Incompatible plugins gracefully disabled

When a single failing or incompatible plugin crashes the entire host on startup, operators face a binary choice: disable all plugins or accept a broken application. Nine functioning plugins are blocked by the tenth's startup error. ISO 25010 reliability.availability requires that the system remain operational when individual components fail; graceful degradation is the mechanism that makes plugin system failures scope-contained. The absence of graceful degradation also makes plugin troubleshooting a binary-search exercise rather than a directed diagnosis.

Wrap each plugin's load and init sequence in an independent try/catch. Log the plugin name and failure reason, mark the plugin as disabled, and continue loading remaining plugins. Surface disabled plugins in an admin UI or startup log.

async function loadAllPlugins(manifests: PluginManifest[]): Promise<PluginLoadResult[]> {
  const results: PluginLoadResult[] = [];
  for (const manifest of manifests) {
    try {
      checkCompatibility(manifest);
      await loadAndInit(manifest);
      results.push({ name: manifest.name, status: 'loaded' });
    } catch (error) {
      this.logger.error(`Plugin "${manifest.name}" disabled: ${error.message}`);
      results.push({ name: manifest.name, status: 'disabled', reason: error.message });
    }
  }
  return results;
}