Add address capture deploy apply stage

docs/architecture.md

@@ -142,6 +142,10 @@ after the state files they reference exist. It does not start or reload services
 services after state and supervisor files exist. Address capture and health verification
 remain separate stages.
 
+`ampg deploy apply --stage addresses` records daemon-written public addresses after the
+transport has produced them. It writes only the AMPG address registry; health
+verification remains a separate stage.
+
 The dry-run command is intentionally stricter than `doctor`: missing generated output is
 blocked during activation, because AMPG must not point a transport at an unbuilt output
 root.

docs/daemon-management.md

@@ -62,6 +62,8 @@ python3 -m ampg --config gateway.toml deploy apply --stage supervisor --dry-run
 python3 -m ampg --config gateway.toml deploy apply --stage supervisor --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml deploy apply --stage start --dry-run --profile mobile-i2p
 python3 -m ampg --config gateway.toml deploy apply --stage start --profile mobile-i2p --yes
+python3 -m ampg --config gateway.toml deploy apply --stage addresses --dry-run --profile mobile-i2p
+python3 -m ampg --config gateway.toml deploy apply --stage addresses --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml doctor --platform android-termux
 ```
 
@@ -99,9 +101,9 @@ daemon-written addresses under `gateway.state_dir`.
 which paths are AMPG-owned, daemon-written, required, or sensitive.
 
 `addresses list` prints the effective public address for each enabled protocol:
-configured, captured, derived, or placeholder. `addresses capture` reads daemon-written
-address files from AMPG state or a protocol `address_file` override, then updates the
-address registry under `state_dir`.
+configured, captured, derived, or placeholder. `deploy apply --stage addresses` and
+`addresses capture` read daemon-written address files from AMPG state or a protocol
+`address_file` override, then update the address registry under `state_dir`.
 
 `health-plan` prints fixture-based checks to run after services start. Published checks
 target real transport URLs; preview checks target local loopback preview endpoints.
@@ -139,6 +141,11 @@ requires both state and supervisor files to exist, and runs only structured plat
 commands for AMPG-named services. It does not install packages, rewrite config, remove
 files, capture addresses, or run health checks.
 
+`deploy apply --stage addresses` is the fourth live apply stage. Dry-run mode prints
+`AMPG_DEPLOY_ADDRESS` rows for configured, skipped, missing, and capturable addresses.
+Live mode requires `--yes` and writes captured transport addresses under
+`gateway.state_dir`. It does not rewrite daemon config or run health checks.
+
 `--protocol` scopes operational commands to selected enabled protocols. A clearnet
 `adopt` failure will block a full activation run, but it will not block
 `apply --dry-run --protocol i2p` because clearnet is outside that selected run.

docs/fixture-manifests.md

@@ -33,6 +33,7 @@ or deployment notes.
 python3 -m ampg --config examples/wownero.gateway.toml build
 python3 -m ampg --config examples/wownero.gateway.toml manifest
 python3 -m ampg --config examples/wownero.gateway.toml addresses list
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage addresses --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml addresses capture --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml preview manifest
 python3 -m ampg --config examples/wownero.gateway.toml health-plan
@@ -62,10 +63,11 @@ Some transports may not have final public addresses when a fixture is generated.
 cases AMPG uses route-valid placeholders such as `http://wownero.onion/` so AMPB can still
 verify transport selection without contacting the network.
 
-When a managed or adopted daemon writes an actual address, run `addresses capture`.
-Captured addresses are stored under `gateway.state_dir` and replace placeholders in
-fixture manifests and published health plans. Operators can also use `addresses set` to
-store an address manually.
+When a managed or adopted daemon writes an actual address, run
+`deploy apply --stage addresses --dry-run` before recording it. Captured addresses are
+stored under `gateway.state_dir` and replace placeholders in fixture manifests and
+published health plans. Operators can also use `addresses capture` for a direct write or
+`addresses set` to store an address manually.
 
 ## Interaction Policy
 

docs/state-contract.md

@@ -61,3 +61,7 @@ explicit stage.
 `deploy apply --stage start` runs the service-manager start commands for AMPG-named
 services only after required state and supervisor files exist. It does not write or
 delete state files.
+
+`deploy apply --stage addresses` reads daemon-written address files from the state
+contract and writes captured public addresses to `addresses.json` under
+`gateway.state_dir`.

docs/wownero-integration.md

@@ -141,8 +141,8 @@ daemon_policy = "auto"
 - `ampg build` writes a fixture manifest that AMPB can check.
 - `ampg preview manifest` writes loopback fixture URLs that AMPB can check before live
   transport daemons are installed or adopted.
-- `ampg deploy apply --stage state`, `--stage supervisor`, and `--stage start` stage
-  Wownero transport services without mixing config writes and service start.
+- `ampg deploy apply --stage state`, `--stage supervisor`, `--stage start`, and
+  `--stage addresses` stage Wownero transport publication without mixing concerns.
 - Tor output contains no `<script>` tags or inline event handlers.
 - Generated Gemini output has readable headings, paragraphs, and links.
 - Generated Micron output fits terminal-first browsing.
@@ -167,6 +167,7 @@ python3 -m ampg --config examples/wownero.gateway.toml approvals approve --profi
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage state --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage supervisor --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage start --dry-run --profile mobile-i2p
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage addresses --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/i2p-only.gateway.toml plan
 python3 -m ampg --config examples/i2p-only.gateway.toml build
 ```
@@ -180,3 +181,4 @@ python3 -m ampg --config examples/i2p-only.gateway.toml build
 - [ ] Add Reticulum/Micron conversion fixtures.
 - [ ] Enable I2P and Reticulum daemon management only after static outputs are stable.
 - [ ] Start only AMPG-owned Wownero transport services after reviewed files are applied.
+- [ ] Capture Wownero transport addresses before published health checks.