re-audit / verification round

## Goal
re-audit / verification round

## Scope
- See referenced docs in repo.

## Acceptance criteria
- [ ] Implementation complete
- [ ] Tests added (where applicable)
- [ ] Coverage gate met for the touched area
- [ ] CI green on PR
- [ ] No leak words

## Test plan
- [ ] Local build green
- [ ] CI green