This is the exact shape the run pipeline (PR7/PR8) writes into
form_runs.template_snapshot at kickoff and later re-reads to fill the PDF —
a versioned contract, stamped snapshotVersion: 2. Treat every field as
frozen: additive changes require bumping snapshotVersion and a reader that
handles both versions.
Access control: loadTemplate performs NO visibility checks — callers must
authorize the form first via formsRepo.getById (visibility) plus the tRPC
middleware (roles/superadmin) before loading a template; startFormFillRun does so in
authorizeFormVisibility. Otherwise an owner-private template is reachable by a guessed (sequential) id.
THE FROZEN v2
template_snapshotPAYLOAD.This is the exact shape the run pipeline (PR7/PR8) writes into
form_runs.template_snapshotat kickoff and later re-reads to fill the PDF — a versioned contract, stampedsnapshotVersion: 2. Treat every field as frozen: additive changes require bumpingsnapshotVersionand a reader that handles both versions.Access control:
loadTemplateperforms NO visibility checks — callers must authorize the form first viaformsRepo.getById(visibility) plus the tRPC middleware (roles/superadmin) before loading a template;startFormFillRundoes so inauthorizeFormVisibility. Otherwise an owner-private template is reachable by a guessed (sequential) id.