@malloy-publisher/server 0.0.226 → 0.0.228

package/src/server.ts

@@ -41,7 +41,6 @@ import { queryConcurrency } from "./query_concurrency";
 import { MaterializationController } from "./controller/materialization.controller";
 import { ThemeController } from "./controller/theme.controller";
 import { initializeMcpServer } from "./mcp/server";
-import { startAgentMcpServer } from "./mcp/agent_server";
 import { registerLegacyRoutes } from "./server-old";
 import { EnvironmentStore } from "./service/environment_store";
 import { MaterializationService } from "./service/materialization_service";
@@ -50,8 +49,6 @@ import { PackageMemoryGovernor } from "./service/package_memory_governor";
 import { ThemeStore } from "./service/theme_store";
 import { assertSafePackageName, safeJoinUnderRoot } from "./path_safety";
 
-export { normalizeQueryArray } from "./query_param_utils";
-
 // Parse command line arguments
 function parseArgs() {
    const args = process.argv.slice(2);
@@ -105,7 +102,7 @@ function parseArgs() {
             "  --port <number>        Port to run the server on (default: 4000)",
          );
          console.log(
-            "  --host <string>        Host to bind the server to (default: localhost)",
+            "  --host <string>        Host to bind the REST and MCP servers to (default: 0.0.0.0)",
          );
          console.log(
             "  --server_root <path>   Root directory to serve files from (default: .)",
@@ -123,7 +120,7 @@ function parseArgs() {
             "  --shutdown_graceful_close_timeout_seconds <number>  Time in seconds to wait after closing servers before exit (default: 0)",
          );
          console.log(
-            "  --init                 Initialize the storage (default: false)",
+            "  --init                 Wipe persisted storage and re-sync it from the config (default: false)",
          );
          console.log(
             "  --watch-env <name>     Enable dev-mode watch for the named environment.",
@@ -150,7 +147,7 @@ function parseArgs() {
    // this — the user told us where to look. Skip in NODE_ENV=test as a
    // belt-and-suspenders so any spec that ends up evaluating this
    // module doesn't accidentally pin the EnvironmentStore to the
-   // bundled malloy-samples config.
+   // bundled examples config.
    if (!sawServerRoot && !sawConfig && process.env.NODE_ENV !== "test") {
       process.env.PUBLISHER_USE_BUNDLED_DEFAULT = "true";
    }
@@ -162,7 +159,6 @@ parseArgs();
 const PUBLISHER_PORT = Number(process.env.PUBLISHER_PORT || 4000);
 const PUBLISHER_HOST = process.env.PUBLISHER_HOST || "0.0.0.0";
 const MCP_PORT = Number(process.env.MCP_PORT || 4040);
-const AGENT_MCP_PORT = Number(process.env.AGENT_MCP_PORT || 4041);
 const MCP_ENDPOINT = "/mcp";
 const SHUTDOWN_DRAIN_DURATION_SECONDS = Number(
    process.env.SHUTDOWN_DRAIN_DURATION_SECONDS || 0,
@@ -1617,13 +1613,15 @@ app.get(
 );
 
 app.post(
-   `${API_PREFIX}/environments/:environmentName/packages/:packageName/models/:modelName/compile`,
+   `${API_PREFIX}/environments/:environmentName/packages/:packageName/models/*?/compile`,
    async (req, res) => {
       try {
+         // Express stores wildcard matches in params['0'], so nested model
+         // paths (models in subdirectories) compile just like they query.
          const result = await compileController.compile(
             req.params.environmentName,
             req.params.packageName,
-            req.params.modelName,
+            (req.params as Record<string, string>)["0"],
             req.body.source,
             req.body.includeSql === true,
             req.body.givens as Record<string, GivenValue> | undefined,
@@ -1868,21 +1866,9 @@ mcpServer.timeout = 600000;
 mcpServer.keepAliveTimeout = 600000;
 mcpServer.headersTimeout = 600000;
 
-// Separate, isolated MCP server for the agent retrieval tools (get_context,
-// search_docs) on its own listener. Kept apart from the core MCP server above.
-const agentMcpServer = startAgentMcpServer(
-   environmentStore,
-   PUBLISHER_HOST,
-   AGENT_MCP_PORT,
-);
-agentMcpServer.timeout = 600000;
-agentMcpServer.keepAliveTimeout = 600000;
-agentMcpServer.headersTimeout = 600000;
-
 registerSignalHandlers(
    mainServer,
    mcpServer,
    SHUTDOWN_DRAIN_DURATION_SECONDS,
    SHUTDOWN_GRACEFUL_CLOSE_TIMEOUT_SECONDS,
-   agentMcpServer,
 );

package/src/service/environment.ts

@@ -471,9 +471,30 @@ export class Environment {
             if (includeSql && queryMaterializer) {
                try {
                   sql = await queryMaterializer.getSQL({ givens });
-               } catch {
-                  // Source may not contain a runnable query (e.g. only source definitions),
-                  // in which case we simply omit the sql field.
+               } catch (error) {
+                  // A bad caller given (unknown name, wrong-typed value, finalized
+                  // override, ...) surfaces as a Malloy `runtime-given-*` error.
+                  // Map it to a 400 rather than silently omitting `sql` (which is
+                  // indistinguishable from "no runnable query"). Duck-type on
+                  // `.code`; let a MalloyError fall to the outer catch → problems.
+                  // The `runtime-given-` prefix is pinned to Malloy's error codes
+                  // (given_binding.ts / runtime.ts, same as model.ts) — if they're
+                  // renamed upstream a bad given would silently revert to the omit
+                  // branch below, so keep the two in sync.
+                  const givenCode = (error as { code?: string })?.code;
+                  if (
+                     typeof givenCode === "string" &&
+                     givenCode.startsWith("runtime-given-")
+                  ) {
+                     throw new BadRequestError(
+                        error instanceof Error ? error.message : String(error),
+                     );
+                  }
+                  if (error instanceof MalloyError) {
+                     throw error;
+                  }
+                  // Otherwise the source may just not contain a runnable query
+                  // (e.g. only source definitions) — omit the sql field.
                }
             }
 
@@ -792,7 +813,7 @@ export class Environment {
       // reloadAllModelsForPackage, ...) acquire the lock themselves.
       //
       // INVARIANT: callers that consume the returned Package on the fast
-      // path (notably MCP resource handlers and Model.getModel()) must
+      // path (notably the MCP query tools and Model.getModel()) must
       // remain in-memory only. If any code reachable from a `Package`
       // method ever grows new disk I/O against the canonical tree, that
       // path needs to be bracketed by `withPackageLock`; otherwise a
@@ -860,8 +881,17 @@ export class Environment {
          return _package;
       } catch (error) {
          logger.error(`Failed to load package ${packageName}`, { error });
-         this.packages.delete(packageName);
-         this.packageStatuses.delete(packageName);
+         if (existingPackage !== undefined && reload) {
+            // A failed RELOAD must not take down a package that is already
+            // serving. The compiled model in `packages` is still the last good
+            // one (it is only replaced on success), so keep serving it and let
+            // the caller surface the error instead of evicting the package and
+            // leaving the environment with nothing to answer from.
+            this.setPackageStatus(packageName, PackageStatus.SERVING);
+         } else {
+            this.packages.delete(packageName);
+            this.packageStatuses.delete(packageName);
+         }
          throw error;
       }
    }
@@ -1019,6 +1049,10 @@ export class Environment {
                packageName,
                canonicalPath,
                () => this.malloyConfig.malloyConfig,
+               // This tree was just staged into place by the rename above, so a
+               // failed load leaves a half-built directory that is ours to
+               // remove; the rollback below restores the previous one.
+               true,
             );
             // Strict-reject hook (publish/update only — reload passes no
             // validator and stays fail-safe). Throw INSIDE the try so the
@@ -1064,7 +1098,37 @@ export class Environment {
             await fs.promises
                .rm(stagingPath, { recursive: true, force: true })
                .catch(() => {});
-            this.deletePackageStatus(packageName);
+            if (oldPackage && restored) {
+               // The rollback put the old tree back and the previous package is
+               // still in `this.packages` (it is only replaced on success
+               // below), so it is genuinely still serving. Deleting its status
+               // would strand it: listPackages enumerates packageStatuses, so
+               // the package would answer getPackage while being invisible to
+               // listings and discovery until a restart.
+               this.setPackageStatus(packageName, PackageStatus.SERVING);
+            } else {
+               // Either there was nothing to fall back to (a first install), or
+               // the restore did not happen: the rename-back threw, or the old
+               // tree was never on disk to retire. The canonical path is then
+               // missing or still holds the rejected content, so the cached
+               // package no longer matches disk and must not be advertised as
+               // serving. Drop both, and keep the two maps agreeing.
+               this.deletePackageStatus(packageName);
+               if (oldPackage) {
+                  // Retire before dropping it, the same way every other eviction
+                  // here does: once it leaves this.packages, closeAllConnections
+                  // can no longer reach its MalloyConfig, so its native handles
+                  // would never be released. Retire rather than shut down
+                  // inline, because withPackageLock does not cover queries that
+                  // already took this Package from an earlier getPackage; the
+                  // drain lets those finish first.
+                  this.retireConnectionGeneration(
+                     `package ${packageName}`,
+                     () => oldPackage.getMalloyConfig().shutdown("close"),
+                  );
+               }
+               this.packages.delete(packageName);
+            }
             logger.debug("install.phase2.rollback", {
                environmentName: this.environmentName,
                packageName,

package/src/service/model.spec.ts

@@ -444,6 +444,55 @@ describe("service/model", () => {
             sinon.restore();
          });
 
+         it("maps a finalized-given rejection (code) to BadRequestError, not 500", async () => {
+            // Malloy throws this (extends Error, not MalloyError, not root-exported)
+            // when a client supplies a given an operator finalized. model.ts
+            // duck-types on `.code`; guard against that mapping regressing.
+            const finalizedErr = Object.assign(
+               new Error(
+                  "Given 'region' is finalized and cannot be overridden",
+               ),
+               { code: "runtime-given-finalized" },
+            );
+            const runnableStub = {
+               getPreparedResult: sinon.stub().rejects(finalizedErr),
+               run: sinon.stub(),
+            };
+            const modelMaterializer = {
+               loadQuery: sinon.stub().returns(runnableStub),
+               loadRestrictedQuery: sinon.stub().returns(runnableStub),
+            };
+
+            const model = new Model(
+               packageName,
+               mockModelPath,
+               {},
+               "model",
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               modelMaterializer as any,
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               { contents: {}, exports: [], queryList: [] } as any,
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+            );
+
+            await expect(
+               model.getQueryResults(
+                  undefined,
+                  undefined,
+                  "run: orders -> summary",
+                  undefined,
+                  undefined,
+                  { region: "EU" },
+               ),
+            ).rejects.toThrow(BadRequestError);
+
+            sinon.restore();
+         });
+
          /**
           * The row/byte caps live in `model_limits.ts` (unit-tested in
           * `model_limits.spec.ts`); these tests just confirm the wiring —
@@ -684,6 +733,49 @@ describe("service/model", () => {
             sinon.restore();
          });
 
+         it("maps a finalized-given rejection (code) to BadRequestError, not 500", async () => {
+            const finalizedErr = Object.assign(
+               new Error(
+                  "Given 'target_code' is finalized and cannot be overridden",
+               ),
+               { code: "runtime-given-finalized" },
+            );
+            const cellRunnable = {
+               getPreparedResult: sinon.stub().rejects(finalizedErr),
+               run: sinon.stub(),
+            };
+            const runnableCells = [
+               {
+                  type: "code" as const,
+                  text: "run: orders -> by_code",
+                  runnable: cellRunnable,
+               },
+            ];
+
+            const model = new Model(
+               packageName,
+               "test.malloynb",
+               {},
+               "notebook",
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               runnableCells as any,
+               undefined,
+            );
+
+            await expect(
+               model.executeNotebookCell(0, undefined, undefined, {
+                  target_code: "AA",
+               }),
+            ).rejects.toThrow(BadRequestError);
+
+            sinon.restore();
+         });
+
          it("embeds model-level givens in executed cell newSources", async () => {
             const sourceInfo = { name: "carriers", schema: { fields: [] } };
             const givens = [

package/src/service/model.ts

@@ -1147,6 +1147,7 @@ export class Model {
             `Model compilation failed: ${this.compilationError.message}`,
          );
       }
+
       let runnable: QueryMaterializer;
       if (!this.modelMaterializer || !this.modelDef || !this.modelInfo)
          throw new BadRequestError("Model has no queryable entities.");
@@ -1309,16 +1310,23 @@ export class Model {
       // (for the row limit) and the run so a stale persist source falls back per
       // its declared policy — and prep/run agree on the same substitution.
       const buildManifest = this.resolveFreshBuildManifest();
-      const rowLimit = resolveModelQueryRowLimit(
-         (await runnable.getPreparedResult({ givens, buildManifest }))
-            .resultExplore.limit,
-         { defaultLimit: getDefaultQueryRowLimit(), maxRows },
-      );
-      const endTime = performance.now();
-      const executionTime = endTime - startTime;
 
+      // Prepare INSIDE the run try/catch: a bad-given / value-type throw at
+      // prepare time (getPreparedResult binds the givens) gets the same
+      // MalloyError→rethrow / else→400 handling as run, instead of escaping as
+      // a 500. `executionTime` is still captured after prepare and before run,
+      // preserving the pre-existing timing recorded by the success histogram.
+      let rowLimit = 0;
+      let executionTime = 0;
       let queryResults;
       try {
+         rowLimit = resolveModelQueryRowLimit(
+            (await runnable.getPreparedResult({ givens, buildManifest }))
+               .resultExplore.limit,
+            { defaultLimit: getDefaultQueryRowLimit(), maxRows },
+         );
+         executionTime = performance.now() - startTime;
+
          queryResults = await runnable.run({
             rowLimit,
             givens,
@@ -1337,6 +1345,31 @@ export class Model {
             "malloy.model.query.status": "error",
          });
 
+         // Bad client-supplied givens (unknown name, wrong-typed value, an
+         // operator-finalized override, ...) all surface as a Malloy
+         // `runtime-given-*` error. Malloy is the single validator; the publisher
+         // just maps its rejection to a clean 400. Duck-type on `.code`
+         // (MalloyCompileError extends Error, not MalloyError, and isn't
+         // root-exported). The `runtime-given-` prefix is a pinned coupling to
+         // Malloy's error codes (@malloydata/malloy given_binding.ts / runtime.ts);
+         // if they're renamed upstream, update it here (and in environment.ts) —
+         // otherwise these fall through to the generic 400 below with a worse
+         // message, and the /compile path silently omits `sql`.
+         const givenCode = (error as { code?: string })?.code;
+         if (
+            typeof givenCode === "string" &&
+            givenCode.startsWith("runtime-given-")
+         ) {
+            logger.debug("Rejected client-supplied given", {
+               environmentName: this.packageName,
+               modelPath: this.modelPath,
+               error: error instanceof Error ? error.message : String(error),
+            });
+            throw new BadRequestError(
+               error instanceof Error ? error.message : String(error),
+            );
+         }
+
          // Re-throw Malloy errors as-is (they will be handled by error handler)
          if (error instanceof MalloyError) {
             throw error;
@@ -1607,6 +1640,24 @@ export class Model {
             if (error instanceof FilterValidationError) {
                throw new BadRequestError(error.message);
             }
+            // Bad client-supplied givens (unknown name, wrong-typed value,
+            // finalized override, ...) surface as a Malloy `runtime-given-*`
+            // error; see getQueryResults. Malloy validates, the publisher maps
+            // to 400. Duck-type on `.code` (not a MalloyError, not root-exported).
+            const givenCode = (error as { code?: string })?.code;
+            if (
+               typeof givenCode === "string" &&
+               givenCode.startsWith("runtime-given-")
+            ) {
+               logger.debug("Rejected client-supplied given", {
+                  environmentName: this.packageName,
+                  modelPath: this.modelPath,
+                  error: error instanceof Error ? error.message : String(error),
+               });
+               throw new BadRequestError(
+                  error instanceof Error ? error.message : String(error),
+               );
+            }
             if (error instanceof MalloyError) {
                throw error;
             }

package/src/service/package.ts

@@ -29,6 +29,11 @@ import {
 } from "../errors";
 import { formatDuration, logger } from "../logger";
 import { recordBuildPlanComputeDuration } from "../materialization_metrics";
+import {
+   LOAD_DURATION_BUCKETS_MS,
+   recordPackageLoadPhases,
+   type PackageLoadStatus,
+} from "../package_load_metrics";
 import { assertSafeEnvironmentPath, safeJoinUnderRoot } from "../path_safety";
 import {
    BuildManifest,
@@ -73,6 +78,23 @@ function toTableNameManifest(
    return out;
 }
 
+/**
+ * Classify a failed package load into the `status` label shared by the
+ * `malloy_package_load_duration` histogram and the per-phase load metrics, so
+ * both slice failures identically. A real Malloy/model compile error is a 4xx
+ * `compilation_error`; a rewrapped pool-infrastructure failure is a transient
+ * `pool_unavailable`; anything else is a generic `error`.
+ */
+function packageLoadFailureStatus(error: unknown): PackageLoadStatus {
+   if (error instanceof ModelCompilationError || error instanceof MalloyError) {
+      return "compilation_error";
+   }
+   if (error instanceof ServiceUnavailableError) {
+      return "pool_unavailable";
+   }
+   return "error";
+}
+
 export class Package {
    private environmentName: string;
    private packageName: string;
@@ -127,6 +149,10 @@ export class Package {
       {
          description: "Time taken to load a Malloy package",
          unit: "ms",
+         // OTel's default buckets top out at 10s, censoring the slow-load tail.
+         // Use the shared load-duration buckets (→5min) so p95/p99 of large
+         // package loads are resolvable. See LOAD_DURATION_BUCKETS_MS.
+         advice: { explicitBucketBoundaries: LOAD_DURATION_BUCKETS_MS },
       },
    );
 
@@ -211,6 +237,17 @@ export class Package {
       packageName: string,
       packagePath: string,
       environmentMalloyConfig: PackageConnectionInput,
+      /**
+       * Delete `packagePath` if the load fails. Opt-in, and only correct for a
+       * caller that created the directory itself (an install staged into place),
+       * where the half-built tree is Publisher's to clean up and `installPackage`
+       * rolls the previous one back. Every other caller loads a directory that
+       * already existed: a reload of a package that is currently serving, or a
+       * user directory registered via addPackage. Deleting those on a transient
+       * compile error destroys the source and takes the package offline, so the
+       * default is to leave the directory alone.
+       */
+      cleanupDirectoryOnFailure: boolean = false,
    ): Promise<Package> {
       assertSafeEnvironmentPath(packagePath);
       const startTime = performance.now();
@@ -248,34 +285,34 @@ export class Package {
          console.error(error);
          const endTime = performance.now();
          const executionTime = endTime - startTime;
-         const status =
-            error instanceof ModelCompilationError ||
-            error instanceof MalloyError
-               ? "compilation_error"
-               : error instanceof ServiceUnavailableError
-                 ? "pool_unavailable"
-                 : "error";
          this.packageLoadHistogram.record(executionTime, {
             malloy_package_name: packageName,
-            status,
+            status: packageLoadFailureStatus(error),
          });
-         // Clean up the package directory on failure, but NOT when packagePath
-         // is an in-place mount symlink (watch mode). Removing it would unmount
-         // the package, so a transient compile error from a half-typed model
-         // saved mid-edit would brick the package until a restart. The symlink
-         // points at the user's live source, which is left untouched; the next
-         // save recompiles against it.
+         // Clean up the package directory only when the caller opted in (an
+         // install that staged this tree), and never when packagePath is an
+         // in-place mount symlink (watch mode). Removing it would unmount the
+         // package, so a transient compile error from a half-typed model saved
+         // mid-edit would brick the package until a restart. The symlink points
+         // at the user's live source, which is left untouched; the next save
+         // recompiles against it.
          try {
-            const stat = await fs.lstat(packagePath).catch(() => null);
-            if (stat?.isSymbolicLink()) {
+            if (!cleanupDirectoryOnFailure) {
                logger.info(
-                  `Skipping cleanup of symlinked package path on failure: ${packagePath}`,
+                  `Preserving existing package directory after failed load: ${packagePath}`,
                );
             } else {
-               await fs.rm(packagePath, { recursive: true, force: true });
-               logger.info(
-                  `Cleaned up failed package directory: ${packagePath}`,
-               );
+               const stat = await fs.lstat(packagePath).catch(() => null);
+               if (stat?.isSymbolicLink()) {
+                  logger.info(
+                     `Skipping cleanup of symlinked package path on failure: ${packagePath}`,
+                  );
+               } else {
+                  await fs.rm(packagePath, { recursive: true, force: true });
+                  logger.info(
+                     `Cleaned up failed package directory: ${packagePath}`,
+                  );
+               }
             }
          } catch (cleanupError) {
             logger.warn(`Failed to clean up package directory ${packagePath}`, {
@@ -361,6 +398,10 @@ export class Package {
          workerDurationMs: outcome.loadDurationMs,
          dispatchOverheadMs:
             workerDoneTime - dispatchTime - outcome.loadDurationMs,
+         // Phase split of the worker duration (remainder = setup + extraction).
+         compileDurationMs: outcome.timings.compileDurationMs,
+         schemaFetchDurationMs: outcome.timings.schemaFetchDurationMs,
+         schemaFetchCount: outcome.timings.schemaFetchCount,
          modelCount: outcome.models.length,
          databaseCount: databases.length,
       });
@@ -400,43 +441,59 @@ export class Package {
       // hydration path.)
       const models = new Map<string, Model>();
       const renderTagWarnings: ApiPackageWarning[] = [];
-      for (const sm of outcome.models) {
-         if (sm.compilationError) {
-            const err = Model.deserializeCompilationError(sm.compilationError);
-            logger.error("Model compilation failed", {
+      try {
+         for (const sm of outcome.models) {
+            if (sm.compilationError) {
+               const err = Model.deserializeCompilationError(
+                  sm.compilationError,
+               );
+               logger.error("Model compilation failed", {
+                  packageName,
+                  modelPath: sm.modelPath,
+                  error: err.message,
+               });
+               // The outer catch in Package.create records the total metric +
+               // cleans the package directory.
+               throw err;
+            }
+            const model = Model.fromSerialized(
                packageName,
-               modelPath: sm.modelPath,
-               error: err.message,
-            });
-            // The outer catch in Package.create records the metric +
-            // cleans the package directory.
-            throw err;
-         }
-         const model = Model.fromSerialized(
-            packageName,
-            packagePath,
-            malloyConfig,
-            sm,
-         );
-         // Validate renderer tags on the main thread (the renderer is too heavy
-         // to load inside the pure-CPU package-load worker). A misconfigured tag
-         // is logged as a warning naming the target; it does not fail the load.
-         // The findings also ride the package response as non-fatal `warnings`.
-         for (const w of await model.validateRenderTags()) {
-            renderTagWarnings.push({ model: sm.modelPath, ...w });
-         }
-         // Reject unquoted `#@ persist name=` annotations the same way: an
-         // unquoted name is dropped from the build plan, so the source would
-         // publish but never materialize. Scan the raw `.malloy` source (the
-         // ground truth for quoting); throws a ModelCompilationError (424).
-         if (sm.modelPath.endsWith(MODEL_FILE_SUFFIX)) {
-            const modelSource = await fs.readFile(
-               path.join(packagePath, sm.modelPath),
-               "utf-8",
+               packagePath,
+               malloyConfig,
+               sm,
             );
-            assertPersistNamesQuoted(modelSource, sm.modelPath);
+            // Validate renderer tags on the main thread (the renderer is too
+            // heavy to load inside the pure-CPU package-load worker). A
+            // misconfigured tag is logged as a warning naming the target; it
+            // does not fail the load. The findings also ride the package
+            // response as non-fatal `warnings`.
+            for (const w of await model.validateRenderTags()) {
+               renderTagWarnings.push({ model: sm.modelPath, ...w });
+            }
+            // Reject unquoted `#@ persist name=` annotations the same way: an
+            // unquoted name is dropped from the build plan, so the source would
+            // publish but never materialize. Scan the raw `.malloy` source (the
+            // ground truth for quoting); throws a ModelCompilationError (424).
+            if (sm.modelPath.endsWith(MODEL_FILE_SUFFIX)) {
+               const modelSource = await fs.readFile(
+                  path.join(packagePath, sm.modelPath),
+                  "utf-8",
+               );
+               assertPersistNamesQuoted(modelSource, sm.modelPath);
+            }
+            models.set(sm.modelPath, model);
          }
-         models.set(sm.modelPath, model);
+      } catch (err) {
+         // Record the load's phase cost tagged with the terminal status before
+         // the error propagates to the outer catch (which records the total).
+         // Only in-band compile failures reach here — the worker already
+         // produced `outcome.timings`; a pool failure throws before `outcome`
+         // exists and carries no timings, so it's simply not recorded.
+         recordPackageLoadPhases(
+            outcome.timings,
+            packageLoadFailureStatus(err),
+         );
+         throw err;
       }
 
       const endTime = performance.now();
@@ -445,6 +502,7 @@ export class Package {
          malloy_package_name: packageName,
          status: "success",
       });
+      recordPackageLoadPhases(outcome.timings, "success");
       logger.info(`Successfully loaded package ${packageName}`, {
          packageName,
          duration: formatDuration(executionTime),