pub const UNWRAP_BATCH: usize = 16;
Wraps opened per vault read on bulk paths. It bounds how long the key stays materialised: two ECDHs per wrap, about 1.5 ms per batch on a desktop core.