Panic, recover and failure boundaries

recover only stops a panic when called directly by a deferred function on the panicking goroutine's stack. A parent goroutine's deferred recovery does not catch an unrelated child panic.

Use errors for expected failures such as invalid input or unavailable storage. Panic usually represents a violated invariant or programming error; recovery at a server boundary can protect the process but cannot prove shared state remains valid.

Cleanup still needs ownership and error reporting. Do not convert every panic into a successful zero result, and do not use panic/recover as ordinary cross-goroutine control flow.