After an extensive search and to the Author's knowledge this is the first operational, falsifiable protocol for device-independent certification of Hilbert subspace containment code[[5,1,3]], specifying on-plateau gating, preregistered cuts, and cross-platform margins. This guide wraps a device-independent (DI) subspace test in an Operational Containment Layer (OCL): a plateau-gated hygiene window with engage/disengage cuts at . Inside that window, a Falsifier-Wrapped DI (FW-DI) procedure requires four preregistered falsifiers—flip-only , disable-, co-flip, and monotone-to-plateau—plus an orthogonal rank/phase cross-check to suppress single-driver spoofs. Every claim reports two margins: the DI violation margin and the corrected containment margin . The protocol is bench-ready and platform-agnostic: it provides a one-page run card, numeric thresholds, and a model-selection workflow (“table of four”) to scan candidate slices while holding the same hygiene. In effect, it moves the field from “is this state entangled?” to “are we in the right logical Hilbert room—and performing the intended logical action—under falsifiable, portable conditions?”