Implement verified OCI prepared-lower lifecycle

docs/schema.md

@@ -1061,11 +1061,22 @@ classDiagram
         operation_id
         expected_artifact_id
         source_identity
+        selected_manifest_digest
+        policy_id
+        id_map_digest
         stage_path
+        stage_state
         device
         inode
     }
 
+    class PrepareStageState {
+        <<serialized>>
+        <<enumeration>>
+        Intent
+        Owned
+    }
+
     StorageCatalog "1" *-- "1" StoreMetadata
     StorageCatalog "1" *-- "0..*" PreparedArtifact
     StorageCatalog "1" *-- "0..*" ArtifactLease
@@ -1073,8 +1084,14 @@ classDiagram
     PreparedArtifact --> ArtifactState
     PreparedArtifact "1" --> "0..*" ArtifactLease
     PrepareOperation "0..*" --> "0..1" PreparedArtifact : publishes
+    PrepareOperation --> PrepareStageState
 ```
 
+A prepare operation is durably recorded with `stage_state=Intent` and absent
+device/inode evidence before its stage is created. The exact same operation then
+moves to `Owned` with both values present. Only an owned operation can publish or
+authorize exact abandoned-stage recovery.
+
 An artifact lease identifies one prepared artifact, Domain, and generation. Its
 Domain and generation fields correspond to a Domain Store generation; the stores
 do not form one transactional database.