# MMD PDF — versions and sign-off log

Only Ben signs. An agent's own screenshots, a green build, or an independent
reviewer's PASS are all evidence — none of them is a signature.

## Log

| Date | Feature | Ver | Event | Who | Evidence |
|---|---|---|---|---|---|
| 2026-08-27 | PDF-01…06 | 1.7.5 / 0.1 | proven end-to-end, keyboard and mouse only, on mmd-win-test-01 | kua-agent | Hindsight `mmd-pdf` + `live-verified` |
| 2026-08-27 | PDF-03 | 0.1 | `12 tonnes` no longer recoverable from the saved file; `19 tonnes` present; other lines intact | kua-agent | `pdftotext` before/after on the VM |
| 2026-08-27 | PDF-06 | 1.7.5 | `.pdf` UserChoice ProgId + Hash unchanged; deny ACE intact; no helper binary | kua-agent | registry read before and after install and first open |
| 2026-08-27 | PDF-07…09 | 0.1 | **DESIGN-FAIL** — independent adversarial review, 3 blockers, 5 major, 3 minor | independent reviewer (separate agent, default-FAIL) | findings below |
| 2026-08-28 | PDF-07…09 | 2026.8.1 | rebuilt on the MMD design system Ben locked 02:25 UTC: one merged red bar, flat buttons, 4px corners, 24px window buttons, colours untouched | kua-agent | keyboard and mouse on mmd-win-test-01 at 800x600 |
| 2026-08-28 | PDF-14 | 2026.8.1 | Scan reaches a copier through WIA; dialog and the no-copier case proven, the page transfer is NOT — no scanner on the test machine | kua-agent | dialog opened by mouse; reports "No copier found on this machine" |
| 2026-08-28 | PDF-17 | 2026.8.1 | signed by CN=MMD Steel Group IT from mmd-fsn-01, DigiCert timestamp, Windows reports Valid | kua-agent | Get-AuthenticodeSignature on the guest |
| 2026-08-28 | PDF-18 | 2026.8.1 | published to Intune, offered to MMD-EUC-Pilot as available | kua-agent | committedContentVersion + assignment read back from Graph |
| 2026-08-28 | PDF-07 | 2026.8.1 | **three defects Ben found by looking at it** — fixed, see below | Ben | his own look at the running application |
| 2026-08-28 | — | — | **awaiting Ben** | — | — |

## What Ben found on 2026-08-28, and what was done

He looked at the running application and read it as still being the tool it was
forked from. Three things, all real:

1. **The upstream manual was what he saw first.** It sat in the repository root
   as `MmdPdf.pdf` and on the test machine at `C:\src`. It was never in the
   shipped payload — but the application restores the previous session, so once
   it had been opened it came back on every start, a full-page upstream logo on
   black. Removed and gitignored. *Not shipped is not the same as not on screen.*
   It was visible in this project's own screenshots the day before and was noted
   rather than fixed; that is why it reached him.
2. **Scan was in the window chrome**, beside minimise, maximise and close. It is
   a toolbar button now, next to Print, captioned like every other tool.
3. **The footer read v1.7.5**, the upstream project's number. The application is
   **2026.8.1**. Not 1.0: the pilot machines already carry a build numbered
   1.7.5, and an upgrade has to sort above what it replaces or Intune reads it
   as a downgrade.

## The design gate — OPEN

### DESIGN-FAIL, 2026-08-27, round 1

**Blockers**

1. The `···` overflow control is an unlabelled icon-only button and the only
   way to sixteen of thirty tools. Icon-only is permitted for window controls
   only. → label it, or ship Direction C which hides nothing.
2. Every toolbar tool name is 7.5px — below the reading floor, on the one screen
   size that matters, for the exact text the design's argument rests on.
   → 9–10px minimum; if fourteen names then stop fitting, that is the argument
   for C over A.
3. Disabled tools use `#A9A69C` — off-palette and lighter than the `#6B6A64`
   floor. → `#767368`.

**Major**

4. Eleven off-palette values across the set. *(Partly my bad brief: `#FAFAF8`
   and `#C9C6BC` are legitimate design-system tokens I failed to give the
   reviewer. `#C9C7C0` on the page thumbnails is genuinely mine and wrong.)*
5. The whole mono-label scale runs 7.5–8.5px, including the data-loss warning
   meant to stop a clerk destroying a figure. → 9–9.5px floor.
6. `OCR` is an acronym sitting among plain words. → "Read text".
7. Direction A hides sixteen tools; B asks a first-timer to guess thirty
   glyphs. **Reviewer picks C.** → rebuild the four screens on C.
8. The recent-documents table leaves a dead band above the status bar.

**Minor**

9. Page thumbnails show generic grey bars, not the real page.
10. The toolbar's first icon and the status bar's first text do not share a
    left column (~14–17px vs ~9–10px).
11. "Keep both" does not say what filename it creates.

**What the reviewer said works:** the Save and Scan dialogs each keep exactly
one red fill for the one primary action, with plain button words and the
destructive action correctly primary; Save states the consequence in plain
language; the recent table matches the table spec exactly; square corners, no
gradients or grain, Fraunces for titles and mono for data throughout.

### Fix state at handover

Applied: findings 2, 3, 5 (type scale to a 9.5px floor; disabled tone to
`#767368`), and the `#C9C7C0` half of 4. Also fixed before the review landed:
two competing red fills per dialog, dialogs floating on an empty field, the
selection edge painting down every cell, and the stacked "1 / 1".

Reverted deliberately: I had edited `redplate.css`, the design system's own
stylesheet, to chase finding 4. That file is another session's and is lifted
verbatim — it has been restored from source. `#FAFAF8` and `#C9C6BC` stay.

Not applied: **1, 6, 7, 8, 9, 10, 11** — including the rebuild onto Direction C,
which is the big one and needs Ben's pick first.

**No re-review has run.** The design is DESIGN-FAIL as it stands.