Safe DOCX posture
w:headerReference binding
Each declared header slot (first/default/even) becomes its own part bound
through a typed w:headerReference whose r:id (written namespace-aware
via setAttributeNS) resolves in the document's relationships. References
lead the w:sectPr child sequence; the structural validator rejects
dangling or missing ids.
The package audit follows each reference through document.xml.rels, checks
the header relationship type, resolves its target part, and requires a
w:hdr root. Duplicate roles within one section, duplicate relationship ids,
targets that escape the package root, and fragment-bearing targets are
rejected. Relative and package-absolute targets are normalized before lookup;
URI-fragment semantics are outside this audit's supported OPC target model.
Relationship reuse across sections is accepted. Pagination,
role inheritance when a reference is absent, and reader rendering are not
evaluated. Comparison uses this same audit to select only valid direct
section bindings; target normalization and package containment are additional
SafeDocX safety policies rather than claims made by this clause.
Schema declarations
Bounded evidence
- source
packages/docx-core/src/primitives/sectPrAudit.ts - test
packages/docx-core/src/generation/generation-sections-fields.test.ts - source
packages/docx-compare/src/baselines/atomizer/ancillaryFieldSafety.ts - formal verification
verification/lean/Tier2/RelationshipStorySelector.lean - formal verification
verification/lean/LeanDocxChecker.lean - test
packages/docx-compare/src/baselines/atomizer/leanXmlVerifier.test.ts - test
packages/docx-core/src/integration/ancillary-field-safety.test.ts - test
packages/docx-core/src/integration/nvca-coi-regression.test.ts