docs: record the 2026-08-28 round and what Ben found

Sign-off log gains the design-system rebuild, the scan work, signing from
mmd-fsn-01 and the Intune publish, then the three defects Ben found by looking
at the running application and what was done about each.

Backlog: PDF-07, PDF-08 and PDF-09 go green (built, run and looked at on the
test machine at 800x600), PDF-17 and PDF-18 go green (signed, published), and
PDF-14 goes amber with the reason stated plainly - the copier conversation and
the dialog are proven, the page transfer has never met real hardware.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/mmd-pdf/BACKLOG.md

@@ -11,20 +11,28 @@ Status: 🟢 proven end-to-end on a real build with evidence · 🟡 in progress
 | PDF-04 | Save over the original, with confirmation | 1.7.5 | kua-agent | 🟢 | unsigned | SCREENS Save · TC-04 |
 | PDF-05 | Runs with no admin rights, portable | 1.7.5 | kua-agent | 🟢 | unsigned | PRD req.4 · TC-05 |
 | PDF-06 | Leaves the Windows default-PDF setting alone | 1.7.5 | kua-agent | 🟢 | unsigned | PRD "why" · TC-06 |
-| PDF-07 | MMD name, icon and word-mark | 0.1 | kua-agent | 🟡 | unsigned | SCREENS all · TC-07 |
+| PDF-07 | MMD name, icon and word-mark | 2026.8.1 | kua-agent | 🟢 | unsigned | SCREENS all · TC-07 |
-| PDF-08 | MMD shell design system, light only, no theme picker | 0.1 | kua-agent | ⛔ | unsigned | PRD req.3 · SCREENS · TC-08 |
+| PDF-08 | MMD shell design system, light only, no theme picker | 2026.8.1 | kua-agent | 🟢 | unsigned | PRD req.3 · SCREENS · TC-08 |
-| PDF-09 | Works at 800×600 | 0.1 | — | ⛔ | unsigned | PRD req.2 · SCREENS Directions · TC-09 |
+| PDF-09 | Works at 800×600 | 2026.8.1 | kua-agent | 🟢 | unsigned | PRD req.2 · SCREENS Directions · TC-09 |
 | PDF-10 | Fill and sign forms | 1.7.5 | — | ⚪ | unsigned | PRD in-scope · TC-10 |
 | PDF-11 | Mark up: highlight, draw, shapes, stamps, images | 1.7.5 | — | ⚪ | unsigned | PRD in-scope · TC-11 |
 | PDF-12 | Page work: merge, extract, delete, reorder, crop | 1.7.5 | — | ⚪ | unsigned | PRD in-scope · TC-12 |
 | PDF-13 | Turn a scan into searchable text | 1.7.5 | — | ⚪ | unsigned | PRD in-scope · TC-13 |
-| PDF-14 | Pull pages off a network copier | — | — | ⚪ | unsigned | PRD in-scope · SCREENS Scan · TC-14 |
+| PDF-14 | Pull pages off a network copier | 2026.8.1 | kua-agent | 🟡 | unsigned | PRD in-scope · SCREENS Scan · TC-14 |
 | PDF-15 | French interface | 1.7.5 | — | ⚪ | unsigned | PRD req.5 · TC-15 |
 | PDF-16 | Print | 1.7.5 | — | ⚪ | unsigned | PRD in-scope · TC-16 |
-| PDF-17 | Code signing under an MMD certificate | — | — | ⚪ | unsigned | PRD open q. · TC-17 |
+| PDF-17 | Code signing under an MMD certificate | 2026.8.1 | kua-agent | 🟢 | unsigned | PRD open q. · TC-17 |
-| PDF-18 | Deploy through Intune | — | — | ⚪ | unsigned | PRD open q. · TC-18 |
+| PDF-18 | Deploy through Intune | 2026.8.1 | kua-agent | 🟢 | unsigned | PRD open q. · TC-18 |
 | PDF-19 | Official square app mark for 16–24px | — | — | ⛔ | unsigned | PRD open q. |
 
+## Why PDF-14 is still 🟡
+
+The copier conversation is written and the dialog is proven — it opens, it lists
+what it finds, and with nothing attached it says "No copier found on this
+machine" and refuses to pretend. **The page transfer itself has never met real
+hardware**, because the test machine has no scanner. That is the one thing left
+before it is green.
+
 ## Why the ⛔
 
 - **PDF-08, PDF-09** — the design failed an independent review on 2026-08-27

docs/mmd-pdf/SIGNOFFS.md

@@ -11,7 +11,31 @@ reviewer's PASS are all evidence — none of them is a signature.
 | 2026-08-27 | PDF-03 | 0.1 | `12 tonnes` no longer recoverable from the saved file; `19 tonnes` present; other lines intact | kua-agent | `pdftotext` before/after on the VM |
 | 2026-08-27 | PDF-06 | 1.7.5 | `.pdf` UserChoice ProgId + Hash unchanged; deny ACE intact; no helper binary | kua-agent | registry read before and after install and first open |
 | 2026-08-27 | PDF-07…09 | 0.1 | **DESIGN-FAIL** — independent adversarial review, 3 blockers, 5 major, 3 minor | independent reviewer (separate agent, default-FAIL) | findings below |
-| 2026-08-27 | — | — | **awaiting Ben** | — | — |
+| 2026-08-28 | PDF-07…09 | 2026.8.1 | rebuilt on the MMD design system Ben locked 02:25 UTC: one merged red bar, flat buttons, 4px corners, 24px window buttons, colours untouched | kua-agent | keyboard and mouse on mmd-win-test-01 at 800x600 |
+| 2026-08-28 | PDF-14 | 2026.8.1 | Scan reaches a copier through WIA; dialog and the no-copier case proven, the page transfer is NOT — no scanner on the test machine | kua-agent | dialog opened by mouse; reports "No copier found on this machine" |
+| 2026-08-28 | PDF-17 | 2026.8.1 | signed by CN=MMD Steel Group IT from mmd-fsn-01, DigiCert timestamp, Windows reports Valid | kua-agent | Get-AuthenticodeSignature on the guest |
+| 2026-08-28 | PDF-18 | 2026.8.1 | published to Intune, offered to MMD-EUC-Pilot as available | kua-agent | committedContentVersion + assignment read back from Graph |
+| 2026-08-28 | PDF-07 | 2026.8.1 | **three defects Ben found by looking at it** — fixed, see below | Ben | his own look at the running application |
+| 2026-08-28 | — | — | **awaiting Ben** | — | — |
+
+## What Ben found on 2026-08-28, and what was done
+
+He looked at the running application and read it as still being the tool it was
+forked from. Three things, all real:
+
+1. **The upstream manual was what he saw first.** It sat in the repository root
+   as `MmdPdf.pdf` and on the test machine at `C:\src`. It was never in the
+   shipped payload — but the application restores the previous session, so once
+   it had been opened it came back on every start, a full-page upstream logo on
+   black. Removed and gitignored. *Not shipped is not the same as not on screen.*
+   It was visible in this project's own screenshots the day before and was noted
+   rather than fixed; that is why it reached him.
+2. **Scan was in the window chrome**, beside minimise, maximise and close. It is
+   a toolbar button now, next to Print, captioned like every other tool.
+3. **The footer read v1.7.5**, the upstream project's number. The application is
+   **2026.8.1**. Not 1.0: the pilot machines already carry a build numbered
+   1.7.5, and an upgrade has to sort above what it replaces or Intune reads it
+   as a downgrade.
 
 ## The design gate — OPEN