{"v":"<h2 id=\"user-content-built-cce1ffb\" dir=\"auto\">Built (cce1ffb)<\/h2>\n<p dir=\"auto\"><strong>Question 1 decided: only the forms a change reaches are generated and signed again.<\/strong> Signatures on forms the change doesn&#39;t touch stay good.<\/p>\n<p dir=\"auto\"><strong>How a correction works<\/strong><\/p>\n<ul dir=\"auto\">\n<li><strong>The answers lock once forms exist.<\/strong> After the forms are generated, the questions are read-only behind <strong>Change an answer<\/strong>. That opens a confirmation: &#34;Changing an answer withdraws the forms it changes, and any signatures on them\u2026 Forms the change does not reach keep their signatures.&#34;<\/li>\n<li><strong>There is a way back from signing.<\/strong> The signing screen has &#34;An answer is wrong? Change it&#34;, for when the client or employee finds an error and won&#39;t sign.<\/li>\n<li><strong>The server enforces the confirmation.<\/strong> While a printing is current, <code>form_v2_visit_save()<\/code> refuses a changed answer with code <code>printed<\/code>, unless the save carries <code>withdraw_candidate<\/code> naming that printing. Moving between sections needs nothing. A stale tab or a retried request gets the same confirmation instead of silently withdrawing signatures.<\/li>\n<li><strong>Generating again keeps unchanged forms.<\/strong> Each form now carries a fingerprint, <code>form_v2_candidate_form_digest()<\/code>: its pinned version and blank form, plus its own answers. On the next generate, a form whose fingerprint matches the last printing (<code>form_v2_candidate_carry()<\/code>) is not printed again. Its review copy is reused, and its signed and &#34;reviewed&#34; taps are copied onto the new printing. If every form matches, the new printing is ready at once. The forms list marks kept forms &#34;unchanged, signatures kept&#34;.<\/li>\n<li><strong>Adopted signatures carry too<\/strong> (<code>form_v2_sign_carry_signers()<\/code>), so nobody draws theirs again. The exceptions:\n<ul dir=\"auto\">\n<li>a signer the correction renamed, such as an attendant whose name changed;<\/li>\n<li>a client whose adoption now contradicts how the interview says the client signs.<\/li>\n<\/ul>\n<\/li>\n<li><strong>A decline does not carry.<\/strong> A refusal is what the correction answers, so the line is asked again.<\/li>\n<li><strong>The audit trail is kept.<\/strong> Every copied tap and adoption has <code>fk_carried_from<\/code> pointing at the original row (<code>migrations\/20261008-02_carried-signatures.sql<\/code>), with the original time and the hash and digest it cited. A copy of a copy still points at the original.<\/li>\n<\/ul>\n<p dir=\"auto\"><strong>Tests:<\/strong> new cases in <code>test-form-v2-visit-rules<\/code>, <code>test-form-v2-sign-rules<\/code>, <code>test-form-v2-sign-state<\/code> (98 pass) and <code>test-form-v2-candidate-state<\/code>. The sign-state test covers: a signed form kept while the changed one is signed again, the decline not carried, nobody adopting again, and a refused change followed by a confirmed one. The lock and the confirmation were also checked in the browser. Keeping a signed form could not be checked in the browser locally, because the dev document store isn&#39;t configured.<\/p>\n<p dir=\"auto\"><strong>To deploy:<\/strong> <code>php scripts\/migrate.php --apply<\/code>.<\/p>\n<p dir=\"auto\"><strong>Question 2 (correcting a visit that is already <em>signed<\/em>) is #119.<\/strong> That is the second stage of correcting a mistake: the office finds it while reviewing the forms after the visit. This issue covered the first stage, the supervisor on site while signatures are being collected.<\/p>\n"}