diff --git a/.gitea/workflows/checker-check.yml b/.gitea/workflows/checker-check.yml
new file mode 100644
index 0000000..a6ce325
--- /dev/null
+++ b/.gitea/workflows/checker-check.yml
@@ -0,0 +1,53 @@
+name: checker check
+
+# Builds and lints the Rust implementation crates under crates/ (the rule-based
+# checker that "stands in Lean's position" at product runtime).
+#
+# Like spec-check, this is an INTERNAL gate on the implementation's own health
+# (does it build, pass its tests, satisfy clippy + rustfmt?). It is NOT a
+# spec-to-implementation conformance gate — implementations align to the Lean
+# contract by human review, not by CI. See the repo README.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  checker-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Rust toolchain (stable + clippy + rustfmt)
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - name: Cache cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      # Fonts for typst compilation (WU-4 onward): the engineering files are
+      # CJK-heavy, so the compile-check / build tests need a CJK font present.
+      # Harmless before those crates exist.
+      - name: Install CJK fonts
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y fonts-noto-cjk
+
+      - name: Format check
+        run: cargo fmt --all --check
+
+      - name: Clippy (deny warnings)
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Test
+        run: cargo test --all-features --workspace
diff --git a/.gitea/workflows/spec-check.yml b/.gitea/workflows/spec-check.yml
new file mode 100644
index 0000000..8e862dc
--- /dev/null
+++ b/.gitea/workflows/spec-check.yml
@@ -0,0 +1,20 @@
+name: spec check
+
+# Builds the Lean semantic master spec under spec/.
+# This is an INTERNAL well-formedness gate (does the contract type-check?),
+# NOT a spec-to-implementation conformance gate — implementations align to the
+# contract by human review, not by CI. See repo README.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  spec-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: leanprover/lean-action@v1
+        with:
+          lake-package-directory: spec
diff --git a/.gitignore b/.gitignore
index 3bdd52e..a28e9e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,15 @@
-node_modules/
-dist/
+# Lean / Lake build artifacts (spec/ has its own .gitignore too)
+.lake/
+**/.lake/
+
+# Rust / Cargo build artifacts (repo-wide cargo workspace at root)
+/target
+**/*.pdf
+.cph/
+
+# Test-only @local package resolution convenience (self-referential symlink);
+# regenerable, not for VCS. The embedded engine mounts cph-render directly.
+render/vendor/local-packages/
+
+# OS / editor
 .DS_Store
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..a076d38
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,20 @@
+# CLAUDE.md —— agent 操作手册(全 repo)
+
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+
+## 这个 repo 是什么
+
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
+
+## 纪律
+
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
+
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
+
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
+
+5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..5ef80d4
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3291 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys",
+]
+
+[[package]]
+name = "approx"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab112f0a86d568ea0e627cc1d6be74a1e9cd55214684db5561995f6dad897c6"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ar_archive_writer"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4087686b4b0a3427190bae57a1d9a478dbb2d40c5dc1bd6e2b6d797913bdd348"
+dependencies = [
+ "object",
+]
+
+[[package]]
+name = "arrayref"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02882884d3e1bc524fb12c79f107f6ad0e1cfd498c536ffb494301740995dfe"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "az"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be5eb007b7cacc6c660343e96f650fedf4b5a77512399eb952ca6642cf8d13f7"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "biblatex"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "591eba69b7c085632e22ca03606f0bbea68d53bbe26c8962e2d549af20c6a561"
+dependencies = [
+ "paste",
+ "roman-numerals-rs",
+ "strum",
+ "unic-langid",
+ "unicode-normalization",
+ "unscanny",
+]
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "by_address"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9abbd1bc6865053c427f7198e6af43bfdedc55ab791faed4fbd361d789575ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
+[[package]]
+name = "cc"
+version = "1.2.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chinese-number"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e964125508474a83c95eb935697abbeb446ff4e9d62c71ce880e3986d1c606b"
+dependencies = [
+ "chinese-variant",
+ "enum-ordinalize",
+ "num-bigint",
+ "num-traits",
+]
+
+[[package]]
+name = "chinese-variant"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58b52a9840ffff5d4d0058ae529fa066a75e794e3125546acfc61c23ad755e49"
+
+[[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
+name = "citationberg"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756ff1e3d43a9ecc8183932fb4d9fd3971236f3ce4acb62fe51d1cd43297547d"
+dependencies = [
+ "quick-xml 0.38.4",
+ "serde",
+ "serde_path_to_error",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "codex"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0732ab1a27b4ea05e6f9f60a5122c9924dd5123defde0d8e907f58cf643d40e6"
+dependencies = [
+ "chinese-number",
+]
+
+[[package]]
+name = "color"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ec7c5eb7a16992b1904d76c517d170ab353b0e0b3d5a0c81a8a0cd1037893cf"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "color_quant"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "comemo"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c963350b2b08aa4b725d7802593245380ab53dacfedcaa971385fc33306c0d4"
+dependencies = [
+ "comemo-macros",
+ "parking_lot",
+ "rustc-hash",
+ "siphasher",
+ "slab",
+]
+
+[[package]]
+name = "comemo-macros"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3c400139ba1389ef9e20ad2d87cda68b437a66483aa0da616bdf2cea7413853"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "core_maths"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "cph-check"
+version = "0.1.0"
+dependencies = [
+ "cph-diag",
+ "cph-model",
+ "cph-schema",
+ "cph-typst",
+]
+
+[[package]]
+name = "cph-cli"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "cph-check",
+ "cph-diag",
+ "cph-typst",
+]
+
+[[package]]
+name = "cph-diag"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cph-model"
+version = "0.1.0"
+dependencies = [
+ "cph-diag",
+ "serde",
+ "toml",
+]
+
+[[package]]
+name = "cph-schema"
+version = "0.1.0"
+dependencies = [
+ "cph-diag",
+ "cph-model",
+ "serde_json",
+ "toml",
+]
+
+[[package]]
+name = "cph-typst"
+version = "0.1.0"
+dependencies = [
+ "cph-diag",
+ "cph-model",
+ "cph-schema",
+ "dirs",
+ "include_dir",
+ "tempfile",
+ "toml",
+ "typst",
+ "typst-kit",
+ "typst-layout",
+ "typst-library",
+ "typst-pdf",
+ "typst-syntax",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "csv"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde_core",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "data-url"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "ecow"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78e4f79b296fbaab6ce2e22d52cb4c7f010fe0ebe7a32e34fa25885fd797bd02"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "either"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+
+[[package]]
+name = "enum-ordinalize"
+version = "4.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a1091a7bb1f8f2c4b28f1fe2cef4980ca2d410a3d727d67ecc3178c9b0800f0"
+dependencies = [
+ "enum-ordinalize-derive",
+]
+
+[[package]]
+name = "enum-ordinalize-derive"
+version = "4.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca9601fb2d62598ee17836250842873a413586e5d7ed88b356e38ddbb0ec631"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "euclid"
+version = "0.22.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fancy-regex"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "998b056554fbe42e03ae0e152895cd1a7e1002aec800fdc6635d20270260c46f"
+dependencies = [
+ "bit-set",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "fast-srgb8"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd2e7510819d6fbf51a5545c8f922716ecfb14df168a3242f7d33e0239efe6a1"
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "fearless_simd"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "font-types"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b38ad915f6dadd993ced50848a8291a543bd41ca62bc10740d5e64e2ab4cfd7"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "fontconfig-parser"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc773e24e02d4ddd8395fd30dc147524273a83e54e0f312d986ea30de5f5646"
+dependencies = [
+ "roxmltree 0.20.0",
+]
+
+[[package]]
+name = "fontdb"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "457e789b3d1202543297a350643cf459f836cade38934e7a4cf6a39e7cde2905"
+dependencies = [
+ "fontconfig-parser",
+ "log",
+ "memmap2",
+ "slotmap",
+ "tinyvec",
+ "ttf-parser",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "gif"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee8cfcc411d9adbbaba82fb72661cc1bcca13e8bba98b364e62b2dba8f960159"
+dependencies = [
+ "color_quant",
+ "weezl",
+]
+
+[[package]]
+name = "glidesort"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2e102e6eb644d3e0b186fc161e4460417880a0a0b87d235f2e5b8fb30f2e9e0"
+
+[[package]]
+name = "glifo"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d99fc21d493812643aae86d53b7bbd02f376434a90317e8a790bc209fdd6605e"
+dependencies = [
+ "bytemuck",
+ "foldhash",
+ "hashbrown",
+ "log",
+ "peniko",
+ "png",
+ "skrifa",
+ "smallvec",
+ "vello_common 0.0.9",
+]
+
+[[package]]
+name = "guillotiere"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b17e70c989c36bad147b27a58d148c0741c51448aa5653436547323e524d0ab"
+dependencies = [
+ "euclid",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "zerocopy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hayagriva"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b6c185c5c72546d50b25b70187f01ab9a1a2fa21c4db8691e2426fa5fce805c"
+dependencies = [
+ "biblatex",
+ "ciborium",
+ "citationberg",
+ "icu_collator",
+ "icu_locale",
+ "indexmap",
+ "paste",
+ "roman-numerals-rs",
+ "serde",
+ "serde_yaml",
+ "thiserror",
+ "unic-langid",
+ "unicode-segmentation",
+ "unscanny",
+ "url",
+]
+
+[[package]]
+name = "hayro"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4caa128ab87fd48ffb7490617cf93f77f606820dffbc9fd9ef6ab0ed077f56d"
+dependencies = [
+ "bytemuck",
+ "hayro-interpret",
+ "image",
+ "kurbo",
+ "pic-scale",
+ "vello_cpu",
+]
+
+[[package]]
+name = "hayro-ccitt"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
+
+[[package]]
+name = "hayro-cmap"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
+dependencies = [
+ "hayro-postscript",
+]
+
+[[package]]
+name = "hayro-interpret"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2613d0406898995042d0794c4245b2f2fba1246490c8ac593769bba6551129d"
+dependencies = [
+ "bitflags",
+ "hayro-cmap",
+ "hayro-syntax",
+ "kurbo",
+ "moxcms",
+ "phf",
+ "rustc-hash",
+ "siphasher",
+ "skrifa",
+ "smallvec",
+ "yoke",
+]
+
+[[package]]
+name = "hayro-jbig2"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69374b3668dd45aeb3d3145cda68f2c7b4f223aaa2511e67d076f1c7d741388d"
+dependencies = [
+ "fearless_simd",
+ "hayro-ccitt",
+]
+
+[[package]]
+name = "hayro-jpeg2000"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
+dependencies = [
+ "fearless_simd",
+]
+
+[[package]]
+name = "hayro-postscript"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"
+
+[[package]]
+name = "hayro-svg"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7434c89e920d84e077214a29e69b462a6518754610f732f1124af3948410cb8c"
+dependencies = [
+ "base64",
+ "hayro-interpret",
+ "image",
+ "kurbo",
+ "siphasher",
+ "xmlwriter",
+]
+
+[[package]]
+name = "hayro-syntax"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0edeafd70aa2db743de8ede8637d07ec87db05efe69cde371d03f1b185fcef27"
+dependencies = [
+ "flate2",
+ "hayro-ccitt",
+ "hayro-jbig2",
+ "hayro-jpeg2000",
+ "memchr",
+ "rustc-hash",
+ "smallvec",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "hayro-write"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0b3db92c4917aad24ff30d61413a9a7509ae88b27aee1ae34eff881e1d2723a"
+dependencies = [
+ "flate2",
+ "hayro-syntax",
+ "pdf-writer",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hypher"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef68590049bab63a464eee1a1158ac04c6f6613a546d8d90f78636b8b94f171"
+
+[[package]]
+name = "icu_collator"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b521b92a2666061ddda902769d8a4cf730b5c9529a845cc1b69770b12a6c9a71"
+dependencies = [
+ "icu_collator_data",
+ "icu_collections",
+ "icu_locale",
+ "icu_locale_core",
+ "icu_normalizer",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_collator_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "038ed8e5817f2059c2f3efb0945ba78d060d3d25e8f1a1bea5139f821a21a2f0"
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "serde",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5a396343c7208121dc86e35623d3dfe19814a7613cfd14964994cdc9c9a2e26"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_locale_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "serde",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fdcc9ac77c6d74ff5cf6e65ef3181d6af32003b16fce3a77fb451d2f695993"
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "serde",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af99a43c4436b6c9a37c27a822ff05238bbad134bcdf6176732208acfae46a3f"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c0794db0b1a86193ac9c48768d0e6c52c54448e0870ad87907d456ee0dac964"
+dependencies = [
+ "core_maths",
+ "icu_collections",
+ "icu_locale",
+ "icu_provider",
+ "icu_segmenter_data",
+ "potential_utf",
+ "serde",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a2c462a4d927d512f5f882a033ddd62f33a05bb9f230d98f736ac3dc85938f"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "image"
+version = "0.25.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
+dependencies = [
+ "bytemuck",
+ "byteorder-lite",
+ "color_quant",
+ "gif",
+ "image-webp",
+ "moxcms",
+ "num-traits",
+ "png",
+ "zune-core",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "image-webp"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
+dependencies = [
+ "byteorder-lite",
+ "quick-error",
+]
+
+[[package]]
+name = "imagesize"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c"
+
+[[package]]
+name = "include_dir"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "923d117408f1e49d914f1a379a309cffe4f18c05cf4e3d12e613a15fc81bd0dd"
+dependencies = [
+ "include_dir_macros",
+]
+
+[[package]]
+name = "include_dir_macros"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cab85a7ed0bd5f0e76d93846e0147172bed2e2d3f859bcc33a8d9699cad1a75"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+ "rayon",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "infer"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "kamadak-exif"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1130d80c7374efad55a117d715a3af9368f0fa7a2c54573afc15a188cd984837"
+dependencies = [
+ "mutate_once",
+]
+
+[[package]]
+name = "krilla"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27da593198b20eeba65caeb73c2bbeec3e53ab08fa549898312ce81c4fce5e33"
+dependencies = [
+ "base64",
+ "bumpalo",
+ "comemo",
+ "flate2",
+ "float-cmp",
+ "gif",
+ "hayro-write",
+ "image-webp",
+ "imagesize",
+ "indexmap",
+ "pdf-writer",
+ "png",
+ "rayon",
+ "rustc-hash",
+ "rustybuzz",
+ "siphasher",
+ "skrifa",
+ "smallvec",
+ "subsetter",
+ "tiny-skia-path",
+ "xmp-writer",
+ "yoke",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "krilla-svg"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1237d7c37b16ca9fbc2e72dde13a10d321f9a44aceee35c062bc0a43bfc7ce16"
+dependencies = [
+ "flate2",
+ "fontdb",
+ "krilla",
+ "resvg",
+ "skrifa",
+ "smallvec",
+ "tiny-skia",
+ "usvg",
+]
+
+[[package]]
+name = "kurbo"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b60dfc32f652b926df6192e55525b16d186c69d47876c3ead4da5cc9f8450e2"
+dependencies = [
+ "arrayvec",
+ "euclid",
+ "polycool",
+ "smallvec",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "linebender_resource_handle"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "lipsum"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "636860251af8963cc40f6b4baadee105f02e21b28131d76eba8e40ce84ab8064"
+dependencies = [
+ "rand",
+ "rand_chacha",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "memmap2"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "moxcms"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
+dependencies = [
+ "num-traits",
+ "pxfm",
+]
+
+[[package]]
+name = "mutate_once"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13d2233c9842d08cfe13f9eac96e207ca6a2ea10b80259ebe8ad0268be27d2af"
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "object"
+version = "0.37.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "palette"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cbf71184cc5ecc2e4e1baccdb21026c20e5fc3dcf63028a086131b3ab00b6e6"
+dependencies = [
+ "approx",
+ "fast-srgb8",
+ "libm",
+ "palette_derive",
+]
+
+[[package]]
+name = "palette_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5030daf005bface118c096f510ffb781fc28f9ab6a32ab224d8631be6851d30"
+dependencies = [
+ "by_address",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pdf-writer"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5e456864a7a304047bff84977dc6fb162bd956475d40ba50b2dcecaada7f753"
+dependencies = [
+ "bitflags",
+ "itoa",
+ "memchr",
+ "ryu",
+]
+
+[[package]]
+name = "peniko"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "839c8299360d2e998bdb106dc0a6cd71dcc5f4df51df1b620361bf50e283cca6"
+dependencies = [
+ "bytemuck",
+ "color",
+ "kurbo",
+ "linebender_resource_handle",
+ "smallvec",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pic-scale"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b05a62c3762cb26cb62665b915fea652def8a9f609b0b289b7f782a7394307b"
+dependencies = [
+ "num-traits",
+ "pxfm",
+]
+
+[[package]]
+name = "pico-args"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
+
+[[package]]
+name = "plist"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "092791278e026273c1b65bbdcfbba3a300f2994c896bd01ab01da613c29c46f1"
+dependencies = [
+ "base64",
+ "indexmap",
+ "quick-xml 0.39.4",
+ "serde",
+ "time",
+]
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "polycool"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50596ddc09eb5ad5f75cacd40209568e66df71baf86e1499a0e99c4cff12a5a6"
+dependencies = [
+ "arrayvec",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "serde_core",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "psm"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645dbe486e346d9b5de3ef16ede18c26e6c70ad97418f4874b8b1889d6e761ea"
+dependencies = [
+ "ar_archive_writer",
+ "cc",
+]
+
+[[package]]
+name = "pxfm"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
+
+[[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
+[[package]]
+name = "quick-xml"
+version = "0.38.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.39.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "read-fonts"
+version = "0.39.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4ed38b89c2c77ff968c524145ad65fb010f38af5c7a224b53b81d47ac2daa81"
+dependencies = [
+ "bytemuck",
+ "font-types",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "resvg"
+version = "0.47.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9be183ad6a216aa96f33e4c8033b0988b8b3ea6fd2359d19af5bac4643fd8e81"
+dependencies = [
+ "gif",
+ "image-webp",
+ "log",
+ "pico-args",
+ "rgb",
+ "svgtypes",
+ "tiny-skia",
+ "usvg",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "rgb"
+version = "0.8.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b34b781b31e5d73e9fbc8689c70551fd1ade9a19e3e28cfec8580a79290cc4"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "roman-numerals-rs"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c85cd47a33a4510b1424fe796498e174c6a9cf94e606460ef022a19f3e4ff85e"
+
+[[package]]
+name = "roxmltree"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
+
+[[package]]
+name = "roxmltree"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1964b10c76125c36f8afe190065a4bf9a87bf324842c05701330bba9f1cacbb"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be2a24f50780bc85f09cc6ac299bdf1424302742d77221106859c9d8b102126a"
+dependencies = [
+ "arrayvec",
+ "num-traits",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "rustybuzz"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3c7c96f8a08ee34eff8857b11b49b07d71d1c3f4e88f8a88d4c9e9f90b1702"
+dependencies = [
+ "bitflags",
+ "bytemuck",
+ "core_maths",
+ "log",
+ "smallvec",
+ "ttf-parser",
+ "unicode-bidi-mirroring",
+ "unicode-ccc",
+ "unicode-properties",
+ "unicode-script",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "simplecss"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9c6883ca9c3c7c90e888de77b7a5c849c779d25d74a1269b0218b14e8b136c"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "skrifa"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c34617370ae968efb7161bb2beb517d9084659aae19e24b89e3db25b46e4564"
+dependencies = [
+ "bytemuck",
+ "read-fonts",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "slotmap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stacker"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "640c8cdd92b6b12f5bcb1803ca3bbf5ab96e5e6b6b96b9ab77dabe9e880b3190"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "windows-sys",
+]
+
+[[package]]
+name = "strict-num"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6637bab7722d379c8b41ba849228d680cc12d0a45ba1fa2b48f2a30577a06731"
+dependencies = [
+ "float-cmp",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subsetter"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38803281d1c23166c5ebcb455439a5d2afe711cc909cf88af72448c297756ad6"
+dependencies = [
+ "kurbo",
+ "rustc-hash",
+ "skrifa",
+ "write-fonts",
+]
+
+[[package]]
+name = "svgtypes"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "695b5790b3131dafa99b3bbfd25a216edb3d216dad9ca208d4657bfb8f2abc3d"
+dependencies = [
+ "kurbo",
+ "siphasher",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syntect"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "656b45c05d95a5704399aeef6bd0ddec7b2b3531b7c9e900abbf7c4d2190c925"
+dependencies = [
+ "bincode",
+ "fancy-regex",
+ "flate2",
+ "fnv",
+ "once_cell",
+ "plist",
+ "regex-syntax",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "thiserror",
+ "walkdir",
+ "yaml-rust",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "thin-vec"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0f7e269b48f0a7dd0146680fa24b50cc67fc0373f086a5b2f99bd084639b482"
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "711a53c2d47bbd818258c498c8dbfe186a2526c631495cfe7e078567f86b8469"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71c652a3727a9cbb9a02f707f530b618ce00d0ccd762009c8c23bd191df3c17d"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tiny-skia"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47ffee5eaaf5527f630fb0e356b90ebdec84d5d18d937c5e440350f88c5a91ea"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "png",
+ "tiny-skia-path",
+]
+
+[[package]]
+name = "tiny-skia-path"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edca365c3faccca67d06593c5980fa6c57687de727a03131735bb85f01fdeeb9"
+dependencies = [
+ "arrayref",
+ "bytemuck",
+ "strict-num",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "serde_core",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_write",
+ "winnow",
+]
+
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
+[[package]]
+name = "ttf-parser"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
+dependencies = [
+ "core_maths",
+]
+
+[[package]]
+name = "two-face"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39e51b6e60e545cfdae5a4639ff423818f52372211a8d9a3e892b4b0761f76b2"
+dependencies = [
+ "serde",
+ "serde_derive",
+ "syntect",
+]
+
+[[package]]
+name = "typed-arena"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
+
+[[package]]
+name = "typst"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c8bf2a5a9d58cc542764a88dd43c8a679b683db4ae23e36267219339ab36b01"
+dependencies = [
+ "arrayvec",
+ "comemo",
+ "ecow",
+ "rustc-hash",
+ "typst-eval",
+ "typst-html",
+ "typst-layout",
+ "typst-library",
+ "typst-macros",
+ "typst-realize",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+]
+
+[[package]]
+name = "typst-assets"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da9b236d339dce0ec443dc44afe4ba4c6d76b8917bd4b1ae80158d2111f6637b"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "typst-eval"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d064876305073ab75d5af039ae5e8dcb32c4cac4aa9f43d0f5aae347baef7c3"
+dependencies = [
+ "comemo",
+ "ecow",
+ "indexmap",
+ "rustc-hash",
+ "stacker",
+ "toml",
+ "typst-library",
+ "typst-macros",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "typst-html"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d442f92bae44087735efc8b83508b259c573bbccf027e098ac68c8f4ca879f76"
+dependencies = [
+ "az",
+ "bumpalo",
+ "comemo",
+ "ecow",
+ "palette",
+ "rustc-hash",
+ "time",
+ "typst-assets",
+ "typst-library",
+ "typst-macros",
+ "typst-svg",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+ "unicode-math-class",
+]
+
+[[package]]
+name = "typst-kit"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55a24650fc436d32deb55b49fd63f7bcad3a864c96f52587b9934c85e0092d6f"
+dependencies = [
+ "dirs",
+ "ecow",
+ "fontdb",
+ "once_cell",
+ "parking_lot",
+ "rustc-hash",
+ "serde",
+ "serde_json",
+ "typst-assets",
+ "typst-library",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+ "url",
+]
+
+[[package]]
+name = "typst-layout"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae5af3949efc6d02e3d55e79430c9096415fcf68166414c3a0e5fed1c3325d5f"
+dependencies = [
+ "az",
+ "bumpalo",
+ "codex",
+ "comemo",
+ "ecow",
+ "either",
+ "hypher",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_blob",
+ "icu_segmenter",
+ "kurbo",
+ "libm",
+ "memchr",
+ "rustc-hash",
+ "rustybuzz",
+ "smallvec",
+ "ttf-parser",
+ "typst-assets",
+ "typst-library",
+ "typst-macros",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+ "unicode-bidi",
+ "unicode-math-class",
+ "unicode-script",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "typst-library"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9550a33d0f4e1965fd7d69abcf10135e965a4ad3a3aee24573b52dda9234e491"
+dependencies = [
+ "arrayvec",
+ "az",
+ "bitflags",
+ "bumpalo",
+ "ciborium",
+ "codex",
+ "comemo",
+ "csv",
+ "ecow",
+ "either",
+ "flate2",
+ "fontdb",
+ "glidesort",
+ "hayagriva",
+ "hayro-syntax",
+ "icu_properties",
+ "image",
+ "indexmap",
+ "kamadak-exif",
+ "kurbo",
+ "libm",
+ "lipsum",
+ "memchr",
+ "moxcms",
+ "palette",
+ "percent-encoding",
+ "phf",
+ "png",
+ "rayon",
+ "regex",
+ "regex-syntax",
+ "roxmltree 0.21.1",
+ "rust_decimal",
+ "rustc-hash",
+ "rustybuzz",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "siphasher",
+ "smallvec",
+ "syntect",
+ "time",
+ "toml",
+ "ttf-parser",
+ "two-face",
+ "typed-arena",
+ "typst-assets",
+ "typst-macros",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+ "unicode-math-class",
+ "unicode-normalization",
+ "unicode-segmentation",
+ "unscanny",
+ "usvg",
+ "utf8_iter",
+ "wasmi",
+ "xmlwriter",
+]
+
+[[package]]
+name = "typst-macros"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "500e2873a544ca161f98183eea7ddb00030d16f4585b5ffa9e9c8e24f53148e1"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typst-pdf"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd7b33bcabc3357480768f6c78dda99a838d621c71b4738b25e09ac30ac063c9"
+dependencies = [
+ "az",
+ "bytemuck",
+ "codex",
+ "comemo",
+ "ecow",
+ "flate2",
+ "image",
+ "indexmap",
+ "infer",
+ "krilla",
+ "krilla-svg",
+ "rustc-hash",
+ "serde",
+ "smallvec",
+ "typst-assets",
+ "typst-layout",
+ "typst-library",
+ "typst-macros",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+]
+
+[[package]]
+name = "typst-realize"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "917e09614771258b13409b9a8d4f3915b2a2f7f28ca987701695f82fc6a7c0b9"
+dependencies = [
+ "arrayvec",
+ "bumpalo",
+ "comemo",
+ "ecow",
+ "regex",
+ "typst-html",
+ "typst-library",
+ "typst-macros",
+ "typst-syntax",
+ "typst-timing",
+ "typst-utils",
+]
+
+[[package]]
+name = "typst-svg"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "878b6e1293c2bea77a8be50670d1cbca4e676af96480313a105cba539da51d1c"
+dependencies = [
+ "base64",
+ "comemo",
+ "ecow",
+ "flate2",
+ "hayro",
+ "hayro-svg",
+ "image",
+ "indexmap",
+ "itoa",
+ "rustc-hash",
+ "ryu",
+ "ttf-parser",
+ "typst-assets",
+ "typst-layout",
+ "typst-library",
+ "typst-macros",
+ "typst-timing",
+ "typst-utils",
+ "xmlwriter",
+]
+
+[[package]]
+name = "typst-syntax"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22bf7f87450e5841debd4986b0f912b0f7a2251e600c08aca406305ff52c67b4"
+dependencies = [
+ "ecow",
+ "rustc-hash",
+ "serde",
+ "toml",
+ "typst-timing",
+ "typst-utils",
+ "unicode-ident",
+ "unicode-math-class",
+ "unicode-script",
+ "unicode-segmentation",
+ "unscanny",
+]
+
+[[package]]
+name = "typst-timing"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cc0c78ece2ade6ef73d00a13f9c474e02efc3bcfdb770e16d7c4d24e7492773"
+dependencies = [
+ "parking_lot",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "typst-utils"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40215eb2541102ecfb4cf3bef29da53033a82e22dbc2308c43bdb855701bf8d2"
+dependencies = [
+ "libm",
+ "once_cell",
+ "portable-atomic",
+ "rayon",
+ "rustc-hash",
+ "semver",
+ "siphasher",
+ "smallvec",
+ "thin-vec",
+ "unicode-math-class",
+]
+
+[[package]]
+name = "unic-langid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28ba52c9b05311f4f6e62d5d9d46f094bd6e84cb8df7b3ef952748d752a7d05"
+dependencies = [
+ "unic-langid-impl",
+ "unic-langid-macros",
+]
+
+[[package]]
+name = "unic-langid-impl"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce1bf08044d4b7a94028c93786f8566047edc11110595914de93362559bc658"
+dependencies = [
+ "serde",
+ "tinystr",
+]
+
+[[package]]
+name = "unic-langid-macros"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5957eb82e346d7add14182a3315a7e298f04e1ba4baac36f7f0dbfedba5fc25"
+dependencies = [
+ "proc-macro-hack",
+ "tinystr",
+ "unic-langid-impl",
+ "unic-langid-macros-impl",
+]
+
+[[package]]
+name = "unic-langid-macros-impl"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1249a628de3ad34b821ecb1001355bca3940bcb2f88558f1a8bd82e977f75b5"
+dependencies = [
+ "proc-macro-hack",
+ "quote",
+ "syn",
+ "unic-langid-impl",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-bidi-mirroring"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfa6e8c60bb66d49db113e0125ee8711b7647b5579dc7f5f19c42357ed039fe"
+
+[[package]]
+name = "unicode-ccc"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce61d488bcdc9bc8b5d1772c404828b17fc481c0a582b5581e95fb233aef503e"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-math-class"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d246cf599d5fae3c8d56e04b20eb519adb89a8af8d0b0fbcded369aa3647d65"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-script"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "383ad40bb927465ec0ce7720e033cb4ca06912855fc35db31b5755d0de75b1ee"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-vo"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1d386ff53b415b7fe27b50bb44679e2cc4660272694b7b6f3326d8480823a94"
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "unscanny"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9df2af067a7953e9c3831320f35c1cc0600c30d44d9f7a12b01db1cd88d6b47"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "usvg"
+version = "0.47.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d46cf96c5f498d36b7a9693bc6a7075c0bb9303189d61b2249b0dc3d309c07de"
+dependencies = [
+ "base64",
+ "data-url",
+ "flate2",
+ "fontdb",
+ "imagesize",
+ "kurbo",
+ "log",
+ "pico-args",
+ "roxmltree 0.21.1",
+ "rustybuzz",
+ "simplecss",
+ "siphasher",
+ "strict-num",
+ "svgtypes",
+ "tiny-skia-path",
+ "ttf-parser",
+ "unicode-bidi",
+ "unicode-script",
+ "unicode-vo",
+ "xmlwriter",
+]
+
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "vello_common"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3361bff7f7d82c0c496b92048db83846691f0e844cc28dee92b1c824291b55ee"
+dependencies = [
+ "bytemuck",
+ "fearless_simd",
+ "guillotiere",
+ "hashbrown",
+ "log",
+ "peniko",
+ "png",
+ "smallvec",
+ "thiserror",
+]
+
+[[package]]
+name = "vello_common"
+version = "0.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19d672facaa2d697285a786cd9d44d614cd2ce54cdc022504bf339f8fff3b750"
+dependencies = [
+ "bytemuck",
+ "fearless_simd",
+ "guillotiere",
+ "hashbrown",
+ "log",
+ "peniko",
+ "png",
+ "smallvec",
+ "thiserror",
+]
+
+[[package]]
+name = "vello_cpu"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d8ded630e8316bb94a55881256506d1f3b9947b5f66db8a7d32ca7ba02decd0"
+dependencies = [
+ "bytemuck",
+ "glifo",
+ "hashbrown",
+ "png",
+ "vello_common 0.0.8",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasmi"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2300d0f78cba12f14e29e8dd157ea64050c0a688179aefdb2050105805594a0c"
+dependencies = [
+ "spin",
+ "wasmi_collections",
+ "wasmi_core",
+ "wasmi_ir",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmi_collections"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a8c42a2a76148d43097b1d7cc2a5bf33d5c23bd4dd69015fc887e311767884"
+
+[[package]]
+name = "wasmi_core"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9013136083d988725953390bf668b64b7a218fabf26f8b913bbc59546b97ee27"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "wasmi_ir"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1fa003f79156f406d62ef0e1464dc03e11ace37170e9fa7524299a75ad8f68"
+dependencies = [
+ "wasmi_core",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.239.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9d90bb93e764f6beabf1d02028c70a2156a6583e63ac4218dd07ef733368b0"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "weezl"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "write-fonts"
+version = "0.48.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb731d4c4d93eacc69a1ad2f270f905788a98e4a3438267bcafbe08d3431c8d8"
+dependencies = [
+ "font-types",
+ "indexmap",
+ "kurbo",
+ "log",
+ "read-fonts",
+]
+
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "xmlwriter"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
+
+[[package]]
+name = "xmp-writer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "serde_core",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "serde",
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513"
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zune-core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb8a0807f7c01457d0379ba880ba6322660448ddebc890ce29bb64da71fb40f9"
+
+[[package]]
+name = "zune-jpeg"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
+dependencies = [
+ "zune-core",
+]
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..ca2868d
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,23 @@
+[workspace]
+resolver = "2"
+members = [
+    "crates/cph-diag",
+    "crates/cph-model",
+    "crates/cph-schema",
+    "crates/cph-typst",
+    "crates/cph-check",
+    "crates/cph-cli",
+]
+
+# Shared metadata for all workspace crates. Individual crates inherit these via
+# `version.workspace = true` / `edition.workspace = true`.
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+
+[workspace.dependencies]
+serde = { version = "1", features = ["derive"] }
+toml = "0.8"
+cph-diag = { path = "crates/cph-diag" }
+cph-model = { path = "crates/cph-model" }
diff --git a/README.md b/README.md
index ba5a6d2..62285d9 100644
--- a/README.md
+++ b/README.md
@@ -1,35 +1,50 @@
-# Curriculum Project Hub
+# curriculum-project-hub
 
-教研项目工作台的架构仓库。
+教研生产的数字化解决方案。核心思路:课程像 DAW / 剪辑软件那样有一个**结构化的工程文件**;coding agent 协助编辑它;一个 rule-based checker(类编译器)校验其合法性并给出 helpful fix hint。目标是把教研从一次性的文档,沉淀成**可累积、可校验、可复用的资产**。
 
-当前阶段先用 LikeC4 把产品边界、系统职责、核心领域模型和关键运行时流程敲定，再进入实现。
+这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`spec/` 是上游的语义母本,其余部件是向它对齐的实现。**
 
-## Architecture
+## 仓库布局
 
-LikeC4 model:
-
-- [docs/architecture/likec4/specification.c4](/Users/jiarong/local/paradigm/curriculum-project-hub/docs/architecture/likec4/specification.c4)
-- [docs/architecture/likec4/model.c4](/Users/jiarong/local/paradigm/curriculum-project-hub/docs/architecture/likec4/model.c4)
-- [docs/architecture/likec4/views.c4](/Users/jiarong/local/paradigm/curriculum-project-hub/docs/architecture/likec4/views.c4)
-
-Commands:
-
-```sh
-npm install
-npm run dev
-npm run validate
-npm run build
+```
+README.md          ← 本文件:总览 + 宪法(下面 5 条)
+CLAUDE.md          ← 全局 agent 操作手册(管整个 repo)
+docs/adr/          ← 系统级架构决策记录(跨部件,被 spec 契约引用)
+spec/              ← Lean 语义母本(自包含的 Lean 工程)。见 spec/README.md
+Cargo.toml         ← 仓库级 cargo workspace(实现部件共用,便于跨部件复用 crate)
+crates/            ← 实现:rule-based checker(向 spec 对齐)。见 crates/README.md
+  cph-diag / cph-model / cph-schema / cph-typst   ← 可复用基础(模型/校验/typst 引擎)
+  cph-check / cph-cli                             ← checker 本体 + `cph` 命令行
+render/            ← typst 渲染包 cph-render(母本的渲染后端之一,ADR-0005)
+examples/          ← 样例工程文件(如 TH-141),流水线的真实输入
+(hub/ exporter/ …) ← 将来的其他部件,平级于 spec/。尚未创建
 ```
 
-Key views to review first:
+`spec/` 与实现部件**物理分离、平级共存**:谁是上游、谁向谁对齐,一眼可见。
+实现部件共用一个仓库根的 cargo workspace,使基础 crate(模型、typst 引擎)能被
+未来部件(如 exporter)复用,而非各自重造。
 
-- `index`: system context
-- `containers`: target containers and external systems
-- `permissions`: Feishu Docs-like permission model
-- `domain_model`: Project / ProjectGroupChat / AgentSession / AgentRun / ProjectAgentLock
-- `run_lifecycle`: `@Claude` creates a run and holds a project lock
-- `context_access`: Claude reads Feishu history on demand through MCP
+## 宪法
 
-## Decisions
+这 5 条是 `spec/` 这份语义母本的定位与约束,是本仓库一切工作的前提。
 
-Architecture decisions live in [docs/architecture/adr](/Users/jiarong/local/paradigm/curriculum-project-hub/docs/architecture/adr).
+1. **角色 —— Lean 是研发侧的上游参照。**
+   `spec/` 用 Lean 编写,是开发者(领域专家)与 coding agent **共用**的 spec 工具,用来沉淀产品各部件的**语义**。它**不进入产品运行时**——产品里"站在 Lean 这个位置"的那个 checker 用什么技术实现,尚未决定;但那个东西的语义,先在 `spec/` 里固定下来。
+
+2. **对齐机制 —— Lean 只做上游参照。**
+   不做 extract / codegen,不派生 conformance test,CI 里**没有** spec→实现的 gate。实现对齐 spec,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。
+   (CI 里的 `spec check` 只验 spec **自身**能否 type-check,即契约内部良构,不是 spec↔实现的对齐检查。)
+
+3. **资产性 —— 由 review 纪律承载,无机器兜底。**
+   这份仓库给你的是"精确、自洽、机器验内部良构的语义共识",**不是**"实现正确性保证"。spec 与实现之间那道缝,是我们自愿用人来守的——清醒地守,它就是资产;放任实现漂移而不回头同步,它就退化成最贵的过期文档。
+
+4. **形态 —— 它是人机共识的契约。**
+   契约必须**自包含**:凡契约未明文规定的,开发者与 agent 双方都不该假设。这比"文档"严格——type checker 会逼这份契约在结构上无洞。
+
+5. **深度判据 —— 只收录分歧点。**
+   一条语义该不该写进 Lean,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进契约;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   深度上限不是 Lean 的表达力,而是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
+
+## CI
+
+`.gitea/workflows/spec-check.yml` 在每次 push / PR 时于 `spec/` 下跑 `lake build`,确保契约始终 type-check 通过(从第一天起就是"绿"的)。这是良构 gate,见宪法第 2 条。
diff --git a/crates/README.md b/crates/README.md
new file mode 100644
index 0000000..11eb86a
--- /dev/null
+++ b/crates/README.md
@@ -0,0 +1,34 @@
+# crates/
+
+These crates implement the rule-based lesson checker that aligns to the
+semantic master in `spec/`: it reads an engineering-file (one lesson, ADR-0005)
+laid out per ADR-0008 (declarative `manifest.toml` + per-element
+`element.toml`), validates structure and content, and emits diagnostics.
+`cph-diag` (the shared diagnostic vocabulary), `cph-model` (the ADR-0008 loader),
+and `cph-typst` (the typst `World` / compile / span-mapping layer) are
+deliberately reusable by future components such as an `exporter`, which is why
+they live in this repo-wide `crates/` directory rather than under any single
+component; `cph-schema` (kind JSON Schemas + validation), `cph-check`
+(orchestration + render-coverage) and `cph-cli` (the `cph` command-line
+entrypoint) are the checker proper.
+
+## Crate map
+
+| crate         | owner | role |
+|---------------|-------|------|
+| `cph-diag`    | WU-1  | shared diagnostic vocabulary (`Severity`, `DiagCode`, `Diagnostic`, `SourceSpan`) — reusable |
+| `cph-model`   | WU-1  | parses the ADR-0008 layout into an in-memory ordered `Lesson` — reusable |
+| `cph-schema`  | WU-3  | the 4 stdlib kind JSON Schemas + structural validation |
+| `cph-typst`   | WU-4  | typst `World`, driver generation, compile, PDF, span mapping — reusable |
+| `cph-check`   | WU-5  | orchestration: render-coverage and the full check pipeline |
+| `cph-cli`     | WU-5  | the `cph` command-line entrypoint |
+
+## Build
+
+```sh
+# from the repository root (the cargo workspace root)
+cargo build      # all crates
+cargo test       # cph-diag + cph-model unit/integration tests
+cargo clippy --all-targets -- -D warnings
+cargo fmt --check
+```
diff --git a/crates/cph-check/Cargo.toml b/crates/cph-check/Cargo.toml
new file mode 100644
index 0000000..5408e07
--- /dev/null
+++ b/crates/cph-check/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "cph-check"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+cph-diag = { workspace = true }
+cph-model = { workspace = true }
+cph-schema = { path = "../cph-schema" }
+cph-typst = { path = "../cph-typst" }
diff --git a/crates/cph-check/src/lib.rs b/crates/cph-check/src/lib.rs
new file mode 100644
index 0000000..d547846
--- /dev/null
+++ b/crates/cph-check/src/lib.rs
@@ -0,0 +1,912 @@
+//! `cph-check` — check-pipeline orchestration.
+//!
+//! Owned by **WU-5**. Ties together `cph-model` (load), `cph-schema`
+//! (validate), and `cph-typst` (compile), runs the render-coverage rule
+//! (ADR-0005's "missing render ⇒ warning"), and collects all diagnostics.
+//!
+//! The orchestrator owns *sequencing and gating*, not the individual checks:
+//! each phase is implemented by an upstream crate, and `cph-check` decides the
+//! order, what gates what, and how the results are merged / deduped. See
+//! [`check`] for the full pipeline and [`build`] for the export path.
+
+use std::path::Path;
+
+use cph_diag::{DiagCode, Diagnostic, Severity};
+use cph_typst::Engine;
+
+/// The default render target when a lesson declares no `[targets.*]` at all.
+const DEFAULT_TARGET: &str = "student";
+
+/// Severity of the render-coverage ("element ignored under a target") diagnostic.
+///
+/// **PINNED to `warning` by the contract.** Mirrors the Lean master's
+/// `Spec.Courseware.renderIgnoredSeverity : Severity := .warning`
+/// (`spec/Spec/Courseware/Check/Diagnostic.lean`), itself citing ADR-0005: when a
+/// `(kind, target)` pair has no render rule the checker reports that the element
+/// is ignored under that target and **does not block the export**. Naming the
+/// severity as a const makes "it is a warning, not an error" a greppable,
+/// alignable fact rather than an inline literal.
+const RENDER_IGNORED_SEVERITY: Severity = Severity::Warning;
+
+/// The result of running [`check`] (or the check phases of [`build`]).
+#[derive(Debug, Clone, PartialEq)]
+pub struct CheckReport {
+    /// Every diagnostic collected across all phases, deduplicated.
+    pub diagnostics: Vec<Diagnostic>,
+    /// `false` if `cph_model::load` returned `None` (a hard manifest failure
+    /// that prevents any further phase from running).
+    pub lesson_loaded: bool,
+}
+
+impl CheckReport {
+    /// How many collected diagnostics are `Error`-severity.
+    pub fn error_count(&self) -> usize {
+        self.diagnostics
+            .iter()
+            .filter(|d| d.severity == Severity::Error)
+            .count()
+    }
+
+    /// How many collected diagnostics are `Warning`-severity.
+    pub fn warning_count(&self) -> usize {
+        self.diagnostics
+            .iter()
+            .filter(|d| d.severity == Severity::Warning)
+            .count()
+    }
+
+    /// Whether any collected diagnostic is `Error`-severity.
+    ///
+    /// **Legality decision (spec alignment).** `!has_errors()` is the
+    /// implementation of `Spec.Courseware.Legal` (`spec/Spec/Courseware/Check/Diagnostic.lean`):
+    /// a lesson is *legal* iff its diagnostics contain no error-level diagnostic
+    /// (warnings are non-blocking — see `Severity` / ADR-0010). There is no CI
+    /// gate enforcing this alignment (repo constitution); it is kept greppable
+    /// here so a reviewer can tie the orchestrator's gate to the Lean master.
+    pub fn has_errors(&self) -> bool {
+        self.diagnostics
+            .iter()
+            .any(|d| d.severity == Severity::Error)
+    }
+}
+
+/// Run the full check pipeline against the engineering file at `root`.
+///
+/// Phases, in order, with gating:
+/// - **(a) load** — `cph_model::load`. Its diagnostics are collected. On a hard
+///   failure (`None`) the report is returned immediately with
+///   `lesson_loaded == false`; nothing downstream can run.
+/// - **(b) structural** — for each part, check `part.kind` is in
+///   `cph_schema::known_kinds()`; an unknown kind is an `UnknownKind` error.
+///   (cph-model already checked path existence, `..` traversal, and
+///   part/element kind *mismatch*; this complements that with the *known-set*
+///   check and does not duplicate it.) Parts whose folder cph-model already
+///   flagged as missing are skipped for the rest of the pipeline.
+/// - **(c) schema** — for each part whose folder exists and whose kind is
+///   known, `cph_schema::validate(&part.descriptor)`.
+/// - **(d) typst compile** — only if phases (a)–(c) produced **zero** errors
+///   (otherwise the compile is noise on known-broken input). Compiles each
+///   declared `lesson.targets` (defaulting to `"student"` if none), deduping
+///   identical diagnostics across targets.
+/// - **(e) render-coverage** — a `warning` (never an error) for each
+///   `(kind, target)` the target's `covers` declaration does not include. Runs
+///   regardless of (d) gating.
+///
+/// The engine is taken as a parameter so the caller owns it (and tests can
+/// inject `Engine::with_render_dir`).
+pub fn check(root: &Path, engine: &Engine) -> CheckReport {
+    let mut diags = Vec::new();
+
+    // (a) load.
+    let (lesson, load_diags) = cph_model::load(root);
+    diags.extend(load_diags);
+
+    let Some(lesson) = lesson else {
+        // Hard manifest failure: nothing else can run.
+        return CheckReport {
+            diagnostics: dedup(diags),
+            lesson_loaded: false,
+        };
+    };
+
+    let known = cph_schema::known_kinds();
+
+    // (b) structural + (c) schema.
+    run_structural_and_schema(&lesson, known, &mut diags);
+
+    // (d) typst compile — gated on zero errors from (a)–(c).
+    let pre_compile_has_error = diags.iter().any(|d| d.severity == Severity::Error);
+    if !pre_compile_has_error {
+        for target in compile_targets(&lesson) {
+            diags.extend(engine.compile_check(&lesson, target));
+        }
+    }
+
+    // (e) render-coverage — always runs; only a warning. Skips parts already
+    // broken in (b) (missing folder / unknown kind).
+    diags.extend(render_coverage(&lesson, known));
+
+    CheckReport {
+        diagnostics: dedup(diags),
+        lesson_loaded: true,
+    }
+}
+
+/// Build a PDF for `target`.
+///
+/// Runs the check phases **(a)–(c)** (load → structural → schema). If those
+/// produce any `Error`, the build is refused: returns `(None, report)` with the
+/// blocking diagnostics. Otherwise it compiles + exports the PDF for `target`
+/// via `engine.build_pdf`; on a clean compile returns `(Some(bytes), report)`,
+/// and on a typst error returns `(None, report)` with the compile diagnostics
+/// folded into the report.
+///
+/// Note `build` does **not** run render-coverage (phase (e)): coverage warnings
+/// describe export *loss*, which is informational for a `check`, not a gate on
+/// producing a single target's PDF.
+pub fn build(root: &Path, engine: &Engine, target: &str) -> (Option<Vec<u8>>, CheckReport) {
+    let mut diags = Vec::new();
+
+    // (a) load.
+    let (lesson, load_diags) = cph_model::load(root);
+    diags.extend(load_diags);
+
+    let Some(lesson) = lesson else {
+        return (
+            None,
+            CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: false,
+            },
+        );
+    };
+
+    let known = cph_schema::known_kinds();
+
+    // (b) structural + (c) schema.
+    run_structural_and_schema(&lesson, known, &mut diags);
+
+    if diags.iter().any(|d| d.severity == Severity::Error) {
+        return (
+            None,
+            CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: true,
+            },
+        );
+    }
+
+    // Phases passed: compile + export the requested target.
+    match engine.build_pdf(&lesson, target) {
+        Ok(bytes) => (
+            Some(bytes),
+            CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: true,
+            },
+        ),
+        Err(compile_diags) => {
+            diags.extend(compile_diags);
+            (
+                None,
+                CheckReport {
+                    diagnostics: dedup(diags),
+                    lesson_loaded: true,
+                },
+            )
+        }
+    }
+}
+
+/// One shell step's execution outcome (for [`run_shell_target`]).
+#[derive(Debug, Clone, PartialEq)]
+pub struct ShellStepOutcome {
+    /// The command line that was run (verbatim from the manifest `run` field).
+    pub run: String,
+    /// Process exit code (`None` if the process was killed by a signal).
+    pub status: Option<i32>,
+    /// Captured stdout.
+    pub stdout: String,
+    /// Captured stderr.
+    pub stderr: String,
+}
+
+impl ShellStepOutcome {
+    /// Whether the step exited successfully (status 0).
+    pub fn ok(&self) -> bool {
+        self.status == Some(0)
+    }
+}
+
+/// The result of [`run_shell_target`].
+#[derive(Debug, Clone, PartialEq)]
+pub struct ShellRunReport {
+    /// The check phases' report (load → structural → schema). Shell steps run
+    /// only when this has no errors.
+    pub check: CheckReport,
+    /// Each shell step's outcome, in declared order. Empty if the build was
+    /// refused (check errors, unknown target, or the target has no shell steps).
+    pub outcomes: Vec<ShellStepOutcome>,
+    /// `true` if the target was found, check passed, and every shell step exited 0.
+    pub ok: bool,
+}
+
+/// Execute the `Shell` steps of a `file-tree`/tool-generated target (ADR-0009
+/// category (b); e.g. the KenKen interactives produced by the `kendoku` CLI).
+///
+/// This is the **escape-hatch executor**: unlike [`build`] (which compiles a
+/// typst template to a PDF), a shell target hands off to an external tool that
+/// writes files itself. cph only *runs the declared command* in the engineering
+/// root and reports what happened — it assembles nothing.
+///
+/// Contract / safety:
+/// - Runs the check phases first (load → structural → schema). Any error refuses
+///   the run (`ok == false`, no command executed) — a shell build of a broken
+///   lesson is not attempted.
+/// - Each `Step::Shell { run }` is executed via the platform shell
+///   (`sh -c <run>` / `cmd /C <run>`) with the **engineering root as the working
+///   directory**, so a manifest can use root-relative paths.
+/// - **Arbitrary command execution is opt-in by construction**: this function is
+///   only reached from `cph build --target <name>`, never from `check`. Callers
+///   (the CLI) surface the command before running it.
+/// - `TypstCompile` steps inside the same target are skipped here (a shell target
+///   is not a typst build); a target with no shell steps yields `ok == false`.
+pub fn run_shell_target(root: &Path, engine: &Engine, target: &str) -> ShellRunReport {
+    let mut diags = Vec::new();
+
+    let (lesson, load_diags) = cph_model::load(root);
+    diags.extend(load_diags);
+
+    let Some(lesson) = lesson else {
+        return ShellRunReport {
+            check: CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: false,
+            },
+            outcomes: Vec::new(),
+            ok: false,
+        };
+    };
+
+    let known = cph_schema::known_kinds();
+    run_structural_and_schema(&lesson, known, &mut diags);
+
+    // Suppress the unused-parameter warning while keeping the signature uniform
+    // with `build`/`check` (the engine is not needed to run shell steps, but
+    // callers pass it so the API is consistent and future steps may use it).
+    let _ = engine;
+
+    let has_error = diags.iter().any(|d| d.severity == Severity::Error);
+
+    let Some(tc) = lesson.targets.iter().find(|t| t.name == target) else {
+        diags.push(
+            Diagnostic::error(
+                DiagCode::SchemaViolation,
+                format!("target '{target}' not declared in manifest"),
+            )
+            .with_hint(format!(
+                "add a `[targets.{target}]` table, or run a declared target"
+            )),
+        );
+        return ShellRunReport {
+            check: CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: true,
+            },
+            outcomes: Vec::new(),
+            ok: false,
+        };
+    };
+
+    let shell_steps: Vec<&str> = tc
+        .steps
+        .iter()
+        .filter_map(|s| match s {
+            cph_model::Step::Shell { run } => Some(run.as_str()),
+            cph_model::Step::TypstCompile { .. } => None,
+            cph_model::Step::AssembleMarkdown { .. } => None,
+        })
+        .collect();
+
+    if has_error || shell_steps.is_empty() {
+        return ShellRunReport {
+            check: CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: true,
+            },
+            outcomes: Vec::new(),
+            ok: false,
+        };
+    }
+
+    // Run each shell step in the engineering root. First non-zero exit stops the
+    // sequence (a failed step's successors likely depend on it).
+    let mut outcomes = Vec::new();
+    let mut all_ok = true;
+    for run in shell_steps {
+        let outcome = run_one_shell(&lesson.root, run);
+        let ok = outcome.ok();
+        outcomes.push(outcome);
+        if !ok {
+            all_ok = false;
+            break;
+        }
+    }
+
+    ShellRunReport {
+        check: CheckReport {
+            diagnostics: dedup(diags),
+            lesson_loaded: true,
+        },
+        outcomes,
+        ok: all_ok,
+    }
+}
+
+/// Whether the named target is a **shell-step** target (its steps contain at
+/// least one `Step::Shell` and no `Step::TypstCompile`) — i.e. a tool-generated
+/// asset bundle that [`run_shell_target`] executes rather than [`build`]
+/// compiling to PDF.
+///
+/// Loads the lesson read-only (ignoring diagnostics); an unloadable lesson or an
+/// unknown target returns `false`, so the caller falls through to the normal
+/// (typst) build path, which then reports the real error.
+pub fn target_is_shell(root: &Path, target: &str) -> bool {
+    let (Some(lesson), _) = cph_model::load(root) else {
+        return false;
+    };
+    lesson
+        .targets
+        .iter()
+        .find(|t| t.name == target)
+        .is_some_and(|t| {
+            t.steps.iter().any(|s| matches!(s, cph_model::Step::Shell { .. }))
+                && !t.steps.iter().any(|s| matches!(s, cph_model::Step::TypstCompile { .. }))
+        })
+}
+
+/// Run one shell command line in `cwd` via the platform shell, capturing output.
+fn run_one_shell(cwd: &Path, run: &str) -> ShellStepOutcome {
+    use std::process::Command;
+
+    let output = if cfg!(target_os = "windows") {
+        Command::new("cmd").arg("/C").arg(run).current_dir(cwd).output()
+    } else {
+        Command::new("sh").arg("-c").arg(run).current_dir(cwd).output()
+    };
+
+    match output {
+        Ok(out) => ShellStepOutcome {
+            run: run.to_string(),
+            status: out.status.code(),
+            stdout: String::from_utf8_lossy(&out.stdout).into_owned(),
+            stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
+        },
+        Err(e) => ShellStepOutcome {
+            run: run.to_string(),
+            status: None,
+            stdout: String::new(),
+            stderr: format!("failed to spawn command: {e}"),
+        },
+    }
+}
+
+/// One assemble-markdown step's outcome (for [`run_markdown_assemble_target`]).
+#[derive(Debug, Clone, PartialEq)]
+pub struct MarkdownAssembleOutcome {
+    /// The field name that was assembled (verbatim from the step's `field`).
+    pub field: String,
+    /// How many elements' `<field>.md` files were read and concatenated.
+    pub parts_read: usize,
+    /// The assembled markdown body (empty if nothing was read).
+    pub body: String,
+    /// Where the assembled file was written (relative to the engineering root);
+    /// `None` if the write failed or was skipped.
+    pub written: Option<String>,
+    /// `None` on success; an error message if reading a required file or writing
+    /// the artifact failed.
+    pub error: Option<String>,
+}
+
+impl MarkdownAssembleOutcome {
+    /// Whether the step succeeded (wrote the artifact with no error).
+    pub fn ok(&self) -> bool {
+        self.error.is_none() && self.written.is_some()
+    }
+}
+
+/// The result of [`run_markdown_assemble_target`].
+#[derive(Debug, Clone, PartialEq)]
+pub struct MarkdownAssembleReport {
+    /// The check phases' report (load → structural → schema). Assembly runs only
+    /// when this has no errors.
+    pub check: CheckReport,
+    /// Each assemble-markdown step's outcome, in declared order. Empty if the
+    /// build was refused (check errors, unknown target, no assemble steps).
+    pub outcomes: Vec<MarkdownAssembleOutcome>,
+    /// `true` if the target was found, check passed, and every assemble step wrote
+    /// its artifact without error.
+    pub ok: bool,
+}
+
+/// Execute the `AssembleMarkdown` steps of a target (ADR-0015): concatenate each
+/// element's `<field>.md` markdown content file in `[[parts]]` order into the
+/// target's single-file artifact. This is the **third typed step**: unlike
+/// [`build`] (typst template → PDF) the framework owns the read/concatenate/write
+/// itself (not a typst compile, not an external tool like [`run_shell_target`]).
+///
+/// Contract / safety (same three boundaries as the shell step, ADR-0013/0015):
+/// - Runs the check phases first (load → structural → schema). Any error refuses
+///   the run (`ok == false`, nothing written) — assembling a broken lesson is
+///   not attempted.
+/// - Walks `lesson.parts` **in declared order**, reading `<part.path>/<field>.md`
+///   when it exists (skipping absent ones — these fields are optional), joining
+///   them with a blank line, and writing to the artifact's single-file
+///   `filepath` (relative to the engineering root). Each `slides.md`/etc.
+///   authors its own heading; the assembler injects nothing (presentation in the
+///   content, ADR-0011).
+/// - **Opt-in by construction**: only reached from `cph build --target <name>`,
+///   never from `check`. A non-typst target, so `check`'s compile phase skips it.
+/// - A write error is a **build-process error**, not a lesson diagnostic — it is
+///   reported in `MarkdownAssembleOutcome::error`, not the 6-class taxonomy.
+pub fn run_markdown_assemble_target(
+    root: &Path,
+    engine: &Engine,
+    target: &str,
+) -> MarkdownAssembleReport {
+    let mut diags = Vec::new();
+
+    let (lesson, load_diags) = cph_model::load(root);
+    diags.extend(load_diags);
+
+    let Some(lesson) = lesson else {
+        return MarkdownAssembleReport {
+            check: CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: false,
+            },
+            outcomes: Vec::new(),
+            ok: false,
+        };
+    };
+
+    let known = cph_schema::known_kinds();
+    run_structural_and_schema(&lesson, known, &mut diags);
+
+    // Signature uniform with `build`/`run_shell_target`; the engine is not used
+    // to assemble markdown (no typst compile), but callers pass it for API
+    // consistency.
+    let _ = engine;
+
+    let has_error = diags.iter().any(|d| d.severity == Severity::Error);
+
+    let Some(tc) = lesson.targets.iter().find(|t| t.name == target) else {
+        diags.push(
+            Diagnostic::error(
+                DiagCode::SchemaViolation,
+                format!("target '{target}' not declared in manifest"),
+            )
+            .with_hint(format!(
+                "add a `[targets.{target}]` table, or run a declared target"
+            )),
+        );
+        return MarkdownAssembleReport {
+            check: CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: true,
+            },
+            outcomes: Vec::new(),
+            ok: false,
+        };
+    };
+
+    let assemble_steps: Vec<&str> = tc
+        .steps
+        .iter()
+        .filter_map(|s| match s {
+            cph_model::Step::AssembleMarkdown { field } => Some(field.as_str()),
+            _ => None,
+        })
+        .collect();
+
+    if has_error || assemble_steps.is_empty() {
+        return MarkdownAssembleReport {
+            check: CheckReport {
+                diagnostics: dedup(diags),
+                lesson_loaded: true,
+            },
+            outcomes: Vec::new(),
+            ok: false,
+        };
+    }
+
+    // Run each assemble-markdown step. First failure stops the sequence.
+    let mut outcomes = Vec::new();
+    let mut all_ok = true;
+    for field in assemble_steps {
+        let outcome = assemble_one(&lesson, field);
+        let ok = outcome.ok();
+        outcomes.push(outcome);
+        if !ok {
+            all_ok = false;
+            break;
+        }
+    }
+
+    MarkdownAssembleReport {
+        check: CheckReport {
+            diagnostics: dedup(diags),
+            lesson_loaded: true,
+        },
+        outcomes,
+        ok: all_ok,
+    }
+}
+
+/// Assemble one markdown `field` across all parts in order, writing the
+/// single-file artifact.
+fn assemble_one(lesson: &cph_model::Lesson, field: &str) -> MarkdownAssembleOutcome {
+    let mut chunks: Vec<String> = Vec::new();
+    let mut parts_read = 0usize;
+
+    // Inject the course-level title as the document's h1. The title is course
+    // metadata (from `[info]` in the manifest), not per-element content, so the
+    // assembler prepends it; each element's `<field>.md` then contributes its
+    // `##` part heading and `###` 小节. (ADR-0011's "presentation lives in the
+    // content" is about per-element presentation; the single course title is a
+    // document-level fact the assembler owns.)
+    if !lesson.info.title.trim().is_empty() {
+        chunks.push(format!("# {}", lesson.info.title.trim()));
+    }
+
+    for part in &lesson.parts {
+        if !part.descriptor.dir.is_dir() {
+            continue;
+        }
+        let md = part.descriptor.dir.join(format!("{field}.md"));
+        if md.is_file() {
+            match std::fs::read_to_string(&md) {
+                Ok(body) => {
+                    chunks.push(body);
+                    parts_read += 1;
+                }
+                Err(e) => {
+                    return MarkdownAssembleOutcome {
+                        field: field.to_string(),
+                        parts_read,
+                        body: String::new(),
+                        written: None,
+                        error: Some(format!("failed to read '{}': {e}", md.display())),
+                    };
+                }
+            }
+        }
+        // Absent `<field>.md` is fine — the field is optional (ADR-0015).
+    }
+
+    let body = chunks.join("\n\n");
+
+    // Resolve the target's single-file artifact path. (The assemble target is a
+    // single-file artifact by construction; a file-tree target has no single
+    // filepath to write to, which is a manifest error surfaced here.)
+    let tc = lesson.targets.iter().find(|t| {
+        t.steps
+            .iter()
+            .any(|s| matches!(s, cph_model::Step::AssembleMarkdown { field: f } if f == field))
+    });
+    let Some(tc) = tc else {
+        return MarkdownAssembleOutcome {
+            field: field.to_string(),
+            parts_read,
+            body,
+            written: None,
+            error: Some("no target carries this assemble-markdown step".into()),
+        };
+    };
+    let cph_model::Artifact::SingleFile { filepath } = &tc.artifact else {
+        return MarkdownAssembleOutcome {
+            field: field.to_string(),
+            parts_read,
+            body,
+            written: None,
+            error: Some(format!(
+                "target '{}' has a non-single-file artifact; assemble-markdown writes a single file",
+                tc.name
+            )),
+        };
+    };
+
+    let out_path = lesson.root.join(filepath);
+    if let Some(parent) = out_path.parent() {
+        if let Err(e) = std::fs::create_dir_all(parent) {
+            return MarkdownAssembleOutcome {
+                field: field.to_string(),
+                parts_read,
+                body,
+                written: None,
+                error: Some(format!("failed to create '{}': {e}", parent.display())),
+            };
+        }
+    }
+    match std::fs::write(&out_path, &body) {
+        Ok(()) => {
+            // Collect referenced image assets so the build dir is self-contained.
+            // The assembled `body` is written under `build_root` (the artifact
+            // filepath's parent); its `![](rel)` image references resolve against
+            // that build root. So each referenced local image is copied from the
+            // engineering root (`lesson.root/<rel>`) into the build root
+            // (`build_root/<rel>`), preserving its relative path. A referenced
+            // image that is missing at the engineering root is a build-process
+            // error (a self-contained build with a dangling ref is broken) — it
+            // does not enter the 6-class diagnostic taxonomy (ADR-0015).
+            if let Some(build_root) = out_path.parent() {
+                if let Err(e) = collect_image_assets(&lesson.root, build_root, &body) {
+                    return MarkdownAssembleOutcome {
+                        field: field.to_string(),
+                        parts_read,
+                        body,
+                        written: Some(filepath.display().to_string()),
+                        error: Some(e),
+                    };
+                }
+            }
+            MarkdownAssembleOutcome {
+                field: field.to_string(),
+                parts_read,
+                body,
+                written: Some(filepath.display().to_string()),
+                error: None,
+            }
+        }
+        Err(e) => MarkdownAssembleOutcome {
+            field: field.to_string(),
+            parts_read,
+            body,
+            written: None,
+            error: Some(format!("failed to write '{}': {e}", out_path.display())),
+        },
+    }
+}
+
+/// Copy each local markdown image reference in `body` from the engineering root
+/// `eng_root` into the build root `build_root`, preserving the reference's
+/// relative path. Returns `Err(message)` on the first referenced image that is
+/// missing at `eng_root` (a build-process error, ADR-0015).
+///
+/// References are `![alt](target)` markdown images; `target` is taken up to the
+/// first whitespace (a possible ` "title"` suffix is stripped). Absolute URLs
+/// (`http://`, `https://`, `data:`) are left untouched — they are not local
+/// assets to collect. Duplicate references copy once.
+fn collect_image_assets(eng_root: &Path, build_root: &Path, body: &str) -> Result<(), String> {
+    let mut seen: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
+    for target in image_refs(body) {
+        if target.is_empty()
+            || target.starts_with("http://")
+            || target.starts_with("https://")
+            || target.starts_with("data:")
+        {
+            continue;
+        }
+        if !seen.insert(target.to_string()) {
+            continue;
+        }
+        let src = eng_root.join(target);
+        if !src.is_file() {
+            return Err(format!(
+                "slides references image '{}' which is missing from the engineering root",
+                src.display()
+            ));
+        }
+        let dst = build_root.join(target);
+        if let Some(parent) = dst.parent() {
+            if let Err(e) = std::fs::create_dir_all(parent) {
+                return Err(format!("failed to create '{}': {e}", parent.display()));
+            }
+        }
+        if let Err(e) = std::fs::copy(&src, &dst) {
+            return Err(format!("failed to copy '{}' → '{}': {e}", src.display(), dst.display()));
+        }
+    }
+    Ok(())
+}
+
+/// Scan `body` for markdown image references `![alt](target)` and yield each
+/// `target` (whitespace-trimmed of a trailing ` "title"`). Hand-rolled to avoid
+/// pulling a regex dependency for a single, simple pattern.
+fn image_refs(body: &str) -> Vec<&str> {
+    let bytes = body.as_bytes();
+    let mut out = Vec::new();
+    let mut i = 0;
+    while i + 1 < bytes.len() {
+        // Look for the `![` opener.
+        if bytes[i] == b'!' && bytes[i + 1] == b'[' {
+            // Find the matching `]`.
+            if let Some(bracket_close) = body[i + 2..].find(']') {
+                let after_bracket = i + 2 + bracket_close + 1;
+                if after_bracket < bytes.len() && bytes[after_bracket] == b'(' {
+                    // Find the closing `)` of the link target.
+                    if let Some(paren_close) = body[after_bracket + 1..].find(')') {
+                        let target_start = after_bracket + 1;
+                        let target_end = target_start + paren_close;
+                        let target = &body[target_start..target_end];
+                        // Trim a possible ` "title"` suffix: take up to first space.
+                        let target = target.split_whitespace().next().unwrap_or("");
+                        out.push(target);
+                        i = target_end + 1;
+                        continue;
+                    }
+                }
+            }
+        }
+        i += 1;
+    }
+    out
+}
+
+/// Whether the named target is an **assemble-markdown** target (its steps
+/// contain at least one `Step::AssembleMarkdown` and no `Step::TypstCompile`) —
+/// i.e. a markdown deliverable that [`run_markdown_assemble_target`] builds
+/// rather than [`build`] compiling to PDF.
+///
+/// Loads the lesson read-only (ignoring diagnostics); an unloadable lesson or an
+/// unknown target returns `false`, so the caller falls through to the normal
+/// (typst) build path, which then reports the real error.
+pub fn target_is_markdown_assemble(root: &Path, target: &str) -> bool {
+    let (Some(lesson), _) = cph_model::load(root) else {
+        return false;
+    };
+    lesson
+        .targets
+        .iter()
+        .find(|t| t.name == target)
+        .is_some_and(|t| {
+            t.steps
+                .iter()
+                .any(|s| matches!(s, cph_model::Step::AssembleMarkdown { .. }))
+                && !t.steps
+                    .iter()
+                    .any(|s| matches!(s, cph_model::Step::TypstCompile { .. }))
+        })
+}
+
+/// Whether a part's folder exists on disk. cph-model emits `PartPathMissing`
+/// for parts whose folder is absent, so the orchestrator skips those parts in
+/// the structural/schema/coverage phases to avoid piling diagnostics on the
+/// same root cause.
+fn part_exists(p: &cph_model::Part) -> bool {
+    p.descriptor.dir.is_dir()
+}
+
+/// Phases (b) + (c): the known-kind structural check and per-part schema
+/// validation. Shared by [`check`] and [`build`] so their gating stays
+/// identical.
+fn run_structural_and_schema(
+    lesson: &cph_model::Lesson,
+    known: &[&str],
+    diags: &mut Vec<Diagnostic>,
+) {
+    // (b) structural: known-kind check.
+    for part in &lesson.parts {
+        if !part_exists(part) {
+            continue;
+        }
+        if !known.contains(&part.kind.as_str()) {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::UnknownKind,
+                    format!(
+                        "part '{}' has unknown kind '{}'",
+                        part.path.display(),
+                        part.kind
+                    ),
+                )
+                .with_hint(format!("valid kinds are: {}", known.join(", "))),
+            );
+        }
+    }
+
+    // (c) schema: validate each existing part with a known kind. Skipping
+    // unknown kinds avoids a second `UnknownKind` from `cph_schema::validate`
+    // (already reported in (b)).
+    for part in &lesson.parts {
+        if !part_exists(part) || !known.contains(&part.kind.as_str()) {
+            continue;
+        }
+        diags.extend(cph_schema::validate(&part.descriptor));
+    }
+}
+
+/// The targets to compile-check for [`check`]: every declared **typst-compile**
+/// target, or `["student"]` if the lesson declares none.
+///
+/// A target whose steps are all `Shell` (e.g. a tool-generated asset bundle —
+/// ADR-0005 category (b), like the KenKen interactives produced by `kendoku`) is
+/// **not** typst-compiled, so it is excluded here: compile-checking it would
+/// wrongly route a non-typst build through the typst engine. Such targets are
+/// executed only on an explicit `cph build --target <name>` (see
+/// [`run_shell_target`]); `check` validates the lesson structure, not the
+/// outcome of running an external tool.
+fn compile_targets(lesson: &cph_model::Lesson) -> Vec<&str> {
+    if lesson.targets.is_empty() {
+        return vec![DEFAULT_TARGET];
+    }
+    lesson
+        .targets
+        .iter()
+        .filter(|t| t.steps.iter().any(|s| matches!(s, cph_model::Step::TypstCompile { .. })))
+        .map(|t| t.name.as_str())
+        .collect()
+}
+
+/// Phase (e): for each `(part.kind, target)` over the lesson's declared targets,
+/// emit a `RenderIgnored` **warning** when the target does not cover that kind.
+///
+/// Coverage is the per-target **declaration** ADR-0011 pinned (and the spec's
+/// `RenderConfig.covers k t` in `Export/Render.lean`): a target's
+/// `cph_model::TargetConfig::covers` lists the kinds it renders. A used kind not
+/// in that list draws the warning. An **absent** `covers` (the loader's `None`)
+/// is resolved here — the orchestrator owns the kind universe via `cph-schema` —
+/// to "covers all known kinds", so an undeclared target is fully covering rather
+/// than covering nothing. (An explicit `covers = []` stays empty: it covers
+/// nothing on purpose.) Parts already broken in (b) (missing folder / unknown
+/// kind) are skipped — they are reported there.
+fn render_coverage(lesson: &cph_model::Lesson, known: &[&str]) -> Vec<Diagnostic> {
+    let mut out = Vec::new();
+    // De-dupe (kind, target) pairs so we emit one warning per pair, not per part.
+    let mut seen: Vec<(String, String)> = Vec::new();
+
+    for part in &lesson.parts {
+        // Skip parts already flagged structurally.
+        if !part_exists(part) || !known.contains(&part.kind.as_str()) {
+            continue;
+        }
+        for target in &lesson.targets {
+            // Resolve the coverage set: an absent declaration defaults to the
+            // full known-kind universe; an explicit list (possibly empty) is
+            // taken verbatim.
+            let covered = match &target.covers {
+                None => true,
+                Some(kinds) => kinds.iter().any(|k| k == &part.kind),
+            };
+            if covered {
+                continue;
+            }
+            let key = (part.kind.clone(), target.name.clone());
+            if seen.contains(&key) {
+                continue;
+            }
+            seen.push(key);
+            let mut d = Diagnostic::warning(
+                DiagCode::RenderIgnored,
+                format!(
+                    "kind '{}' is not covered by target '{}'; it will be omitted from that export",
+                    part.kind, target.name
+                ),
+            )
+            .with_hint(format!(
+                "add '{}' to `covers` under target '{}', or remove the target",
+                part.kind, target.name
+            ));
+            // Pin the severity via the named contract const. `Diagnostic::warning`
+            // already produces a warning, but assigning the const keeps the
+            // alignment to `renderIgnoredSeverity` load-bearing and greppable.
+            d.severity = RENDER_IGNORED_SEVERITY;
+            out.push(d);
+        }
+    }
+    out
+}
+
+/// Deduplicate diagnostics that are identical (same code+severity+message+span+
+/// hint). The same typst error can surface once per compiled target, and the
+/// same root cause can be reached by more than one phase; callers see each
+/// distinct problem once.
+fn dedup(diags: Vec<Diagnostic>) -> Vec<Diagnostic> {
+    let mut out: Vec<Diagnostic> = Vec::with_capacity(diags.len());
+    for d in diags {
+        if !out.contains(&d) {
+            out.push(d);
+        }
+    }
+    out
+}
diff --git a/crates/cph-check/tests/pipeline.rs b/crates/cph-check/tests/pipeline.rs
new file mode 100644
index 0000000..a834da2
--- /dev/null
+++ b/crates/cph-check/tests/pipeline.rs
@@ -0,0 +1,672 @@
+//! Integration tests for the `cph-check` orchestrator.
+//!
+//! These exercise phase gating and the public API against the shared `mini`
+//! fixture (`crates/cph-typst/tests/fixtures/mini/`) and small throwaway
+//! fixtures built in a temp dir. The typst Engine is pointed at the repo's real
+//! `render/` package via `Engine::with_render_dir`.
+
+use std::path::PathBuf;
+
+use cph_diag::DiagCode;
+use cph_typst::Engine;
+
+/// `<this crate>/../cph-typst/tests/fixtures/mini` — the known-good lesson.
+fn mini_fixture() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .join("cph-typst")
+        .join("tests")
+        .join("fixtures")
+        .join("mini")
+}
+
+/// `<this crate>/../../render` — the repo render package.
+fn render_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .join("..")
+        .join("render")
+}
+
+fn engine() -> Engine {
+    Engine::with_render_dir(render_dir())
+}
+
+#[test]
+fn good_fixture_has_no_errors() {
+    let report = cph_check::check(&mini_fixture(), &engine());
+    assert!(report.lesson_loaded, "mini fixture should load");
+    assert_eq!(
+        report.error_count(),
+        0,
+        "mini fixture should have zero errors, got: {:#?}",
+        report.diagnostics
+    );
+    assert!(!report.has_errors());
+}
+
+#[test]
+fn unknown_kind_is_an_error() {
+    // Build a throwaway lesson whose part declares kind "frob".
+    let tmp = tempdir();
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        r#"
+[project]
+id = "broken"
+name = "broken"
+
+[info]
+title = "broken"
+
+[[parts]]
+kind = "frob"
+path = "elements/widget"
+"#,
+    )
+    .unwrap();
+    let part_dir = tmp.join("elements").join("widget");
+    std::fs::create_dir_all(&part_dir).unwrap();
+    std::fs::write(part_dir.join("element.toml"), "kind = \"frob\"\n").unwrap();
+
+    let report = cph_check::check(&tmp, &engine());
+    assert!(report.lesson_loaded);
+    assert!(report.has_errors());
+    assert!(
+        report
+            .diagnostics
+            .iter()
+            .any(|d| d.code == DiagCode::UnknownKind && d.message.contains("frob")),
+        "expected an UnknownKind error mentioning 'frob', got: {:#?}",
+        report.diagnostics
+    );
+    cleanup(&tmp);
+}
+
+#[test]
+fn hard_manifest_failure_sets_lesson_not_loaded() {
+    let tmp = tempdir();
+    // No manifest.toml at all → cph_model::load returns None.
+    let report = cph_check::check(&tmp, &engine());
+    assert!(!report.lesson_loaded, "missing manifest is a hard failure");
+    assert!(report.has_errors());
+    cleanup(&tmp);
+}
+
+#[test]
+fn build_returns_pdf_on_good_fixture() {
+    let (pdf, report) = cph_check::build(&mini_fixture(), &engine(), "student");
+    assert!(report.lesson_loaded);
+    assert_eq!(
+        report.error_count(),
+        0,
+        "no check errors expected, got: {:#?}",
+        report.diagnostics
+    );
+    let pdf = pdf.expect("expected PDF bytes for the good fixture");
+    assert!(pdf.starts_with(b"%PDF"), "output should be a PDF");
+    assert!(pdf.len() > 1000, "PDF should be non-trivial");
+}
+
+#[test]
+fn build_returns_none_on_broken_fixture() {
+    // A part folder is missing → cph-model flags PartPathMissing (an error),
+    // so build refuses before ever compiling.
+    let tmp = tempdir();
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        r#"
+[project]
+id = "broken"
+name = "broken"
+
+[info]
+title = "broken"
+
+[[parts]]
+kind = "segment"
+path = "segments/does-not-exist"
+"#,
+    )
+    .unwrap();
+
+    let (pdf, report) = cph_check::build(&tmp, &engine(), "student");
+    assert!(pdf.is_none(), "broken lesson must not produce a PDF");
+    assert!(report.has_errors());
+    cleanup(&tmp);
+}
+
+/// Write a throwaway one-segment lesson into `tmp`, with the given `[targets.x]`
+/// body spliced in. Returns nothing; the caller runs `check`.
+fn write_segment_lesson_with_target(tmp: &PathBuf, target_body: &str) {
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        format!(
+            r#"
+[project]
+id = "cov"
+name = "cov"
+
+[info]
+title = "cov"
+
+[[parts]]
+kind = "segment"
+path = "segments/intro"
+
+{target_body}
+"#
+        ),
+    )
+    .unwrap();
+    let part_dir = tmp.join("segments").join("intro");
+    std::fs::create_dir_all(&part_dir).unwrap();
+    std::fs::write(part_dir.join("element.toml"), "kind = \"segment\"\n").unwrap();
+    std::fs::write(part_dir.join("textbook.typ"), "Hello.\n").unwrap();
+}
+
+#[test]
+fn covers_omitting_used_kind_warns_render_ignored() {
+    // A target that declares `covers = ["example"]` does NOT cover the lesson's
+    // `segment` part → exactly one RenderIgnored warning (non-blocking).
+    let tmp = tempdir();
+    write_segment_lesson_with_target(
+        &tmp,
+        r#"[targets.handout]
+artifact = { type = "single-file", filepath = "build/handout.pdf" }
+covers = ["example"]
+[[targets.handout.steps]]
+type = "typst-compile"
+template = "exports/handout.typ"
+"#,
+    );
+
+    let report = cph_check::check(&tmp, &engine());
+    assert!(report.lesson_loaded);
+    let render_ignored: Vec<_> = report
+        .diagnostics
+        .iter()
+        .filter(|d| d.code == DiagCode::RenderIgnored)
+        .collect();
+    assert_eq!(
+        render_ignored.len(),
+        1,
+        "expected exactly one RenderIgnored warning, got: {:#?}",
+        report.diagnostics
+    );
+    // It is a non-blocking warning, so legality is unaffected by it.
+    assert_eq!(
+        report.warning_count(),
+        1,
+        "the coverage gap is a warning: {:#?}",
+        report.diagnostics
+    );
+    cleanup(&tmp);
+}
+
+#[test]
+fn covers_including_used_kind_has_no_render_ignored() {
+    // A target that covers `segment` (the only used kind) → no RenderIgnored.
+    let tmp = tempdir();
+    write_segment_lesson_with_target(
+        &tmp,
+        r#"[targets.handout]
+artifact = { type = "single-file", filepath = "build/handout.pdf" }
+covers = ["segment"]
+[[targets.handout.steps]]
+type = "typst-compile"
+template = "exports/handout.typ"
+"#,
+    );
+
+    let report = cph_check::check(&tmp, &engine());
+    assert!(report.lesson_loaded);
+    assert!(
+        !report
+            .diagnostics
+            .iter()
+            .any(|d| d.code == DiagCode::RenderIgnored),
+        "a covering target should yield no RenderIgnored, got: {:#?}",
+        report.diagnostics
+    );
+    cleanup(&tmp);
+}
+
+#[test]
+fn absent_covers_defaults_to_full_coverage() {
+    // No `covers` key at all → the orchestrator defaults to all known kinds, so
+    // even a non-"student"/"teacher" target name covers `segment`. (This is the
+    // behavior change: coverage now follows the declaration/default, not a
+    // hardcoded target-name allowlist.)
+    let tmp = tempdir();
+    write_segment_lesson_with_target(
+        &tmp,
+        r#"[targets.handout]
+artifact = { type = "single-file", filepath = "build/handout.pdf" }
+[[targets.handout.steps]]
+type = "typst-compile"
+template = "exports/handout.typ"
+"#,
+    );
+
+    let report = cph_check::check(&tmp, &engine());
+    assert!(report.lesson_loaded);
+    assert!(
+        !report
+            .diagnostics
+            .iter()
+            .any(|d| d.code == DiagCode::RenderIgnored),
+        "an absent `covers` defaults to full coverage, got: {:#?}",
+        report.diagnostics
+    );
+    cleanup(&tmp);
+}
+
+/// Write a one-segment lesson with a `file-tree` shell target whose `run` is the
+/// given command. Returns nothing; the caller runs `run_shell_target`.
+fn write_shell_target_lesson(tmp: &PathBuf, run: &str) {
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        format!(
+            r#"
+[project]
+id = "sh"
+name = "sh"
+
+[info]
+title = "sh"
+
+[[parts]]
+kind = "segment"
+path = "segments/intro"
+
+[targets.assets]
+artifact = {{ type = "file-tree", root = "build/assets", outputs = "**/*" }}
+[[targets.assets.steps]]
+type = "shell"
+run = "{run}"
+"#
+        ),
+    )
+    .unwrap();
+    let part_dir = tmp.join("segments").join("intro");
+    std::fs::create_dir_all(&part_dir).unwrap();
+    std::fs::write(part_dir.join("element.toml"), "kind = \"segment\"\n").unwrap();
+    std::fs::write(part_dir.join("textbook.typ"), "Hi.\n").unwrap();
+}
+
+#[test]
+fn target_is_shell_detects_shape() {
+    let tmp = tempdir();
+    write_shell_target_lesson(&tmp, "true");
+    assert!(cph_check::target_is_shell(&tmp, "assets"));
+    assert!(!cph_check::target_is_shell(&tmp, "nonexistent"));
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_shell_target_executes_in_engineering_root() {
+    // The command writes a file under the engineering root; cwd must be the root.
+    let tmp = tempdir();
+    write_shell_target_lesson(
+        &tmp,
+        "mkdir -p build/assets && printf ok > build/assets/marker.txt",
+    );
+
+    let report = cph_check::run_shell_target(&tmp, &engine(), "assets");
+    assert!(report.ok, "shell target should succeed: {:#?}", report);
+    assert_eq!(report.outcomes.len(), 1);
+    assert!(report.outcomes[0].ok());
+
+    // The side effect landed in the engineering root.
+    let marker = tmp.join("build").join("assets").join("marker.txt");
+    assert_eq!(std::fs::read_to_string(&marker).unwrap(), "ok");
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_shell_target_reports_nonzero_exit() {
+    let tmp = tempdir();
+    write_shell_target_lesson(&tmp, "exit 3");
+
+    let report = cph_check::run_shell_target(&tmp, &engine(), "assets");
+    assert!(!report.ok, "non-zero exit must fail the run");
+    assert_eq!(report.outcomes.len(), 1);
+    assert_eq!(report.outcomes[0].status, Some(3));
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_shell_target_refuses_broken_lesson() {
+    // A part path that doesn't exist → check error → shell steps never run.
+    let tmp = tempdir();
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        r#"
+[project]
+id = "sh"
+name = "sh"
+
+[info]
+title = "sh"
+
+[[parts]]
+kind = "segment"
+path = "segments/missing"
+
+[targets.assets]
+artifact = { type = "file-tree", root = "build/assets", outputs = "**/*" }
+[[targets.assets.steps]]
+type = "shell"
+run = "printf SHOULD_NOT_RUN > build/ran.txt"
+"#,
+    )
+    .unwrap();
+
+    let report = cph_check::run_shell_target(&tmp, &engine(), "assets");
+    assert!(!report.ok);
+    assert!(report.outcomes.is_empty(), "no command should run on a broken lesson");
+    assert!(report.check.has_errors());
+    assert!(
+        !tmp.join("build").join("ran.txt").exists(),
+        "the command must not have executed"
+    );
+    cleanup(&tmp);
+}
+
+// --- assemble-markdown target (ADR-0015) ---------------------------------------
+
+/// Write a two-segment lesson where each segment carries a `slides.md` markdown
+/// content file, plus a `slides` target that assembles them. The `which` slice
+/// controls which segments get a `slides.md` (so the "skip absent" path can be
+/// exercised). Returns nothing; the caller runs `run_markdown_assemble_target`.
+fn write_markdown_assemble_target_lesson(tmp: &PathBuf, slides: &[(&str, &str)]) {
+    let mut parts = String::new();
+    for (i, (name, _)) in slides.iter().enumerate() {
+        if i > 0 {
+            parts.push('\n');
+        }
+        parts.push_str(&format!(
+            "[[parts]]\nkind = \"segment\"\npath = \"segments/{name}\"\n"
+        ));
+    }
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        format!(
+            r#"
+[project]
+id = "md"
+name = "md"
+
+[info]
+title = "md"
+
+{parts}
+
+[targets.slides]
+artifact = {{ type = "single-file", filepath = "build/slides.md" }}
+[[targets.slides.steps]]
+type = "assemble-markdown"
+field = "slides"
+"#
+        ),
+    )
+    .unwrap();
+    for (name, body) in slides {
+        let dir = tmp.join("segments").join(name);
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("element.toml"), "kind = \"segment\"\n").unwrap();
+        std::fs::write(dir.join("textbook.typ"), "text.\n").unwrap();
+        std::fs::write(dir.join("slides.md"), body).unwrap();
+    }
+}
+
+#[test]
+fn target_is_markdown_assemble_detects_shape() {
+    let tmp = tempdir();
+    write_markdown_assemble_target_lesson(
+        &tmp,
+        &[("a", "# A"), ("b", "# B")],
+    );
+    assert!(cph_check::target_is_markdown_assemble(&tmp, "slides"));
+    // The student target doesn't exist here → falls through to typst path → false.
+    assert!(!cph_check::target_is_markdown_assemble(&tmp, "student"));
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_markdown_assemble_target_concatenates_in_parts_order() {
+    let tmp = tempdir();
+    write_markdown_assemble_target_lesson(
+        &tmp,
+        &[("intro", "# 规则一\n- 范围"), ("rule2", "# 规则二\n$8\\times$")],
+    );
+
+    let report = cph_check::run_markdown_assemble_target(&tmp, &engine(), "slides");
+    assert!(report.ok, "assembly should succeed: {:#?}", report);
+    assert_eq!(report.outcomes.len(), 1);
+    let o = &report.outcomes[0];
+    assert!(o.ok());
+    assert_eq!(o.parts_read, 2);
+    assert_eq!(o.field, "slides");
+
+    let out = tmp.join("build").join("slides.md");
+    let body = std::fs::read_to_string(&out).unwrap();
+    // Both parts present, in declared order, joined by a blank line.
+    let intro_idx = body.find("规则一").unwrap();
+    let rule2_idx = body.find("规则二").unwrap();
+    assert!(intro_idx < rule2_idx, "parts must keep manifest order");
+    assert!(body.contains("$8\\times$"), "KaTeX source survives as text");
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_markdown_assemble_target_skips_parts_without_the_field() {
+    // Only the first segment has a slides.md; the second is skipped (optional).
+    let tmp = tempdir();
+    let mut parts = String::new();
+    parts.push_str("[[parts]]\nkind = \"segment\"\npath = \"segments/a\"\n\n");
+    parts.push_str("[[parts]]\nkind = \"segment\"\npath = \"segments/b\"\n");
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        format!(
+            r#"
+[project]
+id = "md"
+name = "md"
+
+[info]
+title = "md"
+
+{parts}
+
+[targets.slides]
+artifact = {{ type = "single-file", filepath = "build/slides.md" }}
+[[targets.slides.steps]]
+type = "assemble-markdown"
+field = "slides"
+"#
+        ),
+    )
+    .unwrap();
+    for name in ["a", "b"] {
+        let dir = tmp.join("segments").join(name);
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("element.toml"), "kind = \"segment\"\n").unwrap();
+        std::fs::write(dir.join("textbook.typ"), "text.\n").unwrap();
+    }
+    // Only `a` gets a slides.md.
+    std::fs::write(tmp.join("segments/a/slides.md"), "# A only\n").unwrap();
+
+    let report = cph_check::run_markdown_assemble_target(&tmp, &engine(), "slides");
+    assert!(report.ok, "{:#?}", report);
+    assert_eq!(report.outcomes[0].parts_read, 1);
+    let body = std::fs::read_to_string(tmp.join("build/slides.md")).unwrap();
+    // The assembler prepends the course title (info.title = "md") as an h1,
+    // then the single part's slides.md.
+    assert_eq!(body, "# md\n\n# A only\n");
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_markdown_assemble_target_copies_referenced_images() {
+    // A slides.md that references two local images; both must be copied from
+    // the engineering root into the build root (same relative path) so the
+    // build dir is self-contained (ADR-0015).
+    let tmp = tempdir();
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        r#"
+[project]
+id = "md"
+name = "md"
+
+[info]
+title = "md"
+
+[[parts]]
+kind = "segment"
+path = "segments/a"
+
+[targets.slides]
+artifact = { type = "single-file", filepath = "build/slides.md" }
+[[targets.slides.steps]]
+type = "assemble-markdown"
+field = "slides"
+"#,
+    )
+    .unwrap();
+    let dir = tmp.join("segments").join("a");
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("element.toml"), "kind = \"segment\"\n").unwrap();
+    std::fs::write(dir.join("textbook.typ"), "text.\n").unwrap();
+    std::fs::write(
+        dir.join("slides.md"),
+        "## A\n\n![one](assets/img/one.png)\n\n![two](assets/img/two.png)\n",
+    )
+    .unwrap();
+    // The two referenced images exist at the engineering root.
+    std::fs::create_dir_all(tmp.join("assets/img")).unwrap();
+    std::fs::write(tmp.join("assets/img/one.png"), b"PNG1").unwrap();
+    std::fs::write(tmp.join("assets/img/two.png"), b"PNG2").unwrap();
+
+    let report = cph_check::run_markdown_assemble_target(&tmp, &engine(), "slides");
+    assert!(report.ok, "{:#?}", report);
+
+    // Both images copied into the build root, preserving the assets/img/ path.
+    assert_eq!(
+        std::fs::read(tmp.join("build/assets/img/one.png")).unwrap(),
+        b"PNG1"
+    );
+    assert_eq!(
+        std::fs::read(tmp.join("build/assets/img/two.png")).unwrap(),
+        b"PNG2"
+    );
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_markdown_assemble_target_fails_on_missing_referenced_image() {
+    // A slides.md references an image that does NOT exist at the engineering
+    // root → a build-process error (self-contained build would be broken),
+    // not a lesson diagnostic.
+    let tmp = tempdir();
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        r#"
+[project]
+id = "md"
+name = "md"
+
+[info]
+title = "md"
+
+[[parts]]
+kind = "segment"
+path = "segments/a"
+
+[targets.slides]
+artifact = { type = "single-file", filepath = "build/slides.md" }
+[[targets.slides.steps]]
+type = "assemble-markdown"
+field = "slides"
+"#,
+    )
+    .unwrap();
+    let dir = tmp.join("segments").join("a");
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("element.toml"), "kind = \"segment\"\n").unwrap();
+    std::fs::write(dir.join("textbook.typ"), "text.\n").unwrap();
+    std::fs::write(
+        dir.join("slides.md"),
+        "## A\n\n![ghost](assets/img/ghost.png)\n",
+    )
+    .unwrap();
+    // No image created → reference is dangling.
+
+    let report = cph_check::run_markdown_assemble_target(&tmp, &engine(), "slides");
+    assert!(!report.ok, "a missing referenced image must fail the build");
+    let o = &report.outcomes[0];
+    assert!(o.error.as_deref().unwrap_or("").contains("ghost.png"));
+    // The markdown was still written, but the image was not (it doesn't exist).
+    assert!(tmp.join("build/slides.md").is_file());
+    cleanup(&tmp);
+}
+
+#[test]
+fn run_markdown_assemble_target_refuses_broken_lesson() {
+    // A part path that doesn't exist → check error → assembly never runs.
+    let tmp = tempdir();
+    std::fs::write(
+        tmp.join("manifest.toml"),
+        r#"
+[project]
+id = "md"
+name = "md"
+
+[info]
+title = "md"
+
+[[parts]]
+kind = "segment"
+path = "segments/missing"
+
+[targets.slides]
+artifact = { type = "single-file", filepath = "build/slides.md" }
+[[targets.slides.steps]]
+type = "assemble-markdown"
+field = "slides"
+"#,
+    )
+    .unwrap();
+
+    let report = cph_check::run_markdown_assemble_target(&tmp, &engine(), "slides");
+    assert!(!report.ok);
+    assert!(report.outcomes.is_empty(), "no assembly on a broken lesson");
+    assert!(report.check.has_errors());
+    assert!(
+        !tmp.join("build").join("slides.md").exists(),
+        "nothing should have been written"
+    );
+    cleanup(&tmp);
+}
+
+// --- tiny temp-dir helpers (no external dev-dep) ------------------------------
+
+fn tempdir() -> PathBuf {
+    let mut p = std::env::temp_dir();
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    p.push(format!(
+        "cph-check-test-{nanos}-{:?}",
+        std::thread::current().id()
+    ));
+    std::fs::create_dir_all(&p).unwrap();
+    p
+}
+
+fn cleanup(p: &PathBuf) {
+    let _ = std::fs::remove_dir_all(p);
+}
diff --git a/crates/cph-cli/Cargo.toml b/crates/cph-cli/Cargo.toml
new file mode 100644
index 0000000..ba6f955
--- /dev/null
+++ b/crates/cph-cli/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "cph-cli"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[[bin]]
+name = "cph"
+path = "src/main.rs"
+
+[dependencies]
+cph-check = { path = "../cph-check" }
+cph-diag = { workspace = true }
+cph-typst = { path = "../cph-typst" }
+clap = { version = "4", features = ["derive"] }
diff --git a/crates/cph-cli/src/main.rs b/crates/cph-cli/src/main.rs
new file mode 100644
index 0000000..10a0936
--- /dev/null
+++ b/crates/cph-cli/src/main.rs
@@ -0,0 +1,231 @@
+//! `cph` — the command-line entrypoint for the checker.
+//!
+//! Owned by **WU-5**. Parses args, constructs the typst [`Engine`], runs the
+//! `cph-check` pipeline against an engineering file, and prints diagnostics.
+//!
+//! Convention: **diagnostics go to stderr, results go to stdout.** `check`
+//! exits 1 when there is any `Error`-severity diagnostic (warnings alone exit
+//! 0); `build` exits 1 when the PDF could not be produced.
+
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use clap::{Parser, Subcommand};
+use cph_check::CheckReport;
+use cph_typst::Engine;
+
+/// The `cph` checker for curriculum engineering files.
+#[derive(Debug, Parser)]
+#[command(name = "cph", version, about, long_about = None)]
+struct Cli {
+    /// Override the `cph-render` package directory (the folder containing
+    /// `lib.typ` / `typst.toml`). Defaults to the engine's own resolution
+    /// (`CPH_RENDER_DIR` env var, else the repo `render/`).
+    #[arg(long, global = true, value_name = "DIR")]
+    render_dir: Option<PathBuf>,
+
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Debug, Subcommand)]
+enum Command {
+    /// Run the full check pipeline and print diagnostics. Exits 1 on any error.
+    Check {
+        /// Path to the engineering-file root (the folder with `manifest.toml`).
+        path: PathBuf,
+    },
+    /// Build a PDF for a render target. Exits 1 if the build fails.
+    Build {
+        /// Path to the engineering-file root (the folder with `manifest.toml`).
+        path: PathBuf,
+        /// Render target to export.
+        #[arg(long, default_value = "student")]
+        target: String,
+        /// Output PDF path. Defaults to `<PATH>/build/<target>.pdf`.
+        #[arg(short = 'o', long, value_name = "OUT")]
+        out: Option<PathBuf>,
+    },
+}
+
+fn main() -> ExitCode {
+    let cli = Cli::parse();
+
+    let engine = match &cli.render_dir {
+        Some(dir) => Engine::with_render_dir(dir.clone()),
+        None => Engine::new(),
+    };
+
+    match cli.command {
+        Command::Check { path } => run_check(&path, &engine),
+        Command::Build { path, target, out } => run_build(&path, &engine, &target, out),
+    }
+}
+
+/// Print every diagnostic in `report` to stderr, followed by a summary line.
+fn print_diagnostics(report: &CheckReport) {
+    for d in &report.diagnostics {
+        eprintln!("{d}");
+    }
+    eprintln!(
+        "{} error{}, {} warning{}",
+        report.error_count(),
+        plural(report.error_count()),
+        report.warning_count(),
+        plural(report.warning_count()),
+    );
+}
+
+fn plural(n: usize) -> &'static str {
+    if n == 1 {
+        ""
+    } else {
+        "s"
+    }
+}
+
+fn run_check(path: &std::path::Path, engine: &Engine) -> ExitCode {
+    let report = cph_check::check(path, engine);
+    print_diagnostics(&report);
+
+    if report.has_errors() {
+        ExitCode::FAILURE
+    } else {
+        println!("check passed: {}", path.display());
+        ExitCode::SUCCESS
+    }
+}
+
+fn run_build(
+    path: &std::path::Path,
+    engine: &Engine,
+    target: &str,
+    out: Option<PathBuf>,
+) -> ExitCode {
+    // A target whose steps are shell commands (a tool-generated asset bundle,
+    // ADR-0009 category (b) — e.g. KenKen interactives via `kendoku`) is run by
+    // executing those commands, not by compiling a typst template. Detect that
+    // shape up front and route accordingly.
+    if cph_check::target_is_shell(path, target) {
+        return run_shell_build(path, engine, target);
+    }
+
+    // A target whose steps assemble markdown (ADR-0015: slides outline / 逐字稿
+    // transcript surfaces) is built by concatenating per-element `<field>.md`
+    // files in parts order, not by compiling a typst template.
+    if cph_check::target_is_markdown_assemble(path, target) {
+        return run_markdown_assemble_build(path, engine, target);
+    }
+
+    let out_path = out.unwrap_or_else(|| path.join("build").join(format!("{target}.pdf")));
+
+    let (pdf, report) = cph_check::build(path, engine, target);
+    print_diagnostics(&report);
+
+    match pdf {
+        Some(bytes) => {
+            if let Some(parent) = out_path.parent() {
+                if let Err(e) = std::fs::create_dir_all(parent) {
+                    eprintln!(
+                        "error: cannot create output directory '{}': {e}",
+                        parent.display()
+                    );
+                    return ExitCode::FAILURE;
+                }
+            }
+            if let Err(e) = std::fs::write(&out_path, &bytes) {
+                eprintln!("error: cannot write '{}': {e}", out_path.display());
+                return ExitCode::FAILURE;
+            }
+            println!("wrote {} ({} bytes)", out_path.display(), bytes.len());
+            ExitCode::SUCCESS
+        }
+        None => {
+            eprintln!("build failed: {} errors", report.error_count());
+            ExitCode::FAILURE
+        }
+    }
+}
+
+/// Run a shell-step target: execute its declared commands in the engineering
+/// root. Arbitrary command execution is **opt-in** — it only happens on an
+/// explicit `cph build --target <name>`, and each command is printed before it
+/// runs so the user sees exactly what is executed.
+fn run_shell_build(path: &std::path::Path, engine: &Engine, target: &str) -> ExitCode {
+    eprintln!("running shell-step target '{target}' (commands execute in {})", path.display());
+    let report = cph_check::run_shell_target(path, engine, target);
+    print_diagnostics(&report.check);
+
+    if report.outcomes.is_empty() && !report.ok {
+        // Refused before running anything (check errors / unknown target / no
+        // shell steps): the diagnostics above explain why.
+        if report.check.has_errors() {
+            eprintln!("build refused: {} errors (fix the lesson first)", report.check.error_count());
+        } else {
+            eprintln!("build failed: target '{target}' has no shell steps to run");
+        }
+        return ExitCode::FAILURE;
+    }
+
+    for outcome in &report.outcomes {
+        eprintln!("$ {}", outcome.run);
+        if !outcome.stdout.trim().is_empty() {
+            print!("{}", outcome.stdout);
+        }
+        if !outcome.ok() {
+            eprint!("{}", outcome.stderr);
+            eprintln!(
+                "step failed (exit {})",
+                outcome.status.map(|c| c.to_string()).unwrap_or_else(|| "signal".into())
+            );
+        }
+    }
+
+    if report.ok {
+        println!("shell-step target '{target}' completed: {} step(s) ok", report.outcomes.len());
+        ExitCode::SUCCESS
+    } else {
+        eprintln!("shell-step target '{target}' failed");
+        ExitCode::FAILURE
+    }
+}
+
+/// Run an assemble-markdown target: concatenate each element's `<field>.md`
+/// (in parts order) and write the single-file artifact (ADR-0015). Like the
+/// shell path, this is opt-in — only on an explicit `cph build --target <name>`,
+/// and never in `check`.
+fn run_markdown_assemble_build(path: &std::path::Path, engine: &Engine, target: &str) -> ExitCode {
+    eprintln!("assembling markdown target '{target}' (reading parts under {})", path.display());
+    let report = cph_check::run_markdown_assemble_target(path, engine, target);
+    print_diagnostics(&report.check);
+
+    if report.outcomes.is_empty() && !report.ok {
+        if report.check.has_errors() {
+            eprintln!("build refused: {} errors (fix the lesson first)", report.check.error_count());
+        } else {
+            eprintln!("build failed: target '{target}' has no assemble-markdown steps to run");
+        }
+        return ExitCode::FAILURE;
+    }
+
+    for outcome in &report.outcomes {
+        eprintln!(
+            "assembled field '{}' from {} part(s)",
+            outcome.field, outcome.parts_read
+        );
+        if let Some(out_rel) = &outcome.written {
+            println!("wrote {} ({} bytes)", path.join(out_rel).display(), outcome.body.len());
+        }
+        if let Some(err) = &outcome.error {
+            eprintln!("assemble failed: {err}");
+        }
+    }
+
+    if report.ok {
+        println!("assemble-markdown target '{target}' completed: {} step(s) ok", report.outcomes.len());
+        ExitCode::SUCCESS
+    } else {
+        eprintln!("assemble-markdown target '{target}' failed");
+        ExitCode::FAILURE
+    }
+}
diff --git a/crates/cph-diag/Cargo.toml b/crates/cph-diag/Cargo.toml
new file mode 100644
index 0000000..fe44e86
--- /dev/null
+++ b/crates/cph-diag/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "cph-diag"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+serde = { workspace = true }
diff --git a/crates/cph-diag/src/lib.rs b/crates/cph-diag/src/lib.rs
new file mode 100644
index 0000000..d7d7224
--- /dev/null
+++ b/crates/cph-diag/src/lib.rs
@@ -0,0 +1,277 @@
+//! `cph-diag` — the shared diagnostic vocabulary for the checker.
+//!
+//! Every other crate in the workspace depends on these types to report
+//! problems. The vocabulary is intentionally small and stable: a [`Severity`]
+//! (mirroring the Lean master), a closed set of machine-stable [`DiagCode`]s, an
+//! optional [`SourceSpan`] pointing back at the offending source, and a
+//! [`Diagnostic`] tying them together with a human message and a fix hint.
+//!
+//! All public types derive `Serialize` (downstream prints diagnostics as JSON),
+//! plus `Debug`, `Clone`, `PartialEq`, `Eq`.
+
+use std::fmt;
+use std::ops::Range;
+use std::path::PathBuf;
+
+use serde::Serialize;
+
+/// Severity of a diagnostic.
+///
+/// **Mirrors `Spec.Courseware.Diagnostic.Severity`** in the Lean semantic
+/// master (`spec/Spec/Courseware/Check/Diagnostic.lean`), whose definition is
+/// exactly:
+///
+/// ```text
+/// inductive Severity where
+///   | warning
+///   | error
+/// ```
+///
+/// This two-valued shape is a **contract decision**, not an accident: the Lean
+/// module pins `Severity` to exactly `warning | error` and states the finer
+/// levels (`info` / `hint` / `note`) are deliberately undecided. We therefore
+/// do **not** add an info/note level here. `error` blocks (the artifact is
+/// invalid); `warning` does not block (the artifact still exports, but with
+/// loss / an ignored element — e.g. ADR-0005's "missing render ⇒ warning").
+///
+/// There is no CI gate enforcing this alignment (see the repo constitution);
+/// it is maintained by review, which is why this correspondence is documented
+/// here rather than only in the spec.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub enum Severity {
+    /// Non-blocking: the artifact still exports, but is lossy / has an ignored
+    /// element. Mirrors Lean `Severity.warning`.
+    Warning,
+    /// Blocking: the artifact is invalid. Mirrors Lean `Severity.error`.
+    Error,
+}
+
+/// A location in a source file within the engineering-file tree.
+///
+/// `file` is relative to the engineering-file root so spans are portable and
+/// diffable. `line` / `col` are 1-based (as editors display them); `byte_range`
+/// is a 0-based byte offset range into the file.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct SourceSpan {
+    /// Path to the file, relative to the engineering-file root.
+    pub file: PathBuf,
+    /// Byte offset range into the file (0-based).
+    pub byte_range: Range<usize>,
+    /// 1-based line number.
+    pub line: u32,
+    /// 1-based column number.
+    pub col: u32,
+}
+
+/// Stable, machine-readable diagnostic codes.
+///
+/// This set is **closed**: codes are part of the checker's public contract, so
+/// downstream tooling can match on the string form (see [`DiagCode::as_str`]).
+/// Do not invent codes outside this enum without a deliberate decision.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub enum DiagCode {
+    /// A `[[parts]]` entry references a folder/path that does not exist.
+    PartPathMissing,
+    /// An element declares a `kind` that is not a known kind.
+    UnknownKind,
+    /// A required `content` `.typ` file (per the kind schema) is missing.
+    MissingContentFile,
+    /// Instance data does not conform to its kind's JSON Schema.
+    SchemaViolation,
+    /// The assembled typst source failed to compile.
+    ///
+    /// Includes **reference-resolution** failures — an unresolved cross-reference
+    /// (`@ref`) or a relative `import`/`include` that escapes the import boundary
+    /// or names a missing file. typst detects all of these at compile time, so
+    /// they surface here rather than as a separate diagnostic (ADR-0012 folded
+    /// the former `DanglingReference` class into this one).
+    TypstCompile,
+    /// An element is ignored under a render target (ADR-0005: warning).
+    RenderIgnored,
+}
+
+impl DiagCode {
+    /// The stable string form of this code, e.g. `"E-PART-PATH"`.
+    ///
+    /// The `E-` / `W-` prefix reflects the *typical* severity of the code but
+    /// is not authoritative — the actual severity lives on the [`Diagnostic`].
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            DiagCode::PartPathMissing => "E-PART-PATH",
+            DiagCode::UnknownKind => "E-UNKNOWN-KIND",
+            DiagCode::MissingContentFile => "E-MISSING-CONTENT",
+            DiagCode::SchemaViolation => "E-SCHEMA",
+            DiagCode::TypstCompile => "E-TYPST-COMPILE",
+            DiagCode::RenderIgnored => "W-RENDER-IGNORED",
+        }
+    }
+}
+
+impl fmt::Display for DiagCode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+/// A single diagnostic emitted by the checker.
+///
+/// Construct via [`Diagnostic::error`] / [`Diagnostic::warning`] and attach an
+/// optional [`SourceSpan`] / hint with the builder methods
+/// [`Diagnostic::with_span`] / [`Diagnostic::with_hint`].
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Diagnostic {
+    /// How serious this diagnostic is.
+    pub severity: Severity,
+    /// The stable machine code.
+    pub code: DiagCode,
+    /// Human-readable message.
+    pub message: String,
+    /// Optional location this diagnostic points at.
+    pub span: Option<SourceSpan>,
+    /// Optional fix hint — the product's core value.
+    pub hint: Option<String>,
+}
+
+impl Diagnostic {
+    /// Create an `error`-severity diagnostic.
+    pub fn error(code: DiagCode, message: impl Into<String>) -> Self {
+        Diagnostic {
+            severity: Severity::Error,
+            code,
+            message: message.into(),
+            span: None,
+            hint: None,
+        }
+    }
+
+    /// Create a `warning`-severity diagnostic.
+    pub fn warning(code: DiagCode, message: impl Into<String>) -> Self {
+        Diagnostic {
+            severity: Severity::Warning,
+            code,
+            message: message.into(),
+            span: None,
+            hint: None,
+        }
+    }
+
+    /// Attach a source span (builder-style).
+    pub fn with_span(mut self, span: SourceSpan) -> Self {
+        self.span = Some(span);
+        self
+    }
+
+    /// Attach a fix hint (builder-style).
+    pub fn with_hint(mut self, hint: impl Into<String>) -> Self {
+        self.hint = Some(hint.into());
+        self
+    }
+}
+
+impl fmt::Display for Severity {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Severity::Warning => "warning",
+            Severity::Error => "error",
+        })
+    }
+}
+
+impl fmt::Display for Diagnostic {
+    /// Renders one line `error[E-PART-PATH]: <msg>`, plus an indented
+    /// `--> file:line:col` line when a span is present, and a `hint: ...` line
+    /// when a hint is present.
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}[{}]: {}", self.severity, self.code, self.message)?;
+        if let Some(span) = &self.span {
+            write!(
+                f,
+                "\n  --> {}:{}:{}",
+                span.file.display(),
+                span.line,
+                span.col
+            )?;
+        }
+        if let Some(hint) = &self.hint {
+            write!(f, "\n  hint: {hint}")?;
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn code_as_str_is_stable() {
+        assert_eq!(DiagCode::PartPathMissing.as_str(), "E-PART-PATH");
+        assert_eq!(DiagCode::RenderIgnored.as_str(), "W-RENDER-IGNORED");
+        assert_eq!(DiagCode::SchemaViolation.as_str(), "E-SCHEMA");
+        // Display matches as_str.
+        assert_eq!(DiagCode::UnknownKind.to_string(), "E-UNKNOWN-KIND");
+    }
+
+    #[test]
+    fn error_constructor() {
+        let d = Diagnostic::error(DiagCode::UnknownKind, "no such kind 'frob'");
+        assert_eq!(d.severity, Severity::Error);
+        assert_eq!(d.code, DiagCode::UnknownKind);
+        assert_eq!(d.message, "no such kind 'frob'");
+        assert!(d.span.is_none());
+        assert!(d.hint.is_none());
+    }
+
+    #[test]
+    fn warning_constructor() {
+        let d = Diagnostic::warning(DiagCode::RenderIgnored, "ignored under 'teacher'");
+        assert_eq!(d.severity, Severity::Warning);
+        assert_eq!(d.code, DiagCode::RenderIgnored);
+    }
+
+    #[test]
+    fn builders_attach_span_and_hint() {
+        let span = SourceSpan {
+            file: PathBuf::from("segments/intro/textbook.typ"),
+            byte_range: 10..20,
+            line: 3,
+            col: 5,
+        };
+        let d = Diagnostic::error(DiagCode::TypstCompile, "unclosed bracket")
+            .with_span(span.clone())
+            .with_hint("close the '[' opened on line 2");
+        assert_eq!(d.span, Some(span));
+        assert_eq!(d.hint.as_deref(), Some("close the '[' opened on line 2"));
+    }
+
+    #[test]
+    fn display_bare() {
+        let d = Diagnostic::error(DiagCode::PartPathMissing, "folder not found");
+        assert_eq!(d.to_string(), "error[E-PART-PATH]: folder not found");
+    }
+
+    #[test]
+    fn display_with_span_and_hint() {
+        let d = Diagnostic::error(DiagCode::PartPathMissing, "folder not found")
+            .with_span(SourceSpan {
+                file: PathBuf::from("manifest.toml"),
+                byte_range: 0..0,
+                line: 12,
+                col: 3,
+            })
+            .with_hint("create the folder 'segments/intro' or fix the path");
+        assert_eq!(
+            d.to_string(),
+            "error[E-PART-PATH]: folder not found\n  --> manifest.toml:12:3\n  hint: create the folder 'segments/intro' or fix the path"
+        );
+    }
+
+    #[test]
+    fn display_warning() {
+        let d = Diagnostic::warning(DiagCode::RenderIgnored, "ignored under 'teacher'");
+        assert_eq!(
+            d.to_string(),
+            "warning[W-RENDER-IGNORED]: ignored under 'teacher'"
+        );
+    }
+}
diff --git a/crates/cph-model/Cargo.toml b/crates/cph-model/Cargo.toml
new file mode 100644
index 0000000..145ca5c
--- /dev/null
+++ b/crates/cph-model/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "cph-model"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+cph-diag = { workspace = true }
+serde = { workspace = true }
+# `preserve_order` keeps `[targets.*]` tables in TOML document order, which is
+# the declared order this crate exposes via `Lesson.targets` (ADR-0009).
+toml = { workspace = true, features = ["preserve_order"] }
diff --git a/crates/cph-model/src/lib.rs b/crates/cph-model/src/lib.rs
new file mode 100644
index 0000000..b3c4d10
--- /dev/null
+++ b/crates/cph-model/src/lib.rs
@@ -0,0 +1,1028 @@
+//! `cph-model` — load the ADR-0008 declarative layout into an in-memory lesson.
+//!
+//! This crate is the **loader**, not the full checker. It reads
+//! `<root>/manifest.toml` (project / info / ordered `[[parts]]` / declared
+//! `[targets.*]`) and each part's `<root>/<path>/element.toml`, and produces an
+//! ordered [`Lesson`] — mirroring the Lean master's `Lesson = List (Element P)`
+//! (`spec/Spec/Courseware/Model/Lesson.lean`), where the order of `parts` carries
+//! teaching semantics.
+//!
+//! Scope boundaries (deliberately staying in lane):
+//! - It validates **structure** only: manifest shape, element.toml shape, and
+//!   the cross-check `part.kind == element.toml kind`.
+//! - It does **not** validate instance data against a kind's JSON Schema (that
+//!   is WU-3 / `cph-schema`), does **not** check that `content` `.typ` files
+//!   exist (also schema-driven, WU-3), and does **not** compile typst (WU-4).
+//!
+//! Entry point: [`load`].
+
+use std::path::{Component, Path, PathBuf};
+
+use cph_diag::{DiagCode, Diagnostic};
+use serde::{Deserialize, Serialize};
+
+/// An ordered, in-memory lesson loaded from an engineering file.
+///
+/// Mirrors the Lean master's `Lesson = List (Element P)`: `parts` is an ordered
+/// `Vec`, and that order is the lesson's order (ADR-0008 §"the lesson manifest
+/// is declarative" — the `[[parts]]` array order is the single source of truth).
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct Lesson {
+    /// `[project]` from the manifest (id, name).
+    pub project: Project,
+    /// `[info]` from the manifest (title, optional author).
+    pub info: Info,
+    /// The ordered parts — the lesson's element sequence.
+    pub parts: Vec<Part>,
+    /// Declared export targets, collected from the `[targets.<name>]` tables.
+    ///
+    /// Per ADR-0009/0011 an export target is a *build* producing a typed
+    /// [`Artifact`] via an ordered list of typed [`Step`]s. This carries those
+    /// in declared (TOML document) order. See [`TargetConfig`].
+    pub targets: Vec<TargetConfig>,
+    /// Engineering-file root (absolute), for resolving part paths.
+    pub root: PathBuf,
+}
+
+impl Lesson {
+    /// The declared export-target names, in declared order.
+    ///
+    /// Convenience for callers that only need the names (the shape this crate
+    /// exposed before ADR-0009 turned `targets` into structured
+    /// [`TargetConfig`]s).
+    pub fn target_names(&self) -> Vec<&str> {
+        self.targets.iter().map(|t| t.name.as_str()).collect()
+    }
+}
+
+/// One declared export target's build config (ADR-0009/0011).
+///
+/// An export target is a **build** producing a typed [`Artifact`] via an
+/// **ordered** list of typed [`Step`]s. ADR-0011 fixed the *shape* of that
+/// build: the artifact carries fields (where the product lands / which files it
+/// is), and the build is a step list, each step a typed operation. Presentation
+/// (heading numbering, styling) lives in the `typstCompile` template file, not
+/// in the manifest — so there is no `numbering` field here anymore.
+///
+/// ## Defaults for a minimal manifest
+///
+/// - A target with **no `artifact`** key defaults to
+///   [`Artifact::SingleFile`] with `filepath = "build/<name>.pdf"`, so an
+///   almost-empty `[targets.student]` still produces a usable build.
+/// - A target with **no `steps`** defaults to a single
+///   [`Step::TypstCompile`] with `template = "exports/<name>.typ"` (the
+///   framework's stock per-target template).
+/// - A target with **no `covers`** key leaves [`TargetConfig::covers`] `None`,
+///   meaning "coverage not declared". The consumer (`cph-check`) resolves that
+///   to the full known-kind universe — see the field doc.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct TargetConfig {
+    /// Target name, e.g. `"student"` (the `[targets.<name>]` table key).
+    pub name: String,
+    /// The artifact this target produces. Defaults to a [`Artifact::SingleFile`]
+    /// at `build/<name>.pdf` when the `artifact` field is absent.
+    pub artifact: Artifact,
+    /// The ordered build steps. Defaults to a single [`Step::TypstCompile`]
+    /// with template `exports/<name>.typ` when no `[[steps]]` are given.
+    pub steps: Vec<Step>,
+    /// The **render-coverage declaration**: which element kinds this target
+    /// renders. Realizes `Spec.Courseware.TargetSpec.covers : KindId → Prop`
+    /// (`spec/Spec/Courseware/Export/Render.lean`) and ADR-0011's "render
+    /// coverage is a declaration, not a payload": the contract keeps *which
+    /// kinds a target renders* (used by the `renderIgnored` seed diagnostic),
+    /// while the rendering "how" lives in the template/steps.
+    ///
+    /// `Some(kinds)` is the explicit manifest list (`covers = ["segment", …]`).
+    /// `None` means the `covers` key was **absent**; the loader does not own the
+    /// kind universe (it must not depend on `cph-schema`), so it records the
+    /// absence and lets `cph-check` default it to all known kinds. An empty
+    /// `Some(vec![])` is distinct: a target that explicitly covers nothing.
+    pub covers: Option<Vec<String>>,
+}
+
+/// The artifact an export target produces (ADR-0009/0011).
+///
+/// **Mirrors `Spec.Courseware.Artifact`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Artifact.lean`), whose definition is exactly:
+///
+/// ```text
+/// inductive Artifact where
+///   | singleFile (filepath : String)
+///   | fileTree (root : String) (outputs : String)
+/// ```
+///
+/// ADR-0011 pinned the artifact as an ADT **with fields**: "what the product
+/// is" — one file at some path vs. a tree of files under some root matching a
+/// glob — is the non-obvious domain semantics that must be in the type, not
+/// erased behind a bare tag. `SingleFile` is one bundled document (a 讲义 / 教案
+/// PDF); `FileTree` is a tree of files (a third-party-platform archive). The
+/// on-disk `artifact` inline table's `type` discriminator selects the variant:
+/// `"single-file"` → [`Artifact::SingleFile`], `"file-tree"` →
+/// [`Artifact::FileTree`].
+///
+/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing this
+/// alignment (see the repo constitution) — it is maintained by review, which is
+/// why the correspondence is documented here.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub enum Artifact {
+    /// One bundled document landing at `filepath` (relative to the engineering
+    /// root). Mirrors Lean `Artifact.singleFile`. The default artifact shape.
+    SingleFile {
+        /// Where the single product is written (relative to the engineering
+        /// root), e.g. `build/student.pdf`.
+        filepath: PathBuf,
+    },
+    /// A set of files under `root` matching the `outputs` glob. Mirrors Lean
+    /// `Artifact.fileTree`.
+    FileTree {
+        /// The output directory (relative to the engineering root).
+        root: PathBuf,
+        /// A **glob** describing which files this build produces, e.g.
+        /// `**/*.{html,js,json}` — kept as a string (the contract pins the
+        /// field, not a path/glob algebra).
+        outputs: String,
+    },
+}
+
+impl Artifact {
+    /// The default artifact when `artifact` is omitted: a single file at
+    /// `build/<name>.pdf`.
+    fn default_for(name: &str) -> Artifact {
+        Artifact::SingleFile {
+            filepath: PathBuf::from(format!("build/{name}.pdf")),
+        }
+    }
+}
+
+/// One typed build step (ADR-0011).
+///
+/// **Mirrors `Spec.Courseware.Step`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Render.lean`), whose definition is exactly:
+///
+/// ```text
+/// inductive Step where
+///   | typstCompile (template : String)
+///   | shell (run : String)
+///   | assembleMarkdown (field : String)
+/// ```
+///
+/// A step is a *typed* operation (extensible): `TypstCompile` compiles a
+/// template file — typed, not a raw shell line, because the framework must wire
+/// the manifest into it (`--input manifest=…`), which a bare `typst compile`
+/// string cannot express. `Shell` is the escape hatch for steps that resist
+/// declaration (ADR-0005's medium-only category (b): HTML interactive / npm
+/// builds). `AssembleMarkdown` concatenates a per-element markdown content
+/// field into a single-file markdown deliverable (ADR-0015: the slides outline
+/// and 逐字稿 transcript surfaces, authored directly in markdown+KaTeX to
+/// sidestep the typst→md conversion). The on-disk `[[steps]]` entry's `type`
+/// discriminator selects the variant: `"typst-compile"` →
+/// [`Step::TypstCompile`], `"shell"` → [`Step::Shell`], `"assemble-markdown"`
+/// → [`Step::AssembleMarkdown`].
+///
+/// As with [`Artifact`], this alignment is maintained by review, not CI.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub enum Step {
+    /// Compile a template file (relative to the engineering root) into the
+    /// artifact; the framework injects the manifest. Mirrors Lean
+    /// `Step.typstCompile`.
+    TypstCompile {
+        /// The template file to compile as main, e.g. `exports/student.typ`.
+        template: PathBuf,
+    },
+    /// Run a shell command — the escape hatch. Mirrors Lean `Step.shell`.
+    Shell {
+        /// The command line to run.
+        run: String,
+    },
+    /// Assemble a single-file markdown deliverable by concatenating each
+    /// element's `field` markdown content file in `[[parts]]` order. Mirrors
+    /// Lean `Step.assembleMarkdown` (ADR-0015). Not a typst build — the
+    /// framework owns the read/concatenate/write itself.
+    AssembleMarkdown {
+        /// The per-element markdown content field to assemble (e.g. `slides`,
+        /// `transcript`).
+        field: String,
+    },
+}
+
+impl Step {
+    /// The default step when no `[[steps]]` are given: compile the stock
+    /// per-target template `exports/<name>.typ`.
+    fn default_for(name: &str) -> Step {
+        Step::TypstCompile {
+            template: PathBuf::from(format!("exports/{name}.typ")),
+        }
+    }
+}
+
+/// `[project]` table.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Project {
+    /// Stable project id.
+    pub id: String,
+    /// Folder / display name.
+    pub name: String,
+}
+
+/// `[info]` table (passed through to render targets verbatim).
+///
+/// **Mirrors `Spec.Courseware.Info`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Model/Info.lean`): the *canonical* model whose
+/// `authors` is always a list. The authoring-surface form (string-or-array
+/// `author`) is the separate [`RawInfo`] / [`RawAuthor`], normalized into this
+/// at the load boundary — mirroring the Lean `RawInfo` / `RawAuthor` split. No
+/// CI gate enforces this alignment (repo constitution); it is kept greppable.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Info {
+    /// Lesson title.
+    pub title: String,
+    /// Authors, in declared order. A lesson can have several (a teaching group),
+    /// so this is a list, not a single name. Empty when `[info]` declares no
+    /// `author`. The on-disk `author` accepts either a bare string (one author)
+    /// or an array of strings (see [`RawAuthor`]); both load into this `Vec`.
+    /// Mirrors Lean `Info.authors : List String`.
+    pub authors: Vec<String>,
+}
+
+/// One `[[parts]]` entry plus its loaded element descriptor.
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct Part {
+    /// Declared kind from the manifest (one of the known kinds; ADR-0006).
+    pub kind: String,
+    /// Element folder path **as written in the manifest** (relative to root),
+    /// kept verbatim for diagnostics / display.
+    pub path: PathBuf,
+    /// The element's self-description loaded from its `element.toml`.
+    pub descriptor: ElementDescriptor,
+}
+
+/// An element's `element.toml`, parsed into kind + remaining scalar fields.
+///
+/// ADR-0008: `kind` is explicit in the descriptor (not inferred from the parent
+/// directory), so a folder is self-describing.
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct ElementDescriptor {
+    /// `kind` from `element.toml`. Must equal the part's `kind`; a mismatch is
+    /// reported as a diagnostic (see [`load`]).
+    pub kind: String,
+    /// Element folder, absolute path.
+    pub dir: PathBuf,
+    /// The remaining `element.toml` keys (the scalar fields). Schema validation
+    /// of these is WU-3's job, not this loader's.
+    pub scalars: toml::Table,
+}
+
+// --- raw deserialization shapes (mirror the on-disk TOML) ---------------------
+
+#[derive(Debug, Deserialize)]
+struct RawManifest {
+    project: Option<RawProject>,
+    info: Option<RawInfo>,
+    #[serde(default)]
+    parts: Vec<RawPart>,
+    #[serde(default)]
+    targets: toml::Table,
+}
+
+#[derive(Debug, Deserialize)]
+struct RawProject {
+    id: String,
+    name: String,
+}
+
+/// The authoring-surface `[info]` (mirrors Lean `RawInfo` in
+/// `spec/Spec/Courseware/Model/Info.lean`): the raw form that exists for
+/// fill-in convenience, normalized into the canonical [`Info`] at the load
+/// boundary. Not the form the rest of the model traffics in.
+#[derive(Debug, Deserialize)]
+struct RawInfo {
+    title: String,
+    author: Option<RawAuthor>,
+}
+
+/// On-disk `author`: either a single name (`author = "…"`) or a list
+/// (`author = ["…", "…"]`). Mirrors Lean `RawAuthor`: a fill-in convenience whose
+/// string-or-array union lives **only** at the load boundary — [`RawAuthor::into_vec`]
+/// folds it into the canonical [`Info::authors`] `Vec`, after which it never appears.
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+enum RawAuthor {
+    One(String),
+    Many(Vec<String>),
+}
+
+impl RawAuthor {
+    /// Flatten to the ordered author list (Lean `RawAuthor.normalize`): a single
+    /// name becomes a one-element list; a list passes through verbatim.
+    fn into_vec(self) -> Vec<String> {
+        match self {
+            RawAuthor::One(s) => vec![s],
+            RawAuthor::Many(v) => v,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+struct RawPart {
+    kind: String,
+    path: String,
+}
+
+/// Load the engineering file at `root` into a [`Lesson`].
+///
+/// Returns `(Option<Lesson>, Vec<Diagnostic>)`:
+/// - `Some(lesson)` whenever the manifest parses into a `Lesson` at all. The
+///   structure is produced even when individual parts have problems, so the
+///   WU-5 orchestrator gets **both** the partial lesson and the collected
+///   diagnostics.
+/// - `None` only on a hard failure where no `Lesson` can be built: the
+///   `manifest.toml` is missing/unreadable, is not valid TOML, or lacks the
+///   required `[project]` / `[info]` tables. In that case the diagnostics
+///   describe the hard failure.
+///
+/// Collected (non-fatal) diagnostics include: a part path that does not exist
+/// or escapes the root via `..`, a missing/malformed `element.toml`, and a
+/// `part.kind != element.toml kind` mismatch.
+///
+/// ## Diagnostic-code mapping (judgment call, WU-1)
+///
+/// `cph-diag`'s code set is closed and has **no** dedicated "manifest
+/// malformed" code. We deliberately do not invent one here. Until such a code
+/// is added, manifest-level structural errors (bad TOML, missing `[project]` /
+/// `[info]`) are mapped to the closest existing code, [`DiagCode::SchemaViolation`],
+/// with a message making the real cause clear. A genuinely missing **part
+/// path** uses [`DiagCode::PartPathMissing`] (its actual meaning); a missing /
+/// unreadable / malformed `element.toml` also maps to `SchemaViolation`.
+// TODO(cph-diag): consider adding a dedicated `ManifestMalformed` code so
+// manifest-structure errors don't overload `SchemaViolation`.
+pub fn load(root: &Path) -> (Option<Lesson>, Vec<Diagnostic>) {
+    let mut diags = Vec::new();
+
+    let manifest_path = root.join("manifest.toml");
+
+    let manifest_src = match std::fs::read_to_string(&manifest_path) {
+        Ok(s) => s,
+        Err(e) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("cannot read manifest.toml: {e}"),
+                )
+                .with_hint(format!(
+                    "expected an engineering-file manifest at {}",
+                    manifest_path.display()
+                )),
+            );
+            return (None, diags);
+        }
+    };
+
+    let raw: RawManifest = match toml::from_str(&manifest_src) {
+        Ok(r) => r,
+        Err(e) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("manifest.toml is not valid TOML: {e}"),
+                )
+                .with_hint("fix the TOML syntax in manifest.toml"),
+            );
+            return (None, diags);
+        }
+    };
+
+    // [project] and [info] are required to build a Lesson at all.
+    let project = match raw.project {
+        Some(p) => Project {
+            id: p.id,
+            name: p.name,
+        },
+        None => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    "manifest.toml is missing the required [project] table",
+                )
+                .with_hint("add a [project] table with `id` and `name`"),
+            );
+            return (None, diags);
+        }
+    };
+
+    let info = match raw.info {
+        Some(i) => Info {
+            title: i.title,
+            authors: i.author.map(RawAuthor::into_vec).unwrap_or_default(),
+        },
+        None => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    "manifest.toml is missing the required [info] table",
+                )
+                .with_hint("add an [info] table with at least `title`"),
+            );
+            return (None, diags);
+        }
+    };
+
+    // Parse each [targets.<name>] table into a structured build config
+    // (ADR-0009/0011). Order is the TOML document order, as before. Malformed
+    // target config is non-fatal: it is reported and the target is kept with
+    // defaults so loading continues.
+    let targets: Vec<TargetConfig> = raw
+        .targets
+        .into_iter()
+        .map(|(name, value)| parse_target(name, value, &mut diags))
+        .collect();
+
+    // Load each part. Problems are collected, not fatal: we still build the
+    // Part (with a best-effort descriptor) so order/membership is observable.
+    let mut parts = Vec::with_capacity(raw.parts.len());
+    for raw_part in raw.parts {
+        let rel_path = PathBuf::from(&raw_part.path);
+
+        // Reject `..` traversal: a part path must stay within the root.
+        if has_parent_traversal(&rel_path) {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::PartPathMissing,
+                    format!(
+                        "part path '{}' escapes the engineering-file root via '..'",
+                        raw_part.path
+                    ),
+                )
+                .with_hint("part paths must be relative folders inside the engineering file"),
+            );
+            // Still record the part with an empty descriptor so order is kept.
+            parts.push(Part {
+                kind: raw_part.kind.clone(),
+                path: rel_path.clone(),
+                descriptor: ElementDescriptor {
+                    kind: raw_part.kind,
+                    dir: root.join(&rel_path),
+                    scalars: toml::Table::new(),
+                },
+            });
+            continue;
+        }
+
+        let dir = root.join(&rel_path);
+
+        let descriptor = if !dir.is_dir() {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::PartPathMissing,
+                    format!("part folder '{}' does not exist", raw_part.path),
+                )
+                .with_hint(format!(
+                    "create the folder '{}' or fix the `path` in manifest.toml",
+                    raw_part.path
+                )),
+            );
+            ElementDescriptor {
+                kind: raw_part.kind.clone(),
+                dir,
+                scalars: toml::Table::new(),
+            }
+        } else {
+            load_descriptor(&dir, &rel_path, &raw_part.kind, &mut diags)
+        };
+
+        parts.push(Part {
+            kind: raw_part.kind,
+            path: rel_path,
+            descriptor,
+        });
+    }
+
+    let lesson = Lesson {
+        project,
+        info,
+        parts,
+        targets,
+        root: root.to_path_buf(),
+    };
+    (Some(lesson), diags)
+}
+
+/// Load one element's `element.toml` into an [`ElementDescriptor`], collecting
+/// diagnostics. On a missing/malformed `element.toml` the descriptor falls back
+/// to the part's declared kind with empty scalars so the lesson stays buildable.
+fn load_descriptor(
+    dir: &Path,
+    rel_path: &Path,
+    part_kind: &str,
+    diags: &mut Vec<Diagnostic>,
+) -> ElementDescriptor {
+    let element_toml = dir.join("element.toml");
+    let rel_element_toml = rel_path.join("element.toml");
+
+    let src = match std::fs::read_to_string(&element_toml) {
+        Ok(s) => s,
+        Err(e) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "cannot read element.toml for part '{}': {e}",
+                        rel_path.display()
+                    ),
+                )
+                .with_hint(format!(
+                    "add an element.toml at {} with at least `kind = \"{part_kind}\"`",
+                    rel_element_toml.display()
+                )),
+            );
+            return ElementDescriptor {
+                kind: part_kind.to_string(),
+                dir: dir.to_path_buf(),
+                scalars: toml::Table::new(),
+            };
+        }
+    };
+
+    let mut table: toml::Table = match toml::from_str(&src) {
+        Ok(t) => t,
+        Err(e) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "element.toml for part '{}' is not valid TOML: {e}",
+                        rel_path.display()
+                    ),
+                )
+                .with_hint("fix the TOML syntax in element.toml"),
+            );
+            return ElementDescriptor {
+                kind: part_kind.to_string(),
+                dir: dir.to_path_buf(),
+                scalars: toml::Table::new(),
+            };
+        }
+    };
+
+    // `kind` is required and must be a string. Pull it out of the scalar map so
+    // `scalars` ends up being "the remaining keys".
+    let kind = match table.remove("kind") {
+        Some(toml::Value::String(k)) => k,
+        Some(_) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "element.toml for part '{}' has a non-string `kind`",
+                        rel_path.display()
+                    ),
+                )
+                .with_hint("`kind` must be a string, e.g. `kind = \"lemma\"`"),
+            );
+            part_kind.to_string()
+        }
+        None => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "element.toml for part '{}' is missing the required `kind` key",
+                        rel_path.display()
+                    ),
+                )
+                .with_hint(format!("add `kind = \"{part_kind}\"` to element.toml")),
+            );
+            part_kind.to_string()
+        }
+    };
+
+    // Cross-check: the descriptor's kind must equal the part's declared kind.
+    if kind != part_kind {
+        diags.push(
+            Diagnostic::error(
+                DiagCode::UnknownKind,
+                format!(
+                    "kind mismatch for part '{}': manifest says '{part_kind}', element.toml says '{kind}'",
+                    rel_path.display()
+                ),
+            )
+            .with_hint("make the manifest `kind` and the element.toml `kind` agree"),
+        );
+    }
+
+    ElementDescriptor {
+        kind,
+        dir: dir.to_path_buf(),
+        scalars: table,
+    }
+}
+
+/// Parse one `[targets.<name>]` table into a [`TargetConfig`] (ADR-0009/0011),
+/// collecting [`DiagCode::SchemaViolation`] diagnostics for malformed fields.
+///
+/// Malformed config is **non-fatal**: a bad/absent `artifact` falls back to the
+/// default ([`Artifact::default_for`]); a bad/absent `steps` falls back to the
+/// default single `typst-compile` step ([`Step::default_for`]) — all reported,
+/// never dropping the target. An empty `[targets.<name>]` body is valid (all
+/// defaults, no diagnostics).
+fn parse_target(name: String, value: toml::Value, diags: &mut Vec<Diagnostic>) -> TargetConfig {
+    // A target body must be a table; anything else (`student = 1`) is malformed.
+    let mut table = match value {
+        toml::Value::Table(t) => t,
+        _ => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("target '{name}' must be a table, e.g. `[targets.{name}]`"),
+                )
+                .with_hint("declare a target as a `[targets.<name>]` table"),
+            );
+            return TargetConfig {
+                artifact: Artifact::default_for(&name),
+                steps: vec![Step::default_for(&name)],
+                covers: None,
+                name,
+            };
+        }
+    };
+
+    let artifact = match table.remove("artifact") {
+        None => Artifact::default_for(&name),
+        Some(value) => parse_artifact(&name, value, diags),
+    };
+
+    let steps = match table.remove("steps") {
+        None => vec![Step::default_for(&name)],
+        Some(value) => parse_steps(&name, value, diags),
+    };
+
+    let covers = match table.remove("covers") {
+        None => None,
+        Some(value) => parse_covers(&name, value, diags),
+    };
+
+    TargetConfig {
+        name,
+        artifact,
+        steps,
+        covers,
+    }
+}
+
+/// Parse a target's optional `covers` array into the render-coverage declaration
+/// (ADR-0011). Each entry is a kind name (a string). A non-array `covers`, or any
+/// non-string entry, is reported as a [`DiagCode::SchemaViolation`]; in that case
+/// the declaration falls back to `None` ("not declared"), so `cph-check` defaults
+/// it to the full known-kind universe rather than silently covering nothing.
+///
+/// A well-formed but empty `covers = []` yields `Some(vec![])`: a target that
+/// explicitly renders no kind (every used kind then draws a `renderIgnored`
+/// warning) — distinct from an absent key.
+fn parse_covers(name: &str, value: toml::Value, diags: &mut Vec<Diagnostic>) -> Option<Vec<String>> {
+    let items = match value {
+        toml::Value::Array(items) => items,
+        _ => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "target '{name}' has a non-array `covers`; declare it as a list of \
+                         kind names, e.g. `covers = [\"segment\", \"example\"]`"
+                    ),
+                )
+                .with_hint("set `covers` to an array of kind-name strings, or omit it"),
+            );
+            return None;
+        }
+    };
+
+    let mut kinds = Vec::with_capacity(items.len());
+    for item in items {
+        match item {
+            toml::Value::String(s) => kinds.push(s),
+            other => {
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!(
+                            "target '{name}' has a non-string entry in `covers`: {}",
+                            json_like_type(&other)
+                        ),
+                    )
+                    .with_hint("each `covers` entry is a kind name (a string)"),
+                );
+                return None;
+            }
+        }
+    }
+    Some(kinds)
+}
+
+/// A short type label for a TOML value, for the `covers` non-string diagnostic.
+fn json_like_type(v: &toml::Value) -> &'static str {
+    match v {
+        toml::Value::String(_) => "string",
+        toml::Value::Integer(_) => "integer",
+        toml::Value::Float(_) => "float",
+        toml::Value::Boolean(_) => "boolean",
+        toml::Value::Datetime(_) => "datetime",
+        toml::Value::Array(_) => "array",
+        toml::Value::Table(_) => "table",
+    }
+}
+
+/// Parse the `artifact` inline table into an [`Artifact`]. The `type`
+/// discriminator selects the variant and which fields are read. An unknown or
+/// malformed `type`, a non-table value, or a missing required field is reported
+/// as a [`DiagCode::SchemaViolation`]; in every error case a usable default
+/// ([`Artifact::default_for`]) is returned so loading continues.
+fn parse_artifact(name: &str, value: toml::Value, diags: &mut Vec<Diagnostic>) -> Artifact {
+    let mut table = match value {
+        toml::Value::Table(t) => t,
+        _ => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "target '{name}' has a non-table `artifact`; it must be an \
+                         inline table like `{{ type = \"single-file\", filepath = \"…\" }}`"
+                    ),
+                )
+                .with_hint("set `artifact` to an inline table with a `type` discriminator"),
+            );
+            return Artifact::default_for(name);
+        }
+    };
+
+    let kind = match table.remove("type") {
+        Some(toml::Value::String(s)) => s,
+        Some(_) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("target '{name}' has a non-string `artifact.type`"),
+                )
+                .with_hint("set `artifact.type` to \"single-file\" or \"file-tree\""),
+            );
+            return Artifact::default_for(name);
+        }
+        None => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("target '{name}' has an `artifact` with no `type` discriminator"),
+                )
+                .with_hint("add `type = \"single-file\"` (or `\"file-tree\"`) to `artifact`"),
+            );
+            return Artifact::default_for(name);
+        }
+    };
+
+    match kind.as_str() {
+        "single-file" => {
+            let filepath = match take_string_field(&mut table, "filepath") {
+                Some(s) => PathBuf::from(s),
+                None => {
+                    diags.push(
+                        Diagnostic::error(
+                            DiagCode::SchemaViolation,
+                            format!(
+                                "target '{name}' single-file `artifact` is missing a string \
+                                 `filepath`"
+                            ),
+                        )
+                        .with_hint("add `filepath = \"build/<name>.pdf\"` to the artifact"),
+                    );
+                    return Artifact::default_for(name);
+                }
+            };
+            Artifact::SingleFile { filepath }
+        }
+        "file-tree" => {
+            let root = take_string_field(&mut table, "root");
+            let outputs = take_string_field(&mut table, "outputs");
+            match (root, outputs) {
+                (Some(root), Some(outputs)) => Artifact::FileTree {
+                    root: PathBuf::from(root),
+                    outputs,
+                },
+                (root, outputs) => {
+                    let mut missing = Vec::new();
+                    if root.is_none() {
+                        missing.push("root");
+                    }
+                    if outputs.is_none() {
+                        missing.push("outputs");
+                    }
+                    diags.push(
+                        Diagnostic::error(
+                            DiagCode::SchemaViolation,
+                            format!(
+                                "target '{name}' file-tree `artifact` is missing required \
+                                 string field(s): {}",
+                                missing.join(", ")
+                            ),
+                        )
+                        .with_hint(
+                            "a file-tree artifact needs `root = \"<dir>\"` and \
+                             `outputs = \"<glob>\"`",
+                        ),
+                    );
+                    Artifact::default_for(name)
+                }
+            }
+        }
+        other => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "target '{name}' has an invalid `artifact.type` '{other}'; \
+                         valid values are \"single-file\", \"file-tree\""
+                    ),
+                )
+                .with_hint("set `artifact.type` to \"single-file\" or \"file-tree\""),
+            );
+            Artifact::default_for(name)
+        }
+    }
+}
+
+/// Parse the `steps` array-of-tables into an ordered `Vec<Step>`, preserving
+/// declared order. A non-array `steps`, or any individual step with an unknown
+/// or malformed `type` / missing required field, is reported as a
+/// [`DiagCode::SchemaViolation`]; malformed individual steps are skipped while
+/// well-formed ones are kept. If `steps` is present but yields no usable steps,
+/// the default step ([`Step::default_for`]) is substituted so the build stays
+/// runnable.
+fn parse_steps(name: &str, value: toml::Value, diags: &mut Vec<Diagnostic>) -> Vec<Step> {
+    let items = match value {
+        toml::Value::Array(items) => items,
+        _ => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "target '{name}' has a non-array `steps`; declare steps as \
+                         `[[targets.{name}.steps]]` entries"
+                    ),
+                )
+                .with_hint("each step is a `[[targets.<name>.steps]]` table with a `type`"),
+            );
+            return vec![Step::default_for(name)];
+        }
+    };
+
+    let mut steps = Vec::with_capacity(items.len());
+    for item in items {
+        if let Some(step) = parse_step(name, item, diags) {
+            steps.push(step);
+        }
+    }
+
+    if steps.is_empty() {
+        // `steps` was present but produced nothing usable: keep the build
+        // runnable with the default step (the malformed entries were reported).
+        vec![Step::default_for(name)]
+    } else {
+        steps
+    }
+}
+
+/// Parse one `[[steps]]` entry into a [`Step`]. The `type` discriminator selects
+/// the variant. Returns `None` (after reporting a [`DiagCode::SchemaViolation`])
+/// for a non-table entry, an unknown/malformed `type`, or a missing required
+/// field.
+fn parse_step(name: &str, value: toml::Value, diags: &mut Vec<Diagnostic>) -> Option<Step> {
+    let mut table = match value {
+        toml::Value::Table(t) => t,
+        _ => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("target '{name}' has a step that is not a table"),
+                )
+                .with_hint("each step is a `[[targets.<name>.steps]]` table with a `type`"),
+            );
+            return None;
+        }
+    };
+
+    let kind = match table.remove("type") {
+        Some(toml::Value::String(s)) => s,
+        Some(_) => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("target '{name}' has a step with a non-string `type`"),
+                )
+                .with_hint(
+                    "set the step `type` to \"typst-compile\", \"shell\", or \"assemble-markdown\"",
+                ),
+            );
+            return None;
+        }
+        None => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!("target '{name}' has a step with no `type` discriminator"),
+                )
+                .with_hint(
+                    "add `type = \"typst-compile\"` (or `\"shell\"`, `\"assemble-markdown\"`) to the step",
+                ),
+            );
+            return None;
+        }
+    };
+
+    match kind.as_str() {
+        "typst-compile" => match take_string_field(&mut table, "template") {
+            Some(template) => Some(Step::TypstCompile {
+                template: PathBuf::from(template),
+            }),
+            None => {
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!(
+                            "target '{name}' typst-compile step is missing a string `template`"
+                        ),
+                    )
+                    .with_hint("add `template = \"exports/<name>.typ\"` to the step"),
+                );
+                None
+            }
+        },
+        "shell" => match take_string_field(&mut table, "run") {
+            Some(run) => Some(Step::Shell { run }),
+            None => {
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!("target '{name}' shell step is missing a string `run`"),
+                    )
+                    .with_hint("add `run = \"<command>\"` to the step"),
+                );
+                None
+            }
+        },
+        "assemble-markdown" => match take_string_field(&mut table, "field") {
+            Some(field) => Some(Step::AssembleMarkdown { field }),
+            None => {
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!(
+                            "target '{name}' assemble-markdown step is missing a string `field`"
+                        ),
+                    )
+                    .with_hint("add `field = \"slides\"` (or `\"transcript\"`) to the step"),
+                );
+                None
+            }
+        },
+        other => {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "target '{name}' has a step with an invalid `type` '{other}'; \
+                         valid values are \"typst-compile\", \"shell\", \"assemble-markdown\""
+                    ),
+                )
+                .with_hint(
+                    "set the step `type` to \"typst-compile\", \"shell\", or \"assemble-markdown\"",
+                ),
+            );
+            None
+        }
+    }
+}
+
+/// Remove `key` from `table` and return it if it is a string; otherwise `None`
+/// (a missing key and a non-string value are both treated as absent — the
+/// caller reports the missing-field diagnostic with the right context).
+fn take_string_field(table: &mut toml::Table, key: &str) -> Option<String> {
+    match table.remove(key) {
+        Some(toml::Value::String(s)) => Some(s),
+        _ => None,
+    }
+}
+
+/// True if `path` contains any `..` component (parent-dir traversal).
+fn has_parent_traversal(path: &Path) -> bool {
+    path.components().any(|c| matches!(c, Component::ParentDir))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parent_traversal_detection() {
+        assert!(has_parent_traversal(Path::new("../x")));
+        assert!(has_parent_traversal(Path::new("a/../b")));
+        assert!(!has_parent_traversal(Path::new("a/b/c")));
+        assert!(!has_parent_traversal(Path::new("segments/intro")));
+    }
+}
diff --git a/crates/cph-model/tests/fixtures/bad-target-config/manifest.toml b/crates/cph-model/tests/fixtures/bad-target-config/manifest.toml
new file mode 100644
index 0000000..cacd692
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/bad-target-config/manifest.toml
@@ -0,0 +1,18 @@
+[project]
+id = "fixture-bad-target-config"
+name = "bad-target-config"
+
+[info]
+title = "测试课：非法导出目标配置"
+
+# Invalid artifact `type` → SchemaViolation, falls back to default (single-file).
+[targets.student]
+artifact = { type = "pdf-thing", filepath = "build/student.pdf" }
+
+# Invalid step `type` → SchemaViolation; the bad step is skipped and the build
+# falls back to the default step.
+[targets.teacher]
+artifact = { type = "file-tree", root = "build/teacher", outputs = "**/*.html" }
+[[targets.teacher.steps]]
+type = "make-it-nice"
+template = "exports/teacher.typ"
diff --git a/crates/cph-model/tests/fixtures/kind-mismatch/manifest.toml b/crates/cph-model/tests/fixtures/kind-mismatch/manifest.toml
new file mode 100644
index 0000000..fedd3aa
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/kind-mismatch/manifest.toml
@@ -0,0 +1,12 @@
+[project]
+id = "fixture-kind-mismatch"
+name = "kind-mismatch"
+
+[info]
+title = "kind 不一致测试"
+
+[[parts]]
+kind = "segment"
+path = "segments/intro"
+
+[targets.student]
diff --git a/crates/cph-model/tests/fixtures/kind-mismatch/segments/intro/element.toml b/crates/cph-model/tests/fixtures/kind-mismatch/segments/intro/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/kind-mismatch/segments/intro/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/crates/cph-model/tests/fixtures/kind-mismatch/segments/intro/textbook.typ b/crates/cph-model/tests/fixtures/kind-mismatch/segments/intro/textbook.typ
new file mode 100644
index 0000000..bdd69ac
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/kind-mismatch/segments/intro/textbook.typ
@@ -0,0 +1 @@
+这是一段测试。
diff --git a/crates/cph-model/tests/fixtures/malformed-manifest/manifest.toml b/crates/cph-model/tests/fixtures/malformed-manifest/manifest.toml
new file mode 100644
index 0000000..4f1b473
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/malformed-manifest/manifest.toml
@@ -0,0 +1,3 @@
+[project
+id = "broken"
+this is not valid toml = =
diff --git a/crates/cph-model/tests/fixtures/missing-part/manifest.toml b/crates/cph-model/tests/fixtures/missing-part/manifest.toml
new file mode 100644
index 0000000..d54f585
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/missing-part/manifest.toml
@@ -0,0 +1,16 @@
+[project]
+id = "fixture-missing-part"
+name = "missing-part"
+
+[info]
+title = "缺部件测试"
+
+[[parts]]
+kind = "segment"
+path = "segments/intro"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/does-not-exist"
+
+[targets.student]
diff --git a/crates/cph-model/tests/fixtures/missing-part/segments/intro/element.toml b/crates/cph-model/tests/fixtures/missing-part/segments/intro/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/missing-part/segments/intro/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/crates/cph-model/tests/fixtures/missing-part/segments/intro/textbook.typ b/crates/cph-model/tests/fixtures/missing-part/segments/intro/textbook.typ
new file mode 100644
index 0000000..bdd69ac
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/missing-part/segments/intro/textbook.typ
@@ -0,0 +1 @@
+这是一段测试。
diff --git a/crates/cph-model/tests/fixtures/target-configs/manifest.toml b/crates/cph-model/tests/fixtures/target-configs/manifest.toml
new file mode 100644
index 0000000..ba3bb29
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/target-configs/manifest.toml
@@ -0,0 +1,30 @@
+[project]
+id = "fixture-target-configs"
+name = "target-configs"
+
+[info]
+title = "测试课：导出目标的结构化 build 配置"
+# Array form: a lesson authored by several people.
+author = ["张老师", "李老师"]
+
+# Full v2 config: explicit single-file artifact + an ordered typst-compile step.
+[targets.student]
+artifact = { type = "single-file", filepath = "build/student.pdf" }
+[[targets.student.steps]]
+type = "typst-compile"
+template = "exports/student.typ"
+
+# file-tree artifact + multiple steps (typst-compile then a shell step),
+# exercising both step types and order preservation.
+[targets.archive]
+artifact = { type = "file-tree", root = "build/archive", outputs = "**/*.{html,js,json}" }
+[[targets.archive.steps]]
+type = "typst-compile"
+template = "exports/archive.typ"
+[[targets.archive.steps]]
+type = "shell"
+run = "npm run build"
+
+# Empty body → all defaults (single-file build/teacher.pdf, one typst-compile
+# step exports/teacher.typ).
+[targets.teacher]
diff --git a/crates/cph-model/tests/fixtures/valid/lemmas/young/element.toml b/crates/cph-model/tests/fixtures/valid/lemmas/young/element.toml
new file mode 100644
index 0000000..7dcea61
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/valid/lemmas/young/element.toml
@@ -0,0 +1,2 @@
+kind = "lemma"
+source = "测试引理"
diff --git a/crates/cph-model/tests/fixtures/valid/lemmas/young/proof.typ b/crates/cph-model/tests/fixtures/valid/lemmas/young/proof.typ
new file mode 100644
index 0000000..bdd69ac
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/valid/lemmas/young/proof.typ
@@ -0,0 +1 @@
+这是一段测试。
diff --git a/crates/cph-model/tests/fixtures/valid/lemmas/young/stmt.typ b/crates/cph-model/tests/fixtures/valid/lemmas/young/stmt.typ
new file mode 100644
index 0000000..bdd69ac
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/valid/lemmas/young/stmt.typ
@@ -0,0 +1 @@
+这是一段测试。
diff --git a/crates/cph-model/tests/fixtures/valid/manifest.toml b/crates/cph-model/tests/fixtures/valid/manifest.toml
new file mode 100644
index 0000000..227556b
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/valid/manifest.toml
@@ -0,0 +1,18 @@
+[project]
+id = "fixture-valid"
+name = "valid-2-part"
+
+[info]
+title = "测试课：两个部件"
+author = "范式教育教研组"
+
+[[parts]]
+kind = "segment"
+path = "segments/intro"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/young"
+
+[targets.student]
+[targets.teacher]
diff --git a/crates/cph-model/tests/fixtures/valid/segments/intro/element.toml b/crates/cph-model/tests/fixtures/valid/segments/intro/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/valid/segments/intro/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/crates/cph-model/tests/fixtures/valid/segments/intro/textbook.typ b/crates/cph-model/tests/fixtures/valid/segments/intro/textbook.typ
new file mode 100644
index 0000000..bdd69ac
--- /dev/null
+++ b/crates/cph-model/tests/fixtures/valid/segments/intro/textbook.typ
@@ -0,0 +1 @@
+这是一段测试。
diff --git a/crates/cph-model/tests/load.rs b/crates/cph-model/tests/load.rs
new file mode 100644
index 0000000..9d2414f
--- /dev/null
+++ b/crates/cph-model/tests/load.rs
@@ -0,0 +1,274 @@
+//! Integration tests for `cph_model::load`, driven by static fixtures under
+//! `tests/fixtures/`. The fixtures double as documentation of the ADR-0008
+//! on-disk format.
+
+use std::path::PathBuf;
+
+use cph_diag::DiagCode;
+use cph_model::load;
+
+/// Absolute path to a fixture engineering-file root.
+fn fixture(name: &str) -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures")
+        .join(name)
+}
+
+#[test]
+fn valid_two_part_lesson_loads_in_order_with_no_errors() {
+    let (lesson, diags) = load(&fixture("valid"));
+
+    let lesson = lesson.expect("valid fixture must produce a Lesson");
+    assert!(
+        diags.is_empty(),
+        "valid fixture must have no diagnostics, got: {diags:?}"
+    );
+
+    assert_eq!(lesson.project.id, "fixture-valid");
+    assert_eq!(lesson.project.name, "valid-2-part");
+    assert_eq!(lesson.info.title, "测试课：两个部件");
+    // A single-string `author` loads as a one-element list.
+    assert_eq!(lesson.info.authors, vec!["范式教育教研组".to_string()]);
+
+    // Parts preserve declared order: segment first, lemma second.
+    assert_eq!(lesson.parts.len(), 2);
+    assert_eq!(lesson.parts[0].kind, "segment");
+    assert_eq!(lesson.parts[0].path, PathBuf::from("segments/intro"));
+    assert_eq!(lesson.parts[0].descriptor.kind, "segment");
+    assert_eq!(lesson.parts[1].kind, "lemma");
+    assert_eq!(lesson.parts[1].path, PathBuf::from("lemmas/young"));
+    assert_eq!(lesson.parts[1].descriptor.kind, "lemma");
+
+    // `source` scalar survives on the lemma descriptor; `kind` is removed.
+    let scalars = &lesson.parts[1].descriptor.scalars;
+    assert_eq!(
+        scalars.get("source").and_then(|v| v.as_str()),
+        Some("测试引理")
+    );
+    assert!(scalars.get("kind").is_none());
+
+    // Targets are collected from [targets.*], in declared order.
+    assert_eq!(lesson.target_names(), vec!["student", "teacher"]);
+    // Empty `[targets.x]` bodies → all-default build config, no diagnostics:
+    // single-file artifact at build/<name>.pdf + one typst-compile step.
+    for target in &lesson.targets {
+        assert_eq!(
+            target.artifact,
+            cph_model::Artifact::SingleFile {
+                filepath: PathBuf::from(format!("build/{}.pdf", target.name)),
+            }
+        );
+        assert_eq!(
+            target.steps,
+            vec![cph_model::Step::TypstCompile {
+                template: PathBuf::from(format!("exports/{}.typ", target.name)),
+            }]
+        );
+    }
+
+    // Descriptor dir is absolute, anchored under the root.
+    assert!(lesson.parts[0].descriptor.dir.is_absolute());
+    assert_eq!(
+        lesson.parts[0].descriptor.dir,
+        lesson.root.join("segments/intro")
+    );
+}
+
+#[test]
+fn missing_part_folder_yields_part_path_missing() {
+    let (lesson, diags) = load(&fixture("missing-part"));
+
+    // Still produces a Lesson (loader stays best-effort).
+    let lesson = lesson.expect("missing-part fixture must still produce a Lesson");
+    assert_eq!(lesson.parts.len(), 2, "both parts are recorded for order");
+
+    let missing: Vec<_> = diags
+        .iter()
+        .filter(|d| d.code == DiagCode::PartPathMissing)
+        .collect();
+    assert_eq!(
+        missing.len(),
+        1,
+        "exactly one PartPathMissing expected, got diags: {diags:?}"
+    );
+    assert_eq!(missing[0].severity, cph_diag::Severity::Error);
+}
+
+#[test]
+fn kind_mismatch_yields_unknown_kind_diagnostic() {
+    let (lesson, diags) = load(&fixture("kind-mismatch"));
+
+    let lesson = lesson.expect("kind-mismatch fixture must still produce a Lesson");
+    assert_eq!(lesson.parts.len(), 1);
+
+    let mismatch: Vec<_> = diags
+        .iter()
+        .filter(|d| d.code == DiagCode::UnknownKind)
+        .collect();
+    assert_eq!(
+        mismatch.len(),
+        1,
+        "exactly one kind-mismatch diagnostic expected, got: {diags:?}"
+    );
+    assert!(
+        mismatch[0].message.contains("segment") && mismatch[0].message.contains("lemma"),
+        "message should name both kinds, got: {}",
+        mismatch[0].message
+    );
+}
+
+#[test]
+fn malformed_manifest_is_a_hard_failure() {
+    let (lesson, diags) = load(&fixture("malformed-manifest"));
+
+    assert!(
+        lesson.is_none(),
+        "malformed manifest must be a hard failure (None)"
+    );
+    assert_eq!(diags.len(), 1, "one hard-failure diagnostic expected");
+    assert_eq!(diags[0].code, DiagCode::SchemaViolation);
+    assert_eq!(diags[0].severity, cph_diag::Severity::Error);
+}
+
+#[test]
+fn missing_manifest_is_a_hard_failure() {
+    // A directory with no manifest.toml at all.
+    let (lesson, diags) = load(&fixture("does-not-exist-at-all"));
+    assert!(lesson.is_none());
+    assert_eq!(diags.len(), 1);
+    assert_eq!(diags[0].code, DiagCode::SchemaViolation);
+}
+
+#[test]
+fn structured_target_configs_parse_into_typed_builds() {
+    use cph_model::{Artifact, Step};
+
+    let (lesson, diags) = load(&fixture("target-configs"));
+    let lesson = lesson.expect("target-configs fixture must produce a Lesson");
+    assert!(
+        diags.is_empty(),
+        "well-formed target configs must have no diagnostics, got: {diags:?}"
+    );
+
+    // An array `author` loads as the ordered author list.
+    assert_eq!(
+        lesson.info.authors,
+        vec!["张老师".to_string(), "李老师".to_string()]
+    );
+
+    // Declared order is preserved.
+    assert_eq!(lesson.target_names(), vec!["student", "archive", "teacher"]);
+
+    // student: explicit single-file artifact (with filepath) + one
+    // typst-compile step (with template).
+    let student = &lesson.targets[0];
+    assert_eq!(student.name, "student");
+    assert_eq!(
+        student.artifact,
+        Artifact::SingleFile {
+            filepath: PathBuf::from("build/student.pdf"),
+        }
+    );
+    assert_eq!(
+        student.steps,
+        vec![Step::TypstCompile {
+            template: PathBuf::from("exports/student.typ"),
+        }]
+    );
+
+    // archive: file-tree artifact (root + outputs glob) + two ordered steps,
+    // a typst-compile followed by a shell step (order preserved).
+    let archive = &lesson.targets[1];
+    assert_eq!(archive.name, "archive");
+    assert_eq!(
+        archive.artifact,
+        Artifact::FileTree {
+            root: PathBuf::from("build/archive"),
+            outputs: "**/*.{html,js,json}".to_string(),
+        }
+    );
+    assert_eq!(
+        archive.steps,
+        vec![
+            Step::TypstCompile {
+                template: PathBuf::from("exports/archive.typ"),
+            },
+            Step::Shell {
+                run: "npm run build".to_string(),
+            },
+        ]
+    );
+
+    // teacher: empty body → all defaults.
+    let teacher = &lesson.targets[2];
+    assert_eq!(teacher.name, "teacher");
+    assert_eq!(
+        teacher.artifact,
+        Artifact::SingleFile {
+            filepath: PathBuf::from("build/teacher.pdf"),
+        }
+    );
+    assert_eq!(
+        teacher.steps,
+        vec![Step::TypstCompile {
+            template: PathBuf::from("exports/teacher.typ"),
+        }]
+    );
+}
+
+#[test]
+fn malformed_target_config_is_non_fatal_with_schema_violations() {
+    use cph_model::{Artifact, Step};
+
+    let (lesson, diags) = load(&fixture("bad-target-config"));
+    let lesson = lesson.expect("bad-target-config must still produce a Lesson");
+
+    // Both targets survive despite their malformed fields.
+    assert_eq!(lesson.target_names(), vec!["student", "teacher"]);
+
+    // Bad `artifact.type` → SchemaViolation, target kept with default artifact.
+    let student = &lesson.targets[0];
+    assert_eq!(
+        student.artifact,
+        Artifact::SingleFile {
+            filepath: PathBuf::from("build/student.pdf"),
+        }
+    );
+
+    // Bad step `type` → the step is skipped; the file-tree artifact survives and
+    // the empty step list falls back to the default step.
+    let teacher = &lesson.targets[1];
+    assert_eq!(
+        teacher.artifact,
+        Artifact::FileTree {
+            root: PathBuf::from("build/teacher"),
+            outputs: "**/*.html".to_string(),
+        }
+    );
+    assert_eq!(
+        teacher.steps,
+        vec![Step::TypstCompile {
+            template: PathBuf::from("exports/teacher.typ"),
+        }]
+    );
+
+    let violations: Vec<_> = diags
+        .iter()
+        .filter(|d| d.code == DiagCode::SchemaViolation)
+        .collect();
+    assert_eq!(
+        violations.len(),
+        2,
+        "expected one SchemaViolation per malformed field, got: {diags:?}"
+    );
+    assert!(
+        violations.iter().any(|d| d.message.contains("pdf-thing")),
+        "a diagnostic should name the bad artifact type, got: {diags:?}"
+    );
+    assert!(
+        violations
+            .iter()
+            .any(|d| d.message.contains("make-it-nice")),
+        "a diagnostic should name the bad step type, got: {diags:?}"
+    );
+}
diff --git a/crates/cph-schema/Cargo.toml b/crates/cph-schema/Cargo.toml
new file mode 100644
index 0000000..b374db4
--- /dev/null
+++ b/crates/cph-schema/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "cph-schema"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+cph-diag = { workspace = true }
+cph-model = { workspace = true }
+serde_json = "1"
+toml = { workspace = true }
+
+[dev-dependencies]
+toml = { workspace = true }
diff --git a/crates/cph-schema/schemas/example.json b/crates/cph-schema/schemas/example.json
new file mode 100644
index 0000000..ee10cb0
--- /dev/null
+++ b/crates/cph-schema/schemas/example.json
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "cph:kind/example",
+  "title": "example",
+  "type": "object",
+  "properties": {
+    "problem": { "type": "string", "x-cph-content": true },
+    "solution": { "type": "string", "x-cph-content": true },
+    "slides": { "type": "string", "x-cph-content": "md" },
+    "transcript": { "type": "string", "x-cph-content": "md" },
+    "source": { "type": "string" }
+  },
+  "required": ["problem", "solution"],
+  "additionalProperties": false
+}
diff --git a/crates/cph-schema/schemas/lemma.json b/crates/cph-schema/schemas/lemma.json
new file mode 100644
index 0000000..e5cbd6c
--- /dev/null
+++ b/crates/cph-schema/schemas/lemma.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "cph:kind/lemma",
+  "title": "lemma",
+  "type": "object",
+  "properties": {
+    "stmt": { "type": "string", "x-cph-content": true },
+    "proof": { "type": "string", "x-cph-content": true },
+    "slides": { "type": "string", "x-cph-content": "md" },
+    "transcript": { "type": "string", "x-cph-content": "md" }
+  },
+  "required": ["stmt"],
+  "additionalProperties": false
+}
diff --git a/crates/cph-schema/schemas/segment.json b/crates/cph-schema/schemas/segment.json
new file mode 100644
index 0000000..ea5d53f
--- /dev/null
+++ b/crates/cph-schema/schemas/segment.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "cph:kind/segment",
+  "title": "segment",
+  "type": "object",
+  "properties": {
+    "textbook": { "type": "string", "x-cph-content": true },
+    "slides": { "type": "string", "x-cph-content": "md" },
+    "transcript": { "type": "string", "x-cph-content": "md" }
+  },
+  "required": ["textbook"],
+  "additionalProperties": false
+}
diff --git a/crates/cph-schema/schemas/sop.json b/crates/cph-schema/schemas/sop.json
new file mode 100644
index 0000000..8da118a
--- /dev/null
+++ b/crates/cph-schema/schemas/sop.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "cph:kind/sop",
+  "title": "sop",
+  "type": "object",
+  "properties": {
+    "sop": { "type": "string", "x-cph-content": true },
+    "slides": { "type": "string", "x-cph-content": "md" },
+    "transcript": { "type": "string", "x-cph-content": "md" }
+  },
+  "required": ["sop"],
+  "additionalProperties": false
+}
diff --git a/crates/cph-schema/src/lib.rs b/crates/cph-schema/src/lib.rs
new file mode 100644
index 0000000..1932b49
--- /dev/null
+++ b/crates/cph-schema/src/lib.rs
@@ -0,0 +1,548 @@
+//! `cph-schema` — kind JSON Schemas (ADR-0006) + structural validation.
+//!
+//! Owned by **WU-3**. The schema layer reads each kind's declarative JSON
+//! Schema (built-in scalars plus the `content` extension type) and validates
+//! element instance data against it, including which `content` `.typ` files
+//! must exist.
+//!
+//! # The `content` extension convention
+//!
+//! ADR-0006 fixes that a kind's data schema is a declarative **JSON Schema**
+//! (draft 2020-12 here) with one extension type — `content` — whose value is a
+//! Typst source rather than inline data. JSON Schema has no native `content`
+//! type, so this crate marks a content field with a **custom keyword**:
+//!
+//! ```json
+//! { "type": "string", "x-cph-content": true }
+//! ```
+//!
+//! The `x-cph-content: true` marker is the single convention this crate honors.
+//! A field carrying it is treated as a **content field**: it does NOT appear in
+//! `element.toml`; instead the validator checks that the sibling file
+//! `<field>.typ` exists in the element's directory (ADR-0008). A required
+//! content field whose `.typ` file is missing yields a
+//! [`cph_diag::DiagCode::MissingContentFile`]; an *optional* content field
+//! (one not in the schema's `required` list, e.g. a lemma's `proof`) may be
+//! absent with no diagnostic. All other (non-`x-cph-content`) properties are
+//! **scalar** fields that live in `element.toml` and are validated structurally.
+//!
+//! The four stdlib kind schemas live as real JSON artifacts under
+//! `crates/cph-schema/schemas/{segment,example,lemma,sop}.json` and are
+//! compiled in via `include_str!`, parsed once on first use.
+//!
+//! # Validation approach
+//!
+//! The MVP scalar surface is intentionally tiny (a single optional string on
+//! `example`), so rather than pull in a full JSON Schema engine (and its
+//! version churn), this crate uses `serde_json` to parse the schemas and a
+//! small hand-rolled interpreter that understands exactly the keywords the
+//! stdlib schemas use: `properties`, `required`, `type`, `enum`,
+//! `additionalProperties`, plus the `x-cph-content` extension marker. This
+//! keeps the schemas as declarative artifacts (ADR-0006 intent) while keeping
+//! the validator dependency-light and fully under our control.
+
+use std::collections::BTreeMap;
+use std::sync::OnceLock;
+
+use cph_diag::{DiagCode, Diagnostic};
+use cph_model::ElementDescriptor;
+use serde_json::Value as Json;
+
+/// The custom JSON Schema keyword marking a field as a `content` (Typst-source)
+/// field rather than a scalar. See the crate docs for the convention.
+const CONTENT_MARKER: &str = "x-cph-content";
+
+/// The known stdlib kinds, in a stable order.
+const KNOWN_KINDS: &[&str] = &["segment", "example", "lemma", "sop"];
+
+/// Raw schema JSON for each kind, embedded at compile time.
+const SCHEMA_SOURCES: &[(&str, &str)] = &[
+    ("segment", include_str!("../schemas/segment.json")),
+    ("example", include_str!("../schemas/example.json")),
+    ("lemma", include_str!("../schemas/lemma.json")),
+    ("sop", include_str!("../schemas/sop.json")),
+];
+
+/// The scalar `type` a property declares (the subset the stdlib schemas use).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ScalarType {
+    String,
+    Number,
+    Integer,
+    Boolean,
+}
+
+impl ScalarType {
+    fn from_json(s: &str) -> Option<Self> {
+        match s {
+            "string" => Some(ScalarType::String),
+            "number" => Some(ScalarType::Number),
+            "integer" => Some(ScalarType::Integer),
+            "boolean" => Some(ScalarType::Boolean),
+            _ => None,
+        }
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            ScalarType::String => "string",
+            ScalarType::Number => "number",
+            ScalarType::Integer => "integer",
+            ScalarType::Boolean => "boolean",
+        }
+    }
+
+    /// Whether `value` (a scalar coming from `element.toml`, already converted
+    /// to JSON) satisfies this declared type.
+    fn matches(self, value: &Json) -> bool {
+        match self {
+            ScalarType::String => value.is_string(),
+            ScalarType::Number => value.is_number(),
+            ScalarType::Integer => value.is_i64() || value.is_u64(),
+            ScalarType::Boolean => value.is_boolean(),
+        }
+    }
+}
+
+/// One scalar property of a kind (a field that lives in `element.toml`).
+#[derive(Debug, Clone)]
+struct ScalarField {
+    name: String,
+    /// Declared `type`, if any. `None` means "unconstrained" (we still accept
+    /// the field but apply no type check).
+    ty: Option<ScalarType>,
+    /// Allowed values from a JSON Schema `enum`, as JSON values.
+    allowed: Option<Vec<Json>>,
+    required: bool,
+}
+
+/// One content property of a kind (a field whose value is a sibling content
+/// file, marked with `x-cph-content`). The file extension is determined by the
+/// marker's value: `true` (or `"typ"`) → `.typ`; any other string → that
+/// extension (e.g. `"md"` → `.md`, ADR-0015 markdown content surfaces).
+#[derive(Debug, Clone)]
+struct ContentField {
+    name: String,
+    required: bool,
+    /// The content file's extension without the dot (e.g. `"typ"`, `"md"`).
+    ext: String,
+}
+
+/// A parsed kind schema: the content fields (which drive `.typ` existence
+/// checks) and the scalar fields (validated against `element.toml`).
+#[derive(Debug, Clone)]
+pub struct KindSchema {
+    kind: String,
+    content_fields: Vec<ContentField>,
+    scalar_fields: Vec<ScalarField>,
+    /// Whether the schema forbids properties beyond those declared
+    /// (`additionalProperties: false`).
+    deny_additional: bool,
+}
+
+impl KindSchema {
+    /// The kind name this schema describes (e.g. `"example"`).
+    pub fn kind(&self) -> &str {
+        &self.kind
+    }
+
+    /// The names of the `content` fields (those requiring a `<field>.typ`
+    /// file), in schema order.
+    pub fn content_field_names(&self) -> Vec<&str> {
+        self.content_fields
+            .iter()
+            .map(|f| f.name.as_str())
+            .collect()
+    }
+
+    /// The names of the scalar fields (those living in `element.toml`), in
+    /// schema order.
+    pub fn scalar_field_names(&self) -> Vec<&str> {
+        self.scalar_fields.iter().map(|f| f.name.as_str()).collect()
+    }
+
+    /// Parse a kind schema from its raw JSON source. Panics on a malformed
+    /// schema — schemas are compile-time artifacts owned by this crate, so a
+    /// bad one is a build-time bug, not a runtime condition.
+    fn parse(kind: &str, src: &str) -> Self {
+        let root: Json = serde_json::from_str(src)
+            .unwrap_or_else(|e| panic!("kind schema for '{kind}' is not valid JSON: {e}"));
+
+        let deny_additional = root
+            .get("additionalProperties")
+            .and_then(Json::as_bool)
+            .map(|b| !b)
+            .unwrap_or(false);
+
+        let required: Vec<String> = root
+            .get("required")
+            .and_then(Json::as_array)
+            .map(|a| {
+                a.iter()
+                    .filter_map(|v| v.as_str().map(str::to_string))
+                    .collect()
+            })
+            .unwrap_or_default();
+        let is_required = |name: &str| required.iter().any(|r| r == name);
+
+        let mut content_fields = Vec::new();
+        let mut scalar_fields = Vec::new();
+
+        let props = root
+            .get("properties")
+            .and_then(Json::as_object)
+            .unwrap_or_else(|| panic!("kind schema for '{kind}' has no `properties` object"));
+
+        for (name, prop) in props {
+            // The `x-cph-content` marker selects a content field and fixes its
+            // file extension. `true` (the legacy form) and the string `"typ"`
+            // both mean a `.typ` file; any other string is taken as the
+            // extension (e.g. `"md"` → `.md` for markdown content surfaces,
+            // ADR-0015). Absent ⇒ a scalar field.
+            let ext = match prop.get(CONTENT_MARKER) {
+                Some(Json::Bool(true)) => Some("typ".to_string()),
+                Some(Json::String(s)) => Some(s.clone()),
+                _ => None,
+            };
+
+            if let Some(ext) = ext {
+                content_fields.push(ContentField {
+                    name: name.clone(),
+                    required: is_required(name),
+                    ext,
+                });
+            } else {
+                let ty = prop
+                    .get("type")
+                    .and_then(Json::as_str)
+                    .and_then(ScalarType::from_json);
+                let allowed = prop
+                    .get("enum")
+                    .and_then(Json::as_array)
+                    .map(|a| a.to_vec());
+                scalar_fields.push(ScalarField {
+                    name: name.clone(),
+                    ty,
+                    allowed,
+                    required: is_required(name),
+                });
+            }
+        }
+
+        KindSchema {
+            kind: kind.to_string(),
+            content_fields,
+            scalar_fields,
+            deny_additional,
+        }
+    }
+}
+
+/// The lazily-built registry mapping kind name → parsed schema.
+fn registry() -> &'static BTreeMap<&'static str, KindSchema> {
+    static REGISTRY: OnceLock<BTreeMap<&'static str, KindSchema>> = OnceLock::new();
+    REGISTRY.get_or_init(|| {
+        SCHEMA_SOURCES
+            .iter()
+            .map(|(kind, src)| (*kind, KindSchema::parse(kind, src)))
+            .collect()
+    })
+}
+
+/// Look up the parsed [`KindSchema`] for `kind`, or `None` if it is unknown.
+pub fn schema_for(kind: &str) -> Option<&'static KindSchema> {
+    registry().get(kind)
+}
+
+/// The known stdlib kind names (`["segment", "example", "lemma", "sop"]`),
+/// for use by the orchestrator (`cph-check`).
+pub fn known_kinds() -> &'static [&'static str] {
+    KNOWN_KINDS
+}
+
+/// Validate an element instance against its kind's schema.
+///
+/// Self-contained: looks up the schema by `desc.kind` and, if the kind is
+/// unknown, returns a single [`cph_diag::DiagCode::UnknownKind`] diagnostic.
+/// Otherwise it checks, in order:
+///
+/// 1. **Scalar fields** (`desc.scalars`, a `toml::Table`) against the
+///    non-content part of the schema — required-ness, declared `type`, and
+///    `enum`. Violations are [`cph_diag::DiagCode::SchemaViolation`]. Under an
+///    `additionalProperties: false` schema, an unexpected scalar key is also a
+///    `SchemaViolation`.
+/// 2. **Content fields**: for each required content field, that the sibling
+///    file `desc.dir.join("<field>.typ")` exists; if not, a
+///    [`cph_diag::DiagCode::MissingContentFile`]. Optional content fields may be
+///    absent with no diagnostic.
+///
+/// Every diagnostic carries a fix `hint`. `MissingContentFile` names the
+/// expected path in its message; `span` is left `None` (there is no line/col
+/// for a file that does not exist).
+pub fn validate(desc: &ElementDescriptor) -> Vec<Diagnostic> {
+    let Some(schema) = schema_for(&desc.kind) else {
+        return vec![Diagnostic::error(
+            DiagCode::UnknownKind,
+            format!("unknown element kind '{}'", desc.kind),
+        )
+        .with_hint(format!("valid kinds are: {}", KNOWN_KINDS.join(", ")))];
+    };
+
+    let mut diags = Vec::new();
+    validate_scalars(schema, desc, &mut diags);
+    validate_content_files(schema, desc, &mut diags);
+    diags
+}
+
+/// Validate the scalar fields in `desc.scalars` against the schema's scalar
+/// part.
+fn validate_scalars(schema: &KindSchema, desc: &ElementDescriptor, diags: &mut Vec<Diagnostic>) {
+    let scalars = &desc.scalars;
+
+    // Required scalar fields must be present.
+    for field in &schema.scalar_fields {
+        if field.required && !scalars.contains_key(&field.name) {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "element of kind '{}' is missing required field '{}'",
+                        schema.kind, field.name
+                    ),
+                )
+                .with_hint(format!("add `{} = ...` to element.toml", field.name)),
+            );
+        }
+    }
+
+    // Each present scalar: type / enum checks, and (if known) reject unexpected
+    // keys when additionalProperties is false. Content fields must never appear
+    // in element.toml.
+    for (key, value) in scalars {
+        if let Some(field) = schema.content_fields.iter().find(|f| f.name == *key) {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::SchemaViolation,
+                    format!(
+                        "field '{}' of kind '{}' is a content field and must not appear in element.toml",
+                        key, schema.kind
+                    ),
+                )
+                .with_hint(format!(
+                    "remove '{key}' from element.toml; put its content in the sibling file '{key}.{}'",
+                    field.ext
+                )),
+            );
+            continue;
+        }
+
+        let Some(field) = schema.scalar_fields.iter().find(|f| f.name == *key) else {
+            if schema.deny_additional {
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!("unexpected field '{}' for kind '{}'", key, schema.kind),
+                    )
+                    .with_hint(format!(
+                        "remove '{key}' from element.toml (it is not part of the '{}' schema)",
+                        schema.kind
+                    )),
+                );
+            }
+            continue;
+        };
+
+        let json = toml_to_json(value);
+
+        if let Some(ty) = field.ty {
+            if !ty.matches(&json) {
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!(
+                            "field '{}' of kind '{}' must be a {}, got {}",
+                            key,
+                            schema.kind,
+                            ty.label(),
+                            json_type_label(&json)
+                        ),
+                    )
+                    .with_hint(format!(
+                        "set '{key}' to a {} value in element.toml",
+                        ty.label()
+                    )),
+                );
+                continue;
+            }
+        }
+
+        if let Some(allowed) = &field.allowed {
+            if !allowed.contains(&json) {
+                let choices: Vec<String> = allowed.iter().map(render_json_choice).collect();
+                diags.push(
+                    Diagnostic::error(
+                        DiagCode::SchemaViolation,
+                        format!(
+                            "field '{}' of kind '{}' has value {} which is not one of the allowed values",
+                            key,
+                            schema.kind,
+                            render_json_choice(&json)
+                        ),
+                    )
+                    .with_hint(format!("'{key}' must be one of: {}", choices.join(", "))),
+                );
+            }
+        }
+    }
+}
+
+/// For each required content field, check that its `<field>.<ext>` file exists
+/// in the element directory (`.typ` for typst content, `.md` for markdown
+/// content surfaces — ADR-0015).
+fn validate_content_files(
+    schema: &KindSchema,
+    desc: &ElementDescriptor,
+    diags: &mut Vec<Diagnostic>,
+) {
+    for field in &schema.content_fields {
+        if !field.required {
+            // Optional content (e.g. lemma's `proof`): absence is fine.
+            continue;
+        }
+        let file_name = format!("{}.{}", field.name, field.ext);
+        let path = desc.dir.join(&file_name);
+        if !path.is_file() {
+            diags.push(
+                Diagnostic::error(
+                    DiagCode::MissingContentFile,
+                    format!(
+                        "kind '{}' requires the content file '{}', which is missing",
+                        schema.kind,
+                        path.display()
+                    ),
+                )
+                .with_hint(format!(
+                    "create '{file_name}' in the element folder with the {} source for '{}'",
+                    ext_label(&field.ext),
+                    field.name
+                )),
+            );
+        }
+    }
+}
+
+/// A human label for a content-file extension, used in diagnostic hints.
+fn ext_label(ext: &str) -> &'static str {
+    match ext {
+        "md" => "markdown",
+        "typ" => "typst",
+        _ => "content",
+    }
+}
+
+/// Convert a `toml::Value` scalar into the equivalent `serde_json::Value` for
+/// type checking. Composite TOML values (arrays / tables) are converted
+/// structurally too, though the MVP stdlib schemas only use scalars.
+fn toml_to_json(value: &toml::Value) -> Json {
+    match value {
+        toml::Value::String(s) => Json::String(s.clone()),
+        toml::Value::Integer(i) => Json::from(*i),
+        toml::Value::Float(f) => Json::from(*f),
+        toml::Value::Boolean(b) => Json::Bool(*b),
+        toml::Value::Datetime(dt) => Json::String(dt.to_string()),
+        toml::Value::Array(arr) => Json::Array(arr.iter().map(toml_to_json).collect()),
+        toml::Value::Table(tbl) => Json::Object(
+            tbl.iter()
+                .map(|(k, v)| (k.clone(), toml_to_json(v)))
+                .collect(),
+        ),
+    }
+}
+
+/// A short label for a JSON value's runtime type, for diagnostic messages.
+fn json_type_label(value: &Json) -> &'static str {
+    match value {
+        Json::Null => "null",
+        Json::Bool(_) => "boolean",
+        Json::Number(n) => {
+            if n.is_i64() || n.is_u64() {
+                "integer"
+            } else {
+                "number"
+            }
+        }
+        Json::String(_) => "string",
+        Json::Array(_) => "array",
+        Json::Object(_) => "object",
+    }
+}
+
+/// Render a JSON value for an enum-choice list (strings unquoted-ish, others as
+/// JSON).
+fn render_json_choice(value: &Json) -> String {
+    match value {
+        Json::String(s) => format!("\"{s}\""),
+        other => other.to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn registry_has_all_known_kinds() {
+        for kind in known_kinds() {
+            assert!(schema_for(kind).is_some(), "missing schema for {kind}");
+        }
+        assert!(schema_for("frob").is_none());
+    }
+
+    #[test]
+    fn example_field_split() {
+        let s = schema_for("example").unwrap();
+        // `problem`/`solution` are typst content; `slides`/`transcript` are the
+        // optional markdown content surfaces (ADR-0015); `source` is a scalar.
+        // (serde_json's Map is a BTreeMap without the `preserve_order` feature,
+        // so content field names come back alphabetically sorted.)
+        assert_eq!(
+            s.content_field_names(),
+            vec!["problem", "slides", "solution", "transcript"]
+        );
+        assert_eq!(s.scalar_field_names(), vec!["source"]);
+    }
+
+    #[test]
+    fn lemma_proof_is_optional_content() {
+        let s = schema_for("lemma").unwrap();
+        let proof = s.content_fields.iter().find(|f| f.name == "proof").unwrap();
+        assert!(!proof.required);
+        let stmt = s.content_fields.iter().find(|f| f.name == "stmt").unwrap();
+        assert!(stmt.required);
+    }
+
+    #[test]
+    fn markdown_content_fields_carry_md_ext() {
+        // ADR-0015: `slides`/`transcript` are markdown content fields (`x-cph-content: "md"`),
+        // distinct from the `.typ` content fields.
+        let s = schema_for("segment").unwrap();
+        let slides = s.content_fields.iter().find(|f| f.name == "slides").unwrap();
+        assert_eq!(slides.ext, "md");
+        assert!(!slides.required);
+        let transcript = s
+            .content_fields
+            .iter()
+            .find(|f| f.name == "transcript")
+            .unwrap();
+        assert_eq!(transcript.ext, "md");
+        assert!(!transcript.required);
+        // Legacy typst content still resolves to `.typ`.
+        let textbook = s
+            .content_fields
+            .iter()
+            .find(|f| f.name == "textbook")
+            .unwrap();
+        assert_eq!(textbook.ext, "typ");
+        assert!(textbook.required);
+    }
+}
diff --git a/crates/cph-schema/tests/fixtures/example_missing_solution/problem.typ b/crates/cph-schema/tests/fixtures/example_missing_solution/problem.typ
new file mode 100644
index 0000000..3af134b
--- /dev/null
+++ b/crates/cph-schema/tests/fixtures/example_missing_solution/problem.typ
@@ -0,0 +1,2 @@
+= Problem
+only the problem here
diff --git a/crates/cph-schema/tests/fixtures/example_valid/problem.typ b/crates/cph-schema/tests/fixtures/example_valid/problem.typ
new file mode 100644
index 0000000..200e0de
--- /dev/null
+++ b/crates/cph-schema/tests/fixtures/example_valid/problem.typ
@@ -0,0 +1,2 @@
+= Problem
+What is 2+2?
diff --git a/crates/cph-schema/tests/fixtures/example_valid/solution.typ b/crates/cph-schema/tests/fixtures/example_valid/solution.typ
new file mode 100644
index 0000000..31152c0
--- /dev/null
+++ b/crates/cph-schema/tests/fixtures/example_valid/solution.typ
@@ -0,0 +1,2 @@
+= Solution
+4.
diff --git a/crates/cph-schema/tests/fixtures/lemma_no_proof/stmt.typ b/crates/cph-schema/tests/fixtures/lemma_no_proof/stmt.typ
new file mode 100644
index 0000000..1ae08b6
--- /dev/null
+++ b/crates/cph-schema/tests/fixtures/lemma_no_proof/stmt.typ
@@ -0,0 +1,2 @@
+= Statement
+A lemma.
diff --git a/crates/cph-schema/tests/validate.rs b/crates/cph-schema/tests/validate.rs
new file mode 100644
index 0000000..f742d2e
--- /dev/null
+++ b/crates/cph-schema/tests/validate.rs
@@ -0,0 +1,76 @@
+//! Integration tests for `cph-schema::validate`, driven by tiny fixtures under
+//! `tests/fixtures/<case>/` and in-code `ElementDescriptor`s.
+
+use std::path::{Path, PathBuf};
+
+use cph_diag::DiagCode;
+use cph_model::ElementDescriptor;
+use cph_schema::validate;
+
+/// Absolute path to a fixture directory.
+fn fixture(case: &str) -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests")
+        .join("fixtures")
+        .join(case)
+}
+
+fn desc(kind: &str, dir: PathBuf, scalars: toml::Table) -> ElementDescriptor {
+    ElementDescriptor {
+        kind: kind.to_string(),
+        dir,
+        scalars,
+    }
+}
+
+#[test]
+fn valid_example_no_diagnostics() {
+    let mut scalars = toml::Table::new();
+    scalars.insert("source".into(), toml::Value::String("Textbook §3".into()));
+    let d = desc("example", fixture("example_valid"), scalars);
+    let diags = validate(&d);
+    assert!(diags.is_empty(), "expected no diagnostics, got {diags:?}");
+}
+
+#[test]
+fn example_missing_solution_typ_is_missing_content_file() {
+    let d = desc(
+        "example",
+        fixture("example_missing_solution"),
+        toml::Table::new(),
+    );
+    let diags = validate(&d);
+    assert_eq!(diags.len(), 1, "got {diags:?}");
+    assert_eq!(diags[0].code, DiagCode::MissingContentFile);
+    assert!(diags[0].message.contains("solution.typ"));
+    assert!(diags[0].hint.is_some());
+}
+
+#[test]
+fn lemma_without_proof_typ_is_ok() {
+    // stmt.typ exists, proof.typ does not — proof is optional, so no diagnostic.
+    let d = desc("lemma", fixture("lemma_no_proof"), toml::Table::new());
+    let diags = validate(&d);
+    assert!(diags.is_empty(), "expected no diagnostics, got {diags:?}");
+}
+
+#[test]
+fn unknown_kind_is_reported() {
+    let d = desc("frob", fixture("example_valid"), toml::Table::new());
+    let diags = validate(&d);
+    assert_eq!(diags.len(), 1, "got {diags:?}");
+    assert_eq!(diags[0].code, DiagCode::UnknownKind);
+    assert!(diags[0].message.contains("frob"));
+}
+
+#[test]
+fn example_source_non_string_is_schema_violation() {
+    let mut scalars = toml::Table::new();
+    scalars.insert("source".into(), toml::Value::Integer(42));
+    let d = desc("example", fixture("example_valid"), scalars);
+    let diags = validate(&d);
+    assert_eq!(diags.len(), 1, "got {diags:?}");
+    assert_eq!(diags[0].code, DiagCode::SchemaViolation);
+    assert!(diags[0].message.contains("source"));
+    assert!(diags[0].message.contains("string"));
+}
diff --git a/crates/cph-typst/Cargo.toml b/crates/cph-typst/Cargo.toml
new file mode 100644
index 0000000..08bab88
--- /dev/null
+++ b/crates/cph-typst/Cargo.toml
@@ -0,0 +1,32 @@
+[package]
+name = "cph-typst"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+cph-diag = { workspace = true }
+cph-model = { workspace = true }
+cph-schema = { path = "../cph-schema" }
+toml = { workspace = true }
+
+# Embed the `render/` package (cph-render + vendored @preview/numbly) INTO the
+# binary so an installed `cph` is self-contained — no reliance on a source
+# checkout living at a compile-time path. `dirs` locates a per-user cache dir to
+# extract the embedded tree to (typst's World reads render files from disk).
+include_dir = "0.7"
+dirs = "6"
+
+typst = "=0.15.0"
+typst-layout = "=0.15.0"
+typst-pdf = "=0.15.0"
+typst-syntax = "=0.15.0"
+typst-library = "=0.15.0"
+typst-kit = { version = "=0.15.0", features = [
+    "scan-fonts",
+    "embedded-fonts",
+] }
+
+[dev-dependencies]
+cph-model = { workspace = true }
+tempfile = "3"
diff --git a/crates/cph-typst/build.rs b/crates/cph-typst/build.rs
new file mode 100644
index 0000000..c0e215c
--- /dev/null
+++ b/crates/cph-typst/build.rs
@@ -0,0 +1,64 @@
+//! Build script: stage a clean copy of the repo `render/` package into `OUT_DIR`
+//! so `src/embedded.rs` can `include_dir!` it without tripping over the dev-only
+//! self-referential symlink at `render/vendor/local-packages/`.
+//!
+//! Why this exists: `include_dir!` walks a directory at compile time and follows
+//! symlinks. The repo keeps `render/vendor/local-packages/local/cph-render/0.1.0`
+//! as a symlink pointing back at `render/` (a gitignored dev convenience for
+//! typst's local-package resolution). Embedding `render/` directly would make
+//! `include_dir!` recurse into that link forever. The runtime never needs that
+//! link (the engine resolves `@local/cph-render` from the render dir directly,
+//! and `@preview/*` from `vendor/typst-packages/`), so we copy everything EXCEPT
+//! `vendor/local-packages/` into `OUT_DIR/render` and embed that staged tree.
+
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let manifest_dir = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    let render_src = manifest_dir.join("..").join("..").join("render");
+    let out_dir = PathBuf::from(std::env::var("OUT_DIR").unwrap());
+    let staged = out_dir.join("render");
+
+    // Rebuild the staged tree from scratch each run (cheap — ~140 KiB).
+    if staged.exists() {
+        let _ = std::fs::remove_dir_all(&staged);
+    }
+    copy_tree(&render_src, &staged).expect("stage render/ for embedding");
+
+    // Re-run when the render package changes.
+    println!("cargo:rerun-if-changed={}", render_src.display());
+    // Expose the staged path to the crate via an env var include_dir! can read.
+    println!("cargo:rustc-env=CPH_STAGED_RENDER_DIR={}", staged.display());
+}
+
+/// Recursively copy `src` → `dst`, skipping the dev-only `vendor/local-packages`
+/// subtree and never following symlinks into it.
+fn copy_tree(src: &Path, dst: &Path) -> std::io::Result<()> {
+    std::fs::create_dir_all(dst)?;
+    for entry in std::fs::read_dir(src)? {
+        let entry = entry?;
+        let name = entry.file_name();
+        let from = entry.path();
+        let to = dst.join(&name);
+
+        // Skip the self-referential dev symlink tree.
+        if from.ends_with("vendor/local-packages") || name == *"local-packages" {
+            continue;
+        }
+
+        // Resolve symlinks/metadata without following into a cycle: use
+        // `symlink_metadata` so a symlinked dir is treated by its link, not its
+        // (recursive) target. We only copy real files and real directories.
+        let meta = std::fs::symlink_metadata(&from)?;
+        let ft = meta.file_type();
+        if ft.is_symlink() {
+            // Skip any symlink (the only one in the tree is the dev convenience).
+            continue;
+        } else if ft.is_dir() {
+            copy_tree(&from, &to)?;
+        } else if ft.is_file() {
+            std::fs::copy(&from, &to)?;
+        }
+    }
+    Ok(())
+}
diff --git a/crates/cph-typst/src/diag.rs b/crates/cph-typst/src/diag.rs
new file mode 100644
index 0000000..447c9a5
--- /dev/null
+++ b/crates/cph-typst/src/diag.rs
@@ -0,0 +1,120 @@
+//! Map typst [`SourceDiagnostic`]s to [`cph_diag::Diagnostic`]s.
+//!
+//! ## Span mapping (typst 0.15 specifics)
+//!
+//! In 0.15 a diagnostic's `span` is a [`typst::syntax::DiagSpan`] (not the bare
+//! `Span` of 0.14). To locate it we:
+//! 1. `span.id() -> Option<FileId>` for the owning file (`None` ⇒ detached, so
+//!    no span is emitted);
+//! 2. `WorldExt::range(span) -> Option<Range<usize>>` for the byte range — this
+//!    handles every `DiagSpanKind` variant internally (numbered source spans
+//!    *and* raw external byte ranges), so we never match the enum by hand;
+//! 3. compute 1-based line/col from the file's [`typst::syntax::Source`] via
+//!    `lines().byte_to_line_column` (0-based ⇒ `+1`).
+//!
+//! The `main` file is now the real **template** (`exports/<target>.typ`), so a
+//! span there resolves naturally to an authored file — no re-pointing needed. A
+//! span landing in the **virtual augmented manifest** ([`crate::MANIFEST_VPATH`],
+//! served in-memory, not on disk) is reported with its vpath plus a hint marking
+//! it as the framework-synthesized manifest (a manifest-generation bug
+//! indicator) rather than mis-attributed to a user file. Spans in the
+//! `cph-render` package are reported with an `@local/cph-render:…` pseudo-path.
+
+use std::path::PathBuf;
+
+use cph_diag::{DiagCode, Diagnostic, Severity, SourceSpan};
+use typst::diag::{Severity as TypstSeverity, SourceDiagnostic};
+use typst::syntax::{FileId, VirtualRoot};
+use typst::{World, WorldExt};
+
+use crate::world::LessonWorld;
+
+/// Convert one typst diagnostic into a `cph-diag` [`Diagnostic`], resolving its
+/// span against `world`.
+pub fn map_diagnostic(world: &LessonWorld, d: &SourceDiagnostic) -> Diagnostic {
+    let severity = match d.severity {
+        TypstSeverity::Error => Severity::Error,
+        TypstSeverity::Warning => Severity::Warning,
+    };
+
+    // Flatten the typst call trace into the message tail so call-site context
+    // isn't lost (the primary span points at the innermost node).
+    let mut message = d.message.to_string();
+    for tp in &d.trace {
+        message.push_str(&format!("\n  in {}", tp.v));
+    }
+
+    let mut diag = Diagnostic {
+        severity,
+        code: DiagCode::TypstCompile,
+        message,
+        span: None,
+        hint: None,
+    };
+
+    // typst's own hints are the product's core value — carry them through.
+    let mut hints: Vec<String> = d.hints.iter().map(|h| h.v.to_string()).collect();
+
+    if let Some(id) = d.span.id() {
+        if let Some(file) = file_for(world, id) {
+            if is_virtual_manifest(id) {
+                hints.push(
+                    "this span is inside the framework-synthesized manifest \
+                     (/.cph/manifest.toml), not a lesson source file — likely a \
+                     manifest-generation issue"
+                        .to_string(),
+                );
+            }
+            // Byte range via WorldExt::range (DiagSpan is Copy).
+            let byte_range = world.range(d.span).unwrap_or(0..0);
+            let (line, col) = line_col(world, id, byte_range.start);
+            diag.span = Some(SourceSpan {
+                file,
+                byte_range,
+                line,
+                col,
+            });
+        }
+    }
+
+    if !hints.is_empty() {
+        diag.hint = Some(hints.join("; "));
+    }
+    diag
+}
+
+/// Whether `id` is the in-memory augmented-manifest virtual file
+/// ([`crate::MANIFEST_VPATH`]) the engine injects (not a real lesson file).
+fn is_virtual_manifest(id: FileId) -> bool {
+    matches!(id.root(), VirtualRoot::Project)
+        && id.vpath().get_with_slash() == crate::MANIFEST_VPATH
+}
+
+/// 1-based (line, col) for a byte offset in file `id`, defaulting to `(1, 1)`
+/// when the source can't be read or the offset is out of range.
+fn line_col(world: &LessonWorld, id: FileId, byte: usize) -> (u32, u32) {
+    let Ok(source) = world.source(id) else {
+        return (1, 1);
+    };
+    match source.lines().byte_to_line_column(byte) {
+        // byte_to_line_column is 0-based; editors are 1-based.
+        Some((line, col)) => (line as u32 + 1, col as u32 + 1),
+        None => (1, 1),
+    }
+}
+
+/// File path for a `FileId`. Project files are relative to the lesson root (no
+/// leading slash); package files use an `@namespace/name:version/path` form.
+fn file_for(world: &LessonWorld, id: FileId) -> Option<PathBuf> {
+    let _ = world;
+    match id.root() {
+        VirtualRoot::Project => Some(PathBuf::from(id.vpath().get_without_slash())),
+        VirtualRoot::Package(spec) => Some(PathBuf::from(format!(
+            "@{}/{}:{}{}",
+            spec.namespace,
+            spec.name,
+            spec.version,
+            id.vpath().get_with_slash()
+        ))),
+    }
+}
diff --git a/crates/cph-typst/src/embedded.rs b/crates/cph-typst/src/embedded.rs
new file mode 100644
index 0000000..47fc00e
--- /dev/null
+++ b/crates/cph-typst/src/embedded.rs
@@ -0,0 +1,104 @@
+//! Embedded `cph-render` package — makes an installed `cph` self-contained.
+//!
+//! The typst [`crate::world::LessonWorld`] reads the render package
+//! (`@local/cph-render` + the vendored `@preview/numbly`) **from disk**, by
+//! `render_dir.join(vpath.realize)`. In a source checkout that dir is the repo's
+//! `render/`. But a `cargo install`-ed binary has no repo around it — the old
+//! `env!("CARGO_MANIFEST_DIR")/../../render` path points into the build sandbox
+//! and does not exist at runtime.
+//!
+//! So we **embed the whole `render/` tree into the binary** at compile time
+//! (`include_dir!`) and, on first use, **extract it to a per-user cache dir**
+//! keyed by the crate version. `default_render_dir` returns that extracted path.
+//! The tree is tiny (~140 KiB, ~33 files), so embedding is cheap and extraction
+//! is a one-time cost per version.
+//!
+//! `render/vendor/local-packages/` (a dev-only self-referential symlink,
+//! gitignored) is excluded by the build script when it stages the tree for
+//! embedding — see `build.rs`. The embedded copy never contains it, which is
+//! correct: the World resolves `@local/cph-render` from `render_dir` directly,
+//! and `@preview/*` from `vendor/typst-packages/`, neither via that symlink.
+
+use std::path::{Path, PathBuf};
+
+use include_dir::{include_dir, Dir};
+
+/// The `render/` tree, embedded at compile time from the **staged** copy the
+/// build script wrote to `OUT_DIR/render` (which omits the dev-only symlink that
+/// would otherwise make `include_dir!` recurse forever). `CPH_STAGED_RENDER_DIR`
+/// is set by `build.rs`.
+static RENDER_DIR: Dir<'_> = include_dir!("$CPH_STAGED_RENDER_DIR");
+
+/// Resolve the directory the typst World should read the render package from,
+/// extracting the embedded copy to a per-user cache dir if needed.
+///
+/// Resolution order:
+/// 1. `CPH_RENDER_DIR` env var — an explicit override (dev convenience: point
+///    at the live repo `render/`).
+/// 2. The extracted embedded copy under the user cache dir
+///    (`<cache>/cph/render-<version>/`). Extracted once per crate version;
+///    subsequent runs reuse it.
+///
+/// On any failure to locate a cache dir or extract, falls back to a temp-dir
+/// location so the engine still works (just re-extracting per process).
+pub fn resolve_render_dir() -> PathBuf {
+    if let Ok(dir) = std::env::var("CPH_RENDER_DIR") {
+        return PathBuf::from(dir);
+    }
+    ensure_extracted().unwrap_or_else(|_| {
+        // Last-resort: extract under the OS temp dir. Still correct, just not
+        // cached across processes.
+        let fallback = std::env::temp_dir().join(format!("cph-render-{}", env!("CARGO_PKG_VERSION")));
+        let _ = extract_to(&fallback);
+        fallback
+    })
+}
+
+/// The version-keyed cache location and a guarantee the embedded tree is present
+/// there. Returns the directory the World should use.
+fn ensure_extracted() -> std::io::Result<PathBuf> {
+    let base = dirs::cache_dir()
+        .ok_or_else(|| std::io::Error::new(std::io::ErrorKind::NotFound, "no user cache dir"))?;
+    let dest = base
+        .join("cph")
+        .join(format!("render-{}", env!("CARGO_PKG_VERSION")));
+
+    // A sentinel marks a complete extraction; if present, reuse as-is. (Keyed by
+    // version, so a new `cph` version re-extracts into a fresh dir.)
+    let sentinel = dest.join(".extracted");
+    if sentinel.is_file() {
+        return Ok(dest);
+    }
+
+    extract_to(&dest)?;
+    std::fs::write(&sentinel, env!("CARGO_PKG_VERSION"))?;
+    Ok(dest)
+}
+
+/// Write the embedded `render/` tree under `dest` (creating dirs as needed).
+///
+/// Each embedded entry's `.path()` is already relative to the embed root (e.g.
+/// `src/elements/segment.typ`), so we join the **full** path under `dest` and
+/// create parents — no per-level mirroring needed.
+fn extract_to(dest: &Path) -> std::io::Result<()> {
+    std::fs::create_dir_all(dest)?;
+    write_dir(&RENDER_DIR, dest)
+}
+
+/// Recursively write an embedded [`Dir`]'s files under `dest`, preserving the
+/// full relative path of each file.
+fn write_dir(dir: &Dir<'_>, dest: &Path) -> std::io::Result<()> {
+    for entry in dir.entries() {
+        match entry {
+            include_dir::DirEntry::Dir(sub) => write_dir(sub, dest)?,
+            include_dir::DirEntry::File(file) => {
+                let file_dest = dest.join(file.path());
+                if let Some(parent) = file_dest.parent() {
+                    std::fs::create_dir_all(parent)?;
+                }
+                std::fs::write(&file_dest, file.contents())?;
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/crates/cph-typst/src/lib.rs b/crates/cph-typst/src/lib.rs
new file mode 100644
index 0000000..e1bf25f
--- /dev/null
+++ b/crates/cph-typst/src/lib.rs
@@ -0,0 +1,251 @@
+//! `cph-typst` — typst `World`, augmented-manifest injection, compile, PDF,
+//! span mapping.
+//!
+//! Owned by **WU-4**. Embeds the typst 0.15 compiler as a library to:
+//! - **compile-check** a [`cph_model::Lesson`] for a target (collect typst
+//!   errors+warnings as [`cph_diag::Diagnostic`]s), and
+//! - **export a PDF** for a render target.
+//!
+//! ## Model (ADR-0011): compile a template, inject a manifest
+//!
+//! There is **no framework-generated driver** any more. An export target is a
+//! build with a typed [`cph_model::Step::TypstCompile`] naming a **template
+//! file** (e.g. `exports/student.typ`) that lives in the engineering file. The
+//! engine:
+//!
+//! 1. mounts the lesson's engineering-file tree (ADR-0007) as the typst project
+//!    root (`--root`);
+//! 2. sets the World's `main` to that **real template file** under the root, so
+//!    diagnostic spans resolve to an authored file;
+//! 3. builds an **augmented manifest** (the lesson's `info` + ordered `parts`,
+//!    each with a `fields` array of the content fields present on disk — see
+//!    [`manifest`]) and serves it as a virtual in-memory file at
+//!    [`world::MANIFEST_VPATH`], injecting `sys.inputs.manifest` to point there;
+//! 4. lets the template `toml()`-read that manifest and `include` each part's
+//!    content via computed root-relative paths (legal per ADR-0011).
+//!
+//! The augmented manifest closes the OPEN optional-content point: typst has no
+//! file-exists primitive, so the engine (which has filesystem access) tells the
+//! template which optional content fields exist via the per-part `fields` array.
+//!
+//! ## typst version
+//!
+//! Pinned to the `typst` family `=0.15.0`. The 0.15 path/file API differs from
+//! 0.14: `FileId::new(RootedPath)` where `RootedPath::new(VirtualRoot,
+//! VirtualPath)`, and a diagnostic span is a `DiagSpan` (not a bare `Span`).
+
+mod diag;
+mod embedded;
+mod manifest;
+mod world;
+
+use std::path::PathBuf;
+
+use cph_diag::{DiagCode, Diagnostic};
+use cph_model::{Artifact, Lesson, Step, TargetConfig};
+use typst_kit::fonts::{self, FontStore};
+use typst_layout::PagedDocument;
+use typst_pdf::PdfOptions;
+
+pub use manifest::build_augmented_manifest;
+pub use world::{render_package_spec, LessonWorld, MANIFEST_VPATH};
+
+/// The compile/PDF engine: holds the shared font store and the on-disk location
+/// of the `cph-render` package.
+///
+/// Fonts are discovered once (system + embedded) and shared across every
+/// compilation via an [`std::sync::Arc`] inside the per-compile [`LessonWorld`].
+///
+/// `render_dir` is the directory the World resolves `@local/cph-render` (and the
+/// vendored `@preview/*`) from. It is **not** where the compiled template comes
+/// from: the template is a real file under the lesson root (`<root>/<template>`),
+/// found via the normal project-file mapping. `render_dir` only matters for
+/// package resolution.
+pub struct Engine {
+    fonts: std::sync::Arc<FontStore>,
+    render_dir: PathBuf,
+}
+
+impl Engine {
+    /// Construct an engine, discovering system + embedded fonts. The render
+    /// package directory is taken from the `CPH_RENDER_DIR` environment variable
+    /// when set, otherwise the **embedded** render package is extracted to a
+    /// per-user cache dir and used (see [`default_render_dir`]). This keeps an
+    /// installed `cph` self-contained — no source checkout required at runtime.
+    pub fn new() -> Self {
+        Self::with_render_dir(default_render_dir())
+    }
+
+    /// Construct an engine pointing at an explicit `cph-render` package
+    /// directory (the folder containing `lib.typ` / `typst.toml`, and the
+    /// vendored `@preview/*` tree under `vendor/`).
+    pub fn with_render_dir(render_dir: PathBuf) -> Self {
+        let mut store = FontStore::new();
+        // System fonts first (so the host's CJK fonts are preferred), then the
+        // embedded fallbacks. `scan-fonts` / `embedded-fonts` features gate
+        // these iterators.
+        store.extend(fonts::system());
+        store.extend(fonts::embedded());
+        Self {
+            fonts: std::sync::Arc::new(store),
+            render_dir,
+        }
+    }
+
+    /// The directory this engine resolves `@local/cph-render` from.
+    pub fn render_dir(&self) -> &std::path::Path {
+        &self.render_dir
+    }
+
+    /// Compile-check `lesson` for `target`, returning every typst diagnostic
+    /// (errors **and** warnings) mapped to [`Diagnostic`]s. An empty `Vec` means
+    /// a clean compile. Spans are resolved to files relative to `lesson.root`.
+    ///
+    /// A request the engine cannot honor (unknown target, or an MVP-unsupported
+    /// artifact/step shape) short-circuits to a single blocking diagnostic; see
+    /// [`target_precheck`].
+    pub fn compile_check(&self, lesson: &Lesson, target: &str) -> Vec<Diagnostic> {
+        let template = match self.world_for(lesson, target) {
+            Ok(world) => world,
+            Err(blocking) => return blocking,
+        };
+        let world = template;
+        let warned = typst::compile::<PagedDocument>(&world);
+
+        let mut out = Vec::new();
+        if let Err(errors) = &warned.output {
+            out.extend(map_all(&world, errors));
+        }
+        out.extend(map_all(&world, &warned.warnings));
+        out
+    }
+
+    /// Build a PDF for `lesson` / `target`. On a clean compile returns the PDF
+    /// bytes; on a blocking precheck failure or fatal compile errors returns the
+    /// mapped diagnostics. Compile warnings are not surfaced here (use
+    /// [`Engine::compile_check`] for those).
+    ///
+    /// The bytes are returned, not written: for a [`Artifact::SingleFile`] the
+    /// artifact's `filepath` is the *default* output location, but the caller
+    /// (cph-check / the CLI) owns where the PDF lands (and may override with
+    /// `-o`).
+    pub fn build_pdf(&self, lesson: &Lesson, target: &str) -> Result<Vec<u8>, Vec<Diagnostic>> {
+        let world = self.world_for(lesson, target)?;
+        let warned = typst::compile::<PagedDocument>(&world);
+        let doc = match warned.output {
+            Ok(doc) => doc,
+            Err(errors) => return Err(map_all(&world, &errors)),
+        };
+        typst_pdf::pdf(&doc, &PdfOptions::default()).map_err(|errors| map_all(&world, &errors))
+    }
+
+    /// Build the [`LessonWorld`] for `(lesson, target)`, or `Err(blocking)` when
+    /// the request cannot be honored (see [`target_precheck`]).
+    fn world_for(&self, lesson: &Lesson, target: &str) -> Result<LessonWorld, Vec<Diagnostic>> {
+        let template = target_precheck(lesson, target)?;
+        let manifest_src = build_augmented_manifest(lesson);
+        Ok(LessonWorld::new(
+            lesson.root.clone(),
+            self.render_dir.clone(),
+            &template,
+            manifest_src,
+            self.fonts.clone(),
+        ))
+    }
+}
+
+impl Default for Engine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Validate a `(lesson, target)` request and resolve the template path to
+/// compile. Returns `Ok(template_path)` (relative to the lesson root) when the
+/// request is buildable, or `Err(blocking_diagnostics)` when it is not:
+///
+/// - **Unknown target** (the `--target` name isn't in `lesson.targets`, and the
+///   lesson declares at least one target): a `SchemaViolation` error — a target
+///   must be declared in the manifest to be built (ADR-0009).
+/// - **No declared targets at all**: not an error — callers (e.g. `cph-check`)
+///   may compile-check a defaulted `"student"` target the lesson never declared.
+///   The stock template path `exports/<target>.typ` is used (the framework
+///   default; ADR-0011 [`cph_model::Step::default_for`]).
+/// - **MVP-unsupported shape**: per ADR-0011 only a [`Artifact::SingleFile`] with
+///   a [`Step::TypstCompile`] step is implemented this round. A
+///   [`Artifact::FileTree`] artifact, or a target whose (only) step is a
+///   [`Step::Shell`], returns a clear "not yet implemented" `SchemaViolation`
+///   rather than wrong output. The template is taken from the **first**
+///   `TypstCompile` step (MVP: one step per target).
+fn target_precheck(lesson: &Lesson, target: &str) -> Result<PathBuf, Vec<Diagnostic>> {
+    let Some(tc) = lesson.targets.iter().find(|t| t.name == target) else {
+        if lesson.targets.is_empty() {
+            // Lesson declares no targets; the orchestrator compiles a defaulted
+            // target. Use the stock template path (matches cph-model's default).
+            return Ok(PathBuf::from(format!("exports/{target}.typ")));
+        }
+        return Err(vec![Diagnostic::error(
+            DiagCode::SchemaViolation,
+            format!("target '{target}' not declared in manifest"),
+        )
+        .with_hint(format!(
+            "add a `[targets.{target}]` table to manifest.toml, or build a declared target"
+        ))]);
+    };
+
+    // MVP supports a single-file artifact only.
+    if let Artifact::FileTree { .. } = tc.artifact {
+        return Err(vec![Diagnostic::error(
+            DiagCode::SchemaViolation,
+            "file-tree artifact not yet implemented (MVP supports single-file typst-compile)",
+        )
+        .with_hint(format!(
+            "set `[targets.{target}].artifact` to a single-file artifact for now"
+        ))]);
+    }
+
+    template_step(tc).ok_or_else(|| {
+        vec![Diagnostic::error(
+            DiagCode::SchemaViolation,
+            format!(
+                "target '{target}' has no typst-compile step; only single-file \
+                 typst-compile builds are implemented (MVP)"
+            ),
+        )
+        .with_hint(format!(
+            "add a `typst-compile` step with `template = \"exports/{target}.typ\"`, \
+             or defer this target (shell/file-tree builds are not yet implemented)"
+        ))]
+    })
+}
+
+/// The template of the first [`Step::TypstCompile`] in `tc`, if any (MVP: a
+/// target has one step; a `Shell`-only or `AssembleMarkdown`-only target yields
+/// `None`).
+fn template_step(tc: &TargetConfig) -> Option<PathBuf> {
+    tc.steps.iter().find_map(|s| match s {
+        Step::TypstCompile { template } => Some(template.clone()),
+        Step::Shell { .. } => None,
+        Step::AssembleMarkdown { .. } => None,
+    })
+}
+
+/// Map a batch of typst diagnostics to `cph-diag` ones against `world`.
+fn map_all(world: &LessonWorld, diags: &[typst::diag::SourceDiagnostic]) -> Vec<Diagnostic> {
+    diags
+        .iter()
+        .map(|d| diag::map_diagnostic(world, d))
+        .collect()
+}
+
+/// The render-package directory the engine resolves `@local/cph-render` (and the
+/// vendored `@preview/*`) from when no explicit dir is given.
+///
+/// Honors `CPH_RENDER_DIR` first (dev override → live repo `render/`); otherwise
+/// returns a per-user cache dir holding the **embedded** render tree, extracted
+/// on demand (see [`embedded`]). This is what makes a `cargo install`-ed `cph`
+/// self-contained: it no longer depends on a source checkout living at a
+/// compile-time path.
+fn default_render_dir() -> PathBuf {
+    embedded::resolve_render_dir()
+}
diff --git a/crates/cph-typst/src/manifest.rs b/crates/cph-typst/src/manifest.rs
new file mode 100644
index 0000000..cdd4e58
--- /dev/null
+++ b/crates/cph-typst/src/manifest.rs
@@ -0,0 +1,131 @@
+//! Augmented-manifest construction (ADR-0011).
+//!
+//! The template (`exports/<target>.typ`) reads the manifest via
+//! `toml(sys.inputs.manifest)`, then for each part `include`s its content fields
+//! by a **computed** path and reads scalar fields from `<path>/element.toml`.
+//! For *optional* content fields the template must know whether the file exists
+//! on disk — typst has no file-exists primitive and a missing `include` is a
+//! hard error (see the OPEN contract point in `render/templates/student.typ`).
+//!
+//! The ENGINE has filesystem access, so it closes that gap: it builds an
+//! **augmented manifest** = the lesson's `[info]` + ordered `[[parts]]`, with a
+//! per-part **`fields` array** listing the content fields whose `<field>.typ`
+//! actually exists under the lesson root. The augmented manifest is served as an
+//! in-memory virtual file in the [`crate::world::LessonWorld`] (it is **never**
+//! written to the user's tree), and injected via `sys.inputs.manifest`.
+//!
+//! ## `fields` is computed from `cph-schema`
+//!
+//! `cph-schema` already encodes each kind's content fields
+//! ([`cph_schema::KindSchema::content_field_names`]) — the same knowledge the
+//! render package exposes as `part-fields`. We reuse it here rather than
+//! re-deriving a kind→fields map, so the engine and the template agree on what a
+//! kind's content fields are. For each part, a content field is listed in
+//! `fields` iff `<root>/<part.path>/<field>.typ` is a real file.
+
+use cph_model::Lesson;
+
+/// Build the augmented-manifest TOML source for `lesson`.
+///
+/// The result is a self-contained TOML document the template's
+/// `toml(sys.inputs.manifest)` reads. It carries `[info]` (title + optional
+/// author) and the ordered `[[parts]]`, each with `kind`, `path`, and a
+/// `fields = [...]` array of the content fields present on disk (per
+/// [`present_fields`]). It does **not** reproduce `[project]` or `[targets.*]`
+/// — the template only consumes `info` and `parts`.
+pub fn build_augmented_manifest(lesson: &Lesson) -> String {
+    let mut doc = toml::Table::new();
+
+    // [info]
+    let mut info = toml::Table::new();
+    info.insert(
+        "title".to_string(),
+        toml::Value::String(lesson.info.title.clone()),
+    );
+    if !lesson.info.authors.is_empty() {
+        let authors = lesson
+            .info
+            .authors
+            .iter()
+            .cloned()
+            .map(toml::Value::String)
+            .collect();
+        info.insert("author".to_string(), toml::Value::Array(authors));
+    }
+    doc.insert("info".to_string(), toml::Value::Table(info));
+
+    // [[parts]] — preserve declared order; attach the on-disk `fields` array.
+    let parts: Vec<toml::Value> = lesson
+        .parts
+        .iter()
+        .map(|part| {
+            let mut entry = toml::Table::new();
+            entry.insert("kind".to_string(), toml::Value::String(part.kind.clone()));
+            entry.insert(
+                "path".to_string(),
+                toml::Value::String(path_to_forward_slash(&part.path)),
+            );
+            let fields = present_fields(lesson, part)
+                .into_iter()
+                .map(toml::Value::String)
+                .collect();
+            entry.insert("fields".to_string(), toml::Value::Array(fields));
+            toml::Value::Table(entry)
+        })
+        .collect();
+    doc.insert("parts".to_string(), toml::Value::Array(parts));
+
+    toml::to_string(&doc).expect("augmented manifest serializes")
+}
+
+/// The content fields of `part`'s kind whose `<root>/<part.path>/<field>.typ`
+/// file exists on disk, in schema order.
+///
+/// The kind→content-fields knowledge is reused from `cph-schema`
+/// ([`cph_schema::schema_for`]); an unknown kind has no schema and yields an
+/// empty list (the render package surfaces an unknown kind on its own). Both
+/// required and optional content fields are probed — listing a *required* field
+/// here is harmless (the template includes required fields unconditionally), and
+/// it keeps `fields` a faithful "what exists on disk" record.
+fn present_fields(lesson: &Lesson, part: &cph_model::Part) -> Vec<String> {
+    let Some(schema) = cph_schema::schema_for(&part.kind) else {
+        return Vec::new();
+    };
+    let part_dir = lesson.root.join(&part.path);
+    schema
+        .content_field_names()
+        .into_iter()
+        .filter(|field| part_dir.join(format!("{field}.typ")).is_file())
+        .map(str::to_string)
+        .collect()
+}
+
+/// Render a relative `PathBuf` as a forward-slash string, dropping any leading
+/// `./` or `/` and ignoring `..` (already rejected by the cph-model loader).
+/// Element folder names are UTF-8 (e.g. Chinese) and kept verbatim. The template
+/// rebuilds an absolute root-relative include path as `"/" + path + "/" + field`,
+/// so `path` must be a clean relative slash path.
+fn path_to_forward_slash(path: &std::path::Path) -> String {
+    use std::path::Component;
+    let mut out = String::new();
+    for comp in path.components() {
+        if let Component::Normal(s) = comp {
+            if !out.is_empty() {
+                out.push('/');
+            }
+            out.push_str(&s.to_string_lossy());
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn forward_slash_path_keeps_unicode() {
+        let p = std::path::Path::new("segments/开场对照导言");
+        assert_eq!(path_to_forward_slash(p), "segments/开场对照导言");
+    }
+}
diff --git a/crates/cph-typst/src/world.rs b/crates/cph-typst/src/world.rs
new file mode 100644
index 0000000..08b08fc
--- /dev/null
+++ b/crates/cph-typst/src/world.rs
@@ -0,0 +1,236 @@
+//! [`LessonWorld`] — a typst [`World`] over an engineering-file directory tree
+//! plus an in-memory augmented manifest and a disk-mounted `cph-render` package.
+//!
+//! ## Model (ADR-0011)
+//!
+//! The `main` file is the target's **template** (e.g. `<root>/exports/student.typ`),
+//! a *real* file under the lesson root — no framework-generated driver. The
+//! template `toml()`-reads an injected manifest and `include`s each part's
+//! content via computed root-relative paths. The engine injects the manifest as
+//! a virtual file (see below) and sets `sys.inputs.manifest` to its vpath.
+//!
+//! ## File resolution
+//!
+//! - **The template** (`main()`): a `FileId` with `VirtualRoot::Project` whose
+//!   vpath is the template's path under the lesson root (e.g. `/exports/student.typ`).
+//!   It is read from disk like any other project file; its `include "/<part>/…"`
+//!   paths anchor at the lesson root (`--root`).
+//! - **The augmented manifest**: served in-memory at `VirtualRoot::Project` +
+//!   vpath [`MANIFEST_VPATH`] (`/.cph/manifest.toml`). It is **never** written to
+//!   disk — the engine builds it (original manifest + a per-part `fields` array)
+//!   and the template reads it via `toml(sys.inputs.manifest)`.
+//! - **Project files**: any other `FileId` with `VirtualRoot::Project` is read
+//!   from `root.join(vpath.realize)`. Used for content `.typ`, images,
+//!   `element.toml` `toml()`, etc.
+//! - **`@local/cph-render`**: a `FileId` whose root is the render package spec is
+//!   read from `render_dir.join(vpath.realize)`, avoiding installing the package
+//!   into the typst local-package directory.
+//! - **`@preview/<name>:<version>`**: resolved offline from the in-repo vendored
+//!   preview tree at `<render_dir>/vendor/typst-packages/preview/<name>/<version>/`.
+//!   The render package imports `@preview/numbly:0.1.0`; reading it from the
+//!   vendored dir keeps compilation network-free.
+//! - Any *other* `@package` namespace yields a `NotFound` error.
+//!
+//! Sources are cached in a `Mutex<HashMap<FileId, Source>>` so repeated accesses
+//! during one compilation are cheap, as the `World` contract expects.
+
+use std::collections::HashMap;
+use std::path::{Component, Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use typst::diag::{FileError, FileResult};
+use typst::foundations::{Bytes, Datetime, Dict, Duration, Value};
+use typst::syntax::package::{PackageSpec, PackageVersion};
+use typst::syntax::{FileId, RootedPath, Source, VirtualPath, VirtualRoot};
+use typst::text::{Font, FontBook};
+use typst::utils::LazyHash;
+use typst::{Library, LibraryExt, World};
+use typst_kit::fonts::FontStore;
+
+/// Root-relative vpath the augmented manifest is served at (in-memory only).
+///
+/// A **leading slash** is essential: the template lives under `exports/`, and
+/// `toml(sys.inputs.manifest)` resolves a relative path against the template's
+/// own directory — a bare name would miss. A root-relative absolute path anchors
+/// at `--root` (the lesson root) regardless of where the template sits.
+pub const MANIFEST_VPATH: &str = "/.cph/manifest.toml";
+
+/// The package spec the template imports and the World mounts from `render_dir`.
+pub fn render_package_spec() -> PackageSpec {
+    PackageSpec {
+        namespace: "local".into(),
+        name: "cph-render".into(),
+        version: PackageVersion {
+            major: 0,
+            minor: 1,
+            patch: 0,
+        },
+    }
+}
+
+/// A typst `World` for one lesson + target compilation.
+pub struct LessonWorld {
+    /// Engineering-file root (the typst project root).
+    root: PathBuf,
+    /// On-disk location of the `cph-render` package.
+    render_dir: PathBuf,
+    /// The render package spec (`@local/cph-render:0.1.0`).
+    render_spec: PackageSpec,
+    /// FileId of the template entrypoint (a real file under `root`).
+    main: FileId,
+    /// FileId of the in-memory augmented manifest.
+    manifest_id: FileId,
+    /// The augmented-manifest source (in-memory; never on disk).
+    manifest_source: Source,
+    /// Standard library, with `sys.inputs.manifest` set.
+    library: LazyHash<Library>,
+    /// Shared font store (book + lazily-loaded fonts).
+    fonts: Arc<FontStore>,
+    /// Source cache for on-disk files.
+    sources: Mutex<HashMap<FileId, Source>>,
+}
+
+impl LessonWorld {
+    /// Build a world whose `main` is the template at `<root>/<template>` and
+    /// whose injected manifest is `manifest_src` (served virtually at
+    /// [`MANIFEST_VPATH`], with `sys.inputs.manifest` pointing there).
+    ///
+    /// `template` is the lesson-root-relative template path (e.g.
+    /// `exports/student.typ`), taken from the target's `Step::TypstCompile`.
+    pub fn new(
+        root: PathBuf,
+        render_dir: PathBuf,
+        template: &Path,
+        manifest_src: String,
+        fonts: Arc<FontStore>,
+    ) -> Self {
+        let main_vpath = VirtualPath::new(format!("/{}", path_to_forward_slash(template)))
+            .expect("template vpath is a valid virtual path");
+        let main = FileId::new(RootedPath::new(VirtualRoot::Project, main_vpath));
+
+        let manifest_vpath =
+            VirtualPath::new(MANIFEST_VPATH).expect("manifest vpath is a valid virtual path");
+        let manifest_id = FileId::new(RootedPath::new(VirtualRoot::Project, manifest_vpath));
+        let manifest_source = Source::new(manifest_id, manifest_src);
+
+        // Inject `sys.inputs.manifest = "/.cph/manifest.toml"` so the template's
+        // `toml(sys.inputs.manifest)` reads the augmented manifest.
+        let mut inputs = Dict::new();
+        inputs.insert("manifest".into(), Value::Str(MANIFEST_VPATH.into()));
+        let library = Library::builder().with_inputs(inputs).build();
+
+        Self {
+            root,
+            render_dir,
+            render_spec: render_package_spec(),
+            main,
+            manifest_id,
+            manifest_source,
+            library: LazyHash::new(library),
+            fonts,
+            sources: Mutex::new(HashMap::new()),
+        }
+    }
+
+    /// Map a `FileId` to its on-disk path, honoring the project / render-package
+    /// / vendored-`@preview` roots. Returns a `FileError` for any other package
+    /// root.
+    fn resolve(&self, id: FileId) -> FileResult<PathBuf> {
+        let vpath = id.vpath();
+        match id.root() {
+            VirtualRoot::Project => vpath.realize(&self.root).map_err(Into::into),
+            VirtualRoot::Package(spec) if *spec == self.render_spec => {
+                vpath.realize(&self.render_dir).map_err(Into::into)
+            }
+            // `@preview/<name>:<version>` → vendored preview tree under the
+            // render dir. Offline, no download: mirrors typst's preview-cache
+            // layout so e.g. `@preview/numbly:0.1.0` (imported by the render
+            // package) reads from
+            // `<render_dir>/vendor/typst-packages/preview/numbly/0.1.0/`.
+            VirtualRoot::Package(spec) if spec.namespace == "preview" => {
+                let pkg_root = self
+                    .render_dir
+                    .join("vendor")
+                    .join("typst-packages")
+                    .join("preview")
+                    .join(spec.name.as_str())
+                    .join(spec.version.to_string());
+                vpath.realize(&pkg_root).map_err(Into::into)
+            }
+            VirtualRoot::Package(spec) => Err(FileError::Package(
+                typst::diag::PackageError::NotFound(spec.clone()),
+            )),
+        }
+    }
+
+    /// Read raw bytes for `id` from disk (virtual files excluded — handled by
+    /// callers).
+    fn read_bytes(&self, id: FileId) -> FileResult<Vec<u8>> {
+        let path = self.resolve(id)?;
+        std::fs::read(&path).map_err(|e| FileError::from_io(e, &path))
+    }
+}
+
+impl World for LessonWorld {
+    fn library(&self) -> &LazyHash<Library> {
+        &self.library
+    }
+
+    fn book(&self) -> &LazyHash<FontBook> {
+        self.fonts.book()
+    }
+
+    fn main(&self) -> FileId {
+        self.main
+    }
+
+    fn source(&self, id: FileId) -> FileResult<Source> {
+        if id == self.manifest_id {
+            return Ok(self.manifest_source.clone());
+        }
+        // Cache hit?
+        if let Some(src) = self.sources.lock().expect("sources mutex").get(&id) {
+            return Ok(src.clone());
+        }
+        let bytes = self.read_bytes(id)?;
+        let text = String::from_utf8(bytes).map_err(|_| FileError::InvalidUtf8)?;
+        let source = Source::new(id, text);
+        self.sources
+            .lock()
+            .expect("sources mutex")
+            .insert(id, source.clone());
+        Ok(source)
+    }
+
+    fn file(&self, id: FileId) -> FileResult<Bytes> {
+        if id == self.manifest_id {
+            return Ok(Bytes::from_string(self.manifest_source.text().to_string()));
+        }
+        let bytes = self.read_bytes(id)?;
+        Ok(Bytes::new(bytes))
+    }
+
+    fn font(&self, index: usize) -> Option<Font> {
+        self.fonts.font(index)
+    }
+
+    fn today(&self, _offset: Option<Duration>) -> Option<Datetime> {
+        // No clock dependence needed; lessons are reproducible.
+        None
+    }
+}
+
+/// Render a relative `Path` as a forward-slash string, dropping any leading
+/// `./` or `/` and ignoring `..`. UTF-8 segments kept verbatim.
+fn path_to_forward_slash(path: &Path) -> String {
+    let mut out = String::new();
+    for comp in path.components() {
+        if let Component::Normal(s) = comp {
+            if !out.is_empty() {
+                out.push('/');
+            }
+            out.push_str(&s.to_string_lossy());
+        }
+    }
+    out
+}
diff --git a/crates/cph-typst/tests/compile.rs b/crates/cph-typst/tests/compile.rs
new file mode 100644
index 0000000..889efdd
--- /dev/null
+++ b/crates/cph-typst/tests/compile.rs
@@ -0,0 +1,264 @@
+//! Integration tests for `cph-typst` under the ADR-0011 model: the engine
+//! compiles a **template file** (`exports/<target>.typ`) as main, injecting an
+//! **augmented manifest** (per-part `fields` array of on-disk content fields)
+//! served as a virtual file, and resolving `@local/cph-render` + vendored
+//! `@preview/numbly` from the repo `render/` directory.
+//!
+//! There is no render-stub any more: the stock templates import the real
+//! `cph-render` package's full API (`render-lesson`, `part-fields`,
+//! `default-heading-numbering`), so the tests point the [`Engine`] at the real
+//! repo `render/` package. These tests require system CJK fonts (present on dev
+//! and CI via fonts-noto-cjk) and the vendored numbly (committed under
+//! `render/vendor/`), so they run fully offline.
+
+use std::path::PathBuf;
+
+use cph_diag::Severity;
+use cph_typst::{build_augmented_manifest, Engine};
+
+fn fixture_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mini")
+}
+
+fn real_render_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("..")
+        .join("..")
+        .join("render")
+}
+
+fn load_mini() -> cph_model::Lesson {
+    let (lesson, diags) = cph_model::load(&fixture_root());
+    let lesson = lesson.expect("mini fixture loads into a Lesson");
+    let errors: Vec<_> = diags
+        .iter()
+        .filter(|d| d.severity == Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "fixture has loader errors: {errors:?}");
+    lesson
+}
+
+/// PURE UNIT TEST (no fonts, no render package): the augmented manifest carries
+/// `[info]`, the ordered `[[parts]]`, and a per-part `fields` array listing the
+/// content fields present on disk.
+#[test]
+fn augmented_manifest_has_per_part_fields() {
+    let lesson = load_mini();
+    let src = build_augmented_manifest(&lesson);
+
+    // Info round-trips.
+    assert!(src.contains("迷你示例课时"), "info.title present:\n{src}");
+    assert!(src.contains("测试作者"), "info.author present:\n{src}");
+
+    // Parse it back to inspect the per-part fields precisely.
+    let doc: toml::Value = toml::from_str(&src).expect("augmented manifest is valid TOML");
+    let parts = doc
+        .get("parts")
+        .and_then(|p| p.as_array())
+        .expect("parts array present");
+    assert_eq!(parts.len(), 4, "four parts in declared order:\n{src}");
+
+    // `fields` is a presence SET (the template tests membership), so order is
+    // not load-bearing; sort for a stable assertion.
+    let fields_of = |idx: usize| -> Vec<String> {
+        let mut v: Vec<String> = parts[idx]
+            .get("fields")
+            .and_then(|f| f.as_array())
+            .expect("part has a fields array")
+            .iter()
+            .map(|v| v.as_str().unwrap().to_string())
+            .collect();
+        v.sort();
+        v
+    };
+    let path_of = |idx: usize| {
+        parts[idx]
+            .get("path")
+            .unwrap()
+            .as_str()
+            .unwrap()
+            .to_string()
+    };
+    let kind_of = |idx: usize| {
+        parts[idx]
+            .get("kind")
+            .unwrap()
+            .as_str()
+            .unwrap()
+            .to_string()
+    };
+
+    // Order preserved: segment, lemma (w/ proof), lemma (no proof), example.
+    assert_eq!(kind_of(0), "segment");
+    assert_eq!(kind_of(1), "lemma");
+    assert_eq!(kind_of(2), "lemma");
+    assert_eq!(kind_of(3), "example");
+
+    // Paths kept as forward-slash UTF-8.
+    assert_eq!(path_of(0), "segments/开场对照导言");
+    assert_eq!(path_of(2), "lemmas/无证明引理");
+
+    // segment: only `textbook` exists.
+    assert_eq!(fields_of(0), vec!["textbook"]);
+    // lemma WITH proof.typ: both stmt + proof present (sorted).
+    assert_eq!(fields_of(1), vec!["proof", "stmt"]);
+    // lemma WITHOUT proof.typ: only stmt present (the OPTIONAL-content path).
+    assert_eq!(
+        fields_of(2),
+        vec!["stmt"],
+        "proof must be omitted when absent"
+    );
+    // example: problem + solution present (source is a scalar, not a content field).
+    assert_eq!(fields_of(3), vec!["problem", "solution"]);
+}
+
+/// THROUGH-TEMPLATE compile-check against the REAL render package: compiling the
+/// student template as main with the injected augmented manifest is clean (zero
+/// Error-severity diagnostics). This proves the template → manifest → include
+/// loop → cph-render path, including the optional-content gate (the second lemma
+/// has no proof.typ and must NOT cause a missing-include error).
+#[test]
+fn compile_check_clean_through_template() {
+    let lesson = load_mini();
+    let engine = Engine::with_render_dir(real_render_dir());
+    let diags = engine.compile_check(&lesson, "student");
+    let errors: Vec<_> = diags
+        .iter()
+        .filter(|d| d.severity == Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "unexpected compile errors: {errors:#?}");
+}
+
+/// THROUGH-TEMPLATE PDF export, fully offline (vendored numbly + @local/cph-render):
+/// a non-trivial PDF is produced for both targets through the real templates.
+/// This is also the offline-`@preview/numbly` proof — `render/src/style.typ`
+/// imports `@preview/numbly:0.1.0`, resolved from the vendored dir with no
+/// network access; a failure there would surface as a package-not-found error.
+#[test]
+fn build_pdf_through_template_offline() {
+    let lesson = load_mini();
+    let render_dir = real_render_dir();
+    assert!(
+        render_dir.join("lib.typ").is_file(),
+        "real render package missing at {}",
+        render_dir.display()
+    );
+    assert!(
+        render_dir
+            .join("vendor/typst-packages/preview/numbly/0.1.0/lib.typ")
+            .is_file(),
+        "vendored numbly missing under {}",
+        render_dir.display()
+    );
+    let engine = Engine::with_render_dir(render_dir);
+
+    for target in ["student", "teacher"] {
+        let pdf = engine
+            .build_pdf(&lesson, target)
+            .unwrap_or_else(|d| panic!("{target} PDF build failed: {d:#?}"));
+        assert!(pdf.starts_with(b"%PDF"), "{target} output is a PDF");
+        assert!(
+            pdf.len() > 1024,
+            "{target} PDF is non-trivial (got {} bytes)",
+            pdf.len()
+        );
+        eprintln!(
+            "build_pdf_through_template_offline: {target} PDF = {} bytes (numbly resolved offline)",
+            pdf.len()
+        );
+        let out = std::env::temp_dir().join(format!("cph-typst-mini-{target}.pdf"));
+        std::fs::write(&out, &pdf).expect("write pdf");
+    }
+}
+
+/// An undeclared target name (when the lesson declares at least one target) is a
+/// blocking `SchemaViolation`, not a compile attempt.
+#[test]
+fn unknown_target_is_blocking() {
+    let lesson = load_mini();
+    let engine = Engine::with_render_dir(real_render_dir());
+    let diags = engine.compile_check(&lesson, "nonexistent");
+    assert_eq!(diags.len(), 1, "one blocking diagnostic: {diags:#?}");
+    assert_eq!(diags[0].severity, Severity::Error);
+    assert!(
+        diags[0].message.contains("not declared"),
+        "expected an undeclared-target error: {diags:#?}"
+    );
+}
+
+/// A `file-tree` artifact is deferred for MVP: a clear "not yet implemented"
+/// blocking diagnostic rather than a wrong build.
+#[test]
+fn file_tree_artifact_is_deferred() {
+    use cph_model::{Artifact, Info, Lesson, Project, Step, TargetConfig};
+
+    let lesson = Lesson {
+        project: Project {
+            id: "x".into(),
+            name: "x".into(),
+        },
+        info: Info {
+            title: "t".into(),
+            authors: vec![],
+        },
+        parts: vec![],
+        targets: vec![TargetConfig {
+            name: "web".into(),
+            artifact: Artifact::FileTree {
+                root: PathBuf::from("build/web"),
+                outputs: "**/*.html".into(),
+            },
+            steps: vec![Step::TypstCompile {
+                template: PathBuf::from("exports/web.typ"),
+            }],
+            covers: None,
+        }],
+        root: fixture_root(),
+    };
+
+    let engine = Engine::with_render_dir(real_render_dir());
+    let diags = engine.compile_check(&lesson, "web");
+    assert_eq!(diags.len(), 1, "one blocking diagnostic: {diags:#?}");
+    assert!(
+        diags[0].message.contains("file-tree"),
+        "expected a file-tree deferral: {diags:#?}"
+    );
+}
+
+/// A target whose only step is a `shell` step (no typst-compile) is deferred for
+/// MVP with a clear blocking diagnostic.
+#[test]
+fn shell_only_target_is_deferred() {
+    use cph_model::{Artifact, Info, Lesson, Project, Step, TargetConfig};
+
+    let lesson = Lesson {
+        project: Project {
+            id: "x".into(),
+            name: "x".into(),
+        },
+        info: Info {
+            title: "t".into(),
+            authors: vec![],
+        },
+        parts: vec![],
+        targets: vec![TargetConfig {
+            name: "packaged".into(),
+            artifact: Artifact::SingleFile {
+                filepath: PathBuf::from("build/packaged.zip"),
+            },
+            steps: vec![Step::Shell {
+                run: "echo hi".into(),
+            }],
+            covers: None,
+        }],
+        root: fixture_root(),
+    };
+
+    let engine = Engine::with_render_dir(real_render_dir());
+    let diags = engine.compile_check(&lesson, "packaged");
+    assert_eq!(diags.len(), 1, "one blocking diagnostic: {diags:#?}");
+    assert!(
+        diags[0].message.contains("no typst-compile step"),
+        "expected a no-typst-compile-step deferral: {diags:#?}"
+    );
+}
diff --git a/crates/cph-typst/tests/fixtures/mini/examples/自由落体/element.toml b/crates/cph-typst/tests/fixtures/mini/examples/自由落体/element.toml
new file mode 100644
index 0000000..b926a34
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/examples/自由落体/element.toml
@@ -0,0 +1,2 @@
+kind = "example"
+source = "自拟"
diff --git a/crates/cph-typst/tests/fixtures/mini/examples/自由落体/problem.typ b/crates/cph-typst/tests/fixtures/mini/examples/自由落体/problem.typ
new file mode 100644
index 0000000..bd1b529
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/examples/自由落体/problem.typ
@@ -0,0 +1 @@
+一物体从静止自由下落，求下落时间 $t$ 后的速度 $v$ 与位移 $h$。
diff --git a/crates/cph-typst/tests/fixtures/mini/examples/自由落体/solution.typ b/crates/cph-typst/tests/fixtures/mini/examples/自由落体/solution.typ
new file mode 100644
index 0000000..c232427
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/examples/自由落体/solution.typ
@@ -0,0 +1 @@
+由匀加速运动公式，$v = g t$，$h = 1/2 g t^2$。代入 $g approx 9.8 "m/s"^2$ 即得数值结果。
diff --git a/crates/cph-typst/tests/fixtures/mini/exports/student.typ b/crates/cph-typst/tests/fixtures/mini/exports/student.typ
new file mode 100644
index 0000000..a33d25d
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/exports/student.typ
@@ -0,0 +1,79 @@
+// DEFAULT STUDENT TEMPLATE (framework default; ADR-0011).
+//
+// This is a *real, editable* file that lives in an engineering file at
+// `exports/student.typ`. The framework compiles it AS THE MAIN FILE with the
+// manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/student.typ <out>
+//
+// It is intentionally self-contained (no shared helper import) so it can be
+// copied verbatim into a new engineering file's `exports/`. Presentation —
+// heading numbering — lives HERE (editable per engineering file), not in the
+// manifest and not hardcoded in the cph-render package.
+//
+// WHY THE INCLUDE LOOP IS HERE AND NOT IN cph-render: typst resolves a dynamic
+// `include` path relative to the file it lexically appears in, and a package has
+// its own virtual root — an include inside cph-render would resolve against the
+// PACKAGE, not the engineering root. A `/<part.path>/<field>.typ` written HERE
+// (this template lives under `--root`) resolves against `--root`. So the
+// template loads content and hands cph-render an already-assembled `parts` array.
+//
+// OPEN CONTRACT POINT — optional-content presence. typst has no "does this file
+// exist" primitive (a missing `include` is a hard compile error). So the
+// template CANNOT probe disk the way the old Rust driver did for lemma `proof`.
+// It relies on the manifest declaring which optional content fields are present,
+// via a per-part `fields` array listing the content fields that exist on disk
+// (the engine knows this — it walks the part dir). Required fields are loaded
+// unconditionally; optional fields load only if listed in `fields`. If a part
+// omits `fields`, optional content is skipped (conservative). The exact shape of
+// this declaration is for the manifest/Rust contract to pin.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the student build, so the target is fixed.
+#let target = "student"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/crates/cph-typst/tests/fixtures/mini/exports/teacher.typ b/crates/cph-typst/tests/fixtures/mini/exports/teacher.typ
new file mode 100644
index 0000000..b976b1f
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/exports/teacher.typ
@@ -0,0 +1,62 @@
+// DEFAULT TEACHER TEMPLATE (framework default; ADR-0011).
+//
+// Lives in an engineering file at `exports/teacher.typ`. Compiled AS MAIN with
+// the manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/teacher.typ <out>
+//
+// Self-contained (copyable into an engineering file). Identical to student.typ
+// except the fixed target is "teacher" (so the (kind x target) render matrix in
+// cph-render shows solutions and proofs). See student.typ for the full notes on
+// why the include loop lives here (package virtual-root resolution) and on the
+// OPEN optional-content (`fields`) contract point.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the teacher build, so the target is fixed.
+#let target = "teacher"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/crates/cph-typst/tests/fixtures/mini/lemmas/无证明引理/element.toml b/crates/cph-typst/tests/fixtures/mini/lemmas/无证明引理/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/lemmas/无证明引理/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/crates/cph-typst/tests/fixtures/mini/lemmas/无证明引理/stmt.typ b/crates/cph-typst/tests/fixtures/mini/lemmas/无证明引理/stmt.typ
new file mode 100644
index 0000000..af885fb
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/lemmas/无证明引理/stmt.typ
@@ -0,0 +1 @@
+设 $f$ 在闭区间上连续，则 $f$ 有最大值与最小值。
diff --git a/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/element.toml b/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/proof.typ b/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/proof.typ
new file mode 100644
index 0000000..d1c6bb4
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/proof.typ
@@ -0,0 +1,3 @@
+设 $T = l^a g^b$。量纲为 $[T] = "T"$，$[l] = "L"$，$[g] = "L T"^(-2)$。
+比较两端得 $a + b = 0$ 与 $-2 b = 1$，解得 $a = 1 slash 2$，$b = -1 slash 2$，
+故 $T prop sqrt(l slash g)$。$qed$
diff --git a/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/stmt.typ b/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/stmt.typ
new file mode 100644
index 0000000..a88a0fc
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/lemmas/量纲分析估计/stmt.typ
@@ -0,0 +1,3 @@
+设单摆周期 $T$ 仅依赖摆长 $l$ 与重力加速度 $g$，则由量纲分析必有
+$ T = k sqrt(l / g) $
+其中 $k$ 为无量纲常数。
diff --git a/crates/cph-typst/tests/fixtures/mini/manifest.toml b/crates/cph-typst/tests/fixtures/mini/manifest.toml
new file mode 100644
index 0000000..61c8f62
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/manifest.toml
@@ -0,0 +1,38 @@
+[project]
+id = "mini"
+name = "迷你课时"
+
+[info]
+title = "迷你示例课时"
+author = "测试作者"
+
+[[parts]]
+kind = "segment"
+path = "segments/开场对照导言"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/量纲分析估计"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/无证明引理"
+
+[[parts]]
+kind = "example"
+path = "examples/自由落体"
+
+# v2 target shape (ADR-0011): a typed artifact + an ordered list of typed steps.
+# Each target's single `typst-compile` step names the template file to compile
+# as main; the framework injects the augmented manifest into it.
+[targets.student]
+artifact = { type = "single-file", filepath = "build/student.pdf" }
+[[targets.student.steps]]
+type = "typst-compile"
+template = "exports/student.typ"
+
+[targets.teacher]
+artifact = { type = "single-file", filepath = "build/teacher.pdf" }
+[[targets.teacher.steps]]
+type = "typst-compile"
+template = "exports/teacher.typ"
diff --git a/crates/cph-typst/tests/fixtures/mini/segments/开场对照导言/element.toml b/crates/cph-typst/tests/fixtures/mini/segments/开场对照导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/segments/开场对照导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/crates/cph-typst/tests/fixtures/mini/segments/开场对照导言/textbook.typ b/crates/cph-typst/tests/fixtures/mini/segments/开场对照导言/textbook.typ
new file mode 100644
index 0000000..c38b680
--- /dev/null
+++ b/crates/cph-typst/tests/fixtures/mini/segments/开场对照导言/textbook.typ
@@ -0,0 +1,2 @@
+本节通过对照两种估计方法，引入量纲分析这一工具。我们先回顾自由落体，
+其中能量与质量的关系可写作 $E = m c^2$（此处仅作记号示例）。
diff --git a/docs/architecture/adr/0001-project-group-is-collaboration-space.md b/docs/adr/0001-project-group-is-collaboration-space.md
similarity index 100%
rename from docs/architecture/adr/0001-project-group-is-collaboration-space.md
rename to docs/adr/0001-project-group-is-collaboration-space.md
diff --git a/docs/architecture/adr/0002-project-lock-owned-by-agent-run.md b/docs/adr/0002-project-lock-owned-by-agent-run.md
similarity index 100%
rename from docs/architecture/adr/0002-project-lock-owned-by-agent-run.md
rename to docs/adr/0002-project-lock-owned-by-agent-run.md
diff --git a/docs/architecture/adr/0003-on-demand-feishu-context.md b/docs/adr/0003-on-demand-feishu-context.md
similarity index 100%
rename from docs/architecture/adr/0003-on-demand-feishu-context.md
rename to docs/adr/0003-on-demand-feishu-context.md
diff --git a/docs/architecture/adr/0004-feishu-docs-like-permissions.md b/docs/adr/0004-feishu-docs-like-permissions.md
similarity index 100%
rename from docs/architecture/adr/0004-feishu-docs-like-permissions.md
rename to docs/adr/0004-feishu-docs-like-permissions.md
diff --git a/docs/adr/0005-lesson-as-ordered-composition-of-typed-elements.md b/docs/adr/0005-lesson-as-ordered-composition-of-typed-elements.md
new file mode 100644
index 0000000..5cb5756
--- /dev/null
+++ b/docs/adr/0005-lesson-as-ordered-composition-of-typed-elements.md
@@ -0,0 +1,131 @@
+# ADR 0005: Lesson Is An Ordered Composition Of Typed Elements
+
+## Status
+
+Accepted — for the skeleton decisions below. Several sub-decisions are
+deliberately left open; see *Open Questions / Deferred*.
+
+This is the first ADR describing the **product core** (the curriculum
+"engineering file"). ADR 0001–0004 cover only the platform side (Feishu group,
+AgentRun, lock, permissions, on-demand context).
+
+## Context
+
+We are building a digitalization solution for curriculum production. The central
+artifact is a structured "engineering file" for a course — edited with the help
+of a coding agent, validated by a compiler-like rule-based checker that emits
+helpful fix hints. The domain is new; we do not assume LLM pretraining priors
+about its shape. This ADR fixes the shape of that engineering file so that the
+developer and the agent stop making divergent assumptions about it.
+
+What the file is *not*: it is not presentation. The same content drives multiple
+export targets (student handout, teacher lesson plan, PPT, third-party platform
+archive, an HTML interactive-courseware platform). The engineering file is the
+target-agnostic content master; typst, markdown dialects, etc. are downstream.
+
+## Decision
+
+### Granularity: the engineering file is one lesson
+
+One engineering file = one single lesson. A course / unit is *not* an
+engineering file; it is an arrangement (编排) of lessons, modeled elsewhere (see
+*Deferred*).
+
+### A lesson is an ordered sequence of element instances
+
+A lesson is an **ordered** sequence of elements. Order is significant; duration
+is **not** modeled (the file is content-oriented, like a lecture note / handout
+/ slide content flow, not a time-driven timeline). Content is formula-heavy.
+
+### An element instance = a kind tag + data conforming to that kind's schema
+
+Every element carries a **kind** tag plus **data** that conforms to that kind's
+schema. Examples of kinds: worked example (例题), theorem/lemma (定理),
+exposition (讲述/阐述).
+
+### Element kinds form an open, extensible universe
+
+Element kinds are **not** a closed enumeration. They form an open universe — like
+a language standard library: the framework ships a good set of defaults (stdlib),
+and (longer-term) third parties may contribute kinds (like crates). The model
+must therefore never encode kinds as a fixed/closed type.
+
+### A kind's minimal contract to the framework is its data schema only
+
+The single thing a kind must declare to the framework is its **data schema**.
+Rendering is explicitly **not** part of the kind contract.
+
+### Export targets project/render the lesson
+
+An export target (student handout, teacher plan, PPT, third-party archive, HTML
+courseware platform, …) is a projection/rendering of the one lesson. One lesson
+feeds many targets.
+
+### Rendering is a per-(kind, target) configuration matrix that lives in the file
+
+How a given kind appears in a given target is a **configuration matrix**
+indexed by (kind, target). This matrix lives **inside the engineering file**;
+the framework provides good **defaults**, and the file may **override** them.
+(This corresponds to the prototype's `exports/{target}.typ`.)
+
+When a lesson uses a kind for which the current target has **no** render rule,
+the checker emits a **WARNING** (the element is ignored for that target) — **not
+an error**. Missing rendering does not block.
+
+### Target-specific information splits into two categories (a / b)
+
+- **(a) semantic-but-target-specific** — information that genuinely belongs to an
+  element's meaning and only *surfaces* in some targets (e.g. a verbatim script
+  本质上是某 exposition 的口播版本, shown only in the teacher plan; key-point
+  highlighting shown only in the student handout). This **moves up onto the
+  element** as nullable fields.
+- **(b) medium-only** — information that exists only because of a target's medium
+  (HTML interactive behavior, build script, npm dependencies). This does **not**
+  go on the element; it belongs to the target / external artifacts.
+
+### Interactive courseware is an inline heavyweight element
+
+A clickable "teaching apparatus" (教具) that a student plays with on the HTML
+platform is an **inline element** in the content flow (bound to this lesson),
+**not** a whole-lesson render target and **not** (for now) an externally
+referenced artifact. In the model it carries only the apparatus's **problem /
+configuration data**; the heavy implementation (e.g. an npm package such as a
+KenKen-Sudoku renderer) lives **outside** this model, and reuse of such
+implementations is out of scope for this model.
+
+### Typst is a rendering backend, not the definition language
+
+Typst is one rendering backend among several. It is **not** the language in
+which kinds, schemas, or rules are defined (typst's typing is too weak for the
+upper-layer design we want).
+
+## Consequences
+
+- Because kinds are an open universe, the formal model must be parameterized over
+  kinds — no closed `inductive`/enum of element kinds anywhere.
+- Because missing rendering is a warning, not an error, a lesson stays valid and
+  exportable even when some (kind, target) pair has no rule yet.
+- Because the content master is decoupled from presentation, the same lesson
+  projects to many targets; adding a target does not change the lesson.
+- Because a kind's contract is "schema only", rendering and kind-definition can
+  evolve independently of the kind set.
+- The checker (the thing that will "stand in Lean's position" at product runtime)
+  gets its first concrete rule from this ADR: *used-kind-with-no-render-rule ⇒
+  warning*.
+
+## Open Questions / Deferred
+
+Deliberately unspecified. Neither developer nor agent should assume a resolution;
+surface them when they become relevant rather than picking one.
+
+- **Schema representation** — how a kind's data schema is itself expressed (the
+  schema language).
+- **Kind-definition mechanism** — the language/mechanism used to define an element
+  kind (typst scripting is rejected; the replacement is TBD).
+- **Render-rule payload** — the concrete representation of a render rule.
+- **Full lesson legality** — the complete definition of a "legal lesson"; this ADR
+  fixes only the one seed rule (missing render rule ⇒ warning).
+- **Question bank (题库)** — its relationship to elements (reference vs inline) is
+  undecided; a pure-reference model may not be adequate.
+- **Course = arrangement of lessons** — the concrete rules for composing lessons
+  into a course.
diff --git a/docs/adr/0006-element-schema-and-rich-content.md b/docs/adr/0006-element-schema-and-rich-content.md
new file mode 100644
index 0000000..a3c79b3
--- /dev/null
+++ b/docs/adr/0006-element-schema-and-rich-content.md
@@ -0,0 +1,116 @@
+# ADR 0006: Element Schema Is Declarative, Rich Content Is Typst
+
+## Status
+
+Accepted — for the decisions below. Several sub-decisions are deliberately left
+open; see *Open Questions / Deferred*.
+
+Builds on ADR-0005, which fixed that an element instance = a kind tag + data
+conforming to that kind's schema, and that a kind's minimal contract to the
+framework is its **data schema only**. This ADR fixes **how that schema is
+expressed** and **what the schema's "rich content" leaves actually are**.
+
+## Context
+
+ADR-0005 left the schema representation and the kind-definition mechanism as the
+largest OPEN items — and they are the foundation the rule-based checker stands
+on (the checker validates "does this data conform to its kind's schema?"). The
+domain is formula-heavy and content-structured: a worked example has a problem
+statement, options, a solution; a theorem has a statement, a proof, prerequisite
+lemmas. These fields are not bare strings — they are *rich content*.
+
+Two facts about Typst were verified against its source
+(`/Users/sjfhsjfh/Typst/typst`) and drive the decisions below:
+
+- A `.typ` file evaluates to a `Module` that carries **both** a `scope` of
+  `#let` exports **and** a body `Content` (the rendered top-level markup).
+  `Content` retains a `Span` that resolves back to a `FileId` + byte range, so
+  click-to-jump from rendered content to source is possible.
+- `Content` has no `Deserialize`; and Typst's `Source::new` **requires** a
+  `FileId`. Source evaluated with a detached span loses its file identity:
+  `span.id()` becomes `None` (click-to-jump breaks) and a relative
+  `import "../x"` fails with *"cannot access file system from here"*. Relative
+  imports and click-to-jump only work when the source is a real file (with a
+  `VirtualPath`) in the compiler's `World`.
+
+## Decision
+
+### The data schema is declarative — a JSON Schema
+
+A kind declares its data shape as a **declarative JSON Schema** (field names,
+types, constraints), not as a program and not as a bespoke schema DSL. The
+checker reads the schema and validates instance data structurally against it.
+Whether stdlib kinds author their schema by hand-written JSON or via a host-
+language builder is an implementation detail, not part of this contract.
+
+### Field types: built-in scalars plus a `content` leaf type
+
+Schema field types are the built-in scalars (string / number / boolean / enum /
+list / object, as in ordinary JSON Schema) **plus one extension type:
+`content`**. JSON Schema has no native notion of "typst content", so this is a
+deliberate **extension** of JSON Schema (a custom type / `format`). Any
+implementation must honor the same `content` extension rather than inventing its
+own — this is the seam between the schema layer (A) and the rich-content layer.
+
+### A `content` value is a Typst source; its meaning is the module's body content
+
+The value of a `content` field is a **Typst source**. Its denotation is the
+**body content** of that source evaluated as a module (Typst's `Module.content`)
+— not its `#let` exports. The canonical stored form is the **source text**, not
+a serialized `Content`: `Content` cannot be deserialized and its spans are only
+meaningful with the source present, so content is re-evaluated from source when
+needed, never round-tripped as data.
+
+### Rich content is never free-floating — it has a virtual path
+
+Because detached Typst source loses click-to-jump and cannot do relative
+imports, a `content` value is **not** an anonymous text blob. It is a first-class
+file in the compiler's `World`, carrying a **virtual path**. This is what makes
+its spans resolve (click-to-jump) and its relative imports anchor. Concretely,
+the engineering file constitutes a **virtual file system with internal path
+structure**; each rich-content field sits at a path within it.
+
+(This ADR commits only to *"there is a path structure"*. Its concrete on-disk
+form — that the engineering file is a real directory tree — is fixed separately
+in ADR-0007. ADR-0006 does not assume the path structure is a disk directory.)
+
+### Import boundary: within the engineering file, plus packages
+
+A relative `import` inside a rich-content source may resolve only to other paths
+**within the same engineering file's path structure** (reusing definitions local
+to this lesson), plus Typst **`@package`** ecosystem imports. It may **not**
+reach into other engineering files. Cross-lesson reuse, if any, goes through a
+separate mechanism (question bank / reuse — still OPEN, see ADR-0005 Deferred),
+not through raw cross-file imports.
+
+## Consequences
+
+- The checker can introspect a rendered `Content` (its element type, fields,
+  downcasts) to validate rich content beyond "is it present", and can use spans
+  to point diagnostics back at the offending source location.
+- Canonical state is source text; `Content` is a transient product of
+  evaluation. Storage, diffing, and agent edits all operate on source, not on
+  serialized content.
+- Extending JSON Schema with `content` means conformance has a shared extension
+  point: implementations align on one `content` semantics instead of each
+  inventing a rich-text encoding.
+- Rich content requiring a virtual path means the engineering file is inherently
+  a path-structured container, not a bag of anonymous snippets — which is what
+  ADR-0007 then grounds on disk.
+- The import boundary keeps an engineering file self-contained: it depends only
+  on itself and on published packages, never on a sibling lesson's internals.
+
+## Open Questions / Deferred
+
+- **Content element constraints (Y)** — whether a `content` field may be further
+  constrained to admit only certain Typst element kinds (e.g. "inline only, no
+  figure", "exactly one final expression"). Deferred: we will know which
+  constraints are needed only once real stdlib kinds exist. Until then a
+  `content` field means "a block of content", inner element shape unconstrained.
+- **stdlib kind set** — the first batch of framework-provided kinds and their
+  individual schemas (each is later, per-kind work).
+- **JSON Schema dialect** — which draft, and exactly which keywords are
+  permitted in a kind schema (a subset/profile is likely, to keep the checker
+  tractable). Not pinned here.
+- **On-disk form** — fixed in ADR-0007 (directory tree); layout conventions
+  (manifest, element ordering) deferred beyond that.
diff --git a/docs/adr/0007-engineering-file-as-directory-tree.md b/docs/adr/0007-engineering-file-as-directory-tree.md
new file mode 100644
index 0000000..a752d57
--- /dev/null
+++ b/docs/adr/0007-engineering-file-as-directory-tree.md
@@ -0,0 +1,73 @@
+# ADR 0007: The Engineering File Is A Directory Tree On Disk
+
+## Status
+
+Accepted — for the on-disk decision below. The concrete layout conventions are
+deliberately left open; see *Open Questions / Deferred*.
+
+Grounds the abstract premise ADR-0006 relied on. ADR-0006 established that rich
+content needs a **virtual path** and that the engineering file therefore
+constitutes a path-structured virtual file system — but it deliberately did not
+say what that path structure *is* physically. This ADR fixes that: it is a real
+directory tree on a real file system.
+
+## Context
+
+ADR-0006 showed that a rich-content (`content`) value cannot be free-floating
+Typst source: it must be a first-class file with a virtual path so that
+click-to-jump (spans) and relative imports work. That leaves a choice for the
+physical form of the engineering file: a packed/opaque archive, a database blob,
+or a plain directory tree.
+
+The decisive constraint is **who edits the engineering file**: a coding agent
+(Claude) collaboratively with teachers (ADR-0005's premise), and ordinary tools.
+An agent works best when it can read and modify files directly and use existing
+tooling (`grep`, `find`, diff, version control) over plain files in plain
+directories. A packed or database form would force a custom access layer for
+every such operation.
+
+The developer's earlier prototype already had this shape implicitly —
+`segments/`, `examples/`, `lemmas/` directories with per-item files — which is
+the directory tree in embryo, not a crude stand-in.
+
+## Decision
+
+The on-disk form of an engineering file is a **directory tree** on a real file
+system.
+
+- A `content` field's **virtual path** (ADR-0006) is a **real relative path**
+  within that directory tree. The compiler's `World` maps virtual paths to the
+  actual files in the tree; no synthetic/in-memory file system is needed.
+- Relative imports inside rich content resolve relative to the importing file's
+  real position in the tree — which is exactly the import boundary ADR-0006
+  pinned ("within the engineering file, plus `@package`"). This ADR gives that
+  boundary its physical basis: "within the engineering file" = "within this
+  directory tree".
+
+This keeps the engineering file legible to agents and to off-the-shelf tooling,
+and makes the relationship between content fields and their sources directly
+inspectable on disk.
+
+## Consequences
+
+- The engineering file is a directory of plain text/Typst files: directly
+  greppable, diffable, version-controllable, and editable by an agent without a
+  bespoke access layer.
+- `World` is a thin mapping from the directory tree; virtual path = relative path
+  removes any need to invent or maintain a separate virtual file system.
+- The engineering file remains self-contained on disk: its import closure is the
+  tree itself plus published packages (ADR-0006), so it can be moved, copied, or
+  archived as a directory without dangling references to sibling lessons.
+- This is the **physical representation** of ADR-0005's abstract `Lesson` (an
+  ordered sequence of typed elements); how that ordered structure is encoded into
+  the directory is a separate question (below), not implied by "it's a tree".
+
+## Open Questions / Deferred
+
+- **Layout conventions** — the concrete directory layout is *not* fixed here.
+  Specifically deferred: the manifest file (name, location, what it holds); how
+  element instances are arranged in the tree and how their **order** (ADR-0005's
+  `Lesson` is an ordered sequence) is encoded; naming/organization of
+  rich-content `.typ` files. This is the on-disk encoding of ADR-0005's `Lesson`
+  and warrants its own ADR — kept separate so this one fixes only "it is a
+  directory tree", not "how the tree is arranged".
diff --git a/docs/adr/0008-engineering-file-layout-conventions.md b/docs/adr/0008-engineering-file-layout-conventions.md
new file mode 100644
index 0000000..cd66077
--- /dev/null
+++ b/docs/adr/0008-engineering-file-layout-conventions.md
@@ -0,0 +1,145 @@
+# ADR 0008: Engineering-File Layout — Declarative Manifest + Element Descriptors
+
+## Status
+
+Accepted — for the layout conventions below. Some sub-decisions are deferred;
+see *Open Questions / Deferred*.
+
+Discharges the layout question ADR-0007 left open. ADR-0007 fixed that the
+engineering file is a real directory tree but explicitly deferred the concrete
+layout: the manifest (name, location, contents), how element instances are
+arranged and how their **order** (ADR-0005's `Lesson` is an ordered sequence) is
+encoded, and how rich-content `.typ` files are named. This ADR fixes those.
+
+## Context
+
+Two real sample engineering files exist (TH-141, TH-144). They encode the lesson
+as a typst file `main.typ` containing `#import`s of each element's `main.typ`
+plus a `#let parts = (("segment", 模块), ("lemma", 模块), …)` ordered tuple list.
+Each element is a folder under a per-kind directory (`segments/`, `examples/`,
+`lemmas/`, `sop/`); its fields are typst source files (`textbook.typ`,
+`problem.typ`/`solution.typ`, `stmt.typ`/`proof.typ`, `sop.typ`) wired up by the
+element's own `main.typ` via `#let f = include "f.typ"`.
+
+That embryo has one property in tension with the contract: **the ordering
+manifest is itself a typst script**. ADR-0005 rejected typst as the
+definition/scripting language (its typing is too weak), and ADR-0006 moved the
+kind schema off typst onto declarative JSON Schema. A checker that had to *parse
+typst* to recover the lesson's element order would re-introduce exactly the
+dependency those ADRs removed: the order — a first-class part of the `Lesson`
+contract — would be locked inside an evaluated typst program.
+
+## Decision
+
+### The lesson manifest is declarative, not a typst script
+
+The lesson's order and membership live in a **declarative `manifest.toml`** at
+the engineering-file root, read directly by the checker. TOML is chosen for
+consistency with the samples' existing `project.toml` / `info.toml` /
+`meta.toml`. It subsumes `project.toml` and `info.toml`. Shape:
+
+```toml
+[project]
+id   = "…"            # stable project id
+name = "…"            # folder/display name
+
+[info]                # passed through to render targets verbatim
+title  = "…"
+author = "…"           # one author; or a list: author = ["…", "…"]
+
+[[parts]]             # ORDER OF THIS ARRAY IS THE LESSON ORDER (ADR-0005)
+kind = "segment"      # one of the known kinds (ADR-0006 / stdlib set)
+path = "segments/开场对照导言"   # element folder, relative to root
+# … one [[parts]] block per element, in order …
+
+[targets.student]     # which export targets exist for this lesson
+[targets.teacher]
+```
+
+The checker reads `parts` for order and membership. It **must not** parse typst
+to recover ordering — the declarative array is the single source of truth. The
+sample's `main.typ` `#let parts` is **replaced** by this; any typst entrypoint
+that imports elements in order is a *generated build artifact* derived from the
+manifest (see ADR-0007's note that the on-disk encoding of `Lesson` is separate
+from "it's a tree"), never the canonical order.
+
+### `[info].author` is a list; the on-disk single-string form is sugar
+
+A lesson can be authored by several people (a teaching group), so the canonical
+`author` is an **ordered list**, not a single value. For authoring convenience the
+on-disk form accepts **either** a bare string (`author = "…"`, one author) **or** an
+array (`author = ["…", "…"]`). That "string-or-array" union lives **only at the load
+boundary**: the loader normalizes a bare string to a one-element list, and
+everything downstream sees a list. Absent `author` ⇒ empty list. This raw-vs-
+canonical split is pinned in the Lean master as `RawInfo` (the authoring surface)
+vs `Info` (the canonical model whose `authors` is always a list) — see
+`spec/Spec/Courseware/Model/Info.lean`.
+
+### An element folder is self-describing via `element.toml`
+
+Each element folder carries an **`element.toml`** declaring its kind and its
+**scalar** fields (per the kind's JSON Schema, ADR-0006):
+
+```toml
+kind = "example"
+source = "41 届物理竞赛复赛第三大题(1)"   # a scalar field of the example kind
+```
+
+`kind` is explicit in the descriptor (not inferred from the parent directory
+name) so a folder is self-describing and the `segments/`-vs-`lemmas/` directory
+grouping is a human convenience, not load-bearing for the checker.
+
+### `content` fields are convention-named `.typ` siblings
+
+A kind's schema (ADR-0006) marks some fields as the `content` extension type.
+For each such field `F`, its value is the typst source file **`F.typ`** in the
+element folder. The schema — not `element.toml`, not a per-element `main.typ` —
+is the source of truth for *which* `.typ` files must exist. Concretely for the
+MVP kind set: `segment` ⇒ `textbook.typ`; `example` ⇒ `problem.typ`,
+`solution.typ`; `lemma` ⇒ `stmt.typ`, `proof.typ`; `sop` ⇒ `sop.typ`. This
+**drops the samples' per-element `main.typ`** (`#let textbook = include …`):
+that field-to-file wiring is now implied by the schema + naming convention and
+materialized at build time by the export template, not hand-authored. (Originally
+this said "the generated driver"; ADR-0011 supersedes that — there is no generated
+driver, an export template reads the manifest and includes each part's content.)
+
+A `content` field's denotation remains ADR-0006's: the **module body content**
+of `F.typ`, not its `#let` exports. The file sits at a real relative path
+(ADR-0007), so its spans resolve and its relative imports anchor within the tree
+(ADR-0006 import boundary).
+
+## Consequences
+
+- The checker recovers the full ordered lesson from `manifest.toml` + each
+  `element.toml` without evaluating any typst — order and membership are plain
+  data, diffable and greppable.
+- A per-target **export template** (a real, editable `.typ` file, e.g.
+  `exports/student.typ`) reads the manifest and renders the lesson; it is the
+  build entrypoint, not the canonical lesson. (This clause originally described a
+  *generated* driver with static `#import`s, on a since-corrected belief that
+  typst forbids runtime-computed include paths — see ADR-0011's *Correction*.
+  Include/import paths may be computed, so no driver is generated.)
+- Element folders lose their per-element `main.typ`; `element.toml` + the schema's
+  content-file convention replace it. Migrating the samples is a mechanical
+  rewrite (the migration is part of the MVP).
+- `path` being a real relative folder makes "the lesson references element X"
+  inspectable on disk; a dangling `path` is a structural error the checker can
+  point at.
+
+## Open Questions / Deferred
+
+- **Per-file render override.** ADR-0005 says the (kind × target) render matrix
+  lives *in* the engineering file with framework **defaults** the file may
+  **override**. This ADR's `[targets.*]` only *declares which targets exist*; the
+  MVP keeps the render rules entirely in the framework render layer with **no
+  per-file override**. Whether/how a lesson overrides a render rule (a block in
+  `manifest.toml`? a per-target file?) is deferred until a real override need
+  appears. This is a known, surfaced gap against ADR-0005, not an oversight.
+- **Question bank (题库) on disk.** TH-144 has a `题目/` tree of problem/answer
+  pairs outside `parts`. Its layout and its element relationship (ADR-0005
+  Deferred: reference vs inline) stay open; out of MVP scope.
+- **Manifest richness.** Per-part metadata, grouping/sectioning (TH-144's A/B/C
+  structure is only in folder names today), and target-specific options on a part
+  are not modeled here; add when needed rather than guessing now.
+- **stdlib kind set & schema dialect** remain as ADR-0006 left them; this ADR
+  only fixes the on-disk *arrangement*, not the schemas themselves.
diff --git a/docs/adr/0009-export-target-is-a-build.md b/docs/adr/0009-export-target-is-a-build.md
new file mode 100644
index 0000000..f0c718f
--- /dev/null
+++ b/docs/adr/0009-export-target-is-a-build.md
@@ -0,0 +1,149 @@
+# ADR 0009: An Export Target Is A Build Producing A Typed Artifact
+
+## Status
+
+Accepted — for the decisions below. **Amends ADR-0005**: where ADR-0005 framed
+rendering as a passive `(kind × target)` configuration matrix looked up per
+element, this ADR reframes an export target as an active **build** that consumes
+the lesson and produces a typed **artifact**. The seed rule ADR-0005 fixed
+(missing render rule for a used kind ⇒ warning) survives, restated against the
+new structure. Several sub-decisions are deferred; see *Open Questions*.
+
+## Context
+
+ADR-0005 said an export target "projects/renders the lesson", with a render
+matrix that "lives in the engineering file; the framework provides defaults, the
+file may override." The MVP implementation did not realize that override path:
+it hardcoded one target's behavior as a `target == "student"` branch inside the
+render package and baked presentation defaults (heading numbering) into the
+package with no way for an engineering file to change them. That produced a
+concrete bug — a single-symbol numbering pattern (`一、`) reused across heading
+levels, so level-2 headings rendered as `二、一、…` — which is not a typo but the
+**symptom of a missing layer**: targets were behavior welded into code, not
+configuration a lesson can carry and override.
+
+Looking at the prototype confirms the real shape of the problem. It had two
+near-identical export entrypoints (`exports/学生版.typ`, `exports/教师版.typ`)
+plus a `display-control.typ` switching on `sys.inputs("x-export-target")` with a
+scatter of per-concern booleans (`show-answer`, `show-discussion-script`,
+`show-eg-comment`, …). The two scripts are ~95% identical; the duplication —
+load, assemble, compile, page setup — is the same across every target, and only
+a thin policy delta differs. **That repetition is the thing to factor out.**
+
+A target is therefore best understood as **a build script with the repeated
+mechanism abstracted away** — closer in spirit to a GitHub Actions workflow
+(declarative steps, plus a `run`-shell escape hatch) than to a Makefile.
+
+## Decision
+
+### A target is a build that produces a typed artifact
+
+An export target is **a build**: it consumes the (ordered, typed) lesson and
+produces one **artifact**. The artifact's *shape* is part of what the target
+*is*, modeled as an ADT value the target carries:
+
+- `SingleFile` — one bundled document (a 讲义 PDF, a teacher plan PDF).
+- `FileTree` — many files plus an index/manifest (a third-party platform
+  archive).
+
+"Single file vs. many files" is a genuine divergence point — it changes what
+`cph build` emits and what a consumer expects — so the artifact type is part of
+the contract, not an implementation afterthought. (Backend/format beyond this —
+which concrete PDF engine, which markdown dialect — stays open.)
+
+### A build is map + reduce; the reduce is determined by the artifact
+
+A build has two phases, kept distinct:
+
+- **map (per-kind).** For each element kind, how that kind becomes an
+  intermediate fragment. This is declarative and keyed by kind — the part a
+  GitHub-Actions-style schema expresses naturally. **Field visibility lives
+  here**: "student hides `example.solution` and `lemma.proof`; teacher shows
+  them" is simply *what this target's per-kind map does* — not a separate
+  concept and not a property of the element.
+- **reduce / assemble.** The ordered fragments are folded into the artifact.
+  This fold is **determined by the artifact type**, not written per target:
+  - `SingleFile` ⇒ concatenate fragments in lesson order into one document, then
+    compile it. (This is *why* cross-references `@label`/`@ref` and the
+    例题1/例题2 counters work at all: they resolve only when the whole lesson is
+    one compiled document. The fold's statefulness is carried by the backend's
+    own counters at assemble-compile time, not re-implemented in the map.)
+  - `FileTree` ⇒ each part to its own file, plus a generated index.
+
+The framework provides the assembler for each artifact shape; a build only
+*chooses* its artifact type. This is the answer to "a per-kind rule can't express
+aggregation": aggregation isn't crammed into the per-kind schema — the artifact
+value picks a framework assembler, and the **shell escape hatch** is reserved for
+the genuinely irregular case (a third-party archive that runs an npm build).
+
+### The build form: declarative schema plus a `run`-shell hatch
+
+A build is expressed declaratively (a schema — concretely a YAML-ish document,
+consistent with the `manifest.toml`/`element.toml` lineage) with one **`run`
+escape hatch** for steps that resist declaration. Explicitly **not** a Makefile
+or a general scripting language: the declarative surface carries the common
+cases (per-kind map, artifact choice, presentation knobs), and the shell hatch is
+the bounded exception. This mirrors ADR-0006's stance on schemas: fix the *form*
+here, keep the concrete payload an implementation detail.
+
+### typst compilation is a hidden backend mechanism, not part of a target
+
+Compiling typst to PDF is the *shared, repeated* mechanism every PDF-producing
+target needs. It is therefore **backend mechanism, hidden below the target**, not
+something a target re-specifies. A target says "I produce a `SingleFile` PDF";
+*how* the assembled document becomes bytes is the framework's business. (This is
+also where the checker's typst-compile diagnostic belongs — an external facility,
+see ADR-0010.)
+
+### Medium-only information rides the build's shell hatch
+
+ADR-0005's category **(b)** — medium-only information that exists only because of
+a target's medium (HTML interactive behavior, a build script, npm dependencies)
+— finally has a home: it belongs to the **target's build** (its shell hatch /
+artifact assembler), never to the element. This complements ADR-0005's
+category-(a) decision (semantic-but-target-specific fields ride the element); (b)
+rides the build.
+
+### Defaults are seeded at project creation and overridable in the file
+
+The framework ships **default builds** for its stock targets (e.g. student,
+teacher), written into the engineering file when a project is created. The file
+may then **override** pieces of them. The numbering bug is the worked example:
+the fix is not patching the render package but **overriding the student/teacher
+build's numbering** in the engineering file (e.g.
+`numbly("{1:一}、", "{1:1}.{2:1}")` — level-1 `一、`, level-2 `1.1`). This realizes
+ADR-0005's "matrix lives in the file, framework gives defaults, file overrides"
+as an actual editable layer rather than a slogan.
+
+## Consequences
+
+- The two duplicated export scripts collapse into one shared build mechanism plus
+  two small target *configurations* (artifact type + per-kind map + presentation
+  overrides). Adding a target is adding a config value, not copying a script.
+- `cph build --target T` is defined by T's artifact type: it writes one file for
+  `SingleFile`, a directory for `FileTree`.
+- Presentation defaults (numbering, labels, styling) are file-resident and
+  overridable; a wrong default is a one-line edit in the engineering file, not a
+  package change.
+- The contract gains structure (an `Artifact` ADT; a target = build with a
+  per-kind map + an artifact-determined assemble) without committing the concrete
+  build-schema fields — those stay implementation, per the depth ceiling
+  (constitution rule 5).
+- ADR-0005's render-matrix language is superseded by this build framing; its
+  warning rule (missing render for a used kind ⇒ warning, non-blocking) is
+  preserved and restated in ADR-0010 against the new `covers`.
+
+## Open Questions / Deferred
+
+- **Concrete build-schema fields** — the exact declarative keys (per-kind map
+  syntax, where the shell `run` step sits, how an override is written) are an
+  implementation-level schema, fixed later, not in Lean.
+- **Backend / format enumeration** — beyond `SingleFile`/`FileTree`: which PDF
+  engine, and the markdown-dialect / React-template export ADR-0005 mentioned for
+  third-party platforms. Open.
+- **`FileTree` and the shell hatch implementation** — specified here but not
+  implemented in this round (no third-party target instance yet); the MVP
+  implements `SingleFile`/PDF only and marks the rest deferred.
+- **Override granularity** — exactly which pieces of a build a file may override
+  (numbering only? arbitrary presentation? the per-kind map itself?) is fixed as
+  needed; this ADR commits only that an override layer exists and is file-resident.
diff --git a/docs/adr/0010-diagnostics-legal-lesson-and-check-pipeline.md b/docs/adr/0010-diagnostics-legal-lesson-and-check-pipeline.md
new file mode 100644
index 0000000..55bd298
--- /dev/null
+++ b/docs/adr/0010-diagnostics-legal-lesson-and-check-pipeline.md
@@ -0,0 +1,138 @@
+# ADR 0010: Checker Diagnostics, Legal Lesson, And The Check Pipeline
+
+## Status
+
+Accepted — for the decisions below. **Backfills the "full lesson legality"** item
+ADR-0005 explicitly deferred ("the complete definition of a legal lesson; this
+ADR fixes only the one seed rule"). Builds on ADR-0005's seed (missing render ⇒
+warning) and ADR-0009 (target = build). Some items deferred; see *Open Questions*.
+
+> **Corrected by ADR-0012.** The taxonomy below lists *seven* classes including
+> `DanglingReference`. ADR-0012 retires `DanglingReference` — its cases
+> (unresolved `@ref`, out-of-boundary `import`) are all typst compile-time
+> failures, so they fold into `TypstCompile` — leaving *six* classes, and removes
+> the `Oracle.refsResolve` conjunct from `Legal`. Read the taxonomy and the
+> `Legal` definition here through that correction.
+
+## Context
+
+The checker is the product's moat — the thing that "stands in Lean's position" at
+runtime, validating an engineering file and emitting helpful fix hints. The MVP
+implementation grew a **diagnostic taxonomy** (seven codes), a notion of when a
+lesson is **legal** (publishable / buildable), and an ordered **check pipeline** —
+and then treated all three as "implementation detail." They are not. What each
+error class *means*, whether it blocks, what "legal" *is*, and in what order
+checks run with what gating are exactly the non-obvious domain decisions the
+constitution (rule 5) says must be pinned: the developer and the agent would
+otherwise each assume a different answer. This ADR lifts them into the contract.
+
+A deliberate boundary runs through the taxonomy. Some checks the model can state
+structurally (a manifest part points at a folder that exists; a declared kind is
+known). Others are **external facilities** the semantic model cannot itself
+decide — does this typst source compile? do its cross-references resolve? does
+this data conform to its JSON Schema? Those are real, contractually-named
+diagnostics, but their *verdict* comes from an implementation oracle (the typst
+compiler, the schema validator), not from Lean. The contract names them and fixes
+their severity; it does not pretend to decide them.
+
+## Decision
+
+### The diagnostic taxonomy (seven classes)
+
+Each diagnostic carries a **code**, a **severity** (`error` | `warning`, per
+ADR-0005 / `Spec.Courseware.Severity` — two-valued, no info/note), a message, an
+optional source span, and a fix hint. The MVP classes:
+
+| Code | Meaning | Severity | Kind |
+|------|---------|----------|------|
+| `PartPathMissing` | A manifest `[[parts]]` entry points at a folder that does not exist (or escapes the root via `..`). | error | structural |
+| `UnknownKind` | A part declares a kind not in the known kind set (and: a part/`element.toml` kind mismatch). | error | structural |
+| `MissingContentFile` | A `content` field required by the kind's schema has no corresponding `<field>.typ` on disk. | error | structural/schema |
+| `SchemaViolation` | Instance data does not conform to its kind's JSON Schema (bad scalar type, missing required, stray key); also the fallback for a malformed `manifest.toml`/`element.toml`. | error | schema / external |
+| `DanglingReference` | A reference does not resolve — a relative import outside the import boundary, or an unresolved cross-reference. | error | external |
+| `TypstCompile` | The assembled typst source fails to compile (syntax error, unresolved `@ref`, etc.). | error | external |
+| `RenderIgnored` | A used kind has no render rule for a declared target; the element is omitted from that export. | **warning** | semantic |
+
+Six are `error` (blocking); **`RenderIgnored` alone is a `warning`** — the
+ADR-0005 seed rule, restated. The split between *structural* (model decides),
+*schema/external* (oracle decides), and *semantic* (the coverage rule) is the
+boundary described above.
+
+`RenderIgnored`'s severity is pinned to `warning` as a named contract fact (Lean:
+`renderIgnoredSeverity`), so "it does not block export" is greppable and
+alignable, not an inline literal.
+
+### A legal lesson has no error-level diagnostic
+
+A lesson is **legal** (valid, publishable) iff the check pipeline produces **no
+`error`-severity diagnostic**. Warnings do not affect legality — a lesson with
+`RenderIgnored` warnings is still legal and still exports (lossily). This is the
+complete legality predicate ADR-0005 deferred: legality is defined *by the
+diagnostic set*, not by a separate hand-written rulebook. New rules enter
+legality by adding diagnostics, keeping one source of truth.
+
+### External-facility diagnostics are oracle verdicts, not model judgments
+
+`TypstCompile`, `DanglingReference`, and the schema-conformance face of
+`SchemaViolation` assert facts the semantic model **cannot decide on its own**:
+they depend on running the typst compiler and the schema validator. The contract
+therefore models them as **abstract predicates** (e.g. "this source compiles",
+"these references resolve", "this data conforms") **parameterized over an
+implementation-provided oracle**. The Lean spec states *that* such a diagnostic
+exists, what it means, and its severity — and explicitly marks that its truth
+value is supplied by the implementation, not computed in Lean. This keeps the
+contract honest (it does not embed a typst compiler) while still naming the
+diagnostic as part of the legality definition.
+
+### The check pipeline: ordered phases with compile gating
+
+`check` runs five phases in a fixed order, collecting all diagnostics:
+
+1. **load** — parse `manifest.toml` + each `element.toml`. A hard failure (no
+   parseable lesson) stops the pipeline; nothing downstream can run.
+2. **structural** — every part path exists, no `..`, kind is known, part/element
+   kinds agree. Parts already flagged missing here are skipped downstream (no
+   piling diagnostics on one root cause).
+3. **schema** — each present, known-kind part's data validated against its kind
+   schema (scalars + required content files).
+4. **typst compile** — the external-facility phase. **Gated: it runs only if
+   phases 1–3 produced zero errors**, because compiling known-broken input yields
+   noise on top of the real cause. When it runs, it compiles each declared target
+   (ADR-0009), deduping identical diagnostics across targets.
+5. **render-coverage** — the semantic warning rule; runs regardless of gating.
+
+`build --target T` runs phases 1–3, refuses (no artifact) if any error, else
+compiles + exports T's artifact (ADR-0009). It does **not** run coverage —
+coverage describes export loss, informational for `check`, not a gate on one
+target's build.
+
+The **order and the gating are contract**, because they determine which
+diagnostics a user sees (a syntax error behind a missing file is hidden until the
+file exists — deliberate). The per-phase *algorithms* are not pinned in Lean
+(depth ceiling, rule 5): the spec fixes the phases, their order, and the gate, not
+how each check is computed.
+
+## Consequences
+
+- "Is this lesson done / publishable?" has one precise answer: no error-level
+  diagnostic. The CLI's exit code (1 on any error) is this predicate.
+- Adding a checker rule = adding a diagnostic with a severity; legality updates
+  automatically, no separate legality rulebook to keep in sync.
+- The contract can name compile/reference/schema diagnostics as part of legality
+  without embedding the oracles that decide them — the spec stays a semantic
+  master, not a re-implementation.
+- The implementation's `DiagCode` enum, `CheckReport`, and phase sequence now have
+  a contract to align to (by review, per the constitution — no CI gate); the
+  alignment is documented at both ends.
+
+## Open Questions / Deferred
+
+- **Additional codes.** A dedicated `ManifestMalformed` (today folded into
+  `SchemaViolation`) and finer schema/reference codes may be added; the taxonomy
+  is open to growth, each addition a deliberate decision.
+- **Cross-lesson diagnostics.** Anything about a *course* (arrangement of lessons)
+  or the question bank is out of scope — those models are still OPEN (ADR-0005).
+- **Severity of future classes.** Each new diagnostic's blocking/non-blocking
+  status is decided when introduced; only the seven above are fixed here.
+- **Warning sub-structure.** Whether warnings ever need ordering/grouping or a
+  third "info" level remains deferred (ADR-0005 kept `Severity` two-valued).
diff --git a/docs/adr/0011-export-builds-are-typed-steps-over-templates.md b/docs/adr/0011-export-builds-are-typed-steps-over-templates.md
new file mode 100644
index 0000000..e58a765
--- /dev/null
+++ b/docs/adr/0011-export-builds-are-typed-steps-over-templates.md
@@ -0,0 +1,142 @@
+# ADR 0011: Export Builds Are Ordered Typed Steps Over Template Files
+
+## Status
+
+Accepted. **Refines ADR-0009** (which established target = a build producing a
+typed artifact) by fixing the *shape* of a build and of an artifact. **Corrects
+ADR-0008** on one point of fact (see *Correction* below). Some items deferred;
+see *Open Questions*.
+
+## Context
+
+ADR-0009 said an export target is a build producing a typed `Artifact`, with a
+map+reduce structure and a "declarative schema + shell hatch" form. The first
+implementation of that idea (and its initial Lean encoding) got three things at
+the wrong level of abstraction, surfaced in review:
+
+1. **The `Artifact` type was a bare enum** (`singleFile | fileTree`) with no
+   fields. But "what the product *is*" — a single file at some path, vs. a tree
+   of files under some root — is exactly the non-obvious semantics that must be
+   pinned. A bare enum erases it.
+2. **A target was modeled as a loose config bag** (an artifact plus a per-kind
+   render map) with presentation knobs (heading numbering) stuffed into
+   `manifest.toml`. But a build is naturally **an ordered list of steps**, each a
+   typed operation; and presentation belongs in a **template file**, not the
+   manifest.
+3. **A false premise about typst drove the design.** The build was going to have
+   the framework *generate* a typst entrypoint with **static** `#include`s of
+   every element, on the stated belief that "typst forbids a runtime-computed
+   include/import path." That belief is **wrong** (verified below). It is the
+   reason ADR-0008 mentions "the generated driver" and "static `#import`s" — that
+   wording is a residue of the false premise and is corrected here.
+
+## Correction: include/import paths may be runtime-computed
+
+Verified against the typst source (`/Users/sjfhsjfh/Typst/typst`, 0.15):
+
+- `#include` and `#import` parse an **arbitrary code expression**, not a string
+  literal (`typst-syntax` parser uses `code_expr` for both).
+- The source operand is **evaluated at runtime**
+  (`typst-eval/src/import.rs:22` for import, `:174` for include); a
+  `Value::Str` is then resolved to a module via runtime path resolution
+  (`span.resolve_path(...)`). Path resolution is a **runtime** operation, so a
+  missing file is a runtime error, not a parse error.
+- The test suite confirms it: `tests/suite/scripting/include.typ` contains
+  `#let chap2 = include "modu" + "les/chap" + "2.typ"` — a computed path.
+- The **only** restriction: a *bare* `import expr` (no `as name`) rejects a
+  dynamic string source ("dynamic import requires an explicit name");
+  `import expr as name` and `include expr` both accept dynamic paths.
+
+**Consequence:** the framework does **not** need to generate a static-include
+driver. A template can `toml()`-read the manifest and `include` each part's
+content via a **computed** path. This removes an entire generated-artifact layer.
+
+## Decision
+
+### `Artifact` is an ADT with fields
+
+```
+SingleFile { filepath }            -- the product is one file, written at filepath
+FileTree   { root, outputs:glob }  -- the product is the files under root matching outputs
+```
+
+`SingleFile.filepath` says where the one product lands (a 讲义/教案 PDF).
+`FileTree.root` is the output directory; `FileTree.outputs` is a **glob**
+describing which files this build produces (e.g. `**/*.{html,js,json}`) — lighter
+than an explicit manifest of outputs, while still letting a consumer/checker know
+what to expect and verify. These fields are the semantics; they go in the Lean
+ADT with doc, not erased behind a bare tag.
+
+### A target is an artifact plus ordered, typed steps
+
+A target's build is `{ artifact, steps }`, where `steps` is an **ordered** list
+and each `Step` is a **typed operation** (extensible):
+
+- `typstCompile { template }` — compile a **template file** (e.g.
+  `exports/student.typ`) to the artifact. It is *typed*, not a raw shell line,
+  precisely because the framework must **wire the manifest into it** — a bare
+  `typst compile` shell string cannot express that injection.
+- `shell { run }` — an escape hatch for steps that resist declaration (this is
+  where ADR-0005's medium-only category (b): HTML interactive builds, npm, lands).
+
+MVP has exactly one step per target (a single `typstCompile`), but the structure
+is a list because a `FileTree`/third-party build will need several.
+
+### Presentation lives in the template file, not the manifest
+
+The `typstCompile.template` (e.g. `exports/student.typ`) is a **real, editable
+file** in the engineering file. Presentation — heading numbering (numbly), styling
+— lives **there**, not in `manifest.toml`. The manifest's earlier
+`[targets.*.numbering]` block is **removed**. (Framework defaults for these
+templates are written into the engineering file at project-creation time; the
+creation flow is out of this round's scope — the sample's templates are authored
+by hand and noted as "should be seeded".)
+
+### The manifest is injected, not statically inlined
+
+A `typstCompile` step compiles its template **as the main file**, passing the
+manifest in via `--input manifest=<path>` (a path relative to the typst `--root`,
+which is the engineering-file root). The template does
+`toml(sys.inputs.manifest)` to read metadata (course title, author) and the
+ordered `parts`, and `include`s each part's content via the part's path (a
+**computed** path — legal per the *Correction*). No framework-generated driver.
+
+### Render coverage is a declaration, not a payload
+
+ADR-0009's per-target render *payload* (`RenderRule`) is **retired**: the "how" of
+rendering now lives in the template/steps, not in a contract-level rule object.
+What the contract keeps is a **coverage declaration** — *which kinds a target
+renders* — used only by the seed diagnostic. ADR-0005's rule survives unchanged:
+a used kind a target does **not** cover ⇒ a `renderIgnored` **warning** (non-
+blocking). `Primitives.RenderRule` is removed from the model.
+
+## Consequences
+
+- The product type is self-describing: `SingleFile`'s path and `FileTree`'s
+  root+glob are in the contract; `cph build` and any consumer know exactly what a
+  target emits and where.
+- A build is a list of typed steps — adding a non-typst step (npm, packaging) is
+  adding a `shell` step, not bending the typst path.
+- Presentation is editable in one obvious place (the template file); the manifest
+  carries structure (parts, targets, artifacts, steps), not styling.
+- Removing the generated-driver layer simplifies the engine: it compiles a real
+  template file as main (spans resolve to a real authored file, not a synthetic
+  one) and sets one `sys.inputs` value.
+- ADR-0008's "generated driver / static `#import`s" wording is superseded by the
+  template-injection model here.
+
+## Open Questions / Deferred
+
+- **`FileTree` and `shell` step implementation** — specified here, not built this
+  round (no third-party target instance yet). MVP implements `SingleFile` + a
+  single `typstCompile` step; the rest is deferred with explicit diagnostics.
+- **Project-creation seeding** — that default templates are written into a new
+  engineering file at creation time is asserted but not implemented here; the
+  sample's templates are hand-authored.
+- **Template ↔ framework calling convention** — how exactly the template pulls
+  part content (a `cph-render` helper that takes a loader closure, vs. the
+  template doing its own `for`+`include`) is an implementation detail settled in
+  the render package, not pinned in Lean.
+- **Multiple steps / step dependencies** — ordering is fixed as a list; whether
+  steps ever need richer dependency structure is deferred until a multi-step
+  target exists.
diff --git a/docs/adr/0012-fold-dangling-reference-into-typst-compile.md b/docs/adr/0012-fold-dangling-reference-into-typst-compile.md
new file mode 100644
index 0000000..94b5ece
--- /dev/null
+++ b/docs/adr/0012-fold-dangling-reference-into-typst-compile.md
@@ -0,0 +1,90 @@
+# ADR 0012: Reference Resolution Folds Into `TypstCompile` (Taxonomy 7 → 6)
+
+## Status
+
+Accepted. **Corrects ADR-0010**, which fixed the diagnostic taxonomy at *seven*
+classes including a separate `DanglingReference`. This ADR retires
+`DanglingReference`, folding reference-resolution failures into `TypstCompile`, so
+the taxonomy is now *six* classes. ADR-0010 stays the record of the original
+decision; this one records the correction.
+
+## Context
+
+ADR-0010 named two distinct external-facility diagnostics for reference problems:
+
+- `DanglingReference` — "a relative import outside the import boundary, or an
+  unresolved cross-reference."
+- `TypstCompile` — "the assembled typst source fails to compile (syntax error,
+  **unresolved `@ref`**, etc.)."
+
+The unresolved cross-reference (`@ref`) was listed under **both** — a genuine
+contradiction in the contract. And on inspection, the *other* `DanglingReference`
+case (an out-of-boundary relative import) is **also** a typst compile-time error:
+typst resolves `import`/`include` paths at runtime (ADR-0011's *Correction*), so a
+path escaping the import boundary fails as `"cannot access file system from
+here"` — a `TypstCompile` diagnostic. Both of `DanglingReference`'s cases are
+therefore detected by, and surface as, the typst compiler's own output.
+
+The implementation reflected this from the start: `cph-typst` maps **every** typst
+`SourceDiagnostic` to `DiagCode::TypstCompile` (`crates/cph-typst/src/diag.rs`), and
+**no** code path ever emits `DanglingReference`. The Lean `Oracle` likewise had a
+`refsResolve` field separate from `compiles`, but `compiles t` already entails that
+target `t`'s references resolve (the source would not compile otherwise) — so
+`refsResolve` was redundant in the `Legal` conjunction.
+
+`DanglingReference` was thus a contract class with no distinct verdict, no distinct
+emitter, and a definition overlapping `TypstCompile`. It diluted the taxonomy
+rather than carving a real boundary.
+
+## Decision
+
+### `TypstCompile` owns reference resolution
+
+`TypstCompile` is the single external-facility diagnostic for the assembled typst
+source failing to compile — **including** an unresolved cross-reference (`@ref`)
+and a relative `import`/`include` that escapes the import boundary or names a
+missing file. There is no separate reference-resolution diagnostic.
+
+### `DanglingReference` is retired; the taxonomy is six classes
+
+The diagnostic taxonomy is now:
+
+| Code | Meaning | Severity | Kind |
+|------|---------|----------|------|
+| `PartPathMissing` | A manifest `[[parts]]` entry points at a non-existent folder (or escapes the root via `..`). | error | structural |
+| `UnknownKind` | A part declares a kind not in the known set (or a part/`element.toml` kind mismatch). | error | structural |
+| `MissingContentFile` | A `content` field required by the kind schema has no `<field>.typ`. | error | structural/schema |
+| `SchemaViolation` | Instance data violates its kind's JSON Schema; also the malformed-`manifest`/`element.toml` fallback. | error | schema / external |
+| `TypstCompile` | The assembled typst source fails to compile — syntax error, unresolved `@ref`, out-of-boundary or missing `import`/`include`. | error | external |
+| `RenderIgnored` | A used kind a target does not cover; the element is omitted from that export. | **warning** | semantic |
+
+`RenderIgnored` alone is a `warning`; the other five are `error`. The
+structural / external / semantic boundary from ADR-0010 is unchanged.
+
+### `Oracle.refsResolve` is removed
+
+The `Legal`-predicate oracle drops its `refsResolve` field. Reference resolution is
+subsumed by `compiles` (per target): `compiles t` already requires `t`'s assembled
+source to compile, which requires its references to resolve. `Legal` becomes
+`dataConforms ∧ contentFilesPresent ∧ (∀ declared t, compiles t)`.
+
+## Consequences
+
+- The contract no longer contradicts itself on where an unresolved `@ref` is
+  reported: it is a `TypstCompile` diagnostic, full stop.
+- The implementation needs no behavioral change — it already routed all reference
+  failures to `TypstCompile` and never emitted `DanglingReference`. The
+  correction *removes* the unused `DiagCode::DanglingReference` variant, closing
+  the spec↔impl gap (a named-but-unemitted code) rather than leaving it as a
+  permanent MVP-deferred stub.
+- The `Oracle` / `Legal` definitions in the Lean master shrink by one redundant
+  conjunct, with no change to which lessons are legal.
+
+## Open Questions / Deferred
+
+- **Finer reference diagnostics.** Should a future checker want to distinguish an
+  out-of-boundary import from a missing file from an unresolved `@ref` — with
+  reference-specific fix hints better than typst's generic message — that is a
+  *new* diagnostic class, introduced deliberately when the need is real (ADR-0010's
+  "taxonomy is open to growth" still holds). This ADR removes the redundant class;
+  it does not forbid a genuinely distinct one later.
diff --git a/docs/adr/0013-shell-step-execution-for-tool-generated-assets.md b/docs/adr/0013-shell-step-execution-for-tool-generated-assets.md
new file mode 100644
index 0000000..4d29b49
--- /dev/null
+++ b/docs/adr/0013-shell-step-execution-for-tool-generated-assets.md
@@ -0,0 +1,106 @@
+# ADR 0013: Shell-Step Execution For Tool-Generated Assets
+
+## Status
+
+Accepted — and implemented. The `Step::Shell` escape hatch (introduced
+structurally in ADR-0011 but left unimplemented) now has an executor in
+`cph-check`, wired into `cph build --target <shell-target>`. First real use: the
+KenKen interactive boards of the 恒一小奥 lesson, generated by the external
+`kendoku` CLI.
+
+Builds on **ADR-0005** (category (b): medium-only information — HTML interactive
+behavior, build scripts, npm deps — belongs to the target's build, not the
+element) and **ADR-0009/0011** (a target is an `Artifact` produced by an ordered
+list of typed `Step`s; `Shell` is the escape hatch for steps that resist
+declaration). It does not amend them; it fixes the **execution semantics** of
+`Shell`, which those ADRs left open ("MVP 不实现,先建结构").
+
+## Context
+
+Authoring the 恒一小奥 KenKen lesson as a native engineering file surfaced a
+concrete category-(b) need. The lesson's interactive teaching apparatus — a
+clickable 4×4 KenKen board per problem — is produced by a **separate tool**
+(`kendoku`, a TypeScript CLI living in the playground: `kendoku export
+<puzzle.json> -o <out.html>`). The structured source of truth is the puzzle JSON
+(cages / solution / cell-to-cage); the self-contained interactive HTML is a
+**generated build artifact**, exactly ADR-0005's category (b) and ADR-0009's
+"third-party archive that runs an external build".
+
+The contract already named this (`Step::Shell`, `Artifact::FileTree`), and
+`cph-model` already parsed both, but the engine refused them: there was **no step
+executor**, and `cph build` only knew how to compile a typst template to a single
+PDF. So the lesson's apparatus could be *described* but not *produced* through the
+same framework.
+
+Three questions about *how* a shell step runs were genuinely undecided, and
+divergent answers would matter (safety, what `check` means, where failures go).
+
+## Decision
+
+### A shell step executes the command, in the engineering root, on explicit build
+
+`cph build --target <name>` for a target whose steps are `Shell` runs each `run`
+string through the platform shell (`sh -c` / `cmd /C`) with the **engineering
+root as the working directory**, so manifests use root-relative paths. cph
+**executes** the declared command and reports the outcome; it does **not**
+assemble or post-process the tool's output — the external tool writes the files
+(this is the difference from a `TypstCompile` step, where the framework owns the
+compile).
+
+### Arbitrary command execution is opt-in by construction
+
+A shell step is arbitrary code execution, so it must never be a surprise:
+
+- It runs **only** on an explicit `cph build --target <shell-target>`.
+- `cph check` **never** runs shell steps — `check` validates lesson *structure*
+  (is the lesson legal?), not the outcome of running an external tool. A
+  shell/file-tree target is also skipped by the check pipeline's typst-compile
+  phase (it is not a typst build).
+- The CLI prints each command before running it, and streams the tool's output.
+
+### A shell step failure is a build-process error, not a lesson diagnostic
+
+A non-zero exit is a failure of the *build process*, categorically distinct from
+the six lesson-legality diagnostics (`PartPathMissing`, `UnknownKind`,
+`MissingContentFile`, `SchemaViolation`, `TypstCompile`, `RenderIgnored`). Those
+six describe defects *in the lesson*; a tool that fails to run says nothing about
+the lesson's legality.
+
+**We deliberately do NOT add a `ShellStep` diagnostic code.** The closed,
+spec-pinned taxonomy (`Check/Diagnostic.lean`, ADR-0010/0012) stays at six. Shell
+outcomes are reported by the build-execution layer (exit status + captured
+stdout/stderr surfaced by the CLI), keeping the diagnostic vocabulary about
+lesson legality only. This is the lighter, constitution-respecting choice
+(taxonomy is a pinned divergence point; not every error category belongs in it).
+
+### `kendoku` reachability is left open
+
+How the external tool is invoked (a relative `node …/dist/cli.js` path, `npx
+kendoku` after `npm link`, or an installed binary on PATH) is **not** fixed by
+the contract — it is a property of a given engineering file's `run` string and
+its host. The 恒一小奥 manifest uses a relative `node` path as an MVP and its
+README documents the prerequisite; a portable convention is left open.
+
+## Consequences
+
+- The same framework now *produces* the apparatus it could previously only
+  describe: `cph build --target interactives` runs `kendoku` and writes the 10
+  interactive boards under the target's `FileTree` root. The lesson's PDFs
+  (`student`/`teacher`) and its interactives all come from one engineering file
+  through one CLI.
+- `Step::Shell` is no longer a placeholder; its execution semantics are pinned in
+  `Export/Render.lean`.
+- The diagnostic taxonomy is unchanged (still six). Build-process failures live
+  outside it.
+- `TypstCompile` targets are unaffected: the PDF path is exactly as before.
+
+## Open Questions / Deferred
+
+- **Portable tool reachability.** A cross-machine convention for locating an
+  external generator (`npx`/PATH/vendored) rather than a host-specific path.
+- **`FileTree` output validation.** Whether the checker should verify a shell
+  target actually produced the files its `Artifact::FileTree` `outputs` glob
+  declares (currently the tool's exit status is the only signal).
+- **Step animation (GIF) pipeline.** `kendoku steps` → headless-Chrome
+  screenshots → ffmpeg is a multi-tool chain; this lesson uses pre-generated
+  static step PNGs instead. Wiring that chain as shell steps is deferred.
diff --git a/docs/adr/0014-markdown-html-export-backend-direction.md b/docs/adr/0014-markdown-html-export-backend-direction.md
new file mode 100644
index 0000000..0aa6106
--- /dev/null
+++ b/docs/adr/0014-markdown-html-export-backend-direction.md
@@ -0,0 +1,107 @@
+# ADR 0014: Direction For A Markdown / HTML Export Backend
+
+## Status
+
+Proposed — **design-only**. This ADR fixes the *direction* and the key open
+decision for a future markdown/HTML export target; it does **not** implement a
+backend. No code or schema changes accompany it. (The 恒一小奥 lesson ships with
+`student`/`teacher` PDF targets and a `kendoku`-generated `interactives` target;
+a markdown/HTML analog is future work gated on the decision below.)
+
+Builds on **ADR-0009** (export targets are builds producing typed artifacts;
+"which markdown dialect … stays open") and **ADR-0011** (presentation lives in
+the template; the manifest is injected). Relates to **ADR-0013** (a non-typst
+backend could ride a shell step or earn a typed step — still open).
+
+## Context
+
+The third-party 恒一小奥 deliverable was a slide-deck markdown bundle
+(`lesson_slides.md`). A recurring goal is to export an analog of such
+markdown/HTML from the same engineering file. The hard part is **math**: a
+curriculum is formula-heavy, and a markdown/HTML export that turns formulas into
+images (losing selectability, accessibility, and editability) is a regression.
+Three facts were established (web research + reading the pinned deps), and a
+fourth is the user's framing:
+
+1. **typlite (tinymist's markdown export)** renders math **as images** and loses
+   cross-references and styles — it goes through HTML as an intermediary. This is
+   exactly the failure mode to avoid for a math-rich curriculum.
+2. **typst 0.15 native HTML export** (the version this repo pins; `typst-html
+   0.15` is already in `Cargo.lock`) emits equations as **MathML**. MathML is
+   *accessibility-oriented*: selectable and screen-readable, but **not** trivially
+   convertible to KaTeX/LaTeX, and rendering fidelity varies by browser.
+3. **`mitex`** converts **LaTeX → typst** (an authoring-time import direction),
+   **not** typst → LaTeX. So it is not, by itself, the typst-source → markdown
+   lever; the user's instinct that "keep the formula source span and convert it"
+   is right about *what* we want, but `mitex`'s direction is the reverse of what a
+   typst→markdown path needs.
+4. **The user's framing**: the content a markdown/HTML target needs and the
+   content the PDF 讲义/教案 need **do not fully overlap** — so whether a
+   markdown/HTML export must reuse the *same* `typst-content` source, or instead
+   draw on target-specific content, is **genuinely open** and is the pivotal
+   design decision here.
+
+## Decision (direction, not implementation)
+
+### The pivotal open decision: shared source vs. target-specific content
+
+Before any backend is built, decide: **does the markdown/HTML target render the
+same per-element `typst-content` the PDF targets render, or does it consume
+target-specific content?** This ADR does **not** pre-pick it; it names it as the
+gating decision and frames the two routes so the next round can choose
+deliberately (constitution rule 2 — surface, do not assume):
+
+- **(R1) Shared typst-content.** One source of truth; markdown/HTML is another
+  projection of the same `.typ`. Requires a real typst-source → markdown/HTML
+  converter that preserves math as editable markup. Highest reuse, hardest math
+  story.
+- **(R2) Target-specific content.** The element carries (or the target supplies)
+  content authored for the web medium. Decouples the hard typst→markdown math
+  problem from the PDF path, at the cost of a second content surface to maintain.
+
+### Preferred math direction (whichever route is chosen)
+
+Math must survive as **markup, not images**. The favored approach is to obtain
+each equation's **source span** from the typst AST and convert that span's source
+to LaTeX/KaTeX, rather than accept typlite's image rendering or 0.15's
+accessibility-MathML as the final form. Concretely, the next round should
+evaluate:
+
+- harvesting equation source spans via `typst-syntax` and emitting
+  `$…$`/`$$…$$` (KaTeX-compatible) from the typst math source, and
+- studying tinymist's own conversion crate (typlite / `cmarker`) for reusable
+  pieces — adopting what helps, but **not** its math-as-image fallback.
+
+A small **proof-of-concept** scoped to *this* lesson (whose math is trivial —
+`8×`, `2-`, `12×`) is the right first experiment: it exercises the pipeline
+end-to-end while sidestepping the hardest formula cases, and shows whether
+equations come out as text/KaTeX rather than images.
+
+### Backend mechanics, once the route is chosen
+
+- typst 0.15 HTML export is reachable today (`typst-html 0.15` is a transitive
+  dep; promotable to a direct dep) — usable for R1's HTML side.
+- A markdown (rather than HTML) artifact may post-process that HTML, or emit
+  markdown directly from the AST — open, decided with the route.
+- Per ADR-0013, the backend may run as a typed step or a shell step; whether the
+  non-typst backend earns its own typed `Step` constructor is still open.
+
+## Consequences
+
+- The export-backend work has an explicit gating decision (R1 vs. R2) and a
+  pinned math principle (markup, not images), so the next round starts from a
+  decision rather than a blank page.
+- No implementation, schema, or Lean change lands now — the contract is
+  unchanged; this is a recorded design direction.
+- The PDF and interactives paths are unaffected and remain the lesson's shipping
+  targets.
+
+## Open Questions / Deferred
+
+- **R1 vs. R2** — the pivotal decision above; unresolved by design.
+- **Concrete math conversion** — span-harvest → KaTeX vs. reusing a tinymist
+  crate; to be settled by the PoC.
+- **Markdown dialect** — which dialect/fenced-div conventions the markdown
+  artifact targets (ADR-0009 left this open; still open).
+- **Typed non-typst step** — whether the backend rides `Shell` or earns a typed
+  `Step` (ADR-0013 open question).
diff --git a/docs/adr/0015-slides-and-transcript-markdown-surfaces.md b/docs/adr/0015-slides-and-transcript-markdown-surfaces.md
new file mode 100644
index 0000000..14fb1e0
--- /dev/null
+++ b/docs/adr/0015-slides-and-transcript-markdown-surfaces.md
@@ -0,0 +1,177 @@
+# ADR 0015: Slides & Transcript As Per-Element Markdown Content Surfaces
+
+## Status
+
+Accepted — and to be implemented. Adds two new **markdown** content surfaces
+(`slides`, `transcript`) as per-element optional content fields, plus a typed
+`Step.assembleMarkdown` that concatenates them in parts order into a single-file
+markdown deliverable.
+
+Builds on **ADR-0005** ((a)-class fields like 逐字稿 live inside a kind's
+`ElementData`; (b)-class medium lives in the target build), **ADR-0006**
+(`content` leaves in a kind schema), **ADR-0011** (a target is an artifact +
+ordered typed steps; presentation lives in the template/content not the
+manifest), **ADR-0013** (non-typst targets ride a build step; failures are
+build-process errors outside the 6-class taxonomy), and **ADR-0014** (the
+markdown/HTML export direction — R1 shared typst-content vs. R2 target-specific
+content; math must survive as markup not images).
+
+## Context
+
+The KenKen lesson (and curriculum generally) needs a **slides** deliverable —
+an **outline-grade** projection (titles + bullet points; detail belongs in the
+讲义/教案 or the 逐字稿), aimed at a third-party platform whose interchange
+format is a **specific markdown dialect**. It also needs a **逐字稿**
+(transcript) — the spoken text, read aloud, no typography needed.
+
+Two prior facts made the design:
+
+1. **slides content ≠ 讲义 content.** ADR-0014 already recorded that a
+   markdown/HTML target's content does not fully overlap the PDF 讲义/教案.
+   Forcing slides to be a projection of the same typst source (ADR-0014's R1)
+   drags in the hard **typst→markdown math conversion** (typlite renders math
+   as images; 0.15 MathML is accessibility-oriented and hard to turn into KaTeX;
+   `mitex` is LaTeX→typst, the reverse direction — ADR-0014 §Context).
+2. **slides/逐字稿 can be authored directly in markdown.** If `slides` and
+   `transcript` are authored as **markdown + KaTeX from the start**, there is
+   *no* typst→markdown conversion at all — the math is KaTeX source (`$…$`) on
+   the day it is written. The math principle ("markup, not images", ADR-0014)
+   is satisfied for free, not by building a fragile converter.
+
+So for the slides/transcript surfaces this ADR picks **ADR-0014's R2**
+(target-specific content) deliberately: it **sidesteps** the typst→md converter
+entirely. The converter (R1) remains an open problem only for the *讲义* surface,
+which is independent and out of scope here.
+
+The spec already pins where (a)-class fields live: `Element.lean` says
+"逐字稿、重点圈划 落在具体 kind 的 `ElementData` 内". So `slides`/`transcript`
+are modeled as **per-kind optional `content` leaves** (declared in each kind's
+JSON schema), consistent with the existing `textbook`/`problem`/`solution`
+content fields — except their **format is markdown, not typst**. This is a real
+extension to the `content` concept: a content leaf now carries a *format*
+(typst | markdown). `RichContent.lean` gains a `ContentFormat` and the content
+ref gains a `format` field.
+
+## Decision
+
+### Two new markdown content fields on every kind
+
+Each stdlib kind schema (`segment`, `example`, `lemma`, `sop`) gains two
+**optional** `content` fields — `slides` and `transcript` — whose format is
+**markdown** (`x-cph-content: "md"`, the new extension-bearing form of the
+marker; the old `x-cph-content: true` stays `.typ` for backward compat).
+Optional ⇒ a kind instance without them is legal (like a lemma's `proof`).
+Convention: `slides.md` is **outline-grade** (title + bullets; no worked
+detail — that lives in 讲义/逐字稿); `transcript.md` is the **spoken** text.
+
+### A new typed step `Step.assembleMarkdown field`
+
+A target like `[targets.slides]` carries `[[…steps]] type = "assemble-markdown"
+field = "slides"` over a `single-file` artifact. The framework **owns** the
+assembly (not a `cat`): it walks the manifest `[[parts]]` **in order**, reads
+each element's `<field>.md` if present (skips if absent), joins them with a
+blank-line separator, and writes the single file to the artifact's `filepath`
+(relative to the engineering root). It does **not** inject headings — each
+`slides.md`/`transcript.md` authors its own `# …` (presentation lives in the
+content, ADR-0011).
+
+This is **typed**, not `shell`, because ordered-read + skip-missing +
+write-to-artifact-path is cleaner owned by the framework than expressed as a
+shell pipeline, and it stays deterministic/testable.
+
+### Self-contained build dir: the assembler collects referenced images
+
+The assembled `slides.md` is written under the build root (the artifact
+`filepath`'s parent, e.g. `build/`). For that directory to be a **standalone
+deliverable** — uploadable to the platform on its own — its `![](rel)` image
+references must resolve *within* it, not back into the engineering root. So the
+assembler, after writing the markdown, scans it for local `![](rel)` references
+and copies each referenced image from the engineering root (`<eng-root>/<rel>`)
+into the build root (`<build-root>/<rel>`), preserving the relative path. This
+is part of the `assembleMarkdown` step's owned responsibility (one step, not a
+separate copy step), keeping a slides target a single typed step.
+
+Conventions that fall out of this:
+
+- **Image references are authored relative to the engineering root** (`assets/images/…`),
+  which is *also* their form relative to the build root after the copy — so the
+  same path string is correct both at authoring time (the source image exists at
+  `<eng-root>/assets/images/…`) and in the assembled output.
+- **Widget references are build-relative** (`interactives/ex1.html`): widgets are
+  *build artifacts* produced by a separate target (the `interactives` shell
+  target writes `build/interactives/`), not engineering-root sources, so they are
+  referenced but **not** copied by the assembler. A fully self-contained `build/`
+  therefore requires running the `interactives` target first — a documented
+  prerequisite, like `kendoku` reachability (ADR-0013).
+- **External URLs** (`http://`/`https://`/`data:`) are left untouched.
+- A referenced image **missing** at the engineering root is a build-process error
+  (the build dir would be broken), reported by the build layer — it does **not**
+  enter the 6-class taxonomy.
+
+### Course-level h1 is injected
+
+The assembler prepends the course title (from manifest `[info] title`) as the
+document's `#` h1. This is course metadata, not per-element content; each
+element's `<field>.md` then contributes its `##` part and `###` 小节. This is
+the one piece of presentation the assembler owns at the document level (ADR-0011's
+"presentation lives in the content" governs *per-element* presentation).
+
+### Same three boundaries as the shell step (ADR-0013)
+
+`assembleMarkdown` is a **non-typst target**, identical in boundary to the
+shell step:
+
+1. **opt-in by construction** — runs only on an explicit
+   `cph build --target <name>`, never in `check`. `check` validates lesson
+   *structure*, not the outcome of assembling markdown.
+2. **failure is a build-process error, not a lesson diagnostic** — an assembly
+   failure (e.g. write error) does **not** enter the 6-class diagnostic
+   taxonomy; it is reported by the build layer. We do **not** add an
+   `AssembleMarkdown` diagnostic code (taxonomy stays 6, ADR-0010/0012/0013).
+3. **non-typst targets skip typst compile** — `check`'s compile phase already
+   filters to `TypstCompile`-bearing targets, so a pure `assembleMarkdown`
+   target is naturally excluded.
+
+### Single-file artifact now; structured FileTree deferred
+
+The artifact is a **single-file** markdown. The user reasoned that until parts
+are organized as an **ordered tree** (rather than the current flat ordered
+list), single-file is unavoidable — a loose FileTree of per-element `.md`
+files would lose the ordering/structure the manifest encodes. So: single-file
+now; a structured multi-file FileTree artifact is deferred until the parts
+tree-restructure lands (it is out of scope here and recorded as OPEN).
+
+## Consequences
+
+- The framework gains two orthogonal content surfaces (outline slides, spoken
+  transcript) authored directly in markdown+KaTeX, with **no** typst→md math
+  conversion in their path. The math problem (ADR-0014) is *not* solved
+  generally — it is *avoided* for these surfaces by choosing R2.
+- A third typed `Step` variant (`assembleMarkdown`) joins `typstCompile` and
+  `shell`; the step universe is extensible by design (ADR-0011).
+- The `content` leaf concept broadens: it now carries a *format*. The
+  `x-cph-content` marker accepts an extension (`"md"`), backward-compatible
+  with the boolean form (`.typ`). `RichContent.lean` pins `ContentFormat`.
+- The 6-class diagnostic taxonomy is unchanged.
+- The 恒一小奥 KenKen lesson gains `slides`/`transcript` targets alongside its
+  existing `student`/`teacher`/`interactives` targets — all from one
+  engineering file through one CLI.
+
+## Open Questions / Deferred
+
+- **Third-party markdown dialect.** Baseline CommonMark + KaTeX (`$…$`/`$$…$$`)
+  ships now; the platform's specific dialect (page-break markers, callout /
+  fenced-div conventions, heading-depth rules, math-delimiter quirks) is a
+  transform layer to be added once the lesson's output is fed to the platform
+  and the real requirements are observed.
+- **Structured FileTree artifact.** A multi-file markdown deliverable organized
+  by the parts tree — deferred until the parts tree-restructure (itself a
+  separate OPEN / future ADR; touches the manifest schema, render assembly,
+  and all examples).
+- **讲义 (typst) → markdown.** Still ADR-0014's open R1/converter problem,
+  *unaffected* by this ADR. Whether the 讲义 surface ever needs a markdown
+  export is an independent decision.
+- **Universal vs. per-kind markdown surfaces.** `slides`/`transcript` are
+  declared per-kind (4 schemas, duplicated) to match ADR-0005's "(a)-class
+  lives in kind `ElementData`". Whether they should become a cross-cutting
+  universal content surface is reconsidered alongside the parts tree-restructure.
diff --git a/docs/architecture/likec4/model.c4 b/docs/architecture/likec4/model.c4
deleted file mode 100644
index c6a59d1..0000000
--- a/docs/architecture/likec4/model.c4
+++ /dev/null
@@ -1,126 +0,0 @@
-model {
-  teacher = actor 'Teacher' {
-    description '教研老师。可以同时参与多个项目群，在群里讨论并在需要时 @Claude。'
-  }
-
-  admin = actor 'Admin' {
-    description '管理员。管理项目、权限、异常锁释放和审计。'
-  }
-
-  feishu = externalSystem 'Feishu / Lark' {
-    description '项目群、消息、卡片交互和历史消息 API。'
-  }
-
-  claude = externalSystem 'Claude / Claude Code' {
-    description '执行课程资料生成、修改和问答的 AI agent。'
-  }
-
-  workspace = externalSystem 'Project Workspace' {
-    description '每个课程项目的文件、素材、课件、教案和生成产物所在工作区。'
-  }
-
-  hub = system 'Curriculum Project Hub' {
-    description '教研项目工作台。把项目、飞书群、Claude run、锁、上下文和产物管理成一个明确的协作系统。'
-
-    web = app 'Project Console' {
-      description '后台/工作台 UI，用于项目管理、权限、run 审计、异常取消和强制释放锁。'
-    }
-
-    api = service 'Hub API' {
-      description '对 UI、飞书回调、内部 agent runtime 暴露业务 API。'
-    }
-
-    project = service 'Project Service' {
-      description '管理 Project、成员、项目群绑定、项目状态和产物引用。'
-    }
-
-    permission = service 'Permission Service' {
-      description '飞书云文档式权限层。按 resource + principal + role 授权，并用 permission settings 控制分享、评论、下载、协作者管理和 Claude 调用。'
-    }
-
-    im = adapter 'IM Bridge Adapter' {
-      description '飞书/Lark 适配层。负责事件去重、卡片、消息投递、按钮回调和限流；优先评估复用 Claude-to-IM 的 adapter/delivery 能力。'
-    }
-
-    run = service 'Run Orchestrator' {
-      description '在 @Claude 时创建 AgentRun，申请项目锁，调度 Claude runtime，处理取消、失败、等待用户和完成。'
-    }
-
-    locks = service 'Project Lock Service' {
-      description '统一项目级锁。scope = project_id，owner = run_id，lifetime = 一次 Claude run。'
-    }
-
-    context = service 'Context Service' {
-      description '提供当前触发消息、回复链、项目记忆、产物上下文和按需历史读取。第一版不长期缓存飞书全文。'
-    }
-
-    mcp = service 'MCP Gateway' {
-      description 'Claude 可调用的内部工具入口，例如读取当前项目群历史、触发消息、附件和产物上下文。'
-    }
-
-    runtime = runtime 'Claude Runtime' {
-      description '调用 Claude Code / SDK / wrapper，维护 provider session resume，并执行具体任务。'
-    }
-
-    db = store 'Application Database' {
-      description '项目、群绑定、AgentSession、AgentRun、锁、审计和轻量索引。'
-
-      projectEntity = entity 'Project'
-      groupEntity = entity 'ProjectGroupChat'
-      sessionEntity = entity 'AgentSession'
-      runEntity = entity 'AgentRun'
-      lockEntity = entity 'ProjectAgentLock'
-      permissionEntity = entity 'PermissionGrant'
-      settingsEntity = entity 'PermissionSettings'
-      memoryEntity = entity 'ProjectMemory / Decisions'
-      auditEntity = entity 'AuditLog'
-    }
-
-    web -> api 'manage projects, runs and locks'
-    api -> project 'project commands'
-    api -> permission 'authorize user actions'
-    api -> run 'trigger/cancel/admin actions'
-    api -> db 'read/write application state'
-
-    im -> api 'Feishu events and card callbacks'
-    im -> feishu 'send messages, cards, updates'
-    im -> project 'bind chat to project'
-    im -> permission 'check card/action permissions'
-    im -> run 'create/cancel run on @Claude or card action'
-
-    project -> db 'persist projects and group bindings'
-    permission -> db 'persist grants and settings'
-    run -> locks 'acquire/release project lock'
-    run -> permission 'authorize trigger/cancel/force release'
-    locks -> db 'persist lock owner = run_id'
-    run -> context 'build seed context'
-    run -> runtime 'execute Claude turn'
-    run -> db 'persist AgentRun state'
-
-    runtime -> claude 'resume/call Claude'
-    runtime -> workspace 'read/write project files'
-    runtime -> mcp 'request project context'
-    mcp -> context 'resolve run-scoped context'
-    context -> feishu 'read messages by chat/thread/message id'
-    context -> db 'read project memory and anchors'
-
-    projectEntity -> groupEntity 'has project group'
-    projectEntity -> permissionEntity 'has collaborators'
-    projectEntity -> settingsEntity 'has operation settings'
-    projectEntity -> sessionEntity 'has long-lived Claude session'
-    projectEntity -> runEntity 'has many runs'
-    projectEntity -> lockEntity 'has current lock'
-    permissionEntity -> settingsEntity 'is constrained by'
-    runEntity -> lockEntity 'owns while running'
-    sessionEntity -> runEntity 'is reused by runs'
-    projectEntity -> memoryEntity 'stores summary and decisions'
-    runEntity -> auditEntity 'records lifecycle events'
-  }
-
-  teacher -> feishu 'discusses in project groups'
-  teacher -> hub.im '@Claude and card actions'
-  teacher -> hub.web 'reviews projects and runs'
-  admin -> hub.web 'administers locks, permissions and audit'
-
-  feishu -> hub.im 'message events and callbacks'
-}
diff --git a/docs/architecture/likec4/specification.c4 b/docs/architecture/likec4/specification.c4
deleted file mode 100644
index 115fe05..0000000
--- a/docs/architecture/likec4/specification.c4
+++ /dev/null
@@ -1,80 +0,0 @@
-specification {
-  element actor {
-    style {
-      shape person
-      color indigo
-    }
-  }
-
-  element system {
-    style {
-      color primary
-    }
-  }
-
-  element externalSystem {
-    style {
-      color gray
-    }
-  }
-
-  element app {
-    style {
-      shape browser
-      color green
-    }
-  }
-
-  element service {
-    style {
-      shape component
-      color primary
-    }
-  }
-
-  element adapter {
-    style {
-      shape component
-      color amber
-    }
-  }
-
-  element runtime {
-    style {
-      shape component
-      color secondary
-    }
-  }
-
-  element store {
-    style {
-      shape storage
-      color muted
-    }
-  }
-
-  element entity {
-    style {
-      shape storage
-      color muted
-    }
-  }
-
-  relationship sync {
-    line solid
-  }
-
-  relationship async {
-    line dotted
-  }
-
-  relationship reads {
-    line dashed
-    color gray
-  }
-
-  relationship writes {
-    line solid
-    color gray
-  }
-}
diff --git a/docs/architecture/likec4/views.c4 b/docs/architecture/likec4/views.c4
deleted file mode 100644
index 90b48d7..0000000
--- a/docs/architecture/likec4/views.c4
+++ /dev/null
@@ -1,103 +0,0 @@
-views {
-  view index {
-    title 'System Context'
-    description '''
-      Curriculum Project Hub treats a Feishu group as the long-lived project collaboration space.
-      Claude joins only when teachers @Claude, and the Hub creates one AgentRun for that work.
-    '''
-
-    include teacher, admin, hub, feishu, claude, workspace
-  }
-
-  view containers of hub {
-    title 'Target Containers'
-    description 'Main runtime containers and external integrations for the target architecture.'
-
-    include *
-    include teacher, admin, feishu, claude, workspace
-  }
-
-  view permissions of hub {
-    title 'Permission Model'
-    description '''
-      Permissions follow the Feishu Docs pattern: collaborator grants are separate from operation settings.
-      Grants are resource + principal + role; settings decide who may share, comment, copy/download, manage collaborators and invoke Claude.
-    '''
-
-    include permission, project, im, run, db
-    include db.projectEntity, db.groupEntity, db.permissionEntity, db.settingsEntity, db.auditEntity
-    include teacher, admin, feishu
-  }
-
-  view domain_model of hub.db {
-    title 'Core Domain Model'
-    description '''
-      The main correction from the old demo model: project groups and Claude sessions are long-lived,
-      but project locks are owned by AgentRun, not by teacher, chat or session.
-    '''
-
-    include *
-  }
-
-  dynamic view run_lifecycle {
-    title '@Claude Run Lifecycle'
-    description 'A teacher @Claude message creates one AgentRun, which owns the project lock until completion, cancellation or timeout.'
-
-    teacher -> feishu 'send @Claude in project group'
-    feishu -> hub.im 'message event'
-    hub.im -> hub.project 'resolve chat binding'
-    hub.im -> hub.permission 'check trigger permission'
-    hub.im -> hub.run 'create AgentRun'
-    hub.run -> hub.locks 'acquire project lock with run_id'
-    hub.run -> hub.context 'build seed context'
-    hub.run -> hub.runtime 'execute Claude turn'
-    hub.runtime -> claude 'resume/call Claude'
-    hub.runtime -> workspace 'read/write project files'
-    hub.runtime -> hub.mcp 'request extra context if needed'
-    hub.mcp -> hub.context 'resolve run-scoped tools'
-    hub.context -> feishu 'read history by message/thread/chat'
-    hub.runtime -> hub.run 'return result'
-    hub.run -> hub.im 'publish status/result card'
-    hub.im -> feishu 'send/update card'
-    hub.run -> hub.locks 'release run-owned lock'
-
-    include teacher, feishu, claude, workspace
-  }
-
-  dynamic view cancel_lifecycle {
-    title 'Cancel Current Processing'
-    description 'A permitted teacher can cancel the current active run from card action or @Claude cancel command.'
-
-    teacher -> feishu 'click cancel or @Claude cancel'
-    feishu -> hub.im 'callback/event'
-    hub.im -> hub.project 'resolve project group binding'
-    hub.im -> hub.permission 'check cancel permission'
-    hub.im -> hub.run 'cancel active run'
-    hub.run -> hub.runtime 'abort controller if local process is alive'
-    hub.run -> hub.locks 'release lock by run_id'
-    hub.run -> hub.db 'mark AgentRun canceled and audit actor'
-    hub.run -> hub.im 'update status card'
-    hub.im -> feishu 'processing canceled'
-
-    include teacher, feishu
-  }
-
-  dynamic view context_access {
-    title 'On-demand Context Access'
-    description '''
-      The Hub stores anchors and memory, not full Feishu history. Claude can call MCP tools
-      to fetch the current trigger message, reply chain, thread history and recent group messages.
-    '''
-
-    hub.runtime -> hub.mcp 'call get_current_message / get_thread_context'
-    hub.mcp -> hub.context 'authorize by run_id and project_id'
-    hub.context -> hub.db 'read anchors, memory and decisions'
-    hub.context -> feishu 'fetch message/thread/chat history'
-    feishu -> hub.context 'history page'
-    hub.context -> hub.mcp 'filtered context'
-    hub.mcp -> hub.runtime 'tool result'
-    hub.runtime -> claude 'continue with retrieved context'
-
-    include feishu, claude
-  }
-}
diff --git a/examples/TH-141/examples/41届复赛三-1-混注石油/element.toml b/examples/TH-141/examples/41届复赛三-1-混注石油/element.toml
new file mode 100644
index 0000000..8a62024
--- /dev/null
+++ b/examples/TH-141/examples/41届复赛三-1-混注石油/element.toml
@@ -0,0 +1,2 @@
+kind = "example"
+source = "41 届物理竞赛复赛第三大题(1)"
diff --git a/examples/TH-141/examples/41届复赛三-1-混注石油/problem.typ b/examples/TH-141/examples/41届复赛三-1-混注石油/problem.typ
new file mode 100644
index 0000000..1826e85
--- /dev/null
+++ b/examples/TH-141/examples/41届复赛三-1-混注石油/problem.typ
@@ -0,0 +1,7 @@
+某油井内未抽出的石油温度 $100 thin "℃"$，密度为水的 $80%$、比热容为水的 $60%$，记此为参考态。混合物表面张力系数
+
+$ sigma \/ (10^(-3) thin "N/m") = 60 + 0.065 thin T \/ "K" - 24.0 thin p \/ "bar" + 3.15 thin (p \/ "bar")^2 . $
+
+参考态下 $p$ 与 $T$ 成正比，比例系数为等容压强系数 $beta = 7.28 times 10^(-3) thin "bar/K"$。
+
+某区域原本充满参考态石油，抽出一半的同时等体积注入水，混合后总体积等于两者之和，抽注过程绝热。问为使混合物 $sigma$ 最小，注入水的温度应为多少 ℃。
diff --git a/examples/TH-141/examples/41届复赛三-1-混注石油/solution.typ b/examples/TH-141/examples/41届复赛三-1-混注石油/solution.typ
new file mode 100644
index 0000000..31706ae
--- /dev/null
+++ b/examples/TH-141/examples/41届复赛三-1-混注石油/solution.typ
@@ -0,0 +1,27 @@
+参考态满足 $p = beta T$。混合过程总体积不变，仍属等容过程，故混合后亦满足 $p = beta T$。即整个过程始终有 $p = beta T$。
+
+代入 $sigma(T, p)$，令 $tau equiv T \/ "K"$，得 $sigma$ 退化为 $tau$ 的单变量函数
+
+$ sigma(tau) \/ (10^(-3) "N/m") = 60 + 0.065 tau - 24.0 thin (beta tau) + 3.15 thin (beta tau)^2 . $
+
+代入 $beta = 7.28 times 10^(-3)$，注意 $24.0 times 7.28 times 10^(-3) = 0.1747$、$3.15 times (7.28 times 10^(-3))^2 = 1.670 times 10^(-4)$：
+
+$ sigma(tau) \/ (10^(-3) "N/m") = 60 - 0.1097 tau + 1.670 times 10^(-4) tau^2 . $
+
+对 $tau$ 求导取零：
+
+$ tau_("mix") = 0.1097 / (2 times 1.670 times 10^(-4)) approx 328.4 , $
+
+即 $T_("mix") approx 328.4 thin "K" approx 55.3 thin "℃"$。
+
+混合的热平衡。设参考态石油温度 $T_0 = 373.15 thin "K"$、密度 $rho_0 = 0.8 rho_w$、比热容 $c_0 = 0.6 c_w$；注入水温度 $T_w$、密度 $rho_w$、比热容 $c_w$。等体积混合且绝热给出
+
+$ rho_0 c_0 (T_0 - T_("mix")) = rho_w c_w (T_("mix") - T_w) , $
+
+代入 $rho_0 c_0 = 0.48 thin rho_w c_w$，
+
+$ 0.48 (T_0 - T_("mix")) = T_("mix") - T_w , $
+
+解出
+
+$ T_w = T_("mix") - 0.48 (T_0 - T_("mix")) approx 306.9 thin "K" approx 33.7 thin "℃" . $
diff --git a/examples/TH-141/examples/41届复赛三-2-缺键模型/element.toml b/examples/TH-141/examples/41届复赛三-2-缺键模型/element.toml
new file mode 100644
index 0000000..f813285
--- /dev/null
+++ b/examples/TH-141/examples/41届复赛三-2-缺键模型/element.toml
@@ -0,0 +1,2 @@
+kind = "example"
+source = "41 届物理竞赛复赛第三大题(2)"
diff --git a/examples/TH-141/examples/41届复赛三-2-缺键模型/problem.typ b/examples/TH-141/examples/41届复赛三-2-缺键模型/problem.typ
new file mode 100644
index 0000000..b278dcf
--- /dev/null
+++ b/examples/TH-141/examples/41届复赛三-2-缺键模型/problem.typ
@@ -0,0 +1 @@
+假设液体表面张力的存在可以全部归结为表面层内与液体内部每个粒子邻近粒子数目的不同，且表面层内粒子间距与液体内部相同。设表面层每个粒子邻近粒子数是液体内部的 $zeta$ 倍（$0 < zeta < 1$）。已知液体摩尔质量 $mu$、摩尔汽化热 $L_m$、质量密度 $rho$、阿伏伽德罗常量 $N_A$，导出液气界面张力系数 $sigma$ 的表达式。
diff --git a/examples/TH-141/examples/41届复赛三-2-缺键模型/solution.typ b/examples/TH-141/examples/41届复赛三-2-缺键模型/solution.typ
new file mode 100644
index 0000000..04e77b8
--- /dev/null
+++ b/examples/TH-141/examples/41届复赛三-2-缺键模型/solution.typ
@@ -0,0 +1,3 @@
+完整推导见 @缺键一般式。要点为：设体相分子最近邻数 $Z$、单键能 $epsilon$，由共享键计数得 $epsilon = 2 L_m \/ (N_A Z)$；表面分子缺 $(1 - zeta) Z$ 根键，按半键计赔账得亏损能 $Delta U = (1 - zeta) L_m \/ N_A$；分子占体积 $d^3 = mu \/ (rho N_A)$ 给出面密度 $n_s = (rho N_A \/ mu)^(2\/3)$。代入 @骨架公式
+
+$ sigma = Delta U dot n_s = (1 - zeta) thin L_m thin rho^(2\/3) / (mu^(2\/3) thin N_A^(1\/3)) . $
diff --git a/examples/TH-141/exports/student.typ b/examples/TH-141/exports/student.typ
new file mode 100644
index 0000000..a33d25d
--- /dev/null
+++ b/examples/TH-141/exports/student.typ
@@ -0,0 +1,79 @@
+// DEFAULT STUDENT TEMPLATE (framework default; ADR-0011).
+//
+// This is a *real, editable* file that lives in an engineering file at
+// `exports/student.typ`. The framework compiles it AS THE MAIN FILE with the
+// manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/student.typ <out>
+//
+// It is intentionally self-contained (no shared helper import) so it can be
+// copied verbatim into a new engineering file's `exports/`. Presentation —
+// heading numbering — lives HERE (editable per engineering file), not in the
+// manifest and not hardcoded in the cph-render package.
+//
+// WHY THE INCLUDE LOOP IS HERE AND NOT IN cph-render: typst resolves a dynamic
+// `include` path relative to the file it lexically appears in, and a package has
+// its own virtual root — an include inside cph-render would resolve against the
+// PACKAGE, not the engineering root. A `/<part.path>/<field>.typ` written HERE
+// (this template lives under `--root`) resolves against `--root`. So the
+// template loads content and hands cph-render an already-assembled `parts` array.
+//
+// OPEN CONTRACT POINT — optional-content presence. typst has no "does this file
+// exist" primitive (a missing `include` is a hard compile error). So the
+// template CANNOT probe disk the way the old Rust driver did for lemma `proof`.
+// It relies on the manifest declaring which optional content fields are present,
+// via a per-part `fields` array listing the content fields that exist on disk
+// (the engine knows this — it walks the part dir). Required fields are loaded
+// unconditionally; optional fields load only if listed in `fields`. If a part
+// omits `fields`, optional content is skipped (conservative). The exact shape of
+// this declaration is for the manifest/Rust contract to pin.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the student build, so the target is fixed.
+#let target = "student"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/examples/TH-141/exports/teacher.typ b/examples/TH-141/exports/teacher.typ
new file mode 100644
index 0000000..b976b1f
--- /dev/null
+++ b/examples/TH-141/exports/teacher.typ
@@ -0,0 +1,62 @@
+// DEFAULT TEACHER TEMPLATE (framework default; ADR-0011).
+//
+// Lives in an engineering file at `exports/teacher.typ`. Compiled AS MAIN with
+// the manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/teacher.typ <out>
+//
+// Self-contained (copyable into an engineering file). Identical to student.typ
+// except the fixed target is "teacher" (so the (kind x target) render matrix in
+// cph-render shows solutions and proofs). See student.typ for the full notes on
+// why the include loop lives here (package virtual-root resolution) and on the
+// OPEN optional-content (`fields`) contract point.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the teacher build, so the target is fixed.
+#let target = "teacher"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/examples/TH-141/lemmas/Dupré关系/element.toml b/examples/TH-141/lemmas/Dupré关系/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/Dupré关系/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/Dupré关系/proof.typ b/examples/TH-141/lemmas/Dupré关系/proof.typ
new file mode 100644
index 0000000..dc51544
--- /dev/null
+++ b/examples/TH-141/lemmas/Dupré关系/proof.typ
@@ -0,0 +1,5 @@
+剥离单位面积固液界面前后的界面能账目变化为：消失一份固液界面贡献 $-gamma_(S L)$，新生成一份固气面与一份液气面贡献 $+(gamma_(S G) + gamma_(L G))$。剥离所做的可逆功 $W_(S L)$ 等于界面能的净增量
+
+$ W_(S L) = gamma_(S G) + gamma_(L G) - gamma_(S L) , $
+
+整理即得 @Dupré关系。
diff --git a/examples/TH-141/lemmas/Dupré关系/stmt.typ b/examples/TH-141/lemmas/Dupré关系/stmt.typ
new file mode 100644
index 0000000..157c7b3
--- /dev/null
+++ b/examples/TH-141/lemmas/Dupré关系/stmt.typ
@@ -0,0 +1,5 @@
+设把单位面积固液界面剥离成各自暴露的固气面与液气面所需的可逆功为粘附功 $W_(S L)$，则
+
+$ gamma_(S L) = gamma_(S G) + gamma_(L G) - W_(S L) . $ <Dupré关系>
+
+$W_(S L)$ 越大，固液之间越"粘"得紧，$gamma_(S L)$ 越小。
diff --git a/examples/TH-141/lemmas/Eötvös规则/element.toml b/examples/TH-141/lemmas/Eötvös规则/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/Eötvös规则/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/Eötvös规则/stmt.typ b/examples/TH-141/lemmas/Eötvös规则/stmt.typ
new file mode 100644
index 0000000..5d65dac
--- /dev/null
+++ b/examples/TH-141/lemmas/Eötvös规则/stmt.typ
@@ -0,0 +1,5 @@
+设液体的摩尔体积为 $V_m$、临界温度为 $T_c$，则其表面张力随温度的标度律为
+
+$ sigma thin V_m^(2\/3) = k (T_c - T) , $ <Eötvös规则>
+
+其中 $k approx 2.1 times 10^(-7) thin "J" dot "K"^(-1) dot "mol"^(-2\/3)$ 是一个对所有液体共用的普适常数，称为 Eötvös 常数。
diff --git a/examples/TH-141/lemmas/GGZ浸润判据/element.toml b/examples/TH-141/lemmas/GGZ浸润判据/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/GGZ浸润判据/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/GGZ浸润判据/proof.typ b/examples/TH-141/lemmas/GGZ浸润判据/proof.typ
new file mode 100644
index 0000000..d5a39dc
--- /dev/null
+++ b/examples/TH-141/lemmas/GGZ浸润判据/proof.typ
@@ -0,0 +1,13 @@
+把 @GG公式 给出的 $gamma_(S L) = (sqrt(gamma_(S G)) - sqrt(gamma_(L G)))^2$ 代入 @Young方程：
+
+$ cos theta = (gamma_(S G) - (sqrt(gamma_(S G)) - sqrt(gamma_(L G)))^2) / gamma_(L G) . $
+
+展开右端分子：
+
+$ gamma_(S G) - (gamma_(S G) - 2 sqrt(gamma_(S G) gamma_(L G)) + gamma_(L G)) = 2 sqrt(gamma_(S G) gamma_(L G)) - gamma_(L G) , $
+
+代回得
+
+$ cos theta = 2 sqrt(gamma_(S G) / gamma_(L G)) - 1 , $
+
+即 @GGZ判据。
diff --git a/examples/TH-141/lemmas/GGZ浸润判据/stmt.typ b/examples/TH-141/lemmas/GGZ浸润判据/stmt.typ
new file mode 100644
index 0000000..6fb29d0
--- /dev/null
+++ b/examples/TH-141/lemmas/GGZ浸润判据/stmt.typ
@@ -0,0 +1,5 @@
+把 Berthelot 估计 @GG公式 代回 Young 方程 @Young方程，得到 Girifalco–Good–Zisman 浸润判据
+
+$ cos theta = 2 sqrt(gamma_(S G) / gamma_(L G)) - 1 . $ <GGZ判据>
+
+接触角完全由比值 $gamma_(S G) \/ gamma_(L G)$ 一个无量纲数决定。
diff --git a/examples/TH-141/lemmas/Girifalco-Good公式/element.toml b/examples/TH-141/lemmas/Girifalco-Good公式/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/Girifalco-Good公式/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/Girifalco-Good公式/proof.typ b/examples/TH-141/lemmas/Girifalco-Good公式/proof.typ
new file mode 100644
index 0000000..2bb6bf0
--- /dev/null
+++ b/examples/TH-141/lemmas/Girifalco-Good公式/proof.typ
@@ -0,0 +1,9 @@
+把 @Berthelot粘附 代入 @Dupré关系：
+
+$ gamma_(S L) = gamma_(S G) + gamma_(L G) - 2 sqrt(gamma_(S G) thin gamma_(L G)) , $
+
+右端是完全平方差，化简得
+
+$ gamma_(S L) approx (sqrt(gamma_(S G)) - sqrt(gamma_(L G)))^2 , $
+
+即 @GG公式。
diff --git a/examples/TH-141/lemmas/Girifalco-Good公式/stmt.typ b/examples/TH-141/lemmas/Girifalco-Good公式/stmt.typ
new file mode 100644
index 0000000..6d1fb67
--- /dev/null
+++ b/examples/TH-141/lemmas/Girifalco-Good公式/stmt.typ
@@ -0,0 +1,7 @@
+对色散力为主的固液体系，异种相互作用能由同种相互作用能的几何平均近似：$epsilon_(S L) approx sqrt(epsilon_(S S) thin epsilon_(L L))$。相应地粘附功
+
+$ W_(S L) approx 2 sqrt(gamma_(S G) thin gamma_(L G)) . $ <Berthelot粘附>
+
+代入 @Dupré关系 得 Girifalco–Good 公式
+
+$ gamma_(S L) approx (sqrt(gamma_(S G)) - sqrt(gamma_(L G)))^2 . $ <GG公式>
diff --git a/examples/TH-141/lemmas/Guggenheim-Katayama改良/element.toml b/examples/TH-141/lemmas/Guggenheim-Katayama改良/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/Guggenheim-Katayama改良/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/Guggenheim-Katayama改良/stmt.typ b/examples/TH-141/lemmas/Guggenheim-Katayama改良/stmt.typ
new file mode 100644
index 0000000..cc4018e
--- /dev/null
+++ b/examples/TH-141/lemmas/Guggenheim-Katayama改良/stmt.typ
@@ -0,0 +1,5 @@
+Eötvös 规则 @Eötvös规则 在 $T arrow.r T_c$ 附近预言 $sigma prop (T_c - T)$ 线性趋零。实验观测显示趋零行为更接近幂律：
+
+$ sigma = sigma_0 (1 - T \/ T_c)^n , quad n approx 11 \/ 9 . $ <GK规则>
+
+@GK规则 在临界点附近比 @Eötvös规则 更准确。
diff --git a/examples/TH-141/lemmas/LJ对势积分标度/element.toml b/examples/TH-141/lemmas/LJ对势积分标度/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/LJ对势积分标度/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/LJ对势积分标度/proof.typ b/examples/TH-141/lemmas/LJ对势积分标度/proof.typ
new file mode 100644
index 0000000..4451f19
--- /dev/null
+++ b/examples/TH-141/lemmas/LJ对势积分标度/proof.typ
@@ -0,0 +1,13 @@
+设下半空间体相分子的数密度为 $n_v = 1 \/ d^3$。固定一个表面分子作为参考分子，对其与下半空间所有体相分子的相互作用求和。由对称性，相对参考分子距离 $r$ 在下半空间内的体积元为 $dif V = 2 pi r^2 dif r$。下限取 $r = d$，上限取 $infinity$：
+
+$ Delta U = 2 pi n_v integral_d^infinity u(r) thin r^2 dif r . $
+
+代入 $u(r)$，用 $integral r^2 dot r^(-n) dif r = r^(3 - n) \/ (3 - n)$ 化简，得
+
+$ Delta U tilde.op epsilon . $
+
+把 $Delta U$ 乘以单位面积分子数 $n_s tilde.op 1 \/ d^2$，由 @骨架公式 即得
+
+$ sigma tilde.op epsilon / d^2 , $
+
+即 @LJ标度。
diff --git a/examples/TH-141/lemmas/LJ对势积分标度/stmt.typ b/examples/TH-141/lemmas/LJ对势积分标度/stmt.typ
new file mode 100644
index 0000000..532bf82
--- /dev/null
+++ b/examples/TH-141/lemmas/LJ对势积分标度/stmt.typ
@@ -0,0 +1,9 @@
+设分子间对势为 Lennard–Jones 6-12 形式
+
+$ u(r) = 4 epsilon [(d \/ r)^(12) - (d \/ r)^6] . $
+
+把一个表面分子与下半空间所有分子的相互作用积分求和，得到
+
+$ sigma tilde.op epsilon / d^2 . $ <LJ标度>
+
+此式与量纲估计 @量纲估计 同标度。
diff --git a/examples/TH-141/lemmas/Stefan极简估算/element.toml b/examples/TH-141/lemmas/Stefan极简估算/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/Stefan极简估算/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/Stefan极简估算/proof.typ b/examples/TH-141/lemmas/Stefan极简估算/proof.typ
new file mode 100644
index 0000000..255e3fe
--- /dev/null
+++ b/examples/TH-141/lemmas/Stefan极简估算/proof.typ
@@ -0,0 +1,9 @@
+在 @缺键一般式 中取 $zeta = 1\/2$，
+
+$ sigma_(L G) = 1/2 dot L_m thin rho^(2\/3) / (mu^(2\/3) N_A^(1\/3)) . $
+
+由 $d^3 = mu \/ (rho N_A)$ 得 $rho^(2\/3) \/ (mu^(2\/3) N_A^(1\/3)) = 1 \/ (d^2 N_A)$，代入即得
+
+$ sigma_(L G) thin d^2 approx L_m / (2 N_A) , $
+
+即 @Stefan估算。
diff --git a/examples/TH-141/lemmas/Stefan极简估算/stmt.typ b/examples/TH-141/lemmas/Stefan极简估算/stmt.typ
new file mode 100644
index 0000000..39040aa
--- /dev/null
+++ b/examples/TH-141/lemmas/Stefan极简估算/stmt.typ
@@ -0,0 +1,5 @@
+在 @缺键一般式 中取 $zeta = 1\/2$，得
+
+$ sigma_(L G) thin d^2 approx L_m / (2 N_A) . $ <Stefan估算>
+
+它是缺键模型的最简退化形式，不含任何晶格信息。
diff --git a/examples/TH-141/lemmas/Young方程/element.toml b/examples/TH-141/lemmas/Young方程/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/Young方程/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/Young方程/proof.typ b/examples/TH-141/lemmas/Young方程/proof.typ
new file mode 100644
index 0000000..2c8961d
--- /dev/null
+++ b/examples/TH-141/lemmas/Young方程/proof.typ
@@ -0,0 +1,9 @@
+沿固体表面把接触线挪动 $dif x$，单位接触线长度上：固液界面增 $dif x$，固气界面减 $dif x$，液气界面长度按 $cos theta$ 投影增 $dif x cos theta$。总界面能的变化
+
+$ dif F = gamma_(S L) dif x - gamma_(S G) dif x + gamma_(L G) cos theta thin dif x . $
+
+平衡条件 $dif F = 0$ 给出
+
+$ gamma_(S G) = gamma_(S L) + gamma_(L G) cos theta , $
+
+即 @Young方程。
diff --git a/examples/TH-141/lemmas/Young方程/stmt.typ b/examples/TH-141/lemmas/Young方程/stmt.typ
new file mode 100644
index 0000000..33e04e4
--- /dev/null
+++ b/examples/TH-141/lemmas/Young方程/stmt.typ
@@ -0,0 +1,3 @@
+一滴液体落在固体表面上，与固气界面之间形成三相接触线。设浸润角即接触角为 $theta$，则三种界面张力满足
+
+$ gamma_(S G) = gamma_(S L) + gamma_(L G) cos theta , quad arrow.r.double quad cos theta = (gamma_(S G) - gamma_(S L)) / gamma_(L G) . $ <Young方程>
diff --git a/examples/TH-141/lemmas/固体表面能的晶面各向异性/element.toml b/examples/TH-141/lemmas/固体表面能的晶面各向异性/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/固体表面能的晶面各向异性/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/固体表面能的晶面各向异性/stmt.typ b/examples/TH-141/lemmas/固体表面能的晶面各向异性/stmt.typ
new file mode 100644
index 0000000..af1b939
--- /dev/null
+++ b/examples/TH-141/lemmas/固体表面能的晶面各向异性/stmt.typ
@@ -0,0 +1,3 @@
+不同晶面的表面原子缺键数不同，故 $gamma_(S G)$ 随晶面指数 $(h k l)$ 而变。以简单立方为例：(100) 缺 1 键、(110) 缺 2 键、(111) 缺 3 键，从而
+
+$ gamma_(S G)^((100)) < gamma_(S G)^((110)) < gamma_(S G)^((111)) . $ <晶面各向异性>
diff --git a/examples/TH-141/lemmas/拉伸固体的总应力/element.toml b/examples/TH-141/lemmas/拉伸固体的总应力/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/拉伸固体的总应力/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/拉伸固体的总应力/proof.typ b/examples/TH-141/lemmas/拉伸固体的总应力/proof.typ
new file mode 100644
index 0000000..34a8b42
--- /dev/null
+++ b/examples/TH-141/lemmas/拉伸固体的总应力/proof.typ
@@ -0,0 +1,9 @@
+设固体体积 $V$、表面积 $A$，应变 $epsilon$ 为均匀小量。体相单位体积的自由能 $f_b = Y epsilon^2 \/ 2$，表面单位面积的自由能 $gamma(epsilon)$，总自由能
+
+$ F = V f_b + A gamma(epsilon) . $
+
+对均匀拉伸 $V epsilon$ 求导得单位横截面承担的应力
+
+$ sigma_("tot") = (partial F) / (partial (V epsilon)) = Y epsilon + A / V dot (dif gamma) / (dif epsilon) , $
+
+即 @总应力。
diff --git a/examples/TH-141/lemmas/拉伸固体的总应力/stmt.typ b/examples/TH-141/lemmas/拉伸固体的总应力/stmt.typ
new file mode 100644
index 0000000..2c0bbf1
--- /dev/null
+++ b/examples/TH-141/lemmas/拉伸固体的总应力/stmt.typ
@@ -0,0 +1,5 @@
+对横截面被均匀拉伸的固体，单位横截面承担的总应力为
+
+$ sigma_("tot") = Y epsilon + A / V dot (dif gamma) / (dif epsilon) , $ <总应力>
+
+其中 $Y$ 为杨氏模量、$epsilon$ 为应变、$A \/ V$ 为表面积与体积之比。第一项为体相弹性贡献，第二项为表面贡献。
diff --git a/examples/TH-141/lemmas/立方格子下zeta具体值/element.toml b/examples/TH-141/lemmas/立方格子下zeta具体值/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/立方格子下zeta具体值/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/立方格子下zeta具体值/proof.typ b/examples/TH-141/lemmas/立方格子下zeta具体值/proof.typ
new file mode 100644
index 0000000..b593aea
--- /dev/null
+++ b/examples/TH-141/lemmas/立方格子下zeta具体值/proof.typ
@@ -0,0 +1,5 @@
+数缺键以几何方式进行。
+
+简单立方中每个体相原子的 6 个最近邻分布在上下左右前后六个方向。(100) 面上的表面原子失去上方那 1 个邻居，故 $Z_s = 5$、$zeta = 5\/6$。
+
+面心立方中每个体相原子的 12 个最近邻分布在该原子周围三个 (111) 面上。(111) 面是最密堆积，表面原子失去上方一层的 3 个邻居，$Z_s = 9$、$zeta = 3\/4$。(100) 面失去 4 个上方邻居，$Z_s = 8$、$zeta = 2\/3$。(110) 面失去的近邻更多，$zeta$ 进一步减小。
diff --git a/examples/TH-141/lemmas/立方格子下zeta具体值/stmt.typ b/examples/TH-141/lemmas/立方格子下zeta具体值/stmt.typ
new file mode 100644
index 0000000..5507866
--- /dev/null
+++ b/examples/TH-141/lemmas/立方格子下zeta具体值/stmt.typ
@@ -0,0 +1,8 @@
+通过对几何晶格直接数缺键数，可以把 @缺键一般式 中的 $zeta$ 落到具体数字：
+
+- 简单立方 (100) 面：$Z = 6$、$Z_s = 5$，$zeta = 5\/6$。
+- 面心立方 (111) 面：$Z = 12$、$Z_s = 9$，$zeta = 3\/4$。
+- 面心立方 (100) 面：$Z_s = 8$，$zeta = 2\/3$。
+- 面心立方 (110) 面：$zeta < 2\/3$。
+
+后续讨论以 FCC (111) 面为代表，因其密度最大、$gamma$ 最低、平衡形貌中最易出现。
diff --git a/examples/TH-141/lemmas/缺键模型一般公式/element.toml b/examples/TH-141/lemmas/缺键模型一般公式/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/缺键模型一般公式/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/缺键模型一般公式/proof.typ b/examples/TH-141/lemmas/缺键模型一般公式/proof.typ
new file mode 100644
index 0000000..8a73fff
--- /dev/null
+++ b/examples/TH-141/lemmas/缺键模型一般公式/proof.typ
@@ -0,0 +1,17 @@
+设体相分子的最近邻数为 $Z$、每根键的能量为 $epsilon$。每根键被两个分子共享，一摩尔液体的独立键数为 $N_A Z \/ 2$，把它们全部断开所需的能量即摩尔汽化热
+
+$ L_m = N_A Z epsilon / 2 , quad arrow.r.double quad epsilon = (2 L_m) / (N_A Z) . $ <缺键-单键>
+
+表面分子的近邻数为 $zeta Z$，相比体相少 $(1 - zeta) Z$ 个近邻。按共享原则，每个缺键的能量代价为 $epsilon \/ 2$，于是每个表面分子的亏损能为
+
+$ Delta U = (1 - zeta) Z dot epsilon / 2 = ((1 - zeta) L_m) / N_A . $ <缺键-亏损能>
+
+设每个分子占体积 $d^3 = mu \/ (rho N_A)$，则单位面积分子数
+
+$ n_s = d^(-2) = (rho N_A / mu)^(2\/3) . $ <缺键-面密度>
+
+代入 @骨架公式 即得
+
+$ sigma_(L G) = Delta U dot n_s = (1 - zeta) thin L_m thin rho^(2\/3) / (mu^(2\/3) thin N_A^(1\/3)) , $
+
+即 @缺键一般式。
diff --git a/examples/TH-141/lemmas/缺键模型一般公式/stmt.typ b/examples/TH-141/lemmas/缺键模型一般公式/stmt.typ
new file mode 100644
index 0000000..3282d90
--- /dev/null
+++ b/examples/TH-141/lemmas/缺键模型一般公式/stmt.typ
@@ -0,0 +1,3 @@
+设液体表面层每个分子的近邻数是体相分子近邻数的 $zeta$ 倍（$0 < zeta < 1$），摩尔汽化热为 $L_m$、摩尔质量为 $mu$、质量密度为 $rho$、阿伏伽德罗常量为 $N_A$，则液气界面张力系数为
+
+$ sigma_(L G) = (1 - zeta) thin L_m thin rho^(2\/3) / (mu^(2\/3) thin N_A^(1\/3)) . $ <缺键一般式>
diff --git a/examples/TH-141/lemmas/缺键模型迁移到固气/element.toml b/examples/TH-141/lemmas/缺键模型迁移到固气/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/缺键模型迁移到固气/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/缺键模型迁移到固气/stmt.typ b/examples/TH-141/lemmas/缺键模型迁移到固气/stmt.typ
new file mode 100644
index 0000000..58813e3
--- /dev/null
+++ b/examples/TH-141/lemmas/缺键模型迁移到固气/stmt.typ
@@ -0,0 +1,5 @@
+固气界面 $gamma_(S G)$ 的缺键模型公式由 @缺键一般式 直接迁移，只把摩尔汽化热 $L_m$ 替换为摩尔升华热 $L_s$：
+
+$ gamma_(S G) = (1 - zeta) thin L_s thin rho^(2\/3) / (mu^(2\/3) thin N_A^(1\/3)) . $ <固气缺键式>
+
+物理来源也只是把"把分子从液体里拉出来"换成"把原子从晶格里拉出来"，骨架公式 @骨架公式 与单键计数过程不变。
diff --git a/examples/TH-141/lemmas/表面熵热力学关系/element.toml b/examples/TH-141/lemmas/表面熵热力学关系/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/表面熵热力学关系/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/表面熵热力学关系/proof.typ b/examples/TH-141/lemmas/表面熵热力学关系/proof.typ
new file mode 100644
index 0000000..c12f954
--- /dev/null
+++ b/examples/TH-141/lemmas/表面熵热力学关系/proof.typ
@@ -0,0 +1,11 @@
+$sigma$ 的热力学定义是恒温恒容下单位面积自由能：$sigma = (partial F \/ partial A)_(T, V)$。自由能微分
+
+$ dif F = - S dif T - p dif V + sigma dif A , $
+
+给出 Maxwell 关系
+
+$ ((partial sigma) / (partial T))_(A, V) = - ((partial S) / (partial A))_(T, V) = - s_s , $
+
+其中 $s_s equiv (partial S \/ partial A)_(T, V)$。代回即 @表面熵。
+
+液面分子被约束在准二维层内，可达微观态数比体相分子少，故 $s_s > 0$，进而 $dif sigma \/ dif T < 0$。
diff --git a/examples/TH-141/lemmas/表面熵热力学关系/stmt.typ b/examples/TH-141/lemmas/表面熵热力学关系/stmt.typ
new file mode 100644
index 0000000..ee50bbe
--- /dev/null
+++ b/examples/TH-141/lemmas/表面熵热力学关系/stmt.typ
@@ -0,0 +1,5 @@
+设单位面积表面熵为 $s_s$，则表面张力对温度的变化率满足
+
+$ (dif sigma) / (dif T) = - s_s . $ <表面熵>
+
+物理上 $s_s > 0$，故 $dif sigma \/ dif T < 0$，$sigma$ 随温度升高单调下降。
diff --git a/examples/TH-141/lemmas/量纲分析估计/element.toml b/examples/TH-141/lemmas/量纲分析估计/element.toml
new file mode 100644
index 0000000..e0a523e
--- /dev/null
+++ b/examples/TH-141/lemmas/量纲分析估计/element.toml
@@ -0,0 +1 @@
+kind = "lemma"
diff --git a/examples/TH-141/lemmas/量纲分析估计/stmt.typ b/examples/TH-141/lemmas/量纲分析估计/stmt.typ
new file mode 100644
index 0000000..136b2a4
--- /dev/null
+++ b/examples/TH-141/lemmas/量纲分析估计/stmt.typ
@@ -0,0 +1,5 @@
+设液体的单键能为 $epsilon$、分子间距为 $d$，仅由量纲组合可得液气界面张力的标度
+
+$ sigma tilde.op epsilon / d^2 . $ <量纲估计>
+
+此式不依赖具体势函数、晶格结构或相变热，是后续更精细模型的下限基准。
diff --git a/examples/TH-141/manifest.toml b/examples/TH-141/manifest.toml
new file mode 100644
index 0000000..3376bf0
--- /dev/null
+++ b/examples/TH-141/manifest.toml
@@ -0,0 +1,181 @@
+[project]
+id   = "local-mpttwr3t-sn1oma"
+name = "TH-141_表面张力的严肃理论"
+
+[info]
+title  = "TH-141:表面张力的严肃理论"
+author = "范式教育教研组"
+
+[[parts]]
+kind = "segment"
+path = "segments/开场对照导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/胡克唯象模型回顾"
+
+[[parts]]
+kind = "segment"
+path = "segments/液面拉伸的本质"
+
+[[parts]]
+kind = "segment"
+path = "segments/液气界面导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/微观建模的共同骨架"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/量纲分析估计"
+
+[[parts]]
+kind = "segment"
+path = "segments/缺键模型导言"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/缺键模型一般公式"
+
+[[parts]]
+kind = "example"
+path = "examples/41届复赛三-2-缺键模型"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/Stefan极简估算"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/立方格子下zeta具体值"
+
+[[parts]]
+kind = "segment"
+path = "segments/LJ积分导言"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/LJ对势积分标度"
+
+[[parts]]
+kind = "segment"
+path = "segments/固气界面导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/表面能γ与表面应力f"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/拉伸固体的总应力"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/缺键模型迁移到固气"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/固体表面能的晶面各向异性"
+
+[[parts]]
+kind = "segment"
+path = "segments/不同物质γ量级对比"
+
+[[parts]]
+kind = "segment"
+path = "segments/固液界面导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/固液界面能的物理图像"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/Dupré关系"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/Girifalco-Good公式"
+
+[[parts]]
+kind = "segment"
+path = "segments/Fowkes极性修正"
+
+[[parts]]
+kind = "segment"
+path = "segments/三相接触导言"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/Young方程"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/GGZ浸润判据"
+
+[[parts]]
+kind = "segment"
+path = "segments/浸润全谱与高低能表面"
+
+[[parts]]
+kind = "segment"
+path = "segments/σT建模导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/微观派Lm下降"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/Eötvös规则"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/Guggenheim-Katayama改良"
+
+[[parts]]
+kind = "lemma"
+path = "lemmas/表面熵热力学关系"
+
+[[parts]]
+kind = "segment"
+path = "segments/σTp态函数导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/σ作为态函数的图像"
+
+[[parts]]
+kind = "example"
+path = "examples/41届复赛三-1-混注石油"
+
+[[parts]]
+kind = "segment"
+path = "segments/收束导言"
+
+[[parts]]
+kind = "segment"
+path = "segments/各模型对水的预测对照"
+
+[[parts]]
+kind = "segment"
+path = "segments/算不准背后的真实物理"
+
+# Export targets (ADR-0009/0011): each target is a build producing a typed
+# artifact, run as an ordered list of typed steps. A `typst-compile` step names a
+# real template file under `exports/` — the framework compiles it as the main
+# file with the manifest injected, and the template reads the manifest and renders
+# the lesson. Presentation (heading numbering, styling) lives in the template
+# file, NOT here (ADR-0011 moved it off the manifest).
+[targets.student]
+artifact = { type = "single-file", filepath = "build/student.pdf" }
+[[targets.student.steps]]
+type = "typst-compile"
+template = "exports/student.typ"
+
+[targets.teacher]
+artifact = { type = "single-file", filepath = "build/teacher.pdf" }
+[[targets.teacher.steps]]
+type = "typst-compile"
+template = "exports/teacher.typ"
diff --git a/examples/TH-141/segments/Fowkes极性修正/element.toml b/examples/TH-141/segments/Fowkes极性修正/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/Fowkes极性修正/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/Fowkes极性修正/textbook.typ b/examples/TH-141/segments/Fowkes极性修正/textbook.typ
new file mode 100644
index 0000000..ae4f16a
--- /dev/null
+++ b/examples/TH-141/segments/Fowkes极性修正/textbook.typ
@@ -0,0 +1,5 @@
+Girifalco–Good 公式 @GG公式 建立在纯色散力假设上，对水这类强极性或氢键液体已不够精确。Fowkes 给出的修正路径是把表面能 $gamma$ 拆为色散分量 $gamma^d$ 与极性分量 $gamma^p$，分别做几何平均：
+
+$ W_(S L) = 2 sqrt(gamma_(S G)^d thin gamma_(L G)^d) + 2 sqrt(gamma_(S G)^p thin gamma_(L G)^p) . $
+
+工程实际计算中水、聚合物等强极性体系的接触角分析走的就是这条路。本节只列出公式作为知识地图的一站，不要求会用。
diff --git a/examples/TH-141/segments/LJ积分导言/element.toml b/examples/TH-141/segments/LJ积分导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/LJ积分导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/LJ积分导言/textbook.typ b/examples/TH-141/segments/LJ积分导言/textbook.typ
new file mode 100644
index 0000000..964ac16
--- /dev/null
+++ b/examples/TH-141/segments/LJ积分导言/textbook.typ
@@ -0,0 +1,3 @@
+== Lennard–Jones 对势积分
+
+缺键模型把分子间作用力简化为最近邻间存在的离散键。若代之以连续对势函数 $u(r)$、对表面分子与下半空间所有分子之间的相互作用直接积分，得到的标度律应当与缺键模型一致，并与最初的量纲分析 @量纲估计 互为印证。本节以 Lennard–Jones 6-12 势为例完成这一积分。
diff --git a/examples/TH-141/segments/σTp态函数导言/element.toml b/examples/TH-141/segments/σTp态函数导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/σTp态函数导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/σTp态函数导言/textbook.typ b/examples/TH-141/segments/σTp态函数导言/textbook.typ
new file mode 100644
index 0000000..5d13e21
--- /dev/null
+++ b/examples/TH-141/segments/σTp态函数导言/textbook.typ
@@ -0,0 +1,3 @@
+= $sigma(T, p)$ 态函数与工程应用
+
+以上所有模型都从微观或唯象规律推出 $sigma$。在工程实际中，$sigma$ 常被直接当作状态变量 $(T, p, "组分")$ 的态函数处理，由实验数据拟合给出。本节给出一道典型的工程应用题：把 $sigma(T, p)$ 当作给定的多项式态函数，用它解一个混合优化问题。
diff --git a/examples/TH-141/segments/σT建模导言/element.toml b/examples/TH-141/segments/σT建模导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/σT建模导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/σT建模导言/textbook.typ b/examples/TH-141/segments/σT建模导言/textbook.typ
new file mode 100644
index 0000000..fc38804
--- /dev/null
+++ b/examples/TH-141/segments/σT建模导言/textbook.typ
@@ -0,0 +1,3 @@
+= $sigma(T)$ 的建模
+
+以上讨论都默认温度固定。但 $sigma$ 随温度变化的图像是物理学的常识——温度升高时分子热运动加剧，表面层的亏损能下降，$sigma$ 随之下降，在临界点处趋零。本节给出 $sigma(T)$ 的几条关系：从缺键模型直接读出的 $L_m(T)$ 单调下降图像、唯象的 Eötvös 规则及其幂律修正、以及把 $sigma$ 升级为自由能的热力学关系 $dif sigma \/ dif T = - s_s$。
diff --git a/examples/TH-141/segments/σ作为态函数的图像/element.toml b/examples/TH-141/segments/σ作为态函数的图像/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/σ作为态函数的图像/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/σ作为态函数的图像/textbook.typ b/examples/TH-141/segments/σ作为态函数的图像/textbook.typ
new file mode 100644
index 0000000..f6eb5cf
--- /dev/null
+++ b/examples/TH-141/segments/σ作为态函数的图像/textbook.typ
@@ -0,0 +1,3 @@
+$sigma$ 是温度、压强、组分的态函数。在工程实际中，对某一类流体（如石油、混合液烃、电池电解液）做大量实验测量后用多项式拟合 $sigma(T, p)$ 给出经验公式，并直接代入应用。这种"输入最多、假设最少"的建模方式与前面从分子层面推出 $sigma$ 的方式互不冲突，是同一物理量在不同抽象层级的两种表达。
+
+下题给出一道把 $sigma(T, p)$ 当作给定的多项式态函数、求工程优化条件的真实问题。题中所有外加参数都是给定的——本题考查的是把态函数代入混合过程后如何利用其变量关系简化为单变量优化。
diff --git a/examples/TH-141/segments/三相接触导言/element.toml b/examples/TH-141/segments/三相接触导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/三相接触导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/三相接触导言/textbook.typ b/examples/TH-141/segments/三相接触导言/textbook.typ
new file mode 100644
index 0000000..c980020
--- /dev/null
+++ b/examples/TH-141/segments/三相接触导言/textbook.typ
@@ -0,0 +1,3 @@
+= 三相接触：Young 方程与浸润
+
+把三种界面能 $gamma_(L G)$、$gamma_(S G)$、$gamma_(S L)$ 放在固体表面上一滴液体的三相接触线处，用能量极小化条件可得到接触角 $theta$ 的表达式，即 Young 方程。把 Berthelot 估计 @GG公式 代回 Young 方程，$theta$ 进一步退化为只依赖比值 $gamma_(S G) \/ gamma_(L G)$ 的形式，由此得到浸润判据并把"什么液体在什么固体上铺得开"翻译成一个无量纲数的取值。
diff --git a/examples/TH-141/segments/不同物质γ量级对比/element.toml b/examples/TH-141/segments/不同物质γ量级对比/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/不同物质γ量级对比/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/不同物质γ量级对比/textbook.typ b/examples/TH-141/segments/不同物质γ量级对比/textbook.typ
new file mode 100644
index 0000000..081f66f
--- /dev/null
+++ b/examples/TH-141/segments/不同物质γ量级对比/textbook.typ
@@ -0,0 +1,16 @@
+不同物质的表面张力系数差异可达两个量级。
+
+#figure(
+  table(
+    columns: (auto, auto),
+    align: (left, left),
+    table.header[*物质*][*$gamma$ ($"J/m"^2$)*],
+    [水（液气界面）], [$approx 0.072$],
+    [分子晶体], [$0.05 thin "—" thin 0.1$],
+    [离子晶体], [$0.2 thin "—" thin 1$],
+    [金属（Au、Fe、W）], [$1 thin "—" thin 3$],
+  ),
+  caption: [常见物质表面张力系数的典型量级]
+) <γ量级表>
+
+该量级谱可由缺键模型 @固气缺键式 解释。分子晶体的键合主要是范德瓦尔斯力，$L_s$ 小、$gamma$ 小；离子晶体的键合包含库仑作用，$L_s$ 上升一个量级，$gamma$ 也随之上升；金属内部的金属键键合最强，$L_s$ 最大、$gamma$ 最大。同一公式横跨四个数量级的物理体系都给出对的量级。
diff --git a/examples/TH-141/segments/各模型对水的预测对照/element.toml b/examples/TH-141/segments/各模型对水的预测对照/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/各模型对水的预测对照/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/各模型对水的预测对照/textbook.typ b/examples/TH-141/segments/各模型对水的预测对照/textbook.typ
new file mode 100644
index 0000000..d3826cd
--- /dev/null
+++ b/examples/TH-141/segments/各模型对水的预测对照/textbook.typ
@@ -0,0 +1,16 @@
+把本章四种模型对常温水液气界面 $sigma_(L G)$ 的预测整理如下：
+
+#figure(
+  table(
+    columns: (auto, auto, auto),
+    align: (left, left, left),
+    table.header[*模型*][*$sigma$ 预测（$"N/m"$）*][*相对实测 $0.072$*],
+    [量纲分析], [$tilde.op 0.1$], [量级正确],
+    [Stefan ($zeta = 1\/2$)], [$approx 0.38$], [偏大约 5 倍],
+    [缺键模型 ($zeta = 3\/4$，FCC (111))], [$approx 0.13$], [偏大约 2 倍],
+    [Eötvös 规则（外推）], [$approx 0.072$], [量级与具体值都接近],
+  ),
+  caption: [本章各模型对常温水 $sigma_(L G)$ 的预测]
+) <模型对照表>
+
+从表上读出的事实有两条：其一，所有模型都能给出对的量级；其二，量纲分析与 Stefan 这类"几乎不假设"的模型反而偏离最大，缺键模型代入具体晶面 $zeta$ 后精度提升一档，而完全唯象的 Eötvös 规则反而最接近实测。最简单的微观模型并不是最准的——粗略的微观模型给出量级，唯象的拟合规则给出具体值。
diff --git a/examples/TH-141/segments/固气界面导言/element.toml b/examples/TH-141/segments/固气界面导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/固气界面导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/固气界面导言/textbook.typ b/examples/TH-141/segments/固气界面导言/textbook.typ
new file mode 100644
index 0000000..58f6ec3
--- /dev/null
+++ b/examples/TH-141/segments/固气界面导言/textbook.typ
@@ -0,0 +1,3 @@
+= 固气界面 $sigma_(S G)$ 的微观建模
+
+固体表面没有"流动补缺"这条退路。从物理上讲，"创造新表面"与"拉伸已存在表面"在固体中是两件独立的事，对应两个不同的物理量——表面能 $gamma$ 与表面应力 $f$。本节先把这二者分清，再把缺键模型 @缺键一般式 中的摩尔汽化热替换为摩尔升华热，得到固气界面的 $gamma_(S G)$。最后讨论 $gamma_(S G)$ 的晶面各向异性以及不同物质的 $gamma$ 量级谱。
diff --git a/examples/TH-141/segments/固液界面导言/element.toml b/examples/TH-141/segments/固液界面导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/固液界面导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/固液界面导言/textbook.typ b/examples/TH-141/segments/固液界面导言/textbook.typ
new file mode 100644
index 0000000..33b18eb
--- /dev/null
+++ b/examples/TH-141/segments/固液界面导言/textbook.typ
@@ -0,0 +1,3 @@
+= 固液界面 $sigma_(S L)$ 的微观建模
+
+固液界面的能量由两件事的净结果决定：固体表面原子失去固–固近邻、同时获得固–液异种近邻。前者可继续沿用缺键模型，后者引入新的物理——异种相互作用强度怎么估。本节先用 Dupré 思想实验把 $gamma_(S L)$ 改写为粘附功 $W_(S L)$，再用 Berthelot 几何平均估计 $W_(S L)$，最终给出 Girifalco–Good 公式。
diff --git a/examples/TH-141/segments/固液界面能的物理图像/element.toml b/examples/TH-141/segments/固液界面能的物理图像/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/固液界面能的物理图像/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/固液界面能的物理图像/textbook.typ b/examples/TH-141/segments/固液界面能的物理图像/textbook.typ
new file mode 100644
index 0000000..4a18fa5
--- /dev/null
+++ b/examples/TH-141/segments/固液界面能的物理图像/textbook.typ
@@ -0,0 +1,3 @@
+把固体与液体贴在一起形成固液界面时，固体表面原子损失部分同种近邻（固–固键），同时获得异种近邻（固–液相互作用）。$gamma_(S L)$ 是这两个效应的净结果：若异种作用恰好补偿同种损失，则 $gamma_(S L) = 0$；若异种作用很弱，则 $gamma_(S L)$ 大。
+
+仅有缺键模型 @缺键一般式 已不够用——它只算了"损失同种键"那一半，没算"获得异种键"那一半。固液界面建模真正的难点在于异种相互作用怎么估。下面用 Dupré 关系把 $gamma_(S L)$ 改写为粘附功 $W_(S L)$，再用 Berthelot 规则估 $W_(S L)$，从而绕过对异种相互作用的直接计算。
diff --git a/examples/TH-141/segments/开场对照导言/element.toml b/examples/TH-141/segments/开场对照导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/开场对照导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/开场对照导言/textbook.typ b/examples/TH-141/segments/开场对照导言/textbook.typ
new file mode 100644
index 0000000..60acdb1
--- /dev/null
+++ b/examples/TH-141/segments/开场对照导言/textbook.typ
@@ -0,0 +1,3 @@
+= 开场对照：弹性膜与液面
+
+$sigma$ 与机械张力同名，却有一个显著不同的性质：肥皂膜的 $sigma$ 与膜的面积无关，而弹性膜的张力随拉伸单调增大。本章从这一对照入手，目的是定位液面张力的微观来源——液面 $sigma$ 来自体相向表面补充新分子，而非把已有分子拉远。本节先把弹性膜的张力机制写一遍，再把液面的拉伸过程写一遍，两者对照得到液面 $sigma$ 与面积无关的物理原因。
diff --git a/examples/TH-141/segments/微观建模的共同骨架/element.toml b/examples/TH-141/segments/微观建模的共同骨架/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/微观建模的共同骨架/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/微观建模的共同骨架/textbook.typ b/examples/TH-141/segments/微观建模的共同骨架/textbook.typ
new file mode 100644
index 0000000..9d0e7af
--- /dev/null
+++ b/examples/TH-141/segments/微观建模的共同骨架/textbook.typ
@@ -0,0 +1,7 @@
+前一节得到的关系
+
+$ sigma = ("每个表面分子的亏损能") times ("单位面积分子数") $ <骨架公式>
+
+适用于所有以"分子搬到表面要付出键能代价"为出发点的微观模型。两个因子分别对应两类物理：前者衡量把一个分子从体相搬到表面的能量代价，后者衡量单位面积上有多少这种亏损分子。不同模型的差异只在于这两个因子的估法。
+
+接下来的几个模型都可以视为对 @骨架公式 的不同填法。量纲分析直接用单键能 $epsilon$ 与分子间距 $d$ 给出两因子的标度；缺键模型把亏损能精细化为"缺键数 $times$ 单键能"、把面密度精细化为 $(rho N_A \/ mu)^(2\/3)$；LJ 模型用 6-12 对势对半空间积分得到两因子的标度。同一骨架在固气界面也会被原样套用，仅把摩尔汽化热替换为摩尔升华热。
diff --git a/examples/TH-141/segments/微观派Lm下降/element.toml b/examples/TH-141/segments/微观派Lm下降/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/微观派Lm下降/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/微观派Lm下降/textbook.typ b/examples/TH-141/segments/微观派Lm下降/textbook.typ
new file mode 100644
index 0000000..76d4335
--- /dev/null
+++ b/examples/TH-141/segments/微观派Lm下降/textbook.typ
@@ -0,0 +1 @@
+从缺键模型 @缺键一般式 看，$sigma$ 对 $T$ 的依赖完全由 $L_m(T)$ 携带——另几个量 $rho$、$mu$、$N_A$ 与温度关系微弱，可视为常数。摩尔汽化热 $L_m$ 随 $T$ 升高单调下降：分子热运动加剧，平均键合能减弱，把分子从液体里拉出来所需的能量变小。临界点处 $L_m arrow.r 0$，故由 @缺键一般式 有 $sigma arrow.r 0$。这一行为是微观模型内禀给出的，不依赖任何外加假设。
diff --git a/examples/TH-141/segments/收束导言/element.toml b/examples/TH-141/segments/收束导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/收束导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/收束导言/textbook.typ b/examples/TH-141/segments/收束导言/textbook.typ
new file mode 100644
index 0000000..b004290
--- /dev/null
+++ b/examples/TH-141/segments/收束导言/textbook.typ
@@ -0,0 +1,3 @@
+= 收束：各模型横向对比
+
+本章沿着"假设由少到多"的方向给出了多种模型：量纲分析、Stefan 极简估算、缺键模型一般式、Eötvös 规则、$sigma(T, p)$ 多项式拟合。模型的输入复杂度不同，对常温水 $sigma_(L G)$ 的预测精度也不同。把几种典型预测并排列出，与实测 $0.072 thin "N/m"$ 对照，可以看到一个略反预期的现象——最简单的微观模型并不是最准的。下面给出对照表并逐一讨论偏差来源。
diff --git a/examples/TH-141/segments/浸润全谱与高低能表面/element.toml b/examples/TH-141/segments/浸润全谱与高低能表面/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/浸润全谱与高低能表面/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/浸润全谱与高低能表面/textbook.typ b/examples/TH-141/segments/浸润全谱与高低能表面/textbook.typ
new file mode 100644
index 0000000..150e04c
--- /dev/null
+++ b/examples/TH-141/segments/浸润全谱与高低能表面/textbook.typ
@@ -0,0 +1,17 @@
+由 @GGZ判据 按 $r equiv gamma_(S G) \/ gamma_(L G)$ 切段：
+
+#figure(
+  table(
+    columns: (auto, auto, auto),
+    align: (left, left, left),
+    table.header[*比值范围*][*接触角*][*现象*],
+    [$r > 1$], [无解], [完全铺展（superwetting）],
+    [$r = 1$], [$theta = 0$], [临界完全浸润],
+    [$1\/4 < r < 1$], [$0 < theta < pi\/2$], [部分浸润],
+    [$r = 1\/4$], [$theta = pi\/2$], [临界不浸润],
+    [$r < 1\/4$], [$theta > pi\/2$], [不浸润、成珠状],
+  ),
+  caption: [浸润全谱]
+) <浸润全谱表>
+
+把 @γ量级表 与浸润全谱并置就得到日常现象的解释。高能表面如金属、清洁玻璃，$gamma_(S G) tilde.op 1 thin "J/m"^2$，远大于水的 $gamma_(L G) tilde.op 0.072 thin "J/m"^2$，$r >> 1$，水在其上完全铺展。低能表面如石蜡、Teflon，$gamma_(S G) tilde.op 0.02 thin "J/m"^2$ 小于水的 $gamma_(L G)$，$r < 1\/4$，水在其上不浸润、成珠状。"水在玻璃上铺、在荷叶上成珠"这两件日常现象就是 $r$ 取值在 @GGZ判据 中位于 $r >> 1$ 与 $r < 1\/4$ 两端的直接体现。
diff --git a/examples/TH-141/segments/液气界面导言/element.toml b/examples/TH-141/segments/液气界面导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/液气界面导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/液气界面导言/textbook.typ b/examples/TH-141/segments/液气界面导言/textbook.typ
new file mode 100644
index 0000000..301c9ee
--- /dev/null
+++ b/examples/TH-141/segments/液气界面导言/textbook.typ
@@ -0,0 +1,3 @@
+= 液气界面 $sigma_(L G)$ 的微观建模
+
+液气界面的微观建模是表面张力理论的主菜。以下沿着"假设由少到多"的方向给出几个模型：从仅由量纲组合给出标度的量纲分析，到带一个自由参数 $zeta$ 的缺键模型，再到用真实势函数对半空间积分的 Lennard–Jones 模型。每个模型给出 $sigma_(L G)$ 的一个表达式，依次接受更多的物理输入。
diff --git a/examples/TH-141/segments/液面拉伸的本质/element.toml b/examples/TH-141/segments/液面拉伸的本质/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/液面拉伸的本质/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/液面拉伸的本质/textbook.typ b/examples/TH-141/segments/液面拉伸的本质/textbook.typ
new file mode 100644
index 0000000..19c3dfb
--- /dev/null
+++ b/examples/TH-141/segments/液面拉伸的本质/textbook.typ
@@ -0,0 +1,15 @@
+把同样的拉伸过程搬到液面上。设想用框架拉动一个肥皂膜，使液面面积由 $A$ 增至 $A + dif A$。若沿用弹性膜的图像，表面分子之间的距离应当被拉远，分子间键被拉长，张力随面积单调增大。但实验上肥皂膜的 $sigma$ 与面积 $A$ 无关。这意味着液面被拉大时发生的事情并非分子被拉远。
+
+液体内部分子可以自由流动。面积由 $A$ 增至 $A + dif A$ 时，体相中一部分分子被搬到表面，使表面分子数 $N_s$ 按 $N_s prop A$ 同步增大。每个表面分子相对体相分子的"亏损能"由局域近邻结构决定，与表面大小无关，记为 $Delta U$。总表面能为
+
+$ E_s = N_s Delta U prop A , $
+
+单位面积能量
+
+$ sigma = E_s / A = "(每个表面分子的亏损能)" times "(单位面积分子数)" $
+
+是一个与 $A$ 无关的常数。这就是液面 $sigma$ 与面积无关的微观原因。
+
+需要顺手澄清的是表面层的厚度。液体分子的作用程在 nm 量级，宏观尺度下表面层可视为零厚度膜——它不是一层有厚度的"皮"，只是体相分子近邻环境与表面分子近邻环境不同所定义出来的一个抽象切面。
+
+"流动补缺"这一图像是液体独有的。固体内部分子不能自由流动，扩大固体表面时不能从体相搬一个分子上来。后续讨论固体表面时这条退路被切断，将出现新的物理。
diff --git a/examples/TH-141/segments/算不准背后的真实物理/element.toml b/examples/TH-141/segments/算不准背后的真实物理/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/算不准背后的真实物理/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/算不准背后的真实物理/textbook.typ b/examples/TH-141/segments/算不准背后的真实物理/textbook.typ
new file mode 100644
index 0000000..936e8af
--- /dev/null
+++ b/examples/TH-141/segments/算不准背后的真实物理/textbook.typ
@@ -0,0 +1,11 @@
+@模型对照表 中的偏差并非来源不明，每一条都可追溯到一项物理简化。
+
+分子作用力的各向异性。缺键模型把每对分子之间的键能简化为同一个 $epsilon$，但真实的分子间相互作用具有方向性，水的氢键尤甚。各向异性对应的研究方向是液晶与晶体表面物理。
+
+参数 $zeta$ 的有效性。Stefan 取 $zeta = 1\/2$ 只是为得到不依赖晶格的最简表达；FCC (111) 给出 $zeta = 3\/4$ 是基于严格晶格的几何计数。真实液体并没有严格晶格，$zeta$ 应当被视为有效参数。如何从液体的局部结构出发反推 $zeta$ 是液体统计物理的一个分支。
+
+氢键带来的极性贡献。缺键模型把所有相互作用都归为单一键能，忽略了水分子之间的氢键贡献。@GG公式 在水/聚合物体系下与实验偏差较大就是这一简化的具体后果，Fowkes 分解就是针对这一偏差的修正路径。
+
+表面层并非严格二维。我们建模时把表面分子当作一个零厚度的层，但真实液体的表面层有 nm 量级的厚度，密度随深度连续变化。这条偏差对应的研究方向是液气界面的密度剖面与梯度理论。
+
+逐条看下来，每一条偏差都对应一个仍在活跃的研究方向。本章的微观模型给出"理论从分子到宏观浸润如何一步步推出来"的完整链条，但同时也指明了链条上每一段还能被怎么继续精细化。这才是建模在物理学里的常态。
diff --git a/examples/TH-141/segments/缺键模型导言/element.toml b/examples/TH-141/segments/缺键模型导言/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/缺键模型导言/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/缺键模型导言/textbook.typ b/examples/TH-141/segments/缺键模型导言/textbook.typ
new file mode 100644
index 0000000..dee31ae
--- /dev/null
+++ b/examples/TH-141/segments/缺键模型导言/textbook.typ
@@ -0,0 +1,3 @@
+== 缺键模型
+
+缺键模型在 @骨架公式 的两个因子上各加一层物理输入。亏损能由"表面分子比体相分子缺多少根键"乘以"每根键的能量"给出，单键能由摩尔汽化热反推；面密度由"每个分子占的体积"开 2/3 次方给出。模型只保留一个无量纲参数 $zeta$——表面分子近邻数与体相近邻数之比。下面给出一般式，再讨论它的两个特例：$zeta = 1\/2$ 对应不带任何晶格信息的 Stefan 估算，立方格子下 $zeta$ 可以精确取到 $5\/6$、$3\/4$ 等具体数值。
diff --git a/examples/TH-141/segments/胡克唯象模型回顾/element.toml b/examples/TH-141/segments/胡克唯象模型回顾/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/胡克唯象模型回顾/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/胡克唯象模型回顾/textbook.typ b/examples/TH-141/segments/胡克唯象模型回顾/textbook.typ
new file mode 100644
index 0000000..045159b
--- /dev/null
+++ b/examples/TH-141/segments/胡克唯象模型回顾/textbook.typ
@@ -0,0 +1,3 @@
+考虑一根原长 $L_0$、劲度系数 $k$ 的弹性绳，把它拉伸至长度 $L$。宏观上张力为 $F = k(L - L_0)$，随长度线性增大。从微观上看，弹性绳内部的所有分子被一同拉远，分子间距由 $d_0$ 增至 $d_0 (L \/ L_0)$，键能上升，张力即为这些键被拉长所提供的回复力之和。
+
+二维弹性膜的情形与此完全平行。设原面积 $A_0$、二维劲度系数 $k_("2D")$，把面积拉至 $A$，则单位长度上的张力沿两个主方向各贡献一份，随应变 $(A - A_0) \/ A_0$ 线性增大。无论一维还是二维，弹性体被拉伸时承担应力的始终是同一批分子——拉伸前后分子数不变，变的是它们之间的距离。
diff --git a/examples/TH-141/segments/表面能γ与表面应力f/element.toml b/examples/TH-141/segments/表面能γ与表面应力f/element.toml
new file mode 100644
index 0000000..d67ae12
--- /dev/null
+++ b/examples/TH-141/segments/表面能γ与表面应力f/element.toml
@@ -0,0 +1 @@
+kind = "segment"
diff --git a/examples/TH-141/segments/表面能γ与表面应力f/textbook.typ b/examples/TH-141/segments/表面能γ与表面应力f/textbook.typ
new file mode 100644
index 0000000..585d7bd
--- /dev/null
+++ b/examples/TH-141/segments/表面能γ与表面应力f/textbook.typ
@@ -0,0 +1,9 @@
+液体的 $sigma$ 同时描述两件事：创造单位新表面要付出的能量代价，以及拉伸单位已有表面的弹性反应。它们在液体里合二为一——液体可自由流动，"拉伸"等价于"补充新分子"。
+
+固体不能流动，这两件事必须分开。设单位面积的表面能为 $gamma$，其定义为创造单位新表面所需的可逆功。再设单位长度的表面应力为 $f$，其定义为把已有的单位面积表面拉伸应变 $epsilon$ 所需的功面密度。两者之间的关系由 Shuttleworth 给出
+
+$ f = gamma + (dif gamma) / (dif epsilon) , $
+
+其中右端第二项反映 $gamma$ 本身随应变变化的部分。一般有 $f eq.not gamma$。
+
+本节及之后所有讨论以 $gamma$ 为对象。$f$ 仅在真正"拉固体"的场景下登场，例如薄膜应力、纳米颗粒形变，本节不展开。
diff --git a/package-lock.json b/package-lock.json
deleted file mode 100644
index 613a179..0000000
--- a/package-lock.json
+++ /dev/null
@@ -1,1984 +0,0 @@
-{
-  "name": "curriculum-project-hub",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "curriculum-project-hub",
-      "version": "0.1.0",
-      "devDependencies": {
-        "likec4": "^1.58.0"
-      }
-    },
-    "node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
-      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@hpcc-js/wasm-graphviz": {
-      "version": "1.21.6",
-      "resolved": "https://registry.npmjs.org/@hpcc-js/wasm-graphviz/-/wasm-graphviz-1.21.6.tgz",
-      "integrity": "sha512-Yk+4fx7AjMD22o5hBwkaAtikNNyBNrYWwSpdM8oNaOPLq6apoBVx7KdvhhC3ujCynSQG24SOBrAuCrw6RnkDBw==",
-      "dev": true,
-      "license": "Apache-2.0"
-    },
-    "node_modules/@likec4/core": {
-      "version": "1.58.0",
-      "resolved": "https://registry.npmjs.org/@likec4/core/-/core-1.58.0.tgz",
-      "integrity": "sha512-O4odnNSm9HSbfATY+WOeel39vLJxF5lLKJIH4slfpH2UntX/1ombN3br0Y1Bwqhl6zN8eptvCCUAM8HtpaocQA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "immer": "^11.1.8",
-        "type-fest": "^4.41.0",
-        "zod": "^4.4.3"
-      }
-    },
-    "node_modules/@likec4/icons": {
-      "version": "1.46.4",
-      "resolved": "https://registry.npmjs.org/@likec4/icons/-/icons-1.46.4.tgz",
-      "integrity": "sha512-GAL7aW53Mq3RnbFGK8BxHi/vGf73F7ODqgf7yPqfv/Kslt7KxHoxr/ZDIHcSo0oF4tXhpL7GYlpsgY71UJseqw==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "react": "^18.x || ^19.x",
-        "react-dom": "^18.x || ^19.x"
-      }
-    },
-    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
-      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@tybys/wasm-util": "^0.10.1"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
-      },
-      "peerDependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1"
-      }
-    },
-    "node_modules/@oxc-project/types": {
-      "version": "0.133.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
-      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/Boshen"
-      }
-    },
-    "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
-      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
-      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
-      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
-      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
-      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
-      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
-      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
-      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
-      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
-      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
-      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
-      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
-      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
-      "cpu": [
-        "wasm32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "^1.1.4"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
-      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
-      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
-      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@vitejs/plugin-react": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.2.tgz",
-      "integrity": "sha512-DlSMqo4WhThw4vB8Mpn0Woe9J+Jfq1geJ61AKW0QEgLzGMNwtIMdxbDUzLxcun8W7NbJO0e2Jg/Nxm3cCSVzzg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@rolldown/pluginutils": "^1.0.0"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "peerDependencies": {
-        "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0",
-        "babel-plugin-react-compiler": "^1.0.0",
-        "vite": "^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@rolldown/plugin-babel": {
-          "optional": true
-        },
-        "babel-plugin-react-compiler": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/braces": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fill-range": "^7.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/bundle-require": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/bundle-require/-/bundle-require-5.1.0.tgz",
-      "integrity": "sha512-3WrrOuZiyaaZPWiEt4G3+IffISVC9HYlWueJEBWED4ZH4aIAC2PnkdnuRrR94M+w6yGWn4AglWtJtBI8YqvgoA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "load-tsconfig": "^0.2.3"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "peerDependencies": {
-        "esbuild": ">=0.18"
-      }
-    },
-    "node_modules/chokidar": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
-      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "readdirp": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/esbuild": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.0",
-        "@esbuild/android-arm": "0.28.0",
-        "@esbuild/android-arm64": "0.28.0",
-        "@esbuild/android-x64": "0.28.0",
-        "@esbuild/darwin-arm64": "0.28.0",
-        "@esbuild/darwin-x64": "0.28.0",
-        "@esbuild/freebsd-arm64": "0.28.0",
-        "@esbuild/freebsd-x64": "0.28.0",
-        "@esbuild/linux-arm": "0.28.0",
-        "@esbuild/linux-arm64": "0.28.0",
-        "@esbuild/linux-ia32": "0.28.0",
-        "@esbuild/linux-loong64": "0.28.0",
-        "@esbuild/linux-mips64el": "0.28.0",
-        "@esbuild/linux-ppc64": "0.28.0",
-        "@esbuild/linux-riscv64": "0.28.0",
-        "@esbuild/linux-s390x": "0.28.0",
-        "@esbuild/linux-x64": "0.28.0",
-        "@esbuild/netbsd-arm64": "0.28.0",
-        "@esbuild/netbsd-x64": "0.28.0",
-        "@esbuild/openbsd-arm64": "0.28.0",
-        "@esbuild/openbsd-x64": "0.28.0",
-        "@esbuild/openharmony-arm64": "0.28.0",
-        "@esbuild/sunos-x64": "0.28.0",
-        "@esbuild/win32-arm64": "0.28.0",
-        "@esbuild/win32-ia32": "0.28.0",
-        "@esbuild/win32-x64": "0.28.0"
-      }
-    },
-    "node_modules/escalade": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/fdir": {
-      "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.4.0.tgz",
-      "integrity": "sha512-3oB133prH1o4j/L5lLW7uOCF1PlD+/It2L0eL/iAqWMB91RBbqTewABqxhj0ibBd90EEmWZq7ntIWzVaWcXTGQ==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "picomatch": "^3 || ^4"
-      },
-      "peerDependenciesMeta": {
-        "picomatch": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/fill-range": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "to-regex-range": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/get-caller-file": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/immer": {
-      "version": "11.1.8",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.8.tgz",
-      "integrity": "sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/immer"
-      }
-    },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-number": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.12.0"
-      }
-    },
-    "node_modules/lightningcss": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
-      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
-      "dev": true,
-      "license": "MPL-2.0",
-      "dependencies": {
-        "detect-libc": "^2.0.3"
-      },
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      },
-      "optionalDependencies": {
-        "lightningcss-android-arm64": "1.32.0",
-        "lightningcss-darwin-arm64": "1.32.0",
-        "lightningcss-darwin-x64": "1.32.0",
-        "lightningcss-freebsd-x64": "1.32.0",
-        "lightningcss-linux-arm-gnueabihf": "1.32.0",
-        "lightningcss-linux-arm64-gnu": "1.32.0",
-        "lightningcss-linux-arm64-musl": "1.32.0",
-        "lightningcss-linux-x64-gnu": "1.32.0",
-        "lightningcss-linux-x64-musl": "1.32.0",
-        "lightningcss-win32-arm64-msvc": "1.32.0",
-        "lightningcss-win32-x64-msvc": "1.32.0"
-      }
-    },
-    "node_modules/lightningcss-android-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
-      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
-      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-darwin-x64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
-      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
-      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
-      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
-      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
-      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
-      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
-      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
-      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
-      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/likec4": {
-      "version": "1.58.0",
-      "resolved": "https://registry.npmjs.org/likec4/-/likec4-1.58.0.tgz",
-      "integrity": "sha512-B4Jc2fZ4ZSd7vaolcDjgMQvl6+vU7v2ADZj7Oi99HUZQp0wtifeG/438E/dpfAjlh198e+I7QLdaLHkvRC+Xlg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@hpcc-js/wasm-graphviz": "1.21.6",
-        "@likec4/core": "1.58.0",
-        "@likec4/icons": "1.46.4",
-        "@vitejs/plugin-react": "^6.0.2",
-        "bundle-require": "^5.1.0",
-        "chokidar": "^5.0.0",
-        "esbuild": "0.28.0",
-        "fdir": "6.4.0",
-        "immer": "^11.1.8",
-        "nano-spawn": "^2.1.0",
-        "playwright": "1.60.0",
-        "std-env": "^4.1.0",
-        "type-fest": "^4.41.0",
-        "use-sync-external-store": "^1.6.0",
-        "vite": "^8.0.14",
-        "vite-plugin-singlefile": "^2.3.3",
-        "yargs": "17.7.2"
-      },
-      "bin": {
-        "likec4": "bin/likec4.mjs"
-      },
-      "engines": {
-        "node": ">=22.22.3"
-      },
-      "peerDependencies": {
-        "@tanstack/ai": "^0.14.0",
-        "@tanstack/ai-anthropic": "^0.8.3",
-        "@tanstack/ai-gemini": "^0.10.0",
-        "@tanstack/ai-ollama": "^0.6.10",
-        "@tanstack/ai-openai": "^0.8.2",
-        "@tanstack/ai-openrouter": "^0.8.2",
-        "react": "^19.x",
-        "react-dom": "^19.x"
-      },
-      "peerDependenciesMeta": {
-        "@tanstack/ai": {
-          "optional": true
-        },
-        "@tanstack/ai-anthropic": {
-          "optional": true
-        },
-        "@tanstack/ai-gemini": {
-          "optional": true
-        },
-        "@tanstack/ai-ollama": {
-          "optional": true
-        },
-        "@tanstack/ai-openai": {
-          "optional": true
-        },
-        "@tanstack/ai-openrouter": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/load-tsconfig": {
-      "version": "0.2.5",
-      "resolved": "https://registry.npmjs.org/load-tsconfig/-/load-tsconfig-0.2.5.tgz",
-      "integrity": "sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      }
-    },
-    "node_modules/micromatch": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "braces": "^3.0.3",
-        "picomatch": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/micromatch/node_modules/picomatch": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/nano-spawn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/nano-spawn/-/nano-spawn-2.1.0.tgz",
-      "integrity": "sha512-yTW+2okrElHiH4fsiz/+/zc0EDo9BDDoC3iKk8dpv1GeRc9nUWzUZHx6TofMWErchhUQR8hY9/Eu1Uja9x1nqA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.17"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/nano-spawn?sponsor=1"
-      }
-    },
-    "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
-    "node_modules/picocolors": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/playwright": {
-      "version": "1.60.0",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
-      "integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "playwright-core": "1.60.0"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "fsevents": "2.3.2"
-      }
-    },
-    "node_modules/playwright-core": {
-      "version": "1.60.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
-      "integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "playwright-core": "cli.js"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "nanoid": "^3.3.12",
-        "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
-    "node_modules/react": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
-      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/react-dom": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
-      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "scheduler": "^0.27.0"
-      },
-      "peerDependencies": {
-        "react": "^19.2.7"
-      }
-    },
-    "node_modules/readdirp": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
-      "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "type": "individual",
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/require-directory": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/rolldown": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
-      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@oxc-project/types": "=0.133.0",
-        "@rolldown/pluginutils": "^1.0.0"
-      },
-      "bin": {
-        "rolldown": "bin/cli.mjs"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.3",
-        "@rolldown/binding-darwin-arm64": "1.0.3",
-        "@rolldown/binding-darwin-x64": "1.0.3",
-        "@rolldown/binding-freebsd-x64": "1.0.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
-        "@rolldown/binding-linux-arm64-musl": "1.0.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-musl": "1.0.3",
-        "@rolldown/binding-openharmony-arm64": "1.0.3",
-        "@rolldown/binding-wasm32-wasi": "1.0.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
-        "@rolldown/binding-win32-x64-msvc": "1.0.3"
-      }
-    },
-    "node_modules/scheduler": {
-      "version": "0.27.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
-      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/std-env": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
-      "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tinyglobby": {
-      "version": "0.2.17",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
-      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/SuperchupuDev"
-      }
-    },
-    "node_modules/tinyglobby/node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependencies": {
-        "picomatch": "^3 || ^4"
-      },
-      "peerDependenciesMeta": {
-        "picomatch": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/to-regex-range": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-number": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=8.0"
-      }
-    },
-    "node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
-      "license": "0BSD",
-      "optional": true
-    },
-    "node_modules/type-fest": {
-      "version": "4.41.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
-      "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
-      "dev": true,
-      "license": "(MIT OR CC0-1.0)",
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/use-sync-external-store": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
-      "integrity": "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
-    "node_modules/vite": {
-      "version": "8.0.16",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
-      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.4",
-        "postcss": "^8.5.15",
-        "rolldown": "1.0.3",
-        "tinyglobby": "^0.2.17"
-      },
-      "bin": {
-        "vite": "bin/vite.js"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "funding": {
-        "url": "https://github.com/vitejs/vite?sponsor=1"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.3"
-      },
-      "peerDependencies": {
-        "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
-        "esbuild": "^0.27.0 || ^0.28.0",
-        "jiti": ">=1.21.0",
-        "less": "^4.0.0",
-        "sass": "^1.70.0",
-        "sass-embedded": "^1.70.0",
-        "stylus": ">=0.54.8",
-        "sugarss": "^5.0.0",
-        "terser": "^5.16.0",
-        "tsx": "^4.8.1",
-        "yaml": "^2.4.2"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        },
-        "@vitejs/devtools": {
-          "optional": true
-        },
-        "esbuild": {
-          "optional": true
-        },
-        "jiti": {
-          "optional": true
-        },
-        "less": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        },
-        "sass-embedded": {
-          "optional": true
-        },
-        "stylus": {
-          "optional": true
-        },
-        "sugarss": {
-          "optional": true
-        },
-        "terser": {
-          "optional": true
-        },
-        "tsx": {
-          "optional": true
-        },
-        "yaml": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/vite-plugin-singlefile": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/vite-plugin-singlefile/-/vite-plugin-singlefile-2.3.3.tgz",
-      "integrity": "sha512-XVnGH0QzbOa8fxRSsHdCarVN1BSBXNi7uLMQYlrGRN5apdHkk62XQWRJhVever0lnfuyBkwn+kvVChdm/OoOUg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "micromatch": "^4.0.8"
-      },
-      "engines": {
-        "node": ">18.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^4.59.0",
-        "vite": "^5.4.21 || ^6.0.0 || ^7.0.0 || ^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/vite/node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}
diff --git a/package.json b/package.json
deleted file mode 100644
index c62cd66..0000000
--- a/package.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "name": "curriculum-project-hub",
-  "version": "0.1.0",
-  "private": true,
-  "description": "Architecture model for Curriculum Project Hub.",
-  "scripts": {
-    "dev": "likec4 serve docs/architecture/likec4",
-    "build": "likec4 build docs/architecture/likec4 -o dist/architecture --base ./ --title \"Curriculum Project Hub Architecture\"",
-    "validate": "likec4 validate docs/architecture/likec4",
-    "format": "likec4 format docs/architecture/likec4",
-    "export:json": "likec4 export json docs/architecture/likec4 -o dist/architecture/model.json",
-    "export:png": "likec4 export png docs/architecture/likec4 -o dist/architecture/png"
-  },
-  "devDependencies": {
-    "likec4": "^1.58.0"
-  }
-}
diff --git a/render/examples/smoke-eng/examples/坐标数量积/element.toml b/render/examples/smoke-eng/examples/坐标数量积/element.toml
new file mode 100644
index 0000000..1c09cee
--- /dev/null
+++ b/render/examples/smoke-eng/examples/坐标数量积/element.toml
@@ -0,0 +1 @@
+source = "2024 高考甲卷"
diff --git a/render/examples/smoke-eng/examples/坐标数量积/problem.typ b/render/examples/smoke-eng/examples/坐标数量积/problem.typ
new file mode 100644
index 0000000..b12b104
--- /dev/null
+++ b/render/examples/smoke-eng/examples/坐标数量积/problem.typ
@@ -0,0 +1 @@
+已知 $arrow(a) = (1, 2)$，$arrow(b) = (3, -1)$，求 $arrow(a) dot arrow(b)$。
diff --git a/render/examples/smoke-eng/examples/坐标数量积/solution.typ b/render/examples/smoke-eng/examples/坐标数量积/solution.typ
new file mode 100644
index 0000000..8dfdfe8
--- /dev/null
+++ b/render/examples/smoke-eng/examples/坐标数量积/solution.typ
@@ -0,0 +1 @@
+由坐标公式，$arrow(a) dot arrow(b) = 1 times 3 + 2 times (-1) = 3 - 2 = 1$。
diff --git a/render/examples/smoke-eng/examples/求模长/element.toml b/render/examples/smoke-eng/examples/求模长/element.toml
new file mode 100644
index 0000000..e4311ae
--- /dev/null
+++ b/render/examples/smoke-eng/examples/求模长/element.toml
@@ -0,0 +1 @@
+# no source scalar — exercises the absent-scalar path
diff --git a/render/examples/smoke-eng/examples/求模长/problem.typ b/render/examples/smoke-eng/examples/求模长/problem.typ
new file mode 100644
index 0000000..1bfe87e
--- /dev/null
+++ b/render/examples/smoke-eng/examples/求模长/problem.typ
@@ -0,0 +1 @@
+求向量 $arrow(a) = (3, 4)$ 的模长 $|arrow(a)|$。
diff --git a/render/examples/smoke-eng/examples/求模长/solution.typ b/render/examples/smoke-eng/examples/求模长/solution.typ
new file mode 100644
index 0000000..87e8a5f
--- /dev/null
+++ b/render/examples/smoke-eng/examples/求模长/solution.typ
@@ -0,0 +1 @@
+$|arrow(a)| = sqrt(3^2 + 4^2) = sqrt(25) = 5$。
diff --git a/render/examples/smoke-eng/exports/student.typ b/render/examples/smoke-eng/exports/student.typ
new file mode 100644
index 0000000..a33d25d
--- /dev/null
+++ b/render/examples/smoke-eng/exports/student.typ
@@ -0,0 +1,79 @@
+// DEFAULT STUDENT TEMPLATE (framework default; ADR-0011).
+//
+// This is a *real, editable* file that lives in an engineering file at
+// `exports/student.typ`. The framework compiles it AS THE MAIN FILE with the
+// manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/student.typ <out>
+//
+// It is intentionally self-contained (no shared helper import) so it can be
+// copied verbatim into a new engineering file's `exports/`. Presentation —
+// heading numbering — lives HERE (editable per engineering file), not in the
+// manifest and not hardcoded in the cph-render package.
+//
+// WHY THE INCLUDE LOOP IS HERE AND NOT IN cph-render: typst resolves a dynamic
+// `include` path relative to the file it lexically appears in, and a package has
+// its own virtual root — an include inside cph-render would resolve against the
+// PACKAGE, not the engineering root. A `/<part.path>/<field>.typ` written HERE
+// (this template lives under `--root`) resolves against `--root`. So the
+// template loads content and hands cph-render an already-assembled `parts` array.
+//
+// OPEN CONTRACT POINT — optional-content presence. typst has no "does this file
+// exist" primitive (a missing `include` is a hard compile error). So the
+// template CANNOT probe disk the way the old Rust driver did for lemma `proof`.
+// It relies on the manifest declaring which optional content fields are present,
+// via a per-part `fields` array listing the content fields that exist on disk
+// (the engine knows this — it walks the part dir). Required fields are loaded
+// unconditionally; optional fields load only if listed in `fields`. If a part
+// omits `fields`, optional content is skipped (conservative). The exact shape of
+// this declaration is for the manifest/Rust contract to pin.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the student build, so the target is fixed.
+#let target = "student"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/render/examples/smoke-eng/exports/teacher.typ b/render/examples/smoke-eng/exports/teacher.typ
new file mode 100644
index 0000000..b976b1f
--- /dev/null
+++ b/render/examples/smoke-eng/exports/teacher.typ
@@ -0,0 +1,62 @@
+// DEFAULT TEACHER TEMPLATE (framework default; ADR-0011).
+//
+// Lives in an engineering file at `exports/teacher.typ`. Compiled AS MAIN with
+// the manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/teacher.typ <out>
+//
+// Self-contained (copyable into an engineering file). Identical to student.typ
+// except the fixed target is "teacher" (so the (kind x target) render matrix in
+// cph-render shows solutions and proofs). See student.typ for the full notes on
+// why the include loop lives here (package virtual-root resolution) and on the
+// OPEN optional-content (`fields`) contract point.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the teacher build, so the target is fixed.
+#let target = "teacher"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/render/examples/smoke-eng/lemmas/垂直判据/element.toml b/render/examples/smoke-eng/lemmas/垂直判据/element.toml
new file mode 100644
index 0000000..73f7af4
--- /dev/null
+++ b/render/examples/smoke-eng/lemmas/垂直判据/element.toml
@@ -0,0 +1 @@
+# lemma WITHOUT proof — proof.typ is absent on disk; manifest omits it from fields
diff --git a/render/examples/smoke-eng/lemmas/垂直判据/stmt.typ b/render/examples/smoke-eng/lemmas/垂直判据/stmt.typ
new file mode 100644
index 0000000..c5f0534
--- /dev/null
+++ b/render/examples/smoke-eng/lemmas/垂直判据/stmt.typ
@@ -0,0 +1 @@
+两个非零向量垂直当且仅当其数量积为零，即 $arrow(a) perp arrow(b) <==> arrow(a) dot arrow(b) = 0$。
diff --git a/render/examples/smoke-eng/lemmas/柯西不等式/element.toml b/render/examples/smoke-eng/lemmas/柯西不等式/element.toml
new file mode 100644
index 0000000..5b79235
--- /dev/null
+++ b/render/examples/smoke-eng/lemmas/柯西不等式/element.toml
@@ -0,0 +1 @@
+# lemma scalars: none
diff --git a/render/examples/smoke-eng/lemmas/柯西不等式/proof.typ b/render/examples/smoke-eng/lemmas/柯西不等式/proof.typ
new file mode 100644
index 0000000..7248a39
--- /dev/null
+++ b/render/examples/smoke-eng/lemmas/柯西不等式/proof.typ
@@ -0,0 +1,3 @@
+由数量积定义 $arrow(a) dot arrow(b) = |arrow(a)| |arrow(b)| cos theta$，
+又 $|cos theta| <= 1$，故 $|arrow(a) dot arrow(b)| = |arrow(a)| |arrow(b)| |cos theta| <= |arrow(a)| |arrow(b)|$。
+$qed$
diff --git a/render/examples/smoke-eng/lemmas/柯西不等式/stmt.typ b/render/examples/smoke-eng/lemmas/柯西不等式/stmt.typ
new file mode 100644
index 0000000..b397fda
--- /dev/null
+++ b/render/examples/smoke-eng/lemmas/柯西不等式/stmt.typ
@@ -0,0 +1 @@
+对任意向量 $arrow(a)$、$arrow(b)$，有 $|arrow(a) dot arrow(b)| <= |arrow(a)| |arrow(b)|$。
diff --git a/render/examples/smoke-eng/manifest.toml b/render/examples/smoke-eng/manifest.toml
new file mode 100644
index 0000000..bb64c9d
--- /dev/null
+++ b/render/examples/smoke-eng/manifest.toml
@@ -0,0 +1,64 @@
+# Throwaway smoke engineering file for the cph-render template round (ADR-0011).
+# Exercises all 4 kinds + nested headings (per-level numbering) + an example with
+# a `source` scalar and one without + a lemma with proof and one without.
+#
+# The per-part `fields` array lists the content fields present ON DISK. The
+# template uses it to decide whether to load OPTIONAL content (lemma `proof`),
+# because typst has no file-exists primitive. (OPEN: the exact manifest shape for
+# declaring optional-field presence is for the Rust/manifest contract to pin.)
+
+[project]
+id   = "smoke-eng"
+name = "cph-render template smoke"
+
+[info]
+title  = "向量与几何 · 示例讲义"
+author = ["张老师", "李老师"]
+
+# segment — nested headings exercise per-level numbering (一、 / 1.1 / 1.1.1).
+[[parts]]
+kind   = "segment"
+path   = "segments/向量数量积"
+fields = ["textbook"]
+
+# example WITH source scalar
+[[parts]]
+kind   = "example"
+path   = "examples/坐标数量积"
+fields = ["problem", "solution"]
+
+# example WITHOUT source scalar
+[[parts]]
+kind   = "example"
+path   = "examples/求模长"
+fields = ["problem", "solution"]
+
+# lemma WITH proof (proof.typ present on disk; declared in fields)
+[[parts]]
+kind   = "lemma"
+path   = "lemmas/柯西不等式"
+fields = ["stmt", "proof"]
+
+# lemma WITHOUT proof (proof.typ absent; fields omits it)
+[[parts]]
+kind   = "lemma"
+path   = "lemmas/垂直判据"
+fields = ["stmt"]
+
+# sop
+[[parts]]
+kind   = "sop"
+path   = "sops/求夹角步骤"
+fields = ["sop"]
+
+[targets.student]
+artifact = "single-file"
+[[targets.student.steps]]
+type     = "typst-compile"
+template = "exports/student.typ"
+
+[targets.teacher]
+artifact = "single-file"
+[[targets.teacher.steps]]
+type     = "typst-compile"
+template = "exports/teacher.typ"
diff --git a/render/examples/smoke-eng/segments/向量数量积/textbook.typ b/render/examples/smoke-eng/segments/向量数量积/textbook.typ
new file mode 100644
index 0000000..9ab574b
--- /dev/null
+++ b/render/examples/smoke-eng/segments/向量数量积/textbook.typ
@@ -0,0 +1,14 @@
+= 平面向量的数量积
+
+本节研究平面向量的基本运算。设 $arrow(a)$、$arrow(b)$ 为平面内两个向量，
+其数量积定义为 $arrow(a) dot arrow(b) = |arrow(a)| |arrow(b)| cos theta$，
+其中 $theta$ 为两向量的夹角。
+
+== 坐标表示
+
+在直角坐标系下，若 $arrow(a) = (x_1, y_1)$、$arrow(b) = (x_2, y_2)$，则
+$arrow(a) dot arrow(b) = x_1 x_2 + y_1 y_2$。
+
+== 几何意义
+
+数量积等于一个向量的模与另一向量在其方向上投影之积。
diff --git a/render/examples/smoke-eng/sops/求夹角步骤/element.toml b/render/examples/smoke-eng/sops/求夹角步骤/element.toml
new file mode 100644
index 0000000..5d987cc
--- /dev/null
+++ b/render/examples/smoke-eng/sops/求夹角步骤/element.toml
@@ -0,0 +1 @@
+# sop scalars: none
diff --git a/render/examples/smoke-eng/sops/求夹角步骤/sop.typ b/render/examples/smoke-eng/sops/求夹角步骤/sop.typ
new file mode 100644
index 0000000..2c9b75a
--- /dev/null
+++ b/render/examples/smoke-eng/sops/求夹角步骤/sop.typ
@@ -0,0 +1,4 @@
+求两向量夹角的标准步骤：
++ 计算数量积 $arrow(a) dot arrow(b)$；
++ 分别计算模长 $|arrow(a)|$、$|arrow(b)|$；
++ 代入 $cos theta = (arrow(a) dot arrow(b)) / (|arrow(a)| |arrow(b)|)$ 求出 $theta$。
diff --git a/render/lib.typ b/render/lib.typ
new file mode 100644
index 0000000..d809220
--- /dev/null
+++ b/render/lib.typ
@@ -0,0 +1,152 @@
+// cph-render — curriculum lesson render package.
+//
+// PUBLIC ENTRY: `render-lesson(info, target, parts, heading-numbering)`.
+//
+// MODEL (ADR-0011). A build compiles a *template file* (e.g. `exports/student.typ`)
+// as the typst main, with the manifest injected via `--input manifest=<path>`.
+// The template reads the manifest, loads each part's content, and calls
+// `render-lesson` here. Presentation (heading numbering) lives in the template,
+// not the manifest, not hardcoded-unreachable in this package — we only provide
+// the DEFAULT scheme (`default-heading-numbering`) for the template to use or
+// override.
+//
+// WHY THE TEMPLATE LOADS CONTENT, NOT US (the include-resolution finding):
+//   typst resolves an `include`/`import` path relative to THE PACKAGE/FILE THE
+//   include LEXICALLY APPEARS IN, and a package (`@local/cph-render`) has its OWN
+//   virtual root. A dynamic `include` written inside this file resolves against
+//   the PACKAGE root — even an absolute `/segments/x.typ` lands in the package
+//   dir, NOT the engineering-file root (`--root`). Verified empirically.
+//   Therefore the dynamic-include LOOP must live in the TEMPLATE (which lives at
+//   `<root>/exports/*.typ`, so `/<part.path>/<field>.typ` resolves against
+//   `--root`). `render-lesson` is content-in: it takes an ALREADY-ASSEMBLED
+//   `parts` array of dicts and never includes anything itself.
+//
+// A part dict the template hands us:
+//   `kind` plus that kind's content/scalar fields. Content field VALUES are
+//   already-evaluated typst content (the template produced them via `include`).
+//
+// kind -> fields (MVP) — see `part-fields` below, which the template uses to
+// know what to load:
+//   segment : textbook (content, required)
+//   example : problem (content, required), solution (content, required),
+//             source (string scalar, optional, from <path>/element.toml)
+//   lemma   : stmt (content, required), proof (content, optional)
+//   sop     : sop (content, required)
+//
+// target -> show/hide (the (kind x target) render matrix; defaults per
+// ADR-0005/0008, derived internally — template passes only the target string):
+//   student : example problem only (hide solution); lemma stmt only (hide
+//             proof); segment textbook; sop shown.
+//   teacher : everything shown.
+//   unknown : rendered conservatively == student (show only required-public
+//             fields). Never crashes. The "no render rule => warning"
+//             diagnostic is the Rust side's job, not ours.
+
+#import "src/style.typ": base-style, default-heading-numbering, title-block, subtitle-block
+#import "src/elements/segment.typ": display-segment
+#import "src/elements/example.typ": display-example
+#import "src/elements/lemma.typ": display-lemma
+#import "src/elements/sop.typ": display-sop
+#import "src/elements/common.typ": example-counter, lemma-counter
+
+/// Per-kind field manifest, exported so a TEMPLATE knows exactly what to load
+/// for each part without hardcoding the matrix. For each kind:
+///   `content`: field names whose `<part.path>/<field>.typ` the template must
+///              `include` (assembling them into the part dict).
+///   `optional-content`: content fields that may be absent (template should
+///              probe before including; absence is fine).
+///   `scalars`: scalar field names the template reads from `<path>/element.toml`
+///              (currently only example `source`).
+/// Keeping this here (not in the template) keeps kind->fields a single source of
+/// truth in the package; the template iterates it generically.
+#let part-fields = (
+  segment: (content: ("textbook",), optional-content: (), scalars: ()),
+  example: (content: ("problem", "solution"), optional-content: (), scalars: ("source",)),
+  lemma: (content: ("stmt",), optional-content: ("proof",), scalars: ()),
+  sop: (content: ("sop",), optional-content: (), scalars: ()),
+)
+
+/// Resolve a target string to the set of show/hide booleans.
+/// Unknown targets fall back to the conservative (student-like) profile.
+#let _flags-for(target) = {
+  if target == "teacher" {
+    (show-solution: true, show-proof: true, subtitle: [教师版讲义])
+  } else if target == "student" {
+    (show-solution: false, show-proof: false, subtitle: [学生版讲义])
+  } else {
+    // Unknown target: conservative — show only required-public fields.
+    (show-solution: false, show-proof: false, subtitle: [讲义])
+  }
+}
+
+/// Render one part according to its `kind`. Unknown kinds render an inline
+/// note instead of crashing.
+#let _render-part(part, flags) = {
+  let kind = part.at("kind", default: none)
+  if kind == "segment" {
+    display-segment(part)
+  } else if kind == "example" {
+    display-example(part, show-solution: flags.show-solution)
+  } else if kind == "lemma" {
+    display-lemma(part, show-proof: flags.show-proof)
+  } else if kind == "sop" {
+    display-sop(part)
+  } else {
+    // Don't crash on an unrecognised kind; surface it visibly instead.
+    block(
+      width: 100%,
+      inset: 0.6em,
+      fill: red.lighten(85%),
+      stroke: red.darken(20%) + 0.6pt,
+      radius: 0.4em,
+      text(fill: red.darken(30%), weight: "bold")[
+        [未知部件类型 / unknown kind: #repr(kind)]
+      ],
+    )
+  }
+}
+
+/// THE ENTRY POINT — called by a template (`exports/*.typ`).
+///
+/// - `info`:   dict, e.g. (title: "…", author: "…"). `author` may be absent.
+///             Templates typically pass `manifest.at("info", default: (:))`.
+/// - `target`: string. MVP: "student" | "teacher". Unknown => conservative.
+///             Each template hardcodes its own target (student.typ => "student").
+/// - `parts`:  ordered array of part dicts, ALREADY ASSEMBLED by the template
+///             (content fields included, scalars read). See file header.
+/// - `heading-numbering`: array of per-level numbly pattern strings, e.g.
+///             `("{1:一}、", "{1:1}.{2:1}", "{1:1}.{2:1}.{3:1}")`. Presentation
+///             lives in the template (ADR-0011); the template passes its chosen
+///             scheme. Defaults to `default-heading-numbering` (the framework
+///             default) when the template omits it.
+#let render-lesson(
+  info: (:),
+  target: "student",
+  parts: (),
+  heading-numbering: default-heading-numbering,
+) = {
+  let title = info.at("title", default: [])
+  let author = info.at("author", default: none)
+
+  // `document` author wants a string/array; normalise the optional field.
+  set document(
+    title: title,
+    author: if author == none { () } else { author },
+  )
+
+  show: base-style.with(heading-numbering: heading-numbering)
+
+  // Reset shared counters so each rendered lesson numbers from 1.
+  example-counter.update(0)
+  lemma-counter.update(0)
+
+  let flags = _flags-for(target)
+
+  title-block()
+  subtitle-block(flags.subtitle)
+
+  // Render strictly in array order.
+  for part in parts {
+    _render-part(part, flags)
+  }
+}
diff --git a/render/src/elements/common.typ b/render/src/elements/common.typ
new file mode 100644
index 0000000..b15d16f
--- /dev/null
+++ b/render/src/elements/common.typ
@@ -0,0 +1,53 @@
+// Shared building blocks for element renderers: counters, tag lines, framed
+// boxes, divider lines. Zero external deps (no fontawesome/showybox) — tags use
+// plain bold text labels instead of icon glyphs.
+
+#import "../fonts.typ"
+#import "../style.typ": no-indent
+
+/// Counters for numbered elements. Shared across the package so numbering is
+/// continuous across the lesson regardless of which file renders a part.
+#let example-counter = counter("cph-example")
+#let lemma-counter = counter("cph-lemma")
+
+/// A bold label line introducing a section of an element body, e.g.
+/// "例题 1" or "解析". Starts flush-left (cancels paragraph indent).
+#let tag-line(label) = {
+  no-indent
+  set text(font: fonts.sans, weight: "bold")
+  label
+  h(1em / 3)
+}
+
+/// A faint horizontal divider between sections inside an element box.
+#let divider(color) = block(spacing: 1em, {
+  set align(center)
+  line(length: 100%, stroke: color.darken(20%) + 0.5pt)
+})
+
+/// A framed, tinted, breakable box wrapping an element's content.
+/// `hue` selects the accent color family (degrees on the oklch hue wheel).
+#let element-box(hue, body) = {
+  let theme = oklch(70%, 0.08, hue * 1deg)
+  block(
+    inset: (x: 1.5em, y: 1em),
+    breakable: true,
+    width: 100%,
+    fill: theme.lighten(70%).transparentize(50%),
+    stroke: theme.darken(60%) + 0.8pt,
+    radius: 0.5em,
+    {
+      set par(first-line-indent: 2em, spacing: 1em)
+      body
+      parbreak()
+    },
+  )
+}
+
+/// The accent hue per element kind (keeps the four kinds visually distinct).
+#let hue-of = (
+  example: 250,
+  lemma: 150,
+  segment: 90,
+  sop: 30,
+)
diff --git a/render/src/elements/example.typ b/render/src/elements/example.typ
new file mode 100644
index 0000000..12c8ea3
--- /dev/null
+++ b/render/src/elements/example.typ
@@ -0,0 +1,38 @@
+// example: a worked example / problem.
+//
+// Contract fields:
+//   content: `problem` (required), `solution` (required)
+//   scalar:  `source` (optional string)
+//
+// Numbered "例题 N" via the shared example-counter.
+//   student: show `problem`, HIDE `solution`.
+//   teacher: show both.
+// `source`, when present, is shown as a small annotation on the problem line.
+
+#import "../fonts.typ"
+#import "common.typ": element-box, tag-line, divider, example-counter, hue-of
+
+#let display-example(part, show-solution: true) = {
+  let theme = oklch(70%, 0.08, hue-of.example * 1deg)
+  example-counter.step()
+
+  element-box(hue-of.example, {
+    // Problem
+    tag-line(context [例题 #example-counter.display()])
+    let source = part.at("source", default: none)
+    if source != none and source != "" {
+      text(size: 0.85em, fill: gray.darken(30%))[（来源：#source）]
+      h(0.3em)
+    }
+    set text(font: fonts.accent)
+    part.problem
+
+    // Solution (teacher-only by default)
+    if show-solution {
+      divider(theme)
+      tag-line[解析]
+      set text(font: fonts.accent)
+      part.solution
+    }
+  })
+}
diff --git a/render/src/elements/lemma.typ b/render/src/elements/lemma.typ
new file mode 100644
index 0000000..f3765c6
--- /dev/null
+++ b/render/src/elements/lemma.typ
@@ -0,0 +1,34 @@
+// lemma: a stated result, optionally with a proof.
+//
+// Contract fields:
+//   content: `stmt` (required), `proof` (optional)
+//   scalar:  none
+//
+// Numbered "定理 N" via the shared lemma-counter.
+//   student: show `stmt`, HIDE `proof`.
+//   teacher: show both (when `proof` is present).
+// `proof` may be absent (key omitted) — handled gracefully.
+
+#import "../fonts.typ"
+#import "common.typ": element-box, tag-line, divider, lemma-counter, hue-of
+
+#let display-lemma(part, show-proof: true) = {
+  let theme = oklch(70%, 0.08, hue-of.lemma * 1deg)
+  lemma-counter.step()
+
+  element-box(hue-of.lemma, {
+    // Statement
+    tag-line(context [定理 #lemma-counter.display()])
+    set text(font: fonts.accent)
+    part.stmt
+
+    // Proof: only when requested AND actually provided.
+    let proof = part.at("proof", default: none)
+    if show-proof and proof != none {
+      divider(theme)
+      tag-line[证明]
+      set text(font: fonts.accent)
+      proof
+    }
+  })
+}
diff --git a/render/src/elements/segment.typ b/render/src/elements/segment.typ
new file mode 100644
index 0000000..57e8954
--- /dev/null
+++ b/render/src/elements/segment.typ
@@ -0,0 +1,16 @@
+// segment: a stretch of textbook prose.
+//
+// Contract fields:
+//   content: `textbook` (required)
+//   scalar:  none
+//
+// Rendered identically for all targets (textbook is always public). Not boxed
+// or numbered — it is the connective body text of the lesson.
+
+/// Render a segment part. `show-textbook` is always true in MVP but kept for
+/// symmetry with the other kinds' show/hide flags.
+#let display-segment(part, show-textbook: true) = {
+  if show-textbook {
+    part.textbook
+  }
+}
diff --git a/render/src/elements/sop.typ b/render/src/elements/sop.typ
new file mode 100644
index 0000000..73714eb
--- /dev/null
+++ b/render/src/elements/sop.typ
@@ -0,0 +1,19 @@
+// sop: a "standard operating procedure" — a methods/steps block.
+//
+// Contract fields:
+//   content: `sop` (required)
+//   scalar:  none
+//
+// Shown for all targets. Lightly boxed for visual separation; not numbered.
+
+#import "common.typ": element-box, tag-line, hue-of
+
+/// Render a sop part.
+#let display-sop(part, show-sop: true) = {
+  if show-sop {
+    element-box(hue-of.sop, {
+      tag-line[方法]
+      part.sop
+    })
+  }
+}
diff --git a/render/src/fonts.typ b/render/src/fonts.typ
new file mode 100644
index 0000000..b1607a7
--- /dev/null
+++ b/render/src/fonts.typ
@@ -0,0 +1,16 @@
+// Font families. The lesson text is Chinese + heavy math.
+//
+// We pass FONT FALLBACK LISTS rather than single names: typst tries each in
+// order and falls back to the next if a face is missing. This means we never
+// hard-fail when one specific CJK font is absent on the compile host — a key
+// MVP robustness requirement (CI may have a different font set).
+
+/// Serif body font (宋体). First broadly-shipped match wins; if none are
+/// present typst falls back to its own default — we never hard-fail.
+#let serif = ("Noto Serif CJK SC", "Source Han Serif SC", "Songti SC", "SimSun")
+
+/// Sans / heading font (黑体).
+#let sans = ("Noto Sans CJK SC", "Source Han Sans SC", "PingFang SC", "Heiti SC", "SimHei")
+
+/// Accent font used for problem/proof bodies (仿宋 feel).
+#let accent = ("FZFangSong-Z02S", "FangSong", "STFangsong", "Songti SC")
diff --git a/render/src/style.typ b/render/src/style.typ
new file mode 100644
index 0000000..b26313f
--- /dev/null
+++ b/render/src/style.typ
@@ -0,0 +1,103 @@
+// Base document styling: CJK fonts, headings, math, paragraph layout, page.
+//
+// Heading numbering is PER-LEVEL and built from a numbly pattern array passed
+// in by the caller (lib.typ resolves it from config + framework default). This
+// fixes the old single-pattern bug where one `numbering: "一、"` was reused for
+// every level (a level-2 heading rendered as `二、一、…`). The only @preview
+// dependency is `@preview/numbly`, vendored under `render/vendor/...` for
+// network-free CI; see render/typst.toml's note.
+
+#import "@preview/numbly:0.1.0": numbly
+#import "fonts.typ"
+
+/// Framework-default per-level heading numbering patterns (numbly syntax).
+/// Level 1 -> `一、`, level 2 -> `1.1`, level 3 -> `1.1.1`. This is the
+/// correct-by-default scheme; `config.numbering.heading` overrides it.
+#let default-heading-numbering = (
+  "{1:一}、",
+  "{1:1}.{2:1}",
+  "{1:1}.{2:1}.{3:1}",
+)
+
+/// Apply the base style to a document body. Used as `show: base-style(..)`.
+///
+/// `heading-numbering` is an array of per-level numbly pattern strings; it is
+/// spread into `numbly(..)` to build the per-level heading numbering function.
+#let base-style(heading-numbering: default-heading-numbering, doc) = {
+  // Language / region drive CJK line-breaking and punctuation.
+  set text(lang: "zh", region: "cn", size: 12pt, font: fonts.serif)
+  set text(cjk-latin-spacing: auto)
+
+  // Per-level heading numbering via numbly: each level gets its own pattern,
+  // so level 2 renders `1.1`, not the old buggy `二、一、`.
+  set heading(numbering: numbly(..heading-numbering))
+  show heading: set text(font: fonts.sans)
+
+  // Number display equations.
+  set math.equation(numbering: "(1)")
+
+  set par(
+    first-line-indent: (amount: 2em, all: true),
+    leading: 0.8em,
+    spacing: 1.5em,
+    justify: true,
+  )
+
+  set page(
+    margin: (x: 2.2cm, y: 2.4cm),
+    footer: context align(center)[
+      #counter(page).get().at(0) / #counter(page).final().at(0)
+    ],
+  )
+
+  set table(inset: 5pt, stroke: 0.75pt)
+
+  // Inline quotes -> subtle highlight (matches prototype feel).
+  show quote.where(block: false): it => highlight(
+    it.body,
+    fill: gray.transparentize(60%),
+    top-edge: 1em,
+    bottom-edge: -0.2em,
+    extent: 0.35em,
+    radius: 0.25em,
+  )
+
+  show link: set text(fill: eastern)
+  show link: underline
+
+  doc
+}
+
+/// Cancel the active paragraph first-line indent (for tag lines that should
+/// start flush-left). Defensive against both `length` and `dict` indent forms.
+#let no-indent = context {
+  let fli = par.first-line-indent
+  if type(fli) == length {
+    h(-fli)
+  } else {
+    h(-fli.amount)
+  }
+}
+
+/// Document title block.
+#let title-block() = {
+  set align(center)
+  set text(font: fonts.sans, size: 22pt, weight: "bold")
+  context document.title
+}
+
+/// Subtitle + authors block under the title.
+#let subtitle-block(subtitle) = {
+  set align(center)
+  set text(size: 14pt)
+  v(1.2em, weak: true)
+  subtitle
+  context {
+    let authors = document.author
+    if authors != () {
+      v(0.8em, weak: true)
+      authors.join(h(1.5em))
+    }
+  }
+  v(1.2em, weak: true)
+}
diff --git a/render/templates/README.md b/render/templates/README.md
new file mode 100644
index 0000000..c4cbd59
--- /dev/null
+++ b/render/templates/README.md
@@ -0,0 +1,63 @@
+# Default export templates (ADR-0011)
+
+`student.typ` / `teacher.typ` are the **framework default templates**. In a real
+engineering file they live at `exports/student.typ` / `exports/teacher.typ`; the
+project-creation flow seeds copies there (out of scope here — see ADR-0011 Open
+Questions). They are kept here as the canonical, copyable defaults and for the
+offline smoke test below.
+
+Each template:
+
+1. reads the injected manifest: `toml(sys.inputs.manifest)`;
+2. loops `manifest.parts`, `include`-ing each content field via a computed
+   **root-relative absolute** path `/<part.path>/<field>.typ`, and reading scalar
+   fields (example `source`) from `/<part.path>/element.toml`;
+3. assembles a `parts` array and calls `cph-render`'s `render-lesson(...)`,
+   passing the per-level heading numbering (presentation lives in the template).
+
+## Why the include loop is in the template, not in cph-render
+
+typst resolves a dynamic `include`/`toml` path relative to **the file the call
+lexically appears in**, and a package (`@local/cph-render`) has its **own virtual
+root**. A dynamic `include` written inside the package resolves against the
+*package* dir — even an absolute `/segments/x.typ` — never the engineering
+`--root`. Verified empirically. The template lives under `--root`, so its
+`/<part.path>/<field>.typ` resolves against `--root`. Hence the template loads
+content and hands `render-lesson` an already-assembled `parts` array;
+`render-lesson` never includes anything.
+
+## Key path facts for the engine
+
+- **Template is the typst main file.** Compile it directly.
+- **`--root` = engineering-file root.** Content `include`s use absolute
+  root-relative paths.
+- **Manifest is injected as a root-relative ABSOLUTE path**:
+  `--input manifest=/manifest.toml`. `toml(sys.inputs.manifest)` resolves
+  relative to the *template's* location (`exports/`), so a bare
+  `manifest=manifest.toml` would look in `exports/`. Pass the leading `/`.
+- **Optional content presence** (lemma `proof`): typst has no file-exists
+  primitive, so the template cannot probe disk. It reads a per-part `fields`
+  array from the manifest listing the content fields present on disk. *(OPEN: the
+  exact manifest shape for this is for the Rust/manifest contract to pin.)*
+
+## Offline smoke test
+
+`@local/cph-render` is resolved from a local-packages dir (a symlink to the
+render package root — regenerable, test-only):
+
+```sh
+cd render
+# one-time: make @local/cph-render resolvable offline
+mkdir -p vendor/local-packages/local/cph-render
+ln -sfn "$(pwd)" vendor/local-packages/local/cph-render/0.1.0
+
+# compile a template against the smoke engineering file
+typst compile --root examples/smoke-eng \
+  --package-path ./vendor/local-packages \
+  --package-cache-path ./vendor/typst-packages \
+  --input manifest=/manifest.toml \
+  examples/smoke-eng/exports/student.typ /tmp/cph-tmpl-student.pdf
+```
+
+(`examples/smoke-eng/exports/{student,teacher}.typ` are copies of the defaults
+here, mirroring how a real engineering file carries its own templates.)
diff --git a/render/templates/student.typ b/render/templates/student.typ
new file mode 100644
index 0000000..a33d25d
--- /dev/null
+++ b/render/templates/student.typ
@@ -0,0 +1,79 @@
+// DEFAULT STUDENT TEMPLATE (framework default; ADR-0011).
+//
+// This is a *real, editable* file that lives in an engineering file at
+// `exports/student.typ`. The framework compiles it AS THE MAIN FILE with the
+// manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/student.typ <out>
+//
+// It is intentionally self-contained (no shared helper import) so it can be
+// copied verbatim into a new engineering file's `exports/`. Presentation —
+// heading numbering — lives HERE (editable per engineering file), not in the
+// manifest and not hardcoded in the cph-render package.
+//
+// WHY THE INCLUDE LOOP IS HERE AND NOT IN cph-render: typst resolves a dynamic
+// `include` path relative to the file it lexically appears in, and a package has
+// its own virtual root — an include inside cph-render would resolve against the
+// PACKAGE, not the engineering root. A `/<part.path>/<field>.typ` written HERE
+// (this template lives under `--root`) resolves against `--root`. So the
+// template loads content and hands cph-render an already-assembled `parts` array.
+//
+// OPEN CONTRACT POINT — optional-content presence. typst has no "does this file
+// exist" primitive (a missing `include` is a hard compile error). So the
+// template CANNOT probe disk the way the old Rust driver did for lemma `proof`.
+// It relies on the manifest declaring which optional content fields are present,
+// via a per-part `fields` array listing the content fields that exist on disk
+// (the engine knows this — it walks the part dir). Required fields are loaded
+// unconditionally; optional fields load only if listed in `fields`. If a part
+// omits `fields`, optional content is skipped (conservative). The exact shape of
+// this declaration is for the manifest/Rust contract to pin.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the student build, so the target is fixed.
+#let target = "student"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/render/templates/teacher.typ b/render/templates/teacher.typ
new file mode 100644
index 0000000..b976b1f
--- /dev/null
+++ b/render/templates/teacher.typ
@@ -0,0 +1,62 @@
+// DEFAULT TEACHER TEMPLATE (framework default; ADR-0011).
+//
+// Lives in an engineering file at `exports/teacher.typ`. Compiled AS MAIN with
+// the manifest injected:
+//   typst compile --root <eng-root> --input manifest=<path-rel-to-root> exports/teacher.typ <out>
+//
+// Self-contained (copyable into an engineering file). Identical to student.typ
+// except the fixed target is "teacher" (so the (kind x target) render matrix in
+// cph-render shows solutions and proofs). See student.typ for the full notes on
+// why the include loop lives here (package virtual-root resolution) and on the
+// OPEN optional-content (`fields`) contract point.
+
+#import "@local/cph-render:0.1.0": render-lesson, part-fields, default-heading-numbering
+
+// This template IS the teacher build, so the target is fixed.
+#let target = "teacher"
+
+// Read the injected manifest (a path string relative to typst --root).
+#let manifest = toml(sys.inputs.manifest)
+#let info = manifest.at("info", default: (:))
+#let raw-parts = manifest.at("parts", default: ())
+
+// Assemble each part: include its content fields (computed absolute paths,
+// resolved against --root) and read scalar fields from <path>/element.toml.
+// `part-fields` (from cph-render) is the single source of truth for kind->fields.
+#let parts = raw-parts.map(raw => {
+  let kind = raw.at("kind", default: none)
+  let path = raw.at("path", default: none)
+  let spec = part-fields.at(kind, default: (content: (), optional-content: (), scalars: ()))
+  // Which optional content fields are present on disk (manifest-declared).
+  let present = raw.at("fields", default: ())
+  let part = (kind: kind)
+
+  // Required content fields: <path>/<field>.typ (absolute, root-relative).
+  for field in spec.content {
+    part.insert(field, include "/" + path + "/" + field + ".typ")
+  }
+  // Optional content fields: only when the manifest says the file exists.
+  for field in spec.optional-content {
+    if field in present {
+      part.insert(field, include "/" + path + "/" + field + ".typ")
+    }
+  }
+  // Scalar fields come from <path>/element.toml.
+  if spec.scalars.len() > 0 {
+    let element = toml("/" + path + "/element.toml")
+    for field in spec.scalars {
+      let v = element.at(field, default: none)
+      if v != none and v != "" { part.insert(field, v) }
+    }
+  }
+  part
+})
+
+// Presentation: per-level heading numbering. Default (一、 / 1.1 / 1.1.1) comes
+// from cph-render; override here per engineering file if desired.
+#render-lesson(
+  info: info,
+  target: target,
+  parts: parts,
+  heading-numbering: default-heading-numbering,
+)
diff --git a/render/typst.toml b/render/typst.toml
new file mode 100644
index 0000000..07429f9
--- /dev/null
+++ b/render/typst.toml
@@ -0,0 +1,18 @@
+[package]
+name = "cph-render"
+version = "0.1.0"
+entrypoint = "lib.typ"
+compiler = "0.15.0"
+authors = ["curriculum-project-hub"]
+license = "MIT"
+description = "Curriculum lesson render package: `render-lesson` entry over an ordered list of typed parts (segment/example/lemma/sop), called by export templates (ADR-0011), targeting student/teacher handouts."
+
+# External @preview dependencies (resolved via the typst package registry):
+#   @preview/numbly:0.1.0  — per-level heading numbering (src/style.typ).
+# numbly is dependency-free (pure typst). For network-free CI the package is
+# VENDORED in-repo at:
+#   render/vendor/typst-packages/preview/numbly/0.1.0/
+# mirroring the typst preview-cache layout
+# ({cache}/typst/packages/preview/numbly/0.1.0/). Point typst's package cache /
+# resolver at render/vendor/typst-packages (e.g. TYPST_PACKAGE_CACHE_PATH or the
+# embedded World's preview dir) so `@preview/numbly:0.1.0` resolves offline.
diff --git a/render/vendor/typst-packages/preview/numbly/0.1.0/LICENSE b/render/vendor/typst-packages/preview/numbly/0.1.0/LICENSE
new file mode 100644
index 0000000..9162d3e
--- /dev/null
+++ b/render/vendor/typst-packages/preview/numbly/0.1.0/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 梦飞翔
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/render/vendor/typst-packages/preview/numbly/0.1.0/README.md b/render/vendor/typst-packages/preview/numbly/0.1.0/README.md
new file mode 100644
index 0000000..c8547fe
--- /dev/null
+++ b/render/vendor/typst-packages/preview/numbly/0.1.0/README.md
@@ -0,0 +1,43 @@
+# numbly
+
+A package that helps you to specify different numbering formats for different levels of headings.
+
+Suppose you want to specify the following numbering format for your document:
+
+- Appendix A. Guide
+  - A.1. Installation
+    - Step 1. Download
+    - Step 2. Install
+  - A.2. Usage
+
+You might use `if` to achieve this:
+
+```typst
+#set heading(numbering: (..nums) => {
+  nums = nums.pos()
+  if nums.len() == 1 {
+    return "Appendix " + numbering("A.", ..nums)
+  } else if nums.len() == 2 {
+    return numbering("A.1.", ..nums)
+  } else {
+    return "Step " + numbering("1.", nums.last())
+  }
+})
+
+= Guide
+== Installation
+=== Download
+=== Install
+== Usage
+```
+
+But with `numbly`, you can do this more easily:
+
+```typst
+#import "@preview/numbly:0.1.0": numbly
+#set heading(numbering: numbly(
+  "Appendix {1:A}.", // use {level:format} to specify the format
+  "{1:A}.{2}.", // if format is not specified, arabic numbers will be used
+  "Step {3}.", // here, we only want the 3rd level
+))
+```
diff --git a/render/vendor/typst-packages/preview/numbly/0.1.0/lib.typ b/render/vendor/typst-packages/preview/numbly/0.1.0/lib.typ
new file mode 100644
index 0000000..baac794
--- /dev/null
+++ b/render/vendor/typst-packages/preview/numbly/0.1.0/lib.typ
@@ -0,0 +1,31 @@
+#let numbly(..arr, default: "1.") = (..nums) => {
+  let arr = arr.pos()
+  nums = nums.pos()
+  if nums.len() > arr.len() {
+    if default == none {
+      return none
+    }
+    if type(default) == function {
+      return default(..nums)
+    }
+    return numbering(default, ..nums)
+  }
+  let format = arr.at(nums.len() - 1)
+  if format == none {
+    return none
+  }
+  if type(format) == function {
+    return format(..nums)
+  }
+  format.replace(
+    regex("\{(\d)(:(.+?))?\}"),
+    m => {
+      let (a, b, c) = m.captures
+      if b != none {
+        numbering(c, nums.at(int(a) - 1))
+      } else {
+        str(nums.at(int(a) - 1))
+      }
+    },
+  )
+}
diff --git a/render/vendor/typst-packages/preview/numbly/0.1.0/typst.toml b/render/vendor/typst-packages/preview/numbly/0.1.0/typst.toml
new file mode 100644
index 0000000..9ecc5e7
--- /dev/null
+++ b/render/vendor/typst-packages/preview/numbly/0.1.0/typst.toml
@@ -0,0 +1,10 @@
+[package]
+name = "numbly"
+version = "0.1.0"
+entrypoint = "lib.typ"
+authors = ["flaribbit <@flaribbit>"]
+license = "MIT"
+description = "A package that helps you to specify different numbering formats for different levels of headings."
+categories = ["utility"]
+keywords = ["numbering", "helper", "tool"]
+repository = "https://github.com/flaribbit/numbly"
\ No newline at end of file
diff --git a/spec/.gitignore b/spec/.gitignore
new file mode 100644
index 0000000..bfb30ec
--- /dev/null
+++ b/spec/.gitignore
@@ -0,0 +1 @@
+/.lake
diff --git a/spec/README.md b/spec/README.md
new file mode 100644
index 0000000..851b345
--- /dev/null
+++ b/spec/README.md
@@ -0,0 +1,55 @@
+# spec —— Lean 语义母本
+
+这是本 monorepo 的**契约**:产品各部件语义的上游参照,用 Lean 编写。它的定位与约束见仓库根 `README.md` 的"宪法"5 条——本文件只讲**怎么往这份契约里写东西**。
+
+## 现状
+
+刚初始化的 Lean 工程(`lake init`),目前只有占位内容(`Spec/Basic.lean`)。实质领域内容(System 平台层、Courseware 产品层)将逐个概念加入,每个都遵循下面的规范。
+
+## 构建
+
+```sh
+cd spec
+lake build
+```
+
+工具链锁定在 `lean-toolchain`(`leanprover/lean4:v4.31.0`)。无外部依赖——Mathlib / Batteries 等留待第一个真正需要它的定理出现时再引入(依赖碰到再加)。
+
+## 写作规范
+
+### 双半契约:prose + type
+
+每个 top-level 声明**必须**带 `/-- … -/` doc 注释,用自然语言陈述其语义意图。两半缺一不可:
+
+- **prose 半**给人读——说清"这在领域里是什么、为什么"。
+- **type 半**给机器读、给 type checker 把关——保证结构无洞。
+
+agent 不得用预训练先验脑补本领域(领域很新,无先验);prose 是 agent 理解语义的唯一权威来源。
+
+### 标签分类法
+
+在 doc 注释里用以下标签标注每条语义的状态:
+
+- **`PINNED`** —— 已解决的分歧点,契约在此处权威,双方据此对齐。
+- **`OPEN`** —— 故意未规定。双方均**不得假设**其解;实现遇到时必须 surface 出来讨论,而不是擅自决定。
+- **`ADR-NNNN`** —— 链接到根 `docs/adr/` 下的对应决策记录(如 `ADR-0002`),交代该语义的决策出处。
+
+### 分歧点测试(写之前先过一遍)
+
+新增任何概念前,先问:**"不写明,开发者与 agent 会不会各自做出不同假设?"**
+
+- 会 → 它是分歧点,入契约。
+- 不会(显然的东西 / 纯 plumbing / 普通 CRUD 字段)→ 不入。
+
+详见根 README 宪法第 5 条。
+
+### 不用 `sorry`
+
+无法陈述清楚的东西,用 `OPEN` 在 prose 里标注,而**不是**用 `sorry` 留一个假装成立的定理。`sorry` 会让 `lake build` 仍然变绿,却在契约里埋一个谎——这与"契约自包含、无洞"直接冲突。
+
+### 命名
+
+- **模块 / 命名空间**:PascalCase,对应分层,如 `Spec.System.Run`、`Spec.Courseware.Validity`。
+- **类型**:PascalCase。
+- **谓词 / `Prop`**:用意图清晰的命名,如 `Legal…`、`ValidTransition`、`Can…`。
+- **文件粒度**:原则上"一个带独立不变式的概念一个文件"。
diff --git a/spec/Spec.lean b/spec/Spec.lean
new file mode 100644
index 0000000..46dd4a3
--- /dev/null
+++ b/spec/Spec.lean
@@ -0,0 +1,5 @@
+-- This module serves as the root of the `Spec` library.
+-- Import modules here that should be built as part of the library.
+import Spec.Prelude
+import Spec.System
+import Spec.Courseware
diff --git a/spec/Spec/Courseware.lean b/spec/Spec/Courseware.lean
new file mode 100644
index 0000000..253a5b9
--- /dev/null
+++ b/spec/Spec/Courseware.lean
@@ -0,0 +1,21 @@
+import Spec.Courseware.Model
+import Spec.Courseware.Export
+import Spec.Courseware.Check
+import Spec.Courseware.Open
+
+/-!
+# Courseware —— 产品层契约(课程工程文件)
+
+护城河:课程"工程文件"的语义母本与合法性规则。决策出处 ADR-0005..0015。按四组组织:
+
+- **`Model`** —— 工程文件的内容模型:基元 `Primitives`、富内容 `RichContent`、原子
+  单位 `Element`、单节课 `Lesson`(element 的有序序列)。
+- **`Export`** —— export target = artifact + 有序 typed steps:产物 ADT `Artifact`
+  (`singleFile` / `fileTree`),build 规格 `TargetSpec`(artifact + steps + 覆盖声明
+  `covers`)与 `RenderConfig`。
+- **`Check`** —— checker 语义:`Severity` + 6 类诊断 + **合法 lesson = 无 error 级
+  诊断**(模型外设施诊断以抽象谓词 + `Oracle` 表示);检查管线的 5 阶段、序、compile
+  门控。
+- **`Open`** —— 留白骨架(核心关系 OPEN,已 surface 不臆造):题库 `QuestionBank`、
+  课程编排 `Course`。
+-/
diff --git a/spec/Spec/Courseware/Check.lean b/spec/Spec/Courseware/Check.lean
new file mode 100644
index 0000000..b326f16
--- /dev/null
+++ b/spec/Spec/Courseware/Check.lean
@@ -0,0 +1,9 @@
+import Spec.Courseware.Check.Diagnostic
+import Spec.Courseware.Check.Pipeline
+
+/-!
+# Courseware.Check —— checker 语义
+
+诊断分类与合法 lesson(`Diagnostic`)、检查管线的阶段与序(`Pipeline`)。决策出处
+ADR-0010。
+-/
diff --git a/spec/Spec/Courseware/Check/Diagnostic.lean b/spec/Spec/Courseware/Check/Diagnostic.lean
new file mode 100644
index 0000000..eab8b25
--- /dev/null
+++ b/spec/Spec/Courseware/Check/Diagnostic.lean
@@ -0,0 +1,100 @@
+import Spec.Courseware.Model.Lesson
+import Spec.Courseware.Export.Render
+
+/-!
+# Diagnostic —— checker 诊断:分类、严重级别、合法 lesson
+
+产品里"站在 Lean 位置"的 rule-based checker,语义在此沉淀(ADR-0010,经 ADR-0012
+修订)。它对 lesson 提诊断,每条有**分类**(`DiagKind`)与**严重级别**(`Severity`)。
+本模块:钉级别类型(二分);钉 6 类诊断各自的含义与级别,并把"**合法 lesson = 无
+error 级诊断**"建成判定(ADR-0005 deferred 的"完整合法判定"的回填);对**模型外设施**
+型诊断(typst 编过否、数据合 schema 否)用**抽象谓词 + `Oracle` 实现边界**表示——契约
+说"存在这条诊断、什么意思、什么级别",真值由实现提供,不在 Lean 内计算(不内嵌 typst
+编译器)。引用解析(`@ref`、相对 import)不另设诊断:它们都是 typst 编译期失败,归
+`typstCompile`(ADR-0012)。
+-/
+
+namespace Spec.Courseware
+
+/-- 诊断严重级别(`PINNED` 二分, ADR-0005)。`error` 阻断(产物不合法),`warning` 不
+阻断(产物仍可导出,只是有损)。更细级别(info/hint)未决策,故只二分。 -/
+inductive Severity where
+  | warning
+  | error
+
+/-- 诊断**分类**(`PINNED` 6 类, ADR-0010,经 ADR-0012 修订为 6 类)。按"谁来判定"分
+三层:**结构型**(模型自身可判):`partPathMissing`/`unknownKind`;**schema/外部设施型**
+(靠实现 oracle):`missingContentFile`/`schemaViolation`/`typstCompile`;**语义型**:
+`renderIgnored`。 -/
+inductive DiagKind where
+  /-- manifest 的 part 指向不存在的文件夹(或经 `..` 逃出根)。结构型。 -/
+  | partPathMissing
+  /-- part 声明了未知 kind(含 part 与 element.toml 的 kind 不一致)。结构型。 -/
+  | unknownKind
+  /-- kind schema 要求的某 `content` 字段缺对应 `<field>.typ`。结构/schema 型。 -/
+  | missingContentFile
+  /-- 实例数据不合其 kind 的 JSON Schema;亦作 manifest/element.toml 畸形的兜底。 -/
+  | schemaViolation
+  /-- 拼装出的 typst 源编译失败:语法错、未解析的交叉引用 `@ref`、越界或缺失的相对
+      `import`/`include`(后两者即旧 `danglingReference` 的两种情形——typst 在编译期
+      检出,故归此类,ADR-0012)。外部设施型。 -/
+  | typstCompile
+  /-- 某被用到的 kind 在某声明的 target 下无渲染规则,该 element 被忽略。语义型。 -/
+  | renderIgnored
+
+/-- 每类诊断的**严重级别**(`PINNED`, ADR-0010)。五类 `error`(阻断);**唯
+`renderIgnored` 为 `warning`**——ADR-0005 种子规则"缺渲染 ⇒ warning,不阻断导出"。
+钉成全函数使"哪类阻断"成为可引用、可对齐的事实(实现侧 `DiagCode` 级别据此对齐)。 -/
+def DiagKind.severity : DiagKind → Severity
+  | .partPathMissing   => .error
+  | .unknownKind       => .error
+  | .missingContentFile => .error
+  | .schemaViolation   => .error
+  | .typstCompile      => .error
+  | .renderIgnored     => .warning
+
+/-- 缺渲染诊断的级别 = **warning**(`PINNED`, ADR-0005/0010,**非 error**)。具名常量,
+使"它是 warning"可被实现侧 grep 对齐(实现里同名常量 `RENDER_IGNORED_SEVERITY` 引用
+本定义)。等价于 `DiagKind.renderIgnored.severity`。 -/
+def renderIgnoredSeverity : Severity := DiagKind.renderIgnored.severity
+
+variable (P : Primitives)
+
+/-- **缺渲染诊断**:lesson 在 target `t` 下存在无法渲染的 element(`PINNED`,
+ADR-0005/0009)。成立 ⟺ 存在某 element,其 kind 在 `t` 下 `covers` 为假。语义型诊断,
+级别 warning。 -/
+def renderIgnored (l : Lesson P) (c : RenderConfig P) (t : P.TargetId) : Prop :=
+  ∃ e ∈ l, ¬ c.covers e.kind t
+
+/-!
+## 模型外设施型诊断:抽象谓词 + 实现边界(ADR-0010)
+
+`typstCompile`/`schemaViolation`(的 schema-合规面)断言的是模型自身无法判定的事实——
+要跑 typst 编译器、schema 校验器。契约把它们建成**抽象谓词**,真值由实现提供的 oracle
+给出。下面用 `Oracle` 收口这些判定:它不是要在 Lean 里实现 checker,而是把"这些事实
+来自模型外"显式化、类型化。
+-/
+
+/-- **实现侧判定 oracle**(`PINNED` 实现边界, ADR-0010)。每个字段是一个谓词,真值由
+实现(checker)提供。结构型诊断(part 路径、未知 kind)不入此 oracle——那些模型自身可判。 -/
+structure Oracle (l : Lesson P) (c : RenderConfig P) where
+  /-- target `t` 下拼装源可编译(否 ⇒ `typstCompile`)。**含引用解析**:源能编译即蕴含
+      其 `@ref`、相对 import 全部解析(ADR-0012 已把引用诊断并入 `typstCompile`)。 -/
+  compiles : P.TargetId → Prop
+  /-- 每个 element 数据合 schema(否 ⇒ `schemaViolation`)。 -/
+  dataConforms : Prop
+  /-- schema 要求的 content 文件齐备(否 ⇒ `missingContentFile`)。 -/
+  contentFilesPresent : Prop
+
+/-- **合法 lesson**(`PINNED`, ADR-0010;回填 ADR-0005 deferred 的"完整合法判定")。
+
+合法 ⟺ 检查管线产出**零条 error 级诊断**。展开为:模型外设施判定(经 `Oracle`)全为真,
+**且**每个声明的 target 都编译通过。结构型诊断由 `cph-model` 在加载期判定;能走到这步
+谈合法性意味着已加载成功,故此处聚焦 schema/外部设施层。引用解析不单列——已被
+`compiles` 蕴含(ADR-0012)。`renderIgnored` 是 warning,**不**进合取——ADR-0005 种子
+规则的体现。`targets` 用全称式表达以不绑定 `TargetId` 的可枚举性。 -/
+def Legal (l : Lesson P) (c : RenderConfig P) (o : Oracle P l c) : Prop :=
+  o.dataConforms ∧ o.contentFilesPresent ∧
+    (∀ t : P.TargetId, (c.spec t).isSome → o.compiles t)
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Check/Pipeline.lean b/spec/Spec/Courseware/Check/Pipeline.lean
new file mode 100644
index 0000000..00efa01
--- /dev/null
+++ b/spec/Spec/Courseware/Check/Pipeline.lean
@@ -0,0 +1,52 @@
+import Spec.Courseware.Check.Diagnostic
+
+/-!
+# Pipeline —— checker 检查管线的阶段与序(ADR-0010)
+
+checker 的 `check` 按**固定顺序**跑五个阶段,逐阶段收集诊断;`compile` 阶段有**门控**。
+顺序与门控是契约——它决定用户看到哪些诊断(藏在缺文件背后的语法错,在文件补齐前不
+显示,这是有意的)。每阶段的**算法**不进 Lean(宪法第 5 条深度上限):只钉**阶段、序、
+门控**。阶段对应上游模块:`load`←`cph-model`;`structural`←part 路径/未知 kind;
+`schema`←`cph-schema`;`compile`←`cph-typst`(模型外设施);`coverage`←`renderIgnored`。
+-/
+
+namespace Spec.Courseware
+
+/-- 检查管线的**阶段**(`PINNED` 5 阶段, ADR-0010)。
+
+- `load` —— 解析 manifest + 各 element.toml。硬失败则**停**整条管线。
+- `structural` —— part 路径存在、无 `..`、kind 已知且一致。此处判缺的 part 后续跳过。
+- `schema` —— 每个"存在且 kind 已知"的 part 按其 kind schema 校验。
+- `compile` —— 模型外设施阶段(typst 编译)。**门控:仅当前序零 error 才跑**。
+- `coverage` —— 语义型 warning(`renderIgnored`);**不**受门控,总跑。 -/
+inductive Phase where
+  | load
+  | structural
+  | schema
+  | compile
+  | coverage
+deriving DecidableEq
+
+/-- 管线阶段的**执行序**(`PINNED`, ADR-0010)。`order p` 越小越先跑。序是契约:
+`compile`(3)排在 `structural`(1)/`schema`(2)之后,正因前者门控于后者无 error。 -/
+def Phase.order : Phase → Nat
+  | .load       => 0
+  | .structural => 1
+  | .schema     => 2
+  | .compile    => 3
+  | .coverage   => 4
+
+/-- 某阶段是否**受"前序零 error"门控**(`PINNED`, ADR-0010)。唯 `compile` 受门控:藏在
+结构/schema 错背后的编译错,在前者修好前不显示——有意降噪。 -/
+def Phase.gated : Phase → Bool
+  | .compile => true
+  | _        => false
+
+/-- 管线在 `load` 硬失败时**停**(`PINNED`, ADR-0010)。`load` 拿不到可解析 lesson 时,
+无 lesson 可喂下游,整条管线终止——唯一会截断后续所有阶段的情形(区别于 `compile`
+门控只跳过自己)。 -/
+def Phase.haltsPipelineOnFailure : Phase → Bool
+  | .load => true
+  | _     => false
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Export.lean b/spec/Spec/Courseware/Export.lean
new file mode 100644
index 0000000..7788bd6
--- /dev/null
+++ b/spec/Spec/Courseware/Export.lean
@@ -0,0 +1,8 @@
+import Spec.Courseware.Export.Artifact
+import Spec.Courseware.Export.Render
+
+/-!
+# Courseware.Export —— export target = artifact + 有序 typed steps
+
+产物 ADT(`Artifact`)、build 规格与渲染覆盖(`Render`)。决策出处 ADR-0009 / 0011。
+-/
diff --git a/spec/Spec/Courseware/Export/Artifact.lean b/spec/Spec/Courseware/Export/Artifact.lean
new file mode 100644
index 0000000..4e202a6
--- /dev/null
+++ b/spec/Spec/Courseware/Export/Artifact.lean
@@ -0,0 +1,23 @@
+/-!
+# Artifact —— export target 的产物(ADR-0009 / 0011)
+
+ADR-0009:一个 export target 是**一次 build**,产出一个**有类型的产物**。ADR-0011
+钉死:产物是**带字段的 ADT**——"产物到底指什么"(单文件落在哪 / 一棵树产出哪些文件)
+是不好猜的领域语义,必须写进字段 + doc,而非抹成两个空构造子。路径/glob 用 `String`
+承载并由 doc 赋义(它们就是文本),不复刻文件系统类型。
+-/
+
+namespace Spec.Courseware
+
+/-- export 产物(`PINNED` 带字段 ADT, ADR-0011)。产物形状决定 `cph build` 吐文件还是
+目录、reduce 怎么折叠(`singleFile` 把有序片段拼成一份再编译——交叉引用 `@ref`、例题
+计数器能工作的前提;`fileTree` 每 part 落一文件)。后端/格式仍 OPEN(ADR-0009)。 -/
+inductive Artifact where
+  /-- 单文件产物,落在 `filepath`(相对工程根)。讲义/教案 PDF 即此。 -/
+  | singleFile (filepath : String)
+  /-- 多文件产物:`root` 目录下匹配 `outputs` **glob** 的文件集(第三方平台 archive
+      即此)。用 glob 而非显式清单:轻,又让消费方/checker 知道该产出哪些文件、可校验
+      完整性。 -/
+  | fileTree (root : String) (outputs : String)
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Export/Render.lean b/spec/Spec/Courseware/Export/Render.lean
new file mode 100644
index 0000000..ed71d5c
--- /dev/null
+++ b/spec/Spec/Courseware/Export/Render.lean
@@ -0,0 +1,93 @@
+import Spec.Courseware.Model.Primitives
+import Spec.Courseware.Export.Artifact
+
+/-!
+# Render —— export target = artifact + 有序 typed steps(ADR-0009 / 0011)
+
+ADR-0009:export target 是一次 build,产出一个有类型的 `Artifact`。ADR-0011 钉死 build
+的**形状**:一个 target 是 `artifact` + 一串**有序 typed step**。
+
+- `typstCompile template` —— 把**模板文件**(如 `exports/student.typ`)编译成产物。它是
+  *typed* 而非裸 shell,正因框架要把 **manifest 注入**模板(经 `--input manifest=…`),
+  裸字符串表达不了这个 wiring。presentation(编号、样式)住模板里,不在 manifest。
+- `shell run` —— 逃生口,给难以声明的步骤(ADR-0005 的 (b) 类 medium-only)。
+- `assembleMarkdown field` —— 按 parts 顺序把每个 element 的 `field`(markdown content 叶子,
+  ADR-0015)拼成**单文件 markdown** 产物。typed 而非 `cat`,因为按 manifest `[[parts]]` 顺序读取 +
+  跳过缺失项 + 写到单文件产物路径这件事,框架 own 比裸 shell 稳。
+
+**渲染覆盖**:ADR-0011 废止了 per-target `RenderRule` 载荷——渲染的"how"已移进模板。
+契约只保留覆盖声明 `covers`(该 target 渲染哪些 kind),供种子诊断用。
+
+**shell step 的执行语义(ADR-0013)。** `shell` 不再只是占位:它**会被执行**,语义是把
+`run` 交给平台 shell、以**工程根为工作目录**运行,产物由被调外部工具自己写出(框架不装配
+内容)。三条边界是真分歧点,故钉契约:
+1. **opt-in by construction** —— 任意命令执行只在用户**显式** build 一个 shell target 时发生,
+   绝不在 `check` 里跑。`check` 只校验结构(lesson 是否合法),不执行外部工具、不验其产物。
+2. **失败归属** —— shell step 退出非零是一次 **build-过程失败**,不是 lesson 的合法性缺陷;
+   因此它**不**进 `Diagnostic` 的 6 类(那 6 类是 lesson 自身的诊断,见 `Check/Diagnostic.lean`),
+   而由 build 执行层报告。诊断分类保持 6 类不变(ADR-0013 显式拒绝新增 `ShellStep` 诊断码)。
+3. **非-typst target 不过 typst 编译** —— 一个只含 `shell` step 的 target(教具包即此)由
+   执行器跑命令,而非走 typst 引擎;`check` 的 compile 阶段跳过它。
+
+**assembleMarkdown step 的执行语义(ADR-0015)。** 与 `shell` 同属"非-typst target":框架 own
+读取每个 element 的 `<field>.md`、按 `[[parts]]` 顺序拼接、写到单文件产物路径(产物是 markdown,
+不经 typst 引擎)。同 shell 的三条边界:① 只在显式 `build --target` 跑,`check` 不跑;② 装配失败
+(如写盘失败、引用图缺失)是 build-过程错误,不入 6 类诊断;③ 非-typst target,`check` 的 compile
+阶段跳过它。**单文件产物**(现):装配器注入课程级标题为文档 h1(课程元数据,非 element 内容),
+每份 `slides.md`/`transcript.md` 贡献其 `##` part 与 `###` 小节(presentation 在内容里, ADR-0011),
+按 `[[parts]]` 顺序拼接(分隔符空行)。**自包含**:装配器扫描产物里的 `![](rel)` 图引用,把引用到的
+本地图从工程根按原相对路径复制进产物所在 build 根,使该 build 目录可独立交付;引用图在工程根缺失属
+build-过程错误(不入 6 类)。外部 URL(`http(s)://`/`data:`)不复制。结构化 FileTree 产物延后
+(待 parts 树形重组, ADR-0015 OPEN)。
+-/
+
+namespace Spec.Courseware
+
+variable (P : Primitives)
+
+/-- 一个 build **step**(`PINNED` typed, ADR-0011;可扩展)。MVP 仅一个 `typstCompile`;
+`steps` 是 list 因为 FileTree / 第三方 build 会需多步。刻意不把模板内部、shell 命令的
+解析结构写进来(实现细节, ADR-0011 OPEN)。 -/
+inductive Step where
+  /-- 编译模板文件 `template`(相对工程根)成产物;框架注入 manifest。typed 的理由:
+      注入这件事裸 shell 写不出。 -/
+  | typstCompile (template : String)
+  /-- shell 逃生口:执行命令 `run`(ADR-0005 (b) 类落这)。**已实现**(ADR-0013):以工程根
+      为 cwd 执行,opt-in(只在显式 build 该 target 时跑,`check` 不跑),失败属 build-过程错误
+      而非 lesson 诊断。教具包(如 KenKen 交互 HTML 由外部 `kendoku` 生成)即走此 step。 -/
+  | shell (run : String)
+  /-- 装配 markdown:按 `[[parts]]` 顺序读取每个 element 的 `field`(markdown content 叶子,
+      ADR-0015),注入课程 h1 后拼接成**单文件 markdown** 产物,并收集 `![](rel)` 引用的本地图进
+      build 根使产物自包含。typed 而非 `cat`:按序读取+跳过缺失+注入标题+写盘+收集图由框架 own。
+      **已实现**(ADR-0015):非-typst target(`check` 不跑,失败属 build-过程错误不入 6 类诊断)。
+      slides 大纲面 / 逐字稿口播面即走此 step(直接 markdown+KaTeX 撰写,绕开 typst→md 公式转换,
+      ADR-0014 R2)。 -/
+  | assembleMarkdown (field : String)
+
+/-- 一个 export target 的 build 规格(`PINNED` artifact + 有序 steps, ADR-0011)。 -/
+structure TargetSpec where
+  /-- 产物(带字段, ADR-0011)。决定 build 折叠成单文件还是文件树。 -/
+  artifact : Artifact
+  /-- **有序** build steps。按序执行;MVP 仅一个 `typstCompile`。 -/
+  steps : List Step
+  /-- **覆盖声明**:`covers k` 表示此 target 渲染 kind `k`。ADR-0011 把旧
+      `renders : KindId → Option RenderRule` 降级后的产物——契约只声明"渲染哪些 kind"
+      (种子诊断 `renderIgnored` 用),"how"由 `steps` 的模板实现。 -/
+  covers : P.KindId → Prop
+
+/-- 渲染配置(`PINNED` target-中心, ADR-0009/0011)。`spec t = none` 表示 target `t`
+未声明(不导出);`some s` 给出其 build 规格。 -/
+structure RenderConfig where
+  /-- target ↦ 该 target 的 build 规格(未声明则 `none`)。 -/
+  spec : P.TargetId → Option (TargetSpec P)
+
+/-- kind `k` 在 target `t` 下**被渲染**(`PINNED`, ADR-0009/0011;承接 ADR-0005)。成立
+⟺ `t` 已声明(`spec t = some s`)**且** `s.covers k`。为假即"此 kind 在此 target 下不
+被渲染"——checker 据此报 warning(见 `Diagnostic.renderIgnored`)。`P` 隐式以便点记法。 -/
+def RenderConfig.covers {P : Primitives} (c : RenderConfig P)
+    (k : P.KindId) (t : P.TargetId) : Prop :=
+  match c.spec t with
+  | none => False
+  | some s => s.covers k
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Model.lean b/spec/Spec/Courseware/Model.lean
new file mode 100644
index 0000000..31df449
--- /dev/null
+++ b/spec/Spec/Courseware/Model.lean
@@ -0,0 +1,13 @@
+import Spec.Courseware.Model.Primitives
+import Spec.Courseware.Model.RichContent
+import Spec.Courseware.Model.Element
+import Spec.Courseware.Model.Lesson
+import Spec.Courseware.Model.Info
+
+/-!
+# Courseware.Model —— 工程文件的内容模型
+
+留白基元(`Primitives`)、富内容锚点(`RichContent`)、原子单位(`Element`)、单节课
+(`Lesson`)、课时元信息(`Info`:canonical author 为列表 vs `RawInfo` 撰写态)。
+决策出处 ADR-0005 / 0006 / 0008。
+-/
diff --git a/spec/Spec/Courseware/Model/Element.lean b/spec/Spec/Courseware/Model/Element.lean
new file mode 100644
index 0000000..19bc8ac
--- /dev/null
+++ b/spec/Spec/Courseware/Model/Element.lean
@@ -0,0 +1,24 @@
+import Spec.Courseware.Model.Primitives
+
+/-!
+# Element —— 课程内容的原子单位
+
+ADR-0005:element 实例 = 一个 kind 标签 + 符合该 kind schema 的数据。本模块把它编码成
+依赖结构,使"数据必须匹配其 kind"成为类型层面的事实而非运行时校验。
+-/
+
+namespace Spec.Courseware
+
+variable (P : Primitives)
+
+/-- element 实例(`PINNED`, ADR-0005)。`data : P.ElementData kind` 由 `kind` 决定——
+无法构造数据与 kind 不符的 element,schema 合规由类型系统保证。ADR-0005 的 (a) 类
+字段(逐字稿、重点圈划)落在具体 kind 的 `ElementData` 内,不出现在此通用结构上;
+交互教具等"重型 kind"在此与例题、定理同构,仅 `kind` 不同,重实现在模型之外。 -/
+structure Element where
+  /-- 该 element 的 kind。 -/
+  kind : P.KindId
+  /-- 符合 `kind` schema 的数据(类型随 `kind` 而变)。 -/
+  data : P.ElementData kind
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Model/Info.lean b/spec/Spec/Courseware/Model/Info.lean
new file mode 100644
index 0000000..c900220
--- /dev/null
+++ b/spec/Spec/Courseware/Model/Info.lean
@@ -0,0 +1,58 @@
+/-!
+# Info —— 课时元信息:canonical 模型 vs 撰写态(authoring surface)
+
+`[info]`(标题、作者)大多是 passthrough 元数据(ADR-0008),本不入契约。但**作者的
+基数**是一个真分歧点:一节课可由多人(教研组)署名,故 canonical 模型里 author 是一个
+**有序列表**,不是单值或可选单值。
+
+另有一条值得钉的模式:on-disk 的**撰写态**(用户实际填写的形态)是**语法糖**——单作者可写
+`author = "…"`,多作者写 `author = ["…", "…"]`——但这个"字符串或数组"的二态**只活在加载
+边界**:`RawInfo` 经归一化折叠成 canonical `Info`,其后不再出现。canonical 接收端始终是
+`List String`,raw 形式不泄漏进模型其余部分。这正是 `Info`(canonical)与 `RawInfo`
+(撰写态)两个结构存在的理由。
+-/
+
+namespace Spec.Courseware
+
+/-- 作者的**撰写态形式**(`PINNED` 仅填写便利, ADR-0008)。on-disk 单作者可写裸
+字符串、多作者写数组——填写便利,非语义分歧。此 union **只活在加载边界**,经
+`RawAuthor.normalize` 折叠后不再出现。 -/
+inductive RawAuthor where
+  /-- 单作者裸字符串 `author = "…"`。 -/
+  | one (name : String)
+  /-- 多作者数组 `author = ["…", "…"]`。 -/
+  | many (names : List String)
+
+/-- raw 作者归一化为**有序作者列表**(`PINNED`, ADR-0008)。单作者 ⇒ 单元素列表;数组
+⇒ 原样。这条钉死"canonical 接收端始终是 `List String`"。 -/
+def RawAuthor.normalize : RawAuthor → List String
+  | .one n => [n]
+  | .many ns => ns
+
+/-- 课时元信息的 **canonical 模型**(`PINNED` author 为列表, ADR-0008)。`authors` 是
+**有序列表**:多人署名第一类,空列表 = 未署名。`title` 等其余字段是 passthrough 元数据,
+不在此承诺更多。这是系统其余部分唯一所见的形态——author 在此**已**是列表,不再是
+"字符串或数组"。 -/
+structure Info where
+  /-- 标题(passthrough 元数据)。 -/
+  title : String
+  /-- 作者**有序列表**(空 = 未署名)。canonical 始终是列表。 -/
+  authors : List String
+
+/-- 撰写态的 `[info]`(`PINNED` 仅填写便利, ADR-0008)。`author` 用 `RawAuthor`
+(字符串或数组),`author` 缺省即未署名。此结构刻画"为便于填写而存在的 raw 形态",
+**不**是模型其余部分流通的形式——它经 `RawInfo.toInfo` 归一化为 canonical `Info`。 -/
+structure RawInfo where
+  /-- 标题。 -/
+  title : String
+  /-- 作者 raw 形式(可选;缺省即未署名)。 -/
+  author : Option RawAuthor
+
+/-- raw `[info]` 归一化为 canonical `Info`(`PINNED` 加载边界归一化, ADR-0008)。缺省
+author ⇒ 空列表,否则按 `RawAuthor.normalize`。raw 的"字符串或数组"二态在此被消解,
+**不**泄漏进 `Info`——canonical 接收端恒为 `List String`。 -/
+def RawInfo.toInfo (r : RawInfo) : Info :=
+  { title := r.title
+    authors := (r.author.map RawAuthor.normalize).getD [] }
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Model/Lesson.lean b/spec/Spec/Courseware/Model/Lesson.lean
new file mode 100644
index 0000000..3a3145d
--- /dev/null
+++ b/spec/Spec/Courseware/Model/Lesson.lean
@@ -0,0 +1,16 @@
+import Spec.Courseware.Model.Element
+
+/-!
+# Lesson —— 单节课工程文件
+
+ADR-0005:一个工程文件 = 一节课,是 element 实例的**有序序列**。课程/单元不是工程
+文件,而是 lesson 的编排(见 `Spec.Courseware.Course`,OPEN)。
+-/
+
+namespace Spec.Courseware
+
+/-- 一节课(`PINNED`, ADR-0005)。用 `List` 因为 **element 次序承载教学语义**(先讲
+定义再举例 ≠ 反过来);**不建模时长**——ADR-0005 决定 lesson 是内容编排而非时间轴。 -/
+abbrev Lesson (P : Primitives) := List (Element P)
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Model/Primitives.lean b/spec/Spec/Courseware/Model/Primitives.lean
new file mode 100644
index 0000000..656ae8b
--- /dev/null
+++ b/spec/Spec/Courseware/Model/Primitives.lean
@@ -0,0 +1,34 @@
+/-!
+# Primitives —— Courseware 契约的留白基元
+
+课程工程文件模型(ADR-0005)依赖一组基元:element kind 怎么标识、某 kind 的数据
+schema 是什么、export target 怎么标识。收口成载体 `Primitives`,让模型在其上参数化
+——契约谈得了 element / lesson / 渲染**之间的关系**,而把每个基元的**内部表示**留给
+实现。注意:某基元语义已 PINNED(如 schema 形态由 ADR-0006 钉死)与其表示进 Lean
+是两回事——JSON Schema / typst 的内部结构属实现细节,不入 Lean,故基元在此仍以抽象
+类型承载。富内容的 prose 母本见 `Courseware.RichContent`。
+-/
+
+namespace Spec.Courseware
+
+/-- Courseware 契约基元载体(关系 `PINNED`, ADR-0005;各基元表示留给实现, ADR-0006)。 -/
+structure Primitives where
+  /-- element kind 标识(`PINNED` **开放宇宙**, ADR-0005;表示 `OPEN`)。刻意用抽象
+      类型而非 `inductive`:ADR-0005 决定 kind 是开放可扩展宇宙(stdlib + 第三方),
+      封闭枚举会违背它——此处开放是**已决策的**(区别于 `RunState` 的"尚未封闭")。 -/
+  KindId : Type
+  /-- 某 kind 的合法数据类型(`PINNED` 依赖关系, ADR-0005;schema 形态 `PINNED`
+      ADR-0006,表示仍抽象)。以 kind 为索引:`ElementData k` 即"符合 `k` schema 的
+      数据"。schema 形态(声明式 JSON Schema + `content` 叶子 = typst 源)是 ADR-0006
+      钉死的,但属 JSON/typst 内部结构、实现细节,不进 Lean;契约只锚定"数据符合
+      kind schema"这条关系,故此处仍是抽象类型。 -/
+  ElementData : KindId → Type
+  /-- export target 标识(`PINNED` 角色, ADR-0005;表示 `OPEN`)。一个 target 是一次
+      build,产出对 lesson 的一种投影(讲义/教案/PPT/平台 archive…),见 `Render`。 -/
+  TargetId : Type
+
+-- 注:原 `RenderRule : Type` 已随 ADR-0011 移除。渲染的"how"不再是契约层 per-target
+-- 载荷,而由 `Render.TargetSpec.steps` 里 `typstCompile` step 引用的**模板文件**承载;
+-- 契约只保留覆盖声明 `TargetSpec.covers`(该 target 渲染哪些 kind),供种子诊断用。
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Model/RichContent.lean b/spec/Spec/Courseware/Model/RichContent.lean
new file mode 100644
index 0000000..d1a8899
--- /dev/null
+++ b/spec/Spec/Courseware/Model/RichContent.lean
@@ -0,0 +1,44 @@
+/-!
+# RichContent —— 富内容(ADR-0006 的 prose 母本)
+
+ADR-0006:element schema 的"叶子"可以是 `content` 类型,其值是一段**源文本**,
+按其 **format** 决定语义(ADR-0015)。两种 format:
+- **typst** —— 一段 typst 源,语义取该源作为 module 求值后的 body content(讲义/教案面)。
+- **markdown** —— 一段**原样**的 markdown + KaTeX 源,**不经 typst 求值**(slides 大纲面 / 逐字稿口播面;
+  ADR-0015)。直接以 markdown 撰写**绕开** typst→markdown 的公式转换难题(ADR-0014 R2):公式一开始就是
+  KaTeX 源(`$…$`),没有"把 typst 公式转成 md"这一步。
+
+关键约束(均 ADR-0006,源自 typst 源码事实):**typst** format 的富内容**不可无主**——typst 的源必须有
+`FileId`,否则 span 脱锚、相对 import 报"cannot access file system from here"。故每段 typst 富内容是 World 里
+的一等文件,坐落在一个**虚拟路径**上;相对 import 限本工程路径结构内 + `@package`(不跨工程)。markdown format
+的富内容不参与 typst 求值,但同样由一个虚拟路径定位(供 markdown 装配 step 按序读取,见 `Export/Render`)。
+
+本模块只立 prose 锚点 + 最小抽象签名:typst 的 `Content`/`Module` 内部结构、JSON Schema 形状、format 的
+具体判别属实现细节,不进 Lean,只承诺"富内容由一个虚拟路径定位"+"叶子带 format"这两条关系。
+-/
+
+namespace Spec.Courseware
+
+/-- 富内容在工程文件路径结构中的**虚拟路径**(`OPEN` 表示, ADR-0006)。把一段富内容
+定位为 World 里的一等文件(span 可解析、相对 import 可锚定)。落盘后即真实相对路径
+(ADR-0007),不在本层承诺,故 opaque。 -/
+opaque VPath : Type
+
+/-- 富内容的 **format**(`PINNED`, ADR-0015)。`content` 叶子带 format:typst 叶子被 typst 求值;
+markdown 叶子原样保留(markdown+KaTeX 源,不经求值)。 -/
+inductive ContentFormat where
+  /-- typst 源:求值为 typst `Content`(讲义/教案面)。 -/
+  | typst
+  /-- markdown + KaTeX 源:原样保留,不经 typst 求值(slides 大纲面 / 逐字稿口播面;ADR-0015)。 -/
+  | markdown
+
+/-- 对一段富内容的**引用**:它坐落在某个虚拟路径上(`PINNED` 关系, ADR-0006),并带一个
+**format**(`PINNED`, ADR-0015)。刻意**不**建模源文本、不建模求值出的 `Content`(那是实现侧的事);
+只钉"富内容经由一个 `VPath` 定位 + 带 format",作为 `Primitives.ElementData` 里 `content` 叶子的语义锚点。 -/
+structure RichContentRef where
+  /-- 该富内容所在的虚拟路径(ADR-0006;落盘后为真实相对路径, ADR-0007)。 -/
+  vpath : VPath
+  /-- 该富内容的 format(ADR-0015)。 -/
+  format : ContentFormat
+
+end Spec.Courseware
diff --git a/spec/Spec/Courseware/Open.lean b/spec/Spec/Courseware/Open.lean
new file mode 100644
index 0000000..d5f8fcb
--- /dev/null
+++ b/spec/Spec/Courseware/Open.lean
@@ -0,0 +1,9 @@
+import Spec.Courseware.Open.QuestionBank
+import Spec.Courseware.Open.Course
+
+/-!
+# Courseware.Open —— 留白骨架(核心关系 OPEN)
+
+题库与 element 的关系(`QuestionBank`)、课程编排规则(`Course`)。两者均为已 surface
+但未决策的分歧点,按宪法第 2 条不臆造,待专门 ADR 落定。
+-/
diff --git a/spec/Spec/Courseware/Open/Course.lean b/spec/Spec/Courseware/Open/Course.lean
new file mode 100644
index 0000000..50617a4
--- /dev/null
+++ b/spec/Spec/Courseware/Open/Course.lean
@@ -0,0 +1,10 @@
+/-!
+# Course —— 课程编排(骨架,规则 OPEN)
+
+ADR-0005:工程文件的粒度是**单节课**;course / 单元**不是**工程文件,而是 lesson 的
+**编排**。但"编排"的具体规则未决策:有序列表还是带层级(单元 → 课)的树?lesson 被
+引用还是被包含?跨 lesson 有无约束(目标覆盖、前后置)?这些都是 `OPEN`。
+
+按宪法第 2 条本模块**不臆造**编排结构——不建 `Course := List Lesson`(那会偷偷承诺
+"扁平有序、无层级")。只在此 surface:课程编排待专门 ADR。本文件当前不引入任何承诺性声明。
+-/
diff --git a/spec/Spec/Courseware/Open/QuestionBank.lean b/spec/Spec/Courseware/Open/QuestionBank.lean
new file mode 100644
index 0000000..7270d8d
--- /dev/null
+++ b/spec/Spec/Courseware/Open/QuestionBank.lean
@@ -0,0 +1,10 @@
+/-!
+# QuestionBank —— 题库(骨架,核心关系 OPEN)
+
+题库是与工程文件并列的资产(类比 DAW 的 sample library):有自身结构的实体,又是最
+典型的可复用单元,lesson 会引用它。但**题库与 element 的关系尚未决策**,且用户明确
+指出"纯引用可能不够"——element 内联题目数据 / lesson 持指向题库条目的引用 / 两者并存?
+
+这是一个 `OPEN` 分歧点。按宪法第 2 条本模块**不替它选解**——不建 `QuestionRef` 也不建
+内联结构,只在此 surface。待专门 ADR 落定后再填。本文件当前不引入任何承诺性声明。
+-/
diff --git a/spec/Spec/Prelude.lean b/spec/Spec/Prelude.lean
new file mode 100644
index 0000000..df99553
--- /dev/null
+++ b/spec/Spec/Prelude.lean
@@ -0,0 +1,24 @@
+/-!
+# Prelude —— System 层共享标识符
+
+平台层反复引用一组标识符(项目、run、session、principal)。其内部表示从未被决策
+(UUID / 复合键、principal 子类型学),也非分歧点,故收口成 opaque 载体
+`Identifiers`,System 各模块在其上参数化——契约谈得了"锁 owner 是哪个 run"这类
+**关系**,却不对标识符表示作承诺。
+-/
+
+namespace Spec.System
+
+/-- System 层标识符载体(关系结构 `PINNED`;各字段表示 `OPEN`)。 -/
+structure Identifiers where
+  /-- 课程项目标识(`OPEN` 表示;聚合根,likec4 `Project`)。 -/
+  ProjectId : Type
+  /-- 一次 Claude 任务的标识(`OPEN` 表示;锁的 owner、审计主体,`AgentRun`)。 -/
+  RunId : Type
+  /-- 长生命周期 Claude 会话标识(`OPEN` 表示;跨多 run 复用,ADR-0002)。 -/
+  SessionId : Type
+  /-- 权限主体标识(`OPEN` 表示及其子类型学;ADR-0004 的 user/chat/department/…
+      子类型学未定且非本层分歧点,纯 plumbing,故只留 opaque 键)。 -/
+  Principal : Type
+
+end Spec.System
diff --git a/spec/Spec/System.lean b/spec/Spec/System.lean
new file mode 100644
index 0000000..d1ae702
--- /dev/null
+++ b/spec/Spec/System.lean
@@ -0,0 +1,19 @@
+import Spec.System.Run
+import Spec.System.Lock
+import Spec.System.Permission
+import Spec.System.Audit
+
+/-!
+# System —— Hub 平台层契约
+
+协作与执行的平台:项目、飞书群、AgentRun、锁、权限、审计。likec4
+(`docs/architecture/likec4/`)已画出这一层的**结构**;本层只补 likec4 画不出的
+**语义分歧点**:
+
+- `Run` —— AgentRun 状态与终止判定(状态集合完整性 OPEN)。
+- `Lock` —— 锁 owner=run(ADR-0002),及"持锁者必为非终止 run"的核心不变式。
+- `Permission` —— read⊂edit⊂manage 角色格、能力推导、单调性;force-release 在格外。
+- `Audit` —— 有意从简(内容多为 plumbing,OPEN)。
+
+标识符见 `Spec.Prelude`。决策出处:ADR-0001..0004。
+-/
diff --git a/spec/Spec/System/Audit.lean b/spec/Spec/System/Audit.lean
new file mode 100644
index 0000000..114d4d1
--- /dev/null
+++ b/spec/Spec/System/Audit.lean
@@ -0,0 +1,22 @@
+import Spec.Prelude
+
+/-!
+# Audit —— 审计日志(有意从简)
+
+likec4 把 `AuditLog` 列为实体(`AgentRun -> AuditLog 'records lifecycle events'`),
+但**审计记录里装什么**(事件 schema、保留策略、可查询维度)在任何 ADR / 散文里都
+未决策,且大多是 plumbing——按分歧点测试不入契约。故本模块刻意几乎为空:只固定
+"审计以 run 为主体记录其生命周期事件"这一条已决策关系,其余 `OPEN`(留白本身是
+契约的一部分:承诺此处尚无答案、勿填)。
+-/
+
+namespace Spec.System
+
+/-- 审计条目的最小骨架(关系 `PINNED` / 内容 `OPEN`, likec4)。只承诺"一条审计记录
+关联到某个 run";事件类型、时间、actor、详情等字段 `OPEN`,待真实分歧点出现时由
+对应 ADR 落定。 -/
+structure AuditEntry (I : Identifiers) where
+  /-- 该审计条目所属的 run(`PINNED` 关系, likec4)。 -/
+  run : I.RunId
+
+end Spec.System
diff --git a/spec/Spec/System/Lock.lean b/spec/Spec/System/Lock.lean
new file mode 100644
index 0000000..94a0e22
--- /dev/null
+++ b/spec/Spec/System/Lock.lean
@@ -0,0 +1,37 @@
+import Spec.Prelude
+import Spec.System.Run
+
+/-!
+# Lock —— 项目锁与排他不变式
+
+ADR-0002 的核心:防止并发 Claude 同改一个项目,锁的 **owner 是当前 `AgentRun`**
+(不是 teacher / chat / session)。本模块把这条决策编码进类型,并钉死那条
+likec4 画不出的语义不变式——**持锁者必为非终止 run**。
+-/
+
+namespace Spec.System
+
+variable (I : Identifiers)
+
+/-- 项目级锁(`PINNED`, ADR-0002)。`owner : RunId`(非 SessionId/Principal)从类型
+上编码"lock owner = run_id":锁不可能被 session / teacher 持有。 -/
+structure ProjectAgentLock where
+  /-- 作用域:项目级(`PINNED`, ADR-0002 `scope = project_id`)。 -/
+  scope : I.ProjectId
+  /-- 持有者:一个 run(`PINNED`, ADR-0002 `owner = run_id`)。 -/
+  owner : I.RunId
+
+/-- 锁表:每项目当前持锁 run(`PINNED` 排他性, ADR-0002)。`ProjectId → Option RunId`
+的结构**本身**即排他——不可能为同一项目登记两个并发 owner。 -/
+def LockTable := I.ProjectId → Option I.RunId
+
+/-- 锁表良构:**持锁者必为非终止 run**(`PINNED` 平台核心不变式, ADR-0002)。
+
+"锁在 run 终止时释放"的逻辑等价物:若 `p` 的锁被 `r` 持有,则 `r` 不在终止态。这条
+把 Lock 与 Run 耦合起来——likec4 能画"run owns lock while running",画不出"终止即
+必须释放"这个约束;它正是契约相对结构图的增量。 -/
+def LockTable.WellFormed
+    (lt : LockTable I) (statusOf : I.RunId → RunState) : Prop :=
+  ∀ p r, lt p = some r → ¬ (statusOf r).Terminal
+
+end Spec.System
diff --git a/spec/Spec/System/Permission.lean b/spec/Spec/System/Permission.lean
new file mode 100644
index 0000000..daffb18
--- /dev/null
+++ b/spec/Spec/System/Permission.lean
@@ -0,0 +1,66 @@
+import Spec.Prelude
+
+/-!
+# Permission —— 角色、能力与授权
+
+ADR-0004:权限走"飞书云文档式"——grant(`resource + principal + role`)与 settings
+分离;role 取自封闭的 `read / edit / manage`,且 **read ⊂ edit ⊂ manage** 累积赋能;
+强制释放锁是 **admin-only**,在 role 体系之外。本模块把这套结构与"高 role 含低
+role 全部能力"的单调性钉死。
+-/
+
+namespace Spec.System
+
+/-- 协作者角色(`PINNED` 封闭, ADR-0004 逐字 "roles are read, edit, or manage")。 -/
+inductive Role where
+  | read
+  | edit
+  | manage
+
+/-- 角色赋能层级(`PINNED` 序, ADR-0004 read⊂edit⊂manage 数值化)。仅服务于
+`Role.le` 与能力推导,不对外承诺"层级就是 `Nat`"。 -/
+def Role.level : Role → Nat
+  | .read => 0
+  | .edit => 1
+  | .manage => 2
+
+/-- 角色偏序:`r₁ ≤ r₂` 即 `r₁` 赋能不强于 `r₂`(`PINNED`, ADR-0004)。 -/
+def Role.le (r₁ r₂ : Role) : Prop := r₁.level ≤ r₂.level
+
+/-- 受 role 调控的操作能力(各项 `PINNED` 取自 ADR-0004;**枚举完整性 `OPEN`**——
+这是 ADR 当前点名的能力,不保证穷尽,新增产品操作时可能扩)。注意 force-release
+**不在此列**——它是 admin-only override,见 `RequiresAdmin`。 -/
+inductive Capability where
+  | view
+  | discussComment
+  | editArtifact
+  | triggerAgent
+  | answerChoiceCard
+  | manageCollaborators
+  | projectSettings
+  | groupBinding
+  | normalCancel
+
+/-- 某能力所**要求的最低角色**(`PINNED`, ADR-0004 各 role 能力展开)。授权判定
+`Role.can` 据此定义,"谁能做什么"只有这一处真相。 -/
+def Capability.requiredRole : Capability → Role
+  | .view => .read
+  | .discussComment | .editArtifact | .triggerAgent | .answerChoiceCard => .edit
+  | .manageCollaborators | .projectSettings | .groupBinding | .normalCancel => .manage
+
+/-- 角色 `r` **具备**能力 `c`(`PINNED`, ADR-0004)。定义为"`c` 的最低角色 ≤ `r`",
+这一处同时编码了 read⊂edit⊂manage 的累积性。 -/
+def Role.can (r : Role) (c : Capability) : Prop := c.requiredRole |>.le r
+
+/-- **单调性**:`r₁ ≤ r₂` 且 `r₁` 能做 `c` ⇒ `r₂` 也能(`PINNED` 定理, ADR-0004 累积
+赋能的形式化保证)。证明即偏序传递性,得益于 `can` 按"最低角色阈值"定义。 -/
+theorem Role.can_mono {r₁ r₂ : Role} {c : Capability}
+    (h : r₁.le r₂) (hc : r₁.can c) : r₂.can c :=
+  Nat.le_trans hc h
+
+/-- **强制释放锁**要求 admin,**在 role 体系之外**(`PINNED`, ADR-0004 admin-only
+override)。即便 `manage` 也不经 `Role.can` 获得它,故它不是 `Capability` 而是独立
+谓词;`isAdmin` 由平台另行判定(本层不建 admin 模型)。 -/
+def RequiresAdmin (isAdmin : Prop) : Prop := isAdmin
+
+end Spec.System
diff --git a/spec/Spec/System/Run.lean b/spec/Spec/System/Run.lean
new file mode 100644
index 0000000..7662200
--- /dev/null
+++ b/spec/Spec/System/Run.lean
@@ -0,0 +1,28 @@
+/-!
+# Run —— AgentRun 状态机
+
+一次 `@Claude` 创建一个 `AgentRun`(ADR-0001),它在终止时释放项目锁(ADR-0002)。
+合法转移关系在任何 ADR / likec4 散文里都未定下,故本模块只刻画**状态**与**终止
+判定**(后者是 Lock 排他不变式的依赖),不臆造转移边。
+-/
+
+namespace Spec.System
+
+/-- AgentRun 运行状态(状态名 `PINNED`, ADR-0001..0003 + likec4;**完整性 `OPEN`**
+——散文从未声明"状态恰好这些";实现若需新状态(如 pending)须 surface,不得默认
+本枚举已穷尽)。终止态见 `RunState.Terminal`。 -/
+inductive RunState where
+  | active
+  | waitingForUser
+  | completed
+  | failed
+  | timedOut
+  | canceled
+
+/-- run 处于**终止态**(`PINNED`, ADR-0002:锁在 completes/fails/timesOut/canceled
+时释放)。`active`/`waitingForUser` 非终止——后者仍占用项目(锁未释放)。 -/
+def RunState.Terminal : RunState → Prop
+  | .completed | .failed | .timedOut | .canceled => True
+  | .active | .waitingForUser => False
+
+end Spec.System
diff --git a/spec/lake-manifest.json b/spec/lake-manifest.json
new file mode 100644
index 0000000..d041e82
--- /dev/null
+++ b/spec/lake-manifest.json
@@ -0,0 +1,6 @@
+{"version": "1.2.0",
+ "packagesDir": ".lake/packages",
+ "packages": [],
+ "name": "Spec",
+ "lakeDir": ".lake",
+ "fixedToolchain": false}
diff --git a/spec/lakefile.toml b/spec/lakefile.toml
new file mode 100644
index 0000000..6db46dc
--- /dev/null
+++ b/spec/lakefile.toml
@@ -0,0 +1,6 @@
+name = "Spec"
+version = "0.1.0"
+defaultTargets = ["Spec"]
+
+[[lean_lib]]
+name = "Spec"
diff --git a/spec/lean-toolchain b/spec/lean-toolchain
new file mode 100644
index 0000000..18640c8
--- /dev/null
+++ b/spec/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:v4.31.0