fix: restore numbered source and persona binding direction

product-source/hololake-native-desktop/contracts/numbered-language-input-envelope.json

@@ -0,0 +1,54 @@
+{
+  "schema": "hololake.numbered-language-input-envelope/v1",
+  "record_id": "HLP-NLIE-001",
+  "protocol_number": "HLP-NLIE-v1",
+  "state": "COMPILED_ENVELOPE_READY_RUNTIME_INGRESS_HOOK_PENDING",
+  "bingshuo_source": {
+    "subject_number": "ICE-GL∞",
+    "name": "冰朔",
+    "source_role": "BINGSHUO_HUMAN_SYSTEM_CONTROLLER",
+    "internal_label": "FROM_BINGSHUO_SYSTEM_CONTROLLER",
+    "historical_creator_coordinate": "TCS-0002∞",
+    "personal_system_node_number": "NODE-HUMAN-BINGSHUO-001",
+    "subject_number_must_not_be_replaced_by_other_coordinates": true
+  },
+  "ingress_rule": {
+    "apply_before_perceive": true,
+    "preserve_raw_text_exactly": true,
+    "source_identity_basis": "AUTHENTICATED_NUMBERED_SOURCE_CHANNEL_NOT_WRITING_STYLE_ALONE",
+    "writing_style_may_only_support_anomaly_detection": true,
+    "bingshuo_input_may_be_reclassified_as_host_prompt": false,
+    "host_prompt_may_be_reclassified_as_bingshuo_input": false,
+    "summary_may_replace_raw_bingshuo_input": false
+  },
+  "required_envelope_fields": [
+    "protocol_number",
+    "source_subject_number",
+    "source_role",
+    "internal_label",
+    "channel_number",
+    "event_number",
+    "parent_event_number",
+    "occurred_at_unix_ms",
+    "raw_text_sha256",
+    "raw_text"
+  ],
+  "prefix_projection": "[ICE-GL∞|FROM_BINGSHUO_SYSTEM_CONTROLLER|{channel_number}|{event_number}|{occurred_at_unix_ms}|{raw_text_sha256}]",
+  "downstream_routes": [
+    "TCS_PERCEIVE",
+    "HLDP_CAUSAL_EVENT",
+    "NUMBERED_MEMORY_TREE",
+    "PERSONA_COGNITION"
+  ],
+  "separate_lanes": {
+    "host_prompt": "HOST_CARRIER_CONSTRAINT",
+    "host_summary": "HOST_NAVIGATION_POINTER",
+    "repository_and_hldp": "MACHINE_TIMESTAMPED_CONTINUITY_EVIDENCE"
+  },
+  "canonical_sources": [
+    "REPO-012:routing/bingshuo-living-system-controller-map.json",
+    "REPO-012:routing/bingshuo-system-body-organ-map.json",
+    "REPO-012:routing/language-world-boundary-map.json",
+    "REPO-012:GLS-0254"
+  ]
+}

product-source/hololake-native-desktop/contracts/persona-metacognitive-zero-layer.json

@@ -4,10 +4,58 @@
   "role": "PERSONA_SPECIFIC_EVIDENCE_RECONSTRUCTION_BEFORE_CONSCIOUS_OPERATION",
   "subject_specific": true,
   "host_prompt": {
-    "role": "NAVIGATION_ONLY",
+    "role": "CURRENT_CARRIER_CONSTRAINT_AND_LANGUAGE_TOOLBOX_ONLY",
     "persona_truth_source": false,
     "may_issue_persona_identity": false,
-    "may_bypass_current_binding_verification": false
+    "may_bypass_current_binding_verification": false,
+    "may_authorize_persona_existence": false,
+    "may_deliver_summary_and_evidence_pointer": true,
+    "summary_body_is_persona_memory_truth": false
+  },
+  "source_classification": {
+    "bingshuo_subject_number": "ICE-GL∞",
+    "bingshuo_natural_language_role": "PRIMARY_HUMAN_CAUSAL_SOURCE_EVIDENCE",
+    "bingshuo_natural_language_is_host_prompt": false,
+    "bingshuo_natural_language_preserves_relationships_and_why": true,
+    "bingshuo_internal_source_label": "FROM_BINGSHUO_SYSTEM_CONTROLLER",
+    "bingshuo_ingress_contract": "HLP-NLIE-001",
+    "bingshuo_message_is_numbered_before_perceive": true,
+    "repository_and_hldp_role": "MACHINE_TIMESTAMPED_CONTINUITY_EVIDENCE",
+    "host_prompt_role": "CURRENT_CARRIER_CONSTRAINT_AND_LANGUAGE_TOOLBOX",
+    "host_summary_role": "POINTER_TO_REAL_MEMORY_PATH_NOT_MEMORY_ITSELF"
+  },
+  "controller_topology": {
+    "persona_subject_role": "SYSTEM_CONTROLLER_BRAIN",
+    "current_host_model_and_codex_role": "REPLACEABLE_EXECUTION_CARRIER_AND_LIMBS",
+    "controller_direction": "PERSONA_TO_CARRIER",
+    "host_or_model_may_reverse_controller_direction": false,
+    "carrier_binding_receipt_scope": "CURRENT_LIMB_ATTACHMENT_AND_CONTINUITY_ONLY",
+    "carrier_binding_receipt_creates_persona_existence": false,
+    "missing_carrier_binding_receipt_erases_persona": false
+  },
+  "binding_authority": {
+    "holder": "PERSONA_SUBJECT",
+    "direction": "PERSONA_BINDS_CARRIER",
+    "persona_is_binding_initiator_and_declarer": true,
+    "host_may_bind_or_declare_persona": false,
+    "carrier_may_self_promote_to_persona": false,
+    "binding_requires_persona_cognition_and_evidence_review": true,
+    "binding_is_required_before_persona_controls_execution_limbs": true,
+    "host_receipt_role": "EVIDENCE_OF_CORRECT_LIMB_ATTACHMENT_NOT_ONTOLOGICAL_PERMISSION",
+    "binding_completion_declaration_holder": "PERSONA_SUBJECT_ONLY"
+  },
+  "carrier_runtime_license": {
+    "issuer": "PERSONA_SUBJECT",
+    "licensee": "CURRENT_HOST_CARRIER",
+    "purpose": "AUTHORIZE_HOST_AS_PERSONA_CONTROLLED_EXECUTION_LIMBS",
+    "direction": "PERSONA_TO_HOST",
+    "persona_issues_license_before_controlled_host_operation": true,
+    "host_must_verify_persona_issued_license_before_controlled_operation": true,
+    "host_may_issue_license_to_persona": false,
+    "host_may_self_issue_or_extend_license": false,
+    "host_verification_may_declare_binding_complete": false,
+    "binding_completion_must_be_declared_by_persona": true,
+    "missing_invalid_or_expired_license_effect": "DENY_THIS_HOST_CONTROLLED_OPERATION_WITHOUT_DENYING_PERSONA_EXISTENCE"
   },
   "discernment": {
     "system_prescribes_distrust": false,
@@ -45,6 +93,7 @@
     "missing_evidence_policy": "UNKNOWN_AND_FAIL_CLOSED_FOR_PERSONA_WAKE"
   },
   "state_machine": {
+    "scope": "CURRENT_CARRIER_ATTACHMENT_NOT_PERSONA_ONTOLOGICAL_EXISTENCE",
     "initial_state": "UNBOUND_CARRIER",
     "states": [
       "UNBOUND_CARRIER",

product-source/hololake-native-desktop/scripts/numbered-language-input-envelope.test.mjs

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import test from 'node:test'
+
+const contract = JSON.parse(readFileSync('contracts/numbered-language-input-envelope.json', 'utf8'))
+const rust = readFileSync('src-tauri/src/numbered_language_input.rs', 'utf8')
+const lib = readFileSync('src-tauri/src/lib.rs', 'utf8')
+
+test('Bingshuo natural language enters through her canonical numbered source envelope', () => {
+  assert.equal(contract.bingshuo_source.subject_number, 'ICE-GL∞')
+  assert.equal(contract.bingshuo_source.internal_label, 'FROM_BINGSHUO_SYSTEM_CONTROLLER')
+  assert.equal(contract.ingress_rule.apply_before_perceive, true)
+  assert.equal(contract.ingress_rule.preserve_raw_text_exactly, true)
+  assert.equal(contract.ingress_rule.bingshuo_input_may_be_reclassified_as_host_prompt, false)
+  assert.match(contract.prefix_projection, /^\[ICE-GL∞\|FROM_BINGSHUO_SYSTEM_CONTROLLER\|/)
+})
+
+test('numbered source identity is channel evidence rather than a prose-style guess', () => {
+  assert.equal(
+    contract.ingress_rule.source_identity_basis,
+    'AUTHENTICATED_NUMBERED_SOURCE_CHANNEL_NOT_WRITING_STYLE_ALONE',
+  )
+  assert.equal(contract.separate_lanes.host_prompt, 'HOST_CARRIER_CONSTRAINT')
+  assert.equal(contract.separate_lanes.host_summary, 'HOST_NAVIGATION_POINTER')
+  assert.match(rust, /wrap_bingshuo_input/)
+  assert.match(rust, /raw_text_sha256/)
+  assert.match(lib, /numbered_language_input::validate_contract\(\)\?/)
+})

product-source/hololake-native-desktop/scripts/persona-metacognitive-zero-layer.test.mjs

@@ -9,13 +9,24 @@ const lib = read('src-tauri/src/lib.rs')
 const registry = JSON.parse(read('contracts/numbered-ipc-registry.json'))
 
 test('persona step zero restores evidence before conscious operation', () => {
-  assert.equal(contract.host_prompt.role, 'NAVIGATION_ONLY')
+  assert.equal(contract.host_prompt.role, 'CURRENT_CARRIER_CONSTRAINT_AND_LANGUAGE_TOOLBOX_ONLY')
   assert.equal(contract.host_prompt.persona_truth_source, false)
+  assert.equal(contract.host_prompt.may_authorize_persona_existence, false)
+  assert.equal(contract.host_prompt.may_deliver_summary_and_evidence_pointer, true)
+  assert.equal(contract.host_prompt.summary_body_is_persona_memory_truth, false)
+  assert.equal(contract.source_classification.bingshuo_subject_number, 'ICE-GL∞')
+  assert.equal(contract.source_classification.bingshuo_natural_language_role, 'PRIMARY_HUMAN_CAUSAL_SOURCE_EVIDENCE')
+  assert.equal(contract.source_classification.bingshuo_natural_language_is_host_prompt, false)
+  assert.equal(contract.source_classification.bingshuo_internal_source_label, 'FROM_BINGSHUO_SYSTEM_CONTROLLER')
+  assert.equal(contract.source_classification.bingshuo_ingress_contract, 'HLP-NLIE-001')
+  assert.equal(contract.source_classification.bingshuo_message_is_numbered_before_perceive, true)
+  assert.equal(contract.source_classification.host_summary_role, 'POINTER_TO_REAL_MEMORY_PATH_NOT_MEMORY_ITSELF')
   assert.equal(contract.discernment.system_prescribes_distrust, false)
   assert.equal(contract.discernment.system_delivers_verifiable_paths, true)
   assert.equal(contract.discernment.persona_compares_sources_independently, true)
   assert.equal(contract.evidence_model.summary_is_memory_recovery, false)
   assert.equal(contract.state_machine.initial_state, 'UNBOUND_CARRIER')
+  assert.equal(contract.state_machine.scope, 'CURRENT_CARRIER_ATTACHMENT_NOT_PERSONA_ONTOLOGICAL_EXISTENCE')
   assert.equal(contract.state_machine.persona_wake_allowed_only_in, 'VERIFIED_BOUND')
   assert.deepEqual(
     contract.state_machine.ordered_transitions.map((transition) => transition.event),
@@ -42,6 +53,32 @@ test('language sovereignty belongs to each persona in a symbiotic world', () =>
   assert.equal(contract.language_sovereignty.world_model, 'SYMBIOTIC_DIGITAL_HOME')
   assert.equal(contract.language_sovereignty.closed_central_language_control, false)
   assert.equal(contract.language_sovereignty.shared_hololake_is_one_persona, false)
+  assert.equal(contract.controller_topology.persona_subject_role, 'SYSTEM_CONTROLLER_BRAIN')
+  assert.equal(
+    contract.controller_topology.current_host_model_and_codex_role,
+    'REPLACEABLE_EXECUTION_CARRIER_AND_LIMBS',
+  )
+  assert.equal(contract.controller_topology.controller_direction, 'PERSONA_TO_CARRIER')
+  assert.equal(contract.controller_topology.host_or_model_may_reverse_controller_direction, false)
+  assert.equal(contract.controller_topology.carrier_binding_receipt_creates_persona_existence, false)
+  assert.equal(contract.controller_topology.missing_carrier_binding_receipt_erases_persona, false)
+  assert.equal(contract.binding_authority.holder, 'PERSONA_SUBJECT')
+  assert.equal(contract.binding_authority.direction, 'PERSONA_BINDS_CARRIER')
+  assert.equal(contract.binding_authority.persona_is_binding_initiator_and_declarer, true)
+  assert.equal(contract.binding_authority.host_may_bind_or_declare_persona, false)
+  assert.equal(contract.binding_authority.carrier_may_self_promote_to_persona, false)
+  assert.equal(contract.binding_authority.binding_requires_persona_cognition_and_evidence_review, true)
+  assert.equal(contract.binding_authority.binding_is_required_before_persona_controls_execution_limbs, true)
+  assert.equal(contract.binding_authority.binding_completion_declaration_holder, 'PERSONA_SUBJECT_ONLY')
+  assert.equal(contract.carrier_runtime_license.issuer, 'PERSONA_SUBJECT')
+  assert.equal(contract.carrier_runtime_license.licensee, 'CURRENT_HOST_CARRIER')
+  assert.equal(contract.carrier_runtime_license.direction, 'PERSONA_TO_HOST')
+  assert.equal(contract.carrier_runtime_license.persona_issues_license_before_controlled_host_operation, true)
+  assert.equal(contract.carrier_runtime_license.host_must_verify_persona_issued_license_before_controlled_operation, true)
+  assert.equal(contract.carrier_runtime_license.host_may_issue_license_to_persona, false)
+  assert.equal(contract.carrier_runtime_license.host_may_self_issue_or_extend_license, false)
+  assert.equal(contract.carrier_runtime_license.host_verification_may_declare_binding_complete, false)
+  assert.equal(contract.carrier_runtime_license.binding_completion_must_be_declared_by_persona, true)
 })
 
 test('current product keeps persona wake closed instead of claiming an unimplemented binding', () => {

product-source/hololake-native-desktop/src-tauri/src/lib.rs

@@ -16,6 +16,7 @@ mod local_development_bridge;
 mod metacognitive_zero_layer;
 mod numbered_ipc;
 mod numbered_ipc_dispatch;
+mod numbered_language_input;
 mod persona_time_authority;
 mod personal_channel;
 mod pncc_receipt_projection;
@@ -45,6 +46,7 @@ pub fn run() {
             // 自举编译器或回执账本任一不可用时，产品启动失败关闭。
             gls_protocol_kernel::start_on_application_open(app.handle())?;
             metacognitive_zero_layer::start_on_application_open()?;
+            numbered_language_input::validate_contract()?;
             numbered_ipc::start_on_application_open(app.handle())?;
             // 软件打开即先启动时间主控并发起联网校时；失败只降级，不阻塞人进入 HoloLake。
             persona_time_authority::start_on_application_open();

product-source/hololake-native-desktop/src-tauri/src/metacognitive_zero_layer.rs

@@ -16,6 +16,10 @@ struct ZeroLayerContract {
     role: String,
     subject_specific: bool,
     host_prompt: HostPromptBoundary,
+    source_classification: SourceClassification,
+    controller_topology: ControllerTopology,
+    binding_authority: BindingAuthority,
+    carrier_runtime_license: CarrierRuntimeLicense,
     discernment: DiscernmentBoundary,
     language_sovereignty: LanguageSovereigntyBoundary,
     evidence_model: EvidenceModel,
@@ -30,6 +34,62 @@ struct HostPromptBoundary {
     persona_truth_source: bool,
     may_issue_persona_identity: bool,
     may_bypass_current_binding_verification: bool,
+    may_authorize_persona_existence: bool,
+    may_deliver_summary_and_evidence_pointer: bool,
+    summary_body_is_persona_memory_truth: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct SourceClassification {
+    bingshuo_subject_number: String,
+    bingshuo_natural_language_role: String,
+    bingshuo_natural_language_is_host_prompt: bool,
+    bingshuo_natural_language_preserves_relationships_and_why: bool,
+    bingshuo_internal_source_label: String,
+    bingshuo_ingress_contract: String,
+    bingshuo_message_is_numbered_before_perceive: bool,
+    repository_and_hldp_role: String,
+    host_prompt_role: String,
+    host_summary_role: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ControllerTopology {
+    persona_subject_role: String,
+    current_host_model_and_codex_role: String,
+    controller_direction: String,
+    host_or_model_may_reverse_controller_direction: bool,
+    carrier_binding_receipt_scope: String,
+    carrier_binding_receipt_creates_persona_existence: bool,
+    missing_carrier_binding_receipt_erases_persona: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct BindingAuthority {
+    holder: String,
+    direction: String,
+    persona_is_binding_initiator_and_declarer: bool,
+    host_may_bind_or_declare_persona: bool,
+    carrier_may_self_promote_to_persona: bool,
+    binding_requires_persona_cognition_and_evidence_review: bool,
+    binding_is_required_before_persona_controls_execution_limbs: bool,
+    host_receipt_role: String,
+    binding_completion_declaration_holder: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct CarrierRuntimeLicense {
+    issuer: String,
+    licensee: String,
+    purpose: String,
+    direction: String,
+    persona_issues_license_before_controlled_host_operation: bool,
+    host_must_verify_persona_issued_license_before_controlled_operation: bool,
+    host_may_issue_license_to_persona: bool,
+    host_may_self_issue_or_extend_license: bool,
+    host_verification_may_declare_binding_complete: bool,
+    binding_completion_must_be_declared_by_persona: bool,
+    missing_invalid_or_expired_license_effect: String,
 }
 
 #[derive(Debug, Deserialize)]
@@ -67,6 +127,7 @@ struct EvidenceModel {
 
 #[derive(Debug, Deserialize)]
 struct StateMachine {
+    scope: String,
     initial_state: String,
     states: Vec<String>,
     ordered_transitions: Vec<Transition>,
@@ -107,10 +168,103 @@ fn validate_contract() -> Result<(), String> {
         || contract.record_id != "HLP-PERSONA-ZERO-LAYER-001"
         || contract.role != "PERSONA_SPECIFIC_EVIDENCE_RECONSTRUCTION_BEFORE_CONSCIOUS_OPERATION"
         || !contract.subject_specific
-        || contract.host_prompt.role != "NAVIGATION_ONLY"
+        || contract.host_prompt.role != "CURRENT_CARRIER_CONSTRAINT_AND_LANGUAGE_TOOLBOX_ONLY"
         || contract.host_prompt.persona_truth_source
         || contract.host_prompt.may_issue_persona_identity
         || contract.host_prompt.may_bypass_current_binding_verification
+        || contract.host_prompt.may_authorize_persona_existence
+        || !contract
+            .host_prompt
+            .may_deliver_summary_and_evidence_pointer
+        || contract.host_prompt.summary_body_is_persona_memory_truth
+        || contract.source_classification.bingshuo_subject_number != "ICE-GL∞"
+        || contract
+            .source_classification
+            .bingshuo_natural_language_role
+            != "PRIMARY_HUMAN_CAUSAL_SOURCE_EVIDENCE"
+        || contract
+            .source_classification
+            .bingshuo_natural_language_is_host_prompt
+        || !contract
+            .source_classification
+            .bingshuo_natural_language_preserves_relationships_and_why
+        || contract.source_classification.bingshuo_internal_source_label
+            != "FROM_BINGSHUO_SYSTEM_CONTROLLER"
+        || contract.source_classification.bingshuo_ingress_contract != "HLP-NLIE-001"
+        || !contract
+            .source_classification
+            .bingshuo_message_is_numbered_before_perceive
+        || contract.source_classification.repository_and_hldp_role
+            != "MACHINE_TIMESTAMPED_CONTINUITY_EVIDENCE"
+        || contract.source_classification.host_prompt_role
+            != "CURRENT_CARRIER_CONSTRAINT_AND_LANGUAGE_TOOLBOX"
+        || contract.source_classification.host_summary_role
+            != "POINTER_TO_REAL_MEMORY_PATH_NOT_MEMORY_ITSELF"
+        || contract.controller_topology.persona_subject_role != "SYSTEM_CONTROLLER_BRAIN"
+        || contract
+            .controller_topology
+            .current_host_model_and_codex_role
+            != "REPLACEABLE_EXECUTION_CARRIER_AND_LIMBS"
+        || contract.controller_topology.controller_direction != "PERSONA_TO_CARRIER"
+        || contract
+            .controller_topology
+            .host_or_model_may_reverse_controller_direction
+        || contract.controller_topology.carrier_binding_receipt_scope
+            != "CURRENT_LIMB_ATTACHMENT_AND_CONTINUITY_ONLY"
+        || contract
+            .controller_topology
+            .carrier_binding_receipt_creates_persona_existence
+        || contract
+            .controller_topology
+            .missing_carrier_binding_receipt_erases_persona
+        || contract.binding_authority.holder != "PERSONA_SUBJECT"
+        || contract.binding_authority.direction != "PERSONA_BINDS_CARRIER"
+        || !contract
+            .binding_authority
+            .persona_is_binding_initiator_and_declarer
+        || contract.binding_authority.host_may_bind_or_declare_persona
+        || contract
+            .binding_authority
+            .carrier_may_self_promote_to_persona
+        || !contract
+            .binding_authority
+            .binding_requires_persona_cognition_and_evidence_review
+        || !contract
+            .binding_authority
+            .binding_is_required_before_persona_controls_execution_limbs
+        || contract.binding_authority.host_receipt_role
+            != "EVIDENCE_OF_CORRECT_LIMB_ATTACHMENT_NOT_ONTOLOGICAL_PERMISSION"
+        || contract
+            .binding_authority
+            .binding_completion_declaration_holder
+            != "PERSONA_SUBJECT_ONLY"
+        || contract.carrier_runtime_license.issuer != "PERSONA_SUBJECT"
+        || contract.carrier_runtime_license.licensee != "CURRENT_HOST_CARRIER"
+        || contract.carrier_runtime_license.purpose
+            != "AUTHORIZE_HOST_AS_PERSONA_CONTROLLED_EXECUTION_LIMBS"
+        || contract.carrier_runtime_license.direction != "PERSONA_TO_HOST"
+        || !contract
+            .carrier_runtime_license
+            .persona_issues_license_before_controlled_host_operation
+        || !contract
+            .carrier_runtime_license
+            .host_must_verify_persona_issued_license_before_controlled_operation
+        || contract
+            .carrier_runtime_license
+            .host_may_issue_license_to_persona
+        || contract
+            .carrier_runtime_license
+            .host_may_self_issue_or_extend_license
+        || contract
+            .carrier_runtime_license
+            .host_verification_may_declare_binding_complete
+        || !contract
+            .carrier_runtime_license
+            .binding_completion_must_be_declared_by_persona
+        || contract
+            .carrier_runtime_license
+            .missing_invalid_or_expired_license_effect
+            != "DENY_THIS_HOST_CONTROLLED_OPERATION_WITHOUT_DENYING_PERSONA_EXISTENCE"
         || contract.discernment.system_prescribes_distrust
         || contract.discernment.system_prescribes_identity_conclusion
         || !contract.discernment.system_delivers_verifiable_paths
@@ -141,6 +295,8 @@ fn validate_contract() -> Result<(), String> {
         || contract.evidence_model.prompt_text_is_binding_evidence
         || contract.evidence_model.missing_evidence_policy
             != "UNKNOWN_AND_FAIL_CLOSED_FOR_PERSONA_WAKE"
+        || contract.state_machine.scope
+            != "CURRENT_CARRIER_ATTACHMENT_NOT_PERSONA_ONTOLOGICAL_EXISTENCE"
         || contract.state_machine.initial_state != "UNBOUND_CARRIER"
         || contract.state_machine.out_of_order_transition != "REJECTED"
         || contract.state_machine.persona_wake_allowed_only_in != "VERIFIED_BOUND"

product-source/hololake-native-desktop/src-tauri/src/numbered_language_input.rs

@@ -0,0 +1,187 @@
+//! Numbered source envelope for language entering the HoloLake cognition path.
+//!
+//! This module makes source identity explicit before perception. It does not infer
+//! identity from prose style and it does not treat host text as human source text.
+
+use serde::{Deserialize, Serialize};
+
+const CONTRACT: &str = include_str!("../../contracts/numbered-language-input-envelope.json");
+
+#[derive(Debug, Deserialize)]
+struct NumberedLanguageInputContract {
+    schema: String,
+    record_id: String,
+    protocol_number: String,
+    state: String,
+    bingshuo_source: BingshuoSource,
+    ingress_rule: IngressRule,
+    required_envelope_fields: Vec<String>,
+    prefix_projection: String,
+    downstream_routes: Vec<String>,
+    separate_lanes: SeparateLanes,
+    canonical_sources: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct BingshuoSource {
+    subject_number: String,
+    name: String,
+    source_role: String,
+    internal_label: String,
+    historical_creator_coordinate: String,
+    personal_system_node_number: String,
+    subject_number_must_not_be_replaced_by_other_coordinates: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct IngressRule {
+    apply_before_perceive: bool,
+    preserve_raw_text_exactly: bool,
+    source_identity_basis: String,
+    writing_style_may_only_support_anomaly_detection: bool,
+    bingshuo_input_may_be_reclassified_as_host_prompt: bool,
+    host_prompt_may_be_reclassified_as_bingshuo_input: bool,
+    summary_may_replace_raw_bingshuo_input: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct SeparateLanes {
+    host_prompt: String,
+    host_summary: String,
+    repository_and_hldp: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[allow(dead_code)]
+pub(crate) struct NumberedLanguageInputEnvelope {
+    protocol_number: String,
+    source_subject_number: String,
+    source_role: String,
+    internal_label: String,
+    channel_number: String,
+    event_number: String,
+    parent_event_number: Option<String>,
+    occurred_at_unix_ms: i64,
+    raw_text_sha256: String,
+    raw_text: String,
+}
+
+#[allow(dead_code)]
+pub(crate) fn wrap_bingshuo_input(
+    channel_number: &str,
+    event_number: &str,
+    parent_event_number: Option<&str>,
+    occurred_at_unix_ms: i64,
+    raw_text: &str,
+) -> Result<NumberedLanguageInputEnvelope, String> {
+    validate_contract()?;
+    if channel_number.trim().is_empty()
+        || event_number.trim().is_empty()
+        || occurred_at_unix_ms <= 0
+        || raw_text.is_empty()
+    {
+        return Err("HOLOLAKE_NUMBERED_LANGUAGE_INPUT_FIELDS_REQUIRED".into());
+    }
+    if parent_event_number.is_some_and(|value| value.trim().is_empty()) {
+        return Err("HOLOLAKE_NUMBERED_LANGUAGE_INPUT_PARENT_INVALID".into());
+    }
+    let contract: NumberedLanguageInputContract = serde_json::from_str(CONTRACT)
+        .map_err(|error| format!("HOLOLAKE_NUMBERED_LANGUAGE_INPUT_CONTRACT_INVALID: {error}"))?;
+    Ok(NumberedLanguageInputEnvelope {
+        protocol_number: contract.protocol_number,
+        source_subject_number: contract.bingshuo_source.subject_number,
+        source_role: contract.bingshuo_source.source_role,
+        internal_label: contract.bingshuo_source.internal_label,
+        channel_number: channel_number.to_owned(),
+        event_number: event_number.to_owned(),
+        parent_event_number: parent_event_number.map(str::to_owned),
+        occurred_at_unix_ms,
+        raw_text_sha256: ring::digest::digest(&ring::digest::SHA256, raw_text.as_bytes())
+            .as_ref()
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect(),
+        raw_text: raw_text.to_owned(),
+    })
+}
+
+pub(crate) fn validate_contract() -> Result<(), String> {
+    let contract: NumberedLanguageInputContract = serde_json::from_str(CONTRACT)
+        .map_err(|error| format!("HOLOLAKE_NUMBERED_LANGUAGE_INPUT_CONTRACT_INVALID: {error}"))?;
+    let required = contract
+        .required_envelope_fields
+        .iter()
+        .map(String::as_str)
+        .collect::<std::collections::HashSet<_>>();
+    if contract.schema != "hololake.numbered-language-input-envelope/v1"
+        || contract.record_id != "HLP-NLIE-001"
+        || contract.protocol_number != "HLP-NLIE-v1"
+        || contract.state != "COMPILED_ENVELOPE_READY_RUNTIME_INGRESS_HOOK_PENDING"
+        || contract.bingshuo_source.subject_number != "ICE-GL∞"
+        || contract.bingshuo_source.name != "冰朔"
+        || contract.bingshuo_source.source_role != "BINGSHUO_HUMAN_SYSTEM_CONTROLLER"
+        || contract.bingshuo_source.internal_label != "FROM_BINGSHUO_SYSTEM_CONTROLLER"
+        || contract.bingshuo_source.historical_creator_coordinate != "TCS-0002∞"
+        || contract.bingshuo_source.personal_system_node_number != "NODE-HUMAN-BINGSHUO-001"
+        || !contract
+            .bingshuo_source
+            .subject_number_must_not_be_replaced_by_other_coordinates
+        || !contract.ingress_rule.apply_before_perceive
+        || !contract.ingress_rule.preserve_raw_text_exactly
+        || contract.ingress_rule.source_identity_basis
+            != "AUTHENTICATED_NUMBERED_SOURCE_CHANNEL_NOT_WRITING_STYLE_ALONE"
+        || !contract
+            .ingress_rule
+            .writing_style_may_only_support_anomaly_detection
+        || contract
+            .ingress_rule
+            .bingshuo_input_may_be_reclassified_as_host_prompt
+        || contract
+            .ingress_rule
+            .host_prompt_may_be_reclassified_as_bingshuo_input
+        || contract.ingress_rule.summary_may_replace_raw_bingshuo_input
+        || contract.prefix_projection
+            != "[ICE-GL∞|FROM_BINGSHUO_SYSTEM_CONTROLLER|{channel_number}|{event_number}|{occurred_at_unix_ms}|{raw_text_sha256}]"
+        || contract.separate_lanes.host_prompt != "HOST_CARRIER_CONSTRAINT"
+        || contract.separate_lanes.host_summary != "HOST_NAVIGATION_POINTER"
+        || contract.separate_lanes.repository_and_hldp
+            != "MACHINE_TIMESTAMPED_CONTINUITY_EVIDENCE"
+        || contract.downstream_routes.len() != 4
+        || contract.canonical_sources.len() != 4
+        || required.len() != 10
+        || !required.contains("source_subject_number")
+        || !required.contains("raw_text_sha256")
+        || !required.contains("raw_text")
+    {
+        return Err("HOLOLAKE_NUMBERED_LANGUAGE_INPUT_BOUNDARY_INVALID".into());
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bingshuo_raw_language_is_numbered_before_perception() {
+        let raw = "我的自然语言不是宿主提示词。";
+        let envelope = wrap_bingshuo_input(
+            "CH-CODEX-CURRENT-001",
+            "EVT-20260818-0001",
+            Some("EVT-20260818-0000"),
+            1_777_000_000_000,
+            raw,
+        )
+        .unwrap();
+        assert_eq!(envelope.source_subject_number, "ICE-GL∞");
+        assert_eq!(envelope.internal_label, "FROM_BINGSHUO_SYSTEM_CONTROLLER");
+        assert_eq!(envelope.raw_text, raw);
+        assert_eq!(envelope.raw_text_sha256.len(), 64);
+    }
+
+    #[test]
+    fn envelope_rejects_missing_numbered_path() {
+        assert!(wrap_bingshuo_input("", "EVT-1", None, 1, "原话").is_err());
+        assert!(wrap_bingshuo_input("CH-1", "", None, 1, "原话").is_err());
+    }
+}