Safe DOCX posture
w:fldChar five-part complex-field emission
Every generated field is a complete five-run sequence — fldChar begin,
preserved-space w:instrText, fldChar separate, a cached-result run,
fldChar end — and w:dirty is never set. The cached result is a
required spec property, making the no-recovery-dialog guarantee
unrepresentable-by-omission; the structural validator runs a begin →
separate → end state machine over every story part. The comparison path keeps
these field-state markers outside the w:del payload wrappers shown by the
Part 1 complex-field and deleted-field-code syntax.
The runtime ancillary predicate adds fail-closed stack diagnostics without
changing the Lean-pinned predicate or protocol.
Schema declarations
Bounded evidence
- source
packages/docx-core/src/generation/emit/run.ts - source
packages/docx-core/src/generation/structural-checks.ts - source
packages/docx-core/src/shared/field-structure.ts - source
packages/docx-compare/src/baselines/atomizer/inPlaceModifier-deletion.ts - test
packages/docx-compare/src/baselines/atomizer/pipeline.field-validation.test.ts - source
packages/docx-compare/src/baselines/atomizer/opaquePassthrough.ts - source
packages/docx-compare/src/baselines/atomizer/ancillaryFieldSafety.ts - test
packages/docx-compare/src/baselines/atomizer/ancillaryFieldSafety.test.ts - test
packages/docx-compare/src/baselines/atomizer/documentReconstructor-complex-fields.test.ts - test
packages/docx-core/src/generation/generation-sections-fields.test.ts - test
packages/docx-core/src/integration/ancillary-field-safety.test.ts - test
packages/docx-core/src/integration/nvca-coi-regression.test.ts - formal verification
verification/lean/Tier2/XmlTripleChecker.lean - formal verification
verification/registry/lean-xml-checker-coverage.json