@@ -0,0 +1,5 @@
+---
+"everything-dev": minor
+---
+
+The two-plane boot, staging leg (ADR 0043): the deploy train now writes the approved boot snapshot for the composition it just confirmed live — stamped with the release thin tag (when the release leg ran) and the lockfile's content digest — so restarts of the published runtime boot from the staged state instead of resolving. Non-fatal like every provenance leg. `everything-dev/snapshot`'s `bootSnapshotOf`/`BootSnapshotSchema` gain the optional `lockfileDigest` staging stamp (the identity tying an approved generation to the deployment record that named it — enforcement deferred; the strict-reader downgrade window is accepted per the ADR 0040 posture). The ADR names the contract: the control plane (registry + train + CI) produces and activates; the application runtime starts from a digest-verified artifact, converges through the watch, and stays fail-loud for fresh activations. Remote-tier staging rides the hosting adapter later (recorded seam).
@@ -0,0 +1,51 @@
+# 0043 — The two-plane boot: the control plane produces, the application runtime consumes
+
+Date: 2026-11-04
+Status: Accepted (the crossroads design; the staging leg ships in the lockfile sprint's final slice)
+
+Lineage: [ADR 0041](./0041-boot-snapshot.md) (the approved boot snapshot — restarts never resolve), [ADR 0042](./0042-composition-lockfile.md) (the composition lockfile — the frozen exact composition), [ADR 0040](./0040-registry-wire-cutover.md) (the wire the control plane writes), [ADR 0021](./0021-universal-runtime-image.md) (identity-driven boot), [ADR 0035](./0035-deploy-console-hosting-adapter.md) (the hosting adapter — where remote-tier staging lands), plan 043 (the bundle cache is a resilience artifact, never a deployment).
+
+## Context
+
+Two sprints shipped the halves of one contract without naming it. The approved boot snapshot (ADR 0041) gives restarts a verified serving state — but the boot still resolves first and falls back only on outage, and nothing writes the snapshot for a deployment that hasn't booted yet. The composition lockfile (ADR 0042) gives CI and the boot a composition identity — but nothing stages it, and the boot still re-derives remote coordinates from mutable upstream state when the registry is reachable.
+
+The architecture review's §6 names the shape these halves converge on: **discovery and execution are separate phases**. The control plane — the registry as the activation and provenance channel, the deploy train and CI as the producers — resolves, verifies, authorizes, and *produces deployment snapshots*. The application runtime starts from an approved, digest-verified artifact, serves traffic, and converges on newer activations in the background. The registry being down must shrink from "boot fails" to "fresh hosts wait; restarts serve the staged state; running hosts keep serving."
+
+## Decision
+
+**1. Two planes, explicit.**
+
+- **Control plane** — produces and activates: the registry wire (config, thin tag, version records, deploy records — activation + provenance), the deploy train and CI (build → verify → publish → **stage** → promote), the gates (`bos lock --check`, smoke, sentinel, drift alarms).
+- **Application runtime** — consumes: starts from a digest-verified approved artifact, serves, reports health and active composition, and converges on newer activations through the pointer watch. The registry is a *background freshness channel*, never a boot dependency for restarts. Fail-loud survives for **fresh activations** — a host that has never verified anything and cannot reach the registry still refuses, exactly as today.
+
+**2. The boot contract (the precedence order is unchanged; the roles are now named).**
+
+1. `--config-path` — the operator's declared truth; the watch is off; no snapshot interaction.
+2. **Registry identity** — a fresh host resolves once and *persists* (ADR 0041's writer seam); a restart during an outage serves the staged snapshot, degraded and visible.
+3. **Staged snapshot** — written by the control plane *at activation* (new, below) or by the host on adopt/cold-resolve; restarts read the staged state first-verify-then-serve, and the registry call becomes a background freshness check through the watch (which is already the convergence mechanism).
+
+**3. Staging is a train leg (the implementation slice of this ADR).** Post-confirm, the deploy train writes the approved snapshot for the runtime it just published — the same writer seam, `bootSnapshotOf` over the exact publish payload, stamped with the release thin tag when the release leg ran and with the lockfile digest (below). Single-box self-hosted runtimes get "restarts never resolve" immediately: the staged state IS the composition the train just verified and published. Remote tiers stage through the hosting adapter (ADR 0035) — recorded seam, not built.
+
+**4. Authorization escalation: the snapshot carries the lockfile digest.** `BootSnapshotSchema` gains an optional `lockfileDigest` — the train stamps it from the staged lockfile (ADR 0042 ticket 04's digest), and the deployment record named the same digest (ticket 04). Enforcement (the rung *requiring* the match when the runtime's own lockfile exists) ships later; the identity ships now. Strict-schema tradeoff, accepted at rc per the ADR 0040 posture: a snapshot written by a newer host carries a key an older host's strict reader refuses — that window is a deliberate downgrade, and the refusal is loud with the registry as the recovery path.
+
+**5. Fresh activations stay fail-loud.** No staged state, no registry → `StartFetchFailed`, unchanged. The rung serves *restarts of approved generations*; it is never a substitute for discovery, and the sentinel (nightly cold-cache) plus the smoke gate (healthy boots must carry no snapshot provenance) remain the detectors for the rung silently becoming the norm.
+
+## Consequences
+
+**Positive.**
+
+- Restarts of staged deployments never resolve — the review's end state, reached by composing the two shipped halves rather than a new mechanism.
+- The registry outage's blast radius shrinks to its true scope: fresh hosts wait, watch convergence pauses, nothing serving degrades.
+- The staging leg reuses the snapshot's writer seam — one artifact, one verification contract (fingerprint recomputation), one lifecycle (last verified generation per runtime).
+
+**Negative / accepted costs.**
+
+- Staging lifecycle grows one writer: the train writes at activation, the host re-writes on adopt — last verified generation wins, bounded at one file per runtime (unchanged from ticket 02).
+- The strict-reader downgrade window (decision 4) refuses loudly rather than stripping — consistent with the cutover's no-alias posture.
+- Remote-tier staging (hosting adapter) is future work; until then, remote restarts keep the ticket-02 behavior: resolve on boot, snapshot on outage.
+
+## References
+
+- Implementation slice: the train's staging leg + `lockfileDigest` on the snapshot (composition-lockfile sprint, crossroads slice).
+- Sprint ledgers: `.scratch/boot-snapshot/` (tickets 01–04, done), `.scratch/composition-lockfile/` (tickets 01–05, done).
+- The review's §6 (control plane vs application startup) and §2 (the lockfile as the resolution authority).
@@ -45,6 +45,7 @@ Format: context → decision → consequences, one file per decision.
 | [0040](./0040-registry-wire-cutover.md) | The registry wire cutover — thin tag + immutable records, slot→remote vocabulary | Accepted |
 | [0041](./0041-boot-snapshot.md) | The approved boot snapshot — restarts never resolve | Accepted |
 | [0042](./0042-composition-lockfile.md) | The composition lockfile — one frozen composition, everything derived | Accepted |
+| [0043](./0043-two-plane-boot.md) | The two-plane boot — the control plane produces, the application runtime consumes | Accepted |
 
 
 Skipped numbers: 0006 exists; there are no gaps otherwise. 0015–0018 were
@@ -56,7 +57,7 @@ split) was added on a side branch that never merged to main — do not reuse it.
 ## Number assignment discipline
 
 - Take the next free number (`ls docs/adr/ | sort -n | tail -1`, then +1 —
-  next free is **0043**). Never reuse a number, even for a rejected ADR.
+  next free is **0044**). Never reuse a number, even for a rejected ADR.
 - When citing an ADR in code, plans, changesets, or AGENTS.md, cite the
   number **with the filename** if the context could be ambiguous.
 - Superseded ADRs stay in place with a `Superseded by` status link to the
 
@@ -109,7 +109,7 @@ export async function publishRollbackSnapshot(
   const bootCheck = await verifyBootPayload(
     targetValue,
     { account: input.account, gateway: input.domain },
-    { ...(input.registry ? { registry: input.registry } : {}) },
+    input.registry ? { registry: input.registry } : undefined,
   );
   if (!bootCheck.ok) {
     const detail = bootCheck.issues
 
@@ -40,6 +40,7 @@ import {
   readVersionRecord,
 } from "../registry/pointer";
 import { mergeAuthoredOverPublished, stripLocalDevelopmentTargets } from "../resolution/merge";
+import { bootSnapshotOf, writeBootSnapshot } from "../snapshot/schema";
 import {
   type BuildTargetsDeps,
   type BuildTargetsInput,
@@ -727,9 +728,7 @@ export async function runPublishTrain(
     bootShape = await resolveBootShape(
       publishPayload,
       { account, gateway },
-      {
-        ...(input.registry ? { registry: input.registry } : {}),
-      },
+      input.registry ? { registry: input.registry } : undefined,
     );
   } catch {
     // KEEP: re-walked by verifyBootPayload, which owns the chain-failure report
@@ -739,9 +738,7 @@ export async function runPublishTrain(
     : await verifyBootPayload(
         publishPayload,
         { account, gateway },
-        {
-          ...(input.registry ? { registry: input.registry } : {}),
-        },
+        input.registry ? { registry: input.registry } : undefined,
       );
   if (!bootCheck.ok) {
     const detail = bootCheck.issues
@@ -836,14 +833,16 @@ export async function runPublishTrain(
   // provenance, never a gate.
   let lock: ReturnType<typeof lockfileOf> | null = null;
   let lockfileDigest: string | null = null;
+  let lockfileSerialized: string | null = null;
   try {
     lock = lockfileOf({
       account,
       gateway,
       config: publishPayload as BosConfig,
       release: (publishPayload as { release?: string }).release ?? null,
     });
-    lockfileDigest = digestOfLockfile(serializeLockfile(lock));
+    lockfileSerialized = serializeLockfile(lock);
+    lockfileDigest = digestOfLockfile(lockfileSerialized);
   } catch (error) {
     console.log(
       colors.dim(
@@ -1076,6 +1075,39 @@ export async function runPublishTrain(
     }
   };
 
+  // The staging leg (ADR 0043): the control plane writes the approved
+  // snapshot for the composition it just confirmed live, so restarts of
+  // this runtime boot from the staged state instead of resolving. Stamped
+  // with the release thin tag (when the release leg ran) and the lockfile
+  // digest (the deployment record's identity). Non-fatal, like every
+  // provenance leg — and AWAITED: a floating write settles after the caller
+  // (a test's teardown, a process exit) has removed the target dir, and the
+  // escaped rejection kills the run.
+  const stageBootSnapshot = async () => {
+    if (!lockfileSerialized) return;
+    try {
+      const manifestTag = platformManifest
+        ? ManifestTagSchema.parse(JSON.parse(platformManifest.tag.value))
+        : null;
+      await writeBootSnapshot(
+        bootSnapshotOf({
+          account,
+          gateway,
+          config: publishPayload as BosConfig,
+          manifestTag,
+          lockfileDigest: lockfileDigest ?? undefined,
+        }),
+        { dir: join(configDir, ".bos", "snapshot") },
+      );
+    } catch (error) {
+      console.log(
+        colors.dim(
+          `  Note: could not stage the boot snapshot — ${error instanceof Error ? error.message : String(error)}`,
+        ),
+      );
+    }
+  };
+
   try {
     // NOT deduped with the preflight's published-config read (#430): that
     // fetch returns the raw stored JSON, while the idempotency comparison is
@@ -1093,6 +1125,7 @@ export async function runPublishTrain(
       console.log("  Already up to date — skipping transaction");
       persistDeployState();
       persistLockfile();
+      await stageBootSnapshot();
       return {
         status: "published",
         registryUrl,
@@ -1267,6 +1300,7 @@ export async function runPublishTrain(
     }
     persistDeployState();
     persistLockfile();
+    await stageBootSnapshot();
 
     return {
       status: "published",
 
@@ -55,6 +55,13 @@ export const BootSnapshotSchema = z
     /** The registry deploy record (`deploys/<ts>.json` key) naming the publish
      * that produced the generation. */
     deployRecordKey: z.string().nullable(),
+    /** The composition lockfile's content digest (ADR 0042 ticket 04) — the
+     * control-plane staging stamp (ADR 0043): the identity that ties this
+     * approved generation to the deployment record that named it. */
+    lockfileDigest: z
+      .string()
+      .regex(/^[0-9a-f]{64}$/)
+      .optional(),
     writtenAt: z.string().min(1),
   })
   .strict();
@@ -94,6 +101,7 @@ export function bootSnapshotOf(input: {
   config: BosConfig;
   manifestTag?: { version: string; digest: string } | null;
   deployRecordKey?: string | null;
+  lockfileDigest?: string;
   writtenAt?: string;
 }): BootSnapshot {
   return BootSnapshotSchema.parse({
@@ -105,6 +113,7 @@ export function bootSnapshotOf(input: {
     config: input.config,
     remotes: pinnedRemotesOf(input.config),
     deployRecordKey: input.deployRecordKey ?? null,
+    ...(input.lockfileDigest ? { lockfileDigest: input.lockfileDigest } : {}),
     writtenAt: input.writtenAt ?? new Date().toISOString(),
   });
 }
 
@@ -207,3 +207,36 @@ describe("verifiedBootSnapshot", () => {
     );
   });
 });
+
+describe("the staging stamp (ADR 0043) — lockfileDigest on the approved snapshot", () => {
+  it("carries the control plane's staging identity through persist + load", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "boot-snapshot-stage-"));
+    const staged = bootSnapshotOf({
+      account: ACCOUNT,
+      gateway: GATEWAY,
+      config,
+      manifestTag: { version: "2.0.0-rc.37", digest: "b143bf5f" },
+      lockfileDigest: "a".repeat(64),
+    });
+    expect(staged.lockfileDigest).toBe("a".repeat(64));
+    await writeBootSnapshot(staged, { dir });
+    const loaded = parseBootSnapshot(
+      await readFile(snapshotPath(ACCOUNT, GATEWAY, { dir }), "utf8"),
+    );
+    expect(loaded.lockfileDigest).toBe("a".repeat(64));
+    expect(snapshotFingerprintMatches(loaded)).toBe(true);
+  });
+
+  it("host-written snapshots (no staging) omit the key entirely", async () => {
+    const snapshot = bootSnapshotOf({ account: ACCOUNT, gateway: GATEWAY, config });
+    expect(snapshot.lockfileDigest).toBeUndefined();
+    expect("lockfileDigest" in snapshot).toBe(false);
+  });
+
+  it("refuses a lockfileDigest that is not 64-hex", () => {
+    const snapshot = bootSnapshotOf({ account: ACCOUNT, gateway: GATEWAY, config });
+    expect(() =>
+      parseBootSnapshot(JSON.stringify({ ...snapshot, lockfileDigest: "nope" })),
+    ).toThrow();
+  });
+});
@@ -0,0 +1 @@
+/Users/elliot.braem/workspace/product/everything.dev/repos
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"everything-dev": minor
 +---
++
 +The two-plane boot, staging leg (ADR 0043): the deploy train now writes the approved boot snapshot for the composition it just confirmed live — stamped with the release thin tag (when the release leg ran) and the lockfile's content digest — so restarts of the published runtime boot from the staged state instead of resolving. Non-fatal like every provenance leg. `everything-dev/snapshot`'s `bootSnapshotOf`/`BootSnapshotSchema` gain the optional `lockfileDigest` staging stamp (the identity tying an approved generation to the deployment record that named it — enforcement deferred; the strict-reader downgrade window is accepted per the ADR 0040 posture). The ADR names the contract: the control plane (registry + train + CI) produces and activates; the application runtime starts from a digest-verified artifact, converges through the watch, and stays fail-loud for fresh activations. Remote-tier staging rides the hosting adapter later (recorded seam).
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+/Users/elliot.braem/workspace/product/everything.dev/repos`