Add supervisor stage deploy apply

docs/architecture.md

@@ -133,9 +133,11 @@ services.
 
 `ampg deploy apply --stage state` is the narrow live stage for managed state. It reads
 the same approved artifact plan, refuses missing, stale, or unapproved inputs, and copies
-only approved generated daemon config into AMPG-owned state. Service installation,
-supervisor registration, daemon start, address capture, and health verification remain
-separate stages.
+only approved generated daemon config into AMPG-owned state.
+
+`ampg deploy apply --stage supervisor` installs approved AMPG-named supervisor files
+after the state files they reference exist. It does not start or reload services; daemon
+start, address capture, and health verification remain separate stages.
 
 The dry-run command is intentionally stricter than `doctor`: missing generated output is
 blocked during activation, because AMPG must not point a transport at an unbuilt output

docs/daemon-management.md

@@ -58,6 +58,8 @@ python3 -m ampg --config gateway.toml approvals list --profile mobile-i2p
 python3 -m ampg --config gateway.toml approvals approve --profile mobile-i2p --all
 python3 -m ampg --config gateway.toml deploy apply --stage state --dry-run --profile mobile-i2p
 python3 -m ampg --config gateway.toml deploy apply --stage state --profile mobile-i2p --yes
+python3 -m ampg --config gateway.toml deploy apply --stage supervisor --dry-run --profile mobile-i2p
+python3 -m ampg --config gateway.toml deploy apply --stage supervisor --profile mobile-i2p --yes
 python3 -m ampg --config gateway.toml doctor --platform android-termux
 ```
 
@@ -123,6 +125,12 @@ artifacts, creates AMPG-owned state directories, and copies approved managed-dae
 config into `gateway.state_dir`. It does not install packages, edit adopted daemon
 configs, start services, or delete identity material.
 
+`deploy apply --stage supervisor` is the second live apply stage. Dry-run mode prints
+`AMPG_DEPLOY_SUPERVISOR` rows. Live mode requires `--yes`, refuses unapproved or stale
+artifacts, requires the state stage to have copied managed config first, and writes
+AMPG-named service files for the selected platform. It does not install packages, start
+services, reload service managers, or delete service files.
+
 `--protocol` scopes operational commands to selected enabled protocols. A clearnet
 `adopt` failure will block a full activation run, but it will not block
 `apply --dry-run --protocol i2p` because clearnet is outside that selected run.

docs/state-contract.md

@@ -50,5 +50,10 @@ state or supervisor inputs still need review.
 
 `deploy apply --stage state` performs the approved copy portion only. It requires
 `--yes` for live writes, refuses unapproved or stale artifacts, writes only under
-`gateway.state_dir`, and leaves daemon start, address capture, and published health
-checks for later stages.
+`gateway.state_dir`, and leaves supervisor file installation, daemon start, address
+capture, and published health checks for later stages.
+
+`deploy apply --stage supervisor` performs the approved supervisor-file installation
+portion only. It requires copied managed state config first, writes AMPG-named service
+files for the selected platform, and leaves service-manager reload/start commands for a
+later explicit stage.

docs/wownero-integration.md

@@ -141,8 +141,8 @@ daemon_policy = "auto"
 - `ampg build` writes a fixture manifest that AMPB can check.
 - `ampg preview manifest` writes loopback fixture URLs that AMPB can check before live
   transport daemons are installed or adopted.
-- `ampg deploy apply --stage state --dry-run` shows approved managed-daemon config copies
-  before any Wownero transport service is started.
+- `ampg deploy apply --stage state --dry-run` and `--stage supervisor --dry-run` show
+  approved managed-daemon files before any Wownero transport service is started.
 - Tor output contains no `<script>` tags or inline event handlers.
 - Generated Gemini output has readable headings, paragraphs, and links.
 - Generated Micron output fits terminal-first browsing.
@@ -165,6 +165,7 @@ python3 -m ampg --config examples/wownero.gateway.toml install-plan --profile mo
 python3 -m ampg --config examples/wownero.gateway.toml approvals list --profile mobile-i2p
 python3 -m ampg --config examples/wownero.gateway.toml approvals approve --profile mobile-i2p --all
 python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage state --dry-run --profile mobile-i2p
+python3 -m ampg --config examples/wownero.gateway.toml deploy apply --stage supervisor --dry-run --profile mobile-i2p
 python3 -m ampg --config examples/i2p-only.gateway.toml plan
 python3 -m ampg --config examples/i2p-only.gateway.toml build
 ```
@@ -177,4 +178,4 @@ python3 -m ampg --config examples/i2p-only.gateway.toml build
 - [ ] Add Gemini conversion fixtures.
 - [ ] Add Reticulum/Micron conversion fixtures.
 - [ ] Enable I2P and Reticulum daemon management only after static outputs are stable.
-- [ ] Copy only reviewed Wownero daemon artifacts into managed state.
+- [ ] Copy only reviewed Wownero daemon and supervisor artifacts before service start.