Errors, Panics, Liveness, and Hot Reload

There are several independent failure domains:

• conversion can reject an incompatible Variant or argument shape;
• a Gd<T> can reference an object Godot already freed;
• dynamic borrowing can detect re-entrant aliasing;
• a method may be unavailable for the loaded engine version;
• initialization metadata can be incompatible with the engine binary;
• user callbacks and async polls can panic.

The library checks object validity and runtime type before dangerous pointer use. Reference-counted and manual-memory classes follow different lifecycle rules, and explicit free rejects active borrows. Placeholder instances in the editor are represented as a distinct limitation rather than pretending Rust state exists.

Initialization and deinitialization occur at engine-defined levels. Class registries are loaded and unloaded accordingly, with special handling for editor hot reload. Fatal startup incompatibility is reported or terminates in a context-sensitive way rather than continuing into undefined behavior.

The deepest lesson is that a safe wrapper cannot make foreign lifecycle facts compile-time facts. It combines static restrictions with fast, contextual runtime validation at every point the engine can invalidate an assumption.