Function guard 

pub fn guard<T>(what: &'static str, fallback: T, body: impl FnOnce() -> T) -> T

Run body, returning fallback if it panics.

The closure is treated as unwind-safe: state it touches lives behind handles the C caller owns, and a panic leaves that state untouched because the engine itself does not panic on error paths – it returns Result.