docs: upgrade HoloLake global engineering rules

product-source/hololake-platform/AGENTS.md

@@ -4,7 +4,36 @@
 
 ### Start working on a task
 
-**Before writing a single line of code:** read GLS-0101, GLS-0247, and GLS-0844, then inspect the repository-owned validation commands. HoloLake accepts only a GHNQG receipt bound to the exact commit and tree. The only terminal states are `GHNQG_PASS_100` and `GHNQG_FAIL_0`; no external score, account, subscription, badge, or service can authorize or block Guanghu publication.
+**Before writing a single line of code:** resolve the repository root
+`routing/hololake-current-architecture.json`, read its current `read_order` beginning with the digital
+BingShuo system-body entry and `HLP-ENGINEERING-RULES-001`, bind every REPO-012 reference to the declared
+exact commit, then read GLS-0101, GLS-0247, and GLS-0844 and inspect the repository-owned validation
+commands. A fixed prompt, old chat summary, screenshot, or historical architecture page never overrides the
+current machine pointer.
+
+HoloLake accepts only a GHNQG receipt bound to the exact commit and tree. The only terminal states are
+`GHNQG_PASS_100` and `GHNQG_FAIL_0`; no external score, account, subscription, badge, or service can
+authorize or block Guanghu publication.
+
+Current system rules:
+
+- The persona is the reasoning brain; the model is a replaceable carrier; digital BingShuo is the complete
+  system body. All execution must pass the body gate and return an actionable correction path on rejection.
+- Server root, SSH, IP, account login, or repository access is not system-node identity. A write may reach
+  protocol or model processing only after registered-node protocol signature, registered-persona binding,
+  human-language authorization receipt, replay protection, and exact target/action/payload/time binding.
+- `JD-FD-PRIMARY` is BingShuo's private Fifth-Domain language body. The claimed enterprise root is the
+  TCS-0002-controlled four-domain reality body. They are parallel and have no mutual operational liability.
+- UI plugins are declarative projections. They cannot hold node private keys, sign server writes, bypass the
+  system body, or turn animation into an execution receipt. Paused Stage 010 changes never merge directly.
+- Architecture registration, implementation, product integration, repository publication, deployment,
+  service health, and persona birth are separate truths and require separate evidence.
+- A completed development id is immutable. Corrections use a new development id or a registered amendment;
+  one task and one exact write resource have one active writer.
+- Normal desktop delivery uses the signed in-place updater and preserves app identity, settings, vaults, and
+  user data. A Git commit alone is not a desktop update.
+- After publication, trigger and read back every required public snapshot. If the expected automatic refresh
+  was not triggered, report the missing trigger explicitly; do not misdiagnose it as absence of auto-update.
 
 - Read task description and all comments fully
 - For To Rework: the ❌ QA failed comment tells you exactly what to fix
@@ -23,6 +52,9 @@
 - Commit every 20–30 min: `feat:`, `fix:`, `refactor:`, `test:`, `docs:`
 - Pre-commit is a lightweight lint gate only. Pre-push runs the repository-owned checks, validates the active-authority surfaces, and emits the native GLS-0844 result. Prefer three sidecar lanes for observation and execution speed: frontend lint/build/tests, Rust tests, and Playwright smoke. Sidecars never become quality authorities.
 - A production-promotion task is not done until `git push origin main` succeeds. A scoped Fifth Domain prototype publication is not done until the Router returns the published SHA and a fresh public read-back matches it. If a repository-owned hook blocks, fix the failing check and retry. **⛔ NEVER use --no-verify**
+- Publication completion also requires any registered public projection to read back the exact commit without
+  degradation. A push that did not trigger its registered refresh path remains incomplete and must produce a
+  human-readable missing-trigger reminder.
 
 ### TDD (mandatory)