Design issue in git merge driver interface

We had a major incident here involving bad merges. It was traced to a problem with a custom merge driver.

On studying why the merge driver failed, we found it was in an unrunnable state (the logical equivalent of calling abort()) and could not mark files as conflicted. Since the users were using a graphical frontend the error messages disappeared into the bitbucket.

I've come to the definite conclusion that treating the file as conflicted was wrong and the merge needed to bail out in the middle as though git merge itself bombed. But there doesn't seem to be any way in the protocol to actually do it.

Looking at the merge driver found that some things cannot be handled, such as OOM condition. The fault has to propagate upwards, unwinding as it goes.