fix: enforce one human one independent node

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -1,5 +1,18 @@
 # Architecture
 
+## User-node sovereignty
+
+HoloLake has no platform-hosted user runtime. Each human has one canonical, independently operated node:
+either a `LOCAL_TERMINAL_NODE` on their own computer or a `USER_OWNED_REMOTE_NODE` on a server they own or
+purchase. A user may explicitly authorize the Guanghu team to deploy to the user's own IDE server, but that
+assistance never transfers ownership or data custody. Servers are optional; the local terminal is a complete
+canonical node.
+
+Guanghu provides zero runtime servers for users, has no pooled multi-tenant node, does not custody private
+user data, and does not absorb user workload concurrency. If the user's node is offline, that user's runtime
+is offline. Migration is a receipt-backed rebind of the single canonical root, not duplication. The machine
+contract is `src/lib/domainRuntimeContract.ts`; see [ADR 0174](./adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md).
+
 ## Hot-pluggable language-shell UI
 
 The language shell accepts a complete declarative UI package through

product-source/hololake-platform/docs/adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md

@@ -0,0 +1,41 @@
+---
+status: accepted
+date: 2026-08-10
+---
+
+# ADR 0174: One human, one independently operated node, and zero platform hosting
+
+## Context
+
+Earlier HoloLake documents used names such as `CLOUD_RESIDENT_NODE`, shared-node descriptions, and
+platform-adjacent relay language. Those names left room to reinterpret an independently operated user node
+as a Guanghu-hosted account or as a multi-tenant runtime. Repeated natural-language corrections did not
+become a single machine-enforced invariant, so stale descriptions could reintroduce the wrong architecture.
+
+## Decision
+
+Each human has exactly one canonical, independently operated user node. That node runs in one of two modes:
+
+1. `LOCAL_TERMINAL_NODE` on the user's own computer; or
+2. `USER_OWNED_REMOTE_NODE` on a server owned or purchased by that user.
+
+A remote node may be deployed by the Guanghu team only after the user explicitly authorizes deployment to
+that user's own IDE server. Deployment assistance does not transfer ownership, custody, or operational
+responsibility to Guanghu.
+
+Guanghu provides zero user runtime servers, exposes no hosted-runtime tier, and does not place multiple
+users on a pooled platform node. Guanghu does not custody private user data and does not absorb user workload
+concurrency. Public routing metadata and software distribution are not user runtime hosting.
+
+A server is optional. If a user's canonical node is offline, that user's runtime is offline; there is no
+platform fallback. Moving the canonical node is a receipt-backed rebind, not the creation of a second root.
+
+## Consequences
+
+- Product and protocol surfaces must not advertise a Guanghu-hosted or shared multi-tenant user runtime.
+- `CLOUD_RESIDENT_NODE` and shared-node aliases are rejected by the current runtime contract.
+- Team-assisted deployment always targets a user-owned node and remains explicitly authorized.
+- Availability and concurrency stay within the capacity and control of each user's node.
+- Historical source quotations remain historical evidence, but current architecture, routing, runtime, and
+  generated agent instructions all follow this decision.
+

product-source/hololake-platform/docs/adr/README.md

@@ -224,3 +224,4 @@ proposed → active → superseded
 | [0170](0170-hololake-inherits-guanghu-native-quality-authority.md) | HoloLake inherits the Guanghu native quality authority | accepted |
 | [0171](0171-guanghu-protocols-are-automatic-runtime-and-engineering-laws.md) | Guanghu protocols are automatic runtime and engineering laws | accepted |
 | [0172](0172-guanghu-cognitive-control-with-linux-execution-substrate.md) | Guanghu cognitive control with a constrained Linux execution substrate | accepted; supersedes ADR-0161 production path |
+| [0174](0174-one-human-one-independent-node-and-zero-platform-hosting.md) | One human, one independently operated node, and zero platform hosting | accepted |