16. Renderer System

The base renderer contract is specs/002-v000-technical-specification/contracts/renderer.md; Mermaid specializes it through specs/003-mermaid-view-edit/contracts/mermaid-renderer.md. A renderer registers a stable ID, exact format families and variants, maturity, platform set, operations, limits, worker policy, and lazy module loader. Registration order never decides detection priority.

The open context contains a bounded byte provider, cancellation signal, metadata sink, renderer-scoped asset URL factory, theme and accessibility preferences, and progress sink. It contains no arbitrary Tauri invocation, filesystem API, Android URI, network client, or shell executor.

The shell renders only commands advertised by the active renderer. edit, save, and save_as remain independent. A recovered text buffer can be editable while its original source is unavailable, exposing Save As without Save.

CPU-intensive parsing runs in Web Workers or Rust worker threads. Cancellation MUST stop new work within 250 ms. Background tabs suspend decoded image surfaces, PDF canvases, office trees, object URLs, and other regenerable caches. Disposal is idempotent and releases every worker, lease, observer, subscription, and timer.

Every renderer passes the shared conformance suite for first content, capabilities, cancellation, malformed and oversized input, metadata provenance, suspension, repeated open/close, disposal, and platform parity. Editable renderers also pass undo/redo, dirty state, round-trip preservation, conflict, save, Save As, recovery, and lossy-save denial.