v2.1.0 — non-breaking security wiring (AID-632) Security configuration is now applied on every resolution path in report mode by default: per-segment case-insensitive blacklist, max_depth enforcement, collection and serialization coverage, request-scoped dedupe, fail-closed on invalid mode. v3.0.0 will flip the default to enforce.