Owner approval, step by step

Installing a realm grants it nothing. Every capability is a separate owner approval, and every approval names the installation revision the owner read; a stale revision answers 409 and changes nothing. This is what the owner walks through, in order, and what each step unlocks. All routes are under /api/v1.

Step	Route	Unlocks
1. The operator turns the realm runtime on	host setting	Captured realms run at all.
2. Install the realm	the host’s install tools	The host loads it and takes a verified copy.
3. Preview	POST /handlers/realms/{realm}/admission/preview with {}	Shows what the capture declares and its digest.
4. Adopt	POST /handlers/realms/{realm}/admission/adopt with {previewDigest, expectedRevision, handlers}	Approves the ticked handlers and creates the installation.
5. API operations	/handlers/realms/{realm}/api-approvals/{operation}/grant	Each read or write operation.
6. Graph read and view aliases	/realms/{realm}/resource-approvals/{resource}/grant	cypher_query, and each view alias on its own.
7. Credentials	/channels/credentials/{realm}/{credential}/bind	Binds a secret to a declared credential. Nothing that needs it starts before.
8. Sources	/channels/sources/{realm}/{source}/grant	Publication to the source.
9. Consumers	/channels/consumers/{realm}/{consumer}/grant	Delivery of one exact source to the consumer.
10. Assistant and pairing	/channels/consumers/{realm}/{consumer}/assistant/grant, /pairing	ctx.assistant.chat for that consumer, and each paired sender.
11. Channels	/channels/captured/{realm}/{channel}/start	The host opens the connection. A websocket handshake has its own grant.
12. Apps	/realm-browser/{realm}/approvals/{app}/grant	The page at /apps/{realm}/{app}.
13. Watches	/realms/{realm}/watch-approvals/{watch}/grant	Scheduled runs; /realms/{realm}/watches/{watch}/check-now runs one on demand.
14. Write proposals	through admission, with the other resources	ctx.writePropose; decisions at /realms/{realm}/proposals.

Upgrading (POST /handlers/realms/{realm}/admission/upgrade) admits a new capture and keeps the approvals it still asks for. Every approval, upgrade and revocation moves the installation to a new revision, and an invocation keeps the authority it started with: a newer approval never widens a call already running, and a revocation stops the next host call. Revoking the installation (.../admission/revoke) closes its channels and makes its pending proposals unusable.