- Shipped
- September 9, 2026 at 8:20 PM UTC
- Author
- Kamo
- Commit
- 63fea09
Three changes, of which only the first is new work. **`signature_date`** is a field ESigService fills at the instant the signer signs — never the browser, whose clock is settable and which is the one value a party has an incentive to misstate on a legal instrument. So there is no control for it: the signer sees the date it WILL carry, locked, formatted from the session's own locale and time zone, which are the same two values the server formats the stamped date with. The preview and the executed document cannot disagree. **`readOnly` was decorative here.** It is in the design shape, it is a switch in kamo-internal's properties panel and ESigService's FieldCompletion honours it — and InteractiveField never looked at it. A field marked read-only rendered as an ordinary input the signer could type into freely, and since required-ness is not enforced on a read-only field, that free-typed value was the one value on the page nothing checked before it was stamped onto the document. **signStore counted read-only fields as required**, so an envelope carrying one could on a box with no control in it, while the SERVER considered the same submission complete and would have accepted it. kamo-internal's port of this file had already diverged to fix exactly that; the two agree again, and both now match FieldCompletion.