Add start stage deploy apply

docs/architecture.md

@@ -136,8 +136,11 @@ the same approved artifact plan, refuses missing, stale, or unapproved inputs, a
 only approved generated daemon config into AMPG-owned state.
 
 `ampg deploy apply --stage supervisor` installs approved AMPG-named supervisor files
-after the state files they reference exist. It does not start or reload services; daemon
-start, address capture, and health verification remain separate stages.
+after the state files they reference exist. It does not start or reload services.
+
+`ampg deploy apply --stage start` runs structured platform start commands for AMPG-named
+services after state and supervisor files exist. Address capture and health verification
+remain separate stages.
 
 The dry-run command is intentionally stricter than `doctor`: missing generated output is
 blocked during activation, because AMPG must not point a transport at an unbuilt output

docs/daemon-management.md

@@ -60,6 +60,8 @@ python3 -m ampg --config gateway.toml deploy apply --stage state --dry-run --pro
 python3 -m ampg --config gateway.toml deploy apply --stage state --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml deploy apply --stage supervisor --dry-run --profile mobile-i2p
 python3 -m ampg --config gateway.toml deploy apply --stage supervisor --profile mobile-i2p --yes
+python3 -m ampg --config gateway.toml deploy apply --stage start --dry-run --profile mobile-i2p
+python3 -m ampg --config gateway.toml deploy apply --stage start --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml doctor --platform android-termux
 ```
 
@@ -131,6 +133,12 @@ artifacts, requires the state stage to have copied managed config first, and wri
 AMPG-named service files for the selected platform. It does not install packages, start
 services, reload service managers, or delete service files.
 
+`deploy apply --stage start` is the third live apply stage. Dry-run mode prints
+`AMPG_DEPLOY_START` rows with exact service-manager commands. Live mode requires `--yes`,
+requires both state and supervisor files to exist, and runs only structured platform
+commands for AMPG-named services. It does not install packages, rewrite config, remove
+files, capture addresses, or run health checks.
+
 `--protocol` scopes operational commands to selected enabled protocols. A clearnet
 `adopt` failure will block a full activation run, but it will not block
 `apply --dry-run --protocol i2p` because clearnet is outside that selected run.

docs/state-contract.md

@@ -55,5 +55,9 @@ capture, and published health checks for later stages.
 
 `deploy apply --stage supervisor` performs the approved supervisor-file installation
 portion only. It requires copied managed state config first, writes AMPG-named service
-files for the selected platform, and leaves service-manager reload/start commands for a
-later explicit stage.
+files for the selected platform, and leaves service-manager start commands for the next
+explicit stage.
+
+`deploy apply --stage start` runs the service-manager start commands for AMPG-named
+services only after required state and supervisor files exist. It does not write or
+delete state files.

docs/wownero-integration.md

@@ -141,8 +141,8 @@ daemon_policy = "auto"
 - `ampg build` writes a fixture manifest that AMPB can check.
 - `ampg preview manifest` writes loopback fixture URLs that AMPB can check before live
   transport daemons are installed or adopted.
-- `ampg deploy apply --stage state --dry-run` and `--stage supervisor --dry-run` show
-  approved managed-daemon files before any Wownero transport service is started.
+- `ampg deploy apply --stage state`, `--stage supervisor`, and `--stage start` stage
+  Wownero transport services without mixing config writes and service start.
 - Tor output contains no `<script>` tags or inline event handlers.
 - Generated Gemini output has readable headings, paragraphs, and links.
 - Generated Micron output fits terminal-first browsing.
@@ -166,6 +166,7 @@ python3 -m ampg --config examples/wownero.gateway.toml approvals list --profile
 python3 -m ampg --config examples/wownero.gateway.toml approvals approve --profile mobile-i2p --all
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage state --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage supervisor --dry-run --profile mobile-i2p
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage start --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/i2p-only.gateway.toml plan
 python3 -m ampg --config examples/i2p-only.gateway.toml build
 ```
@@ -178,4 +179,4 @@ python3 -m ampg --config examples/i2p-only.gateway.toml build
 - [ ] Add Gemini conversion fixtures.
 - [ ] Add Reticulum/Micron conversion fixtures.
 - [ ] Enable I2P and Reticulum daemon management only after static outputs are stable.
-- [ ] Copy only reviewed Wownero daemon and supervisor artifacts before service start.
+- [ ] Start only AMPG-owned Wownero transport services after reviewed files are applied.