bootstrapPackageModules loaded "package_manager" and "package_downloader"
in a loop that `return`ed on the first failure -- before every
set*Directory / setSignaturePolicy call that followed it. Three defects
came out of that one early return:
* It left the daemon half-configured on any platform, not just Windows.
A package_downloader that failed to load for any reason on Linux or
macOS took the whole configuration block with it, while
package_manager stayed up.
* The consequence was not the one originally recorded in flake.nix
("installs would land wherever its unset defaults point"). Every
directory in package-manager-lib fails closed when unset --
installPlugin refuses with "User modules directory is not set". What
does NOT fail closed is the signature policy: it defaults to WARN, so
an operator's `signature_policy: require` was read, advertised in
state.json and by `logosctl config get`, and enforced nowhere.
Unsigned packages, and packages signed by untrusted keys, would
install with a printed warning.
* Because "package_manager" was first in the list, its failure meant
"package_downloader" was never attempted, even when it would have
loaded fine.
The stderr warning was wrong in the same way: both failures claimed
"package commands will be unavailable", which is untrue for either
module on its own.
The sequencing now lives in src/daemon/package_bootstrap.cpp behind
injected hooks -- it was not reachable from a test through
logos_core_load_module and a live socket. Each module loads
independently, package_manager is configured whenever it loaded, and
each failure names only the capability it actually costs.
Delivery is now checked. The setters return void, so a dispatched call
and one that never arrived are indistinguishable in the return value;
the CallError overload of invokeRemoteMethod tells them apart. A
configured policy that cannot be delivered unloads package_manager
rather than leave it enforcing less than the session advertises. An
undelivered directory only warns, since those fail closed on their own.
This matters more since cbd4c09: modules-pkg now ships on Windows, so
both modules are loaded on a platform where the daemon had never run
them before.
flake.nix already records both corrections (cbd4c09 reached them
independently); its remaining forward-reference to a defect "tracked
separately" is retired to point at the fix.
tests/test_package_bootstrap.cpp covers all three defects and the
warning text: 7 of its 12 cases fail against the old control flow.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
