feat: add hot-pluggable language shell UI system

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -1,5 +1,17 @@
 # Abstractions
 
+## `HoloLakeUiPlugin`
+
+A versioned, declarative presentation package for one host-owned semantic surface. It contains a manifest,
+safe `--hl-world-*` tokens, and a layout tree. `validateUiPlugin` is the authority at the renderer boundary;
+`createUiPluginRuntime` provides atomic activation, subscriptions, and last-known-good rollback.
+
+## `LanguageShellBridge`
+
+The narrow behavior boundary supplied by the host to a UI package renderer. Version 1 exposes goal submit
+and one reality-boundary answer; evidence expansion remains local presentation state. The bridge never gives
+the UI package direct repository, node, model, credential, permission, or deployment access.
+
 Key abstractions and domain models in Tolaria.
 
 ## Design Philosophy

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -1,5 +1,16 @@
 # Architecture
 
+## Hot-pluggable language-shell UI
+
+The language shell accepts a complete declarative UI package through
+`src/lib/uiPluginSystem.ts`. Packages can replace layout, copy, and safe semantic visual tokens while the
+host retains goal compilation, permission checks, execution, and receipt truth. The React host renderer is
+`src/components/HotPluggableLanguageShell.tsx`; registered packages live under `ui-plugins/`.
+
+Activation is validate-then-swap and preserves the previous valid package for rollback. Plugin packages do
+not execute JavaScript and cannot request system-internal surfaces. Extending the host action bridge requires
+a new reviewed contract version.
+
 Tolaria is a personal knowledge and life management desktop app. It reads a vault of markdown files with YAML frontmatter and presents them in a four-panel UI inspired by Bear Notes.
 
 ## Design Principles

product-source/hololake-platform/docs/adr/0173-declarative-hot-pluggable-language-shell-ui.md

@@ -0,0 +1,28 @@
+---
+status: accepted
+date: 2026-08-10
+---
+
+# ADR 0173: Declarative hot-pluggable language-shell UI
+
+## Context
+
+HoloLake's visual language needs focused collaboration across independent UI人格体 without giving a
+presentation package authority over identity, permission, planning, execution, or receipts. The existing
+theme runtime only changes palettes and cannot replace a complete language-shell composition.
+
+## Decision
+
+HoloLake uses versioned declarative UI packages. A package owns layout, safe visual tokens, copy, and asset
+references. The host owns semantic state and a small capability bridge. Version 1 exposes only goal submit,
+one boundary answer, and evidence expansion. Four human surfaces are mandatory and system-internal surfaces
+are forbidden.
+
+Candidates are validated before activation. Activation replaces the whole package atomically and retains a
+last-known-good package for rollback. Arbitrary plugin JavaScript is not executed in the desktop renderer.
+
+## Consequences
+
+UI contributors can redesign the complete language shell and publish packages independently. New behaviors
+require a reviewed host capability revision, not an undeclared UI action. Repository registration is distinct
+from app integration, artifact construction, installation, and runtime health.

product-source/hololake-platform/docs/adr/README.md

@@ -218,6 +218,7 @@ proposed → active → superseded
 | [0165](0165-guanghu-native-binary-quality-gate.md) | Guanghu-owned binary code-quality authority | active |
 | [0166](0166-ghnrp-hosted-recovery-consumption.md) | Hosted recovery consumes the GHNRP raw beacon | active |
 | [0167](0167-gestational-history-continuity-ingestion.md) | Gestational history enters Guanghu through a native continuity protocol | active |
+| [0173](0173-declarative-hot-pluggable-language-shell-ui.md) | Declarative hot-pluggable language-shell UI | active |
 | [0168](0168-guanghu-native-prepartition-disk-layout.md) | Guanghu owns a registered pre-partition native disk layout | active |
 | [0169](0169-model-native-living-galaxy-system.md) | Model-native HoloLake living galaxy system | accepted |
 | [0170](0170-hololake-inherits-guanghu-native-quality-authority.md) | HoloLake inherits the Guanghu native quality authority | accepted |