[entelecheia]

After merge renumbers a picture's common instance ID, its preserved raw picture record can still hold 0x30100000. A later insert_blocks image previously received that same picture-record ID. Picture synthesis now reserves both common IDs and IDs in preserved raw picture records before selecting a new common/picture pair.

Closes #465.

• collect_raw_picture_ids reads only the complete little-endian u32 at SHAPE_COMPONENT_PICTURE payload bytes 74..78. The source is this writer's existing build_picture_extras append sequence: 12 border + 32 corner + 16 clip + 8 margin + 3 adjustment + 2 BinItem-ID + 1 transparency bytes precede the ID. The same offset is documented in docs/design/03-hwp5-write.md, section 7. Short records are ignored without reading a partial field.
• The allocator visits preserved opaque body trees, including picture/table extras, Generic extras/raw children, paragraph/section/section-definition extras, and nested semantic paragraphs/captions. It retains existing common-ID reservations, candidate/derived-ID checks and range exhaustion behavior. It does not rewrite existing records or change merge's renumbering.
• The synthetic CLI regression runs the real merge, then edit --ops insert_blocks with an image generated from an owner-authored pixel. It scans serialized HWP body records, verifies two pictures and preservation of the source raw payload, then checks distinct picture-record IDs. Five allocator regressions cover both candidate collision classes, nested raw Generic trees, captions, opaque owners and the complete-field boundary.
• No document_merge.rs change is needed; the separate merge namespace work remains independent. Public APIs are unchanged. CHANGELOG adds only this issue's Fixed entry.

Validation:

• Before the fix, all five new unit regressions failed at their intended assertions. The real CLI regression completed setup/merge/insertion and then failed specifically at the duplicate-ID assertion ([0x30100000, 0x30100000]); the original raw payload remained byte-identical.
• Full remote Linux scripts/check.sh passed on final head 6966c7b32a2aaf092ae70d4cf69cab1a41260f98 (stdin closed, two build/test workers). All five new allocator tests and the CLI regression passed in that run. Local-only fixtures were absent (49 skips, including four optional); public PDF parity was skipped because the pinned Poppler version was unavailable.

== check: OK (fmt/clippy/test/crate-edges/pdf-runner/structured-corpus/claims/doc-surface/release-block/readiness-selfcheck/skip-accounting/public-parity=skipped) skipped-for-missing-fixtures=49 (optional=4) ==

• Hancom effect remains unverified. These writer-authored synthetic records establish serialized ID uniqueness, not whether a genuine saved file opens differently in Hancom. No new native acceptance claim is made.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T16:42:00.669525Z	6966c7b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.