Design issue in git merge driver interface

We had a major incident here involving bad merges. It was traced to a 
problem with a custom merge driver.

On studying why the merge driver failed, we found it was in an 
unrunnable state (the logical equivalent of calling abort()) and could 
not mark files as conflicted. Since the users were using a graphical 
frontend the error messages disappeared into the bitbucket.

I've come to the definite conclusion that treating the file as 
conflicted was wrong and the merge needed to bail out in the middle as 
though git merge itself bombed. But there doesn't seem to be any way in 
the protocol to actually do it.

Looking at the merge driver found that some things cannot be handled, 
such as OOM condition. The fault has to propagate upwards, unwinding as 
it goes.