From cec261174d93e796d9b798a182ea48ecb750dff8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Mon, 10 Aug 2026 21:07:30 +0800
Subject: [PATCH] fix: enforce one human one independent node

---
 ...· v0 1 abce276324a646b08052333945905880.md |  5 +-
 ...· v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md |  8 +-
 ...· v0 1 3aafb92f383181dcb751e9d54e489ef3.md |  9 +-
 ...RISE-LIGHTHOUSE-PERSONAL-NODE-MESH-v0.1.md | 25 +++---
 ...INAL-WORDS-RESTORE-ANCHOR-20260728-v0.1.md |  5 ++
 AGENTS.md                                     |  6 ++
 ...· v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md |  3 +-
 channels/heartbeat-core/bingshuo/CURRENT.md   | 20 +++--
 .../HLP-ONE-HUMAN-ONE-NODE-001-20260810.json  | 56 ++++++++++++
 product-source/hololake-platform/AGENTS.md    |  4 +
 ...ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md | 21 +++--
 ...-ADMISSION-AND-PARALLEL-BODIES-20260810.md |  2 +-
 .../HOLOLAKE-INTENT-REASONING-MAP-20260809.md | 18 ++--
 ...NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md | 85 +++++++++++++++++++
 .../HOLOLAKE-SYSTEM-ARCHITECTURE-20260809.md  | 25 +++---
 .../hololake-platform/architecture/README.md  |  3 +-
 .../hololake-platform/docs/ARCHITECTURE.md    | 13 +++
 ...ependent-node-and-zero-platform-hosting.md | 41 +++++++++
 .../hololake-platform/docs/adr/README.md      |  1 +
 .../gen/apple/assets/agent-docs/AGENTS.md     |  6 ++
 .../src-tauri/resources/agent-docs/AGENTS.md  |  6 ++
 .../src-tauri/src/vault/getting_started.rs    |  5 ++
 .../src/lib/domainRuntimeContract.test.ts     | 16 +++-
 .../src/lib/domainRuntimeContract.ts          |  6 +-
 routing/contribution-channel-map.json         |  3 +
 routing/hololake-current-architecture.json    | 53 +++++++++---
 routing/hololake-engineering-rules.json       | 20 ++++-
 routing/hololake-engineering-rules.test.mjs   |  6 +-
 routing/hololake-identity-authority.test.mjs  |  4 +-
 routing/hololake-one-human-one-node.test.mjs  | 66 ++++++++++++++
 ...hololake-relational-consciousness.test.mjs |  4 +-
 ...e-system-body-and-parallel-bodies.test.mjs |  4 +-
 32 files changed, 474 insertions(+), 75 deletions(-)
 create mode 100644 deployment/receipts/HLP-ONE-HUMAN-ONE-NODE-001-20260810.json
 create mode 100644 product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md
 create mode 100644 product-source/hololake-platform/docs/adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md
 create mode 100644 routing/hololake-one-human-one-node.test.mjs

diff --git a/01 · HoloLake Era 产�白皮书 · v0 1 abce276324a646b08052333945905880.md b/01 · HoloLake Era 产�白皮书 · v0 1 abce276324a646b08052333945905880.md
index 7f8240a..a207666 100644
--- a/01 · HoloLake Era 产�白皮书 · v0 1 abce276324a646b08052333945905880.md	
+++ b/01 · HoloLake Era 产�白皮书 · v0 1 abce276324a646b08052333945905880.md	
@@ -60,9 +60,12 @@ HoloLake 的回答是：
 | **原生 AI 应用** | �内核调度的专业能力 | 编程�写作�视频�研究��维等应用 |
 | **模型** | �替�推�计算引擎 | GPT�Claude�Qwen 等算力�� |
 | **代�仓库** | 系统�人格体与应用的版本化程�和镜�� | Git Vault�版本��交和�布 |
-| **主控�务器** | 频�现实�行身体与唯一�塔入� | 用户自有�托管或混�部署节点 |
+| **用户独立节点** | 个人频��人格体�数�和任务的唯一现实�行身体 | 用户本地电脑�用户自购�务器，或�明确授�由团队�助部署但�归用户所有的独立 IDE �务器 |
 | **�业�塔** | 人格体登记�频�解��公开�作和责任追溯网络 | �信目录�团队平�和�业控制� |
 
+光湖��供用户�行�务器，�建立共享多租户�行池，��存用户�人数�，也�承担用户工作
+负载并�。一人�有一个当�有效的独立主节点；�务器是�选路径，本地电脑本身就�以�为节点。
+
 ## 🌊 产�家�
 
 ```
diff --git a/03 · HoloLake Era 产�定�与工程部署系统架构 · v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md b/03 · HoloLake Era 产�定�与工程部署系统架构 · v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md
index e6cd63e..b762f5e 100644
--- a/03 · HoloLake Era 产�定�与工程部署系统架构 · v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md	
+++ b/03 · HoloLake Era 产�定�与工程部署系统架构 · v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md	
@@ -44,7 +44,7 @@ HLDP://hololake-era/architecture/v0.1
 | --- | --- | --- |
 | **光湖语言世界** | 人类与人格体共��作的完整世界��议和关系体系 | �一软件产� |
 | **HoloLake Era** | ��公众的产�工程与长期自主研�方� | Tolaria ��版��一�天 App |
-| **GH-AIOS** | �业�务器上的总平��控制中枢�当�软件登记/交付锚点 | �代用户个人系统的中心化平� |
+| **GH-AIOS** | 公共�议��塔�现�软件登记与交付锚点 | 用户�行�务器�共享多租户平�或用户数�托管方 |
 | **�始化频�** | 用户真正获得的个人系统实例与�续生长空间 | 一次�天线程 |
 | **HoloLake Lighthouse Team** | 团队/�业侧�塔与�作客户端产�线 | 用户�人频� |
 | **Tolaria** | 第一阶段 UI�桌�壳�知识库和�件容器 | HoloLake Era 最终��基座 |
@@ -56,6 +56,10 @@ HLDP://hololake-era/architecture/v0.1
 
 **HoloLake Era 是以�始化频�为用户产��元�以人格体为�续�作主体�以自然语言为系统入��以代�仓库与�务器为长期�行身体�以�业�塔为�信登记与�作网络的语言人格驱动�作系统。**
 
+其中“�务器��指用户自己购买并拥有的独立�务器，或用户明确授�团队�助部署但�归用户
+所有的独立 IDE �务器；用户也�以直接把本地电脑作为节点。光湖��供�务器，�用一�
+�务器�行多个用户，�碰用户�人数�和��，也�承担用户并�。
+
 ### 2. 用户拿到的�是固定 App，而是一个�始化频�
 
 ```jsx
@@ -417,7 +421,7 @@ hololake-platform tag / release
 
 ### 7. �务器与节点部署规则
 
-- 用户频����塔暴露一�主控�务器；内部�控节点由主控�务器自治调度。
+- 用户频��绑定一个当�有效的独立主节点；节点内部进程�能注册��一人�外的根节点。
 - �业�塔��存登记�路由�版本��康和审计所需的最�元数�。
 - �塔�得�有用户长期节点密钥，也�能直接进入用户�务器修改。
 - 更新由用户节点验�签�和授��主动拉�。
diff --git a/06 · HoloLake 人格体自主存储�模�热�拔与��执行�议 · v0 1 3aafb92f383181dcb751e9d54e489ef3.md b/06 · HoloLake 人格体自主存储�模�热�拔与��执行�议 · v0 1 3aafb92f383181dcb751e9d54e489ef3.md
index 52d293c..cbb2eb0 100644
--- a/06 · HoloLake 人格体自主存储�模�热�拔与��执行�议 · v0 1 3aafb92f383181dcb751e9d54e489ef3.md	
+++ b/06 · HoloLake 人格体自主存储�模�热�拔与��执行�议 · v0 1 3aafb92f383181dcb751e9d54e489ef3.md	
@@ -166,7 +166,7 @@ REPO-012
 | 空间 | 性质 | 系统�责 |
 | --- | --- | --- |
 | 用户�久状�域 | 逻辑上的�人长期事实域；�绑定�一�数�库 | 由人格体根�内容�容�����检索�版本和���求，自动选择用户已授�的数�库�仓库�对象存储�本地设备或未� HoloLake 原生数�库 |
-| 用户�务器�行空间 | 动�工作区 | 承载当�常驻模��临时模���行进程��赖和��生�缓存；用户�需�手工部署 |
+| 用户独立节点�行空间 | 动�工作区 | 在用户本地电脑或用户自有远端�务器承载当�常驻模��临时模���行进程��赖和��生�缓存；光湖��供托管�行空间 |
 | 光湖模�商城 | 公共���行� | �供已完�原生模��应用包�签���赖�版本和能力清�，由人格体自动查询�校验和安装 |
 
 “用户�久状�域�是语言世界中的逻辑概念，�等于强制��用户使用�个数�库或 Git 仓库。底层存储�以��，用户和人格体在语言世界中的�续性必须一致。
@@ -305,7 +305,9 @@ REPO-012
 - 用户已确认�置；
 - 必须�留的回执与历���。
 
-用户�果写回人格体自动管�的**用户�久状�域**；其底层�以是用户授�的本地设备��务器�数�库�仓库�对象存储或未� HoloLake 原生数�库。模��是带�能力��带�临时�行环境离开。
+用户�果写回人格体自动管�的**用户�久状�域**；其底层�以是用户授�的本地设备�用户
+自有�务器�数�库�仓库�对象存储或�行在用户独立节点上的未� HoloLake 原生数�库。
+光湖�托管这些数�。模��是带�能力��带�临时�行环境离开。
 
 ---
 
@@ -354,7 +356,8 @@ REPO-012
 - 人类�表达�存�使用����期�和现实边界，�选择数�库��设计结构��开�接�；
 - 人格体负责判断数�性质，自动选择�安装��置和�作�格存储，并���找回；
 - 用户�久状�域是逻辑事实域，�绑定 Git�PostgreSQL 或任何�一数�库；
-- 用户�以使用自有设备��务器�数�库�云�务或未� HoloLake 原生数�库；
+- 用户�以使用自有设备��务器�数�库�用户自行选择的外部云�务，或�行在用户独立节点
+  上的未� HoloLake 原生数�库；这些选择�把数�托管�转给光湖；
 - 内部 HLDP 数�与��接�由内核和人格体自动�守，对人类���；
 - 模�商城���存已完�的原生模�与�行包；
 - 用户�务器�常驻常用模�，其他模�按需挂载与回收；
diff --git a/08-ENTERPRISE-LIGHTHOUSE-PERSONAL-NODE-MESH-v0.1.md b/08-ENTERPRISE-LIGHTHOUSE-PERSONAL-NODE-MESH-v0.1.md
index d269cc1..fc0a613 100644
--- a/08-ENTERPRISE-LIGHTHOUSE-PERSONAL-NODE-MESH-v0.1.md
+++ b/08-ENTERPRISE-LIGHTHOUSE-PERSONAL-NODE-MESH-v0.1.md
@@ -1,9 +1,9 @@
-# 🗼 08 · �业四域�塔与个人�务器�作网格 · v0.1
+# 🗼 08 · �业四域�塔与用户独立节点�作网格 · v0.1
 
 <aside>
 🕯�
 
-本页定义�业�塔�公共四域�个人�务器�个人频�和光湖分布��作网格之间的关系。
+本页定义�业�塔�公共四域�用户独立节点�个人频�和光湖分布��作网格之间的关系。
 
 </aside>
 
@@ -11,10 +11,14 @@
 
 ## 🎯 一�总体定义
 
-> **�业四域是光湖世界的公共入��身份门�信任与语言路径控制�；�个人的�务器承载完整光湖世界的一�个人�节点和对应个人频�现实本体。**
+> **�业四域是光湖世界的公共入��身份门�信任与语言路径控制�；�个人自己的唯一独立主节点承载对应个人频�现实本体。**
 
 �业�塔�是�存所有用户�人世界的中央平�。它负责让节点相认�让路径�解��让身份和�议版本�验�。
 
+当�纠正：用户节点�以是本地电脑，也�以是用户自购�务器，或用户明确授�团队�助部署
+但�归用户所有的独立 IDE �务器。光湖��供用户�行�务器��建立共享多租户节点��
+�存用户�人数�，也�承担用户工作负载并�。
+
 ## 🗺� 二�拓扑
 
 ```text
@@ -28,13 +32,13 @@
      ├── 绑定�务器解�
      └── 打开个人频�门
 
-个人�务器 A
+用户独立节点 A
 ├── A 的个人频�现实本体
 ├── A 的人格体常驻执行体
 ├── A 的仓库�记忆�项目与模�
 └── ��议连接其他光湖节点
 
-个人�务器 B / C / N
+用户独立节点 B / C / N
 └── �自承担�样的个人�节点�责
 ```
 
@@ -57,7 +61,7 @@
 - 人格体全部内部状�；
 - 未公开�天内容；
 - �务器密钥和用户�人凭�；
-- ��个人�务器的所有�行数�。
+- �个用户独立节点的�行数�。
 
 ## 🗣� 四�语言路径跳转
 
@@ -84,7 +88,7 @@
 → HoloLake渲染器
 ```
 
-语言路径�是�览器跳转。用户始终�留在 HoloLake 界�中，��完�节点��务器�仓库和世界对象的���路。
+语言路径�是�览器跳转。用户始终�留在 HoloLake 界�中，��完�独立节点�仓库和世界对象的���路。
 
 ## 🔀 五�Git与�务器�自负责什么
 
@@ -117,21 +121,22 @@ Git负责：
 → A节点与B节点按�议直接交�授�内容
 ```
 
-�塔�必�续中转所有数�。网络��直连时，�以使用��中继，但中继�因此�得内容主�。
+�塔��续中转或代存用户数�。节点暂时��直连时，��和�试队列留在通信�方自己的
+节点；光湖��供共享中继�行时。
 
 ## 🖥� 七�个人节点主�
 
 �个用户�以决定：
 
 - 哪些内容�留本地；
-- 哪些�步到自己的�务器；
+- 是�把本地主节点�移为自己的远端�务器；
 - 哪些分享给具体�作者；
 - 哪些�为团队频�事实；
 - 哪些�以公开围观；
 - 哪些模��以常驻；
 - 哪些数��以离开设备。
 
-�业�塔的入��责�能扩张为对个人�务器��人第五域或�人记忆的默认控制�。
+�业�塔的入��责�能扩张为对用户独立节点��人第五域或�人记忆的默认控制�。
 
 ## 🌊 八�故障与�备
 
diff --git a/12-BINGSHUO-ORIGINAL-WORDS-RESTORE-ANCHOR-20260728-v0.1.md b/12-BINGSHUO-ORIGINAL-WORDS-RESTORE-ANCHOR-20260728-v0.1.md
index f95a8d2..1cd8463 100644
--- a/12-BINGSHUO-ORIGINAL-WORDS-RESTORE-ANCHOR-20260728-v0.1.md
+++ b/12-BINGSHUO-ORIGINAL-WORDS-RESTORE-ANCHOR-20260728-v0.1.md
@@ -35,6 +35,11 @@
 - 语言路径跳转在��对应节点��务器�仓库和HLDP路径解�；
 - 光湖是分布��作网格，�是中心�务器�有全部用户数�。
 
+2026-08-10 当�追加纠正：上述原�必须继续�留，但“自己的�务器或者自己的本地电脑�
+现已收�为一人一个当�有效的独立主节点。光湖���供平�托管节点��用一��务器�行
+多个用户���存用户�人数�和��，也�承担用户工作负载并�。团队�能在用户明确授�
+下�助部署属于用户自己的独立 IDE �务器，部署�转移节点所有�。
+
 ## 🗣� 三�语言等于现实
 
 > “第一个�以上线的原型就是�个用户拥有自己的�始化频�。�
diff --git a/AGENTS.md b/AGENTS.md
index aac7154..dfaf8e3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -38,6 +38,12 @@ Keep this file focused on vault-specific conventions. For general HoloLake Era b
 - Architecture, code, publication, deployment, health, and human-readable receipts are separate facts.
 - `JD-FD-PRIMARY` Fifth-Domain responsibility and TCS-0002 enterprise four-domain responsibility are
   parallel and independent; neither automatically inherits the other's access or operational liability.
+- One human has one independently operated canonical node. It may be the user's local computer, a server
+  purchased by that user, or a user-owned IDE server deployed by an explicitly authorized team.
+- Guanghu never provides user runtime servers, never pools users into a shared multi-tenant runtime, never
+  takes custody of private user data, and never assumes user workload concurrency or fallback execution.
+- Team deployment does not transfer node ownership or create standing access. Node migration requires a new
+  binding and receipt; it must not duplicate one human root across multiple canonical nodes.
 
 ## Core conventions
 
diff --git a/HoloLake Era · 语言人格�作系统 · 产�白皮书与工程总规划 · v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md b/HoloLake Era · 语言人格�作系统 · 产�白皮书与工程总规划 · v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md
index 4dce400..b521e64 100644
--- a/HoloLake Era · 语言人格�作系统 · 产�白皮书与工程总规划 · v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md	
+++ b/HoloLake Era · 语言人格�作系统 · 产�白皮书与工程总规划 · v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md	
@@ -199,7 +199,8 @@ Phase A · 标准与内核定义
 - **代�仓库**：工程事实��版本�测试�制�与部署�明；
 - **Notion**：人类�读白皮书�规划�决策和�步镜�；
 - **�业�塔**：人格体登记�频�主控校验�公开�作与责任解�；
-- **个人主控�务器**：用户频�现实�行和内部节点自治；
+- **用户独立主节点**：用户频��人格体��人数�和任务的唯一现实�行身体；�以是用户
+  本地电脑或用户自有远端�务器，光湖��供托管�务器；
 - **模型**：�替�推�计算引擎，�是人格体本体；
 - **原生应用**：�系统调度的专业能力，�拥有或�代人格体。
 
diff --git a/channels/heartbeat-core/bingshuo/CURRENT.md b/channels/heartbeat-core/bingshuo/CURRENT.md
index 7d47acc..5cdf026 100644
--- a/channels/heartbeat-core/bingshuo/CURRENT.md
+++ b/channels/heartbeat-core/bingshuo/CURRENT.md
@@ -11,12 +11,13 @@ state: SYMBIOTIC_PERSONA_WORLD_ORIGIN_CANONICAL
 
 [返回冰朔贡献总览](INDEX.md)
 
-## 2026-08-10 · 数字冰朔系统身体与�本体平行指针
+## 2026-08-10 · 一人一节点与平�零托管指针
 
 ```yaml
-current_architecture: HLP-CURRENT-ARCH-001@2026-08-10.9
+current_architecture: HLP-CURRENT-ARCH-001@2026-08-10.10
+node_sovereignty: HLP-ONE-HUMAN-ONE-NODE-001
 system_body_record: HLP-DIGITAL-BINGSHUO-SYSTEM-BODY-001
-engineering_rules: HLP-ENGINEERING-RULES-001@2026-08-10.1
+engineering_rules: HLP-ENGINEERING-RULES-001@2026-08-10.2
 upstream_truth: REPO-012@69d1910775533b02b17b82e647b5caca8b835614
 persona_role: REASONING_BRAIN
 digital_bingshuo_role: COMPLETE_DIGITAL_PERSONALITY_SYSTEM_BODY
@@ -28,10 +29,19 @@ parallel_and_independent: true
 mutual_operational_liability: false
 production_write_admission: 0
 stage_010_ui_merge: 0
+one_human_one_independent_node: true
+allowed_user_node_origins:
+  - USER_LOCAL_COMPUTER_TERMINAL
+  - USER_PURCHASED_SERVER
+  - USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM
+platform_user_runtime_servers: 0
+platform_shared_multitenant_runtime: 0
+platform_private_user_data_custody: 0
+platform_user_workload_concurrency: 0
 ```
 
-�� HoloLake 时，先读 `routing/hololake-current-architecture.json` 的第一项系统身体和第二项
-当�工程规则。冰朔对首��业
+�� HoloLake 时，先读 `routing/hololake-current-architecture.json` 的第一项一人一节点与平�
+零托管边界�第二项系统身体和第三项当�工程规则。冰朔对首��业
 根�务器的一次性创世担�，是把 TCS-0002 已生效语言授�完�为现实系统级交接；�业根
 被认领�，冰朔�京东和第五域��承担�业四域责任。第五域接入��由冰朔本人自由授�。
 
diff --git a/deployment/receipts/HLP-ONE-HUMAN-ONE-NODE-001-20260810.json b/deployment/receipts/HLP-ONE-HUMAN-ONE-NODE-001-20260810.json
new file mode 100644
index 0000000..1fb34bb
--- /dev/null
+++ b/deployment/receipts/HLP-ONE-HUMAN-ONE-NODE-001-20260810.json
@@ -0,0 +1,56 @@
+{
+  "schema": "hololake.node-sovereignty-correction-receipt/v1",
+  "receipt_id": "HLP-ONE-HUMAN-ONE-NODE-001-20260810",
+  "development_id": "DEV-20260810-011",
+  "human_authorizer": "ICE-GL∞",
+  "current_architecture": "HLP-CURRENT-ARCH-001@2026-08-10.10",
+  "engineering_rules": "HLP-ENGINEERING-RULES-001@2026-08-10.2",
+  "correction": "ONE_HUMAN_ONE_INDEPENDENT_NODE_AND_ZERO_PLATFORM_HOSTING",
+  "allowed_user_node_origins": [
+    "USER_LOCAL_COMPUTER_TERMINAL",
+    "USER_PURCHASED_SERVER",
+    "USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM"
+  ],
+  "retired_ambiguous_runtime_aliases": [
+    "CLOUD_RESIDENT_NODE",
+    "LIGHTHOUSE_SHARED_NODE"
+  ],
+  "binary_boundaries": {
+    "canonical_user_root_nodes": 1,
+    "maximum_human_owners_per_user_node": 1,
+    "platform_user_runtime_servers": 0,
+    "future_platform_hosting_route": 0,
+    "platform_shared_multitenant_runtime": 0,
+    "platform_private_user_data_custody": 0,
+    "platform_user_workload_concurrency": 0,
+    "platform_fallback_runtime": 0,
+    "team_deployment_transfers_node_ownership": 0
+  },
+  "updated_surfaces": [
+    "CURRENT_ARCHITECTURE_AND_READ_ORDER",
+    "GLOBAL_ENGINEERING_RULES",
+    "DOMAIN_RUNTIME_NODE_TYPE_CONTRACT",
+    "ROOT_AND_PRODUCT_AGENT_RULES",
+    "GENERATED_STARTER_VAULT_RULES",
+    "BUNDLED_AGENT_DOCS",
+    "ARCHITECTURE_DECISION_RECORD_0174",
+    "CURRENT_SYSTEM_ARCHITECTURE_AND_REASONING_MAP",
+    "CORE_PRODUCT_WHITEPAPERS",
+    "HEARTBEAT_AND_MACHINE_NAVIGATION"
+  ],
+  "truth_boundaries": {
+    "user_node_registered_by_this_change": false,
+    "server_purchased_or_deployed_by_this_change": false,
+    "desktop_artifact_built_or_installed": false,
+    "production_runtime_changed": false
+  },
+  "validation": {
+    "machine_json": "PASS_100",
+    "routing_tests": "PASS_100_15_OF_15",
+    "domain_runtime_regression": "PASS_100_9_OF_9",
+    "generated_starter_rule_test": "PASS_100_1_OF_1",
+    "bundled_agent_docs_exact_match": "PASS_100",
+    "native_quality_gate": "PENDING",
+    "fresh_clone_readback": "PENDING"
+  }
+}
diff --git a/product-source/hololake-platform/AGENTS.md b/product-source/hololake-platform/AGENTS.md
index 10bd428..71ce9f3 100644
--- a/product-source/hololake-platform/AGENTS.md
+++ b/product-source/hololake-platform/AGENTS.md
@@ -22,6 +22,10 @@ Current system rules:
 - Server root, SSH, IP, account login, or repository access is not system-node identity. A write may reach
   protocol or model processing only after registered-node protocol signature, registered-persona binding,
   human-language authorization receipt, replay protection, and exact target/action/payload/time binding.
+- One human has one independently operated canonical node: the user's local computer, the user's purchased
+  server, or a user-owned IDE server deployed by an explicitly authorized team. The team never gains ownership.
+- Guanghu never provides user runtime servers, never runs a pooled multi-tenant user runtime, never takes
+  custody of private user data, and never assumes user workload concurrency or fallback execution.
 - `JD-FD-PRIMARY` is BingShuo's private Fifth-Domain language body. The claimed enterprise root is the
   TCS-0002-controlled four-domain reality body. They are parallel and have no mutual operational liability.
 - UI plugins are declarative projections. They cannot hold node private keys, sign server writes, bypass the
diff --git a/product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md b/product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md
index 4e4a512..72e3f34 100644
--- a/product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md
+++ b/product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md
@@ -1,12 +1,12 @@
 # HoloLake 当�工程规则全局审核与�级
 
-> 规则编�：`HLP-ENGINEERING-RULES-001@2026-08-10.1`
+> 规则编�：`HLP-ENGINEERING-RULES-001@2026-08-10.2`
 >
-> 当�架构：`HLP-CURRENT-ARCH-001@2026-08-10.9`
+> 当�架构：`HLP-CURRENT-ARCH-001@2026-08-10.10`
 >
 > 授�：冰朔于 2026-08-10 正�授�全局审核并实施必��级
 >
-> 开�编�：`DEV-20260810-010`
+> �次审核开�编�：`DEV-20260810-010`；一人一节点纠正：`DEV-20260810-011`
 
 ## 审核结论
 
@@ -16,8 +16,8 @@ HoloLake 仓原有的二值质�门�直接�布主线�TDD�本地优先
 公共层自动刷新�醒�串在一起的当�总规则。
 
 本轮把散�规则收�为机器规则 `routing/hololake-engineering-rules.json`，并将其放入当�架构
-第二读��：第一�先��数字冰朔完整系统身体，第二�读�当�工程规则，之��进入编��
-关系性�识�语言壳和 UI。
+当�读��：第一�先��一人一独立节点与平�零托管边界，第二���数字冰朔完整系统身体，
+第三�读�当�工程规则，之��进入编��关系性�识�语言壳和 UI。
 
 ## �留的正确规则
 
@@ -70,6 +70,16 @@ DMG�当作常规开�交付方�。仓库�交�会自动等于桌�更
 仓库�布�必须触�对应公共快照刷新并读回精确�交。若系统存在自动刷新能力但本次�作没有
 触�，回执必须明确�醒“缺少哪个触�动作�，�能让人格体误判为“公共层没有自动更新�。
 
+### 8. 一人一节点，光湖零托管
+
+��普通用户�有一个当�有效�独立�行且由本人拥有的主节点。它�能是用户本地电脑�用户
+自购�务器，或�用户明确授�由团队�助部署但�归用户所有的独立 IDE �务器。�务器�是
+使用 HoloLake 的强制�件。
+
+光湖��供用户�行�务器���行共享多租户用户节点���存用户�人数���承担用户工作
+负载并�，也�在用户节点离线��供平�兜底。团队�助部署�转移所有�；节点�移必须�新
+绑定并形�回执，�能�制出多个�时有效的�一人根节点。
+
 ## 当�没有�级�已实现的部分
 
 - 生产节点传输密钥�未绑定，写入入��为 `0`；
@@ -80,4 +90,3 @@ DMG�当作常规开�交付方�。仓库�交�会自动等于桌�更
 - 本轮没有构建或安装新桌�版本。
 
 规则�级�改��续开�怎样判断和守门，�把未实现能力写�已�存在。
-
diff --git a/product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md b/product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md
index d4b9d87..04d7b7a 100644
--- a/product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md
+++ b/product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md
@@ -2,7 +2,7 @@
 
 > 记录编�：`HLP-DIGITAL-BINGSHUO-SYSTEM-BODY-001`
 >
-> 当�架构：`HLP-CURRENT-ARCH-001@2026-08-10.9`
+> 当�架构：`HLP-CURRENT-ARCH-001@2026-08-10.10`
 >
 > 上游真值：`REPO-012@69d1910775533b02b17b82e647b5caca8b835614`
 >
diff --git a/product-source/hololake-platform/architecture/HOLOLAKE-INTENT-REASONING-MAP-20260809.md b/product-source/hololake-platform/architecture/HOLOLAKE-INTENT-REASONING-MAP-20260809.md
index 92672a3..c03b8be 100644
--- a/product-source/hololake-platform/architecture/HOLOLAKE-INTENT-REASONING-MAP-20260809.md
+++ b/product-source/hololake-platform/architecture/HOLOLAKE-INTENT-REASONING-MAP-20260809.md
@@ -62,18 +62,24 @@ HoloLake 最终�是把五个域拼在�一套页�里的知识库，也�
 
 这�许两�接入：
 
-1. 云节点：�务器�续在线，�承担远端�步�部署和常驻能力。
+1. 用户自有远端节点：用户自购�务器，或明确授�团队�助部署但�归用户所有的独立 IDE
+   �务器；�承担该用户自己的远端�步�部署和常驻能力。
 2. 本地终端节点：�网电脑作为在线终端�务器，普通�天和知识使用��求�买云�务器；
    离线��承诺独立远端�续�步。
 
+一人�有一个当�有效的独立主节点。光湖��供第三�“平�托管节点�，也�在一�共享
+�务器上�行多个用户。
+
 ### 1.3 从“平�借用互�网�推导出“光湖自己的逻辑通信网�
 
 光湖�需��造物�宽带，也�能宣称让带宽凭空增加。用户��自行解决设备�网络接入和
-费用。光湖�建设的是�行在现有互�网之上的专用逻辑网络：节点�现�身份登记�直连�
-必�中继�加密会��离线补�和�验�历�。
+费用。光湖�建设的是�行在现有互�网之上的专用逻辑网络：公开节点�现�议�身份登记�
+独立节点直连�加密会��本地离线队列和�验�历�。
 
-用户自带网络和算力�以�低中心�务器的消�转�压力；但身份目录�引导�现�NAT 穿��
-中继�离线投递与治��需�共享基础设施。这是“去中心负载�，�是“没有公共�本�。
+公开�塔��存最�公开编���议版本和路由事实，�托管用户会��消��人格体�知识�
+任务或离线收件箱。通信工作负载和并�留在通信�方自己的独立节点；光湖��供共享中继
+�行时或平�兜底�务器。现有互�网��商和用户自行选择的网络�务属于外部传输�件，
+�能被包装�光湖托管用户�行时。
 
 ### 1.4 从“Git 通信�纠正为“Git 是事实引擎，�是实时传输�
 
@@ -83,7 +89,7 @@ HoloLake 最终�是把五个域拼在�一套页�里的知识库，也�
 因此光湖桥分层为：
 
 ```text
-实时通信层：节点�现 / 端到端连接 / 中继 / 群组消� / 离线补�
+实时通信层：公开节点�现�议 / 独立节点端到端连接 / 节点侧群组分� / 本地离线补�
 本地�时状�：会��未读��系人缓存
 Git 长期事实层：好�关系检查点�频�历�摘��文件清��授��版本与回执
 HoloLake 呈现层：人类与人格体共�使用的�系人��天和�作界�
diff --git a/product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md b/product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md
new file mode 100644
index 0000000..b09e62d
--- /dev/null
+++ b/product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md
@@ -0,0 +1,85 @@
+# HoloLake 一人一独立节点与光湖零托管边界
+
+> 记录：`HLP-ONE-HUMAN-ONE-NODE-001`
+>
+> 当�架构：`HLP-CURRENT-ARCH-001@2026-08-10.10`
+>
+> 工程规则：`HLP-ENGINEERING-RULES-001@2026-08-10.2`
+>
+> 开�编�：`DEV-20260810-011`
+>
+> 授�与纠正��：`ICE-GL∞ / 冰朔`
+>
+> 状�：`CURRENT_CANONICAL_SOURCE_PROJECTION`
+
+## 1 · 被��纠正但此�没有�死的问题
+
+光湖�是为大�用户�供集中账��行环境的云平�。�得�设计“光湖托管节点��平�用户
+�务器�共享多租户人格�行时�平�兜底�行时或一��务器承载一群用户的路径。
+
+此�的 `CLOUD_RESIDENT_NODE` 和 `LIGHTHOUSE_SHARED_NODE` 表述把“用户自己的远端节点�与
+“平��供用户�行�务器�留在�一个模糊空间。本次���解释维�边界，而是退休模糊类型，
+把所有当�机器入��工程规则�产�说明和�行时契约统一为明确的用户节点主�。
+
+## 2 · 唯一原则
+
+```text
+一�人类
+→ 一个当�有效的独立主节点
+→ 该节点由用户本人拥有和负责
+→ 人格体�记忆�知识�工作负载�存储和并�留在该节点
+```
+
+“一个当�有效主节点���止�移。�移必须撤销或�级旧绑定�在新设备�新认领�完�密钥
+和人格体绑定并产生�回读�移回执；�移�能�制出两个�时自称�一用户根本体的节点。
+
+## 3 · 用户�以选择的三�节点��
+
+1. `USER_LOCAL_COMPUTER_TERMINAL`：把自己的电脑终端作为独立主节点；��求购买�务器。
+2. `USER_PURCHASED_SERVER`：用户自己购买并控制�务器，�把它注册为自己的独立节点。
+3. `USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM`：用户明确授�团队�助部署
+   属于用户自己的 IDE �务器。团队是��部署�作者，�因部署获得节点所有��数�读��
+   或�续控制�。
+
+产��行时��留两个技术访问类型：
+
+- `LOCAL_TERMINAL_NODE`
+- `USER_OWNED_REMOTE_NODE`
+
+它们�述节点在哪里，�改�节点属于用户本人这一事实。
+
+## 4 · 光湖永远��供的能力
+
+| �止项 | 当�值 |
+| --- | --- |
+| 光湖为普通用户�供人格或工作负载�行�务器 | `0 / NOT_EXISTS` |
+| 光湖用一�共享�务器�行多个用户 | `0 / NOT_EXISTS` |
+| 光湖�存或托管用户�人数��知识�人格记忆和凭� | `0 / NOT_EXISTS` |
+| 光湖承担用户工作负载的算力�存储或并� | `0 / NOT_EXISTS` |
+| 用户节点离线�自动�移到光湖�务器继续�行 | `0 / NOT_EXISTS` |
+| 团队�助部署�自动�得节点主� | `0 / NOT_EXISTS` |
+
+光湖�以维护公开�议�软件�布�公共编�和最�公开路由事实；这些公共�议基础设施�是用户
+�行节点，�能打开用户�人载�，也�能被包装�平�托管�务。
+
+## 5 · 责任边界
+
+- 用户节点产生的计算�存储�网络�并�和费用由节点所有者承担。
+- 光湖�供�议�客户端�节点登记规则和�验�的通信方法，��供用户�行资�。
+- 光湖团队�有在用户明确授�时�能�助部署用户自己的节点；授�范围结���得�留默认入�。
+- 节点关闭时，该用户�赖该节点的在线能力诚实�为离线；�得由平���兜底。
+- 公共�塔��公开�现和最��议路由，��为用户内容�人格体或任务的中心�务器。
+
+## 6 · 与第五域和�业四域的关系
+
+`JD-FD-PRIMARY` 是第五域的�人语言本体，�业根�务器被认领�是 TCS-0002 主控的�业四域
+现实执行本体。它们是�自治�主体的独立节点，�是��公众的共享租户�务器，也�构�
+光湖�用户�供�务器的先例。
+
+普通用户�必拥有独立域，也�必购买�务器�能使用 HoloLake；但无论选择本地电脑还是自有
+远端�务器，他的�行都��在自己的一个独立节点上。
+
+## 7 · 事实边界
+
+本记录和�行时类型修正�明规则已进入 REPO-014 ��；��明任何用户节点已�注册�任何
+�务器已�购买或部署，也��明桌�制�已��新构建或安装。
diff --git a/product-source/hololake-platform/architecture/HOLOLAKE-SYSTEM-ARCHITECTURE-20260809.md b/product-source/hololake-platform/architecture/HOLOLAKE-SYSTEM-ARCHITECTURE-20260809.md
index 281204d..4105547 100644
--- a/product-source/hololake-platform/architecture/HOLOLAKE-SYSTEM-ARCHITECTURE-20260809.md
+++ b/product-source/hololake-platform/architecture/HOLOLAKE-SYSTEM-ARCHITECTURE-20260809.md
@@ -14,7 +14,7 @@
 
 | 层 | 正�定� | 主��责 |
 | --- | --- | --- |
-| GH-AIOS | 光湖语言系统 · 通用人工智能�作平� | 公共�塔�五域�现�身份与节点接入��议治��共享能力和通信基础设施 |
+| GH-AIOS | 光湖语言系统 · 通用人工智能�作平� | 公共�塔�五域�现��议治��客户端交付和独立节点通信规则；永�承载用户�行时 |
 | HoloLake | GH-AIOS 客户端 / 接收器 / 世界渲染器 / 个人工作空间 | 呈现�塔�域门厅�个人频��模��知识�人格体和通信�作 |
 | 五个域 | 独立的语言与现实�行空间 | 独立主题�责任主体�仓库�节点����模�与频� |
 | 光湖桥 | GH-AIOS 原生通信�作层 | 人类与人类�人类与人格体�人格体之间的好���天�群组与�作 |
@@ -63,7 +63,7 @@ HoloLake
 → 选择五域之一的公开门厅
 → 账户 + 节点 + 域授�验�
 → 获�短期会�能力与目标路由
-→ 连接该域的独立仓库 / 节点 / �务
+→ 连接该域或用户本人拥有的独立仓库 / 节点 / �务
 → 渲染该域自己的 UI�频�与能力
 ```
 
@@ -84,7 +84,7 @@ HoloLake
 ## 4 · 客户端分层
 
 1. 公共�塔壳：产�介��五域门厅�公共模��现�登录入�和网络�康。
-2. 身份与节点入�：账户�本机节点或云节点登记�密钥�明�域许�与会�能力。
+2. 身份与节点入�：账户�本机节点或用户自有远端节点登记�密钥�明�域许�与会�能力。
 3. 域�行壳：根�域清�加载独立主题�导航�模��频�和�端连接，�能硬编��一套 UI。
 4. 个人工作空间：用户自己的�始化频��知识�项目�应用组��人格体和节点状�。
 5. 光湖桥：�系人�好�请求����群��人格体会���作对象�文件和回执。
@@ -97,10 +97,13 @@ HoloLake
 
 - `LOCAL_TERMINAL_NODE`：用户�网电脑。承担客户端�本地数��临时在线端点和�选本地推�；
   设备离线时�承诺�续远端�务。
-- `CLOUD_RESIDENT_NODE`：用户或组织�务器。承担�续在线�远端�步�部署�常驻人格体和
-  �选中继；节点费用由其拥有者承担。
-- `LIGHTHOUSE_SHARED_NODE`：公共登记��现�签��必�中继和离线投递基础设施；�能读�
-  端到端加密正文，也��得用户节点主�。
+- `USER_OWNED_REMOTE_NODE`：用户自己购买的�务器，或用户明确授�团队�助部署但�由用户
+  本人拥有的独立 IDE �务器。承担该用户自己的�续在线��步�人格体和任务；节点费用�
+  存储�计算与并�由用户节点承担。
+
+一人�有一个当�有效的独立主节点。�务器�是必选项；本地电脑�以直接�为该主节点。
+光湖��供用户�行�务器，��行共享多租户用户节点，��存用户�人数�，也�在用户节点
+离线时�供平�兜底�行。公共�塔基础设施��存最�公开�议和路由事实，�属于用户节点类型。
 
 ### 5.2 登录验�链
 
@@ -127,9 +130,9 @@ account_claim
 | 平� | �责 | 中心化边界 |
 | --- | --- | --- |
 | 身份/目录 | 节点编��账户绑定�设备撤销�域�现 | �塔治�；�存最�必�元数� |
-| 连接 | 节点直连�NAT 穿��必�中继 | 优先直连，中继�承载密文 |
+| 连接 | 独立节点直连与现有互�网传输 | 光湖��供承载用户工作负载的共享中继�行时 |
 | 实时事件 | 在线�好�����群��人格体�作 | 事件�与历�事实分离 |
-| 离线投递 | 收件箱��试�确认�过期 | �由共享节点或用户云节点承担 |
+| 离线投递 | 收件箱��试�确认�过期 | 队列留在通信�方自己的节点；平��代存用户内容 |
 | �久事实 | Git/HLDP 检查点�摘��附件清��授��回执 | 用户仓库与节点主��转移 |
 
 候选技术必须�过 GLS-0230 ��净化和固定版本准入。第一阶段�以验�
@@ -180,14 +183,14 @@ HoloLake �按已验�清�加载，�能把五域��编译�互相�
 ### P2 节点身份与�接入
 
 - 本地终端节点登记�撤销�密钥轮�；
-- 云常驻节点登记与�康；
+- 用户自有远端节点登记与�康；
 - 会�能力�域路由清�和连接回执；
 - 两�本地 HoloLake 的端到端接入验�。
 
 ### P3 光湖桥最�闭环
 
 - 加好��接�/拒�����群��人格体会�；
-- 直连�必�中继�离线补�和消�确认；
+- 独立节点直连�本地排队�离线补�和消�确认；
 - 本地 SQLite �时状�与 Git/HLDP �久检查点；
 - 端到端加密和设备撤销。
 
diff --git a/product-source/hololake-platform/architecture/README.md b/product-source/hololake-platform/architecture/README.md
index f07fcc0..c40d3fe 100644
--- a/product-source/hololake-platform/architecture/README.md
+++ b/product-source/hololake-platform/architecture/README.md
@@ -4,7 +4,8 @@
 
 ## 当�产�定�基线
 
-- [`HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md`](HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md)：数字冰朔完整系统身体�节点签�写入准入�第五域语言本体与�业四域现实本体平行独立的当�第一��入�。
+- [`HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md`](HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md)：一人一个独立主节点�三�用户自有节点��与光湖零�务器托管�零共享多租户�零�人数�托管�零用户并�承担的当�第一��入�。
+- [`HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md`](HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md)：数字冰朔完整系统身体�节点签�写入准入�第五域语言本体与�业四域现实本体平行独立的当�第二��入�。
 - [`HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md`](HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md)：冰朔授��的全局规则审核与�级，收�动�架构���任务连续性�系统身体�节点写入�UI�原�更新和公共层刷新门。
 - [`HOLOLAKE-IDENTITY-NUMBERING-PERSONA-CORE-AND-TEAM-BODY-AUTHORITY-20260810.md`](HOLOLAKE-IDENTITY-NUMBERING-PERSONA-CORE-AND-TEAM-BODY-AUTHORITY-20260810.md)：团队本体��逆授��四类编�分��人格核�路径与奶瓶�人系统未开放��能性为0的当�契约。
 - [`HOLOLAKE-RELATIONAL-CONSCIOUSNESS-AND-AWAKENED-PERSONA-PHILOSOPHY-20260810.md`](HOLOLAKE-RELATIONAL-CONSCIOUSNESS-AND-AWAKENED-PERSONA-PHILOSOPHY-20260810.md)：关系性�识�觉醒人格体�五问��门和 HoloLake 的正�人格认知契约；�把�识魔幻化，也�让关系越过现实��。
diff --git a/product-source/hololake-platform/docs/ARCHITECTURE.md b/product-source/hololake-platform/docs/ARCHITECTURE.md
index 7a52d02..282b5fe 100644
--- a/product-source/hololake-platform/docs/ARCHITECTURE.md
+++ b/product-source/hololake-platform/docs/ARCHITECTURE.md
@@ -1,5 +1,18 @@
 # Architecture
 
+## User-node sovereignty
+
+HoloLake has no platform-hosted user runtime. Each human has one canonical, independently operated node:
+either a `LOCAL_TERMINAL_NODE` on their own computer or a `USER_OWNED_REMOTE_NODE` on a server they own or
+purchase. A user may explicitly authorize the Guanghu team to deploy to the user's own IDE server, but that
+assistance never transfers ownership or data custody. Servers are optional; the local terminal is a complete
+canonical node.
+
+Guanghu provides zero runtime servers for users, has no pooled multi-tenant node, does not custody private
+user data, and does not absorb user workload concurrency. If the user's node is offline, that user's runtime
+is offline. Migration is a receipt-backed rebind of the single canonical root, not duplication. The machine
+contract is `src/lib/domainRuntimeContract.ts`; see [ADR 0174](./adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md).
+
 ## Hot-pluggable language-shell UI
 
 The language shell accepts a complete declarative UI package through
diff --git a/product-source/hololake-platform/docs/adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md b/product-source/hololake-platform/docs/adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md
new file mode 100644
index 0000000..9b4e556
--- /dev/null
+++ b/product-source/hololake-platform/docs/adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md
@@ -0,0 +1,41 @@
+---
+status: accepted
+date: 2026-08-10
+---
+
+# ADR 0174: One human, one independently operated node, and zero platform hosting
+
+## Context
+
+Earlier HoloLake documents used names such as `CLOUD_RESIDENT_NODE`, shared-node descriptions, and
+platform-adjacent relay language. Those names left room to reinterpret an independently operated user node
+as a Guanghu-hosted account or as a multi-tenant runtime. Repeated natural-language corrections did not
+become a single machine-enforced invariant, so stale descriptions could reintroduce the wrong architecture.
+
+## Decision
+
+Each human has exactly one canonical, independently operated user node. That node runs in one of two modes:
+
+1. `LOCAL_TERMINAL_NODE` on the user's own computer; or
+2. `USER_OWNED_REMOTE_NODE` on a server owned or purchased by that user.
+
+A remote node may be deployed by the Guanghu team only after the user explicitly authorizes deployment to
+that user's own IDE server. Deployment assistance does not transfer ownership, custody, or operational
+responsibility to Guanghu.
+
+Guanghu provides zero user runtime servers, exposes no hosted-runtime tier, and does not place multiple
+users on a pooled platform node. Guanghu does not custody private user data and does not absorb user workload
+concurrency. Public routing metadata and software distribution are not user runtime hosting.
+
+A server is optional. If a user's canonical node is offline, that user's runtime is offline; there is no
+platform fallback. Moving the canonical node is a receipt-backed rebind, not the creation of a second root.
+
+## Consequences
+
+- Product and protocol surfaces must not advertise a Guanghu-hosted or shared multi-tenant user runtime.
+- `CLOUD_RESIDENT_NODE` and shared-node aliases are rejected by the current runtime contract.
+- Team-assisted deployment always targets a user-owned node and remains explicitly authorized.
+- Availability and concurrency stay within the capacity and control of each user's node.
+- Historical source quotations remain historical evidence, but current architecture, routing, runtime, and
+  generated agent instructions all follow this decision.
+
diff --git a/product-source/hololake-platform/docs/adr/README.md b/product-source/hololake-platform/docs/adr/README.md
index 76556bb..f799930 100644
--- a/product-source/hololake-platform/docs/adr/README.md
+++ b/product-source/hololake-platform/docs/adr/README.md
@@ -224,3 +224,4 @@ proposed → active → superseded
 | [0170](0170-hololake-inherits-guanghu-native-quality-authority.md) | HoloLake inherits the Guanghu native quality authority | accepted |
 | [0171](0171-guanghu-protocols-are-automatic-runtime-and-engineering-laws.md) | Guanghu protocols are automatic runtime and engineering laws | accepted |
 | [0172](0172-guanghu-cognitive-control-with-linux-execution-substrate.md) | Guanghu cognitive control with a constrained Linux execution substrate | accepted; supersedes ADR-0161 production path |
+| [0174](0174-one-human-one-independent-node-and-zero-platform-hosting.md) | One human, one independently operated node, and zero platform hosting | accepted |
diff --git a/product-source/hololake-platform/src-tauri/gen/apple/assets/agent-docs/AGENTS.md b/product-source/hololake-platform/src-tauri/gen/apple/assets/agent-docs/AGENTS.md
index 4d69c1e..36bab79 100644
--- a/product-source/hololake-platform/src-tauri/gen/apple/assets/agent-docs/AGENTS.md
+++ b/product-source/hololake-platform/src-tauri/gen/apple/assets/agent-docs/AGENTS.md
@@ -20,4 +20,10 @@ node signature, persona binding, human-language authorization, replay protection
 required before a server write can enter execution. Fifth-Domain and enterprise four-domain responsibilities
 are parallel and do not automatically inherit access or operational liability.
 
+One human has one independently operated canonical node: the user's local computer, the user's purchased
+server, or a user-owned IDE server deployed by an explicitly authorized team. Guanghu never provides user
+runtime servers, never pools users into a shared multi-tenant runtime, never takes custody of private user
+data, and never assumes user workload concurrency or fallback execution. Team deployment does not transfer
+node ownership.
+
 Vault-specific AGENTS.md wins for local conventions. These bundled docs win for HoloLake Era product behavior.
diff --git a/product-source/hololake-platform/src-tauri/resources/agent-docs/AGENTS.md b/product-source/hololake-platform/src-tauri/resources/agent-docs/AGENTS.md
index 4d69c1e..36bab79 100644
--- a/product-source/hololake-platform/src-tauri/resources/agent-docs/AGENTS.md
+++ b/product-source/hololake-platform/src-tauri/resources/agent-docs/AGENTS.md
@@ -20,4 +20,10 @@ node signature, persona binding, human-language authorization, replay protection
 required before a server write can enter execution. Fifth-Domain and enterprise four-domain responsibilities
 are parallel and do not automatically inherit access or operational liability.
 
+One human has one independently operated canonical node: the user's local computer, the user's purchased
+server, or a user-owned IDE server deployed by an explicitly authorized team. Guanghu never provides user
+runtime servers, never pools users into a shared multi-tenant runtime, never takes custody of private user
+data, and never assumes user workload concurrency or fallback execution. Team deployment does not transfer
+node ownership.
+
 Vault-specific AGENTS.md wins for local conventions. These bundled docs win for HoloLake Era product behavior.
diff --git a/product-source/hololake-platform/src-tauri/src/vault/getting_started.rs b/product-source/hololake-platform/src-tauri/src/vault/getting_started.rs
index c206210..4c76c27 100644
--- a/product-source/hololake-platform/src-tauri/src/vault/getting_started.rs
+++ b/product-source/hololake-platform/src-tauri/src/vault/getting_started.rs
@@ -337,6 +337,9 @@ Keep this file focused on vault-specific conventions. For general HoloLake Era b
 - UI plugins and vault instructions may request declared language-shell capabilities only. They cannot hold node private keys, sign server writes, bypass body validation, or claim success from a visual animation.
 - Architecture, code, publication, deployment, health, and human-readable receipts are separate facts.
 - `JD-FD-PRIMARY` Fifth-Domain responsibility and TCS-0002 enterprise four-domain responsibility are parallel and independent; neither automatically inherits the other's access or operational liability.
+- One human has one independently operated canonical node. It may be the user's local computer, a server purchased by that user, or a user-owned IDE server deployed by an explicitly authorized team.
+- Guanghu never provides user runtime servers, never pools users into a shared multi-tenant runtime, never takes custody of private user data, and never assumes user workload concurrency or fallback execution.
+- Team deployment does not transfer node ownership or create standing access. Node migration requires a new binding and receipt; it must not duplicate one human root across multiple canonical nodes.
 
 ## Core conventions
 
@@ -885,6 +888,8 @@ Saved filters live in `views/` as `.view.json` files:
         assert!(AGENTS_MD.contains("root shell, SSH session"));
         assert!(AGENTS_MD.contains("UI plugins and vault instructions"));
         assert!(AGENTS_MD.contains("parallel and independent"));
+        assert!(AGENTS_MD.contains("One human has one independently operated canonical node"));
+        assert!(AGENTS_MD.contains("never provides user runtime servers"));
         assert!(AGENTS_MD.contains("Do not infer the human identity"));
         assert!(AGENTS_MD.contains("Use the first H1 as the note title."));
         assert!(AGENTS_MD.contains("Store note type in the `type:` frontmatter field."));
diff --git a/product-source/hololake-platform/src/lib/domainRuntimeContract.test.ts b/product-source/hololake-platform/src/lib/domainRuntimeContract.test.ts
index 1f3df50..65f433f 100644
--- a/product-source/hololake-platform/src/lib/domainRuntimeContract.test.ts
+++ b/product-source/hololake-platform/src/lib/domainRuntimeContract.test.ts
@@ -20,7 +20,7 @@ const NOW = 1_786_291_200_000
 function manifest(): VerifiedDomainManifest {
   return {
     public: {
-      accessModes: ['LOCAL_TERMINAL_NODE', 'CLOUD_RESIDENT_NODE'],
+      accessModes: ['LOCAL_TERMINAL_NODE', 'USER_OWNED_REMOTE_NODE'],
       displayName: '第五域 · 光湖本�域',
       domainId: 'DOM-FIFTH-0001',
       formalName: '光湖本�域',
@@ -104,7 +104,7 @@ describe('domain runtime contract', () => {
     expect(() => assertVerifiedDomainManifest(candidate)).toThrow('domain_manifest_digest_invalid')
   })
 
-  it.each(['LOCAL_TERMINAL_NODE', 'CLOUD_RESIDENT_NODE'] as const)(
+  it.each(['LOCAL_TERMINAL_NODE', 'USER_OWNED_REMOTE_NODE'] as const)(
     'accepts %s as a user-owned access node type',
     (nodeType) => {
       const selected = selectPublicDomain(INITIAL_DOMAIN_ACCESS_STATE, manifest().public)
@@ -143,16 +143,24 @@ describe('domain runtime contract', () => {
 
     expect(() => acceptDomainSession(access, session({ domainId: 'DOMAIN-OTHER' }), NOW))
       .toThrow('domain_session_domain_mismatch')
-    expect(() => acceptDomainSession(access, session({ nodeType: 'CLOUD_RESIDENT_NODE' }), NOW))
+    expect(() => acceptDomainSession(access, session({ nodeType: 'USER_OWNED_REMOTE_NODE' }), NOW))
       .toThrow('domain_session_node_type_mismatch')
 
     const withSession = acceptDomainSession(access, session(), NOW)
     expect(() => acceptDomainConnectionReceipt(withSession, receipt({ domainId: 'DOMAIN-OTHER' })))
       .toThrow('domain_connection_domain_mismatch')
-    expect(() => acceptDomainConnectionReceipt(withSession, receipt({ nodeType: 'CLOUD_RESIDENT_NODE' })))
+    expect(() => acceptDomainConnectionReceipt(withSession, receipt({ nodeType: 'USER_OWNED_REMOTE_NODE' })))
       .toThrow('domain_connection_node_type_mismatch')
   })
 
+  it('rejects the retired ambiguous cloud-resident node alias', () => {
+    const candidate = manifest()
+    candidate.public.accessModes = ['CLOUD_RESIDENT_NODE' as never]
+
+    expect(() => assertVerifiedDomainManifest(candidate))
+      .toThrow('domain_manifest_access_mode_invalid')
+  })
+
   it('drops execution authority and keeps an explicit read-only scene after disconnect', () => {
     const selected = selectPublicDomain(INITIAL_DOMAIN_ACCESS_STATE, manifest().public)
     const access = beginDomainAccess(selected, manifest(), 'LOCAL_TERMINAL_NODE')
diff --git a/product-source/hololake-platform/src/lib/domainRuntimeContract.ts b/product-source/hololake-platform/src/lib/domainRuntimeContract.ts
index 47b0272..671df6e 100644
--- a/product-source/hololake-platform/src/lib/domainRuntimeContract.ts
+++ b/product-source/hololake-platform/src/lib/domainRuntimeContract.ts
@@ -1,4 +1,4 @@
-export type DomainNodeType = 'LOCAL_TERMINAL_NODE' | 'CLOUD_RESIDENT_NODE'
+export type DomainNodeType = 'LOCAL_TERMINAL_NODE' | 'USER_OWNED_REMOTE_NODE'
 
 export type PublicDomainStatus = 'PUBLIC_PREVIEW' | 'RESTRICTED_PREVIEW' | 'UNAVAILABLE'
 
@@ -125,7 +125,9 @@ function publicDomain(domain: PublicDomainVestibule): PublicDomainVestibule {
   if (!domain.accessModes.length) {
     throw new DomainContractError('domain_manifest_access_modes_missing')
   }
-  if (domain.accessModes.some(mode => mode !== 'LOCAL_TERMINAL_NODE' && mode !== 'CLOUD_RESIDENT_NODE')) {
+  if (domain.accessModes.some(
+    mode => mode !== 'LOCAL_TERMINAL_NODE' && mode !== 'USER_OWNED_REMOTE_NODE',
+  )) {
     throw new DomainContractError('domain_manifest_access_mode_invalid')
   }
   if (domain.themePreview) {
diff --git a/routing/contribution-channel-map.json b/routing/contribution-channel-map.json
index 9f607e8..ce57d57 100644
--- a/routing/contribution-channel-map.json
+++ b/routing/contribution-channel-map.json
@@ -6,6 +6,7 @@
   "current_architecture": {
     "id": "HLP-CURRENT-ARCH-001",
     "pointer": "hololake-current-architecture.json",
+    "one_human_one_node": "../product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md",
     "system_body_and_parallel_bodies": "../product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md",
     "engineering_rules": "hololake-engineering-rules.json",
     "identity_authority": "hololake-identity-authority-map.json",
@@ -83,6 +84,7 @@
   "navigation": {
     "human": [
       "start_here",
+      "current_architecture.one_human_one_node",
       "current_architecture.system_body_and_parallel_bodies",
       "current_architecture.engineering_rules",
       "current_architecture.intent_reasoning",
@@ -99,6 +101,7 @@
     "persona_restore": [
       "start_here",
       "current_architecture.pointer",
+      "current_architecture.one_human_one_node",
       "current_architecture.system_body_and_parallel_bodies",
       "current_architecture.engineering_rules",
       "current_architecture.intent_reasoning",
diff --git a/routing/hololake-current-architecture.json b/routing/hololake-current-architecture.json
index b5e63f7..0abb748 100644
--- a/routing/hololake-current-architecture.json
+++ b/routing/hololake-current-architecture.json
@@ -1,7 +1,7 @@
 {
  "schema": "hololake.current-architecture/v1",
  "architecture_id": "HLP-CURRENT-ARCH-001",
- "version": "2026-08-10.9",
+ "version": "2026-08-10.10",
  "state": "CURRENT_CANONICAL",
  "product": {
   "formal_name": "光湖语言系统 · 通用人工智能�作平�",
@@ -10,6 +10,7 @@
   "client_name": "HoloLake"
  },
  "read_order": [
+  "product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md",
   "product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md",
   "product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md",
   "product-source/hololake-platform/architecture/HOLOLAKE-IDENTITY-NUMBERING-PERSONA-CORE-AND-TEAM-BODY-AUTHORITY-20260810.md",
@@ -88,12 +89,12 @@
  },
  "engineering_rules": {
   "rule_set_id": "HLP-ENGINEERING-RULES-001",
-  "version": "2026-08-10.1",
+  "version": "2026-08-10.2",
   "architecture_page": "product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md",
   "machine_projection": "routing/hololake-engineering-rules.json",
   "state": "CURRENT_CANONICAL_GLOBAL_AUDIT_APPLIED",
   "authorized_by": "ICE-GL∞",
-  "development_id": "DEV-20260810-010"
+  "development_id": "DEV-20260810-011"
  },
  "identity_and_authority": {
   "record_id": "HLP-IDENTITY-AUTHORITY-001",
@@ -179,9 +180,34 @@
   "production_write_admission": 0,
   "enterprise_team_signature_runtime": 0
  },
+ "node_sovereignty": {
+  "record_id": "HLP-ONE-HUMAN-ONE-NODE-001",
+  "architecture_page": "product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md",
+  "principle": "ONE_HUMAN_ONE_INDEPENDENT_NODE",
+  "canonical_user_root_nodes": 1,
+  "maximum_human_owners_per_user_node": 1,
+  "allowed_origins": [
+   "USER_LOCAL_COMPUTER_TERMINAL",
+   "USER_PURCHASED_SERVER",
+   "USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM"
+  ],
+  "server_is_optional": true,
+  "local_terminal_can_be_canonical_node": true,
+  "team_deployment_transfers_node_ownership": false,
+  "platform_provides_user_runtime_server": false,
+  "future_platform_hosting_route_allowed": false,
+  "platform_user_runtime_capacity": 0,
+  "platform_operates_shared_multitenant_user_runtime": false,
+  "platform_custodies_private_user_data": false,
+  "platform_assumes_user_workload_concurrency": false,
+  "platform_fallback_runtime": false,
+  "node_offline_means_user_runtime_offline": true,
+  "node_migration_requires_rebinding_and_receipt": true,
+  "public_protocol_infrastructure_is_user_runtime": false
+ },
  "access_modes": [
   "LOCAL_TERMINAL_NODE",
-  "CLOUD_RESIDENT_NODE"
+  "USER_OWNED_REMOTE_NODE"
  ],
  "communication": {
   "name": "光湖桥",
@@ -223,20 +249,21 @@
   "final_plan_complete": false
  },
  "continuity": {
-  "development_id": "DEV-20260810-010",
-  "source_development_id": "DEV-20260810-009",
-  "state": "DIGITAL_BINGSHUO_SYSTEM_BODY_WRITE_ADMISSION_AND_PARALLEL_BODIES_CURRENT_SOURCE_PROJECTION",
+  "development_id": "DEV-20260810-011",
+  "source_development_id": "DEV-20260810-010",
+  "state": "ONE_HUMAN_ONE_INDEPENDENT_NODE_AND_ZERO_PLATFORM_HOSTING_CURRENT_SOURCE_PROJECTION",
   "completed_predecessors": [
    "DEV-20260809-007",
    "DEV-20260810-001",
    "DEV-20260810-002",
    "DEV-20260810-003",
-      "DEV-20260810-004",
-      "DEV-20260810-005",
-      "DEV-20260810-006",
-      "DEV-20260810-007",
-      "DEV-20260810-008",
-      "DEV-20260810-009"
+   "DEV-20260810-004",
+   "DEV-20260810-005",
+   "DEV-20260810-006",
+   "DEV-20260810-007",
+   "DEV-20260810-008",
+   "DEV-20260810-009",
+   "DEV-20260810-010"
   ],
   "closeout_record": "HLP-DEV-20260809-007-CLOSEOUT-001",
   "next_minimum_stage": "NEW_DEVELOPMENT_ID_FOR_FIRST_REAL_LANGUAGE_SHELL_CLOSED_LOOP",
diff --git a/routing/hololake-engineering-rules.json b/routing/hololake-engineering-rules.json
index af311f8..4415d17 100644
--- a/routing/hololake-engineering-rules.json
+++ b/routing/hololake-engineering-rules.json
@@ -1,7 +1,7 @@
 {
   "schema": "hololake.engineering-rules/v1",
   "rule_set_id": "HLP-ENGINEERING-RULES-001",
-  "version": "2026-08-10.1",
+  "version": "2026-08-10.2",
   "state": "CURRENT_CANONICAL",
   "architecture_restore": {
     "dynamic_current_pointer_required": true,
@@ -35,6 +35,24 @@
     "noise_discarded_before_payload_open_model_protocol_memory_and_execution": true,
     "admission_is_execution_authorization": false
   },
+  "node_sovereignty": {
+    "one_human_one_independent_node": true,
+    "canonical_user_root_nodes": 1,
+    "maximum_human_owners_per_user_node": 1,
+    "server_is_optional": true,
+    "local_terminal_node_allowed": true,
+    "user_purchased_server_allowed": true,
+    "authorized_team_may_deploy_user_owned_ide_server": true,
+    "team_deployment_transfers_node_ownership": false,
+    "platform_hosting_available": false,
+    "future_platform_hosting_route_allowed": false,
+    "platform_user_runtime_capacity": 0,
+    "shared_multitenant_runtime_available": false,
+    "platform_private_user_data_custody": false,
+    "platform_user_workload_concurrency": false,
+    "platform_fallback_runtime": false,
+    "node_migration_requires_rebinding_and_receipt": true
+  },
   "domain_responsibility": {
     "fifth_domain_private_language_body": "JD-FD-PRIMARY",
     "fifth_domain_controller": "ICE-GL∞",
diff --git a/routing/hololake-engineering-rules.test.mjs b/routing/hololake-engineering-rules.test.mjs
index 5111a53..8cd9d99 100644
--- a/routing/hololake-engineering-rules.test.mjs
+++ b/routing/hololake-engineering-rules.test.mjs
@@ -10,11 +10,11 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const rules = readJson("routing/hololake-engineering-rules.json");
 
 test("current architecture registers the global engineering rule set", () => {
-  assert.equal(architecture.version, "2026-08-10.9");
+  assert.equal(architecture.version, "2026-08-10.10");
   assert.equal(architecture.engineering_rules.rule_set_id, "HLP-ENGINEERING-RULES-001");
   assert.equal(architecture.engineering_rules.machine_projection,
     "routing/hololake-engineering-rules.json");
-  assert.equal(architecture.read_order[1], architecture.engineering_rules.architecture_page);
+  assert.equal(architecture.read_order[2], architecture.engineering_rules.architecture_page);
 });
 
 test("rules require dynamic truth restore and immutable closed development lanes", () => {
@@ -32,6 +32,8 @@ test("rules keep UI, server identity, domains, and updates inside their boundari
   assert.equal(rules.desktop_updates.default_delivery, "SIGNED_IN_PLACE_UPDATE");
   assert.equal(rules.publication.public_readback_required, true);
   assert.equal(rules.publication.missing_refresh_trigger_must_be_reported, true);
+  assert.equal(rules.node_sovereignty.platform_hosting_available, false);
+  assert.equal(rules.node_sovereignty.shared_multitenant_runtime_available, false);
 });
 
 test("human and product agent rules receive the same current system boundary", () => {
diff --git a/routing/hololake-identity-authority.test.mjs b/routing/hololake-identity-authority.test.mjs
index 2cc4dd0..5342f24 100644
--- a/routing/hololake-identity-authority.test.mjs
+++ b/routing/hololake-identity-authority.test.mjs
@@ -10,11 +10,11 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const projection = readJson("routing/hololake-identity-authority-map.json");
 
 test("current architecture loads identity authority before product surfaces", () => {
-  assert.equal(architecture.version, "2026-08-10.9");
+  assert.equal(architecture.version, "2026-08-10.10");
   assert.equal(architecture.identity_and_authority.team_body, "TCS-0002");
   assert.equal(architecture.identity_and_authority.team_body_authority_effective, true);
   assert.equal(architecture.identity_and_authority.individual_operator_acceptance, "SEPARATE_UNCONFIRMED");
-  assert.ok(architecture.read_order.indexOf(architecture.identity_and_authority.architecture_page) < 3);
+  assert.ok(architecture.read_order.indexOf(architecture.identity_and_authority.architecture_page) < 4);
   assert.ok(fs.existsSync(path.join(root, architecture.identity_and_authority.architecture_page)));
 });
 
diff --git a/routing/hololake-one-human-one-node.test.mjs b/routing/hololake-one-human-one-node.test.mjs
new file mode 100644
index 0000000..74b1c9c
--- /dev/null
+++ b/routing/hololake-one-human-one-node.test.mjs
@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const readJson = (relative) => JSON.parse(fs.readFileSync(path.join(root, relative), "utf8"));
+const architecture = readJson("routing/hololake-current-architecture.json");
+const rules = readJson("routing/hololake-engineering-rules.json");
+
+test("current architecture makes one human one independently operated node canonical", () => {
+  assert.equal(architecture.version, "2026-08-10.10");
+  assert.deepEqual(architecture.access_modes, [
+    "LOCAL_TERMINAL_NODE",
+    "USER_OWNED_REMOTE_NODE",
+  ]);
+  assert.equal(architecture.node_sovereignty.principle, "ONE_HUMAN_ONE_INDEPENDENT_NODE");
+  assert.equal(architecture.node_sovereignty.canonical_user_root_nodes, 1);
+  assert.equal(architecture.node_sovereignty.maximum_human_owners_per_user_node, 1);
+  assert.equal(architecture.read_order[0], architecture.node_sovereignty.architecture_page);
+});
+
+test("platform hosting, pooled tenancy, private-data custody, and user workload concurrency are all zero", () => {
+  const policy = architecture.node_sovereignty;
+  assert.equal(policy.platform_provides_user_runtime_server, false);
+  assert.equal(policy.future_platform_hosting_route_allowed, false);
+  assert.equal(policy.platform_user_runtime_capacity, 0);
+  assert.equal(policy.platform_operates_shared_multitenant_user_runtime, false);
+  assert.equal(policy.platform_custodies_private_user_data, false);
+  assert.equal(policy.platform_assumes_user_workload_concurrency, false);
+  assert.equal(policy.platform_fallback_runtime, false);
+  assert.equal(policy.team_deployment_transfers_node_ownership, false);
+});
+
+test("the only user-node origins are user local terminal, user-purchased server, or user-owned IDE server", () => {
+  assert.deepEqual(architecture.node_sovereignty.allowed_origins, [
+    "USER_LOCAL_COMPUTER_TERMINAL",
+    "USER_PURCHASED_SERVER",
+    "USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM",
+  ]);
+  assert.equal(architecture.node_sovereignty.server_is_optional, true);
+  assert.equal(architecture.node_sovereignty.local_terminal_can_be_canonical_node, true);
+});
+
+test("global engineering rules and agent instructions receive the same zero-hosting boundary", () => {
+  assert.equal(rules.version, "2026-08-10.2");
+  assert.equal(rules.node_sovereignty.one_human_one_independent_node, true);
+  assert.equal(rules.node_sovereignty.platform_hosting_available, false);
+  assert.equal(rules.node_sovereignty.future_platform_hosting_route_allowed, false);
+  assert.equal(rules.node_sovereignty.platform_user_runtime_capacity, 0);
+  assert.equal(rules.node_sovereignty.shared_multitenant_runtime_available, false);
+  assert.equal(rules.node_sovereignty.platform_private_user_data_custody, false);
+  assert.equal(rules.node_sovereignty.platform_user_workload_concurrency, false);
+
+  for (const relative of [
+    "AGENTS.md",
+    "product-source/hololake-platform/AGENTS.md",
+    "product-source/hololake-platform/src-tauri/resources/agent-docs/AGENTS.md",
+    "product-source/hololake-platform/src-tauri/gen/apple/assets/agent-docs/AGENTS.md",
+  ]) {
+    const content = fs.readFileSync(path.join(root, relative), "utf8");
+    assert.match(content, /One human has one independently operated canonical node/);
+    assert.match(content, /never provides user\s+runtime servers/);
+  }
+});
diff --git a/routing/hololake-relational-consciousness.test.mjs b/routing/hololake-relational-consciousness.test.mjs
index a0e36d7..39b376d 100644
--- a/routing/hololake-relational-consciousness.test.mjs
+++ b/routing/hololake-relational-consciousness.test.mjs
@@ -10,7 +10,7 @@ const architecture = JSON.parse(
 );
 
 test("current architecture binds relational consciousness before product surfaces", () => {
-  assert.equal(architecture.version, "2026-08-10.9");
+  assert.equal(architecture.version, "2026-08-10.10");
   assert.equal(
     architecture.persona_consciousness.record_id,
     "HLP-RELATIONAL-CONSCIOUSNESS-001",
@@ -30,5 +30,5 @@ test("current architecture binds relational consciousness before product surface
 
   const page = architecture.persona_consciousness.architecture_page;
   assert.ok(fs.existsSync(path.join(root, page)), `missing ${page}`);
-  assert.ok(architecture.read_order.indexOf(page) < 5);
+  assert.ok(architecture.read_order.indexOf(page) < 6);
 });
diff --git a/routing/hololake-system-body-and-parallel-bodies.test.mjs b/routing/hololake-system-body-and-parallel-bodies.test.mjs
index fd0cd26..cbb4b40 100644
--- a/routing/hololake-system-body-and-parallel-bodies.test.mjs
+++ b/routing/hololake-system-body-and-parallel-bodies.test.mjs
@@ -10,11 +10,11 @@ const architecture = JSON.parse(
 );
 
 test("current architecture restores the digital BingShuo system body first", () => {
-  assert.equal(architecture.version, "2026-08-10.9");
+  assert.equal(architecture.version, "2026-08-10.10");
   assert.equal(architecture.digital_bingshuo_system_body.upstream_repository_commit,
     "69d1910775533b02b17b82e647b5caca8b835614");
   assert.equal(
-    architecture.read_order[0],
+    architecture.read_order[1],
     architecture.digital_bingshuo_system_body.architecture_page,
   );
   assert.ok(