@namzu/sdk 2.0.0 → 3.0.0

package/src/plugin/__tests__/lifecycle.test.ts

@@ -64,10 +64,14 @@ describe('PluginLifecycleManager', () => {
 			const hook2Handler = vi.fn(async (): Promise<PluginHookResult> => ({ action: 'continue' }))
 
 			// Register hooks manually
-			manager['hookHandlers'].set('run_start', [
-				{ pluginId: 'plugin_1' as PluginId, handler: hook1Handler },
-				{ pluginId: 'plugin_2' as PluginId, handler: hook2Handler },
-			])
+			manager.registerHook('plugin_1' as PluginId, {
+				event: 'run_start',
+				handler: hook1Handler,
+			})
+			manager.registerHook('plugin_2' as PluginId, {
+				event: 'run_start',
+				handler: hook2Handler,
+			})
 
 			const results = await manager.executeHooks('run_start', { runId: mockRunId })
 
@@ -84,7 +88,10 @@ describe('PluginLifecycleManager', () => {
 					}),
 			)
 
-			manager['hookHandlers'].set('run_start', [{ pluginId: mockPluginId, handler: slowHandler }])
+			manager.registerHook(mockPluginId, {
+				event: 'run_start',
+				handler: slowHandler,
+			})
 
 			const managerWithShortTimeout = new PluginLifecycleManager({
 				pluginRegistry,
@@ -93,9 +100,10 @@ describe('PluginLifecycleManager', () => {
 				hookTimeoutMs: 10, // Very short timeout
 			})
 
-			managerWithShortTimeout['hookHandlers'].set('run_start', [
-				{ pluginId: mockPluginId, handler: slowHandler },
-			])
+			managerWithShortTimeout.registerHook(mockPluginId, {
+				event: 'run_start',
+				handler: slowHandler,
+			})
 
 			const results = await managerWithShortTimeout.executeHooks('run_start', {
 				runId: mockRunId,
@@ -127,11 +135,18 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('pre_tool_use', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-					{ pluginId: 'plugin_3' as PluginId, handler: handler3 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler2,
+				})
+				manager.registerHook('plugin_3' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler3,
+				})
 
 				await manager.executeHooks('pre_tool_use', { runId: mockRunId })
 
@@ -156,11 +171,18 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('post_tool_use', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-					{ pluginId: 'plugin_3' as PluginId, handler: handler3 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'post_tool_use',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'post_tool_use',
+					handler: handler2,
+				})
+				manager.registerHook('plugin_3' as PluginId, {
+					event: 'post_tool_use',
+					handler: handler3,
+				})
 
 				await manager.executeHooks('post_tool_use', { runId: mockRunId })
 
@@ -181,10 +203,14 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('run_start', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'run_start',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'run_start',
+					handler: handler2,
+				})
 
 				await manager.executeHooks('run_start', { runId: mockRunId })
 
@@ -202,10 +228,14 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('run_start', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'run_start',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'run_start',
+					handler: handler2,
+				})
 
 				const results = await manager.executeHooks('run_start', { runId: mockRunId })
 
@@ -223,39 +253,19 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('pre_tool_use', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
-
-				const results = await manager.executeHooks('pre_tool_use', { runId: mockRunId })
-
-				expect(results).toHaveLength(1)
-				expect(results[0]?.action).toBe('skip')
-				expect(handler2).not.toHaveBeenCalled()
-			})
-
-			it('should short-circuit and return resume action', async () => {
-				const handler1 = vi.fn(async (): Promise<PluginHookResult> => {
-					return { action: 'resume', input: 'new_input_value' }
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler1,
 				})
-
-				const handler2 = vi.fn(async (): Promise<PluginHookResult> => {
-					return { action: 'continue' }
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler2,
 				})
 
-				manager['hookHandlers'].set('pre_llm_call', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
-
-				const results = await manager.executeHooks('pre_llm_call', { runId: mockRunId })
+				const results = await manager.executeHooks('pre_tool_use', { runId: mockRunId })
 
 				expect(results).toHaveLength(1)
-				expect(results[0]?.action).toBe('resume')
-				if (results[0]?.action === 'resume') {
-					expect(results[0].input).toBe('new_input_value')
-				}
+				expect(results[0]?.action).toBe('skip')
 				expect(handler2).not.toHaveBeenCalled()
 			})
 
@@ -270,10 +280,14 @@ describe('PluginLifecycleManager', () => {
 
 				// Use pre_* hook for forward execution order (plugin_1 runs first and short-circuits).
 				// post_* hooks run in reverse order for cleanup semantics.
-				manager['hookHandlers'].set('pre_llm_call', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'pre_llm_call',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'pre_llm_call',
+					handler: handler2,
+				})
 
 				const results = await manager.executeHooks('pre_llm_call', { runId: mockRunId })
 
@@ -291,10 +305,14 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('pre_tool_use', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'pre_tool_use',
+					handler: handler2,
+				})
 
 				const results = await manager.executeHooks('pre_tool_use', { runId: mockRunId })
 
@@ -313,10 +331,14 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('iteration_start', [
-					{ pluginId: 'plugin_1' as PluginId, handler: handler1 },
-					{ pluginId: 'plugin_2' as PluginId, handler: handler2 },
-				])
+				manager.registerHook('plugin_1' as PluginId, {
+					event: 'iteration_start',
+					handler: handler1,
+				})
+				manager.registerHook('plugin_2' as PluginId, {
+					event: 'iteration_start',
+					handler: handler2,
+				})
 
 				const results = await manager.executeHooks('iteration_start', { runId: mockRunId })
 
@@ -335,7 +357,7 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('pre_tool_use', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'pre_tool_use', handler })
 
 				const contextData = {
 					runId: mockRunId,
@@ -362,7 +384,7 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('iteration_end', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'iteration_end', handler })
 
 				await manager.executeHooks('iteration_end', {
 					runId: mockRunId,
@@ -383,7 +405,7 @@ describe('PluginLifecycleManager', () => {
 					return { action: 'continue' }
 				})
 
-				manager['hookHandlers'].set('run_start', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'run_start', handler })
 
 				await manager.executeHooks('run_start', { runId: mockRunId })
 
@@ -404,7 +426,7 @@ describe('PluginLifecycleManager', () => {
 					throw new Error('Handler crashed')
 				})
 
-				manager['hookHandlers'].set('run_start', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'run_start', handler })
 
 				const results = await manager.executeHooks('run_start', { runId: mockRunId })
 
@@ -420,7 +442,7 @@ describe('PluginLifecycleManager', () => {
 					throw new Error('Handler failed')
 				})
 
-				manager['hookHandlers'].set('run_start', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'run_start', handler })
 
 				const executePromise = manager.executeHooks('run_start', { runId: mockRunId })
 				await expect(executePromise).resolves.not.toThrow()
@@ -438,7 +460,7 @@ describe('PluginLifecycleManager', () => {
 					async (): Promise<PluginHookResult> => ({ action: 'modify', input: { x: 1 } }),
 				)
 
-				manager['hookHandlers'].set('pre_tool_use', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'pre_tool_use', handler })
 
 				await manager.executeHooks(
 					'pre_tool_use',
@@ -464,7 +486,7 @@ describe('PluginLifecycleManager', () => {
 
 			it('should not emit RunEvents when emitRunEvent omitted', async () => {
 				const handler = vi.fn(async (): Promise<PluginHookResult> => ({ action: 'continue' }))
-				manager['hookHandlers'].set('run_start', [{ pluginId: mockPluginId, handler }])
+				manager.registerHook(mockPluginId, { event: 'run_start', handler })
 				await expect(manager.executeHooks('run_start', { runId: mockRunId })).resolves.toHaveLength(
 					1,
 				)

package/src/plugin/lifecycle.ts

@@ -2,7 +2,11 @@ import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { mcpToolToToolDefinition } from '../connector/mcp/adapter.js'
 import { MCPClient } from '../connector/mcp/client.js'
-import { HOOK_TIMEOUT_MS, PLUGIN_NAMESPACE_SEPARATOR } from '../constants/plugin/index.js'
+import {
+	DEFAULT_HOOK_PRIORITY,
+	HOOK_TIMEOUT_MS,
+	PLUGIN_NAMESPACE_SEPARATOR,
+} from '../constants/plugin/index.js'
 import type { PluginRegistry } from '../registry/plugin/index.js'
 import type { PluginId } from '../types/ids/index.js'
 import type {
@@ -21,7 +25,7 @@ import type { ToolDefinition, ToolRegistryContract } from '../types/tool/index.j
 import { toErrorMessage } from '../utils/error.js'
 import { generatePluginId } from '../utils/id.js'
 import type { Logger } from '../utils/logger.js'
-import { loadPluginManifest } from './loader.js'
+import { assertEnableable, loadPluginManifest } from './loader.js'
 
 interface PluginContributionRecord {
 	toolNames: string[]
@@ -41,7 +45,12 @@ export class PluginLifecycleManager {
 	private listeners: PluginEventListener[] = []
 	private hookHandlers: Map<
 		PluginHookEvent,
-		Array<{ pluginId: PluginId; handler: PluginHookDefinition['handler'] }>
+		Array<{
+			pluginId: PluginId
+			handler: PluginHookDefinition['handler']
+			priority: number
+			seq: number
+		}>
 	> = new Map()
 	private pluginContributions: Map<PluginId, PluginContributionRecord> = new Map()
 	private hookTimeoutMs: number
@@ -54,6 +63,35 @@ export class PluginLifecycleManager {
 		this.log = config.log.child({ component: 'PluginLifecycleManager' })
 	}
 
+	/**
+	 * Attach a hook without installing a plugin from disk.
+	 *
+	 * Registration was reachable only through `enable()`, which loads a
+	 * manifest and imports modules by path — so a host that wanted one
+	 * in-process guard had to lay out a plugin directory to get it. That
+	 * also left this class's own tests reaching into the private map,
+	 * which is how they came to construct entries the real path would
+	 * never produce.
+	 *
+	 * Hooks are held in priority order (lower first), ties keeping
+	 * registration order.
+	 */
+	registerHook(pluginId: PluginId, hook: PluginHookDefinition): void {
+		const handlers = this.hookHandlers.get(hook.event) ?? []
+		handlers.push({
+			pluginId,
+			handler: hook.handler,
+			priority: hook.priority ?? DEFAULT_HOOK_PRIORITY,
+			// Registration index, so the sort has something stable to fall
+			// back on when priorities are equal.
+			seq: handlers.length,
+		})
+		// Sorted on insert rather than on dispatch: a chain runs on every
+		// tool call, and the order only changes when a plugin comes or goes.
+		handlers.sort((a, b) => a.priority - b.priority || a.seq - b.seq)
+		this.hookHandlers.set(hook.event, handlers)
+	}
+
 	on(listener: PluginEventListener): void {
 		this.listeners.push(listener)
 	}
@@ -110,17 +148,18 @@ export class PluginLifecycleManager {
 
 		const { manifest } = plugin
 
-		// Unsupported contribution types must fail fast (Convention #0, #5).
-		// SDK lacks removable registries / instance factories / persona loader design
-		// for these categories. Remove from manifest or upgrade runtime.
-		const unsupported: string[] = []
-		if (manifest.skills?.length) unsupported.push('skills')
-		if (manifest.connectors?.length) unsupported.push('connectors')
-		if (manifest.personas?.length) unsupported.push('personas')
-		if (unsupported.length > 0) {
-			throw new Error(
-				`Plugin "${manifest.name}": contribution type(s) [${unsupported.join(', ')}] not yet supported by the runtime. Remove from manifest or upgrade @namzu/sdk.`,
-			)
+		// The same refusal the loader applies at install, kept here as the
+		// backstop for a plugin that reached this point another way — a
+		// record written by an older build, or a host constructing one
+		// directly. Reaching it means the install-time gate was bypassed,
+		// so the plugin transitions to `error` rather than staying
+		// `installed`: a status that says the plugin is fine while it can
+		// never enable is how the next reader gets misled.
+		try {
+			assertEnableable(manifest)
+		} catch (err) {
+			this.pluginRegistry.register({ ...plugin, status: 'error' })
+			throw err
 		}
 
 		const contributions: PluginContributionRecord = { toolNames: [], mcpClients: [] }
@@ -162,9 +201,7 @@ export class PluginLifecycleManager {
 					}
 
 					for (const hook of mod.hooks) {
-						const handlers = this.hookHandlers.get(hook.event) ?? []
-						handlers.push({ pluginId, handler: hook.handler })
-						this.hookHandlers.set(hook.event, handlers)
+						this.registerHook(pluginId, hook)
 					}
 				}
 			}
@@ -399,16 +436,33 @@ export class PluginLifecycleManager {
 			const start = performance.now()
 			let result: PluginHookResult
 
+			// The deadline timer is captured and cleared in `finally`.
+			// Without that it stayed armed after the hook resolved, and an
+			// armed timer keeps the Node event loop alive: hooks fire on
+			// every tool call and every model call, so a run of twenty tool
+			// calls left twenty live timers and the process could not exit
+			// until the last one expired. Nothing failed — it just hung, for
+			// up to the timeout, every time.
+			const deadline = new AbortController()
+			let timer: ReturnType<typeof setTimeout> | undefined
+
 			try {
 				result = await Promise.race([
-					handlerFn(hookContext),
-					new Promise<PluginHookResult>((_, reject) =>
-						setTimeout(() => reject(new Error('Hook timeout')), this.hookTimeoutMs),
-					),
+					handlerFn({ ...hookContext, signal: deadline.signal }),
+					new Promise<PluginHookResult>((_, reject) => {
+						timer = setTimeout(() => {
+							// Told, not just abandoned: a hook holding a socket
+							// open can close it.
+							deadline.abort()
+							reject(new Error('Hook timeout'))
+						}, this.hookTimeoutMs)
+					}),
 				])
 			} catch (err) {
 				const message = toErrorMessage(err)
 				result = { action: 'error', message }
+			} finally {
+				if (timer !== undefined) clearTimeout(timer)
 			}
 
 			const durationMs = Math.round(performance.now() - start)
@@ -441,7 +495,7 @@ export class PluginLifecycleManager {
 			if (result.action === 'error' || result.action === 'skip') {
 				break
 			}
-			if (result.action === 'resume' || result.action === 'retry') {
+			if (result.action === 'retry') {
 				break
 			}
 		}

package/src/plugin/loader.ts

@@ -49,7 +49,43 @@ export async function loadPluginManifest(pluginDir: string): Promise<PluginManif
 	const manifestPath = join(pluginDir, PLUGIN_MANIFEST_FILENAME)
 	const raw = await readFile(manifestPath, 'utf-8')
 	const parsed: unknown = JSON.parse(raw)
-	return PluginManifestSchema.parse(parsed)
+	const manifest = PluginManifestSchema.parse(parsed)
+	assertEnableable(manifest)
+	return manifest
+}
+
+/**
+ * Contribution types the manifest accepts and the runtime cannot enable.
+ *
+ * The schema validates `skills`, `connectors` and `personas` with per-type
+ * caps, and enabling then refuses all three wholesale — so a plugin
+ * shipping four tools and one skill validated clean, installed clean, and
+ * contributed zero tools. The refusal was right; its position was not.
+ */
+const UNSUPPORTED_CONTRIBUTIONS = ['skills', 'connectors', 'personas'] as const
+
+/**
+ * Refuse a manifest whose contributions can never be enabled.
+ *
+ * Checked at LOAD, not at enable. A plugin that cannot enable was being
+ * persisted as `installed` — a status that says the opposite — and the
+ * author found out only when something tried to use it, at which point
+ * every tool it also shipped went down with it. Failing where the manifest
+ * is read means the author learns at the moment they are looking at the
+ * manifest.
+ *
+ * The registries these types would need all exist and are wired to agents
+ * through host configuration; what does not exist is the manifest path
+ * into them. Naming the types is what makes that actionable.
+ */
+export function assertEnableable(manifest: PluginManifest): void {
+	const record = manifest as unknown as Record<string, unknown[] | undefined>
+	const unsupported = UNSUPPORTED_CONTRIBUTIONS.filter((key) => record[key]?.length)
+	if (unsupported.length === 0) return
+
+	throw new Error(
+		`Plugin "${manifest.name}" declares contribution type(s) [${unsupported.join(', ')}] that the runtime cannot enable, so installing it would produce a plugin that reports "installed" and contributes nothing — including its other, supported contributions. Remove them from the manifest, or configure them on the agent directly (the skill, connector and persona registries all accept them that way).`,
+	)
 }
 
 /**

package/src/probe/registry.test.ts

@@ -1,7 +1,13 @@
 /**
- * Ratified §9 of docs.local/sessions/ses_007-probe-and-doctor/design.md.
- * These tests pin the contract documented there — not an internal
- * implementation detail. If the semantics change, update §9 first.
+ * These tests pin the probe CONTRACT, not an internal implementation
+ * detail. If the semantics change, change the published documentation
+ * first: `docs/sdk/architecture/safety.md`, "Which Way a Gate Fails".
+ *
+ * They used to point at a session design document that has since been
+ * frozen and removed, so the instruction to update it first could not be
+ * followed — which is how the fail-open veto kept its ratified status
+ * with no surviving argument for it. A contract reference has to name
+ * something a reader can still open.
  */
 
 import { describe, expect, it, vi } from 'vitest'
@@ -388,7 +394,18 @@ describe('ProbeRegistry — veto API', () => {
 		expect(audit).toEqual(['high-priority-allow', 'mid-priority-deny', 'low-priority-deny'])
 	})
 
-	it('a throwing veto handler defaults to allow for that probe; aggregate unaffected', () => {
+	it('a throwing veto handler denies — it did not say yes', () => {
+		// This asserted `allow`, with no rationale recorded for why. The
+		// result was that the SAME policy inverted its security posture
+		// depending on which surface it was written on: a content guardrail
+		// that throws blocks the run (and says so in its own comment —
+		// "safety is unknown"), while a tool veto that threw waved the tool
+		// through. Nobody chose that asymmetry, which is how it survived.
+		//
+		// The exposure this trades against is real and is the same one the
+		// guardrail already accepted: a buggy veto can refuse every call.
+		// The refusal names the probe, so it is diagnosable; a wrongly
+		// permitted destructive call is not recoverable at all.
 		const reg = createProbeRegistry()
 		reg.setLogger(makeLogger())
 		const audit: string[] = []
@@ -413,8 +430,34 @@ describe('ProbeRegistry — veto API', () => {
 			{ type: 'tool_executing', runId: 'r' as never, toolName: 't', input: {} } as never,
 			buildProbeContext(),
 		)
-		expect(outcome.action).toBe('allow')
-		expect(audit).toEqual(['throw', 'allow'])
+		expect(outcome.action).toBe('deny')
+		expect(outcome.probeName).toBe('bad')
+		expect(outcome.reason).toContain('threw while deciding')
+		// Short-circuits: once a decision is missing there is nothing a
+		// later allow can add, and running on would spend handlers to reach
+		// the same answer.
+		expect(audit).toEqual(['throw'])
+	})
+
+	it('still skips a throwing OBSERVER, which was never asked a question', () => {
+		// The asymmetry that IS deliberate. An observer has no answer to
+		// withhold, so taking a run down because a metrics handler crashed
+		// would be the same mistake pointing the other way.
+		const reg = createProbeRegistry()
+		reg.setLogger(makeLogger())
+		const seen: string[] = []
+		reg.on('tool_executing', () => {
+			throw new Error('boom')
+		})
+		reg.on('tool_executing', () => {
+			seen.push('second')
+		})
+
+		reg.dispatch(
+			{ type: 'tool_executing', runId: 'r' as never, toolName: 't', input: {} } as never,
+			buildProbeContext(),
+		)
+		expect(seen).toEqual(['second'])
 	})
 
 	it('observe-tier dispatch is independent — veto registration does not fire on dispatch', () => {

package/src/probe/registry.ts

@@ -194,8 +194,28 @@ export class ProbeRegistry {
 			try {
 				decision = entry.handler(frozen, ctx)
 			} catch (error) {
+				// A veto that threw did not say yes.
+				//
+				// Skipping it let the call proceed — so the SAME policy
+				// inverted its security posture depending on which surface it
+				// was written on: a content guardrail that throws blocks the
+				// run, and a tool veto that throws waved the tool through.
+				// The two are the same kind of decision and the asymmetry was
+				// nobody's decision, which is how it survived.
+				//
+				// An OBSERVER that throws is still skipped, a few lines up.
+				// That asymmetry IS deliberate: an observer was never asked a
+				// question, so it has no answer to withhold, and taking a run
+				// down because a metrics handler crashed would be the same
+				// mistake pointing the other way.
 				this.logThrow(entry.name ?? 'unnamed', frozen.type, error)
-				continue
+				return {
+					action: 'deny',
+					probeName: entry.name,
+					reason: `probe "${entry.name ?? 'unnamed'}" threw while deciding, so it did not permit this: ${
+						error instanceof Error ? error.message : String(error)
+					}`,
+				}
 			}
 			const normalized = normalizeDecision(decision)
 			if (!normalized.allow && firstDeny === undefined) {