feat: add remote-first education work lake

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -172,6 +172,16 @@ interface VaultEntry {
 }
 ```
 
+### Industry work lake
+
+An industry work lake is a client-rendered collection of registered capabilities rather than a new vault type. The stage-one education channel uses:
+
+- `EducationInstructionRoute` to map one bounded language instruction to one surface and module id.
+- `EducationWorkLake` to hold application-scoped document and spreadsheet state and project chart/dashboard views.
+- `engineering/MODULE-REGISTRY.json` as the stable lookup from module id to real source path, provenance, license state, and execution boundary.
+
+Opening a surface proves only that the client routed and rendered it. It does not prove server persistence, multi-user collaboration, deployment health, or persona birth.
+
 ### WorkspaceIdentity
 
 Mounted workspace provenance is renderer-owned metadata attached to `VaultEntry.workspace` when entries are loaded through the registered workspace set. It is not parsed from note frontmatter and is not written into vault files.

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -157,7 +157,7 @@ Editor responsiveness is also protected by a synthetic browser benchmark. `pnpm
 | Backend language | Rust (edition 2021) | 1.77.2 |
 | Frontmatter parsing | gray_matter | 0.2 |
 | Filesystem watcher | notify | 6.1 |
-| AI (workspace) | CLI agent adapters (Claude Code + Codex + GitHub Copilot + OpenCode + Pi + Antigravity + Kiro + Hermes Agent) plus configured local/API model targets | - |
+| AI (workspace) | Product-visible CLI adapters (Claude Code + Codex + GitHub Copilot) plus configured local/API model targets | - |
 | Search | Keyword (walkdir-based file scan) | - |
 | Localization | App-owned runtime + JSON catalogs (`src/lib/i18n.ts`, `src/lib/locales/*.json`, `lara.yaml`) | English fallback + Lara CLI sync |
 | MCP | @modelcontextprotocol/sdk | 1.0 |
@@ -183,6 +183,8 @@ flowchart TD
 
 `HoloLakeHome` owns only transient navigation state. It does not persist system ownership, server addresses, or credentials. Its navigation and native-module entries now pass through the versioned living-system contract in `guanghuLivingSystem.ts`. Each event binds one exact allowlisted intent; the host invokes Knowledge Lake, Agent workspace, or local-folder callbacks only after the returned event id, intent, route, truth references, authorization state, and declarative scene all validate. Theme selection remains a human decision and emits only a bounded scene-adaptation intent. The native desktop first requests a receipt-backed plan from the BS-SH-005 lighthouse through a loopback-only HLDP tunnel; when that tunnel is absent the native command restores the exact registered SSH forward before retrying once. The DeepSeek credential never leaves the server. A configured direct model is the secondary planner, and the deterministic recovery plan is the final availability path. Invalid, unavailable, or late model output produces an explicitly tagged recovery plan rather than an invented success. The canvas consumes only validated motion, star-density, depth, and connection-emphasis primitives; the model never draws pixels or runs per animation frame. The existing vault remains the filesystem source of truth. From 0.1.7 onward, channel mode owns the full application body; entering Knowledge Lake reveals the sidebar and note list as navigation inside that module while a Guanghu module dock remains present. In 0.1.8, `JD-FD-PRIMARY` resolves the public Fifth Domain discovery document without credentials and validates its read-only Guanghu routes. That result proves only public navigation availability; the UI continues to withhold private server-health claims until an authenticated probe exists. See [ADR 0154](adr/0154-channel-owned-workspace-shell.md), [ADR 0155](adr/0155-fifth-domain-read-only-discovery-and-ai-tool-boundary.md), and [ADR 0169](adr/0169-model-native-living-galaxy-system.md).
 
+The education work lake is the first remote-first industry channel. `EducationWorkLake` routes a bounded language instruction to one registered capability, opens a client-rendered surface, and exposes the capability and execution receipt. Its editable document and IronCalc spreadsheet remain inside the application boundary; chart and dashboard views are projections of the current sheet. The HoloLake world entry bypasses local-vault onboarding while the existing local knowledge lake remains available as an optional module. See [ADR 0173](adr/0173-remote-first-industry-work-lakes.md).
+
 ```mermaid
 flowchart TD
     subgraph TW["Tauri v2 Window"]

product-source/hololake-platform/docs/adr/0173-remote-first-industry-work-lakes.md

@@ -0,0 +1,27 @@
+---
+type: ADR
+id: "0173"
+title: "Remote-first industry work lakes use registered client-rendered modules"
+status: active
+date: 2026-08-07
+---
+
+## Context
+
+The inherited Tolaria entry assumes that a local filesystem vault must exist before any useful surface can open. HoloLake needs a different product boundary: Git repositories hold reusable, numbered components; a persona routes human language to those components; the resulting document, spreadsheet, chart, dashboard, or knowledge surface renders on the user's device. An industry workspace may be temporarily hosted on `JD-FD-PRIMARY` and later moved without changing its capability identifiers.
+
+## Decision
+
+Industry work lakes are remote-first application channels above the optional local vault.
+
+- The HoloLake world entry is available without creating, choosing, or repairing a local vault.
+- Every callable surface has a stable module id in `engineering/MODULE-REGISTRY.json`.
+- Language routing selects a registered capability and emits a receipt; it does not treat model text as proof of execution.
+- Stage-one document and spreadsheet state remains inside the application/browser boundary.
+- Server hosting and client rendering are separate: the temporary server serves the application, while user-facing editing and projection execute on the client.
+- The first education work lake mounts document, spreadsheet, comparison-chart, dashboard, and knowledge surfaces. Remote multi-user persistence is a later capability and must have its own authorization and receipt contract.
+- Grok Build remains an isolated research source for agent-runtime patterns. Its runtime is not merged into a persona subject.
+
+## Consequences
+
+The obsolete local-vault chooser no longer blocks the HoloLake entry. Existing vault features remain available as one optional knowledge module. Industry migration becomes a deployment-route change rather than a data-model rewrite. Collaborative persistence, domestic model providers, and production whiteboards remain explicit follow-up modules instead of hidden claims in stage one.