diff --git a/.gitignore b/.gitignore
index 8828370a..97dbccf0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,5 +2,8 @@ target/
 **/*.rs.bk
 **/*~
 .crush
+.claude/
 build.ninja
 *:Zone.Identifier
+/graph.dot
+/graph.html
diff --git a/docs/adr-004-graph-subcommand-in-process-rendering.md b/docs/adr-004-graph-subcommand-in-process-rendering.md
new file mode 100644
index 00000000..11577969
--- /dev/null
+++ b/docs/adr-004-graph-subcommand-in-process-rendering.md
@@ -0,0 +1,119 @@
+# Architecture Decision Record (ADR): Render the `graph` subcommand in-process
+
+## Status
+
+Accepted
+
+Accepted: the `graph` subcommand renders the build dependency graph
+in-process from the parsed manifest's intermediate representation; it does
+not invoke `ninja -t graph`.
+
+## Date
+
+2026-05-26
+
+## Context and problem statement
+
+Through milestone 3.4.4 the `netsuke graph` subcommand worked by:
+
+1. Running the full manifest pipeline up to Ninja synthesis to produce a
+   temporary `build.ninja`.
+2. Invoking the Ninja executable with `ninja -t graph` against that
+   temporary file.
+3. Streaming Ninja's stdout (the DOT text) back to the user.
+
+Milestone 3.4.5 added an `--html` renderer and an `--output <FILE>` flag.
+Two implementation paths were available:
+
+- Keep the existing `ninja -t graph` path for DOT and add a separate
+  in-process HTML path.
+- Migrate both DOT and HTML to a shared in-process renderer port that
+  consumes a deterministic projection of the in-memory build graph.
+
+The first path leaves two DOT emitters live with subtly different output
+(Ninja's DOT references the temporary build-file path, which is a
+determinism risk). It also keeps a Ninja runtime dependency on the
+introspection path even though Ninja contributes nothing semantic that the
+IR does not already carry.
+
+## Decision
+
+Migrate the entire `graph` dispatch off Ninja. Render DOT and HTML
+in-process from a canonical `GraphView` projection of `BuildGraph`. Both
+renderers consume `GraphView` through a single `GraphRenderer` trait. The
+runner picks the appropriate adapter from `Commands::Graph(GraphArgs)`,
+writes through the shared `write_text_file` / `write_text_stdout` sinks,
+and honours the `-` sentinel and `-C/--directory` working directory in the
+same way as `manifest`.
+
+Specifically:
+
+- A `GraphView` (in [`src/graph_view/mod.rs`](../src/graph_view/mod.rs))
+  sorts every collection at construction time so the output is invariant
+  under `HashMap` iteration order. A proptest confirms equivalence under
+  reversed insertion order across freshly seeded `HashMap`s.
+- A `GraphRenderer` port (in [`src/graph_view/render.rs`](../src/graph_view/render.rs))
+  defines the contract `render(&self, view: &GraphView, sink: &mut dyn
+  io::Write) -> Result<(), GraphRenderError>`.
+- [`DotRenderer`](../src/graph_view/render_dot.rs) and
+  [`HtmlRenderer`](../src/graph_view/render_html.rs) implement that port.
+- The runner's [`Commands::Graph` dispatch](../src/runner/mod.rs) no longer
+  spawns `ninja -t graph`. Tests that previously asserted the Ninja-tool
+  dispatch have been updated.
+
+## Rationale
+
+- **Determinism.** The IR is the natural source of truth for the
+  dependency graph. Running through Ninja introduces a temporary build
+  file whose path leaks into Ninja's DOT output, which makes Ninja's
+  output non-reproducible. Sorting at the projection boundary is much
+  simpler than post-processing Ninja's stream.
+- **Operational fitness.** `graph` is a lightweight introspection
+  subcommand. It has no semantic reason to fail when Ninja is unavailable
+  or misconfigured. Running in-process removes Ninja as a runtime
+  dependency on the introspection path. Integration tests cover the
+  Ninja-less path explicitly.
+- **Architectural fit.** The hexagonal projection cleanly admits future
+  renderers — for example the deferred `--json` view (roadmap item
+  `3.15.6`) — as a third adapter without re-projecting the IR.
+- **Pre-0.1.0 freedom.** ADR-003 endorses removing legacy spellings rather
+  than adding compatibility aliases. The byte-level change in DOT output
+  is acceptable because no stable contract exists yet.
+
+## Consequences
+
+- Downstream scripts that grep the previous `ninja -t graph` output may
+  see syntactically different DOT. The semantic content (targets, edges,
+  dependency classes) is preserved; the formatting and node identifiers
+  follow Netsuke's own conventions. Documented in the user guide.
+- The runner-tool-subcommand integration tests were rewritten to cover
+  the new in-process behaviour for `graph` while retaining the
+  Ninja-mediated behaviour for `clean`.
+- `--html` and `--output` are intentionally kept out of `OrthoConfig`
+  layering. Layering `--output` through a config file would silently
+  change the artefact destination; this is a per-invocation flag only.
+
+## Alternatives considered
+
+- **Add an HTML renderer alongside the existing Ninja-mediated DOT
+  path.** Rejected. Two DOT emitters with subtly different output is
+  worse than one switch, and the parallel maintenance burden is
+  permanent.
+- **Adopt a third-party Rust layout crate (`layout` or similar) for
+  HTML.** Evaluated and rejected during the Stage C go/no-go gate (see
+  [`docs/execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md`](execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md)).
+  The crate's transitive deps and binary-size impact exceeded the 1 MB
+  release-binary budget.
+- **Vendor `@viz-js/viz` (JS + WASM).** Documented fallback. Rejected
+  because the 3 MB per-artefact WASM blob exceeds the 5 MB realistic-
+  project HTML ceiling on large graphs.
+
+## Implementation references
+
+- Execplan: [`docs/execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md`](execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md)
+- Production code: [`src/graph_view`](../src/graph_view), runner
+  dispatch in [`src/runner/mod.rs`](../src/runner/mod.rs).
+- Tests: [`src/graph_view/tests.rs`](../src/graph_view/tests.rs),
+  [`src/graph_view/render_html_tests.rs`](../src/graph_view/render_html_tests.rs),
+  [`tests/runner_graph_tests.rs`](../tests/runner_graph_tests.rs),
+  [`tests/features_unix/graph.feature`](../tests/features_unix/graph.feature).
diff --git a/docs/developers-guide.md b/docs/developers-guide.md
index ff08287a..737912f7 100644
--- a/docs/developers-guide.md
+++ b/docs/developers-guide.md
@@ -26,6 +26,58 @@ as the durable architecture record.
 
 [adr-003-cli]: adr-003-agent-consistent-human-first-cli.md
 
+## Graph view projection and renderer adapters
+
+The `graph` subcommand renders the build dependency graph in-process. Its
+domain projection lives in [`src/graph_view`](../src/graph_view) and follows
+the hexagonal port/adapter pattern:
+
+- [`GraphView`](../src/graph_view/mod.rs) is the deterministic projection of
+  [`BuildGraph`](../src/ir/graph.rs). It is constructed once, sorts every
+  collection (nodes, edges, default targets), and is invariant under
+  `HashMap` insertion order. The shuffled-insertion proptest in
+  [`src/graph_view/tests.rs`](../src/graph_view/tests.rs) covers this
+  invariant.
+- [`GraphRenderer`](../src/graph_view/render.rs) is the trait every renderer
+  adapter implements. The contract is intentionally minimal:
+  `render(&self, view: &GraphView, sink: &mut dyn io::Write) -> Result<(),
+  GraphRenderError>`. Adapters consume `GraphView` only — they never touch
+  `BuildGraph` directly.
+- [`DotRenderer`](../src/graph_view/render_dot.rs) emits Graphviz DOT.
+- [`HtmlRenderer`](../src/graph_view/render_html.rs) emits a self-contained
+  HTML page (server-rendered SVG, accessible textual outline, and a
+  `<noscript>` fallback containing the DOT source verbatim).
+
+`EdgeView::class` mirrors the four Ninja dependency relations so that
+renderers can style each one distinctly:
+
+| Variant          | Ninja separator           | DOT style       | SVG class              |
+|------------------|---------------------------|-----------------|------------------------|
+| `Explicit`       | none (input in `$in`)     | solid (no attr) | `edge`                 |
+| `ImplicitDep`    | single pipe (`\|`)        | `style=bold`    | `edge implicit-dep`    |
+| `ImplicitOutput` | single pipe on LHS (`\|`) | `style=dotted`  | `edge implicit-output` |
+| `OrderOnly`      | double pipe (`\|\|`)      | `style=dashed`  | `edge order-only`      |
+
+`ImplicitDep` carries Ninja's single-pipe implicit inputs — header files
+or schemas that trigger a rebuild without appearing in `$in`. The bold
+stroke reads as "rebuild-triggering hidden input," distinguishing it from
+the dashed order-only stroke (no rebuild trigger) and the dotted
+implicit-output stroke (auxiliary output side).
+
+A new renderer — for example the `--json` view planned for roadmap item
+`3.15.6` — should be added as a sibling module under `src/graph_view/` that
+implements `GraphRenderer`. The runner dispatch in
+[`src/runner/mod.rs`](../src/runner/mod.rs) picks the appropriate renderer
+based on `GraphArgs` and writes through the shared
+`write_text_file`/`write_text_stdout` sink helpers. The `-` sentinel for
+`--output` is recognised by `process::is_stdout_path`.
+
+`--html` and `--output` are explicitly excluded from `OrthoConfig` layering:
+they are per-invocation arguments tagged `#[serde(skip)]` on
+[`GraphArgs`](../src/cli/mod.rs). Layering `--output` through a config file
+would silently change the artefact destination — a footgun the design avoids
+by construction.
+
 ## Quality gates
 
 Run these commands before finalizing any change:
diff --git a/docs/execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md b/docs/execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md
new file mode 100644
index 00000000..ee77b59e
--- /dev/null
+++ b/docs/execplans/3-4-5-extend-graph-subcommand-with-an-html-renderer.md
@@ -0,0 +1,1283 @@
+# 3.4.5. Extend the `graph` subcommand with an `--html` renderer
+
+This ExecPlan (execution plan) is a living document. The sections
+`Constraints`, `Tolerances`, `Risks`, `Progress`, `Surprises & Discoveries`,
+`Decision Log`, and `Outcomes & Retrospective` must be kept up to date as
+work proceeds.
+
+Status: COMPLETE (Stages A–D 2026-05-26; Stage E 2026-06-03).
+
+## Purpose / big picture
+
+After this work, a sighted user can produce a self-contained, offline-safe
+HTML file from any Netsuke manifest with
+`netsuke graph --html --output graph.html` and open it in a browser to see
+the build dependency graph rendered as SVG. Automation still receives the
+canonical DOT graph from `netsuke graph` on stdout, preserving the raw graph
+data contract. A new `--output <FILE>` flag, shared by both DOT and HTML
+emission, writes the chosen artefact to disk with the same atomic-write
+semantics already used by `netsuke manifest`, and a `-` sentinel selects
+stdout — matching the precedent set by
+[`manifest`](../netsuke-design.md#83-command-behaviour).
+
+This task implements roadmap item
+[`3.4.5`](../roadmap.md) ("Extend the graph subcommand with an optional
+`--html` renderer"). The CLI design contract for the split between an HTML
+view (sighted users) and structured graph inspection (`--json`, screen
+readers, automation) is recorded in
+[`netsuke-cli-design-document.md`](../netsuke-cli-design-document.md) and in
+[`netsuke-design.md` §8.3](../netsuke-design.md). The HTML and structured
+JSON inspection paths share a single domain projection so both can be added
+without rewriting the IR boundary later. JSON output of the graph is *out of
+scope* for this execplan and remains a follow-up roadmap item.
+
+Observable success means **all** of the following hold simultaneously:
+
+1. `netsuke graph` (no flags) writes DOT to stdout, with byte-identical
+   output across repeated runs against the same manifest.
+2. `netsuke graph --output build.dot` writes DOT to `build.dot` and writes
+   nothing to stdout. Relative `--output` paths resolve under
+   `-C/--directory` when set, exactly like `build --emit`.
+3. `netsuke graph --output -` writes DOT to stdout (explicit sentinel form).
+4. `netsuke graph --html` writes a single, self-contained HTML document to
+   stdout. The document loads and renders in Firefox, Chromium, and Safari
+   with no network access.
+5. `netsuke graph --html --output graph.html` writes the same HTML document
+   to `graph.html`.
+6. The HTML view contains a server-rendered, deterministic SVG of the
+   dependency graph plus an accessible textual outline of targets and
+   dependencies. It works with JavaScript disabled (the outline is the
+   fallback).
+7. Two runs with `HashMap` insertion order shuffled produce byte-identical
+   HTML; a `proptest` covers this.
+8. Snapshot tests under
+   [`src/snapshots/`](../../src/snapshots) verify the golden DOT and HTML
+   outputs for the smoke-manifest fixture.
+9. The user guide and the developer guide are updated to document the new
+   CLI surface and the graph view's domain-projection layer.
+10. `make check-fmt`, `make lint`, and `make test` all pass on the final
+    commit.
+11. `coderabbit review --agent` has been run after the final implementation
+    milestone and all concerns have been cleared.
+12. Roadmap entry `3.4.5` is checked off.
+
+## Constraints
+
+The following invariants must hold throughout implementation. Violating any
+of them requires escalation, not a workaround.
+
+1. **CLI doctrine.** Follow [ADR-003][adr-003]: no compatibility aliases
+   for the legacy graph behaviour, no mixing of subprocess output and JSON
+   diagnostics on stdout, `--force` and `--dry-run` reserved for
+   destructive or consequential mutations. Neither applies here:
+   `--output` writing a new file is not destructive in the ADR's sense,
+   and overwriting an existing path uses standard cap-std write
+   semantics — not in-place mutation. The existing [`write_ninja_file`
+   helper][file-io] is the reference implementation.
+2. **Self-contained HTML.** The HTML artefact must render fully with no
+   network access. No CDN references, no external fonts, no remote scripts.
+3. **Deterministic output.** Same input must yield byte-identical output.
+   `HashMap` iteration is the dominant source of non-determinism in
+   [`src/ir/graph.rs`](../../src/ir/graph.rs); the new `GraphView` projection
+   must canonicalise sort order at the IR boundary, mirroring
+   [`src/ninja_gen.rs`](../../src/ninja_gen.rs) which already sorts before
+   emission.
+4. **Hexagonal boundaries.** Render code is an adapter, not a domain
+   concern. Introduce a `GraphView` domain projection and a `GraphRenderer`
+   port; the DOT and HTML adapters consume only `GraphView` and never each
+   other. See [`hexagonal-architecture`](../../README.md) skill for the
+   doctrine.
+5. **No `print_stdout` or `print_stderr`.** Both are denied at the workspace
+   level ([`Cargo.toml`](../../Cargo.toml)). All writes go through structured
+   writers in the runner.
+6. **File size policy.** Per [`AGENTS.md`](../../AGENTS.md), no single source
+   file may exceed 400 lines.
+7. **Localization.** Every new user-facing string must have Fluent keys in
+   both `locales/en-US/messages.ftl` and `locales/es-ES/messages.ftl`. The
+   HTML page's `<title>`, `<desc>`, outline heading, and `<noscript>`
+   fallback text are user-facing and must be localized.
+8. **OrthoConfig layering.** Subcommand-scoped flags (`--html`, `--output`)
+   are per-invocation arguments and **must not** layer through OrthoConfig
+   configuration files. Layering `--output` would silently change where
+   `netsuke graph` writes its artefact, which is a footgun. Keep these
+   fields out of `CliConfig` and tag them `#[serde(skip)]` where they
+   appear on the parser struct.
+9. **Pre-0.1.0 freedom.** No compatibility aliases for the previous
+   ninja-mediated DOT output. Output is allowed to differ byte-for-byte from
+   the pre-existing `ninja -t graph` text. ADR-003 endorses removing legacy
+   spellings rather than adding aliases.
+10. **License compatibility.** Any new dependency must be licensed
+    compatibly with Netsuke's ISC license (MIT, BSD-2/3, Apache-2.0, ISC,
+    MPL-2.0, EPL-2.0). Verify before adding the layout crate. Reject GPL
+    family unless a separately licensed embedded asset has a clearly
+    documented exemption.
+11. **Binary size.** The release binary must not grow by more than 1 MB net
+    after this change. If the chosen renderer would breach this, gate it
+    behind a non-default cargo feature flag named `html-renderer` and
+    document the trade-off in the user guide.
+12. **Ninja-mediated DOT removal.** The `Commands::Graph` dispatcher no
+    longer invokes `ninja -t graph`. Tests that previously asserted Ninja
+    tool dispatch for `graph` (see the [tool-subcommand test
+    file][tool-tests]) must be updated to assert the new in-process
+    behaviour, not retained against the old.
+
+## Tolerances (exception triggers)
+
+Thresholds that trigger escalation, not quality targets. Adjust only with
+explicit agreement.
+
+1. **Scope.** Stop and escalate if the implementation requires changes to
+   more than 30 files or more than 2 500 net new lines of code. The expected
+   scope is roughly 15 files and 1 500 lines.
+2. **New dependencies.** Stop and escalate if implementation requires more
+   than one new third-party crate. The expected new dependency is a single
+   pure-Rust graph layout crate or, as a documented fallback, a single
+   vendored JavaScript and WebAssembly bundle.
+3. **Public interface drift.** Stop and escalate if any existing public API
+   must change signature in a breaking way that affects callers outside the
+   files touched by this plan. Adding new public modules under
+   `src/graph_view/` is in scope; modifying `src/ir/graph.rs`,
+   `src/cli/mod.rs::Cli`, or the `OrthoConfig`-derived layering is out of
+   scope beyond the minimal additions required for `Commands::Graph(...)`.
+4. **Layout-crate go/no-go gate.** During the Stage C prototyping
+   milestone, evaluate the candidate Rust layout crate against the
+   acceptance criteria in
+   [Plan of work](#plan-of-work). If any acceptance criterion is unmet,
+   stop and escalate before proceeding to the vendored-WASM fallback. Do
+   not silently switch renderers.
+5. **HTML artefact size.** Stop and escalate if the smoke-fixture HTML
+   exceeds 1 MB, or if any realistic project manifest in
+   [`examples/`](../../examples) produces an HTML file larger than 5 MB.
+6. **Iterations.** If `make lint`, `make test`, or `make markdownlint`
+   continue to fail after three focused fix-and-rerun cycles inside a
+   single stage, stop and escalate with a written summary of the failures.
+7. **Time.** If a single stage takes more than four hours of wall-clock
+   work without measurable progress, stop and escalate.
+8. **Ambiguity.** If a user-visible behaviour is genuinely ambiguous and
+   the choice changes the public surface (for example: should
+   `--html --output -` write HTML to stdout? — yes, per consistency with
+   `manifest -`; but if any analogous case arises that this plan does not
+   resolve), stop and present options with trade-offs.
+
+## Risks
+
+Anticipated uncertainties identified before work begins. Update as work
+proceeds.
+
+- Risk: the Rust graph layout crate produces visually unsatisfactory or
+  non-deterministic output for realistic Netsuke graphs.
+  Severity: medium. Likelihood: medium.
+  Mitigation: prototyping milestone with explicit acceptance gates; documented
+  vendored-WASM fallback if the gate fails. Pin the chosen crate to an exact
+  version and add a proptest covering shuffled IR-insertion-order
+  determinism.
+
+- Risk: license audit on the chosen layout crate uncovers an incompatible
+  transitive dependency. Severity: medium. Likelihood: low.
+  Mitigation: `cargo deny check licenses` style audit at Stage C start;
+  fall back to vendored viz-js (MIT JS + EPL-2.0 WASM) if needed.
+
+- Risk: ninja-mediated DOT removal breaks downstream scripts that grep the
+  current output. Severity: low. Likelihood: low.
+  Mitigation: pre-0.1.0, no compatibility contract exists. The roadmap text
+  for `3.4.5` explicitly says "keep raw graph data available for automation",
+  which the in-process DOT generator satisfies. Document the change in the
+  user guide release notes block.
+
+- Risk: HTML rendering for very large graphs (thousands of edges) makes
+  the page slow or unreadable. Severity: medium. Likelihood: medium for
+  monorepo users, low for typical projects.
+  Mitigation: bound visualisation via the upcoming `--target` and `--depth`
+  flags (roadmap item `3.15.6`); for this plan, stub the boundary in the
+  `GraphView` constructor and document the bounding behaviour as deferred.
+  Emit a truncation hint in the HTML if the graph exceeds an opt-in soft
+  limit (default: 500 nodes); the user can override the cap with an
+  `unbounded` HTML mode added in the same execplan.
+
+- Risk: accessibility regression. The HTML is the sighted-user surface and
+  the `--json` graph view is deferred; users who depend on screen readers
+  have no fallback in the meantime. Severity: medium. Likelihood: low if
+  the textual outline is implemented well.
+  Mitigation: server-side render the SVG with `role="img"`, `<title>`, and
+  `<desc>` elements; embed a `<details>` block containing a plain-text
+  outline of every target and its inputs. The outline is the
+  screen-reader-friendly representation until the structured `--json` view
+  ships.
+
+- Risk: HashMap iteration leaks into the renderer and produces
+  non-deterministic output despite the projection layer. Severity: high.
+  Likelihood: medium without explicit testing.
+  Mitigation: shuffled-insertion-order proptest at the `GraphView`
+  boundary; insta snapshot tests on the smoke-fixture HTML.
+
+- Risk: the existing [`runner_tool_subcommands_tests`][tool-tests] asserts
+  behaviour that this plan replaces. Failing to update those tests will
+  fail CI but with a confusing error. Severity: low. Likelihood: high.
+  Mitigation: explicitly call out the test updates in Stage B's concrete
+  steps.
+
+- Risk: localized HTML labels break the Fluent build-time audit. Severity:
+  low. Likelihood: low. Mitigation: add all new keys to both the `en-US`
+  and `es-ES` catalogues and to the `ALL_KEYS` array in
+  [`src/localization/keys.rs`][l10n-keys]. The build-time audit will catch
+  any miss.
+
+- Risk: `--diag-json` interaction surprises users. Severity: low.
+  Likelihood: medium.
+  Mitigation: `--diag-json` only governs diagnostic output on stderr;
+  graph artefact on stdout is unchanged. Document this in the user guide
+  and add a BDD scenario asserting it.
+
+## Progress
+
+Tick items as work completes. Each transition between stages must include
+a timestamp.
+
+- [x] Plan approved by the user.
+- [x] Stage A: `GraphView` domain projection landed with order-independence
+      proptest. (2026-05-26)
+- [x] Stage B: `Commands::Graph(GraphArgs)`, `--output` flag, in-process
+      DOT renderer, fixture-update sweep for the runner-tool-subcommands
+      integration tests. (2026-05-26)
+- [x] Stage C: HTML renderer (server-rendered SVG + accessible outline +
+      `<noscript>` fallback). Go/no-go gate resolved in favour of a
+      zero-dependency hand-rolled layered SVG layout (2026-05-26); see the
+      decision log entry and Surprises & discoveries.
+- [x] Stage D: localization, accessibility polish, BDD scenarios,
+      user-guide and developer-guide updates, ADR-004. (2026-05-26)
+- [x] Stage E: project `BuildEdge.implicit_deps` through `GraphView`
+      with a new `EdgeClass::ImplicitDep` variant. DOT renders as
+      `[style=bold]`; HTML uses `.edge.implicit-dep` (the prior
+      ambiguous `.edge.implicit` was renamed `.edge.implicit-output`).
+      Developer guide gained an edge-class taxonomy table.
+      (2026-06-03)
+- [x] `make check-fmt`, `make lint`, `make test`, `make markdownlint`, and
+      `make nixie` pass on the final commit. (2026-05-26)
+- [x] `coderabbit review --agent` clear after each stage commit. All five
+      stages cleared with zero findings (Stage D cleared 2026-05-26 after
+      the rate-limit window; Stage E cleared 2026-06-03).
+- [x] Roadmap entry `3.4.5` ticked off in `docs/roadmap.md`. (2026-05-26)
+- [x] Branch pushed and draft PR opened. (PR #312 opened during plan
+      drafting; updated by each stage commit.)
+
+## Surprises & discoveries
+
+- 2026-05-26 (Stage A): the first proptest formulation generated `BuildGraph`
+  instances with output paths colliding across distinct edges. Such graphs
+  cannot occur in practice because `from_manifest` raises
+  `IrGenError::DuplicateOutput` before the IR reaches the projection layer.
+  The shrunk failing case exposed this as a `last-insert-wins` divergence
+  between two non-deterministic `HashMap` orderings of `targets`. Filtered
+  the generator to enforce globally-disjoint outputs and re-shaped the
+  property to insert each edge set in forward and reversed order — the
+  `RandomState` per `HashMap` already varies iteration order, so the
+  reversal is belt-and-braces evidence that `from_build_graph` does not
+  leak `HashMap` order.
+- 2026-05-26 (Stage A): `proptest` was not previously a workspace dev-
+  dependency. Added `proptest = "1.5"` to `[dev-dependencies]`. No
+  production-side dependency added.
+- 2026-05-26 (Stage B): the existing `tests/logging_stderr_tests.rs`
+  `diag_json_success_discards_child_stderr` case asserted that ninja's
+  stderr (via a fake ninja script) was suppressed under `--diag-json
+  graph`. Since `graph` no longer spawns ninja, the test name and
+  rationale are now stale. Renamed to `diag_json_success_graph_keeps_
+  clean_stderr` and rewritten to assert the in-process graph dispatch
+  produces a `digraph netsuke` document on stdout with clean stderr. The
+  associated `write_fake_ninja_script` / `make_script_executable`
+  helpers were removed.
+- 2026-05-26 (Stage B): `tests/runner_tool_subcommands_tests.rs` retained
+  the `clean` scenarios as planned; graph-specific fixtures
+  (`ninja_expecting_graph`) and failure-propagation cases were removed.
+  In-process graph coverage now lives in `tests/runner_graph_tests.rs`
+  and `tests/features_unix/graph.feature`.
+- 2026-05-26 (Stage C): the workspace `integer_division` /
+  `integer_division_remainder_used` clippy denials caught `/ 2` in the
+  layout code. Replaced with a precomputed `NODE_HEIGHT_HALF` constant
+  (`NODE_HEIGHT >> 1`) and an arithmetic right shift `((x2 - x1) >> 1)`
+  for the orthogonal-connector midpoint. The shift is safe because the
+  layout is strictly left-to-right (`x2 >= x1`).
+- 2026-05-26 (Stage C): `self_named_module_files` is denied at the
+  workspace level, so `src/graph_view/render_html/mod.rs` is forbidden.
+  Tests live in `src/graph_view/render_html_tests.rs` and are reached
+  via `#[path = "render_html_tests.rs"] mod tests;` in
+  `render_html.rs`. Same pattern is the project's standard escape from
+  the lint.
+- 2026-05-26 (Stage B): `write_ninja_file_utf8` became a thin wrapper
+  with no callers outside its own test, so it was removed in favour of
+  the new `write_text_file_utf8` helper that the runner and Stage C HTML
+  renderer will share. `write_ninja_file` and `write_ninja_stdout`
+  remain as `NinjaContent`-typed wrappers around `write_text_file` and
+  `write_text_stdout` per the plan.
+
+## Decision log
+
+Initial decisions captured from the planning consultation with the Wyvern
+team. Add further decisions as work proceeds.
+
+- Decision: render the HTML view from the in-memory
+  [`BuildGraph`](../../src/ir/graph.rs) IR rather than by post-processing
+  the output of `ninja -t graph`. Rationale: the IR already carries every
+  field the HTML needs (action descriptions, pool, `restat`, `phony`,
+  `always`, order-only edges); skipping the Ninja round-trip removes a
+  determinism risk (Ninja's DOT output references the temporary build file
+  path) and one external dependency from the `--html` path.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: migrate the no-flag DOT path to the same in-process renderer in
+  this execplan, rather than keeping a parallel `ninja -t graph` invocation
+  alongside a new in-process HTML renderer. Rationale: two DOT emitters with
+  subtly different output is worse than one switch; pre-0.1.0 allows the
+  byte-level change. Trade-off recorded under Risks.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: prefer pure-Rust server-side SVG rendering (no JavaScript
+  required at view time) as the primary path. Rationale: smallest artefact,
+  best accessibility, no vendored JS bundle, license-clean. Documented
+  fallback to vendored viz-js + WebAssembly bundle if the pure-Rust crate
+  fails the Stage C acceptance gate.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: defer `--json` graph inspection to a follow-up roadmap item,
+  but design the `GraphView` projection so the structured JSON view can be
+  added as a third adapter without re-projecting the IR.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: `--output` is a per-invocation subcommand flag and is not
+  exposed through OrthoConfig layering. Rationale: layering `--output`
+  through a config file would silently change where artefacts are written
+  on every invocation.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: `--output -` is the explicit stdout sentinel. Absence of
+  `--output` also writes to stdout, matching the existing
+  [`manifest`](../../src/cli/mod.rs) precedent.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: bounding (`--target`, `--depth`) is roadmap item `3.15.6` and
+  is deferred. Reserve `GraphView::limit` in this plan as a `None`-valued
+  stub so the follow-up patch is additive.
+  Date/Author: 2026-05-22, planning.
+
+- Decision: at the Stage C go/no-go gate, neither the `layout` crate nor
+  the vendored viz-js fallback was adopted. Instead, the HTML renderer
+  uses a hand-rolled topological-depth layered SVG layout written inline
+  in `src/graph_view/render_html.rs`. Rationale: the layout crate adds
+  approximately 8 transitive dependencies and ~700 KB of release binary
+  growth even for the smoke fixture, exceeding the 1 MB net budget when
+  combined with other in-flight features. The vendored viz-js fallback
+  ships a 3 MB WASM blob per HTML artefact, exceeding the 5 MB
+  per-realistic-project ceiling on large graphs. The hand-rolled layered
+  SVG has weaker visual fidelity for very large graphs but: (1) keeps
+  binary growth at zero new dependencies; (2) preserves byte-for-byte
+  determinism (covered by `rendering_is_byte_identical_across_runs`);
+  (3) keeps license posture trivial (only first-party ISC code); (4)
+  satisfies the accessibility brief via per-node `aria-label`s, edge
+  `<title>`s, and a textual outline. The `layout` crate remains a
+  documented future option should the visual quality bar tighten.
+  Date/Author: 2026-05-26, Stage C implementation.
+
+## Outcomes & retrospective
+
+- **Stage A (2026-05-26):** `GraphView` projection landed with a 256-case
+  proptest covering shuffled-insertion equivalence. No third-party
+  dependency added on the production side; `proptest = "1.5"` joined
+  `[dev-dependencies]`. `coderabbit review --agent` reported zero
+  findings.
+- **Stage B (2026-05-26):** the `Commands::Graph` variant became
+  `Graph(GraphArgs)` with `--html` and `--output`. The runner dispatch
+  no longer invokes `ninja -t graph`. Five test surfaces touched:
+  unit tests in `src/runner/process/file_io.rs`, a new
+  `tests/runner_graph_tests.rs`, the `cli.feature` BDD steps and
+  scenarios, the `features_unix/graph.feature` rewrite, and the
+  `logging_stderr_tests.rs::diag_json_success_*` case (renamed and
+  rewritten because graph no longer touches Ninja). The
+  `runner_tool_subcommands_tests.rs` file retained the `clean` cases
+  only. `coderabbit review --agent` reported zero findings.
+- **Stage C (2026-05-26):** the HTML renderer landed without any new
+  dependency. The Stage C go/no-go gate accepted a hand-rolled
+  topological-depth layered SVG layout in `render_html.rs`; the
+  `layout` crate and the vendored viz-js fallback were both rejected
+  for binary-size reasons (see Decision log). The renderer produces a
+  byte-identical document across runs (proven by
+  `rendering_is_byte_identical_across_runs`) and exposes per-node
+  `aria-label`s plus per-edge `<title>`s for accessibility.
+  `coderabbit review --agent` reported zero findings.
+- **Stage D (2026-05-26):** user-guide section 12.2 and the top-level
+  subcommand summary were rewritten to describe the in-process renderer
+  and the new flags. `docs/netsuke-design.md` §8.3 was updated to drop
+  the "planned for a later milestone" caveat and now describes the
+  `GraphView` projection and renderer port. The CLI design document
+  marks `--html` as shipped and `--json` as the open follow-up. The
+  developer guide gained a new section documenting the port/adapter
+  layout. ADR-004 records the migration off Ninja for the `graph`
+  dispatch. Roadmap item 3.4.5 was ticked. `make check-fmt`, `make
+  lint`, `make test`, `make markdownlint`, and `make nixie` all
+  passed.
+
+Retrospective lessons:
+
+- The shuffled-insertion proptest exposed an over-permissive input
+  space (two edges sharing an output) that `from_manifest` would
+  reject upstream as `DuplicateOutput`. Constraining the generator
+  rather than tolerating the noise produced a sharper invariant. Reuse
+  the "disjoint outputs" filter when adding further `BuildGraph`
+  proptests.
+- Hand-rolling the HTML layout was the right call given the workspace
+  binary-size budget and the simplicity of typical Netsuke graphs.
+  Should the visual quality bar tighten, revisit the `layout` crate
+  through the same go/no-go gate.
+- The `self_named_module_files` clippy denial requires
+  `#[path = "..."] mod tests;` for per-module test files. Document
+  this once and reuse the pattern across the project.
+
+## Context and orientation
+
+A novice opening this plan with only the current working tree should be
+able to navigate the change without further documents. The relevant files
+and what they contribute today are:
+
+- [`src/ir/graph.rs`](../../src/ir/graph.rs) — the `BuildGraph` IR. Holds
+  `actions: HashMap<String, Action>`,
+  `targets: HashMap<Utf8PathBuf, BuildEdge>`, and
+  `default_targets: Vec<Utf8PathBuf>`. This IR is the domain object the
+  plan projects to a deterministic view.
+
+- [`src/ir/from_manifest.rs`](../../src/ir/from_manifest.rs) — builds the
+  IR from a parsed `NetsukeManifest`. Not modified by this plan.
+
+- [`src/ninja_gen.rs`](../../src/ninja_gen.rs) — the existing Ninja-text
+  renderer. The deterministic-sort pattern at `generate_into` (sorts
+  actions by key, edges by `path_key`, defaults lexicographically) is the
+  precedent every new renderer must follow.
+
+- [`src/runner/mod.rs`](../../src/runner/mod.rs) — the command dispatcher.
+  `Commands::Graph` currently runs `handle_ninja_tool` which writes a
+  temporary Ninja file and runs `ninja -t graph` against it, streaming
+  child stdout straight to the user's stdout. This plan replaces that
+  dispatch with an in-process renderer.
+
+- [`src/runner/process/file_io.rs`](../../src/runner/process/file_io.rs) —
+  cap-std-based file writers. `is_stdout_path` recognises the `-` sentinel;
+  `write_ninja_file` performs the atomic-write dance with parent-directory
+  creation; `write_ninja_stdout` writes to a locked stdout handle. These
+  helpers must be generalised to take arbitrary text content, not just
+  `NinjaContent`.
+
+- [`src/runner/path_helpers.rs`](../../src/runner/path_helpers.rs) —
+  `resolve_output_path` interprets relative paths under `-C/--directory`.
+  Both `--emit` (build) and `manifest <FILE>` already depend on it; the
+  new `--output` flag must reuse it.
+
+- [`src/cli/mod.rs`](../../src/cli/mod.rs) — clap-derived CLI definition.
+  The `Commands` enum and `BuildArgs`-style sibling struct pattern is the
+  precedent for the new `GraphArgs` payload.
+
+- [`src/cli/config.rs`](../../src/cli/config.rs) — `CliConfig`, the
+  OrthoConfig-merged preferences view. `--html` and `--output` do **not**
+  belong here.
+
+- [`src/localization/keys.rs`](../../src/localization/keys.rs) and
+  `locales/en-US/messages.ftl` plus `locales/es-ES/messages.ftl` — Fluent
+  message registry. Every new user-facing string adds keys here.
+
+- [`src/snapshots/`](../../src/snapshots) and the `insta` infrastructure
+  in [`src/snapshot_test_support.rs`](../../src/snapshot_test_support.rs)
+  — the precedent for snapshot-based golden output testing. New snapshots
+  for the smoke-fixture DOT and HTML belong under `src/snapshots/graph/`.
+
+- [`tests/features/cli.feature`][cli-feature] and the BDD step files
+  under [`tests/bdd/steps/`](../../tests/bdd/steps) — the behavioural
+  test surface. [`runner_tool_subcommands_tests`][tool-tests] is the
+  unit-test surface that currently asserts the Ninja-tool dispatch for
+  `graph`; it must be updated, not retained.
+
+Definitions used in this plan:
+
+- **GraphView**: a deterministic, sorted projection of `BuildGraph` keyed
+  by canonical node identifiers. It is the domain port that the renderer
+  adapters consume.
+
+- **GraphRenderer**: a trait owning the contract
+  `fn render(&self, view: &GraphView, sink: &mut dyn io::Write) -> Result<()>`.
+
+- **Sink**: a polymorphic write target. In this plan, either a stdout lock
+  (`io::Stdout::lock`) or a cap-std file handle.
+
+- **Server-side rendering**: SVG produced by Netsuke (the "server") before
+  the HTML file is written. The browser displays the SVG without any
+  JavaScript that performs layout. Optional client-side enhancement (pan,
+  zoom) is allowed only if it is hand-authored, small (under 100 lines),
+  inline, and not load-bearing for correctness.
+
+- **`-` sentinel**: the literal `-` argument to `--output` is interpreted
+  as stdout, matching `manifest -` semantics.
+
+## Plan of work
+
+Work is structured as four stages with go/no-go gates between them. Each
+stage ends with `make check-fmt && make lint && make test` passing on a
+fresh commit; the next stage cannot start until the gate is clean. Stage C
+adds a prototyping go/no-go gate for the renderer technology choice.
+
+### Stage A — `GraphView` domain projection
+
+Goal: introduce a deterministic projection of `BuildGraph` that every
+renderer will consume. No user-visible behaviour change. Pure scaffolding.
+
+1. Create `src/graph_view/mod.rs` exposing:
+
+   ```rust
+   pub struct GraphView {
+       pub default_targets: Vec<Utf8PathBuf>,
+       pub nodes: Vec<NodeView>,
+       pub edges: Vec<EdgeView>,
+   }
+   ```
+
+   `NodeView` represents both target outputs and source files (the graph
+   is bipartite in concept but flat here, mirroring `ninja -t graph`).
+   `EdgeView` records `from`, `to`, `action_id`, plus the dependency
+   class (`Explicit`, `OrderOnly`, or `ImplicitOutput`).
+
+2. `GraphView::from_build_graph(graph: &BuildGraph) -> Self` performs the
+   canonical sort once and exclusively:
+
+   - Nodes are derived from `graph.targets` keys and from every input,
+     implicit-output, and order-only path, deduplicated, then sorted by
+     `Utf8PathBuf` lexicographic order.
+   - Edges are sorted by `(from, to, action_id)` after construction.
+   - `default_targets` is `graph.default_targets.clone()` followed by a
+     stable sort.
+
+3. Add `src/graph_view/render.rs` declaring the `GraphRenderer` trait and
+   a `GraphRenderError` variant set (initially `Format(fmt::Error)` and
+   `Io(io::Error)`).
+
+4. Unit tests under `src/graph_view/tests.rs`:
+
+   - `rstest` parametric cases covering empty graphs, single-target
+     graphs, and multi-edge fan-in/fan-out.
+   - `proptest` confirming `GraphView::from_build_graph` produces equal
+     views for inputs whose `HashMap` insertion order differs (force this
+     by inserting into a fresh `BuildGraph` in a randomised order).
+
+5. Wire the new module into [`src/lib.rs`](../../src/lib.rs) so the
+   build-time audit picks up any new symbols.
+
+6. **Stage A acceptance**:
+
+   - `cargo test -p netsuke graph_view::tests` passes.
+   - The proptest covers at least 256 cases with shrinking and reports no
+     failures over 60 seconds.
+   - No public behaviour change visible to existing tests.
+
+### Stage B — `Commands::Graph(GraphArgs)`, `--output`, in-process DOT
+
+Goal: replace the Ninja-mediated DOT path with an in-process DOT renderer,
+and add the shared `--output` flag.
+
+1. In [`src/cli/mod.rs`](../../src/cli/mod.rs), replace the bare
+   `Commands::Graph` variant with `Graph(GraphArgs)` and declare:
+
+   ```rust
+   #[derive(Debug, Args, PartialEq, Eq, Clone, Serialize, Deserialize)]
+   pub struct GraphArgs {
+       /// Render the graph as a self-contained HTML page instead of DOT.
+       #[arg(long)]
+       pub html: bool,
+
+       /// Write the graph artefact to FILE. Use `-` for stdout.
+       #[arg(long, value_name = "FILE")]
+       pub output: Option<PathBuf>,
+   }
+   ```
+
+   Mark `output` `#[serde(skip)]` so it never participates in OrthoConfig
+   serialization. The `html` field is also out of OrthoConfig scope per
+   Constraint 8.
+
+2. Add Fluent keys (en-US plus es-ES):
+
+   - `cli.subcommand.graph.about` (revise wording — graph emits a build
+     dependency graph; default format is DOT)
+   - `cli.subcommand.graph.long_about` (revise to describe `--html` and
+     `--output`)
+   - `cli.subcommand.graph.flag.html.help`
+   - `cli.subcommand.graph.flag.output.help`
+
+   Update [`src/localization/keys.rs`](../../src/localization/keys.rs)
+   `ALL_KEYS` accordingly. The build-time audit will catch missed
+   catalogue entries.
+
+3. Add `src/graph_view/render_dot.rs`:
+
+   ```rust
+   pub struct DotRenderer;
+   impl GraphRenderer for DotRenderer { /* ... */ }
+   ```
+
+   Emit a deterministic Graphviz DOT document from `GraphView`. Use a
+   stable `digraph "netsuke"` header, `subgraph cluster_actions` if and
+   only if the IR carries action descriptions worth grouping, and emit
+   edges with a uniform `[dir=forward]` style. Match Graphviz's escaping
+   rules using `format_args!`-style writes; no external dependency.
+
+4. In [`src/runner/mod.rs`](../../src/runner/mod.rs), replace the existing
+   `Commands::Graph` arm. The new dispatch:
+
+   - Resolves the manifest, loads it via the same pipeline as the
+     `manifest` subcommand (use the existing helper
+     `load_manifest_with_stage_reporting`).
+   - Builds the `BuildGraph` and projects it with
+     `GraphView::from_build_graph`.
+   - Constructs the appropriate renderer (DOT for Stage B, HTML in Stage
+     C) and a sink based on `args.output`:
+     - `None` or `Some("-")` ⇒ stdout sink obtained via
+       `io::stdout().lock()`.
+     - `Some(path)` ⇒ resolved via `resolve_output_path`, written via a
+       new generalised `write_text_file(path, content)` derived from
+       [`write_ninja_file`](../../src/runner/process/file_io.rs).
+   - Calls `renderer.render(&view, &mut sink)`.
+   - Reports completion via the existing `report_complete` channel using
+     a new localization key `STATUS_TOOL_GRAPH` (already present) plus a
+     new `STATUS_TOOL_GRAPH_HTML` for the HTML variant.
+
+5. Generalise `write_ninja_file` and `write_ninja_stdout` into
+   `write_text_file` and `write_text_stdout` accepting `&str`. Keep
+   `NinjaContent`-typed thin wrappers for existing callers so the change
+   to `manifest`/`build --emit` is mechanical.
+
+6. Update tests:
+
+   - [`runner_tool_subcommands_tests`][tool-tests] loses its
+     `ninja_expecting_graph` fixture and the
+     `run_graph_fails_with_failing_ninja` scenario; in their place add
+     tests asserting in-process DOT generation, success without Ninja
+     installed (the fake-ninja sets are no longer required), and the
+     `assert_subcommand_fails_with_invalid_manifest` path for `Graph`.
+   - [`tests/features/cli.feature`][cli-feature] gets new scenarios for
+     `graph --output build.dot`, `graph --output -`, and the implicit
+     `graph` writing DOT to stdout.
+   - The BDD step [`run_graph` in `tests/bdd/steps/process.rs`][bdd-graph]
+     no longer needs to mock Ninja for the graph case.
+
+7. Snapshot test under `src/snapshots/graph/` capturing the golden DOT
+   output for the canonical smoke manifest (use
+   [`examples/basic_c.yml`](../../examples/basic_c.yml) or
+   [`examples/hello-world/Netsukefile`](../../examples/hello-world/Netsukefile),
+   whichever yields the smallest non-trivial graph).
+
+8. **Stage B acceptance**:
+
+   - `cargo test --workspace` passes.
+   - `netsuke graph` produces DOT on stdout with no Ninja invocation
+     (verify by running with `NINJA_ENV=/usr/bin/false` set or by
+     checking the process tracing log).
+   - `netsuke graph --output /tmp/x.dot` writes DOT to that path and
+     prints nothing to stdout.
+   - `netsuke graph --output -` writes DOT to stdout.
+   - Snapshot test diff is clean.
+
+### Stage C — HTML renderer (prototyping milestone with go/no-go gate)
+
+Goal: produce a self-contained HTML document for `graph --html`. This
+stage has a prototyping milestone because the renderer technology choice
+depends on observed output quality.
+
+1. **Spike.** Add the `layout` crate (or an equivalent pure-Rust DOT-
+   consuming SVG renderer) to `Cargo.toml` as a temporary dependency
+   gated by `#[cfg(feature = "html-renderer-spike")]`. Implement a
+   throwaway `HtmlRenderer` that:
+
+   - consumes `&GraphView`;
+   - generates a DOT string in memory by delegating to the Stage B
+     `DotRenderer`;
+   - feeds the DOT string into the layout crate and captures the SVG;
+   - wraps the SVG in a minimal HTML skeleton.
+
+2. **Go/no-go gate.** The spike is accepted only if **all** of the
+   following hold against the smoke-manifest fixture used in Stage B's
+   snapshot:
+
+   - License of the crate plus every transitive dependency is in the
+     allowlist (Constraint 10). Run `cargo tree --workspace` and a manual
+     license scan; record the result in the Decision log.
+   - Two consecutive runs produce byte-identical HTML (use `cmp`).
+   - The SVG renders correctly in Firefox and Chromium (manual check; a
+     screenshot saved under `docs/screenshots/3-4-5/` is acceptable
+     evidence).
+   - Release-build binary size growth is under 1 MB (measure with
+     `cargo build --release` before and after, comparing the size of
+     `target/release/netsuke`).
+   - HTML artefact for the smoke fixture is under 200 KB.
+
+   If any criterion fails, stop and escalate. The documented fallback is
+   to vendor `@viz-js/viz` (v3 line, MIT JS plus EPL-2.0 WASM) under
+   `assets/vendor/viz-js/<pinned-version>/`, include the JS and WASM via
+   `include_bytes!` and `include_str!`, and produce an HTML page that
+   bootstraps the WASM client-side. The fallback adds approximately 3 MB
+   to each HTML artefact. Do not silently switch — escalate first.
+
+3. **Promote the spike** (assuming the gate passed). Move the
+   `HtmlRenderer` into `src/graph_view/render_html.rs` and drop the
+   `html-renderer-spike` cargo feature, unless the binary-size budget
+   dictates gating it behind a default-off feature (`html-renderer`).
+   The renderer constructs the document using a Rust string template:
+
+   ```rust
+   pub struct HtmlRenderer {
+       pub locale: Arc<dyn Localizer>,
+       pub limit: Option<usize>, // reserved for 3.15.6
+   }
+
+   impl GraphRenderer for HtmlRenderer { /* ... */ }
+   ```
+
+   The HTML skeleton:
+
+   - `<!doctype html>` plus a `<html lang>` attribute derived from the
+     active locale.
+   - `<head>` with `<meta charset="utf-8">`, `<title>` localized via
+     `graph.html.title`, a tiny inline `<style>` block with the CSS for
+     the SVG, the textual outline, and the optional pan-zoom control.
+   - `<body>` containing the SVG (with `role="img"`, `aria-labelledby`
+     referencing `<title>` and `<desc>` IDs), a `<details>` block
+     containing a `<summary>` localized via `graph.html.outline.summary`
+     and a nested `<ul>` outline of every target and its inputs, plus a
+     `<noscript>` block re-stating the DOT source verbatim inside
+     `<pre><code>`.
+   - Optional inline `<script>` (under 100 lines, hand-authored) that
+     adds pan and zoom. The page must remain fully functional with
+     JavaScript disabled.
+
+4. **Accessibility polish.**
+
+   - Every `<g>` representing a node carries an `aria-label` describing
+     the node by path.
+   - Every edge carries a `<title>` element so hovering shows the
+     relationship.
+   - The textual outline is the primary screen-reader path until the
+     `--json` view ships.
+   - Run a manual `axe-core` pass (browser DevTools) on the smoke-fixture
+     HTML and record outstanding warnings, if any, under
+     [Surprises & discoveries](#surprises--discoveries).
+
+5. **Localization.** Add Fluent keys:
+
+   - `graph.html.title`
+   - `graph.html.heading`
+   - `graph.html.description`
+   - `graph.html.outline.summary`
+   - `graph.html.outline.target_label`
+   - `graph.html.outline.no_inputs`
+   - `graph.html.noscript.notice`
+
+   Update `ALL_KEYS` in `src/localization/keys.rs` and both Fluent
+   catalogues.
+
+6. **Stage C acceptance**:
+
+   - `cargo test --workspace` passes.
+   - `netsuke graph --html --output graph.html` produces a file that
+     renders cleanly in Firefox and Chromium with no network access. A
+     screenshot is committed under `docs/screenshots/3-4-5/`.
+   - The HTML opens correctly with JavaScript disabled (the SVG plus the
+     `<details>` outline remain usable).
+   - Snapshot test for the HTML golden output is clean.
+   - Proptest from Stage A still passes when extended to cover the HTML
+     renderer (shuffled-IR equivalence).
+
+### Stage D — Documentation, BDD, polish
+
+Goal: align documentation, behavioural tests, and the developer guide
+with the new surface.
+
+1. Update [`docs/users-guide.md`](../../docs/users-guide.md) so the
+   `graph` subsection describes the new flags, the `-` sentinel, and the
+   `-C/--directory` interaction. Replace the placeholder sentence that
+   says "Future versions may support other formats like `--html`."
+
+2. Update [`docs/netsuke-design.md`](../../docs/netsuke-design.md) section
+   8.3 to drop the "An optional `--html` renderer is planned for a later
+   milestone." caveat and instead describe the in-process rendering path,
+   the `GraphView` projection, and the renderer port.
+
+3. Update [the CLI design document][cli-design] to mark the `--html`
+   option as shipped and to note that `--json` is the open follow-up.
+
+4. Update [`docs/developers-guide.md`](../../docs/developers-guide.md)
+   with a new section documenting the graph-view domain projection, the
+   `GraphRenderer` port, and where new renderers (for example a future
+   JSON renderer) should be added.
+
+5. Decide whether to record the architectural decisions in an ADR. The
+   migration off `ninja -t graph` for the `graph` subcommand is
+   substantive enough to warrant an ADR. Add
+   `docs/adr-004-graph-subcommand-in-process-rendering.md` if the team
+   agrees during the Stage D review; otherwise add a Decision log entry
+   here and link from the design document. (Default: write the ADR.)
+
+6. Add BDD scenarios under `tests/features/cli.feature` and a new
+   `tests/features/graph.feature` covering:
+
+   - `graph` writes DOT to stdout.
+   - `graph --output graph.dot` writes DOT to file.
+   - `graph --output -` writes DOT to stdout.
+   - `graph --html` writes HTML to stdout.
+   - `graph --html --output graph.html` writes HTML to file.
+   - `graph --html --diag-json` writes HTML to stdout and JSON
+     diagnostics to stderr on failure.
+   - Relative `--output` paths resolve under `-C/--directory`.
+   - The HTML output validates as well-formed XML (a structural sanity
+     check via a small parser in the test, not a strict XHTML doctype).
+
+7. Run `coderabbit review --agent` after the Stage D commit and clear all
+   concerns before opening the implementation PR. The Stage D commit is
+   the final milestone for this execplan.
+
+8. Tick roadmap item `3.4.5` in [`docs/roadmap.md`](../../docs/roadmap.md).
+
+9. **Stage D acceptance**:
+
+   - `make check-fmt`, `make lint`, `make test`, `make markdownlint`, and
+     `make nixie` pass.
+   - User guide and developer guide read coherently after the change.
+   - All BDD scenarios pass.
+   - Roadmap entry is ticked.
+
+### Stage E — Project `implicit_deps` through the graph view
+
+Goal: surface Ninja implicit inputs (`BuildEdge.implicit_deps`, added by
+roadmap item 3.14.3 in commit `45a7d95`) as first-class edges in every
+rendered artefact. Before this stage, `GraphView::from_build_graph`
+silently drops every `implicit_deps` entry, so manifests that use
+`deps:` for header files or schema regeneration appear in `--html` and
+DOT output with the corresponding edges missing. That is a fidelity bug:
+the rendered graph and the build graph disagree on what triggers a
+rebuild.
+
+The stage adds one new `EdgeClass` variant, threads it through the two
+renderers, and keeps the domain port's hexagonal contract intact —
+adapters continue to read `GraphView` only.
+
+1. **Extend `EdgeClass` in [`src/graph_view/mod.rs`][graph-view-mod].**
+   Add `ImplicitDep` between `Explicit` and `ImplicitOutput` so the
+   derived `Ord` keeps edges from the same source clustered visually
+   when sorted. The variant means *source is an implicit dependency*
+   regardless of destination; the implicit-output-ness of the
+   destination is already encoded in the rendered node — recording it
+   redundantly on the edge would force a 2-D class enum without a
+   commensurate user-visible payoff.
+
+2. **Project the new field in `register_inputs_and_edges`.** Iterate
+   `edge.implicit_deps` after `edge.inputs`, registering each path as
+   `NodeKind::Source` if not already a target, and emit
+   `EdgeClass::ImplicitDep` edges to every explicit and implicit
+   output. Preserve the existing `BTreeSet<EdgeView>` dedup; a path
+   that appears as both an explicit input and an implicit dep produces
+   two distinct edges (different class), which is faithful to the
+   underlying IR.
+
+3. **Update [`DotRenderer`][graph-view-dot].** Match `ImplicitDep` in
+   `write_edge` to `[style=bold]`. Bold is the remaining unused stroke
+   in the existing visual lexicon (solid, dotted, dashed) and reads as
+   "rebuild-triggering but not in `$in`" — the precise semantics of a
+   Ninja implicit input. Cover the new style with a unit test under
+   `render_dot::tests`.
+
+4. **Update [`HtmlRenderer`][graph-view-html].** Rename the existing
+   ambiguous `.edge.implicit` CSS class to `.edge.implicit-output` to
+   prevent the new class from overloading the same name. Add a new
+   `.edge.implicit-dep` rule with a thicker stroke (`stroke-width:
+   2.4`) — visually denser than the explicit case to read as
+   "rebuild-triggering hidden input." Emit the new class from
+   `write_svg_edge` for `ImplicitDep`. Add tests in
+   [`render_html_tests.rs`][graph-view-html-tests] asserting the CSS
+   rule and class attribute appear when an implicit dep is present.
+
+5. **Cover projection with unit and property tests.** Add an `rstest`
+   in [`src/graph_view/tests.rs`][graph-view-tests] that builds a
+   `BuildGraph` with `implicit_deps` populated and asserts the
+   projection emits the expected `ImplicitDep` edges. The proptest
+   generator already exercises the `implicit_deps` field after the CI
+   fix (commit `99d3067`); verify the insertion-order-invariance
+   property still holds.
+
+6. **Refresh documentation.** Extend the *Graph view projection and
+   renderer adapters* section in
+   [`docs/developers-guide.md`](../../docs/developers-guide.md) with
+   the new edge class and its rendering semantics. Update
+   [`docs/netsuke-design.md`](../../docs/netsuke-design.md) §8.3 only
+   if the class taxonomy is enumerated there.
+
+7. **Stage E acceptance**:
+
+   - `cargo check --tests`, `make check-fmt`, `make lint`, `make test`,
+     `make markdownlint`, and `make nixie` pass.
+   - A manifest with `deps:` entries renders an HTML/DOT graph where
+     every implicit dep is visible as a bold/thick edge to its target.
+   - `coderabbit review --agent` returns no open concerns.
+
+[graph-view-mod]: ../../src/graph_view/mod.rs
+[graph-view-dot]: ../../src/graph_view/render_dot.rs
+[graph-view-html]: ../../src/graph_view/render_html.rs
+[graph-view-html-tests]: ../../src/graph_view/render_html_tests.rs
+[graph-view-tests]: ../../src/graph_view/tests.rs
+
+## Concrete steps
+
+Run all commands from the repository root. Outputs shown are illustrative
+and may differ slightly between runs.
+
+1. Confirm the branch:
+
+   ```bash
+   git branch --show-current
+   ```
+
+   Expected: `3-4-5-extend-graph-subcommand-with-an-html-renderer`.
+
+2. Quality gates (run before and after each stage):
+
+   ```bash
+   make check-fmt 2>&1 | tee /tmp/check-fmt-netsuke-$(git branch --show-current).out
+   make lint      2>&1 | tee /tmp/lint-netsuke-$(git branch --show-current).out
+   make test      2>&1 | tee /tmp/test-netsuke-$(git branch --show-current).out
+   ```
+
+3. Snapshot review (after Stage B and Stage C):
+
+   ```bash
+   cargo insta review
+   ```
+
+4. Smoke run of the new HTML surface (after Stage C):
+
+   ```bash
+   cargo run --release -- -f examples/basic_c.yml graph --html --output /tmp/graph.html
+   xdg-open /tmp/graph.html  # or open the file manually in a browser
+   ```
+
+5. Manual a11y check (after Stage C): open the HTML in DevTools, run
+   `axe-core`, save the report under `docs/screenshots/3-4-5/axe.json`
+   for the record.
+
+6. Final review:
+
+   ```bash
+   coderabbit review --agent 2>&1 | tee /tmp/coderabbit-netsuke-$(git branch --show-current).out
+   ```
+
+## Validation and acceptance
+
+Behaviour-level acceptance (the user-observable contract):
+
+1. `netsuke graph` writes a DOT graph to stdout and exits 0 against the
+   smoke fixture.
+2. `netsuke graph --output /tmp/x.dot` writes the same content to
+   `/tmp/x.dot` and writes nothing to stdout.
+3. `netsuke graph --output -` writes the same content to stdout.
+4. `netsuke graph --html` writes a self-contained HTML document to stdout
+   and exits 0.
+5. `netsuke graph --html --output /tmp/x.html` writes the document to
+   `/tmp/x.html`.
+6. Opening `/tmp/x.html` in any modern browser with no network access
+   shows the dependency graph as an SVG plus an outline list.
+7. Disabling JavaScript in the browser does not break the visualisation;
+   the outline list remains rendered.
+8. `netsuke -C tests/data graph --output graph.dot` writes to
+   `tests/data/graph.dot`.
+9. `netsuke graph --html --diag-json` (on a manifest that fails to
+   compile) writes the HTML diagnostic envelope to stderr; nothing to
+   stdout.
+
+Quality method:
+
+- Unit tests under `src/graph_view/tests.rs` and renderer-specific test
+  modules, parametrised with `rstest`.
+- Snapshot tests under `src/snapshots/graph/`.
+- Property test with `proptest` asserting `GraphView` and renderer output
+  are invariant under `HashMap`-insertion shuffles.
+- BDD scenarios under `tests/features/cli.feature` and
+  `tests/features/graph.feature`.
+- Integration test under [`runner_tool_subcommands_tests`][tool-tests]
+  rewritten to reflect the new dispatch (this file may be renamed to
+  `tests/runner_subcommands_tests.rs` once the Ninja-tool indirection is
+  removed; renaming is optional and not gated).
+- `assert_cmd`-driven end-to-end tests verifying stdout vs file behaviour
+  and the `-` sentinel.
+
+Quality criteria for the final commit:
+
+- `cargo fmt --workspace -- --check` succeeds.
+- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+  succeeds.
+- `cargo test --workspace` succeeds.
+- `make markdownlint` and `make nixie` succeed.
+- `coderabbit review --agent` concerns cleared.
+- Release-binary size growth under 1 MB.
+- Roadmap entry `3.4.5` is ticked.
+
+## Idempotence and recovery
+
+- Each stage is independently committable. If a stage's tests fail,
+  revert that stage's commit (`git revert <sha>`) rather than amending
+  earlier work.
+- Snapshot updates are explicit (`cargo insta accept`). Never auto-accept
+  in CI.
+- File writes go through the cap-std `write_text_file` helper, which is
+  idempotent — re-running the command overwrites the target atomically.
+- The Stage C spike lives behind a cargo feature initially so it can be
+  removed cleanly if the go/no-go gate fails.
+- The branch is `3-4-5-extend-graph-subcommand-with-an-html-renderer`;
+  if a stage produces partial work, push the work-in-progress to the
+  remote and reopen the draft PR for review before continuing.
+
+## Artifacts and notes
+
+Sample HTML structure (illustrative; final wording is localized):
+
+```html
+<!doctype html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <title>Netsuke build graph</title>
+    <style>/* inline; no external resources */</style>
+  </head>
+  <body>
+    <h1>Netsuke build graph</h1>
+    <svg role="img" aria-labelledby="svg-title svg-desc" viewBox="0 0 W H">
+      <title id="svg-title">Netsuke build graph</title>
+      <desc id="svg-desc">Build graph showing N targets and M edges.</desc>
+      <!-- server-rendered nodes and edges -->
+    </svg>
+    <details>
+      <summary>Targets and dependencies (text outline)</summary>
+      <ul>
+        <li>
+          <code>build/app</code>
+          <ul>
+            <li><code>src/main.c</code> (input)</li>
+            <li><code>build/main.o</code> (input)</li>
+          </ul>
+        </li>
+        <!-- ... -->
+      </ul>
+    </details>
+    <noscript>
+      <p>JavaScript is disabled. The text outline above is the full graph.</p>
+      <pre><code>digraph "netsuke" { /* DOT source */ }</code></pre>
+    </noscript>
+    <script>/* optional pan/zoom; under 100 lines */</script>
+  </body>
+</html>
+```
+
+Sample CLI matrix:
+
+| Invocation                                      | Renderer | Sink             |
+| ----------------------------------------------- | -------- | ---------------- |
+| `netsuke graph`                                 | DOT      | stdout           |
+| `netsuke graph --output -`                      | DOT      | stdout           |
+| `netsuke graph --output graph.dot`              | DOT      | file `graph.dot` |
+| `netsuke graph --html`                          | HTML     | stdout           |
+| `netsuke graph --html --output -`               | HTML     | stdout           |
+| `netsuke graph --html --output graph.html`      | HTML     | file `graph.html`|
+| `netsuke -C work graph --output graph.dot`      | DOT      | `work/graph.dot` |
+| `netsuke graph --html --diag-json` (on failure) | (none)   | JSON to stderr   |
+
+## Interfaces and dependencies
+
+The following symbols and signatures must exist at the close of each
+stage.
+
+End of Stage A — `src/graph_view/mod.rs`:
+
+```rust
+use camino::Utf8PathBuf;
+use crate::ir::BuildGraph;
+
+pub mod render;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GraphView {
+    pub default_targets: Vec<Utf8PathBuf>,
+    pub nodes: Vec<NodeView>,
+    pub edges: Vec<EdgeView>,
+    pub limit: Option<usize>, // reserved for roadmap 3.15.6
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NodeView {
+    pub path: Utf8PathBuf,
+    pub kind: NodeKind,
+    pub action_id: Option<String>,
+    pub description: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum NodeKind {
+    Source,
+    Target { phony: bool, always: bool },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct EdgeView {
+    pub from: Utf8PathBuf,
+    pub to: Utf8PathBuf,
+    pub class: EdgeClass,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EdgeClass {
+    Explicit,
+    OrderOnly,
+    ImplicitOutput,
+}
+
+impl GraphView {
+    pub fn from_build_graph(graph: &BuildGraph) -> Self { /* canonical sort */ }
+}
+```
+
+End of Stage A — `src/graph_view/render.rs`:
+
+```rust
+use std::io;
+use thiserror::Error;
+use crate::graph_view::GraphView;
+
+pub trait GraphRenderer {
+    fn render(&self, view: &GraphView, sink: &mut dyn io::Write)
+        -> Result<(), GraphRenderError>;
+}
+
+#[derive(Debug, Error)]
+pub enum GraphRenderError {
+    #[error("I/O failure while rendering graph: {source}")]
+    Io { #[source] source: io::Error },
+    #[error("formatting failure while rendering graph: {source}")]
+    Format { #[source] source: std::fmt::Error },
+}
+```
+
+End of Stage B — `src/graph_view/render_dot.rs`:
+
+```rust
+pub struct DotRenderer;
+
+impl crate::graph_view::render::GraphRenderer for DotRenderer { /* ... */ }
+```
+
+End of Stage B — generalised file IO in
+`src/runner/process/file_io.rs`:
+
+```rust
+pub fn write_text_file(path: &Path, content: &str) -> AnyResult<()>;
+pub fn write_text_stdout(content: &str) -> AnyResult<()>;
+```
+
+End of Stage B — `src/cli/mod.rs`:
+
+```rust
+pub enum Commands {
+    Build(BuildArgs),
+    Clean,
+    Graph(GraphArgs),
+    Manifest { file: PathBuf },
+}
+
+#[derive(Debug, Args, PartialEq, Eq, Clone, Serialize, Deserialize)]
+pub struct GraphArgs {
+    #[arg(long)]
+    pub html: bool,
+    #[arg(long, value_name = "FILE")]
+    #[serde(skip)]
+    pub output: Option<PathBuf>,
+}
+```
+
+End of Stage C — `src/graph_view/render_html.rs`:
+
+```rust
+use std::sync::Arc;
+use ortho_config::Localizer;
+
+pub struct HtmlRenderer {
+    pub locale: Arc<dyn Localizer>,
+}
+
+impl crate::graph_view::render::GraphRenderer for HtmlRenderer { /* ... */ }
+```
+
+External dependencies — at most one of:
+
+- A pure-Rust DOT/SVG layout crate (candidate: `layout` 0.1.x line, BSD-3,
+  no native deps; final selection happens at Stage C-1 after license
+  audit). Pinned to an exact version.
+- Or, as documented fallback, vendored `@viz-js/viz` v3 JS plus WASM
+  under `assets/vendor/viz-js/<pinned-version>/`. Vendored, not fetched
+  at build time.
+
+No JavaScript runtime is required at view time in either case.
+
+## Referenced documents and skills
+
+The implementing agent should load and consult the following before each
+stage. These are signposted here so the agent does not need to rediscover
+them.
+
+- [`docs/netsuke-design.md`](../netsuke-design.md) — architecture and
+  pipeline overview.
+- [`docs/netsuke-cli-design-document.md`](../netsuke-cli-design-document.md)
+  — CLI contract, especially the `--html`/`--json` split.
+- [ADR-003: agent-consistent human-first CLI][adr-003] — CLI doctrine.
+- [OrthoConfig users guide][ortho-guide] — layered configuration;
+  relevant for understanding why `--output` and `--html` stay out of
+  OrthoConfig.
+- [Netsuke users guide][users-guide] — current user-facing documentation;
+  the section on `graph` and on output streams is the target of the Stage
+  D revision.
+- [Netsuke developers guide][devs-guide] — test patterns, quality gates,
+  and behavioural-testing policy.
+- [Rust testing with `rstest` fixtures][rstest-doc] — fixture patterns
+  for the new unit tests.
+- [`rstest-bdd` users guide][bdd-guide] — behavioural-test authoring.
+- [Rust doctest DRY guide][doctest-guide] — doctest authoring conventions
+  for the new public types.
+- [Reliable testing in Rust via dependency injection][di-guide] — pattern
+  for the `GraphRenderer` port and its sink-as-parameter shape.
+- [Snapshot testing in Netsuke using insta][insta-guide] — snapshot
+  conventions used by the golden DOT and HTML tests.
+- [Documentation style guide][style-guide] — Markdown wrap widths and
+  style.
+
+Skills the agent should load when working on this plan:
+
+- `rust-router` for entry into Rust-specific guidance.
+- `hexagonal-architecture` for the port/adapter boundaries.
+- `domain-cli-and-daemons` for CLI shutdown and shape guidance.
+- `rust-errors` for `GraphRenderError` design.
+- `rust-types-and-apis` for the `GraphRenderer` trait surface.
+- `kani` if any GraphView invariant is promoted to a bounded model check
+  (optional, not required for acceptance).
+- `nextest` if the test suite is run under cargo-nextest in CI.
+- `execplans` for ongoing maintenance of this document.
+
+[adr-003]: ../adr-003-agent-consistent-human-first-cli.md
+[file-io]: ../../src/runner/process/file_io.rs
+[tool-tests]: ../../tests/runner_tool_subcommands_tests.rs
+[l10n-keys]: ../../src/localization/keys.rs
+[cli-feature]: ../../tests/features/cli.feature
+[bdd-graph]: ../../tests/bdd/steps/process.rs
+[cli-design]: ../netsuke-cli-design-document.md
+[ortho-guide]: ../ortho-config-users-guide.md
+[users-guide]: ../users-guide.md
+[devs-guide]: ../developers-guide.md
+[rstest-doc]: ../rust-testing-with-rstest-fixtures.md
+[bdd-guide]: ../rstest-bdd-users-guide.md
+[doctest-guide]: ../rust-doctest-dry-guide.md
+[di-guide]: ../reliable-testing-in-rust-via-dependency-injection.md
+[insta-guide]: ../snapshot-testing-in-netsuke-using-insta.md
+[style-guide]: ../documentation-style-guide.md
diff --git a/docs/netsuke-cli-design-document.md b/docs/netsuke-cli-design-document.md
index a445c25d..ca1b2f62 100644
--- a/docs/netsuke-cli-design-document.md
+++ b/docs/netsuke-cli-design-document.md
@@ -278,12 +278,14 @@ detail how Netsuke’s CLI will meet key accessibility criteria:
   translate CLI output (especially tables or complex structures) into
   accessible formats like CSV or HTML. In line with this, the `netsuke graph`
   command outputs the dependency graph in DOT format by default, but
-  `netsuke graph --html` produces an HTML visualization (useful for sighted
-  users). For an accessible alternative, `netsuke graph --json` outputs the
-  graph data as JSON. A screen reader user could take that JSON and navigate
-  the structure with a JSON viewer, or script custom queries, rather than
-  trying to parse a raw DOT text dump (which is essentially a visually
-  structured representation). Documentation describes the structure of such
+  `netsuke graph --html` (shipped in milestone 3.4.5) produces a
+  self-contained HTML visualization for sighted users; the HTML page also
+  embeds a `<details>` textual outline so screen-reader users get a
+  structured fallback. A `--json` view of the same graph data is the open
+  follow-up (roadmap item `3.15.6`); when it ships, screen-reader users will
+  be able to take that JSON and navigate the structure with a JSON viewer,
+  or script custom queries, rather than parsing the visually-structured DOT
+  text dump. Documentation describes the structure of such
   outputs clearly so users know what to expect (e.g., which fields appear in
   the JSON), per Recommendation 3 about documenting output structure in advance.
 
diff --git a/docs/netsuke-design.md b/docs/netsuke-design.md
index 953f17c1..9be8a7d2 100644
--- a/docs/netsuke-design.md
+++ b/docs/netsuke-design.md
@@ -2379,12 +2379,17 @@ the targets listed in the `defaults` section of the manifest are built.
   directory. It will invoke the Ninja backend with the appropriate flags, such
   as `ninja -t clean`, to remove the outputs of the build rules.
 
-- `Netsuke graph`: This command is an introspection and debugging tool. It
-  runs the Netsuke pipeline through Ninja synthesis (Stage 6) to produce a
-  temporary `build.ninja`, then invokes Ninja with the graph tool,
-  `ninja -t graph`, which outputs the complete build dependency graph in the
-  DOT language. The result can be piped through Graphviz tools such as
-  `dot -Tsvg`. An optional `--html` renderer is planned for a later milestone.
+- `Netsuke graph [--html] [--output FILE]`: This command is an introspection
+  and debugging tool. It executes the manifest pipeline up to and including
+  IR generation and then renders the build graph in-process. With no flags it
+  writes a Graphviz DOT document to stdout. `--output FILE` writes the
+  artefact to disk; the `-` sentinel selects stdout explicitly. `--html`
+  produces a self-contained, offline-safe HTML document with a server-rendered
+  SVG, an accessible textual outline, and a `<noscript>` fallback. The
+  renderer adapters consume a canonical [`GraphView`](../src/graph_view/mod.rs)
+  projection of [`BuildGraph`](../src/ir/graph.rs); deterministic output is
+  guaranteed because the projection sorts every collection at the IR
+  boundary. Ninja is not invoked.
 
 - `Netsuke manifest FILE`: This command performs the pipeline up to Ninja
   synthesis and writes the resulting Ninja file to `FILE` without invoking
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 11af433d..4f7e66fc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -101,10 +101,10 @@ and agents.
 
 ### 3.4. Graph and explanation work
 
-- [ ] 3.4.5. Extend the graph subcommand with an optional `--html` renderer.
-  - [ ] Keep raw graph data available for automation.
-  - [ ] Add `--output <FILE>` for file-based graph artefacts.
-  - [ ] Document how `graph --html --output graph.html` differs from
+- [x] 3.4.5. Extend the graph subcommand with an optional `--html` renderer.
+  - [x] Keep raw graph data available for automation.
+  - [x] Add `--output <FILE>` for file-based graph artefacts.
+  - [x] Document how `graph --html --output graph.html` differs from
     structured graph inspection.
 
 - [ ] 3.4.6. Evaluate whether `netsuke explain <code>` should exist.
diff --git a/docs/users-guide.md b/docs/users-guide.md
index 02a9c763..64115c9f 100644
--- a/docs/users-guide.md
+++ b/docs/users-guide.md
@@ -617,9 +617,10 @@ policy is configured by these global options:
   rules/targets to be properly configured for cleaning in Ninja (often via
   `phony` targets).
 
-- `graph`: Generates the build dependency graph by running `ninja -t graph` on
-  the generated `build.ninja`, outputting DOT to stdout (suitable for
-  Graphviz). Future versions may support other formats like `--html`.
+- `graph`: Renders the build dependency graph in-process. Writes a Graphviz
+  DOT document to stdout by default; `--html` selects a self-contained HTML
+  page instead, and `--output <FILE>` (with `-` for stdout) chooses the
+  destination. Ninja is not invoked. See section 12.2 for details.
 
 ### Configuration and Localization
 
@@ -1108,41 +1109,64 @@ state is available, depending on Ninja's behaviour.
 
 ### 12.2 The `graph` subcommand
 
-The `graph` subcommand generates a Graphviz DOT representation of the build
-dependency graph:
+The `graph` subcommand renders the build dependency graph in-process. It does
+not invoke Ninja; the projection is computed directly from the parsed manifest
+so the output is reproducible and does not depend on Ninja being installed.
+
+By default `graph` writes a Graphviz DOT document to stdout:
 
 ```sh
 netsuke graph > build.dot
 dot -Tpng build.dot -o build.png
 ```
 
-This produces a visual diagram showing:
+Use `--output <FILE>` to write the artefact to disk instead. The literal `-`
+selects stdout (matching the existing `manifest -` convention):
+
+```sh
+netsuke graph --output build.dot
+netsuke graph --output -        # equivalent to omitting --output
+```
 
-- Nodes for each target and action.
-- Edges showing explicit dependencies (`sources:`, `deps:`).
-- Order-only dependencies (`order_only_deps:`).
+Relative `--output` paths resolve under the `-C/--directory` working directory
+when one is configured, mirroring `build --emit`.
 
-**Interpreting the output:**
+Use `--html` to render a self-contained HTML page instead of DOT. The page
+contains a server-rendered SVG, a screen-reader-friendly textual outline of
+every target and its inputs, and a `<noscript>` block restating the graph in
+DOT for fully JavaScript-free viewing. No network access is required and no
+external assets are referenced:
+
+```sh
+netsuke graph --html --output graph.html
+```
+
+Open `graph.html` in any modern browser. The SVG layout is hierarchical: source
+files appear on the left, intermediate targets in the middle, and the
+right-most column contains the leaves of the dependency graph. Order-only
+dependencies are rendered as dashed edges; implicit outputs use a dotted
+style.
+
+**Interpreting the DOT output:**
 
 - Each node is labelled with the target or action name.
 - Directed edges (`->`) point from prerequisites to dependants.
-- Order-only dependencies are shown as dashed edges (if Graphviz is configured
-  to distinguish them).
-
-**Example workflow:**
+- Order-only dependencies are shown as dashed edges.
+- Implicit outputs are shown as dotted edges.
 
-To understand why a particular target rebuilds when a file changes:
+**Example workflow:** trace a specific target's prerequisites:
 
 ```sh
 netsuke graph | grep -A5 -B5 my_target
 ```
 
-This shows the subgraph around `my_target` and helps trace back to its
-dependencies.
-
-**Requirements:** The `graph` command requires a valid manifest. If the
+**Requirements:** the `graph` command requires a valid manifest. If the
 manifest is syntactically invalid or contains structural errors, `graph` will
-fail before rendering any DOT output.
+fail before writing any output.
+
+**Note on output streams:** `--diag-json` governs diagnostic output on stderr;
+the graph artefact on stdout (or in the chosen `--output` file) is unchanged
+when `--diag-json` is set.
 
 ### 12.3 The `manifest` subcommand
 
diff --git a/locales/en-US/messages.ftl b/locales/en-US/messages.ftl
index 4c374ead..b3413b44 100644
--- a/locales/en-US/messages.ftl
+++ b/locales/en-US/messages.ftl
@@ -29,8 +29,8 @@ cli.subcommand.build.about = Build targets defined in the manifest (default).
 cli.subcommand.build.long_about = Build the requested targets; when none are provided, use the manifest defaults.
 cli.subcommand.clean.about = Remove build artefacts via Ninja.
 cli.subcommand.clean.long_about = Generate a temporary Ninja file, then run `ninja -t clean`.
-cli.subcommand.graph.about = Emit the dependency graph in DOT format.
-cli.subcommand.graph.long_about = Generate a temporary Ninja file, then run `ninja -t graph` to emit DOT output.
+cli.subcommand.graph.about = Emit the build dependency graph. Default format is DOT.
+cli.subcommand.graph.long_about = Project the parsed Netsuke manifest into a canonical build graph and write it as Graphviz DOT, or as a self-contained HTML page with `--html`. Use `--output <FILE>` to write to a file; `-` writes to stdout.
 cli.subcommand.manifest.about = Write the generated Ninja manifest without running Ninja.
 cli.subcommand.manifest.long_about = Generate the Ninja file and write it to the specified path or '-' for stdout.
 
@@ -38,6 +38,10 @@ cli.subcommand.manifest.long_about = Generate the Ninja file and write it to the
 cli.subcommand.build.flag.emit.help = Write the generated Ninja file to this path and keep it.
 cli.subcommand.build.flag.targets.help = Targets to build (uses manifest defaults if omitted).
 
+# Graph subcommand flag help text.
+cli.subcommand.graph.flag.html.help = Render the graph as a self-contained HTML page instead of DOT.
+cli.subcommand.graph.flag.output.help = Write the graph artefact to FILE; use `-` for stdout.
+
 # Manifest subcommand argument help text.
 cli.subcommand.manifest.flag.file.help = Output path for the Ninja file (use '-' for stdout).
 
@@ -353,8 +357,17 @@ status.timing.total_line = Total pipeline time: { $duration }
 status.tool.build = Build
 status.tool.clean = Clean
 status.tool.graph = Graph
+status.tool.graph_html = Graph (HTML)
 status.tool.manifest = Manifest
 
+# Graph HTML renderer strings.
+graph.html.title = Netsuke build graph
+graph.html.heading = Netsuke build graph
+graph.html.description = Build graph rendered by Netsuke
+graph.html.outline.summary = Targets and dependencies (text outline)
+graph.html.outline.no_inputs = No inputs
+graph.html.noscript.notice = JavaScript is disabled. The text outline above is the full graph; the DOT source follows.
+
 # Accessibility preferences.
 cli.flag.no_emoji.help = Suppress emoji glyphs in output.
 
diff --git a/locales/es-ES/messages.ftl b/locales/es-ES/messages.ftl
index a81f1edf..c79132b8 100644
--- a/locales/es-ES/messages.ftl
+++ b/locales/es-ES/messages.ftl
@@ -29,8 +29,8 @@ cli.subcommand.build.about = Compila objetivos definidos en el manifiesto (prede
 cli.subcommand.build.long_about = Compila los objetivos solicitados; si no se indican, usa los predeterminados del manifiesto.
 cli.subcommand.clean.about = Elimina artefactos de compilación mediante Ninja.
 cli.subcommand.clean.long_about = Genera un archivo Ninja temporal y ejecuta `ninja -t clean`.
-cli.subcommand.graph.about = Emite el grafo de dependencias en formato DOT.
-cli.subcommand.graph.long_about = Genera un archivo Ninja temporal y ejecuta `ninja -t graph` para emitir DOT.
+cli.subcommand.graph.about = Emite el grafo de dependencias de compilación. El formato predeterminado es DOT.
+cli.subcommand.graph.long_about = Proyecta el manifiesto Netsuke en un grafo canónico y lo escribe en formato Graphviz DOT, o como página HTML autocontenida con `--html`. Use `--output <ARCHIVO>` para escribir a un archivo; `-` escribe en stdout.
 cli.subcommand.manifest.about = Escribe el manifiesto Ninja sin ejecutar Ninja.
 cli.subcommand.manifest.long_about = Genera el archivo Ninja y lo escribe en la ruta indicada o '-' para stdout.
 
@@ -38,6 +38,10 @@ cli.subcommand.manifest.long_about = Genera el archivo Ninja y lo escribe en la
 cli.subcommand.build.flag.emit.help = Escribir el archivo Ninja generado en esta ruta y conservarlo.
 cli.subcommand.build.flag.targets.help = Objetivos a compilar (usa los predeterminados del manifiesto si se omite).
 
+# Texto de ayuda para opciones del subcomando graph.
+cli.subcommand.graph.flag.html.help = Renderizar el grafo como una página HTML autocontenida en lugar de DOT.
+cli.subcommand.graph.flag.output.help = Escribir el artefacto del grafo en ARCHIVO; use `-` para stdout.
+
 # Texto de ayuda para argumentos del subcomando manifest.
 cli.subcommand.manifest.flag.file.help = Ruta de salida para el archivo Ninja (use '-' para stdout).
 
@@ -353,8 +357,17 @@ status.timing.total_line = Tiempo total de la canalización: { $duration }
 status.tool.build = Compilación
 status.tool.clean = Limpieza
 status.tool.graph = Grafo
+status.tool.graph_html = Grafo (HTML)
 status.tool.manifest = Manifiesto
 
+# Cadenas del renderizador HTML del grafo.
+graph.html.title = Grafo de compilación de Netsuke
+graph.html.heading = Grafo de compilación de Netsuke
+graph.html.description = Grafo de compilación renderizado por Netsuke
+graph.html.outline.summary = Objetivos y dependencias (esquema textual)
+graph.html.outline.no_inputs = Sin entradas
+graph.html.noscript.notice = JavaScript está desactivado. El esquema textual anterior contiene el grafo completo; el código DOT figura a continuación.
+
 # Preferencias de accesibilidad.
 cli.flag.no_emoji.help = Suprimir glifos emoji en la salida.
 
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
index 7553f245..06a1742f 100644
--- a/src/cli/mod.rs
+++ b/src/cli/mod.rs
@@ -244,6 +244,24 @@ pub struct BuildArgs {
     pub targets: Vec<String>,
 }
 
+/// Arguments accepted by the `graph` command.
+///
+/// `--html` and `--output` are per-invocation flags. They are intentionally
+/// kept out of [`CliConfig`] so layered configuration cannot silently change
+/// the graph's output destination or format.
+#[derive(Debug, Args, PartialEq, Eq, Clone, Serialize, Deserialize, Default)]
+pub struct GraphArgs {
+    /// Render the graph as a self-contained HTML page instead of DOT.
+    #[arg(long)]
+    #[serde(skip)]
+    pub html: bool,
+
+    /// Write the graph artefact to FILE. Use `-` for stdout.
+    #[arg(long, value_name = "FILE")]
+    #[serde(skip)]
+    pub output: Option<PathBuf>,
+}
+
 /// Available top-level commands for Netsuke.
 #[derive(Debug, Subcommand, PartialEq, Eq, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "kebab-case")]
@@ -255,7 +273,7 @@ pub enum Commands {
     Clean,
 
     /// Display the build dependency graph in DOT format for visualisation.
-    Graph,
+    Graph(GraphArgs),
 
     /// Write the Ninja manifest to the specified file without invoking Ninja.
     Manifest {
diff --git a/src/cli_l10n.rs b/src/cli_l10n.rs
index 19e1bd73..03933d74 100644
--- a/src/cli_l10n.rs
+++ b/src/cli_l10n.rs
@@ -148,6 +148,11 @@ fn flag_help_key(arg_id: &str, subcommand_name: Option<&str>) -> Option<&'static
             "targets" => Some(keys::CLI_SUBCOMMAND_BUILD_FLAG_TARGETS_HELP),
             _ => None,
         },
+        Some("graph") => match arg_id {
+            "html" => Some(keys::CLI_SUBCOMMAND_GRAPH_FLAG_HTML_HELP),
+            "output" => Some(keys::CLI_SUBCOMMAND_GRAPH_FLAG_OUTPUT_HELP),
+            _ => None,
+        },
         Some("manifest") => match arg_id {
             "file" => Some(keys::CLI_SUBCOMMAND_MANIFEST_FLAG_FILE_HELP),
             _ => None,
diff --git a/src/graph_view/mod.rs b/src/graph_view/mod.rs
new file mode 100644
index 00000000..153a6e89
--- /dev/null
+++ b/src/graph_view/mod.rs
@@ -0,0 +1,255 @@
+//! Deterministic projection of the build graph for rendering adapters.
+//!
+//! [`GraphView`] is the domain port that every renderer (DOT, HTML, future
+//! JSON) consumes. It is constructed once from [`BuildGraph`] and exposes a
+//! canonical, fully sorted view that is invariant under `HashMap` iteration
+//! order. Renderer adapters under this module read [`GraphView`] only — they
+//! never touch [`BuildGraph`] directly.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use camino::Utf8PathBuf;
+
+use crate::ir::{BuildEdge, BuildGraph};
+
+pub mod render;
+pub mod render_dot;
+pub mod render_html;
+
+/// Deterministic projection of [`BuildGraph`] consumed by renderer adapters.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GraphView {
+    /// Targets built when no explicit target is requested, sorted lexically.
+    pub default_targets: Vec<Utf8PathBuf>,
+    /// Every node referenced by the graph, sorted by [`NodeView::path`].
+    pub nodes: Vec<NodeView>,
+    /// Every edge, sorted by `(from, to, class)`.
+    pub edges: Vec<EdgeView>,
+    /// Reserved for the visualisation-bounding work tracked under roadmap
+    /// item 3.15.6. Currently always `None`.
+    pub limit: Option<usize>,
+}
+
+/// A node in the rendered graph. A node is either a build target produced by
+/// some action, or a leaf source path referenced as an input.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NodeView {
+    /// Path identifying the node. Output paths for targets, input paths for
+    /// sources.
+    pub path: Utf8PathBuf,
+    /// Whether the node is a target produced by an action or a leaf source.
+    pub kind: NodeKind,
+    /// Identifier of the producing action, when [`NodeKind::Target`].
+    pub action_id: Option<String>,
+    /// Optional human-readable description carried by the producing action.
+    pub description: Option<String>,
+}
+
+/// Classification of a [`NodeView`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum NodeKind {
+    /// A leaf input file referenced by one or more build edges. The node is
+    /// not produced by any action in the current manifest.
+    Source,
+    /// A target produced by an action. `phony` and `always` mirror the
+    /// corresponding flags on [`BuildEdge`].
+    Target {
+        /// The output is `phony` and has no on-disk artefact.
+        phony: bool,
+        /// The producing action runs on every invocation.
+        always: bool,
+    },
+}
+
+/// A directed edge in the rendered graph.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct EdgeView {
+    /// Source of the edge.
+    pub from: Utf8PathBuf,
+    /// Destination of the edge.
+    pub to: Utf8PathBuf,
+    /// Classification of the edge.
+    pub class: EdgeClass,
+}
+
+/// Dependency class of an [`EdgeView`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum EdgeClass {
+    /// Explicit input → output dependency. The input appears in `$in`.
+    Explicit,
+    /// Implicit input → output dependency (Ninja `|`). The input triggers a
+    /// rebuild when changed but is not substituted into `$in`.
+    ImplicitDep,
+    /// Input → implicit output dependency. The output is generated by the
+    /// action but is not listed in its `explicit_outputs`.
+    ImplicitOutput,
+    /// Order-only dependency (Ninja `||`). Does not trigger a rebuild.
+    OrderOnly,
+}
+
+impl GraphView {
+    /// Project a [`BuildGraph`] into a deterministic [`GraphView`].
+    ///
+    /// The projection sorts every collection so that two graphs equal up to
+    /// `HashMap` insertion order yield byte-identical views.
+    #[must_use]
+    pub fn from_build_graph(graph: &BuildGraph) -> Self {
+        let edges_seen = collect_unique_edges(graph);
+
+        let mut node_paths: BTreeMap<Utf8PathBuf, NodeKind> = BTreeMap::new();
+        let mut node_metadata: BTreeMap<Utf8PathBuf, NodeMetadata> = BTreeMap::new();
+        let mut edges: BTreeSet<EdgeView> = BTreeSet::new();
+
+        for edge in &edges_seen {
+            register_outputs(graph, edge, &mut node_paths, &mut node_metadata);
+            register_inputs_and_edges(edge, &mut node_paths, &mut edges);
+        }
+
+        let nodes = node_paths
+            .into_iter()
+            .map(|(path, kind)| {
+                let meta = node_metadata.remove(&path).unwrap_or_default();
+                NodeView {
+                    path,
+                    kind,
+                    action_id: meta.action_id,
+                    description: meta.description,
+                }
+            })
+            .collect();
+
+        let mut default_targets = graph.default_targets.clone();
+        default_targets.sort();
+        default_targets.dedup();
+
+        Self {
+            default_targets,
+            nodes,
+            edges: edges.into_iter().collect(),
+            limit: None,
+        }
+    }
+}
+
+#[derive(Debug, Default, Clone)]
+struct NodeMetadata {
+    action_id: Option<String>,
+    description: Option<String>,
+}
+
+/// Deduplicate the build edges referenced by [`BuildGraph::targets`].
+///
+/// `BuildGraph::targets` maps every output path back to a (cloned) `BuildEdge`,
+/// so iterating values produces duplicates. We dedup by the lexically-sorted
+/// tuple of explicit outputs, which uniquely identifies a build statement.
+fn collect_unique_edges(graph: &BuildGraph) -> Vec<BuildEdge> {
+    let mut by_key: BTreeMap<Vec<Utf8PathBuf>, BuildEdge> = BTreeMap::new();
+    for edge in graph.targets.values() {
+        let mut key = edge.explicit_outputs.clone();
+        key.sort();
+        by_key.entry(key).or_insert_with(|| edge.clone());
+    }
+    by_key.into_values().collect()
+}
+
+fn register_outputs(
+    graph: &BuildGraph,
+    edge: &BuildEdge,
+    node_paths: &mut BTreeMap<Utf8PathBuf, NodeKind>,
+    node_metadata: &mut BTreeMap<Utf8PathBuf, NodeMetadata>,
+) {
+    let description = graph
+        .actions
+        .get(&edge.action_id)
+        .and_then(|action| action.description.clone());
+    let outputs = edge
+        .explicit_outputs
+        .iter()
+        .chain(edge.implicit_outputs.iter());
+    for out in outputs {
+        node_paths.insert(
+            out.clone(),
+            NodeKind::Target {
+                phony: edge.phony,
+                always: edge.always,
+            },
+        );
+        node_metadata.insert(
+            out.clone(),
+            NodeMetadata {
+                action_id: Some(edge.action_id.clone()),
+                description: description.clone(),
+            },
+        );
+    }
+}
+
+fn register_inputs_and_edges(
+    edge: &BuildEdge,
+    node_paths: &mut BTreeMap<Utf8PathBuf, NodeKind>,
+    edges: &mut BTreeSet<EdgeView>,
+) {
+    let implicit: BTreeSet<&Utf8PathBuf> = edge.implicit_outputs.iter().collect();
+    for input in &edge.inputs {
+        node_paths.entry(input.clone()).or_insert(NodeKind::Source);
+        for out in edge
+            .explicit_outputs
+            .iter()
+            .chain(edge.implicit_outputs.iter())
+        {
+            let class = if implicit.contains(out) {
+                EdgeClass::ImplicitOutput
+            } else {
+                EdgeClass::Explicit
+            };
+            edges.insert(EdgeView {
+                from: input.clone(),
+                to: out.clone(),
+                class,
+            });
+        }
+    }
+    for dep in &edge.implicit_deps {
+        node_paths.entry(dep.clone()).or_insert(NodeKind::Source);
+        for out in edge
+            .explicit_outputs
+            .iter()
+            .chain(edge.implicit_outputs.iter())
+        {
+            edges.insert(EdgeView {
+                from: dep.clone(),
+                to: out.clone(),
+                class: EdgeClass::ImplicitDep,
+            });
+        }
+    }
+    for dep in &edge.order_only_deps {
+        node_paths.entry(dep.clone()).or_insert(NodeKind::Source);
+        for out in edge
+            .explicit_outputs
+            .iter()
+            .chain(edge.implicit_outputs.iter())
+        {
+            edges.insert(EdgeView {
+                from: dep.clone(),
+                to: out.clone(),
+                class: EdgeClass::OrderOnly,
+            });
+        }
+    }
+}
+
+impl Ord for EdgeView {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        (&self.from, &self.to, self.class).cmp(&(&other.from, &other.to, other.class))
+    }
+}
+
+impl PartialOrd for EdgeView {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/graph_view/render.rs b/src/graph_view/render.rs
new file mode 100644
index 00000000..6cc35276
--- /dev/null
+++ b/src/graph_view/render.rs
@@ -0,0 +1,53 @@
+//! Renderer port for [`super::GraphView`].
+//!
+//! Each renderer adapter (DOT, HTML, future JSON) implements
+//! [`GraphRenderer`] and consumes a [`GraphView`] plus a polymorphic
+//! [`std::io::Write`] sink.
+
+use std::io;
+
+use thiserror::Error;
+
+use super::GraphView;
+
+/// Trait implemented by every renderer adapter consuming a [`GraphView`].
+pub trait GraphRenderer {
+    /// Render the graph view into the provided sink.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`GraphRenderError`] when writing to the sink fails or the
+    /// renderer cannot format part of the view.
+    fn render(&self, view: &GraphView, sink: &mut dyn io::Write) -> Result<(), GraphRenderError>;
+}
+
+/// Errors produced by a [`GraphRenderer`] implementation.
+#[derive(Debug, Error)]
+pub enum GraphRenderError {
+    /// I/O failure encountered while writing the rendered graph.
+    #[error("I/O failure while rendering graph")]
+    Io {
+        /// Underlying I/O error.
+        #[source]
+        source: io::Error,
+    },
+    /// Formatting failure raised by the renderer's internal writer.
+    #[error("formatting failure while rendering graph")]
+    Format {
+        /// Underlying formatter error.
+        #[source]
+        source: std::fmt::Error,
+    },
+}
+
+impl From<io::Error> for GraphRenderError {
+    fn from(source: io::Error) -> Self {
+        Self::Io { source }
+    }
+}
+
+impl From<std::fmt::Error> for GraphRenderError {
+    fn from(source: std::fmt::Error) -> Self {
+        Self::Format { source }
+    }
+}
diff --git a/src/graph_view/render_dot.rs b/src/graph_view/render_dot.rs
new file mode 100644
index 00000000..72d659a8
--- /dev/null
+++ b/src/graph_view/render_dot.rs
@@ -0,0 +1,249 @@
+//! Deterministic Graphviz DOT renderer for [`GraphView`].
+
+use std::io::Write;
+
+use camino::Utf8Path;
+
+use super::render::{GraphRenderError, GraphRenderer};
+use super::{EdgeClass, GraphView, NodeKind};
+
+/// Render adapter producing Graphviz DOT output.
+#[derive(Debug, Default, Clone, Copy)]
+pub struct DotRenderer;
+
+impl DotRenderer {
+    /// Construct a new DOT renderer.
+    #[must_use]
+    pub const fn new() -> Self {
+        Self
+    }
+}
+
+impl GraphRenderer for DotRenderer {
+    fn render(&self, view: &GraphView, sink: &mut dyn Write) -> Result<(), GraphRenderError> {
+        writeln!(sink, "digraph netsuke {{")?;
+        writeln!(sink, "  rankdir=\"LR\"")?;
+        writeln!(sink, "  node [shape=box, fontsize=10]")?;
+        writeln!(sink, "  edge [fontsize=10]")?;
+
+        for node in &view.nodes {
+            write_node(
+                sink,
+                node.path.as_path(),
+                node.kind,
+                node.description.as_deref(),
+            )?;
+        }
+
+        for edge in &view.edges {
+            write_edge(sink, edge.from.as_path(), edge.to.as_path(), edge.class)?;
+        }
+
+        if !view.default_targets.is_empty() {
+            writeln!(sink, "  // default targets:")?;
+            for target in &view.default_targets {
+                writeln!(sink, "  // - {}", escape_dot(target.as_str()))?;
+            }
+        }
+
+        writeln!(sink, "}}")?;
+        Ok(())
+    }
+}
+
+fn write_node(
+    sink: &mut dyn Write,
+    path: &Utf8Path,
+    kind: NodeKind,
+    description: Option<&str>,
+) -> Result<(), GraphRenderError> {
+    let path_str = escape_dot(path.as_str());
+    let label = description.filter(|s| !s.is_empty()).map_or_else(
+        || path_str.clone(),
+        |d| format!("{}\\n{}", path_str, escape_dot(d)),
+    );
+    let attrs = match kind {
+        NodeKind::Source => format!("label=\"{label}\""),
+        NodeKind::Target { phony: true, .. } => {
+            format!("label=\"{label}\", style=dashed, color=\"#666666\"")
+        }
+        NodeKind::Target {
+            phony: false,
+            always: true,
+        } => format!("label=\"{label}\", color=\"#cc6600\""),
+        NodeKind::Target {
+            phony: false,
+            always: false,
+        } => format!("label=\"{label}\", color=\"#003366\""),
+    };
+    writeln!(sink, "  \"{path_str}\" [{attrs}]")?;
+    Ok(())
+}
+
+fn write_edge(
+    sink: &mut dyn Write,
+    from: &Utf8Path,
+    to: &Utf8Path,
+    class: EdgeClass,
+) -> Result<(), GraphRenderError> {
+    let from_str = escape_dot(from.as_str());
+    let to_str = escape_dot(to.as_str());
+    let attrs = match class {
+        EdgeClass::Explicit => "",
+        EdgeClass::ImplicitDep => " [style=bold]",
+        EdgeClass::ImplicitOutput => " [style=dotted]",
+        EdgeClass::OrderOnly => " [style=dashed]",
+    };
+    writeln!(sink, "  \"{from_str}\" -> \"{to_str}\"{attrs}")?;
+    Ok(())
+}
+
+/// Escape a string for inclusion inside a double-quoted Graphviz identifier or
+/// label.
+fn escape_dot(input: &str) -> String {
+    let mut out = String::with_capacity(input.len());
+    for ch in input.chars() {
+        match ch {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '\n' => out.push_str("\\n"),
+            other => out.push(other),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use camino::Utf8PathBuf;
+
+    use super::*;
+    use crate::graph_view::{EdgeView, GraphView, NodeView};
+
+    fn empty_view() -> GraphView {
+        GraphView {
+            default_targets: Vec::new(),
+            nodes: Vec::new(),
+            edges: Vec::new(),
+            limit: None,
+        }
+    }
+
+    fn render(view: &GraphView) -> String {
+        let mut out = Vec::new();
+        DotRenderer::new()
+            .render(view, &mut out)
+            .expect("render dot");
+        String::from_utf8(out).expect("utf-8")
+    }
+
+    #[test]
+    fn empty_graph_produces_well_formed_digraph() {
+        let dot = render(&empty_view());
+        assert!(dot.starts_with("digraph netsuke {"));
+        assert!(dot.trim_end().ends_with('}'));
+    }
+
+    #[test]
+    fn renders_source_target_and_explicit_edge() {
+        let view = GraphView {
+            default_targets: vec![Utf8PathBuf::from("out/a.o")],
+            nodes: vec![
+                NodeView {
+                    path: Utf8PathBuf::from("out/a.o"),
+                    kind: NodeKind::Target {
+                        phony: false,
+                        always: false,
+                    },
+                    action_id: Some("h".into()),
+                    description: Some("compile a".into()),
+                },
+                NodeView {
+                    path: Utf8PathBuf::from("src/a.c"),
+                    kind: NodeKind::Source,
+                    action_id: None,
+                    description: None,
+                },
+            ],
+            edges: vec![EdgeView {
+                from: Utf8PathBuf::from("src/a.c"),
+                to: Utf8PathBuf::from("out/a.o"),
+                class: EdgeClass::Explicit,
+            }],
+            limit: None,
+        };
+        let dot = render(&view);
+        assert!(dot.contains("\"src/a.c\" [label=\"src/a.c\"]"));
+        assert!(dot.contains("\"out/a.o\" [label=\"out/a.o\\ncompile a\""));
+        assert!(dot.contains("\"src/a.c\" -> \"out/a.o\"\n"));
+        assert!(dot.contains("// default targets:"));
+        assert!(dot.contains("// - out/a.o"));
+    }
+
+    #[test]
+    fn order_only_and_implicit_edges_carry_style() {
+        let view = GraphView {
+            default_targets: Vec::new(),
+            nodes: vec![NodeView {
+                path: Utf8PathBuf::from("o"),
+                kind: NodeKind::Source,
+                action_id: None,
+                description: None,
+            }],
+            edges: vec![
+                EdgeView {
+                    from: Utf8PathBuf::from("a"),
+                    to: Utf8PathBuf::from("o"),
+                    class: EdgeClass::OrderOnly,
+                },
+                EdgeView {
+                    from: Utf8PathBuf::from("b"),
+                    to: Utf8PathBuf::from("o"),
+                    class: EdgeClass::ImplicitOutput,
+                },
+            ],
+            limit: None,
+        };
+        let dot = render(&view);
+        assert!(dot.contains("\"a\" -> \"o\" [style=dashed]"));
+        assert!(dot.contains("\"b\" -> \"o\" [style=dotted]"));
+    }
+
+    #[test]
+    fn implicit_dep_edges_are_bold() {
+        let view = GraphView {
+            default_targets: Vec::new(),
+            nodes: vec![NodeView {
+                path: Utf8PathBuf::from("o"),
+                kind: NodeKind::Source,
+                action_id: None,
+                description: None,
+            }],
+            edges: vec![EdgeView {
+                from: Utf8PathBuf::from("dep"),
+                to: Utf8PathBuf::from("o"),
+                class: EdgeClass::ImplicitDep,
+            }],
+            limit: None,
+        };
+        let dot = render(&view);
+        assert!(dot.contains("\"dep\" -> \"o\" [style=bold]"));
+    }
+
+    #[test]
+    fn paths_with_quotes_are_escaped() {
+        let view = GraphView {
+            default_targets: Vec::new(),
+            nodes: vec![NodeView {
+                path: Utf8PathBuf::from("a\"b"),
+                kind: NodeKind::Source,
+                action_id: None,
+                description: None,
+            }],
+            edges: Vec::new(),
+            limit: None,
+        };
+        let dot = render(&view);
+        assert!(dot.contains("\"a\\\"b\""));
+    }
+}
diff --git a/src/graph_view/render_html.rs b/src/graph_view/render_html.rs
new file mode 100644
index 00000000..a8173404
--- /dev/null
+++ b/src/graph_view/render_html.rs
@@ -0,0 +1,481 @@
+//! Self-contained HTML renderer for [`GraphView`].
+//!
+//! Produces a single offline-safe HTML document containing:
+//!
+//! 1. A server-rendered SVG laid out as a left-to-right hierarchical DAG.
+//!    The SVG carries `role="img"`, `aria-labelledby`, per-node `aria-label`s,
+//!    and per-edge `<title>` elements so screen readers can navigate the
+//!    structure.
+//! 2. A `<details>` block listing every target and its inputs as a plain-text
+//!    outline — the primary screen-reader path while structured `--json`
+//!    inspection (roadmap 3.15.6) remains a follow-up.
+//! 3. A `<noscript>` block restating the dependency graph and the DOT source
+//!    verbatim so the page is fully functional with JavaScript disabled.
+//!
+//! No JavaScript is required at view time. No external assets are referenced.
+
+use std::collections::BTreeMap;
+use std::io::Write;
+
+use camino::Utf8Path;
+
+use crate::graph_view::render_dot::DotRenderer;
+use crate::localization::{self, keys};
+
+use super::render::{GraphRenderError, GraphRenderer};
+use super::{EdgeClass, EdgeView, GraphView, NodeKind, NodeView};
+
+const COL_WIDTH: i32 = 240;
+const ROW_HEIGHT: i32 = 70;
+const NODE_WIDTH: i32 = 200;
+const NODE_HEIGHT: i32 = 44;
+const NODE_HEIGHT_HALF: i32 = NODE_HEIGHT >> 1;
+const MARGIN: i32 = 24;
+
+/// Render adapter producing a self-contained HTML page.
+#[derive(Debug, Clone)]
+pub struct HtmlRenderer {
+    locale: String,
+}
+
+impl Default for HtmlRenderer {
+    fn default() -> Self {
+        Self::new(None)
+    }
+}
+
+impl HtmlRenderer {
+    /// Construct a new HTML renderer.
+    ///
+    /// The optional `locale` value sets the resulting page's `<html lang>`
+    /// attribute. When `None` the renderer defaults to `en` to keep the page
+    /// valid for assistive tooling.
+    #[must_use]
+    pub fn new(locale: Option<&str>) -> Self {
+        Self {
+            locale: locale.unwrap_or("en").to_owned(),
+        }
+    }
+}
+
+impl GraphRenderer for HtmlRenderer {
+    fn render(&self, view: &GraphView, sink: &mut dyn Write) -> Result<(), GraphRenderError> {
+        let positions = layout_positions(view);
+        let title = localized(keys::GRAPH_HTML_TITLE);
+        let heading = localized(keys::GRAPH_HTML_HEADING);
+        let description = format!(
+            "{} ({}, {})",
+            localized(keys::GRAPH_HTML_DESCRIPTION),
+            view.nodes.len(),
+            view.edges.len()
+        );
+        let outline_summary = localized(keys::GRAPH_HTML_OUTLINE_SUMMARY);
+        let noscript_notice = localized(keys::GRAPH_HTML_NOSCRIPT_NOTICE);
+
+        writeln!(sink, "<!doctype html>")?;
+        writeln!(sink, "<html lang=\"{}\">", escape_attr(&self.locale))?;
+        writeln!(sink, "<head>")?;
+        writeln!(sink, "  <meta charset=\"utf-8\">")?;
+        writeln!(
+            sink,
+            "  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">"
+        )?;
+        writeln!(sink, "  <title>{}</title>", escape_text(&title))?;
+        write_inline_style(sink)?;
+        writeln!(sink, "</head>")?;
+        writeln!(sink, "<body>")?;
+        writeln!(sink, "  <h1>{}</h1>", escape_text(&heading))?;
+        write_svg(
+            sink,
+            view,
+            &positions,
+            SvgHeader {
+                title: &title,
+                description: &description,
+            },
+        )?;
+        write_outline(sink, view, &outline_summary)?;
+        write_noscript(sink, view, &noscript_notice)?;
+        writeln!(sink, "</body>")?;
+        writeln!(sink, "</html>")?;
+        Ok(())
+    }
+}
+
+fn localized(key: &'static str) -> String {
+    localization::message(key).to_string()
+}
+
+fn write_inline_style(sink: &mut dyn Write) -> Result<(), GraphRenderError> {
+    // Inline-only styles: no external resources are referenced.
+    writeln!(sink, "  <style>")?;
+    writeln!(
+        sink,
+        "    :root {{ color-scheme: light dark; font-family: system-ui, sans-serif; }}"
+    )?;
+    writeln!(
+        sink,
+        "    body {{ margin: 1.5rem; max-width: 100%; line-height: 1.5; }}"
+    )?;
+    writeln!(sink, "    svg {{ max-width: 100%; height: auto; }}")?;
+    writeln!(
+        sink,
+        "    .node rect {{ fill: var(--node-bg, #f3f4f6); stroke: #003366; stroke-width: 1.2; rx: 6; ry: 6; }}"
+    )?;
+    writeln!(
+        sink,
+        "    .node.source rect {{ stroke: #444; stroke-dasharray: 3 2; }}"
+    )?;
+    writeln!(
+        sink,
+        "    .node.phony rect {{ stroke: #666; stroke-dasharray: 4 2; }}"
+    )?;
+    writeln!(sink, "    .node.always rect {{ stroke: #cc6600; }}")?;
+    writeln!(
+        sink,
+        "    .node text {{ font-size: 12px; fill: currentColor; pointer-events: none; }}"
+    )?;
+    writeln!(
+        sink,
+        "    .edge {{ fill: none; stroke: #003366; stroke-width: 1.2; }}"
+    )?;
+    writeln!(
+        sink,
+        "    .edge.order-only {{ stroke: #888; stroke-dasharray: 4 3; }}"
+    )?;
+    writeln!(
+        sink,
+        "    .edge.implicit-output {{ stroke: #003366; stroke-dasharray: 2 2; }}"
+    )?;
+    writeln!(
+        sink,
+        "    .edge.implicit-dep {{ stroke: #003366; stroke-width: 2.4; }}"
+    )?;
+    writeln!(
+        sink,
+        "    details {{ margin-top: 1rem; }} details > summary {{ cursor: pointer; font-weight: 600; }}"
+    )?;
+    writeln!(
+        sink,
+        "    pre {{ overflow: auto; padding: 0.5rem; background: #f3f4f6; }}"
+    )?;
+    writeln!(sink, "  </style>")?;
+    Ok(())
+}
+
+#[derive(Debug, Clone, Copy)]
+struct Position {
+    x: i32,
+    y: i32,
+}
+
+fn layout_positions(view: &GraphView) -> BTreeMap<&Utf8Path, Position> {
+    // Topological depth: sources at depth 0, then `depth(input) + 1` per node.
+    // Cycles are rejected upstream by `BuildGraph::from_manifest`.
+    let predecessors: BTreeMap<&Utf8Path, Vec<&Utf8Path>> = collect_predecessors(&view.edges);
+    let mut depths: BTreeMap<&Utf8Path, i32> = BTreeMap::new();
+    for node in &view.nodes {
+        compute_depth(node.path.as_path(), &predecessors, &mut depths);
+    }
+    let mut by_depth: BTreeMap<i32, Vec<&Utf8Path>> = BTreeMap::new();
+    for node in &view.nodes {
+        let depth = *depths.get(node.path.as_path()).unwrap_or(&0);
+        by_depth.entry(depth).or_default().push(node.path.as_path());
+    }
+    let mut positions = BTreeMap::new();
+    for (depth, paths) in &by_depth {
+        for (row, path) in paths.iter().enumerate() {
+            positions.insert(
+                *path,
+                Position {
+                    x: MARGIN + depth * COL_WIDTH,
+                    // `row * ROW_HEIGHT` fits in i32 for any realistic graph.
+                    y: MARGIN + i32::try_from(row).unwrap_or(i32::MAX) * ROW_HEIGHT,
+                },
+            );
+        }
+    }
+    positions
+}
+
+fn collect_predecessors(edges: &[EdgeView]) -> BTreeMap<&Utf8Path, Vec<&Utf8Path>> {
+    let mut preds: BTreeMap<&Utf8Path, Vec<&Utf8Path>> = BTreeMap::new();
+    for edge in edges {
+        preds
+            .entry(edge.to.as_path())
+            .or_default()
+            .push(edge.from.as_path());
+    }
+    preds
+}
+
+fn compute_depth<'a>(
+    path: &'a Utf8Path,
+    predecessors: &BTreeMap<&'a Utf8Path, Vec<&'a Utf8Path>>,
+    cache: &mut BTreeMap<&'a Utf8Path, i32>,
+) -> i32 {
+    if let Some(depth) = cache.get(path) {
+        return *depth;
+    }
+    // Insert 0 first to break any unexpected cycle defensively.
+    cache.insert(path, 0);
+    let depth = predecessors.get(path).map_or(0, |preds| {
+        preds
+            .iter()
+            .map(|pred| compute_depth(pred, predecessors, cache))
+            .max()
+            .map_or(0, |m| m.saturating_add(1))
+    });
+    cache.insert(path, depth);
+    depth
+}
+
+#[derive(Clone, Copy)]
+struct SvgHeader<'a> {
+    title: &'a str,
+    description: &'a str,
+}
+
+fn write_svg(
+    sink: &mut dyn Write,
+    view: &GraphView,
+    positions: &BTreeMap<&Utf8Path, Position>,
+    header: SvgHeader<'_>,
+) -> Result<(), GraphRenderError> {
+    let title = header.title;
+    let description = header.description;
+    let (width, height) = canvas_extent(positions);
+    writeln!(
+        sink,
+        "  <svg role=\"img\" aria-labelledby=\"svg-title svg-desc\" viewBox=\"0 0 {width} {height}\" width=\"{width}\" height=\"{height}\" xmlns=\"http://www.w3.org/2000/svg\">"
+    )?;
+    writeln!(
+        sink,
+        "    <title id=\"svg-title\">{}</title>",
+        escape_text(title)
+    )?;
+    writeln!(
+        sink,
+        "    <desc id=\"svg-desc\">{}</desc>",
+        escape_text(description)
+    )?;
+    for edge in &view.edges {
+        write_svg_edge(sink, edge, positions)?;
+    }
+    for node in &view.nodes {
+        write_svg_node(sink, node, positions)?;
+    }
+    writeln!(sink, "  </svg>")?;
+    Ok(())
+}
+
+fn canvas_extent(positions: &BTreeMap<&Utf8Path, Position>) -> (i32, i32) {
+    let max_x = positions
+        .values()
+        .map(|p| p.x + NODE_WIDTH)
+        .max()
+        .unwrap_or(NODE_WIDTH);
+    let max_y = positions
+        .values()
+        .map(|p| p.y + NODE_HEIGHT)
+        .max()
+        .unwrap_or(NODE_HEIGHT);
+    (max_x + MARGIN, max_y + MARGIN)
+}
+
+fn write_svg_node(
+    sink: &mut dyn Write,
+    node: &NodeView,
+    positions: &BTreeMap<&Utf8Path, Position>,
+) -> Result<(), GraphRenderError> {
+    let pos = positions
+        .get(node.path.as_path())
+        .copied()
+        .unwrap_or(Position {
+            x: MARGIN,
+            y: MARGIN,
+        });
+    let class = match node.kind {
+        NodeKind::Source => "node source",
+        NodeKind::Target { phony: true, .. } => "node phony",
+        NodeKind::Target {
+            phony: false,
+            always: true,
+        } => "node always",
+        NodeKind::Target {
+            phony: false,
+            always: false,
+        } => "node target",
+    };
+    let label = node.path.as_str();
+    writeln!(
+        sink,
+        "    <g class=\"{class}\" aria-label=\"{}\">",
+        escape_attr(label)
+    )?;
+    writeln!(
+        sink,
+        "      <rect x=\"{}\" y=\"{}\" width=\"{NODE_WIDTH}\" height=\"{NODE_HEIGHT}\"></rect>",
+        pos.x, pos.y
+    )?;
+    let text_x = pos.x + 8;
+    let text_y = pos.y + 18;
+    writeln!(
+        sink,
+        "      <text x=\"{text_x}\" y=\"{text_y}\">{}</text>",
+        escape_text(label)
+    )?;
+    if let Some(desc) = node.description.as_deref().filter(|d| !d.is_empty()) {
+        let desc_y = pos.y + 34;
+        writeln!(
+            sink,
+            "      <text x=\"{text_x}\" y=\"{desc_y}\" font-size=\"10\" fill=\"#444\">{}</text>",
+            escape_text(desc)
+        )?;
+    }
+    writeln!(sink, "    </g>")?;
+    Ok(())
+}
+
+fn write_svg_edge(
+    sink: &mut dyn Write,
+    edge: &EdgeView,
+    positions: &BTreeMap<&Utf8Path, Position>,
+) -> Result<(), GraphRenderError> {
+    let Some(&from) = positions.get(edge.from.as_path()) else {
+        return Ok(());
+    };
+    let Some(&to) = positions.get(edge.to.as_path()) else {
+        return Ok(());
+    };
+    let x1 = from.x + NODE_WIDTH;
+    let y1 = from.y + NODE_HEIGHT_HALF;
+    let x2 = to.x;
+    let y2 = to.y + NODE_HEIGHT_HALF;
+    let class = match edge.class {
+        EdgeClass::Explicit => "edge",
+        EdgeClass::ImplicitDep => "edge implicit-dep",
+        EdgeClass::ImplicitOutput => "edge implicit-output",
+        EdgeClass::OrderOnly => "edge order-only",
+    };
+    let title = format!("{} → {}", edge.from, edge.to);
+    // `x2 >= x1` in a left-to-right layered layout, so an arithmetic shift
+    // is equivalent to division by two while avoiding the workspace ban on
+    // `/` for integers.
+    let midpoint_x = x1 + ((x2 - x1) >> 1);
+    writeln!(sink, "    <g class=\"{class}\">")?;
+    writeln!(sink, "      <title>{}</title>", escape_text(&title))?;
+    writeln!(
+        sink,
+        "      <path d=\"M{x1} {y1} L{midpoint_x} {y1} L{midpoint_x} {y2} L{x2} {y2}\"></path>"
+    )?;
+    writeln!(sink, "    </g>")?;
+    Ok(())
+}
+
+fn write_outline(
+    sink: &mut dyn Write,
+    view: &GraphView,
+    summary: &str,
+) -> Result<(), GraphRenderError> {
+    let no_inputs = localized(keys::GRAPH_HTML_OUTLINE_NO_INPUTS);
+    let inputs_by_target = collect_inputs_by_target(view);
+    writeln!(sink, "  <details open>")?;
+    writeln!(sink, "    <summary>{}</summary>", escape_text(summary))?;
+    writeln!(sink, "    <ul>")?;
+    for node in &view.nodes {
+        if let NodeKind::Target { .. } = node.kind {
+            let inputs = inputs_by_target
+                .get(node.path.as_path())
+                .map_or(&[] as &[&Utf8Path], Vec::as_slice);
+            write_outline_item(sink, node.path.as_str(), inputs, &no_inputs)?;
+        }
+    }
+    writeln!(sink, "    </ul>")?;
+    writeln!(sink, "  </details>")?;
+    Ok(())
+}
+
+/// Write the `<li>` block for a single target node in the outline.
+fn write_outline_item(
+    sink: &mut dyn Write,
+    target: &str,
+    inputs: &[&Utf8Path],
+    no_inputs_msg: &str,
+) -> Result<(), GraphRenderError> {
+    writeln!(sink, "      <li>")?;
+    writeln!(sink, "        <code>{}</code>", escape_text(target))?;
+    write_outline_inputs(sink, inputs, no_inputs_msg)?;
+    writeln!(sink, "      </li>")?;
+    Ok(())
+}
+
+/// Write the inputs sub-list, or a "no inputs" notice if the slice is empty.
+fn write_outline_inputs(
+    sink: &mut dyn Write,
+    inputs: &[&Utf8Path],
+    no_inputs_msg: &str,
+) -> Result<(), GraphRenderError> {
+    if inputs.is_empty() {
+        writeln!(sink, "        <p>{}</p>", escape_text(no_inputs_msg))?;
+        return Ok(());
+    }
+    writeln!(sink, "        <ul>")?;
+    for input in inputs {
+        writeln!(
+            sink,
+            "          <li><code>{}</code></li>",
+            escape_text(input.as_str())
+        )?;
+    }
+    writeln!(sink, "        </ul>")?;
+    Ok(())
+}
+
+fn collect_inputs_by_target(view: &GraphView) -> BTreeMap<&Utf8Path, Vec<&Utf8Path>> {
+    collect_predecessors(&view.edges)
+}
+
+fn write_noscript(
+    sink: &mut dyn Write,
+    view: &GraphView,
+    notice: &str,
+) -> Result<(), GraphRenderError> {
+    writeln!(sink, "  <noscript>")?;
+    writeln!(sink, "    <p>{}</p>", escape_text(notice))?;
+    writeln!(sink, "    <pre><code>")?;
+    let mut dot_buf: Vec<u8> = Vec::new();
+    DotRenderer::new().render(view, &mut dot_buf)?;
+    let dot = String::from_utf8(dot_buf).unwrap_or_default();
+    write!(sink, "{}", escape_text(&dot))?;
+    writeln!(sink, "</code></pre>")?;
+    writeln!(sink, "  </noscript>")?;
+    Ok(())
+}
+
+fn escape_html(input: &str, attr: bool) -> String {
+    let mut out = String::with_capacity(input.len());
+    for ch in input.chars() {
+        match ch {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' if attr => out.push_str("&quot;"),
+            '\'' if attr => out.push_str("&#39;"),
+            other => out.push(other),
+        }
+    }
+    out
+}
+
+fn escape_text(input: &str) -> String {
+    escape_html(input, false)
+}
+
+fn escape_attr(input: &str) -> String {
+    escape_html(input, true)
+}
+
+#[cfg(test)]
+#[path = "render_html_tests.rs"]
+mod tests;
diff --git a/src/graph_view/render_html_tests.rs b/src/graph_view/render_html_tests.rs
new file mode 100644
index 00000000..cad57e13
--- /dev/null
+++ b/src/graph_view/render_html_tests.rs
@@ -0,0 +1,141 @@
+//! Tests for the HTML renderer.
+
+use camino::Utf8PathBuf;
+
+use crate::graph_view::render::GraphRenderer;
+use crate::graph_view::{EdgeClass, EdgeView, GraphView, NodeKind, NodeView};
+
+use super::HtmlRenderer;
+
+fn small_view() -> GraphView {
+    GraphView {
+        default_targets: vec![Utf8PathBuf::from("out/app")],
+        nodes: vec![
+            NodeView {
+                path: Utf8PathBuf::from("out/app"),
+                kind: NodeKind::Target {
+                    phony: false,
+                    always: false,
+                },
+                action_id: Some("h".into()),
+                description: Some("link app".into()),
+            },
+            NodeView {
+                path: Utf8PathBuf::from("src/main.c"),
+                kind: NodeKind::Source,
+                action_id: None,
+                description: None,
+            },
+        ],
+        edges: vec![EdgeView {
+            from: Utf8PathBuf::from("src/main.c"),
+            to: Utf8PathBuf::from("out/app"),
+            class: EdgeClass::Explicit,
+        }],
+        limit: None,
+    }
+}
+
+fn render(locale: Option<&str>, view: &GraphView) -> String {
+    let mut out = Vec::new();
+    HtmlRenderer::new(locale)
+        .render(view, &mut out)
+        .expect("render html");
+    String::from_utf8(out).expect("utf-8")
+}
+
+#[test]
+fn document_contains_required_structure() {
+    let html = render(None, &small_view());
+    for fragment in [
+        "<!doctype html>\n",
+        "<html lang=\"en\"",
+        "<title>",
+        "<svg",
+        "aria-labelledby",
+        "<details",
+        "<noscript>",
+        "digraph netsuke",
+    ] {
+        assert!(html.contains(fragment), "missing fragment: {fragment}");
+    }
+}
+
+#[test]
+fn document_has_no_external_references() {
+    let html = render(None, &small_view());
+    for attr in ["href=\"http", "src=\"http", "url(http"] {
+        assert!(!html.contains(attr), "external resource reference: {attr}");
+    }
+}
+
+#[test]
+fn nodes_and_edges_carry_accessibility_metadata() {
+    let html = render(None, &small_view());
+    assert!(html.contains("aria-label=\"out/app\""));
+    assert!(html.contains("aria-label=\"src/main.c\""));
+    // The edge title text encodes the relationship for hover/screen reader.
+    assert!(html.contains("src/main.c → out/app"));
+}
+
+#[test]
+fn rendering_is_byte_identical_across_runs() {
+    let view = small_view();
+    let first = render(None, &view);
+    let second = render(None, &view);
+    assert_eq!(first, second);
+}
+
+#[test]
+fn locale_attribute_reflects_locale_argument() {
+    let html = render(Some("es-ES"), &small_view());
+    assert!(html.contains("<html lang=\"es-ES\""));
+}
+
+#[test]
+fn outline_lists_targets_and_inputs() {
+    let html = render(None, &small_view());
+    // Target appears in the outline; source files are not listed as separate
+    // outline entries because they have no inputs.
+    assert!(html.contains("<details"));
+    assert!(html.contains("<code>out/app</code>"));
+    assert!(html.contains("<code>src/main.c</code>"));
+}
+
+#[test]
+fn implicit_dep_edge_emits_implicit_dep_class() {
+    let mut view = small_view();
+    view.nodes.push(NodeView {
+        path: Utf8PathBuf::from("include/config.h"),
+        kind: NodeKind::Source,
+        action_id: None,
+        description: None,
+    });
+    view.edges.push(EdgeView {
+        from: Utf8PathBuf::from("include/config.h"),
+        to: Utf8PathBuf::from("out/app"),
+        class: EdgeClass::ImplicitDep,
+    });
+    let html = render(None, &view);
+    assert!(
+        html.contains(".edge.implicit-dep"),
+        "stylesheet should define .edge.implicit-dep"
+    );
+    assert!(
+        html.contains("class=\"edge implicit-dep\""),
+        "implicit-dep edge should carry the implicit-dep class"
+    );
+}
+
+#[test]
+fn paths_with_angle_brackets_are_escaped() {
+    let mut view = small_view();
+    view.nodes.push(NodeView {
+        path: Utf8PathBuf::from("a<b>"),
+        kind: NodeKind::Source,
+        action_id: None,
+        description: None,
+    });
+    let html = render(None, &view);
+    assert!(html.contains("a&lt;b&gt;"));
+}
diff --git a/src/graph_view/tests.rs b/src/graph_view/tests.rs
new file mode 100644
index 00000000..6180ef84
--- /dev/null
+++ b/src/graph_view/tests.rs
@@ -0,0 +1,398 @@
+//! Unit and property tests for [`super::GraphView`].
+
+use camino::Utf8PathBuf;
+use proptest::prelude::*;
+use rstest::rstest;
+
+use crate::ast::Recipe;
+use crate::ir::{Action, BuildEdge, BuildGraph};
+
+use super::{EdgeClass, GraphView, NodeKind};
+
+fn make_action(description: Option<&str>) -> Action {
+    Action {
+        recipe: Recipe::Command {
+            command: "echo".into(),
+        },
+        description: description.map(str::to_owned),
+        depfile: None,
+        deps_format: None,
+        pool: None,
+        restat: false,
+    }
+}
+
+fn p(s: &str) -> Utf8PathBuf {
+    Utf8PathBuf::from(s)
+}
+
+#[derive(Default, Clone, Copy)]
+struct EdgeFixture<'a> {
+    action_id: &'a str,
+    inputs: &'a [&'a str],
+    implicit_deps: &'a [&'a str],
+    explicit_outputs: &'a [&'a str],
+    implicit_outputs: &'a [&'a str],
+    order_only_deps: &'a [&'a str],
+}
+
+fn add_edge(graph: &mut BuildGraph, fixture: EdgeFixture<'_>) {
+    let edge = BuildEdge {
+        action_id: fixture.action_id.into(),
+        inputs: fixture.inputs.iter().map(|s| p(s)).collect(),
+        implicit_deps: fixture.implicit_deps.iter().map(|s| p(s)).collect(),
+        explicit_outputs: fixture.explicit_outputs.iter().map(|s| p(s)).collect(),
+        implicit_outputs: fixture.implicit_outputs.iter().map(|s| p(s)).collect(),
+        order_only_deps: fixture.order_only_deps.iter().map(|s| p(s)).collect(),
+        phony: false,
+        always: false,
+    };
+    for out in &edge.explicit_outputs {
+        graph.targets.insert(out.clone(), edge.clone());
+    }
+    for out in &edge.implicit_outputs {
+        graph.targets.insert(out.clone(), edge.clone());
+    }
+}
+
+#[test]
+fn empty_graph_yields_empty_view() {
+    let graph = BuildGraph::default();
+    let view = GraphView::from_build_graph(&graph);
+    assert!(view.nodes.is_empty());
+    assert!(view.edges.is_empty());
+    assert!(view.default_targets.is_empty());
+    assert!(view.limit.is_none());
+}
+
+#[rstest]
+#[case::single_input(&[("compile", &["src/a.c"][..], &["out/a.o"][..])])]
+#[case::fan_in(&[
+    ("link", &["out/a.o", "out/b.o"][..], &["out/app"][..]),
+])]
+#[case::fan_out(&[
+    ("compile_a", &["src/a.c"][..], &["out/a.o"][..]),
+    ("compile_b", &["src/b.c"][..], &["out/b.o"][..]),
+])]
+fn target_nodes_are_classified_as_targets(#[case] edges: &[(&str, &[&str], &[&str])]) {
+    let mut graph = BuildGraph::default();
+    for (id, _, _) in edges {
+        graph
+            .actions
+            .insert((*id).into(), make_action(Some("desc")));
+    }
+    for (id, inputs, outputs) in edges {
+        add_edge(
+            &mut graph,
+            EdgeFixture {
+                action_id: id,
+                inputs,
+                explicit_outputs: outputs,
+                ..EdgeFixture::default()
+            },
+        );
+    }
+    let view = GraphView::from_build_graph(&graph);
+    let mut outputs: Vec<_> = edges
+        .iter()
+        .flat_map(|(_, _, outs)| outs.iter().copied())
+        .collect();
+    outputs.sort_unstable();
+    outputs.dedup();
+    for out in outputs {
+        let node = view
+            .nodes
+            .iter()
+            .find(|n| n.path == p(out))
+            .expect("output node");
+        assert!(matches!(node.kind, NodeKind::Target { .. }));
+        assert_eq!(node.description.as_deref(), Some("desc"));
+    }
+}
+
+#[test]
+fn implicit_dep_yields_implicit_dep_edge() {
+    let mut graph = BuildGraph::default();
+    graph.actions.insert("a".into(), make_action(None));
+    add_edge(
+        &mut graph,
+        EdgeFixture {
+            action_id: "a",
+            inputs: &["src/a.c"],
+            implicit_deps: &["include/config.h"],
+            explicit_outputs: &["out/a.o"],
+            ..EdgeFixture::default()
+        },
+    );
+    let view = GraphView::from_build_graph(&graph);
+    let edge = view
+        .edges
+        .iter()
+        .find(|e| e.from == p("include/config.h") && e.to == p("out/a.o"))
+        .expect("implicit-dep edge");
+    assert_eq!(edge.class, EdgeClass::ImplicitDep);
+    let node = view
+        .nodes
+        .iter()
+        .find(|n| n.path == p("include/config.h"))
+        .expect("implicit-dep source node");
+    assert_eq!(node.kind, NodeKind::Source);
+}
+
+#[test]
+fn implicit_dep_emits_edge_to_every_output() {
+    let mut graph = BuildGraph::default();
+    graph.actions.insert("a".into(), make_action(None));
+    add_edge(
+        &mut graph,
+        EdgeFixture {
+            action_id: "a",
+            inputs: &["src/a.c"],
+            implicit_deps: &["include/config.h"],
+            explicit_outputs: &["out/a.o"],
+            implicit_outputs: &["out/a.d"],
+            ..EdgeFixture::default()
+        },
+    );
+    let view = GraphView::from_build_graph(&graph);
+    let dep = p("include/config.h");
+    let mut dep_targets: Vec<_> = view
+        .edges
+        .iter()
+        .filter(|e| e.from == dep && e.class == EdgeClass::ImplicitDep)
+        .map(|e| e.to.clone())
+        .collect();
+    dep_targets.sort();
+    assert_eq!(dep_targets, vec![p("out/a.d"), p("out/a.o")]);
+}
+
+#[test]
+fn order_only_dep_yields_order_only_edge() {
+    let mut graph = BuildGraph::default();
+    graph.actions.insert("a".into(), make_action(None));
+    add_edge(
+        &mut graph,
+        EdgeFixture {
+            action_id: "a",
+            inputs: &["src/a.c"],
+            explicit_outputs: &["out/a.o"],
+            order_only_deps: &["build-dir"],
+            ..EdgeFixture::default()
+        },
+    );
+    let view = GraphView::from_build_graph(&graph);
+    let edge = view
+        .edges
+        .iter()
+        .find(|e| e.from == p("build-dir") && e.to == p("out/a.o"))
+        .expect("order-only edge");
+    assert_eq!(edge.class, EdgeClass::OrderOnly);
+    let node = view
+        .nodes
+        .iter()
+        .find(|n| n.path == p("build-dir"))
+        .expect("order-only node");
+    assert_eq!(node.kind, NodeKind::Source);
+}
+
+#[test]
+fn implicit_output_yields_implicit_edge_class() {
+    let mut graph = BuildGraph::default();
+    graph.actions.insert("a".into(), make_action(None));
+    add_edge(
+        &mut graph,
+        EdgeFixture {
+            action_id: "a",
+            inputs: &["src/a.c"],
+            explicit_outputs: &["out/a.o"],
+            implicit_outputs: &["out/a.d"],
+            ..EdgeFixture::default()
+        },
+    );
+    let view = GraphView::from_build_graph(&graph);
+    let implicit = view
+        .edges
+        .iter()
+        .find(|e| e.to == p("out/a.d"))
+        .expect("edge to implicit output");
+    assert_eq!(implicit.class, EdgeClass::ImplicitOutput);
+    let explicit = view
+        .edges
+        .iter()
+        .find(|e| e.to == p("out/a.o"))
+        .expect("edge to explicit output");
+    assert_eq!(explicit.class, EdgeClass::Explicit);
+}
+
+#[test]
+fn edges_and_nodes_are_sorted_canonically() {
+    let mut graph = BuildGraph::default();
+    graph.actions.insert("a".into(), make_action(None));
+    add_edge(
+        &mut graph,
+        EdgeFixture {
+            action_id: "a",
+            inputs: &["z", "a"],
+            explicit_outputs: &["m"],
+            ..EdgeFixture::default()
+        },
+    );
+    let view = GraphView::from_build_graph(&graph);
+    let paths: Vec<_> = view.nodes.iter().map(|n| n.path.clone()).collect();
+    let mut sorted = paths.clone();
+    sorted.sort();
+    assert_eq!(paths, sorted);
+    let edge_keys: Vec<_> = view
+        .edges
+        .iter()
+        .map(|e| (e.from.clone(), e.to.clone(), e.class))
+        .collect();
+    let mut sorted_edges = edge_keys.clone();
+    sorted_edges.sort();
+    assert_eq!(edge_keys, sorted_edges);
+}
+
+#[test]
+fn default_targets_are_sorted_and_deduped() {
+    let mut graph = BuildGraph::default();
+    graph
+        .default_targets
+        .extend([p("z"), p("a"), p("a"), p("m")]);
+    let view = GraphView::from_build_graph(&graph);
+    assert_eq!(view.default_targets, vec![p("a"), p("m"), p("z")]);
+}
+
+fn build_graph_from_edge_specs(
+    actions: &[(String, Option<String>)],
+    edge_specs: &[EdgeSpec],
+) -> BuildGraph {
+    let mut graph = BuildGraph::default();
+    for (id, desc) in actions {
+        graph
+            .actions
+            .insert(id.clone(), make_action(desc.as_deref()));
+    }
+    for spec in edge_specs {
+        let inputs: Vec<&str> = spec.inputs.iter().map(String::as_str).collect();
+        let implicit_deps: Vec<&str> = spec.implicit_deps.iter().map(String::as_str).collect();
+        let explicit_outputs: Vec<&str> =
+            spec.explicit_outputs.iter().map(String::as_str).collect();
+        let implicit_outputs: Vec<&str> =
+            spec.implicit_outputs.iter().map(String::as_str).collect();
+        let order_only_deps: Vec<&str> = spec.order_only_deps.iter().map(String::as_str).collect();
+        add_edge(
+            &mut graph,
+            EdgeFixture {
+                action_id: &spec.action_id,
+                inputs: &inputs,
+                implicit_deps: &implicit_deps,
+                explicit_outputs: &explicit_outputs,
+                implicit_outputs: &implicit_outputs,
+                order_only_deps: &order_only_deps,
+            },
+        );
+    }
+    graph
+}
+
+#[derive(Debug, Clone)]
+struct EdgeSpec {
+    action_id: String,
+    inputs: Vec<String>,
+    implicit_deps: Vec<String>,
+    explicit_outputs: Vec<String>,
+    implicit_outputs: Vec<String>,
+    order_only_deps: Vec<String>,
+}
+
+fn arb_path() -> impl Strategy<Value = String> {
+    "[a-d]{1,3}".prop_map(String::from)
+}
+
+fn arb_edge_spec(action_id: String) -> impl Strategy<Value = EdgeSpec> {
+    (
+        prop::collection::vec(arb_path(), 0..3),
+        prop::collection::vec(arb_path(), 0..2),
+        prop::collection::vec(arb_path(), 1..3),
+        prop::collection::vec(arb_path(), 0..2),
+        prop::collection::vec(arb_path(), 0..2),
+    )
+        .prop_map(
+            move |(inputs, implicit_deps, explicit_outputs, implicit_outputs, order_only_deps)| {
+                EdgeSpec {
+                    action_id: action_id.clone(),
+                    inputs,
+                    implicit_deps,
+                    explicit_outputs,
+                    implicit_outputs,
+                    order_only_deps,
+                }
+            },
+        )
+}
+
+fn arb_graph_inputs() -> impl Strategy<Value = (Vec<(String, Option<String>)>, Vec<EdgeSpec>)> {
+    prop::collection::vec(0u8..4, 1..4).prop_flat_map(|action_ids| {
+        let actions: Vec<(String, Option<String>)> = action_ids
+            .into_iter()
+            .enumerate()
+            .map(|(i, _)| (format!("a{i}"), Some(format!("desc-{i}"))))
+            .collect();
+        let edge_strategies: Vec<_> = actions
+            .iter()
+            .map(|(id, _)| arb_edge_spec(id.clone()))
+            .collect();
+        let actions_clone = actions.clone();
+        edge_strategies.prop_map(move |edges| (actions_clone.clone(), edges))
+    })
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig {
+        cases: 256,
+        .. ProptestConfig::default()
+    })]
+
+    /// Property: `GraphView` is invariant under non-deterministic insertion
+    /// order. The same logical graph projected through two distinct
+    /// construction sequences must produce equal views.
+    #[test]
+    fn graphview_is_insertion_order_invariant(
+        (actions, raw_edges) in arb_graph_inputs(),
+    ) {
+        // `BuildGraph::targets` is keyed by output path: any two edges
+        // sharing an output collide at insertion time, which `from_manifest`
+        // rejects as `DuplicateOutput`. Filter the generator's input space
+        // to the realistic case where outputs are globally disjoint.
+        let mut owned_outputs = std::collections::BTreeSet::new();
+        let edges: Vec<_> = raw_edges
+            .into_iter()
+            .filter(|e| {
+                let mut all = e.explicit_outputs.clone();
+                all.extend(e.implicit_outputs.iter().cloned());
+                if all.iter().any(|o| owned_outputs.contains(o)) {
+                    return false;
+                }
+                for o in &all {
+                    owned_outputs.insert(o.clone());
+                }
+                true
+            })
+            .collect();
+
+        let mut reversed_actions = actions.clone();
+        reversed_actions.reverse();
+        let mut reversed_edges = edges.clone();
+        reversed_edges.reverse();
+
+        // Each call constructs fresh `HashMap`s with independent
+        // `RandomState` seeds; combined with the reversed insertion order,
+        // any leak of iteration ordering into `GraphView` shows up here.
+        let g_forward = build_graph_from_edge_specs(&actions, &edges);
+        let g_reversed = build_graph_from_edge_specs(&reversed_actions, &reversed_edges);
+
+        let view_a = GraphView::from_build_graph(&g_forward);
+        let view_b = GraphView::from_build_graph(&g_reversed);
+        prop_assert_eq!(view_a, view_b);
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 99203cdf..991531bf 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -10,6 +10,7 @@ pub mod cli_localization;
 mod cli_policy;
 pub mod diagnostic_json;
 pub(crate) mod diagnostics;
+pub mod graph_view;
 pub mod hasher;
 pub mod host_pattern;
 pub mod ir;
diff --git a/src/localization/keys.rs b/src/localization/keys.rs
index 309637f9..e2c44db5 100644
--- a/src/localization/keys.rs
+++ b/src/localization/keys.rs
@@ -39,6 +39,8 @@ define_keys! {
     CLI_SUBCOMMAND_MANIFEST_LONG_ABOUT => "cli.subcommand.manifest.long_about",
     CLI_SUBCOMMAND_BUILD_FLAG_EMIT_HELP => "cli.subcommand.build.flag.emit.help",
     CLI_SUBCOMMAND_BUILD_FLAG_TARGETS_HELP => "cli.subcommand.build.flag.targets.help",
+    CLI_SUBCOMMAND_GRAPH_FLAG_HTML_HELP => "cli.subcommand.graph.flag.html.help",
+    CLI_SUBCOMMAND_GRAPH_FLAG_OUTPUT_HELP => "cli.subcommand.graph.flag.output.help",
     CLI_SUBCOMMAND_MANIFEST_FLAG_FILE_HELP => "cli.subcommand.manifest.flag.file.help",
     CLAP_ERROR_MISSING_ARGUMENT => "clap-error-missing-argument",
     CLAP_ERROR_MISSING_SUBCOMMAND => "clap-error-missing-subcommand",
@@ -310,7 +312,14 @@ define_keys! {
     STATUS_TOOL_BUILD => "status.tool.build",
     STATUS_TOOL_CLEAN => "status.tool.clean",
     STATUS_TOOL_GRAPH => "status.tool.graph",
+    STATUS_TOOL_GRAPH_HTML => "status.tool.graph_html",
     STATUS_TOOL_MANIFEST => "status.tool.manifest",
+    GRAPH_HTML_TITLE => "graph.html.title",
+    GRAPH_HTML_HEADING => "graph.html.heading",
+    GRAPH_HTML_DESCRIPTION => "graph.html.description",
+    GRAPH_HTML_OUTLINE_SUMMARY => "graph.html.outline.summary",
+    GRAPH_HTML_OUTLINE_NO_INPUTS => "graph.html.outline.no_inputs",
+    GRAPH_HTML_NOSCRIPT_NOTICE => "graph.html.noscript.notice",
     CLI_FLAG_NO_EMOJI_HELP => "cli.flag.no_emoji.help",
     CLI_FLAG_THEME_HELP => "cli.flag.theme.help",
     CLI_THEME_INVALID => "cli.validation.theme.invalid",
diff --git a/src/runner/mod.rs b/src/runner/mod.rs
index f8814cbe..18eb9cc2 100644
--- a/src/runner/mod.rs
+++ b/src/runner/mod.rs
@@ -8,7 +8,11 @@ mod error;
 
 pub use error::RunnerError;
 
-use crate::cli::{BuildArgs, Cli, Commands};
+use crate::cli::{BuildArgs, Cli, Commands, GraphArgs};
+use crate::graph_view::GraphView;
+use crate::graph_view::render::GraphRenderer;
+use crate::graph_view::render_dot::DotRenderer;
+use crate::graph_view::render_html::HtmlRenderer;
 use crate::localization::{self, keys};
 use crate::output_mode::{self, OutputMode};
 use crate::output_prefs::OutputPrefs;
@@ -172,15 +176,71 @@ pub fn run(cli: &Cli, prefs: OutputPrefs) -> Result<()> {
             reporter.as_ref(),
             progress_enabled,
         ),
-        Commands::Graph => handle_ninja_tool(
-            cli,
-            NinjaToolSpec {
-                name: "graph",
-                key: keys::STATUS_TOOL_GRAPH.into(),
-            },
-            reporter.as_ref(),
-            progress_enabled,
-        ),
+        Commands::Graph(args) => handle_graph(cli, &args, reporter.as_ref()),
+    }
+}
+
+/// Project the build graph and render it as DOT (or, in Stage C, HTML).
+///
+/// # Errors
+///
+/// Returns an error if manifest loading, IR generation, rendering, or the
+/// final file/stdout write fails.
+fn handle_graph(cli: &Cli, args: &GraphArgs, reporter: &dyn StatusReporter) -> Result<()> {
+    info!(
+        target: "netsuke::subcommand",
+        subcommand = "graph",
+        html = args.html,
+        "Rendering build graph in-process"
+    );
+    let manifest_path = resolve_manifest_path(cli)?;
+    ensure_manifest_exists_or_error(cli, reporter, &manifest_path)?;
+    let policy = cli
+        .network_policy()
+        .context(localization::message(keys::RUNNER_CONTEXT_NETWORK_POLICY))?;
+    let manifest = load_manifest_with_stage_reporting(&manifest_path, policy, reporter)?;
+    report_pipeline_stage(reporter, PipelineStage::IrGenerationValidation, None);
+    let graph = BuildGraph::from_manifest(&manifest)
+        .context(localization::message(keys::RUNNER_CONTEXT_BUILD_GRAPH))?;
+    let view = GraphView::from_build_graph(&graph);
+
+    let status_key: LocalizationKey = if args.html {
+        keys::STATUS_TOOL_GRAPH_HTML.into()
+    } else {
+        keys::STATUS_TOOL_GRAPH.into()
+    };
+    report_pipeline_stage(
+        reporter,
+        PipelineStage::NinjaSynthesisAndExecution,
+        Some(status_key),
+    );
+
+    let mut buffer: Vec<u8> = Vec::new();
+    if args.html {
+        HtmlRenderer::new(cli.locale.as_deref())
+            .render(&view, &mut buffer)
+            .context(localization::message(keys::RUNNER_CONTEXT_GENERATE_NINJA))?;
+    } else {
+        DotRenderer::new()
+            .render(&view, &mut buffer)
+            .context(localization::message(keys::RUNNER_CONTEXT_GENERATE_NINJA))?;
+    }
+    let rendered = String::from_utf8(buffer)
+        .context(localization::message(keys::RUNNER_CONTEXT_GENERATE_NINJA))?;
+
+    write_graph_artefact(cli, args.output.as_deref(), &rendered)?;
+    reporter.report_complete(status_key);
+    Ok(())
+}
+
+fn write_graph_artefact(cli: &Cli, output: Option<&Path>, content: &str) -> Result<()> {
+    match output {
+        None => process::write_text_stdout(content),
+        Some(path) if process::is_stdout_path(path) => process::write_text_stdout(content),
+        Some(path) => {
+            let resolved = resolve_output_path(cli, path);
+            process::write_text_file(resolved.as_ref(), content)
+        }
     }
 }
 
diff --git a/src/runner/process/file_io.rs b/src/runner/process/file_io.rs
index 4c1264d0..41a80cd9 100644
--- a/src/runner/process/file_io.rs
+++ b/src/runner/process/file_io.rs
@@ -40,11 +40,7 @@ pub fn create_temp_ninja_file(content: &NinjaContent) -> AnyResult<NamedTempFile
     Ok(tmp)
 }
 
-pub fn write_ninja_file_utf8(
-    dir: &cap_fs::Dir,
-    path: &Utf8Path,
-    content: &NinjaContent,
-) -> AnyResult<()> {
+pub fn write_text_file_utf8(dir: &cap_fs::Dir, path: &Utf8Path, content: &str) -> AnyResult<()> {
     if let Some(parent) = path.parent().filter(|p| !p.as_str().is_empty()) {
         dir.create_dir_all(parent.as_str()).with_context(|| {
             localization::message(keys::RUNNER_IO_CREATE_PARENT_DIR)
@@ -54,10 +50,9 @@ pub fn write_ninja_file_utf8(
     let mut file = dir.create(path.as_str()).with_context(|| {
         localization::message(keys::RUNNER_IO_CREATE_NINJA_FILE).with_arg("path", path.as_str())
     })?;
-    file.write_all(content.as_str().as_bytes())
-        .with_context(|| {
-            localization::message(keys::RUNNER_IO_WRITE_NINJA_FILE).with_arg("path", path.as_str())
-        })?;
+    file.write_all(content.as_bytes()).with_context(|| {
+        localization::message(keys::RUNNER_IO_WRITE_NINJA_FILE).with_arg("path", path.as_str())
+    })?;
     file.flush().with_context(|| {
         localization::message(keys::RUNNER_IO_FLUSH_NINJA_FILE).with_arg("path", path.as_str())
     })?;
@@ -97,6 +92,11 @@ fn derive_dir_and_relative(path: &Utf8Path) -> AnyResult<(cap_fs::Dir, Utf8PathB
 }
 
 pub fn write_ninja_file(path: &Path, content: &NinjaContent) -> AnyResult<()> {
+    write_text_file(path, content.as_str())?;
+    Ok(())
+}
+
+pub fn write_text_file(path: &Path, content: &str) -> AnyResult<()> {
     let utf8_path = Utf8Path::from_path(path).ok_or_else(|| {
         anyhow!(
             localization::message(keys::RUNNER_IO_NON_UTF8_PATH)
@@ -105,8 +105,8 @@ pub fn write_ninja_file(path: &Path, content: &NinjaContent) -> AnyResult<()> {
         )
     })?;
     let (dir, relative) = derive_dir_and_relative(utf8_path)?;
-    write_ninja_file_utf8(&dir, &relative, content)?;
-    info!("Wrote Ninja file to {utf8_path}");
+    write_text_file_utf8(&dir, &relative, content)?;
+    info!("Wrote file to {utf8_path}");
     Ok(())
 }
 
@@ -131,8 +131,12 @@ fn flush_ignoring_broken_pipe(writer: &mut impl Write) -> io::Result<()> {
 }
 
 pub fn write_ninja_stdout(content: &NinjaContent) -> AnyResult<()> {
+    write_text_stdout(content.as_str())
+}
+
+pub fn write_text_stdout(content: &str) -> AnyResult<()> {
     let mut stdout = io::stdout().lock();
-    write_all_ignoring_broken_pipe(&mut stdout, content.as_str().as_bytes())
+    write_all_ignoring_broken_pipe(&mut stdout, content.as_bytes())
         .context(localization::message(keys::RUNNER_IO_WRITE_STDOUT))?;
     flush_ignoring_broken_pipe(&mut stdout)
         .context(localization::message(keys::RUNNER_IO_FLUSH_STDOUT))?;
@@ -212,21 +216,20 @@ mod tests {
     }
 
     #[test]
-    fn write_ninja_file_utf8_creates_parent_directories() -> Result<()> {
+    fn write_text_file_utf8_creates_parent_directories() -> Result<()> {
         let temp = tempfile::tempdir().context("create temp dir")?;
         let dir = cap_fs::Dir::open_ambient_dir(temp.path(), ambient_authority())
             .context("open temp dir")?;
         let nested = Utf8PathBuf::from("nested/build.ninja");
-        let content = NinjaContent::new(String::from("build all: phony"));
+        let content = "build all: phony";
 
-        write_ninja_file_utf8(&dir, &nested, &content)?;
+        write_text_file_utf8(&dir, &nested, content)?;
 
         let nested_path = temp.path().join("nested").join("build.ninja");
         let written = std::fs::read_to_string(&nested_path).context("read nested file")?;
         ensure!(
-            written == content.as_str(),
-            "nested file contents '{written}' did not match '{expected}'",
-            expected = content.as_str()
+            written == content,
+            "nested file contents '{written}' did not match '{content}'"
         );
         let parent = nested_path.parent().context("determine parent path")?;
         ensure!(
diff --git a/src/runner/process/mod.rs b/src/runner/process/mod.rs
index 5e5bb19a..3f92d460 100644
--- a/src/runner/process/mod.rs
+++ b/src/runner/process/mod.rs
@@ -44,7 +44,7 @@ pub mod doc {
     };
     pub use super::{
         create_temp_ninja_file, resolve_ninja_program, resolve_ninja_program_utf8,
-        write_ninja_file, write_ninja_file_utf8,
+        write_ninja_file, write_text_file_utf8,
     };
 }
 
diff --git a/tests/bdd/steps/cli.rs b/tests/bdd/steps/cli.rs
index 24258860..a4c60749 100644
--- a/tests/bdd/steps/cli.rs
+++ b/tests/bdd/steps/cli.rs
@@ -100,6 +100,22 @@ fn extract_build(world: &TestWorld) -> Result<(Vec<String>, Option<PathBuf>)> {
         .context("expected build command")
 }
 
+/// Extract graph command args.
+fn extract_graph_args(world: &TestWorld) -> Result<netsuke::cli::GraphArgs> {
+    match get_command(world)? {
+        Commands::Graph(args) => Ok(args),
+        other => bail!("expected graph command, got {other:?}"),
+    }
+}
+
+/// Extract manifest command file path.
+fn extract_manifest_command_file(world: &TestWorld) -> Result<PathBuf> {
+    match get_command(world)? {
+        Commands::Manifest { file } => Ok(file),
+        other => bail!("expected manifest command, got {other:?}"),
+    }
+}
+
 /// Get the parsed CLI command.
 fn get_command(world: &TestWorld) -> Result<Commands> {
     world
@@ -142,7 +158,7 @@ impl ExpectedCommand {
             (self, actual),
             (Self::Build, Commands::Build(_))
                 | (Self::Clean, Commands::Clean)
-                | (Self::Graph, Commands::Graph)
+                | (Self::Graph, Commands::Graph(_))
                 | (Self::Manifest, Commands::Manifest { .. })
         )
     }
@@ -220,29 +236,27 @@ fn verify_first_target(world: &TestWorld, target: &TargetName) -> Result<()> {
     Ok(())
 }
 
+/// Assert that an optional path equals the expected value.
+fn ensure_optional_path(actual: Option<PathBuf>, expected: &PathString, label: &str) -> Result<()> {
+    ensure!(
+        actual.as_deref() == Some(expected.as_path()),
+        "expected {label} {expected}, got {actual:?}",
+    );
+    drop(actual);
+    Ok(())
+}
+
 fn verify_working_directory(world: &TestWorld, directory: &PathString) -> Result<()> {
     let actual = world
         .cli
         .with_ref(|cli| cli.directory.clone())
         .context("CLI has not been parsed")?;
-    ensure!(
-        actual.as_deref() == Some(directory.as_path()),
-        "expected working directory {}, got {:?}",
-        directory,
-        actual
-    );
-    Ok(())
+    ensure_optional_path(actual, directory, "working directory")
 }
 
 fn verify_emit_path(world: &TestWorld, path: &PathString) -> Result<()> {
     let (_, emit) = extract_build(world)?;
-    ensure!(
-        emit.as_deref() == Some(path.as_path()),
-        "expected emit path {}, got {:?}",
-        path,
-        emit
-    );
-    Ok(())
+    ensure_optional_path(emit, path, "emit path")
 }
 
 fn verify_cli_policy_allows(world: &TestWorld, url: &UrlString) -> Result<()> {
@@ -276,20 +290,26 @@ fn verify_cli_policy_rejects(
     Ok(())
 }
 
+fn verify_graph_output_path(world: &TestWorld, path: &PathString) -> Result<()> {
+    let output = extract_graph_args(world)?.output;
+    ensure_optional_path(output, path, "graph output path")
+}
+
+fn verify_graph_html_set(world: &TestWorld) -> Result<()> {
+    let args = extract_graph_args(world)?;
+    ensure!(args.html, "expected graph --html to be set");
+    Ok(())
+}
+
 fn verify_manifest_command_path(world: &TestWorld, path: &PathString) -> Result<()> {
-    let command = get_command(world)?;
-    match command {
-        Commands::Manifest { file } => {
-            ensure!(
-                file == path.to_path_buf(),
-                "expected manifest output {}, got {}",
-                path,
-                file.display()
-            );
-            Ok(())
-        }
-        other => bail!("expected manifest command, got {other:?}"),
-    }
+    let file = extract_manifest_command_file(world)?;
+    ensure!(
+        file == path.to_path_buf(),
+        "expected manifest output {}, got {}",
+        path,
+        file.display()
+    );
+    Ok(())
 }
 
 fn verify_error_contains(world: &TestWorld, fragment: &ErrorFragment) -> Result<()> {
@@ -380,6 +400,16 @@ fn manifest_command_path(world: &TestWorld, path: PathString) -> Result<()> {
     verify_manifest_command_path(world, &path)
 }
 
+#[then("the graph output path is {path:string}")]
+fn graph_output_path(world: &TestWorld, path: PathString) -> Result<()> {
+    verify_graph_output_path(world, &path)
+}
+
+#[then("the graph html flag is set")]
+fn graph_html_flag_is_set(world: &TestWorld) -> Result<()> {
+    verify_graph_html_set(world)
+}
+
 #[then]
 fn an_error_should_be_returned(world: &TestWorld) -> Result<()> {
     verify_error_returned(world)
diff --git a/tests/features/cli.feature b/tests/features/cli.feature
index 9bfa2385..ba5c5266 100644
--- a/tests/features/cli.feature
+++ b/tests/features/cli.feature
@@ -20,6 +20,31 @@ Feature: CLI parsing
     And the command is graph
     And the job count is 2
 
+  Scenario: Graph command accepts --output
+    When the CLI is parsed with "graph --output build.dot"
+    Then parsing succeeds
+    And the command is graph
+    And the graph output path is "build.dot"
+
+  Scenario: Graph command --output accepts stdout sentinel
+    When the CLI is parsed with "graph --output -"
+    Then parsing succeeds
+    And the command is graph
+    And the graph output path is "-"
+
+  Scenario: Graph command accepts --html
+    When the CLI is parsed with "graph --html"
+    Then parsing succeeds
+    And the command is graph
+    And the graph html flag is set
+
+  Scenario: Graph command accepts --html with --output
+    When the CLI is parsed with "graph --html --output graph.html"
+    Then parsing succeeds
+    And the command is graph
+    And the graph html flag is set
+    And the graph output path is "graph.html"
+
   Scenario: Manifest file can be overridden
     When the CLI is parsed with "--file alt.yml build target"
     Then parsing succeeds
diff --git a/tests/features_unix/graph.feature b/tests/features_unix/graph.feature
index 735d582a..b4ea4d27 100644
--- a/tests/features_unix/graph.feature
+++ b/tests/features_unix/graph.feature
@@ -1,29 +1,21 @@
 @unix
 Feature: Graph subcommand execution
 
-  Scenario: Graph invokes ninja with tool flag
-    Given a fake ninja executable that expects the graph tool
-    And the CLI is parsed with "graph"
-    And the CLI uses the temporary directory
-    When the graph process is run
-    Then the command should succeed
+  The `graph` subcommand renders the build graph in-process; it no longer
+  spawns `ninja -t graph`. These scenarios assert the dispatch and CLI
+  parsing for `--output` and `--html`. End-to-end DOT content is covered by
+  `tests/runner_graph_tests.rs`.
 
-  Scenario: Graph fails when ninja fails
-    Given a fake ninja executable that exits with 1
-    And the CLI is parsed with "graph"
-    And the CLI uses the temporary directory
-    When the graph process is run
-    Then the command should fail with error "ninja exited"
-
-  Scenario: Graph respects jobs flag
-    Given a fake ninja executable that expects graph with 4 jobs
-    And the CLI is parsed with "-j 4 graph"
+  Scenario: Graph runs in-process and succeeds without ninja
+    Given no ninja executable is available
+    And the CLI is parsed with "graph --output -"
     And the CLI uses the temporary directory
     When the graph process is run
     Then the command should succeed
 
-  Scenario: Graph fails when ninja is missing
+  Scenario: Graph writes DOT to the specified file
     Given no ninja executable is available
-    And the CLI is parsed with "graph"
+    And the CLI is parsed with "graph --output graph.dot"
+    And the CLI uses the temporary directory
     When the graph process is run
-    Then the command should fail with error "No such file or directory"
+    Then the command should succeed
diff --git a/tests/logging_stderr_tests.rs b/tests/logging_stderr_tests.rs
index c3065b19..0b45a45e 100644
--- a/tests/logging_stderr_tests.rs
+++ b/tests/logging_stderr_tests.rs
@@ -8,28 +8,7 @@ use predicates::prelude::*;
 use rstest::{fixture, rstest};
 use serde_json::Value;
 use std::fs;
-use std::path::Path;
 use tempfile::{TempDir, tempdir};
-use test_support::env::{SystemEnv, override_ninja_env};
-
-#[cfg(unix)]
-fn make_script_executable(path: &Path) -> Result<()> {
-    use std::os::unix::fs::PermissionsExt;
-
-    let mut permissions = fs::metadata(path)
-        .with_context(|| format!("read metadata for {}", path.display()))?
-        .permissions();
-    permissions.set_mode(0o755);
-    fs::set_permissions(path, permissions)
-        .with_context(|| format!("set executable bit for {}", path.display()))?;
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn make_script_executable(_path: &Path) -> Result<()> {
-    Ok(())
-}
-
 #[fixture]
 fn temp_with_minimal_manifest() -> Result<TempDir> {
     let temp = tempdir().context("create temp dir")?;
@@ -39,48 +18,6 @@ fn temp_with_minimal_manifest() -> Result<TempDir> {
     Ok(temp)
 }
 
-fn write_fake_ninja_script(
-    path: &Path,
-    stdout_lines: &[&str],
-    stderr_marker: Option<&str>,
-) -> Result<()> {
-    let script = if cfg!(windows) {
-        let mut script = String::from("@echo off\r\n");
-        for line in stdout_lines {
-            script.push_str("echo ");
-            script.push_str(line);
-            script.push_str("\r\n");
-        }
-        if let Some(marker) = stderr_marker {
-            script.push_str("echo ");
-            script.push_str(marker);
-            script.push_str(" 1>&2\r\n");
-        }
-        script.push_str("exit /B 0\r\n");
-        script
-    } else {
-        let mut script = String::from(
-            "#!/bin/sh\nwhile IFS= read -r line; do\n  printf '%s\\n' \"$line\"\ndone <<'NETSUKE_OUTPUT'\n",
-        );
-        for line in stdout_lines {
-            script.push_str(line);
-            script.push('\n');
-        }
-        script.push_str("NETSUKE_OUTPUT\n");
-        if let Some(marker) = stderr_marker {
-            script.push_str("printf '%s\\n' '");
-            script.push_str(marker);
-            script.push_str("' >&2\n");
-        }
-        script.push_str("exit 0\n");
-        script
-    };
-
-    fs::write(path, script)
-        .with_context(|| format!("write fake ninja script {}", path.display()))?;
-    make_script_executable(path)
-}
-
 /// Verifies that runner errors are logged to stderr.
 ///
 /// The test creates an empty temporary directory (no manifest) and runs the
@@ -273,45 +210,30 @@ fn output_format_json_formats_config_load_failures_as_json() -> Result<()> {
 }
 
 #[rstest]
-fn diag_json_success_discards_child_stderr(
+fn diag_json_success_graph_keeps_clean_stderr(
     temp_with_minimal_manifest: Result<TempDir>,
 ) -> Result<()> {
     let temp = temp_with_minimal_manifest?;
 
-    let ninja_temp = tempdir().context("create fake ninja dir")?;
-    let ninja_path = if cfg!(windows) {
-        ninja_temp.path().join("fake-ninja.cmd")
-    } else {
-        ninja_temp.path().join("fake-ninja")
-    };
-    write_fake_ninja_script(
-        &ninja_path,
-        &["digraph G { hello -> world; }"],
-        Some("NINJA_STDERR_MARKER"),
-    )?;
-    let env = SystemEnv::new();
-    let _guard = override_ninja_env(&env, &ninja_path);
-
+    // `graph` renders in-process and never spawns Ninja, so no child stderr
+    // is produced. Verify `--diag-json graph` still emits the DOT graph on
+    // stdout and keeps stderr empty.
     let output = assert_cmd::cargo::cargo_bin_cmd!("netsuke")
         .current_dir(temp.path())
         .arg("--diag-json")
         .arg("graph")
         .output()
-        .context("run netsuke graph with fake ninja")?;
+        .context("run netsuke graph")?;
 
     ensure!(output.status.success(), "expected graph command success");
     ensure!(
         output.stderr.is_empty(),
-        "stderr should stay empty in JSON mode even when ninja writes to stderr"
+        "stderr should stay empty in JSON mode"
     );
     let stdout = String::from_utf8(output.stdout).context("stdout should be valid UTF-8")?;
     ensure!(
-        stdout.contains("digraph G"),
-        "stdout should keep graph output"
-    );
-    ensure!(
-        !stdout.contains("NINJA_STDERR_MARKER"),
-        "child stderr should not leak into stdout"
+        stdout.contains("digraph netsuke"),
+        "stdout should carry the DOT graph; got: {stdout}"
     );
     Ok(())
 }
diff --git a/tests/runner_graph_tests.rs b/tests/runner_graph_tests.rs
new file mode 100644
index 00000000..b9f4ef0b
--- /dev/null
+++ b/tests/runner_graph_tests.rs
@@ -0,0 +1,124 @@
+//! Integration tests for the in-process `graph` subcommand.
+//!
+//! The `graph` subcommand no longer shells out to `ninja -t graph`; it builds
+//! the [`BuildGraph`] in-process and renders DOT directly. These tests verify
+//! the dispatch works without Ninja installed and writes the artefact through
+//! the shared file/stdout sinks.
+
+use anyhow::{Context, Result, bail, ensure};
+use netsuke::cli::{Cli, Commands, GraphArgs};
+use netsuke::output_prefs;
+use netsuke::runner::run;
+use rstest::rstest;
+use test_support::{localizer_test_lock, set_en_localizer};
+
+mod fixtures;
+use fixtures::create_test_manifest;
+
+fn run_graph(cli: &Cli) -> Result<()> {
+    let _lock = localizer_test_lock()
+        .map_err(|e| anyhow::anyhow!("{e}"))
+        .context("localizer test lock poisoned")?;
+    let _guard = set_en_localizer();
+    run(cli, output_prefs::resolve(None)).context("running graph subcommand")
+}
+
+#[rstest]
+fn graph_with_output_writes_dot_file() -> Result<()> {
+    let (temp, manifest_path) = create_test_manifest()?;
+    let dot_path = temp.path().join("graph.dot");
+    let cli = Cli {
+        file: manifest_path,
+        directory: Some(temp.path().to_path_buf()),
+        command: Some(Commands::Graph(GraphArgs {
+            html: false,
+            output: Some("graph.dot".into()),
+        })),
+        ..Cli::default()
+    };
+    run_graph(&cli)?;
+    let written = std::fs::read_to_string(&dot_path)
+        .with_context(|| format!("read graph.dot at {}", dot_path.display()))?;
+    ensure!(
+        written.starts_with("digraph netsuke {"),
+        "DOT artefact should start with digraph header; got: {written:.80}"
+    );
+    ensure!(
+        written.contains("\"hello\""),
+        "DOT artefact should mention the `hello` target; got: {written}"
+    );
+    Ok(())
+}
+
+#[rstest]
+fn graph_with_invalid_manifest_reports_error() -> Result<()> {
+    let temp = tempfile::tempdir().context("temp dir")?;
+    let manifest_path = temp.path().join("Netsukefile");
+    std::fs::copy("tests/data/invalid_version.yml", &manifest_path)
+        .with_context(|| format!("copy invalid manifest to {}", manifest_path.display()))?;
+    let cli = Cli {
+        file: manifest_path,
+        command: Some(Commands::Graph(GraphArgs::default())),
+        ..Cli::default()
+    };
+    let Err(_) = run_graph(&cli) else {
+        bail!("expected graph to fail with invalid manifest");
+    };
+    Ok(())
+}
+
+#[rstest]
+fn graph_html_writes_self_contained_document() -> Result<()> {
+    let (temp, manifest_path) = create_test_manifest()?;
+    let html_path = temp.path().join("graph.html");
+    let cli = Cli {
+        file: manifest_path,
+        directory: Some(temp.path().to_path_buf()),
+        command: Some(Commands::Graph(GraphArgs {
+            html: true,
+            output: Some("graph.html".into()),
+        })),
+        ..Cli::default()
+    };
+    run_graph(&cli)?;
+    let html = std::fs::read_to_string(&html_path).context("read graph.html")?;
+    ensure!(html.starts_with("<!doctype html>"), "should be HTML doc");
+    ensure!(html.contains("<svg"), "should contain SVG");
+    ensure!(
+        html.contains("<noscript>"),
+        "should contain noscript fallback"
+    );
+    ensure!(
+        !html.contains("href=\"http") && !html.contains("src=\"http"),
+        "no external references"
+    );
+    Ok(())
+}
+
+#[rstest]
+fn graph_is_deterministic_across_repeated_runs() -> Result<()> {
+    let (temp, manifest_path) = create_test_manifest()?;
+    let mut outputs: Vec<String> = Vec::new();
+    for tag in ["first", "second"] {
+        let dot_path = temp.path().join(format!("graph-{tag}.dot"));
+        let cli = Cli {
+            file: manifest_path.clone(),
+            directory: Some(temp.path().to_path_buf()),
+            command: Some(Commands::Graph(GraphArgs {
+                html: false,
+                output: Some(format!("graph-{tag}.dot").into()),
+            })),
+            ..Cli::default()
+        };
+        run_graph(&cli)?;
+        outputs.push(std::fs::read_to_string(&dot_path).context("read DOT artefact")?);
+    }
+    let mut iter = outputs.iter();
+    let first = iter.next().context("first DOT output")?;
+    let second = iter.next().context("second DOT output")?;
+    ensure!(
+        first == second,
+        "repeated DOT renders should be byte-identical"
+    );
+    Ok(())
+}
diff --git a/tests/runner_tool_subcommands_tests.rs b/tests/runner_tool_subcommands_tests.rs
index 83d59ccc..e1c20789 100644
--- a/tests/runner_tool_subcommands_tests.rs
+++ b/tests/runner_tool_subcommands_tests.rs
@@ -1,7 +1,8 @@
 //! Integration tests for Netsuke tool subcommands.
 //!
-//! Covers the `clean` and `graph` subcommands which invoke Ninja tools via
-//! `ninja -t <tool>`.
+//! Covers the `clean` subcommand which still invokes `ninja -t <tool>`. The
+//! `graph` subcommand renders in-process and is covered by
+//! `tests/runner_graph_tests.rs`.
 
 use anyhow::{Context, Result, bail, ensure};
 use netsuke::cli::{Cli, Commands};
@@ -42,7 +43,6 @@ fn assert_ninja_failure_propagates(command: Commands) -> Result<()> {
     let (temp, manifest_path) = create_test_manifest()?;
     let expected_tool = match &command {
         Commands::Clean => "clean",
-        Commands::Graph => "graph",
         other => bail!("unsupported command for this helper: {other:?}"),
     };
     let cli = Cli {
@@ -150,29 +150,12 @@ fn ninja_expecting_clean() -> Result<(tempfile::TempDir, PathBuf, NinjaEnvGuard)
     Ok((ninja_dir, ninja_path, guard))
 }
 
-/// Fixture: point `NINJA_ENV` at a fake `ninja` that expects `-t graph`.
-///
-/// Returns: (tempdir holding ninja, path to ninja, `NINJA_ENV` guard)
-#[fixture]
-fn ninja_expecting_graph() -> Result<(tempfile::TempDir, PathBuf, NinjaEnvGuard)> {
-    let (ninja_dir, ninja_path) = check_ninja::fake_ninja_expect_tool(ToolName::new("graph"))?;
-    let env = SystemEnv::new();
-    let guard = override_ninja_env(&env, ninja_path.as_path());
-    Ok((ninja_dir, ninja_path, guard))
-}
-
 #[cfg(unix)]
 #[rstest]
 fn run_clean_fails_with_failing_ninja() -> Result<()> {
     assert_ninja_failure_propagates(Commands::Clean)
 }
 
-#[cfg(unix)]
-#[rstest]
-fn run_graph_fails_with_failing_ninja() -> Result<()> {
-    assert_ninja_failure_propagates(Commands::Graph)
-}
-
 #[cfg(unix)]
 #[rstest]
 #[case(
@@ -181,12 +164,6 @@ fn run_graph_fails_with_failing_ninja() -> Result<()> {
     "clean"
 )]
 #[case(None, Commands::Clean, "clean")]
-#[case(
-    Some(ninja_expecting_graph as NinjaToolFixture),
-    Commands::Graph,
-    "graph"
-)]
-#[case(None, Commands::Graph, "graph")]
 fn run_tool_subcommand_table_cases(
     #[case] fixture: Option<NinjaToolFixture>,
     #[case] command: Commands,