diff --git a/Dockerfile b/Dockerfile
index 98ea0a8..1090589 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,30 +1,100 @@
-# KNELPDF - TSYS Group fleet document-generation image.
-# pandoc + texlive (xetex/luatex) + DejaVu/Noto fonts (box-drawing + wide unicode).
-# Rebuild = bump the version pins, never float.
+# KNELPDF - TSYS Group fleet document-production system.
+# "Document production across all outputs": PDF (xelatex/lualatex/typst/
+# weasyprint), books (mdbook), sites (hugo), papers/slides (quarto),
+# diagrams (mermaid via headless chromium, plantuml, graphviz, gnuplot).
+#
+# NO Node.js (founder ruling 2026-09-07): mermaid renders through bundled
+# mermaid.min.js + headless chromium, not mermaid-cli. Quarto is a
+# self-contained binary (bundles its own Deno) - accepted as "not
+# Node.js"; veto by deleting layer 4b's quarto lines if not.
+#
+# Layer order: least-changing at the bottom, most-volatile at the top.
+# Bump a pin = edit its ARG, rebuild; layers above rebuild, below don't.
 
 FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
 
 ARG PANDOC_VERSION=3.11
 ARG PANDOC_DEB=pandoc-3.11-1-amd64.deb
+ARG QUARTO_VERSION=1.10.18
+ARG QUARTO_DEB=quarto-1.10.18-linux-amd64.deb
+ARG TYPST_VERSION=0.15.1
+ARG HUGO_VERSION=0.165.0
+ARG MDBOOK_VERSION=0.5.4
+ARG MDBOOK_MERMAID_VERSION=0.17.1
+ARG PLANTUML_VERSION=1.2026.8
+ARG MERMAID_VERSION=11.17.2
+ARG REVEALJS_VERSION=6.0.1
+ARG EISVOGEL_VERSION=3.5.1
+ARG WEASYPRINT_VERSION=69.0
 
+# --- layer 2: system packages, fonts, charting, python runtime ----------
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
-      ca-certificates \
-      curl \
-      texlive-latex-base \
-      texlive-latex-recommended \
-      texlive-latex-extra \
-      texlive-xetex \
-      texlive-luatex \
-      texlive-fonts-recommended \
-      lmodern \
-      fonts-dejavu \
-      fonts-noto-core \
+      ca-certificates curl xz-utils unzip zip jq \
+      chromium \
+      default-jre-headless \
+      fonts-dejavu fonts-noto-core fonts-liberation fonts-lato \
+      graphviz gnuplot-nox librsvg2-bin \
+      qpdf ghostscript \
+      python3 python3-pip python3-venv \
+      libpango-1.0-0 libpangoft2-1.0-0 \
+ && rm -rf /var/lib/apt/lists/*
+
+# --- layer 3: texlive-full (every feature; huge, rarely changes) --------
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends texlive-full \
+ && rm -rf /var/lib/apt/lists/*
+
+# --- layer 4a: weasyprint (python venv, pinned) -------------------------
+RUN python3 -m venv /opt/weasy \
+ && /opt/weasy/bin/pip install --no-cache-dir "weasyprint==${WEASYPRINT_VERSION}" \
+ && ln -s /opt/weasy/bin/weasyprint /usr/local/bin/weasyprint
+
+# --- layer 4b: pandoc + quarto (deb-installed, self-contained) ----------
+RUN apt-get update \
  && curl -fsSL -o /tmp/pandoc.deb \
       "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/${PANDOC_DEB}" \
- && dpkg -i /tmp/pandoc.deb \
- && rm -f /tmp/pandoc.deb \
+ && curl -fsSL -o /tmp/quarto.deb \
+      "https://github.com/quarto-dev/quarto-cli/releases/download/v${QUARTO_VERSION}/${QUARTO_DEB}" \
+ && apt-get install -y /tmp/pandoc.deb /tmp/quarto.deb \
+ && rm -f /tmp/pandoc.deb /tmp/quarto.deb \
  && rm -rf /var/lib/apt/lists/*
 
+# --- layer 4c: single-binary downloads (rust/go) ------------------------
+RUN curl -fsSL "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz" \
+      | tar xJ -C /tmp \
+ && mv /tmp/typst-x86_64-unknown-linux-musl/bin/typst /usr/local/bin/typst \
+ && curl -fsSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" \
+      | tar xz -C /tmp hugo \
+ && mv /tmp/hugo /usr/local/bin/hugo \
+ && curl -fsSL "https://github.com/rust-lang/mdbook/releases/download/v${MDBOOK_VERSION}/mdbook-v${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
+      | tar xz -C /usr/local/bin mdbook \
+ && curl -fsSL "https://github.com/badboy/mdbook-mermaid/releases/download/v${MDBOOK_MERMAID_VERSION}/mdbook-mermaid-v${MDBOOK_MERMAID_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
+      | tar xz -C /usr/local/bin mdbook-mermaid \
+ && rm -rf /tmp/typst-x86_64-unknown-linux-musl
+
+# --- layer 4d: web/diagram assets (jar, js, template) -------------------
+RUN mkdir -p /opt/plantuml /opt/mermaid /opt/reveal.js /usr/local/share/pandoc/templates \
+ && curl -fsSL -o /opt/plantuml/plantuml.jar \
+      "https://github.com/plantuml/plantuml/releases/download/v${PLANTUML_VERSION}/plantuml-${PLANTUML_VERSION}.jar" \
+ && printf '#!/bin/sh\nexec java -jar /opt/plantuml/plantuml.jar "$@"\n' \
+      > /usr/local/bin/plantuml && chmod +x /usr/local/bin/plantuml \
+ && curl -fsSL "https://registry.npmjs.org/mermaid/-/mermaid-${MERMAID_VERSION}.tgz" \
+      | tar xz -C /tmp package/dist/mermaid.min.js \
+ && mv /tmp/package/dist/mermaid.min.js /opt/mermaid/mermaid.min.js \
+ && curl -fsSL -o /tmp/reveal.zip \
+      "https://github.com/hakimel/reveal.js/releases/download/${REVEALJS_VERSION}/reveal.js-${REVEALJS_VERSION}.zip" \
+ && unzip -q /tmp/reveal.zip -d /tmp/rv \
+ && if [ -d "/tmp/rv/reveal.js-${REVEALJS_VERSION}" ]; then \
+      mv "/tmp/rv/reveal.js-${REVEALJS_VERSION}"/* /opt/reveal.js/; \
+    else mv /tmp/rv/* /opt/reveal.js/; fi \
+ && rm -rf /tmp/reveal.zip /tmp/rv /tmp/package \
+ && curl -fsSL -o /usr/local/share/pandoc/templates/eisvogel.latex \
+      "https://raw.githubusercontent.com/Wandmalfarbe/pandoc-latex-template/v${EISVOGEL_VERSION}/eisvogel.latex"
+
+# --- layer 5: local scripts (most volatile) -----------------------------
+COPY scripts/knelpdf-mermaid /usr/local/bin/knelpdf-mermaid
+RUN chmod +x /usr/local/bin/knelpdf-mermaid
+
 # Fleet rule: NO ENTRYPOINT - keeps `sh -c` composition working.
 CMD ["pandoc", "--version"]
diff --git a/examples/diagram-demo.mmd b/examples/diagram-demo.mmd
new file mode 100644
index 0000000..3330560
--- /dev/null
+++ b/examples/diagram-demo.mmd
@@ -0,0 +1,6 @@
+flowchart LR
+  A[Markdown] --> B{KNELPDF}
+  B -->|xelatex| C[PDF]
+  B -->|typst| C
+  B -->|weasyprint| D[HTML-styled PDF]
+  B -->|mdbook/hugo| E[Sites]
diff --git a/scripts/knelpdf-mermaid b/scripts/knelpdf-mermaid
new file mode 100755
index 0000000..0c5e31e
--- /dev/null
+++ b/scripts/knelpdf-mermaid
@@ -0,0 +1,27 @@
+#!/bin/bash
+# knelpdf-mermaid: render a mermaid diagram to PNG without Node.js.
+# Uses bundled mermaid.min.js + headless chromium.
+# usage: knelpdf-mermaid input.mmd output.png [theme] [width] [height]
+set -euo pipefail
+IN="${1:?usage: knelpdf-mermaid input.mmd output.png [theme] [width] [height]}"
+OUT="${2:?usage: knelpdf-mermaid input.mmd output.png [theme] [width] [height]}"
+THEME="${3:-default}"
+W="${4:-1600}"; H="${5:-1200}"
+case "$IN" in *.svg|*.png) echo "output-only extension in OUT, not IN" >&2; exit 2;; esac
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+{
+  echo '<!doctype html><html><head><meta charset="utf-8">'
+  echo '<style>body{margin:0;background:white;font-family:sans-serif}</style>'
+  echo '</head><body><div class="mermaid">'
+  cat "$IN"
+  echo '</div>'
+  echo '<script src="file:///opt/mermaid/mermaid.min.js"></script>'
+  echo "<script>mermaid.initialize({startOnLoad:true,theme:\"${THEME}\"});</script>"
+  echo '</body></html>'
+} > "$WORK/render.html"
+chromium --headless=new --no-sandbox --disable-gpu \
+  --allow-file-access-from-files --hide-scrollbars \
+  --screenshot="$OUT" --window-size="${W},${H}" \
+  --virtual-time-budget=10000 "file://$WORK/render.html" 2>/dev/null
+test -s "$OUT" && echo "wrote $OUT"