[GTrunSec]

This adds a source-bound functional rendering Library. D2/SysML own Questions and model content; composable project functions, replaceable visual themes/icons, browser measurement and ELK produce offline HTML, SVG and PNG. The README starts with a complete numbered overview and uses one sketchbook visual language. Component architecture and Workflow remain separate.

The public Design contract binds audience, message, Questions and mandatory model references. Taste now participates before composition: ordered pure policies choose focus, optional scope, ELK direction and visual roles from explicit Question/model bindings and selected source observations. The same Library/Profile/Scenario program responds to adopter, maintainer and source-gap inputs without Case-specific layout recipes. Selection reasons and the input binding remain in the receipt; changed inputs require explicit reselection. Post-export inspection retains actual observations and advice without claiming aesthetic acceptance.

Mandatory subjects/relations and explicit Scope boundaries remain checked. Missing source observations participate in measured node content; supported declarations never confer verification or approval. Model adapters preserve SDK identities and exact model/source bindings. Existing compositors, ELK, Rough.js and typed Valibot contracts are reused; the raw D2 SVG fallback, duplicate theme paths and example package configuration are removed.

The project uses LGPL-2.1-or-later and follows REUSE: comment-capable files have SPDX headers, JSON/PNG use standard sidecars, existing mixed licenses remain intact, and embedded-font notices retain their actual owners. The redundant LGPL-only texts are removed. The original PR #1 history locates the concurrency test creation and mixed header in 9c8f608; 65725bd only updates the compiler query API. The test is project-specific code added alongside its Justfile change, with no recorded upstream copy. Its unsupported Apache header and now-unused Apache text are removed. Project-owned notices and example export defaults identify hardenedlinux Linux Team and Contributors; actual third-party font notices are preserved. Package archives reuse LICENSE and include the unmodified font text as LICENSE.OFL-1.1 plus asset notices. Optional host-supplied export attribution is serialized before HTML/SVG hashes and assigns no downstream copyright by default. Official REUSE CI checks the repository.

Validation:

• Frozen dependency installation and TypeScript typecheck pass.
• 45 unit tests, 35 browser tests with two workers, and 4 example tests pass locally, including unknown references, stale selection, missing excerpts, forbidden fidelity changes, Scope containment, output binding, attribution injection and README style controls.
• All example generators run; 12 scene views, 44 full-overview/gallery artifacts and the three new Taste candidates have source/output bindings checked before copying.
• An independent consumer installs the actual package archive, typechecks and exercises selection, source gaps, stale refusal and host-attributed HTML/SVG export. The archive includes required licenses and source headers.
• Official REUSE 6.3.0 reports 725/725 files covered, no missing or invalid license expressions, compliant with REUSE Specification 3.3. Used licenses are LGPL-2.1-or-later and OFL-1.1.
• Linux/macOS and REUSE exact-head checks are reported by this PR; local results do not substitute for those checks. Existing CI worker/resource settings are unchanged.

Org 10.146, D2 90.138, package documentation and README describe the final contracts, trust boundary and real Case. Source observations and rendering receipts are not an issued C/Q/R, independent review or delivery authorization.

[GTrunSec]

Weaver consumer: semantic annotation and standalone canvas contract

The Weaver consumer exposed three framework-level failures. This request belongs in this existing Library PR; it should not be closed by another downstream renderer or page-specific CSS.

1. Question and Answer headings can reuse the same domain glyph and typography. The visual grammar then loses the distinction between an inquiry and the content that answers it. Provide immutable, functional semantic components with open presentation roles. A Question retains its selected source reference and role marker; an Answer may retain a domain glyph independently. Themes should preserve this distinction without a mandatory page template.
2. The published exporter adjusts only the first text element in an annotation. A numbered heading with a circle, ordinal and label can move the numeral outside its badge. Measure and position the complete semantic group, including native font bounds and optional ordinal/glyph, before vector export. Consumers should not own baseline or transform corrections.
3. The published combined SVG reads the figure root's computed background. A background on body or main alone produced rgba(0,0,0,0), so GitHub's dark page showed through behind dark titles. An opaque theme canvas must be the default export contract, with transparency explicitly selected when intended. Combined and extracted SVG scenes must follow the same declared contract.

Acceptance should include generated combinations of roles, fonts, optional ordinals, glyphs and themes; source-bound Question mismatch refusal; measured group alignment and bounds; and standalone SVG image decoding on a dark host with pixel-alpha checks. Include negative controls that fail under the former first-text-only measurement and transparent-canvas behavior. Source/model identity must remain unchanged.

The current Weaver local baseline generated all 108 figures, and the 30 measured model vectors passed independent readability and image-opacity checks. A separate complete 26-test run passed after splitting batched source-compilation hooks without widening their existing timeouts. These are downstream observations, not acceptance of the new upstream API. Raw failures remain outside Git.

Downstream removal boundary: once the upstream public contract and a qualified package artifact are available, Weaver should consume the semantic primitives and remove its manual Question circle/text assembly, page-specific alignment correction and root-background override. Do not consume a moving worktree or silently replace the existing content-addressed dependency artifact. Existing runtime dependency pins remain unchanged.