Function nova_rt_float_fixed 

#[unsafe(no_mangle)]
pub extern "C" fn nova_rt_float_fixed(
    v: f64,
    places: i64,
) -> *mut NovaStr

Format a Float to a fixed number of decimal places.

extern "C" with no unsafe and no -unwind, matching nova_rt_float_to_str directly above: this takes no pointer, and format! on an f64 cannot panic once places is clamped. Do not reach for extern "C-unwind" here because the async intrinsics use it – the two families differ, and an earlier draft of this increment’s spec got it wrong by pattern-matching the wrong neighbour.

places is clamped to 0..=17. The ceiling is where an f64 stops carrying information. The floor is load-bearing in a stronger way than “it would panic”: a negative precision reaches format! and panics Formatting argument out of range, and because this function is extern "C" with no -unwind that panic cannot unwind — it escalates to panic in a function that cannot unwind and aborts the process (measured: STATUS_STACK_BUFFER_OVERRUN, on both the direct Rust path and the JIT-compiled path, where the backtrace truncates at this frame because generated code carries no unwind tables).

That escalation is the argument for extern "C" here rather than against it. crate::task’s module docs already set the rule this follows: anything reachable from a generated call site must abort rather than attempt to unwind. The clamp is what keeps this function inside that rule.