@teamscala/service-boot 0.23.493 → 0.23.494

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.493",
+  "version": "0.23.494",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/mount-server-packages.ts

@@ -65,6 +65,10 @@ export async function mountServerPackages(
 	const mountRegistry = createMountRegistry();
 	const mountCtx = createMountContext(serviceSlug, config, app, mountRegistry, getSharedDb);
 	const serverPackages = (config.server_packages ?? []) as string[];
+	/** Packages that loaded but whose mount threw — unavailable, not fatal.
+	 *  Named in the summary so a degraded boot is legible without grepping for
+	 *  the per-package error line. */
+	const degraded: string[] = [];
 
 	if (serverPackages.length === 0) {
 		log.info(`[scala-install:${serviceSlug}] No server_packages declared`);
@@ -125,11 +129,34 @@ export async function mountServerPackages(
 			}
 		} catch (err) {
 			if (err instanceof BootFatalError) throw err;
-			throw new BootFatalError(
-				"mount-server-packages",
-				serviceSlug,
-				`server_package "${pkg}" mount failed: ${err instanceof Error ? err.message : err}`,
-				err,
+			// A PLUGIN THAT FAILS TO MOUNT IS UNAVAILABLE, NOT FATAL. `crash-isolation`
+			// states the law directly — "a failure in one package does not crash the
+			// host" — and names the plugin failure domain: "a broken plugin degrades
+			// to 'that plugin unavailable'". This arm used to wrap ANY mount error in
+			// a BootFatalError, so one plugin's missing config killed a whole service.
+			//
+			// MEASURED 2026-09-07: scala-agents-ui, the operator's fleet monitoring UI,
+			// booted through db, auth, routes and every other server_package, then died
+			// at @teamscala/opencode because OPENCODE_SERVER_URL was absent. systemd
+			// retried five times and gave up, agents.scala.business served 502, and the
+			// operator lost sight of his fleet — over one optional integration missing
+			// one variable, on a page that needs no opencode connection to render.
+			//
+			// THE ASYMMETRY DECIDES IT. A service that boots without one plugin still
+			// serves every route that plugin did not own, and the gap is loud in this
+			// log line and counted in the summary below. A service that refuses to boot
+			// serves NOTHING — including the surface that would have explained why.
+			//
+			// NOT-FOUND STAYS FATAL, deliberately: that arm is above and untouched. A
+			// package that LOADS and then throws is a broken plugin, which is this
+			// case. A package that cannot be resolved at all means the declared
+			// dependency set was never installed — an install-integrity failure, where
+			// booting a half-installed service would serve wrong results while looking
+			// healthy.
+			degraded.push(pkg);
+			log.error(
+				`[scala-install:${serviceSlug}] server_package "${pkg}" UNAVAILABLE — mount failed; ` +
+					`the service continues without it: ${err instanceof Error ? err.message : err}`,
 			);
 		}
 	}
@@ -137,7 +164,12 @@ export async function mountServerPackages(
 	log.info(
 		`[scala-install:${serviceSlug}] Registered ${mountRegistry.handlers.size} handler(s), ` +
 			`${mountRegistry.wsRoutes.size} ws route(s), ` +
-			`${mountRegistry.bootHooks.size} boot hook(s)`,
+			`${mountRegistry.bootHooks.size} boot hook(s)` +
+			// NAMED, NEVER COUNTED. A bare "1 degraded" sends the reader hunting for
+			// which one; the name is the whole value of the line.
+			(degraded.length > 0
+				? `, ${degraded.length} server_package(s) UNAVAILABLE: ${degraded.join(", ")}`
+				: ""),
 	);
 
 	return mountRegistry;