v2.6.1: read-only and safe mode enforced per action, plus client-go v2.55.1