docs: clarify middleware callback error semantics

docs/about-nemo-relay/concepts/middleware.mdx

@@ -104,6 +104,20 @@ NeMo Relay has two major middleware families:
 - **Intercepts** change the real execution path
 - **Guardrails** block work or rewrite emitted observability payloads
 
+### Callback Error Handling
+
+Conditional-execution guardrails and request or execution intercepts fail
+closed when their callbacks return a failure result. A failure returned
+directly or produced when a callback raises an exception or rejects a `Promise`
+stops Relay at that middleware stage, and Relay surfaces the failure to the
+managed caller. A conditional guardrail or request intercept therefore prevents
+the real callback from running when it fails. Separately, a
+conditional-execution guardrail can return its documented rejection message to
+block execution. A rejection is normal control flow, not a callback failure. An
+execution intercept cannot undo work from a `next` continuation that it already
+invoked. This fail-closed contract is the same whether the callback completes
+directly or asynchronously.
+
 ## Intercepts
 
 Intercepts are middleware that change the real request or execution path.

docs/reference/migration-guides.mdx

@@ -46,6 +46,15 @@ existing error behavior for its middleware family.
 | Node.js | Direct return value | Direct return value or `Promise` |
 | Go / raw C FFI | Synchronous callback | Synchronous callback |
 
+Conditional-execution guardrails and request or execution intercepts retain a
+fail-closed exception contract in 0.7. Relay stops at the failing middleware
+stage and surfaces the error to the managed caller. Conditional guardrail and
+request-intercept failures prevent the real callback from running. This
+behavior is the same for callbacks that return directly and callbacks that
+complete asynchronously. If an execution intercept fails after invoking `next`,
+Relay cannot undo completed downstream work. Relay rejects `next` calls that
+remain unfinished and calls that begin after the interceptor settles.
+
 The experimental Go and raw C FFI callbacks remain synchronous. Relay waits
 for each callback on a native thread, so blocking I/O and other long-running
 callback work occupy that thread. No completion-based registration API is