## 1. Server binding contract

- [x] 1.1 Add deployment-target and dedicated-Run ownership fields to domain, persistence, DTO, and safe server projections.
- [x] 1.2 Validate exclusive dedicated endpoint ownership and draft/deployment state transitions.

## 2. Secure lifecycle and control behavior

- [x] 2.1 Create target-bound drafts, reserve their dedicated Run identity, and dispatch deployment only to a registered dedicated Run.
- [x] 2.2 Build Run distributions through the deployment target while recording the reserved dedicated endpoint identity.
- [x] 2.3 Constrain component hello and revocation to the matching server-owned endpoint.

## 3. Management console workflow

- [x] 3.1 Update API types and the creation workflow to label deployment targets and save target-bound drafts.
- [x] 3.2 Guide draft operators through dedicated Run registration before deployment and update focused UI tests.

## 4. Verification

- [x] 4.1 Add backend tests for exclusive ownership, registration mismatch rejection, scoped revocation, and draft deployment gating.
- [x] 4.2 Run formatting, focused tests, full structural validation, strict OpenSpec validation, and build/type checks.