> Security vulnerability? Do not open a public PR. Report it privately through GitHub Security Advisories: https://github.com/open-pencil/open-pencil/security/advisories/new

Before opening a PR, read `CONTRIBUTING.md` and `AGENTS.md`. PRs should explain the intent, meaningful changes, and validation. Placeholder, non-English, unrelated, or otherwise unreviewable PRs may be closed by maintainers.

### Summary

<!-- One short paragraph: the problem, why it matters, and the outcome. Remove guidance comments before opening. -->

### What changed

<!-- One to three meaningful implementation details. Do not repeat the Summary or list every changed file. -->

- Describe a meaningful implementation detail.

### AI assistance

<!-- If an LLM materially helped create or modify this PR, list the model names. Otherwise write “None”. This is disclosure, not co-authorship; omit tool promotional signatures and session links. No prompts or transcripts are required. -->

Models: None

### Validation

<!-- List commands actually run and their results, plus relevant checks not run and why. Note changelog status. Replace these examples; do not claim unperformed validation. -->

- Checks/tests: commands and results, or not run and why.
- Changelog: updated, or not needed and why.