+ );
+}
+```
+
+
+
+
+
+ Task 1: Restrict /file route to original PDF only
+ teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts
+
+Replace line 25 (the signedFilePath fallback) with a direct use of doc.filePath.
+
+Current line 25:
+```typescript
+ const relativePath = doc.signedFilePath ?? doc.filePath;
+```
+
+Replace with:
+```typescript
+ // Always serve the original uploaded PDF — signed PDF is exclusively
+ // available via the presigned /download?adt=[token] route (LEGAL-03)
+ const relativePath = doc.filePath;
+```
+
+Also update the comment on the line above (currently "Serve signed PDF for completed documents, original otherwise") to remove the misleading description. Remove that comment entirely or replace it with:
+```typescript
+ // Serve the original unsigned PDF only — see LEGAL-03
+```
+
+No other changes to this file. The session auth check, path traversal guard, and readFile/Response logic are all correct and must remain untouched.
+
+
+ grep -n "signedFilePath" /Users/ccopeland/temp/red/teressa-copeland-homes/src/app/api/documents/\[id\]/file/route.ts; echo "exit:$?"
+
+
+ grep returns no matches (exit 1 from grep is acceptable — means the string is absent).
+ The file still compiles (no TypeScript errors introduced — doc.filePath is string | null per schema, same type as before).
+
+
+
+
+ Task 2: Hide Download anchor in PdfViewer for Signed documents
+ teressa-copeland-homes/src/app/portal/(protected)/documents/[docId]/_components/PdfViewer.tsx
+
+Wrap the Download anchor (lines 60-66) in a conditional that hides it when the document status is 'Signed'.
+
+Current code (lines 60-66):
+```tsx
+
+ Download
+
+```
+
+Replace with:
+```tsx
+ {docStatus !== 'Signed' && (
+
+ Download
+
+ )}
+```
+
+Rationale: For Signed documents, the PreparePanel already renders a Download Signed PDF anchor pointing to the presigned /download?adt=[token] URL. The viewer toolbar Download (which points to /file) is redundant and now incorrect for Signed docs since /file no longer serves the signed PDF. For Draft/Sent/Viewed documents, the toolbar Download is still useful — it serves the original PDF for reference.
+
+No other changes to PdfViewer.tsx. The Document file prop (`/api/documents/${docId}/file`) remains unchanged — the PDF viewer still loads the original for in-browser display regardless of status.
+
+
+ grep -n "docStatus !== 'Signed'" /Users/ccopeland/temp/red/teressa-copeland-homes/src/app/portal/\(protected\)/documents/\[docId\]/_components/PdfViewer.tsx
+
+
+ grep finds the conditional wrapping the Download anchor.
+ The Download anchor is present in the file but only rendered when docStatus !== 'Signed'.
+ The Document file prop (`/api/documents/${docId}/file`) is unchanged on line 72.
+
+
+
+
+
+
+After both tasks complete:
+
+1. Confirm /file no longer contains signedFilePath:
+ `grep -n "signedFilePath" teressa-copeland-homes/src/app/api/documents/\[id\]/file/route.ts` — must return nothing.
+
+2. Confirm PdfViewer Download anchor is conditional:
+ `grep -n "docStatus !== 'Signed'" teressa-copeland-homes/src/app/portal/\(protected\)/documents/\[docId\]/_components/PdfViewer.tsx` — must find the conditional.
+
+3. TypeScript build check (optional but recommended):
+ `cd /Users/ccopeland/temp/red/teressa-copeland-homes && npx tsc --noEmit 2>&1 | head -20`
+ No new errors expected — both changes use types already present in the codebase.
+
+
+
+LEGAL-03 is fully satisfied when:
+1. GET /api/documents/[id]/file always returns the unsigned original PDF (doc.filePath), never the signed PDF (doc.signedFilePath)
+2. A logged-in agent navigating to /api/documents/[signed-doc-id]/file receives the original unsigned PDF, not the signed one
+3. The PDF viewer toolbar shows no Download button when docStatus is 'Signed'
+4. The PreparePanel Download Signed PDF anchor (presigned, 5-min TTL) remains the only way to download a signed PDF
+5. SIGN-07 is unaffected — agent can still download signed PDFs via the PreparePanel presigned URL
+
+
+