- Shipped
- August 14, 2026 at 2:03 AM UTC
- Author
- Kamo
- Commit
- 8e31ebb
**************** required dat.convertedDat to be non-null. ConversionService only mints a second ImgDat when it actually converts something -- a document that already IS a PDF gets isConverted=true with convertedDat left NULL, because the original bytes at <datId>.pdf are the converted form. So resolveSource returned null for every native-PDF template, which is every e-sign template in production. It failed three layers deep, and never loudly: - buildSession rendered the signing surface with a null page count, so the member never saw the document they were signing; - submit recorded sourceDocumentSha256 = "unavailable" and skipped flatten entirely under `complete && sourceBytes != null`, leaving the envelope SIGNED with signedBlobId null and NO log line at all; - LegalExecutedPackageFiler then refused to assemble the executed HR package forever ("every document must be available before it can be filed"), and every retry refused identically. The fallback mirrors **************** **************** and ImagingController's inline-PDF endpoint, which have always had it -- ESigService was the last reader without. The mime check is load-bearing: an office doc that failed Docs conversion can carry isConverted=true with no rendition, and serving <datId>.pdf for it would hand PDFBox raw .docx bytes and fail at flatten time, after the member had already signed. Also make the two silent paths in submit loud. An envelope that completes without source bytes, or whose flattened PDF fails to store, reaches SIGNED with signedBlobId null and nothing sweeps it -- so the one line naming the unreadable document is the whole diagnosis. Left fail-soft on purpose: throwing would roll back the signature audit row submit has already written.