[callumalpass]

Reader displays the embedded blue SVG as a broken image when opening the imported HTML reproduced in round 2 and round 3.

The fixture uses an <img src="data:image/svg+xml,..."> with percent-encoded SVG. prepareHtmlDocument removed its src because its image allowlist accepted only base64 raster images. The document CSP already permits data images.

Sanitize SVG image payloads with DOMPurify before re-encoding them, removing scripts, event handlers, foreign HTML, animation, styling and external references. Reject malformed XML and omit source doctypes and processing instructions. Preserve local fragment references, quoted paints and non-breaking spaces. Accept SVG data URLs only as image sources, and strip srcset candidates so they cannot bypass sanitization. Preserve safe nested raster data images. Keep the document CSP and iframe sandbox unchanged.

Validation:

• Fixture regression reproduced the missing src before the fix.
• Chromium regression passes: the original fixture and both Reader sanitization passes render the image at 30×30, with unchanged CSP and no external requests. Added to CI.
• rpnpm typecheck passed.
• Main-screen axe-core 4.13.0 audit: zero violations at 1440×900 and 390×844, using local sample data with external requests blocked.
• Final CI passed on 386b06bd3c4867830b6c23cd1562554e89de8458: lint, formatting, architecture, typecheck, full test suite, Chromium SVG regression, build and generated-file checks. Renderer HTML: 11 files / 99 tests passed, including 17 SVG sanitizer tests.
• rpnpm --filter @mdbase-reader/web-capture test passed: 834 tests. SVG tests use jsdom because DOMPurify explicitly does not support happy-dom.
• Two independent Opus reviews completed; actionable findings were fixed and regression-covered. CSS support remains the follow-up below.

Follow-ups: SVG CSS remains stripped, including inline style attributes and class-based <style> rules; supporting those drawings would need CSS sanitization. The existing multi-screen accessibility script times out on its stale grid locator; the requested main-screen axe checks were run directly. No production testing, daemon access, merge or deployment.