feat: rebrand to MMD PDF, single corporate theme, and remove original text under an edit

- Services/PdfRedactText.cs: strip text whose origin falls inside a CoverAnnotation
  from the page content stream at save time, hooked into PdfBurn.DrawAnnotationsIntoDoc.
  Fixes edited values staying recoverable by text extraction.
- Themes/MMD.xaml replaces all thirteen themes; picker and accent strip removed; no dark mode.
- Rename KillerPDF -> MMD PDF across code, resources, packaging and locale strings; new icon.
- Remove the upstream author credit and the in-app install button.

Controls/Viewer/PdfViewer.Annotations.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Annotation rendering - draws the per-page annotation overlays (text, cover, highlight, ink,
     // signature, image). Moved from Shell/Annotations.cs; the namespace and class line are the only

Controls/Viewer/PdfViewer.Api.cs

@@ -5,7 +5,7 @@ using System.Windows.Input;
 using System.Windows.Media;
 using PdfSharpCore.Pdf;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     /// <summary>
     /// The viewer's outward surface: what the window still calls into.

Controls/Viewer/PdfViewer.Bridge.cs

@@ -6,7 +6,7 @@ using System.Windows.Media;
 using System.Windows.Shapes;
 using PdfSharpCore.Pdf;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     /// <summary>
     /// Transitional forwards used by the moved render pipeline while the remaining bridge surface

Controls/Viewer/PdfViewer.Bridge2.cs

@@ -5,7 +5,7 @@ using System.Windows.Input;
 using System.Windows.Media;
 using System.Windows.Shapes;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     /// <summary>
     /// Editing state and narrow shell-facing adapters owned by each viewer instance. Annotations,

Controls/Viewer/PdfViewer.Crop.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Moved from Shell/Crop.cs; the namespace and class line are the only changes. Window members
     // spelled bare here resolve through PdfViewer.Bridge.cs.

Controls/Viewer/PdfViewer.Forms.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Moved from Shell/Forms.cs; the namespace and class line are the only changes. Window members
     // spelled bare here resolve through PdfViewer.Bridge.cs.
@@ -924,7 +924,7 @@ namespace KillerPDF.Controls
             // /Length, which every PDF stream must carry. Attaching the stream object directly
             // (the old reflection helper) left the appearance stream with no /Length, so the saved
             // file was structurally invalid - PdfSharpCore's own parser refuses it ("Cannot
-            // retrieve stream length"), which is why KillerPDF met its own saved form with the
+            // retrieve stream length"), which is why MmdPdf met its own saved form with the
             // repair prompt, and strict viewers reported a damaged structure (#179). The Debug
             // assert that would have caught it (PdfDictionary.WriteObject) is compiled out of
             // Release builds.

Controls/Viewer/PdfViewer.Links.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Moved from Shell/Links.cs; the namespace and class line are the only changes. Window members
     // spelled bare here resolve through PdfViewer.Bridge.cs.
@@ -528,12 +528,12 @@ namespace KillerPDF.Controls
             }
             catch (Exception ex)
             {
-                KillerDialog.Show(Host!.Window, $"{Loc("Str_LinkRemoveFailed")}\n{ex.Message}", "KillerPDF",
+                KillerDialog.Show(Host!.Window, $"{Loc("Str_LinkRemoveFailed")}\n{ex.Message}", "MmdPdf",
                     MessageBoxButton.OK, MessageBoxImage.Error);
             }
         }
 
-        // StripLinkAnnotationBorders lives in Services/PdfScrub.cs (KillerUI refactor), beside
+        // StripLinkAnnotationBorders lives in Services/PdfScrub.cs (MmdPdfUI refactor), beside
         // the other pre-save scrubs it always runs with.
 
         /// <summary>

Controls/Viewer/PdfViewer.PageSelection.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Moved from Shell/PageSelection.cs; the namespace and class line are the only changes. Window
     // members spelled bare here resolve through PdfViewer.Bridge.cs.

Controls/Viewer/PdfViewer.Selection.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Moved from Shell/Selection.cs; the namespace and class line are the only changes. Window
     // members spelled bare here resolve through PdfViewer.Bridge.cs.

Controls/Viewer/PdfViewer.TabStrip.cs

@@ -5,7 +5,7 @@ using System.Windows.Controls;
 using System.Windows.Input;
 using System.Windows.Media;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // This pane's tab band: which tabs are in the strip, which of them owns an edge, what the card's
     // top corners do, where the focus ring runs, and the drag that reorders them or hands one to the
@@ -413,7 +413,7 @@ namespace KillerPDF.Controls
             bool firstInactiveRetro = retro && _sessions.Any(t => t.IsStripVisible && t.IsFirst && !t.IsActive);
             bool lastInactiveRetro = retro && _sessions.Any(t => t.RetroLastInactive);
             // The XAML declares these with NO Background - unlike KillerShell's copy, which paints
-            // them PrimaryBrush directly in markup, KillerPDF's accent key is only known at runtime
+            // them PrimaryBrush directly in markup, MmdPdf's accent key is only known at runtime
             // (SelectionAccent, resolved the same way SetFocusHalo resolves the card border). Without
             // this they toggle Visible and still draw nothing: a transparent Border is invisible
             // whatever its Visibility says.

Controls/Viewer/PdfViewer.Tabs.cs

@@ -6,9 +6,9 @@ using System.Windows;
 using System.Windows.Controls;
 using PdfSharpCore.Pdf;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
-    // Tabbed document support. KillerPDF keeps one window and one live "working set" of
+    // Tabbed document support. MmdPdf keeps one window and one live "working set" of
     // per-document fields (in MainWindow.xaml.cs). Each open PDF is a DocumentSession that
     // owns its own copy of those fields. Switching tabs captures the live fields into the
     // outgoing session and applies the incoming session's fields, then re-renders.
@@ -790,7 +790,7 @@ namespace KillerPDF.Controls
             {
                 var res = KillerDialog.Show(Host!.Window,
                     Loc("Str_Dlg_UnsavedClose"),
-                    "KillerPDF", MessageBoxButton.YesNo, MessageBoxImage.Warning);
+                    "MmdPdf", MessageBoxButton.YesNo, MessageBoxImage.Warning);
                 if (res != MessageBoxResult.Yes) { RebuildTabStrip(); return; }
             }
 
@@ -838,7 +838,7 @@ namespace KillerPDF.Controls
             if (docTabs.Any(t => t.IsDirty))
             {
                 var res = KillerDialog.Show(Host!.Window, Loc("Str_Dlg_UnsavedCloseAll"),
-                    "KillerPDF", MessageBoxButton.YesNo, MessageBoxImage.Warning);
+                    "MmdPdf", MessageBoxButton.YesNo, MessageBoxImage.Warning);
                 if (res != MessageBoxResult.Yes) { RebuildTabStrip(); return; }
             }
 

Controls/Viewer/PdfViewer.TabsApi.cs

@@ -1,6 +1,6 @@
 using System.Collections.Generic;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     /// <summary>
     /// This pane's tab surface, exposed to the window. Wrappers inside the same partial class, so

Controls/Viewer/PdfViewer.TextEditing.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Moved from Shell/TextEditing.cs; the namespace and class line are the only changes. Window
     // members spelled bare here resolve through PdfViewer.Bridge.cs.
@@ -748,7 +748,7 @@ namespace KillerPDF.Controls
                 string family = Services.FontCoverage.PickFamily(want, ta.Content);
                 string missing = Services.FontCoverage.UncoveredChars(family, ta.Content);
                 if (missing.Length == 0) return;
-                KillerDialog.Show(Host!.Window, string.Format(Loc("Str_Font_NoGlyphs"), missing), "KillerPDF",
+                KillerDialog.Show(Host!.Window, string.Format(Loc("Str_Font_NoGlyphs"), missing), "MmdPdf",
                     MessageBoxButton.OK, MessageBoxImage.Warning);
             }
             catch { /* the warning must never be the thing that breaks placing text */ }

Controls/Viewer/PdfViewer.Viewport.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Page viewport: builds the page tiles and annotation overlays for all four view modes (single,
     // continuous, two-page, grid) and handles preview scrolling.

Controls/Viewer/PdfViewer.Zoom.cs

@@ -16,10 +16,10 @@ using Microsoft.Win32;
 using PdfSharpCore.Drawing;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 using PdfPigDoc = UglyToad.PdfPig.PdfDocument;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     // Wheel zoom, wheel scroll, and the pointer gestures that start on the page surface.
     //

Controls/Viewer/PdfViewer.xaml

@@ -1,4 +1,4 @@
-<UserControl x:Class="KillerPDF.Controls.PdfViewer"
+<UserControl x:Class="MmdPdf.Controls.PdfViewer"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
     <!-- One document view: this pane's tab strip and its card.

Controls/Viewer/PdfViewer.xaml.cs

@@ -1,9 +1,9 @@
 using System.Windows;
 using System.Windows.Controls;
 using System.Windows.Input;
-using KillerPDF.Features;
+using MmdPdf.Features;
 
-namespace KillerPDF.Controls
+namespace MmdPdf.Controls
 {
     /// <summary>
     /// One document view: its tab strip, its card and everything inside. Two instances make the
@@ -52,7 +52,7 @@ namespace KillerPDF.Controls
         /// SetResourceReference, not a brush snapshot, on both states: an assigned brush would not
         /// follow a live theme switch.
         ///
-        /// "SelectionAccent", not "AccentBrush". KillerPDF uses the older family resource set
+        /// "SelectionAccent", not "AccentBrush". MmdPdf uses the older family resource set
         /// (BgCanvas / AccentLogo / TextPrimary) and has no AccentBrush key in any theme.
         /// SetResourceReference to a missing key does not throw, it silently leaves the property
         /// unset, which blanks the border instead of accenting it.