[entelecheia]

Problem

A section's first body paragraph owns its section setup (Control::SectionDef and the column
definition). PR #450 (#428 T2) guarded the addressed splice (insert_paragraphs_at, used by
insert_blocks and addressed insert_para), but two entry points could still place another
paragraph in front of that owner:

• anchored insert_paragraph(doc, anchor, text, before = true), when the matched anchor paragraph
  is the section owner;
• move_paragraph to index 0 of a section body — it already refused moving the owner itself, not
  moving another paragraph in front of it.

Neither native writer repairs the result. HWPX (crates/hwpx/src/write/section.rs) injects a
default secPr into the new first paragraph while the original setup is still written later, so
the section ends up with two setups and the first one has default page size, margins and
header/footer settings; HWP5 leaves the first paragraph without secd/cold and only sets
break_type.

Change

• insert_paragraph_checked(doc, anchor, text, before) -> Result<bool, String> is the one place
  that decides this boundary: Ok(true) inserted, Ok(false) no anchor matched (the bool
  form's behaviour), Err the refusal, always before any mutation. insert_paragraph keeps its
  public signature and delegates, so every existing bool caller and test still compiles.
• insert_paragraphs_at and the new checked variant share one SECTION_OWNER_INSERT_REFUSAL
  constant, so insert_blocks, addressed insert_para and anchored insert_para give the same
  cause and the same remedy (position=after / before=false).
• move_paragraph refuses to_index == 0 on a section body list when that list's first paragraph
  carries Control::SectionDef, in its existing pre-mutation validation block. Nested lists (cells,
  captions) carry no section setup and stay allowed.
• CLI (crates/hwp-cli/src/commands/edit.rs): the flag-form --insert-para-before / --insert-para
  arms and the typed insert_para anchor selector call the checked variant, so the refusal reaches
  the user instead of the generic anchor-miss message.
• No relocation of section controls and no writer repair, per the issue's scope. The other 12
  Korean development-comment lines in the touched hwp-convert/src/lib.rs were translated to
  English (meaning preserved, user-facing strings untouched).

Tests

Refusal and control cases run over hwp new --from bases for both hwp and hwpx, because
the composed fixture used by insert_blocks keeps its section setup on an empty first paragraph
that no anchor search can name:

test	refusal	control
anchored_insert_para_before_section_definition_refuses_in_both_formats	insert_para with anchor on the owner and before=true fails, the message carries 구역/앞 and the before=false remedy, the source bytes are unchanged and no output file is published	before=false inserts at index 1 and the owner stays first
move_para_before_section_definition_refuses_in_both_formats	move_para from paragraph 2 to before paragraph 0 fails with the boundary in the message, source and destination untouched	moving paragraph 1 behind paragraph 2 succeeds and the owner stays first

Red-first against this branch's pre-fix tree (0358c84, both tests present, guard absent):

---- move_para_before_section_definition_refuses_in_both_formats ----
a move in front of the section definition owner must refuse
---- anchored_insert_para_before_section_definition_refuses_in_both_formats ----
insertion before the section definition owner must refuse
test result: FAILED. 0 passed; 2 failed

With the guards in place the same two lines report test result: ok. 2 passed.

Two existing assertions had to move, not weaken:

• structure::tests::move_paragraph_문단_이동_id_보존 and move_paragraph_앵커_컨트롤도_함께_이동
  moved a paragraph to index 0 to prove instance_id and anchored controls travel with it. They now
  move behind the owner (index 1) and keep exactly those assertions; move_paragraph_구역정의_앞으로는_거부
  pins the refusal itself, including that nothing moved.
• The edit-ops tracer fixture anchored insert_para on the section owner, so TRACER_MD gains a
  trailing paragraph and fixtures/edit-ops/tracer.json anchors there; before=true coverage is
  kept inside the new boundary and the test now also asserts the owner stays first.

Verification

== check: OK (fmt/clippy/test/crate-edges/pdf-runner/structured-corpus/claims/doc-surface/release-block/readiness-selfcheck/skip-accounting/public-parity=skipped) skipped-for-missing-fixtures=49 (optional=4) ==

Local: cargo test -p hwp-convert (600 lib), cargo test -p hwp-cli (all targets, incl. 85
edit_ops and 51 insert_blocks), cargo fmt --all --check.

Hancom open/export verification is a separate person-run evidence leg and was not performed here.
This change refuses paths rather than repairing writers, so it introduces no new format rule.

Closes #451.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T16:13:45.727195Z	b630c89	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.