Scope a decoder to the recipient who decoderd

Shipped

August 6, 2026 at 12:36 PM UTC

Author

Kamo

Commit

1dbbf90

Any single recipient declining set the whole envelope DEcoderD, so a counter-signer could destroy signatures the other parties had already given, with no recovery path. The envelope now terminates only when nobody is left who could still sign. Also stops DELEGATED counting as signed for completion: that was safe only via an invariant nothing enforces.