diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e24971a1f4..9ea98ba30a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,3 +78,34 @@ jobs:
 
       - name: Run tests
         run: pnpm run test
+
+      # The verify gate's browser is downloaded once per Playwright version and
+      # restored from cache on every later run.
+      - name: Resolve Playwright version
+        id: playwright
+        run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
+
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      # The config-projection acceptance needs a browser, so it runs here
+      # instead of in the fast suite. Blocking: it guards a real regression
+      # (an export's article content leaking into the comparison).
+      - name: Run browser-gated CLI tests
+        env:
+          MD_WEB_CLI_BROWSER_TESTS: '1'
+        run: pnpm --filter @dane.dai/md-web-cli exec vitest run tests/verify-config.test.ts
+
+      # TEMPORARY: non-blocking while the gate is red on purpose. The difference
+      # classes are visible in the log on every change. The transition to
+      # blocking is an explicit decision, recorded per
+      # docs/adr/0003-single-verify-gate.md ("The gate deliberately landed red").
+      - name: Verify rendering (non-blocking)
+        continue-on-error: true
+        run: pnpm wcli:verify
diff --git a/.github/workflows/publish-md-web-cli.yml b/.github/workflows/publish-md-web-cli.yml
new file mode 100644
index 0000000000..d23eb28615
--- /dev/null
+++ b/.github/workflows/publish-md-web-cli.yml
@@ -0,0 +1,103 @@
+name: Publish md-web-cli
+
+# Ticket #9: push to main runs the verify gate (which builds the md-web-cli
+# bundle itself, captures a browser Oracle, and compares byte for byte) and,
+# only when everything is green, publishes to npm via OIDC trusted publishing.
+# Red runs publish nothing; failure notification is GitHub's built-in Actions
+# email (account-level: Email + only failed workflows) — no notification
+# secrets or steps here.
+#
+# While the gate is deliberately red (see docs/adr/0003-single-verify-gate.md),
+# this workflow stays blocking on purpose: a red gate publishes nothing.
+#
+# DANE: before the first successful publish, configure the npmjs trusted
+# publisher for @dane.dai/md-web-cli (npmjs.com → package/Automation settings):
+#   - package name: @dane.dai/md-web-cli
+#   - repository: DaneSpiritGOD/md
+#   - workflow filename: publish-md-web-cli.yml
+#   - environment: (leave empty — this workflow uses no GitHub environment)
+# The very first publish is manual (trusted publisher cannot be configured
+# before the package exists on npm); afterwards this workflow owns publishing.
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-publish
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write # OIDC trusted publishing — no NODE_AUTH_TOKEN anywhere below
+
+jobs:
+  verify-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/setup@v3
+        with:
+          version: 12.14.0
+          runtime: node@22
+          cache: true
+          install: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Resolve Playwright version
+        id: playwright
+        run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
+
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      # Builds both workspaces itself (never a previously built bundle), captures
+      # a fresh Oracle, and compares byte for byte. Non-zero exits here publish
+      # nothing: every later step is skipped.
+      - name: Verify rendering (wcli:verify)
+        run: pnpm wcli:verify
+
+      - name: Run package unit tests
+        run: pnpm --filter @dane.dai/md-web-cli test
+
+      - name: Upgrade npm for OIDC trusted publishing
+        # Node 22 bundles npm 10.x; npm trusted publishing (id-token OIDC)
+        # requires npm >= 11.5.1.
+        run: npm install -g npm@latest
+
+      - name: Resolve publish version
+        id: resolve-version
+        working-directory: packages/md-web-cli
+        env:
+          # Same registry the gate/CI uses for reads; explicit so the repo
+          # .npmrc mirror cannot redirect version lookups.
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org
+        run: node scripts/resolve-publish-version.mjs
+
+      - name: Apply publish version
+        working-directory: packages/md-web-cli
+        env:
+          PUBLISH_VERSION: ${{ steps.resolve-version.outputs.version }}
+        run: npm version "$PUBLISH_VERSION" --no-git-tag-version
+
+      - name: Publish to npm (OIDC trusted publishing)
+        working-directory: packages/md-web-cli
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org
+          # Deliberately NO NODE_AUTH_TOKEN: authentication is the job's
+          # id-token (npm provenance / trusted publishing).
+          NPM_CONFIG_PROVENANCE: 'true'
+        run: npm publish
diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
new file mode 100644
index 0000000000..98e7b05ba1
--- /dev/null
+++ b/.github/workflows/sync-upstream.yml
@@ -0,0 +1,208 @@
+name: Sync upstream doocs/md
+
+# Ticket #10: weekly cron + manual dispatch upstream sync.
+#
+# Flow: fetch upstream (doocs/md) → if upstream/main has commits not yet on
+# main, merge them into the `sync/upstream` branch in this workspace → run the
+# verify gate (same `pnpm wcli:verify` as publish-md-web-cli.yml, so the two
+# never disagree about what passes) → push the branch and open — or
+# force-update an already-open — PR into main whose body records the
+# verification result rendered from this run's actual outcome, plus this run
+# link. The human reviews the diff and merges manually; that merge is a real
+# push to main and triggers the publish chain (publish-md-web-cli.yml)
+# normally.
+#
+# The PR is created with GITHUB_TOKEN, so it carries no checks — events from
+# the default token do not trigger workflows. The verification that already
+# passed here, recorded in the PR body, is what the human merges on.
+#
+# Failure modes (all surface as job failure → GitHub's built-in Actions
+# notification; no PR is opened, nothing is pushed):
+#   1. Merge conflict   — "Merge upstream main" step fails.
+#   2. Build failure    — the build inside `pnpm wcli:verify` fails.
+#   3. Verify failure   — `pnpm wcli:verify` exits non-zero (the gate is red).
+#
+# While the gate is deliberately red (docs/adr/0003-single-verify-gate.md),
+# this workflow stays blocking on purpose: upstream merges are held until the
+# known differences are worked through.
+#
+# No new upstream commits → job exits successfully, no PR, no branch change.
+
+on:
+  schedule:
+    - cron: '0 3 * * 1' # every Monday 03:00 UTC
+  workflow_dispatch:
+
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
+permissions:
+  contents: write # push / force-update the sync branch
+  pull-requests: write # open and update the sync PR
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main (full history)
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0 # merge + ancestry check + force-update need history
+          persist-credentials: true # GITHUB_TOKEN push access for the sync branch
+
+      - name: Fetch upstream
+        run: |
+          git remote add upstream https://github.com/doocs/md.git
+          git fetch upstream main --no-tags
+          git fetch origin main --no-tags
+
+      - name: Check for new upstream commits
+        id: upstream
+        run: |
+          UPSTREAM_HEAD="$(git rev-parse upstream/main)"
+          echo "head=${UPSTREAM_HEAD}" >> "$GITHUB_OUTPUT"
+          if git merge-base --is-ancestor "${UPSTREAM_HEAD}" origin/main; then
+            echo "new=false" >> "$GITHUB_OUTPUT"
+            echo "No new upstream commits (upstream/main ${UPSTREAM_HEAD} already contained in main)."
+          else
+            echo "new=true" >> "$GITHUB_OUTPUT"
+            echo "New upstream commits detected; range main..${UPSTREAM_HEAD}:"
+            git log --oneline origin/main.."${UPSTREAM_HEAD}" || true
+          fi
+
+      - name: Stop early — nothing to sync
+        if: steps.upstream.outputs.new != 'true'
+        run: echo "Upstream is already fully merged into main; nothing to do."
+
+      - name: Create sync branch from main
+        if: steps.upstream.outputs.new == 'true'
+        run: |
+          git checkout -B sync/upstream origin/main
+
+      - name: Merge upstream main
+        # Failure here = failure mode 1 (merge conflict): git exits non-zero,
+        # the job fails, GitHub notifies, no PR is opened, main is untouched.
+        if: steps.upstream.outputs.new == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git merge --no-edit "upstream/main" \
+            -m "chore: merge upstream doocs/md at $(git rev-parse upstream/main)"
+
+      - name: Set up pnpm
+        # Mirror publish-md-web-cli.yml so both workflows run identical toolchain.
+        if: steps.upstream.outputs.new == 'true'
+        uses: pnpm/setup@v3
+        with:
+          version: 12.14.0
+          runtime: node@22
+          cache: true
+          install: false
+
+      - name: Install dependencies
+        # Failure here is surfaced as a build failure (failure mode 2).
+        # Upstream may have changed dependencies, breaking the frozen lockfile;
+        # fall back to a plain install and commit the refreshed lockfile with
+        # the merge so the PR is self-consistent.
+        if: steps.upstream.outputs.new == 'true'
+        run: |
+          pnpm config set store-dir ~/.pnpm-store
+          if ! pnpm install --frozen-lockfile; then
+            echo "::warning::pnpm install --frozen-lockfile failed — retrying without frozen lockfile (upstream dependency change)"
+            pnpm install --no-frozen-lockfile
+          fi
+
+      - name: Resolve Playwright version
+        if: steps.upstream.outputs.new == 'true'
+        id: playwright
+        run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Playwright browsers
+        if: steps.upstream.outputs.new == 'true'
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
+
+      - name: Install Playwright Chromium
+        if: steps.upstream.outputs.new == 'true'
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Verify rendering (wcli:verify)
+        id: verify
+        # Failure here = failure mode 2 or 3: the build inside the gate or the
+        # comparison failed. Job fails, GitHub notifies, no PR is opened, main
+        # is untouched.
+        if: steps.upstream.outputs.new == 'true'
+        run: |
+          set +e
+          pnpm wcli:verify 2>&1 | tee verify.log
+          STATUS=${PIPESTATUS[0]}
+          set -e
+          if [ "$STATUS" -ne 0 ]; then
+            # Recorded so the PR body can never claim a success that did not
+            # happen; this step exits before any PR step runs.
+            echo "result=FAILED" >> "$GITHUB_OUTPUT"
+            echo "::error::pnpm wcli:verify failed — nothing was pushed and no PR was opened"
+            exit "$STATUS"
+          fi
+          echo "result=PASSED" >> "$GITHUB_OUTPUT"
+
+      - name: Run package unit tests
+        if: steps.upstream.outputs.new == 'true'
+        run: pnpm --filter @dane.dai/md-web-cli test
+
+      - name: Push sync branch
+        # force-with-lease: a second dispatch while the PR is open re-creates
+        # the branch from the latest main and force-updates it — the open PR
+        # follows the branch, no duplicate is created.
+        if: steps.upstream.outputs.new == 'true' && steps.verify.outputs.result == 'PASSED'
+        run: git push --force-with-lease origin sync/upstream
+
+      - name: Open or update sync pull request
+        if: steps.upstream.outputs.new == 'true' && steps.verify.outputs.result == 'PASSED'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_LINK: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          UPSTREAM_HEAD: ${{ steps.upstream.outputs.head }}
+          VERIFY_RESULT: ${{ steps.verify.outputs.result }}
+        run: |
+          COMMIT_COUNT="$(git rev-list --count origin/main..upstream/main)"
+          RANGE="origin/main...${UPSTREAM_HEAD}"
+          # Rendered from the run's real outcome. A failed verification exits
+          # before this step, so this line can never claim a success that did
+          # not happen.
+          if [ "${VERIFY_RESULT}" = "PASSED" ]; then
+            VERIFY_LINE="✅ PASSED — \`pnpm wcli:verify\` (build + fresh Oracle + byte-exact comparison + structural assertions) and package unit tests are green in this workflow's sync workspace"
+          else
+            VERIFY_LINE="❌ ${VERIFY_RESULT:-NOT RUN} — \`pnpm wcli:verify\` did not pass; this pull request must not be merged"
+          fi
+          BODY=$(cat <<EOF
+          ## Upstream sync: doocs/md
+
+          Merge upstream \`doocs/md\` (\`${UPSTREAM_HEAD}\`) into \`main\`.
+
+          - **Upstream range:** \`${RANGE}\` (${COMMIT_COUNT} commit(s)) ([upstream commits](https://github.com/doocs/md/commits/main)):
+          $(git log --oneline --no-decorate origin/main.."${UPSTREAM_HEAD}" | sed 's/^/  - /' | head -20)
+          - **Verification:** ${VERIFY_LINE} ([run link](${RUN_LINK}))
+          - **Verification run:** ${RUN_LINK}
+
+          > The PR is created with the workflow's own token, so it carries no
+          > checks. The verification recorded above is this run's actual
+          > result in the sync workspace — that is what you merge on. Merging this PR is a real
+          > push to \`main\` and triggers the publish chain
+          > (\`publish-md-web-cli.yml\`) normally.
+          EOF
+          )
+          if gh pr view sync/upstream --json state >/dev/null 2>&1; then
+            gh pr edit sync/upstream --title "chore: sync upstream doocs/md" --body "$BODY"
+            echo "Force-updated existing sync PR."
+          else
+            gh pr create \
+              --base main \
+              --head sync/upstream \
+              --title "chore: sync upstream doocs/md" \
+              --body "$BODY"
+          fi
diff --git a/.gitignore b/.gitignore
index 9a7d0a83d2..84a7ec1822 100644
--- a/.gitignore
+++ b/.gitignore
@@ -66,3 +66,16 @@ dev-dist
 # uTools build artifacts
 apps/utools/dist
 apps/utools/release
+
+# Corepack cache, relocated inside the workspace when the home cache is not writable
+.corepack
+
+# Playwright browser cache relocated inside the workspace when the home cache is not writable
+.playwright-browsers
+
+# implement-spec worktrees
+.wt-ticket-*
+.pnpm-store/
+
+# local scratch docs (handoff notes, keep out of git)
+temp/
diff --git a/AGENTS.md b/AGENTS.md
index d5fd7c1654..81d262b94d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,17 +13,18 @@
 
 ## Monorepo 结构
 
-| 工作区           | 路径                  | 说明                                                                                                  |
-| ---------------- | --------------------- | ----------------------------------------------------------------------------------------------------- |
-| `@md/web`        | `apps/web`            | 主应用，Vue 3 + 浏览器扩展（WXT: Chrome/Firefox）                                                     |
-| `doocs-md`       | `apps/vscode`         | VS Code 扩展（webpack 构建，marketplace ID: `doocs.doocs-md`）                                        |
-| `@md/utools`     | `apps/utools`         | uTools 插件打包                                                                                       |
-| `@md/core`       | `packages/core`       | 核心 Markdown 渲染引擎（marked + 自定义扩展）                                                         |
-| `@md/shared`     | `packages/shared`     | 共享工具函数、配置、类型、编辑器配置                                                                  |
-| `@md/config`     | `packages/config`     | TypeScript 配置基础文件                                                                               |
-| `@doocs/md-cli`  | `packages/md-cli`     | CLI 工具（Express 服务托管构建产物）                                                                  |
-| `@md/mcp-server` | `packages/mcp-server` | MCP 服务，为 AI Agent 暴露接口                                                                        |
-| `@md/api`        | `apps/api`            | 后端 API：账户、云同步、计费、上传代理、分享、主题/组件市场、表情包（Cloudflare Workers + Hono + D1） |
+| 工作区                 | 路径                  | 说明                                                                                                  |
+| ---------------------- | --------------------- | ----------------------------------------------------------------------------------------------------- |
+| `@md/web`              | `apps/web`            | 主应用，Vue 3 + 浏览器扩展（WXT: Chrome/Firefox）                                                     |
+| `doocs-md`             | `apps/vscode`         | VS Code 扩展（webpack 构建，marketplace ID: `doocs.doocs-md`）                                        |
+| `@md/utools`           | `apps/utools`         | uTools 插件打包                                                                                       |
+| `@md/core`             | `packages/core`       | 核心 Markdown 渲染引擎（marked + 自定义扩展）                                                         |
+| `@md/shared`           | `packages/shared`     | 共享工具函数、配置、类型、编辑器配置                                                                  |
+| `@md/config`           | `packages/config`     | TypeScript 配置基础文件                                                                               |
+| `@doocs/md-cli`        | `packages/md-cli`     | CLI 工具（Express 服务托管构建产物）                                                                  |
+| `@md/mcp-server`       | `packages/mcp-server` | MCP 服务，为 AI Agent 暴露接口                                                                        |
+| `@md/api`              | `apps/api`            | 后端 API：账户、云同步、计费、上传代理、分享、主题/组件市场、表情包（Cloudflare Workers + Hono + D1） |
+| `@dane.dai/md-web-cli` | `packages/md-web-cli` | Fork-local 无浏览器渲染 CLI（esbuild 单文件零依赖 bundle，发布 npm）                                  |
 
 独立示例（不在 workspace 内）：`docs/examples/wechat-openapi-worker/` — 微信公众号 OpenAPI 代理 Worker。
 
@@ -151,6 +152,7 @@ Web 主应用与部分浏览器扩展 UI 支持 **zh-CN**、**zh-TW**、**en-US*
 - **提交信息 / PR 标题:** 遵循 Conventional Commits（`feat`、`fix`、`docs`、`style`、`refactor`、`perf`、`test`、`build`、`chore`），**一律使用英文**（见 `CONTRIBUTING.md`）
 - **分支命名:** `feat/description`、`fix/description`、`docs/description`；其他类型用 `<type>/`
 - **PR 说明:** 按 [`.github/pull_request_template.md`](./.github/pull_request_template.md) 填写；无关联 Issue 时不要写 Related Issue 占位符
+- **Fork-local 工作流:** 本 fork 自有改动（`md-web-cli` 包、其发布工作流与 fixture）直接推 `main`，不开 PR、不走上游 review；上游更新以 merge commit 进入 `main`。详见 [ADR-0001](./docs/adr/0001-fork-local-workflow.md)
 
 ## Skills
 
@@ -167,3 +169,17 @@ Reusable workflows live in [`.agents/skills/`](./.agents/skills/) (canonical). C
 | `wechat-svg` | WeChat SVG whitelist, bubbling-group interaction, paste compatibility (`/wechat-svg`) |
 
 Invoke manually: `/skill-name` in Cursor or Claude Code; OpenCode uses the `skill` tool.
+
+## Agent skills
+
+### Issue tracker
+
+Issues live in this repo's GitHub Issues (`DaneSpiritGOD/md`), via the `gh` CLI. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Default five canonical roles, label strings unchanged. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context: root `GLOSSARY.md` + `docs/adr/`. See `docs/agents/domain.md`.
diff --git a/GLOSSARY.md b/GLOSSARY.md
new file mode 100644
index 0000000000..89b1cba33c
--- /dev/null
+++ b/GLOSSARY.md
@@ -0,0 +1,41 @@
+# doocs/md
+
+A WeChat Markdown editor that renders Markdown into article HTML for the WeChat official account editor. This glossary covers the vocabulary of the fork-local headless rendering work.
+
+## Language
+
+**md-web-cli**:
+A headless Markdown-to-WeChat-ready-HTML converter shipped as a Node CLI from this fork.
+_Avoid_: renderer CLI, headless backend, md-to-richtext
+
+**WeChat-ready HTML**:
+HTML that pastes into the WeChat article editor without further processing: inline styles, no class attributes, no `<style>` blocks.
+_Avoid_: richtext, inlined HTML, clipboard HTML
+
+**Designer config**:
+The JSON produced by the `md.doocs.org` designer's import/export feature; the CLI's primary configuration input.
+_Avoid_: site config, theme JSON, export JSON
+
+**MCP schema JSON**:
+The render-parameter dialect of `@md/mcp-server`, accepted by the CLI as an alias dialect for Designer config.
+_Avoid_: MCP config, agent config
+
+**Renderer options**:
+The normalized internal parameter set the renderer consumes, named after the renderer (for example `citeStatus`), after any dialect has been normalized into it.
+_Avoid_: render flags, CLI options
+
+**Oracle**:
+The browser-rendered baseline produced at verification time: the clipboard HTML a real browser emits for a fixture through the application's own WeChat copy flow. Produced by a capability that writes only to a temporary directory and returns the HTML; never a committed artifact, never reused between runs.
+_Avoid_: reference output, baseline HTML, golden file
+
+**verify**:
+The single gate: build the bundle, capture a fresh Oracle, render the same fixture through the CLI, and compare the two outputs byte for byte with zero tolerance. Exits non-zero on any difference.
+_Avoid_: snapshot gate, fidelity check
+
+**Pending placeholder**:
+A marker the renderer leaves where asynchronous hydration has not completed — diagram loading text, a formula placeholder, an unregistered-language marker. The CLI treats any occurrence as a hard failure.
+_Avoid_: loading state, stub, TODO marker
+
+**Fork-local change**:
+A change that exists only in this fork and is never offered upstream.
+_Avoid_: local patch, downstream change
diff --git a/docs/adr/0001-fork-local-workflow.md b/docs/adr/0001-fork-local-workflow.md
new file mode 100644
index 0000000000..8fd2433cb5
--- /dev/null
+++ b/docs/adr/0001-fork-local-workflow.md
@@ -0,0 +1,15 @@
+# Fork-local development workflow
+
+This fork carries changes that are deliberately never offered to `doocs/md` upstream: a headless rendering CLI, its two release workflows, and its fixtures. We therefore develop fork-local: our own commits go straight to `main` with no pull request and no review cycle, while upstream arrives through a sync pull request — created by the sync workflow, verified there before it is opened, and merged by a human after reviewing the diff. Upstream is merged into ours rather than rebased.
+
+## Consequences
+
+- Every push to `main` is a release candidate. Anything that must not ship has to be gated before it lands, not after review.
+- Upstream's deploy and release workflows guard on `github.repository == 'doocs/md'`. Those guards are left untouched on purpose: flipping them would make the fork run upstream's infrastructure with secrets it does not have, failing every workflow at once. Fork-side verification runs through the unguarded CI workflow instead.
+- Upstream changes land through a sync pull request whose verification has already run in the sync workflow's workspace — the pull request itself carries no checks, because a pull request created with the workflow's own token triggers no workflows. The human review is the gate that verification cannot be: the verification gate catches breakage, not badness, and upstream visual changes need human judgment before they reach `main`.
+- A merge from upstream can conflict with fork-local files. When the sync workflow cannot produce a clean merge, it notifies and opens nothing; conflict resolution happens locally and the next sync run retries.
+
+## Considered Options
+
+- **Rebase onto upstream, keep fork changes as a patch series.** Rejected: every upstream change replays the whole series, and a conflict mid-series leaves the branch unbuildable rather than leaving a single merge to resolve.
+- **Offer changes upstream and track a release branch.** Rejected: review latency upstream would gate every fork release, and the CLI is not a change upstream has asked for.
diff --git a/docs/adr/0002-single-file-zero-dep-cli.md b/docs/adr/0002-single-file-zero-dep-cli.md
new file mode 100644
index 0000000000..0b144aa9d0
--- /dev/null
+++ b/docs/adr/0002-single-file-zero-dep-cli.md
@@ -0,0 +1,10 @@
+# Ship the CLI as a single file with zero runtime dependencies
+
+`md-web-cli` is published as one bundled file plus a manifest, with every dependency — the Markdown renderer, syntax highlighter, HTML sanitizer, and CSS inliner, together with their transitive dependencies — compiled into the bundle. Theme CSS and code-block themes are embedded at build time rather than read from disk or fetched at runtime.
+
+## Consequences
+
+- The CLI never touches the network. Both theme sources move to build time: theme CSS by importing the source files as text, and code-block themes by vendoring the presets the highlighter ships, because the upstream path fetches them from a CDN at runtime and a bundled file has no stable relative path to read from.
+- A consumer pins an exact version and gets byte-identical rendering. There is no transitive dependency range to drift and no CDN outage to interrupt a publish.
+- Upgrading the renderer, the sanitizer, or the inliner means rebuilding and republishing; nothing resolves at install time.
+- Bundling hides which upstream modules actually run, so a diagram extension imported but never invoked would silently bloat the bundle. The bundle entry deliberately omits the diagram extensions and fails hard on their input instead.
diff --git a/docs/adr/0003-single-verify-gate.md b/docs/adr/0003-single-verify-gate.md
new file mode 100644
index 0000000000..f5801782ee
--- /dev/null
+++ b/docs/adr/0003-single-verify-gate.md
@@ -0,0 +1,49 @@
+# One byte-exact `verify` gate replaces the three previous verification gates
+
+`md-web-cli` verification is a single command, `verify`: it builds the CLI bundle, captures a fresh Oracle from a real browser, renders the same fixture through the CLI, and compares the two outputs byte for byte with zero tolerance. It exits non-zero on any difference. The browser appears only inside this command; the Oracle is a runtime capability that writes to a temp directory and returns a string, never a committed artifact. The three previous gates — a one-off semantic diff, a recurring golden-snapshot comparison, and an on-demand Oracle rebuild — are deleted, along with the vocabulary that described them.
+
+## Consequences
+
+- The gate builds its own input. It never compares against a bundle on disk, so a changed rendering default cannot pass because nobody rebuilt by hand.
+- The Oracle is captured on every run from the current source. Nothing that the gate compares against can be stale, because nothing is stored between runs.
+- The comparison has no tolerance, no allow-list, no known-gaps list, and no expiry mechanism. A difference is a failure; there is nothing to configure and nothing to exempt.
+- Failure output is actionable rather than binary: a summary grouped by difference class with counts and locations, the complete unified diff, a total hunk count, and both rendered outputs plus the diff under a printed temporary path.
+- The command accepts the same Designer config the maintainer publishes with, projected down to render-affecting keys and fed identically to both sides. Article content carried in an export can never leak into the comparison.
+- The non-browser assertions the old verifier owned survive inside the comparator: no pending placeholders, and WeChat-ready output with inline styles. A reverse-case self-test corrupts a known-good render and asserts the gate rejects each mutant, so the gate's ability to fail is itself tested without a browser.
+- Two seams carry the gate's external behaviour: the `verify` process boundary (exit code, summary shape, artifacts written, and the config-projection case) and the site-default parity unit test. The structural helpers migrated from the retired verifier keep the unit coverage they already had. Rendered-output assertions live inside the byte comparison rather than in separate scripts.
+- The repository contains no Oracle HTML, no report, and no golden snapshot. Everything regenerable is produced into a temporary directory at run time.
+
+### The gate deliberately landed red
+
+The two implementations genuinely differ today, so the first landing is red. The residual differences measured with `class`/`id` set aside are six classes: an explicit body text colour on the CLI side, a table margin reset present only in the browser, an SVG `overflow` attribute set only by the browser, unitless versus pixel widths from the CSS inliner, link `href` normalisation performed by browser URL parsing, and a provenance comment only the old Oracle carried.
+
+A byte-exact comparison also reports the `class`/`id` difference itself: the browser's clipboard HTML keeps `class` and `id` attributes because WeChat strips them at paste time, while the CLI emits the post-paste form. That is a real product difference, not a measurement artefact, and it is one of the differences to be resolved after the gate produces output — either the CLI keeps the attributes or the comparison gains a machine-checked transform. The provenance comment, by contrast, is gone by construction: the Oracle capability returns the raw clipboard payload with nothing added.
+
+CI runs the gate as a non-blocking signal until those differences are worked through, so the diff is visible on every change without making every commit on `main` a red build. The publish and upstream-sync workflows run the same command and remain blocking: a red gate publishes nothing and holds the sync pull request. That is accepted for the scaffold period on purpose, not a malfunction — a red publish or sync job during this period means the gate is doing its job.
+
+**The acceptance ends when the difference classes are resolved and `verify` is green.** At that point the CI signal becomes blocking, and the transition from non-blocking to blocking is itself an explicit decision, recorded when it is made. It must not be inherited silently in either direction: neither the non-blocking CI step nor the accepted red in publish and sync is a permanent design.
+
+## Why tolerance is forbidden
+
+A tolerance is a decision that two different renderings are the same, made without looking at which difference it is swallowing. The previous comparator used a numeric tolerance of 0.5 on style values, so a line-height change from 1.75 to 1.8 compared as equal — a real visual regression passed the gate. That is not a near-miss; it is the failure mode the gate exists to prevent.
+
+Tolerance also destroys the gate's diagnostic value. Once a threshold is introduced, every future difference has to be argued against it, and the cheapest resolution is always to widen it slightly. An allow-list is worse: it turns a difference into a permanent exemption that nobody reads again. Both mechanisms make the gate's meaning depend on configuration rather than on the two implementations agreeing.
+
+If normalisation is ever needed — for example to strip an attribute that provably has no visual effect — it must be machine-checked code with tests proving it transforms rather than masks, and the decision must be recorded. That work is explicitly deferred out of this change; there is no normalisation, and no place in the comparator to put one today.
+
+## Why the Oracle became a capability
+
+A committed baseline drifts. The previous design stored accepted HTML in the repository and compared against it, so the artifact could be stale relative to the source, and regenerating it was a separate manual step that nothing on the gate path performed. Evidence kept in the repository also blurred two different things: the accepted baseline, and the instructions for the human acceptance step that cannot be automated. A stale Oracle looked like a current one.
+
+A capability cannot drift. It serves the built application, drives the real copy flow, waits on the application's own readiness signals, and returns the captured HTML. It writes only into a caller-supplied temporary directory, so there is no artifact to commit, refresh, or forget. Its contract is narrow and total: it builds nothing, so the caller must have built first; it fails loudly when the build is missing rather than emitting partial or empty output; and its browser executable is overridable by environment variable so a machine with a browser already installed does not download a second one.
+
+The cost is that a full run needs a browser. That cost is paid by the one command that needs it, not by the test suite: the reverse-case self-test and the defaults parity test are browser-free and run in seconds.
+
+## Considered Options
+
+- **Keep the golden snapshot and regenerate it inside the gate.** Rejected: the artifact stays committed, so it is still regenerable source in the repository, still stale between runs, and still a thing a human can accept by hand. Capturing at run time is strictly simpler and cannot drift.
+- **Compare after normalising both sides (strip classes, normalise URLs, coerce widths).** Rejected for now: each rule is a hand-written claim that a difference does not matter, which is the same judgement a tolerance makes, only spelled out. If normalisation is introduced later it must be machine-checked and tested as a transform, not adopted as an escape hatch.
+- **Keep the tolerance but shrink the number.** Rejected: any non-zero threshold is a class of differences declared acceptable without examining them, and the number invites widening.
+- **Run the Oracle rebuild as a separate workflow and compare against its committed output.** Rejected: this is the previous design that failed. It separates capture from comparison, so the artifact can be older than the source, and it makes the browser a recurring CI cost with committed output as its product.
+- **Make CI blocking on landing.** Rejected: the differences are real and unresolved, so every commit on `main` would be red before anyone can act on it. Non-blocking keeps the signal visible while the work proceeds, and the transition to blocking is recorded as a decision rather than inherited.
+- **Allow a known-gaps list so the gate can be green while differences remain.** Rejected: a known-gaps list is an allow-list with a story. It converts unresolved differences into permanent exemptions and hides progress instead of counting it.
diff --git a/docs/agents/domain.md b/docs/agents/domain.md
new file mode 100644
index 0000000000..a31025961d
--- /dev/null
+++ b/docs/agents/domain.md
@@ -0,0 +1,45 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+This repo is **single-context**: one `GLOSSARY.md` and one `docs/adr/` at the root, covering the whole monorepo (`apps/*` and `packages/*`).
+
+## Before exploring, read these
+
+- **`GLOSSARY.md`** at the repo root.
+- **`docs/adr/`**: read ADRs that touch the area you're about to work in.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+```
+/
+├── GLOSSARY.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+├── apps/
+│   ├── api/
+│   ├── utools/
+│   ├── vscode/
+│   └── web/
+└── packages/
+    ├── config/
+    ├── core/
+    ├── mcp-server/
+    ├── md-cli/
+    └── shared/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `GLOSSARY.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal: either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders), but worth reopening because…_
diff --git a/docs/agents/issue-tracker.md b/docs/agents/issue-tracker.md
new file mode 100644
index 0000000000..ab97ee19aa
--- /dev/null
+++ b/docs/agents/issue-tracker.md
@@ -0,0 +1,46 @@
+# Issue tracker: GitHub
+
+Issues and specs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+
+**Repo: `DaneSpiritGOD/md`.** This clone is a fork of `doocs/md`. `gh` infers the repo from the `origin` remote, which is correct, but pass `--repo DaneSpiritGOD/md` when a command runs outside the clone or when you need to be explicit. Never target `doocs/md` for issue operations unless the user asks for it: it is upstream, not this repo.
+
+## Conventions
+
+- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
+- **Read an issue**: `gh issue view <number> --json number,title,body,labels,comments`.
+- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
+- **Make an issue a sub-issue of a parent**: `gh issue create --parent <parent> ...`, or `gh issue edit <parent> --add-sub-issue <child>` afterwards (`gh` 2.94+). Older `gh`: `gh api --method POST repos/<owner>/<repo>/issues/<parent>/sub_issues -F sub_issue_id=<child-db-id>` (database id, as in **Blocking** below). Without sub-issues, put `Part of #<parent>` at the top of the child body.
+- **Comment on an issue**: `gh issue comment <number> --body "..."`
+- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
+- **Close**: `gh issue close <number> --comment "..."`
+
+## Pull requests as a triage surface
+
+**PRs as a request surface: no.** _(Set to `yes` if this repo treats external PRs as feature requests; `/triage` reads this flag.)_
+
+When set to `yes`, PRs run through the same labels and states as issues, using the `gh pr` equivalents:
+
+- **Read a PR**: `gh pr view <number> --comments` and `gh pr diff <number>` for the diff.
+- **List external PRs for triage**: `gh api --paginate 'repos/{owner}/{repo}/pulls?state=open' --jq '.[] | select(.author_association | IN("OWNER","MEMBER","COLLABORATOR") | not) | {number, title, author: .user.login, author_association, labels: [.labels[].name]}'`.
+- **Comment / label / close**: `gh pr comment`, `gh pr edit --add-label`/`--remove-label`, `gh pr close`.
+
+GitHub shares one number space across issues and PRs, so a bare `#42` may be either: resolve with `gh pr view 42` and fall back to `gh issue view 42`.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitHub issue in `DaneSpiritGOD/md`.
+
+## When a skill says "fetch the relevant ticket"
+
+Read it as in **Read an issue** above.
+
+## Wayfinding operations
+
+Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
+
+- **Map**: a single issue labelled `wayfinder:map`, holding the Notes / Decisions-so-far / Fog body. `gh issue create --label wayfinder:map`.
+- **Child ticket**: an issue linked to the map as a GitHub sub-issue (see **Make an issue a sub-issue of a parent**). Where sub-issues aren't enabled, add the child to a task list in the map body and put `Part of #<map>` at the top of the child body. Labels: `wayfinder:<type>` (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
+- **Blocking**: GitHub's **native issue dependencies**, the canonical, UI-visible representation. Add an edge with `gh api --method POST repos/<owner>/<repo>/issues/<child>/dependencies/blocked_by -F issue_id=<blocker-db-id>`, where `<blocker-db-id>` is the blocker's numeric **database id** (`gh api repos/<owner>/<repo>/issues/<n> --jq .id`, _not_ the `#number` or `node_id`). GitHub reports `issue_dependencies_summary.blocked_by` (open blockers only, the live gate). Where dependencies aren't available, fall back to a `Blocked by: #<n>, #<n>` line at the top of the child body. A ticket is unblocked when every blocker is closed.
+- **Frontier query**: list the map's open children (`gh issue list --state open`, scoped to the map's sub-issues / task list), drop any with an open blocker (`issue_dependencies_summary.blocked_by > 0`, or an open issue in the `Blocked by` line) or an assignee; first in map order wins.
+- **Claim**: `gh issue edit <n> --add-assignee @me`, the session's first write.
+- **Resolve**: `gh issue comment <n> --body "<answer>"`, then `gh issue close <n>`, then append a context pointer (gist + link) to the map's Decisions-so-far.
diff --git a/docs/agents/triage-labels.md b/docs/agents/triage-labels.md
new file mode 100644
index 0000000000..5276464244
--- /dev/null
+++ b/docs/agents/triage-labels.md
@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the "Label in our tracker" column to match whatever vocabulary you actually use.
diff --git a/docs/architecture.md b/docs/architecture.md
index 0d8a18d19b..2ef38874dc 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -4,17 +4,18 @@
 
 ## Monorepo 结构
 
-| 包               | 路径                  | 职责                                                                                            |
-| ---------------- | --------------------- | ----------------------------------------------------------------------------------------------- |
-| `@md/web`        | `apps/web`            | Vue 3 主应用、WXT 浏览器扩展（Chrome/Firefox）、CF Workers 部署                                 |
-| `@md/api`        | `apps/api`            | 账户、云同步、计费、上传代理、分享链接、主题/组件市场、表情包（Cloudflare Workers + Hono + D1） |
-| `doocs-md`       | `apps/vscode`         | VS Code 扩展（webpack 构建，marketplace ID 为 `doocs.doocs-md`）                                |
-| `@md/utools`     | `apps/utools`         | uTools 插件打包壳（构建产物来自 `@md/web`）                                                     |
-| `@md/core`       | `packages/core`       | Markdown → HTML 渲染引擎                                                                        |
-| `@md/shared`     | `packages/shared`     | 配置、类型、CodeMirror 编辑器封装、主题 CSS                                                     |
-| `@md/config`     | `packages/config`     | 共享 TypeScript 配置                                                                            |
-| `@doocs/md-cli`  | `packages/md-cli`     | 已发布 npm CLI（Express 静态服务）                                                              |
-| `@md/mcp-server` | `packages/mcp-server` | MCP 服务（`render_markdown` 等工具）                                                            |
+| 包                     | 路径                  | 职责                                                                                            |
+| ---------------------- | --------------------- | ----------------------------------------------------------------------------------------------- |
+| `@md/web`              | `apps/web`            | Vue 3 主应用、WXT 浏览器扩展（Chrome/Firefox）、CF Workers 部署                                 |
+| `@md/api`              | `apps/api`            | 账户、云同步、计费、上传代理、分享链接、主题/组件市场、表情包（Cloudflare Workers + Hono + D1） |
+| `doocs-md`             | `apps/vscode`         | VS Code 扩展（webpack 构建，marketplace ID 为 `doocs.doocs-md`）                                |
+| `@md/utools`           | `apps/utools`         | uTools 插件打包壳（构建产物来自 `@md/web`）                                                     |
+| `@md/core`             | `packages/core`       | Markdown → HTML 渲染引擎                                                                        |
+| `@md/shared`           | `packages/shared`     | 配置、类型、CodeMirror 编辑器封装、主题 CSS                                                     |
+| `@md/config`           | `packages/config`     | 共享 TypeScript 配置                                                                            |
+| `@doocs/md-cli`        | `packages/md-cli`     | 已发布 npm CLI（Express 静态服务）                                                              |
+| `@md/mcp-server`       | `packages/mcp-server` | MCP 服务（`render_markdown` 等工具）                                                            |
+| `@dane.dai/md-web-cli` | `packages/md-web-cli` | Fork-local 无浏览器渲染 CLI（esbuild 单文件 bundle，主题/高亮 CSS 构建期内联，零网络）          |
 
 独立示例（不在 pnpm workspace 内）：
 
diff --git a/eslint.config.mjs b/eslint.config.mjs
index e44ea35a43..994eebb700 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -4,7 +4,10 @@ export default antfu({
   vue: true,
   typescript: true,
   formatters: true,
-  ignores: [`.github`, `scripts`, `docker`, `packages/md-cli`, `src/assets`, `example`, `apps/web/src/assets/example/`],
+  // `scripts` stays ignored to match upstream. Upstream never lints it, and
+  // un-ignoring it here surfaced pre-existing errors in files this fork does
+  // not own (see issue #15).
+  ignores: [`.github`, `scripts`, `docker`, `packages/md-cli`, `src/assets`, `example`, `apps/web/src/assets/example/`, `packages/md-web-cli/fixtures/`],
 }, {
   rules: {
     'semi': [`error`, `never`],
diff --git a/package.json b/package.json
index b0f2e849bf..fe138552f3 100644
--- a/package.json
+++ b/package.json
@@ -26,11 +26,12 @@
     "cli": "pnpm --filter @doocs/md-cli",
     "build:cli": "pnpm web build && npx shx rm -rf packages/md-cli/dist && npx shx rm -rf dist/**/*.map && npx shx cp -r apps/web/dist packages/md-cli/ && cd packages/md-cli && npm pack",
     "release:cli": "node ./scripts/release.js",
+    "wcli:verify": "node scripts/verify.mjs",
     "lint": "eslint . --fix",
     "type-check": "pnpm type-check:web && pnpm type-check:packages",
     "type-check:web": "pnpm --filter @md/web run type-check",
-    "type-check:packages": "pnpm --filter @md/core --filter @md/shared --filter @md/api --filter @md/mcp-server run type-check && pnpm --prefix ./apps/vscode run type-check",
-    "test": "pnpm --filter @md/shared test && pnpm --filter @md/core test && pnpm --filter @md/web test && pnpm --filter @md/api test",
+    "type-check:packages": "pnpm --filter @md/core --filter @md/shared --filter @md/api --filter @md/mcp-server --filter @dane.dai/md-web-cli run type-check && pnpm --prefix ./apps/vscode run type-check",
+    "test": "pnpm --filter @md/shared test && pnpm --filter @md/core test && pnpm --filter @md/web test && pnpm --filter @md/api test && pnpm --filter @dane.dai/md-web-cli test",
     "postinstall": "simple-git-hooks",
     "inspector": "pnpx node-modules-inspector",
     "utools:package": "node ./scripts/package-utools.mjs"
@@ -42,6 +43,7 @@
     "eslint": "^10.13.0",
     "eslint-plugin-format": "^2.0.1",
     "lint-staged": "^17.6.0",
+    "playwright": "^1.64.1",
     "prettier": "2.8.8",
     "shx": "^0.4.0",
     "simple-git-hooks": "^2.14.0",
diff --git a/packages/md-web-cli/README.md b/packages/md-web-cli/README.md
new file mode 100644
index 0000000000..a73e7c52bf
--- /dev/null
+++ b/packages/md-web-cli/README.md
@@ -0,0 +1,33 @@
+# @dane.dai/md-web-cli
+
+Browserless [doocs/md](https://github.com/doocs/md) rendering CLI — a
+single-file, zero-dependency Node bundle that renders Markdown to
+WeChat-compatible HTML without a browser.
+
+## Install
+
+```bash
+npm install -g @dane.dai/md-web-cli
+```
+
+Requires Node >= 22.22.2.
+
+## Usage
+
+```bash
+md-web-cli render <input.md> -o output.html
+md-web-cli --help
+```
+
+## Documentation
+
+Full documentation lives in [`docs/`](./docs/README.md):
+
+- [The `verify` gate](./docs/verify.md) — one command, byte-exact comparison
+- [Manual WeChat check](./docs/manual-wechat-check.md) — the one human step
+- [Known blind spots](./docs/blind-spots.md) — what a green result does not mean
+- [Fixtures](./fixtures/README.md) — the product signal and the infrastructure probe
+
+## License
+
+MIT
diff --git a/packages/md-web-cli/docs/README.md b/packages/md-web-cli/docs/README.md
new file mode 100644
index 0000000000..0634d3fe4c
--- /dev/null
+++ b/packages/md-web-cli/docs/README.md
@@ -0,0 +1,64 @@
+# md-web-cli documentation
+
+Everything about `@dane.dai/md-web-cli` lives here.
+
+| Document                                           | Read it for                                                           |
+| -------------------------------------------------- | --------------------------------------------------------------------- |
+| [verify.md](./verify.md)                           | The `verify` gate: what it does, how to run it, how to read a failure |
+| [manual-wechat-check.md](./manual-wechat-check.md) | The one human step: pasting both outputs into the real WeChat editor  |
+| [blind-spots.md](./blind-spots.md)                 | What the gate cannot see, so a green result is never over-read        |
+| [fixtures](../fixtures/README.md)                  | The product fixture and the infrastructure probe                      |
+
+## Install
+
+```bash
+npm install -g @dane.dai/md-web-cli
+```
+
+Requires Node >= 22.22.2. The published package is a single bundled file with
+no runtime dependencies.
+
+## Usage
+
+```bash
+md-web-cli render <input.md> -o output.html
+md-web-cli --help
+```
+
+`render` writes WeChat-ready HTML: inline styles, no `<style>` block, no class
+attributes. Pending async content (diagrams, formulas, unregistered code
+languages) is a hard failure rather than silent residue.
+
+Configuration comes from the Designer export JSON that `md.doocs.org` produces:
+
+```bash
+md-web-cli render notes.md -o notes.html --config my-designer-export.json
+```
+
+Individual values can be overridden with flags (`--theme`, `--primary-color`,
+`--font-size`, `--code-theme`, …); config-file values take precedence over
+defaults, and flags over the config file.
+
+## Verify
+
+```bash
+pnpm wcli:verify                 # both fixtures, from the repository root
+pnpm wcli:verify --fixture full  # one fixture while debugging
+pnpm wcli:verify --self-test     # prove the gate can still fail (no browser)
+```
+
+Exit code 0 means the browser's WeChat copy output and the CLI's output are
+byte-identical. See [verify.md](./verify.md) for failure output, artifact
+handling, config projection, and the browser override.
+
+## Development
+
+```bash
+pnpm install
+pnpm --filter @dane.dai/md-web-cli build
+pnpm --filter @dane.dai/md-web-cli test
+```
+
+## License
+
+MIT
diff --git a/packages/md-web-cli/docs/blind-spots.md b/packages/md-web-cli/docs/blind-spots.md
new file mode 100644
index 0000000000..fdbbc7bd07
--- /dev/null
+++ b/packages/md-web-cli/docs/blind-spots.md
@@ -0,0 +1,79 @@
+# Known blind spots
+
+A green `verify` result means the CLI's output is byte-identical to the
+browser's WeChat copy output for the fixtures. That is a strong statement about
+two implementations, and a weak one about the product. These are the gaps it
+does not cover.
+
+## No diagram SVG pipeline in the CLI
+
+The browser runs a real SVG pipeline for Mermaid, PlantUML, and infographic
+diagrams (WeChat-specific SVG sanitising, label promotion, size attributes).
+The CLI has none: `@md/core` is bundled without the diagram extensions, so
+diagram input fails hard with "cannot be rendered offline" instead of producing
+slightly different SVG.
+
+The absence is therefore **latent**: no fixture can reach it, and a green gate
+says nothing about diagrams. Tracked in
+[milestone issue #18](https://github.com/DaneSpiritGOD/md/issues/18). When a
+diagram pipeline lands, add a diagram fixture — the gate will then hold it to the
+same byte-exact bar.
+
+## No automated real-device paste
+
+WeChat's editor is a third implementation: it strips class attributes, rewrites
+some styles, and re-flows images. Nothing in this repository pastes output into
+WeChat. That step is human and remains so —
+see [manual-wechat-check.md](./manual-wechat-check.md).
+
+## The gate is red today, by design
+
+The two implementations differ, and the gate reports those differences rather
+than hiding them. Known classes, in the order they dominate the output:
+
+- **`class` and `id` attributes.** The browser's clipboard HTML keeps them
+  (WeChat strips them at paste time); the CLI emits the post-paste form. This is
+  a product difference to be resolved — either the CLI keeps the attributes or
+  the comparison gains a machine-checked transform — not a measurement artefact.
+- **Body text colour.** The CLI sets an explicit `color: rgb(10,10,10)` on the
+  root section; the browser inherits it from the preview panel. Needs a product
+  decision, not a whitelist.
+- **Table margin reset.** The browser emits `margin-top: 0 !important` on tables.
+- **SVG `overflow` attribute.** The browser sets `overflow="visible"`; the CLI
+  omits it. No visual consequence, which is why it is deferred rather than
+  guessed at.
+- **Unitless versus pixel widths.** The CSS inliner gives the CLI `width="45px"`
+  where the browser has `width="45"`.
+- **Link `href` normalisation.** The browser's URL parsing adds a trailing
+  slash; the CLI keeps the authored URL.
+
+See [ADR-0003](../../../docs/adr/0003-single-verify-gate.md) for why none of
+these may be papered over with a tolerance or an allow-list.
+
+## Code-block themes outside the vendored ten
+
+The application offers 73 highlight.js themes; the CLI vendors ten. Any other
+theme — including valid values in an unmodified Designer export — makes the CLI
+abort with an "unknown code block theme" error rather than render slightly
+differently. That is deliberate (hard failure over silent drift) but it narrows
+which configurations the gate can verify.
+
+## Network at capture time
+
+The browser copy flow fetches the code-block stylesheet from a CDN and inlines
+it. Offline, it silently inlines nothing, so the comparison goes red for an
+infrastructure reason. If a failure is CSS-only and the machine is offline, check
+that first.
+
+## Marketplace themes
+
+A marketplace theme is not installed in the fresh browser and is not known to the
+CLI, so both sides would fall back to their defaults and "agree" by coincidence.
+`--config` refuses a theme outside `default` / `grace` / `simple` for that
+reason.
+
+## No screenshot or pixel comparison
+
+The gate compares HTML, not pixels. A difference that survives WeChat's
+sanitizer identically on both sides will pass even if it looks wrong — that is
+the product fixture's job to catch, and the human paste check's job to confirm.
diff --git a/packages/md-web-cli/docs/manual-wechat-check.md b/packages/md-web-cli/docs/manual-wechat-check.md
new file mode 100644
index 0000000000..70b8d4791a
--- /dev/null
+++ b/packages/md-web-cli/docs/manual-wechat-check.md
@@ -0,0 +1,67 @@
+# Manual WeChat check
+
+The gate compares two implementations. Neither has been pasted into a real
+WeChat editor by an automated check, so one step is still human: paste each
+output into the 公众号 editor and compare what WeChat actually renders.
+
+Do this when a visual change is intentional, when a difference class has just
+been resolved, and before a release that matters.
+
+## 1. Produce the two artifacts
+
+```bash
+pnpm wcli:verify --fixture full --keep
+```
+
+The gate prints where it wrote its artifacts. A red result is expected while
+differences remain — the artifacts are produced either way. Note the printed
+directory:
+
+```
+[verify] artifacts: /tmp/md-verify-XXXX
+[verify] oracle: /tmp/md-verify-XXXX/full/oracle.html
+[verify] cli:    /tmp/md-verify-XXXX/full/cli.html
+```
+
+- `oracle.html` — what the browser's WeChat copy flow puts on the clipboard.
+- `cli.html` — what the CLI produces for the same fixture.
+
+## 2. Paste both
+
+1. Open the WeChat 公众号 editor (`mp.weixin.qq.com`) in a desktop browser.
+2. Open `cli.html` in **another browser tab** — the file is HTML with inline
+   styles, so copying from a text editor would paste markup instead of a
+   rendered article. Select all in the rendered page, copy, and paste into the
+   editor body. Screenshot the result.
+3. Clear the editor. Repeat with `oracle.html`. Screenshot the result.
+4. Compare the two screenshots side by side, or open both in two windows.
+
+If the pasted result looks like raw HTML source, the copy came from the file
+rather than the rendered page; start again from step 2.
+
+## 3. What to look for
+
+- **h2 pill:** white text on the `#0F4C81` blue background, centred.
+- **blockquote:** 4px `#0F4C81` left border, grey `#f7f7f7` background.
+- **code blocks:** dark `#0d1117` background, mac-style three-dot title bar,
+  readable syntax colours.
+- **strong text:** `#0F4C81`.
+- **body text:** near-black (`rgb(10,10,10)`).
+- **links:** WeChat blue `#576b95`.
+- **image captions:** alt text centred under each image.
+- **tables:** thin grey borders, no horizontal overflow.
+- **overall rhythm:** spacing between blocks looks the same in both pastes.
+
+The gate's byte comparison cannot answer any of these. WeChat's editor is a
+third implementation with its own sanitizer, and it is the only one the reader
+ever sees.
+
+## 4. Record the outcome
+
+Comment on the md-web-cli tracking issue ([#1](https://github.com/DaneSpiritGOD/md/issues/1))
+with the verdict — match, or mismatch plus which of the points above differed —
+and attach both screenshots. If something mismatches, open an issue naming the
+element and the observed difference; a screenshot is required.
+
+There is no committed evidence directory any more. The artifacts above are
+regenerable output, not source; do not commit them.
diff --git a/packages/md-web-cli/docs/verify.md b/packages/md-web-cli/docs/verify.md
new file mode 100644
index 0000000000..73fc8d2a95
--- /dev/null
+++ b/packages/md-web-cli/docs/verify.md
@@ -0,0 +1,144 @@
+# The `verify` gate
+
+One command, one meaning:
+
+```bash
+pnpm wcli:verify
+```
+
+It builds both workspaces itself, captures a fresh Oracle from a real browser,
+renders the same fixture through the CLI, and compares the two outputs **byte
+for byte with zero tolerance**. Exit code 0 only on exact equality.
+
+There is no tolerance, no allow-list, no known-gaps list, and no expiry
+mechanism — by design. See [ADR-0003](../../../docs/adr/0003-single-verify-gate.md)
+for why a threshold is worse than a failure.
+
+## Invocation
+
+```bash
+pnpm wcli:verify                          # both fixtures
+pnpm wcli:verify --fixture full           # product signal only
+pnpm wcli:verify --fixture minimal        # infrastructure probe only
+pnpm wcli:verify --config export.json     # gate on the config you publish with
+pnpm wcli:verify --keep                   # keep the artifacts
+pnpm wcli:verify --out-dir /tmp/verify    # keep them somewhere specific
+pnpm wcli:verify --self-test              # reverse cases, no browser
+```
+
+`--config` accepts an unmodified Designer export (the JSON the web application's
+import/export feature produces). It is projected down to render-affecting keys
+and the **same projected file** is given to both sides, so a config-driven
+difference cannot masquerade as an implementation difference.
+
+- **Kept:** `theme`, `primaryColor`, `fontFamily`, `fontSize`, `isUseIndent`,
+  `isUseJustify`, `legend`, `isCiteStatus`, `isCountStatus`, `isMacCodeBlock`,
+  `isShowLineNumber`, `codeBlockTheme`, `cssContentConfig`.
+- **Dropped:** article content (`posts`, `currentPostId`, `currentPostIndex`,
+  `titleList`, `readingTime`) and pure-UI state (panel/dialog visibility, editor
+  dark mode, toolbox visibility). An export can never make the gate compare an
+  article instead of the fixture.
+- **Absent by design:** the five style keys a Designer export cannot carry —
+  `lineHeight`, `blockSpacing`, `linkColor`, `blockquoteBackground`,
+  `headingStyles`. Each side falls back to its own site defaults, and a unit
+  test asserts those defaults agree.
+- **Code-block theme:** a CDN URL is passed through unchanged and normalised by
+  the CLI to the same theme identity the browser uses. Only the ten vendored
+  themes are renderable by the CLI; see [blind-spots.md](./blind-spots.md).
+
+## Fixtures
+
+| Fixture               | Meaning                                                                                                                               |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `fixtures/full.md`    | Product signal: headings, tables, code blocks, lists, blockquotes, images, links, rules                                               |
+| `fixtures/minimal.md` | Infrastructure probe: heading, paragraph, inline code. A failure means the harness is broken; a success proves nothing about fidelity |
+
+Both run by default so one command produces both signals. See
+[fixtures/README.md](../fixtures/README.md).
+
+## Reading a failure
+
+```
+[verify] FAIL full (product signal): outputs are not byte-identical (oracle 20161 bytes, CLI 17755 bytes, first difference at byte 75)
+[verify] a difference here is a product fidelity difference
+[verify] difference classes (6 hunks total):
+  attribute:class             6 hunks   lines 3, 53, 74, 95, 113, 128
+  style:color                 1 hunks   lines 3
+  ...
+[verify] complete unified diff:
+...
+[verify] total: 6 hunks across 8 class(es)
+[verify] oracle: /tmp/md-verify-XXXX/full/oracle.html
+[verify] cli:    /tmp/md-verify-XXXX/full/cli.html
+[verify] diff:   /tmp/md-verify-XXXX/full/diff.txt
+```
+
+Classes are derived mechanically from what differs — `attribute:<name>`,
+`style:<property>`, `text`, `element`, `structure` — so the summary says whether
+the failure is a class-attribute difference or a real style drift. A hunk can
+belong to more than one class.
+
+Artifacts land in a fresh temporary directory whose path is printed: both
+rendered outputs, the unified diff, and a summary report. They are removed at
+exit unless `--keep` or `--out-dir` is given. `--out-dir` must be outside the
+repository — the Oracle capability refuses to write repo paths, so no
+regenerable artifact can be committed.
+
+## Structural assertions
+
+Independent of the byte comparison, the gate fails when the CLI output carries:
+
+- a pending async placeholder — diagram (`data-md-diagram-state="loading"`),
+  formula (`.katex-pending`), or unregistered code language
+  (`data-language-pending`);
+- a `<style>` block, a `class` attribute, or a block-level element without an
+  inline style (`tr`/`tbody`/`thead`/`svg` are exempt: WeChat formats them
+  structurally).
+
+## Self-test
+
+```bash
+pnpm wcli:verify --self-test
+```
+
+Corrupts a known-good CLI render seven distinct ways — injected diagram,
+formula, and language placeholders, stripped inline styles, a leaked class
+attribute, an injected style block, and truncation — and asserts each mutant is
+rejected. It launches no browser and builds only the CLI bundle, so it doubles
+as the fast suite's proof that the gate can fail.
+
+## Freshness guarantees
+
+- The gate builds both workspaces inside the command. It never compares against
+  a previously built bundle, so a changed rendering default cannot pass because
+  nobody rebuilt.
+- The Oracle is captured on every run into a temporary directory. Nothing that
+  the gate compares against is stored between runs, so no baseline can go stale.
+
+## Browser
+
+Playwright Chromium is installed by the workflows. To use a browser that is
+already on the machine instead of downloading one, point the executable at it:
+
+```bash
+MD_WEB_CLI_CHROMIUM="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+  pnpm wcli:verify
+```
+
+Where Playwright looks for its browsers can be redirected with
+`PLAYWRIGHT_BROWSERS_PATH`. The capture is deterministic and cross-platform:
+two Chromium builds on two operating systems produce byte-identical Oracle HTML.
+
+## Status in CI
+
+- **CI** runs the gate on every push and pull request as a **non-blocking**
+  signal, with the browser cached on the Playwright version. A red gate is
+  visible in the log and does not fail the job; an infrastructure failure around
+  it (the browser download, for instance) still fails CI.
+- **Publish** and **upstream sync** run the same command and are **blocking**: a
+  red gate publishes nothing and holds the sync pull request.
+
+The gate landed **red on purpose** — the two implementations differ today. The
+transition from non-blocking to blocking is an explicit decision, recorded when
+it happens. Do not restore a tolerance to make it green; work the differences
+off one class at a time. See [ADR-0003](../../../docs/adr/0003-single-verify-gate.md).
diff --git a/packages/md-web-cli/fixtures/README.md b/packages/md-web-cli/fixtures/README.md
new file mode 100644
index 0000000000..3bbb6fc9b4
--- /dev/null
+++ b/packages/md-web-cli/fixtures/README.md
@@ -0,0 +1,38 @@
+# Fixtures
+
+Two inputs for the `verify` gate, with different meanings.
+
+## `full.md` — the product signal
+
+Exercises every rendering surface the CLI supports: h1–h6, tables with
+alignment, fenced code blocks in several languages, nested lists, nested
+blockquotes, images with and without titles, inline code, strong/emphasis/
+strikethrough, links, and horizontal rules. A difference here is a product
+fidelity difference; this is the fixture the gate exists for.
+
+## `minimal.md` — an infrastructure probe
+
+A heading, a paragraph, and inline code. Nothing else: no tables, diagrams,
+formulas, images, or links. It isolates the harness from the product.
+
+**Read its result strictly one way.** A *failure* means the harness is broken —
+the browser capture, the CLI render, or the comparison — which is a strong and
+useful signal. A *pass* proves nothing about product fidelity, because the
+fixture barely exercises the renderer. Never cite a green `minimal` run as
+evidence that the CLI matches the site.
+
+Both fixtures run by default so one command produces both signals; `--fixture`
+restricts a run to one while debugging. See the gate's documentation for
+invocation.
+
+### Reading a probe failure
+
+Check where it stopped:
+
+- **Before the comparison** — an error, a timeout, an empty capture, or a
+  missing build: the harness is broken. This is the strong signal the probe
+  exists to give.
+- **At the comparison** — a byte difference: the probe is reporting the same
+  product difference `full.md` reports. The CLI strips `class`/`id` attributes
+  and the browser's clipboard HTML keeps them, so this difference is present at
+  every scale and is not by itself evidence that the harness broke.
diff --git a/packages/md-web-cli/fixtures/full.md b/packages/md-web-cli/fixtures/full.md
new file mode 100644
index 0000000000..ec9bb8bdb3
--- /dev/null
+++ b/packages/md-web-cli/fixtures/full.md
@@ -0,0 +1,101 @@
+# Full-coverage fixture: h1-h6, tables, multi-language code blocks, nested lists, blockquotes, images, horizontal rules
+
+# Heading 1
+
+## Heading 2
+
+### Heading 3
+
+#### Heading 4
+
+##### Heading 5
+
+###### Heading 6
+
+This is a paragraph with **bold**, _italic_, ~~strikethrough~~, `inline code` and a [link](https://example.com).
+
+## Table
+
+| Feature | Supported | Notes          |
+| ------- | --------- | -------------- |
+| Tables  | Yes       | With alignment |
+| Images  | Yes       | See below      |
+| Code    | Yes       | Multi-language |
+
+## Code Blocks
+
+```javascript
+function greet(name) {
+  const message = `Hello, ${name}!`
+  console.log(message)
+}
+greet('WeChat')
+```
+
+```python
+def greet(name: str) -> None:
+    message = f"Hello, {name}!"
+    print(message)
+
+greet("WeChat")
+```
+
+```css
+.md-web-cli {
+  color: #0f4c81;
+  font-size: 16px;
+}
+```
+
+```bash
+pnpm install && pnpm run build
+```
+
+```json
+{ "name": "md-web-cli", "private": true }
+```
+
+## Nested Lists
+
+- Level one
+  - Level two
+    - Level three
+      - Level four
+  - Back to level two
+- Ordered inside unordered
+  1. First
+  2. Second
+     1. Nested first
+     2. Nested second
+
+1. Ordered level one
+   1. Ordered level two
+      1. Ordered level three
+
+## Blockquotes
+
+> A single-level blockquote with **emphasis**.
+
+> First level
+>
+> > Second level
+> >
+> > > Third level
+
+## Images
+
+![Fixture landscape](https://example.com/images/fixture-landscape.png)
+
+![Fixture portrait](https://example.com/images/fixture-portrait.png 'Portrait with title')
+
+## Horizontal Rules
+
+---
+
+---
+
+---
+
+## Closing
+
+The fixture ends here. Tickets 04/05 reuse this file.
diff --git a/packages/md-web-cli/fixtures/minimal.md b/packages/md-web-cli/fixtures/minimal.md
new file mode 100644
index 0000000000..8cb1aff8a5
--- /dev/null
+++ b/packages/md-web-cli/fixtures/minimal.md
@@ -0,0 +1,3 @@
+# Minimal fixture: heading, paragraph, inline code
+
+A paragraph with `inline code` so the body and code-span styles are exercised.
diff --git a/packages/md-web-cli/package.json b/packages/md-web-cli/package.json
new file mode 100644
index 0000000000..fdc6751d96
--- /dev/null
+++ b/packages/md-web-cli/package.json
@@ -0,0 +1,36 @@
+{
+  "name": "@dane.dai/md-web-cli",
+  "type": "module",
+  "version": "0.1.0",
+  "description": "Browserless doocs/md rendering CLI — single-file, zero-dependency Node bundle",
+  "license": "MIT",
+  "bin": {
+    "md-web-cli": "dist/cli.js"
+  },
+  "files": [
+    "README.md",
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.22.2"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "pretest": "node scripts/build.mjs",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "type-check": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@md/config": "workspace:*",
+    "@md/core": "workspace:*",
+    "@md/shared": "workspace:*",
+    "@types/jsdom": "^30.0.0",
+    "@types/node": "catalog:",
+    "esbuild": ">=0.28.2",
+    "jsdom": "^30.1.3",
+    "juice": "^12.2.0",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  }
+}
diff --git a/packages/md-web-cli/scripts/build.mjs b/packages/md-web-cli/scripts/build.mjs
new file mode 100644
index 0000000000..4a27e4e60e
--- /dev/null
+++ b/packages/md-web-cli/scripts/build.mjs
@@ -0,0 +1,79 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { build } from 'esbuild'
+
+const root = path.dirname(fileURLToPath(import.meta.url))
+
+await build({
+  entryPoints: [path.join(root, '../src/cli.ts')],
+  bundle: true,
+  platform: 'node',
+  format: 'esm',
+  target: 'node22',
+  outfile: path.join(root, '../dist/cli.js'),
+  // Single-file, zero-dependency bundle: inline everything, including CSS as
+  // text. `.css?raw` keeps the suffix the source uses for Vite/vitest parity.
+  loader: { '.css': 'text' },
+  external: [],
+  packages: 'bundle',
+  minify: false,
+  sourcemap: false,
+  banner: {
+    // Shebang for the bin entry, plus CJS shims: bundled CJS deps (jsdom via
+    // isomorphic-dompurify) use require()/__dirname at runtime.
+    js: [
+      '#!/usr/bin/env node',
+      `import { createRequire as __createRequire } from 'node:module'`,
+      `import { fileURLToPath as __fileURLToPath } from 'node:url'`,
+      `import * as __path from 'node:path'`,
+      `const require = __createRequire(${JSON.stringify(path.join(root, '../core/package.json'))})`,
+      `const __filename = __fileURLToPath(import.meta.url)`,
+      `const __dirname = __path.dirname(__filename)`,
+    ].join('\n'),
+  },
+  plugins: [
+    {
+      name: 'jsdom-default-stylesheet',
+      setup(build) {
+        build.onLoad(
+          { filter: /jsdom[\\/]lib[\\/]jsdom[\\/]living[\\/]css[\\/]helpers[\\/]computed-style\.js$/ },
+          async (args) => {
+            const jsdomRoot = args.path.slice(0, args.path.lastIndexOf(`lib${path.sep}jsdom`))
+            let source = await fs.promises.readFile(args.path, 'utf-8')
+            source = source.replace(
+              `path.resolve(__dirname, "../../../browser/default-stylesheet.css")`,
+              JSON.stringify(path.join(jsdomRoot, 'lib', 'jsdom', 'browser', 'default-stylesheet.css')),
+            )
+            return { contents: source, loader: 'js' }
+          },
+        )
+      },
+    },
+    {
+      // jsdom lazily require.resolve()s its xhr sync worker relative to its own
+      // install; outside the bundle that path doesn't exist. Rewrite the
+      // resolution to an absolute path (the worker is never spawned for our
+      // rendering flow, so only resolution must succeed).
+      name: 'jsdom-xhr-sync-worker',
+      setup(build) {
+        build.onLoad(
+          { filter: /jsdom[\\/]lib[\\/]jsdom[\\/]living[\\/]xhr[\\/]XMLHttpRequest-impl\.js$/ },
+          async (args) => {
+            const dir = path.dirname(args.path)
+            let source = await fs.promises.readFile(args.path, 'utf-8')
+            source = source.replace(
+              `require.resolve("./xhr-sync-worker.js")`,
+              JSON.stringify(path.join(dir, 'xhr-sync-worker.js')),
+            )
+            return { contents: source, loader: 'js' }
+          },
+        )
+      },
+    },
+  ],
+  logLevel: 'info',
+})
+
+process.stdout.write('md-web-cli bundle built\n')
diff --git a/packages/md-web-cli/scripts/resolve-publish-version.mjs b/packages/md-web-cli/scripts/resolve-publish-version.mjs
new file mode 100644
index 0000000000..4d75aae42d
--- /dev/null
+++ b/packages/md-web-cli/scripts/resolve-publish-version.mjs
@@ -0,0 +1,80 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Resolve the publish version from the manifest version and the registry's
+ * latest published version.
+ *
+ * Rule (issue #9): MAJOR.MINOR is hand-edited in the manifest; PATCH is
+ * automatic.
+ * - registry latest is unknown (not published yet) or its (MAJOR, MINOR)
+ *   differs from the manifest's → publish the manifest version as-is.
+ * - otherwise → registry PATCH + 1.
+ *
+ * Returns the version string; never writes back to git (npm version is run
+ * with --no-git-tag-version in the caller).
+ */
+export function resolvePublishVersion(manifestVersion, registryVersion) {
+  if (!manifestVersion || typeof manifestVersion !== 'string') {
+    throw new Error(`Invalid manifest version: ${JSON.stringify(manifestVersion)}`)
+  }
+  if (registryVersion == null) {
+    return manifestVersion
+  }
+  if (typeof registryVersion !== 'string') {
+    throw new TypeError(`Invalid registry version: ${JSON.stringify(registryVersion)}`)
+  }
+  const manifest = parseSemver(manifestVersion)
+  const registry = parseSemver(registryVersion)
+  if (manifest.major !== registry.major || manifest.minor !== registry.minor) {
+    return manifestVersion
+  }
+  return `${manifest.major}.${manifest.minor}.${registry.patch + 1}`
+}
+
+function parseSemver(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].+)?$/.exec(version.trim())
+  if (!match) {
+    throw new Error(`Unparseable semver: ${version}`)
+  }
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) }
+}
+
+async function main() {
+  const pkgDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+  const pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8'))
+  const registryVersion = await queryRegistryVersion(pkg.name)
+  const next = resolvePublishVersion(pkg.version, registryVersion)
+  console.log(`registry latest: ${registryVersion ?? '(none)'}`)
+  console.log(`manifest version: ${pkg.version}`)
+  console.log(`resolved publish version: ${next}`)
+  // Written to the GitHub Actions output; applied with
+  // `npm version --no-git-tag-version` by the publish workflow.
+  if (process.env.GITHUB_OUTPUT) {
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `version=${next}\n`)
+  }
+}
+
+/**
+ * Query the registry for the latest published version. A 404 (package never
+ * published) resolves to null. Never reads .npmrc auth; OIDC trusted
+ * publishing needs no token for read-only registry queries.
+ */
+export async function queryRegistryVersion(name, registryUrl = 'https://registry.npmjs.org') {
+  const res = await fetch(`${registryUrl}/${encodeURIComponent(name).replace(/^%40/, '@')}`)
+  if (res.status === 404) {
+    return null
+  }
+  if (!res.ok) {
+    throw new Error(`Registry query failed: HTTP ${res.status} for ${name}`)
+  }
+  const data = await res.json()
+  return data['dist-tags']?.latest ?? null
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+if (isMain) {
+  await main()
+}
diff --git a/packages/md-web-cli/src/assets.ts b/packages/md-web-cli/src/assets.ts
new file mode 100644
index 0000000000..ce350d6368
--- /dev/null
+++ b/packages/md-web-cli/src/assets.ts
@@ -0,0 +1,53 @@
+import atomOneDarkCSS from '../vendor/hljs-styles/atom-one-dark.min.css?raw'
+import atomOneLightCSS from '../vendor/hljs-styles/atom-one-light.min.css?raw'
+import githubDarkCSS from '../vendor/hljs-styles/github-dark.min.css?raw'
+import githubCSS from '../vendor/hljs-styles/github.min.css?raw'
+import monokaiCSS from '../vendor/hljs-styles/monokai.min.css?raw'
+import nordCSS from '../vendor/hljs-styles/nord.min.css?raw'
+import tokyoNightDarkCSS from '../vendor/hljs-styles/tokyo-night-dark.min.css?raw'
+import tokyoNightLightCSS from '../vendor/hljs-styles/tokyo-night-light.min.css?raw'
+import vsCSS from '../vendor/hljs-styles/vs.min.css?raw'
+import xcodeCSS from '../vendor/hljs-styles/xcode.min.css?raw'
+/**
+ * Theme + syntax-highlighting stylesheet assets, imported as text at bundle
+ * time via esbuild's `.css -> text` loader (mirrors Vite's `?raw` imports
+ * used by @md/shared). Nothing is fetched at runtime: the CLI is zero-network.
+ */
+import baseCSS from './assets/base.css?raw'
+import defaultCSS from './assets/default.css?raw'
+import graceCSS from './assets/grace.css?raw'
+import simpleCSS from './assets/simple.css?raw'
+
+export const baseCSSContent = baseCSS
+
+export const themeMap = {
+  default: defaultCSS,
+  grace: graceCSS,
+  simple: simpleCSS,
+} as const
+
+export type ThemeName = keyof typeof themeMap
+
+/**
+ * Friendly name -> vendored highlight.js preset stylesheet contents.
+ * Copies of the CDN files the web app references; bundled locally so
+ * rendering makes zero network requests.
+ */
+export const codeBlockThemeMap: Record<string, string> = {
+  'github': githubCSS,
+  'github-dark': githubDarkCSS,
+  'atom-one-light': atomOneLightCSS,
+  'atom-one-dark': atomOneDarkCSS,
+  'monokai': monokaiCSS,
+  'vs': vsCSS,
+  'xcode': xcodeCSS,
+  'nord': nordCSS,
+  'tokyo-night-light': tokyoNightLightCSS,
+  'tokyo-night-dark': tokyoNightDarkCSS,
+}
+
+export const codeBlockThemeNames = Object.keys(codeBlockThemeMap)
+
+export function isKnownCodeBlockTheme(name: string): boolean {
+  return Object.hasOwn(codeBlockThemeMap, name)
+}
diff --git a/packages/md-web-cli/src/assets/base.css b/packages/md-web-cli/src/assets/base.css
new file mode 100644
index 0000000000..5c44e5cf6a
--- /dev/null
+++ b/packages/md-web-cli/src/assets/base.css
@@ -0,0 +1,75 @@
+/**
+ * MD base theme styles
+ * Base element styles and CSS variable definitions
+ */
+
+/* ==================== Container ==================== */
+section,
+#output .container {
+  font-family: var(--md-font-family);
+  font-size: var(--md-font-size);
+  line-height: var(--md-line-height);
+  text-align: left;
+}
+
+#output {
+  font-family: var(--md-font-family);
+  font-size: var(--md-font-size);
+  line-height: var(--md-line-height);
+  text-align: left;
+}
+
+#output section > :first-child {
+  margin-top: 0 !important;
+}
+
+/*
+ * Reset for exported HTML / share pages / VSCode preview (no Tailwind preflight).
+ * Browser defaults leak in (e.g. blockquote 40px side margins, table border-collapse: separate).
+ * Reset horizontal (and top) margins so export matches in-app preview.
+ * Vertical spacing comes from theme blockquote { margin-bottom }; do not zero all margins here.
+ * section selector covers VSCode preview (no #output; content in section.container).
+ */
+#output blockquote,
+section blockquote {
+  margin-left: 0;
+  margin-right: 0;
+  margin-top: 0;
+}
+
+#output table,
+section table {
+  border-collapse: collapse;
+  min-width: 100%;
+}
+
+.mermaid-diagram .nodeLabel p {
+  color: unset !important;
+  letter-spacing: unset !important;
+}
+
+/* ==================== Inline emoji ====================
+ * `<img class="md-emoji">` comes from `<Emoji id="…">` (and legacy
+ * `{{emoji:id}}`). Native pixel sizing makes the image dwarf the surrounding
+ * text; constrain to the line box so it reads as an inline character.
+ */
+#output img.md-emoji,
+section img.md-emoji {
+  max-height: 1.4em;
+  width: auto;
+  vertical-align: text-bottom;
+  margin: 0 0.1em;
+  display: inline;
+}
+
+/*
+ * Original-size stickers (`width="N%"`) use a separate class so the line-box
+ * cap above does not shrink them. Keep aspect ratio and stay inside the article.
+ */
+#output img.md-asset-img,
+section img.md-asset-img {
+  height: auto;
+  max-width: 100%;
+  vertical-align: text-bottom;
+  display: inline;
+}
diff --git a/packages/md-web-cli/src/assets/default.css b/packages/md-web-cli/src/assets/default.css
new file mode 100644
index 0000000000..d846767f98
--- /dev/null
+++ b/packages/md-web-cli/src/assets/default.css
@@ -0,0 +1,580 @@
+/**
+ * MD default theme (classic).
+ * Format with Alt/Option + Shift + F.
+ * Use var(--md-primary-color) for theme color instead of hard-coded values.
+ * Vertical block margins are scaled by var(--md-block-spacing) so the theme's
+ * own rhythm is preserved while the user tightens or loosens the whole page.
+ */
+
+/* ==================== H1 ==================== */
+h1 {
+  display: table;
+  padding: 0 1em;
+  border-bottom: 2px solid var(--md-primary-color);
+  margin: calc(2em * var(--md-block-spacing)) auto calc(1em * var(--md-block-spacing));
+  color: hsl(var(--foreground));
+  font-size: calc(var(--md-font-size) * 1.2);
+  font-weight: bold;
+  text-align: center;
+}
+
+/* ==================== H2 ==================== */
+h2 {
+  display: table;
+  padding: 0 0.2em;
+  margin: calc(4em * var(--md-block-spacing)) auto calc(2em * var(--md-block-spacing));
+  color: #fff;
+  background: var(--md-primary-color);
+  font-size: calc(var(--md-font-size) * 1.2);
+  font-weight: bold;
+  text-align: center;
+}
+
+/* ==================== H3 ==================== */
+h3 {
+  padding-left: 8px;
+  border-left: 3px solid var(--md-primary-color);
+  margin: calc(2em * var(--md-block-spacing)) 8px calc(0.75em * var(--md-block-spacing)) 0;
+  color: hsl(var(--foreground));
+  font-size: calc(var(--md-font-size) * 1.1);
+  font-weight: bold;
+  line-height: 1.2;
+}
+
+/* ==================== H4 ==================== */
+h4 {
+  margin: calc(2em * var(--md-block-spacing)) 8px calc(0.5em * var(--md-block-spacing));
+  color: var(--md-primary-color);
+  font-size: calc(var(--md-font-size) * 1);
+  font-weight: bold;
+}
+
+/* ==================== H5 ==================== */
+h5 {
+  margin: calc(1.5em * var(--md-block-spacing)) 8px calc(0.5em * var(--md-block-spacing));
+  color: var(--md-primary-color);
+  font-size: calc(var(--md-font-size) * 1);
+  font-weight: bold;
+}
+
+/* ==================== H6 ==================== */
+h6 {
+  margin: calc(1.5em * var(--md-block-spacing)) 8px calc(0.5em * var(--md-block-spacing));
+  font-size: calc(var(--md-font-size) * 1);
+  color: var(--md-primary-color);
+}
+
+/* ==================== Paragraph ==================== */
+p {
+  margin: calc(1.5em * var(--md-block-spacing)) 8px;
+  letter-spacing: 0.1em;
+  color: hsl(var(--foreground));
+}
+
+/* ==================== Blockquote ==================== */
+blockquote {
+  font-style: normal;
+  padding: 1em;
+  border-left: 4px solid var(--md-primary-color);
+  border-radius: 6px;
+  color: hsl(var(--foreground));
+  background: var(--md-blockquote-background, var(--blockquote-background));
+  margin-bottom: calc(1em * var(--md-block-spacing));
+}
+
+blockquote > p {
+  display: block;
+  font-size: 1em;
+  letter-spacing: 0.1em;
+  color: hsl(var(--foreground));
+  margin: 0;
+}
+
+/* ==================== GFM alerts ==================== */
+.alert-title-note,
+.alert-title-tip,
+.alert-title-info,
+.alert-title-important,
+.alert-title-warning,
+.alert-title-caution,
+.alert-title-abstract,
+.alert-title-summary,
+.alert-title-tldr,
+.alert-title-todo,
+.alert-title-success,
+.alert-title-done,
+.alert-title-question,
+.alert-title-help,
+.alert-title-faq,
+.alert-title-failure,
+.alert-title-fail,
+.alert-title-missing,
+.alert-title-danger,
+.alert-title-error,
+.alert-title-bug,
+.alert-title-example,
+.alert-title-quote,
+.alert-title-cite,
+.alert-title-theorem,
+.alert-title-lemma,
+.alert-title-corollary,
+.alert-title-proposition,
+.alert-title-definition,
+.alert-title-axiom,
+.alert-title-postulate,
+.alert-title-assumption,
+.alert-title-proof,
+.alert-title-remark,
+.alert-title-custom {
+  display: flex;
+  align-items: center;
+  gap: 0.5em;
+  margin-bottom: 0.5em;
+}
+
+.alert-title-note {
+  color: #478be6;
+}
+
+.alert-title-tip {
+  color: #57ab5a;
+}
+
+.alert-title-info {
+  color: #93c5fd;
+}
+
+.alert-title-important {
+  color: #986ee2;
+}
+
+.alert-title-warning {
+  color: #c69026;
+}
+
+.alert-title-caution {
+  color: #e5534b;
+}
+
+/* Obsidian-style callout colors */
+.alert-title-abstract,
+.alert-title-summary,
+.alert-title-tldr {
+  color: #00bfff;
+}
+
+.alert-title-todo {
+  color: #478be6;
+}
+
+.alert-title-success,
+.alert-title-done {
+  color: #57ab5a;
+}
+
+.alert-title-question,
+.alert-title-help,
+.alert-title-faq {
+  color: #c69026;
+}
+
+.alert-title-failure,
+.alert-title-fail,
+.alert-title-missing {
+  color: #e5534b;
+}
+
+.alert-title-danger,
+.alert-title-error {
+  color: #e5534b;
+}
+
+.alert-title-bug {
+  color: #e5534b;
+}
+
+.alert-title-example {
+  color: #986ee2;
+}
+
+.alert-title-quote,
+.alert-title-cite {
+  color: #9ca3af;
+}
+
+/* GFM alert SVG icon colors */
+.alert-icon-note {
+  fill: #478be6;
+}
+
+.alert-icon-tip {
+  fill: #57ab5a;
+}
+
+.alert-icon-info {
+  fill: #93c5fd;
+}
+
+.alert-icon-important {
+  fill: #986ee2;
+}
+
+.alert-icon-warning {
+  fill: #c69026;
+}
+
+.alert-icon-caution {
+  fill: #e5534b;
+}
+
+/* Obsidian-style callout icon colors */
+.alert-icon-abstract,
+.alert-icon-summary,
+.alert-icon-tldr {
+  fill: #00bfff;
+}
+
+.alert-icon-todo {
+  fill: #478be6;
+}
+
+.alert-icon-success,
+.alert-icon-done {
+  fill: #57ab5a;
+}
+
+.alert-icon-question,
+.alert-icon-help,
+.alert-icon-faq {
+  fill: #c69026;
+}
+
+.alert-icon-failure,
+.alert-icon-fail,
+.alert-icon-missing {
+  fill: #e5534b;
+}
+
+.alert-icon-danger,
+.alert-icon-error {
+  fill: #e5534b;
+}
+
+.alert-icon-bug {
+  fill: #e5534b;
+}
+
+.alert-icon-example {
+  fill: #986ee2;
+}
+
+.alert-icon-quote,
+.alert-icon-cite {
+  fill: #9ca3af;
+}
+
+/* ==================== Academic environments (theorem, lemma, definition, …) ==================== */
+/* Title colors */
+.alert-title-theorem,
+.alert-title-lemma,
+.alert-title-corollary,
+.alert-title-proposition {
+  color: #986ee2;
+}
+
+.alert-title-definition {
+  color: #57ab5a;
+}
+
+.alert-title-axiom,
+.alert-title-postulate,
+.alert-title-assumption {
+  color: #478be6;
+}
+
+.alert-title-proof {
+  color: #9ca3af;
+}
+
+.alert-title-remark {
+  color: #c69026;
+}
+
+/* Icon colors */
+.alert-icon-theorem,
+.alert-icon-lemma,
+.alert-icon-corollary,
+.alert-icon-proposition {
+  fill: #986ee2;
+}
+
+.alert-icon-definition {
+  fill: #57ab5a;
+}
+
+.alert-icon-axiom,
+.alert-icon-postulate,
+.alert-icon-assumption {
+  fill: #478be6;
+}
+
+.alert-icon-proof {
+  fill: #9ca3af;
+}
+
+.alert-icon-remark {
+  fill: #c69026;
+}
+
+/* Full border on academic boxes (theorem-style appearance) */
+.markdown-alert-theorem,
+.markdown-alert-lemma,
+.markdown-alert-corollary,
+.markdown-alert-proposition {
+  border: 1px solid rgba(152, 110, 226, 0.35);
+  border-left: 4px solid #986ee2;
+}
+
+.markdown-alert-definition {
+  border: 1px solid rgba(87, 171, 90, 0.35);
+  border-left: 4px solid #57ab5a;
+}
+
+.markdown-alert-axiom,
+.markdown-alert-postulate,
+.markdown-alert-assumption {
+  border: 1px solid rgba(71, 139, 230, 0.35);
+  border-left: 4px solid #478be6;
+}
+
+.markdown-alert-proof {
+  border: 1px solid rgba(156, 163, 175, 0.35);
+  border-left: 4px solid #9ca3af;
+}
+
+.markdown-alert-remark {
+  border: 1px solid rgba(198, 144, 38, 0.35);
+  border-left: 4px solid #c69026;
+}
+
+/* Fallback for custom/unknown names: no icon, theme primary color */
+.alert-title-custom {
+  color: var(--md-primary-color);
+}
+
+.markdown-alert-custom {
+  border-left: 4px solid var(--md-primary-color);
+}
+
+/* Italic body text in academic environments (math convention) */
+.markdown-alert-theorem > :not(.markdown-alert-title),
+.markdown-alert-lemma > :not(.markdown-alert-title),
+.markdown-alert-corollary > :not(.markdown-alert-title),
+.markdown-alert-proposition > :not(.markdown-alert-title),
+.markdown-alert-definition > :not(.markdown-alert-title),
+.markdown-alert-axiom > :not(.markdown-alert-title),
+.markdown-alert-postulate > :not(.markdown-alert-title),
+.markdown-alert-assumption > :not(.markdown-alert-title) {
+  font-style: italic;
+}
+
+/* ==================== Code blocks ==================== */
+pre.code__pre,
+.hljs.code__pre {
+  font-size: 90%;
+  overflow-x: auto;
+  border-radius: 8px;
+  padding: 0 !important;
+  line-height: 1.5;
+  margin: calc(10px * var(--md-block-spacing)) 8px;
+}
+
+/* ==================== Images ==================== */
+img {
+  display: block;
+  max-width: 100%;
+  margin: calc(0.1em * var(--md-block-spacing)) auto calc(0.5em * var(--md-block-spacing));
+  border-radius: 4px;
+}
+
+/* ==================== Lists ==================== */
+ol {
+  padding-left: 1em;
+  margin-left: 0;
+  color: hsl(var(--foreground));
+}
+
+ul {
+  list-style: circle;
+  padding-left: 1em;
+  margin-left: 0;
+  color: hsl(var(--foreground));
+}
+
+li {
+  display: block;
+  margin: calc(0.2em * var(--md-block-spacing)) 8px;
+  color: hsl(var(--foreground));
+}
+
+/* Footnotes */
+/* footnotes rendered as <p> in buildFootnotes() */
+p.footnotes {
+  margin: calc(0.5em * var(--md-block-spacing)) 8px;
+  font-size: 80%;
+  color: hsl(var(--foreground));
+}
+
+/* Diagrams */
+figure {
+  margin: calc(1.5em * var(--md-block-spacing)) 8px;
+  color: hsl(var(--foreground));
+}
+
+figcaption,
+.md-figcaption {
+  text-align: center;
+  color: color-mix(in srgb, hsl(var(--foreground)) 50%, transparent);
+  font-size: 0.8em;
+}
+
+/* ==================== Horizontal rules ==================== */
+hr {
+  border-style: solid;
+  border-width: 2px 0 0;
+  border-color: rgba(0, 0, 0, 0.1);
+  -webkit-transform-origin: 0 0;
+  -webkit-transform: scale(1, 0.5);
+  transform-origin: 0 0;
+  transform: scale(1, 0.5);
+  height: 0.4em;
+  margin: calc(1.5em * var(--md-block-spacing)) 0;
+}
+
+/* Inline code */
+.codespan {
+  font-size: 90%;
+  color: var(--md-primary-color);
+  background: color-mix(in srgb, var(--md-primary-color) 8%, transparent);
+  padding: 3px 5px;
+  border-radius: 4px;
+  border: 1px solid color-mix(in srgb, var(--md-primary-color) 20%, transparent);
+}
+
+/* code inside pre (override inline code) */
+pre.code__pre > code,
+.hljs.code__pre > code {
+  display: -webkit-box;
+  padding: 0.5em 1em 1em;
+  overflow-x: auto;
+  text-indent: 0;
+  color: inherit;
+  background: none;
+  white-space: nowrap;
+  margin: 0;
+}
+
+/* Emphasis */
+em {
+  font-style: italic;
+  font-size: inherit;
+}
+
+/* ==================== Links ==================== */
+a {
+  color: var(--md-link-color);
+  text-decoration: none;
+}
+
+/* ==================== Bold ==================== */
+strong {
+  color: var(--md-primary-color);
+  font-weight: bold;
+  font-size: inherit;
+}
+
+/* ==================== Strikethrough ==================== */
+.del {
+  color: color-mix(in srgb, hsl(var(--foreground)) 55%, transparent);
+  text-decoration: line-through;
+}
+
+/* ==================== Tables ==================== */
+table {
+  color: hsl(var(--foreground));
+}
+
+thead {
+  font-weight: bold;
+  color: hsl(var(--foreground));
+}
+
+th {
+  border: 1px solid color-mix(in srgb, hsl(var(--foreground)) 15%, transparent);
+  padding: 0.25em 0.5em;
+  color: hsl(var(--foreground));
+  word-break: keep-all;
+  background: color-mix(in srgb, hsl(var(--foreground)) 5%, transparent);
+}
+
+td {
+  border: 1px solid color-mix(in srgb, hsl(var(--foreground)) 15%, transparent);
+  padding: 0.25em 0.5em;
+  color: hsl(var(--foreground));
+  word-break: keep-all;
+}
+
+/* ==================== KaTeX ==================== */
+.katex-inline {
+  max-width: 100%;
+  overflow-x: auto;
+  cursor: pointer;
+}
+
+.katex-block {
+  max-width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  cursor: pointer;
+  padding: 0.5em 0;
+  text-align: center;
+}
+
+.katex-pending {
+  color: hsl(var(--muted-foreground, 0 0% 45%));
+  font-size: 0.875em;
+}
+
+.katex-block.katex-pending {
+  padding: 0.75em 0;
+}
+
+.katex-inline.katex-pending {
+  opacity: 0.75;
+}
+
+/* ==================== Markup highlight ==================== */
+.markup-highlight {
+  background-color: var(--md-primary-color);
+  padding: 2px 4px;
+  border-radius: 2px;
+  color: #fff;
+}
+
+.markup-underline {
+  text-decoration: underline;
+  text-decoration-color: var(--md-primary-color);
+}
+
+.markup-wavyline {
+  text-decoration: underline wavy;
+  text-decoration-color: var(--md-primary-color);
+  text-decoration-thickness: 2px;
+}
+
+/* line-height: 0 keeps the raised glyph from stretching the line box */
+.markup-superscript {
+  font-size: 0.75em;
+  line-height: 0;
+  vertical-align: super;
+}
diff --git a/packages/md-web-cli/src/assets/grace.css b/packages/md-web-cli/src/assets/grace.css
new file mode 100644
index 0000000000..a310143267
--- /dev/null
+++ b/packages/md-web-cli/src/assets/grace.css
@@ -0,0 +1,136 @@
+/**
+ * MD grace theme (@brzhang) — refinements on default
+ */
+
+/* Headings */
+h1 {
+  padding: 0.5em 1em;
+  border-bottom: 2px solid var(--md-primary-color);
+  font-size: calc(var(--md-font-size) * 1.4);
+  text-shadow: 2px 2px 4px rgba(0, 0, 0, 0.1);
+}
+
+h2 {
+  padding: 0.3em 1em;
+  border-radius: 8px;
+  font-size: calc(var(--md-font-size) * 1.3);
+  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+}
+
+h3 {
+  padding-left: 12px;
+  font-size: calc(var(--md-font-size) * 1.2);
+  border-left: 4px solid var(--md-primary-color);
+  border-bottom: 1px dashed var(--md-primary-color);
+}
+
+h4 {
+  font-size: calc(var(--md-font-size) * 1.1);
+}
+
+h5 {
+  font-size: var(--md-font-size);
+}
+
+h6 {
+  font-size: var(--md-font-size);
+}
+
+/* Blockquote */
+blockquote {
+  font-style: italic;
+  padding: 1em 1em 1em 2em;
+  border-left: 4px solid var(--md-primary-color);
+  border-radius: 6px;
+  color: rgba(0, 0, 0, 0.6);
+  background: var(--md-blockquote-background, transparent);
+  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.05);
+  margin-bottom: calc(1em * var(--md-block-spacing));
+}
+
+.markdown-alert {
+  font-style: italic;
+}
+
+/* Inline code */
+.codespan {
+  font-family: 'Fira Code', Menlo, Operator Mono, Consolas, Monaco, monospace;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.08);
+}
+
+/* Code blocks */
+pre.code__pre,
+.hljs.code__pre {
+  box-shadow: inset 0 0 10px rgba(0, 0, 0, 0.05);
+}
+
+pre.code__pre > code,
+.hljs.code__pre > code {
+  font-family: 'Fira Code', Menlo, Operator Mono, Consolas, Monaco, monospace;
+}
+
+/* Images */
+img {
+  border-radius: 8px;
+  box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
+}
+
+figcaption,
+.md-figcaption {
+  text-align: center;
+  color: #888;
+  font-size: 0.8em;
+}
+
+/* Lists */
+ol {
+  padding-left: 1.5em;
+}
+
+ul {
+  list-style: none;
+  padding-left: 1.5em;
+}
+
+li {
+  margin: calc(0.5em * var(--md-block-spacing)) 8px;
+}
+
+/* Horizontal rules */
+hr {
+  height: 1px;
+  border: none;
+  margin: calc(2em * var(--md-block-spacing)) 0;
+  background: linear-gradient(to right, rgba(0, 0, 0, 0), rgba(0, 0, 0, 0.1), rgba(0, 0, 0, 0));
+}
+
+/* Tables */
+table {
+  border-collapse: separate;
+  border-spacing: 0;
+  border-radius: 8px;
+  margin: calc(1em * var(--md-block-spacing)) 8px;
+  color: hsl(var(--foreground));
+  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+  overflow: hidden;
+}
+
+thead {
+  color: #fff;
+}
+
+td {
+  padding: 0.5em 1em;
+}
+
+/* Emphasis */
+em {
+  font-style: italic;
+  font-size: inherit;
+}
+
+/* Links */
+a {
+  color: var(--md-link-color);
+  text-decoration: none;
+}
diff --git a/packages/md-web-cli/src/assets/simple.css b/packages/md-web-cli/src/assets/simple.css
new file mode 100644
index 0000000000..f96ba41c2a
--- /dev/null
+++ b/packages/md-web-cli/src/assets/simple.css
@@ -0,0 +1,130 @@
+/**
+ * MD simple theme (@okooo5km) — minimal modern layout
+ */
+
+/* Headings */
+h1 {
+  padding: 0.5em 1em;
+  font-size: calc(var(--md-font-size) * 1.4);
+  text-shadow: 1px 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+h2 {
+  padding: 0.3em 1.2em;
+  font-size: calc(var(--md-font-size) * 1.3);
+  border-radius: 8px 24px 8px 24px;
+  box-shadow: 0 2px 6px rgba(0, 0, 0, 0.06);
+}
+
+h3 {
+  padding-left: 12px;
+  font-size: calc(var(--md-font-size) * 1.2);
+  border-radius: 6px;
+  line-height: 2.4em;
+  border-left: 4px solid var(--md-primary-color);
+  border-right: 1px solid color-mix(in srgb, var(--md-primary-color) 10%, transparent);
+  border-bottom: 1px solid color-mix(in srgb, var(--md-primary-color) 10%, transparent);
+  border-top: 1px solid color-mix(in srgb, var(--md-primary-color) 10%, transparent);
+  background: color-mix(in srgb, var(--md-primary-color) 8%, transparent);
+}
+
+h4 {
+  font-size: calc(var(--md-font-size) * 1.1);
+  border-radius: 6px;
+}
+
+h5 {
+  font-size: var(--md-font-size);
+  border-radius: 6px;
+}
+
+h6 {
+  font-size: var(--md-font-size);
+  border-radius: 6px;
+}
+
+/* Blockquote */
+blockquote {
+  font-style: italic;
+  padding: 1em 1em 1em 2em;
+  color: rgba(0, 0, 0, 0.6);
+  background: var(--md-blockquote-background, transparent);
+  border-bottom: 0.2px solid rgba(0, 0, 0, 0.04);
+  border-top: 0.2px solid rgba(0, 0, 0, 0.04);
+  border-right: 0.2px solid rgba(0, 0, 0, 0.04);
+}
+
+/* GFM alert overrides */
+.markdown-alert-note,
+.markdown-alert-tip,
+.markdown-alert-info,
+.markdown-alert-important,
+.markdown-alert-warning,
+.markdown-alert-caution {
+  font-style: italic;
+}
+
+/* Inline code */
+.codespan {
+  font-family: 'Fira Code', Menlo, Operator Mono, Consolas, Monaco, monospace;
+  border-radius: 6px;
+  border: 1px solid color-mix(in srgb, var(--md-primary-color) 15%, transparent);
+}
+
+/* Code blocks */
+pre.code__pre,
+.hljs.code__pre {
+  border: 1px solid rgba(0, 0, 0, 0.04);
+}
+
+pre.code__pre > code,
+.hljs.code__pre > code {
+  font-family: 'Fira Code', Menlo, Operator Mono, Consolas, Monaco, monospace;
+}
+
+/* Images */
+img {
+  border-radius: 8px;
+  border: 1px solid rgba(0, 0, 0, 0.04);
+}
+
+figcaption,
+.md-figcaption {
+  text-align: center;
+  color: #888;
+  font-size: 0.8em;
+}
+
+/* Lists */
+ol {
+  padding-left: 1.5em;
+}
+
+ul {
+  list-style: none;
+  padding-left: 1.5em;
+}
+
+li {
+  margin: calc(0.5em * var(--md-block-spacing)) 8px;
+}
+
+/* Horizontal rules */
+hr {
+  height: 1px;
+  border: none;
+  margin: calc(2em * var(--md-block-spacing)) 0;
+  background: linear-gradient(to right, rgba(0, 0, 0, 0), rgba(0, 0, 0, 0.1), rgba(0, 0, 0, 0));
+}
+
+/* Emphasis */
+em {
+  font-style: italic;
+  font-size: inherit;
+}
+
+/* Links */
+a {
+  color: var(--md-link-color);
+  text-decoration: none;
+}
diff --git a/packages/md-web-cli/src/cli.ts b/packages/md-web-cli/src/cli.ts
new file mode 100644
index 0000000000..b92da39a48
--- /dev/null
+++ b/packages/md-web-cli/src/cli.ts
@@ -0,0 +1,315 @@
+import type { FlagOverrides, RawStyleConfig } from './config'
+/**
+ * CLI entry for @dane.dai/md-web-cli.
+ *
+ * Ticket 03 contract: `render <in.md> -o <out.html>` with site defaults.
+ * Ticket 04: output is WeChat-ready (inlined styles, no <style> block, no
+ * class attributes) and pending placeholders (mermaid/KaTeX/infographic/
+ * unregistered languages) fail the run instead of being silently stripped.
+ * Ticket 05: `--config` (Designer or MCP dialect JSON), `--raw` (pre-inlining
+ * intermediate output) and flag overrides. Precedence: built-in defaults <
+ * config file < CLI flags.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { applyFlagOverrides, normalizeStyleConfig } from './config'
+import { renderMarkdownToStyledHtml } from './render'
+import { PendingPlaceholderError, renderMarkdownToWeChatHtml } from './wechat'
+
+interface ParsedArgs {
+  input?: string
+  output?: string
+  config?: string
+  raw?: boolean
+  cssTab?: string
+  flags: FlagOverrides
+}
+
+function printUsage(): void {
+  process.stderr.write(`Usage: md-web-cli render <in.md> -o <out.html> [options]
+
+Options:
+  -o, --output <file>       Output HTML file (required)
+  --config <file>           Style config JSON: Designer export (first-class)
+                            or MCP render_markdown schema (alias)
+  --css-tab <id|name>       Use the given CSS editor tab instead of the active one
+  --raw                     Emit the pre-inlining intermediate form (with
+                            <style> block) instead of WeChat-ready HTML
+  --theme <name>            default | grace | simple
+  --primary-color <color>   Primary accent color (hex)
+  --font-family <stack>     Font family stack
+  --font-size <size>        Base font size (e.g. 16px)
+  --line-height <n>         Body line height (unitless, e.g. 1.75)
+  --block-spacing <n>       Block spacing multiplier (e.g. 1)
+  --link-color <color>      Link color
+  --blockquote-background <value>  Blockquote background
+  --body-color <color>      Body text color (default rgb(10,10,10))
+  --legend <mode>           Image caption format
+  --code-theme <name>       Code highlight theme (preset name or MCP URL)
+  --theme-mode <mode>       light | dark
+  --mac-code-block / --no-mac-code-block        macOS code block title bar
+  --show-line-number / --no-show-line-number    Code block line numbers
+  --cite-status / --no-cite-status              Footnote-style citations
+  --count-status / --no-count-status            Reading time estimate
+  --use-indent / --no-use-indent                Paragraph first-line indent
+  --use-justify / --no-use-justify              Justified paragraph text
+  -h, --help                Show this help
+`)
+}
+
+function fail(message: string): never {
+  process.stderr.write(`md-web-cli: ${message}\n`)
+  process.exit(1)
+}
+
+/**
+ * Consume the next argv token as the flag's explicit value only when it is a
+ * boolean literal (`true`/`false`/`1`/`0`). A bare `--flag` means true; this
+ * keeps a following positional input (or another flag) from being swallowed.
+ */
+function takeBool(argv: string[], i: number): { value: boolean, next: number } {
+  const raw = argv[i + 1]
+  if (raw === `true` || raw === `1`)
+    return { value: true, next: i + 1 }
+  if (raw === `false` || raw === `0`)
+    return { value: false, next: i + 1 }
+  return { value: true, next: i }
+}
+
+function parseArgs(argv: string[]): ParsedArgs {
+  const parsed: ParsedArgs = { flags: {} }
+  const flags = parsed.flags
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === `-o` || arg === `--output`) {
+      parsed.output = argv[++i]
+    }
+    else if (arg.startsWith(`--output=`)) {
+      parsed.output = arg.slice(`--output=`.length)
+    }
+    else if (arg === `--config`) {
+      parsed.config = argv[++i]
+    }
+    else if (arg.startsWith(`--config=`)) {
+      parsed.config = arg.slice(`--config=`.length)
+    }
+    else if (arg === `--raw`) {
+      parsed.raw = true
+    }
+    else if (arg === `--css-tab`) {
+      parsed.cssTab = argv[++i]
+    }
+    else if (arg.startsWith(`--css-tab=`)) {
+      parsed.cssTab = arg.slice(`--css-tab=`.length)
+    }
+    else if (arg === `--body-color`) {
+      flags.bodyColor = argv[++i]
+    }
+    else if (arg.startsWith(`--body-color=`)) {
+      flags.bodyColor = arg.slice(`--body-color=`.length)
+    }
+    else if (arg === `--theme` || arg.startsWith(`--theme=`)) {
+      const value = arg === `--theme` ? argv[++i] : arg.slice(`--theme=`.length)
+      if (value === `default` || value === `grace` || value === `simple`)
+        flags.theme = value
+      else
+        fail(`--theme must be one of: default, grace, simple`)
+    }
+    else if (arg === `--theme-mode` || arg.startsWith(`--theme-mode=`)) {
+      const value = arg === `--theme-mode` ? argv[++i] : arg.slice(`--theme-mode=`.length)
+      if (value === `light` || value === `dark`)
+        flags.themeMode = value
+      else
+        fail(`--theme-mode must be light or dark`)
+    }
+    else if (arg === `--legend` || arg.startsWith(`--legend=`)) {
+      const value = arg === `--legend` ? argv[++i] : arg.slice(`--legend=`.length)
+      if ([`title-alt`, `alt-title`, `title`, `alt`, `filename`, `none`].includes(value))
+        flags.legend = value as FlagOverrides['legend']
+      else
+        fail(`--legend must be one of: title-alt, alt-title, title, alt, filename, none`)
+    }
+    else if (arg === `--code-theme` || arg.startsWith(`--code-theme=`)) {
+      flags.codeBlockTheme = arg === `--code-theme` ? argv[++i] : arg.slice(`--code-theme=`.length)
+    }
+    else if (arg === `--primary-color`) {
+      flags.primaryColor = argv[++i]
+    }
+    else if (arg.startsWith(`--primary-color=`)) {
+      flags.primaryColor = arg.slice(`--primary-color=`.length)
+    }
+    else if (arg === `--font-family`) {
+      flags.fontFamily = argv[++i]
+    }
+    else if (arg.startsWith(`--font-family=`)) {
+      flags.fontFamily = arg.slice(`--font-family=`.length)
+    }
+    else if (arg === `--font-size`) {
+      flags.fontSize = argv[++i]
+    }
+    else if (arg.startsWith(`--font-size=`)) {
+      flags.fontSize = arg.slice(`--font-size=`.length)
+    }
+    else if (arg === `--line-height`) {
+      flags.lineHeight = argv[++i]
+    }
+    else if (arg.startsWith(`--line-height=`)) {
+      flags.lineHeight = arg.slice(`--line-height=`.length)
+    }
+    else if (arg === `--block-spacing`) {
+      flags.blockSpacing = argv[++i]
+    }
+    else if (arg.startsWith(`--block-spacing=`)) {
+      flags.blockSpacing = arg.slice(`--block-spacing=`.length)
+    }
+    else if (arg === `--link-color`) {
+      flags.linkColor = argv[++i]
+    }
+    else if (arg.startsWith(`--link-color=`)) {
+      flags.linkColor = arg.slice(`--link-color=`.length)
+    }
+    else if (arg === `--blockquote-background`) {
+      flags.blockquoteBackground = argv[++i]
+    }
+    else if (arg.startsWith(`--blockquote-background=`)) {
+      flags.blockquoteBackground = arg.slice(`--blockquote-background=`.length)
+    }
+    else if (arg === `--mac-code-block`) {
+      const taken = takeBool(argv, i)
+      flags.isMacCodeBlock = taken.value
+      i = taken.next
+    }
+    else if (arg === `--no-mac-code-block`) {
+      flags.isMacCodeBlock = false
+    }
+    else if (arg === `--show-line-number`) {
+      const taken = takeBool(argv, i)
+      flags.isShowLineNumber = taken.value
+      i = taken.next
+    }
+    else if (arg === `--no-show-line-number`) {
+      flags.isShowLineNumber = false
+    }
+    else if (arg === `--cite-status`) {
+      const taken = takeBool(argv, i)
+      flags.citeStatus = taken.value
+      i = taken.next
+    }
+    else if (arg === `--no-cite-status`) {
+      flags.citeStatus = false
+    }
+    else if (arg === `--count-status`) {
+      const taken = takeBool(argv, i)
+      flags.countStatus = taken.value
+      i = taken.next
+    }
+    else if (arg === `--no-count-status`) {
+      flags.countStatus = false
+    }
+    else if (arg === `--use-indent`) {
+      const taken = takeBool(argv, i)
+      flags.isUseIndent = taken.value
+      i = taken.next
+    }
+    else if (arg === `--no-use-indent`) {
+      flags.isUseIndent = false
+    }
+    else if (arg === `--use-justify`) {
+      const taken = takeBool(argv, i)
+      flags.isUseJustify = taken.value
+      i = taken.next
+    }
+    else if (arg === `--no-use-justify`) {
+      flags.isUseJustify = false
+    }
+    else if (arg === `-h` || arg === `--help`) {
+      printUsage()
+      process.exit(0)
+    }
+    else if (!arg.startsWith(`-`)) {
+      parsed.input = arg
+    }
+    else {
+      fail(`Unknown option "${arg}". See --help.`)
+    }
+  }
+  return parsed
+}
+
+function loadConfigFile(configPath: string, cssTab?: string): FlagOverrides & RawStyleConfig {
+  const resolved = path.resolve(configPath)
+  if (!fs.existsSync(resolved))
+    fail(`Config file not found: ${resolved}`)
+  let parsedJson: unknown
+  try {
+    parsedJson = JSON.parse(fs.readFileSync(resolved, `utf-8`))
+  }
+  catch (error) {
+    fail(`Config file is not valid JSON: ${error instanceof Error ? error.message : String(error)}`)
+  }
+  if (typeof parsedJson !== `object` || parsedJson === null || Array.isArray(parsedJson))
+    fail(`Config file must contain a JSON object`)
+
+  return normalizeStyleConfig(parsedJson as RawStyleConfig, { cssTab }) as FlagOverrides & RawStyleConfig
+}
+
+function runRender(argv: string[]): void {
+  const parsed = parseArgs(argv)
+  const { input, output } = parsed
+  if (!input)
+    fail(`render requires an input Markdown file. Usage: md-web-cli render <in.md> -o <out.html>`)
+  if (!output)
+    fail(`render requires an output path via -o <out.html>`)
+
+  const inputPath = path.resolve(input)
+  const outputPath = path.resolve(output)
+
+  if (!fs.existsSync(inputPath))
+    fail(`Input file not found: ${inputPath}`)
+  if (!fs.statSync(inputPath).isFile())
+    fail(`Input path is not a file: ${inputPath}`)
+  if (path.dirname(outputPath) !== outputPath && !fs.existsSync(path.dirname(outputPath)))
+    fail(`Output directory does not exist: ${path.dirname(outputPath)}`)
+
+  // Precedence: built-in defaults < config file < CLI flags.
+  const configFromFile = parsed.config ? loadConfigFile(parsed.config, parsed.cssTab) : {}
+  const config = applyFlagOverrides(configFromFile, parsed.flags)
+
+  const markdown = fs.readFileSync(inputPath, `utf-8`)
+
+  let result
+  try {
+    result = parsed.raw
+      ? renderMarkdownToStyledHtml(markdown, config)
+      : renderMarkdownToWeChatHtml(markdown, config)
+  }
+  catch (error) {
+    if (error instanceof PendingPlaceholderError) {
+      process.stderr.write(`md-web-cli: render failed — ${error.message}\n`)
+      for (const placeholder of error.placeholders) {
+        process.stderr.write(`  - ${placeholder.kind}: ${placeholder.detail}\n`)
+      }
+      process.exit(1)
+    }
+    fail(error instanceof Error ? error.message : String(error))
+  }
+
+  fs.writeFileSync(outputPath, result.html, `utf-8`)
+  process.stdout.write(`Rendered ${inputPath} -> ${outputPath}\n`)
+}
+
+function main(): void {
+  const [command, ...rest] = process.argv.slice(2)
+  if (!command || command === `-h` || command === `--help`) {
+    printUsage()
+    process.exit(command ? 0 : 1)
+  }
+  if (command === `render`) {
+    runRender(rest)
+    return
+  }
+  fail(`Unknown command "${command}". Available commands: render`)
+}
+
+main()
diff --git a/packages/md-web-cli/src/config.ts b/packages/md-web-cli/src/config.ts
new file mode 100644
index 0000000000..44e11dbde6
--- /dev/null
+++ b/packages/md-web-cli/src/config.ts
@@ -0,0 +1,301 @@
+/**
+ * Config-file dialects for the md-web-cli `--config` option.
+ *
+ * Two dialects are accepted and both normalize to the internal
+ * `RenderConfigInput`:
+ *
+ * - Designer config (first-class): what the web app's editor-state dialog
+ *   exports (`apps/web/src/components/editor/dialogs/EditorStateDialog.vue`,
+ *   `getAllStoreStates()`). Uses `isCiteStatus` / `isCountStatus` naming and
+ *   carries the CSS editor state as `cssContentConfig`.
+ * - MCP schema JSON (alias): the `render_markdown` input schema from
+ *   `packages/mcp-server` (`citeStatus`, `headingStyles`, preset
+ *   `codeBlockTheme` URLs, ...).
+ *
+ * Normalization is whitelist-based: unknown ("junk") keys are ignored
+ * silently, never an error. The five style parameters the Designer export
+ * does not carry (lineHeight, blockSpacing, linkColor, blockquoteBackground,
+ * headingStyles) simply stay unset and fall back to site defaults.
+ */
+import type { HeadingLevel, HeadingStyles, HeadingStyleType } from '@md/shared/configs/style'
+import type { LegendValue, RenderConfigInput } from './types'
+
+export type ConfigDialect = 'designer' | 'mcp'
+
+/** One CSS editor tab as persisted by the web app's cssEditor store. */
+export interface DesignerCssTabInput {
+  id?: unknown
+  title?: unknown
+  name?: unknown
+  content?: unknown
+  [key: string]: unknown
+}
+
+/** CSS editor state as exported by the Designer (`cssContentConfig`). */
+export interface DesignerCssContentConfigInput {
+  active?: unknown
+  tabs?: unknown
+  [key: string]: unknown
+}
+
+/** Arbitrary JSON object, e.g. a parsed `--config` file. */
+export interface RawStyleConfig {
+  [key: string]: unknown
+}
+
+/** CLI flag overrides that beat config-file values. */
+export interface FlagOverrides {
+  theme?: RenderConfigInput['theme']
+  primaryColor?: string
+  fontFamily?: string
+  fontSize?: string
+  lineHeight?: string
+  blockSpacing?: string
+  linkColor?: string
+  blockquoteBackground?: string
+  bodyColor?: string
+  legend?: LegendValue
+  codeBlockTheme?: string
+  themeMode?: RenderConfigInput['themeMode']
+  citeStatus?: boolean
+  countStatus?: boolean
+  isMacCodeBlock?: boolean
+  isShowLineNumber?: boolean
+  isUseIndent?: boolean
+  isUseJustify?: boolean
+  headingStyles?: HeadingStyles
+}
+
+const HEADING_LEVELS: HeadingLevel[] = [`h1`, `h2`, `h3`, `h4`, `h5`, `h6`]
+const HEADING_STYLE_VALUES: HeadingStyleType[] = [`default`, `color-only`, `border-bottom`, `border-left`, `custom`]
+const LEGEND_VALUES: LegendValue[] = [`title-alt`, `alt-title`, `title`, `alt`, `filename`, `none`]
+const THEME_NAMES = [`default`, `grace`, `simple`] as const
+const THEME_MODES = [`light`, `dark`] as const
+
+const CODE_BLOCK_THEME_URL_PREFIX = `https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/11.11.1/styles/`
+
+function pickString(value: unknown): string | undefined {
+  return typeof value === `string` && value.length > 0 ? value : undefined
+}
+
+function pickBoolean(value: unknown): boolean | undefined {
+  return typeof value === `boolean` ? value : undefined
+}
+
+/** Accept both the MCP preset URLs and the friendly hljs theme names. */
+function normalizeCodeBlockTheme(value: unknown): string | undefined {
+  const raw = pickString(value)
+  if (!raw)
+    return undefined
+  if (raw.startsWith(CODE_BLOCK_THEME_URL_PREFIX)) {
+    return raw
+      .slice(CODE_BLOCK_THEME_URL_PREFIX.length)
+      .replace(/\.min\.css$/i, ``)
+  }
+  return raw
+}
+
+function pickEnum<T extends string>(value: unknown, allowed: readonly T[]): T | undefined {
+  return typeof value === `string` && (allowed as readonly string[]).includes(value) ? value as T : undefined
+}
+
+function normalizeHeadingStyles(value: unknown): HeadingStyles | undefined {
+  if (typeof value !== `object` || value === null)
+    return undefined
+  const source = value as Record<string, unknown>
+  const result: HeadingStyles = {}
+  let found = false
+  for (const level of HEADING_LEVELS) {
+    const style = pickEnum(source[level], HEADING_STYLE_VALUES)
+    if (style && style !== `default`) {
+      result[level] = style
+      found = true
+    }
+  }
+  return found ? result : undefined
+}
+
+/**
+ * Resolve the CSS editor state to the active tab's CSS.
+ *
+ * Mirrors the site: only the active tab's content is applied, other tabs are
+ * ignored. `active` holds a tab id (legacy data may hold a name).
+ * `cssTab` (--css-tab) overrides the selection by id or name.
+ */
+export function resolveCustomCss(
+  cssContentConfig: DesignerCssContentConfigInput | undefined,
+  cssTab?: string,
+): string | undefined {
+  if (!cssContentConfig || typeof cssContentConfig !== `object`)
+    return undefined
+  const tabs = Array.isArray(cssContentConfig.tabs) ? cssContentConfig.tabs as DesignerCssTabInput[] : []
+  const usable = tabs.filter(tab => typeof tab === `object` && tab !== null)
+  if (usable.length === 0)
+    return undefined
+
+  let tab: DesignerCssTabInput | undefined
+  if (cssTab) {
+    tab = usable.find(t => t.id === cssTab)
+      ?? usable.find(t => pickString(t.name) === cssTab)
+      ?? usable.find(t => pickString(t.title) === cssTab)
+    if (tab === undefined) {
+      const names = usable.map(t => pickString(t.name) ?? pickString(t.title) ?? pickString(t.id) ?? `(unnamed)`)
+      throw new Error(`--css-tab "${cssTab}" does not match any CSS editor tab (id or name). Known tabs: ${names.join(', ')}`)
+    }
+  }
+  else {
+    const active = pickString(cssContentConfig.active)
+    tab = (active ? (usable.find(t => t.id === active) ?? usable.find(t => pickString(t.name) === active)) : undefined)
+      ?? usable[0]
+  }
+
+  const content = pickString(tab.content)
+  return content?.trim() ? content : undefined
+}
+
+/** Normalize the Designer export dialect (`isCiteStatus`, `cssContentConfig`, ...). */
+export function normalizeDesignerConfig(raw: RawStyleConfig, options: { cssTab?: string } = {}): RenderConfigInput {
+  const config: RenderConfigInput = {}
+  const theme = pickEnum(raw.theme, THEME_NAMES)
+  if (theme)
+    config.theme = theme
+  const fontFamily = pickString(raw.fontFamily)
+  if (fontFamily)
+    config.fontFamily = fontFamily
+  const fontSize = pickString(raw.fontSize)
+  if (fontSize)
+    config.fontSize = fontSize
+  const primaryColor = pickString(raw.primaryColor)
+  if (primaryColor)
+    config.primaryColor = primaryColor
+  const codeBlockTheme = normalizeCodeBlockTheme(raw.codeBlockTheme)
+  if (codeBlockTheme)
+    config.codeBlockTheme = codeBlockTheme
+  const legend = pickEnum(raw.legend, LEGEND_VALUES)
+  if (legend)
+    config.legend = legend
+  const isMacCodeBlock = pickBoolean(raw.isMacCodeBlock)
+  if (isMacCodeBlock !== undefined)
+    config.isMacCodeBlock = isMacCodeBlock
+  const isShowLineNumber = pickBoolean(raw.isShowLineNumber)
+  if (isShowLineNumber !== undefined)
+    config.isShowLineNumber = isShowLineNumber
+  // Designer naming -> internal Renderer option naming.
+  const citeStatus = pickBoolean(raw.isCiteStatus)
+  if (citeStatus !== undefined)
+    config.citeStatus = citeStatus
+  const countStatus = pickBoolean(raw.isCountStatus)
+  if (countStatus !== undefined)
+    config.countStatus = countStatus
+  const isUseIndent = pickBoolean(raw.isUseIndent)
+  if (isUseIndent !== undefined)
+    config.isUseIndent = isUseIndent
+  const isUseJustify = pickBoolean(raw.isUseJustify)
+  if (isUseJustify !== undefined)
+    config.isUseJustify = isUseJustify
+
+  const cssContentConfig = raw.cssContentConfig as DesignerCssContentConfigInput | undefined
+  const customCss = resolveCustomCss(
+    typeof cssContentConfig === `object` && cssContentConfig !== null ? cssContentConfig : undefined,
+    options.cssTab,
+  )
+  if (customCss)
+    config.customCss = customCss
+
+  return config
+}
+
+/** Normalize the MCP schema dialect (`citeStatus`, `headingStyles`, ...). */
+export function normalizeMcpConfig(raw: RawStyleConfig): RenderConfigInput {
+  const config: RenderConfigInput = {}
+  const theme = pickEnum(raw.theme, THEME_NAMES)
+  if (theme)
+    config.theme = theme
+  const fontFamily = pickString(raw.fontFamily)
+  if (fontFamily)
+    config.fontFamily = fontFamily
+  const fontSize = pickString(raw.fontSize)
+  if (fontSize)
+    config.fontSize = fontSize
+  const primaryColor = pickString(raw.primaryColor)
+  if (primaryColor)
+    config.primaryColor = primaryColor
+  const lineHeight = pickString(raw.lineHeight)
+  if (lineHeight)
+    config.lineHeight = lineHeight
+  const blockSpacing = pickString(raw.blockSpacing)
+  if (blockSpacing)
+    config.blockSpacing = blockSpacing
+  const linkColor = pickString(raw.linkColor)
+  if (linkColor)
+    config.linkColor = linkColor
+  const blockquoteBackground = pickString(raw.blockquoteBackground)
+  if (blockquoteBackground)
+    config.blockquoteBackground = blockquoteBackground
+  const codeBlockTheme = normalizeCodeBlockTheme(raw.codeBlockTheme)
+  if (codeBlockTheme)
+    config.codeBlockTheme = codeBlockTheme
+  const legend = pickEnum(raw.legend, LEGEND_VALUES)
+  if (legend)
+    config.legend = legend
+  const themeMode = pickEnum(raw.themeMode, THEME_MODES)
+  if (themeMode)
+    config.themeMode = themeMode
+  const isMacCodeBlock = pickBoolean(raw.isMacCodeBlock)
+  if (isMacCodeBlock !== undefined)
+    config.isMacCodeBlock = isMacCodeBlock
+  const isShowLineNumber = pickBoolean(raw.isShowLineNumber)
+  if (isShowLineNumber !== undefined)
+    config.isShowLineNumber = isShowLineNumber
+  const citeStatus = pickBoolean(raw.citeStatus)
+  if (citeStatus !== undefined)
+    config.citeStatus = citeStatus
+  const countStatus = pickBoolean(raw.countStatus)
+  if (countStatus !== undefined)
+    config.countStatus = countStatus
+  const isUseIndent = pickBoolean(raw.isUseIndent)
+  if (isUseIndent !== undefined)
+    config.isUseIndent = isUseIndent
+  const isUseJustify = pickBoolean(raw.isUseJustify)
+  if (isUseJustify !== undefined)
+    config.isUseJustify = isUseJustify
+  const headingStyles = normalizeHeadingStyles(raw.headingStyles)
+  if (headingStyles)
+    config.headingStyles = headingStyles
+  return config
+}
+
+/**
+ * Detect the dialect of a raw config object. The Designer export is
+ * recognized by its `is*` naming or the CSS editor state; anything else is
+ * treated as the MCP alias.
+ */
+export function detectConfigDialect(raw: RawStyleConfig): ConfigDialect {
+  if (`cssContentConfig` in raw || `isCiteStatus` in raw || `isCountStatus` in raw)
+    return `designer`
+  return `mcp`
+}
+
+/** Normalize either dialect to the internal render config. */
+export function normalizeStyleConfig(
+  raw: RawStyleConfig,
+  options: { dialect?: ConfigDialect, cssTab?: string } = {},
+): RenderConfigInput {
+  const dialect = options.dialect ?? detectConfigDialect(raw)
+  return dialect === `designer`
+    ? normalizeDesignerConfig(raw, options)
+    : normalizeMcpConfig(raw)
+}
+
+/**
+ * Apply CLI flag overrides on top of a normalized config.
+ * Precedence: built-in defaults < config file < CLI flags.
+ */
+export function applyFlagOverrides(config: RenderConfigInput, flags: FlagOverrides): RenderConfigInput {
+  const merged: RenderConfigInput = { ...config }
+  for (const [key, value] of Object.entries(flags)) {
+    if (value !== undefined)
+      (merged as Record<string, unknown>)[key] = value
+  }
+  return merged
+}
diff --git a/packages/md-web-cli/src/css-text.d.ts b/packages/md-web-cli/src/css-text.d.ts
new file mode 100644
index 0000000000..4979e0fafd
--- /dev/null
+++ b/packages/md-web-cli/src/css-text.d.ts
@@ -0,0 +1,5 @@
+/** Declares raw-text CSS imports (`*.css?raw`), matching Vite's `?raw` suffix. */
+declare module '*.css?raw' {
+  const content: string
+  export default content
+}
diff --git a/packages/md-web-cli/src/defaults.ts b/packages/md-web-cli/src/defaults.ts
new file mode 100644
index 0000000000..d8158bdcf8
--- /dev/null
+++ b/packages/md-web-cli/src/defaults.ts
@@ -0,0 +1,44 @@
+/**
+ * Site-default style configuration for the md-web-cli render pipeline.
+ *
+ * Mirrors `defaultStyleConfig` in @md/shared/configs/style (the web app's
+ * defaults), NOT the MCP server's `defaultRenderOptions`. Key differences:
+ * the site shows the mac code-block title bar and highlights with the
+ * `github-dark` theme; the MCP defaults use a light theme and no mac bar.
+ */
+import type { HeadingStyles } from '@md/shared/configs/style'
+import type { LegendValue } from './types'
+
+/** Site default font stack (sans-serif) as used by the web app. */
+export const DEFAULT_FONT_FAMILY
+  = '-apple-system-font,BlinkMacSystemFont, Helvetica Neue, PingFang SC, Hiragino Sans GB , Microsoft YaHei UI , Microsoft YaHei ,Arial,sans-serif'
+
+export const siteDefaultRenderConfig = {
+  theme: 'default',
+  primaryColor: '#0F4C81',
+  fontFamily: DEFAULT_FONT_FAMILY,
+  fontSize: '16px',
+  lineHeight: '1.75',
+  blockSpacing: '1',
+  linkColor: '#576b95',
+  blockquoteBackground: 'default',
+  legend: 'alt' as LegendValue,
+  codeBlockTheme: 'github-dark',
+  isMacCodeBlock: true,
+  isShowLineNumber: false,
+  citeStatus: false,
+  countStatus: false,
+  themeMode: 'light' as const,
+  isUseIndent: false,
+  isUseJustify: false,
+}
+
+/**
+ * Effective heading-style default. The Designer export cannot carry
+ * `headingStyles`, so both sides resolve its absence to "no per-level
+ * overrides" rather than inventing one; `tests/defaults.test.ts` asserts this
+ * matches the app's own default.
+ */
+export const siteDefaultHeadingStyles: HeadingStyles = {}
+
+export type SiteDefaultRenderConfig = typeof siteDefaultRenderConfig
diff --git a/packages/md-web-cli/src/render.ts b/packages/md-web-cli/src/render.ts
new file mode 100644
index 0000000000..4c6c6b5bb8
--- /dev/null
+++ b/packages/md-web-cli/src/render.ts
@@ -0,0 +1,134 @@
+/**
+ * Render pipeline entry for md-web-cli.
+ *
+ * Mirrors the MCP server's pipeline (marked + custom renderer + HTML
+ * post-processing + merged CSS in a <style> block) but bundles every asset
+ * locally: theme CSS is inlined at build time and code themes come from
+ * vendored files — zero network requests.
+ *
+ * Output is an intermediate form carrying a <style> block; CSS inlining into
+ * style attributes (juice + WeChat post-processing) is ticket 04's job.
+ */
+import type { HeadingStyles } from '@md/shared/configs/style'
+import type { RenderConfigInput } from './types'
+import { initRenderer } from '@md/core/renderer'
+import { generateCSSVariables, generateHeadingStyles, processCSS } from '@md/core/theme'
+import { postProcessHtml, renderMarkdown } from '@md/core/utils'
+import { baseCSSContent, codeBlockThemeMap, isKnownCodeBlockTheme, themeMap } from './assets'
+import { siteDefaultRenderConfig } from './defaults'
+
+function escapeStyleContent(css: string): string {
+  return css.replace(/<\/style/gi, `<\\/style`)
+}
+
+/** Default body text color (site copy flow inherits rgb(10,10,10) from body). */
+export const DEFAULT_BODY_COLOR = `rgb(10,10,10)`
+
+function resolveHeadingStyles(config: RenderConfigInput): HeadingStyles | undefined {
+  return config.headingStyles
+}
+
+/**
+ * Body text color applied the way the copy flow does: a rule on the output
+ * container that every element inherits. Default rgb(10,10,10). The rendered
+ * fragment's root element is `<section class="container">`, so target that —
+ * juice inlines it onto the container in WeChat output.
+ */
+function generateBodyColorCSS(bodyColor: string): string {
+  return `section.container {\n  color: ${bodyColor};\n}`
+}
+
+/**
+ * Unscope the site's `#output`-scoped custom CSS so it matches the rendered
+ * fragment (apps/web stripOutputScope, before juice). `#output x` -> `x`;
+ * a bare `#output {` rule becomes the container rule.
+ */
+function unscopeCustomCSS(css: string): string {
+  return css
+    .replace(/#output\s*\{/g, `section.container {`)
+    .replace(/#output\s+/g, ``)
+    .replace(/^#output\s*/gm, ``)
+}
+
+export interface RenderResult {
+  html: string
+  readingTime: {
+    words: number
+    minutes: number
+  }
+}
+
+export function renderMarkdownToStyledHtml(markdown: string, config: RenderConfigInput = {}): RenderResult {
+  const theme = config.theme ?? siteDefaultRenderConfig.theme
+  const primaryColor = config.primaryColor ?? siteDefaultRenderConfig.primaryColor
+  const fontFamily = config.fontFamily ?? siteDefaultRenderConfig.fontFamily
+  const fontSize = config.fontSize ?? siteDefaultRenderConfig.fontSize
+  const lineHeight = config.lineHeight ?? siteDefaultRenderConfig.lineHeight
+  const blockSpacing = config.blockSpacing ?? siteDefaultRenderConfig.blockSpacing
+  const linkColor = config.linkColor ?? siteDefaultRenderConfig.linkColor
+  const blockquoteBackground = config.blockquoteBackground ?? siteDefaultRenderConfig.blockquoteBackground
+  const legend = config.legend ?? siteDefaultRenderConfig.legend
+  const codeBlockTheme = config.codeBlockTheme ?? siteDefaultRenderConfig.codeBlockTheme
+
+  if (!isKnownCodeBlockTheme(codeBlockTheme)) {
+    throw new Error(
+      `Unknown code block theme "${codeBlockTheme}". Known themes: ${Object.keys(codeBlockThemeMap).join(', ')}`,
+    )
+  }
+
+  const renderer = initRenderer({
+    isMacCodeBlock: config.isMacCodeBlock ?? siteDefaultRenderConfig.isMacCodeBlock,
+    isShowLineNumber: config.isShowLineNumber ?? siteDefaultRenderConfig.isShowLineNumber,
+    citeStatus: config.citeStatus ?? siteDefaultRenderConfig.citeStatus,
+    countStatus: config.countStatus ?? siteDefaultRenderConfig.countStatus,
+    themeMode: config.themeMode ?? siteDefaultRenderConfig.themeMode,
+    legend,
+  })
+
+  const { html: baseHtml, readingTime } = renderMarkdown(markdown, renderer)
+  const processedHtml = postProcessHtml(baseHtml, readingTime, renderer)
+
+  const cssConfig = {
+    primaryColor,
+    fontFamily,
+    fontSize,
+    lineHeight,
+    blockSpacing,
+    linkColor,
+    blockquoteBackground,
+    isUseIndent: config.isUseIndent ?? siteDefaultRenderConfig.isUseIndent,
+    isUseJustify: config.isUseJustify ?? siteDefaultRenderConfig.isUseJustify,
+    headingStyles: resolveHeadingStyles(config),
+  }
+
+  const variablesCSS = generateCSSVariables(cssConfig)
+  const headingStylesCSS = generateHeadingStyles(cssConfig)
+  const themeCSS = themeMap[theme as keyof typeof themeMap]
+  const hljsCSS = codeBlockThemeMap[codeBlockTheme]
+
+  // Order mirrors the site's applyTheme: variables, base, theme, heading
+  // styles, then the active CSS editor tab's custom CSS (site scopes custom
+  // CSS to #output; the intermediate form already targets #output).
+  const customCSS = config.customCss?.trim() ? unscopeCustomCSS(config.customCss) : ``
+  const bodyColorCSS = generateBodyColorCSS(config.bodyColor ?? DEFAULT_BODY_COLOR)
+
+  const mergedCSS = [
+    variablesCSS,
+    baseCSSContent,
+    themeCSS,
+    headingStylesCSS,
+    hljsCSS,
+    customCSS,
+    bodyColorCSS,
+  ].filter(Boolean).join(`\n\n`)
+
+  const html = `<style>\n${escapeStyleContent(processCSS(mergedCSS))}\n</style>\n${processedHtml}`
+
+  return {
+    html,
+    readingTime: {
+      words: readingTime.words,
+      minutes: readingTime.minutes,
+    },
+  }
+}
diff --git a/packages/md-web-cli/src/types.ts b/packages/md-web-cli/src/types.ts
new file mode 100644
index 0000000000..7bfaa015d4
--- /dev/null
+++ b/packages/md-web-cli/src/types.ts
@@ -0,0 +1,33 @@
+/** Shared types for the md-web-cli render pipeline. */
+
+import type { HeadingStyles } from '@md/shared/configs/style'
+
+/** Figure legend display mode, mirroring @md/shared legendOptions values. */
+export type LegendValue = 'title-alt' | 'alt-title' | 'title' | 'alt' | 'filename' | 'none'
+
+/** Options accepted by the render pipeline; all fall back to site defaults. */
+export interface RenderConfigInput {
+  theme?: 'default' | 'grace' | 'simple'
+  primaryColor?: string
+  fontFamily?: string
+  fontSize?: string
+  lineHeight?: string
+  blockSpacing?: string
+  linkColor?: string
+  blockquoteBackground?: string
+  legend?: LegendValue
+  codeBlockTheme?: string
+  isMacCodeBlock?: boolean
+  isShowLineNumber?: boolean
+  citeStatus?: boolean
+  countStatus?: boolean
+  themeMode?: 'light' | 'dark'
+  isUseIndent?: boolean
+  isUseJustify?: boolean
+  /** Per-level heading style presets (MCP dialect key: headingStyles). */
+  headingStyles?: HeadingStyles
+  /** Active CSS editor tab's custom CSS (Designer dialect), merged after theme CSS. */
+  customCss?: string
+  /** Body text color, default rgb(10,10,10); applied the way the copy flow does. */
+  bodyColor?: string
+}
diff --git a/packages/md-web-cli/src/wechat.ts b/packages/md-web-cli/src/wechat.ts
new file mode 100644
index 0000000000..7a94b72bac
--- /dev/null
+++ b/packages/md-web-cli/src/wechat.ts
@@ -0,0 +1,370 @@
+/**
+ * WeChat-ready output pipeline for md-web-cli.
+ *
+ * CSS inlining + WeChat post-processing vendored from the official copy flow in
+ * apps/web/src/services/export/clipboard.ts and clipboard-dom.ts (juice options,
+ * nested-list hoisting, img width/height -> inline style, zero-font-size
+ * paragraph bracketing, hsl()/var() literal resolution). Vendored — not imported
+ * — so this package never depends on apps/web.
+ *
+ * Also detects pending async placeholders (mermaid / KaTeX / infographic /
+ * unregistered code languages) so the CLI can fail loudly instead of silently
+ * stripping them.
+ */
+import type { RenderConfigInput } from './types'
+import process from 'node:process'
+import { JSDOM } from 'jsdom'
+import juice from 'juice'
+import { siteDefaultRenderConfig } from './defaults'
+import { renderMarkdownToStyledHtml } from './render'
+
+const JUICE_OPTIONS = {
+  inlinePseudoElements: true,
+  preserveImportant: true,
+  resolveCSSVariables: false,
+} as const
+
+// ---------------------------------------------------------------------------
+// Vendored from apps/web/src/services/export/clipboard-dom.ts
+// ---------------------------------------------------------------------------
+
+const GENERIC_FONT_FAMILIES = /^(?:serif|sans-serif|monospace|cursive|fantasy|system-ui|ui-sans-serif|ui-serif|ui-monospace|ui-rounded|inherit|initial|unset|revert|revert-layer)$/i
+
+/** Mermaid may emit `style="undefined;"` on edges; juice's CSS parser then throws. */
+function isUndefinedCssValue(value: string): boolean {
+  const normalized = value.replace(/\s*!important$/i, ``).trim()
+  return !normalized || /^undefined$/i.test(normalized) || /\bundefined\b/i.test(normalized)
+}
+
+function mapFontFamilyName(family: string): string {
+  const unquoted = family.replace(/["']/g, ``).trim()
+  if (!unquoted)
+    return family
+  if (/^var\(/i.test(family))
+    return family
+  if (GENERIC_FONT_FAMILIES.test(unquoted))
+    return unquoted
+  // Quote multi-word / CJK names so juice/PostCSS can parse them.
+  if (/\s/.test(unquoted) || unquoted.split(``).some(ch => ch.charCodeAt(0) > 127))
+    return `'${unquoted}'`
+  return unquoted
+}
+
+function quoteFontFamilyList(value: string): string {
+  return value
+    .split(/,(?=(?:[^'"]|'[^']*'|"[^"]*")*$)/)
+    .map(part => mapFontFamilyName(part.trim()))
+    .filter(Boolean)
+    .join(`, `)
+}
+
+/** C4 / sequence / gantt default to unquoted `Open Sans`, which juice/PostCSS rejects. */
+function quoteUnquotedFontFamilies(css: string): string {
+  return css
+    .replace(/font-family\s*:\s*([^;}{]+)/gi, (_, value: string) => `font-family: ${quoteFontFamilyList(value)}`)
+    .replace(/(?<!['"])\bOpen Sans\b(?!['"])/gi, `sans-serif`)
+}
+
+function decodeStyleAttr(value: string): string {
+  return value
+    .replace(/&quot;/g, `"`)
+    .replace(/&#34;/g, `"`)
+    .replace(/&apos;|&#39;/g, `'`)
+    .replace(/&amp;/g, `&`)
+}
+
+function encodeStyleAttr(value: string, quote: string): string {
+  let next = value.replace(/&/g, `&amp;`)
+  if (quote === `"`)
+    next = next.replace(/"/g, `&quot;`)
+  else
+    next = next.replace(/'/g, `&#39;`)
+  return next
+}
+
+function sanitizeCssDeclarations(css: string): string {
+  const cleaned = css
+    .split(`;`)
+    .map(part => part.trim())
+    .filter((part) => {
+      if (!part || /^undefined$/i.test(part))
+        return false
+      const colon = part.indexOf(`:`)
+      if (colon === -1)
+        return false
+      return !isUndefinedCssValue(part.slice(colon + 1))
+    })
+    .join(`; `)
+  return quoteUnquotedFontFamilies(cleaned)
+}
+
+function sanitizeEmbeddedStylesheet(css: string): string {
+  return quoteUnquotedFontFamilies(
+    css.replace(/([a-z_-]+)\s*:\s*undefined\b\s*;?/gi, ``),
+  )
+}
+
+/**
+ * Quote / drop juice-invalid CSS in the HTML string juice actually parses.
+ * (apps/web: sanitizeHtmlCssForJuice)
+ */
+function sanitizeHtmlCssForJuice(html: string): string {
+  const withStyleAttrs = html.replace(/\sstyle\s*=\s*(["'])([\s\S]*?)\1/gi, (_full, quote: string, value: string) => {
+    const sanitized = sanitizeCssDeclarations(decodeStyleAttr(value))
+    return ` style=${quote}${encodeStyleAttr(sanitized, quote)}${quote}`
+  })
+
+  const withSheets = withStyleAttrs.replace(/(<style\b[^>]*>)([\s\S]*?)(<\/style>)/gi, (_full, open: string, css: string, close: string) => {
+    return `${open}${sanitizeEmbeddedStylesheet(css)}${close}`
+  })
+
+  return withFontAttrs(withSheets)
+}
+
+function withFontAttrs(html: string): string {
+  return html
+    .replace(/\sfont-family\s*=\s*(["'])([\s\S]*?)\1/gi, (_full, quote: string, value: string) => {
+      return ` font-family=${quote}${encodeStyleAttr(quoteFontFamilyList(decodeStyleAttr(value)), quote)}${quote}`
+    })
+    .replace(/(?<!['"])\bOpen Sans\b(?!['"])/gi, `sans-serif`)
+}
+
+function stripFontFamilyForJuiceFallback(html: string): string {
+  return html
+    .replace(/font-family\s*:[^;}{]+;?/gi, ``)
+    .replace(/\sfont-family\s*=\s*(["'])[\s\S]*?\1/gi, ``)
+    .replace(/(?<!['"])\bOpen Sans\b(?!['"])/gi, `sans-serif`)
+}
+
+/** Inlined via the same juice options the official WeChat copy flow uses. */
+function mergeCss(html: string): string {
+  const sanitized = sanitizeHtmlCssForJuice(html)
+  const attempts = [
+    () => juice(sanitized, JUICE_OPTIONS),
+    () => juice(sanitized, { ...JUICE_OPTIONS, inlinePseudoElements: false }),
+    () => juice(stripFontFamilyForJuiceFallback(sanitized), { ...JUICE_OPTIONS, inlinePseudoElements: false }),
+  ]
+
+  for (const attempt of attempts) {
+    try {
+      return attempt()
+    }
+    catch {
+      // Fall through to the next, progressively laxer juice attempt.
+    }
+  }
+
+  // Every juice attempt failed: returning the un-inlined form would silently
+  // ship a non-WeChat-ready artifact (<style> block, no inline styles). The
+  // spec's loud-failure spirit says warn on stderr instead of staying quiet.
+  process.stderr.write(`md-web-cli: warning - CSS inlining failed after all fallback attempts; output still carries a <style> block and is NOT WeChat-ready\n`)
+  return sanitized
+}
+
+/**
+ * Hoist nested lists out of list items (WeChat drops them otherwise).
+ * (apps/web: modifyHtmlStructure)
+ */
+function hoistNestedLists(html: string): string {
+  const root = new JSDOM(html).window.document.body
+  root.querySelectorAll(`li > ul, li > ol`).forEach((nested) => {
+    nested.parentElement?.insertAdjacentElement(`afterend`, nested)
+  })
+  return root.innerHTML
+}
+
+/** Convert img width/height attributes to inline styles (apps/web: solveWeChatImage). */
+function convertImageDimensionsToStyle(html: string): string {
+  const root = new JSDOM(html).window.document.body
+  root.querySelectorAll(`img`).forEach((image) => {
+    const width = image.getAttribute(`width`)
+    const height = image.getAttribute(`height`)
+    if (width) {
+      image.removeAttribute(`width`)
+      image.style.width = /^\d+$/.test(width) ? `${width}px` : width
+    }
+    if (height) {
+      image.removeAttribute(`height`)
+      image.style.height = /^\d+$/.test(height) ? `${height}px` : height
+    }
+  })
+  return root.innerHTML
+}
+
+/**
+ * Bracket the output with zero-font-size empty paragraphs so WeChat does not
+ * inject its own leading/trailing paragraphs. (apps/web: createEmptyNode)
+ */
+function bracketWithZeroFontParagraphs(html: string): string {
+  const root = new JSDOM(html).window.document.body
+  const bracket = root.ownerDocument!.createElement(`p`)
+  bracket.style.fontSize = `0`
+  bracket.style.lineHeight = `0`
+  bracket.style.margin = `0`
+  bracket.innerHTML = `&nbsp;`
+  root.insertBefore(bracket.cloneNode(true), root.firstChild)
+  root.appendChild(bracket.cloneNode(true))
+  return root.innerHTML
+}
+
+// ---------------------------------------------------------------------------
+// Vendored from apps/web/src/services/export/clipboard.ts (var()/hsl() literals)
+// ---------------------------------------------------------------------------
+
+export interface WeChatVariableValues {
+  primaryColor: string
+  fontFamily: string
+  fontSize: string
+  lineHeight: string
+  blockSpacing: string
+}
+
+/**
+ * Resolve hsl()/var() literals to concrete values — WeChat strips <style> blocks
+ * and CSS custom properties on paste.
+ */
+function resolveCssLiterals(html: string, values: WeChatVariableValues): string {
+  return html
+    .replace(/([^-])top:(.*?)em/g, `$1transform: translateY($2em)`)
+    .replace(/hsl\(var\(--foreground\)\)/g, `#3f3f3f`)
+    .replace(/var\(--blockquote-background\)/g, `#f7f7f7`)
+    .replace(/var\(--md-primary-color\)/g, values.primaryColor)
+    .replace(/var\(--md-font-family\)/g, values.fontFamily)
+    .replace(/var\(--md-font-size\)/g, values.fontSize)
+    .replace(/var\(--md-line-height\)/g, values.lineHeight)
+    .replace(/var\(--md-block-spacing\)/g, values.blockSpacing)
+    .replace(/--md-primary-color:.+?;/g, ``)
+    .replace(/--md-font-family:.+?;/g, ``)
+    .replace(/--md-font-size:.+?;/g, ``)
+    .replace(/--md-line-height:.+?;/g, ``)
+    .replace(/--md-block-spacing:.+?;/g, ``)
+    .replace(/--md-link-color:.+?;/g, ``)
+    .replace(/--md-blockquote-background:.+?;/g, ``)
+    .replace(
+      /<span class="nodeLabel"([^>]*)><p[^>]*>(.*?)<\/p><\/span>/g,
+      `<span class="nodeLabel"$1>$2</span>`,
+    )
+    .replace(
+      /<span class="edgeLabel"([^>]*)><p[^>]*>(.*?)<\/p><\/span>/g,
+      `<span class="edgeLabel"$1>$2</span>`,
+    )
+}
+
+/** WeChat-ready HTML must carry no class attributes and no <style> block. */
+function stripClassAttributes(html: string): string {
+  return html.replace(/\sclass\s*=\s*(["'])[\s\S]*?\1/gi, ``)
+}
+
+// ---------------------------------------------------------------------------
+// Pending placeholder detection
+// ---------------------------------------------------------------------------
+
+export interface PendingPlaceholder {
+  /** Human-readable kind, e.g. "mermaid diagram", "unregistered code language". */
+  kind: string
+  /** What exactly is pending (language name, block class, ...). */
+  detail: string
+  /** How the user can resolve it. */
+  wayForward: string
+}
+
+const WAY_FORWARD_DIAGRAM = `render the diagram manually (e.g. in the doocs/md web app) and paste the resulting SVG/HTML, or fall back to the browser backend temporarily`
+const WAY_FORWARD_MATH = `render the formula manually (e.g. in the doocs/md web app) and paste the resulting HTML, or fall back to the browser backend temporarily`
+const WAY_FORWARD_LANGUAGE = `register the language via a supported highlight theme, use a registered language (bash, css, javascript, json, markdown, plaintext, python, shell, typescript, xml), or fall back to the browser backend temporarily`
+
+/**
+ * Scan rendered HTML for pending async placeholders. The renderer marks them
+ * with data-md-diagram-state="loading" (mermaid/plantuml/infographic),
+ * katex-pending elements (KaTeX before MathJax resolves) and
+ * data-language-pending (code languages whose highlight.js grammar is not
+ * bundled). Scans the DOM body — the theme CSS legitimately mentions
+ * `.katex-pending` selectors that must not read as pending content.
+ */
+export function detectPendingPlaceholders(html: string): PendingPlaceholder[] {
+  const pending: PendingPlaceholder[] = []
+  // Strip the leading <style> block the intermediate form carries; selectors
+  // such as `.katex-pending` would otherwise match the regex scans below.
+  const bodyHtml = html.replace(/^<style>[\s\S]*?<\/style>/, ``)
+
+  const diagramRegex = /<div[^>]*class="([^"]*)"[^>]*data-md-diagram-state="loading"/g
+  for (const match of bodyHtml.matchAll(diagramRegex)) {
+    const className = match[1]
+    if (className.includes(`mermaid-diagram`))
+      pending.push({ kind: `mermaid diagram`, detail: className, wayForward: WAY_FORWARD_DIAGRAM })
+    else if (className.includes(`infographic-diagram`))
+      pending.push({ kind: `infographic`, detail: className, wayForward: WAY_FORWARD_DIAGRAM })
+    else if (className.includes(`plantuml-diagram`))
+      pending.push({ kind: `plantuml diagram`, detail: className, wayForward: WAY_FORWARD_DIAGRAM })
+    else
+      pending.push({ kind: `async diagram`, detail: className, wayForward: WAY_FORWARD_DIAGRAM })
+  }
+
+  if (/<[^>]*\bkatex-pending\b/.test(bodyHtml))
+    pending.push({ kind: `KaTeX formula`, detail: `katex-pending`, wayForward: WAY_FORWARD_MATH })
+
+  for (const match of bodyHtml.matchAll(/data-language-pending="([^"]*)"/g))
+    pending.push({ kind: `unregistered code language`, detail: match[1], wayForward: WAY_FORWARD_LANGUAGE })
+
+  return pending
+}
+
+// ---------------------------------------------------------------------------
+// Public entry points
+// ---------------------------------------------------------------------------
+
+export interface WeChatRenderResult {
+  html: string
+  readingTime: {
+    words: number
+    minutes: number
+  }
+}
+
+/**
+ * Render Markdown to WeChat-ready HTML: inline styles everywhere, no class
+ * attributes, no <style> block, WeChat post-processing applied.
+ * Throws if the render produces pending placeholders (mermaid, KaTeX,
+ * infographic, unregistered code languages) — they must never be silently
+ * stripped.
+ */
+export function renderMarkdownToWeChatHtml(markdown: string, config: RenderConfigInput = {}): WeChatRenderResult {
+  const styled = renderMarkdownToStyledHtml(markdown, config)
+
+  const pending = detectPendingPlaceholders(styled.html)
+  if (pending.length > 0) {
+    const first = pending[0]
+    throw new PendingPlaceholderError(pending, `pending ${first.kind} ("${first.detail}") cannot be rendered offline: ${first.wayForward}`)
+  }
+
+  const values: WeChatVariableValues = {
+    primaryColor: config.primaryColor ?? siteDefaultRenderConfig.primaryColor,
+    fontFamily: config.fontFamily ?? siteDefaultRenderConfig.fontFamily,
+    fontSize: config.fontSize ?? siteDefaultRenderConfig.fontSize,
+    lineHeight: config.lineHeight ?? siteDefaultRenderConfig.lineHeight,
+    blockSpacing: config.blockSpacing ?? siteDefaultRenderConfig.blockSpacing,
+  }
+
+  let html = mergeCss(styled.html)
+  html = hoistNestedLists(html)
+
+  // Inline anchors are meaningless in WeChat articles.
+  html = html.replace(/<a([^>]*)href="#[^"]*"([^>]*)>/gi, `<a$1$2>`)
+
+  html = resolveCssLiterals(html, values)
+  html = convertImageDimensionsToStyle(html)
+  html = bracketWithZeroFontParagraphs(html)
+  html = stripClassAttributes(html)
+
+  return { html, readingTime: styled.readingTime }
+}
+
+/** Thrown when rendering leaves pending placeholders (mermaid, KaTeX, ...). */
+export class PendingPlaceholderError extends Error {
+  readonly placeholders: PendingPlaceholder[]
+
+  constructor(placeholders: PendingPlaceholder[], message: string) {
+    super(message)
+    this.name = `PendingPlaceholderError`
+    this.placeholders = placeholders
+  }
+}
diff --git a/packages/md-web-cli/tests/cli.test.ts b/packages/md-web-cli/tests/cli.test.ts
new file mode 100644
index 0000000000..0623788570
--- /dev/null
+++ b/packages/md-web-cli/tests/cli.test.ts
@@ -0,0 +1,156 @@
+import { execFileSync } from 'node:child_process'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+
+const root = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..')
+const cliPath = path.join(root, 'dist/cli.js')
+const fixturePath = path.join(root, 'fixtures/full.md')
+
+const tmpDirs: string[] = []
+
+function makeTmpDir(): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'md-web-cli-'))
+  tmpDirs.push(dir)
+  return dir
+}
+
+function runCli(args: string[]): { status: number, stdout: string, stderr: string } {
+  try {
+    // Network is not policed here: Node's fetch ignores HTTP_PROXY unless
+    // --use-env-proxy is passed (and this machine sets none), so a proxy env
+    // var guards nothing. The zero-network guarantee is proven directly in
+    // offline.test.ts: a poisoning preload plus a loopback sink that counts
+    // every outbound connect attempt.
+    const stdout = execFileSync(process.execPath, [cliPath, ...args], { encoding: 'utf-8' })
+    return { status: 0, stdout, stderr: '' }
+  }
+  catch (error: any) {
+    return {
+      status: error.status ?? 1,
+      stdout: error.stdout ?? '',
+      stderr: error.stderr ?? String(error.message),
+    }
+  }
+}
+
+afterAll(() => {
+  for (const dir of tmpDirs)
+    fs.rmSync(dir, { recursive: true, force: true })
+})
+
+describe('cli subprocess: render', () => {
+  it('converts the fixture to WeChat-ready HTML with inlined styles and full body', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const result = runCli(['render', fixturePath, '-o', out])
+
+    expect(result.status).toBe(0)
+    expect(fs.existsSync(out)).toBe(true)
+    const html = fs.readFileSync(out, 'utf-8')
+    // Ticket 04: no <style> block — everything is inlined into style attributes.
+    expect((html.match(/<style/g) ?? []).length).toBe(0)
+    expect(html).not.toMatch(/\sclass\s*=/i)
+    expect(html).toContain('font-family')
+    // Mac code-block title bar survives class stripping as an inlined span.
+    expect(html).toContain('padding: 10px 14px 0')
+  }, 30_000)
+
+  it('exits non-zero with a clear stderr message for a missing input file', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const result = runCli(['render', path.join(dir, 'missing.md'), '-o', out])
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toMatch(/Input file not found/)
+  })
+
+  it('exits non-zero when -o is missing', () => {
+    const result = runCli(['render', fixturePath])
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toMatch(/-o/)
+  })
+
+  it('rejects unknown commands', () => {
+    const result = runCli(['frobnicate'])
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toMatch(/Unknown command/)
+  })
+})
+
+describe('cli subprocess: WeChat output + pending placeholders (ticket 04)', () => {
+  function writeFixture(dir: string, content: string): string {
+    const file = path.join(dir, 'in.md')
+    fs.writeFileSync(file, content, 'utf-8')
+    return file
+  }
+
+  it('clean fixture exits zero, empty stderr, WeChat-ready output without placeholder residue', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const result = runCli(['render', fixturePath, '-o', out])
+
+    expect(result.status).toBe(0)
+    expect(result.stderr).toBe('')
+    expect(fs.existsSync(out)).toBe(true)
+    const html = fs.readFileSync(out, 'utf-8')
+    expect((html.match(/<style/g) ?? []).length).toBe(0)
+    expect(html.match(/\sclass\s*=/i)).toBeNull()
+    expect(html).not.toMatch(/data-md-diagram-state="loading"/)
+    expect(html).not.toMatch(/data-language-pending/)
+    expect(html).not.toMatch(/Loading Mermaid|Loading infographic|Loading PlantUML/)
+    // Every block-level element carries an inline style. Bare <tr> is
+    // acceptable: the renderer emits styled cells, and WeChat ignores tr styles.
+    for (const match of html.matchAll(/<(section|p|h[1-6]|ul|ol|li|table|th|td|blockquote|pre)\b([^>]*)>/gi)) {
+      expect(match[2]).toMatch(/\sstyle=/i)
+    }
+  }, 60_000)
+
+  it('mermaid fence exits non-zero, writes no output file, explains cause and way forward', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const input = writeFixture(dir, '# Diagram\n\n```mermaid\ngraph TD\nA-->B\n```\n')
+    const result = runCli(['render', input, '-o', out])
+
+    expect(result.status).not.toBe(0)
+    expect(fs.existsSync(out)).toBe(false)
+    expect(result.stderr).toMatch(/mermaid/i)
+    expect(result.stderr).toMatch(/handle the diagram manually|fall back to the browser backend/i)
+  }, 60_000)
+
+  it('katex syntax exits non-zero the same way', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const input = writeFixture(dir, 'Math: $e^{i\\pi}+1=0$\n')
+    const result = runCli(['render', input, '-o', out])
+
+    expect(result.status).not.toBe(0)
+    expect(fs.existsSync(out)).toBe(false)
+    expect(result.stderr).toMatch(/KaTeX/i)
+    expect(result.stderr).toMatch(/fall back to the browser backend/i)
+  }, 60_000)
+
+  it('infographic block exits non-zero the same way', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const input = writeFixture(dir, '```infographic\n{"type":"bar","data":[1,2]}\n```\n')
+    const result = runCli(['render', input, '-o', out])
+
+    expect(result.status).not.toBe(0)
+    expect(fs.existsSync(out)).toBe(false)
+    expect(result.stderr).toMatch(/infographic/i)
+    expect(result.stderr).toMatch(/handle the diagram manually|fall back to the browser backend/i)
+  }, 60_000)
+
+  it('unregistered code language (go) exits non-zero the same way', () => {
+    const dir = makeTmpDir()
+    const out = path.join(dir, 'out.html')
+    const input = writeFixture(dir, '```go\nfunc main() {}\n```\n')
+    const result = runCli(['render', input, '-o', out])
+
+    expect(result.status).not.toBe(0)
+    expect(fs.existsSync(out)).toBe(false)
+    expect(result.stderr).toMatch(/\bgo\b/)
+    expect(result.stderr).toMatch(/fall back to the browser backend/i)
+  }, 60_000)
+})
diff --git a/packages/md-web-cli/tests/config.test.ts b/packages/md-web-cli/tests/config.test.ts
new file mode 100644
index 0000000000..4050dfa7a1
--- /dev/null
+++ b/packages/md-web-cli/tests/config.test.ts
@@ -0,0 +1,234 @@
+import { describe, expect, it } from 'vitest'
+import {
+  applyFlagOverrides,
+  detectConfigDialect,
+  normalizeDesignerConfig,
+  normalizeMcpConfig,
+  normalizeStyleConfig,
+  resolveCustomCss,
+} from '../src/config'
+import { renderMarkdownToStyledHtml } from '../src/render'
+import { renderMarkdownToWeChatHtml } from '../src/wechat'
+
+const designerExport = {
+  isDark: false,
+  isOpenRightSlider: true,
+  // UI toggles / article content — junk keys that must be ignored silently.
+  posts: [{ id: `p1`, content: `# junk` }],
+  titleList: [],
+  readingTime: { words: 999, minutes: 5 },
+  isShowCssEditor: true,
+  theme: `grace`,
+  fontFamily: `Menlo, Monaco, 'Courier New', monospace`,
+  fontSize: `17px`,
+  primaryColor: `#FA5151`,
+  codeBlockTheme: `https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/11.11.1/styles/monokai.min.css`,
+  legend: `title-alt`,
+  isMacCodeBlock: false,
+  isShowLineNumber: true,
+  isCiteStatus: true,
+  isCountStatus: true,
+  isUseIndent: true,
+  isUseJustify: true,
+  cssContentConfig: {
+    active: `tab-2`,
+    tabs: [
+      { id: `tab-1`, title: `First`, name: `First`, content: `h1 { color: red; }` },
+      { id: `tab-2`, title: `Second`, name: `Second`, content: `h2 { color: blue; }` },
+    ],
+  },
+}
+
+describe('normalizeDesignerConfig', () => {
+  it('maps the twelve styling keys of a Designer export, key by key', () => {
+    const config = normalizeDesignerConfig(designerExport)
+    // 1. theme
+    expect(config.theme).toBe(`grace`)
+    // 2. primaryColor
+    expect(config.primaryColor).toBe(`#FA5151`)
+    // 3. fontFamily
+    expect(config.fontFamily).toBe(`Menlo, Monaco, 'Courier New', monospace`)
+    // 4. fontSize
+    expect(config.fontSize).toBe(`17px`)
+    // 5. codeBlockTheme (MCP preset URL -> friendly hljs name)
+    expect(config.codeBlockTheme).toBe(`monokai`)
+    // 6. legend
+    expect(config.legend).toBe(`title-alt`)
+    // 7. isMacCodeBlock
+    expect(config.isMacCodeBlock).toBe(false)
+    // 8. isShowLineNumber
+    expect(config.isShowLineNumber).toBe(true)
+    // 9. isCiteStatus -> citeStatus
+    expect(config.citeStatus).toBe(true)
+    // 10. isCountStatus -> countStatus
+    expect(config.countStatus).toBe(true)
+    // 11. isUseIndent
+    expect(config.isUseIndent).toBe(true)
+    // 12. isUseJustify
+    expect(config.isUseJustify).toBe(true)
+    // Plus the CSS editor state -> active tab CSS.
+    expect(config.customCss).toBe(`h2 { color: blue; }`)
+  })
+
+  it('ignores junk keys and article content silently', () => {
+    const config = normalizeDesignerConfig({
+      ...designerExport,
+      posts: [{ id: 'x', content: '# huge article' }],
+      someUnknownFutureKey: { nested: true },
+      isOpenRightSlider: false,
+    })
+    expect(config).not.toHaveProperty('posts')
+    expect(config).not.toHaveProperty('someUnknownFutureKey')
+    expect(config).not.toHaveProperty('isOpenRightSlider')
+    expect(config.theme).toBe(`grace`)
+  })
+
+  it('leaves the five keys absent from Designer exports unset (site defaults apply)', () => {
+    const config = normalizeDesignerConfig(designerExport)
+    expect(config.lineHeight).toBeUndefined()
+    expect(config.blockSpacing).toBeUndefined()
+    expect(config.linkColor).toBeUndefined()
+    expect(config.blockquoteBackground).toBeUndefined()
+    expect(config.headingStyles).toBeUndefined()
+  })
+})
+
+describe('multi-tab CSS editor config', () => {
+  it('applies only the active tab\'s CSS; other tabs do not interfere', () => {
+    const raw = {
+      isCiteStatus: false,
+      cssContentConfig: designerExport.cssContentConfig,
+    }
+    const styled = renderMarkdownToStyledHtml(`# Hello`, normalizeDesignerConfig(raw))
+    expect(styled.html).toContain(`h2 { color: blue; }`)
+    // Neither tab-1's custom CSS nor the default theme may leak into the output.
+    // Compare semantically: custom CSS is re-serialized by the CSS pipeline
+    // (whitespace collapsed, colors lowercased), so a literal `color: red`
+    // would never match and the assertion would pass no matter what.
+    expect(styled.html).not.toMatch(/color:\s*(?:#f00|#ff0000|rgba?\(\s*255,\s*0,\s*0\b)/i)
+    expect(styled.html).not.toMatch(/color:\s*red\b/i)
+  })
+
+  it('--css-tab overrides the selection by id or name', () => {
+    const styledById = renderMarkdownToStyledHtml(
+      `# Hello`,
+      normalizeDesignerConfig(designerExport, { cssTab: `tab-1` }),
+    )
+    expect(styledById.html).toContain(`h1 { color: red; }`)
+    expect(styledById.html).not.toContain(`color: blue`)
+
+    const styledByName = renderMarkdownToStyledHtml(
+      `# Hello`,
+      normalizeStyleConfig(designerExport, { dialect: `designer`, cssTab: `Second` }),
+    )
+    expect(styledByName.html).toContain(`h2 { color: blue; }`)
+
+    expect(() => normalizeDesignerConfig(designerExport, { cssTab: `nope` }))
+      .toThrowError(/does not match any CSS editor tab/)
+  })
+
+  it('falls back to the first tab when no active marker matches', () => {
+    const css = resolveCustomCss({ active: `missing`, tabs: designerExport.cssContentConfig.tabs })
+    expect(css).toBe(`h1 { color: red; }`)
+  })
+})
+
+describe('dialect equivalence', () => {
+  const designerDialect = normalizeDesignerConfig({
+    theme: `simple`,
+    primaryColor: `#009874`,
+    fontFamily: `Optima-Regular, Optima, PingFangSC-light, serif`,
+    fontSize: `15px`,
+    legend: `none`,
+    isMacCodeBlock: true,
+    isShowLineNumber: true,
+    isCiteStatus: true,
+    isCountStatus: true,
+    isUseIndent: false,
+    isUseJustify: false,
+    codeBlockTheme: `https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/11.11.1/styles/github.min.css`,
+  })
+
+  const mcpDialect = normalizeMcpConfig({
+    theme: `simple`,
+    primaryColor: `#009874`,
+    fontFamily: `Optima-Regular, Optima, PingFangSC-light, serif`,
+    fontSize: `15px`,
+    legend: `none`,
+    isMacCodeBlock: true,
+    isShowLineNumber: true,
+    citeStatus: true,
+    countStatus: true,
+    isUseIndent: false,
+    isUseJustify: false,
+    codeBlockTheme: `https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/11.11.1/styles/github.min.css`,
+  })
+
+  it('normalizes both dialects to the same internal config', () => {
+    expect(mcpDialect).toEqual(designerDialect)
+  })
+
+  it('produces equivalent HTML from the same source', () => {
+    const markdown = `# Title\n\nText with [a link](https://example.com).\n\n\`\`\`js\nconsole.log(1)\n\`\`\`\n`
+    expect(renderMarkdownToStyledHtml(markdown, mcpDialect).html)
+      .toBe(renderMarkdownToStyledHtml(markdown, designerDialect).html)
+    expect(renderMarkdownToWeChatHtml(markdown, mcpDialect).html)
+      .toBe(renderMarkdownToWeChatHtml(markdown, designerDialect).html)
+  })
+
+  it('detects the dialect from the config shape', () => {
+    expect(detectConfigDialect({ isCiteStatus: true })).toBe(`designer`)
+    expect(detectConfigDialect({ cssContentConfig: { active: '', tabs: [] } })).toBe(`designer`)
+    expect(detectConfigDialect({ citeStatus: true })).toBe(`mcp`)
+    expect(detectConfigDialect({ theme: `grace` })).toBe(`mcp`)
+  })
+})
+
+describe('flag overrides beat config values', () => {
+  it('applyFlagOverrides only sets explicitly provided flags', () => {
+    const config = applyFlagOverrides(
+      normalizeMcpConfig({ primaryColor: `#009874`, theme: `grace` }),
+      { primaryColor: `#556B2F` },
+    )
+    expect(config.primaryColor).toBe(`#556B2F`)
+    expect(config.theme).toBe(`grace`)
+  })
+
+  it('--body-color changes the body text color over config and default', () => {
+    const markdown = `# Title\n\nParagraph.\n`
+    const defaultRender = renderMarkdownToWeChatHtml(markdown)
+    expect(defaultRender.html).toContain(`rgb(10,10,10)`)
+
+    const config = normalizeMcpConfig({ primaryColor: `#009874` })
+    const overridden = renderMarkdownToWeChatHtml(markdown, applyFlagOverrides(config, { bodyColor: `#123456` }))
+    expect(overridden.html).toContain(`color: #123456`)
+    expect(overridden.html).not.toContain(`rgb(10,10,10)`)
+
+    const styled = renderMarkdownToStyledHtml(markdown, applyFlagOverrides(config, { bodyColor: `#ABCDEF` }))
+    expect(styled.html).toContain(`color: #ABCDEF`)
+  })
+})
+
+describe('--raw intermediate output', () => {
+  const markdown = `# Title\n\nParagraph.\n`
+
+  it('emits the pre-inlining form with a <style> block', () => {
+    const raw = renderMarkdownToStyledHtml(markdown, {})
+    expect(raw.html.startsWith(`<style>`)).toBe(true)
+    expect(raw.html).toContain(`</style>`)
+  })
+
+  it('differs from the WeChat output of the same source', () => {
+    const raw = renderMarkdownToStyledHtml(markdown, {})
+    const wechat = renderMarkdownToWeChatHtml(markdown, {})
+    expect(raw.html).not.toBe(wechat.html)
+    expect(wechat.html.startsWith(`<style>`)).toBe(false)
+  })
+
+  it('keeps ticket 04 failure semantics: pending placeholders fail in both modes', () => {
+    const mermaidMarkdown = '```mermaid\ngraph TD\nA-->B\n```\n'
+    expect(() => renderMarkdownToWeChatHtml(mermaidMarkdown, {})).toThrowError(/cannot be rendered offline/)
+    const raw = renderMarkdownToStyledHtml(mermaidMarkdown, {})
+    expect(raw.html).toContain(`data-md-diagram-state="loading"`)
+  })
+})
diff --git a/packages/md-web-cli/tests/defaults.test.ts b/packages/md-web-cli/tests/defaults.test.ts
new file mode 100644
index 0000000000..9bfd5cae59
--- /dev/null
+++ b/packages/md-web-cli/tests/defaults.test.ts
@@ -0,0 +1,44 @@
+import { defaultStyleConfig } from '@md/shared/configs/style'
+import { describe, expect, it } from 'vitest'
+import { siteDefaultHeadingStyles, siteDefaultRenderConfig } from '../src/defaults'
+
+function format(value: unknown): string {
+  return typeof value === `string` ? value : JSON.stringify(value)
+}
+
+/**
+ * Compares one site default and names the key plus both values on failure, so
+ * drift reports say which key moved and in which direction.
+ */
+function expectSiteDefaultParity(key: string, cliValue: unknown, appValue: unknown): void {
+  expect(cliValue, `${key}: CLI=${format(cliValue)} app=${format(appValue)}`).toEqual(appValue)
+}
+
+describe(`site default parity between the CLI and the app`, () => {
+  it(`lineHeight agrees`, () => {
+    expectSiteDefaultParity(`lineHeight`, siteDefaultRenderConfig.lineHeight, defaultStyleConfig.lineHeight)
+  })
+
+  it(`blockSpacing agrees`, () => {
+    expectSiteDefaultParity(`blockSpacing`, siteDefaultRenderConfig.blockSpacing, defaultStyleConfig.blockSpacing)
+  })
+
+  it(`linkColor agrees`, () => {
+    expectSiteDefaultParity(`linkColor`, siteDefaultRenderConfig.linkColor, defaultStyleConfig.linkColor)
+  })
+
+  it(`blockquoteBackground agrees`, () => {
+    expectSiteDefaultParity(
+      `blockquoteBackground`,
+      siteDefaultRenderConfig.blockquoteBackground,
+      defaultStyleConfig.blockquoteBackground,
+    )
+  })
+
+  it(`headingStyles has the same effective default`, () => {
+    // The CLI config carries no headingStyles key; the render path treats
+    // absence as "no preset overrides", which is the app's `{}`. Compare that
+    // effective value rather than `undefined`.
+    expectSiteDefaultParity(`headingStyles`, siteDefaultHeadingStyles, defaultStyleConfig.headingStyles)
+  })
+})
diff --git a/packages/md-web-cli/tests/helpers/run-verify.ts b/packages/md-web-cli/tests/helpers/run-verify.ts
new file mode 100644
index 0000000000..1a1cb13c5f
--- /dev/null
+++ b/packages/md-web-cli/tests/helpers/run-verify.ts
@@ -0,0 +1,42 @@
+import { execFileSync } from 'node:child_process'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Run the verify command as a subprocess.
+ *
+ * The gate's contract is a process boundary — exit code, printed summary,
+ * artifacts written — so tests exercise it the way a maintainer does rather
+ * than importing its internals.
+ */
+
+const here = fileURLToPath(import.meta.url)
+
+export const repoRoot = path.resolve(path.dirname(here), '../../../..')
+export const verifyScript = path.join(repoRoot, 'scripts/verify.mjs')
+
+export interface VerifyResult {
+  status: number
+  stdout: string
+  stderr: string
+}
+
+export function runVerify(args: string[], timeout = 120_000): VerifyResult {
+  try {
+    const stdout = execFileSync(process.execPath, [verifyScript, ...args], {
+      encoding: `utf-8`,
+      cwd: repoRoot,
+      stdio: [`ignore`, `pipe`, `pipe`],
+      timeout,
+    })
+    return { status: 0, stdout, stderr: `` }
+  }
+  catch (error: any) {
+    return {
+      status: error.status ?? 1,
+      stdout: error.stdout ?? ``,
+      stderr: error.stderr ?? String(error.message),
+    }
+  }
+}
diff --git a/packages/md-web-cli/tests/offline.test.ts b/packages/md-web-cli/tests/offline.test.ts
new file mode 100644
index 0000000000..66d0728628
--- /dev/null
+++ b/packages/md-web-cli/tests/offline.test.ts
@@ -0,0 +1,135 @@
+import type { AddressInfo } from 'node:net'
+import { execFileSync } from 'node:child_process'
+
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { createServer as createTcpServer } from 'node:net'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+
+/**
+ * Zero-network conversion, proven by observation rather than by a proxy
+ * setting.
+ *
+ * A loopback TCP "sink" counts every inbound connection. While it listens, the
+ * CLI renders the fixture in a child process preloaded with a poison module:
+ *
+ *   - `net.Socket.prototype.connect` and `fetch` throw, so a render that needs
+ *     the network fails loudly instead of silently succeeding. (This replaces
+ *     the old HTTP_PROXY env vars, which guard nothing: Node's fetch ignores
+ *     HTTP_PROXY unless --use-env-proxy is passed.)
+ *   - The sink makes a dial *visible*: it counts connections, so an attempt
+ *     through proxy env vars pointed at the sink would be recorded instead of
+ *     merely failing.
+ *
+ * The CLI is launched as a file so process.argv keeps the CLI's shape; the
+ * preload's connect wrapper re-enables only connections made to the sink
+ * (harness self-check) and leaves every other target poisoned.
+ */
+const POISON = `
+const net = require('node:net')
+const target = Number(process.env.MD_WEB_CLI_SINK_PORT)
+const originalConnect = net.Socket.prototype.connect
+net.Socket.prototype.connect = function (...args) {
+  const options = typeof args[0] === 'object' && args[0] !== null
+    ? args[0]
+    : { port: args[0], host: args[1] }
+  if (target && Number(options.port) === target && options.host === '127.0.0.1')
+    return originalConnect.apply(this, args)
+  throw new Error('NETWORK BLOCKED: net.connect')
+}
+globalThis.fetch = () => { throw new Error('NETWORK BLOCKED: fetch') }
+`
+
+const distCli = path.resolve(__dirname, '../dist/cli.js')
+const fixture = path.resolve(__dirname, '../fixtures/full.md')
+
+interface Sink {
+  server: ReturnType<typeof createTcpServer>
+  port: number
+  counts: { requests: number, connections: number }
+}
+
+async function startSink(): Promise<Sink> {
+  const counts = { requests: 0, connections: 0 }
+  // Raw TCP: every connection is observable, whether or not it speaks HTTP.
+  const server = createTcpServer((socket) => {
+    counts.connections++
+    socket.on('data', () => { counts.requests++ })
+    socket.end()
+  })
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  return { server, port: (server.address() as AddressInfo).port, counts }
+}
+
+function closeSink(sink: Sink): Promise<void> {
+  return new Promise(resolve => sink.server.close(() => resolve()))
+}
+
+describe('zero-network conversion', () => {
+  let dir: string
+
+  afterAll(async () => {
+    if (dir)
+      await rm(dir, { recursive: true, force: true })
+  })
+
+  async function render(outName: string, env: Record<string, string>, port?: number) {
+    const poisonPath = path.join(dir, 'poison.cjs')
+    const outPath = path.join(dir, outName)
+    await writeFile(poisonPath, POISON)
+    const stdout = execFileSync(process.execPath, [
+      '--require',
+      poisonPath,
+      distCli,
+      'render',
+      fixture,
+      '-o',
+      outPath,
+    ], {
+      encoding: 'utf-8',
+      env: { ...process.env, MD_WEB_CLI_SINK_PORT: port ? String(port) : '', ...env },
+    })
+    return { stdout, html: await readFile(outPath, 'utf-8') }
+  }
+
+  it('renders the fixture with net.connect and fetch poisoned, leaving the sink silent', async () => {
+    dir = await mkdtemp(path.join(tmpdir(), 'md-web-cli-net-'))
+    const sink = await startSink()
+    const { html } = await render('out.html', {}, sink.port)
+    expect(html).toContain(`font-family`)
+    expect(html.length).toBeGreaterThan(1000)
+    expect(sink.counts).toEqual({ requests: 0, connections: 0 })
+    await closeSink(sink)
+  }, 60_000)
+
+  it('stays silent even with proxy env vars pointed at the sink', async () => {
+    // If the renderer ever starts honouring proxies, that traffic lands here
+    // and the counters fail the test.
+    const sink = await startSink()
+    const proxy = `http://127.0.0.1:${sink.port}`
+    await render('out-proxy.html', {
+      HTTP_PROXY: proxy,
+      HTTPS_PROXY: proxy,
+      ALL_PROXY: proxy,
+      http_proxy: proxy,
+      https_proxy: proxy,
+      all_proxy: proxy,
+    }, sink.port)
+    expect(sink.counts).toEqual({ requests: 0, connections: 0 })
+    await closeSink(sink)
+  }, 60_000)
+
+  it('a poisoned child cannot reach any host other than the sink', async () => {
+    // Harness control: proves the poison is active in the CLI's process, so
+    // the two tests above are not passing merely because nothing dials.
+    const out = execFileSync(process.execPath, [
+      '--require',
+      path.join(dir, 'poison.cjs'),
+      '-e',
+      `const net = require('node:net'); try { net.connect(80, 'example.com'); console.log('DIALLED') } catch (error) { console.log(error.message) }`,
+    ], { encoding: 'utf-8', env: { ...process.env, MD_WEB_CLI_SINK_PORT: '' } })
+    expect(out).toContain('NETWORK BLOCKED')
+    expect(out).not.toContain('DIALLED')
+  }, 30_000)
+})
diff --git a/packages/md-web-cli/tests/oracle-capability.test.ts b/packages/md-web-cli/tests/oracle-capability.test.ts
new file mode 100644
index 0000000000..d3bb21dd2b
--- /dev/null
+++ b/packages/md-web-cli/tests/oracle-capability.test.ts
@@ -0,0 +1,45 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { afterEach, describe, expect, it } from 'vitest'
+
+// The Oracle capability lives outside the package (scripts/verify/oracle.mjs)
+// and is imported rather than re-implemented, so the repository guard and the
+// build precondition are observed through its public entry point. Neither
+// case launches a browser: both fail before Playwright is loaded.
+const here = fileURLToPath(import.meta.url)
+const repoRoot = resolve(here, '../../../..')
+const capabilityPath = resolve(repoRoot, 'scripts/verify/oracle.mjs')
+const fixturePath = resolve(repoRoot, 'packages/md-web-cli/fixtures/full.md')
+
+const { captureOracle } = await import(capabilityPath)
+
+const tempDirs: string[] = []
+
+async function makeTempDir() {
+  const dir = await mkdtemp(join(tmpdir(), 'md-web-cli-oracle-test-'))
+  tempDirs.push(dir)
+  return dir
+}
+
+afterEach(async () => {
+  await Promise.all(tempDirs.splice(0).map(dir => rm(dir, { recursive: true, force: true })))
+})
+
+describe('captureOracle repository guard', () => {
+  it('refuses an output directory inside the repository', async () => {
+    const outDir = resolve(repoRoot, 'packages/md-web-cli/tests/.oracle-should-not-exist')
+
+    await expect(captureOracle({ fixturePath, outDir })).rejects.toThrow(/repository/i)
+  })
+})
+
+describe('captureOracle build precondition', () => {
+  it('fails loudly when the web application has not been built', async () => {
+    const outDir = await makeTempDir()
+    const distDir = join(outDir, 'missing-dist')
+
+    await expect(captureOracle({ fixturePath, outDir, distDir })).rejects.toThrow(/pnpm --filter @md\/web build:only/)
+  })
+})
diff --git a/packages/md-web-cli/tests/output-structure.test.ts b/packages/md-web-cli/tests/output-structure.test.ts
new file mode 100644
index 0000000000..8928137aca
--- /dev/null
+++ b/packages/md-web-cli/tests/output-structure.test.ts
@@ -0,0 +1,54 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { expect, it } from 'vitest'
+
+/**
+ * Behavioural guard for WeChat-ready output produced through the real CLI path.
+ *
+ * The verify gate asserts these invariants on its own output, but it only sees
+ * what the built bundle produces. A regression that drops juice or class
+ * stripping inside the renderer would be caught there — late, and only if the
+ * gate runs. This file pins the same behaviour at the source so the fast suite
+ * fails first.
+ */
+import { renderMarkdownToWeChatHtml } from '../src/wechat'
+
+const fixture = new URL('../fixtures/full.md', import.meta.url)
+const fixturePath = path.resolve(fixture.pathname)
+const repoRoot = path.resolve(fixturePath, '../../../..')
+
+const BLOCK_TAGS = 'section|p|div|h[1-6]|ul|ol|li|table|thead|tbody|tr|th|td|blockquote|pre|hr|img'
+
+it('fixture render is WeChat-ready: no <style>, no class attributes, inline styles everywhere', async () => {
+  const { readFileSync } = await import('node:fs')
+  const { html } = renderMarkdownToWeChatHtml(readFileSync(fixturePath, 'utf-8'))
+  expect(html).not.toMatch(/<style/)
+  expect(html).not.toMatch(/\sclass\s*=/i)
+  const missing = []
+  for (const match of html.matchAll(new RegExp(`<(${BLOCK_TAGS})\\b([^>]*)>`, 'gi'))) {
+    const attrs = match[2]
+    // Structural wrappers legitimately carry no style (table sections, rows).
+    if (!/\sstyle\s*=/i.test(attrs) && attrs.trim() !== '')
+      missing.push(`<${match[1]}${attrs}>`)
+  }
+  expect(missing).toEqual([])
+})
+
+it('the gate structural assertions accept a real CLI render of the fixture', async () => {
+  const { readFileSync } = await import('node:fs')
+  const { findStructuralProblems } = await import('../../../scripts/verify/structural.mjs')
+  const { execFileSync } = await import('node:child_process')
+  const dir = mkdtempSync(path.join(tmpdir(), 'md-web-cli-struct-'))
+  try {
+    const out = path.join(dir, 'out.html')
+    execFileSync(process.execPath, [path.join(repoRoot, 'packages/md-web-cli/dist/cli.js'), 'render', fixturePath, '-o', out])
+    const html = readFileSync(out, 'utf-8')
+    expect(findStructuralProblems(html)).toEqual([])
+    expect(html.match(/<h2\b/g)?.length ?? 0).toBeGreaterThan(0)
+    expect(html.match(/<pre\b/g)?.length ?? 0).toBeGreaterThan(0)
+  }
+  finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+}, 60_000)
diff --git a/packages/md-web-cli/tests/publish-version.test.ts b/packages/md-web-cli/tests/publish-version.test.ts
new file mode 100644
index 0000000000..edc91ded2e
--- /dev/null
+++ b/packages/md-web-cli/tests/publish-version.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, it } from 'vitest'
+import { resolvePublishVersion } from '../scripts/resolve-publish-version.mjs'
+
+describe('resolvePublishVersion', () => {
+  it('publishes manifest version as-is when never published', () => {
+    expect(resolvePublishVersion('0.1.0', null)).toBe('0.1.0')
+    expect(resolvePublishVersion('1.2.3', undefined)).toBe('1.2.3')
+  })
+
+  it('publishes manifest version as-is when (MAJOR, MINOR) differs from registry', () => {
+    // Hand-edited MINOR bump: publish exactly what the manifest says.
+    expect(resolvePublishVersion('0.2.0', '0.1.7')).toBe('0.2.0')
+    expect(resolvePublishVersion('1.0.0', '0.9.9')).toBe('1.0.0')
+    // Manifest lower than registry (e.g. revert) still publishes as-is.
+    expect(resolvePublishVersion('0.1.0', '0.2.5')).toBe('0.1.0')
+  })
+
+  it('increments registry PATCH when (MAJOR, MINOR) matches', () => {
+    expect(resolvePublishVersion('0.1.0', '0.1.0')).toBe('0.1.1')
+    expect(resolvePublishVersion('0.1.0', '0.1.7')).toBe('0.1.8')
+    expect(resolvePublishVersion('1.2.3', '1.2.41')).toBe('1.2.42')
+  })
+
+  it('ignores manifest PATCH when (MAJOR, MINOR) matches (PATCH is automatic)', () => {
+    expect(resolvePublishVersion('0.1.9', '0.1.3')).toBe('0.1.4')
+  })
+
+  it('handles prerelease registry versions by using their numeric base patch', () => {
+    // 0.1.5-beta.2 parses to (0,1,5); next is 0.1.6.
+    expect(resolvePublishVersion('0.1.0', '0.1.5-beta.2')).toBe('0.1.6')
+  })
+
+  it('rejects unparseable versions', () => {
+    expect(() => resolvePublishVersion('not-semver', '1.2.0')).toThrow()
+    expect(() => resolvePublishVersion('1.2', '1.2.0')).toThrow()
+    expect(() => resolvePublishVersion('1.2.3', 'garbage')).toThrow()
+    expect(() => resolvePublishVersion('', null)).toThrow()
+  })
+
+  describe('boundary inputs', () => {
+    it('ignores build metadata on the registry version', () => {
+      expect(resolvePublishVersion('1.2.3', '1.2.3+build.7')).toBe('1.2.4')
+    })
+
+    it('treats a registry prerelease as its numeric base', () => {
+      // registry 1.2.4-alpha parses to patch 4, so the next stable is 1.2.5.
+      expect(resolvePublishVersion('1.2.3', '1.2.4-alpha')).toBe('1.2.5')
+    })
+
+    it('trims surrounding whitespace', () => {
+      expect(resolvePublishVersion(' 1.2.3 ', '1.2.3\n')).toBe('1.2.4')
+    })
+
+    it('does not reject leading zeros (documented limitation)', () => {
+      // Strict semver forbids `1.02.3`, but this regex accepts it and parses
+      // it as 1.2.3 on either side. Both inputs are repo/registry-generated,
+      // so the leniency only shows up in hand-edited manifests; pinned here.
+      expect(resolvePublishVersion('1.02.3', '1.2.3')).toBe('1.2.4')
+      expect(resolvePublishVersion('1.2.3', '01.2.3')).toBe('1.2.4')
+    })
+
+    it('rejects a v-prefixed registry version (documented limitation)', () => {
+      // npm's dist-tags never carry a `v` prefix; if a registry ever returns
+      // one, failing loudly is preferable to publishing a guessed version.
+      expect(() => resolvePublishVersion('1.2.3', 'v1.2.3')).toThrow(/Unparseable semver/)
+    })
+
+    it('loses precision above Number.MAX_SAFE_INTEGER (documented limitation)', () => {
+      // PATCH is handled as a JS number. npm versions never get this far, but
+      // the behaviour is pinned so a future parser change is a conscious one.
+      expect(resolvePublishVersion('1.2.3', '1.2.9007199254740993')).toBe('1.2.9007199254740992')
+    })
+
+    it('never returns a version lower than the registry when MAJOR.MINOR match', () => {
+      expect(resolvePublishVersion('0.0.0', '0.0.0')).toBe('0.0.1')
+      expect(resolvePublishVersion('9.9.0', '9.9.99')).toBe('9.9.100')
+    })
+  })
+})
diff --git a/packages/md-web-cli/tests/render.test.ts b/packages/md-web-cli/tests/render.test.ts
new file mode 100644
index 0000000000..4851692aa0
--- /dev/null
+++ b/packages/md-web-cli/tests/render.test.ts
@@ -0,0 +1,128 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { codeBlockThemeMap, isKnownCodeBlockTheme } from '../src/assets'
+import { siteDefaultRenderConfig } from '../src/defaults'
+import { renderMarkdownToStyledHtml } from '../src/render'
+
+const root = path.dirname(fileURLToPath(import.meta.url))
+const fixturePath = path.join(root, '../fixtures/full.md')
+const fixtureMarkdown = fs.readFileSync(fixturePath, 'utf-8')
+
+describe('site default render config', () => {
+  it('matches the web app defaults, not the MCP server defaults', () => {
+    expect(siteDefaultRenderConfig.isMacCodeBlock).toBe(true)
+    expect(siteDefaultRenderConfig.codeBlockTheme).toBe('github-dark')
+    expect(siteDefaultRenderConfig.theme).toBe('default')
+    expect(siteDefaultRenderConfig.primaryColor).toBe('#0F4C81')
+    expect(siteDefaultRenderConfig.fontSize).toBe('16px')
+    expect(siteDefaultRenderConfig.lineHeight).toBe('1.75')
+    expect(siteDefaultRenderConfig.linkColor).toBe('#576b95')
+    expect(siteDefaultRenderConfig.legend).toBe('alt')
+  })
+})
+
+describe('code block theme whitelist', () => {
+  it('maps exactly the ten preset names to non-empty CSS', () => {
+    expect(Object.keys(codeBlockThemeMap).sort()).toEqual([
+      'atom-one-dark',
+      'atom-one-light',
+      'github',
+      'github-dark',
+      'monokai',
+      'nord',
+      'tokyo-night-dark',
+      'tokyo-night-light',
+      'vs',
+      'xcode',
+    ].sort())
+    for (const css of Object.values(codeBlockThemeMap)) {
+      expect(css.length).toBeGreaterThan(50)
+    }
+  })
+
+  it('rejects names outside the whitelist', () => {
+    expect(isKnownCodeBlockTheme('github-dark')).toBe(true)
+    expect(isKnownCodeBlockTheme('dracula')).toBe(false)
+    expect(isKnownCodeBlockTheme('__proto__')).toBe(false)
+  })
+})
+
+describe('renderMarkdownToStyledHtml', () => {
+  const result = renderMarkdownToStyledHtml(fixtureMarkdown)
+
+  it('emits a themed <style> block followed by the rendered body', () => {
+    expect(result.html.startsWith('<style>')).toBe(true)
+    expect(result.html).toContain('</style>')
+    const body = result.html.slice(result.html.indexOf('</style>'))
+    expect(body).toContain('container')
+    expect(body.length).toBeGreaterThan(1000)
+  })
+
+  it('renders the full fixture body: headings, table, code, lists, blockquote, images, hr', () => {
+    for (const tag of ['h1', 'h2', 'h3', 'h4', 'h5', 'h6']) {
+      expect(result.html).toMatch(new RegExp(`<${tag}[\\s>]`))
+    }
+    expect(result.html).toContain('preview-table')
+    expect(result.html).toContain('mac-sign')
+    expect(result.html).toContain('hr hr-dash')
+    expect(result.html).toContain('<blockquote')
+    expect(result.html).toContain('<img')
+    expect((result.html.match(/<li/g) ?? []).length).toBeGreaterThanOrEqual(10)
+  })
+
+  it('applies site-default characteristics in the merged CSS', () => {
+    // 16px / 1.75 typography via CSS variables
+    expect(result.html).toContain('--md-font-size: 16px')
+    expect(result.html).toContain('--md-line-height: 1.75')
+    // theme primary color
+    expect(result.html).toContain('--md-primary-color: #0F4C81')
+    // link color
+    expect(result.html).toContain('#576b95')
+    // github-dark highlighting colors shipped inline (zero network)
+    expect(result.html).toMatch(/\.hljs\b/)
+    const styleBlock = result.html.slice(0, result.html.indexOf('</style>'))
+    expect(styleBlock).toContain('#0d1117') // github-dark background
+  })
+
+  it('h2 heading carries theme-color background with white text (default theme)', () => {
+    // processCSS resolves var() to concrete values (required for WeChat),
+    // so the h2 rule carries the resolved primary color, centered, white text.
+    const styleBlock = result.html.slice(0, result.html.indexOf('</style>'))
+    const h2Rule = styleBlock.match(/h2\s*\{[^}]*\}/)?.[0] ?? ''
+    expect(h2Rule).toContain('background: #0F4C81')
+    expect(h2Rule).toContain('color: #fff')
+    expect(h2Rule).toContain('text-align: center')
+  })
+
+  it('mac code block title bar is enabled by default (three lights)', () => {
+    // postProcessHtml toggles .mac-sign display via inline style block
+    expect(result.html).toMatch(/\.hljs\.code__pre\s*>\s*\.mac-sign\s*\{[^}]*display:\s*flex/)
+    // The renderer emits the three-light mac sign markup
+    expect(result.html).toMatch(/mac-sign/)
+  })
+
+  it('computes reading time', () => {
+    expect(result.readingTime.words).toBeGreaterThan(0)
+    expect(result.readingTime.minutes).toBeGreaterThan(0)
+  })
+
+  it('throws a clear error for unknown code themes', () => {
+    expect(() => renderMarkdownToStyledHtml(fixtureMarkdown, { codeBlockTheme: 'dracula' }))
+      .toThrow(/Unknown code block theme/)
+  })
+
+  it('contains no network URLs in the style block (offline by construction)', () => {
+    // Strip comments first: the vendored highlight.js themes carry a metadata
+    // comment crediting the upstream repo, which is not a runtime request.
+    const styleBlock = result.html.slice(0, result.html.indexOf('</style>'))
+    const withoutComments = styleBlock.replace(/\/\*[\s\S]*?\*\//g, '')
+    expect(withoutComments).not.toMatch(/https?:\/\//)
+  })
+
+  it('contains no CDN or dynamic-import network calls in the body pipeline output', () => {
+    expect(result.html).not.toMatch(/cdn-doocs\.oss/)
+    expect(result.html).not.toMatch(/import\s*\(\s*['"]https?/)
+  })
+})
diff --git a/packages/md-web-cli/tests/verify-command.test.ts b/packages/md-web-cli/tests/verify-command.test.ts
new file mode 100644
index 0000000000..9192007236
--- /dev/null
+++ b/packages/md-web-cli/tests/verify-command.test.ts
@@ -0,0 +1,100 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runVerify } from './helpers/run-verify'
+
+/**
+ * The verify gate's process seam, browser-free half.
+ *
+ * Argument validation happens before any build or browser work, so these cases
+ * exercise the command's contract (exit codes, messages, documented options)
+ * without the eight-second Oracle capture. The failure-path coverage that needs
+ * a render belongs to the reverse-case self-test.
+ */
+
+describe(`verify command: options`, () => {
+  it(`documents fixtures, config, and artifact handling in --help`, () => {
+    const { status, stdout } = runVerify([`--help`])
+
+    expect(status).toBe(0)
+    expect(stdout).toContain(`--fixture`)
+    expect(stdout).toContain(`--config`)
+    expect(stdout).toContain(`--out-dir`)
+    expect(stdout).toContain(`--keep`)
+    expect(stdout).toContain(`byte for byte`)
+    // The absence of a tolerance is part of the contract, not an implementation
+    // detail: it is stated where the maintainer reads the options.
+    expect(stdout).toMatch(/no tolerance, allow-list, or known-gaps/)
+  })
+
+  it(`rejects an unknown option instead of ignoring it`, () => {
+    const { status, stderr } = runVerify([`--frobnicate`])
+
+    expect(status).toBe(1)
+    expect(stderr).toContain(`unknown option "--frobnicate"`)
+  })
+
+  it(`rejects an option given without a value`, () => {
+    const { status, stderr } = runVerify([`--fixture`])
+
+    expect(status).toBe(1)
+    expect(stderr).toContain(`--fixture requires a value`)
+  })
+})
+
+describe(`verify command: missing inputs`, () => {
+  it(`fails loudly for an unknown fixture`, () => {
+    const { status, stderr } = runVerify([`--fixture`, `no-such-fixture`])
+
+    expect(status).toBe(1)
+    expect(stderr).toContain(`fixture not found:`)
+    expect(stderr).toContain(`known names: full, minimal`)
+  })
+
+  it(`resolves the infrastructure-probe fixture by name`, () => {
+    // Reaching the config check proves the fixture name resolved; an unknown
+    // name would have failed earlier with "fixture not found".
+    const { status, stderr } = runVerify([`--fixture`, `minimal`, `--config`, `no-such-config.json`])
+
+    expect(status).toBe(1)
+    expect(stderr).toContain(`config not found:`)
+  })
+
+  it(`rejects a config that is not valid JSON`, () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `verify-config-`))
+    try {
+      const configPath = path.join(dir, `broken.json`)
+      fs.writeFileSync(configPath, `{ not json`)
+      const { status, stderr } = runVerify([`--fixture`, `minimal`, `--config`, configPath])
+
+      expect(status).toBe(1)
+      expect(stderr).toContain(`config is not valid JSON:`)
+    }
+    finally {
+      fs.rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it(`rejects a theme the two sides cannot both honour`, () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `verify-config-`))
+    try {
+      const configPath = path.join(dir, `marketplace.json`)
+      fs.writeFileSync(configPath, JSON.stringify({ theme: `md-theme-obsidian`, primaryColor: `#FA5151` }))
+      const { status, stderr } = runVerify([`--fixture`, `minimal`, `--config`, configPath])
+
+      expect(status).toBe(1)
+      expect(stderr).toContain(`theme "md-theme-obsidian" is not available to both sides`)
+    }
+    finally {
+      fs.rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it(`fails loudly for a config file that does not exist`, () => {
+    const { status, stderr } = runVerify([`--fixture`, `full`, `--config`, `no-such-config.json`])
+
+    expect(status).toBe(1)
+    expect(stderr).toContain(`config not found:`)
+  })
+})
diff --git a/packages/md-web-cli/tests/verify-config.test.ts b/packages/md-web-cli/tests/verify-config.test.ts
new file mode 100644
index 0000000000..c483b29a1d
--- /dev/null
+++ b/packages/md-web-cli/tests/verify-config.test.ts
@@ -0,0 +1,77 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runVerify } from './helpers/run-verify'
+
+/**
+ * Config projection at the verify process seam.
+ *
+ * This case needs the browser (it runs the whole gate), so it is opt-in:
+ * `MD_WEB_CLI_BROWSER_TESTS=1 pnpm --filter @dane.dai/md-web-cli test`.
+ * It stays at the process boundary on purpose — a unit test of the projection
+ * function would be a third seam, and the behaviour that matters is "the gate
+ * never compares an article carried in the export".
+ */
+
+const browserTests = Boolean(process.env.MD_WEB_CLI_BROWSER_TESTS)
+
+const ARTICLE_MARKER = `ARTICLE MARKER: this article must never be rendered`
+
+describe.skipIf(!browserTests)(`verify command: Designer config`, () => {
+  it(`compares the fixture, never the article carried in the export`, () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `verify-config-seam-`))
+    try {
+      const configPath = path.join(dir, `export.json`)
+      const outDir = path.join(dir, `artifacts`)
+      fs.writeFileSync(configPath, JSON.stringify({
+        // Article content: must be dropped before either side sees the config.
+        posts: [{ id: `post-1`, content: `# ${ARTICLE_MARKER}` }],
+        currentPostId: `post-1`,
+        currentPostIndex: 0,
+        titleList: [ARTICLE_MARKER],
+        readingTime: { words: 9999, minutes: 42 },
+        // Pure UI: no effect on the rendered article.
+        isDark: true,
+        isOpenRightSlider: false,
+        isOpenPostSlider: true,
+        showAIToolbox: false,
+        isShowCssEditor: true,
+        isShowTableEditDialog: true,
+        isShowUploadImgDialog: true,
+        aiDialogVisible: true,
+        aiImageDialogVisible: true,
+        // Render-affecting: reach both sides.
+        theme: `default`,
+        primaryColor: `#0F4C81`,
+        fontFamily: `-apple-system-font,BlinkMacSystemFont, Helvetica Neue, PingFang SC, Hiragino Sans GB , Microsoft YaHei UI , Microsoft YaHei ,Arial,sans-serif`,
+        fontSize: `16px`,
+        codeBlockTheme: `https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/11.11.1/styles/github-dark.min.css`,
+        legend: `alt`,
+        isMacCodeBlock: true,
+        isShowLineNumber: false,
+        isCiteStatus: false,
+        isCountStatus: false,
+        isUseIndent: false,
+        isUseJustify: false,
+        cssContentConfig: { active: `default`, tabs: [{ id: `default`, title: `default`, name: `default`, content: `` }] },
+      }), `utf-8`)
+
+      const { stdout, stderr } = runVerify([`--fixture`, `minimal`, `--config`, configPath, `--out-dir`, outDir], 240_000)
+      const combined = `${stdout}${stderr}`
+
+      expect(combined).toContain(`article-content`)
+      expect(combined).toContain(`the same projected file goes to both sides`)
+
+      const cliHtml = fs.readFileSync(path.join(outDir, `minimal`, `cli.html`), `utf-8`)
+      const oracleHtml = fs.readFileSync(path.join(outDir, `minimal`, `oracle.html`), `utf-8`)
+      for (const html of [cliHtml, oracleHtml]) {
+        expect(html).toContain(`Minimal fixture`)
+        expect(html).not.toContain(ARTICLE_MARKER)
+      }
+    }
+    finally {
+      fs.rmSync(dir, { recursive: true, force: true })
+    }
+  }, 240_000)
+})
diff --git a/packages/md-web-cli/tests/verify-structural.test.ts b/packages/md-web-cli/tests/verify-structural.test.ts
new file mode 100644
index 0000000000..76ad81be72
--- /dev/null
+++ b/packages/md-web-cli/tests/verify-structural.test.ts
@@ -0,0 +1,89 @@
+import { execFileSync } from 'node:child_process'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { findInlineStyleProblems, findPendingPlaceholders, findStructuralProblems } from '../../../scripts/verify/structural.mjs'
+
+/**
+ * Coverage adapted from the verifier the byte-exact gate replaced.
+ *
+ * The script those tests imported is gone from the gate path, but the
+ * invariants it protected are not: pending placeholders must never ship, the
+ * output must be WeChat-ready, and the reverse-case self-test must prove the
+ * gate can fail.
+ */
+
+const here = fileURLToPath(import.meta.url)
+const repoRoot = resolve(here, '../../../..')
+const verifyScript = resolve(repoRoot, 'scripts/verify.mjs')
+
+describe(`pending placeholder detection`, () => {
+  it(`finds diagram, katex and language markers, naming each kind`, () => {
+    const html = '<div class="mermaid-diagram" data-md-diagram-state="loading"></div><span class="katex-pending">x</span><code data-language-pending="rust">fn</code>'
+    const problems = findPendingPlaceholders(html)
+
+    expect(problems.map(problem => problem.kind)).toEqual([
+      `pending-diagram`,
+      `pending-katex`,
+      `pending-language`,
+    ])
+    expect(problems[2].detail).toContain(`rust`)
+  })
+
+  it(`ignores katex-pending selectors inside a style block`, () => {
+    expect(findPendingPlaceholders('<style>.katex-pending { color: red }</style><p>x</p>')).toHaveLength(0)
+  })
+})
+
+describe(`weChat-ready inline style checks`, () => {
+  it(`accepts a WeChat-ready artifact`, () => {
+    expect(findInlineStyleProblems('<section style="color: red"><p style="margin: 0">x</p></section>')).toHaveLength(0)
+  })
+
+  it(`rejects class attributes, style blocks and unstyled block elements`, () => {
+    const problems = findInlineStyleProblems('<style>a{}</style><div class="x" style="a"><p>b</p></div>')
+
+    expect(problems.map(problem => problem.kind)).toEqual([
+      `style-tag`,
+      `class-attribute`,
+      `unstyled-block`,
+    ])
+  })
+
+  it(`exempts the documented structurally-formatted elements`, () => {
+    const html = '<table style="border-collapse: collapse"><tbody><tr><td style="border">x</td></tr></tbody></table>'
+
+    expect(findInlineStyleProblems(html)).toHaveLength(0)
+  })
+
+  it(`reports every problem class for one artifact`, () => {
+    const problems = findStructuralProblems('<p class="x">no style</p><div style="x" data-md-diagram-state="loading"></div>')
+
+    expect(problems.map(problem => problem.kind).sort()).toEqual([`class-attribute`, `pending-diagram`, `unstyled-block`])
+  })
+})
+
+describe(`reverse-case self-test`, () => {
+  it(`exits 0 with every mutant rejected, without launching a browser`, () => {
+    const output = execFileSync(process.execPath, [verifyScript, `--self-test`], {
+      cwd: repoRoot,
+      encoding: `utf-8`,
+      stdio: [`ignore`, `pipe`, `pipe`],
+      timeout: 120_000,
+    })
+
+    for (const name of [
+      `injected diagram placeholder`,
+      `injected formula placeholder`,
+      `injected unregistered-language marker`,
+      `stripped inline styles`,
+      `injected class attribute`,
+      `injected style block`,
+      `truncated artifact`,
+    ]) {
+      expect(output).toContain(`PASS: ${name} -> gate rejects it`)
+    }
+    expect(output).toContain(`PASS: identical input compares equal`)
+    expect(output).toContain(`7 reverse case(s)`)
+  }, 120_000)
+})
diff --git a/packages/md-web-cli/tests/wechat.test.ts b/packages/md-web-cli/tests/wechat.test.ts
new file mode 100644
index 0000000000..e602eb8ad9
--- /dev/null
+++ b/packages/md-web-cli/tests/wechat.test.ts
@@ -0,0 +1,118 @@
+/**
+ * Ticket 04: WeChat-ready output + pending-placeholder failure semantics.
+ *
+ * Library-level tests cover the transformation itself; cli.test.ts covers the
+ * subprocess exit/stderr contract for pending placeholders.
+ */
+import { describe, expect, it } from 'vitest'
+import { renderMarkdownToWeChatHtml } from '../src/wechat'
+
+function blockLevelElementsMissingStyle(html: string): string[] {
+  const missing: string[] = []
+  const regex = /<(section|p|div|h[1-6]|ul|ol|li|table|thead|tbody|tr|th|td|blockquote|pre|hr|img)\b([^>]*)>/gi
+  for (const match of html.matchAll(regex)) {
+    if (!/\sstyle=/i.test(match[2]) && match[2].trim() !== ``)
+      missing.push(`<${match[1]}${match[2]}>`)
+  }
+  return missing
+}
+
+describe('renderMarkdownToWeChatHtml: WeChat-ready output', () => {
+  it('produces zero <style> blocks and zero class attributes for the full fixture body', () => {
+    const { html } = renderMarkdownToWeChatHtml('# Hello\n\nWorld.')
+    expect((html.match(/<style/g) ?? []).length).toBe(0)
+    expect(html.match(/\sclass\s*=/i)).toBeNull()
+  }, 30_000)
+
+  it('inlines styles so every block-level element carries a style attribute', () => {
+    const markdown = [
+      '# Heading',
+      '',
+      'A paragraph with **bold**.',
+      '',
+      '- item one',
+      '  - nested item',
+      '',
+      '> a quote',
+      '',
+      '| A | B |',
+      '| - | - |',
+      '| 1 | 2 |',
+      '',
+      '```javascript',
+      'const a = 1',
+      '```',
+      '',
+      '---',
+    ].join('\n')
+    const { html } = renderMarkdownToWeChatHtml(markdown)
+    const missing = blockLevelElementsMissingStyle(html)
+    expect(missing).toEqual([])
+  }, 30_000)
+
+  it('resolves hsl() and var() literals to concrete values', () => {
+    const { html } = renderMarkdownToWeChatHtml('# T\n\n> quote body\n')
+    expect(html).not.toMatch(/hsl\(var\(/)
+    expect(html).not.toMatch(/var\(--md-/)
+    // hsl(var(--foreground)) resolves to the shell foreground color.
+    expect(html).toContain('#3f3f3f')
+  }, 30_000)
+
+  it('brackets the output with zero-font-size empty paragraphs', () => {
+    const { html } = renderMarkdownToWeChatHtml('Body text.')
+    const trimmed = html.trim()
+    expect(trimmed.startsWith('<p style="font-size: 0')).toBe(true)
+    expect(trimmed).toMatch(/<p style="font-size: 0[^"]*"[^>]*>&nbsp;<\/p>$/)
+  }, 30_000)
+
+  it('hoists nested lists out of list items', () => {
+    const { html } = renderMarkdownToWeChatHtml('- level one\n  - level two\n')
+    expect(html).not.toMatch(/<li[^>]*>(?:(?!<\/li>)[\s\S])*<ul/i)
+  }, 30_000)
+
+  it('converts img width/height attributes to inline styles', () => {
+    const { html } = renderMarkdownToWeChatHtml('<img src="https://example.com/a.png" width="300" height="200" />')
+    expect(html).toMatch(/<img[^>]*style="[^"]*width: 300px/)
+    expect(html).toMatch(/<img[^>]*style="[^"]*height: 200px/)
+    expect(html).not.toMatch(/<img[^>]*\swidth=/)
+  }, 30_000)
+})
+
+describe('renderMarkdownToWeChatHtml: pending placeholder detection', () => {
+  it('throws for a mermaid code block', () => {
+    expect(() => renderMarkdownToWeChatHtml('```mermaid\ngraph TD\nA-->B\n```\n'))
+      .toThrow(/mermaid/)
+  }, 30_000)
+
+  it('throws for an infographic block', () => {
+    expect(() => renderMarkdownToWeChatHtml('```infographic\n{"type":"bar","data":[1,2]}\n```\n'))
+      .toThrow(/infographic/)
+  }, 30_000)
+
+  it('throws for KaTeX math', () => {
+    expect(() => renderMarkdownToWeChatHtml('Euler: $e^{i\\pi}+1=0$\n'))
+      .toThrow(/KaTeX/)
+  }, 30_000)
+
+  it('throws for an unregistered code language such as go', () => {
+    try {
+      renderMarkdownToWeChatHtml('```go\nfunc main() {}\n```\n')
+      expect.unreachable('expected PendingPlaceholderError')
+    }
+    catch (error) {
+      expect((error as Error).message).toMatch(/go/)
+      expect((error as Error).message).toMatch(/browser backend/)
+    }
+  }, 30_000)
+
+  it('reports a way forward in the error message', () => {
+    try {
+      renderMarkdownToWeChatHtml('```mermaid\ngraph TD\nA-->B\n```\n')
+    }
+    catch (error) {
+      expect((error as Error).message).toMatch(/handle the diagram manually|fall back to the browser backend/)
+      return
+    }
+    expect.unreachable('expected PendingPlaceholderError')
+  }, 30_000)
+})
diff --git a/packages/md-web-cli/tsconfig.json b/packages/md-web-cli/tsconfig.json
new file mode 100644
index 0000000000..e459ae40ef
--- /dev/null
+++ b/packages/md-web-cli/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "@md/config/tsconfig.base.json",
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "types": ["node"],
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true
+  },
+  "include": [
+    "src/**/*.ts",
+    "../shared/src/global.d.ts",
+    "../shared/src/types/raw-imports.d.ts"
+  ],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/packages/md-web-cli/vendor/hljs-styles/atom-one-dark.min.css b/packages/md-web-cli/vendor/hljs-styles/atom-one-dark.min.css
new file mode 100644
index 0000000000..5344ee3819
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/atom-one-dark.min.css
@@ -0,0 +1 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}.hljs{color:#abb2bf;background:#282c34}.hljs-comment,.hljs-quote{color:#5c6370;font-style:italic}.hljs-doctag,.hljs-formula,.hljs-keyword{color:#c678dd}.hljs-deletion,.hljs-name,.hljs-section,.hljs-selector-tag,.hljs-subst{color:#e06c75}.hljs-literal{color:#56b6c2}.hljs-addition,.hljs-attribute,.hljs-meta .hljs-string,.hljs-regexp,.hljs-string{color:#98c379}.hljs-attr,.hljs-number,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-pseudo,.hljs-template-variable,.hljs-type,.hljs-variable{color:#d19a66}.hljs-bullet,.hljs-link,.hljs-meta,.hljs-selector-id,.hljs-symbol,.hljs-title{color:#61aeee}.hljs-built_in,.hljs-class .hljs-title,.hljs-title.class_{color:#e6c07b}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:700}.hljs-link{text-decoration:underline}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/atom-one-light.min.css b/packages/md-web-cli/vendor/hljs-styles/atom-one-light.min.css
new file mode 100644
index 0000000000..df0268a948
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/atom-one-light.min.css
@@ -0,0 +1 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}.hljs{color:#383a42;background:#fafafa}.hljs-comment,.hljs-quote{color:#a0a1a7;font-style:italic}.hljs-doctag,.hljs-formula,.hljs-keyword{color:#a626a4}.hljs-deletion,.hljs-name,.hljs-section,.hljs-selector-tag,.hljs-subst{color:#e45649}.hljs-literal{color:#0184bb}.hljs-addition,.hljs-attribute,.hljs-meta .hljs-string,.hljs-regexp,.hljs-string{color:#50a14f}.hljs-attr,.hljs-number,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-pseudo,.hljs-template-variable,.hljs-type,.hljs-variable{color:#986801}.hljs-bullet,.hljs-link,.hljs-meta,.hljs-selector-id,.hljs-symbol,.hljs-title{color:#4078f2}.hljs-built_in,.hljs-class .hljs-title,.hljs-title.class_{color:#c18401}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:700}.hljs-link{text-decoration:underline}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/github-dark.min.css b/packages/md-web-cli/vendor/hljs-styles/github-dark.min.css
new file mode 100644
index 0000000000..03b6da8bf4
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/github-dark.min.css
@@ -0,0 +1,10 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}/*!
+  Theme: GitHub Dark
+  Description: Dark theme as seen on github.com
+  Author: github.com
+  Maintainer: @Hirse
+  Updated: 2021-05-15
+
+  Outdated base version: https://github.com/primer/github-syntax-dark
+  Current colors taken from GitHub's CSS
+*/.hljs{color:#c9d1d9;background:#0d1117}.hljs-doctag,.hljs-keyword,.hljs-meta .hljs-keyword,.hljs-template-tag,.hljs-template-variable,.hljs-type,.hljs-variable.language_{color:#ff7b72}.hljs-title,.hljs-title.class_,.hljs-title.class_.inherited__,.hljs-title.function_{color:#d2a8ff}.hljs-attr,.hljs-attribute,.hljs-literal,.hljs-meta,.hljs-number,.hljs-operator,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-id,.hljs-variable{color:#79c0ff}.hljs-meta .hljs-string,.hljs-regexp,.hljs-string{color:#a5d6ff}.hljs-built_in,.hljs-symbol{color:#ffa657}.hljs-code,.hljs-comment,.hljs-formula{color:#8b949e}.hljs-name,.hljs-quote,.hljs-selector-pseudo,.hljs-selector-tag{color:#7ee787}.hljs-subst{color:#c9d1d9}.hljs-section{color:#1f6feb;font-weight:700}.hljs-bullet{color:#f2cc60}.hljs-emphasis{color:#c9d1d9;font-style:italic}.hljs-strong{color:#c9d1d9;font-weight:700}.hljs-addition{color:#aff5b4;background-color:#033a16}.hljs-deletion{color:#ffdcd7;background-color:#67060c}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/github.min.css b/packages/md-web-cli/vendor/hljs-styles/github.min.css
new file mode 100644
index 0000000000..275239a7aa
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/github.min.css
@@ -0,0 +1,10 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}/*!
+  Theme: GitHub
+  Description: Light theme as seen on github.com
+  Author: github.com
+  Maintainer: @Hirse
+  Updated: 2021-05-15
+
+  Outdated base version: https://github.com/primer/github-syntax-light
+  Current colors taken from GitHub's CSS
+*/.hljs{color:#24292e;background:#fff}.hljs-doctag,.hljs-keyword,.hljs-meta .hljs-keyword,.hljs-template-tag,.hljs-template-variable,.hljs-type,.hljs-variable.language_{color:#d73a49}.hljs-title,.hljs-title.class_,.hljs-title.class_.inherited__,.hljs-title.function_{color:#6f42c1}.hljs-attr,.hljs-attribute,.hljs-literal,.hljs-meta,.hljs-number,.hljs-operator,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-id,.hljs-variable{color:#005cc5}.hljs-meta .hljs-string,.hljs-regexp,.hljs-string{color:#032f62}.hljs-built_in,.hljs-symbol{color:#e36209}.hljs-code,.hljs-comment,.hljs-formula{color:#6a737d}.hljs-name,.hljs-quote,.hljs-selector-pseudo,.hljs-selector-tag{color:#22863a}.hljs-subst{color:#24292e}.hljs-section{color:#005cc5;font-weight:700}.hljs-bullet{color:#735c0f}.hljs-emphasis{color:#24292e;font-style:italic}.hljs-strong{color:#24292e;font-weight:700}.hljs-addition{color:#22863a;background-color:#f0fff4}.hljs-deletion{color:#b31d28;background-color:#ffeef0}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/monokai.min.css b/packages/md-web-cli/vendor/hljs-styles/monokai.min.css
new file mode 100644
index 0000000000..d289f635dd
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/monokai.min.css
@@ -0,0 +1 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}.hljs{background:#272822;color:#ddd}.hljs-keyword,.hljs-literal,.hljs-name,.hljs-number,.hljs-selector-tag,.hljs-strong,.hljs-tag{color:#f92672}.hljs-code{color:#66d9ef}.hljs-attr,.hljs-attribute,.hljs-link,.hljs-regexp,.hljs-symbol{color:#bf79db}.hljs-addition,.hljs-built_in,.hljs-bullet,.hljs-emphasis,.hljs-section,.hljs-selector-attr,.hljs-selector-pseudo,.hljs-string,.hljs-subst,.hljs-template-tag,.hljs-template-variable,.hljs-title,.hljs-type,.hljs-variable{color:#a6e22e}.hljs-class .hljs-title,.hljs-title.class_{color:#fff}.hljs-comment,.hljs-deletion,.hljs-meta,.hljs-quote{color:#75715e}.hljs-doctag,.hljs-keyword,.hljs-literal,.hljs-section,.hljs-selector-id,.hljs-selector-tag,.hljs-title,.hljs-type{font-weight:700}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/nord.min.css b/packages/md-web-cli/vendor/hljs-styles/nord.min.css
new file mode 100644
index 0000000000..efbb0c13e6
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/nord.min.css
@@ -0,0 +1 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}.hljs{background:#2e3440}.hljs,.hljs-subst{color:#d8dee9}.hljs-selector-tag{color:#81a1c1}.hljs-selector-id{color:#8fbcbb;font-weight:700}.hljs-selector-attr,.hljs-selector-class{color:#8fbcbb}.hljs-property,.hljs-selector-pseudo{color:#88c0d0}.hljs-addition{background-color:rgba(163,190,140,.5)}.hljs-deletion{background-color:rgba(191,97,106,.5)}.hljs-built_in,.hljs-class,.hljs-type{color:#8fbcbb}.hljs-function,.hljs-function>.hljs-title,.hljs-title.hljs-function{color:#88c0d0}.hljs-keyword,.hljs-literal,.hljs-symbol{color:#81a1c1}.hljs-number{color:#b48ead}.hljs-regexp{color:#ebcb8b}.hljs-string{color:#a3be8c}.hljs-title{color:#8fbcbb}.hljs-params{color:#d8dee9}.hljs-bullet{color:#81a1c1}.hljs-code{color:#8fbcbb}.hljs-emphasis{font-style:italic}.hljs-formula{color:#8fbcbb}.hljs-strong{font-weight:700}.hljs-link:hover{text-decoration:underline}.hljs-comment,.hljs-quote{color:#4c566a}.hljs-doctag{color:#8fbcbb}.hljs-meta,.hljs-meta .hljs-keyword{color:#5e81ac}.hljs-meta .hljs-string{color:#a3be8c}.hljs-attr{color:#8fbcbb}.hljs-attribute{color:#d8dee9}.hljs-name{color:#81a1c1}.hljs-section{color:#88c0d0}.hljs-tag{color:#81a1c1}.hljs-template-variable,.hljs-variable{color:#d8dee9}.hljs-template-tag{color:#5e81ac}.language-abnf .hljs-attribute{color:#88c0d0}.language-abnf .hljs-symbol{color:#ebcb8b}.language-apache .hljs-attribute{color:#88c0d0}.language-apache .hljs-section{color:#81a1c1}.language-arduino .hljs-built_in{color:#88c0d0}.language-aspectj .hljs-meta{color:#d08770}.language-aspectj>.hljs-title{color:#88c0d0}.language-bnf .hljs-attribute{color:#8fbcbb}.language-clojure .hljs-name{color:#88c0d0}.language-clojure .hljs-symbol{color:#ebcb8b}.language-coq .hljs-built_in{color:#88c0d0}.language-cpp .hljs-meta .hljs-string{color:#8fbcbb}.language-css .hljs-built_in{color:#88c0d0}.language-css .hljs-keyword{color:#d08770}.language-diff .hljs-meta,.language-ebnf .hljs-attribute{color:#8fbcbb}.language-glsl .hljs-built_in{color:#88c0d0}.language-groovy .hljs-meta:not(:first-child),.language-haxe .hljs-meta,.language-java .hljs-meta{color:#d08770}.language-ldif .hljs-attribute{color:#8fbcbb}.language-lisp .hljs-name,.language-lua .hljs-built_in,.language-moonscript .hljs-built_in,.language-nginx .hljs-attribute{color:#88c0d0}.language-nginx .hljs-section{color:#5e81ac}.language-pf .hljs-built_in,.language-processing .hljs-built_in{color:#88c0d0}.language-scss .hljs-keyword,.language-stylus .hljs-keyword{color:#81a1c1}.language-swift .hljs-meta{color:#d08770}.language-vim .hljs-built_in{color:#88c0d0;font-style:italic}.language-yaml .hljs-meta{color:#d08770}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/tokyo-night-dark.min.css b/packages/md-web-cli/vendor/hljs-styles/tokyo-night-dark.min.css
new file mode 100644
index 0000000000..dc63ad9e76
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/tokyo-night-dark.min.css
@@ -0,0 +1,8 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}/*!
+  Theme: Tokyo-night-Dark
+  origin: https://github.com/enkia/tokyo-night-vscode-theme
+  Description: Original highlight.js style
+  Author: (c) Henri Vandersleyen <hvandersleyen@gmail.com>
+  License: see project LICENSE
+  Touched: 2022
+*/.hljs-comment,.hljs-meta{color:#565f89}.hljs-deletion,.hljs-doctag,.hljs-regexp,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-id,.hljs-selector-pseudo,.hljs-tag,.hljs-template-tag,.hljs-variable.language_{color:#f7768e}.hljs-link,.hljs-literal,.hljs-number,.hljs-params,.hljs-template-variable,.hljs-type,.hljs-variable{color:#ff9e64}.hljs-attribute,.hljs-built_in{color:#e0af68}.hljs-keyword,.hljs-property,.hljs-subst,.hljs-title,.hljs-title.class_,.hljs-title.class_.inherited__,.hljs-title.function_{color:#7dcfff}.hljs-selector-tag{color:#73daca}.hljs-addition,.hljs-bullet,.hljs-quote,.hljs-string,.hljs-symbol{color:#9ece6a}.hljs-code,.hljs-formula,.hljs-section{color:#7aa2f7}.hljs-attr,.hljs-char.escape_,.hljs-keyword,.hljs-name,.hljs-operator{color:#bb9af7}.hljs-punctuation{color:#c0caf5}.hljs{background:#1a1b26;color:#9aa5ce}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:700}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/tokyo-night-light.min.css b/packages/md-web-cli/vendor/hljs-styles/tokyo-night-light.min.css
new file mode 100644
index 0000000000..0096d4d1ec
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/tokyo-night-light.min.css
@@ -0,0 +1,8 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}/*!
+  Theme: Tokyo-night-light
+  origin: https://github.com/enkia/tokyo-night-vscode-theme
+  Description: Original highlight.js style
+  Author: (c) Henri Vandersleyen <hvandersleyen@gmail.com>
+  License: see project LICENSE
+  Touched: 2022
+*/.hljs-comment,.hljs-meta{color:#9699a3}.hljs-deletion,.hljs-doctag,.hljs-regexp,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-id,.hljs-selector-pseudo,.hljs-tag,.hljs-template-tag,.hljs-variable.language_{color:#8c4351}.hljs-link,.hljs-literal,.hljs-number,.hljs-params,.hljs-template-variable,.hljs-type,.hljs-variable{color:#965027}.hljs-attribute,.hljs-built_in{color:#8f5e15}.hljs-keyword,.hljs-property,.hljs-subst,.hljs-title,.hljs-title.class_,.hljs-title.class_.inherited__,.hljs-title.function_{color:#0f4b6e}.hljs-selector-tag{color:#33635c}.hljs-addition,.hljs-bullet,.hljs-quote,.hljs-string,.hljs-symbol{color:#485e30}.hljs-code,.hljs-formula,.hljs-section{color:#34548a}.hljs-attr,.hljs-char.escape_,.hljs-keyword,.hljs-name,.hljs-operator{color:#5a4a78}.hljs-punctuation{color:#343b58}.hljs{background:#d5d6db;color:#565a6e}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:700}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/vs.min.css b/packages/md-web-cli/vendor/hljs-styles/vs.min.css
new file mode 100644
index 0000000000..fb695c14b9
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/vs.min.css
@@ -0,0 +1 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}.hljs{background:#fff;color:#000}.hljs-comment,.hljs-quote,.hljs-variable{color:green}.hljs-built_in,.hljs-keyword,.hljs-name,.hljs-selector-tag,.hljs-tag{color:#00f}.hljs-addition,.hljs-attribute,.hljs-literal,.hljs-section,.hljs-string,.hljs-template-tag,.hljs-template-variable,.hljs-title,.hljs-type{color:#a31515}.hljs-deletion,.hljs-meta,.hljs-selector-attr,.hljs-selector-pseudo{color:#2b91af}.hljs-doctag{color:grey}.hljs-attr{color:red}.hljs-bullet,.hljs-link,.hljs-symbol{color:#00b0e8}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:700}
\ No newline at end of file
diff --git a/packages/md-web-cli/vendor/hljs-styles/xcode.min.css b/packages/md-web-cli/vendor/hljs-styles/xcode.min.css
new file mode 100644
index 0000000000..cda4adc17a
--- /dev/null
+++ b/packages/md-web-cli/vendor/hljs-styles/xcode.min.css
@@ -0,0 +1 @@
+pre code.hljs{display:block;overflow-x:auto;padding:1em}code.hljs{padding:3px 5px}.hljs{background:#fff;color:#000}.xml .hljs-meta{color:silver}.hljs-comment,.hljs-quote{color:#007400}.hljs-attribute,.hljs-keyword,.hljs-literal,.hljs-name,.hljs-selector-tag,.hljs-tag{color:#aa0d91}.hljs-template-variable,.hljs-variable{color:#3f6e74}.hljs-code,.hljs-meta .hljs-string,.hljs-string{color:#c41a16}.hljs-link,.hljs-regexp{color:#0e0eff}.hljs-bullet,.hljs-number,.hljs-symbol,.hljs-title{color:#1c00cf}.hljs-meta,.hljs-section{color:#643820}.hljs-built_in,.hljs-class .hljs-title,.hljs-params,.hljs-title.class_,.hljs-type{color:#5c2699}.hljs-attr{color:#836c28}.hljs-subst{color:#000}.hljs-formula{background-color:#eee;font-style:italic}.hljs-addition{background-color:#baeeba}.hljs-deletion{background-color:#ffc8bd}.hljs-selector-class,.hljs-selector-id{color:#9b703f}.hljs-doctag,.hljs-strong{font-weight:700}.hljs-emphasis{font-style:italic}
\ No newline at end of file
diff --git a/packages/md-web-cli/vitest.config.ts b/packages/md-web-cli/vitest.config.ts
new file mode 100644
index 0000000000..187bbd3dd8
--- /dev/null
+++ b/packages/md-web-cli/vitest.config.ts
@@ -0,0 +1,13 @@
+import { defineConfig } from 'vitest/config'
+
+// `.css?raw` imports are handled natively by Vite's ?raw suffix, matching
+// what src/assets.ts uses (the esbuild build maps the same suffix to its text
+// loader). css must be enabled: with vitest's default CSS handling disabled,
+// CSS imports (including ?raw) come back as empty strings.
+export default defineConfig({
+  test: {
+    css: true,
+    environment: `node`,
+    include: [`tests/**/*.test.ts`],
+  },
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f8a49d9373..bb6eb7c109 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -278,6 +278,9 @@ importers:
       lint-staged:
         specifier: ^17.6.0
         version: 17.6.0
+      playwright:
+        specifier: ^1.64.1
+        version: 1.64.1
       prettier:
         specifier: 2.8.8
         version: 2.8.8
@@ -622,6 +625,39 @@ importers:
         specifier: ^3.1.14
         version: 3.1.14
 
+  packages/md-web-cli:
+    devDependencies:
+      '@md/config':
+        specifier: workspace:*
+        version: link:../config
+      '@md/core':
+        specifier: workspace:*
+        version: link:../core
+      '@md/shared':
+        specifier: workspace:*
+        version: link:../shared
+      '@types/jsdom':
+        specifier: ^30.0.0
+        version: 30.0.0
+      '@types/node':
+        specifier: 'catalog:'
+        version: 26.6.5
+      esbuild:
+        specifier: '>=0.28.2'
+        version: 0.28.2
+      jsdom:
+        specifier: ^30.1.3
+        version: 30.1.3
+      juice:
+        specifier: ^12.2.0
+        version: 12.2.0
+      typescript:
+        specifier: 'catalog:'
+        version: 6.0.3
+      vitest:
+        specifier: 'catalog:'
+        version: 5.0.5(@types/node@26.6.5)(jsdom@30.1.3)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(less@4.9.1(supports-color@10.2.2))(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))
+
   packages/shared:
     dependencies:
       '@codemirror/autocomplete':
@@ -2564,6 +2600,9 @@ packages:
   '@types/hast@3.0.5':
     resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==}
 
+  '@types/jsdom@30.0.0':
+    resolution: {integrity: sha512-uAHGxujGE0cDaKGdK28zgDotFtNA7MKq5DXl8LrfdxdCI8VHcg15oJz+amHTChPNI5JpgEPQWc2xFdrw3em/nQ==}
+
   '@types/json-schema@7.0.15':
     resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
 
@@ -2579,6 +2618,9 @@ packages:
   '@types/node@26.6.5':
     resolution: {integrity: sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==}
 
+  '@types/tough-cookie@4.0.5':
+    resolution: {integrity: sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==}
+
   '@types/trusted-types@2.0.7':
     resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
 
@@ -5513,6 +5555,16 @@ packages:
   pkg-types@2.3.3:
     resolution: {integrity: sha512-j/lCFdcppV0JxWpCEITdbDltBxPP6cHT+yNJ6Go2OgoSA9518X847X9z0p6LtA4Nc16+eQzCZjRrWanTGvHJ5w==}
 
+  playwright-core@1.64.1:
+    resolution: {integrity: sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==}
+    engines: {node: '>=20'}
+    hasBin: true
+
+  playwright@1.64.1:
+    resolution: {integrity: sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==}
+    engines: {node: '>=20'}
+    hasBin: true
+
   pluralize@8.0.0:
     resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
     engines: {node: '>=4'}
@@ -8651,6 +8703,13 @@ snapshots:
     dependencies:
       '@types/unist': 3.0.3
 
+  '@types/jsdom@30.0.0':
+    dependencies:
+      '@types/node': 26.6.5
+      '@types/tough-cookie': 4.0.5
+      parse5: 8.0.1
+      undici-types: 8.9.0
+
   '@types/json-schema@7.0.15': {}
 
   '@types/katex@0.16.8': {}
@@ -8665,6 +8724,8 @@ snapshots:
     dependencies:
       undici-types: 8.9.0
 
+  '@types/tough-cookie@4.0.5': {}
+
   '@types/trusted-types@2.0.7':
     optional: true
 
@@ -11948,6 +12009,12 @@ snapshots:
       exsolve: 1.1.3
       pathe: 2.0.3
 
+  playwright-core@1.64.1: {}
+
+  playwright@1.64.1:
+    dependencies:
+      playwright-core: 1.64.1
+
   pluralize@8.0.0: {}
 
   pnpm-workspace-yaml@1.9.1:
diff --git a/scripts/verify.mjs b/scripts/verify.mjs
new file mode 100644
index 0000000000..0195d93c23
--- /dev/null
+++ b/scripts/verify.mjs
@@ -0,0 +1,436 @@
+#!/usr/bin/env node
+/**
+ * The verify gate.
+ *
+ * One command, one meaning: build the bundle, capture a fresh Oracle from the
+ * browser, render the same fixture through the CLI, and compare the two outputs
+ * byte for byte. Exit code 0 only when they are identical.
+ *
+ * It builds its own inputs so it can never pass against a stale bundle, and it
+ * captures the Oracle on every run so it can never pass against a stale
+ * baseline. The browser appears only here.
+ *
+ * Usage: node scripts/verify.mjs [--fixture <name|path>] [--config <file>]
+ *                               [--out-dir <dir>] [--keep]
+ */
+
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import process from 'node:process'
+import { compareOutputs } from './verify/compare.mjs'
+import { assertConfigApplied, buildConfigSeedScript, ConfigError, projectDesignerConfig } from './verify/config.mjs'
+import { assertOutsideRepository, REPO_ROOT } from './verify/paths.mjs'
+import { runSelfTest } from './verify/self-test.mjs'
+import { findStructuralProblems } from './verify/structural.mjs'
+
+const CLI_BUNDLE = resolve(REPO_ROOT, `packages/md-web-cli/dist/cli.js`)
+const FIXTURE_DIR = resolve(REPO_ROOT, `packages/md-web-cli/fixtures`)
+
+/**
+ * Fixture registry.
+ *
+ * `full` is the product signal. `minimal` is an infrastructure probe: its
+ * failure means the harness is broken, its success proves nothing about
+ * product fidelity. Both run by default so one command yields both signals.
+ */
+const FIXTURES = {
+  full: {
+    path: join(FIXTURE_DIR, `full.md`),
+    role: `product signal`,
+    summary: `headings, tables, code blocks, lists, blockquotes, images, links, rules`,
+    failureMeaning: `a difference here is a product fidelity difference`,
+  },
+  minimal: {
+    path: join(FIXTURE_DIR, `minimal.md`),
+    role: `infrastructure probe`,
+    summary: `heading, paragraph, inline code — a failure means the harness is broken and a pass proves nothing about product fidelity`,
+    failureMeaning: `a probe failure means the harness is broken, not that rendering drifted`,
+  },
+}
+
+const BUILD_COMMANDS = [
+  [`--filter`, `@md/web`, `build:only`],
+  [`--filter`, `@dane.dai/md-web-cli`, `build`],
+]
+
+class VerifyError extends Error {}
+
+function printUsage() {
+  process.stdout.write(`Usage: node scripts/verify.mjs [options]
+
+Builds the CLI bundle, captures a fresh browser Oracle for each fixture, renders
+the same fixture through the CLI, and compares the outputs byte for byte. Exits
+non-zero on any difference. There is no tolerance, allow-list, or known-gaps
+mechanism.
+
+Fixtures (both run by default):
+${
+  Object.entries(FIXTURES).map(([name, fixture]) => `  ${name.padEnd(9)} ${fixture.role} — ${fixture.summary}`).join(`\n`)
+}
+
+Options:
+  --fixture <name|path>   Run one fixture (or a path to a Markdown file) instead
+                          of both registry fixtures
+  --config <file>         Designer config JSON; projected to render-affecting
+                          keys and given identically to both sides. The five
+                          style keys a Designer export cannot carry fall back
+                          to each side's own site defaults
+  --out-dir <dir>         Write artifacts here and keep them (implies --keep;
+                          must be outside the repository)
+  --keep                  Keep the artifacts and print their paths
+  --self-test             Reverse-case self-test: corrupt a known-good CLI
+                          render several ways and assert the gate rejects each
+                          mutant. Needs no browser
+  -h, --help              Show this help
+`)
+}
+
+function fail(message) {
+  throw new VerifyError(message)
+}
+
+function parseArgs(argv) {
+  const args = { keep: false, fixture: null }
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index]
+    const next = () => {
+      const value = argv[++index]
+      if (value === undefined || value.startsWith(`--`))
+        fail(`${arg} requires a value`)
+      return value
+    }
+    if (arg === `--fixture`)
+      args.fixture = next()
+    else if (arg.startsWith(`--fixture=`))
+      args.fixture = arg.slice(`--fixture=`.length)
+    else if (arg === `--config`)
+      args.config = next()
+    else if (arg.startsWith(`--config=`))
+      args.config = arg.slice(`--config=`.length)
+    else if (arg === `--out-dir`)
+      args.outDir = next()
+    else if (arg.startsWith(`--out-dir=`))
+      args.outDir = arg.slice(`--out-dir=`.length)
+    else if (arg === `--keep`)
+      args.keep = true
+    else if (arg === `--self-test`)
+      args.selfTest = true
+    else if (arg === `-h` || arg === `--help`)
+      args.help = true
+    else
+      fail(`unknown option "${arg}" (see --help)`)
+  }
+  return args
+}
+
+function resolveFixtures(value) {
+  if (value === null)
+    return Object.entries(FIXTURES).map(([name, fixture]) => ({ name, ...fixture }))
+  if (value in FIXTURES)
+    return [{ name: value, ...FIXTURES[value] }]
+  const path = resolve(process.cwd(), value)
+  if (!existsSync(path))
+    fail(`fixture not found: ${path} (known names: ${Object.keys(FIXTURES).join(`, `)})`)
+  return [{ name: value, path, role: `custom fixture`, failureMeaning: `outputs differ` }]
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: REPO_ROOT,
+    stdio: options.capture ? `pipe` : `inherit`,
+    encoding: `utf8`,
+  })
+  if (result.error)
+    fail(`${command} failed to start: ${result.error.message}`)
+  if (result.status !== 0) {
+    if (options.capture && result.stderr)
+      process.stderr.write(result.stderr)
+    fail(options.describe ?? `${command} ${args.join(` `)} exited ${result.status}`)
+  }
+  return result
+}
+
+function buildEverything() {
+  process.stdout.write(`[verify] building its own input (never a previously built bundle)\n`)
+  for (const args of BUILD_COMMANDS)
+    run(`pnpm`, args, { describe: `build failed: pnpm ${args.join(` `)}` })
+}
+
+function renderThroughCli(fixturePath, outPath, configPath) {
+  const args = [CLI_BUNDLE, `render`, fixturePath, `-o`, outPath]
+  if (configPath)
+    args.push(`--config`, configPath)
+  run(process.execPath, args, {
+    capture: true,
+    describe: `CLI render failed for ${fixturePath}`,
+  })
+}
+
+function formatLocations(locations) {
+  const shown = locations.slice(0, 10).map(line => String(line))
+  const suffix = locations.length > shown.length ? `, +${locations.length - shown.length} more` : ``
+  return `${shown.join(`, `)}${suffix}`
+}
+
+function printStructuralFailure(fixture, problems) {
+  process.stderr.write(
+    `[verify] STRUCTURAL FAIL ${fixture.name}: ${problems.length} WeChat-readiness problem(s) in the CLI output\n`,
+  )
+  for (const problem of problems)
+    process.stderr.write(`  ${problem.kind}: ${problem.detail}\n`)
+}
+
+function printFailure(fixture, oracleHtml, cliHtml, comparison) {
+  process.stderr.write(
+    `[verify] FAIL ${fixture.name} (${fixture.role}): outputs are not byte-identical `
+    + `(oracle ${Buffer.byteLength(oracleHtml, `utf8`)} bytes, CLI ${Buffer.byteLength(cliHtml, `utf8`)} bytes, `
+    + `first difference at byte ${comparison.firstDifference})\n`,
+  )
+  process.stderr.write(`[verify] ${fixture.failureMeaning}\n`)
+  process.stderr.write(`[verify] difference classes (${comparison.hunkCount} hunks total):\n`)
+  for (const entry of comparison.classes) {
+    process.stderr.write(
+      `  ${entry.name.padEnd(24)} ${String(entry.locations.length).padStart(4)} hunks   lines ${formatLocations(entry.locations)}\n`,
+    )
+  }
+  process.stderr.write(`[verify] complete unified diff:\n`)
+  process.stderr.write(`${comparison.unifiedDiff}\n`)
+  process.stderr.write(
+    `[verify] total: ${comparison.hunkCount} hunks across ${comparison.classes.length} class(es)\n`,
+  )
+}
+
+function printPass(fixture, html) {
+  process.stdout.write(
+    `[verify] PASS ${fixture.name} (${fixture.role}): outputs are byte-identical (${Buffer.byteLength(html, `utf8`)} bytes)\n`,
+  )
+  if (fixture.role === `infrastructure probe`)
+    process.stdout.write(`[verify] note: a green infrastructure probe proves nothing about product fidelity\n`)
+}
+
+function isPassing(result) {
+  return result.comparison.equal && result.structuralProblems.length === 0
+}
+
+function printSummary(results) {
+  const passed = results.filter(isPassing).length
+  process.stdout.write(
+    `[verify] summary: ${results.length} fixture(s) — ${passed} passed, ${results.length - passed} failed\n`,
+  )
+  for (const result of results) {
+    const { fixture, comparison, structuralProblems } = result
+    const verdict = isPassing(result) ? `PASS` : `FAIL`
+    const details = []
+    if (!comparison.equal)
+      details.push(`${comparison.hunkCount} hunks: ${fixture.failureMeaning}`)
+    if (structuralProblems.length > 0)
+      details.push(`${structuralProblems.length} structural problem(s)`)
+    const detail = details.length > 0 ? ` — ${details.join(`; `)}` : ``
+    process.stdout.write(`  ${verdict} ${fixture.name} (${fixture.role})${detail}\n`)
+  }
+}
+
+async function verifyFixture({ fixture, workDir, configPath, projectedConfig, captureOracle }) {
+  const artifactDir = join(workDir, fixture.name)
+  mkdirSync(artifactDir, { recursive: true })
+  process.stdout.write(`[verify] fixture: ${fixture.name} — ${fixture.role}\n`)
+
+  // Render through the CLI first: a config or fixture the CLI rejects fails in
+  // under a second instead of after the browser capture.
+  const cliOutPath = join(artifactDir, `cli.html`)
+  renderThroughCli(fixture.path, cliOutPath, configPath)
+  const cliHtml = readFileSync(cliOutPath, `utf8`)
+
+  const oracleHtml = await captureOracle({
+    fixturePath: fixture.path,
+    outDir: artifactDir,
+    ...(projectedConfig
+      ? {
+          initScripts: [buildConfigSeedScript(projectedConfig)],
+          afterLoad: page => assertConfigApplied(page, projectedConfig),
+        }
+      : {}),
+  })
+
+  const structuralProblems = findStructuralProblems(cliHtml)
+  const comparison = compareOutputs(oracleHtml, cliHtml)
+  writeFileSync(join(artifactDir, `diff.txt`), comparison.unifiedDiff, `utf8`)
+  writeFileSync(
+    join(artifactDir, `report.txt`),
+    comparison.equal
+      ? `PASS: outputs are byte-identical (${Buffer.byteLength(oracleHtml, `utf8`)} bytes)\n`
+      : `FAIL: ${comparison.hunkCount} hunks across ${comparison.classes.length} class(es)\n${
+        comparison.classes.map(entry => `${entry.name}: ${entry.locations.length} hunks at lines ${entry.locations.join(`, `)}\n`).join(``)
+      }`,
+    `utf8`,
+  )
+
+  if (structuralProblems.length > 0)
+    printStructuralFailure(fixture, structuralProblems)
+
+  if (comparison.equal)
+    printPass(fixture, oracleHtml)
+  else
+    printFailure(fixture, oracleHtml, cliHtml, comparison)
+
+  process.stdout.write(`[verify] oracle: ${join(artifactDir, `oracle.html`)}\n`)
+  process.stdout.write(`[verify] cli:    ${cliOutPath}\n`)
+  process.stdout.write(`[verify] diff:   ${join(artifactDir, `diff.txt`)}\n`)
+  process.stdout.write(`[verify] report: ${join(artifactDir, `report.txt`)}\n`)
+
+  return { fixture, comparison, structuralProblems }
+}
+
+async function runSelfTestMode() {
+  const workDir = mkdtempSync(join(tmpdir(), `md-verify-self-test-`))
+  try {
+    process.stdout.write(`[self-test] building the CLI bundle (no browser involved)\n`)
+    run(`pnpm`, [`--filter`, `@dane.dai/md-web-cli`, `build`], { describe: `build failed` })
+    const knownGoodPath = join(workDir, `known-good.html`)
+    run(process.execPath, [CLI_BUNDLE, `render`, FIXTURES.full.path, `-o`, knownGoodPath], {
+      capture: true,
+      describe: `CLI render failed; the self-test needs a known-good render`,
+    })
+
+    const { baselineProblems, positiveControl, cases } = runSelfTest(readFileSync(knownGoodPath, `utf8`))
+    if (!positiveControl) {
+      process.stderr.write(
+        `[self-test] FAIL: identical input did not compare equal; every reverse case would pass for the wrong reason\n`,
+      )
+      return 1
+    }
+    process.stdout.write(`[self-test] PASS: identical input compares equal\n`)
+
+    if (baselineProblems.length > 0) {
+      process.stderr.write(`[self-test] baseline render is not WeChat-ready; cannot self-test against it:\n`)
+      for (const problem of baselineProblems)
+        process.stderr.write(`  ${problem.kind}: ${problem.detail}\n`)
+      return 1
+    }
+
+    let ok = true
+    for (const testCase of cases) {
+      if (testCase.rejected) {
+        process.stdout.write(`[self-test] PASS: ${testCase.name} -> gate rejects it (${testCase.firstReason})\n`)
+        continue
+      }
+      ok = false
+      const missingKind = testCase.expectedKind && !testCase.expectedKindFound
+        ? ` (expected a "${testCase.expectedKind}" problem, saw: ${testCase.matchedKinds.join(`, `) || `none`})`
+        : ``
+      process.stderr.write(
+        `[self-test] FAIL: ${testCase.name} was NOT rejected${missingKind}; the gate cannot be trusted\n`,
+      )
+    }
+    process.stdout.write(
+      `[self-test] ${ok ? `PASS` : `FAIL`}: ${cases.length} reverse case(s), every mutant must be rejected\n`,
+    )
+    return ok ? 0 : 1
+  }
+  finally {
+    rmSync(workDir, { recursive: true, force: true })
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2))
+  if (args.help) {
+    printUsage()
+    return 0
+  }
+  if (args.selfTest)
+    return runSelfTestMode()
+
+  const fixtures = resolveFixtures(args.fixture)
+  for (const fixture of fixtures) {
+    if (!existsSync(fixture.path))
+      fail(`fixture not found: ${fixture.path}`)
+  }
+
+  let requestedConfig
+  if (args.config) {
+    const sourcePath = resolve(process.cwd(), args.config)
+    if (!existsSync(sourcePath))
+      fail(`config not found: ${sourcePath}`)
+    try {
+      requestedConfig = JSON.parse(readFileSync(sourcePath, `utf8`))
+    }
+    catch (error) {
+      fail(`config is not valid JSON: ${error.message}`)
+    }
+  }
+
+  const keepArtifacts = Boolean(args.outDir || args.keep)
+  let workDir
+  if (args.outDir) {
+    try {
+      workDir = assertOutsideRepository(resolve(process.cwd(), args.outDir), `--out-dir`)
+    }
+    catch (error) {
+      fail(error.message)
+    }
+  }
+  else {
+    workDir = mkdtempSync(join(tmpdir(), `md-verify-`))
+  }
+  mkdirSync(workDir, { recursive: true })
+  process.stdout.write(`[verify] artifacts: ${workDir}\n`)
+
+  try {
+    let configPath
+    let projectedConfig
+    if (requestedConfig) {
+      const { projected, dropped } = projectDesignerConfig(requestedConfig)
+      projectedConfig = projected
+      const keptCount = Object.keys(projected).length
+      const droppedCount = dropped.content.length + dropped.ui.length + dropped.unknown.length
+      process.stdout.write(
+        `[verify] config: ${keptCount} render-affecting key(s) kept, ${droppedCount} dropped `
+        + `(${dropped.content.length} article-content, ${dropped.ui.length} UI, ${dropped.unknown.length} unknown)\n`,
+      )
+      if (dropped.unknown.length > 0)
+        process.stdout.write(`[verify] config: unknown keys ignored: ${dropped.unknown.join(`, `)}\n`)
+      configPath = join(workDir, `projected-config.json`)
+      writeFileSync(configPath, JSON.stringify(projected, null, 2), `utf8`)
+      process.stdout.write(`[verify] config: the same projected file goes to both sides (${configPath})\n`)
+    }
+
+    buildEverything()
+    // Loaded lazily: this module pulls in Playwright, and --help, argument
+    // validation, and --self-test must not pay for the browser driver.
+    const { captureOracle } = await import(`./verify/oracle.mjs`)
+
+    const results = []
+    for (const fixture of fixtures)
+      results.push(await verifyFixture({ fixture, workDir, configPath, projectedConfig, captureOracle }))
+
+    printSummary(results)
+
+    if (keepArtifacts)
+      process.stdout.write(`[verify] artifacts preserved: ${workDir}\n`)
+    else
+      process.stdout.write(`[verify] artifacts are temporary; pass --keep to preserve them\n`)
+
+    return results.every(isPassing) ? 0 : 1
+  }
+  finally {
+    if (!keepArtifacts)
+      rmSync(workDir, { recursive: true, force: true })
+  }
+}
+
+main()
+  .then((exitCode) => {
+    process.exitCode = exitCode
+  })
+  .catch((error) => {
+    if (error instanceof VerifyError || error instanceof ConfigError) {
+      process.stderr.write(`[verify] ${error.message}\n`)
+    }
+    else {
+      process.stderr.write(`[verify] unexpected failure: ${error?.stack ?? error?.message ?? String(error)}\n`)
+    }
+    process.exitCode = 1
+  })
diff --git a/scripts/verify/compare.mjs b/scripts/verify/compare.mjs
new file mode 100644
index 0000000000..f2ac2f1168
--- /dev/null
+++ b/scripts/verify/compare.mjs
@@ -0,0 +1,346 @@
+/**
+ * Strict comparator for the verify gate.
+ *
+ * Two rendered outputs are equal only when they are byte-identical. There is no
+ * tolerance, no allow-list, and no expiry mechanism here by design: a tolerance
+ * cannot tell "same rendering" from "similar number", which is how a line-height
+ * change from 1.75 to 1.8 used to pass a gate.
+ *
+ * The diff below is reporting, never comparison: it explains a failure that the
+ * byte comparison has already decided.
+ */
+
+const CONTEXT_LINES = 3
+const MAX_LCS_LINES = 4000
+
+/**
+ * Split HTML into one tag or text run per line. The outputs are HTML with few
+ * newlines, so line-diffing the raw text would collapse every difference into a
+ * handful of unreadable hunks.
+ */
+function explodeHtml(html) {
+  return html.replace(/></g, `>\n<`).split(`\n`)
+}
+
+function diffSequences(a, b) {
+  const n = a.length
+  const m = b.length
+  if (n === 0)
+    return b.map((_, index) => ({ type: `insert`, bIndex: index }))
+  if (m === 0)
+    return a.map((_, index) => ({ type: `delete`, aIndex: index }))
+  // Identical inputs are the common case (and the only passing one).
+  if (a.join(`\n`) === b.join(`\n`))
+    return a.map((_, index) => ({ type: `equal`, aIndex: index, bIndex: index }))
+
+  let prefix = 0
+  while (prefix < n && prefix < m && a[prefix] === b[prefix])
+    prefix += 1
+  let suffix = 0
+  while (suffix < n - prefix && suffix < m - prefix && a[n - 1 - suffix] === b[m - 1 - suffix])
+    suffix += 1
+
+  const ops = []
+  for (let index = 0; index < prefix; index++)
+    ops.push({ type: `equal`, aIndex: index, bIndex: index })
+
+  const midA = a.slice(prefix, n - suffix)
+  const midB = b.slice(prefix, m - suffix)
+  const p = midA.length
+  const q = midB.length
+
+  // Above the cap the diff degrades to "the whole middle changed"; the verdict
+  // (byte equality) never depends on this.
+  if (p * q > MAX_LCS_LINES * MAX_LCS_LINES) {
+    for (let index = 0; index < p; index++)
+      ops.push({ type: `delete`, aIndex: prefix + index })
+    for (let index = 0; index < q; index++)
+      ops.push({ type: `insert`, bIndex: prefix + index })
+  }
+  else {
+    const width = q + 1
+    const lcs = new Uint32Array((p + 1) * width)
+    for (let i = p - 1; i >= 0; i--) {
+      for (let j = q - 1; j >= 0; j--) {
+        lcs[i * width + j] = midA[i] === midB[j]
+          ? lcs[(i + 1) * width + (j + 1)] + 1
+          : Math.max(lcs[(i + 1) * width + j], lcs[i * width + (j + 1)])
+      }
+    }
+    let i = 0
+    let j = 0
+    while (i < p && j < q) {
+      if (midA[i] === midB[j]) {
+        ops.push({ type: `equal`, aIndex: prefix + i, bIndex: prefix + j })
+        i += 1
+        j += 1
+      }
+      else if (lcs[(i + 1) * width + j] >= lcs[i * width + (j + 1)]) {
+        ops.push({ type: `delete`, aIndex: prefix + i })
+        i += 1
+      }
+      else {
+        ops.push({ type: `insert`, bIndex: prefix + j })
+        j += 1
+      }
+    }
+    while (i < p) {
+      ops.push({ type: `delete`, aIndex: prefix + i })
+      i += 1
+    }
+    while (j < q) {
+      ops.push({ type: `insert`, bIndex: prefix + j })
+      j += 1
+    }
+  }
+
+  for (let index = 0; index < suffix; index++)
+    ops.push({ type: `equal`, aIndex: n - suffix + index, bIndex: m - suffix + index })
+
+  return ops
+}
+
+function groupHunks(ops) {
+  const hunks = []
+  let current = null
+  for (let index = 0; index < ops.length; index++) {
+    const op = ops[index]
+    if (op.type === `equal`) {
+      if (current)
+        current.trailingEqual += 1
+      continue
+    }
+    if (current && current.trailingEqual <= CONTEXT_LINES * 2) {
+      current.ops.push(op)
+      current.endIndex = index
+      current.trailingEqual = 0
+      continue
+    }
+    current = { ops: [op], startIndex: index, endIndex: index, trailingEqual: 0 }
+    hunks.push(current)
+  }
+  return hunks
+}
+
+function parseAttributes(line) {
+  // Exploded lines can carry the original document's indentation.
+  const trimmed = line.trimStart()
+  if (!trimmed.startsWith(`<`))
+    return null
+  const end = trimmed.lastIndexOf(`>`)
+  if (end < 0)
+    return null
+  const tagMatch = trimmed.match(/^<([\w-]+)/)
+  if (!tagMatch)
+    return null
+  const source = trimmed.slice(0, end)
+  const attrs = new Map()
+  for (const match of source.matchAll(/([\w:-]+)\s*=\s*"([^"]*)"/g))
+    attrs.set(match[1], match[2])
+  return { tag: tagMatch[1], attrs }
+}
+
+function parseStyleDeclarations(value) {
+  const declarations = new Map()
+  for (const part of value.split(`;`)) {
+    const colon = part.indexOf(`:`)
+    if (colon < 0)
+      continue
+    const property = part.slice(0, colon).trim()
+    const propertyValue = part.slice(colon + 1).trim()
+    if (property)
+      declarations.set(property, propertyValue)
+  }
+  return declarations
+}
+
+/**
+ * Classify what actually differs between one removed and one added line.
+ *
+ * Classes are derived mechanically from the two lines — attribute presence,
+ * style-property value, text, element name — so a summary can say whether a
+ * failure is the class-attribute difference or a real style drift without any
+ * allow-list deciding the verdict.
+ */
+function classifyLinePair(removed, added) {
+  const classes = new Set()
+  if (removed === undefined) {
+    classes.add(`structure`)
+    return [...classes]
+  }
+  if (added === undefined) {
+    classes.add(`structure`)
+    return [...classes]
+  }
+
+  const before = parseAttributes(removed)
+  const after = parseAttributes(added)
+  if (!before || !after) {
+    // A text run that carries inline markup: compare the tag-stripped text and
+    // the class-attribute count, which is what the CLI's class stripping moves.
+    const classCount = value => (value.match(/\sclass\s*=/g) ?? []).length
+    if (classCount(removed) !== classCount(added))
+      classes.add(`attribute:class`)
+    const stripTags = value => value.replace(/<[^>]*>/g, ``)
+    if (stripTags(removed) !== stripTags(added))
+      classes.add(`text`)
+    if (classes.size === 0)
+      classes.add(`text`)
+    return [...classes]
+  }
+  if (before.tag !== after.tag) {
+    classes.add(`element`)
+    return [...classes]
+  }
+
+  for (const [name, value] of before.attrs) {
+    if (!after.attrs.has(name)) {
+      classes.add(`attribute:${name}`)
+      continue
+    }
+    const other = after.attrs.get(name)
+    if (other === value)
+      continue
+    if (name === `style`) {
+      const a = parseStyleDeclarations(value)
+      const b = parseStyleDeclarations(other)
+      for (const [property, propertyValue] of a) {
+        if (b.get(property) !== propertyValue)
+          classes.add(`style:${property}`)
+      }
+      for (const property of b.keys()) {
+        if (!a.has(property))
+          classes.add(`style:${property}`)
+      }
+    }
+    else {
+      classes.add(`attribute:${name}`)
+    }
+  }
+  for (const name of after.attrs.keys()) {
+    if (!before.attrs.has(name))
+      classes.add(`attribute:${name}`)
+  }
+
+  // Same tag, same attributes, different text: content drift.
+  const textOf = line => line.replace(/<[^>]*>/g, ``)
+  if (textOf(removed) !== textOf(added))
+    classes.add(`text`)
+
+  return [...classes]
+}
+
+function lineNumbers(values) {
+  return values.map(value => value + 1)
+}
+
+/**
+ * Pair removed and added lines inside a hunk by element name first, then by
+ * position. Plain index pairing misattributes classes whenever one side has an
+ * extra element (an inserted `<svg>` shifts every following pair).
+ */
+function pairLines(removed, added) {
+  const used = new Set()
+  const pairs = []
+  const tagOf = line => parseAttributes(line)?.tag ?? null
+  for (const line of removed) {
+    const tag = tagOf(line)
+    const match = added.findIndex((candidate, index) => !used.has(index) && tagOf(candidate) === tag)
+    if (match >= 0) {
+      used.add(match)
+      pairs.push([line, added[match]])
+    }
+    else {
+      pairs.push([line, undefined])
+    }
+  }
+  added.forEach((line, index) => {
+    if (!used.has(index))
+      pairs.push([undefined, line])
+  })
+  return pairs
+}
+
+function summarize(hunks, aLines, bLines) {
+  const classes = new Map()
+  for (const hunk of hunks) {
+    const removed = hunk.ops.filter(op => op.type === `delete`).map(op => aLines[op.aIndex])
+    const added = hunk.ops.filter(op => op.type === `insert`).map(op => bLines[op.bIndex])
+    const hunkClasses = new Set()
+    for (const [before, after] of pairLines(removed, added))
+      for (const name of classifyLinePair(before, after))
+        hunkClasses.add(name)
+    if (hunkClasses.size === 0)
+      hunkClasses.add(`unclassified`)
+
+    const location = hunk.ops[0].aIndex ?? hunk.ops[0].bIndex
+    hunk.classes = [...hunkClasses].sort()
+    for (const name of hunk.classes) {
+      if (!classes.has(name))
+        classes.set(name, [])
+      classes.get(name).push(location + 1)
+    }
+  }
+  return classes
+}
+
+function formatUnifiedDiff(hunks, ops, aLines, bLines) {
+  const lines = []
+  for (const hunk of hunks) {
+    // Attach leading/trailing context for a standard unified view.
+    const start = Math.max(0, hunk.startIndex - CONTEXT_LINES)
+    const end = Math.min(ops.length - 1, hunk.endIndex + CONTEXT_LINES)
+    const slice = ops.slice(start, end + 1)
+
+    const aStart = slice.find(op => op.aIndex !== undefined)?.aIndex ?? 0
+    const bStart = slice.find(op => op.bIndex !== undefined)?.bIndex ?? 0
+    const aCount = slice.filter(op => op.type !== `insert`).length
+    const bCount = slice.filter(op => op.type !== `delete`).length
+    const header = `@@ -${aStart + 1},${aCount} +${bStart + 1},${bCount} @@ [${hunk.classes.join(`, `)}]`
+
+    const body = slice.map((op) => {
+      if (op.type === `equal`)
+        return ` ${aLines[op.aIndex]}`
+      if (op.type === `delete`)
+        return `-${aLines[op.aIndex]}`
+      return `+${bLines[op.bIndex]}`
+    })
+    lines.push(header, ...body)
+  }
+  return lines.join(`\n`)
+}
+
+/**
+ * Compare two outputs byte for byte.
+ *
+ * @returns {{equal: boolean, hunkCount: number, classes: Array<{name: string, locations: number[]}>, unifiedDiff: string, firstDifference: number}}
+ */
+export function compareOutputs(oracleHtml, cliHtml) {
+  if (oracleHtml === cliHtml) {
+    return { equal: true, hunkCount: 0, classes: [], unifiedDiff: ``, firstDifference: -1 }
+  }
+
+  const aLines = explodeHtml(oracleHtml)
+  const bLines = explodeHtml(cliHtml)
+  const ops = diffSequences(aLines, bLines)
+  const hunks = groupHunks(ops)
+  const classMap = summarize(hunks, aLines, bLines)
+
+  const classes = [...classMap.entries()]
+    .map(([name, locations]) => ({ name, locations: lineNumbers(locations) }))
+    .sort((a, b) => b.locations.length - a.locations.length || a.name.localeCompare(b.name))
+
+  // Byte offset of the first character that differs, for a one-line pointer
+  // when a caller only needs to know where the outputs part ways.
+  let firstDifference = 0
+  while (firstDifference < oracleHtml.length && oracleHtml[firstDifference] === cliHtml[firstDifference])
+    firstDifference += 1
+
+  return {
+    equal: false,
+    hunkCount: hunks.length,
+    classes,
+    unifiedDiff: formatUnifiedDiff(hunks, ops, aLines, bLines),
+    firstDifference,
+  }
+}
diff --git a/scripts/verify/config.mjs b/scripts/verify/config.mjs
new file mode 100644
index 0000000000..dcf0c84d9a
--- /dev/null
+++ b/scripts/verify/config.mjs
@@ -0,0 +1,182 @@
+/**
+ * Designer config support for the verify gate.
+ *
+ * The same projected configuration must reach both sides, or a config-driven
+ * difference would masquerade as an implementation difference. Projection keeps
+ * only render-affecting keys: article content and pure-UI state are dropped
+ * before either side sees the config, so an exported config can never make the
+ * gate compare an article instead of the fixture.
+ *
+ * The five style keys a Designer export cannot carry (lineHeight, blockSpacing,
+ * linkColor, blockquoteBackground, headingStyles) are deliberately left out:
+ * each side falls back to its own site defaults, and a unit test guards that
+ * those defaults agree.
+ */
+
+const RENDER_KEYS = [
+  `theme`,
+  `primaryColor`,
+  `fontFamily`,
+  `fontSize`,
+  `isUseIndent`,
+  `isUseJustify`,
+  `legend`,
+  `isCiteStatus`,
+  `isCountStatus`,
+  `isMacCodeBlock`,
+  `isShowLineNumber`,
+  `codeBlockTheme`,
+  `cssContentConfig`,
+]
+
+const CONTENT_KEYS = [`posts`, `currentPostId`, `currentPostIndex`, `titleList`, `readingTime`]
+
+const UI_KEYS = [
+  `isDark`,
+  `isOpenRightSlider`,
+  `isOpenPostSlider`,
+  `showAIToolbox`,
+  `isShowCssEditor`,
+  `isShowTableEditDialog`,
+  `isShowUploadImgDialog`,
+  `aiDialogVisible`,
+  `aiImageDialogVisible`,
+]
+
+const SUPPORTED_THEMES = [`default`, `grace`, `simple`]
+
+/** Per-theme style keys the Designer export carries inside `themeSettings`. */
+const PER_THEME_KEYS = [
+  `primaryColor`,
+  `fontFamily`,
+  `fontSize`,
+  `codeBlockTheme`,
+  `isShowLineNumber`,
+  `isMacCodeBlock`,
+]
+
+class ConfigError extends Error {}
+
+/**
+ * Project a parsed Designer export down to render-affecting keys.
+ *
+ * Unknown keys are dropped rather than forwarded: the browser's import path
+ * would apply a key it knows and the CLI would ignore it, which is exactly how
+ * one side would silently see a different configuration.
+ */
+export function projectDesignerConfig(raw) {
+  if (typeof raw !== `object` || raw === null || Array.isArray(raw))
+    throw new ConfigError(`config must be a JSON object`)
+
+  const projected = {}
+  const dropped = { content: [], ui: [], unknown: [] }
+  for (const key of Object.keys(raw)) {
+    if (RENDER_KEYS.includes(key))
+      projected[key] = raw[key]
+    else if (CONTENT_KEYS.includes(key))
+      dropped.content.push(key)
+    else if (UI_KEYS.includes(key))
+      dropped.ui.push(key)
+    else
+      dropped.unknown.push(key)
+  }
+
+  if (typeof projected.theme === `string` && !SUPPORTED_THEMES.includes(projected.theme)) {
+    throw new ConfigError(
+      `theme "${projected.theme}" is not available to both sides `
+      + `(supported: ${SUPPORTED_THEMES.join(`, `)}). A marketplace theme is not installed in the `
+      + `browser and is not known to the CLI, so the two would silently default differently.`,
+    )
+  }
+
+  return { projected, dropped }
+}
+
+function setEntry(entries, key, value, encoding) {
+  entries.push({ key, value, encoding })
+}
+
+/**
+ * Build the init script that seeds the projected config into the app's own
+ * storage before boot.
+ *
+ * The app migrates every `localStorage` key into IndexedDB on first launch and
+ * serves it synchronously to the Pinia stores, so one navigation with a seeded
+ * localStorage is enough. Every write stays inside the temporary browser
+ * profile; nothing touches the repository.
+ */
+export function buildConfigSeedScript(projected) {
+  const entries = []
+  if (typeof projected.theme === `string`)
+    setEntry(entries, `MD__theme`, projected.theme, `raw`)
+
+  const themeSettings = {}
+  for (const key of PER_THEME_KEYS) {
+    if (projected[key] !== undefined)
+      themeSettings[key] = projected[key]
+  }
+  if (Object.keys(themeSettings).length > 0) {
+    setEntry(entries, `MD__themeSettings`, {
+      [projected.theme ?? `default`]: themeSettings,
+    }, `json`)
+  }
+
+  if (projected.isCiteStatus !== undefined)
+    setEntry(entries, `isCiteStatus`, projected.isCiteStatus, `json`)
+  if (projected.isCountStatus !== undefined)
+    setEntry(entries, `isCountStatus`, projected.isCountStatus, `json`)
+  if (typeof projected.legend === `string`)
+    setEntry(entries, `legend`, projected.legend, `raw`)
+  if (projected.isUseIndent !== undefined)
+    setEntry(entries, `MD__use_indent`, projected.isUseIndent, `json`)
+  if (projected.isUseJustify !== undefined)
+    setEntry(entries, `MD__use_justify`, projected.isUseJustify, `json`)
+  if (projected.cssContentConfig !== undefined)
+    setEntry(entries, `MD__css_content_config`, projected.cssContentConfig, `json`)
+
+  const payload = JSON.stringify(entries)
+  return `(() => {
+  const entries = ${payload}
+  try {
+    for (const entry of entries)
+      localStorage.setItem(entry.key, entry.encoding === 'json' ? JSON.stringify(entry.value) : String(entry.value))
+  } catch {}
+})()`
+}
+
+/**
+ * Assert the seed actually took effect before the fixture is injected.
+ *
+ * An untrusted seed that silently no-ops would compare two site-default renders
+ * and pass — the worst possible failure for a gate, so it is checked instead of
+ * assumed.
+ */
+export async function assertConfigApplied(page, projected) {
+  if (typeof projected.primaryColor === `string`) {
+    const applied = await page.evaluate(() => {
+      const theme = document.getElementById(`md-theme`)
+      return theme ? theme.textContent : ``
+    })
+    if (!applied.includes(`--md-primary-color: ${projected.primaryColor}`)) {
+      throw new ConfigError(
+        `config did not reach the app: expected --md-primary-color: ${projected.primaryColor} in #md-theme, `
+        + `found ${applied.includes(`--md-primary-color`) ? `a different value` : `no variable`}. `
+        + `Refusing to compare two site-default renders.`,
+      )
+    }
+  }
+
+  if (typeof projected.codeBlockTheme === `string`) {
+    const href = await page.evaluate(() => {
+      const link = document.getElementById(`hljs`)
+      return link ? link.getAttribute(`href`) : null
+    })
+    if (href !== projected.codeBlockTheme) {
+      throw new ConfigError(
+        `config did not reach the app: expected the #hljs stylesheet to be ${projected.codeBlockTheme}, got ${href}.`,
+      )
+    }
+  }
+}
+
+export { ConfigError }
diff --git a/scripts/verify/oracle.mjs b/scripts/verify/oracle.mjs
new file mode 100644
index 0000000000..a73e4d2ce7
--- /dev/null
+++ b/scripts/verify/oracle.mjs
@@ -0,0 +1,320 @@
+/**
+ * Oracle capability: browser-rendered ground truth for the md-web-cli gate.
+ *
+ * Serves the built web application, drives Chromium through the app's real
+ * WeChat copy pipeline, and returns the captured clipboard HTML. This is a
+ * capability, not an artifact: every write is confined to a caller-supplied
+ * directory outside the repository, and repeated runs against the same build
+ * return byte-identical HTML.
+ *
+ * The capability builds nothing. The caller must have built the app first;
+ * a missing build fails loudly instead of producing partial output.
+ */
+
+import { createReadStream, existsSync, statSync } from 'node:fs'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { createServer } from 'node:http'
+import { extname, join, normalize, resolve } from 'node:path'
+import process from 'node:process'
+import { chromium } from 'playwright'
+import { assertOutsideRepository, REPO_ROOT } from './paths.mjs'
+
+const WEB_DIST = resolve(REPO_ROOT, `apps/web/dist`)
+const BUILD_COMMAND = `pnpm --filter @md/web build:only`
+
+const NAV_TIMEOUT_MS = 60_000
+const PREVIEW_TIMEOUT_MS = 60_000
+const COPY_TIMEOUT_MS = 30_000
+const STABILITY_POLLS = 6
+const POLL_INTERVAL_MS = 250
+
+const MIME = {
+  '.html': `text/html; charset=utf-8`,
+  '.js': `text/javascript; charset=utf-8`,
+  '.mjs': `text/javascript; charset=utf-8`,
+  '.css': `text/css; charset=utf-8`,
+  '.json': `application/json`,
+  '.png': `image/png`,
+  '.jpg': `image/jpeg`,
+  '.jpeg': `image/jpeg`,
+  '.gif': `image/gif`,
+  '.svg': `image/svg+xml`,
+  '.ico': `image/x-icon`,
+  '.woff': `font/woff`,
+  '.woff2': `font/woff2`,
+  '.ttf': `font/ttf`,
+  '.map': `application/json`,
+  '.txt': `text/plain; charset=utf-8`,
+}
+
+function assertBuilt(distDir) {
+  const indexPath = join(distDir, `index.html`)
+  if (!existsSync(indexPath)) {
+    throw new Error(
+      `The web application has not been built (missing ${indexPath}). `
+      + `Build it first: \`${BUILD_COMMAND}\`. The Oracle capability builds nothing itself.`,
+    )
+  }
+}
+
+function startStaticServer(rootDir) {
+  return new Promise((resolvePromise, reject) => {
+    const server = createServer((req, res) => {
+      try {
+        const urlPath = decodeURIComponent(new URL(req.url, `http://localhost`).pathname)
+        // The build uses base `/md/`; strip the prefix before resolving.
+        const relative = urlPath.replace(/^\/md\/?/, ``) || `index.html`
+        const filePath = normalize(join(rootDir, relative))
+        if (!filePath.startsWith(rootDir)) {
+          res.writeHead(403)
+          res.end(`forbidden`)
+          return
+        }
+        const target = existsSync(filePath) && statSync(filePath).isFile()
+          ? filePath
+          : join(rootDir, `index.html`) // SPA fallback
+        if (!existsSync(target)) {
+          res.writeHead(404)
+          res.end(`not found: ${urlPath}`)
+          return
+        }
+        res.writeHead(200, { 'content-type': MIME[extname(target)] ?? `application/octet-stream` })
+        createReadStream(target).pipe(res)
+      }
+      catch (error) {
+        res.writeHead(500)
+        res.end(`server error: ${error.message}`)
+      }
+    })
+    server.on(`error`, reject)
+    // Port 0 asks the OS for a free port: concurrent captures never collide.
+    server.listen(0, `127.0.0.1`, () => resolvePromise(server))
+  })
+}
+
+function launchOptions() {
+  const executablePath = process.env.MD_WEB_CLI_CHROMIUM
+  return {
+    headless: true,
+    args: [`--headless=new`, `--disable-web-security`, `--allow-file-access-from-files`],
+    ...(executablePath ? { executablePath } : {}),
+  }
+}
+
+async function readPreviewState(page) {
+  return page.evaluate(() => {
+    // Cheap rolling hash, in-page: text identity without shipping the text out.
+    const hashText = (value) => {
+      let hash = 0
+      for (let index = 0; index < value.length; index++)
+        hash = (hash * 31 + value.charCodeAt(index)) | 0
+      return hash
+    }
+    const output = document.getElementById(`output`)
+    if (!output)
+      return null
+    return {
+      length: output.innerHTML.length,
+      // The signature has to change when only the text changes: a custom
+      // fixture could otherwise render with the same element counts as the
+      // app's default document and never look "ready".
+      signature: [
+        output.innerHTML.length,
+        output.querySelectorAll(`h1, h2, h3, h4, h5, h6`).length,
+        output.querySelectorAll(`table`).length,
+        output.querySelectorAll(`section`).length,
+        output.querySelectorAll(`pre`).length,
+        output.querySelectorAll(`p`).length,
+        hashText(output.textContent ?? ``),
+      ].join(`|`),
+      text: output.textContent ?? ``,
+      pendingDiagram: !!output.querySelector(`[data-md-diagram-state="loading"]`),
+      pendingMath: !!output.querySelector(`.katex-pending`),
+      pendingLanguage: !!output.querySelector(`[data-language-pending]`),
+    }
+  })
+}
+
+/**
+ * Wait until the preview reflects the injected fixture and stops changing.
+ *
+ * Fixture-agnostic on purpose: a minimal probe fixture and the full-coverage
+ * fixture must both satisfy the same readiness rules, so readiness cannot key
+ * off "the full fixture's table exists". The rules are: the preview changed
+ * after injection, holds no pending async placeholders, and its structural
+ * signature is stable across several polls.
+ */
+async function waitForStablePreview(page, beforeSignature) {
+  await page.waitForSelector(`#output`, { timeout: NAV_TIMEOUT_MS })
+
+  const deadline = Date.now() + PREVIEW_TIMEOUT_MS
+  let previousSignature = ``
+  let stableCount = 0
+
+  while (Date.now() < deadline) {
+    const state = await readPreviewState(page)
+    const ready = state
+      && state.text.trim().length > 0
+      && state.signature !== beforeSignature
+      && !state.pendingDiagram
+      && !state.pendingMath
+      && !state.pendingLanguage
+    if (ready) {
+      if (state.signature === previousSignature) {
+        stableCount += 1
+        if (stableCount >= STABILITY_POLLS)
+          return state
+      }
+      else {
+        stableCount = 0
+        previousSignature = state.signature
+      }
+    }
+    else {
+      stableCount = 0
+    }
+    await new Promise(r => setTimeout(r, POLL_INTERVAL_MS))
+  }
+
+  throw new Error(`preview did not stabilize within ${PREVIEW_TIMEOUT_MS / 1000}s`)
+}
+
+/**
+ * Capture the browser Oracle for one fixture.
+ *
+ * @param {object} options
+ * @param {string} options.fixturePath Markdown fixture to inject.
+ * @param {string} options.outDir Fresh directory outside the repository; the
+ *   captured HTML is written here as `oracle.html`.
+ * @param {string} [options.distDir] Built web app directory (testing seam).
+ * @param {Array<string|{content: string}>} [options.initScripts] Scripts run
+ *   before app boot, e.g. to seed a projected config into localStorage.
+ * @param {(page: import('playwright').Page) => Promise<void>} [options.afterLoad]
+ *   Runs once the app shell is up and before the fixture is injected.
+ * @returns {Promise<string>} The captured clipboard HTML (byte-exact).
+ */
+export async function captureOracle(options) {
+  const {
+    fixturePath,
+    outDir,
+    distDir = WEB_DIST,
+    initScripts = [],
+    afterLoad,
+  } = options
+
+  const safeOutDir = assertOutsideRepository(outDir, `Oracle output directory`)
+  assertBuilt(distDir)
+  if (!existsSync(fixturePath))
+    throw new Error(`fixture not found: ${fixturePath}`)
+
+  const fixture = await readFile(fixturePath, `utf8`)
+  await mkdir(safeOutDir, { recursive: true })
+
+  const server = await startStaticServer(distDir)
+  const port = server.address().port
+  const pageUrl = `http://127.0.0.1:${port}/md/`
+
+  let browser
+  try {
+    browser = await chromium.launch(launchOptions())
+    const context = await browser.newContext({
+      viewport: { width: 1400, height: 1000 },
+      permissions: [`clipboard-read`, `clipboard-write`],
+      locale: `zh-CN`,
+      baseURL: `http://127.0.0.1:${port}`,
+    })
+
+    // The copy flow forces a light render anyway; pinning the UI theme keeps
+    // the capture independent of the machine's colour-scheme preference.
+    await context.addInitScript(() => {
+      try {
+        localStorage.setItem(`vueuse-color-scheme`, `light`)
+      }
+      catch {}
+    })
+    for (const script of initScripts) {
+      if (typeof script === `string`)
+        await context.addInitScript({ content: script })
+      else
+        await context.addInitScript(script)
+    }
+
+    const page = await context.newPage()
+    page.setDefaultTimeout(NAV_TIMEOUT_MS)
+
+    const pageErrors = []
+    page.on(`pageerror`, (error) => {
+      pageErrors.push(String(error))
+    })
+
+    await page.goto(pageUrl, { waitUntil: `domcontentloaded` })
+    await page.waitForSelector(`.cm-editor`, { timeout: NAV_TIMEOUT_MS })
+    await page.waitForSelector(`#output`, { timeout: NAV_TIMEOUT_MS })
+
+    // Settle the default document before reading the baseline signature.
+    await page.waitForFunction(() => {
+      const output = document.getElementById(`output`)
+      return output && output.textContent.length > 0
+    }, { timeout: NAV_TIMEOUT_MS })
+    const before = await readPreviewState(page)
+
+    if (afterLoad)
+      await afterLoad(page)
+
+    // Inject through the app's own input handling: CodeMirror ignores
+    // synthetic DOM selections, so focus for real and replace the document
+    // with keyboard select-all + insertText. The app's debounced listeners
+    // then refresh the preview and persist the post as if typed.
+    await page.click(`.cm-content`)
+    await page.keyboard.press(`ControlOrMeta+A`)
+    await page.keyboard.insertText(fixture)
+
+    await waitForStablePreview(page, before.signature)
+
+    // Trigger the real WeChat copy flow through the header's copy button.
+    const copyButton = page.locator(`header button:has-text("复制"), .header-container button:has-text("复制")`).first()
+    if (await copyButton.count() === 0)
+      throw new Error(`WeChat copy button not found in header — has the header markup changed?`)
+    await copyButton.click()
+
+    // The clipboard is the app's own completion signal: the copy flow writes
+    // `text/html` when it finishes, so poll it instead of sleeping past the
+    // button's spinner. A fresh browser context starts with an empty clipboard.
+    const clipboardDeadline = Date.now() + COPY_TIMEOUT_MS
+    let clipboardHtml = ``
+    while (Date.now() < clipboardDeadline) {
+      clipboardHtml = await page.evaluate(async () => {
+        const items = await navigator.clipboard.read()
+        for (const item of items) {
+          if (item.types.includes(`text/html`)) {
+            const blob = await item.getType(`text/html`)
+            return await blob.text()
+          }
+        }
+        return ``
+      })
+      if (clipboardHtml)
+        break
+      await new Promise(r => setTimeout(r, 100))
+    }
+
+    if (!clipboardHtml) {
+      throw new Error(
+        `clipboard text/html is still empty after ${COPY_TIMEOUT_MS / 1000}s — the copy flow did not produce output`,
+      )
+    }
+
+    if (pageErrors.length > 0)
+      process.stderr.write(`[oracle] warning: ${pageErrors.length} page error(s): ${pageErrors[0]}\n`)
+
+    // The raw clipboard payload: no provenance comment, no wrapper, nothing
+    // added. Any extra byte here would make the byte comparison lie.
+    await writeFile(join(safeOutDir, `oracle.html`), clipboardHtml, `utf8`)
+    return clipboardHtml
+  }
+  finally {
+    if (browser)
+      await browser.close().catch(() => {})
+    server.close()
+  }
+}
diff --git a/scripts/verify/paths.mjs b/scripts/verify/paths.mjs
new file mode 100644
index 0000000000..f6ff84725d
--- /dev/null
+++ b/scripts/verify/paths.mjs
@@ -0,0 +1,30 @@
+/**
+ * Repository path guard shared by the verify gate and the Oracle capability.
+ *
+ * The Oracle is a runtime capability, never a committed artifact: anything it
+ * produces, and anything the gate preserves for debugging, has to live outside
+ * the repository so no regenerable output can be committed by accident.
+ */
+
+import { dirname, resolve, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+
+export const REPO_ROOT = resolve(HERE, `../..`)
+
+export function isInsideRepository(dir) {
+  const resolved = resolve(dir)
+  return resolved === REPO_ROOT || resolved.startsWith(`${REPO_ROOT}${sep}`)
+}
+
+export function assertOutsideRepository(dir, what = `output directory`) {
+  const resolved = resolve(dir)
+  if (isInsideRepository(resolved)) {
+    throw new Error(
+      `${what} must be outside the repository (received ${resolved}). `
+      + `Rendered output is regenerable, so it is never written into the tree; pass a temp directory.`,
+    )
+  }
+  return resolved
+}
diff --git a/scripts/verify/self-test.mjs b/scripts/verify/self-test.mjs
new file mode 100644
index 0000000000..6c8fc875dc
--- /dev/null
+++ b/scripts/verify/self-test.mjs
@@ -0,0 +1,79 @@
+/**
+ * Reverse-case self-test: proof that the gate can fail.
+ *
+ * A gate that never fails is indistinguishable from a broken gate, so this mode
+ * corrupts a known-good render several distinct ways and asserts that each
+ * mutant is rejected. It needs no browser: the known-good render comes from the
+ * CLI bundle.
+ */
+
+import { compareOutputs } from './compare.mjs'
+import { findStructuralProblems } from './structural.mjs'
+
+const CASES = [
+  {
+    name: `injected diagram placeholder`,
+    expectKind: `pending-diagram`,
+    mutate: html => html.replace(`<section`, `<div data-md-diagram-state="loading"></div><section`),
+  },
+  {
+    name: `injected formula placeholder`,
+    expectKind: `pending-katex`,
+    mutate: html => html.replace(`<section`, `<section><span class="katex-pending">x</span>`),
+  },
+  {
+    name: `injected unregistered-language marker`,
+    expectKind: `pending-language`,
+    mutate: html => html.replace(`<section`, `<section><code data-language-pending="rust">fn</code>`),
+  },
+  {
+    name: `stripped inline styles`,
+    expectKind: `unstyled-block`,
+    mutate: html => html.replace(/\sstyle\s*=\s*(["'])[\s\S]*?\1/gi, ``),
+  },
+  {
+    name: `injected class attribute`,
+    expectKind: `class-attribute`,
+    mutate: html => html.replace(/<p\b/, `<p class="leaked"`),
+  },
+  {
+    name: `injected style block`,
+    expectKind: `style-tag`,
+    mutate: html => `<style>p { color: red }</style>${html}`,
+  },
+  {
+    name: `truncated artifact`,
+    expectKind: null,
+    mutate: html => html.slice(0, Math.floor(html.length / 2)),
+  },
+]
+
+/**
+ * @param {string} knownGoodHtml A CLI render that already passes the structural
+ *   assertions.
+ * @returns {{baselineProblems: Array, positiveControl: boolean, cases: Array<{name: string, rejected: boolean, expectedKind: string|null, matchedKinds: string[], expectedKindFound: boolean, firstReason: string}>}}
+ */
+export function runSelfTest(knownGoodHtml) {
+  const baselineProblems = findStructuralProblems(knownGoodHtml)
+  // Positive control: a comparator that always reports a difference would make
+  // every reverse case "pass" for the wrong reason.
+  const positiveControl = compareOutputs(knownGoodHtml, knownGoodHtml).equal
+
+  const cases = CASES.map((testCase) => {
+    const mutant = testCase.mutate(knownGoodHtml)
+    const problems = findStructuralProblems(mutant)
+    const matchedKinds = problems.map(problem => problem.kind)
+    const comparison = compareOutputs(knownGoodHtml, mutant)
+    const expectedKindFound = testCase.expectKind === null || matchedKinds.includes(testCase.expectKind)
+    return {
+      name: testCase.name,
+      expectedKind: testCase.expectKind,
+      matchedKinds,
+      rejected: !comparison.equal && expectedKindFound,
+      expectedKindFound,
+      firstReason: problems[0]?.detail ?? `byte comparison rejected the mutant`,
+    }
+  })
+
+  return { baselineProblems, positiveControl, cases }
+}
diff --git a/scripts/verify/structural.mjs b/scripts/verify/structural.mjs
new file mode 100644
index 0000000000..93aa2bd172
--- /dev/null
+++ b/scripts/verify/structural.mjs
@@ -0,0 +1,93 @@
+/**
+ * Non-browser assertions the gate owns.
+ *
+ * These are the invariants the retired verifier enforced, kept alive so they do
+ * not die with the script that used to host them: the CLI's output must carry no
+ * pending async placeholders, and it must be WeChat-ready (no style block, no
+ * class attributes, inline styles on block-level elements).
+ *
+ * They run against the CLI output only. The browser's clipboard HTML is
+ * pre-paste and legitimately keeps class attributes; WeChat strips them at paste
+ * time. Asserting WeChat readiness on that side would be asserting the wrong
+ * artefact's contract.
+ */
+
+/** Elements WeChat formats structurally; they legitimately carry no style attr. */
+const STYLE_EXEMPT = new Set([`tr`, `tbody`, `thead`, `svg`])
+
+const BLOCK_TAGS = new Set([
+  `section`,
+  `p`,
+  `h1`,
+  `h2`,
+  `h3`,
+  `h4`,
+  `h5`,
+  `h6`,
+  `blockquote`,
+  `table`,
+  `pre`,
+  `ul`,
+  `ol`,
+  `li`,
+  `td`,
+  `th`,
+  `figure`,
+  `figcaption`,
+  `hr`,
+  `div`,
+  `details`,
+  `summary`,
+])
+
+/**
+ * Scan for pending-async markers.
+ *
+ * Leading style blocks are stripped first so a legitimate CSS selector such as
+ * `.katex-pending` never reads as pending content.
+ */
+export function findPendingPlaceholders(html) {
+  const body = html.replace(/<style[\s\S]*?<\/style>/gi, ``)
+  const found = []
+  if (/<div[^>]*data-md-diagram-state="loading"/.test(body))
+    found.push({ kind: `pending-diagram`, detail: `async diagram placeholder (data-md-diagram-state="loading")` })
+  if (/<[^>]*\bkatex-pending\b/.test(body))
+    found.push({ kind: `pending-katex`, detail: `KaTeX formula placeholder (.katex-pending)` })
+  for (const match of body.matchAll(/data-language-pending="([^"]*)"/g))
+    found.push({ kind: `pending-language`, detail: `unregistered code language placeholder (${match[1]})` })
+  return found
+}
+
+/**
+ * Scan for output that is not WeChat-ready.
+ *
+ * The exemptions are a documented product rule, not a convenience: WeChat
+ * formats table sections, rows, and SVG structurally, so demanding an inline
+ * style on them would report a difference that does not exist. The full
+ * fixture contains tables, so the baseline render in the self-test fails if
+ * these stop being honoured.
+ */
+export function findInlineStyleProblems(html) {
+  const problems = []
+  if (/<style[\s>]/i.test(html))
+    problems.push({ kind: `style-tag`, detail: `document contains a <style> block` })
+
+  const classCount = (html.match(/\sclass\s*=\s*(["'])/gi) ?? []).length
+  if (classCount > 0)
+    problems.push({ kind: `class-attribute`, detail: `document contains ${classCount} class attribute(s)` })
+
+  for (const match of html.matchAll(/<([a-z][\w-]*)\b([^>]*)>/gi)) {
+    const tag = match[1].toLowerCase()
+    const attrs = match[2] ?? ``
+    if (!BLOCK_TAGS.has(tag) || STYLE_EXEMPT.has(tag))
+      continue
+    if (!/\sstyle\s*=/i.test(attrs))
+      problems.push({ kind: `unstyled-block`, detail: `<${tag}> block element without a style attribute` })
+  }
+  return problems
+}
+
+/** All non-browser problems for one rendered artifact. */
+export function findStructuralProblems(html) {
+  return [...findPendingPlaceholders(html), ...findInlineStyleProblems(html)]
+}