoverable internal invariants should use a separate, explicit mechanism.
LogLevel::kFataland the fatal logging macros unconditionally callstd::abort().FatalHandlerruns before the abort, but it is process-global and cannot prevent termination.This is unsafe for embedded and multi-tenant applications, where one failed Iceberg operation must not terminate the host process.
Logging should not control process lifetime. Recoverable failures should continue to use
Status/Result, while termination for unrecoverable internal invariants should use a separate, explicit mechanism.