[yacinekahlerras-turbodocx]

Closes #215

Why

embedded-signing/index.md and the shared build/_setup-and-verify.mdx said "Every embedded signer needs a verification method". A developer reads that as enforced. It isn't, by design: on an org that verifies only when requested, a recipient with no auth/otpChannel gets a reusable signing link. A forgotten auth therefore silently yields an unprotected link. The identity-verification page and reference.md already said so. These two spots disagreed with them.

What

• index.md: "Give every embedded signer a verification method." plus a caution, "TurboSign does not enforce this". It covers the reusable link on "Only when requested" orgs and the default method on "On every signature request" orgs, and links to the existing warning.
• _setup-and-verify.mdx (rendered in all four build guides): the same point in one sentence, with the same link.

Verified

Against a local TurboDocx API and the built site:

• Org "Only when requested" (defaultChannel: none), recipient with no auth:
  • createSigningUrl returns a URL with mode: null and pendingChecks: [].
  • The same URL comes back on a second call.
  • In the browser, it opened twice with no passcode step, and the signer completed signing.
• Org "On every signature request" (email), same recipient: mode: otp, pendingChecks: ["email_otp"].
• Built site:
  • The caution renders as a warning admonition.
  • Its link, and the partial's link in each of the four build guides, lands on identity-verification#signers-in-your-own-app-embedded-signing.
  • The old phrase is gone.
  • Checked at 390px wide and in dark mode.
• Build: docusaurus build passes, with no new broken anchors.

🤖 Generated with Claude Code

[yacinekahlerras-turbodocx]

Self-review (author). No blocking issues found.

Checked:

• Accuracy against the product:
  • "Only when requested" in Settings saves defaultChannel: "none" and "On every signature request" saves email/sms.
  • A recipient with no channel resolves to that default.
  • Both sentences in the caution match a live run:
    • With none: reusable URL, pendingChecks: [], and signing completes with no passcode.
    • With email: pendingChecks: ["email_otp"].
• Links: the new link resolves from both index.md (../) and the shared partial (../../). It lands on #signers-in-your-own-app-embedded-signing in all four build guides that import the partial.
• Consistency: the wording now agrees with identity-verification/index.md:63-65 and reference.md:142.

Nits, optional:

• The lead sentence no longer says "unless you use the sender override while testing". The override is still the third row of the methods table right below, so nothing is lost, but say if you'd rather keep it in the prose.
• The partial's paragraph is now four sentences in one block. It reads fine, but it could be split if it feels dense on the build guides.