docs(07-04): complete LEGAL-03 gap closure plan — SUMMARY, STATE, ROADMAP updated

- 07-04-SUMMARY.md: plan execution documented
- STATE.md: position advanced to 07-04 complete, decisions added, metrics recorded
- ROADMAP.md: phase 7 progress updated (4/4 plans)

.planning/ROADMAP.md

@@ -157,4 +157,4 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7
 | 4. PDF Ingest | 4/4 | Complete   | 2026-03-20 |
 | 5. PDF Fill and Field Mapping | 3/4 | In Progress|  |
 | 6. Signing Flow | 6/6 | Complete   | 2026-03-21 |
-| 7. Audit Trail and Download | 3/3 | Complete   | 2026-03-21 |
+| 7. Audit Trail and Download | 4/4 | Complete   | 2026-03-21 |

.planning/STATE.md

@@ -3,12 +3,12 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: unknown
-last_updated: "2026-03-21T17:00:00.000Z"
+last_updated: "2026-03-21T16:56:31.521Z"
 progress:
   total_phases: 7
   completed_phases: 7
-  total_plans: 27
+  total_plans: 28
-  completed_plans: 26
+  completed_plans: 28
 ---
 
 # Project State
@@ -22,12 +22,12 @@ See: .planning/PROJECT.md (updated 2026-03-19)
 
 ## Current Position
 
-Phase: 7 of 7 (Audit Trail and Download) — COMPLETE (all 3 plans done)
+Phase: 7 of 7 (Audit Trail and Download) — COMPLETE (all 4 plans done)
-Plan: 07-03 (3 of 3 plans) — Full Phase 7 browser verification checkpoint — SIGN-07 and LEGAL-03 confirmed by human
+Plan: 07-04 (4 of 4 plans) — LEGAL-03 gap closure — /file route restricted to original PDF, PdfViewer Download anchor hidden for Signed
-Status: Phase 7 complete. All 4 browser verification criteria passed: agent download works, Signed badge shows, private storage returns 404, download button absent for non-Signed docs.
+Status: All plans complete. LEGAL-03 fully satisfied: /file route serves original PDF only, presigned /download?adt=[token] is sole signed PDF download path.
-Last activity: 2026-03-21 — Phase 7 Plan 03: browser verification approved, Phase 7 complete
+Last activity: 2026-03-21 — Phase 7 Plan 04: LEGAL-03 gap closure complete, all 28 plans done
 
-Progress: [███████████] 100% (Phase 7 plan 3 of 3 complete — all phases done)
+Progress: [███████████] 100% (Phase 7 plan 4 of 4 complete — all phases done)
 
 ## Performance Metrics
 
@@ -67,6 +67,7 @@ Progress: [███████████] 100% (Phase 7 plan 3 of 3 complete
 | Phase 07-audit-trail-and-download P01 | 2 | 2 tasks | 2 files |
 | Phase 07-audit-trail-and-download P02 | 2 | 2 tasks | 6 files |
 | Phase 07-audit-trail-and-download P03 | 0 | 1 task (checkpoint) | 0 files |
+| Phase 07-audit-trail-and-download P04 | 1 | 2 tasks | 2 files |
 
 ## Accumulated Context
 
@@ -147,6 +148,8 @@ Recent decisions affecting current work:
 - [Phase 07-audit-trail-and-download 07-02]: Download button is a plain anchor tag — browser follows href directly, Content-Disposition:attachment header in API route drives save dialog
 - [Phase 07-audit-trail-and-download 07-02]: signedAt added to both dashboard and client profile queries — all document tables show consistent Date Signed column
 - [Phase 07-audit-trail-and-download 07-03]: Phase 7 declared complete after human confirmation of all 4 browser verification criteria — SIGN-07 and LEGAL-03 verified working end-to-end in live browser
+- [Phase 07-audit-trail-and-download]: /file route reads doc.filePath only — signedFilePath fallback removed per LEGAL-03; presigned /download?adt=[token] is sole signed PDF download path
+- [Phase 07-audit-trail-and-download]: PdfViewer Download anchor wrapped in {docStatus \!== 'Signed' && ...} — toolbar download hidden for Signed docs, PDF still loads via /file for in-browser display
 
 ### Pending Todos
 
@@ -163,5 +166,5 @@ None yet.
 ## Session Continuity
 
 Last session: 2026-03-21
-Stopped at: Completed 07-03-PLAN.md — Phase 7 browser verification approved, Phase 7 complete
+Stopped at: Completed 07-04-PLAN.md — LEGAL-03 gap closure complete, all 28 plans done
 Resume file: None

.planning/phases/07-audit-trail-and-download/07-04-SUMMARY.md

@@ -0,0 +1,110 @@
+---
+phase: 07-audit-trail-and-download
+plan: 04
+subsystem: api
+tags: [pdf, legal-compliance, presigned-url, next-js, react]
+
+# Dependency graph
+requires:
+  - phase: 07-audit-trail-and-download
+    provides: Presigned /download?adt=[token] route (07-01, 07-02) serving signed PDFs with 5-min TTL
+provides:
+  - /file route restricted to original unsigned PDF only (signedFilePath fallback removed)
+  - PdfViewer Download anchor hidden when docStatus is 'Signed'
+  - LEGAL-03 fully satisfied — sole signed PDF download path is presigned /download?adt=[token]
+affects:
+  - 07-audit-trail-and-download
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns:
+    - "LEGAL-03 enforcement: /file route hardcoded to filePath (no signedFilePath fallback) — signed PDF only downloadable via presigned token"
+    - "Conditional anchor: docStatus !== 'Signed' guard hides toolbar Download link in PdfViewer"
+
+key-files:
+  created: []
+  modified:
+    - teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts
+    - teressa-copeland-homes/src/app/portal/(protected)/documents/[docId]/_components/PdfViewer.tsx
+
+key-decisions:
+  - "/file route always reads doc.filePath (original) — signedFilePath fallback removed per Option A lock; LEGAL-03 comment added"
+  - "PdfViewer Download anchor wrapped in {docStatus !== 'Signed' && ...} — still loads PDF via /file for in-browser display, toolbar download hidden for Signed"
+
+patterns-established:
+  - "Enforcement via subtraction: removing the fallback (doc.signedFilePath ?? doc.filePath) is simpler and more secure than adding checks"
+  - "Toolbar action gating by docStatus: use conditional rendering rather than disabling to completely eliminate the download path for Signed docs"
+
+requirements-completed: [SIGN-07, LEGAL-03]
+
+# Metrics
+duration: 1min
+completed: 2026-03-21
+---
+
+# Phase 7 Plan 04: LEGAL-03 Gap Closure Summary
+
+**Removed signedFilePath fallback from /file route and conditionally hidden PdfViewer Download anchor for Signed docs, making presigned /download?adt=[token] the sole signed PDF download path**
+
+## Performance
+
+- **Duration:** 1 min
+- **Started:** 2026-03-21T16:53:33Z
+- **Completed:** 2026-03-21T16:54:50Z
+- **Tasks:** 2
+- **Files modified:** 2
+
+## Accomplishments
+- `/file` route no longer serves signed PDFs — always returns the unsigned original via `doc.filePath`
+- PdfViewer toolbar Download anchor is absent when `docStatus === 'Signed'` — no second download path for agents
+- LEGAL-03 requirement fully satisfied: presigned `/download?adt=[token]` is the exclusive route for signed PDF downloads
+- TypeScript compiles cleanly — `doc.filePath` type matches previous usage, no new errors
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Restrict /file route to original PDF only** - `6775cc7` (fix)
+2. **Task 2: Hide Download anchor in PdfViewer for Signed documents** - `cac5d5b` (fix)
+
+**Plan metadata:** (final commit — see below)
+
+## Files Created/Modified
+- `teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts` - Replaced `doc.signedFilePath ?? doc.filePath` with `doc.filePath`; updated comment to reference LEGAL-03
+- `teressa-copeland-homes/src/app/portal/(protected)/documents/[docId]/_components/PdfViewer.tsx` - Wrapped Download `<a>` in `{docStatus !== 'Signed' && (...)}` conditional; Document file prop unchanged
+
+## Decisions Made
+- Used `doc.filePath` directly with no null coalescence — clean and unambiguous. The previous `??` fallback was the entire gap; removing it closes it in 2 characters.
+- Conditional rendering (`{docStatus !== 'Signed' && ...}`) rather than `disabled` on the anchor — a hidden anchor is a cleaner UX signal that no download is available, not just unavailable.
+
+## Deviations from Plan
+
+None - plan executed exactly as written.
+
+## Issues Encountered
+
+None. Both changes were minimal and targeted (2-line change in route.ts, wrapping existing anchor in PdfViewer.tsx). TypeScript confirmed clean on first pass.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+LEGAL-03 is fully closed. All 27 plans across all 7 phases are now complete:
+- Signed PDF downloads are exclusively available via PreparePanel presigned URL (5-min TTL, purpose:'agent-download' JWT claim)
+- `/file` route is safe to use for in-browser PDF viewing without inadvertently serving signed PDFs
+- No further Phase 7 work required
+
+---
+*Phase: 07-audit-trail-and-download*
+*Completed: 2026-03-21*
+
+## Self-Check: PASSED
+
+- route.ts: FOUND
+- PdfViewer.tsx: FOUND
+- 07-04-SUMMARY.md: FOUND
+- Commit 6775cc7: FOUND
+- Commit cac5d5b: FOUND