fix(slides): unify master/layout id pool in append_from to clear PowerPoint repair

`Presentation.append_from` triggered PowerPoint's bad-content / repair
dialog on first open of any multi-master output. Three distinct OOXML
id collisions inherited from the shared default.pptx template needed
scrubbing during cross-package master/layout deepcopy:

1. `<p:sldMasterId id>` and `<p:sldLayoutId id>` share one identifier
   pool per ECMA-376 sec 19.2.1.34 / 19.2.1.27, and PowerPoint enforces
   uniqueness across both. The new master2 was being allocated id
   2147483649 (one above target's lone master at 2147483648) — but
   2147483649 was already master1's first layout id. PowerPoint's
   repair output renumbered master2 to 2147483660. Root fix: build a
   unified pool from BOTH master and layout ids in the target, allocate
   master id first (consumes one slot), then renumber layout ids above
   it. End state matches PowerPoint's repair ordering (master2=
   2147483660, master2's layouts=2147483661..2147483671).

2. `<p:sldLayoutId id>` collided across masters because deepcopy of the
   source master carried the source's layout ids verbatim, identical to
   target's existing master's layout ids when both came from the same
   default.pptx. Spec: unique within the layout collection; PowerPoint:
   unique across the presentation.

3. `<p14:creationId val>` was deterministic in default.pptx (master:
   2209977519, plus 11 fixed layout vals), so two presentations from
   the template ended up with identical vals across their parallel
   masters and layouts. Refresh each val to a fresh secrets.randbits(32)
   on deepcopy to keep the extLst structure intact while breaking the
   collision.

Diagnostic path: PowerPoint's repair dialog gave only the generic
"PowerPoint found a problem with content" with no error-line detail.
Iterated by having the maintainer save the repaired copy and diffing
against the original; the rewritten `<p:sldMasterId id>` value
(2147483649 → 2147483660) revealed the master/layout pool sharing.

Surface:
- src/pptx/parts/slide.py: new _used_master_layout_ids_in_target,
  _renumber_sldLayoutIds, _refresh_creation_ids; _add_sldMasterId_to
  _presentation accepts unified pool; _port_master and _port_layout
  _standalone apply scrubs at deepcopy points
- tests/test_append_from.py: DescribePresentation_AppendFrom_OOXML
  Integrity class with 4 zip-level integrity tests (sldLayoutId
  uniqueness across masters, master id disjoint from layout id pool,
  master creationId uniqueness, layout creationId uniqueness)

Refs #11.

Tests: 3166 unit (+4 new) + 994 behave scenarios all passing.
Lint: ruff check + ruff format clean.

Author: Matthew Horoszowski

src/pptx/parts/slide.py

@@ -5,6 +5,7 @@
 import contextlib
 import copy
 import re
+import secrets
 from io import BytesIO
 from typing import IO, TYPE_CHECKING, cast
 
@@ -293,6 +294,9 @@ def duplicate(self) -> SlidePart:
 # ---------------------------------------------------------------------------
 
 _RELS_NS = "{http://schemas.openxmlformats.org/officeDocument/2006/relationships}"
+_P_NS = "{http://schemas.openxmlformats.org/presentationml/2006/main}"
+_P14_NS = "{http://schemas.microsoft.com/office/powerpoint/2010/main}"
+_OOXML_LAYOUT_ID_FLOOR = 2147483648  # uint32 floor per ECMA-376 sec 19.2.1.27.
 
 # Reltypes filtered out during slide duplication. NOTES_SLIDE is wired
 # explicitly by |Slides.duplicate| so the new notes-slide back-references
@@ -382,6 +386,13 @@ def __init__(self, target_pres_part: PresentationPart):
         self._master_map: dict[Part, Part] = {}
         self._layout_map: dict[Part, Part] = {}
         self._theme_map: dict[Part, Part] = {}
+        # ---unified id pool: master ids and layout ids share one pool per
+        #    OOXML spec, and PowerPoint enforces uniqueness across both.
+        #    Both `_add_sldMasterId_to_presentation` and
+        #    `_renumber_sldLayoutIds` allocate from this set and update it
+        #    so sequential master ports don't collide with each other or
+        #    with target's existing layout ids.
+        self._used_layout_ids = _used_master_layout_ids_in_target(target_pres_part)
 
     # -- Public entry point ---------------------------------------------------
 
@@ -512,6 +523,7 @@ def _port_layout_standalone(self, src_layout_part: SlideLayoutPart) -> SlideLayo
 
         new_partname = self.target_package.next_partname("/ppt/slideLayouts/slideLayout%d.xml")
         new_element = copy.deepcopy(src_layout_part._element)
+        _refresh_creation_ids(new_element)
         new_layout_part = SlideLayoutPart(
             new_partname, src_layout_part.content_type, self.target_package, new_element
         )
@@ -537,11 +549,18 @@ def _port_master(self, src_master_part: SlideMasterPart) -> SlideMasterPart:
         if src_master_part in self._master_map:
             return cast(SlideMasterPart, self._master_map[src_master_part])
 
-        # 1. Create new master part (deep-copy element)
+        # 1. Create new master part (deep-copy element).
+        #    `<p14:creationId val>` is deterministic in default.pptx, so
+        #    deepcopied creationIds collide with target's; refresh now.
+        #    sldLayoutId renumbering is deferred to step 3 so layout ids
+        #    end up ABOVE the new master's id — PowerPoint's own repair
+        #    output matches this ordering and ECMA-376 sec 19.2.1.34 /
+        #    19.2.1.27 confirm master and layout ids share one pool.
         new_master_partname = self.target_package.next_partname(
             "/ppt/slideMasters/slideMaster%d.xml"
         )
         new_element = copy.deepcopy(src_master_part._element)
+        _refresh_creation_ids(new_element)
         new_master_part = SlideMasterPart(
             new_master_partname,
             src_master_part.content_type,
@@ -550,9 +569,16 @@ def _port_master(self, src_master_part: SlideMasterPart) -> SlideMasterPart:
         )
         # 2. Register in map + relate to presentation FIRST so iter_parts
         #    reaches the master before any subsequent next_partname call.
+        #    Allocate the new master's id from the unified master/layout
+        #    pool — collision with an existing layout id flags repair.
         self._master_map[src_master_part] = new_master_part
         new_master_rId = self.target_pres_part.relate_to(new_master_part, RT.SLIDE_MASTER)
-        _add_sldMasterId_to_presentation(self.target_pres_part, new_master_rId)
+        _add_sldMasterId_to_presentation(
+            self.target_pres_part, new_master_rId, self._used_layout_ids
+        )
+        # 3. Renumber the deepcopied sldLayoutIds NOW, after the master id
+        #    has consumed its slot in the pool, so layouts land above it.
+        _renumber_sldLayoutIds(new_element, self._used_layout_ids)
 
         # 3. For each source layout owned by this master: create + register
         #    + relate to the master IMMEDIATELY (before next next_partname).
@@ -567,6 +593,7 @@ def _port_master(self, src_master_part: SlideMasterPart) -> SlideMasterPart:
                 "/ppt/slideLayouts/slideLayout%d.xml"
             )
             new_layout_element = copy.deepcopy(src_layout._element)
+            _refresh_creation_ids(new_layout_element)
             new_layout = SlideLayoutPart(
                 new_layout_partname,
                 src_layout.content_type,
@@ -761,25 +788,102 @@ def _duplicate_blob_part_into(src: Part, target_package) -> Part:
     return cls(new_partname, src.content_type, target_package, src.blob)
 
 
-def _add_sldMasterId_to_presentation(pres_part: PresentationPart, rId: str) -> None:
+def _used_master_layout_ids_in_target(pres_part: PresentationPart) -> set[int]:
+    """Return every `<p:sldMasterId>` AND `<p:sldLayoutId>` `id` in target.
+
+    PowerPoint enforces uniqueness across the SHARED master/layout id pool
+    (per ECMA-376 sec 19.2.1.34 sldMasterId / sec 19.2.1.27 sldLayoutId,
+    both consume the same conceptual identifier space). A new master id
+    that collides with an existing layout id flags the file for repair on
+    load.
+    """
+    used: set[int] = set()
+    sldMasterIdLst = pres_part._element.find(f"{_P_NS}sldMasterIdLst")
+    if sldMasterIdLst is not None:
+        for smi in sldMasterIdLst.findall(f"{_P_NS}sldMasterId"):
+            raw = smi.get("id")
+            if raw is None:
+                continue
+            with contextlib.suppress(ValueError):
+                used.add(int(raw))
+    for rel in pres_part.rels.values():
+        if rel.is_external or rel.reltype != RT.SLIDE_MASTER:
+            continue
+        master_element = rel.target_part._element
+        sldLayoutIdLst = master_element.find(f"{_P_NS}sldLayoutIdLst")
+        if sldLayoutIdLst is None:
+            continue
+        for sli in sldLayoutIdLst.findall(f"{_P_NS}sldLayoutId"):
+            raw = sli.get("id")
+            if raw is None:
+                continue
+            with contextlib.suppress(ValueError):
+                used.add(int(raw))
+    return used
+
+
+def _renumber_sldLayoutIds(element, used_ids: set[int]) -> None:
+    """Reassign `<p:sldLayoutId>` `id` attributes on a deepcopied master.
+
+    Mutates `used_ids` in place so back-to-back ports of multiple masters
+    keep allocating unique ids relative to one another, not just relative
+    to target's pre-existing masters.
+    """
+    sldLayoutIdLst = element.find(f"{_P_NS}sldLayoutIdLst")
+    if sldLayoutIdLst is None:
+        return
+    next_id = max(used_ids | {_OOXML_LAYOUT_ID_FLOOR - 1}) + 1
+    for sli in sldLayoutIdLst.findall(f"{_P_NS}sldLayoutId"):
+        sli.set("id", str(next_id))
+        used_ids.add(next_id)
+        next_id += 1
+
+
+def _refresh_creation_ids(element) -> None:
+    """Reassign every `<p14:creationId val>` to a fresh uint32 value.
+
+    The default `default.pptx` ships with deterministic vals on each
+    master / layout `<p14:creationId>`, so two presentations built from
+    it carry identical vals. PowerPoint flags those as bad content.
+    Replacing the val (rather than stripping the element) keeps the
+    extLst structure PowerPoint expects intact.
+    """
+    creation_id_tag = f"{_P14_NS}creationId"
+    for node in element.iter(creation_id_tag):
+        # 32-bit unsigned, cryptographically strong enough for collision avoidance.
+        node.set("val", str(secrets.randbits(32)))
+
+
+def _add_sldMasterId_to_presentation(
+    pres_part: PresentationPart, rId: str, used_ids: set[int] | None = None
+) -> None:
     """Append a `<p:sldMasterId>` to the presentation, allocating an id.
 
     Slide-master ids in OOXML are required uint32 values typically in the
     high range (default first master is `2147483648`). python-pptx's
     `CT_SlideMasterIdListEntry` only declares the `rId` attribute, so we
     set / read `id` directly on the lxml element to round-trip cleanly.
+
+    `used_ids`, when supplied, is the unified master/layout id pool. The
+    new id is taken above its current max and added to it; PowerPoint
+    enforces master/layout id uniqueness across this shared pool, and a
+    collision flags the file for repair on load. When `used_ids` is None,
+    only existing sldMasterId values are scanned (back-compat for any
+    out-of-band caller).
     """
     sldMasterIdLst = pres_part._element.get_or_add_sldMasterIdLst()
-    used_ids: list[int] = []
-    for sm in sldMasterIdLst.sldMasterId_lst:
-        raw = sm.get("id")
-        if raw is not None:
-            with contextlib.suppress(ValueError):
-                used_ids.append(int(raw))
-    next_id = max(used_ids + [2147483647]) + 1
+    if used_ids is None:
+        used_ids = set()
+        for sm in sldMasterIdLst.sldMasterId_lst:
+            raw = sm.get("id")
+            if raw is not None:
+                with contextlib.suppress(ValueError):
+                    used_ids.add(int(raw))
+    next_id = max(used_ids | {_OOXML_LAYOUT_ID_FLOOR - 1}) + 1
     sldMasterId = sldMasterIdLst._add_sldMasterId()
     sldMasterId.rId = rId
     sldMasterId.set("id", str(next_id))
+    used_ids.add(next_id)
 
 
 def _add_sldLayoutId_to_master(master_part, rId: str) -> None:

tests/test_append_from.py

@@ -527,3 +527,122 @@ def it_does_not_carry_comments_through_an_append(self):
 
         with pytest.raises(KeyError):
             new_slide.part.part_related_by(RT.COMMENTS)
+
+
+# ---------------------------------------------------------------------------
+# PowerPoint round-trip integrity (uniqueness of OOXML-spec ID attrs).
+# ---------------------------------------------------------------------------
+
+
+class DescribePresentation_AppendFrom_OOXMLIntegrity(object):
+    """PowerPoint flags 'bad content / repair' on collisions across masters.
+
+    Two distinct collision classes appear when porting a master from a
+    source presentation that was built from the same default template as
+    the target:
+
+    1. ``<p:sldLayoutId id="...">`` — the deepcopy carries source's layout
+       ids verbatim, which match target's already-existing master's ids.
+    2. ``<p14:creationId val="...">`` — the default ``default.pptx`` ships
+       with a deterministic creationId on every master and layout, so
+       both masters and every parallel layout end up with identical vals.
+
+    Both surface only after a save -> reopen, hence the zip-level checks.
+    """
+
+    def _save_to_zip(self, prs):
+        import zipfile
+
+        buf = io.BytesIO()
+        prs.save(buf)
+        buf.seek(0)
+        return zipfile.ZipFile(buf)
+
+    def it_assigns_unique_sldLayoutId_values_across_masters(self):
+        import re
+
+        src = _seed_presentation_with(1)
+        tgt = Presentation()
+
+        tgt.append_from(src)
+
+        with self._save_to_zip(tgt) as zf:
+            all_ids: list[str] = []
+            for n in zf.namelist():
+                if not (n.startswith("ppt/slideMasters/slideMaster") and n.endswith(".xml")):
+                    continue
+                xml = zf.read(n).decode()
+                all_ids.extend(re.findall(r'<p:sldLayoutId id="(\d+)"', xml))
+
+        assert len(all_ids) == len(set(all_ids)), (
+            "duplicate sldLayoutId across masters: %r" % all_ids
+        )
+
+    def it_assigns_master_id_outside_existing_layout_id_pool(self):
+        """sldMasterId and sldLayoutId share one id pool per ECMA-376.
+
+        Regression for the PowerPoint-repair trigger where the new master's
+        id collided with target's existing master's first layout id (both
+        landed at 2147483649 because the master-id allocator only consulted
+        master ids). PowerPoint flagged the file as bad content.
+        """
+        import re
+
+        src = _seed_presentation_with(1)
+        tgt = Presentation()
+
+        tgt.append_from(src)
+
+        with self._save_to_zip(tgt) as zf:
+            pres_xml = zf.read("ppt/presentation.xml").decode()
+            master_ids = set(re.findall(r'<p:sldMasterId[^/]*\bid="(\d+)"', pres_xml))
+            layout_ids: set[str] = set()
+            for n in zf.namelist():
+                if not (n.startswith("ppt/slideMasters/slideMaster") and n.endswith(".xml")):
+                    continue
+                xml = zf.read(n).decode()
+                layout_ids.update(re.findall(r'<p:sldLayoutId id="(\d+)"', xml))
+
+        assert master_ids.isdisjoint(layout_ids), (
+            "master id collides with a layout id: master=%r layouts=%r" % (master_ids, layout_ids)
+        )
+
+    def it_does_not_duplicate_p14_creationId_across_masters(self):
+        import re
+
+        src = _seed_presentation_with(1)
+        tgt = Presentation()
+
+        tgt.append_from(src)
+
+        with self._save_to_zip(tgt) as zf:
+            master_creation_ids: list[str] = []
+            for n in zf.namelist():
+                if not (n.startswith("ppt/slideMasters/slideMaster") and n.endswith(".xml")):
+                    continue
+                xml = zf.read(n).decode()
+                master_creation_ids.extend(re.findall(r'creationId[^>]*val="([^"]+)"', xml))
+
+        assert len(master_creation_ids) == len(set(master_creation_ids)), (
+            "duplicate master creationId: %r" % master_creation_ids
+        )
+
+    def it_does_not_duplicate_p14_creationId_across_layouts(self):
+        import re
+
+        src = _seed_presentation_with(1)
+        tgt = Presentation()
+
+        tgt.append_from(src)
+
+        with self._save_to_zip(tgt) as zf:
+            layout_creation_ids: list[str] = []
+            for n in zf.namelist():
+                if not (n.startswith("ppt/slideLayouts/slideLayout") and n.endswith(".xml")):
+                    continue
+                xml = zf.read(n).decode()
+                layout_creation_ids.extend(re.findall(r'creationId[^>]*val="([^"]+)"', xml))
+
+        assert len(layout_creation_ids) == len(set(layout_creation_ids)), (
+            "duplicate layout creationId: %r" % layout_creation_ids
+        )