A signed URL for the BLANK template a run was started from, so the review screen's left pane shows
the form immediately instead of a spinner for the whole run.
KEYED ON runId, never on formId. A form-keyed endpoint would let any caller who can reach one run
enumerate every template in the instance by id; keying on the run means canAccessFormRun — which
is patient-anchored — decides, exactly as it does for download.
Signs the run's FROZEN template_snapshot.form.fileUrl, never the live forms.file_url. The
answer overlay is positioned from the snapshot's coordinates, so a template re-annotated (or
re-uploaded) since kickoff would put this run's boxes over the wrong page. The snapshot is the
only document those coordinates are true of.
signedUrl: null rather than an error for a run with no usable snapshot — every v1 run, which
never wrote the column — and for a signing failure. The pane then shows exactly the placeholder it
shows today; a blank template is a convenience, and failing the screen over one would be worse
than not having it. A signing failure is logged, never swallowed silently.
A signed URL for the BLANK template a run was started from, so the review screen's left pane shows the form immediately instead of a spinner for the whole run.
KEYED ON runId, never on formId. A form-keyed endpoint would let any caller who can reach one run enumerate every template in the instance by id; keying on the run means
canAccessFormRun— which is patient-anchored — decides, exactly as it does fordownload.Signs the run's FROZEN
template_snapshot.form.fileUrl, never the liveforms.file_url. The answer overlay is positioned from the snapshot's coordinates, so a template re-annotated (or re-uploaded) since kickoff would put this run's boxes over the wrong page. The snapshot is the only document those coordinates are true of.signedUrl: nullrather than an error for a run with no usable snapshot — every v1 run, which never wrote the column — and for a signing failure. The pane then shows exactly the placeholder it shows today; a blank template is a convenience, and failing the screen over one would be worse than not having it. A signing failure is logged, never swallowed silently.