### Problem/Motivation The release audit of 2026-10-20 found work done several times over, code no caller reaches, logic written out twice, and method names that are not a verb. **Performance** - The owner's vault page decrypts each item's metadata on its own (`VaultController::buildFilesTable()`, `buildRecordsTable()`, `getItemLabel()`): one subject-key load and one Master KEK unwrap per item, which with the Vault Transit plugin is one HTTP request to the secret store per item. `Vault::decryptMetadataForItems()` already does it once per owner. The page also lists the owner's items twice. - The page's active grants come from items of every tenant, while the rest of the page shows the active tenant only; the labels of the others cannot be decrypted. - `ConsumerApi::readFile()` loads the item a second time and resolves the subject key a second time, after `read()` did both: two Master KEK unwraps per file read. - The owner's item pickers (`VaultOptionsTrait::getItemOptions()`, used by the grant and approval forms) decrypt each item's metadata on its own, the same way. - `pdv_subject_key` has no index starting with `owner_uid`. `touch()` with no tenant runs on every sign-in and every visit to the vault page, and `purgeAllTenants()`, `hasAnyKey()` and `DormancyCollector::getEarliestDeadline()` query by owner too: each scans the table. - The garbage collector's anti-joins (crypto-erased items, three orphan reapers, three consumer-orphan reapers) scan their whole tables on every cron run, even when there is nothing to reap. **Dead code** (no caller outside the tests): `Vault::loadOwnerItems()`, which is also the one owner listing that ignores the tenant; `SubjectKeyManager::unlockSession()`, `lockSession()` and `changePassphrase()`; `GrantManager::revokeByIdentity()` and `TrustManager::revokeByIdentity()`; pdv_client's `HandleStore::getLinkedUsersByConnection()`, which would also load every user's data of the module at once. **Repeated logic** - `Vault::findReplaceableUniqueItem()` repeats the query of `loadUniqueOwnerItem()`. - `FileUploadForm` and `FileEditForm` repeat the allowed upload extensions. - pdv_client's `ConsentController` and `VaultUnlockController` repeat the pending round-trip store (remember a state, match it on return, forget it) and the "no usable vault connection" answer, which has already drifted: only one of them links an administrator to the settings. - `LocalConsentController` builds its own random state, though `RandomToken::generate()` exists. - pdv_mail and pdv_message repeat the rule for the deadline a warning gives. - `LocalVaultClient` maps an item reference to an array twice. - `PdvRequirements::isMasterKekUsable()` repeats how `SubjectKeyManager` finds the wrap plugin of a Master KEK. **Names and docblocks** - Not verb first: `VaultController::recordKinds()` and `recordKindIds()`, `SubjectsController::getRotationStatus()` (builds a render array), `PdvRecordMap::unlockPrompt()` and `writeGrantError()`, `UnlockedSessionManager::parkStore()`, `OwnerOrAdminManageTrait::manageReturnUrl()`, `VaultManageForm::batchSubmit()`, `VaultTransit::request()`, `PdvFile::saveToVaultElement()`. - `HandleCodec::decodeBase64Url()` is described as the inverse of a `base64UrlEncode()` that does not exist; `UnlockedSubjectKeyStore` describes a caller that is removed here. ### Proposed resolution - Decrypt the vault page's and the item pickers' metadata in one pass from one listing, and scope its grants to the active tenant. Read a file's body and metadata with one subject-key resolution. Index `pdv_subject_key.owner_uid` (installed sites add it by hand: no update hooks before the first beta). Let the garbage collector walk each table from a saved position, a bounded slice per run. - Delete the dead methods, and move their tests to the methods the code uses. - Keep each repeated rule once. - Rename the methods: `getRecordKinds()`, `getRecordKindIds()`, `buildRotationStatus()`, `buildUnlockPrompt()`, `buildWriteGrantError()`, `getHandoffParkStore()`, `getManageReturnUrl()`, `submitBatch()`, `sendTransitRequest()`, `buildSaveToVaultElement()`. Fix the two docblocks. - Tests: the vault page, the item pickers and a file read resolve the subject key once whatever the item count; the vault page lists no grant from another tenant; a garbage collector run reads a bounded slice. ### API changes The removed methods were on `@internal` classes. Pre-1.0: no deprecation. AI-Generated: Yes (Claude Code was used to help draft this issue summary and will be used to write the change and its tests. I review both before the MR is opened.)