handle
Sanitize any other failure into a generic 500. The cause is logged server-side; the response body carries a fixed message, so driver or store detail never reaches a caller whatever the consumer's global error config does.