- Shipped
- September 9, 2026 at 8:15 PM UTC
- Author
- Kamo
- Commit
- c4c4753
**"Sent" was not the same thing as "delivered", and the dialog never said so.** ESigService discarded the result of every invitation email, so a send whose mail was refused still showed "Document sent for signature" — the exact failure reported today, where a recipient was never told a document was waiting. The dialog now reads what the send actually reported and, when an invitation did not leave, puts a warning up that STAYS up, names the address, and carries the resend button itself rather than sending the sender off to find the row on another tab. **Signature Date.** A new tool in Signature Tools. The signer is shown no control for it: the server writes the date at the instant they sign, in their own time zone and the organization's locale, so what the executed PDF says cannot be the signing browser's clock. The designer shows it locked, offers no Required/Read-only/validation settings for it (they are questions about an input that does not exist), and the signer sees the date it WILL carry — formatted from the session's own locale and zone so the preview and the document agree. Three things it turned up that were already broken: - **`readOnly` was decorative in both signer UIs.** The flag is in the design shape, it is a switch in the properties panel and ESigService honours it — and neither InteractiveField ever looked at it, so a "read-only" field rendered as an ordinary input the signer could type into freely. Because nothing enforces required-ness on a read-only field, that free-typed value was the one value on the page nothing checked before it was stamped onto the document. - **kamo-signer's signStore counted read-only fields as required**, so a package carrying one could never be finished — Finish stayed disabled and the "next field" submission complete. kamo-internal's port had already fixed this; the two now agree with each other and with FieldCompletion. - **Nothing held the three copies of the field vocabulary together.** Two of them say "PORTED VERBATIM, do not diverge" in their own headers and nothing enforced it; a type added to one alone renders as a bare text input everywhere else, silently, because every renderer has a default branch. There is a ratchet now. The send dialog also labels each recipient row with the signer slot it binds to, and prefills a slot the template already pins to somebody. Binding is by POSITION, and staff never saw the slots at all — so on a two-party template the only thing deciding who got the employer's blocks and who got the employee's was which name happened to be typed first, with nothing on screen saying so.