### Problem/Motivation A second pass of the release audit of 2026-10-20, reading every file as if no audit had run before, found these defects. - **The webform handler acts on submissions that are not a new one of the current user.** `PdvRecordMap` prefills, checks write access and saves back with no look at the submission: - Webform fills an existing submission's elements before handlers run `alterForm()`, so the prefill overwrites them: an administrator editing someone's submission sees it filled from the **administrator's** vault, and saves that. - On submit, `validateForm()` refuses the administrator's save unless the administrator granted write access, and `postSave()` writes the submitter's answers into the administrator's own vault. - A draft resumed by its owner loses the edits it holds the same way, and each draft save already writes to the vault. - **The consent landing answers 500 to some valid requests.** `pdv_grant_request` stores the consumer's `state` in a 64-character ASCII column and `return_url` in a 1024-character one, and the landing checks neither: a longer value is a database error, a non-ASCII state an `AsciiFields` exception, where the API contract lists a 400. - **An item kind's type and tenant can change while items use them.** Turning a file kind into a record kind lists its files under Structured data, and opening one fails in `RecordCodec::decode()`. Scoping a shared kind to one tenant leaves its items in the other tenants with a kind that is no longer available there. Deleting a kind counts its items, not its pending store requests, so a later approval creates an item of a kind that no longer exists. - **A secret-store outage stops a Master KEK rotation.** Every subject the rotation reaches while the store is unreachable is recorded as failed, so the rotation soon has nothing left to try and stops "incomplete". The failed list kept in state, and the `NOT IN` condition built from it, grow with every run. - **Two settings take input they cannot use.** A dormancy reminder line that is not a positive number (`3O`, `-7`) is dropped without a word, so the owner gets fewer reminders than the operator typed. An allowed return-URL origin with a path, a trailing slash or capitals never matches, so consent fails with no hint why. - **The ECA owner tokens are empty on read and write events.** Those events name the owner under `uid`, the tokens read only `owner_uid`. - **Links that open a new tab do not say so.** The vault page's "View" and the file edit form's current-file link open in a new tab with nothing telling a screen reader or keyboard user. ### Proposed resolution - Prefill only a new submission. Check write access and save back only when the current user owns the submission and it is not a draft. - Refuse a `state` longer than 64 characters or outside the URL-safe set, and a `return_url` longer than 1024 characters, with a 400 at the consent landing; say so in `openapi.yaml`. - Lock an item kind's type and tenant once it is used (form and `preSave()`, so a config import is refused too); count pending store requests before deleting a kind. - Skip a rotation run when the target Master KEK is not usable, instead of recording its subjects as failed. - Refuse a reminder line that is not a positive whole number; check that each allowed origin is `scheme://host[:port]`, and compare origins in lower case. - Read the ECA owner from `uid` too. - Say "(opens in a new tab)" in those links, visually hidden. - Tests: each defect, proven to fail without its fix. ### API changes None. AI-Generated: Yes (Claude Code was used to help draft this issue summary and will be used to write the change and its tests. I review both before the MR is opened.)