@@ -1709,6 +1709,16 @@ jobs:
       - name: S2 owen-rewrite core (guards + regressions)
         run: bash tests/rewriter_regressions.sh "$RUNNER_TEMP/s2"
 
+      # S2 step 8 — the canonical patch bundle over the same real chain, ending in
+      # `own-fix subscriptions apply`. Asserts the three-part bundle, canonical patch
+      # headers with no temp/absolute path or timestamp, the exact byte-deterministic
+      # manifest, a `git apply` round-trip that reproduces the postimage byte for byte,
+      # the mixed-action partition, the empty-patch contract, and that a refusal leaves
+      # no output. (The transport-tampering cases are pure-function tests in
+      # tests/test_patch_bundle.py — forging a report must not need a hook in the rewriter.)
+      - name: S2 step 8 — canonical patch bundle (patch + manifest + postimage)
+        run: bash tests/patch_bundle_regressions.sh "$RUNNER_TEMP/s8"
+
       # A stale preimage SHA is the one refusal worth pinning in the workflow itself: it is
       # the invariant the whole hash-bound chain rests on.
       - name: S2 owen-rewrite — a stale preimage SHA is a hard refusal
 
@@ -559,11 +559,46 @@ def _cmd_validate_plan(rest: list[str]) -> int:
     return rc
 
 
+def _cmd_apply(rest: list[str]) -> int:
+    """S2 step 8: `own-fix subscriptions apply` — the canonical patch bundle. Thin
+    orchestration only: re-run the apply gate, invoke the accepted Owen.CSharp.Rewriter
+    (as an argv vector, never a shell string), verify its transport output, and publish
+    change.patch + apply-manifest.json + postimage/ as ONE atomic bundle. No model, no o7."""
+    import shlex
+
+    from ownlang.fix_apply import ApplyError
+    from ownlang.fix_bundle import apply_bundle
+
+    flags = {"--plan", "--candidates", "--root", "--out", "--rewriter"}
+    parsed = _own_fix_parse(rest, flags, set())
+    if parsed is None:
+        return 2
+    positional, opts = parsed
+    if positional or not all(opts.get(k) for k in ("--plan", "--candidates", "--out")):
+        print("usage: own-fix subscriptions apply --plan <validated-plan.json> "
+              "--candidates <candidates.json> --root <source-root> --out <artifact-dir> "
+              "[--rewriter <owen-rewrite-command>]", file=sys.stderr)
+        return 2
+    rewriter = shlex.split(opts.get("--rewriter") or "owen-rewrite",
+                           posix=(os.name != "nt"))
+    if not rewriter:
+        print("own-fix: --rewriter is empty", file=sys.stderr)
+        return 2
+    try:
+        published = apply_bundle(opts["--plan"], opts["--candidates"],
+                                 opts.get("--root") or ".", opts["--out"], rewriter)
+    except ApplyError as exc:
+        print(f"own-fix: refuse: {exc}", file=sys.stderr)
+        return 2
+    print(f"own-fix: wrote change.patch + apply-manifest.json + postimage -> {published}")
+    return 0
+
+
 def cmd_own_fix(rest: list[str]) -> int:
-    """`own-fix subscriptions {candidates|render|validate-plan} ...`."""
+    """`own-fix subscriptions {candidates|render|validate-plan|apply} ...`."""
     if len(rest) < 2 or rest[0] != "subscriptions":
         print("usage: python -m ownlang own-fix subscriptions "
-              "{candidates|render|validate-plan} ...", file=sys.stderr)
+              "{candidates|render|validate-plan|apply} ...", file=sys.stderr)
         return 2
     verb, args = rest[1], rest[2:]
     if verb == "candidates":
@@ -572,8 +607,10 @@ def cmd_own_fix(rest: list[str]) -> int:
         return _cmd_render(args)
     if verb == "validate-plan":
         return _cmd_validate_plan(args)
+    if verb == "apply":
+        return _cmd_apply(args)
     print(f"own-fix: unknown subcommand {verb!r} "
-          "(candidates | render | validate-plan)", file=sys.stderr)
+          "(candidates | render | validate-plan | apply)", file=sys.stderr)
     return 2