Add health deploy apply stage

docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-> Status: draft | Updated 2026-07-05 | Applies to: AMPG core
+> Status: draft | Updated 2026-07-07 | Applies to: AMPG core
 
 AMPG is a compiler plus an ingress manager. The compiler turns one site into a
 protocol-neutral content graph, then renders protocol-specific outputs. The ingress
@@ -146,6 +146,10 @@ remain separate stages.
 transport has produced them. It writes only the AMPG address registry; health
 verification remains a separate stage.
 
+`ampg deploy apply --stage health` runs published fixture checks through the selected
+transport after addresses are configured or captured. It reports pass/fail and does not
+mutate deployment state.
+
 The dry-run command is intentionally stricter than `doctor`: missing generated output is
 blocked during activation, because AMPG must not point a transport at an unbuilt output
 root.

docs/daemon-management.md

@@ -1,6 +1,6 @@
 # Daemon Management
 
-> Status: draft | Updated 2026-07-06 | Applies to: protocol adapters
+> Status: draft | Updated 2026-07-07 | Applies to: protocol adapters
 
 AMPG can use daemons that already exist on a server or create AMPG-owned daemons when
 the selected protocol is not running. This keeps simple deployments simple while avoiding
@@ -64,6 +64,8 @@ python3 -m ampg --config gateway.toml deploy apply --stage start --dry-run --pro
 python3 -m ampg --config gateway.toml deploy apply --stage start --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml deploy apply --stage addresses --dry-run --profile mobile-i2p
 python3 -m ampg --config gateway.toml deploy apply --stage addresses --profile mobile-i2p --yes
+python3 -m ampg --config gateway.toml deploy apply --stage health --dry-run --profile mobile-i2p
+python3 -m ampg --config gateway.toml deploy apply --stage health --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml doctor --platform android-termux
 ```
 
@@ -108,6 +110,8 @@ configured, captured, derived, or placeholder. `deploy apply --stage addresses`
 `health-plan` prints fixture-based checks to run after services start. Published checks
 target real transport URLs; preview checks target local loopback preview endpoints.
 Missing output blocks the plan, while placeholder transport addresses are review items.
+`deploy apply --stage health` runs the published checks after addresses are configured or
+captured.
 
 `approvals list` prints generated artifact candidates and their digest status. `approve`
 requires `--all` or a `--kind` filter, then records approvals only for artifacts that
@@ -146,6 +150,11 @@ files, capture addresses, or run health checks.
 Live mode requires `--yes` and writes captured transport addresses under
 `gateway.state_dir`. It does not rewrite daemon config or run health checks.
 
+`deploy apply --stage health` is the fifth live apply stage. Dry-run mode prints
+`AMPG_DEPLOY_HEALTH` rows with published fixture URLs and transport commands. Live mode
+requires `--yes`, runs those commands, and reports pass/fail. It does not change daemon
+config, service state, or address registries.
+
 `--protocol` scopes operational commands to selected enabled protocols. A clearnet
 `adopt` failure will block a full activation run, but it will not block
 `apply --dry-run --protocol i2p` because clearnet is outside that selected run.

docs/fixture-manifests.md

@@ -1,6 +1,6 @@
 # Fixture Manifests
 
-> Status: draft | Updated 2026-07-06 | Applies to: AMPG and AMPB compatibility checks
+> Status: draft | Updated 2026-07-07 | Applies to: AMPG and AMPB compatibility checks
 
 AMPG writes deterministic fixture manifests so AMPB can verify that generated site
 variants route to the expected browser transport and profile.
@@ -38,6 +38,7 @@ python3 -m ampg --config examples/wownero.gateway.toml addresses capture --profi
 python3 -m ampg --config examples/wownero.gateway.toml preview manifest
 python3 -m ampg --config examples/wownero.gateway.toml health-plan
 python3 -m ampg --config examples/wownero.gateway.toml health-plan --mode preview
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage health --dry-run --profile mobile-i2p
 ```
 
 `build` emits the manifest after writing protocol outputs. `manifest` rewrites only the
@@ -56,6 +57,8 @@ real Tor, I2P, Gemini, or other transport daemons are installed or adopted.
 
 `health-plan` consumes the same fixture contract. Published mode prints checks for real
 transport URLs. Preview mode prints loopback checks against generated preview URLs.
+`deploy apply --stage health` runs the published checks after transport addresses are
+configured or captured.
 
 ## Address Status
 
@@ -66,8 +69,9 @@ verify transport selection without contacting the network.
 When a managed or adopted daemon writes an actual address, run
 `deploy apply --stage addresses --dry-run` before recording it. Captured addresses are
 stored under `gateway.state_dir` and replace placeholders in fixture manifests and
-published health plans. Operators can also use `addresses capture` for a direct write or
-`addresses set` to store an address manually.
+published health plans. Operators can then run `deploy apply --stage health --dry-run`
+to review the exact transport checks before live verification. Operators can also use
+`addresses capture` for a direct write or `addresses set` to store an address manually.
 
 ## Interaction Policy
 

docs/wownero-integration.md

@@ -1,6 +1,6 @@
 # Wownero Integration
 
-> Status: draft | Updated 2026-07-05 | Applies to: Wownero static site publishing
+> Status: draft | Updated 2026-07-07 | Applies to: Wownero static site publishing
 
 The Wownero integration exercises AMPG against a real public static site. The source is
 the existing `wownero.org` website checked out next to this repository as
@@ -141,8 +141,9 @@ daemon_policy = "auto"
 - `ampg build` writes a fixture manifest that AMPB can check.
 - `ampg preview manifest` writes loopback fixture URLs that AMPB can check before live
   transport daemons are installed or adopted.
-- `ampg deploy apply --stage state`, `--stage supervisor`, `--stage start`, and
-  `--stage addresses` stage Wownero transport publication without mixing concerns.
+- `ampg deploy apply --stage state`, `--stage supervisor`, `--stage start`,
+  `--stage addresses`, and `--stage health` stage Wownero transport publication without
+  mixing concerns.
 - Tor output contains no `<script>` tags or inline event handlers.
 - Generated Gemini output has readable headings, paragraphs, and links.
 - Generated Micron output fits terminal-first browsing.
@@ -168,6 +169,7 @@ python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage stat
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage supervisor --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage start --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage addresses --dry-run --profile mobile-i2p
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage health --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/i2p-only.gateway.toml plan
 python3 -m ampg --config examples/i2p-only.gateway.toml build
 ```
@@ -182,3 +184,4 @@ python3 -m ampg --config examples/i2p-only.gateway.toml build
 - [ ] Enable I2P and Reticulum daemon management only after static outputs are stable.
 - [ ] Start only AMPG-owned Wownero transport services after reviewed files are applied.
 - [ ] Capture Wownero transport addresses before published health checks.
+- [ ] Run published health checks through each selected transport.