💥 Fail a root document on an uncaught failure without requiring <Output>

[taras]

Story

As the author of an executable document used as an entrypoint, I want an uncaught failure to fail the document execution by default, so a refusal or failed validation cannot become a comment followed by exit 0 merely because I did not wrap the document in <Output>.

Motivation

README.md and operational documents such as scripts/bootstrap-npm-package.md are entrypoints. Today their root error mode prints an ordinary failure and continues unless the author places the work inside <Output>.

That makes this surprising document succeed:

```ts eval
throw new Error("refusing to continue");
```

```bash exec
echo THIS MUST NOT RUN
```

The error becomes a rendered comment, the later command runs, and xmd run exits 0. Wrapping the document in <Output> makes the same failure fatal, but <Output> is presented as rendered-content selection. Requiring it as entrypoint fail-fast boilerplate overloads presentation syntax with the document's safety policy.

Foreground commands expose the inconsistency. Since #442, an ordinary nonzero exec is a checked failure and stops the run without <Output>. Since #448, exec as="name" deliberately turns that status into data; if the classifier then throws, the root prints the refusal and continues unless <Output> is present. To an author, both are failed executable steps.

Product contract

Root settlement

An error that reaches the root document undecided fails the document execution by default:

• the failure propagates through structured teardown;
• later executable work and later siblings do not start;
• output rendered before the failure remains visible and becomes the failed execution's partial output;
• xmd run exits nonzero; and
• a retained execution records and replays the same determined failure without repeating completed effects.

This changes the root's default failure policy, not its rendering mode. A successful text root still renders its ordinary document content. Authors do not need <Output> to select the whole document or to make it fail fast.

Explicit recovery

<PrintErrors> remains the authored construct that turns failures in its region into printed errors and permits continuation:

<PrintErrors>
 <MayFail />
</PrintErrors>

This is reached after a recovered failure.

Root fail-fast does not make every diagnostic fatal after some construct has deliberately handled it. Existing component-owned handling of a component's own failure remains governed by its settled contract. In particular:

• printErrors(fn) continues to speak only for that component's own work;
• it does not recover caller content projected through the component;
• <Test> continues to contain a checked failure as a failed test and lets the testing outcome decide the run; and
• a real <PrintErrors> remains the only document construct that recovers a checked foreground-command failure to ordinary continuation.

<Output>

<Output> continues to select the rendered regions of a document and to preserve partial selected output on failure. It is no longer required merely to make root failures fatal.

Do not rename or remove <Output> in this story. The implementation may reuse the existing internal error mode, but the public contract must keep rendered-output selection separate from the root's default settlement policy.

Existing authority boundaries

• Preserve 🔒 Let the region decide a projected content failure #446: projected caller content executes under the caller site's error policy. A root site is now fail-fast, so an unhandled projected-content failure reaches and fails that root; a component's printing declaration does not acquire authority over caller content.
• Preserve 🚿 Stream a foreground command and keep what the boundary received #442: an ordinary nonzero foreground command remains a checked failure without requiring <Output>.
• Preserve 🔗 Bind a command's settled result so a document can decide on its exit code #448: a bound command's settled nonzero status remains data. Only a later unhandled refusal raised by the document fails the root.
• Durability failures, Files infrastructure failures, cancellation, and teardown retain their existing precedence and identity rules.

Compatibility

This is an intentional compatibility change for roots that currently rely on an undecided error being printed followed by successful continuation.

Inventory repository documents and focused fixtures that rely on that behavior. Migrate deliberate recovery to an explicit <PrintErrors> region. Do not preserve compatibility by adding implicit recovery, frontmatter, a hidden <Output>, or a new root-only exception.

Specifications and release-facing documentation must call out the changed root default and the migration spelling.

Acceptance

1. A root eval throw without <Output> fails the execution, preserves its earlier rendered prefix, starts no later command, and makes xmd run exit nonzero.
2. The same failure inside a real <PrintErrors> is printed once, later work runs, and the root may complete successfully.
3. A successful root without <Output> still renders its complete ordinary document.
4. <Output> continues to select content and preserve selected partial output; removing it from a document changes selection only when the document used that selection.
5. An ordinary nonzero exec retains 🚿 Stream a foreground command and keep what the boundary received #442's checked-failure behavior.
6. A nonzero exec as="result" still binds and continues; an unhandled classifier throw that follows fails the root.
7. Caller content projected through <TempDir>, <File>, or another printing component retains 🔒 Let the region decide a projected content failure #446's ownership: an unhandled failure fails the root after cleanup and no later sibling runs.
8. Component-owned failures intentionally handled under the existing printErrors(fn) contract remain component-owned; the change does not silently reclassify them as caller-content failures.
9. <Test> containment and final testing failure semantics are unchanged.
10. A retained replay restores the same success, explicitly recovered outcome, or root failure without repeating the effect that produced it.
11. Architecture, executable-MDX specification, CLI behavior, examples, and the tier matrix describe the same default and recovery boundary.

Tests must distinguish a successful completion containing a printed diagnostic from a failed completion; output text alone is not sufficient evidence.

Motivating consumer

After this lands, rebase draft PR #308 onto it and remove the outer <Output> from scripts/bootstrap-npm-package.md. Its refusal cases must still fail, start no later npm call, preserve already-rendered explanation, and exit nonzero. The five expected-404 reads are independently migrated to exec as="name" through merged #448.

Delivery

Implement as one focused core semantic PR from current main at or after #448 (90105577c3f10e749e308ccd18a16792d66c54b1). Update architecture, specification, compatibility guidance, and discriminating core/CLI regressions in the same PR.

PR #308 consumes the landed behavior after rebasing; it does not define or temporarily emulate the root policy.

Not this issue

• Renaming, removing, or redesigning <Output>.
• Adding <FailFast>, root frontmatter, or another opt-in spelling for the new default.
• Changing <PrintErrors>, printErrors(fn), or <Test> beyond what is necessary to preserve their settled authority.
• Changing bound-command grammar or process-output retention.
• Building the Markdown testing improvements identified separately.
• Implementing <Stringify> from ✨ Add <Json> as the explicit structured-value rendering boundary #452.