handle
Sanitize any failure from a live store/driver (timeouts, query errors) into a generic 500. The cause is logged server-side; the response body carries only a fixed message so internal or driver detail never leaks to the caller, regardless of the consumer's global error config.