# HANDOVER — MMD PDF (Windows PDF editor for staff) **Written** 2026-08-27 15:18:53 +04 (11:18 UTC) **Session** mmd-projects-87 · **Repo** `gitea.baobab-ts.com/mmd-it/mmd-pdf` --- ## What this is MMD staff had no sanctioned way to write inside PDF documents. PDFgear was blocked on 2026-07-20 for forging the Windows default-PDF registry setting. This session picked a replacement, proved it, forked it, and started turning it into an MMD product. **MMD PDF** = GPL-3.0 fork of KillerPDF 1.7.5, staying GPL-3.0, `FORK-NOTICE.md` in the repo records what changed. --- ## What was done ### Chosen and proven (this part is solid) - Surveyed open-source Windows PDF editors. **No MIT-licensed app does true inline PDF text editing** — the only genuinely MIT desktop option (every-pdf) can only stamp text on top of a page. KillerPDF (GPL-3.0) was picked; GPL restricts forking and redistribution, not internal deployment to staff. - **Passed the check that killed PDFgear.** `.pdf` UserChoice ProgId and Hash identical before and after install and after opening a PDF; the protective deny ACE intact; one signed executable, no helper binary. Read live from the registry on our own machine. - **Found and fixed a real defect.** Editing existing text left the original glyphs in the file — a delivery note corrected from 12 to 17 tonnes returned *both* figures from `pdftotext`. `Services/PdfRedactText.cs` now walks the page content stream, tracks the CTM and text matrix, and blanks every show-text operator whose origin sits inside the cover rectangle, before any new content is appended. Proven: after the fix the saved file contains only the new figure, every other line intact and still searchable. - **Built the test rig that found it.** `/opt/mmd-wintest/wintest` on the hypervisor: Xvfb + xfreerdp3 + xdotool, so every action is a real pointer or key event with no scripting back door. This is how user testing is done from now on. ### Dedicated Windows test machine VM 203 on **mmd-fsn-03** renamed **mmd-win-test-01**, `onboot=1`, described in Proxmox. Windows Server 2022, 20 cores / 72 GB, guest 10.10.20.22. Its DNS was broken (no internet at all) — fixed. .NET SDK 8 installed for builds. It still also carries the Mali plant-station build, so it is shared. ### Design — failed review, not accepted The rebrand and the new MMD shell design system ("red plate") were applied and merged **before any design existed**, which is the wrong order and Ben called it. Redone properly afterwards: design system pulled from the Claude Design project, red-plate stylesheet lifted verbatim from the session that owns it, seven screens composed at 800×600, then put through an **independent adversarial review** — the gate that was missing. **Verdict: DESIGN-FAIL.** 3 blockers, 5 major, 3 minor. All eleven findings and the fix state are in `docs/mmd-pdf/SIGNOFFS.md`. --- ## Current live / verified state | Thing | State | |---|---| | `main` | carries the rebrand + the redaction fix (PR #1, merged) | | `design/official-logo-and-tokens-20260827` | **bfb9845, pushed, NOT merged** — official logo + design-system values. Unaccepted: the design failed review. | | Build | `dotnet build -c Release`, 0 errors, on mmd-win-test-01 | | App | runs; opens, edits and saves correctly, keyboard-and-mouse tested | | Design | **DESIGN-FAIL**, no re-review run, no Ben sign-off | | Scanning | not written | | Signing / Intune | not started | Claude Design project `446a3931-c345-48da-a3ac-246af02a2e52` ("Design System"): the repo's live CDS 0.3.40 was pushed into `mmd-portal/` (its mirror was stale at 0.3.11), and round-1 design pages into `mmd-pdf/`. **Round 2 was not pushed** — it failed review. Two artifact links exist from before Ben's `/login` and are **dead** (`65c7726d…`, `e47d705f…`). Live under the current account: `7d8d6b56-ef36-4729-8e88-a3fb1392707e` (round-1 canvas) and `a7a974e8-aff4-49e6-b4cc-f80414769515` (status page). Both are round-1 and both predate the review — do not present either as reviewed. --- ## Resume steps 1. **Read** `docs/mmd-pdf/SIGNOFFS.md` for the eleven findings, then `BACKLOG.md` for what is ⛔. 2. **Get Ben's toolbar pick** — A, B or C on the Directions board. The independent reviewer recommends **C** (three tabs; nothing hidden, every tool named). Nothing else in the design can be finished without it. 3. **Apply the seven unapplied findings** — 1, 6, 7, 8, 9, 10, 11 — the big one being the rebuild of Main / EditText / PageRail / Nothing onto Direction C. Working files: `docs/mmd-pdf/design/build.py`, regenerate with `python3 build.py`, render each `.dc.html` locally and look at it. 4. **Re-run the independent review** with the prompt in `docs/mmd-pdf/TEST-CASES.md` under "To review a design". Give the reviewer the **complete** palette this time, including `#FAFAF8` and `#C9C6BC` — my incomplete brief caused half of finding 4. 5. **Only after DESIGN-PASS**, publish the canvas and hand Ben the link for annotation. His annotation closes the gate; the reviewer's PASS does not. 6. **Then** re-derive `Themes/MMD.xaml` from the signed-off design and merge `design/official-logo-and-tokens-20260827`. 7. **Then** scanning (NAPS2.Wia, MIT, .NET Framework 4.6.2 — compatible with this net48 codebase), then signing, then Intune. --- ## Key facts, commits, addresses - Repo `gitea.baobab-ts.com/mmd-it/mmd-pdf`; `main` = PR #1 merged; branch `design/official-logo-and-tokens-20260827` = **bfb9845**. - Hypervisor **mmd-fsn-03** — Hetzner dedicated, Falkenstein FSN1-DC16, auction #3049905, public 168.119.88.172, tailnet 100.64.0.19, Proxmox VE 9.2.10. Reach it with `ssh -i ~/.ssh/id_ed25519_mmd_fsn03_rescue root@100.64.0.19`. - Test machine **mmd-win-test-01** (VM 203), guest 10.10.20.22. Humans reach it in a browser at `https://plantpc.baobab-ts.com` (Guacamole, Entra SSO). - Source on the VM at `C:\src`; build output `C:\src\bin\Release\net48\MmdPdf.exe`; .NET SDK at `C:\build\dotnet`. - Graph for Intune/Entra: **MMD-CIO-Agent client secret** at `~/mmd-projects/entra-cio-agent/secret.env`, helper `graphlib.mjs`. The certificate in `~/.config/mmd/certs` is Exchange PowerShell only — do not reach for it and then conclude the agent lacks Intune access. --- ## Open items - **Ben: pick the toolbar direction.** Blocks everything else in the design. - **Ben: the 16–24px app icon.** No official small MMD mark exists anywhere. The icon crops the lockup's baobab disc, which reads from 32px and is muddy below it. An agent must not draw a simplified one. Commission or accept muddy. - Seven design findings unapplied; no re-review run. - Scanning not written. Signing not started. Intune not started. - mmd-win-test-01's Windows evaluation licence — a restart reset it to 180 days, but it needs a real licence before it is a standing fixture. - Design round 2 not pushed to the Claude Design project (it failed review). --- ## Gotchas 1. **`Stop-Process` over WinRM against a running GUI app hangs the session.** Launch GUI apps with a *new* scheduled-task name instead. 2. **`freerdp2-x11` does not exist on Debian 13.** It is `freerdp3-x11`, and the binary is `xfreerdp3`, not `xfreerdp`. 3. **The word-mark was two literal `` elements**, not the product-name token — a global rename misses it. Check the title bar visually after any rename. 4. **`redplate.css` belongs to another session.** It is lifted verbatim from their `build.mjs`. I edited it once chasing a review finding and reverted it. Do not edit it; raise a discrepancy with the owning session instead. 5. **A `/login` mid-session orphans artifacts** published earlier under the old account. Republishing the same *file path* keeps mapping to the dead one — copy the file to a new path to claim a fresh URL. 6. **`Ctrl+A` inside an inline text edit selects all annotations**, not the text. Use `End` + `BackSpace`. `Enter` commits, `Escape` cancels — the status bar now says so because both were guessed wrong. 7. **Flatten is not redaction's friend.** It removes the old text by turning the page into a picture, destroying every searchable word. That is why the content-stream fix exists. 8. **The design gate is not closed by a reviewer's PASS.** Only Ben's annotation closes it, and design that never went through the proper lane is an automatic fail however good it looks.