go: panic + recover → eval 92/92, total 509/509, Phase 6 closed [shapes-scheduler]

Panic/recover builtins + per-frame __go-panic-cell of shape
(STATE V). Body panic flips cell :none→:raised BEFORE defers drain
so recover() can find it. recover() walks env chain past shadowing
cells to the outermost :raised one — flips it :recovered, returns V.
Frame exit checks cell: :recovered → return clean; :raised →
propagate (:go-panic V).

6 tests: uncaught-from-program, panic-from-fn, defer-recover-swallow,
recover-captures-via-channel, propagation-through-no-defer-chain,
middle-frame-catches-deeper-panic.

Shape: panic cell is a frame-attached out-of-band channel that
survives function boundaries via env-chain walk. Same primitive
slots into the scheduler kit's termination-record + cleanup-with-
error-context hook. Maps cleanly to Erlang try/catch/after.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

plans/go-on-sx.md

@@ -359,8 +359,12 @@ Progress-log line → push `origin/loops/go`.
 - [x] Defer stack per function frame; runs LIFO on normal return.
       Args eager at defer-time; frame-local (inner defers don't run
       outer ones); defer-in-loop pushes each iteration. 6 tests.
-- [ ] `panic(v)` unwinds frames running deferreds; `recover()` inside a
-      deferred fn captures the panic value and stops unwinding.
+- [x] `panic(v)` unwinds frames running deferreds; `recover()` inside a
+      deferred fn captures the panic value and stops unwinding. Panic
+      sentinel `(:go-panic V)` propagates through go-eval-block /
+      go-eval-stmt / go-eval-program-loop. Per-frame panic cell
+      `(STATE V)` flips :none → :raised → :recovered; recover walks
+      env chain finding the outermost :raised cell. 6 tests on eval/.
 - Goroutine panic propagation: a panicking goroutine that doesn't recover
   crashes the whole program (honour Go spec, or document divergence).
 - Tests: defer order (LIFO), defer + named-return mutation, panic/recover,
@@ -611,6 +615,24 @@ Minimal repro: see `lib/go/lex.sx#gl-oct-digit?` and `#gl-match-op`.
 
 _Newest first. Append one dated entry per commit._
 
+- 2026-05-27 — **Phase 6: panic + recover.** `panic` and `recover`
+  builtins. Panic sentinel `(:go-panic V)` propagates like
+  `:return-value` through stmt/block/program-loop. Each call frame
+  gets its own `__go-panic-cell` of shape `(STATE V)`; on body panic
+  the cell flips to `:raised V` BEFORE defers drain so `recover()`
+  can find it. `recover` walks the env chain looking for the
+  outermost `:raised` cell (so deferred calls invoked from a
+  panicking frame still see that frame's cell despite their own
+  nested cell shadowing it). Flips to `:recovered` and returns V;
+  the panicking frame then returns normally instead of propagating.
+  6 tests: uncaught surfaces from program, panic from fn surfaces,
+  defer-recover swallows, defer-recover captures value via channel,
+  propagation through 3-deep no-defer chain, middle frame catches
+  panic from deeper. 509/509 total. **Shape:** the panic cell is
+  a *frame-attached out-of-band channel* that survives across the
+  function boundary because env-chain lookup can walk past
+  shadowed bindings to find it. Same primitive will serve as the
+  scheduler kit's "cleanup-with-error-context" hook. [shapes-scheduler]
 - 2026-05-27 — **Phase 6 first slice: defer + LIFO.** Added
   `go-eval-defer-stmt`, `go-run-defers!`, `go-run-defers-prefix!`,
   plus new `:quoted-value` AST node so deferred calls can be

plans/lib-guest-scheduler.md

@@ -231,6 +231,40 @@ real result.
 
 _Newest first. Append one dated entry per milestone landed._
 
+- 2026-05-27 — **Phase 6: panic/recover shape lands.** The panic
+  cell is the missing piece. It's a per-frame mutable record of
+  shape `(STATE VALUE)` carrying one of `:none` / `:raised` /
+  `:recovered`. Three properties matter for the scheduler kit:
+
+    1. **It survives the function boundary** via env-chain lookup —
+       when a deferred call's own frame creates a shadowing cell,
+       `recover()` walks past it to find the OUTER frame's cell (the
+       one that's `:raised`). This is the same mechanism the
+       scheduler will need when a panic-unwinding goroutine has
+       multiple frames each carrying their own state, and the
+       "current panic" must be locatable from any depth.
+
+    2. **It flips state in place** (`set-nth!`) so that the change
+       made by `recover()` deep in a defer chain is visible to the
+       enclosing frame's exit check. The scheduler kit needs the
+       same pattern: a goroutine's "termination reason" must be
+       writable by any frame in its stack.
+
+    3. **It's distinct from the return-value channel.** A frame can
+       carry both `(:go-panic V)` from its body AND a recovery
+       commitment in its panic cell; they're checked in sequence.
+       For the scheduler this maps to: a goroutine carries both its
+       running-state (channel-blocked, ready, sleeping) AND its
+       termination-record (panic V / clean exit / killed) — two
+       orthogonal slots, not one tag.
+
+  Concrete kit hint: every frame record should expose
+  `frame-panic-cell` alongside `frame-defer-queue`. The scheduler's
+  exit-path becomes: drain defers (cell may flip :raised→:recovered)
+  → consult cell → either propagate or return clean. Erlang's
+  `try/catch/after` decomposes identically: `after` is the defer
+  queue, `catch` is the recover-via-cell mechanism.
+
 - 2026-05-27 — **Phase 6 first slice: defer + LIFO observation.**
   Go's defer is a *frame-local cleanup queue* — a list of (callee,
   pre-evaluated-args) records appended on `defer`, drained LIFO at