V4 bounded document-render capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local pandoc CLI ingredient exposes readiness, supported-format discovery, a generic DOCX/HTML/EPUB renderer, and one fixed Markdown-to-PDF operation. PDF generation is explicit and buildable: document.markdown_to_pdf selects Pandoc's HTML writer plus the declared WeasyPrint pack dependency instead of pretending PDF is a native Pandoc output format or relying on an undeclared TeX runtime. The fixed PDF result is captured into durable CAS only after the executor verifies a PDF envelope, and returns its exact SHA-256, size, MIME, filename, and file ref. No operation exposes a shell wrapper, arbitrary flags, filters/defaults/templates/reference-doc paths, PDF-engine choice, or caller-controlled output path. The PDF op is not an untrusted-Markdown sanitizer: external PDF-engine I/O is outside Pandoc's reader/writer sandbox, so D-200 feeds it only strict renderer output and other callers must use trusted, self-contained Markdown. Part of the Lane-1 deterministic document toolkit alongside docling (parse) and xlsx-pack (export).