Function open_chunk 

pub fn open_chunk(
    aad: &[u8],
    dek: &[u8; 32],
    stream_nonce: &[u8; 19],
    position: u32,
    last: bool,
    ciphertext: &[u8],
) -> Result<Vec<u8>, BlobError>

Decrypt ONE chunk, without touching the ones before it.

This is what makes a ranged read cost the chunks it asked for rather than every chunk preceding them. StreamBE32 is a stateless primitive keyed by position — the sequential open path is a convenience over exactly this operation, not a different construction — so chunk N authenticates alone.

last is bound into the tag, so it is not a hint: passing false for the real final chunk fails, and so does passing true for a middle one. That is the property that catches a truncated container, and it only holds if the caller derives last from the header’s declared size rather than from where the file happens to end.