When an app fails: fault isolation and recovery
How Basehim keeps one broken app from taking a site down: code checked before it is loaded, failures contained while it starts, the app switched off with a report for the administrator, and a validated way to turn it back on.