Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

Read verbs now run in the serving process, where a panic would end every
call; refused logins are nobody's reconnect loop (review of hq issue 327).

internal/link/calls.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log"
 	"regexp"
+	"runtime/debug"
 	"sort"
 	"strconv"
 	"strings"
@@ -575,6 +576,19 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	done := make(chan outcome, 1)
 	go func() {
 		var body []byte
+		// **A handler that panics is an answer, not a dead controller.** A verb answered in the serving
+		// process (novox/hq issue 327: conditions, hand-acts, queue, dead-letters) runs on this goroutine,
+		// where a panic would take every other call and the controller with it.
+		defer func() {
+			if p := recover(); p != nil {
+				if logger != nil {
+					logger.Printf("%s.%s: call %s panicked: %v\n%s", seat, verb, c.ID, p, debug.Stack())
+				}
+				body, _ = json.Marshal(map[string]any{"error": fmt.Sprintf("%s failed inside the controller and "+
+					"answered nothing: %v. It is in the controller's log", verb, p)})
+				done <- outcome{body, true}
+			}
+		}()
 		result, err := handle(ctx, args)
 		failed := err != nil
 		if errors.Is(err, ErrHandingOver) {