From 2354a269f4ca3a0ec6bac08d4c74e313c2e2872d Mon Sep 17 00:00:00 2001
From: James Kurz <jameskurz@Jamess-MacBook-Air.local>
Date: Sun, 11 Oct 2026 21:25:00 -0400
Subject: [PATCH 1/3] Add signing progress and void incomplete signature
 requests

---
 apps/web/.storybook/main.ts                   |   5 +-
 .../internal-ops/contracts/action-result.ts   |   2 +
 .../internal-ops/contracts/actions.ts         |   2 +-
 .../contracts/client-components.test.tsx      | 110 ++++++++-----
 .../features/internal-ops/contracts/copy.ts   |  12 ++
 .../internal-ops/contracts/signing-panel.tsx  |  87 ++---------
 .../features/internal-ops/mnda/dialogs.tsx    |   5 +-
 .../src/features/internal-ops/mnda/labels.ts  |   4 +
 .../src/features/internal-ops/mnda/results.ts |  11 ++
 .../internal-ops/mnda/workspace.test.tsx      | 123 +++++++++++----
 .../features/internal-ops/mnda/workspace.tsx  |   7 +
 .../internal-ops/signing-errors.test.ts       |  36 +++++
 .../internal-ops/signing-progress.module.css  |  49 ++++++
 .../internal-ops/signing-progress.test.tsx    | 126 +++++++++++++++
 .../internal-ops/signing-progress.tsx         |  89 +++++++++++
 .../src/i18n/messages/operations-contracts.ts |  23 ++-
 apps/web/src/i18n/messages/operations-mnda.ts |  31 +++-
 apps/web/src/i18n/messages/operations.ts      |  16 ++
 .../storybook/signing-progress.stories.tsx    |  34 ++++
 docs/operations/add-a-document-type.md        |   8 +-
 docs/operations/commerce-mnda.md              |  34 +++-
 docs/operations/contract-templates.md         |  20 ++-
 packages/contracts/src/contract-register.ts   |   3 +-
 packages/contracts/src/mnda.test.ts           |   3 +-
 packages/contracts/src/mnda.ts                |   7 +-
 .../integrations/src/esign/signwell.test.ts   |  58 +++++++
 packages/integrations/src/esign/signwell.ts   |  39 ++++-
 packages/workflows/src/contracts.test.ts      | 145 +++++++++++++++---
 packages/workflows/src/mnda.test.ts           | 128 ++++++++++++++--
 packages/workflows/src/signing/engine.ts      |  67 ++++++--
 30 files changed, 1055 insertions(+), 229 deletions(-)
 create mode 100644 apps/web/src/features/internal-ops/signing-errors.test.ts
 create mode 100644 apps/web/src/features/internal-ops/signing-progress.module.css
 create mode 100644 apps/web/src/features/internal-ops/signing-progress.test.tsx
 create mode 100644 apps/web/src/features/internal-ops/signing-progress.tsx
 create mode 100644 apps/web/src/storybook/signing-progress.stories.tsx

diff --git a/apps/web/.storybook/main.ts b/apps/web/.storybook/main.ts
index 12b7bdd3..04dc58b3 100644
--- a/apps/web/.storybook/main.ts
+++ b/apps/web/.storybook/main.ts
@@ -1,7 +1,10 @@
 import type { StorybookConfig } from "@storybook/nextjs-vite";
 
 const config: StorybookConfig = {
-  stories: ["../../../packages/ui/src/stories/**/*.stories.@(ts|tsx)"],
+  stories: [
+    "../../../packages/ui/src/stories/**/*.stories.@(ts|tsx)",
+    "../src/storybook/**/*.stories.@(ts|tsx)",
+  ],
   addons: [
     "@storybook/addon-a11y",
     "@storybook/addon-docs",
diff --git a/apps/web/src/features/internal-ops/contracts/action-result.ts b/apps/web/src/features/internal-ops/contracts/action-result.ts
index 228a4e05..0983cc57 100644
--- a/apps/web/src/features/internal-ops/contracts/action-result.ts
+++ b/apps/web/src/features/internal-ops/contracts/action-result.ts
@@ -18,6 +18,8 @@ export function failure(error: unknown): {
   code: string;
   fields?: Record<string, string>;
 } {
+  if (error instanceof Error && error.name === "AbortError")
+    return { ok: false, code: "SIGNWELL_TIMEOUT" };
   if (error instanceof ZodError) {
     const fields: Record<string, string> = {};
     for (const issue of error.issues) {
diff --git a/apps/web/src/features/internal-ops/contracts/actions.ts b/apps/web/src/features/internal-ops/contracts/actions.ts
index 5f28883d..28dbca86 100644
--- a/apps/web/src/features/internal-ops/contracts/actions.ts
+++ b/apps/web/src/features/internal-ops/contracts/actions.ts
@@ -397,7 +397,7 @@ async function assertMayChangeSigning(
 }
 
 /**
- * Voids a sent request the counterparty has not signed, or closes one whose
+ * Voids an incomplete request, including after the counterparty signs, or closes one whose
  * document was deleted in SignWell, with a typed reason or the code for "a
  * different person will sign". Sending needs `contract:write`, and so does
  * voiding; as with MNDAs, someone other than the preparer also needs to be an
diff --git a/apps/web/src/features/internal-ops/contracts/client-components.test.tsx b/apps/web/src/features/internal-ops/contracts/client-components.test.tsx
index b39517a1..f218740e 100644
--- a/apps/web/src/features/internal-ops/contracts/client-components.test.tsx
+++ b/apps/web/src/features/internal-ops/contracts/client-components.test.tsx
@@ -505,47 +505,81 @@ describe("signing panel", () => {
     expect(screen.queryByRole("button", { name: "Discard draft" })).toBeNull();
   });
 
-  it("voids a sent request only with a reason", async () => {
-    mocks.voidContract.mockResolvedValue({
-      ok: true,
-      value: { state: "canceled" },
-    });
-    panel({ state: "sent", providerId: "x" });
-    fireEvent.click(screen.getByRole("button", { name: "Void" }));
-    const dialog = await screen.findByRole("dialog");
-    expect(
-      within(dialog).getByText("Alex Example can no longer sign it."),
-    ).toBeInTheDocument();
-    fireEvent.click(
-      within(dialog).getByRole("button", { name: "Void contract" }),
-    );
-    expect(
-      await within(dialog).findByText(
-        "Enter a reason of at least 3 characters.",
-      ),
-    ).toBeInTheDocument();
-    expect(mocks.voidContract).not.toHaveBeenCalled();
-    fireEvent.change(within(dialog).getByRole("textbox"), {
-      target: { value: "Wrong legal entity" },
-    });
-    fireEvent.click(
-      within(dialog).getByRole("button", { name: "Void contract" }),
-    );
-    await waitFor(() =>
-      expect(mocks.voidContract).toHaveBeenCalledWith({
-        contractId: fixtureSigningRecord.contractId,
-        requestNumber: 1,
-        reason: "Wrong legal entity",
-      }),
-    );
-    expect(mocks.refresh).toHaveBeenCalled();
-  });
+  it.each([
+    {
+      state: "sent" as const,
+      documentType: "contract_template" as const,
+      counterpartySigns: true,
+    },
+    {
+      state: "awaiting_countersignature" as const,
+      documentType: "contract_template" as const,
+      counterpartySigns: true,
+    },
+    {
+      state: "awaiting_countersignature" as const,
+      documentType: "counterparty_paper" as const,
+      counterpartySigns: true,
+    },
+    {
+      state: "sent" as const,
+      documentType: "counterparty_paper" as const,
+      counterpartySigns: false,
+    },
+  ])(
+    "voids $documentType / $state only with confirmation and a reason",
+    async ({ state, documentType, counterpartySigns }) => {
+      mocks.voidContract.mockResolvedValue({
+        ok: true,
+        value: { state: "canceled" },
+      });
+      panel({ state, documentType, counterpartySigns, providerId: "x" });
+      if (state === "awaiting_countersignature" || !counterpartySigns)
+        expect(screen.queryByRole("button", { name: "Fix email" })).toBeNull();
+      fireEvent.click(screen.getByRole("button", { name: "Void" }));
+      const dialog = await screen.findByRole("dialog");
+      if (state === "awaiting_countersignature")
+        expect(
+          within(dialog).getByText(
+            /Their partially signed copy will be deleted/,
+          ),
+        ).toBeVisible();
+      expect(
+        within(dialog).getByText(
+          "No remaining signer can sign this contract after it is voided.",
+        ),
+      ).toBeInTheDocument();
+      fireEvent.click(
+        within(dialog).getByRole("button", { name: "Void contract" }),
+      );
+      expect(
+        await within(dialog).findByText(
+          "Enter a reason of at least 3 characters.",
+        ),
+      ).toBeInTheDocument();
+      expect(mocks.voidContract).not.toHaveBeenCalled();
+      fireEvent.change(within(dialog).getByRole("textbox"), {
+        target: { value: "Wrong legal entity" },
+      });
+      fireEvent.click(
+        within(dialog).getByRole("button", { name: "Void contract" }),
+      );
+      await waitFor(() =>
+        expect(mocks.voidContract).toHaveBeenCalledWith({
+          contractId: fixtureSigningRecord.contractId,
+          requestNumber: 1,
+          reason: "Wrong legal entity",
+        }),
+      );
+      expect(mocks.refresh).toHaveBeenCalled();
+    },
+  );
 
-  it("offers no void once the counterparty has signed, or to a colleague without approval", () => {
-    panel({ state: "awaiting_countersignature", providerId: "x" });
+  it("offers no void once completed, or to a colleague without approval", () => {
+    panel({ state: "completed", providerId: "x" });
     expect(screen.queryByRole("button", { name: "Void" })).toBeNull();
     panel(
-      { state: "sent", providerId: "x" },
+      { state: "awaiting_countersignature", providerId: "x" },
       { canApprove: false, isPreparer: false },
     );
     expect(screen.queryByRole("button", { name: "Void" })).toBeNull();
diff --git a/apps/web/src/features/internal-ops/contracts/copy.ts b/apps/web/src/features/internal-ops/contracts/copy.ts
index 62923c26..bfc120e0 100644
--- a/apps/web/src/features/internal-ops/contracts/copy.ts
+++ b/apps/web/src/features/internal-ops/contracts/copy.ts
@@ -220,6 +220,18 @@ const errorMessages: Readonly<Record<string, MessageId>> = {
 };
 
 export function errorMessage(code: string | null | undefined): MessageId {
+  if (code === "SIGNWELL_TIMEOUT")
+    return "operations.contracts.error.providerTimeout";
+  if (code === "SIGNWELL_HTTP_401" || code === "SIGNWELL_HTTP_403")
+    return "operations.contracts.error.providerAccess";
+  if (code === "SIGNWELL_HTTP_429")
+    return "operations.contracts.error.providerRateLimit";
+  if (
+    code &&
+    /^SIGNWELL_HTTP_4\d{2}$/.test(code) &&
+    code !== "SIGNWELL_HTTP_408"
+  )
+    return "operations.contracts.error.providerRejected";
   if (code?.startsWith("SIGNWELL_"))
     return "operations.contracts.error.provider";
   return (code && errorMessages[code]) || "operations.contracts.error.generic";
diff --git a/apps/web/src/features/internal-ops/contracts/signing-panel.tsx b/apps/web/src/features/internal-ops/contracts/signing-panel.tsx
index b1af21de..b2592d3e 100644
--- a/apps/web/src/features/internal-ops/contracts/signing-panel.tsx
+++ b/apps/web/src/features/internal-ops/contracts/signing-panel.tsx
@@ -19,11 +19,9 @@ import {
   Dialog,
   InlineNotice,
   Input,
-  ProgressSteps,
   StatusBadge,
   Textarea,
   buttonClassName,
-  type ProgressStep,
 } from "@clockwork/ui";
 import type { MessageId } from "@/src/i18n";
 import { useFormattingLocale, useTranslations } from "@/src/i18n/client";
@@ -45,6 +43,7 @@ import {
 import { SessionExpiredReload } from "../session-expiry";
 import { SelfApprovalDialog } from "../self-approval/self-approval-dialog";
 import styles from "./contracts.module.css";
+import { SigningProgress } from "../signing-progress";
 
 type Operation = "send" | "sync" | "remind" | "cancel";
 
@@ -77,71 +76,6 @@ const sentStates = ["sent", "viewed", "awaiting_countersignature"];
 export const prepareAgainHref = (signing: ContractSigningRecord) =>
   `/internal/contracts/templates/${signing.templateId}?from=${signing.contractId}` as Route;
 
-function steps(
-  signing: ContractSigningRecord,
-  label: (id: Parameters<ReturnType<typeof useTranslations>>[0]) => string,
-): ProgressStep[] {
-  const order = [
-    "draft",
-    "preparing",
-    "ready",
-    "sending",
-    "sent",
-    "viewed",
-    "awaiting_countersignature",
-    "completed",
-  ];
-  const reached = order.indexOf(signing.state);
-  const failed = ["declined", "expired", "canceled", "attention"].includes(
-    signing.state,
-  );
-  const state = (done: boolean, current: boolean): ProgressStep["state"] =>
-    done ? "complete" : current ? (failed ? "error" : "current") : "upcoming";
-  const approved =
-    signing.approvalState !== "pending" && signing.approvalState !== "rejected";
-  const list: ProgressStep[] = [
-    {
-      id: "prepared",
-      label: label("operations.contracts.signing.step.prepared"),
-      state: "complete",
-    },
-  ];
-  if (signing.approvalRequired)
-    list.push({
-      id: "approved",
-      label: label("operations.contracts.signing.step.approved"),
-      state:
-        signing.approvalState === "rejected"
-          ? "error"
-          : state(approved, !approved),
-    });
-  list.push(
-    {
-      id: "sent",
-      label: label("operations.contracts.signing.step.sent"),
-      state: state(reached >= 4, approved && reached < 4),
-    },
-    ...(signing.counterpartySigns
-      ? [
-          {
-            id: "counterparty",
-            label: label("operations.contracts.signing.step.counterparty"),
-            state: state(reached >= 6, reached >= 4 && reached < 6),
-          },
-        ]
-      : []),
-    {
-      id: "countersigned",
-      label: label("operations.contracts.signing.step.countersigned"),
-      // Fil One alone signs counterparty paper signed already.
-      state: signing.counterpartySigns
-        ? state(reached === 7, reached === 6)
-        : state(reached === 7, reached >= 4 && reached < 7),
-    },
-  );
-  return list;
-}
-
 export function SigningPanel({
   signing,
   previousSigning = [],
@@ -279,10 +213,14 @@ export function SigningPanel({
           {t(signingStateLabel(signing.state, signing.cancelCode))}
         </StatusBadge>
       </div>
-      <ProgressSteps
-        className={styles.signingSteps ?? ""}
-        label={t("operations.contracts.signing.progress")}
-        steps={steps(signing, t)}
+      <SigningProgress
+        subject={signing.documentName}
+        state={signing.state}
+        prepared={Boolean(generatedFileId)}
+        counterpartySigns={signing.counterpartySigns}
+        {...(signing.approvalRequired
+          ? { approval: signing.approvalState }
+          : {})}
       />
       {signing.testMode ? (
         <InlineNotice
@@ -705,9 +643,7 @@ export function SigningPanel({
         open={voiding}
         onOpenChange={setVoiding}
         title={t("operations.contracts.signing.void.title")}
-        description={t("operations.contracts.signing.void.description", {
-          signer: signing.counterpartySigner.name,
-        })}
+        description={t("operations.contracts.signing.void.description")}
         closeLabel={t("operations.contracts.signing.void.keep")}
         trigger={<span hidden />}
         footer={
@@ -752,6 +688,9 @@ export function SigningPanel({
         <p className={styles.muted}>
           {t("operations.contracts.signing.void.evidence")}
         </p>
+        {signing.state === "awaiting_countersignature" ? (
+          <p>{t("operations.contracts.signing.void.partialWarning")}</p>
+        ) : null}
         {signerChange ? (
           <p className={styles.muted}>
             {t(
diff --git a/apps/web/src/features/internal-ops/mnda/dialogs.tsx b/apps/web/src/features/internal-ops/mnda/dialogs.tsx
index da3725bd..39e8c7a6 100644
--- a/apps/web/src/features/internal-ops/mnda/dialogs.tsx
+++ b/apps/web/src/features/internal-ops/mnda/dialogs.tsx
@@ -13,7 +13,7 @@ import { SessionExpiredReload } from "../session-expiry";
 import styles from "./workspace.module.css";
 
 /**
- * Voids a sent MNDA. SignWell stops the request and deletes its copy; the
+ * Voids an incomplete MNDA. SignWell stops the request and deletes its copy; the
  * original PDF and the history stay here. With `signerChange` no reason is
  * typed: the void is recorded as "a different person will sign".
  */
@@ -93,6 +93,9 @@ export function VoidDialog({
       }
     >
       <p className={styles.muted}>{t("operations.mnda.void.evidence")}</p>
+      {record.state === "awaiting_countersignature" ? (
+        <p>{t("operations.mnda.void.partialWarning")}</p>
+      ) : null}
       {signerChange ? (
         <p className={styles.muted}>
           {t("operations.mnda.void.signerChangeNote")}
diff --git a/apps/web/src/features/internal-ops/mnda/labels.ts b/apps/web/src/features/internal-ops/mnda/labels.ts
index 89aaaa0b..409779ca 100644
--- a/apps/web/src/features/internal-ops/mnda/labels.ts
+++ b/apps/web/src/features/internal-ops/mnda/labels.ts
@@ -49,6 +49,10 @@ export const mndaErrorLabels: Record<MndaErrorCode, MessageId> = {
   reminder_cooldown: "operations.mnda.error.reminderCooldown",
   busy: "operations.mnda.error.busy",
   provider_failed: "operations.mnda.error.providerFailed",
+  provider_timeout: "operations.mnda.error.providerTimeout",
+  provider_access: "operations.mnda.error.providerAccess",
+  provider_rate_limit: "operations.mnda.error.providerRateLimit",
+  provider_rejected: "operations.mnda.error.providerRejected",
   forbidden: "operations.mnda.error.forbidden",
   mfa_required: "operations.mnda.error.mfaRequired",
   not_configured: "operations.mnda.error.notConfigured",
diff --git a/apps/web/src/features/internal-ops/mnda/results.ts b/apps/web/src/features/internal-ops/mnda/results.ts
index f31bd4f1..6f2a7865 100644
--- a/apps/web/src/features/internal-ops/mnda/results.ts
+++ b/apps/web/src/features/internal-ops/mnda/results.ts
@@ -92,6 +92,17 @@ export function mndaFailure(error: unknown): MndaResult<never> {
         ? { fields: [{ field: match.field, code: match.code }] }
         : {}),
     };
+  if (
+    message === "SIGNWELL_TIMEOUT" ||
+    (error instanceof Error && error.name === "AbortError")
+  )
+    return { ok: false, code: "provider_timeout" };
+  if (["SIGNWELL_HTTP_401", "SIGNWELL_HTTP_403"].includes(message))
+    return { ok: false, code: "provider_access" };
+  if (message === "SIGNWELL_HTTP_429")
+    return { ok: false, code: "provider_rate_limit" };
+  if (/^SIGNWELL_HTTP_4\d{2}$/.test(message) && message !== "SIGNWELL_HTTP_408")
+    return { ok: false, code: "provider_rejected" };
   if (
     message.startsWith("SIGNWELL_") ||
     (error instanceof Error && error.name === "AbortError")
diff --git a/apps/web/src/features/internal-ops/mnda/workspace.test.tsx b/apps/web/src/features/internal-ops/mnda/workspace.test.tsx
index 8803dab4..1031c651 100644
--- a/apps/web/src/features/internal-ops/mnda/workspace.test.tsx
+++ b/apps/web/src/features/internal-ops/mnda/workspace.test.tsx
@@ -424,38 +424,52 @@ it("filters by status and owner through the URL", async () => {
   );
 });
 
-it("voids a sent MNDA only after a reason is given", async () => {
-  mocks.void.mockResolvedValue({
-    ok: true,
-    value: { ...sent, state: "canceled", cancelReason: "Wrong entity" },
-  });
-  render(<MndaWorkspace initial={data([sent])} initialQuery={query} />);
-  openMore(screen);
-  fireEvent.click(screen.getByRole("button", { name: "Void" }));
-  const dialog = await screen.findByRole("dialog", {
-    name: "Void this MNDA?",
-  });
-  fireEvent.click(within(dialog).getByRole("button", { name: "Void MNDA" }));
-  expect(
-    await within(dialog).findByText("Enter a reason of at least 3 characters."),
-  ).toBeVisible();
-  expect(mocks.void).not.toHaveBeenCalled();
-  fireEvent.change(within(dialog).getByLabelText(/Reason/), {
-    target: { value: "Wrong entity" },
-  });
-  act(() => {
+it.each(["sent", "awaiting_countersignature"] as const)(
+  "voids a %s MNDA only after confirmation and a reason",
+  async (state) => {
+    mocks.void.mockResolvedValue({
+      ok: true,
+      value: { ...sent, state: "canceled", cancelReason: "Wrong entity" },
+    });
+    render(
+      <MndaWorkspace
+        initial={data([{ ...sent, state }])}
+        initialQuery={query}
+      />,
+    );
+    openMore(screen);
+    fireEvent.click(screen.getByRole("button", { name: "Void" }));
+    const dialog = await screen.findByRole("dialog", {
+      name: "Void this MNDA?",
+    });
+    if (state === "awaiting_countersignature")
+      expect(
+        within(dialog).getByText(/Their partially signed copy will be deleted/),
+      ).toBeVisible();
     fireEvent.click(within(dialog).getByRole("button", { name: "Void MNDA" }));
-  });
-  expect(mocks.void).toHaveBeenCalledWith({
-    id: sent.id,
-    reason: "Wrong entity",
-  });
-  expect(
-    await screen.findByText(
-      "MNDA voided. The counterparty can no longer sign it.",
-    ),
-  ).toBeVisible();
-});
+    expect(
+      await within(dialog).findByText(
+        "Enter a reason of at least 3 characters.",
+      ),
+    ).toBeVisible();
+    expect(mocks.void).not.toHaveBeenCalled();
+    fireEvent.change(within(dialog).getByLabelText(/Reason/), {
+      target: { value: "Wrong entity" },
+    });
+    act(() => {
+      fireEvent.click(
+        within(dialog).getByRole("button", { name: "Void MNDA" }),
+      );
+    });
+    expect(mocks.void).toHaveBeenCalledWith({
+      id: sent.id,
+      reason: "Wrong entity",
+    });
+    expect(
+      await screen.findByText("MNDA voided. No remaining signer can sign it."),
+    ).toBeVisible();
+  },
+);
 
 it("says a draft SignWell is still preparing was not sent", async () => {
   mocks.operate.mockResolvedValueOnce({ ok: false, code: "still_preparing" });
@@ -561,7 +575,7 @@ it("turns off every control the demo would refuse and says why", () => {
       expect(button).toHaveAttribute("aria-disabled", "true");
 });
 
-it("offers void and email fixes only to the preparer, and never after the partner signed", () => {
+it("offers partial-signature void only to the preparer, while email correction stays unavailable", () => {
   const colleague = {
     ...sent,
     id: "019a44ac-0000-7000-8000-0000000000aa",
@@ -596,7 +610,41 @@ it("offers void and email fixes only to the preparer, and never after the partne
   expect(
     row("Colleague Co").getByRole("button", { name: /^Remind/ }),
   ).toBeVisible();
-  expect(row("Signed Co").queryByRole("button", { name: "Void" })).toBeNull();
+  expect(row("Signed Co").getByRole("button", { name: "Void" })).toBeVisible();
+  expect(
+    row("Signed Co").queryByRole("button", { name: "Fix email" }),
+  ).toBeNull();
+});
+
+it("keeps completed MNDAs immutable while managers can void another person's incomplete request", () => {
+  const completed = {
+    ...sent,
+    state: "completed" as const,
+    input: { ...sent.input, company: "Completed Co" },
+  };
+  const other = {
+    ...sent,
+    id: "019a44ac-0000-7000-8000-0000000000cc",
+    ownerId: "019a44ac-0000-7000-8000-0000000000bb",
+    state: "awaiting_countersignature" as const,
+    input: { ...sent.input, company: "Colleague Co" },
+  };
+  render(
+    <MndaWorkspace
+      initial={{ ...data([completed, other]), canManage: true }}
+      initialQuery={query}
+    />,
+  );
+  const row = (company: string) =>
+    within(screen.getByText(company).closest("tr") as HTMLElement);
+  openMore(row("Completed Co"));
+  openMore(row("Colleague Co"));
+  expect(
+    row("Completed Co").queryByRole("button", { name: "Void" }),
+  ).toBeNull();
+  expect(
+    row("Colleague Co").getByRole("button", { name: "Void" }),
+  ).toBeVisible();
 });
 
 it("refreshes an expired session through a navigation and retries the poll once", async () => {
@@ -769,7 +817,14 @@ it("leads each row with one action for its state and folds the rest under More",
   // Void comes last, after the other actions.
   const row = within(screen.getByText("Sent Co").closest("tr") as HTMLElement);
   openMore(row);
-  const more = row.getAllByRole("listitem").map((item) => item.textContent);
+  const panelId = row
+    .getByRole("button", { name: /^More actions for/ })
+    .getAttribute("aria-controls");
+  const panel = panelId ? document.getElementById(panelId) : null;
+  if (!panel) throw new Error("Missing row action menu");
+  const more = within(panel)
+    .getAllByRole("listitem")
+    .map((item) => item.textContent);
   expect(more).toEqual([
     "Open PDF",
     "Fix email",
diff --git a/apps/web/src/features/internal-ops/mnda/workspace.tsx b/apps/web/src/features/internal-ops/mnda/workspace.tsx
index a581da76..133a31b8 100644
--- a/apps/web/src/features/internal-ops/mnda/workspace.tsx
+++ b/apps/web/src/features/internal-ops/mnda/workspace.tsx
@@ -37,6 +37,7 @@ import {
 } from "./actions";
 import { MndaComposer, type ComposerStart } from "./composer";
 import { CorrectSignerDialog, DiscardDialog, VoidDialog } from "./dialogs";
+import { SigningProgress } from "../signing-progress";
 import { emptyValues, valuesFromRecord } from "./form-model";
 import { formatMndaDate } from "./format";
 import {
@@ -836,6 +837,12 @@ export function MndaWorkspace({
                           <StatusBadge tone={tones[r.state] ?? "neutral"}>
                             {t(mndaRecordStateLabel(r))}
                           </StatusBadge>
+                          <SigningProgress
+                            subject={r.input.company}
+                            state={r.state}
+                            prepared
+                            sent={Boolean(r.sentAt)}
+                          />
                           {r.testMode ? (
                             <span className={styles.testMark}>
                               {t("operations.mnda.testBadge")}
diff --git a/apps/web/src/features/internal-ops/signing-errors.test.ts b/apps/web/src/features/internal-ops/signing-errors.test.ts
new file mode 100644
index 00000000..dfeca861
--- /dev/null
+++ b/apps/web/src/features/internal-ops/signing-errors.test.ts
@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { mndaFailure } from "./mnda/results";
+import { failure } from "./contracts/action-result";
+import { errorMessage } from "./contracts/copy";
+
+describe("signing failure guidance", () => {
+  it.each([
+    ["SIGNWELL_HTTP_401", "provider_access", "providerAccess"],
+    ["SIGNWELL_HTTP_403", "provider_access", "providerAccess"],
+    ["SIGNWELL_HTTP_429", "provider_rate_limit", "providerRateLimit"],
+    ["SIGNWELL_HTTP_422", "provider_rejected", "providerRejected"],
+    ["SIGNWELL_TIMEOUT", "provider_timeout", "providerTimeout"],
+    ["SIGNWELL_HTTP_408", "provider_failed", "provider"],
+    ["SIGNWELL_HTTP_500", "provider_failed", "provider"],
+    ["SIGNWELL_INVALID_RESPONSE", "provider_failed", "provider"],
+    ["SIGNWELL_NETWORK_ERROR", "provider_failed", "provider"],
+  ])(
+    "distinguishes %s without exposing provider details",
+    (message, mndaCode, contractKey) => {
+      expect(mndaFailure(new Error(message))).toEqual({
+        ok: false,
+        code: mndaCode,
+      });
+      expect(errorMessage(failure(new Error(message)).code)).toBe(
+        `operations.contracts.error.${contractKey}`,
+      );
+    },
+  );
+  it("handles aborts consistently for both document types", () => {
+    const error = Object.assign(new Error("private abort details"), {
+      name: "AbortError",
+    });
+    expect(mndaFailure(error)).toEqual({ ok: false, code: "provider_timeout" });
+    expect(failure(error)).toEqual({ ok: false, code: "SIGNWELL_TIMEOUT" });
+  });
+});
diff --git a/apps/web/src/features/internal-ops/signing-progress.module.css b/apps/web/src/features/internal-ops/signing-progress.module.css
new file mode 100644
index 00000000..57252ed9
--- /dev/null
+++ b/apps/web/src/features/internal-ops/signing-progress.module.css
@@ -0,0 +1,49 @@
+.progress {
+  margin-top: var(--cw-space-2, 0.5rem);
+  font-size: var(--cw-text-sm, 0.875rem);
+  line-height: 1.5;
+}
+.progress[open] {
+  min-width: 15rem;
+  max-width: 24rem;
+}
+.progress summary {
+  cursor: pointer;
+  color: var(--cw-action);
+  width: fit-content;
+}
+.progress summary:focus-visible {
+  outline: 2px solid var(--cw-focus);
+  outline-offset: 2px;
+}
+.progress ol {
+  list-style: none;
+  padding: 0;
+  margin: var(--cw-space-2, 0.5rem) 0;
+  display: grid;
+  gap: var(--cw-space-1, 0.25rem);
+}
+.progress li {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  gap: var(--cw-space-4, 1rem);
+}
+.progress strong {
+  font-size: var(--cw-text-xs, 0.75rem);
+  font-weight: 500;
+  color: var(--cw-muted);
+  white-space: nowrap;
+  flex-shrink: 0;
+}
+.progress [data-status="current"] {
+  color: var(--cw-ink);
+  font-weight: 700;
+}
+.progress [data-status="done"] {
+  color: var(--cw-ink);
+}
+
+.progress [data-status="rejected"] {
+  color: var(--cw-danger-strong);
+}
diff --git a/apps/web/src/features/internal-ops/signing-progress.test.tsx b/apps/web/src/features/internal-ops/signing-progress.test.tsx
new file mode 100644
index 00000000..9b3f3cce
--- /dev/null
+++ b/apps/web/src/features/internal-ops/signing-progress.test.tsx
@@ -0,0 +1,126 @@
+import { render, screen, within } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+import { SigningProgress, signingProgress } from "./signing-progress";
+
+describe("confirmed signing progress", () => {
+  it("distinguishes preparation, sending and the current counterparty signature", () => {
+    expect(signingProgress({ state: "draft", prepared: true })).toEqual([
+      { id: "prepared", status: "done" },
+      { id: "sent", status: "current" },
+      { id: "counterparty", status: "pending" },
+      { id: "countersigned", status: "pending" },
+      { id: "saved", status: "pending" },
+    ]);
+    expect(signingProgress({ state: "viewed", prepared: true })).toContainEqual(
+      { id: "counterparty", status: "current" },
+    );
+  });
+
+  it("keeps Fil One signature and final PDF pending after the partner signs", () => {
+    expect(
+      signingProgress({ state: "awaiting_countersignature", prepared: true }),
+    ).toEqual([
+      { id: "prepared", status: "done" },
+      { id: "sent", status: "done" },
+      { id: "counterparty", status: "done" },
+      { id: "countersigned", status: "current" },
+      { id: "saved", status: "pending" },
+    ]);
+  });
+
+  it("does not invent historical signatures or current work for a held or closed request", () => {
+    for (const state of [
+      "attention",
+      "canceled",
+      "declined",
+      "expired",
+    ] as const) {
+      const progress = signingProgress({ state, prepared: true, sent: true });
+      expect(progress.find((step) => step.id === "sent")?.status).toBe("done");
+      expect(
+        progress
+          .filter((step) =>
+            ["counterparty", "countersigned", "saved"].includes(step.id),
+          )
+          .every((step) => step.status === "unconfirmed"),
+      ).toBe(true);
+      expect(progress.some((step) => step.status === "current")).toBe(false);
+    }
+    expect(
+      signingProgress({ state: "attention", prepared: true }).find(
+        (step) => step.id === "sent",
+      )?.status,
+    ).toBe("unconfirmed");
+  });
+
+  it("adapts approval and signatures to uploaded PDFs with only a Fil One signer", () => {
+    const pending = signingProgress({
+      state: "draft",
+      prepared: true,
+      counterpartySigns: false,
+      approval: "pending",
+    });
+    expect(pending.find((step) => step.id === "approved")?.status).toBe(
+      "current",
+    );
+    expect(pending.some((step) => step.id === "counterparty")).toBe(false);
+    const sent = signingProgress({
+      state: "sent",
+      prepared: true,
+      counterpartySigns: false,
+      approval: "approved",
+    });
+    expect(sent.find((step) => step.id === "countersigned")?.status).toBe(
+      "current",
+    );
+    expect(
+      signingProgress({
+        state: "completed",
+        prepared: true,
+        counterpartySigns: false,
+      }).every((step) => step.status === "done"),
+    ).toBe(true);
+  });
+
+  it("marks a rejected approval explicitly and pauses subsequent progress", () => {
+    const steps = signingProgress({
+      state: "draft",
+      prepared: true,
+      approval: "rejected",
+    });
+    expect(steps.find((step) => step.id === "approved")?.status).toBe(
+      "rejected",
+    );
+    expect(steps.find((step) => step.id === "sent")?.status).toBe(
+      "unconfirmed",
+    );
+    expect(steps.some((step) => step.status === "current")).toBe(false);
+  });
+
+  it("starts collapsed, names the document and exposes readable statuses without relying on color", () => {
+    render(
+      <SigningProgress
+        subject="Example Co"
+        state="awaiting_countersignature"
+        prepared
+      />,
+    );
+    const disclosure = screen.getByText("View progress");
+    expect(disclosure).toHaveAccessibleName(
+      "View signing progress for Example Co",
+    );
+    const details = disclosure.closest("details");
+    expect(details).not.toHaveAttribute("open");
+    details?.setAttribute("open", "");
+    const list = screen.getByRole("list", {
+      name: "Last confirmed signing progress",
+    });
+    const current = within(list).getByText("Fil One signed").closest("li");
+    expect(current).toHaveAttribute("aria-current", "step");
+    if (!current) throw new Error("Missing current progress step");
+    expect(within(current).getByText("Current step")).toBeVisible();
+    expect(
+      within(list).getByText("Final PDF saved").closest("li"),
+    ).toHaveTextContent("Pending");
+  });
+});
diff --git a/apps/web/src/features/internal-ops/signing-progress.tsx b/apps/web/src/features/internal-ops/signing-progress.tsx
new file mode 100644
index 00000000..066ce894
--- /dev/null
+++ b/apps/web/src/features/internal-ops/signing-progress.tsx
@@ -0,0 +1,89 @@
+"use client";
+
+import type { ContractApprovalState, MndaState } from "@clockwork/contracts";
+import { useTranslations } from "@/src/i18n/client";
+import styles from "./signing-progress.module.css";
+
+type StepId =
+  "prepared" | "approved" | "sent" | "counterparty" | "countersigned" | "saved";
+type StepStatus = "done" | "current" | "pending" | "unconfirmed" | "rejected";
+interface Evidence {
+  state: MndaState;
+  prepared: boolean;
+  sent?: boolean;
+  counterpartySigns?: boolean;
+  approval?: ContractApprovalState;
+}
+
+/** Uses stored evidence only. A held/closed state cannot prove earlier signatures. */
+export function signingProgress(
+  evidence: Evidence,
+): { id: StepId; status: StepStatus }[] {
+  const completed = evidence.state === "completed";
+  const awaiting = evidence.state === "awaiting_countersignature";
+  const sent =
+    evidence.sent ||
+    ["sent", "viewed", "awaiting_countersignature", "completed"].includes(
+      evidence.state,
+    );
+  const uncertain =
+    evidence.approval === "rejected" ||
+    ["attention", "declined", "expired", "canceled"].includes(evidence.state);
+  const checkpoints: { id: StepId; done: boolean }[] = [
+    { id: "prepared", done: evidence.prepared || completed },
+    ...(evidence.approval
+      ? [
+          {
+            id: "approved" as const,
+            done:
+              evidence.approval === "approved" ||
+              evidence.approval === "not_required",
+          },
+        ]
+      : []),
+    { id: "sent", done: Boolean(sent) },
+    ...(evidence.counterpartySigns === false
+      ? []
+      : [{ id: "counterparty" as const, done: awaiting || completed }]),
+    { id: "countersigned", done: completed },
+    // The workflow persists completion and the executed PDF together.
+    { id: "saved", done: completed },
+  ];
+  let currentAssigned = false;
+  return checkpoints.map(({ id, done }) => {
+    if (done) return { id, status: "done" };
+    if (id === "approved" && evidence.approval === "rejected")
+      return { id, status: "rejected" };
+    if (uncertain) return { id, status: "unconfirmed" };
+    if (!currentAssigned) {
+      currentAssigned = true;
+      return { id, status: "current" };
+    }
+    return { id, status: "pending" };
+  });
+}
+
+export function SigningProgress({
+  subject,
+  ...evidence
+}: Evidence & { subject: string }) {
+  const t = useTranslations();
+  return (
+    <details className={styles.progress}>
+      <summary aria-label={t("operations.signingProgress.for", { subject })}>
+        {t("operations.signingProgress.view")}
+      </summary>
+      <ol aria-label={t("operations.signingProgress.title")}>
+        {signingProgress(evidence).map(({ id, status }) => (
+          <li key={id} aria-current={status === "current" ? "step" : undefined}>
+            <span>{t(`operations.signingProgress.step.${id}`)}</span>
+            <strong data-status={status}>
+              {status === "done" ? <span aria-hidden="true">✓ </span> : null}
+              {t(`operations.signingProgress.status.${status}`)}
+            </strong>
+          </li>
+        ))}
+      </ol>
+    </details>
+  );
+}
diff --git a/apps/web/src/i18n/messages/operations-contracts.ts b/apps/web/src/i18n/messages/operations-contracts.ts
index baf8a0c6..fcabb126 100644
--- a/apps/web/src/i18n/messages/operations-contracts.ts
+++ b/apps/web/src/i18n/messages/operations-contracts.ts
@@ -839,10 +839,13 @@ export const contractMessages = defineStaffMessages({
   "operations.contracts.signing.void.action": { en: "Void" },
   "operations.contracts.signing.void.title": { en: "Void this contract?" },
   "operations.contracts.signing.void.description": {
-    en: "{signer} can no longer sign it.",
+    en: "No remaining signer can sign this contract after it is voided.",
   },
   "operations.contracts.signing.void.evidence": {
-    en: "SignWell stops the request and deletes its copy. The register keeps the prepared PDF and the history. Once the counterparty has signed, the contract can no longer be voided.",
+    en: "SignWell stops the request and deletes its copy, including any partial signatures. The register keeps the prepared PDF and the history. A completed contract cannot be voided.",
+  },
+  "operations.contracts.signing.void.partialWarning": {
+    en: "The counterparty has already signed. Their partially signed copy will be deleted from SignWell, and the countersigner can no longer sign.",
   },
   "operations.contracts.signing.void.reason": { en: "Reason" },
   "operations.contracts.signing.void.reasonHelp": {
@@ -938,7 +941,7 @@ export const contractMessages = defineStaffMessages({
     en: "Both sides have signed this contract, so it can no longer be voided.",
   },
   "operations.contracts.error.notVoidable": {
-    en: "The counterparty has already signed, so this contract can no longer be voided.",
+    en: "This contract is no longer available to void. Refresh its status; completed contracts cannot be voided.",
   },
   "operations.contracts.error.notPreparer": {
     en: "Only the person who prepared this contract, or an approver, can void it.",
@@ -973,8 +976,20 @@ export const contractMessages = defineStaffMessages({
   "operations.contracts.error.uploadInterrupted": {
     en: "The upload was interrupted. Check your connection and try again.",
   },
+  "operations.contracts.error.providerTimeout": {
+    en: "SignWell took too long to respond. Check status before retrying; the last action may have succeeded.",
+  },
+  "operations.contracts.error.providerAccess": {
+    en: "SignWell refused access. Ask a Commerce administrator to check the signing connection before retrying.",
+  },
+  "operations.contracts.error.providerRateLimit": {
+    en: "SignWell is limiting requests. Wait a minute, then check status before retrying.",
+  },
+  "operations.contracts.error.providerRejected": {
+    en: "SignWell rejected this request. Ask a Commerce administrator to check the signing connection and document details before retrying.",
+  },
   "operations.contracts.error.provider": {
-    en: "SignWell did not respond as expected. Nothing was sent twice. Try again in a few minutes.",
+    en: "Commerce could not confirm the result with SignWell. Check status before retrying. If this continues, contact a Commerce administrator.",
   },
   "operations.contracts.error.generic": {
     en: "Something went wrong. Try again, and if it keeps happening, tell a Commerce administrator.",
diff --git a/apps/web/src/i18n/messages/operations-mnda.ts b/apps/web/src/i18n/messages/operations-mnda.ts
index a7c94314..1cf0457d 100644
--- a/apps/web/src/i18n/messages/operations-mnda.ts
+++ b/apps/web/src/i18n/messages/operations-mnda.ts
@@ -190,7 +190,7 @@ export const mndaMessages = defineStaffMessages({
     en: "SignWell is sending the request to {email}.",
   },
   "operations.mnda.voidedMessage": {
-    en: "MNDA voided. The counterparty can no longer sign it.",
+    en: "MNDA voided. No remaining signer can sign it.",
   },
 
   "operations.mnda.note.bounced": {
@@ -201,9 +201,11 @@ export const mndaMessages = defineStaffMessages({
   },
   "operations.mnda.note.stopped": { en: "SignWell stopped this request." },
   "operations.mnda.note.stoppedNext": { en: "Void it, then send it again." },
-  "operations.mnda.note.sendUnfinished": { en: "Sending did not finish." },
+  "operations.mnda.note.sendUnfinished": {
+    en: "Sending has not been confirmed.",
+  },
   "operations.mnda.note.sendUnfinishedNext": {
-    en: "Choose Continue and send again. The counterparty never gets two copies.",
+    en: "Choose Continue to review and retry this request. Commerce checks its existing SignWell copy before sending.",
   },
   "operations.mnda.note.unreachable": {
     en: "SignWell did not answer the last check.",
@@ -255,12 +257,15 @@ export const mndaMessages = defineStaffMessages({
   "operations.mnda.void.action": { en: "Void" },
   "operations.mnda.void.title": { en: "Void this MNDA?" },
   "operations.mnda.void.description": {
-    en: "The signer at {company} can no longer sign it.",
+    en: "This stops all remaining signatures on the MNDA for {company}.",
   },
   "operations.mnda.void.evidence": {
-    en: "SignWell stops the request and deletes its copy. This register keeps the original PDF and the history. Once the counterparty has signed, the MNDA can no longer be voided.",
+    en: "SignWell stops the request and deletes its copy, including any partial signatures. This register keeps the original PDF and the history. A completed MNDA cannot be voided.",
   },
 
+  "operations.mnda.void.partialWarning": {
+    en: "The counterparty has already signed. Their partially signed copy will be deleted from SignWell, and the countersigner can no longer sign.",
+  },
   "operations.mnda.void.reason": { en: "Reason" },
   "operations.mnda.void.reasonHelp": {
     en: "For example: wrong legal entity. Saved with the record.",
@@ -316,8 +321,20 @@ export const mndaMessages = defineStaffMessages({
   "operations.mnda.error.busy": {
     en: "Someone else is updating this MNDA. Try again in a moment.",
   },
+  "operations.mnda.error.providerTimeout": {
+    en: "SignWell took too long to respond. Check status before retrying; the last action may have succeeded.",
+  },
+  "operations.mnda.error.providerAccess": {
+    en: "SignWell refused access. Ask a Commerce administrator to check the signing connection before retrying.",
+  },
+  "operations.mnda.error.providerRateLimit": {
+    en: "SignWell is limiting requests. Wait a minute, then check status before retrying.",
+  },
+  "operations.mnda.error.providerRejected": {
+    en: "SignWell rejected this request. Ask a Commerce administrator to check the signing connection and document details before retrying.",
+  },
   "operations.mnda.error.providerFailed": {
-    en: "SignWell did not respond. Try again in a minute. Nothing was sent twice.",
+    en: "Commerce could not confirm the result with SignWell. Check status before retrying. If this continues, contact a Commerce administrator.",
   },
   "operations.mnda.error.forbidden": {
     en: "Your account can't do this. Ask a commerce administrator for access.",
@@ -435,7 +452,7 @@ export const mndaMessages = defineStaffMessages({
     en: "Only the person who prepared this MNDA or a commerce administrator can do this.",
   },
   "operations.mnda.error.notVoidable": {
-    en: "The counterparty has already signed, so this MNDA can't be voided. If it must not take effect, tell the Fil One countersigner not to sign it.",
+    en: "This MNDA is no longer available to void. Refresh its status; completed MNDAs cannot be voided.",
   },
 
   "operations.mnda.error.settingsChanged": {
diff --git a/apps/web/src/i18n/messages/operations.ts b/apps/web/src/i18n/messages/operations.ts
index 33d5e2e3..b7abf5ba 100644
--- a/apps/web/src/i18n/messages/operations.ts
+++ b/apps/web/src/i18n/messages/operations.ts
@@ -4,6 +4,22 @@ import { defineStaffMessages, sameInAllLanguages } from "../define";
  * Internal operations: queues, search, finance lifecycle, reconciliation, revenue, recovery, status. Owned by the operations lane.
  */
 export const operationsMessages = defineStaffMessages({
+  "operations.signingProgress.view": { en: "View progress" },
+  "operations.signingProgress.for": {
+    en: "View signing progress for {subject}",
+  },
+  "operations.signingProgress.title": { en: "Last confirmed signing progress" },
+  "operations.signingProgress.step.prepared": { en: "Prepared" },
+  "operations.signingProgress.step.approved": { en: "Approved" },
+  "operations.signingProgress.step.sent": { en: "Sent for signature" },
+  "operations.signingProgress.step.counterparty": { en: "Counterparty signed" },
+  "operations.signingProgress.step.countersigned": { en: "Fil One signed" },
+  "operations.signingProgress.step.saved": { en: "Final PDF saved" },
+  "operations.signingProgress.status.done": { en: "Done" },
+  "operations.signingProgress.status.current": { en: "Current step" },
+  "operations.signingProgress.status.pending": { en: "Pending" },
+  "operations.signingProgress.status.unconfirmed": { en: "Not confirmed" },
+  "operations.signingProgress.status.rejected": { en: "Rejected" },
   "operations.cases": {
     count: "count",
     en: { one: "{count} case", other: "{count} cases" },
diff --git a/apps/web/src/storybook/signing-progress.stories.tsx b/apps/web/src/storybook/signing-progress.stories.tsx
new file mode 100644
index 00000000..b62cd135
--- /dev/null
+++ b/apps/web/src/storybook/signing-progress.stories.tsx
@@ -0,0 +1,34 @@
+// i18n-exempt-file: Fictional Storybook fixture labels, never shipped in an application route
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { LanguageProvider } from "../i18n/client";
+import { catalogs } from "../i18n/catalogs";
+import { SigningProgress } from "../features/internal-ops/signing-progress";
+
+const meta: Meta<typeof SigningProgress> = {
+  title: "Operations/Signing progress",
+  component: SigningProgress,
+  decorators: [
+    (Story) => (
+      <LanguageProvider locale="en" catalog={catalogs.en}>
+        <div style={{ maxWidth: 360 }}>
+          <Story />
+        </div>
+      </LanguageProvider>
+    ),
+  ],
+  args: { subject: "Example agreement", prepared: true },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Preparing: Story = { args: { state: "preparing" } };
+export const AwaitingCountersignature: Story = {
+  args: { state: "awaiting_countersignature" },
+};
+export const SingleSigner: Story = {
+  args: { state: "sent", counterpartySigns: false },
+};
+export const Rejected: Story = {
+  args: { state: "draft", approval: "rejected" },
+};
+export const Completed: Story = { args: { state: "completed" } };
diff --git a/docs/operations/add-a-document-type.md b/docs/operations/add-a-document-type.md
index 0e82a996..59df2194 100644
--- a/docs/operations/add-a-document-type.md
+++ b/docs/operations/add-a-document-type.md
@@ -29,8 +29,12 @@ store or SignWell client cannot correct.
 A declared signer can sit out a given request: the store's view lists only those
 who sign it. Counterparty paper the counterparty already signed lists Fil One
 alone: the engine then expects SignWell's copy to name that one recipient, with
-its fields, and reminds them. Voiding does not depend on the list; it reads
-SignWell's document and refuses once anyone has signed it.
+its fields, and reminds them. Voiding reads and validates the current SignWell
+copy. It refuses completed copies or those where every required recipient has
+signed, including the one-recipient case. A bound, incomplete copy with a
+partial signature can be voided only with a typed reason; signed mismatches are
+always refused. The provider read and delete are not atomic; see the
+[void limitation](commerce-mnda.md).
 
 ## 2. Store
 
diff --git a/docs/operations/commerce-mnda.md b/docs/operations/commerce-mnda.md
index 1bb41db7..87a17f4d 100644
--- a/docs/operations/commerce-mnda.md
+++ b/docs/operations/commerce-mnda.md
@@ -178,14 +178,25 @@ email**). Manual reminders are a minute apart.
 - **Someone else will sign** voids the MNDA (recorded as a signer change, shown
   in each reader's language) and opens a new draft with the same company details
   and a blank signer.
-- **Void** is available for drafts, sent and opened MNDAs and those needing
-  attention, never once the partner has signed. It asks for a reason, re-reads
-  the request in SignWell, and deletes it there (`DELETE /documents/{id}`),
-  which stops signing. If the partner signed in the meantime the void is
-  refused; if both sides signed, the signed copy is kept. When the delete's
-  answer is lost, Commerce reads the document back: gone means the void is
-  recorded with its reason. Commerce keeps the original PDF, the record and the
-  reason, audited as `mnda.voided`.
+- **Void** is available for drafts, sent and opened MNDAs, those awaiting the
+  Fil One countersignature, and those needing attention. It requires a reason
+  and confirmation; a partially signed request warns that SignWell's copy,
+  including the existing signature, will be deleted. Commerce re-reads and
+  checks the document binding before deleting it (`DELETE /documents/{id}`).
+  Completed requests, requests with every required signature already present,
+  and signed copies that do not match the request are refused. A partially
+  signed request requires a typed reason, not the signer-change shortcut.
+  Commerce keeps the original PDF, the record and reason, audited as
+  `mnda.voided`. When the delete's answer is lost, Commerce reads back: gone
+  means the void is recorded; a remaining document is reconciled. SignWell does
+  not expose a conditional delete, so the fresh read and delete are not atomic:
+  a signature could arrive between them. This pre-existing provider limitation
+  also applies to contract signing requests; no claim of atomic completion
+  protection is made.
+- **View progress** expands the status cell into the last confirmed steps:
+  prepared, sent, counterparty signed, Fil One signed, and final PDF saved. Held
+  or closed requests show missing evidence as **Not confirmed**, without
+  inventing signature timestamps or implying that signing can continue.
 - **New MNDA from this one** starts a new draft prefilled from the row, dated
   today.
 - A document deleted directly in SignWell (404 on two reads) moves to **Needs
@@ -282,6 +293,13 @@ through it.
 
 ## Recovery and verification
 
+- Send failures record a bounded diagnostic category, HTTP status when present,
+  and phase (`prepare_pdf`, `create_draft`, `read_draft`, `send`, or
+  `read_after_send`) in operator logs. Provider response bodies, recipient data
+  and credentials are excluded. Older `provider_unavailable` records do not
+  retain the original HTTP cause; do not infer a timeout or duplicate-contact
+  refusal from that generic error.
+
 - Retry a pending/error request from its preview (**Continue**). It keeps the
   same provider binding. Never recreate a live request merely because its first
   send response timed out.
diff --git a/docs/operations/contract-templates.md b/docs/operations/contract-templates.md
index ee74c766..27505785 100644
--- a/docs/operations/contract-templates.md
+++ b/docs/operations/contract-templates.md
@@ -313,10 +313,20 @@ one of the demo's sample templates.
    prepared the request.
 
 A request that never reached SignWell can be discarded. Once it has, it is
-voided in Commerce, with a reason, until the counterparty signs: Commerce reads
-SignWell first, deletes the SignWell copy, and marks the request canceled. The
+voided in Commerce, with a reason, while the request is incomplete, including
+while awaiting the Fil One countersignature. The confirmation warns that any
+partial signatures on SignWell's copy will be deleted. Commerce reads and
+validates SignWell first, deletes that copy, and marks the request canceled. The
 register row returns to draft and keeps the prepared PDF and the history. The
 preparer can void their own request; anyone else needs contract approval rights.
+Completed copies and requests with every required signature already present are
+refused, including requests where only Fil One signs. SignWell's read and delete
+are not atomic; a remote signature can arrive between them.
+
+**View progress** expands the last confirmed preparation, approval (when
+required), send, signature and final-PDF steps. Requests where only Fil One
+signs omit the counterparty signature step. Missing historical evidence on held
+or closed requests is shown as **Not confirmed**.
 
 If someone deletes the document in SignWell directly, the next refresh or
 callback marks the request **SignWell no longer has this document** instead of
@@ -324,8 +334,10 @@ failing, and callbacks keep succeeding. Void it in Commerce to close it. The
 same holds when SignWell's copy names other signers or does not belong to the
 contract: nothing from that copy is applied, the request waits in attention
 (`signwell_signers_mismatch` or `signwell_binding_mismatch`), and it can be
-voided. A request is never voided once SignWell shows the counterparty's
-signature, even when a bounced countersigner email has put it in attention.
+voided while unsigned. Any signed copy whose binding or signers differ is
+refused. A correctly bound partial signature can be voided with a typed reason
+even when a bounced countersigner email has put the request in attention; the
+signer-change shortcut is unavailable after a signature.
 
 When the counterparty's email bounced or was mistyped, **Fix email** on the
 signing panel sends the request to the corrected address, until the counterparty
diff --git a/packages/contracts/src/contract-register.ts b/packages/contracts/src/contract-register.ts
index cc16b10b..992459f3 100644
--- a/packages/contracts/src/contract-register.ts
+++ b/packages/contracts/src/contract-register.ts
@@ -208,13 +208,14 @@ export const terminalContractSigningStates: readonly ContractSigningState[] = [
   "expired",
   "canceled",
 ];
-/** A request can be voided until the counterparty has signed. */
+/** An incomplete request can be voided, including after the counterparty signs. */
 export const contractVoidableStates: readonly ContractSigningState[] = [
   "draft",
   "preparing",
   "ready",
   "sent",
   "viewed",
+  "awaiting_countersignature",
   "attention",
 ];
 /** Why a request in `attention` needs a person, beyond SignWell's status. */
diff --git a/packages/contracts/src/mnda.test.ts b/packages/contracts/src/mnda.test.ts
index c0013593..ff3fc609 100644
--- a/packages/contracts/src/mnda.test.ts
+++ b/packages/contracts/src/mnda.test.ts
@@ -166,7 +166,8 @@ it("voids with a typed reason or the signer-change code, never with neither", ()
   expect(MndaVoidSchema.safeParse({ id, code: "superseded" }).success).toBe(
     false,
   );
-  expect(mndaVoidableStates).not.toContain("awaiting_countersignature");
+  expect(mndaVoidableStates).toContain("awaiting_countersignature");
+  expect(mndaVoidableStates).not.toContain("completed");
 });
 
 it("refuses new partner-completes drafts while existing ones still parse", () => {
diff --git a/packages/contracts/src/mnda.ts b/packages/contracts/src/mnda.ts
index 07dcc53b..ef82acc8 100644
--- a/packages/contracts/src/mnda.ts
+++ b/packages/contracts/src/mnda.ts
@@ -358,13 +358,14 @@ export const MndaVoidSchema = z.union([
     .strict(),
   z.object({ id: z.uuid(), code: z.literal("signer_change") }).strict(),
 ]);
-/** A sent request can be voided until the partner has signed. */
+/** An incomplete request can be voided, including after the partner signs. */
 export const mndaVoidableStates: readonly MndaState[] = [
   "draft",
   "preparing",
   "ready",
   "sent",
   "viewed",
+  "awaiting_countersignature",
   "attention",
 ];
 export const MndaCorrectSignerSchema = z
@@ -390,6 +391,10 @@ export const mndaErrorCodes = [
   "reminder_cooldown",
   "busy",
   "provider_failed",
+  "provider_timeout",
+  "provider_access",
+  "provider_rate_limit",
+  "provider_rejected",
   "forbidden",
   "mfa_required",
   "not_configured",
diff --git a/packages/integrations/src/esign/signwell.test.ts b/packages/integrations/src/esign/signwell.test.ts
index 42af29c9..7b5bc3f5 100644
--- a/packages/integrations/src/esign/signwell.test.ts
+++ b/packages/integrations/src/esign/signwell.test.ts
@@ -2,6 +2,7 @@ import { createHmac } from "node:crypto";
 import { describe, expect, it, vi } from "vitest";
 import { fixtureRecord } from "../../../contracts/src/mnda-fixture";
 import {
+  classifySignWellFailure,
   assertSignWellCopiedContacts,
   assertSignWellSigningFields,
   signWellRefused,
@@ -500,3 +501,60 @@ describe("partner-entered values at completion", () => {
     ).toEqual({});
   });
 });
+
+describe("safe signing diagnostics", () => {
+  it("retains only an allowlisted category and HTTP status", () => {
+    expect(classifySignWellFailure(new Error("SIGNWELL_HTTP_422"))).toEqual({
+      code: "http",
+      status: 422,
+    });
+    expect(
+      classifySignWellFailure(new Error("SIGNWELL_HTTP_422 private response")),
+    ).toEqual({ code: "other" });
+    expect(classifySignWellFailure(new Error("private data"))).toBeNull();
+  });
+  it.each([
+    "not JSON: private provider data",
+    JSON.stringify({ recipients: [{ email: "private@example.test" }] }),
+  ])("sanitizes malformed document responses", async (body) => {
+    const client = new SignWellClient(
+      "private-key",
+      vi.fn<typeof fetch>().mockResolvedValue(new Response(body)),
+    );
+    await expect(client.get(providerId)).rejects.toThrow(
+      /^SIGNWELL_INVALID_RESPONSE$/,
+    );
+  });
+  it("normalizes a failed connection without exposing its URL", async () => {
+    const client = new SignWellClient(
+      "private-key",
+      vi
+        .fn<typeof fetch>()
+        .mockRejectedValue(new TypeError("fetch failed: private URL")),
+    );
+    await expect(client.get(providerId)).rejects.toThrow(
+      /^SIGNWELL_NETWORK_ERROR$/,
+    );
+  });
+  it("classifies the client deadline as a timeout", async () => {
+    vi.useFakeTimers();
+    try {
+      const transport = vi.fn<typeof fetch>().mockImplementation(
+        (_input, init) =>
+          new Promise((_resolve, reject) => {
+            init?.signal?.addEventListener("abort", () =>
+              reject(new Error("private abort reason")),
+            );
+          }),
+      );
+      const request = new SignWellClient("private-key", transport).get(
+        providerId,
+      );
+      const assertion = expect(request).rejects.toThrow(/^SIGNWELL_TIMEOUT$/);
+      await vi.advanceTimersByTimeAsync(20_000);
+      await assertion;
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
diff --git a/packages/integrations/src/esign/signwell.ts b/packages/integrations/src/esign/signwell.ts
index 17d5b2e7..7c27629f 100644
--- a/packages/integrations/src/esign/signwell.ts
+++ b/packages/integrations/src/esign/signwell.ts
@@ -136,6 +136,10 @@ export abstract class SignWellSigningClient<K extends string> {
         chunks.push(value);
       }
       return Buffer.concat(chunks);
+    } catch (error) {
+      if (controller.signal.aborted) throw new Error("SIGNWELL_TIMEOUT");
+      if (classifySignWellFailure(error)) throw error;
+      throw new Error("SIGNWELL_NETWORK_ERROR");
     } finally {
       clearTimeout(timer);
     }
@@ -145,11 +149,15 @@ export abstract class SignWellSigningClient<K extends string> {
     method = "GET",
     body?: unknown,
   ): Promise<SignWellSigningDocument<K>> {
-    return signWellDocumentSchema(this.bindingKey).parse(
-      JSON.parse(
-        Buffer.from(await this.request(path, method, body)).toString("utf8"),
-      ),
-    );
+    const bytes = await this.request(path, method, body);
+    try {
+      return signWellDocumentSchema(this.bindingKey).parse(
+        JSON.parse(Buffer.from(bytes).toString("utf8")),
+      );
+    } catch {
+      // Validation errors can contain provider data. Keep them out of logs/UI.
+      throw new Error("SIGNWELL_INVALID_RESPONSE");
+    }
   }
   /** An unsent draft. Text tags place the fields; sending is a separate call. */
   protected createSigningDraft<R>(
@@ -301,6 +309,27 @@ export function assertSignWellCopiedContacts(
     signWellCopiedContacts(record).map((c) => c.email),
   );
 }
+/** Only bounded diagnostics; never provider bodies, URLs, or recipient data. */
+export function classifySignWellFailure(error: unknown): {
+  code: "timeout" | "network" | "http" | "invalid_response" | "other";
+  status?: number;
+} | null {
+  if (!(error instanceof Error)) return null;
+  const status = /^SIGNWELL_HTTP_([1-5]\d{2})$/.exec(error.message)?.[1];
+  if (status) return { code: "http", status: Number(status) };
+  if (error.message === "SIGNWELL_TIMEOUT" || error.name === "AbortError")
+    return { code: "timeout" };
+  if (error.message === "SIGNWELL_NETWORK_ERROR") return { code: "network" };
+  if (
+    [
+      "SIGNWELL_INVALID_RESPONSE",
+      "SIGNWELL_INVALID_PDF",
+      "SIGNWELL_RESPONSE_TOO_LARGE",
+    ].includes(error.message)
+  )
+    return { code: "invalid_response" };
+  return error.message.startsWith("SIGNWELL_") ? { code: "other" } : null;
+}
 /** Whether a failed call certainly changed nothing at SignWell: a 4xx refusal.
  * Timeouts, 5xx and unreadable responses may have been applied. */
 export function signWellRefused(error: unknown): boolean {
diff --git a/packages/workflows/src/contracts.test.ts b/packages/workflows/src/contracts.test.ts
index fb684e3a..4d82f9ad 100644
--- a/packages/workflows/src/contracts.test.ts
+++ b/packages/workflows/src/contracts.test.ts
@@ -365,27 +365,105 @@ it("closes a request whose document was deleted in SignWell without calling dele
   expect(provider.cancel).not.toHaveBeenCalled();
 });
 
-it("refuses to void once the counterparty has signed, and keeps a completed contract", async () => {
-  const signed = setup(sent);
-  signed.doc.status = "Sent";
-  const counterparty = signed.doc.recipients[0];
-  if (counterparty) counterparty.status = "signed";
+it.each(["contract_template", "counterparty_paper"] as const)(
+  "voids the incomplete counterparty-signed %s request, but preserves completed contracts",
+  async (documentType) => {
+    const signed = setup({
+      ...sent,
+      documentType,
+      state: "awaiting_countersignature",
+    });
+    signed.doc.status = "Sent";
+    const counterparty = signed.doc.recipients[0];
+    if (!counterparty) throw new Error("Missing counterparty");
+    counterparty.status = "signed";
+    await expect(
+      signed.workflow.void(signed.record().contractId, actor, {
+        reason: "Wrong entity",
+      }),
+    ).resolves.toMatchObject({
+      state: "canceled",
+      cancelReason: "Wrong entity",
+    });
+    expect(signed.provider.cancel).toHaveBeenCalledExactlyOnceWith(
+      signed.doc.id,
+    );
+    expect(signed.notes.at(-1)).toEqual({
+      eventType: "contract.voided",
+      detail: { reason: "Wrong entity" },
+    });
+
+    const completed = setup({ ...sent, state: "awaiting_countersignature" });
+    completed.doc.status = "Completed";
+    await expect(
+      completed.workflow.void(completed.record().contractId, actor, {
+        reason: "Too late",
+      }),
+    ).rejects.toThrow("CONTRACT_ALREADY_COMPLETED");
+    expect(completed.archived()).toBeDefined();
+    expect(completed.provider.cancel).not.toHaveBeenCalled();
+  },
+);
+
+it.each([true, false])(
+  "never deletes a request with every required signer finished (counterpartySigns=%s)",
+  async (counterpartySigns) => {
+    const s = setup({ ...sent, counterpartySigns });
+    s.doc.status = "Sent";
+    for (const recipient of s.doc.recipients) recipient.status = "completed";
+    await expect(
+      s.workflow.void(s.record().contractId, actor, { reason: "Too late" }),
+    ).rejects.toThrow("CONTRACT_ALREADY_COMPLETED");
+    expect(s.provider.cancel).not.toHaveBeenCalled();
+    expect(s.record().state).not.toBe("canceled");
+    expect(s.archived()).toBeUndefined();
+  },
+);
+
+it("retains a partial signature when delete fails, then allows a safe retry", async () => {
+  const s = setup(sent);
+  s.doc.status = "Sent";
+  const counterparty = s.doc.recipients[0];
+  if (!counterparty) throw new Error("Missing counterparty");
+  counterparty.status = "signed";
+  vi.mocked(s.provider.cancel).mockRejectedValueOnce(
+    new Error("SIGNWELL_HTTP_502"),
+  );
   await expect(
-    signed.workflow.void(signed.record().contractId, actor, {
-      reason: "Too late",
-    }),
-  ).rejects.toThrow("CONTRACT_NOT_VOIDABLE");
-  expect(signed.record().state).toBe("awaiting_countersignature");
-  expect(signed.provider.cancel).not.toHaveBeenCalled();
+    s.workflow.void(s.record().contractId, actor, { reason: "Wrong entity" }),
+  ).rejects.toThrow("SIGNWELL_HTTP_502");
+  expect(s.record().state).toBe("awaiting_countersignature");
+  expect(s.notes.some((note) => note?.eventType === "contract.voided")).toBe(
+    false,
+  );
+  await expect(
+    s.workflow.void(s.record().contractId, actor, { reason: "Wrong entity" }),
+  ).resolves.toMatchObject({ state: "canceled" });
+  expect(s.provider.cancel).toHaveBeenCalledTimes(2);
+});
 
-  const completed = setup(sent);
-  completed.doc.status = "Completed";
+it("keeps and archives completion observed after an ambiguous delete refusal", async () => {
+  const s = setup(sent);
+  s.doc.status = "Sent";
+  const counterparty = s.doc.recipients[0];
+  if (!counterparty) throw new Error("Missing counterparty");
+  counterparty.status = "signed";
+  vi.mocked(s.provider.cancel).mockImplementationOnce(async () => {
+    s.doc.status = "Completed";
+    throw new Error("SIGNWELL_HTTP_502");
+  });
   await expect(
-    completed.workflow.void(completed.record().contractId, actor, {
-      reason: "Too late",
-    }),
+    s.workflow.void(s.record().contractId, actor, { reason: "Too late" }),
+  ).rejects.toThrow("SIGNWELL_HTTP_502");
+  expect(s.record().state).toBe("completed");
+  expect(s.archived()).toBeDefined();
+  expect(s.notes.some((note) => note?.eventType === "contract.voided")).toBe(
+    false,
+  );
+  await expect(
+    s.workflow.void(s.record().contractId, actor, { reason: "Too late" }),
   ).rejects.toThrow("CONTRACT_ALREADY_COMPLETED");
-  expect(completed.archived()).toBeDefined();
+  expect(s.provider.cancel).toHaveBeenCalledOnce();
 });
 
 it("treats an unclear delete as done when a re-read finds the document gone", async () => {
@@ -433,7 +511,7 @@ it("names the executed copy within the file name limit", async () => {
   expect(fileName.endsWith(" (executed).pdf")).toBe(true);
 });
 
-it("refuses to void when the counterparty signed and the countersigner's email bounced", async () => {
+it("voids an incomplete counterparty-signed request after the countersigner's email bounced", async () => {
   const { workflow, doc, record, provider } = setup(sent);
   doc.status = "Sent";
   const [counterparty, filOne] = doc.recipients;
@@ -442,9 +520,8 @@ it("refuses to void when the counterparty signed and the countersigner's email b
   filOne.bounced = true;
   await expect(
     workflow.void(record().contractId, actor, { reason: "Wrong legal entity" }),
-  ).rejects.toThrow("CONTRACT_NOT_VOIDABLE");
-  expect(record().state).toBe("attention");
-  expect(provider.cancel).not.toHaveBeenCalled();
+  ).resolves.toMatchObject({ state: "canceled" });
+  expect(provider.cancel).toHaveBeenCalledExactlyOnceWith(doc.id);
 });
 
 it("holds a contract whose SignWell copy names other signers, and answers the wakeup", async () => {
@@ -639,3 +716,29 @@ describe("counterparty paper the counterparty signed already", () => {
     });
   });
 });
+
+it.each(["request", "provider", "signer", "template", "mode"] as const)(
+  "refuses signed documents with a mismatched %s binding",
+  async (mismatch) => {
+    const s = setup({ ...sent, state: "awaiting_countersignature" });
+    s.doc.status = "Sent";
+    const counterparty = s.doc.recipients[0];
+    if (!counterparty) throw new Error("Missing counterparty");
+    counterparty.status = "signed";
+    if (mismatch === "request")
+      s.doc.metadata.commerce_contract_id = randomUUID();
+    if (mismatch === "provider") s.doc.id = randomUUID();
+    if (mismatch === "signer") counterparty.email = "different@example.com";
+    if (mismatch === "template")
+      s.doc.metadata.template_sha256 = "c".repeat(64);
+    if (mismatch === "mode") s.doc.test_mode = false;
+    await expect(
+      s.workflow.void(s.record().contractId, actor, { reason: "Wrong entity" }),
+    ).rejects.toThrow("CONTRACT_NOT_VOIDABLE");
+    expect(s.provider.cancel).not.toHaveBeenCalled();
+    expect(s.record()).toMatchObject({
+      state: "attention",
+      error: "signwell_signed_mismatch",
+    });
+  },
+);
diff --git a/packages/workflows/src/mnda.test.ts b/packages/workflows/src/mnda.test.ts
index 7fbeab99..d298a0e3 100644
--- a/packages/workflows/src/mnda.test.ts
+++ b/packages/workflows/src/mnda.test.ts
@@ -177,7 +177,8 @@ it("stops waiting when the lease is lost while SignWell prepares the draft", asy
   );
   expect(warn).toHaveBeenCalledWith("MNDA send failure not recorded", {
     mndaId: fixtureRecord.id,
-    error: "MNDA_LEASE_LOST",
+    phase: "read_draft",
+    code: "other",
   });
   warn.mockRestore();
   expect(s.wait).toHaveBeenCalledOnce();
@@ -242,7 +243,8 @@ it("returns the sent request when SignWell accepted the send but the read back f
   const sent = await s.workflow.send(fixtureRecord.id, actor);
   expect(warn).toHaveBeenCalledWith("MNDA state not read after send", {
     mndaId: fixtureRecord.id,
-    error: "This operation was aborted",
+    phase: "read_after_send",
+    code: "timeout",
   });
   warn.mockRestore();
   expect(sent).toMatchObject({ state: "sending", error: null });
@@ -327,16 +329,51 @@ it("records a signer change as a code, not as typed text", async () => {
     await s.workflow.void(fixtureRecord.id, actor, { code: "signer_change" }),
   ).toMatchObject({ cancelCode: "signer_change", cancelReason: null });
 });
-it("never voids once the partner has signed, even when only SignWell knows it", async () => {
+it("voids a bound partially signed request with a reason and makes repeats idempotent", async () => {
+  const s = setup();
+  await s.workflow.send(fixtureRecord.id, actor);
+  partnerOf(s.doc).status = "signed";
+  expect(
+    await s.workflow.void(fixtureRecord.id, actor, { reason: "Wrong entity" }),
+  ).toMatchObject({ state: "canceled", cancelReason: "Wrong entity" });
+  expect(
+    await s.workflow.void(fixtureRecord.id, actor, { reason: "Repeat" }),
+  ).toMatchObject({ state: "canceled", cancelReason: "Wrong entity" });
+  expect(s.provider.cancel).toHaveBeenCalledExactlyOnceWith(s.doc.id);
+  expect(s.events.filter((event) => event === "mnda.voided")).toHaveLength(1);
+});
+it("requires a typed reason after a signature instead of the signer-change shortcut", async () => {
   const s = setup();
   await s.workflow.send(fixtureRecord.id, actor);
   partnerOf(s.doc).status = "signed";
   await expect(
-    s.workflow.void(fixtureRecord.id, actor, { reason: "Too late" }),
+    s.workflow.void(fixtureRecord.id, actor, { code: "signer_change" }),
   ).rejects.toThrow("NOT_VOIDABLE");
   expect(s.record().state).toBe("awaiting_countersignature");
+  expect(s.provider.cancel).not.toHaveBeenCalled();
+});
+it.each(["Sent", "Unexpected provider status"])(
+  "preserves all signatures while %s awaits finalization",
+  async (status) => {
+    const s = setup();
+    await s.workflow.send(fixtureRecord.id, actor);
+    s.doc.status = status;
+    for (const recipient of s.doc.recipients) recipient.status = "signed";
+    await expect(
+      s.workflow.void(fixtureRecord.id, actor, { reason: "Too late" }),
+    ).rejects.toThrow("ALREADY_COMPLETED");
+    expect(s.provider.cancel).not.toHaveBeenCalled();
+    expect(s.record().state).not.toBe("canceled");
+    expect(s.archived()).toBeUndefined();
+  },
+);
+it("refuses a partially signed document whose provider status is unknown", async () => {
+  const s = setup();
+  await s.workflow.send(fixtureRecord.id, actor);
+  partnerOf(s.doc).status = "signed";
+  s.doc.status = "Unexpected provider status";
   await expect(
-    s.workflow.void(fixtureRecord.id, actor, { reason: "Too late" }),
+    s.workflow.void(fixtureRecord.id, actor, { reason: "Uncertain" }),
   ).rejects.toThrow("NOT_VOIDABLE");
   expect(s.provider.cancel).not.toHaveBeenCalled();
 });
@@ -630,7 +667,8 @@ it("reports the original send failure when the lease was lost before it could be
   );
   expect(warn).toHaveBeenCalledWith("MNDA send failure not recorded", {
     mndaId: fixtureRecord.id,
-    error: "MNDA_LEASE_LOST",
+    phase: "create_draft",
+    code: "other",
   });
   warn.mockRestore();
 });
@@ -753,7 +791,7 @@ it("settles a correction SignWell applied late instead of refusing it as a signe
   ).rejects.toThrow("NOT_CORRECTABLE");
   expect(s.provider.updateRecipient).toHaveBeenCalledTimes(1);
 });
-it("never voids a document the partner signed while the countersigner's email bounced", async () => {
+it("voids a bound incomplete document after the countersigner's email bounced", async () => {
   const s = setup();
   await s.workflow.send(fixtureRecord.id, actor);
   partnerOf(s.doc).status = "signed";
@@ -767,7 +805,77 @@ it("never voids a document the partner signed while the countersigner's email bo
   });
   await expect(
     s.workflow.void(fixtureRecord.id, actor, { reason: "Bounced" }),
-  ).rejects.toThrow("MNDA_NOT_VOIDABLE");
-  expect(s.provider.cancel).not.toHaveBeenCalled();
-  expect(s.record().state).toBe("attention");
+  ).resolves.toMatchObject({ state: "canceled", cancelReason: "Bounced" });
+  expect(s.provider.cancel).toHaveBeenCalledExactlyOnceWith(s.doc.id);
+});
+
+it("logs a safe create-draft failure phase and status without changing persisted error compatibility", async () => {
+  const s = setup();
+  vi.mocked(s.provider.createDraft).mockRejectedValueOnce(
+    new Error("SIGNWELL_HTTP_422"),
+  );
+  const log = vi.spyOn(console, "error").mockImplementation(() => {});
+  try {
+    await expect(s.workflow.send(fixtureRecord.id, actor)).rejects.toThrow(
+      "SIGNWELL_HTTP_422",
+    );
+    expect(log).toHaveBeenCalledWith("MNDA send failed", {
+      mndaId: fixtureRecord.id,
+      phase: "create_draft",
+      code: "http",
+      status: 422,
+    });
+    expect(s.record()).toMatchObject({
+      state: "preparing",
+      error: "provider_unavailable",
+    });
+  } finally {
+    log.mockRestore();
+  }
+});
+
+it("logs the send phase without leaking an unexpected transport error body", async () => {
+  const s = setup();
+  vi.mocked(s.provider.send).mockRejectedValueOnce(
+    new Error("private provider body with a secret signing URL"),
+  );
+  const log = vi.spyOn(console, "error").mockImplementation(() => {});
+  try {
+    await expect(s.workflow.send(fixtureRecord.id, actor)).rejects.toThrow(
+      "private provider body",
+    );
+    expect(log).toHaveBeenCalledWith("MNDA send failed", {
+      mndaId: fixtureRecord.id,
+      phase: "send",
+      code: "other",
+    });
+    expect(JSON.stringify(log.mock.calls)).not.toContain("secret signing URL");
+    expect(s.record()).toMatchObject({
+      state: "sending",
+      error: "provider_unavailable",
+    });
+  } finally {
+    log.mockRestore();
+  }
+});
+
+it("distinguishes original-PDF failure before any provider creation call", async () => {
+  const s = setup();
+  vi.spyOn(s.repo, "readArtifact").mockRejectedValueOnce(
+    new Error("private storage error"),
+  );
+  const log = vi.spyOn(console, "error").mockImplementation(() => {});
+  try {
+    await expect(s.workflow.send(fixtureRecord.id, actor)).rejects.toThrow(
+      "private storage error",
+    );
+    expect(log).toHaveBeenCalledWith("MNDA send failed", {
+      mndaId: fixtureRecord.id,
+      phase: "prepare_pdf",
+      code: "other",
+    });
+    expect(s.provider.createDraft).not.toHaveBeenCalled();
+  } finally {
+    log.mockRestore();
+  }
 });
diff --git a/packages/workflows/src/signing/engine.ts b/packages/workflows/src/signing/engine.ts
index 30f01c1c..1c9ff655 100644
--- a/packages/workflows/src/signing/engine.ts
+++ b/packages/workflows/src/signing/engine.ts
@@ -8,6 +8,7 @@ import {
   assertSignWellFields,
   assertSignWellNoAutomaticReminders,
   checkSignWellCopiedContacts,
+  classifySignWellFailure,
   signWellAttentionReason,
   signWellFieldValues,
   signWellRefused,
@@ -137,7 +138,7 @@ const terminal: readonly SigningState[] = [
   "expired",
   "canceled",
 ];
-/** A request can be voided until the first signer has signed. */
+/** Incomplete requests can be voided after checking their provider state. */
 const voidable: readonly SigningState[] = [
   "draft",
   "preparing",
@@ -145,6 +146,7 @@ const voidable: readonly SigningState[] = [
   "sent",
   "viewed",
   "attention",
+  "awaiting_countersignature",
 ];
 /** The states in which SignWell has the request out for signature. */
 const outForSignature: readonly SigningState[] = [
@@ -171,8 +173,6 @@ const failure = (code: string) => new Error(`SIGNING_${code}`);
 const is = (error: unknown, ...codes: string[]) =>
   error instanceof Error &&
   codes.some((code) => error.message === `SIGNING_${code}`);
-const message = (error: unknown) =>
-  error instanceof Error ? error.message.slice(0, 120) : "";
 /** SignWell's copy disagrees with the record. Nothing is applied from it; the
  * request waits in `attention` until a person voids it. */
 const signWellFieldsMismatch = "signwell_fields_mismatch";
@@ -471,6 +471,8 @@ export class SigningEngine<R> {
   async send(id: string, actor: Actor) {
     const { record, token } = await this.store.claim(id);
     let current = record;
+    let phase: "prepare_pdf" | "create_draft" | "read_draft" | "send" =
+      "read_draft";
     // The bound document as last read, so a mismatch found while sending is
     // named as apply() names it.
     let seen: SignWellSigningDocument | null = null;
@@ -487,7 +489,9 @@ export class SigningEngine<R> {
           { state: "preparing", error: null },
           actor,
         );
+        phase = "prepare_pdf";
         const pdf = await this.store.originalPdf(id);
+        phase = "create_draft";
         const doc = await this.signWell.createDraft(current, pdf);
         if (
           !["ready", "preparing"].includes(
@@ -505,6 +509,7 @@ export class SigningEngine<R> {
       const bound = this.store.view(current);
       const providerId = bound.providerId;
       if (!providerId) throw failure("PROVIDER_ID_REQUIRED");
+      phase = "read_draft";
       let doc = (seen = await this.fetch(providerId));
       const expected = this.signing(bound).map((slot) => ({
         id: slot.id,
@@ -570,6 +575,7 @@ export class SigningEngine<R> {
         undefined,
         note,
       );
+      phase = "send";
       await this.signWell.send(providerId, bound.testMode);
       // SignWell accepted the send. Failing to read it back is not a send
       // failure: the webhook or the reconcile task settles the state.
@@ -583,7 +589,10 @@ export class SigningEngine<R> {
         return await this.apply(stored, token, sent, actor);
       } catch (error) {
         if (is(error, "NEEDS_ATTENTION")) throw error;
-        this.warn("state not read after send", id, { error: message(error) });
+        this.warn("state not read after send", id, {
+          phase: "read_after_send",
+          ...(classifySignWellFailure(error) ?? { code: "other" }),
+        });
         return sending;
       }
     } catch (error) {
@@ -600,6 +609,14 @@ export class SigningEngine<R> {
         )
       )
         throw error;
+      // Fixed phase/category/status only: provider bodies and signer data
+      // must never reach operator logs even when a transport fails unexpectedly.
+      // i18n-exempt: operator log; identifiers and fixed diagnostic codes only
+      console.error(`${this.type.errorPrefix} send failed`, {
+        [`${this.type.auditPrefix}Id`]: id,
+        phase,
+        ...(classifySignWellFailure(error) ?? { code: "other" }),
+      });
       const found = this.store.view(current).providerId
         ? mismatchReason(error)
         : undefined;
@@ -620,7 +637,8 @@ export class SigningEngine<R> {
         () => true,
         (unrecorded: unknown) => {
           this.warn("send failure not recorded", id, {
-            error: message(unrecorded),
+            phase,
+            ...(classifySignWellFailure(unrecorded) ?? { code: "other" }),
           });
           return false;
         },
@@ -720,10 +738,11 @@ export class SigningEngine<R> {
   }
 
   /**
-   * Voids a request the first signer has not signed. The authoritative state
-   * is read first, so a request signed in the meantime is refused and one
-   * that completed keeps its executed PDF. SignWell's cancel deletes its
-   * copy; the original PDF, the reason and the history stay in Commerce.
+   * Voids an incomplete request, including one waiting for countersignature.
+   * Refreshes the bound provider state and refuses completed/finalizing copies.
+   * SignWell deletes its copy; Commerce keeps the original, reason and history.
+   * The provider has no documented conditional-delete API: its remote signers
+   * can still finish between this read and the delete despite our local lease.
    */
   async void(id: string, actor: Actor, why: SigningVoidReason) {
     const { record, token } = await this.store.claim(id);
@@ -741,13 +760,29 @@ export class SigningEngine<R> {
           if (settled.state === "completed") throw failure("ALREADY_COMPLETED");
           if (terminal.includes(settled.state)) return current;
           if (!voidable.includes(settled.state)) throw failure("NOT_VOIDABLE");
-          // The state may not show a signature: a mismatched copy is not
-          // applied, and a bounce outranks the signature. Never delete a
-          // document anyone signed.
-          if (signedInSignWell(doc))
-            throw failure(
-              mismatched(settled) ? "SIGNED_IN_SIGNWELL" : "NOT_VOIDABLE",
-            );
+          // A bounce or mismatch can hide signatures in the applied state.
+          // Never delete a signed copy whose exact request/signers differ.
+          if (signedInSignWell(doc)) {
+            if (mismatched(settled)) throw failure("SIGNED_IN_SIGNWELL");
+            // Binding validation above establishes the complete recipient set,
+            // including requests where only the countersigner must sign. Their
+            // final signatures can precede the provider's Completed status.
+            if (
+              doc.recipients.every((recipient) =>
+                ["signed", "completed"].includes(
+                  recipient.status?.toLowerCase() ?? "",
+                ),
+              )
+            )
+              throw failure("ALREADY_COMPLETED");
+            // A partial signature may only be voided with an explicit reason
+            // while SignWell reports a recognized in-flight document status.
+            if (
+              "code" in why ||
+              !["sent", "pending", "viewed"].includes(doc.status.toLowerCase())
+            )
+              throw failure("NOT_VOIDABLE");
+          }
           await this.deleteInSignWell(current, token, actor);
         }
       }

From 8303377a8c3395c192081aa2d336a98e98cfa66a Mon Sep 17 00:00:00 2001
From: James Kurz <jameskurz@Jamess-MacBook-Air.local>
Date: Sun, 11 Oct 2026 21:34:05 -0400
Subject: [PATCH 2/3] Align shared signing scenarios with reviewed void policy

---
 .../contracts/client-components.test.tsx      |   4 +-
 docs/operations/commerce-mnda.md              |   2 +-
 packages/workflows/src/signing/scenarios.ts   | 120 ++++++++++++------
 3 files changed, 88 insertions(+), 38 deletions(-)

diff --git a/apps/web/src/features/internal-ops/contracts/client-components.test.tsx b/apps/web/src/features/internal-ops/contracts/client-components.test.tsx
index f218740e..ac180af6 100644
--- a/apps/web/src/features/internal-ops/contracts/client-components.test.tsx
+++ b/apps/web/src/features/internal-ops/contracts/client-components.test.tsx
@@ -773,7 +773,9 @@ describe("signing panel", () => {
     panel({ state: "sent", providerId: "x" });
     fireEvent.click(screen.getByRole("button", { name: "Check status" }));
     expect(
-      await screen.findByText(/SignWell did not respond as expected/),
+      await screen.findByText(
+        /Commerce could not confirm the result with SignWell/,
+      ),
     ).toBeInTheDocument();
     expect(mocks.refresh).not.toHaveBeenCalled();
   });
diff --git a/docs/operations/commerce-mnda.md b/docs/operations/commerce-mnda.md
index 87a17f4d..d71bb5a5 100644
--- a/docs/operations/commerce-mnda.md
+++ b/docs/operations/commerce-mnda.md
@@ -399,7 +399,7 @@ concrete provider failure remains unresolved. Use the corresponding workflow,
 adapter, access or database tests for those changes:
 
 ```sh
-pnpm --filter @clockwork/workflows exec vitest run src/mnda.test.ts
+pnpm --filter @clockwork/workflows exec vitest run src/mnda.test.ts src/contracts.test.ts src/signing/scenarios.test.ts
 pnpm --filter @clockwork/integrations exec vitest run src/esign/signwell.test.ts
 pnpm --filter @clockwork/web exec vitest run src/features/internal-ops/mnda
 DIRECT_DATABASE_URL=... pnpm --filter @clockwork/db exec vitest run --config vitest.integration.config.ts src/repositories/mnda.integration.test.ts
diff --git a/packages/workflows/src/signing/scenarios.ts b/packages/workflows/src/signing/scenarios.ts
index e3751889..1faa711f 100644
--- a/packages/workflows/src/signing/scenarios.ts
+++ b/packages/workflows/src/signing/scenarios.ts
@@ -153,12 +153,15 @@ export const signingScenarios: readonly SigningScenario[] = [
       h.doc.status = "Created";
       h.wait.mockImplementationOnce(async () => h.loseLease());
       const warn = quietly();
-      await expect(h.send()).rejects.toThrow(h.code("LEASE_LOST"));
-      expect(warn).toHaveBeenCalledExactlyOnceWith(
-        `${h.log.label} send failure not recorded`,
-        { [h.log.idKey]: h.record().id, error: h.code("LEASE_LOST") },
-      );
-      warn.mockRestore();
+      try {
+        await expect(h.send()).rejects.toThrow(h.code("LEASE_LOST"));
+        expect(warn).toHaveBeenCalledExactlyOnceWith(
+          `${h.log.label} send failure not recorded`,
+          { [h.log.idKey]: h.record().id, phase: "read_draft", code: "other" },
+        );
+      } finally {
+        warn.mockRestore();
+      }
       expect(h.wait).toHaveBeenCalledOnce();
       expect(h.provider.send).not.toHaveBeenCalled();
       expect(h.record()).toMatchObject({ state: "ready", error: null });
@@ -173,12 +176,19 @@ export const signingScenarios: readonly SigningScenario[] = [
         h.provider.get.mockRejectedValueOnce(abort());
       });
       const warn = quietly();
-      expect(await h.send()).toMatchObject({ state: "sending", error: null });
-      expect(warn).toHaveBeenCalledExactlyOnceWith(
-        `${h.log.label} state not read after send`,
-        { [h.log.idKey]: h.record().id, error: "This operation was aborted" },
-      );
-      warn.mockRestore();
+      try {
+        expect(await h.send()).toMatchObject({ state: "sending", error: null });
+        expect(warn).toHaveBeenCalledExactlyOnceWith(
+          `${h.log.label} state not read after send`,
+          {
+            [h.log.idKey]: h.record().id,
+            phase: "read_after_send",
+            code: "timeout",
+          },
+        );
+      } finally {
+        warn.mockRestore();
+      }
       expect(h.record()).toMatchObject({ state: "sending", error: null });
       expect((await h.sync()).state).toBe("sent");
       expect(h.provider.send).toHaveBeenCalledOnce();
@@ -460,14 +470,17 @@ export const signingScenarios: readonly SigningScenario[] = [
       const version = h.record().version;
       h.doc.status = "Completed";
       const warn = quietly();
-      expect((await h.sync()).state).toBe("completed");
-      // Completion and the follow-up event each take a version.
-      expect(h.record().version).toBe(version + 2);
-      expect(warn).toHaveBeenCalledExactlyOnceWith(
-        `${h.log.label} signer fields not reported by SignWell`,
-        { [h.log.idKey]: h.record().id, providerId: h.doc.id, fields: asked },
-      );
-      warn.mockRestore();
+      try {
+        expect((await h.sync()).state).toBe("completed");
+        // Completion and the follow-up event each take a version.
+        expect(h.record().version).toBe(version + 2);
+        expect(warn).toHaveBeenCalledExactlyOnceWith(
+          `${h.log.label} signer fields not reported by SignWell`,
+          { [h.log.idKey]: h.record().id, providerId: h.doc.id, fields: asked },
+        );
+      } finally {
+        warn.mockRestore();
+      }
       expect(h.record().partnerDetails).toEqual({});
       expect(h.archived()).toBeDefined();
       expect(h.events.slice(-2)).toEqual([
@@ -487,17 +500,37 @@ export const signingScenarios: readonly SigningScenario[] = [
     },
   },
   {
-    name: "reads SignWell before a void and never deletes what anyone signed",
+    name: "reads SignWell before voiding partial signatures and preserves completed or finalizing requests",
     async run(make) {
       const signed = await sent(make);
       signed.partner().status = "signed";
-      await expect(signed.void({ reason: "Too late" })).rejects.toThrow(
+      await expect(signed.void({ code: "signer_change" })).rejects.toThrow(
         signed.code("NOT_VOIDABLE"),
       );
       expect(signed.record().state).toBe("awaiting_countersignature");
-      await expect(signed.void({ reason: "Too late" })).rejects.toThrow(
-        signed.code("NOT_VOIDABLE"),
+      expect(signed.provider.cancel).not.toHaveBeenCalled();
+      expect(await signed.void({ reason: "Wrong entity" })).toMatchObject({
+        state: "canceled",
+        cancelReason: "Wrong entity",
+      });
+      expect(await signed.void({ reason: "Repeat" })).toMatchObject({
+        state: "canceled",
+        cancelReason: "Wrong entity",
+      });
+      expect(signed.provider.cancel).toHaveBeenCalledExactlyOnceWith(
+        signed.doc.id,
       );
+      expect(
+        signed.events.filter(
+          (event) => event.eventType === `${signed.kind}.voided`,
+        ),
+      ).toEqual([
+        {
+          aggregateId: signed.record().id,
+          eventType: `${signed.kind}.voided`,
+          detail: { reason: "Wrong entity" },
+        },
+      ]);
 
       const completed = await sent(make);
       completed.doc.status = "Completed";
@@ -506,17 +539,29 @@ export const signingScenarios: readonly SigningScenario[] = [
       );
       expect(completed.record().state).toBe("completed");
       expect(completed.archived()).toBeDefined();
+      expect(completed.provider.cancel).not.toHaveBeenCalled();
+
+      const finalizing = await sent(make);
+      for (const recipient of finalizing.doc.recipients)
+        recipient.status = "signed";
+      await expect(finalizing.void({ reason: "Changed" })).rejects.toThrow(
+        finalizing.code("ALREADY_COMPLETED"),
+      );
+      expect(finalizing.provider.cancel).not.toHaveBeenCalled();
+      expect(finalizing.record().state).not.toBe("canceled");
 
-      // A bounce outranks the signature in the applied state.
+      // A bounce outranks the partial signature in the applied state, but
+      // the fresh provider copy still proves the request remains incomplete.
       const bounced = await sent(make);
       bounced.partner().status = "signed";
       bounced.filOne().bounced = true;
-      await expect(bounced.void({ reason: "Bounced" })).rejects.toThrow(
-        bounced.code("NOT_VOIDABLE"),
+      expect(await bounced.void({ reason: "Bounced" })).toMatchObject({
+        state: "canceled",
+        cancelReason: "Bounced",
+      });
+      expect(bounced.provider.cancel).toHaveBeenCalledExactlyOnceWith(
+        bounced.doc.id,
       );
-      expect(bounced.record().state).toBe("attention");
-      for (const h of [signed, completed, bounced])
-        expect(h.provider.cancel).not.toHaveBeenCalled();
     },
   },
   {
@@ -809,12 +854,15 @@ export const signingScenarios: readonly SigningScenario[] = [
       if (!h.declares.copySender) return;
       delete h.doc.copied_contacts;
       const warn = quietly();
-      expect((await h.send()).state).toBe("sent");
-      expect(warn).toHaveBeenCalledWith(
-        `${h.log.label} copied contacts not reported by SignWell`,
-        { [h.log.idKey]: h.record().id, providerId: h.doc.id },
-      );
-      warn.mockRestore();
+      try {
+        expect((await h.send()).state).toBe("sent");
+        expect(warn).toHaveBeenCalledWith(
+          `${h.log.label} copied contacts not reported by SignWell`,
+          { [h.log.idKey]: h.record().id, providerId: h.doc.id },
+        );
+      } finally {
+        warn.mockRestore();
+      }
       // SignWell's draft leaves the sender out: the request is held for a
       // void instead of failing every retry, and nothing is sent.
       const refused = make();

From e25ba8b7fc20a1f20d981d0fb9df971149f95b9d Mon Sep 17 00:00:00 2001
From: James Kurz <jameskurz@Jamess-MacBook-Air.local>
Date: Sun, 11 Oct 2026 21:34:24 -0400
Subject: [PATCH 3/3] Require shared signing scenarios for engine changes

---
 docs/operations/commerce-mnda.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/operations/commerce-mnda.md b/docs/operations/commerce-mnda.md
index d71bb5a5..b751231c 100644
--- a/docs/operations/commerce-mnda.md
+++ b/docs/operations/commerce-mnda.md
@@ -396,7 +396,9 @@ the affected partner-detail modes; delete disposable test drafts afterward.
 Repeat the complete two-signer flow when signing order, recipient routing,
 send/retry, callbacks or completed-document retrieval changes, or when a
 concrete provider failure remains unresolved. Use the corresponding workflow,
-adapter, access or database tests for those changes:
+adapter, access or database tests for those changes. Shared signing-engine
+changes must include the scenario matrix for MNDAs, template contracts and
+uploaded PDFs:
 
 ```sh
 pnpm --filter @clockwork/workflows exec vitest run src/mnda.test.ts src/contracts.test.ts src/signing/scenarios.test.ts