fix: harden security, persistence, and operations