fix: report a boundary module that throws or fails to load

Sanitizing the 403 / 401 / 404 body removed the only production-visible
trace of that failure and put nothing in its place, so a boundary whose
module throws or cannot be imported produced a bare heading and no server
signal at all, on a request that already returned a 4xx to a real user.
Sanitizing a response should move a failure out of the RESPONSE, not out of
sight. It reports through the same path the adjacent layout crash does.

The docs site gains the rule this commit and the last one established for
the boundary's own crash: shown in dev, withheld in prod, reported either
way.

Author: vivek7405

packages/server/src/ssr/render.js

@@ -481,6 +481,7 @@ function boundaryErrorKey(err, stage) {
 /** Stage labels, which are part of the dedup key (see boundaryErrorKey). */
 const STAGE_WALK = 'an error boundary or its layout threw while handling a render error';
 const STAGE_GLOBAL_ERROR = 'global-error threw while handling a render error';
+const STAGE_BOUNDARY = 'a boundary module threw or failed to load';
 
 /**
  * Report a throw from a layout wrapped around a boundary page (#1298) to the
@@ -679,6 +680,12 @@ async function ssrBoundaryHtml(file, heading, opts) {
         }
       }
     } catch (e) {
+      // The boundary module itself threw or failed to load. REPORT it: with
+      // the body sanitized below, this is otherwise completely silent in
+      // production, on a request that already returned a 4xx to a real user.
+      // Sanitizing without reporting moves a failure out of sight rather than
+      // out of the response, which is the opposite of the intent.
+      reportBoundaryLayoutError(e, opts, { what: STAGE_BOUNDARY, overlay: true });
       // Dev shows the failure; prod shows only the heading. The 500 path has
       // always drawn that line (a thrown error's message is not
       // author-controlled and must not reach the client), and these pages were
@@ -737,6 +744,8 @@ async function ssrNotFoundHtml(notFoundFile, opts) {
         }
       }
     } catch (e) {
+      // Reported for the same reason as in ssrBoundaryHtml above.
+      reportBoundaryLayoutError(e, opts, { what: STAGE_BOUNDARY, overlay: true });
       body = opts.dev
         ? `<h1>404: Not found</h1><pre>${escapeHtml(safeErrorText(e))}</pre>`
         : '<h1>404: Not found</h1>';

test/ssr/ssr.test.js

@@ -2423,6 +2423,45 @@ test('boundary: an unprintable throw from a 403 boundary degrades, never escapes
   assert.match(await resp.text(), /unprintable value/);
 });
 
+test('boundary: a crashing boundary module is REPORTED, so prod is not silent', async () => {
+  // Sanitizing the body removed the only production-visible trace of this
+  // failure. Sanitizing without reporting moves a failure out of sight rather
+  // than out of the response, on a request that already returned a 4xx to a
+  // real user.
+  const { route, appDir } = makeBoundaryApp({
+    files: {
+      'admin/forbidden.js': `export default function F() { throw new Error('BOUNDARY_MODULE_BOOM'); }\n`,
+      'admin/page.js': `import { forbidden } from ${JSON.stringify(WEBJS_MODULE_URL)};\nexport default function Page() { forbidden(); }\n`,
+    },
+    page: 'admin/page.js',
+    layouts: [],
+    forbiddens: ['admin/forbidden.js'],
+  });
+  const seen = [];
+  const resp = await SILENT(() => ssrPage(route, {}, new URL('http://localhost/admin'), {
+    dev: false, appDir, onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 403);
+  assert.ok(!(await resp.text()).includes('BOUNDARY_MODULE_BOOM'), 'the body stays sanitized');
+  assert.equal(seen.length, 1, 'but the failure reached the sink');
+  assert.match(String(seen[0].message), /BOUNDARY_MODULE_BOOM/);
+});
+
+test('boundary: a 404 boundary that fails to LOAD is reported too', async () => {
+  // The load failure path, not the render one: a syntax error in not-found.ts.
+  const sub = mkdtempSync(join(tmpDir, 'nf-load-'));
+  const appDir = join(sub, 'app');
+  mkdirSync(appDir, { recursive: true });
+  const nf = join(appDir, 'not-found.js');
+  writeFileSync(nf, `export default function NF({ x { return; }\n`);
+  const seen = [];
+  const resp = await SILENT(() => ssrNotFound(nf, {
+    dev: false, appDir, url: new URL('http://localhost/gone'), onError: (e) => seen.push(e),
+  }));
+  assert.equal(resp.status, 404);
+  assert.equal(seen.length, 1, 'a boundary that cannot even be imported is not silent either');
+});
+
 test('boundary: a boundary response is never storable and never reduced', async () => {
   // Two independent guarantees. The HTML cache refuses a non-200 outright, and
   // the reduced X-Webjs-Have path is structurally unreachable: the boundary

website/app/docs/error-handling/page.ts

@@ -40,6 +40,8 @@ export default function ErrorHandling() {
 
     <p>A layout that genuinely crashes is reported to your <code>onError</code> hook rather than being swallowed, so it reaches your error tracker. Repeats of the same crash within one request are collapsed to a single report, since one shared layout can fail several boundary attempts. A <code>redirect()</code> or <code>notFound()</code> is never reported, being routing rather than a crash.</p>
 
+    <p>The same holds when the <strong>boundary file itself</strong> throws or fails to load. Its response body follows the rule the rest of the framework uses for a thrown error: the failure is shown in development and withheld in production, where the page carries only its status, because a thrown message is not something you control and may name a driver, a path or a connection string. The error still reaches <code>onError</code> and the server log either way, so sanitizing the response never means losing the failure.</p>
+
     <p>Two consequences worth knowing. A layout that fetches data runs that fetch a second time on a boundary response, since the chain is rendered again around the boundary. And a <code>&lt;webjs-suspense&gt;</code> inside a wrapped layout shows its fallback, because a boundary response is buffered so its status and headers are final before the first byte goes out.</p>
 
     <code-block>// app/error.ts: root error boundary