It's true we only get weak protection. In Lua 5.1 we still have
newproxy() which generates userdata that can be used as the proxy in
this case - and _then_ the table functions cannot be used.  But I
wonder if this level of paranoia is useful?

As for plain error, it's ok (although say error(msg,2) so that the
error happens in the right place).  pl.utils used to make some effort
to return stack traces which didn't include internal PL details -
perhaps we should return to that experiment. But utils.raise is not
actually well-named, since it usually doesn't raise anything!  I'm
moving away from the idea of globally-controlled state.

steve d.