Add strict glyph hybrid request planner

glyph_hybrid_plan.py

@@ -0,0 +1,793 @@
+"""Fail-closed request planner for the frozen ``glyph_ascii_v1`` profile.
+
+This module is deliberately limited to text and provenance.  It does not load
+audio, generate speech, join waveforms, or alter the legacy frontend.  A
+request either receives one complete, reversible hybrid plan or remains on the
+unchanged legacy path.
+
+The profile scans *maximal printable-ASCII runs*.  A run is network-looking
+when it contains ``@`` or begins exactly with ``http://`` or ``https://``.
+Every such run must independently satisfy the strict ``glyph_ascii_v1``
+grammar.  There is no stripping, case folding, Unicode repair, substring
+borrowing, or partial activation.
+
+Canonical boundary contract
+---------------------------
+
+Every non-empty canonical payload is separated from the next payload by
+exactly one ASCII space.  The same rule applies between glyph atoms.  Spaces
+are represented by explicit, zero-raw/zero-audio separator segments.  Carrier
+punctuation comes only from the existing zh-TW production normalizer; this
+planner injects no lexical cue or punctuation.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import asdict, dataclass
+import hashlib
+import json
+import re
+import unicodedata
+
+from glyph_ascii_v1 import (
+    GLYPH_ASCII_V1_GRAMMAR_ID,
+    GlyphAsciiV1Error,
+    GlyphAsciiV1Proof,
+    glyph_ascii_v1_asset_manifest_sha256,
+    inverse_glyph_ascii_v1,
+    render_glyph_ascii_v1,
+)
+from production import (
+    contains_network_identifier,
+    count_speech_units,
+    normalize_spoken_forms,
+)
+
+
+GLYPH_HYBRID_PROFILE_ID = "glyph_hybrid_request_v1"
+GLYPH_HYBRID_NORMALIZATION_ID = "production.normalize_spoken_forms:zh-TW"
+GLYPH_HYBRID_BOUNDARY_ID = "single_ascii_space_zero_audio_v1"
+
+# These reservations are independent from the ordinary cascade ledger.  The
+# planner runs before generation, so a request cannot consume model or asset
+# work and then discover that it exceeded a profile cap.
+GLYPH_HYBRID_MAX_RAW_CHARS = 360
+GLYPH_HYBRID_MAX_IDENTIFIERS = 8
+GLYPH_HYBRID_MAX_ASSET_ATOMS = 128
+GLYPH_HYBRID_MAX_ASSET_CANONICAL_UNITS = 512
+GLYPH_HYBRID_ASSET_AUDIO_PLACEHOLDER_SAMPLES_PER_ATOM = 144_000
+GLYPH_HYBRID_MAX_ASSET_AUDIO_PLACEHOLDER_SAMPLES = (
+    GLYPH_HYBRID_MAX_ASSET_ATOMS
+    * GLYPH_HYBRID_ASSET_AUDIO_PLACEHOLDER_SAMPLES_PER_ATOM
+)
+GLYPH_HYBRID_MAX_MODEL_GENERATED_CHUNKS = 32
+GLYPH_HYBRID_MAX_MODEL_GENERATED_TEXT_UNITS = 800
+
+_PRINTABLE_ASCII_RUN_RE = re.compile(r"[ -~]+", flags=re.ASCII)
+_SHA256_RE = re.compile(r"[0-9a-f]{64}\Z", flags=re.ASCII)
+_NETWORK_PREFIXES = ("http://", "https://")
+_ZH_CARRIER_COMPATIBILITY_PUNCTUATION = frozenset(
+    "，。！？；：、（）【】「」『』《》〈〉“”‘’［］｛｝"
+    "…⋯—–．｡､〔〕〖〗〘〙〚〛﹁﹂︰﹐﹑﹒﹔﹕﹖﹗"
+)
+_BIDI_UNSAFE = frozenset(
+    {
+        "BN",
+        "LRE",
+        "LRO",
+        "RLE",
+        "RLO",
+        "PDF",
+        "LRI",
+        "RLI",
+        "FSI",
+        "PDI",
+    }
+)
+_SEGMENT_KINDS = frozenset({"carrier", "asset_atom", "control", "separator"})
+_AUDIO_SOURCES = frozenset({"model", "asset", "zero_audio"})
+
+
+class GlyphHybridPlanError(ValueError):
+    """Raised when a plan, proof, manifest, or expected request is invalid."""
+
+
+@dataclass(frozen=True)
+class HybridSegmentSpec:
+    """One exact raw/canonical segment in assembly order.
+
+    ``raw_text`` is retained for carrier/control provenance and for the one
+    ASCII byte represented by an asset atom.  Separator segments have empty
+    raw text and a zero-width raw range.
+    """
+
+    ordinal: int
+    kind: str
+    audio_source: str
+    absolute_raw_start: int
+    absolute_raw_end: int
+    canonical_start: int
+    canonical_end: int
+    raw_text: str
+    canonical_text: str
+    raw_sha256: str
+    canonical_sha256: str
+    identifier_ordinal: int | None
+    atom_ordinal: int | None
+    asset_id: str | None
+    manifest_entry_sha256: str | None
+
+
+@dataclass(frozen=True)
+class HybridReservation:
+    """Pre-generation resource reservation for one complete request."""
+
+    raw_chars: int
+    identifiers: int
+    asset_atoms: int
+    asset_canonical_units: int
+    asset_audio_placeholder_samples: int
+    model_generated_chunks: int
+    model_generated_text_units: int
+
+
+@dataclass(frozen=True)
+class HybridRenderPlan:
+    """Complete request-level proof and canonical assembly plan."""
+
+    profile_id: str
+    grammar_id: str
+    normalization_id: str
+    boundary_contract_id: str
+    raw_input_sha256: str
+    canonical_target: str
+    canonical_target_sha256: str
+    asset_manifest_logical_sha256: str
+    identifier_proofs: tuple[GlyphAsciiV1Proof, ...]
+    segments: tuple[HybridSegmentSpec, ...]
+    reservation: HybridReservation
+    plan_sha256: str
+
+
+@dataclass(frozen=True)
+class _RawPiece:
+    kind: str
+    start: int
+    end: int
+    text: str
+
+
+def _sha256_text(value: str) -> str:
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def _require_sha256(value: object, *, field: str) -> str:
+    if type(value) is not str or _SHA256_RE.fullmatch(value) is None:
+        raise GlyphHybridPlanError(f"{field} must be a lowercase SHA-256 digest")
+    return value
+
+
+def _plan_payload(plan: HybridRenderPlan) -> dict[str, object]:
+    payload = asdict(plan)
+    payload.pop("plan_sha256")
+    return payload
+
+
+def _logical_plan_sha256(plan: HybridRenderPlan) -> str:
+    payload = json.dumps(
+        _plan_payload(plan),
+        ensure_ascii=True,
+        separators=(",", ":"),
+        sort_keys=True,
+    ).encode("ascii")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def glyph_hybrid_plan_sha256(plan: HybridRenderPlan) -> str:
+    """Validate the plan type and return its recomputed logical digest."""
+
+    if type(plan) is not HybridRenderPlan:
+        raise GlyphHybridPlanError("hybrid plan has an invalid type")
+    return _logical_plan_sha256(plan)
+
+
+def _network_looking(run: str) -> bool:
+    return "@" in run or run.startswith(_NETWORK_PREFIXES)
+
+
+def _request_has_unsafe_unicode(raw_request: str) -> bool:
+    """Reject characters that can split or visually rewrite an identifier.
+
+    Han text and ordinary zh-TW punctuation remain eligible.  Non-ASCII Latin,
+    Greek, Cyrillic, combining marks, compatibility forms that fold to
+    printable ASCII, controls, and bidi formatting are intentionally outside
+    this narrow profile.
+    """
+
+    for character in raw_request:
+        if character.isascii():
+            if unicodedata.category(character)[0] == "C":
+                return True
+            continue
+        category = unicodedata.category(character)
+        bidi = unicodedata.bidirectional(character)
+        if category[0] in {"C", "M"} or bidi in _BIDI_UNSAFE:
+            return True
+        if character in _ZH_CARRIER_COMPATIBILITY_PUNCTUATION:
+            continue
+        folded = unicodedata.normalize("NFKC", character)
+        if folded != character and any(
+            folded_character.isascii()
+            and 0x20 <= ord(folded_character) <= 0x7E
+            for folded_character in folded
+        ):
+            return True
+        unicode_name = unicodedata.name(character, "")
+        if any(
+            script in unicode_name
+            for script in ("LATIN", "GREEK", "CYRILLIC")
+        ):
+            return True
+    return False
+
+
+def _raw_pieces(raw_request: str) -> tuple[_RawPiece, ...] | None:
+    network_runs: list[re.Match[str]] = []
+    for match in _PRINTABLE_ASCII_RUN_RE.finditer(raw_request):
+        if _network_looking(match.group(0)):
+            network_runs.append(match)
+    if not network_runs:
+        return None
+    if len(network_runs) > GLYPH_HYBRID_MAX_IDENTIFIERS:
+        return None
+
+    pieces: list[_RawPiece] = []
+    cursor = 0
+    for match in network_runs:
+        if cursor < match.start():
+            pieces.append(
+                _RawPiece(
+                    kind="carrier",
+                    start=cursor,
+                    end=match.start(),
+                    text=raw_request[cursor : match.start()],
+                )
+            )
+        pieces.append(
+            _RawPiece(
+                kind="identifier",
+                start=match.start(),
+                end=match.end(),
+                text=match.group(0),
+            )
+        )
+        cursor = match.end()
+    if cursor < len(raw_request):
+        pieces.append(
+            _RawPiece(
+                kind="carrier",
+                start=cursor,
+                end=len(raw_request),
+                text=raw_request[cursor:],
+            )
+        )
+    return tuple(pieces)
+
+
+def _carrier_canonical(raw_fragment: str) -> str | None:
+    # A network form outside the strict maximal run would make activation
+    # partial.  Reject both before and after legacy normalization.
+    if contains_network_identifier(raw_fragment):
+        return None
+    try:
+        canonical = normalize_spoken_forms(raw_fragment, locale="zh-TW")
+    except (TypeError, ValueError):
+        return None
+    if (
+        contains_network_identifier(canonical)
+        or canonical != " ".join(canonical.split())
+    ):
+        return None
+    return canonical
+
+
+def _manifest_digest(
+    asset_entry_sha256_by_asset_id: Mapping[str, str],
+) -> str:
+    try:
+        return glyph_ascii_v1_asset_manifest_sha256(
+            asset_entry_sha256_by_asset_id
+        )
+    except GlyphAsciiV1Error as error:
+        raise GlyphHybridPlanError("glyph asset manifest is invalid") from error
+
+
+def _segment(
+    *,
+    ordinal: int,
+    kind: str,
+    audio_source: str,
+    absolute_raw_start: int,
+    absolute_raw_end: int,
+    canonical_start: int,
+    raw_text: str,
+    canonical_text: str,
+    identifier_ordinal: int | None = None,
+    atom_ordinal: int | None = None,
+    asset_id: str | None = None,
+    manifest_entry_sha256: str | None = None,
+) -> HybridSegmentSpec:
+    return HybridSegmentSpec(
+        ordinal=ordinal,
+        kind=kind,
+        audio_source=audio_source,
+        absolute_raw_start=absolute_raw_start,
+        absolute_raw_end=absolute_raw_end,
+        canonical_start=canonical_start,
+        canonical_end=canonical_start + len(canonical_text),
+        raw_text=raw_text,
+        canonical_text=canonical_text,
+        raw_sha256=_sha256_text(raw_text),
+        canonical_sha256=_sha256_text(canonical_text),
+        identifier_ordinal=identifier_ordinal,
+        atom_ordinal=atom_ordinal,
+        asset_id=asset_id,
+        manifest_entry_sha256=manifest_entry_sha256,
+    )
+
+
+def build_glyph_hybrid_plan(
+    raw_request: str,
+    *,
+    asset_entry_sha256_by_asset_id: Mapping[str, str],
+) -> HybridRenderPlan | None:
+    """Build one complete strict plan, or return ``None`` without side effects.
+
+    ``None`` means that the whole request must remain on the unchanged legacy
+    path.  Invalid manifest configuration raises because silently falling back
+    would conceal a deployment-integrity error.
+    """
+
+    if type(raw_request) is not str:
+        raise GlyphHybridPlanError("raw request must be an exact string")
+    manifest_sha256 = _manifest_digest(asset_entry_sha256_by_asset_id)
+    if (
+        not raw_request
+        or len(raw_request) > GLYPH_HYBRID_MAX_RAW_CHARS
+        or _request_has_unsafe_unicode(raw_request)
+    ):
+        return None
+    pieces = _raw_pieces(raw_request)
+    if pieces is None:
+        return None
+
+    segments: list[HybridSegmentSpec] = []
+    identifier_proofs: list[GlyphAsciiV1Proof] = []
+    canonical_parts: list[str] = []
+    canonical_cursor = 0
+    last_payload_raw_boundary: int | None = None
+    asset_canonical_units = 0
+    model_generated_chunks = 0
+    model_generated_text_units = 0
+
+    def append_separator(raw_boundary: int) -> None:
+        nonlocal canonical_cursor
+        separator = _segment(
+            ordinal=len(segments),
+            kind="separator",
+            audio_source="zero_audio",
+            absolute_raw_start=raw_boundary,
+            absolute_raw_end=raw_boundary,
+            canonical_start=canonical_cursor,
+            raw_text="",
+            canonical_text=" ",
+        )
+        segments.append(separator)
+        canonical_parts.append(separator.canonical_text)
+        canonical_cursor = separator.canonical_end
+
+    def prepare_payload(raw_boundary: int) -> None:
+        if canonical_parts and canonical_parts[-1] != " ":
+            append_separator(raw_boundary)
+
+    for piece in pieces:
+        if piece.kind == "carrier":
+            canonical = _carrier_canonical(piece.text)
+            if canonical is None:
+                return None
+            speech_units = count_speech_units(canonical)
+            if canonical:
+                prepare_payload(piece.start)
+            kind = "carrier" if speech_units > 0 else "control"
+            audio_source = "model" if kind == "carrier" else "zero_audio"
+            carrier = _segment(
+                ordinal=len(segments),
+                kind=kind,
+                audio_source=audio_source,
+                absolute_raw_start=piece.start,
+                absolute_raw_end=piece.end,
+                canonical_start=canonical_cursor,
+                raw_text=piece.text,
+                canonical_text=canonical,
+            )
+            segments.append(carrier)
+            if canonical:
+                canonical_parts.append(canonical)
+                canonical_cursor = carrier.canonical_end
+                last_payload_raw_boundary = piece.end
+            if kind == "carrier":
+                model_generated_chunks += 1
+                model_generated_text_units += speech_units
+            continue
+
+        if piece.kind != "identifier":
+            raise GlyphHybridPlanError("internal raw piece kind is invalid")
+        try:
+            # Strict eligibility is checked before adding any segment.  There
+            # is no chance to render a valid prefix of an invalid run.
+            if canonical_parts and canonical_parts[-1] != " ":
+                append_separator(piece.start)
+            canonical, proof = render_glyph_ascii_v1(
+                piece.text,
+                asset_entry_sha256_by_asset_id=asset_entry_sha256_by_asset_id,
+                absolute_raw_start=piece.start,
+                canonical_start=canonical_cursor,
+            )
+        except GlyphAsciiV1Error:
+            return None
+
+        identifier_ordinal = len(identifier_proofs)
+        identifier_proofs.append(proof)
+        for atom_index, atom in enumerate(proof.atoms):
+            if atom_index:
+                append_separator(atom.absolute_raw_start)
+            raw_character = chr(atom.raw_byte)
+            asset = _segment(
+                ordinal=len(segments),
+                kind="asset_atom",
+                audio_source="asset",
+                absolute_raw_start=atom.absolute_raw_start,
+                absolute_raw_end=atom.absolute_raw_end,
+                canonical_start=atom.canonical_start,
+                raw_text=raw_character,
+                canonical_text=atom.canonical_token,
+                identifier_ordinal=identifier_ordinal,
+                atom_ordinal=atom.ordinal,
+                asset_id=atom.asset_id,
+                manifest_entry_sha256=atom.manifest_entry_sha256,
+            )
+            segments.append(asset)
+            canonical_parts.append(asset.canonical_text)
+            canonical_cursor = asset.canonical_end
+            asset_canonical_units += count_speech_units(atom.canonical_token)
+        if canonical != "".join(
+            segment.canonical_text
+            for segment in segments
+            if (
+                segment.identifier_ordinal == identifier_ordinal
+                or (
+                    segment.kind == "separator"
+                    and proof.canonical_start
+                    <= segment.canonical_start
+                    < proof.canonical_end
+                )
+            )
+        ):
+            raise GlyphHybridPlanError("core identifier rendering was not preserved")
+        last_payload_raw_boundary = piece.end
+
+    # ``last_payload_raw_boundary`` is an internal construction assertion.  A
+    # valid network request necessarily emitted at least one canonical atom.
+    if last_payload_raw_boundary is None or not identifier_proofs:
+        return None
+    canonical_target = "".join(canonical_parts)
+    asset_atoms = sum(len(proof.atoms) for proof in identifier_proofs)
+    reservation = HybridReservation(
+        raw_chars=len(raw_request),
+        identifiers=len(identifier_proofs),
+        asset_atoms=asset_atoms,
+        asset_canonical_units=asset_canonical_units,
+        asset_audio_placeholder_samples=(
+            asset_atoms
+            * GLYPH_HYBRID_ASSET_AUDIO_PLACEHOLDER_SAMPLES_PER_ATOM
+        ),
+        model_generated_chunks=model_generated_chunks,
+        model_generated_text_units=model_generated_text_units,
+    )
+    if (
+        reservation.identifiers > GLYPH_HYBRID_MAX_IDENTIFIERS
+        or reservation.asset_atoms > GLYPH_HYBRID_MAX_ASSET_ATOMS
+        or reservation.asset_canonical_units
+        > GLYPH_HYBRID_MAX_ASSET_CANONICAL_UNITS
+        or reservation.asset_audio_placeholder_samples
+        > GLYPH_HYBRID_MAX_ASSET_AUDIO_PLACEHOLDER_SAMPLES
+        or reservation.model_generated_chunks
+        > GLYPH_HYBRID_MAX_MODEL_GENERATED_CHUNKS
+        or reservation.model_generated_text_units
+        > GLYPH_HYBRID_MAX_MODEL_GENERATED_TEXT_UNITS
+    ):
+        return None
+
+    unfinished = HybridRenderPlan(
+        profile_id=GLYPH_HYBRID_PROFILE_ID,
+        grammar_id=GLYPH_ASCII_V1_GRAMMAR_ID,
+        normalization_id=GLYPH_HYBRID_NORMALIZATION_ID,
+        boundary_contract_id=GLYPH_HYBRID_BOUNDARY_ID,
+        raw_input_sha256=_sha256_text(raw_request),
+        canonical_target=canonical_target,
+        canonical_target_sha256=_sha256_text(canonical_target),
+        asset_manifest_logical_sha256=manifest_sha256,
+        identifier_proofs=tuple(identifier_proofs),
+        segments=tuple(segments),
+        reservation=reservation,
+        plan_sha256="",
+    )
+    return HybridRenderPlan(
+        **{
+            **unfinished.__dict__,
+            "plan_sha256": _logical_plan_sha256(unfinished),
+        }
+    )
+
+
+def inverse_glyph_hybrid_plan(
+    plan: HybridRenderPlan,
+    *,
+    asset_entry_sha256_by_asset_id: Mapping[str, str],
+    expected_raw_request: str,
+) -> str:
+    """Validate from first principles and reconstruct the exact raw request.
+
+    The original request is mandatory external provenance.  This prevents an
+    attacker from replacing a whole internally-consistent plan and merely
+    recomputing its unkeyed digests.
+    """
+
+    if type(plan) is not HybridRenderPlan:
+        raise GlyphHybridPlanError("hybrid plan has an invalid type")
+    if type(expected_raw_request) is not str:
+        raise GlyphHybridPlanError("expected raw request must be an exact string")
+    manifest_sha256 = _manifest_digest(asset_entry_sha256_by_asset_id)
+    if (
+        type(plan.identifier_proofs) is not tuple
+        or type(plan.segments) is not tuple
+        or type(plan.reservation) is not HybridReservation
+        or plan.profile_id != GLYPH_HYBRID_PROFILE_ID
+        or plan.grammar_id != GLYPH_ASCII_V1_GRAMMAR_ID
+        or plan.normalization_id != GLYPH_HYBRID_NORMALIZATION_ID
+        or plan.boundary_contract_id != GLYPH_HYBRID_BOUNDARY_ID
+        or _require_sha256(
+            plan.raw_input_sha256,
+            field="plan.raw_input_sha256",
+        )
+        != plan.raw_input_sha256
+        or _require_sha256(
+            plan.canonical_target_sha256,
+            field="plan.canonical_target_sha256",
+        )
+        != plan.canonical_target_sha256
+        or _require_sha256(
+            plan.asset_manifest_logical_sha256,
+            field="plan.asset_manifest_logical_sha256",
+        )
+        != plan.asset_manifest_logical_sha256
+        or _require_sha256(plan.plan_sha256, field="plan.plan_sha256")
+        != plan.plan_sha256
+        or plan.asset_manifest_logical_sha256 != manifest_sha256
+        or plan.raw_input_sha256 != _sha256_text(expected_raw_request)
+        or plan.canonical_target_sha256 != _sha256_text(plan.canonical_target)
+        or plan.plan_sha256 != _logical_plan_sha256(plan)
+    ):
+        raise GlyphHybridPlanError("hybrid plan header is inconsistent")
+
+    reconstructed_parts: list[str] = []
+    canonical_parts: list[str] = []
+    raw_cursor = 0
+    canonical_cursor = 0
+    asset_segments: dict[tuple[int, int], HybridSegmentSpec] = {}
+    previous_nonempty_payload = False
+    for ordinal, segment in enumerate(plan.segments):
+        if type(segment) is not HybridSegmentSpec:
+            raise GlyphHybridPlanError("hybrid segment has an invalid type")
+        integer_fields = (
+            segment.ordinal,
+            segment.absolute_raw_start,
+            segment.absolute_raw_end,
+            segment.canonical_start,
+            segment.canonical_end,
+        )
+        if any(type(value) is not int for value in integer_fields):
+            raise GlyphHybridPlanError("hybrid segment integer field is invalid")
+        if (
+            segment.ordinal != ordinal
+            or segment.kind not in _SEGMENT_KINDS
+            or segment.audio_source not in _AUDIO_SOURCES
+            or type(segment.raw_text) is not str
+            or type(segment.canonical_text) is not str
+            or segment.absolute_raw_start != raw_cursor
+            or segment.absolute_raw_end < segment.absolute_raw_start
+            or segment.canonical_start != canonical_cursor
+            or segment.canonical_end
+            != segment.canonical_start + len(segment.canonical_text)
+            or _require_sha256(
+                segment.raw_sha256,
+                field="segment.raw_sha256",
+            )
+            != _sha256_text(segment.raw_text)
+            or _require_sha256(
+                segment.canonical_sha256,
+                field="segment.canonical_sha256",
+            )
+            != _sha256_text(segment.canonical_text)
+        ):
+            raise GlyphHybridPlanError("hybrid segment is inconsistent")
+
+        if segment.kind == "separator":
+            if (
+                segment.audio_source != "zero_audio"
+                or segment.absolute_raw_end != segment.absolute_raw_start
+                or segment.raw_text
+                or segment.canonical_text != " "
+                or any(
+                    value is not None
+                    for value in (
+                        segment.identifier_ordinal,
+                        segment.atom_ordinal,
+                        segment.asset_id,
+                        segment.manifest_entry_sha256,
+                    )
+                )
+                or not previous_nonempty_payload
+            ):
+                raise GlyphHybridPlanError("separator contract is inconsistent")
+            previous_nonempty_payload = False
+        elif segment.kind == "asset_atom":
+            if (
+                segment.audio_source != "asset"
+                or segment.absolute_raw_end != segment.absolute_raw_start + 1
+                or len(segment.raw_text) != 1
+                or not segment.raw_text.isascii()
+                or not segment.canonical_text
+                or type(segment.identifier_ordinal) is not int
+                or type(segment.atom_ordinal) is not int
+                or type(segment.asset_id) is not str
+                or _require_sha256(
+                    segment.manifest_entry_sha256,
+                    field="segment.manifest_entry_sha256",
+                )
+                != segment.manifest_entry_sha256
+                or previous_nonempty_payload
+            ):
+                raise GlyphHybridPlanError("asset segment contract is inconsistent")
+            key = (segment.identifier_ordinal, segment.atom_ordinal)
+            if key in asset_segments:
+                raise GlyphHybridPlanError("asset segment provenance is duplicated")
+            asset_segments[key] = segment
+            reconstructed_parts.append(segment.raw_text)
+            raw_cursor = segment.absolute_raw_end
+            previous_nonempty_payload = True
+        elif segment.kind in {"carrier", "control"}:
+            if (
+                segment.absolute_raw_end <= segment.absolute_raw_start
+                or len(segment.raw_text)
+                != segment.absolute_raw_end - segment.absolute_raw_start
+                or any(
+                    value is not None
+                    for value in (
+                        segment.identifier_ordinal,
+                        segment.atom_ordinal,
+                        segment.asset_id,
+                        segment.manifest_entry_sha256,
+                    )
+                )
+            ):
+                raise GlyphHybridPlanError("carrier/control provenance is inconsistent")
+            canonical = _carrier_canonical(segment.raw_text)
+            speech_units = (
+                count_speech_units(segment.canonical_text)
+                if canonical is not None
+                else -1
+            )
+            if (
+                canonical is None
+                or canonical != segment.canonical_text
+                or (
+                    segment.kind == "carrier"
+                    and (
+                        segment.audio_source != "model"
+                        or speech_units <= 0
+                    )
+                )
+                or (
+                    segment.kind == "control"
+                    and (
+                        segment.audio_source != "zero_audio"
+                        or speech_units != 0
+                    )
+                )
+                or (segment.canonical_text and previous_nonempty_payload)
+            ):
+                raise GlyphHybridPlanError("carrier/control contract is inconsistent")
+            reconstructed_parts.append(segment.raw_text)
+            raw_cursor = segment.absolute_raw_end
+            if segment.canonical_text:
+                previous_nonempty_payload = True
+        else:
+            raise GlyphHybridPlanError("unknown hybrid segment kind")
+
+        canonical_parts.append(segment.canonical_text)
+        canonical_cursor = segment.canonical_end
+
+    reconstructed = "".join(reconstructed_parts)
+    canonical = "".join(canonical_parts)
+    if (
+        raw_cursor != len(reconstructed)
+        or reconstructed != expected_raw_request
+        or canonical != plan.canonical_target
+        or canonical_cursor != len(canonical)
+        or canonical.startswith(" ")
+        or canonical.endswith(" ")
+        or "  " in canonical
+    ):
+        raise GlyphHybridPlanError("hybrid segments do not provide exact coverage")
+
+    expected_asset_keys: set[tuple[int, int]] = set()
+    previous_raw_end = -1
+    previous_canonical_end = -1
+    for identifier_ordinal, proof in enumerate(plan.identifier_proofs):
+        if type(proof) is not GlyphAsciiV1Proof:
+            raise GlyphHybridPlanError("identifier proof has an invalid type")
+        try:
+            raw_identifier = inverse_glyph_ascii_v1(
+                proof,
+                asset_entry_sha256_by_asset_id=asset_entry_sha256_by_asset_id,
+            )
+        except GlyphAsciiV1Error as error:
+            raise GlyphHybridPlanError("identifier proof is invalid") from error
+        if (
+            proof.absolute_raw_start <= previous_raw_end
+            or proof.canonical_start <= previous_canonical_end
+            or expected_raw_request[
+                proof.absolute_raw_start : proof.absolute_raw_end
+            ]
+            != raw_identifier
+            or plan.canonical_target[
+                proof.canonical_start : proof.canonical_end
+            ]
+            != " ".join(atom.canonical_token for atom in proof.atoms)
+        ):
+            raise GlyphHybridPlanError("identifier proof range is inconsistent")
+        previous_raw_end = proof.absolute_raw_end
+        previous_canonical_end = proof.canonical_end
+        for atom in proof.atoms:
+            key = (identifier_ordinal, atom.ordinal)
+            segment = asset_segments.get(key)
+            if (
+                segment is None
+                or segment.absolute_raw_start != atom.absolute_raw_start
+                or segment.absolute_raw_end != atom.absolute_raw_end
+                or segment.canonical_start != atom.canonical_start
+                or segment.canonical_end != atom.canonical_end
+                or ord(segment.raw_text) != atom.raw_byte
+                or segment.canonical_text != atom.canonical_token
+                or segment.asset_id != atom.asset_id
+                or segment.manifest_entry_sha256
+                != atom.manifest_entry_sha256
+            ):
+                raise GlyphHybridPlanError("asset segment does not match its proof")
+            expected_asset_keys.add(key)
+    if set(asset_segments) != expected_asset_keys:
+        raise GlyphHybridPlanError("asset segment set does not match identifier proofs")
+
+    expected_plan = build_glyph_hybrid_plan(
+        reconstructed,
+        asset_entry_sha256_by_asset_id=asset_entry_sha256_by_asset_id,
+    )
+    if (
+        expected_plan is None
+        or type(expected_plan) is not type(plan)
+        or expected_plan != plan
+    ):
+        raise GlyphHybridPlanError("hybrid plan is not the unique expected plan")
+    return reconstructed

tests/test_glyph_hybrid_plan.py

@@ -0,0 +1,616 @@
+from __future__ import annotations
+
+from dataclasses import asdict, replace
+import hashlib
+import json
+import random
+
+import pytest
+
+from glyph_ascii_v1 import (
+    GLYPH_ASCII_V1_SYMBOLS,
+    GlyphAsciiV1AtomProof,
+    GlyphAsciiV1Proof,
+)
+from glyph_hybrid_plan import (
+    GLYPH_HYBRID_ASSET_AUDIO_PLACEHOLDER_SAMPLES_PER_ATOM,
+    GLYPH_HYBRID_BOUNDARY_ID,
+    GLYPH_HYBRID_MAX_ASSET_ATOMS,
+    GLYPH_HYBRID_MAX_ASSET_CANONICAL_UNITS,
+    GLYPH_HYBRID_MAX_IDENTIFIERS,
+    GLYPH_HYBRID_MAX_MODEL_GENERATED_CHUNKS,
+    GLYPH_HYBRID_MAX_MODEL_GENERATED_TEXT_UNITS,
+    GLYPH_HYBRID_MAX_RAW_CHARS,
+    GLYPH_HYBRID_NORMALIZATION_ID,
+    GLYPH_HYBRID_PROFILE_ID,
+    GlyphHybridPlanError,
+    HybridRenderPlan,
+    HybridSegmentSpec,
+    build_glyph_hybrid_plan,
+    glyph_hybrid_plan_sha256,
+    inverse_glyph_hybrid_plan,
+)
+from production import (
+    count_speech_units,
+    normalize_spoken_forms,
+    plan_generation_chunks,
+)
+
+
+def _asset_manifest(prefix: str = "test") -> dict[str, str]:
+    return {
+        symbol.asset_id: hashlib.sha256(
+            f"{prefix}:{symbol.asset_id}".encode("ascii")
+        ).hexdigest()
+        for symbol in GLYPH_ASCII_V1_SYMBOLS
+    }
+
+
+ASSET_MANIFEST = _asset_manifest()
+
+
+def _build(raw: str) -> HybridRenderPlan | None:
+    return build_glyph_hybrid_plan(
+        raw,
+        asset_entry_sha256_by_asset_id=ASSET_MANIFEST,
+    )
+
+
+def _require_plan(raw: str) -> HybridRenderPlan:
+    plan = _build(raw)
+    assert plan is not None
+    return plan
+
+
+def _inverse(
+    plan: HybridRenderPlan,
+    raw: str,
+    *,
+    manifest: dict[str, str] | None = None,
+) -> str:
+    return inverse_glyph_hybrid_plan(
+        plan,
+        asset_entry_sha256_by_asset_id=(
+            ASSET_MANIFEST if manifest is None else manifest
+        ),
+        expected_raw_request=raw,
+    )
+
+
+@pytest.mark.parametrize(
+    "raw",
+    (
+        "請寄mead@forest.org確認。",
+        "客服信箱owl@island.net，下載頁面http://forest.org/release。",
+        (
+            "第一個是owl@island.net，第二個網址"
+            "https://audiocoast.org/tour，完成。"
+        ),
+        (
+            "若要修改設定，請寄信到mead.voice@forest-mail.org，"
+            "或開啟https://audio-coast.org/release_notes。"
+        ),
+        "，mead@forest.org。",
+        "mead@forest.org",
+    ),
+)
+def test_valid_development_style_requests_have_exact_inverse_and_frozen_headers(raw):
+    plan = _require_plan(raw)
+
+    assert _inverse(plan, raw) == raw
+    assert plan.profile_id == GLYPH_HYBRID_PROFILE_ID
+    assert plan.normalization_id == GLYPH_HYBRID_NORMALIZATION_ID
+    assert plan.boundary_contract_id == GLYPH_HYBRID_BOUNDARY_ID
+    assert plan.raw_input_sha256 == hashlib.sha256(raw.encode("utf-8")).hexdigest()
+    assert plan.canonical_target_sha256 == hashlib.sha256(
+        plan.canonical_target.encode("utf-8")
+    ).hexdigest()
+    assert plan.plan_sha256 == glyph_hybrid_plan_sha256(plan)
+    assert plan.canonical_target == "".join(
+        segment.canonical_text for segment in plan.segments
+    )
+    assert plan.canonical_target == plan.canonical_target.strip()
+    assert "  " not in plan.canonical_target
+
+
+def test_multi_identifier_ranges_and_core_renderings_are_absolute_and_disjoint():
+    raw = (
+        "先寄owl@island.net，再看https://audiocoast.org/tour，"
+        "最後通知mead@forest.org。"
+    )
+    plan = _require_plan(raw)
+
+    assert len(plan.identifier_proofs) == 3
+    previous_raw_end = -1
+    previous_canonical_end = -1
+    for proof in plan.identifier_proofs:
+        assert previous_raw_end < proof.absolute_raw_start < proof.absolute_raw_end
+        assert (
+            previous_canonical_end
+            < proof.canonical_start
+            < proof.canonical_end
+        )
+        assert plan.canonical_target[
+            proof.canonical_start : proof.canonical_end
+        ] == " ".join(atom.canonical_token for atom in proof.atoms)
+        previous_raw_end = proof.absolute_raw_end
+        previous_canonical_end = proof.canonical_end
+
+    raw_coverage = "".join(
+        segment.raw_text
+        for segment in plan.segments
+        if segment.kind != "separator"
+    )
+    assert raw_coverage == raw
+    assert _inverse(plan, raw) == raw
+
+
+def test_boundary_contract_is_one_explicit_zero_audio_space_between_payloads():
+    raw = "開頭mead@forest.org，接著https://audiocoast.org/tour結束。"
+    plan = _require_plan(raw)
+    nonempty_payload_indices = [
+        index
+        for index, segment in enumerate(plan.segments)
+        if segment.kind != "separator" and segment.canonical_text
+    ]
+
+    assert len(nonempty_payload_indices) > 2
+    for left, right in zip(
+        nonempty_payload_indices,
+        nonempty_payload_indices[1:],
+    ):
+        assert right == left + 2
+        separator = plan.segments[left + 1]
+        assert separator.kind == "separator"
+        assert separator.audio_source == "zero_audio"
+        assert separator.raw_text == ""
+        assert separator.absolute_raw_start == separator.absolute_raw_end
+        assert separator.canonical_text == " "
+    assert all(
+        segment.canonical_text != " "
+        for segment in plan.segments
+        if segment.kind != "separator"
+    )
+
+
+def test_punctuation_only_carriers_are_controls_and_never_model_calls():
+    raw = "，mead@forest.org。"
+    plan = _require_plan(raw)
+    controls = [
+        segment for segment in plan.segments if segment.kind == "control"
+    ]
+
+    assert [segment.raw_text for segment in controls] == ["，", "。"]
+    assert all(segment.audio_source == "zero_audio" for segment in controls)
+    assert not any(segment.kind == "carrier" for segment in plan.segments)
+    assert plan.reservation.model_generated_chunks == 0
+    assert plan.reservation.model_generated_text_units == 0
+    assert _inverse(plan, raw) == raw
+
+
+def test_carrier_uses_existing_zh_tw_normalization_without_network_content():
+    raw = "版本v1.2.3，寄到mead@forest.org，日期是2026/07/18。"
+    plan = _require_plan(raw)
+    carriers = [
+        segment for segment in plan.segments if segment.kind == "carrier"
+    ]
+
+    assert [segment.canonical_text for segment in carriers] == [
+        normalize_spoken_forms(segment.raw_text, locale="zh-TW")
+        for segment in carriers
+    ]
+    assert all(count_speech_units(segment.canonical_text) > 0 for segment in carriers)
+    assert plan.reservation.model_generated_chunks == len(carriers)
+    assert plan.reservation.model_generated_text_units == sum(
+        count_speech_units(segment.canonical_text) for segment in carriers
+    )
+
+
+def _alpha(rng: random.Random, minimum: int = 1, maximum: int = 7) -> str:
+    return "".join(
+        rng.choice("abcdefghijklmnopqrstuvwxyz")
+        for _ in range(rng.randint(minimum, maximum))
+    )
+
+
+def _email(rng: random.Random) -> str:
+    local = _alpha(rng)
+    if rng.randrange(2):
+        local += rng.choice("._-") + _alpha(rng)
+    return f"{local}@{_alpha(rng)}.{_alpha(rng, 1, 3)}"
+
+
+def _url(rng: random.Random) -> str:
+    url = f"{rng.choice(('http', 'https'))}://{_alpha(rng)}.{_alpha(rng, 1, 3)}"
+    if rng.randrange(2):
+        url += "/" + _alpha(rng)
+    return url
+
+
+def test_seeded_property_valid_multi_identifier_requests_roundtrip_exactly():
+    rng = random.Random(0xB10E_5A11)
+    carriers = ("請聯絡", "，再查看", "，確認完成。")
+    for _ in range(300):
+        first = _email(rng)
+        second = _url(rng)
+        raw = f"{carriers[0]}{first}{carriers[1]}{second}{carriers[2]}"
+        plan = _require_plan(raw)
+
+        assert _inverse(plan, raw) == raw
+        assert len(plan.identifier_proofs) == 2
+        assert plan.reservation.identifiers == 2
+        assert plan.reservation.asset_atoms == len(first) + len(second)
+        assert plan.reservation.asset_audio_placeholder_samples == (
+            plan.reservation.asset_atoms
+            * GLYPH_HYBRID_ASSET_AUDIO_PLACEHOLDER_SAMPLES_PER_ATOM
+        )
+        assert plan.reservation.model_generated_chunks <= (
+            GLYPH_HYBRID_MAX_MODEL_GENERATED_CHUNKS
+        )
+        assert plan.reservation.model_generated_text_units <= (
+            GLYPH_HYBRID_MAX_MODEL_GENERATED_TEXT_UNITS
+        )
+
+
+@pytest.mark.parametrize(
+    "raw",
+    (
+        # Whitespace and ASCII punctuation are part of the maximal run; the
+        # planner may not strip them to rescue a substring.
+        "聯絡 mead@forest.org。",
+        "聯絡mead@forest.org ",
+        "聯絡mead@forest.org.",
+        "聯絡mead@forest.org,",
+        "聯絡mead@forest.org!",
+        "請看 https://forest.org/path。",
+        "請看:https://forest.org/path。",
+        # Native lowercase and strict path/domain grammar are mandatory.
+        "聯絡Mead@forest.org。",
+        "聯絡mead@Forest.org。",
+        "請看HTTP://forest.org/path。",
+        "請看https://forest.org/Path。",
+        "聯絡mead1@forest.org。",
+        "聯絡mead@forest2.org。",
+        "請看https://forest.org/path2。",
+        "請看https://forest.org/path?query。",
+        "請看https://forest.org/path#fragment。",
+        "請看https://forest.org:443/path。",
+        "請看https://user@forest.org/path。",
+        "請看https://user:pass@forest.org/path。",
+        "請看https://forest.org/。",
+        # Unicode/confusable/bidi/control data may not split a run and lend a
+        # valid-looking suffix to the strict renderer.
+        "聯絡méad@forest.org。",
+        "聯絡ｍead@forest.org。",
+        "聯絡mead@forest.org\u202e。",
+        "聯絡mead@forest.org\u2066。",
+        "聯絡mead@forest.org\x00。",
+        "聯絡mead@forest.org\n。",
+        "聯絡mead@forest.org\t。",
+        "聯絡梅@forest.org。",
+        "請看https://forest.org/路徑。",
+        # Other legacy network forms in a carrier make activation partial.
+        "聯絡mead@forest.org，備援www.forest.org。",
+        "聯絡mead@forest.org，備援ftp://forest.org/path。",
+    ),
+)
+def test_malformed_ambiguous_or_partially_eligible_requests_fail_closed(raw):
+    assert _build(raw) is None
+
+
+@pytest.mark.parametrize(
+    "raw",
+    (
+        (
+            "聯絡mead@forest.org，備援MEAD@forest.org。"
+        ),
+        (
+            "聯絡mead@forest.org，再看https://forest.org/path?query。"
+        ),
+        (
+            "先看https://forest.org/path，再寄mead1@forest.org。"
+        ),
+    ),
+)
+def test_one_invalid_network_run_rejects_the_entire_profile_without_partial_plan(raw):
+    assert _build(raw) is None
+
+
+@pytest.mark.parametrize(
+    "raw",
+    (
+        "",
+        "今天測試一般句子，保持原有規劃。",
+        "forest.org只是普通文字。",
+        "網址可能是WWW.FOREST.ORG但不啟用。",
+        "大寫HTTPS://FOREST.ORG不會被修正。",
+        "電子郵件這四個字不是地址。",
+    ),
+)
+def test_no_strict_network_run_never_activates_the_profile(raw):
+    assert _build(raw) is None
+
+
+def test_frozen_reservations_are_computed_before_any_runtime_work():
+    raw = "請寄mead@forest.org，再看https://audiocoast.org/tour。"
+    plan = _require_plan(raw)
+
+    assert plan.reservation.raw_chars == len(raw)
+    assert plan.reservation.identifiers == len(plan.identifier_proofs)
+    assert plan.reservation.asset_atoms == sum(
+        len(proof.atoms) for proof in plan.identifier_proofs
+    )
+    assert plan.reservation.asset_canonical_units == sum(
+        count_speech_units(atom.canonical_token)
+        for proof in plan.identifier_proofs
+        for atom in proof.atoms
+    )
+    assert plan.reservation.asset_atoms <= GLYPH_HYBRID_MAX_ASSET_ATOMS
+    assert (
+        plan.reservation.asset_canonical_units
+        <= GLYPH_HYBRID_MAX_ASSET_CANONICAL_UNITS
+    )
+
+
+def test_raw_identifier_count_atom_and_canonical_caps_fail_closed():
+    overlong = "前" * GLYPH_HYBRID_MAX_RAW_CHARS + "a@b.c"
+    too_many_identifiers = "，".join(
+        f"{chr(ord('a') + index)}@b.c"
+        for index in range(GLYPH_HYBRID_MAX_IDENTIFIERS + 1)
+    )
+    # 129 raw glyphs; each identifier itself remains under the core cap.
+    too_many_atoms = "a" * 125 + "@a.b"
+    assert len(too_many_atoms) == GLYPH_HYBRID_MAX_ASSET_ATOMS + 1
+    # 105 glyphs but >512 speech units because z -> "字母二十六".
+    too_many_canonical_units = "z" * 101 + "@a.b"
+    assert len(too_many_canonical_units) < GLYPH_HYBRID_MAX_ASSET_ATOMS
+
+    assert _build(overlong) is None
+    assert _build(too_many_identifiers) is None
+    assert _build(too_many_atoms) is None
+    assert _build(too_many_canonical_units) is None
+
+
+def _plan_with_segments(
+    plan: HybridRenderPlan,
+    segments: tuple[HybridSegmentSpec, ...] | list[HybridSegmentSpec],
+) -> HybridRenderPlan:
+    return replace(plan, segments=segments)  # type: ignore[arg-type]
+
+
+def test_segment_reorder_omit_duplicate_borrow_substitute_and_gap_are_rejected():
+    raw = "請寄mead@forest.org確認。"
+    plan = _require_plan(raw)
+    donor = _require_plan("請寄owl@island.net確認。")
+    segments = plan.segments
+    first_asset = next(
+        index for index, segment in enumerate(segments)
+        if segment.kind == "asset_atom"
+    )
+    donor_asset = next(
+        segment for segment in donor.segments
+        if segment.kind == "asset_atom"
+    )
+    substituted = list(segments)
+    substituted[first_asset] = replace(
+        segments[first_asset],
+        raw_text="z",
+        raw_sha256=hashlib.sha256(b"z").hexdigest(),
+    )
+    borrowed = list(segments)
+    borrowed[first_asset] = donor_asset
+    gapped = list(segments)
+    gapped[first_asset] = replace(
+        segments[first_asset],
+        absolute_raw_start=segments[first_asset].absolute_raw_start + 1,
+    )
+    overlapped = list(segments)
+    overlapped[first_asset] = replace(
+        segments[first_asset],
+        absolute_raw_start=segments[first_asset].absolute_raw_start - 1,
+    )
+
+    forged = (
+        _plan_with_segments(plan, (segments[1], segments[0], *segments[2:])),
+        _plan_with_segments(
+            plan,
+            (*segments[:first_asset], *segments[first_asset + 1 :]),
+        ),
+        _plan_with_segments(
+            plan,
+            (*segments[:first_asset], segments[first_asset], *segments[first_asset:]),
+        ),
+        _plan_with_segments(plan, tuple(borrowed)),
+        _plan_with_segments(plan, tuple(substituted)),
+        _plan_with_segments(plan, tuple(gapped)),
+        _plan_with_segments(plan, tuple(overlapped)),
+    )
+    for candidate in forged:
+        with pytest.raises(GlyphHybridPlanError):
+            _inverse(candidate, raw)
+
+
+@pytest.mark.parametrize(
+    "mutate",
+    (
+        lambda segment: replace(segment, ordinal=segment.ordinal + 1),
+        lambda segment: replace(segment, kind="carrier"),
+        lambda segment: replace(segment, audio_source="model"),
+        lambda segment: replace(
+            segment,
+            absolute_raw_end=segment.absolute_raw_end + 1,
+        ),
+        lambda segment: replace(
+            segment,
+            canonical_start=segment.canonical_start + 1,
+        ),
+        lambda segment: replace(
+            segment,
+            canonical_end=segment.canonical_end + 1,
+        ),
+        lambda segment: replace(segment, canonical_text="字母二十六"),
+        lambda segment: replace(segment, raw_sha256="0" * 64),
+        lambda segment: replace(segment, canonical_sha256="0" * 64),
+        lambda segment: replace(segment, identifier_ordinal=99),
+        lambda segment: replace(segment, atom_ordinal=99),
+        lambda segment: replace(segment, asset_id="glyph_ascii_v1_letter_z"),
+        lambda segment: replace(segment, manifest_entry_sha256="0" * 64),
+    ),
+)
+def test_asset_segment_field_provenance_tampering_is_rejected(mutate):
+    raw = "請寄mead@forest.org。"
+    plan = _require_plan(raw)
+    segments = list(plan.segments)
+    index = next(
+        index for index, segment in enumerate(segments)
+        if segment.kind == "asset_atom"
+    )
+    segments[index] = mutate(segments[index])
+
+    with pytest.raises(GlyphHybridPlanError):
+        _inverse(_plan_with_segments(plan, tuple(segments)), raw)
+
+
+def test_identifier_atom_and_whole_proof_tampering_is_rejected():
+    raw = "請寄mead@forest.org。"
+    plan = _require_plan(raw)
+    proof = plan.identifier_proofs[0]
+    atoms = list(proof.atoms)
+    atom: GlyphAsciiV1AtomProof = atoms[0]
+    atoms[0] = replace(atom, raw_byte=ord("z"))
+    forged_proof: GlyphAsciiV1Proof = replace(proof, atoms=tuple(atoms))
+    forged = replace(plan, identifier_proofs=(forged_proof,))
+
+    with pytest.raises(GlyphHybridPlanError):
+        _inverse(forged, raw)
+
+
+@pytest.mark.parametrize(
+    "mutate",
+    (
+        lambda plan: replace(plan, profile_id="glyph_hybrid_request_v2"),
+        lambda plan: replace(plan, grammar_id="glyph_ascii_v2"),
+        lambda plan: replace(plan, normalization_id="different"),
+        lambda plan: replace(plan, boundary_contract_id="different"),
+        lambda plan: replace(plan, raw_input_sha256="0" * 64),
+        lambda plan: replace(plan, canonical_target=plan.canonical_target + "X"),
+        lambda plan: replace(plan, canonical_target_sha256="0" * 64),
+        lambda plan: replace(plan, asset_manifest_logical_sha256="0" * 64),
+        lambda plan: replace(plan, plan_sha256="0" * 64),
+        lambda plan: replace(
+            plan,
+            reservation=replace(plan.reservation, asset_atoms=0),
+        ),
+        lambda plan: replace(plan, segments=list(plan.segments)),
+        lambda plan: replace(plan, identifier_proofs=list(plan.identifier_proofs)),
+    ),
+)
+def test_header_hash_type_and_reservation_tampering_is_rejected(mutate):
+    raw = "請寄mead@forest.org。"
+    plan = _require_plan(raw)
+    with pytest.raises(GlyphHybridPlanError):
+        _inverse(mutate(plan), raw)
+
+
+def test_external_raw_request_commitment_rejects_a_different_valid_whole_plan():
+    raw = "請寄mead@forest.org。"
+    other_raw = "請寄owl@island.net。"
+    other_plan = _require_plan(other_raw)
+
+    with pytest.raises(GlyphHybridPlanError):
+        _inverse(other_plan, raw)
+
+
+def test_fresh_rehash_cannot_make_a_changed_reservation_the_expected_plan():
+    raw = "請寄mead@forest.org。"
+    plan = _require_plan(raw)
+    forged = replace(
+        plan,
+        reservation=replace(
+            plan.reservation,
+            model_generated_text_units=(
+                plan.reservation.model_generated_text_units + 1
+            ),
+        ),
+        plan_sha256="",
+    )
+    forged = replace(
+        forged,
+        plan_sha256=glyph_hybrid_plan_sha256(forged),
+    )
+
+    with pytest.raises(GlyphHybridPlanError, match="unique expected plan"):
+        _inverse(forged, raw)
+
+
+def test_manifest_substitution_and_invalid_manifest_configuration_are_rejected():
+    raw = "請寄mead@forest.org。"
+    plan = _require_plan(raw)
+    changed = dict(ASSET_MANIFEST)
+    changed[next(iter(changed))] = hashlib.sha256(b"changed").hexdigest()
+    missing = dict(ASSET_MANIFEST)
+    missing.pop(next(iter(missing)))
+
+    with pytest.raises(GlyphHybridPlanError):
+        _inverse(plan, raw, manifest=changed)
+    with pytest.raises(GlyphHybridPlanError):
+        build_glyph_hybrid_plan(
+            raw,
+            asset_entry_sha256_by_asset_id=missing,
+        )
+
+
+def test_non_string_inputs_and_plan_subclasses_are_rejected():
+    class ForgedPlan(HybridRenderPlan):
+        pass
+
+    raw = "請寄mead@forest.org。"
+    plan = _require_plan(raw)
+    forged = ForgedPlan(**plan.__dict__)
+
+    with pytest.raises(GlyphHybridPlanError):
+        build_glyph_hybrid_plan(  # type: ignore[arg-type]
+            b"mead@forest.org",
+            asset_entry_sha256_by_asset_id=ASSET_MANIFEST,
+        )
+    with pytest.raises(GlyphHybridPlanError):
+        _inverse(forged, raw)
+    with pytest.raises(GlyphHybridPlanError):
+        inverse_glyph_hybrid_plan(
+            plan,
+            asset_entry_sha256_by_asset_id=ASSET_MANIFEST,
+            expected_raw_request=b"mead@forest.org",  # type: ignore[arg-type]
+        )
+
+
+def test_no_network_legacy_normalization_and_plan_remain_byte_for_byte_frozen():
+    samples = (
+        "今天測試一般句子，保持原有規劃。",
+        "日期是2026/07/18，數值為12.5%。",
+        "型號RTX 5090將沿用舊前端。",
+    )
+    output = []
+    for raw in samples:
+        assert _build(raw) is None
+        normalized = normalize_spoken_forms(raw, locale="zh-TW")
+        output.append(
+            {
+                "raw": raw,
+                "normalized": normalized,
+                "plan": [
+                    asdict(spec)
+                    for spec in plan_generation_chunks(raw, normalized)
+                ],
+            }
+        )
+    serialized = json.dumps(
+        output,
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+
+    assert len(serialized) == 1_128
+    assert hashlib.sha256(serialized).hexdigest() == (
+        "d4986f95a0912bc76332a8f0215a22b0359c1fe8ed90733bea99df39535d1759"
+    )