Add state stage deploy apply

docs/architecture.md

@@ -131,6 +131,12 @@ managed state and planned supervisor start/reload actions. The command emits an
 Blocked or unapproved preflight items stop mutation before any live apply path can touch
 services.
 
+`ampg deploy apply --stage state` is the narrow live stage for managed state. It reads
+the same approved artifact plan, refuses missing, stale, or unapproved inputs, and copies
+only approved generated daemon config into AMPG-owned state. Service installation,
+supervisor registration, daemon start, address capture, and health verification remain
+separate stages.
+
 The dry-run command is intentionally stricter than `doctor`: missing generated output is
 blocked during activation, because AMPG must not point a transport at an unbuilt output
 root.

docs/daemon-management.md

@@ -55,6 +55,8 @@ python3 -m ampg --config gateway.toml apply --dry-run --protocol i2p
 python3 -m ampg --config gateway.toml apply --dry-run --write-artifacts
 python3 -m ampg --config gateway.toml approvals list --profile mobile-i2p
 python3 -m ampg --config gateway.toml approvals approve --profile mobile-i2p --all
+python3 -m ampg --config gateway.toml deploy apply --stage state --dry-run --profile mobile-i2p
+python3 -m ampg --config gateway.toml deploy apply --stage state --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml doctor --platform android-termux
 ```
 
@@ -112,6 +114,12 @@ reviewable config snippets to the configured plan root, then prints the copies f
 approved artifacts into `gateway.state_dir` and the supervisor services that would be
 registered or started. It still does not install or reload services.
 
+`deploy apply --stage state` is the first live apply stage. Dry-run mode prints
+`AMPG_DEPLOY_STATE` rows. Live mode requires `--yes`, refuses unapproved or stale
+artifacts, creates AMPG-owned state directories, and copies approved managed-daemon
+config into `gateway.state_dir`. It does not install packages, edit adopted daemon
+configs, start services, or delete identity material.
+
 `--protocol` scopes operational commands to selected enabled protocols. A clearnet
 `adopt` failure will block a full activation run, but it will not block
 `apply --dry-run --protocol i2p` because clearnet is outside that selected run.

docs/state-contract.md

@@ -46,5 +46,9 @@ AMPG must never delete sensitive contract paths without an explicit destructive
 approved artifacts would be copied into managed state and `AMPG_APPLY_SUPERVISOR` rows
 for the services that would be registered or started. The accompanying
 `AMPG_APPLY_PREFLIGHT` verdict includes those rows so live apply can refuse mutation when
-state or supervisor inputs still need review. Live apply should perform approved copies,
-start daemons, capture public addresses, and then run published health checks.
+state or supervisor inputs still need review.
+
+`deploy apply --stage state` performs the approved copy portion only. It requires
+`--yes` for live writes, refuses unapproved or stale artifacts, writes only under
+`gateway.state_dir`, and leaves daemon start, address capture, and published health
+checks for later stages.

docs/wownero-integration.md

@@ -141,6 +141,8 @@ daemon_policy = "auto"
 - `ampg build` writes a fixture manifest that AMPB can check.
 - `ampg preview manifest` writes loopback fixture URLs that AMPB can check before live
   transport daemons are installed or adopted.
+- `ampg deploy apply --stage state --dry-run` shows approved managed-daemon config copies
+  before any Wownero transport service is started.
 - Tor output contains no `<script>` tags or inline event handlers.
 - Generated Gemini output has readable headings, paragraphs, and links.
 - Generated Micron output fits terminal-first browsing.
@@ -158,6 +160,10 @@ python3 -m ampg --config examples/wownero.gateway.toml manifest
 python3 -m ampg --config examples/wownero.gateway.toml addresses list
 python3 -m ampg --config examples/wownero.gateway.toml preview endpoints
 python3 -m ampg --config examples/wownero.gateway.toml preview manifest
+python3 -m ampg --config examples/wownero.gateway.toml install-plan --profile mobile-i2p --write-artifacts
+python3 -m ampg --config examples/wownero.gateway.toml approvals list --profile mobile-i2p
+python3 -m ampg --config examples/wownero.gateway.toml approvals approve --profile mobile-i2p --all
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage state --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/i2p-only.gateway.toml plan
 python3 -m ampg --config examples/i2p-only.gateway.toml build
 ```
@@ -170,3 +176,4 @@ python3 -m ampg --config examples/i2p-only.gateway.toml build
 - [ ] Add Gemini conversion fixtures.
 - [ ] Add Reticulum/Micron conversion fixtures.
 - [ ] Enable I2P and Reticulum daemon management only after static outputs are stable.
+- [ ] Copy only reviewed Wownero daemon artifacts into managed state.