fix: don't re-run encrypt, delete shadow on decrypt