fix(observability): wrap lazy OTel import in try/except ImportError

_emit_event gated the OTel path on `if import_checker.is_otel_installed` but
ran `from opentelemetry import trace` unguarded. If is_otel_installed was
True yet the import failed (PEP 420 namespace false-positive in 0.8.3 and
earlier; or any future partial install / broken api package), the
ImportError escaped _emit_event and crashed the middleware calling it
(AsyncRetry, Retry, AsyncBulkhead, Bulkhead) mid-request.

Wrap the lazy import in `try/except ImportError`. On failure, return — the
structured log record on the line above has already fired, so emission
degrades to log-only.

Catch ImportError specifically, not bare Exception: misconfigured-tracer
crashes (RuntimeError, AttributeError) should still surface; only the
install-gate-is-wrong case is in scope.

_emit_event's docstring grows one sentence describing the soft-fallback.

Closes audit Low finding (observability.py:40) from
planning/audit/2026-06-07-deep-audit.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lesnik512

src/httpware/_internal/observability.py

@@ -29,14 +29,20 @@ def _emit_event(
        ``trace.get_current_span().add_event(event_name, attributes=attributes)``.
        When no tracer is active, ``get_current_span()`` returns a ``NonRecordingSpan``
        whose ``add_event`` is a documented no-op — so the call is unconditional
-       behind the install gate.
+       behind the install gate. If the install gate is wrong (the namespace exists
+       but the api package is missing or broken), the lazy import raises
+       ``ImportError``; we degrade silently to log-only emission.
 
     The lazy ``from opentelemetry import trace`` inside the if-block preserves
     the optional-extras isolation invariant: ``import httpware`` must not pull
     ``opentelemetry`` into ``sys.modules`` when the extra is absent.
     """
     logger.log(level, message, extra=attributes)
     if import_checker.is_otel_installed:
-        from opentelemetry import trace  # noqa: PLC0415 — lazy by design (optional-extras isolation)
-
+        try:
+            from opentelemetry import trace  # noqa: PLC0415 — lazy by design (optional-extras isolation)
+        except ImportError:
+            # opentelemetry namespace exists but the api package is broken or missing —
+            # degrade to log-only emission. The structured log record above has already fired.
+            return
         trace.get_current_span().add_event(event_name, attributes=attributes)

tests/test_optional_extras_otel_missing.py

@@ -11,6 +11,7 @@
 """
 
 import logging
+import sys
 from importlib.metadata import distribution
 from unittest.mock import patch
 
@@ -87,3 +88,47 @@ def test_is_otel_installed_uses_opentelemetry_trace_probe() -> None:
         "(PEP 420 namespace hazard + sys.modules side-effect); "
         "see planning/audit/2026-06-07-deep-audit.md (Low finding on import_checker.py:8)."
     )
+
+
+def test_emit_event_survives_lazy_import_failure(caplog: pytest.LogCaptureFixture) -> None:
+    """_emit_event degrades to log-only when the lazy OTel import fails.
+
+    When is_otel_installed=True but ``from opentelemetry import trace`` raises
+    ImportError, _emit_event must not crash — it emits the structured log record
+    and returns.
+
+    Simulates the partial-install case: opentelemetry/ namespace directory exists
+    (created by some instrumentation package) but opentelemetry-api is missing or
+    broken, so importing ``trace`` from it fails.
+    """
+
+    class _BrokenOpenTelemetry:
+        """Stand-in for opentelemetry/ namespace directory without working api."""
+
+        def __getattr__(self, name: str) -> object:
+            msg = f"cannot import name {name!r} from 'opentelemetry'"
+            raise ImportError(msg)
+
+    # Save and replace the real opentelemetry module for the duration of the test.
+    saved = sys.modules.pop("opentelemetry", None)
+    sys.modules["opentelemetry"] = _BrokenOpenTelemetry()  # ty: ignore[invalid-assignment]
+    try:
+        with (
+            patch("httpware._internal.import_checker.is_otel_installed", True),
+            caplog.at_level(logging.WARNING, logger="httpware.test.otel_missing"),
+        ):
+            _emit_event(
+                _TEST_LOGGER,
+                "test.event",
+                level=logging.WARNING,
+                message="survives broken otel",
+                attributes={"k": "v"},
+            )
+    finally:
+        if saved is not None:
+            sys.modules["opentelemetry"] = saved
+        else:
+            sys.modules.pop("opentelemetry", None)
+
+    # The structured log record still fired despite the OTel branch failing.
+    assert any(r.message == "survives broken otel" for r in caplog.records)