Function guard 

pub fn guard<T>(what: &str, default: T, f: impl FnOnce() -> T) -> T

Run f, catching any panic so it can never unwind across the FFI boundary (undefined behaviour); on panic, log at error and return default.

Every extern entry point a platform shell defines routes its body through this — a panic in a platform callback must be turned into a benign default, not an unwind into platform-owned frames.