Function recover 

pub unsafe fn recover(
    tid: ThreadId,
    cause: i32,
) -> Result<Infallible, RecoveryFailure>

From the shared fault/OOM handler: recover the thread identified by tid by jumping into its innermost active scope that accepts cause, reporting it. protect scopes accept any cause; protect_cause scopes accept one.

Diverges on success: the matching protect returns Err(RecoveryError { cause }). Returns Err(RecoveryFailure) if no active scope for tid accepts cause, so the caller can halt or escalate, leaving every scope live.

Scopes for tid nested inside the one it jumps into never return: the jump abandons their frames and drops their marks from the registry.

Safety

• tid must identify the thread on whose stack the matching protect is still live.
• Must be called from the same thread as tid, not from the other thread, context, or the fault handler.
• All leak / protect # Safety obligations apply to everything between the fault point and the mark.