pub const MAX_RECIPIENTS: u32 = 256;
Maximum number of recipients allowed per submission.
Caps the fan-out so that per-entry metadata (both RAM and disk) is bounded and find_recipient’s signature-verification scan is bounded.
find_recipient