Make function-component failures fail-fast by default with explicit collection boundaries

[taras]

Purpose

Make ordinary function-component failures follow Effection's normal fail-fast
semantics by default. Continuing after such a failure becomes an explicit,
scope-local choice expressed by <CollectFailures> or collectFailures(fn).

This replaces the current inverse model, where the function-component boundary
turns ordinary body and teardown failures into ErrorSegments unless the
function or failure carries an internal abort marker.

Product contract

Default behavior

An ordinary failure from a function component fails its current Effection
operation by default:

• the complete component invocation finishes teardown before the failure leaves
  the boundary;
• an Error propagates by identity, preserving its type and cause;
• a non-Error thrown value is normalized to an Error whose cause is the
  exact original value;
• a body failure combined with teardown failure propagates as the complete
  aggregate produced by withInvocation();
• later siblings do not execute unless an explicit collection boundary handles
  the failure.

Failing an Effection operation is not an unconditional process crash. The
structured scope unwinds and releases its resources, and an enclosing operation
may still recover deliberately.

Failure-handling middleware

Add one public contextual component operation with this effective contract:

export interface ComponentFailure {
 readonly name: string;
 readonly position?: SourcePosition;
 readonly error: Error;
}

interface ComponentApi {
 handleFailure(failure: ComponentFailure): Operation<ErrorSegment>;
}

The final spelling may change only to avoid a collision with an existing
repository convention; do not replace this with process-global hooks, events,
or mutable registration metadata.

The default implementation throws failure.error. The engine calls it only
for an ordinary function-component invocation failure and only after
withInvocation() has produced the complete body-and-teardown outcome.

The standard collection middleware converts the failure into one component
diagnostic, attributes the original failure as its cause, and reports it once
through Component.raise. It is terminal: it handles rather than delegates.

The following are classified before handleFailure and are never downgraded by
the standard collector:

• durability, stale-input, and replay-divergence failures;
• a DocumentationError already selected by the caller's throwing policy;
• the private content-failure transport that restores already-reported
  ErrorSegments;
• established schema-validation diagnostics that already have a structured
  document representation.

Component.raise remains the single observation point for an ErrorSegment.
handleFailure handles an operation failure; it does not replace or duplicate
error observation.

collectFailures(fn)

Export this public decorator from @executablemd/core:

export function collectFailures<T extends FunctionComponent>(component: T): T;

Usage:

export default collectFailures(function* WebForm(props) {
 // body, requested content, retained work, and teardown are inside the
 // collection boundary
});

The decorator records the exact function identity and returns that same
function object with its type preserved. It does not create a delegating
generator and does not catch inside the component body.

When the engine invokes a marked function, it installs the standard collection
middleware outside the entire withInvocation() call. This placement is
required: middleware installed from inside the component would disappear
before invocation teardown could fail. Installing outside also makes the
handler available to nested components and projected content whose scopes are
created by that invocation.

The marker is function identity, never component name. A repository component
with the same name as a marked registered component does not inherit its
collection behavior.

<CollectFailures>

Add <CollectFailures> as a reserved engine-owned control construct. It accepts
no props and expands its content in the caller's ordinary expansion frame while
the same standard collection middleware is installed. It preserves structured
segments rather than rendering content to a string.

<CollectFailures>
 <MayFail />
 <StillRuns />
</CollectFailures>

Both forms establish the same dynamic scope: the nearest collection boundary
handles ordinary failures from the enclosed invocation tree.

Collection converts ordinary failures into ErrorSegments; it does not change
the ambient ErrorPolicy. The caller still settles the segment normally:

• under collect (the root and <Output>), the diagnostic renders and later
  work continues;
• under throw (documentation), the reported segment becomes a
  DocumentationError and execution stops.

Do not add a second "already handled" bit or make collection silently override
an enclosing throwing policy.

Structured-concurrency invariants

• withInvocation() and its ordered teardown remain the component lifetime
  boundary.
• Failure handling runs after projected content, the component body, and
  retained invocation resources have all stopped in the established order.
• A collector never reports success before teardown completes.
• If body and teardown both fail, collection reports one diagnostic whose
  cause is the complete aggregate, not only its first member.
• Cancellation is not converted into a document diagnostic.
• A collector does not retry an invocation.

Required cleanup

Remove the mechanisms that exist only because collection is currently the
default:

• abortOrdinaryComponentFailures() and
  abortsOrdinaryComponentFailures();
• the function-identity abort weak set;
• componentAbort(), its error-identity weak set, and the aborted-failure arm
  of fatalCause();
• hasOrdinaryFailure() and its ordinary-leaf traversal;
• the agent fatally() wrappers and explicit componentAbort() calls;
• the special decoration of AgentProvider;
• tests and specification text that describe ordinary collection with fatality
  as an opt-in exception.

Agent components simply throw when their existing contracts say the document
must stop. They remain fail-fast because that is now the default. Prompt
failures that are deliberately recorded and returned remain unchanged.

Keep and update rather than remove:

• withInvocation() and InvocationTeardownError;
• durability-failure recognition and its precedence;
• AmbientErrorPolicy, settle(), and DocumentationError;
• Component.raise and exactly-once observation;
• cause attribution for a failure deliberately converted to an ErrorSegment;
• ContentError, tryContent(), and the private content transport;
• consumer-boundary settlement between a component and its caller.

Put the public decorator and its private exact-function marker in a focused
module such as src/component-failures.ts; do not grow errors.ts with the
inverse of the machinery being removed.

Behavior matrix and tests

Add discriminating tests for all of the following:

1. An unmarked repository TypeScript component throws an Error: execution is
   Err with the exact object, later siblings do not run, and no diagnostic is
   rendered.
2. An unmarked registered component has the same behavior.
3. An unmarked component's teardown throws only after its body returns: teardown
   finishes and the exact teardown failure propagates.
4. Body and teardown both fail: the complete ordered aggregate propagates.
5. A non-Error throw is normalized with the exact thrown value in cause.
6. collectFailures(fn) converts an ordinary body failure into exactly one
   observed ErrorSegment under collect, preserves the original failure as
   cause, and later siblings run.
7. The decorator collects a teardown-only failure after teardown completes.
8. The decorator collects the complete body-plus-teardown aggregate as one
   diagnostic with the aggregate in cause.
9. <CollectFailures> handles a direct child failure and continues to a later
   child under collect.
10. Both forms reach failures in nested components and in content projected
    through content() without duplicate handling or observation.
11. The nearest nested collection boundary handles once.
12. Under an ambient throwing policy, both forms report once and the resulting
    DocumentationError still stops execution.
13. Neither form collects durability/replay divergence.
14. Uncaught ContentError still restores the original segments without
    reporting them again; explicit content recovery remains recovery.
15. Input- and return-schema behavior remains in its existing structured
    diagnostic channel.
16. A repository component named like a marked registered component remains
    unmarked and fail-fast.
17. Existing Agent, observation, capture, projection, invocation-failure, and
    replay suites remain green after obsolete marker cases are removed.

Tests must distinguish successful operation completion containing a rendered
diagnostic from failed operation completion; checking output text alone is not
sufficient.

Specification updates

Update the executable MDX and component API specifications in present tense:

• ordinary function-component operation failures propagate by default;
• error collection is an explicit dynamic boundary;
• handleFailure runs after complete invocation teardown;
• Component.raise observation and operation-failure handling are distinct;
• <CollectFailures> is reserved engine syntax;
• collectFailures(fn) is keyed by exact function identity;
• collection remains subordinate to the caller's ambient settlement policy;
• durability failures and cancellation are not collectable diagnostics.

Update #202's behavior-preservation account where it describes the private
agent abort marker. This issue deliberately replaces that implementation while
preserving the user-visible fail-fast behavior of Agent components.

Sequencing

1. Land this issue as one focused core semantic-refactor PR based on current
   main. Do not stack it on 🐛 Report a <Testing> boundary only once its body has finished #247.
2. Keep 🐛 Report a <Testing> boundary only once its body has finished #247 open. After this issue lands, rebase 🐛 Report a <Testing> boundary only once its body has finished #247 and replace TB1's custom
   Component.raise throwing middleware with a real ordinary child component
   failure. Assert exact failure identity, absence of later output, and no
   testing boundary observation or journal entry. The ordering fix then lands
   on the new default.
3. Continue Add a bundled local WebForm component for schema-backed user input #195 WebForm transport/server/browser work in parallel. Its public
   registered <WebForm> integration waits for this issue and chooses
   collectFailures(WebForm) only if the component contract explicitly intends
   recoverable rendered diagnostics. Do not inherit collection accidentally.
4. Resume the remaining Register function components and migrate legacy component handlers #202 migrations after the semantic-refactor PR lands.
   Each migrated component is fail-fast unless its approved behavior requires
   an explicit collection boundary.
5. Provider-neutral <Elicit> (Add provider-neutral Elicit through the core Context API #197) remains after the WebForm provider
   contract and the corrected Testing/error semantics are ready.

Non-goals

• Changing the exactly-once ErrorSegment observation contract fixed by ErrorSegments are observed twice in <Each>, <Capture>, and component expansion paths #220.
• Replacing withInvocation() or weakening ordered structured teardown.
• Making every authored document diagnostic an exception.
• Letting collection hide durability divergence or cancellation.
• Adding retry, resume, or fallback values to failure middleware.
• Implementing WebForm, Elicit, or the remaining Register function components and migrate legacy component handlers #202 component migrations in
  this PR.
• External schema references (Resolve external JSON Schema refs through XMD filesystem and fetch capabilities #192), replaying effects inside new ephemeral
  environments (Quest: Resume workflows with their Workspace, repositories, and Agent state #218), filesystem containment (Prevent xmd run filesystem operations from escaping the working directory #227), or secret detection
  (Reject secrets before journal persistence by default #199).

Verification

deno task fmt
deno task lint
deno task check
deno task test
deno task check:jsr
pnpm exec tsc --project tsconfig.node.json --noEmit
deno task build
./dist/xmd test packages/core/src --raw
git diff --check

All hosted checks must be green. A recurring failure from the independent TD8
daemon-liveness defect is tracked in #248 and must not be fixed in this PR.

Acceptance criteria

• Ordinary function-component body and teardown failures propagate by default
  after complete cleanup.
• Component.handleFailure is the one contextual handling seam for ordinary
  invocation failures.
• <CollectFailures> and collectFailures(fn) install the same standard
  collection middleware only within their explicit dynamic scopes.
• Collected failures are observed once, retain the complete original failure as
  cause, and remain subject to the caller's ambient settlement policy.
• Durability failures, cancellation, content transport, and established schema
  diagnostics retain their distinct semantics.
• The inverse abort-marker machinery and agent-specific fatal wrappers are gone.
• Specifications and discriminating tests describe the simplified model.