signature_reconcile_document_state

co.lovie/company-formation · Verify this server

ReconcileDocumentSignatureState re-runs the document-hub write-back for every envelope that is not voided, so the hub carries the signature state of envelopes created before the write-back understood subjects that name a record rather than a document. Platform-wide, never scoped to the caller's company: it reads and rewrites the signature pointer on every tenant's document rows. Invoked on demand, not on a cron. Its purpose is a backfill — the surfaces that read the hub would otherwise report every pre-existing SAFE as unsent — and it stays available afterwards because the same repair is needed whenever a write-back was lost (the document service unreachable at signing time, say). Reports by default; set apply to write. The safe mode is the zero value deliberately — see the field's own comment. Idempotent in effect, not in cost: the write is an upsert of (signature_envelope_id, signed_at) on the hub row, so repeating it converges rather than accumulating, but every call sweeps the whole platform. One case is NOT idempotent, and it is why this runs on demand rather than on a cron. The sweep resolves every envelope before it writes any row, and resolving costs one RPC per envelope over as many as 5000 of them, so the gap between reading an envelope and writing its row can span the whole run. A signature that completes inside that gap is overwritten by the winner the sweep decided on earlier. The write is unconditional anyway because the rows this backfill exists for carry no envelope at all, and a compare-and-set against an expected id cannot match an empty row. Run it when signing is quiet, and re-run it afterwards if it is not.