- Shipped
- September 2, 2026 at 7:53 PM UTC
- Author
- Kamo
- Commit
- 99c965f
The redaction was applied at flatten time, which is after signing. Everything before that — the whole signing session — was served the raw source: fetchDocument returned **************** the signer's app painted the black rectangle onto a canvas, and the PDF those pixels came from still carried every word underneath it. Saving that response out of the network tab was all it took. So the covered text now comes out at the moment the bytes leave, in the one seam both signing controllers share — the public signer's and the in-app recipient's. Nothing else about the design is applied there. The marks, the page operations and the modifiers are all drawn by the surface from the same design JSON, and doing them here as well would double every one; a redaction is the only part that cannot wait, because a picture of one is not one. The stored document is untouched either way, and stays untouched on purpose: the member who drew the rectangle has to be able to move it, change it or take it off again, which needs the words under it. A document with nothing to redact is returned byte for byte, not loaded and re-saved on the way to every signer. And unlike the flatten pass, this one throws rather than falling back to the source — a signing surface that errors is recoverable, and handing the counterparty the words the member hid is not.