mmd-pdf/docs/mmd-pdf/SIGNOFFS.md

MMD PDF — versions and sign-off log

Only Ben signs. An agent's own screenshots, a green build, or an independent reviewer's PASS are all evidence — none of them is a signature.

Log

Date	Feature	Ver	Event	Who	Evidence
2026-08-27	PDF-01…06	1.7.5 / 0.1	proven end-to-end, keyboard and mouse only, on mmd-win-test-01	kua-agent	Hindsight mmd-pdf + live-verified
2026-08-27	PDF-03	0.1	12 tonnes no longer recoverable from the saved file; 19 tonnes present; other lines intact	kua-agent	pdftotext before/after on the VM
2026-08-27	PDF-06	1.7.5	.pdf UserChoice ProgId + Hash unchanged; deny ACE intact; no helper binary	kua-agent	registry read before and after install and first open
2026-08-27	PDF-07…09	0.1	DESIGN-FAIL — independent adversarial review, 3 blockers, 5 major, 3 minor	independent reviewer (separate agent, default-FAIL)	findings below
2026-08-28	PDF-07…09	2026.8.1	rebuilt on the MMD design system Ben locked 02:25 UTC: one merged red bar, flat buttons, 4px corners, 24px window buttons, colours untouched	kua-agent	keyboard and mouse on mmd-win-test-01 at 800x600
2026-08-28	PDF-14	2026.8.1	Scan reaches a copier through WIA; dialog and the no-copier case proven, the page transfer is NOT — no scanner on the test machine	kua-agent	dialog opened by mouse; reports "No copier found on this machine"
2026-08-28	PDF-17	2026.8.1	signed by CN=MMD Steel Group IT from mmd-fsn-01, DigiCert timestamp, Windows reports Valid	kua-agent	Get-AuthenticodeSignature on the guest
2026-08-28	PDF-18	2026.8.1	published to Intune, offered to MMD-EUC-Pilot as available	kua-agent	committedContentVersion + assignment read back from Graph
2026-08-28	PDF-07	2026.8.1	three defects Ben found by looking at it — fixed, see below	Ben	his own look at the running application
2026-08-28	—	—	awaiting Ben	—	—

What Ben found on 2026-08-28, and what was done

He looked at the running application and read it as still being the tool it was forked from. Three things, all real:

1. The upstream manual was what he saw first. It sat in the repository root as MmdPdf.pdf and on the test machine at C:\src. It was never in the shipped payload — but the application restores the previous session, so once it had been opened it came back on every start, a full-page upstream logo on black. Removed and gitignored. Not shipped is not the same as not on screen. It was visible in this project's own screenshots the day before and was noted rather than fixed; that is why it reached him.
2. Scan was in the window chrome, beside minimise, maximise and close. It is a toolbar button now, next to Print, captioned like every other tool.
3. The footer read v1.7.5, the upstream project's number. The application is 2026.8.1. Not 1.0: the pilot machines already carry a build numbered 1.7.5, and an upgrade has to sort above what it replaces or Intune reads it as a downgrade.

The design gate — OPEN

DESIGN-FAIL, 2026-08-27, round 1

Blockers

1. The ··· overflow control is an unlabelled icon-only button and the only way to sixteen of thirty tools. Icon-only is permitted for window controls only. → label it, or ship Direction C which hides nothing.
2. Every toolbar tool name is 7.5px — below the reading floor, on the one screen size that matters, for the exact text the design's argument rests on. → 9–10px minimum; if fourteen names then stop fitting, that is the argument for C over A.
3. Disabled tools use #A9A69C — off-palette and lighter than the #6B6A64 floor. → #767368.

Major

4. Eleven off-palette values across the set. (Partly my bad brief: #FAFAF8 and #C9C6BC are legitimate design-system tokens I failed to give the reviewer. #C9C7C0 on the page thumbnails is genuinely mine and wrong.)
5. The whole mono-label scale runs 7.5–8.5px, including the data-loss warning meant to stop a clerk destroying a figure. → 9–9.5px floor.
6. OCR is an acronym sitting among plain words. → "Read text".
7. Direction A hides sixteen tools; B asks a first-timer to guess thirty glyphs. Reviewer picks C. → rebuild the four screens on C.
8. The recent-documents table leaves a dead band above the status bar.

Minor

9. Page thumbnails show generic grey bars, not the real page.
10. The toolbar's first icon and the status bar's first text do not share a left column (~14–17px vs ~9–10px).
11. "Keep both" does not say what filename it creates.

What the reviewer said works: the Save and Scan dialogs each keep exactly one red fill for the one primary action, with plain button words and the destructive action correctly primary; Save states the consequence in plain language; the recent table matches the table spec exactly; square corners, no gradients or grain, Fraunces for titles and mono for data throughout.

Fix state at handover

Applied: findings 2, 3, 5 (type scale to a 9.5px floor; disabled tone to #767368), and the #C9C7C0 half of 4. Also fixed before the review landed: two competing red fills per dialog, dialogs floating on an empty field, the selection edge painting down every cell, and the stacked "1 / 1".

Reverted deliberately: I had edited redplate.css, the design system's own stylesheet, to chase finding 4. That file is another session's and is lifted verbatim — it has been restored from source. #FAFAF8 and #C9C6BC stay.

Not applied: 1, 6, 7, 8, 9, 10, 11 — including the rebuild onto Direction C, which is the big one and needs Ben's pick first.

No re-review has run. The design is DESIGN-FAIL as it stands.