diff --git a/gui/release.md b/gui/release.md
index fbd9fd8..bcd20f9 100644
--- a/gui/release.md
+++ b/gui/release.md
@@ -1,6 +1,17 @@
 # MarkdownToPdf GUI Release History
 (Note, dates are in yyyy-MM-dd format)
 
+## 0.2.0 (2026-08-14)
+- Added a pluggable file-access layer for sandboxed distributions. Stored projects are retained
+  when their files are temporarily inaccessible, and the application can ask to locate an
+  inaccessible project Markdown file and remember the new location.
+- App-store distributions can disable GitHub update checks with
+  `-Dmd2pdf.update.enabled=false`; this also hides the related **Help** menu items.
+- **View external** now lets sandboxed distributions choose where to save the rendered PDF before
+  opening it in the system viewer. PDF export and file dialogs also handle inaccessible or stale
+  initial directories more safely.
+- CSS style parsing and syntax-highlight injection now behave consistently in every system locale.
+
 ## 0.1.1 (2026-08-11)
 - Added an update check: **Help > Check for Updates…** asks GitHub Releases whether a newer
   version ships an archive for this platform, and offers to open the release page. It also
diff --git a/gui/src/main/java/se/alipsa/md2pdf/gui/HtmlUtils.java b/gui/src/main/java/se/alipsa/md2pdf/gui/HtmlUtils.java
index 7d45547..9a5b6f5 100644
--- a/gui/src/main/java/se/alipsa/md2pdf/gui/HtmlUtils.java
+++ b/gui/src/main/java/se/alipsa/md2pdf/gui/HtmlUtils.java
@@ -31,13 +31,23 @@ private HtmlUtils() {}
    */
   static String injectSyntaxHighlighting(String html) {
     if (html == null) return "";
-    int idx = html.toLowerCase().lastIndexOf("</head>");
+    int idx = lastHeadEndTagStart(html);
     if (idx >= 0) {
       return html.substring(0, idx) + HIGHLIGHT_INJECTION + html.substring(idx);
     }
     return HIGHLIGHT_INJECTION + html;
   }
 
+  private static int lastHeadEndTagStart(String html) {
+    String closingHead = "</head>";
+    for (int i = html.length() - closingHead.length(); i >= 0; i--) {
+      if (html.regionMatches(true, i, closingHead, 0, closingHead.length())) {
+        return i;
+      }
+    }
+    return -1;
+  }
+
   private static String loadResource(String path) {
     try (InputStream is = HtmlUtils.class.getResourceAsStream(path)) {
       if (is == null) return "";
diff --git a/gui/src/main/java/se/alipsa/md2pdf/model/StyleProfile.java b/gui/src/main/java/se/alipsa/md2pdf/model/StyleProfile.java
index fefd308..368681b 100644
--- a/gui/src/main/java/se/alipsa/md2pdf/model/StyleProfile.java
+++ b/gui/src/main/java/se/alipsa/md2pdf/model/StyleProfile.java
@@ -3,6 +3,7 @@
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Properties;
 
@@ -212,7 +213,7 @@ private static List<String[]> extractBlocks(String css) {
   }
 
   private static String normalizeSelector(String sel) {
-    return sel.replaceAll("\\s+", " ").trim().toLowerCase();
+    return sel.replaceAll("\\s+", " ").trim().toLowerCase(Locale.ROOT);
   }
 
   private static Map<String, String> parseDeclarations(String decls) {
@@ -222,7 +223,7 @@ private static Map<String, String> parseDeclarations(String decls) {
       if (decl.isEmpty()) continue;
       int colon = decl.indexOf(':');
       if (colon < 0) continue;
-      String prop = decl.substring(0, colon).trim().toLowerCase();
+      String prop = decl.substring(0, colon).trim().toLowerCase(Locale.ROOT);
       String value = decl.substring(colon + 1).trim();
       map.put(prop, value);
     }
diff --git a/gui/src/test/java/se/alipsa/md2pdf/gui/HtmlUtilsTest.java b/gui/src/test/java/se/alipsa/md2pdf/gui/HtmlUtilsTest.java
new file mode 100644
index 0000000..ae8a6b1
--- /dev/null
+++ b/gui/src/test/java/se/alipsa/md2pdf/gui/HtmlUtilsTest.java
@@ -0,0 +1,25 @@
+package se.alipsa.md2pdf.gui;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.Locale;
+import org.junit.jupiter.api.Test;
+
+class HtmlUtilsTest {
+
+  @Test
+  void syntaxHighlightingPreservesHeadWithTurkishCapitalI() {
+    Locale originalLocale = Locale.getDefault();
+    try {
+      Locale.setDefault(Locale.US);
+      String html = "<html><head><style>font-family: 'İstanbul Sans';</style></head><body/></html>";
+
+      String highlighted = HtmlUtils.injectSyntaxHighlighting(html);
+
+      assertTrue(highlighted.contains("</head>"));
+      assertTrue(highlighted.indexOf("<script>") < highlighted.indexOf("</head>"));
+    } finally {
+      Locale.setDefault(originalLocale);
+    }
+  }
+}
diff --git a/gui/src/test/java/test/alipsa/md2pdf/gui/StyleProfileTest.java b/gui/src/test/java/test/alipsa/md2pdf/gui/StyleProfileTest.java
index 6621b9c..35699c9 100644
--- a/gui/src/test/java/test/alipsa/md2pdf/gui/StyleProfileTest.java
+++ b/gui/src/test/java/test/alipsa/md2pdf/gui/StyleProfileTest.java
@@ -2,6 +2,7 @@
 
 import static org.junit.jupiter.api.Assertions.*;
 
+import java.util.Locale;
 import java.util.Properties;
 import org.junit.jupiter.api.Test;
 import se.alipsa.md2pdf.model.StyleProfile;
@@ -158,6 +159,19 @@ void partialCssMapsCorrectly() {
     assertEquals("#000000", p.getHeadingColor());
   }
 
+  @Test
+  void cssPropertyNamesAreLocaleIndependent() {
+    Locale originalLocale = Locale.getDefault();
+    try {
+      Locale.setDefault(Locale.forLanguageTag("tr-TR"));
+      StyleProfile p = StyleProfile.fromCss("BODY { LINE-HEIGHT: 1.5; }");
+
+      assertEquals(1.5, p.getLineHeight(), 0.001);
+    } finally {
+      Locale.setDefault(originalLocale);
+    }
+  }
+
   @Test
   void unknownSelectorsPreservedInExtraCss() {
     String css =
diff --git a/lib/README.md b/lib/README.md
index 7c52437..e1e7fd5 100644
--- a/lib/README.md
+++ b/lib/README.md
@@ -80,6 +80,25 @@ String      html = job.toHtml();              // string
             job.toHtml(Path.of("out.html"));   // file
 ```
 
+Where the destination directory permits it, file output stages the rendered PDF in a temporary
+sibling before replacing the destination, so a rendering or staging failure cannot overwrite an
+existing file. The replacement is atomic when the filesystem supports atomic moves. A regular
+destination that cannot support sibling staging is rendered in memory before it is written; a
+failure while writing that fallback can still leave a partially written destination.
+
+## Logging
+
+By default, constructing the first engine replaces any OpenHTMLtoPDF JDK logger with the bundled
+SLF4J bridge. This includes a JDK logger installed by OpenHTMLtoPDF's `XRLog` tuning methods. A
+non-JDK logger implementation is preserved.
+
+To explicitly replace OpenHTMLtoPDF's JVM-global logger with the bundled SLF4J bridge during
+application startup:
+
+```java
+Md2PdfEngine.configureOpenHtmlToPdfLogging();
+```
+
 ## Styling
 
 Use `css(...)` to **replace** the default stylesheet entirely:
diff --git a/lib/release.md b/lib/release.md
index 07d259c..9056b75 100644
--- a/lib/release.md
+++ b/lib/release.md
@@ -1,6 +1,13 @@
 # MarkdownToPdf Runtime Release History
 (Note, dates are in yyyy-MM-dd format)
 
+## 0.2.0 (2026-08-14)
+- PDF file output stages regular filesystem destinations before replacing them, so a rendering or
+  staging failure preserves an existing file where sibling staging is available.
+- Engine construction retains the bundled SLF4J bridge when OpenHTMLtoPDF uses a JDK logger,
+  including one installed by its `XRLog` tuning methods, while preserving a non-JDK implementation.
+- Image data-URL type detection now handles uppercase file extensions consistently across locales.
+
 ## 0.1.1 (2026-08-11)
 - **Breaking:** renamed `Md2PdfEngine.Job` to `Md2PdfEngine.Renderer`. Code that named the
   type explicitly must be updated; the fluent `engine.markdown(...)` chain is unchanged.
@@ -10,4 +17,4 @@
   - jsoup 1.22.2 -> 1.23.1
 
 ## 0.1.0 (2026-05-17)
-- Initial release
\ No newline at end of file
+- Initial release
diff --git a/lib/src/main/java/se/alipsa/md2pdf/ImageUtil.java b/lib/src/main/java/se/alipsa/md2pdf/ImageUtil.java
index 90540d3..86a9799 100644
--- a/lib/src/main/java/se/alipsa/md2pdf/ImageUtil.java
+++ b/lib/src/main/java/se/alipsa/md2pdf/ImageUtil.java
@@ -6,6 +6,7 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Base64;
+import java.util.Locale;
 
 /** Image utilities */
 public class ImageUtil {
@@ -127,7 +128,7 @@ private static InputStream locateResource(String resource, Class<?> clazz)
   }
 
   private static String getMediaType(String resource) {
-    String res = resource.toLowerCase();
+    String res = resource.toLowerCase(Locale.ROOT);
     if (res.endsWith("png")) {
       return "image/png";
     }
diff --git a/lib/src/main/java/se/alipsa/md2pdf/Md2PdfEngine.java b/lib/src/main/java/se/alipsa/md2pdf/Md2PdfEngine.java
index 9181a03..75b6bda 100644
--- a/lib/src/main/java/se/alipsa/md2pdf/Md2PdfEngine.java
+++ b/lib/src/main/java/se/alipsa/md2pdf/Md2PdfEngine.java
@@ -4,16 +4,27 @@
 import com.openhtmltopdf.mathmlsupport.MathMLDrawer;
 import com.openhtmltopdf.pdfboxout.PdfRendererBuilder;
 import com.openhtmltopdf.svgsupport.BatikSVGDrawer;
+import com.openhtmltopdf.util.JDKXRLogger;
 import com.openhtmltopdf.util.XRLog;
+import com.openhtmltopdf.util.XRLogger;
 import java.io.*;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
+import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
+import java.nio.file.attribute.PosixFileAttributeView;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Objects;
+import java.util.Set;
+import java.util.UUID;
 import org.apache.pdfbox.Loader;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDDocumentInformation;
@@ -144,7 +155,7 @@ public Md2PdfEngine() {
   }
 
   private Md2PdfEngine(Builder builder) {
-    XRLog.setLoggerImpl(new Slf4jXRLogger());
+    configureOpenHtmlToPdfLoggingIfAbsent();
     var parserBuilder = Parser.builder();
     var rendererBuilder = HtmlRenderer.builder().softbreak(builder.softbreak);
     if (builder.tables) {
@@ -165,6 +176,25 @@ public static Builder builder() {
     return new Builder();
   }
 
+  /**
+   * Configure OpenHTMLtoPDF to route its logging through SLF4J.
+   *
+   * <p>OpenHTMLtoPDF logging is JVM-global. This method replaces any logger already configured for
+   * OpenHTMLtoPDF, so applications should call it deliberately during startup.
+   */
+  public static void configureOpenHtmlToPdfLogging() {
+    XRLog.setLoggerImpl(new Slf4jXRLogger());
+  }
+
+  private static void configureOpenHtmlToPdfLoggingIfAbsent() {
+    synchronized (XRLog.class) {
+      XRLogger logger = XRLog.getLoggerImpl();
+      if (logger == null || logger instanceof JDKXRLogger) {
+        XRLog.setLoggerImpl(new Slf4jXRLogger());
+      }
+    }
+  }
+
   /** Builder for configuring Markdown parsing and HTML rendering options. */
   public static class Builder {
 
@@ -681,18 +711,193 @@ public byte[] toPdf() throws Md2PdfException {
     /**
      * Render the job to a PDF file.
      *
+     * <p>When a temporary sibling can be created, the document is rendered there before replacing
+     * the destination. This preserves an existing file if rendering or staging fails. The
+     * replacement is atomic when the filesystem supports atomic moves. For a regular destination
+     * that cannot support sibling staging, the document is rendered in memory before it is written.
+     * Existing symbolic links are followed so the link itself is retained. Replacing a regular file
+     * gives it a new filesystem identity, so hard links, file ownership, and access-control entries
+     * may not be retained. A write failure on a destination that cannot support sibling staging can
+     * leave that destination partially written.
+     *
      * @param file the file to write the PDF to
      * @throws Md2PdfException if rendering or writing fails
      */
     public void toPdf(File file) throws Md2PdfException {
-      try (BufferedOutputStream fos =
-          new BufferedOutputStream(Files.newOutputStream(file.toPath()))) {
-        String html = buildHtml();
-        String xhtml = htmlToXhtml(html);
-        xhtmlToPdf(xhtml, fos, baseUri, fonts, metadata);
-        log.debug("toPdf: Wrote {}", file.getAbsolutePath());
+      Path target = Objects.requireNonNull(file, "file").toPath().toAbsolutePath();
+      if (Files.isSymbolicLink(target) && Files.isDirectory(target)) {
+        throw new Md2PdfException("PDF destination is a directory: " + target);
+      }
+      if (Files.isSymbolicLink(target) && Files.exists(target) && !Files.isRegularFile(target)) {
+        writePdfDirectly(target);
+        log.debug("toPdf: Wrote {}", target);
+        return;
+      }
+      Path renderTarget = resolveSymbolicLink(target);
+      Path parent = validatePdfDestination(renderTarget);
+      if (Files.exists(renderTarget) && !Files.isRegularFile(renderTarget)) {
+        writePdfDirectly(renderTarget);
+        log.debug("toPdf: Wrote {}", target);
+        return;
+      }
+      Path temporary = null;
+      try {
+        try {
+          temporary = createTemporaryPdfFile(parent);
+        } catch (IOException e) {
+          log.warn("Could not stage PDF beside {}; buffering before writing", renderTarget, e);
+          writePdfAfterRendering(renderTarget);
+          log.debug("toPdf: Wrote {}", target);
+          return;
+        }
+        try (OutputStream output =
+            new BufferedOutputStream(
+                Files.newOutputStream(
+                    temporary,
+                    StandardOpenOption.WRITE,
+                    StandardOpenOption.TRUNCATE_EXISTING,
+                    LinkOption.NOFOLLOW_LINKS))) {
+          renderPdf(output);
+        }
+        preservePosixPermissions(renderTarget, temporary, parent);
+        moveIntoPlace(temporary, renderTarget);
+        temporary = null;
+        log.debug("toPdf: Wrote {}", target);
       } catch (IOException e) {
         throw new Md2PdfException(e);
+      } finally {
+        if (temporary != null) {
+          try {
+            Files.deleteIfExists(temporary);
+          } catch (IOException e) {
+            log.warn("Could not remove temporary PDF {}", temporary, e);
+          }
+        }
+      }
+    }
+
+    private Path resolveSymbolicLink(Path target) throws Md2PdfException {
+      try {
+        Path resolved = target;
+        Set<Path> visited = new HashSet<>();
+        while (Files.isSymbolicLink(resolved)) {
+          if (!visited.add(resolved)) {
+            throw new Md2PdfException("Cyclic symbolic link destination: " + target);
+          }
+          Path linkTarget = Files.readSymbolicLink(resolved);
+          Path linkParent = resolved.getParent();
+          if (!linkTarget.isAbsolute() && linkParent == null) {
+            throw new Md2PdfException("Cannot resolve symbolic link at filesystem root: " + target);
+          }
+          resolved =
+              linkTarget.isAbsolute() ? linkTarget : linkParent.toRealPath().resolve(linkTarget);
+        }
+        return resolved;
+      } catch (IOException e) {
+        throw new Md2PdfException(e);
+      }
+    }
+
+    private Path validatePdfDestination(Path target) throws Md2PdfException {
+      Path parent = target.getParent();
+      if (parent == null) {
+        throw new Md2PdfException("Cannot write a PDF to filesystem root " + target);
+      }
+      if (!Files.isDirectory(parent)) {
+        throw new Md2PdfException("PDF destination directory does not exist: " + parent);
+      }
+      if (Files.isDirectory(target)) {
+        throw new Md2PdfException("PDF destination is a directory: " + target);
+      }
+      if (Files.exists(target) && !Files.isWritable(target)) {
+        throw new Md2PdfException("PDF destination is not writable: " + target);
+      }
+      return parent;
+    }
+
+    private void writePdfDirectly(Path target) throws Md2PdfException {
+      try (OutputStream output = new BufferedOutputStream(Files.newOutputStream(target))) {
+        renderPdf(output);
+      } catch (IOException e) {
+        throw new Md2PdfException(e);
+      }
+    }
+
+    private void writePdfAfterRendering(Path target) throws Md2PdfException {
+      byte[] pdf = toPdf();
+      try {
+        Files.write(target, pdf);
+      } catch (IOException e) {
+        throw new Md2PdfException(e);
+      }
+    }
+
+    private void renderPdf(OutputStream output) throws Md2PdfException {
+      String html = buildHtml();
+      String xhtml = htmlToXhtml(html);
+      xhtmlToPdf(xhtml, output, baseUri, fonts, metadata);
+    }
+
+    private void preservePosixPermissions(Path target, Path temporary, Path parent)
+        throws IOException {
+      if (Files.getFileAttributeView(temporary, PosixFileAttributeView.class) == null) {
+        return;
+      }
+      if (Files.exists(target)) {
+        try {
+          Files.setPosixFilePermissions(temporary, Files.getPosixFilePermissions(target));
+          return;
+        } catch (IOException e) {
+          log.debug("Could not preserve POSIX permissions from {}", target, e);
+        }
+      }
+      try {
+        Files.setPosixFilePermissions(temporary, defaultPosixFilePermissions(parent));
+      } catch (IOException e) {
+        log.debug(
+            "Could not determine default POSIX permissions for {}; retaining temporary mode",
+            parent,
+            e);
+      }
+    }
+
+    private Path createTemporaryPdfFile(Path parent) throws IOException {
+      if (Files.getFileAttributeView(parent, PosixFileAttributeView.class) != null) {
+        return Files.createTempFile(
+            parent,
+            ".md2pdf-",
+            ".tmp",
+            PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rw-------")));
+      }
+      return Files.createTempFile(parent, ".md2pdf-", ".tmp");
+    }
+
+    private Set<PosixFilePermission> defaultPosixFilePermissions(Path parent) throws IOException {
+      return discoverDefaultPosixFilePermissions(parent);
+    }
+
+    private Set<PosixFilePermission> discoverDefaultPosixFilePermissions(Path parent)
+        throws IOException {
+      Path probe = parent.resolve(".md2pdf-permissions-" + UUID.randomUUID() + ".tmp");
+      Files.createFile(probe);
+      try {
+        return Files.getPosixFilePermissions(probe);
+      } finally {
+        Files.deleteIfExists(probe);
+      }
+    }
+
+    private void moveIntoPlace(Path temporary, Path target) throws IOException {
+      try {
+        Files.move(
+            temporary, target, StandardCopyOption.ATOMIC_MOVE, StandardCopyOption.REPLACE_EXISTING);
+      } catch (java.nio.file.AtomicMoveNotSupportedException e) {
+        try {
+          Files.move(temporary, target, StandardCopyOption.REPLACE_EXISTING);
+        } catch (IOException retryFailure) {
+          retryFailure.addSuppressed(e);
+          throw retryFailure;
+        }
       }
     }
 
diff --git a/lib/src/test/java/test/alipsa/md2pdf/ConcurrencyTest.java b/lib/src/test/java/test/alipsa/md2pdf/ConcurrencyTest.java
index dde829a..759bbb2 100644
--- a/lib/src/test/java/test/alipsa/md2pdf/ConcurrencyTest.java
+++ b/lib/src/test/java/test/alipsa/md2pdf/ConcurrencyTest.java
@@ -5,20 +5,23 @@
 import com.openhtmltopdf.util.XRLog;
 import java.io.IOException;
 import java.nio.file.Path;
-import java.nio.file.Paths;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
 import java.util.logging.Level;
 import org.apache.pdfbox.Loader;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.text.PDFTextStripper;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import se.alipsa.md2pdf.Md2PdfEngine;
 import se.alipsa.md2pdf.Md2PdfException;
 
 public class ConcurrencyTest {
 
+  @TempDir Path tempDir;
+
   static {
     // silence openhtmltopdf noice
     XRLog.setLevel(XRLog.LOAD, Level.WARNING);
@@ -27,11 +30,11 @@ public class ConcurrencyTest {
   }
 
   @Test
-  public void testSameInstanceConcurrently() throws InterruptedException, IOException {
+  public void testSameInstanceConcurrently() throws Exception {
     Md2PdfEngine engine = new Md2PdfEngine();
 
-    Path path1 = Paths.get("target/blue.pdf");
-    Path path2 = Paths.get("target/yellow.pdf");
+    Path path1 = tempDir.resolve("blue.pdf");
+    Path path2 = tempDir.resolve("yellow.pdf");
 
     String md1 =
         """
@@ -63,10 +66,10 @@ public void testSameInstanceConcurrently() throws InterruptedException, IOExcept
             throw new RuntimeException(e);
           }
         };
-    executorService.submit(task1);
-    executorService.submit(task2);
+    Future<?> future1 = executorService.submit(task1);
+    Future<?> future2 = executorService.submit(task2);
     executorService.shutdown();
-    assertTrue(executorService.awaitTermination(3, TimeUnit.SECONDS));
+    awaitTasks(executorService, future1, future2);
     assertTrue(path1.toFile().exists());
     assertTrue(path2.toFile().exists());
     assertTrue(extractContent(path1).contains("Blue Circle"));
@@ -74,9 +77,9 @@ public void testSameInstanceConcurrently() throws InterruptedException, IOExcept
   }
 
   @Test
-  public void testDifferentInstancesConcurrently() throws InterruptedException, IOException {
-    Path path1 = Paths.get("target/blue2.pdf");
-    Path path2 = Paths.get("target/yellow2.pdf");
+  public void testDifferentInstancesConcurrently() throws Exception {
+    Path path1 = tempDir.resolve("blue2.pdf");
+    Path path2 = tempDir.resolve("yellow2.pdf");
 
     String md1 =
         """
@@ -110,10 +113,10 @@ public void testDifferentInstancesConcurrently() throws InterruptedException, IO
             throw new RuntimeException(e);
           }
         };
-    executorService.submit(task1);
-    executorService.submit(task2);
+    Future<?> future1 = executorService.submit(task1);
+    Future<?> future2 = executorService.submit(task2);
     executorService.shutdown();
-    assertTrue(executorService.awaitTermination(3, TimeUnit.SECONDS));
+    awaitTasks(executorService, future1, future2);
     assertTrue(path1.toFile().exists());
     assertTrue(path2.toFile().exists());
     assertTrue(extractContent(path1).contains("Blue Circle"));
@@ -125,4 +128,20 @@ String extractContent(Path path) throws IOException {
       return new PDFTextStripper().getText(pdf);
     }
   }
+
+  private void awaitTasks(ExecutorService executorService, Future<?>... futures) throws Exception {
+    boolean tasksCompleted = false;
+    try {
+      for (Future<?> future : futures) {
+        future.get(30, TimeUnit.SECONDS);
+      }
+      tasksCompleted = true;
+    } finally {
+      executorService.shutdownNow();
+      boolean terminated = executorService.awaitTermination(5, TimeUnit.SECONDS);
+      if (tasksCompleted) {
+        assertTrue(terminated);
+      }
+    }
+  }
 }
diff --git a/lib/src/test/java/test/alipsa/md2pdf/ImageUtilTest.java b/lib/src/test/java/test/alipsa/md2pdf/ImageUtilTest.java
index 46bb658..322adc7 100644
--- a/lib/src/test/java/test/alipsa/md2pdf/ImageUtilTest.java
+++ b/lib/src/test/java/test/alipsa/md2pdf/ImageUtilTest.java
@@ -6,6 +6,7 @@
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
+import java.util.Locale;
 import org.junit.jupiter.api.Test;
 import se.alipsa.md2pdf.ImageUtil;
 
@@ -35,4 +36,17 @@ void testAsDataUrlFromUrl() throws Exception {
     assertTrue(dataUrl.startsWith("data:image/png;base64,"));
     assertTrue(Base64.getDecoder().decode(dataUrl.substring(dataUrl.indexOf(',') + 1)).length > 0);
   }
+
+  @Test
+  void testMediaTypeDetectionIsLocaleIndependent() throws Exception {
+    Locale originalLocale = Locale.getDefault();
+    try {
+      Locale.setDefault(Locale.forLanguageTag("tr-TR"));
+      String dataUrl = ImageUtil.asDataUrl("/images/sample.GIF");
+
+      assertTrue(dataUrl.startsWith("data:image/gif;base64,"));
+    } finally {
+      Locale.setDefault(originalLocale);
+    }
+  }
 }
diff --git a/lib/src/test/java/test/alipsa/md2pdf/LoggingConfigurationTest.java b/lib/src/test/java/test/alipsa/md2pdf/LoggingConfigurationTest.java
new file mode 100644
index 0000000..f577481
--- /dev/null
+++ b/lib/src/test/java/test/alipsa/md2pdf/LoggingConfigurationTest.java
@@ -0,0 +1,59 @@
+package test.alipsa.md2pdf;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+import com.openhtmltopdf.util.JDKXRLogger;
+import com.openhtmltopdf.util.XRLog;
+import com.openhtmltopdf.util.XRLogger;
+import org.junit.jupiter.api.Test;
+import se.alipsa.md2pdf.Md2PdfEngine;
+import se.alipsa.md2pdf.Slf4jXRLogger;
+
+class LoggingConfigurationTest {
+
+  @Test
+  void engineConstructionReplacesDefaultJdkLoggerWithSlf4jBridge() {
+    XRLogger original = XRLog.getLoggerImpl();
+    try {
+      XRLog.setLoggerImpl(new JDKXRLogger());
+      new Md2PdfEngine();
+
+      assertInstanceOf(Slf4jXRLogger.class, XRLog.getLoggerImpl());
+    } finally {
+      restoreLogger(original);
+    }
+  }
+
+  @Test
+  void engineConstructionPreservesConfiguredLogger() {
+    XRLogger original = XRLog.getLoggerImpl();
+    XRLogger configured = new Slf4jXRLogger();
+    XRLog.setLoggerImpl(configured);
+    try {
+      new Md2PdfEngine();
+
+      assertSame(configured, XRLog.getLoggerImpl());
+    } finally {
+      restoreLogger(original);
+    }
+  }
+
+  @Test
+  void explicitLoggingConfigurationReplacesExistingLogger() {
+    XRLogger original = XRLog.getLoggerImpl();
+    XRLogger configured = new JDKXRLogger();
+    XRLog.setLoggerImpl(configured);
+    try {
+      Md2PdfEngine.configureOpenHtmlToPdfLogging();
+
+      assertInstanceOf(Slf4jXRLogger.class, XRLog.getLoggerImpl());
+    } finally {
+      restoreLogger(original);
+    }
+  }
+
+  private static void restoreLogger(XRLogger original) {
+    XRLog.setLoggerImpl(original != null ? original : new JDKXRLogger());
+  }
+}
diff --git a/lib/src/test/java/test/alipsa/md2pdf/OutputTest.java b/lib/src/test/java/test/alipsa/md2pdf/OutputTest.java
index 78e207d..05a5339 100644
--- a/lib/src/test/java/test/alipsa/md2pdf/OutputTest.java
+++ b/lib/src/test/java/test/alipsa/md2pdf/OutputTest.java
@@ -1,20 +1,29 @@
 package test.alipsa.md2pdf;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeFalse;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
 
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.util.Set;
 import org.apache.pdfbox.Loader;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import se.alipsa.md2pdf.Md2PdfEngine;
 import se.alipsa.md2pdf.Md2PdfException;
 
@@ -22,6 +31,8 @@ public class OutputTest {
 
   static Md2PdfEngine engine = new Md2PdfEngine();
 
+  @TempDir Path tempDir;
+
   @Test
   public void TestRenderToHtml() throws Md2PdfException {
     String md =
@@ -57,6 +68,135 @@ public void testRenderToFile() throws Md2PdfException {
     assertTrue(file.length() > 0, "File length should be greater than 0");
   }
 
+  @Test
+  void testFailedRenderPreservesExistingPdfFile() throws IOException {
+    Path output = tempDir.resolve("existing.pdf");
+    Files.writeString(output, "existing document");
+
+    assertThrows(
+        NullPointerException.class, () -> engine.markdown((String) null).toPdf(output.toFile()));
+
+    assertEquals("existing document", Files.readString(output));
+  }
+
+  @Test
+  void testFilesystemRootReportsMd2PdfException() {
+    File root = File.listRoots()[0];
+
+    assertThrows(Md2PdfException.class, () -> engine.markdown("# Report").toPdf(root));
+  }
+
+  @Test
+  void testPdfDestinationDirectoryFailsBeforeRendering() throws IOException {
+    Path output = tempDir.resolve("output-directory");
+    Files.createDirectory(output);
+
+    assertThrows(Md2PdfException.class, () -> engine.markdown("# Report").toPdf(output));
+  }
+
+  @Test
+  void testPdfFilePreservesExistingPosixPermissions() throws Exception {
+    assumeTrue(
+        Files.getFileAttributeView(tempDir, java.nio.file.attribute.PosixFileAttributeView.class)
+            != null);
+    Path output = tempDir.resolve("existing.pdf");
+    Set<PosixFilePermission> permissions = PosixFilePermissions.fromString("rw-r-----");
+    Files.writeString(output, "existing document");
+    Files.setPosixFilePermissions(output, permissions);
+
+    engine.markdown("# Report").toPdf(output);
+
+    assertEquals(permissions, Files.getPosixFilePermissions(output));
+  }
+
+  @Test
+  void testPdfFileUsesPlatformDefaultPermissionsForNewFile() throws Exception {
+    assumeTrue(
+        Files.getFileAttributeView(tempDir, java.nio.file.attribute.PosixFileAttributeView.class)
+            != null);
+    Path reference = tempDir.resolve("reference.txt");
+    Path output = tempDir.resolve("new.pdf");
+    Files.writeString(reference, "reference");
+
+    engine.markdown("# Report").toPdf(output);
+
+    assertEquals(Files.getPosixFilePermissions(reference), Files.getPosixFilePermissions(output));
+  }
+
+  @Test
+  void testPdfFileWritesThroughSymbolicLink() throws Exception {
+    assumeTrue(
+        Files.getFileAttributeView(tempDir, java.nio.file.attribute.PosixFileAttributeView.class)
+            != null);
+    Path target = tempDir.resolve("target.pdf");
+    Path link = tempDir.resolve("report.pdf");
+    Files.writeString(target, "existing document");
+    Files.createSymbolicLink(link, target.getFileName());
+
+    engine.markdown("# Report").toPdf(link);
+
+    assertTrue(Files.isSymbolicLink(link));
+    assertTrue(Files.size(target) > "existing document".length());
+  }
+
+  @Test
+  void testPdfFileWritesThroughDanglingSymbolicLink() throws Exception {
+    assumeTrue(
+        Files.getFileAttributeView(tempDir, java.nio.file.attribute.PosixFileAttributeView.class)
+            != null);
+    Path targetDirectory = tempDir.resolve("output");
+    Path target = targetDirectory.resolve("report.pdf");
+    Path link = tempDir.resolve("report.pdf");
+    Files.createDirectory(targetDirectory);
+    Files.createSymbolicLink(link, tempDir.relativize(target));
+
+    engine.markdown("# Report").toPdf(link);
+
+    assertTrue(Files.isSymbolicLink(link));
+    assertTrue(Files.size(target) > 0);
+  }
+
+  @Test
+  void testPdfFileResolvesRelativeLinkFromPhysicalParent() throws Exception {
+    assumeTrue(
+        Files.getFileAttributeView(tempDir, java.nio.file.attribute.PosixFileAttributeView.class)
+            != null);
+    Path logicalParent = tempDir.resolve("x");
+    Path physicalRoot = tempDir.resolve("y");
+    Path physicalParent = physicalRoot.resolve("real");
+    Path expectedTarget = physicalRoot.resolve("out/report.pdf");
+    Files.createDirectories(logicalParent);
+    Files.createDirectories(physicalParent);
+    Files.createDirectories(expectedTarget.getParent());
+    Files.createSymbolicLink(logicalParent.resolve("docs"), physicalParent);
+    Files.createSymbolicLink(physicalParent.resolve("report.pdf"), Path.of("../out/report.pdf"));
+
+    engine.markdown("# Report").toPdf(logicalParent.resolve("docs/report.pdf"));
+
+    assertTrue(Files.size(expectedTarget) > 0);
+    assertFalse(Files.exists(logicalParent.resolve("out/report.pdf")));
+  }
+
+  @Test
+  void testReadOnlyPdfFileIsNotReplaced() throws Exception {
+    assumeTrue(
+        Files.getFileAttributeView(tempDir, java.nio.file.attribute.PosixFileAttributeView.class)
+            != null);
+    Path output = tempDir.resolve("readonly.pdf");
+    Set<PosixFilePermission> originalPermissions = PosixFilePermissions.fromString("rw-r--r--");
+    Files.writeString(output, "existing document");
+    Files.setPosixFilePermissions(output, PosixFilePermissions.fromString("r--r--r--"));
+    try {
+      assumeFalse(Files.isWritable(output));
+
+      assertThrows(Md2PdfException.class, () -> engine.markdown("# Report").toPdf(output));
+    } finally {
+      Files.setPosixFilePermissions(output, originalPermissions);
+    }
+
+    assertEquals("existing document", Files.readString(output));
+  }
+
   @Test
   public void testRenderToByteArray() throws Md2PdfException {
     String md =
diff --git a/lib/src/test/resources/images/sample.GIF b/lib/src/test/resources/images/sample.GIF
new file mode 100644
index 0000000..ee8c1ee
--- /dev/null
+++ b/lib/src/test/resources/images/sample.GIF
@@ -0,0 +1 @@
+fixture
diff --git a/release.md b/release.md
index 729526f..41132f0 100644
--- a/release.md
+++ b/release.md
@@ -6,6 +6,9 @@ the published modules are recorded in their own changelogs:
 
 How a release is cut is documented in [`docs/release-process.md`](docs/release-process.md).
 
+## 0.2.0 (2026-08-14)
+- No changes to the shared build, CI or release tooling.
+
 ## 0.1.1 (2026-08-11)
 - Updated build tooling
   - spotless 3.5.1 -> 3.9.0 (google-java-format 1.22.0 -> 1.28.0)