diff --git a/Cargo.lock b/Cargo.lock
index 1e3447237..f267e499f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -853,6 +853,7 @@ dependencies = [
  "contextful-sync",
  "contextful-wasm",
  "ed25519-dalek",
+ "hmac 0.12.1",
  "jsonwebtoken",
  "proptest",
  "proptest-state-machine",
diff --git a/apps/console/src/control.ts b/apps/console/src/control.ts
new file mode 100644
index 000000000..543bcb084
--- /dev/null
+++ b/apps/console/src/control.ts
@@ -0,0 +1,67 @@
+import type { ConsoleAdapters } from "./index.ts";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+
+type ControlStore = { id: string; endpoint: string };
+type ControlOptions = { stores: ControlStore[]; capability?: string; attestationSecret?: string; fetcher?: typeof fetch };
+
+function unavailable(): never {
+  throw new Error("ConsoleAdapterUnavailable");
+}
+
+function selected(stores: ControlStore[], id: string | null): ControlStore {
+  if (id !== null) {
+    const store = stores.find((candidate) => candidate.id === id);
+    if (store) return store;
+    throw new Error("ConsoleStoreUnknown");
+  }
+  if (stores.length === 1) return stores[0];
+  throw new Error("ConsoleStoreSelectionRequired");
+}
+
+function controlDocument(document: unknown, editing: boolean): { store: string | null; body: { expected: number; document?: string; nonce?: string } } {
+  if (document === null || typeof document !== "object" || Array.isArray(document)) throw new Error("ConsoleRequestMalformed");
+  const value = document as Record<string, unknown>;
+  if (value.store !== undefined && typeof value.store !== "string") throw new Error("ConsoleRequestMalformed");
+  if (!Number.isSafeInteger(value.expected) || (value.expected as number) < 1) throw new Error("ConsoleRequestMalformed");
+  if (editing && typeof value.document !== "string") throw new Error("ConsoleRequestMalformed");
+  if (!editing && (typeof value.nonce !== "string" || !/^[0-9a-f]{48}$/.test(value.nonce))) throw new Error("ConsoleRequestMalformed");
+  const keys = Object.keys(value);
+  if (keys.some((key) => key !== "store" && key !== "expected" && (key !== "document" || !editing) && (key !== "nonce" || editing))) throw new Error("ConsoleRequestMalformed");
+  return { store: typeof value.store === "string" ? value.store : null,
+    body: editing ? { expected: value.expected as number, document: value.document as string } : { expected: value.expected as number, nonce: value.nonce as string } };
+}
+
+export function createLiveControl({ stores, capability, attestationSecret, fetcher = fetch }: ControlOptions): ConsoleAdapters["control"] {
+  async function call(store: ControlStore, path: string, token: string, body?: object, subject?: string): Promise<unknown> {
+    const serialized = body ? JSON.stringify(body) : undefined;
+    const headers: Record<string, string> = { Authorization: `Bearer ${token}`, ...(body ? { "Content-Type": "application/json" } : {}) };
+    if (body && subject && attestationSecret) {
+      const timestamp = Math.floor(Date.now() / 1000).toString();
+      const nonce = randomBytes(16).toString("hex");
+      const digest = createHash("sha256").update(serialized!).digest("hex");
+      const signature = createHmac("sha256", attestationSecret).update(`POST\n${path}\n${digest}\n${subject}\n${timestamp}\n${nonce}`).digest("hex");
+      Object.assign(headers, { "X-Contextful-Operator": subject, "X-Contextful-Operator-Time": timestamp, "X-Contextful-Operator-Nonce": nonce, "X-Contextful-Operator-Signature": signature });
+    }
+    const response = await fetcher(new URL(path, store.endpoint), {
+      method: body ? "POST" : "GET",
+      headers,
+      ...(serialized ? { body: serialized } : {}),
+    });
+    if (!response.ok) throw new Error(`ConsoleControlRefused:${response.status}`);
+    return response.json();
+  }
+  return {
+    workflows: async (_operator, id) => capability ? call(selected(stores, id), "/control/workflows", capability) : unavailable(),
+    record: async (_operator, id) => capability ? call(selected(stores, id), "/control/record", capability) : unavailable(),
+    edit: async (document, token, operator) => {
+      if (!capability || token !== capability) return unavailable();
+      const input = controlDocument(document, true);
+      return call(selected(stores, input.store), "/control/edit", token, input.body, operator.subject);
+    },
+    apply: async (document, token, operator) => {
+      if (!capability || token !== capability) return unavailable();
+      const input = controlDocument(document, false);
+      return call(selected(stores, input.store), "/control/apply", token, input.body, operator.subject);
+    },
+  };
+}
diff --git a/apps/console/src/entry.ts b/apps/console/src/entry.ts
index bfe23b4c7..e4b16f7eb 100644
--- a/apps/console/src/entry.ts
+++ b/apps/console/src/entry.ts
@@ -5,6 +5,7 @@ import { registryFromEnv } from "../../gateway/src/index.ts";
 import { createLiveAnswer } from "./answer_live.ts";
 import { createLiveBrowse } from "./live_browse.ts";
 import type { ConsoleAdapters, Identity } from "./index.ts";
+import { createLiveControl } from "./control.ts";
 import { serveConsole } from "./server.ts";
 
 type HostedAdapters = Pick<ConsoleAdapters, "turn" | "control"> &
@@ -95,6 +96,8 @@ async function main(): Promise<void> {
     brief: live?.brief,
     briefBudgetMs: live?.briefBudgetMs,
     redactView: live?.redactView,
+    control: createLiveControl({ stores: registry.entries, capability: process.env.CONTEXTFUL_ADMIN_CAPABILITY,
+      attestationSecret: process.env.CONTEXTFUL_ADMIN_CAPABILITY ? required("CONTEXTFUL_CONTROL_ATTESTATION_SECRET") : undefined }),
   };
   if (modulePath) {
     const absolute = isAbsolute(modulePath) ? modulePath : resolve(modulePath);
diff --git a/apps/console/src/index.ts b/apps/console/src/index.ts
index 43a3814ac..c1cf35a01 100644
--- a/apps/console/src/index.ts
+++ b/apps/console/src/index.ts
@@ -346,6 +346,7 @@ export function createConsole(adapters: ConsoleAdapters): { fetch: (request: Req
       } else {
         const store = url.searchParams.get("store");
         if (store !== null && !adapters.stores.some((entry) => entry.id === store)) return refusal("ConsoleRequestMalformed", 400);
+        if (request.method === "GET" && path === "/admin/api/stores") return json(adapters.stores);
         if (request.method === "GET" && path === "/admin/api/workflows") return json(await adapters.control.workflows(operator, store));
         if (request.method === "GET" && path === "/admin/api/record") return json(await adapters.control.record(operator, store));
         if (request.method === "GET" && path === "/admin/api/packs") {
@@ -386,6 +387,10 @@ store.addEventListener('change',()=>{void showBrief();void refreshBrowse()});asO
 form.addEventListener('submit',async event=>{event.preventDefault();const question=questionField.value.trim();if(!question)return;brief.hidden=true;const response=await fetch('/query/api/ask',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({store:store.value,question})});const answer=await response.json();transcript.replaceChildren();const item=document.createElement('article');item.textContent=question+'\\n'+(answer.answer??answer.error?.identifier??'No answer');transcript.append(item);widgets.replaceChildren();for(const widget of answer.widgets??[])widgets.append(draw(widget));if(answer.sources?.length){const sources=document.createElement('p');sources.textContent='Sources: '+answer.sources.map(x=>x.title??x.url).join(', ');transcript.append(sources)}});
 </script></html>`;
 
-const adminPage = `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Admin · Contextful</title>${sharedStyle}<div class="shell"><nav aria-label="Console"><strong>Contextful</strong><a href="/query">Query</a><a href="/admin" aria-current="page">Admin</a></nav><main><h1>Store operations</h1><p class="muted">Pipelines, schedules, steps and run outcomes come from the store.</p><section><h2>Workflow canvas</h2><div id="canvas" class="grid"></div></section><section><h2>Operational record</h2><div id="record"></div></section><section><h2>Control document</h2><label for="document">Document</label><textarea id="document"></textarea><p><button id="edit">Edit</button> <button id="apply">Apply</button></p><p id="result" role="status"></p></section></main></div><script>
-const canvas=document.getElementById('canvas'),record=document.getElementById('record');fetch('/admin/api/workflows').then(r=>r.json()).then(data=>{for(const pipeline of data.pipelines??[]){const node=document.createElement('article');node.className='node';node.textContent=[pipeline.id,pipeline.schedule,...(pipeline.steps??[]),...(pipeline.runs??[]).map(run=>run.status)].filter(Boolean).join(' · ');canvas.append(node)}if(!canvas.children.length)canvas.textContent='No workflows are published.'});fetch('/admin/api/record').then(r=>r.json()).then(data=>{record.textContent=JSON.stringify(data,null,2)});for(const action of ['edit','apply'])document.getElementById(action).addEventListener('click',async()=>{const text=document.getElementById('document').value;let documentValue;try{documentValue=JSON.parse(text)}catch{document.getElementById('result').textContent='Enter a valid JSON document.';return}const response=await fetch('/admin/api/'+action,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(documentValue)});document.getElementById('result').textContent=response.ok?action+' complete':(await response.json()).error?.identifier??'Request failed'});
+const adminPage = `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Admin · Contextful</title>${sharedStyle}<div class="shell"><nav aria-label="Console"><strong>Contextful</strong><a href="/query">Query</a><a href="/admin" aria-current="page">Admin</a></nav><main><h1>Store operations</h1><p class="muted">Pipelines, schedules, steps and run outcomes come from the store.</p><label for="admin-store">Store</label> <select id="admin-store" required></select><section><h2>Workflow canvas</h2><div id="canvas" class="grid"></div></section><section><h2>Operational record</h2><div id="record"></div></section><section><h2>Control document</h2><p id="version" class="muted"></p><label for="document">TOML document</label><textarea id="document"></textarea><p><button id="edit">Save draft</button> <button id="apply">Apply draft</button></p><p id="result" role="status"></p></section></main></div><script>
+const canvas=document.getElementById('canvas'),record=document.getElementById('record'),version=document.getElementById('version'),result=document.getElementById('result'),store=document.getElementById('admin-store');let applied=null,draftNonce=null;
+async function workflows(){applied=null;draftNonce=null;if(!store.value)return;const selected=store.value;const response=await fetch('/admin/api/workflows?store='+encodeURIComponent(selected));const data=await response.json();if(selected!==store.value)return;if(!response.ok){result.textContent=data.error?.identifier??'Workflow request failed';return}applied=data.applied;version.textContent=applied===null?'No applied version':'Applied version '+applied;canvas.replaceChildren();for(const pipeline of data.pipelines??[]){const node=document.createElement('article');node.className='node';const run=data.runs?.[pipeline.id];node.textContent=[pipeline.id,pipeline.schedule,...(pipeline.steps??[]),run?.status,run?.run_id].filter(Boolean).join(' · ');canvas.append(node)}if(!canvas.children.length)canvas.textContent='No workflows are published.'}
+async function refresh(){await workflows();if(!store.value)return;const response=await fetch('/admin/api/record?store='+encodeURIComponent(store.value));const data=await response.json();record.textContent=response.ok?JSON.stringify(data,null,2):data.error?.identifier??'Record request failed'}
+store.addEventListener('change',refresh);fetch('/admin/api/stores').then(r=>r.json()).then(rows=>{for(const row of rows){const option=document.createElement('option');option.value=row.id;option.textContent=row.label;store.append(option)}refresh()});
+for(const action of ['edit','apply'])document.getElementById(action).addEventListener('click',async()=>{if(!Number.isSafeInteger(applied)||!store.value){result.textContent='Select a store with an applied version.';return}if(action==='apply'&&!draftNonce){result.textContent='Save a draft before applying.';return}const body=action==='edit'?{store:store.value,expected:applied,document:document.getElementById('document').value}:{store:store.value,expected:applied,nonce:draftNonce};const response=await fetch('/admin/api/'+action,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(body)});const answer=await response.json();result.textContent=response.ok?action+' complete':answer.error?.identifier??'Request failed';if(response.ok&&action==='edit')draftNonce=answer.nonce;if(response.ok&&action==='apply')await refresh()});
 </script></html>`;
diff --git a/apps/console/test/console.test.ts b/apps/console/test/console.test.ts
index 7fc094e75..35c26e30c 100644
--- a/apps/console/test/console.test.ts
+++ b/apps/console/test/console.test.ts
@@ -1,5 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import { Script } from "node:vm";
 import { generateKeyPairSync, sign } from "node:crypto";
 import { createConsole, issueCognitoSession } from "../src/index.ts";
 import { serveConsole } from "../src/server.ts";
@@ -94,6 +95,12 @@ test("Query keeps one composer and transcript and delegates a sourced answer", a
   assert.match(page, /id="composer"/);
   assert.match(page, /id="transcript"/);
   assert.match(page, /id="widgets"/);
+  for (const id of ["brief", "chips", "insights", "file-gallery", "file-preview"]) {
+    assert.match(page, new RegExp(`id="${id}"`));
+  }
+  const script = page.match(/<script>([\s\S]*?)<\/script>/)?.[1];
+  assert.ok(script);
+  assert.doesNotThrow(() => new Script(script));
   const answer = await request("/query/api/ask", { ...access(queryAudience), origin: "https://console.example" }, { method: "POST", body: JSON.stringify({ store: "field-notes", question: "What arrived?" }) });
   assert.equal(answer.status, 200);
   assert.equal((await answer.json() as { sources: unknown[] }).sources.length, 1);
@@ -319,6 +326,24 @@ test("Admin pack listing reaches only the injected listing adapter", async () =>
   assert.deepEqual(calls, ["field-notes:packs/"]);
 });
 
+test("Admin names the selected store on every operational request and shows run outcomes", async () => {
+  const app = createConsole({
+    identity: { kind: "access", issuer, queryAudience, adminAudience, publicKey },
+    stores: [{ id: "one", label: "Store one" }, { id: "two", label: "Store two" }],
+    adminCapability: "server-secret", turn: async () => ({ answer: "", sources: [], widgets: [] }),
+    read: { list: async () => [] },
+    control: { workflows: async () => ({}), record: async () => ({}), edit: async () => ({}), apply: async () => ({}) },
+  });
+  const page = await (await app.fetch(new Request("https://console.example/admin", { headers: access(adminAudience) }))).text();
+  const stores = await app.fetch(new Request("https://console.example/admin/api/stores", { headers: access(adminAudience) }));
+  assert.deepEqual(await stores.json(), [{ id: "one", label: "Store one" }, { id: "two", label: "Store two" }]);
+  assert.match(page, /<select id="admin-store"/);
+  assert.match(page, /\/admin\/api\/workflows\?store=/);
+  assert.match(page, /\/admin\/api\/record\?store=/);
+  assert.match(page, /store:store\.value/);
+  assert.match(page, /data\.runs/);
+});
+
 test("Query builds its widget from rows and sanitizes view props before delivery", async () => {
   const app = createConsole({
     identity: { kind: "access", issuer, queryAudience, adminAudience, publicKey },
diff --git a/apps/console/test/control.test.ts b/apps/console/test/control.test.ts
new file mode 100644
index 000000000..4a707f037
--- /dev/null
+++ b/apps/console/test/control.test.ts
@@ -0,0 +1,104 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createHash, createHmac, generateKeyPairSync, sign } from "node:crypto";
+import { createConsole } from "../src/index.ts";
+import { createLiveControl } from "../src/control.ts";
+
+const { privateKey, publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+const token = (() => {
+  const header = Buffer.from(JSON.stringify({ alg: "RS256" })).toString("base64url");
+  const claims = Buffer.from(JSON.stringify({ iss: "https://access.example", aud: "admin-app", sub: "operator-1", exp: Math.floor(Date.now() / 1000) + 300 })).toString("base64url");
+  return `${header}.${claims}.${sign("RSA-SHA256", Buffer.from(`${header}.${claims}`), privateKey).toString("base64url")}`;
+})();
+
+test("Admin route retrieves applied workflow state and applies through the server capability", async () => {
+  const calls: { path: string; authorization: string | null; body: string }[] = [];
+  const fetcher: typeof fetch = async (input, init) => {
+    const url = new URL(String(input));
+    calls.push({ path: url.pathname, authorization: new Headers(init?.headers).get("authorization"), body: String(init?.body ?? "") });
+    return Response.json(url.pathname === "/control/workflows" ?
+      { applied: 1, pipelines: [{ id: "filings-flow", tables: ["filings"], schedule: "every 1h" }], runs: {} } :
+      url.pathname === "/control/record" ? { entries: [], truncated: false, declined: 0 } :
+      url.pathname === "/control/edit" ? { expected: 1, nonce: "a".repeat(48) } : { applied: 2 });
+  };
+  const control = createLiveControl({ stores: [{ id: "field-notes", endpoint: "http://127.0.0.1:9999" }], capability: "engine-admin-secret", fetcher });
+  const app = createConsole({
+    identity: { kind: "access", issuer: "https://access.example", queryAudience: "query-app", adminAudience: "admin-app", publicKey },
+    stores: [{ id: "field-notes", label: "Field notes" }], adminCapability: "engine-admin-secret",
+    turn: async () => ({ answer: "", sources: [], widgets: [] }), read: { list: async () => [] }, control,
+  });
+  const headers = { "cf-access-jwt-assertion": token };
+  const listing = await app.fetch(new Request("https://console.example/admin/api/workflows", { headers }));
+  assert.equal(listing.status, 200);
+  assert.equal((await listing.json() as { pipelines: { id: string }[] }).pipelines[0].id, "filings-flow");
+  const record = await app.fetch(new Request("https://console.example/admin/api/record", { headers }));
+  assert.equal(record.status, 200);
+  const edit = await app.fetch(new Request("https://console.example/admin/api/edit", {
+    method: "POST", headers: { ...headers, origin: "https://console.example" },
+    body: JSON.stringify({ store: "field-notes", expected: 1, document: "[[pipeline]]\nid = \"filings-flow\"" }),
+  }));
+  assert.equal(edit.status, 200);
+  const apply = await app.fetch(new Request("https://console.example/admin/api/apply", {
+    method: "POST", headers: { ...headers, origin: "https://console.example" }, body: JSON.stringify({ store: "field-notes", expected: 1, nonce: "a".repeat(48) }),
+  }));
+  assert.equal(apply.status, 200);
+  assert.deepEqual(calls, [
+    { path: "/control/workflows", authorization: "Bearer engine-admin-secret", body: "" },
+    { path: "/control/record", authorization: "Bearer engine-admin-secret", body: "" },
+    { path: "/control/edit", authorization: "Bearer engine-admin-secret", body: '{"expected":1,"document":"[[pipeline]]\\nid = \\"filings-flow\\""}' },
+    { path: "/control/apply", authorization: "Bearer engine-admin-secret", body: '{"expected":1,"nonce":"' + "a".repeat(48) + '"}' },
+  ]);
+  assert.doesNotMatch(JSON.stringify(await apply.json()), /engine-admin-secret/);
+});
+
+test("Admin control refuses ambiguous stores", async () => {
+  const control = createLiveControl({
+    stores: [{ id: "one", endpoint: "http://127.0.0.1:1" }, { id: "two", endpoint: "http://127.0.0.1:2" }],
+    capability: "secret", fetcher: async () => { throw new Error("network must not be called"); },
+  });
+  await assert.rejects(control.workflows({ subject: "operator", grants: new Set(["admin"]) }, null), /ConsoleStoreSelectionRequired/);
+  await assert.rejects(control.edit({ expected: 1, document: "" }, "secret", { subject: "operator", grants: new Set(["admin"]) }), /ConsoleStoreSelectionRequired/);
+});
+
+test("registered stores share one Admin capability and console attestation domain", async () => {
+  const seen: string[] = [];
+  const control = createLiveControl({
+    stores: [{ id: "one", endpoint: "https://one.example" }, { id: "two", endpoint: "https://two.example" }],
+    capability: "deployment-admin", attestationSecret: "deployment-attestation",
+    fetcher: async (input, init) => {
+      const url = new URL(String(input));
+      const headers = new Headers(init?.headers);
+      assert.equal(headers.get("authorization"), "Bearer deployment-admin");
+      const body = String(init?.body);
+      const canonical = `POST\n${url.pathname}\n${createHash("sha256").update(body).digest("hex")}\noperator\n${headers.get("x-contextful-operator-time")}\n${headers.get("x-contextful-operator-nonce")}`;
+      assert.equal(headers.get("x-contextful-operator-signature"), createHmac("sha256", "deployment-attestation").update(canonical).digest("hex"));
+      seen.push(url.hostname);
+      return Response.json({ expected: 1, nonce: "a".repeat(48) });
+    },
+  });
+  const operator = { subject: "operator", grants: new Set<"admin">(["admin"]) };
+  await control.edit({ store: "one", expected: 1, document: "" }, "deployment-admin", operator);
+  await control.edit({ store: "two", expected: 1, document: "" }, "deployment-admin", operator);
+  assert.deepEqual(seen, ["one.example", "two.example"]);
+});
+
+test("the live control adapter signs the verified subject and exact request body", async () => {
+  let signed = false;
+  const control = createLiveControl({ stores: [{ id: "one", endpoint: "http://127.0.0.1:1" }],
+    capability: "admin-capability", attestationSecret: "separate-attestation-secret",
+    fetcher: async (input, init) => {
+      const headers = new Headers(init?.headers);
+      const body = String(init?.body);
+      const subject = headers.get("x-contextful-operator");
+      assert.equal(subject, "verified-operator");
+      const canonical = `POST\n${new URL(String(input)).pathname}\n${createHash("sha256").update(body).digest("hex")}\n${subject}\n${headers.get("x-contextful-operator-time")}\n${headers.get("x-contextful-operator-nonce")}`;
+      assert.equal(headers.get("x-contextful-operator-signature"), createHmac("sha256", "separate-attestation-secret").update(canonical).digest("hex"));
+      signed = true;
+      return Response.json({ expected: 1, nonce: "a".repeat(48) });
+    },
+  });
+  await control.edit({ store: "one", expected: 1, document: "" }, "admin-capability", { subject: "verified-operator", grants: new Set(["admin"]) });
+  assert.equal(signed, true);
+  await assert.rejects(control.edit({ store: "one", expected: 1, document: "", operator: "forged" }, "admin-capability",
+    { subject: "verified-operator", grants: new Set(["admin"]) }), /ConsoleRequestMalformed/);
+});
diff --git a/crates/acceptance/tests/integration/m12.rs b/crates/acceptance/tests/integration/m12.rs
index 985a42875..7bf6d4fd1 100644
--- a/crates/acceptance/tests/integration/m12.rs
+++ b/crates/acceptance/tests/integration/m12.rs
@@ -80,24 +80,36 @@ fn request(address: &str, method: &str, path: &str, token: Option<&str>, body: O
 }
 
 #[test]
-#[ignore = "milestone 12 is open: the console server and client library are absent"]
 fn m12_console() {
+    let console_package = workspace_root().join("apps/console");
+    let bundle = console_package.join("dist/server.js");
+    let _ = std::fs::remove_file(&bundle);
+    ok(&Command::new("pnpm").arg("--dir").arg(&console_package).args(["install", "--frozen-lockfile"]).output().unwrap());
+    ok(&Command::new("pnpm").arg("--dir").arg(&console_package).arg("build").output().unwrap());
+    assert!(bundle.is_file(), "the console build writes its runnable server");
     let cf = bin("contextful");
     let repo = GitRepo::init();
-    repo.write("contextful.toml", "authoring_posture = \"per_request\"\n[[pipeline]]\nid = \"filings-flow\"\n[[pipeline.tables]]\nname = \"filings\"\n");
+    repo.write("contextful.toml", "authoring_posture = \"per_request\"\n");
+    repo.write("pipelines/filings.toml", "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1h\"\ntables = [\"filings\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n");
     repo.write("filings.jsonl", &json!({
         "filing_id": "filing-1", "publisher": "Northwind", "summary": "Northwind filed on Monday",
         "source_url": "https://example.test/filing-1"
     }).to_string());
     ok(&repo.run(&cf, &["context", "land", "filings", "--project", "research", "--rows", "filings.jsonl", "--run-id", "load-1", "--site-id", "site-a"]));
+    ok(&repo.run(&cf, &["pipeline", "import", "--project", "research"]));
     repo.write(".contextful/issuance.toml", &format!("default_audience = \"{STORE_AUDIENCE}\"\nmax_lifetime_secs = 3600\n"));
     let public = ok(&repo.run(&cf, &["token", "keygen", "--out", ".contextful/issuer.seed"]));
     let read_token = ok(&repo.run(&cf, &[
         "token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://operator@example.test",
         "--zone", "on-prem:hq", "--action", "read", "--table", "filings", "--ttl", "3600",
     ]));
+    let admin_capability = ok(&repo.run(&cf, &[
+        "token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://operator@example.test",
+        "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "3600",
+    ]));
     let read = Command::new(&cf)
         .args(["serve", "--http", "127.0.0.1:0", "--max-in-flight", "2", "--project", "research", "--public-key", &public, "--audience", STORE_AUDIENCE])
+        .env("CONTEXTFUL_CONTROL_ATTESTATION_SECRET", "separate-attestation-secret")
         .current_dir(&repo.root)
         .stderr(Stdio::piped())
         .spawn()
@@ -120,10 +132,12 @@ fn m12_console() {
     });
     let stores = json!([{ "id": "field-notes", "label": "Field notes", "endpoint": format!("http://{read_address}"), "auth": "shared" }]);
     let console = Command::new("node")
-        .arg(workspace_root().join("apps/console/dist/server.js"))
+        .arg(&bundle)
         .args(["--http", "127.0.0.1:0"])
         .env("CONTEXTFUL_STORES_JSON", stores.to_string())
         .env("FIELD_NOTES_QUERY_TOKEN", &read_token)
+        .env("CONTEXTFUL_ADMIN_CAPABILITY", &admin_capability)
+        .env("CONTEXTFUL_CONTROL_ATTESTATION_SECRET", "separate-attestation-secret")
         .env("CONTEXTFUL_ACCESS_JWKS_URL", jwks.url("/certs"))
         .env("CONTEXTFUL_ACCESS_ISSUER", ACCESS_ISSUER)
         .env("CONTEXTFUL_QUERY_ACCESS_AUDIENCE", QUERY_ACCESS_AUDIENCE)
@@ -137,6 +151,31 @@ fn m12_console() {
 
     assert_eq!(request(&console_address, "GET", "/query", None, None).0, 401);
     assert_eq!(request(&console_address, "GET", "/admin", Some(&access_token(QUERY_ACCESS_AUDIENCE)), None).0, 403);
+    let (status, admin_page) = request(&console_address, "GET", "/admin", Some(&access_token(ADMIN_ACCESS_AUDIENCE)), None);
+    assert_eq!(status, 200);
+    assert!(String::from_utf8_lossy(&admin_page).contains("id=\"canvas\""));
+    assert_eq!(request(&console_address, "GET", "/admin/api/workflows", Some(&access_token(QUERY_ACCESS_AUDIENCE)), None).0, 403);
+    let (status, workflows) = request(&console_address, "GET", "/admin/api/workflows", Some(&access_token(ADMIN_ACCESS_AUDIENCE)), None);
+    assert_eq!(status, 200, "{}", String::from_utf8_lossy(&workflows));
+    let workflows: Value = serde_json::from_slice(&workflows).unwrap();
+    assert_eq!(workflows["applied"], 1, "{workflows}");
+    assert_eq!(workflows["pipelines"][0]["id"], "filings-flow", "{workflows}");
+    assert_eq!(workflows["pipelines"][0]["tables"], json!(["filings"]), "{workflows}");
+    let draft = "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1d\"\ntables = [\"filings\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
+    let (status, edited) = request(&console_address, "POST", "/admin/api/edit", Some(&access_token(ADMIN_ACCESS_AUDIENCE)),
+        Some(&json!({ "store": "field-notes", "expected": 1, "document": draft })));
+    assert_eq!(status, 200, "{}", String::from_utf8_lossy(&edited));
+    let edited: Value = serde_json::from_slice(&edited).unwrap();
+    assert_eq!(edited["expected"], 1, "{edited}");
+    let (status, applied) = request(&console_address, "POST", "/admin/api/apply", Some(&access_token(ADMIN_ACCESS_AUDIENCE)),
+        Some(&json!({ "store": "field-notes", "expected": 1, "nonce": edited["nonce"] })));
+    assert_eq!(status, 200, "{}", String::from_utf8_lossy(&applied));
+    let applied: Value = serde_json::from_slice(&applied).unwrap();
+    assert_eq!(applied["applied"], 2, "{applied}");
+    let (status, workflows) = request(&console_address, "GET", "/admin/api/workflows", Some(&access_token(ADMIN_ACCESS_AUDIENCE)), None);
+    assert_eq!(status, 200);
+    let workflows: Value = serde_json::from_slice(&workflows).unwrap();
+    assert_eq!(workflows["pipelines"][0]["schedule"], "every 1d", "{workflows}");
     let (status, answer) = request(
         &console_address, "POST", "/query/api/ask", Some(&access_token(QUERY_ACCESS_AUDIENCE)),
         Some(&json!({ "store": "field-notes", "question": "Which filing arrived?" })),
@@ -151,9 +190,4 @@ fn m12_console() {
         "the sources must identify the filing behind the answer: {answer}"
     );
     assert!(!model.received("/v1/chat/completions").is_empty(), "the answer uses the model endpoint");
-    assert_eq!(request(&console_address, "GET", "/admin/api/workflows", Some(&access_token(QUERY_ACCESS_AUDIENCE)), None).0, 403);
-    let (status, workflows) = request(&console_address, "GET", "/admin/api/workflows", Some(&access_token(ADMIN_ACCESS_AUDIENCE)), None);
-    assert_eq!(status, 200, "{}", String::from_utf8_lossy(&workflows));
-    let workflows = String::from_utf8(workflows).unwrap();
-    assert!(workflows.contains("filings-flow") && workflows.contains("filings"), "{workflows}");
 }
diff --git a/crates/contextful-agent/src/http.rs b/crates/contextful-agent/src/http.rs
index aac4c133c..90177e1f4 100644
--- a/crates/contextful-agent/src/http.rs
+++ b/crates/contextful-agent/src/http.rs
@@ -14,8 +14,8 @@
 
 use crate::mcp::{build_identity, Caller, ReadRecord, Tools};
 use contextful_context::read::Face;
-use contextful_core::ports::Clock;
 use contextful_core::grant::{Action, TablePattern};
+use contextful_core::ports::Clock;
 use contextful_core::read::{ReadError, Refusal};
 use contextful_core::AuthorityError;
 use contextful_policy::enforce::refuse::payload;
@@ -44,6 +44,8 @@ pub const HEALTH_PATH: &str = "/health";
 
 /// The store-published workflow state and validated control claim routes.
 pub const WORKFLOWS_PATH: &str = "/control/workflows";
+pub const RECORD_PATH: &str = "/control/record";
+pub const EDIT_PATH: &str = "/control/edit";
 pub const APPLY_PATH: &str = "/control/apply";
 
 /// Largest request head the face reads; a head past it answers `431`.
@@ -198,7 +200,7 @@ pub struct Admitting<'a, C> {
 pub struct HttpFace<'a, C> {
     tools: Tools<'a>,
     admitting: Admitting<'a, C>,
-    control: Option<&'a (dyn Fn(&HttpRequest) -> HttpResponse + Sync)>,
+    control: Option<&'a (dyn Fn(&HttpRequest, &AdmittedAuthority) -> HttpResponse + Sync)>,
     ceiling: usize,
     in_flight: AtomicUsize,
     exchange: Option<&'a (dyn Fn(&HttpRequest) -> HttpResponse + Sync)>,
@@ -253,6 +255,12 @@ impl<'a, C: Clock + Sync> HttpFace<'a, C> {
         Ok(HttpFace { tools, admitting, control: None, ceiling, in_flight: AtomicUsize::new(0), exchange: None, exchange_unconfigured: false, claim_write: None })
     }
 
+    /// Attach the store's control API without adding tools to the closed read face.
+    pub fn with_control(mut self, control: &'a (dyn Fn(&HttpRequest, &AdmittedAuthority) -> HttpResponse + Sync)) -> Self {
+        self.control = Some(control);
+        self
+    }
+
     /// The binary's exchange route mints the reader credential without putting issuer
     /// signing material in the read-transport package.
     pub fn with_exchange(mut self, exchange: &'a (dyn Fn(&HttpRequest) -> HttpResponse + Sync), unconfigured: bool) -> Self {
@@ -261,12 +269,6 @@ impl<'a, C: Clock + Sync> HttpFace<'a, C> {
         self
     }
 
-    /// Attach the store's control API without adding tools to the closed read face.
-    pub fn with_control(mut self, control: &'a (dyn Fn(&HttpRequest) -> HttpResponse + Sync)) -> Self {
-        self.control = Some(control);
-        self
-    }
-
     /// The binary owns the claim writer; this route never joins the read MCP tool set.
     pub fn with_claim_write(mut self, write: &'a (dyn Fn(&HttpRequest, &AdmittedAuthority, &dyn Fn() -> Result<(), AuthorityError>) -> HttpResponse + Sync)) -> Self {
         self.claim_write = Some(write);
@@ -360,88 +362,84 @@ impl<'a, C: Clock + Sync> HttpFace<'a, C> {
             (MCP_PATH, _) => {
                 HttpResponse::message(405, "`/mcp` answers POST; the face holds no session and opens no server stream").with("Allow", "POST")
             }
+            (WORKFLOWS_PATH, "GET") | (RECORD_PATH, "GET") | (EDIT_PATH, "POST") | (APPLY_PATH, "POST") if self.control.is_some() => self.control_request(request),
+            (WORKFLOWS_PATH, _) if self.control.is_some() => HttpResponse::message(405, "`/control/workflows` answers GET").with("Allow", "GET"),
+            (RECORD_PATH, _) if self.control.is_some() => HttpResponse::message(405, "`/control/record` answers GET").with("Allow", "GET"),
+            (EDIT_PATH, _) if self.control.is_some() => HttpResponse::message(405, "`/control/edit` answers POST").with("Allow", "POST"),
+            (APPLY_PATH, _) if self.control.is_some() => HttpResponse::message(405, "`/control/apply` answers POST").with("Allow", "POST"),
             ("/memory/claims", "POST") if self.claim_write.is_some() => self.claim_write_request(request),
             ("/memory/claims", _) if self.claim_write.is_some() => HttpResponse::message(405, "`/memory/claims` answers POST").with("Allow", "POST"),
             ("/auth/exchange", "POST") if self.exchange.is_some() => self.exchange.expect("checked above")(request),
             ("/auth/exchange", _) if self.exchange.is_some() => HttpResponse::message(405, "`/auth/exchange` answers POST").with("Allow", "POST"),
-            (WORKFLOWS_PATH, "GET") | (APPLY_PATH, "POST") if self.control.is_some() => self.control(request),
-            (WORKFLOWS_PATH, _) if self.control.is_some() => HttpResponse::message(405, "`/control/workflows` answers GET").with("Allow", "GET"),
-            (APPLY_PATH, _) if self.control.is_some() => HttpResponse::message(405, "`/control/apply` answers POST").with("Allow", "POST"),
             (other, _) => HttpResponse::message(404, format!("no route `{other}`; the protocol endpoint is `{MCP_PATH}`")),
         }
     }
 
     /// Admit the request's credential, then answer its one message.
     fn message(&self, request: &HttpRequest) -> HttpResponse {
-        let (authority, revocation) = match self.admit(request) {
-            Ok(a) => a,
-            Err(response) => return response,
-        };
-        let message: Value = match serde_json::from_slice(&request.body) {
-            Ok(m @ Value::Object(_)) => m,
-            Ok(_) => return HttpResponse::rpc_error(INVALID_REQUEST, "a request body holds one JSON-RPC message object"),
-            Err(e) => return HttpResponse::rpc_error(PARSE_ERROR, format!("the request body is not JSON: {e}")),
-        };
-        let admission = Admission::new(self.tools.clock().now(), &revocation).expecting(self.admitting.audience);
-        let boundary = |a: &AdmittedAuthority| effect_boundary(a, &admission);
-        match self.tools.handle(Caller { authority: &authority, boundary: &boundary }, &message) {
-            Some(answer) => HttpResponse::json(200, &answer),
-            None => HttpResponse::empty(202),
-        }
-    }
-
-    fn control(&self, request: &HttpRequest) -> HttpResponse {
-        let (authority, _) = match self.admit(request) {
-            Ok(a) => a,
-            Err(response) => return response,
-        };
-        if !authority.grants().iter().any(|grant| grant.actions.contains(&Action::Admin) && grant.tables.contains(&TablePattern::All)) {
-            return HttpResponse::json(403, &json!({ "error": { "identifier": "ControlAdminGrantMissing" } }));
-        }
-        let revocation = match (self.admitting.revocation)() {
-            Ok(r) => r,
-            Err(why) => return HttpResponse::unavailable(format!("the revocation denylist is unreadable: {why}")),
-        };
-        let boundary = Admission::new(self.tools.clock().now(), &revocation).expecting(self.admitting.audience);
-        if let Err(error) = effect_boundary(&authority, &boundary) {
-            return unadmitted(&error);
-        }
-        self.control.expect("the route is installed only with a control handler")(request)
+        self.admitted(request, |authority, admission| {
+            let message: Value = match serde_json::from_slice(&request.body) {
+                Ok(m @ Value::Object(_)) => m,
+                Ok(_) => return HttpResponse::rpc_error(INVALID_REQUEST, "a request body holds one JSON-RPC message object"),
+                Err(e) => return HttpResponse::rpc_error(PARSE_ERROR, format!("the request body is not JSON: {e}")),
+            };
+            let boundary = |a: &AdmittedAuthority| effect_boundary(a, admission);
+            match self.tools.handle(Caller { authority, boundary: &boundary }, &message) {
+                Some(answer) => HttpResponse::json(200, &answer),
+                None => HttpResponse::empty(202),
+            }
+        })
     }
 
     fn claim_write_request(&self, request: &HttpRequest) -> HttpResponse {
         if request.header("Origin").is_some() {
             return HttpResponse::json(403, &json!({ "error": { "http": 403, "identifier": "MemoryClaimBrowserRefused" } }));
         }
-        let (authority, _) = match self.admit(request) {
-            Ok(a) => a,
-            Err(response) => return response,
-        };
-        let boundary = || {
-            let revocation = (self.admitting.revocation)().map_err(AuthorityError::AuthorityRevoked)?;
-            let admission = Admission::new(self.tools.clock().now(), &revocation).expecting(self.admitting.audience);
-            effect_boundary(&authority, &admission)
-        };
-        self.claim_write.expect("route exists")(request, &authority, &boundary)
+        self.admitted(request, |authority, _| {
+            let boundary = || {
+                let revocation = (self.admitting.revocation)().map_err(AuthorityError::AuthorityRevoked)?;
+                let admission = Admission::new(self.tools.clock().now(), &revocation).expecting(self.admitting.audience);
+                effect_boundary(authority, &admission)
+            };
+            self.claim_write.expect("route exists")(request, authority, &boundary)
+        })
     }
 
-    fn admit(&self, request: &HttpRequest) -> Result<(AdmittedAuthority, RevocationState), HttpResponse> {
+    /// Control routes admit only an untenanted Admin grant over `*` (`surface.apply.served-admin-grant`).
+    fn control_request(&self, request: &HttpRequest) -> HttpResponse {
+        self.admitted(request, |authority, _| {
+            if !authority.grants().iter().any(|grant| grant.actions.contains(&Action::Admin) && grant.tables.contains(&TablePattern::All) && grant.tenant.is_none()) {
+                return HttpResponse::json(403, &json!({ "error": { "identifier": "ControlAdminGrantMissing" } }));
+            }
+            let revocation = match (self.admitting.revocation)() {
+                Ok(r) => r,
+                Err(why) => return HttpResponse::unavailable(format!("the revocation denylist is unreadable: {why}")),
+            };
+            let boundary = Admission::new(self.tools.clock().now(), &revocation).expecting(self.admitting.audience);
+            if let Err(error) = effect_boundary(authority, &boundary) {
+                return unadmitted(&error);
+            }
+            self.control.expect("the route is installed only with a control handler")(request, authority)
+        })
+    }
+
+    fn admitted(&self, request: &HttpRequest, answer: impl FnOnce(&AdmittedAuthority, &Admission<'_>) -> HttpResponse) -> HttpResponse {
         let Some(credential) = request.credential() else {
             let missing = ReadError::HttpCredentialMissing(
                 "a request carries `Authorization: Bearer <credential>`, or `Authorization: DPoP <credential>` with a `DPoP` proof from the credential's holder key".into(),
             );
-            return Err(HttpResponse::json(401, &payload(&Refusal::Read(missing))).with("WWW-Authenticate", CHALLENGE));
+            return HttpResponse::json(401, &payload(&Refusal::Read(missing))).with("WWW-Authenticate", CHALLENGE);
         };
         let revocation = match (self.admitting.revocation)() {
             Ok(r) => r,
-            Err(why) => return Err(HttpResponse::unavailable(format!("the revocation denylist is unreadable: {why}"))),
+            Err(why) => return HttpResponse::unavailable(format!("the revocation denylist is unreadable: {why}")),
         };
         let admission = Admission::new(self.tools.clock().now(), &revocation).expecting(self.admitting.audience);
         let covered = ProofRequest { method: &request.method, target: &request.target, body: &request.body };
         let checkpoint = self.admitting.checkpoint;
         let keys = match checkpoint.keys() {
             Ok(k) => k,
-            Err(e) => return Err(HttpResponse::unavailable(e.to_string())),
+            Err(e) => return HttpResponse::unavailable(e.to_string()),
         };
         let authority = verify_network(credential, &keys, &admission, |jkt| match request.header("DPoP") {
             Some(proof) => checkpoint.verify_request(jkt, proof, &covered),
@@ -449,11 +447,12 @@ impl<'a, C: Clock + Sync> HttpFace<'a, C> {
                 "the credential binds a holder key, and the request carries no `DPoP` proof".into(),
             ))),
         });
-        match authority {
-            Ok(a) => Ok((a, revocation)),
-            Err(ProofRefusal::NonceCacheFull) => Err(HttpResponse::unavailable(ProofRefusal::NonceCacheFull.to_string())),
-            Err(ProofRefusal::Refused(e)) => Err(unadmitted(&e)),
-        }
+        let authority = match authority {
+            Ok(a) => a,
+            Err(ProofRefusal::NonceCacheFull) => return HttpResponse::unavailable(ProofRefusal::NonceCacheFull.to_string()),
+            Err(ProofRefusal::Refused(e)) => return unadmitted(&e),
+        };
+        answer(&authority, &admission)
     }
 }
 
diff --git a/crates/contextful-agent/tests/integration/http.rs b/crates/contextful-agent/tests/integration/http.rs
index dc7234a71..efede4b0d 100644
--- a/crates/contextful-agent/tests/integration/http.rs
+++ b/crates/contextful-agent/tests/integration/http.rs
@@ -9,7 +9,7 @@ use contextful_agent::mcp::Server;
 use contextful_context::land::{land, Batch, RunContext};
 use contextful_context::read::Face;
 use contextful_context::Store;
-use contextful_core::grant::{Action, Grant, TablePattern};
+use contextful_core::grant::{Action, Grant, TablePattern, TenantScope};
 use contextful_core::identify::Subject;
 use contextful_core::issue::{IssuancePolicy, Lifetime, MintContext, MintRequest, NodeRole, SignatureAlgorithm};
 use contextful_core::ports::FixedClock;
@@ -105,12 +105,16 @@ fn credential(signer: &SeedSigner, tables: &str, ttl: u64, holder: Option<&Signi
 }
 
 fn credential_with_action(signer: &SeedSigner, action: Action, tables: &str, ttl: u64, holder: Option<&SigningKey>) -> String {
+    credential_scoped(signer, action, tables, None, ttl, holder)
+}
+
+fn credential_scoped(signer: &SeedSigner, action: Action, tables: &str, tenant: Option<TenantScope>, ttl: u64, holder: Option<&SigningKey>) -> String {
     let policy = IssuancePolicy::parse(&format!("default_audience = \"{AUD}\"\nmax_lifetime_secs = 86400\n")).unwrap();
     let subject = Subject { on_behalf_of: Some("user://dana@acme.example".into()), zone: Some("on-prem:hq".into()), ..Subject::default() };
     let grant = Grant {
         actions: vec![action],
         tables: vec![TablePattern::parse(tables).unwrap()],
-        tenant: None,
+        tenant,
         aggregate: None,
         templates: Some(vec!["*".into()]),
         max_rows: None,
@@ -137,7 +141,7 @@ fn control_apply_rechecks_revocation_before_dispatch() {
     };
     let admitting = Admitting { checkpoint: &f.checkpoint, audience: AUD, revocation: &revocation };
     let dispatched = AtomicBool::new(false);
-    let handler = |_: &HttpRequest| {
+    let handler = |_: &HttpRequest, _: &contextful_policy::verify::AdmittedAuthority| {
         dispatched.store(true, Ordering::SeqCst);
         contextful_agent::http::HttpResponse::json(200, &json!({ "applied": 2 }))
     };
@@ -152,6 +156,30 @@ fn control_apply_rechecks_revocation_before_dispatch() {
     assert_eq!(checks.load(Ordering::SeqCst), 2);
 }
 
+// spec: surface.apply.served-admin-grant@fc18cabf
+#[test]
+fn control_refuses_a_tenant_scoped_admin_grant_over_every_table() {
+    let f = fixture();
+    let tenant = TenantScope { table: "research/notes".into(), value: "acme-eu".into() };
+    let token = credential_scoped(&f.signer, Action::Admin, "*", Some(tenant), 900, None);
+    let clock = FixedClock(at(NOW));
+    let admitting = Admitting { checkpoint: &f.checkpoint, audience: AUD, revocation: &no_revocation };
+    let dispatched = AtomicBool::new(false);
+    let handler = |_: &HttpRequest, _: &AdmittedAuthority| {
+        dispatched.store(true, Ordering::SeqCst);
+        HttpResponse::json(200, &json!({ "applied": 1 }))
+    };
+    let face = HttpFace::new(&f.face, &clock, &f.audit, admitting, Some(2)).unwrap().with_control(&handler);
+    let request = HttpRequest {
+        method: "GET".into(), target: "/control/workflows".into(),
+        headers: vec![("Authorization".into(), format!("Bearer {token}"))], body: vec![],
+    };
+    let answer = face.answer(&request);
+    assert_eq!(answer.status, 403);
+    assert_eq!(body(&answer.body)["error"]["identifier"], "ControlAdminGrantMissing");
+    assert!(!dispatched.load(Ordering::SeqCst));
+}
+
 fn call(tool: &str, arguments: Value) -> Value {
     json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": tool, "arguments": arguments } })
 }
diff --git a/crates/contextful-cli/Cargo.toml b/crates/contextful-cli/Cargo.toml
index cf58b75d1..f239bc9b6 100644
--- a/crates/contextful-cli/Cargo.toml
+++ b/crates/contextful-cli/Cargo.toml
@@ -39,6 +39,7 @@ clap = { version = "4", features = ["derive", "env"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
+hmac = "0.12"
 tempfile = "3"
 thiserror = "2"
 toml = "0.8"
diff --git a/crates/contextful-cli/src/cadence.rs b/crates/contextful-cli/src/cadence.rs
index bd5574f36..e72c8cd52 100644
--- a/crates/contextful-cli/src/cadence.rs
+++ b/crates/contextful-cli/src/cadence.rs
@@ -27,7 +27,7 @@ use contextful_core::store::sync::ControlHead;
 use contextful_core::surface::edit::check_document;
 use contextful_core::surface::dispatch::{CHILD_GRACE_SECS, DEFAULT_POOL};
 use contextful_core::surface::SurfaceError;
-use contextful_engine::control::{ControlError, SnapshotDir};
+use contextful_engine::control::{ControlError, Draft, SnapshotDir};
 use contextful_engine::scheduler::{Beat, Dispatch, Entry, Fired, LeaseState, Scheduler};
 use contextful_engine::worker::{Relay, WorkerDispatch};
 use contextful_policy::control_receipt::ControlReceipt;
@@ -435,6 +435,67 @@ fn render(specs: &BTreeMap<String, PipelineSpec>) -> Result<String> {
     Ok(format!("# An applied snapshot, claimed by `contextful pipeline apply`; immutable once claimed.\n\n{body}"))
 }
 
+fn validated_draft(document: &str, declaration: &Path, tasks: &Tasks) -> Result<String> {
+    let specs = collect(&[ManifestFile { path: "manifest@draft.toml".into(), text: document.to_owned() }])
+        .map_err(|e| SurfaceError::ApplyValidationRefused(e.to_string()))?;
+    let specs: BTreeMap<String, PipelineSpec> = specs.into_iter().map(|entry| (entry.spec.id.clone(), entry.spec)).collect();
+    let rendered = render(&specs)?;
+    for spec in specs.values() {
+        if let Some(schedule) = spec.schedule.as_deref() {
+            Schedule::parse(schedule).map_err(|e| SurfaceError::ApplyValidationRefused(format!("pipeline `{}`: {e}", spec.id)))?;
+        }
+        check(spec, declaration, tasks).map_err(|e| SurfaceError::ApplyValidationRefused(format!("pipeline `{}`: {e:#}", spec.id)))?;
+    }
+    Ok(rendered)
+}
+
+/// Store one validated, version-bound control draft without changing the applied pointer.
+pub(crate) fn edit(project: &ProjectArgs, declaration: Option<PathBuf>, expected: u64, document: &str, operator: &str, tasks: &Tasks, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<Value> {
+    let (located, _, control) = located(project, declaration)?;
+    let snapshots = owner(&control)?;
+    snapshots.initialized()?;
+    let text = validated_draft(document, &located.declaration, tasks)?;
+    let draft = Draft::new(expected, text, operator.to_owned())?;
+    snapshots.save_draft_guarded(&draft, boundary)?;
+    Ok(json!({ "expected": expected, "nonce": draft.nonce }))
+}
+
+/// Claim a verified control request's nonce in the selected store owner's snapshot state.
+pub(crate) fn claim_operator_nonce(project: &ProjectArgs, declaration: Option<PathBuf>, nonce: &str, signed_at: i64, now: i64, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<bool> {
+    let (_, _, control) = located(project, declaration)?;
+    owner(&control)?.claim_attestation_nonce_guarded(nonce, signed_at, now, boundary).map_err(Into::into)
+}
+
+/// Revalidate the saved draft and claim it only at the version the editor read.
+pub(crate) fn apply_draft(project: &ProjectArgs, declaration: Option<PathBuf>, expected: u64, nonce: &str, operator: &str, tasks: &Tasks, authority: &AdmittedAuthority, admit: &AdmitArgs, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<()> {
+    let (initial, _, control) = located(project, declaration.clone())?;
+    let snapshots = owner(&control)?;
+    snapshots.initialized()?;
+    let draft = snapshots.read_draft()?;
+    if draft.expected != expected || draft.nonce != nonce || draft.operator != operator {
+        return Err(SurfaceError::ManifestVersionConflict(format!("the draft read v{} and apply named v{expected}", draft.expected)).into());
+    }
+    if validated_draft(&draft.document, &initial.declaration, tasks)? != draft.document {
+        return Err(SurfaceError::ApplyValidationRefused("the saved draft is not the validated snapshot".into()).into());
+    }
+    let (fresh, _, control) = located(project, declaration)?;
+    let owner = owner(&control)?;
+    if owner.root() != snapshots.root() || fresh.declaration != initial.declaration {
+        return Err(SurfaceError::ConfigOwnerUnconfigured("the store's control owner changed during validation".into()).into());
+    }
+    match SyncAttestation::for_authority(&fresh, authority.clone(), admit, None)? {
+        Some(attestation) => {
+            owner.claim_draft_attested_guarded(&draft, |next, previous| {
+                let prior_snapshot = owner.read(expected)?;
+                let parent = previous.map(|receipt| (receipt, expected, prior_snapshot.as_str()));
+                attestation.receipt(&fresh.project.name, next, parent, &draft.document)
+            }, boundary)?;
+        }
+        None => { owner.claim_draft_guarded(&draft, boundary)?; }
+    }
+    Ok(())
+}
+
 #[derive(Serialize)]
 struct Change {
     id: String,
@@ -524,6 +585,14 @@ impl SyncAttestation {
         let unavailable = |why: String| SurfaceError::ControlAttestationUnavailable(why);
         let (authority, _) = admit.admit(project.project.as_deref(), "a synced control claim")
             .map_err(|e| unavailable(format!("admin capability: {e:#}")))?;
+        Self::for_authority(l, authority, admit, issuer_key)
+    }
+
+    fn for_authority(l: &Located, authority: AdmittedAuthority, admit: &AdmitArgs, issuer_key: Option<&Path>) -> Result<Option<Self>> {
+        if crate::sync::sync_config(l)?.0.is_none() {
+            return Ok(None);
+        }
+        let unavailable = |why: String| SurfaceError::ControlAttestationUnavailable(why);
         if !authority.permits(Action::Admin, &[]) {
             return Err(unavailable("the credential carries no admin grant".into()).into());
         }
diff --git a/crates/contextful-cli/src/serve.rs b/crates/contextful-cli/src/serve.rs
index dfe689f1e..165366961 100644
--- a/crates/contextful-cli/src/serve.rs
+++ b/crates/contextful-cli/src/serve.rs
@@ -15,6 +15,13 @@ use crate::root::root as project_root;
 use crate::clock::SystemClock;
 use anyhow::Result;
 use contextful_agent::http::{audience, ceiling, Admitting, HttpFace};
+#[cfg(feature = "data-plane")]
+use contextful_agent::http::{HttpRequest, HttpResponse, APPLY_PATH, EDIT_PATH, RECORD_PATH, WORKFLOWS_PATH};
+#[cfg(feature = "data-plane")]
+use contextful_core::surface::SurfaceError;
+use contextful_core::run::derive::task::Tasks;
+#[cfg(feature = "data-plane")]
+use contextful_engine::control::ControlError;
 use contextful_core::issue::{IssuancePolicy, MintContext, NodeRole};
 use contextful_core::ports::{Clock, SigningPort};
 #[cfg(feature = "data-plane")]
@@ -26,12 +33,15 @@ use contextful_memory::MemoryFault;
 use contextful_policy::exchange::answer as exchange_answer;
 use contextful_policy::issue::{SeedSigner, DEFAULT_SEED_PATH};
 use contextful_policy::possession::ProofChecker;
+use contextful_policy::audit::AuditLog;
 #[cfg(feature = "data-plane")]
-use contextful_agent::http::{HttpRequest, HttpResponse, APPLY_PATH, WORKFLOWS_PATH};
+use contextful_policy::verify::AdmittedAuthority;
 #[cfg(feature = "data-plane")]
-use contextful_core::surface::SurfaceError;
-use contextful_core::run::derive::task::Tasks;
-use contextful_policy::audit::AuditLog;
+use hmac::{Hmac, Mac};
+#[cfg(feature = "data-plane")]
+use sha2::{Digest, Sha256};
+#[cfg(feature = "data-plane")]
+use std::time::{SystemTime, UNIX_EPOCH};
 use contextful_policy::keyset::{KeyCheckpoint, StaticPins};
 use contextful_policy::revoke::RevocationState;
 use std::net::TcpListener;
@@ -109,6 +119,54 @@ pub struct ServeArgs {
     keyset: Option<PathBuf>,
 }
 
+#[cfg(feature = "data-plane")]
+fn operator_attestation(request: &HttpRequest, secret: &str) -> Option<(String, String, i64, i64)> {
+    let subject = request.header("X-Contextful-Operator")?;
+    let at: i64 = request.header("X-Contextful-Operator-Time")?.parse().ok()?;
+    let nonce = request.header("X-Contextful-Operator-Nonce")?;
+    let signature = request.header("X-Contextful-Operator-Signature")?;
+    if subject.is_empty() || subject.len() > 256 || nonce.len() != 32 || !nonce.bytes().all(|byte| byte.is_ascii_hexdigit()) || signature.len() != 64 {
+        return None;
+    }
+    let now = SystemTime::now().duration_since(UNIX_EPOCH).ok()?.as_secs() as i64;
+    if now.abs_diff(at) > 60 { return None; }
+    let digest = format!("{:x}", Sha256::digest(&request.body));
+    let message = format!("{}\n{}\n{digest}\n{subject}\n{at}\n{nonce}", request.method, request.target);
+    let mut mac = Hmac::<Sha256>::new_from_slice(secret.as_bytes()).ok()?;
+    mac.update(message.as_bytes());
+    let mut signature_bytes = [0u8; 32];
+    for (index, chunk) in signature.as_bytes().chunks_exact(2).enumerate() {
+        signature_bytes[index] = u8::from_str_radix(std::str::from_utf8(chunk).ok()?, 16).ok()?;
+    }
+    mac.verify_slice(&signature_bytes).ok()?;
+    Some((subject.to_owned(), nonce.to_owned(), at, now))
+}
+
+#[cfg(feature = "data-plane")]
+fn control_failure(error: anyhow::Error) -> HttpResponse {
+    if error.chain().any(|part| matches!(part.downcast_ref::<ControlError>(), Some(ControlError::OperatorAttestationInvalid(_)))) {
+        return HttpResponse::json(403, &json!({ "error": { "identifier": "ControlOperatorAttestationInvalid" } }));
+    }
+    if let Some(authority) = error.chain().find_map(|part| {
+        part.downcast_ref::<contextful_core::AuthorityError>().or_else(|| match part.downcast_ref::<ControlError>() {
+            Some(ControlError::Authority(authority)) => Some(authority),
+            _ => None,
+        })
+    }) {
+        return HttpResponse::json(401, &json!({ "error": { "identifier": authority.to_string().split(':').next().unwrap_or("AuthorityRevoked") } }));
+    }
+    let surface = error.chain().find_map(|part| part.downcast_ref::<SurfaceError>().or_else(|| {
+        match part.downcast_ref::<ControlError>() {
+            Some(ControlError::Surface(refusal)) => Some(refusal),
+            _ => None,
+        }
+    }));
+    let status = surface.map_or(503, SurfaceError::status);
+    let identifier = surface.map(|refusal| refusal.to_string().split(':').next().unwrap_or("ControlUnavailable").to_string())
+        .unwrap_or_else(|| "ControlUnavailable".into());
+    HttpResponse::json(status, &json!({ "error": { "identifier": identifier } }))
+}
+
 /// The issuer key pins, resolved and parsed before the listener binds; no generated key
 /// substitutes (`topology.publish-hostname.issuer-key`).
 fn issuer_pins(flag: Option<&str>) -> Result<StaticPins, ServeError> {
@@ -155,6 +213,86 @@ pub fn run(args: ServeArgs, tasks: &Tasks) -> Result<()> {
         None => face,
     };
     let audit = AuditLog::unanchored(located.project.audit_dir())?;
+    #[cfg(feature = "data-plane")]
+    let control_attestation_secret = std::env::var("CONTEXTFUL_CONTROL_ATTESTATION_SECRET").ok().filter(|secret| !secret.is_empty());
+    #[cfg(feature = "data-plane")]
+    let control_admit = AdmitArgs { public_key: args.public_key.clone(), audience: args.audience.clone(), denylist: args.denylist.clone(), keyset: args.keyset.clone(), holder_key: None };
+    #[cfg(feature = "data-plane")]
+    let control = |request: &HttpRequest, authority: &AdmittedAuthority| -> HttpResponse {
+        let path = request.target.split('?').next().unwrap_or_default();
+        let boundary = || {
+            let state = revocation().map_err(ControlError::Storage)?;
+            contextful_policy::verify::effect_boundary(authority,
+                &contextful_policy::verify::Admission::new(clock.now(), &state).expecting(audience))
+                .map_err(ControlError::from)?;
+            if (path == EDIT_PATH || path == APPLY_PATH) &&
+                control_attestation_secret.as_deref().and_then(|secret| operator_attestation(request, secret)).is_none() {
+                return Err(ControlError::OperatorAttestationInvalid("the operator signature expired before the control mutation".into()));
+            }
+            Ok(())
+        };
+        let malformed = || HttpResponse::json(400, &json!({ "error": { "identifier": "ControlRequestMalformed" } }));
+        let project = crate::run::ProjectArgs { project: Some(located.project.name.clone()), now: None };
+        let operator = if path == EDIT_PATH || path == APPLY_PATH {
+            match control_attestation_secret.as_deref() {
+                Some(secret) => match operator_attestation(request, secret) {
+                    Some((subject, nonce, signed_at, now)) => {
+                        match crate::cadence::claim_operator_nonce(&project, Some(located.declaration.clone()), &nonce, signed_at, now, &boundary) {
+                            Ok(true) => subject,
+                            Ok(false) => return HttpResponse::json(403, &json!({ "error": { "identifier": "ControlOperatorAttestationInvalid" } })),
+                            Err(error) => return control_failure(error),
+                        }
+                    }
+                    None => return HttpResponse::json(403, &json!({ "error": { "identifier": "ControlOperatorAttestationInvalid" } })),
+                },
+                None => return HttpResponse::json(403, &json!({ "error": { "identifier": "ControlOperatorAttestationInvalid" } })),
+            }
+        } else { String::new() };
+        let answer = match path {
+            WORKFLOWS_PATH => crate::cadence::published(&located.project, &located.declaration),
+            RECORD_PATH => contextful_policy::audit::entries(&located.project.audit_dir())
+                .map(|entries| {
+                    let count = entries.len();
+                    json!({ "entries": entries.into_iter().rev().take(1000).collect::<Vec<_>>(), "truncated": count > 1000, "declined": count.saturating_sub(1000) })
+                }).map_err(anyhow::Error::from),
+            EDIT_PATH | APPLY_PATH => {
+                let body: Value = match serde_json::from_slice(&request.body) {
+                    Ok(Value::Object(body)) => Value::Object(body),
+                    _ => return malformed(),
+                };
+                let Some(fields) = body.as_object() else { unreachable!() };
+                let Some(expected) = fields.get("expected").and_then(Value::as_u64) else { return malformed() };
+                if path == EDIT_PATH {
+                    if fields.len() != 2 || fields.keys().any(|field| field != "expected" && field != "document") {
+                        return malformed();
+                    }
+                    let Some(document) = fields.get("document").and_then(Value::as_str) else { return malformed() };
+                    if audit.append(json!({ "contextful.control.operation": "edit", "contextful.operator.subject": operator,
+                        "contextful.operator.attestation": "console-hmac",
+                        "contextful.credential": authority.credential_id(), "contextful.control.expected": expected })).is_err() {
+                        return HttpResponse::json(503, &json!({ "error": { "identifier": "AuditEntryUnpersisted" } }));
+                    }
+                    crate::cadence::edit(&project, Some(located.declaration.clone()), expected, document, &operator, tasks, &boundary)
+                } else {
+                    if fields.len() != 2 { return malformed(); }
+                    let Some(nonce) = fields.get("nonce").and_then(Value::as_str) else { return malformed() };
+                    if audit.append(json!({ "contextful.control.operation": "apply", "contextful.operator.subject": operator,
+                        "contextful.operator.attestation": "console-hmac",
+                        "contextful.credential": authority.credential_id(), "contextful.control.expected": expected,
+                        "contextful.control.draft_nonce": nonce })).is_err() {
+                        return HttpResponse::json(503, &json!({ "error": { "identifier": "AuditEntryUnpersisted" } }));
+                    }
+                    crate::cadence::apply_draft(&project, Some(located.declaration.clone()), expected, nonce, &operator, tasks, authority, &control_admit, &boundary)
+                        .and_then(|()| crate::cadence::published(&located.project, &located.declaration))
+                }
+            }
+            _ => unreachable!(),
+        };
+        match answer {
+            Ok(state) => HttpResponse::json(200, &state),
+            Err(error) => control_failure(error),
+        }
+    };
     let exchange = crate::token::configured_exchange(&root)?;
     let mint_material = if exchange.is_some() {
         let policy = std::fs::read_to_string(root.join(IssuancePolicy::PATH))?;
@@ -210,38 +348,6 @@ pub fn run(args: ServeArgs, tasks: &Tasks) -> Result<()> {
         let result = exchange_answer(exchange.as_ref(), &request.body, request.header("DPoP"), &proofs, issuance, &ctx);
         contextful_agent::http::HttpResponse::json(result.status, &result.body)
     };
-    #[cfg(feature = "data-plane")]
-    let control_admit = AdmitArgs { public_key: args.public_key.clone(), audience: args.audience.clone(), denylist: args.denylist.clone(), keyset: args.keyset.clone(), holder_key: None };
-    #[cfg(feature = "data-plane")]
-    let control = |request: &HttpRequest| -> HttpResponse {
-        let answer = match request.target.split('?').next().unwrap_or_default() {
-            WORKFLOWS_PATH => crate::cadence::published(&located.project, &located.declaration),
-            APPLY_PATH => {
-                let body: Value = match serde_json::from_slice(&request.body) {
-                    Ok(Value::Object(body)) => Value::Object(body),
-                    _ => return HttpResponse::json(400, &json!({ "error": { "identifier": "ControlRequestMalformed" } })),
-                };
-                let Some(fields) = body.as_object() else { unreachable!() };
-                if fields.len() > 1 || fields.keys().any(|field| field != "id") || fields.get("id").is_some_and(|id| !id.is_string()) {
-                    return HttpResponse::json(400, &json!({ "error": { "identifier": "ControlRequestMalformed" } }));
-                }
-                let project = crate::run::ProjectArgs { project: Some(located.project.name.clone()), now: None };
-                crate::cadence::apply(&project, Some(located.declaration.clone()), body["id"].as_str(), tasks, &control_admit, None)
-                    .and_then(|()| crate::cadence::published(&located.project, &located.declaration))
-            }
-            _ => unreachable!(),
-        };
-        match answer {
-            Ok(state) => HttpResponse::json(200, &state),
-            Err(error) => {
-                let surface = error.chain().find_map(|part| part.downcast_ref::<SurfaceError>());
-                let status = surface.map_or(503, SurfaceError::status);
-                let identifier = surface.map(|refusal| refusal.to_string().split(':').next().unwrap_or("ControlUnavailable").to_string())
-                    .unwrap_or_else(|| "ControlUnavailable".into());
-                HttpResponse::json(status, &json!({ "error": { "identifier": identifier } }))
-            }
-        }
-    };
     let http = HttpFace::new(&face, &clock, &audit, admitting, Some(ceiling))
         .map_err(anyhow::Error::msg)?
         .with_exchange(&exchange_route, exchange.is_none());
diff --git a/crates/contextful-cli/tests/integration/serve.rs b/crates/contextful-cli/tests/integration/serve.rs
index f1ba95fbe..f039d0dac 100644
--- a/crates/contextful-cli/tests/integration/serve.rs
+++ b/crates/contextful-cli/tests/integration/serve.rs
@@ -5,6 +5,8 @@
 use contextful_core::time::Instant;
 use contextful_policy::possession::{jwk_thumbprint, sign_proof, ProofRequest};
 use ed25519_dalek::SigningKey;
+use hmac::{Hmac, Mac};
+use sha2::{Digest, Sha256};
 use serde_json::{json, Value};
 use std::io::{BufRead, BufReader, Read, Write};
 use std::net::TcpStream;
@@ -144,6 +146,7 @@ fn serve(dir: &Path, args: &[&str]) -> (Listener, String) {
 fn serve_binary(binary: &Path, dir: &Path, args: &[&str]) -> (Listener, String) {
     let mut child = Command::new(binary)
         .args(args)
+        .env("CONTEXTFUL_CONTROL_ATTESTATION_SECRET", "separate-attestation-secret")
         .current_dir(dir)
         .env_remove("CONTEXTFUL_ISSUER_PUBKEY")
         .env_remove("CONTEXTFUL_AUDIENCE")
@@ -171,10 +174,15 @@ fn control_apply_uses_the_host_registered_task_set() {
     std::fs::write(root.join("contextful.toml"), format!("authoring_posture = \"per_request\"\n{}", super::derive::host_manifest("word-split"))).unwrap();
     let imported = Command::new(&binary).args(["pipeline", "import", "--project", "research"]).current_dir(root).output().unwrap();
     stdout(&imported);
-    std::fs::write(root.join("contextful.toml"), format!("authoring_posture = \"per_request\"\n{}", super::derive::host_manifest("word-split").replace("[pipeline.source]", "schedule = \"every 1h\"\n[pipeline.source]"))).unwrap();
+    let draft = super::derive::host_manifest("word-split").replace("[pipeline.source]", "schedule = \"every 1h\"\n[pipeline.source]");
+    std::fs::write(root.join("contextful.toml"), format!("authoring_posture = \"per_request\"\n{draft}")).unwrap();
     let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
     let (_listener, addr) = serve_binary(&binary, root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
-    let (status, state) = control(&addr, "POST", "/control/apply", Some(&admin), "{}");
+    let edit = json!({ "expected": 1, "document": draft }).to_string();
+    let (status, edited) = control(&addr, "POST", "/control/edit", Some(&admin), &edit);
+    assert_eq!(status, 200, "{edited}");
+    let apply = json!({ "expected": 1, "nonce": edited["nonce"] }).to_string();
+    let (status, state) = control(&addr, "POST", "/control/apply", Some(&admin), &apply);
     assert_eq!(status, 200, "{state}");
     assert_eq!(state["applied"], json!(2));
 }
@@ -205,6 +213,244 @@ fn query() -> Value {
     json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "context.query", "arguments": { "sql": "SELECT note_id FROM \"research/notes\"" } } })
 }
 
+fn control(addr: &str, method: &str, path: &str, token: Option<&str>, body: &str) -> (u16, Value) {
+    let headers = if method == "POST" && (path == "/control/edit" || path == "/control/apply") {
+        let at = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
+        let nonce = NONCE.fetch_add(1, Ordering::SeqCst);
+        attestation(path, body, "user://dana@acme.example", at, &format!("{nonce:032x}"))
+    } else { String::new() };
+    control_headers(addr, method, path, token, body, &headers)
+}
+
+fn control_headers(addr: &str, method: &str, path: &str, token: Option<&str>, body: &str, headers: &str) -> (u16, Value) {
+    let mut stream = TcpStream::connect(addr).unwrap();
+    let auth = token.map(|token| format!("Authorization: Bearer {token}\r\n")).unwrap_or_default();
+    write!(stream, "{method} {path} HTTP/1.1\r\n{auth}{headers}Content-Type: application/json\r\nContent-Length: {}\r\n\r\n{body}", body.len()).unwrap();
+    let mut raw = String::new();
+    stream.read_to_string(&mut raw).unwrap();
+    let (head, answer) = raw.split_once("\r\n\r\n").unwrap();
+    (head.split(' ').nth(1).unwrap().parse().unwrap(), serde_json::from_str(answer).unwrap())
+}
+
+fn attestation(path: &str, body: &str, operator: &str, at: i64, nonce: &str) -> String {
+    let digest = format!("{:x}", Sha256::digest(body.as_bytes()));
+    let mut mac = Hmac::<Sha256>::new_from_slice(b"separate-attestation-secret").unwrap();
+    mac.update(format!("POST\n{path}\n{digest}\n{operator}\n{at}\n{nonce}").as_bytes());
+    let signature = mac.finalize().into_bytes().iter().map(|byte| format!("{byte:02x}")).collect::<String>();
+    format!("X-Contextful-Operator: {operator}\r\nX-Contextful-Operator-Time: {at}\r\nX-Contextful-Operator-Nonce: {nonce}\r\nX-Contextful-Operator-Signature: {signature}\r\n")
+}
+
+#[test]
+fn pending_control_edit_refuses_revoked_authority_before_nonce_or_draft_commit() {
+    pending_control_mutation(false, false);
+}
+
+#[test]
+fn pending_control_apply_refuses_revoked_authority_before_nonce_or_pointer_commit() {
+    pending_control_mutation(true, false);
+}
+
+#[test]
+fn pending_control_edit_refuses_expired_authority_before_nonce_or_draft_commit() {
+    pending_control_mutation(false, true);
+}
+
+fn pending_control_mutation(apply: bool, expired: bool) {
+    let (dir, public) = project();
+    let root = dir.path();
+    let original = "[[pipeline]]\nid = \"filings-flow\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
+    std::fs::create_dir_all(root.join("pipelines")).unwrap();
+    std::fs::write(root.join("pipelines/filings.toml"), original).unwrap();
+    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
+    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    let admin = stdout(&run(root, &["token", "mint", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", if expired { "2" } else { "900" }]));
+    let edit = json!({ "expected": 1, "document": original }).to_string();
+    let (path, body) = if apply {
+        let (status, saved) = control(&addr, "POST", "/control/edit", Some(&admin), &edit);
+        assert_eq!(status, 200, "{saved}");
+        ("/control/apply", json!({ "expected": 1, "nonce": saved["nonce"] }).to_string())
+    } else { ("/control/edit", edit) };
+    let snapshots = root.join(".contextful/control/research");
+    let lock = std::fs::OpenOptions::new().read(true).write(true).open(snapshots.join("manifest.lock")).unwrap();
+    lock.lock().unwrap();
+    let at = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
+    let nonce = "f".repeat(32);
+    let headers = attestation(path, &body, "user://dana@acme.example", at, &nonce);
+    std::thread::scope(|scope| {
+        let pending = scope.spawn(|| control_headers(&addr, "POST", path, Some(&admin), &body, &headers));
+        std::thread::sleep(std::time::Duration::from_millis(if expired { 3100 } else { 200 }));
+        if !expired { stdout(&run(root, &["token", "revoke", "--principal-class", "delegated"])); }
+        drop(lock);
+        let (status, response) = pending.join().unwrap();
+        assert_eq!(status, 401, "{response}");
+        assert_eq!(response["error"]["identifier"], if expired { "AuthorityExpired" } else { "AuthorityRevoked" });
+    });
+    assert!(!snapshots.join(format!("attestation-nonces/{at}/{nonce}")).exists());
+    assert_eq!(std::fs::read_to_string(snapshots.join("manifest@current")).unwrap().trim(), "1");
+    assert_eq!(snapshots.join("manifest@draft.json").exists(), apply);
+}
+
+#[test]
+fn admin_changes_require_fresh_console_attestation_and_record_the_operator() {
+    let (dir, public) = project();
+    let root = dir.path();
+    let original = "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1h\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
+    std::fs::create_dir_all(root.join("pipelines")).unwrap();
+    std::fs::write(root.join("pipelines/filings.toml"), original).unwrap();
+    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
+    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://service@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
+    let (listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    assert_eq!(control(&addr, "GET", "/control/record", Some(&admin), "").0, 200);
+    let edit = json!({ "expected": 1, "document": original.replace("every 1h", "every 1d") }).to_string();
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, "").0, 403);
+    let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
+    let stale = attestation("/control/edit", &edit, "operator-a", now - 120, &"1".repeat(32));
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &stale).0, 403);
+    let forged = attestation("/control/edit", &edit, "operator-a", now, &"2".repeat(32)).replace("Operator: operator-a", "Operator: operator-b");
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &forged).0, 403);
+    let signed = attestation("/control/edit", &edit, "operator-a", now, &"3".repeat(32));
+    let (status, saved) = control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &signed);
+    assert_eq!(status, 200, "{saved}");
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &signed).0, 403);
+    drop(listener);
+    let (_restart, restarted_addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    assert_eq!(control_headers(&restarted_addr, "POST", "/control/edit", Some(&admin), &edit, &signed).0, 403);
+    let apply = json!({ "expected": 1, "nonce": saved["nonce"] }).to_string();
+    let signed = attestation("/control/apply", &apply, "operator-a", now, &"4".repeat(32));
+    let (status, result) = control_headers(&restarted_addr, "POST", "/control/apply", Some(&admin), &apply, &signed);
+    assert_eq!(status, 200, "{result}");
+    let entries = contextful_policy::audit::entries(&root.join(".contextful/audit")).unwrap();
+    assert!(entries.iter().any(|entry| entry.attributes["contextful.operator.subject"] == "operator-a" && entry.attributes["contextful.control.operation"] == "apply"));
+    let (status, record) = control(&restarted_addr, "GET", "/control/record", Some(&admin), "");
+    assert_eq!(status, 200, "{record}");
+    assert!(record["entries"].as_array().unwrap().iter().any(|entry| entry["attributes"]["contextful.operator.subject"] == "operator-a"));
+}
+
+#[test]
+fn control_routes_require_admin_and_project_applied_workflows() {
+    let (dir, public) = project();
+    let root = dir.path();
+    let pipeline = "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1h\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
+    std::fs::create_dir_all(root.join("pipelines")).unwrap();
+    std::fs::write(root.join("pipelines/filings.toml"), pipeline).unwrap();
+    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
+    let read = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "read", "--table", "*", "--ttl", "900"]));
+    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
+    let narrow_admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "unrelated/*", "--ttl", "900"]));
+    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+
+    assert_eq!(control(&addr, "GET", "/control/workflows", None, "").0, 401);
+    assert_eq!(control(&addr, "GET", "/control/record", None, "").0, 401);
+    let (status, answer) = control(&addr, "GET", "/control/workflows", Some(&read), "");
+    assert_eq!(status, 403, "{answer}");
+    assert_eq!(control(&addr, "GET", "/control/record", Some(&read), "").0, 403);
+    assert_eq!(control(&addr, "POST", "/control/apply", Some(&read), "{}").0, 403);
+    assert_eq!(control(&addr, "GET", "/control/workflows", Some(&narrow_admin), "").0, 403);
+    let (status, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
+    assert_eq!(status, 200, "{view}");
+    assert_eq!(view["applied"], json!(1));
+    assert_eq!(view["pipelines"][0]["id"], "filings-flow");
+    assert_eq!(view["pipelines"][0]["tables"], json!(["research/notes"]));
+
+    assert_eq!(control(&addr, "POST", "/control/apply", Some(&admin), "{\"id\":1}").0, 400);
+
+    let edited = json!({ "expected": 1, "document": pipeline.replace("every 1h", "every 1d") }).to_string();
+    let (_, saved) = control(&addr, "POST", "/control/edit", Some(&admin), &edited);
+    let apply = json!({ "expected": 1, "nonce": saved["nonce"] }).to_string();
+    let (status, applied) = control(&addr, "POST", "/control/apply", Some(&admin), &apply);
+    assert_eq!(status, 200, "{applied}");
+    assert_eq!(applied["applied"], json!(2));
+    let (_, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
+    assert_eq!(view["pipelines"][0]["schedule"], "every 1d");
+}
+
+#[test]
+fn control_edit_saves_a_validated_draft_and_apply_claims_its_expected_version() {
+    let (dir, public) = project();
+    let root = dir.path();
+    let original = "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1h\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
+    std::fs::create_dir_all(root.join("pipelines")).unwrap();
+    std::fs::write(root.join("pipelines/filings.toml"), original).unwrap();
+    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
+    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
+    let read = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "read", "--table", "*", "--ttl", "900"]));
+    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    let changed = original.replace("every 1h", "every 1d");
+    let edit = json!({ "expected": 1, "document": changed }).to_string();
+    let (status, absent) = control(&addr, "POST", "/control/apply", Some(&admin), &json!({ "expected": 1, "nonce": "000000000000000000000000000000000000000000000000" }).to_string());
+    assert_eq!(status, 409, "{absent}");
+    assert_eq!(absent["error"]["identifier"], "ControlDraftAbsent");
+    assert_eq!(control(&addr, "POST", "/control/edit", None, &edit).0, 401);
+    assert_eq!(control(&addr, "POST", "/control/edit", Some(&read), &edit).0, 403);
+    let invalid = json!({ "expected": 1, "document": changed.replace("every 1d", "invalid schedule") }).to_string();
+    assert_eq!(control(&addr, "POST", "/control/edit", Some(&admin), &invalid).0, 422);
+    let (status, draft) = control(&addr, "POST", "/control/edit", Some(&admin), &edit);
+    assert_eq!(status, 200, "{draft}");
+    assert_eq!(draft["expected"], 1);
+    let declaration = root.join("contextful.toml");
+    let owner_text = std::fs::read_to_string(&declaration).unwrap();
+    std::fs::write(&declaration, format!("{owner_text}\n[control]\nurl = \"http://127.0.0.1:12345/\"\n")).unwrap();
+    let apply = json!({ "expected": 1, "nonce": draft["nonce"] }).to_string();
+    let (status, refused) = control(&addr, "POST", "/control/apply", Some(&admin), &apply);
+    assert_eq!(status, 503, "{refused}");
+    assert_eq!(refused["error"]["identifier"], "ConfigOwnerUnconfigured");
+    std::fs::write(&declaration, owner_text).unwrap();
+    let (_, before) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
+    assert_eq!(before["applied"], 1);
+    assert_eq!(before["pipelines"][0]["schedule"], "every 1h");
+    let (status, applied) = control(&addr, "POST", "/control/apply", Some(&admin), &apply);
+    assert_eq!(status, 200, "{applied}");
+    assert_eq!(applied["applied"], 2);
+    assert_eq!(applied["pipelines"][0]["schedule"], "every 1d");
+    let (status, refused) = control(&addr, "POST", "/control/apply", Some(&admin), &apply);
+    assert_eq!(status, 409, "{refused}");
+    assert_eq!(refused["error"]["identifier"], "ControlDraftAbsent");
+    let later = original.replace("every 1h", "every 2d");
+    let edit = json!({ "expected": 2, "document": later }).to_string();
+    let (_, later_draft) = control(&addr, "POST", "/control/edit", Some(&admin), &edit);
+    std::fs::write(root.join("pipelines/filings.toml"), original.replace("every 1h", "every 3d")).unwrap();
+    stdout(&run(root, &["pipeline", "apply", "filings-flow", "--project", "research"]));
+    let (status, refused) = control(&addr, "POST", "/control/apply", Some(&admin), &json!({ "expected": 2, "nonce": later_draft["nonce"] }).to_string());
+    assert_eq!(status, 409, "{refused}");
+    assert_eq!(refused["error"]["identifier"], "ManifestVersionConflict");
+}
+
+#[test]
+fn published_workflow_listing_caps_entries_and_flags_truncation() {
+    let (dir, public) = project();
+    let root = dir.path();
+    let snapshot = contextful_engine::control::SnapshotDir::open(&root.join(".contextful/control/research"));
+    let document = (0..1001).map(|index| format!(
+        "[[pipeline]]\nid = \"flow-{index:04}\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = {{ endpoint = \"https://example.test/filings\" }}\n"
+    )).collect::<Vec<_>>().join("\n");
+    snapshot.import(&document).unwrap();
+    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
+    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    let (status, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
+    assert_eq!(status, 200, "{view}");
+    assert_eq!(view["pipelines"].as_array().unwrap().len(), 1000);
+    assert_eq!(view["truncated"], true);
+    assert_eq!(view["declined"], 0);
+}
+
+#[test]
+fn published_workflows_include_completed_local_runs_before_sync_push() {
+    let vendor = super::pipeline::Vendor::start(|_| (200, "[{\"note_id\":\"filed\"}]".into()));
+    let (dir, public) = project();
+    let root = dir.path();
+    let pipeline = format!("[[pipeline]]\nid = \"filings-flow\"\ntables = [\"research/filings\"]\n[pipeline.source]\nname = \"http\"\nconfig = {{ endpoint = \"{}\" }}\n", vendor.url("/filings"));
+    std::fs::create_dir_all(root.join("pipelines")).unwrap();
+    std::fs::write(root.join("pipelines/filings.toml"), pipeline).unwrap();
+    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
+    stdout(&run(root, &["pipeline", "run", "filings-flow", "--project", "research", "--run-id", "run-flow", "--site-id", "site-a"]));
+    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
+    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    let (status, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
+    assert_eq!(status, 200, "{view}");
+    assert_eq!(view["runs"]["filings-flow"]["run_id"], "run-flow");
+    assert_eq!(view["runs"]["filings-flow"]["status"], "success");
+}
+
 fn post_claim(addr: &str, token: &str, body: &Value, browser_origin: bool) -> (u16, Value) {
     let body = body.to_string();
     let origin = if browser_origin { "Origin: https://console.example\r\n" } else { "" };
@@ -339,86 +585,6 @@ fn served_exchange_mints_a_reader_credential_for_the_read_face() {
     assert_eq!(refused["error"]["identifier"], "ExchangeAssertionInvalid");
 }
 
-fn control(addr: &str, method: &str, path: &str, token: Option<&str>, body: &str) -> (u16, Value) {
-    let mut stream = TcpStream::connect(addr).unwrap();
-    let auth = token.map(|token| format!("Authorization: Bearer {token}\r\n")).unwrap_or_default();
-    write!(stream, "{method} {path} HTTP/1.1\r\n{auth}Content-Type: application/json\r\nContent-Length: {}\r\n\r\n{body}", body.len()).unwrap();
-    let mut raw = String::new();
-    stream.read_to_string(&mut raw).unwrap();
-    let (head, answer) = raw.split_once("\r\n\r\n").unwrap();
-    (head.split(' ').nth(1).unwrap().parse().unwrap(), serde_json::from_str(answer).unwrap())
-}
-
-#[test]
-fn control_routes_require_admin_and_project_applied_workflows() {
-    let (dir, public) = project();
-    let root = dir.path();
-    let pipeline = "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1h\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
-    std::fs::create_dir_all(root.join("pipelines")).unwrap();
-    std::fs::write(root.join("pipelines/filings.toml"), pipeline).unwrap();
-    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
-    let read = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "read", "--table", "*", "--ttl", "900"]));
-    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
-    let narrow_admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "unrelated/*", "--ttl", "900"]));
-    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
-
-    assert_eq!(control(&addr, "GET", "/control/workflows", None, "").0, 401);
-    let (status, answer) = control(&addr, "GET", "/control/workflows", Some(&read), "");
-    assert_eq!(status, 403, "{answer}");
-    assert_eq!(control(&addr, "POST", "/control/apply", Some(&read), "{}").0, 403);
-    assert_eq!(control(&addr, "GET", "/control/workflows", Some(&narrow_admin), "").0, 403);
-    let (status, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
-    assert_eq!(status, 200, "{view}");
-    assert_eq!(view["applied"], json!(1));
-    assert_eq!(view["pipelines"][0]["id"], "filings-flow");
-    assert_eq!(view["pipelines"][0]["tables"], json!(["research/notes"]));
-
-    assert_eq!(control(&addr, "POST", "/control/apply", Some(&admin), "{\"id\":1}").0, 400);
-
-    std::fs::write(root.join("pipelines/filings.toml"), pipeline.replace("every 1h", "every 1d")).unwrap();
-    let (status, applied) = control(&addr, "POST", "/control/apply", Some(&admin), "{\"id\":\"filings-flow\"}");
-    assert_eq!(status, 200, "{applied}");
-    assert_eq!(applied["applied"], json!(2));
-    let (_, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
-    assert_eq!(view["pipelines"][0]["schedule"], "every 1d");
-}
-
-#[test]
-fn published_workflow_listing_caps_entries_and_flags_truncation() {
-    let (dir, public) = project();
-    let root = dir.path();
-    let snapshot = contextful_engine::control::SnapshotDir::open(&root.join(".contextful/control/research"));
-    let document = (0..1001).map(|index| format!(
-        "[[pipeline]]\nid = \"flow-{index:04}\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = {{ endpoint = \"https://example.test/filings\" }}\n"
-    )).collect::<Vec<_>>().join("\n");
-    snapshot.import(&document).unwrap();
-    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
-    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
-    let (status, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
-    assert_eq!(status, 200, "{view}");
-    assert_eq!(view["pipelines"].as_array().unwrap().len(), 1000);
-    assert_eq!(view["truncated"], true);
-    assert_eq!(view["declined"], 0);
-}
-
-#[test]
-fn published_workflows_include_completed_local_runs_before_sync_push() {
-    let vendor = super::pipeline::Vendor::start(|_| (200, "[{\"note_id\":\"filed\"}]".into()));
-    let (dir, public) = project();
-    let root = dir.path();
-    let pipeline = format!("[[pipeline]]\nid = \"filings-flow\"\ntables = [\"research/filings\"]\n[pipeline.source]\nname = \"http\"\nconfig = {{ endpoint = \"{}\" }}\n", vendor.url("/filings"));
-    std::fs::create_dir_all(root.join("pipelines")).unwrap();
-    std::fs::write(root.join("pipelines/filings.toml"), pipeline).unwrap();
-    stdout(&run(root, &["pipeline", "import", "--project", "research"]));
-    stdout(&run(root, &["pipeline", "run", "filings-flow", "--project", "research", "--run-id", "run-flow", "--site-id", "site-a"]));
-    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://dana@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
-    let (_listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
-    let (status, view) = control(&addr, "GET", "/control/workflows", Some(&admin), "");
-    assert_eq!(status, 200, "{view}");
-    assert_eq!(view["runs"]["filings-flow"]["run_id"], "run-flow");
-    assert_eq!(view["runs"]["filings-flow"]["status"], "success");
-}
-
 /// The network transport refuses to start without its audience, its ceiling, or an issuer key that resolves and parses.
 // spec: topology.publish-hostname.issuer-key@a7736a7f
 #[test]
@@ -657,3 +823,48 @@ fn serve_caches_a_repeated_statement_under_its_declared_budget() {
     assert_eq!(states(&["--result-cache-bytes", "65536"]), [json!("miss"), json!("hit")]);
     assert_eq!(states(&[]), [Value::Null, Value::Null], "no declared budget caches nothing");
 }
+
+#[test]
+fn synced_admin_draft_apply_keeps_a_signed_receipt_under_network_authority() {
+    let (dir, public) = project();
+    let root = dir.path();
+    let original = "[[pipeline]]\nid = \"filings-flow\"\nschedule = \"every 1h\"\ntables = [\"research/notes\"]\n[pipeline.source]\nname = \"http\"\nconfig = { endpoint = \"https://example.test/filings\" }\n";
+    std::fs::create_dir_all(root.join("pipelines")).unwrap();
+    std::fs::write(root.join("pipelines/filings.toml"), original).unwrap();
+    let admin = stdout(&run(root, &["token", "mint", "--issuer-key", ".contextful/issuer.seed", "--on-behalf-of", "user://service@acme.example", "--zone", "on-prem:hq", "--action", "admin", "--table", "*", "--ttl", "900"]));
+    let bucket = tempfile::tempdir().unwrap();
+    std::fs::write(root.join(".contextful/context/research/config.toml"), format!("[node]\nid = \"site-a\"\n[sync]\nendpoint = \"file://{}\"\nbucket = \"control-test\"\nprefix = \"team\"\ncoordination = \"single-writer\"\n", bucket.path().display())).unwrap();
+    let imported = Command::new(env!("CARGO_BIN_EXE_contextful")).args(["pipeline", "import", "--project", "research", "--public-key", &public, "--audience", AUD]).env("CONTEXTFUL_TOKEN", &admin).current_dir(root).output().unwrap();
+    stdout(&imported);
+    let (listener, addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    assert_eq!(control(&addr, "GET", "/control/record", Some(&admin), "").0, 200);
+    let edit = json!({ "expected": 1, "document": original.replace("every 1h", "every 1d") }).to_string();
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, "").0, 403);
+    let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
+    let stale = attestation("/control/edit", &edit, "operator-a", now - 120, &"1".repeat(32));
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &stale).0, 403);
+    let forged = attestation("/control/edit", &edit, "operator-a", now, &"2".repeat(32)).replace("Operator: operator-a", "Operator: operator-b");
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &forged).0, 403);
+    let signed = attestation("/control/edit", &edit, "operator-a", now, &"3".repeat(32));
+    let (status, saved) = control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &signed);
+    assert_eq!(status, 200, "{saved}");
+    assert_eq!(control_headers(&addr, "POST", "/control/edit", Some(&admin), &edit, &signed).0, 403);
+    drop(listener);
+    let (_restart, restarted_addr) = serve(root, &["serve", "--http", "127.0.0.1:0", "--audience", AUD, "--max-in-flight", "2", "--project", "research", "--public-key", &public]);
+    assert_eq!(control_headers(&restarted_addr, "POST", "/control/edit", Some(&admin), &edit, &signed).0, 403);
+    let apply = json!({ "expected": 1, "nonce": saved["nonce"] }).to_string();
+    let signed = attestation("/control/apply", &apply, "operator-a", now, &"4".repeat(32));
+    let (status, result) = control_headers(&restarted_addr, "POST", "/control/apply", Some(&admin), &apply, &signed);
+    assert_eq!(status, 200, "{result}");
+    let receipts = root.join(".contextful/control/research");
+    let receipt: contextful_policy::control_receipt::ControlReceipt = serde_json::from_str(&std::fs::read_to_string(receipts.join("receipt@v2.json")).unwrap()).unwrap();
+    let snapshot = std::fs::read(receipts.join("manifest@v2.toml")).unwrap();
+    let signer = contextful_policy::issue::SeedSigner::resolve(Some(&root.join(".contextful/issuer.seed"))).unwrap();
+    receipt.verify("research", &snapshot, &[contextful_policy::issue::SignerKey::of(&signer)]).unwrap();
+    assert!(receipt.parent.is_some());
+    let entries = contextful_policy::audit::entries(&root.join(".contextful/audit")).unwrap();
+    assert!(entries.iter().any(|entry| entry.attributes["contextful.operator.subject"] == "operator-a" && entry.attributes["contextful.control.operation"] == "apply"));
+    let (status, record) = control(&restarted_addr, "GET", "/control/record", Some(&admin), "");
+    assert_eq!(status, 200, "{record}");
+    assert!(record["entries"].as_array().unwrap().iter().any(|entry| entry["attributes"]["contextful.operator.subject"] == "operator-a"));
+}
diff --git a/crates/contextful-context/src/read/deadline.rs b/crates/contextful-context/src/read/deadline.rs
new file mode 100644
index 000000000..35009e603
--- /dev/null
+++ b/crates/contextful-context/src/read/deadline.rs
@@ -0,0 +1,23 @@
+//! The connection's deadline watcher and completion acknowledgement.
+
+use std::sync::mpsc::{Receiver, RecvTimeoutError};
+use std::time::{Duration, Instant};
+
+// DuckDB preparation resets its interrupt flag; cancellation persists until completion.
+const INTERRUPT_RETRY: Duration = Duration::from_millis(1);
+
+pub(crate) fn watch(
+    started: Instant,
+    duration: Duration,
+    receiver: Receiver<()>,
+    mut interrupt: impl FnMut(),
+) {
+    let mut wait = duration.saturating_sub(started.elapsed());
+    loop {
+        match receiver.recv_timeout(wait) {
+            Ok(()) | Err(RecvTimeoutError::Disconnected) => return,
+            Err(RecvTimeoutError::Timeout) => interrupt(),
+        }
+        wait = INTERRUPT_RETRY;
+    }
+}
diff --git a/crates/contextful-context/src/read/engine.rs b/crates/contextful-context/src/read/engine.rs
index 5daaa209c..de80408c1 100644
--- a/crates/contextful-context/src/read/engine.rs
+++ b/crates/contextful-context/src/read/engine.rs
@@ -331,9 +331,7 @@ impl SqlEngine {
         let duration = std::time::Duration::from_millis(milliseconds);
         let started = std::time::Instant::now();
         let watcher = std::thread::spawn(move || {
-            if receiver.recv_timeout(duration).is_err_and(|e| e == std::sync::mpsc::RecvTimeoutError::Timeout) {
-                handle.interrupt();
-            }
+            super::deadline::watch(started, duration, receiver, || handle.interrupt());
         });
         let result = run(self);
         let elapsed = started.elapsed().as_millis() as u64;
diff --git a/crates/contextful-context/src/read/mod.rs b/crates/contextful-context/src/read/mod.rs
index 7daf51de7..891be5fb8 100644
--- a/crates/contextful-context/src/read/mod.rs
+++ b/crates/contextful-context/src/read/mod.rs
@@ -2,6 +2,7 @@
 //! and templates, descriptions and file previews, and ranked retrieval.
 
 pub mod audit;
+mod deadline;
 pub(crate) mod engine;
 pub mod evidence;
 pub mod face;
diff --git a/crates/contextful-context/tests/integration/main.rs b/crates/contextful-context/tests/integration/main.rs
index d19cddd36..b11009edf 100644
--- a/crates/contextful-context/tests/integration/main.rs
+++ b/crates/contextful-context/tests/integration/main.rs
@@ -13,6 +13,8 @@ mod init;
 mod lay_out;
 mod ledger;
 mod read;
+#[cfg(feature = "read")]
+mod read_deadline;
 mod reconcile;
 mod retention;
 mod reserve;
diff --git a/crates/contextful-context/tests/integration/read_deadline.rs b/crates/contextful-context/tests/integration/read_deadline.rs
new file mode 100644
index 000000000..d2d716e9a
--- /dev/null
+++ b/crates/contextful-context/tests/integration/read_deadline.rs
@@ -0,0 +1,72 @@
+//! Cancellation persists across preparation's interrupt reset and stops before reuse.
+
+#[path = "../../src/read/deadline.rs"]
+mod deadline;
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{mpsc, Arc};
+use std::time::{Duration, Instant};
+
+fn reset_then_stop(acknowledge: bool) {
+    let interrupted = Arc::new(AtomicBool::new(false));
+    let (cancel, receiver) = mpsc::channel();
+    let (fired, observed) = mpsc::channel();
+    let (resume, barrier) = mpsc::channel();
+    let flag = interrupted.clone();
+    let watcher = std::thread::spawn(move || {
+        let mut first = true;
+        deadline::watch(Instant::now(), Duration::ZERO, receiver, || {
+            flag.store(true, Ordering::SeqCst);
+            fired.send(()).unwrap();
+            if first {
+                first = false;
+                barrier.recv().unwrap();
+            }
+        });
+    });
+    observed
+        .recv_timeout(Duration::from_secs(5))
+        .expect("the deadline interrupts");
+    interrupted.store(false, Ordering::SeqCst);
+    resume.send(()).unwrap();
+    let reasserted = observed.recv_timeout(Duration::from_secs(5));
+    if acknowledge {
+        let _ = cancel.send(());
+    }
+    drop(cancel);
+    watcher.join().unwrap();
+    assert!(
+        reasserted.is_ok(),
+        "preparation erased cancellation: {reasserted:?}"
+    );
+    assert!(interrupted.load(Ordering::SeqCst));
+    interrupted.store(false, Ordering::SeqCst);
+    assert!(
+        !interrupted.load(Ordering::SeqCst),
+        "the joined watcher cannot interrupt the next statement"
+    );
+}
+
+#[test]
+fn cancellation_survives_a_preparation_reset_until_the_statement_acknowledges() {
+    reset_then_stop(true);
+}
+
+#[test]
+fn a_disconnected_running_statement_stops_cancellation_before_connection_reuse() {
+    reset_then_stop(false);
+}
+
+#[test]
+fn a_completed_or_disconnected_statement_stops_the_watcher_without_an_interrupt() {
+    for acknowledge in [true, false] {
+        let (cancel, receiver) = mpsc::channel();
+        if acknowledge {
+            cancel.send(()).unwrap();
+        }
+        drop(cancel);
+        let mut interrupts = 0;
+        deadline::watch(Instant::now(), Duration::ZERO, receiver, || interrupts += 1);
+        assert_eq!(interrupts, 0, "completion acknowledgement={acknowledge}");
+    }
+}
diff --git a/crates/contextful-core/src/surface/mod.rs b/crates/contextful-core/src/surface/mod.rs
index 62ac0826b..4d34147ab 100644
--- a/crates/contextful-core/src/surface/mod.rs
+++ b/crates/contextful-core/src/surface/mod.rs
@@ -37,6 +37,9 @@ pub enum SurfaceError {
     /// (`surface.apply.version-race`)
     #[error("ManifestVersionConflict: {0}")]
     ManifestVersionConflict(String),
+    /// (`surface.apply.draft-absent`)
+    #[error("ControlDraftAbsent: {0}")]
+    ControlDraftAbsent(String),
     /// (`surface.apply.validation`)
     #[error("ApplyValidationRefused: {0}")]
     ApplyValidationRefused(String),
@@ -101,7 +104,7 @@ impl SurfaceError {
             | SurfaceError::CycleControlSourceUnresolved(_)
             | SurfaceError::ConditionalWriteUnsupported(_)
             | SurfaceError::ControlAttestationUnavailable(_) => 503,
-            SurfaceError::StoreNotInitialized(_) | SurfaceError::ManifestVersionConflict(_) | SurfaceError::DispatchCallbackRejected(_) => 409,
+            SurfaceError::StoreNotInitialized(_) | SurfaceError::ManifestVersionConflict(_) | SurfaceError::ControlDraftAbsent(_) | SurfaceError::DispatchCallbackRejected(_) => 409,
             SurfaceError::EnforceRegionMismatch(_) | SurfaceError::ResidencySitesDiverge(_) => 503,
             SurfaceError::DispatchSubmitRejected(_) => 401,
             SurfaceError::ScheduleUnreadable(_)
diff --git a/crates/contextful-core/tests/integration/identify.rs b/crates/contextful-core/tests/integration/identify.rs
index e1ff67db0..58c5c9e79 100644
--- a/crates/contextful-core/tests/integration/identify.rs
+++ b/crates/contextful-core/tests/integration/identify.rs
@@ -16,6 +16,25 @@ fn subject(on_behalf_of: Option<&str>, agent: Option<&str>) -> Subject {
     }
 }
 
+#[test]
+fn an_owner_project_survives_authority_block_round_trips() {
+    let mut document = serde_json::json!({
+        "iss": "issuer", "aud": "contextful://stdio", "jti": "owner",
+        "iat": 1, "exp": 2, "alg": "Ed25519", "sub": { "on_behalf_of": "operator" },
+        "att": {}, "grants": [], "owner_project": "research",
+        "rev": { "id": "owner", "epoch": 0 }
+    });
+    let block: AuthorityBlock = serde_json::from_value(document.clone()).unwrap();
+    let serialized = serde_json::to_value(block).unwrap();
+    assert_eq!(serialized["owner_project"], "research");
+    let restored: AuthorityBlock = serde_json::from_value(serialized).unwrap();
+    assert_eq!(serde_json::to_value(restored).unwrap()["owner_project"], "research");
+
+    document.as_object_mut().unwrap().remove("owner_project");
+    let bearer: AuthorityBlock = serde_json::from_value(document).unwrap();
+    assert!(serde_json::to_value(bearer).unwrap().get("owner_project").is_none());
+}
+
 fn link(method: LinkMethod, confidence: f64) -> IdentityLink {
     IdentityLink {
         source: "drive".to_string(),
diff --git a/crates/contextful-core/tests/integration/surface/control.rs b/crates/contextful-core/tests/integration/surface/control.rs
index bf40c92ff..4ed044140 100644
--- a/crates/contextful-core/tests/integration/surface/control.rs
+++ b/crates/contextful-core/tests/integration/surface/control.rs
@@ -3,6 +3,13 @@
 use contextful_core::surface::control::{parse_pointer, receipt_file, receipt_version, snapshot_file, POINTER_FILE};
 use contextful_core::surface::SurfaceError;
 
+#[test]
+fn an_absent_draft_preserves_its_identifier_and_conflict_status() {
+    let error = SurfaceError::ControlDraftAbsent("draft nonce is absent".into());
+    assert_eq!(error.status(), 409);
+    assert_eq!(error.to_string(), "ControlDraftAbsent: draft nonce is absent");
+}
+
 #[test]
 fn an_untrusted_pulled_control_head_names_its_reason() {
     let error = SurfaceError::ControlSnapshotUntrusted("receipt signature does not verify".into());
diff --git a/crates/contextful-engine/src/control.rs b/crates/contextful-engine/src/control.rs
index 959dbdadb..159ccac73 100644
--- a/crates/contextful-engine/src/control.rs
+++ b/crates/contextful-engine/src/control.rs
@@ -10,9 +10,30 @@ use contextful_core::surface::control::{admit_conditional, parse_pointer, receip
 use contextful_core::surface::SurfaceError;
 use std::io::ErrorKind;
 use std::path::{Path, PathBuf};
+use serde::{Deserialize, Serialize};
 
 /// The lock file serializing claims.
 const LOCK_FILE: &str = "manifest.lock";
+const DRAFT_FILE: &str = "manifest@draft.json";
+const ATTESTATION_NONCES: &str = "attestation-nonces";
+
+/// A validated store draft bound to the applied version it read.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Draft {
+    pub expected: u64,
+    pub document: String,
+    pub operator: String,
+    pub nonce: String,
+}
+
+impl Draft {
+    pub fn new(expected: u64, document: String, operator: String) -> Result<Self, ControlError> {
+        let mut nonce = [0u8; 24];
+        getrandom::fill(&mut nonce).map_err(|e| ControlError::Storage(e.to_string()))?;
+        let nonce = nonce.iter().map(|byte| format!("{byte:02x}")).collect();
+        Ok(Self { expected, document, operator, nonce })
+    }
+}
 
 type ReceiptBuilder<'a> = dyn Fn(u64, Option<&str>) -> Result<String, ControlError> + 'a;
 type ReceiptVerifier<'a> = dyn Fn(&str) -> Result<(), ControlError> + 'a;
@@ -20,6 +41,10 @@ type ReceiptVerifier<'a> = dyn Fn(&str) -> Result<(), ControlError> + 'a;
 /// A snapshot-directory refusal or a storage failure beneath it.
 #[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
 pub enum ControlError {
+    #[error("ControlOperatorAttestationInvalid: {0}")]
+    OperatorAttestationInvalid(String),
+    #[error(transparent)]
+    Authority(#[from] contextful_core::AuthorityError),
     #[error(transparent)]
     Surface(#[from] SurfaceError),
     #[error("{0}")]
@@ -88,6 +113,115 @@ impl SnapshotDir {
         std::fs::read_to_string(&path).map_err(|e| SurfaceError::ControlSnapshotUnreadable(format!("{}: {e}", path.display())).into())
     }
 
+    /// Claim one signed control request under the same lock that serializes draft and
+    /// applied-pointer mutations. A claim stays until its signed time is no longer
+    /// admissible, including across a listener restart.
+    pub fn claim_attestation_nonce(&self, nonce: &str, signed_at: i64, now: i64) -> Result<bool, ControlError> {
+        self.claim_attestation_nonce_guarded(nonce, signed_at, now, &|| Ok(()))
+    }
+
+    /// Recheck authority under the nonce lock before changing replay state.
+    pub fn claim_attestation_nonce_guarded(&self, nonce: &str, signed_at: i64, now: i64, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<bool, ControlError> {
+        if nonce.len() != 32 || !nonce.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+            return Err(ControlError::Storage("an attestation nonce is 32 hexadecimal bytes".into()));
+        }
+        let storage = |e: contextful_core::run::Failure| ControlError::Storage(e.to_string());
+        let _lock = FileLock::acquire(&self.root.join(LOCK_FILE)).map_err(storage)?;
+        boundary()?;
+        let directory = self.root.join(ATTESTATION_NONCES);
+        std::fs::create_dir_all(&directory).map_err(|e| ControlError::Storage(format!("{}: {e}", directory.display())))?;
+        let first_live = now.saturating_sub(60);
+        for entry in std::fs::read_dir(&directory).map_err(|e| ControlError::Storage(format!("{}: {e}", directory.display())))? {
+            let entry = entry.map_err(|e| ControlError::Storage(format!("{}: {e}", directory.display())))?;
+            if !entry.file_type().map_err(|e| ControlError::Storage(format!("{}: {e}", entry.path().display())))?.is_dir() {
+                return Err(ControlError::Storage(format!("{}: an attestation bucket is a directory", entry.path().display())));
+            }
+            let signed_second = entry.file_name().to_str().and_then(|name| name.parse::<i64>().ok())
+                .ok_or_else(|| ControlError::Storage(format!("{}: malformed attestation bucket", entry.path().display())))?;
+            if signed_second < first_live {
+                std::fs::remove_dir_all(entry.path()).map_err(|e| ControlError::Storage(format!("{}: {e}", entry.path().display())))?;
+            }
+        }
+        let marker = directory.join(signed_at.to_string()).join(nonce);
+        let claimed = create_new(&marker, b"").map_err(storage)?;
+        if claimed {
+            std::fs::File::open(&marker).and_then(|file| file.sync_all())
+                .map_err(|e| ControlError::Storage(format!("{}: {e}", marker.display())))?;
+            #[cfg(unix)]
+            for path in [marker.parent().expect("nonce marker has a bucket"), directory.as_path(), self.root.as_path()] {
+                std::fs::File::open(path).and_then(|dir| dir.sync_all())
+                    .map_err(|e| ControlError::Storage(format!("{}: {e}", path.display())))?;
+            }
+        }
+        Ok(claimed)
+    }
+
+    /// Save one store draft only while the applied version still matches its base.
+    pub fn save_draft(&self, draft: &Draft) -> Result<(), ControlError> {
+        self.save_draft_guarded(draft, &|| Ok(()))
+    }
+
+    /// Recheck authority under the draft lock immediately before publication.
+    pub fn save_draft_guarded(&self, draft: &Draft, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<(), ControlError> {
+        let storage = |e: contextful_core::run::Failure| ControlError::Storage(e.to_string());
+        let _lock = FileLock::acquire(&self.root.join(LOCK_FILE)).map_err(storage)?;
+        self.expect_version(draft.expected)?;
+        let body = serde_json::to_vec(draft).map_err(|e| ControlError::Storage(e.to_string()))?;
+        boundary()?;
+        replace(&self.root.join(DRAFT_FILE), &body).map_err(storage)?;
+        Ok(())
+    }
+
+    /// Read the saved draft without changing the applied pointer.
+    pub fn read_draft(&self) -> Result<Draft, ControlError> {
+        let path = self.root.join(DRAFT_FILE);
+        let body = std::fs::read(&path).map_err(|e| match e.kind() {
+            ErrorKind::NotFound => ControlError::Surface(SurfaceError::ControlDraftAbsent(format!("`{}` holds no validated draft", self.root.display()))),
+            _ => ControlError::Storage(format!("{}: {e}", path.display())),
+        })?;
+        serde_json::from_slice(&body).map_err(|e| ControlError::Storage(format!("{}: {e}", path.display())))
+    }
+
+    /// Claim the exact draft revalidated by the caller under the existing pointer lock.
+    pub fn claim_draft(&self, draft: &Draft) -> Result<u64, ControlError> {
+        self.claim_draft_guarded(draft, &|| Ok(()))
+    }
+
+    /// Recheck authority under the claim lock before an unsigned draft commit.
+    pub fn claim_draft_guarded(&self, draft: &Draft, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<u64, ControlError> {
+        self.claim_draft_inner(draft, None, boundary)
+    }
+
+    /// Claim a validated draft with its signed receipt before publishing the pointer.
+    pub fn claim_draft_attested(&self, draft: &Draft, receipt: impl Fn(u64, Option<&str>) -> Result<String, ControlError>) -> Result<u64, ControlError> {
+        self.claim_draft_attested_guarded(draft, receipt, &|| Ok(()))
+    }
+
+    /// Recheck the control boundary after signing and before publishing an attested draft.
+    pub fn claim_draft_attested_guarded(&self, draft: &Draft, receipt: impl Fn(u64, Option<&str>) -> Result<String, ControlError>, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<u64, ControlError> {
+        self.claim_draft_inner(draft, Some(&receipt), boundary)
+    }
+
+    fn claim_draft_inner(&self, draft: &Draft, receipt: Option<&ReceiptBuilder<'_>>, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<u64, ControlError> {
+        let storage = |e: contextful_core::run::Failure| ControlError::Storage(e.to_string());
+        let _lock = FileLock::acquire(&self.root.join(LOCK_FILE)).map_err(storage)?;
+        self.expect_version(draft.expected)?;
+        if self.read_draft()? != *draft {
+            return Err(SurfaceError::ManifestVersionConflict("the validated draft changed before apply; reload and reapply".into()).into());
+        }
+        let version = self.claim_locked_guarded(Some(draft.expected), &draft.document, receipt, None, boundary)?;
+        let _ = std::fs::remove_file(self.root.join(DRAFT_FILE));
+        Ok(version)
+    }
+
+    fn expect_version(&self, expected: u64) -> Result<(), ControlError> {
+        let current = self.initialized()?;
+        if current != expected {
+            return Err(SurfaceError::ManifestVersionConflict(format!("the pointer names v{current} and the draft read v{expected}; reload v{current} and reapply")).into());
+        }
+        Ok(())
+    }
+
     /// Install a verified receipt chain under the claim lock and publish its head last.
     pub fn adopt(&self, expected: Option<u64>, chain: &[(u64, Vec<u8>, Vec<u8>)], head: u64) -> Result<(), ControlError> {
         let storage = |e: contextful_core::run::Failure| ControlError::Storage(e.to_string());
@@ -151,6 +285,15 @@ impl SnapshotDir {
     ) -> Result<u64, ControlError> {
         let storage = |e: contextful_core::run::Failure| ControlError::Storage(e.to_string());
         let _lock = FileLock::acquire(&self.root.join(LOCK_FILE)).map_err(storage)?;
+        self.claim_locked(expected, text, receipt, recover)
+    }
+
+    fn claim_locked(&self, expected: Option<u64>, text: &str, receipt: Option<&ReceiptBuilder<'_>>, recover: Option<&ReceiptVerifier<'_>>) -> Result<u64, ControlError> {
+        self.claim_locked_guarded(expected, text, receipt, recover, &|| Ok(()))
+    }
+
+    fn claim_locked_guarded(&self, expected: Option<u64>, text: &str, receipt: Option<&ReceiptBuilder<'_>>, recover: Option<&ReceiptVerifier<'_>>, boundary: &dyn Fn() -> Result<(), ControlError>) -> Result<u64, ControlError> {
+        let storage = |e: contextful_core::run::Failure| ControlError::Storage(e.to_string());
         let current = self.current()?;
         if current != expected {
             let name = |v: Option<u64>| v.map(|v| format!("v{v}")).unwrap_or_else(|| "no version".into());
@@ -211,6 +354,7 @@ impl SnapshotDir {
             }
             let signed = receipt.map(|sign| sign(version, parent.as_deref())).transpose()?;
             let snapshot = self.root.join(snapshot_file(version));
+            boundary()?;
             if create_new(&snapshot, text.as_bytes()).map_err(storage)? {
                 if let Some(signed) = signed {
                     let receipt_error = match create_new(&self.root.join(receipt_file(version)), signed.as_bytes()) {
diff --git a/crates/contextful-engine/tests/integration/control.rs b/crates/contextful-engine/tests/integration/control.rs
index 2b3dee9e5..dcc51f154 100644
--- a/crates/contextful-engine/tests/integration/control.rs
+++ b/crates/contextful-engine/tests/integration/control.rs
@@ -1,7 +1,58 @@
 //! `surface.apply` and `surface.reconcile` over the local snapshot directory.
 
 use contextful_core::surface::SurfaceError;
-use contextful_engine::control::{ControlError, SnapshotDir};
+use contextful_engine::control::{ControlError, Draft, SnapshotDir};
+
+#[test]
+fn control_mutations_check_authority_under_the_lock_and_refuse_without_writes() {
+    let dir = tempfile::tempdir().unwrap();
+    let snaps = SnapshotDir::open(dir.path());
+    snaps.claim_attested(None, "original", |_, _| Ok("first receipt".into())).unwrap();
+    let draft = Draft::new(1, "edited".into(), "alice".into()).unwrap();
+    let refuse = || {
+        let lock = std::fs::OpenOptions::new().read(true).write(true).open(dir.path().join("manifest.lock")).unwrap();
+        assert!(lock.try_lock().is_err(), "the effect boundary holds the mutation lock");
+        Err(ControlError::Storage("authority revoked at commit".into()))
+    };
+    assert!(snaps.claim_attestation_nonce_guarded(&"a".repeat(32), 100, 100, &refuse).is_err());
+    assert!(!dir.path().join("attestation-nonces").exists());
+    assert!(snaps.save_draft_guarded(&draft, &refuse).is_err());
+    assert!(!dir.path().join("manifest@draft.json").exists());
+    snaps.save_draft(&draft).unwrap();
+    assert!(snaps.claim_draft_guarded(&draft, &refuse).is_err());
+    assert_eq!(snaps.current().unwrap(), Some(1));
+    assert!(!dir.path().join("manifest@v2.toml").exists());
+    assert_eq!(snaps.read_draft().unwrap(), draft);
+    assert!(snaps.claim_draft_attested_guarded(&draft, |_, _| Ok("receipt".into()), &refuse).is_err());
+    assert!(!dir.path().join("receipt@v2.json").exists());
+    assert_eq!(snaps.current().unwrap(), Some(1));
+}
+
+#[test]
+fn a_saved_draft_is_bound_to_its_editor_and_exact_nonce() {
+    let dir = tempfile::tempdir().unwrap();
+    let snaps = SnapshotDir::open(dir.path());
+    snaps.import("# original\n").unwrap();
+    let alice = Draft::new(1, "# alice\n".into(), "alice".into()).unwrap();
+    snaps.save_draft(&alice).unwrap();
+    let bob = Draft::new(1, "# bob\n".into(), "bob".into()).unwrap();
+    snaps.save_draft(&bob).unwrap();
+    assert!(matches!(snaps.claim_draft(&alice), Err(ControlError::Surface(SurfaceError::ManifestVersionConflict(_)))));
+    assert_eq!(snaps.current().unwrap(), Some(1));
+    assert_eq!(snaps.claim_draft(&bob).unwrap(), 2);
+    assert_eq!(snaps.read(2).unwrap(), "# bob\n");
+}
+
+#[test]
+fn an_attestation_nonce_survives_reopen_and_expires_after_its_signed_window() {
+    let dir = tempfile::tempdir().unwrap();
+    let first = SnapshotDir::open(dir.path());
+    assert!(first.claim_attestation_nonce(&"a".repeat(32), 100, 100).unwrap());
+    let reopened = SnapshotDir::open(dir.path());
+    assert!(!reopened.claim_attestation_nonce(&"a".repeat(32), 100, 160).unwrap());
+    assert!(reopened.claim_attestation_nonce(&"b".repeat(32), 161, 161).unwrap());
+    assert!(!dir.path().join("attestation-nonces/100").exists());
+}
 
 #[test]
 fn adoption_publishes_a_verified_chain_with_the_pointer_last() {
@@ -117,3 +168,21 @@ fn an_attested_import_resumes_v1_only_after_receipt_validation() {
     assert!(snaps.import_attested("first", sign, verify).is_err());
     assert!(!dir.path().join("manifest@v2.toml").exists());
 }
+
+#[test]
+fn an_attested_draft_keeps_its_receipt_chain_and_refuses_failed_signing() {
+    let dir = tempfile::tempdir().unwrap();
+    let snaps = SnapshotDir::open(dir.path());
+    snaps.import_attested("first", |_, _| Ok("receipt one".into()), |_| Ok(())).unwrap();
+    let draft = Draft::new(1, "second".into(), "alice".into()).unwrap();
+    snaps.save_draft(&draft).unwrap();
+    assert!(snaps.claim_draft_attested(&draft, |_, _| Err(ControlError::Storage("signer absent".into()))).is_err());
+    assert_eq!(snaps.current().unwrap(), Some(1));
+    assert_eq!(snaps.read_draft().unwrap(), draft);
+    assert_eq!(snaps.claim_draft_attested(&draft, |version, prior| {
+        assert_eq!((version, prior), (2, Some("receipt one")));
+        Ok("receipt two".into())
+    }).unwrap(), 2);
+    assert_eq!(std::fs::read_to_string(dir.path().join("receipt@v2.json")).unwrap(), "receipt two");
+    assert_eq!(snaps.current().unwrap(), Some(2));
+}
diff --git a/spec/70-control-plane.md b/spec/70-control-plane.md
index 1bd55110d..99cdcf3fc 100644
--- a/spec/70-control-plane.md
+++ b/spec/70-control-plane.md
@@ -248,6 +248,8 @@ The configuration document, the records it presents read-only, the structured sc
   *because a value in the document reaches every daemon and replica that reads a snapshot*
 - `connector-upload` — An artifact uploaded through the operator surface raises `ConnectorUploadRefused`; the surface references registered connectors by id and version.
   *because publishing into the registry runs a separate signed path*
+- `store-draft` — An Admin edit validates a complete control document and saves one store-scoped draft bound to its applied version, verified operator and random nonce, leaving the applied pointer unchanged.
+  *A-surface*
 
 ## apply
 
@@ -276,6 +278,18 @@ Validation, the immutable version claim, the pointer advance, the owner's storag
 - `attestation-unavailable` — A synced import or apply lacking an admitted admin capability or issuer signing port raises `ControlAttestationUnavailable` and claims no version.
   *A-surface*
 - `guarded-import` — `contextful pipeline import` claims v1 from the declared pipelines while the snapshot directory holds no version; a second import claims nothing.
+- `draft-claim` — An Admin apply rechecks the configured store owner, validates its saved draft again, and claims that draft through the owner's version compare-and-swap.
+  *A-surface*
+- `operator-attestation` — An Admin mutation lacking a fresh console signature over its verified operator, route and body, or reusing a nonce held in store control state across restarts, raises `ControlOperatorAttestationInvalid` before changing the document.
+  *because a shared store capability cannot identify the person who used the console*
+- `draft-absent` — An Admin apply finding no validated store draft raises `ControlDraftAbsent` and changes no applied version.
+  *because an absent draft supplies no document for the version claim*
+- `served-admin-grant` — A served `/control/*` request whose admitted credential holds no Admin grant over `*` without a tenant scope raises `ControlAdminGrantMissing`, answered `403`, before its handler runs.
+  *because the control document arms work over every table and tenant of the store*
+- `served-malformed` — A served Admin edit or apply whose body is not a JSON object holding exactly its route's fields raises `ControlRequestMalformed`, answered `400`, and changes nothing.
+  *because an absent or extra field leaves the operator's intended version or draft ambiguous*
+- `served-unavailable` — A served control request failing with no authority or surface refusal raises `ControlUnavailable`, answered `503`, and returns no internal error text.
+  *because a storage or owner fault message can disclose paths and endpoints to the console*
 
 One apply through the engine's store-scoped API:
 
diff --git a/spec/adr/A-surface.md b/spec/adr/A-surface.md
index 4ec151640..af7cece57 100644
--- a/spec/adr/A-surface.md
+++ b/spec/adr/A-surface.md
@@ -4,7 +4,7 @@
 
 ## The control document is CAS-versioned, validated per entry, and fails static
 
-One hand-edited control document arms every scheduled entry unattended. `surface.apply` claims a version by compare-and-swap on an engine-assigned version; a loser raises `ManifestVersionConflict`, reloads and reapplies. The engine owns the control-state model and raises `ConfigOwnerUnconfigured`, `StoreNotInitialized` or `ConditionalWriteUnsupported` rather than substitute a local writer. `surface.arm` holds back an invalid entry alone, by name. `surface.reconcile` keeps the armed set unchanged on a failed poll. `surface.dispatch` starts one instance per due unit; a dependent run's step refuses as a unit.
+One hand-edited control document arms every scheduled entry unattended. Admin edit validates and saves one store draft at the version it read; Admin apply rechecks ownership and validates before claiming that draft by compare-and-swap. A loser raises `ManifestVersionConflict`, reloads and reapplies. The engine owns the control-state model and raises `ConfigOwnerUnconfigured`, `StoreNotInitialized` or `ConditionalWriteUnsupported` rather than substitute a local writer. `surface.arm` holds back an invalid entry alone, by name. `surface.reconcile` keeps the armed set unchanged on a failed poll. `surface.dispatch` starts one instance per due unit; a dependent run's step refuses as a unit.
 
 | Option | Lost on | Cost |
 | --- | --- | --- |
diff --git a/spec/cards/surface.md b/spec/cards/surface.md
index ddecc52b8..c33103b13 100644
--- a/spec/cards/surface.md
+++ b/spec/cards/surface.md
@@ -10,8 +10,8 @@ Generated by `contextful-spec state` from the contract's files and `spec/terms/s
 | `reconcile` | The control source, snapshot pointer, signed pulled-head validation against local declarations, schedule diff, and what a failed poll leaves running. | 9 |
 | `fire` | Job declaration, the closed kind union, same-tick order, the fire watermark, and one-shot evaluation. | 7 |
 | `dispatch` | The bounded fire pool and its exclusion keys, the reconciler's hold on the cadence lease, step results, and the worker adapter with its attempt-fenced callback. | 15 |
-| `edit` | The configuration document, the records it presents read-only, the structured schedule specification, and connector configuration. | 2 |
-| `apply` | Validation, the immutable version claim, the pointer advance, the owner's storage, and the authority an apply carries. | 12 |
+| `edit` | The configuration document, the records it presents read-only, the structured schedule specification, and connector configuration. | 3 |
+| `apply` | Validation, the immutable version claim, the pointer advance, the owner's storage, and the authority an apply carries. | 18 |
 | `reside` | Where the data plane runs, the region allow-set gating placement, and operation with no external reach. | 3 |
 | `open-console` | The hosted console's two pages, their API routes, identity gates, page grants and engine capabilities. | 8 |
 | `register-store` | Which stores a deployment serves, how each store's credential and binding names derive, and how a request reaches a store's origin. | 5 |
@@ -56,6 +56,11 @@ Generated by `contextful-spec state` from the contract's files and `spec/terms/s
 | `ConditionalWriteUnsupported` | A configuration owner or catalog backend lacking linearizable conditional replacement. | `surface.apply.weak-conditional-backend` |
 | `StoreNotInitialized` | An edit or apply against a store that has taken no guarded import. | `surface.apply.uninitialized-store` |
 | `ControlAttestationUnavailable` | A synced control claim lacks an admitted admin capability or signing port. | `surface.apply.attestation-unavailable` |
+| `ControlOperatorAttestationInvalid` | An Admin mutation without a fresh single-use console signature for its verified operator and request. | `surface.apply.operator-attestation` |
+| `ControlDraftAbsent` | An Admin apply with no validated store draft. | `surface.apply.draft-absent` |
+| `ControlAdminGrantMissing` | A served control request lacking an untenanted Admin grant over every table. | `surface.apply.served-admin-grant` |
+| `ControlRequestMalformed` | A served control edit or apply body outside its route's exact fields. | `surface.apply.served-malformed` |
+| `ControlUnavailable` | A served control request failing without an authority or surface refusal. | `surface.apply.served-unavailable` |
 | `EnforceRegionMismatch` | A configured resource resolving outside the residency allow-set. | `surface.reside.region-mismatch` |
 | `ResidencySitesDiverge` | A push whose residency allow-set differs from the one another site recorded in the bucket manifest. | `surface.reside.site-regions` |
 | `ConsoleRouteUngated` | An anonymous hosted route serving content instead of its declared identity gate. | `surface.open-console.ungated-route` |
diff --git a/spec/pins.toml b/spec/pins.toml
index bdb559d57..a8ac521c6 100644
--- a/spec/pins.toml
+++ b/spec/pins.toml
@@ -27,6 +27,10 @@
 # `contextful-spec state` reads this file and the tags and writes spec/status.md.
 
 [pin]
+"surface.edit.store-draft" = { test = "contextful_cli::serve::control_edit_saves_a_validated_draft_and_apply_claims_its_expected_version" }
+"surface.apply.draft-claim" = { test = "contextful_cli::serve::control_edit_saves_a_validated_draft_and_apply_claims_its_expected_version" }
+"surface.apply.draft-absent" = { test = "contextful_cli::serve::control_edit_saves_a_validated_draft_and_apply_claims_its_expected_version" }
+"surface.apply.operator-attestation" = { test = "contextful_cli::serve::admin_changes_require_fresh_console_attestation_and_record_the_operator" }
 "store.init.store-identity" = { test = "contextful_context::init::init_persists_a_distinct_store_uuid_across_repetition_and_recreation" }
 "store.init.identity-invalid" = { test = "contextful_context::init::malformed_store_uuid_and_absent_owner_root_refuse_identity" }
 "store.pull.identity-conflict" = { test = "contextful_sync::pull::a_clone_keeps_the_store_uuid_and_an_independent_store_refuses_it" }
@@ -104,5 +108,5 @@ disclosure = 63
 read = 183
 run = 306
 store = 216
-surface = 81
+surface = 86
 topology = 38
diff --git a/spec/spec.lock.json b/spec/spec.lock.json
index 5cd8b913f..f12c089e9 100644
--- a/spec/spec.lock.json
+++ b/spec/spec.lock.json
@@ -20135,6 +20135,17 @@
       "file": "spec/70-control-plane.md",
       "line": 249
     },
+    {
+      "id": "surface.edit.store-draft",
+      "contract": "surface",
+      "operation": "edit",
+      "subject": "store-draft",
+      "kind": "behavior",
+      "statement": "An Admin edit validates a complete control document and saves one store-scoped draft bound to its applied version, verified operator and random nonce, leaving the applied pointer unchanged.",
+      "why": "A-surface",
+      "file": "spec/70-control-plane.md",
+      "line": 251
+    },
     {
       "id": "surface.apply.version-race",
       "contract": "surface",
@@ -20144,7 +20155,7 @@
       "statement": "An apply whose compare-and-swap loses raises `ManifestVersionConflict`, reloads the winning version and reapplies its pending edits onto it, overwriting no applied version.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 256
+      "line": 258
     },
     {
       "id": "surface.apply.validation",
@@ -20155,7 +20166,7 @@
       "statement": "A document failing engine validation raises `ApplyValidationRefused` and claims no version.",
       "why": "because a snapshot store holding a version daemons refuse to arm stalls every daemon reading it",
       "file": "spec/70-control-plane.md",
-      "line": 258
+      "line": 260
     },
     {
       "id": "surface.apply.owner-unconfigured",
@@ -20166,7 +20177,7 @@
       "statement": "An owner with no storage configured or no credential raises `ConfigOwnerUnconfigured`, answered `503`; no local writer substitutes for the store-scoped API.",
       "why": "P3",
       "file": "spec/70-control-plane.md",
-      "line": 260
+      "line": 262
     },
     {
       "id": "surface.apply.weak-conditional-backend",
@@ -20177,7 +20188,7 @@
       "statement": "A configuration owner or catalog backend whose conditional replacement is not linearizable raises `ConditionalWriteUnsupported` at startup or open.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 262
+      "line": 264
     },
     {
       "id": "surface.apply.uninitialized-store",
@@ -20188,7 +20199,7 @@
       "statement": "An edit or apply against a store that has taken no explicit guarded import, an empty store included, raises `StoreNotInitialized`, answered `409`.",
       "why": "P3",
       "file": "spec/70-control-plane.md",
-      "line": 264
+      "line": 266
     },
     {
       "id": "surface.apply.local-claim",
@@ -20199,7 +20210,7 @@
       "statement": "A local control plane validates and claims `manifest@v<N>.toml` in its snapshot directory, `.contextful/control/<project>/` unless `[control] snapshot_dir` names one, on its own; `contextful pipeline apply` is that apply, and no hosted plane sits on its path.",
       "why": "because {{topology.coordinate.air-gap}} holds a single-node deployment to reach no process outside itself",
       "file": "spec/70-control-plane.md",
-      "line": 266
+      "line": 268
     },
     {
       "id": "surface.apply.synced-attestation",
@@ -20210,7 +20221,7 @@
       "statement": "In a project with `[sync]`, import and apply admit an admin capability, then sign a receipt over the project, version, predecessor receipt digest and snapshot digest through {{authority.issue.signing-port}}.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 268
+      "line": 270
     },
     {
       "id": "surface.apply.receipt-message",
@@ -20221,7 +20232,7 @@
       "statement": "A JSON control receipt carries `format: 1`, signer public key and signature over UTF-8 `contextful-control-v1\\n<project>\\n<version>\\n<parent-or-minus>\\n<snapshot-sha256>\\n<signer>\\n`; its parent is `-` only for the first version.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 270,
+      "line": 272,
       "scenarios": [
         "WHEN a receipt's parent or snapshot digest changes after signing, THEN its signature does not verify."
       ]
@@ -20235,7 +20246,7 @@
       "statement": "A predecessor and the bucket head name the lowercase SHA-256 hex digest of a receipt's RFC 8785 canonical JSON bytes.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 272
+      "line": 274
     },
     {
       "id": "surface.apply.receipt-file",
@@ -20246,7 +20257,7 @@
       "statement": "A synced claim writes immutable `receipt@v<N>.json` beside its snapshot before advancing the applied pointer.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 274,
+      "line": 276,
       "scenarios": [
         "WHEN signing fails during a synced import, THEN neither the snapshot nor the pointer names the version."
       ]
@@ -20260,7 +20271,7 @@
       "statement": "A synced import or apply lacking an admitted admin capability or issuer signing port raises `ControlAttestationUnavailable` and claims no version.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 276,
+      "line": 278,
       "scenarios": [
         "WHEN a synced apply presents no admin capability, THEN no version or receipt is claimed."
       ]
@@ -20274,7 +20285,73 @@
       "statement": "`contextful pipeline import` claims v1 from the declared pipelines while the snapshot directory holds no version; a second import claims nothing.",
       "why": "",
       "file": "spec/70-control-plane.md",
-      "line": 278
+      "line": 280
+    },
+    {
+      "id": "surface.apply.draft-claim",
+      "contract": "surface",
+      "operation": "apply",
+      "subject": "draft-claim",
+      "kind": "behavior",
+      "statement": "An Admin apply rechecks the configured store owner, validates its saved draft again, and claims that draft through the owner's version compare-and-swap.",
+      "why": "A-surface",
+      "file": "spec/70-control-plane.md",
+      "line": 281
+    },
+    {
+      "id": "surface.apply.operator-attestation",
+      "contract": "surface",
+      "operation": "apply",
+      "subject": "operator-attestation",
+      "kind": "refusal",
+      "statement": "An Admin mutation lacking a fresh console signature over its verified operator, route and body, or reusing a nonce held in store control state across restarts, raises `ControlOperatorAttestationInvalid` before changing the document.",
+      "why": "because a shared store capability cannot identify the person who used the console",
+      "file": "spec/70-control-plane.md",
+      "line": 283
+    },
+    {
+      "id": "surface.apply.draft-absent",
+      "contract": "surface",
+      "operation": "apply",
+      "subject": "draft-absent",
+      "kind": "refusal",
+      "statement": "An Admin apply finding no validated store draft raises `ControlDraftAbsent` and changes no applied version.",
+      "why": "because an absent draft supplies no document for the version claim",
+      "file": "spec/70-control-plane.md",
+      "line": 285
+    },
+    {
+      "id": "surface.apply.served-admin-grant",
+      "contract": "surface",
+      "operation": "apply",
+      "subject": "served-admin-grant",
+      "kind": "refusal",
+      "statement": "A served `/control/*` request whose admitted credential holds no Admin grant over `*` without a tenant scope raises `ControlAdminGrantMissing`, answered `403`, before its handler runs.",
+      "why": "because the control document arms work over every table and tenant of the store",
+      "file": "spec/70-control-plane.md",
+      "line": 287
+    },
+    {
+      "id": "surface.apply.served-malformed",
+      "contract": "surface",
+      "operation": "apply",
+      "subject": "served-malformed",
+      "kind": "refusal",
+      "statement": "A served Admin edit or apply whose body is not a JSON object holding exactly its route's fields raises `ControlRequestMalformed`, answered `400`, and changes nothing.",
+      "why": "because an absent or extra field leaves the operator's intended version or draft ambiguous",
+      "file": "spec/70-control-plane.md",
+      "line": 289
+    },
+    {
+      "id": "surface.apply.served-unavailable",
+      "contract": "surface",
+      "operation": "apply",
+      "subject": "served-unavailable",
+      "kind": "refusal",
+      "statement": "A served control request failing with no authority or surface refusal raises `ControlUnavailable`, answered `503`, and returns no internal error text.",
+      "why": "because a storage or owner fault message can disclose paths and endpoints to the console",
+      "file": "spec/70-control-plane.md",
+      "line": 291
     },
     {
       "id": "surface.reside.region-entries",
@@ -20285,7 +20362,7 @@
       "statement": "A residency allow-set holds at most 16 entries.",
       "why": "",
       "file": "spec/70-control-plane.md",
-      "line": 320
+      "line": 334
     },
     {
       "id": "surface.reside.region-mismatch",
@@ -20296,7 +20373,7 @@
       "statement": "A configured resource resolving to a region the policy omits raises `EnforceRegionMismatch` at startup, and the runtime serves nothing.",
       "why": "P3",
       "file": "spec/70-control-plane.md",
-      "line": 321
+      "line": 335
     },
     {
       "id": "surface.reside.site-regions",
@@ -20307,7 +20384,7 @@
       "statement": "A push records the pushing site's residency allow-set in the bucket manifest; a push finding a differing set another site recorded, an absent one included, raises `ResidencySitesDiverge` and commits nothing.",
       "why": "A-surface",
       "file": "spec/70-control-plane.md",
-      "line": 323
+      "line": 337
     },
     {
       "id": "surface.open-console.page-routes",
@@ -30188,14 +30265,30 @@
             "clause": "surface.ground.org-face-read-only",
             "gloss": "A write tool registered on an organization-wide face."
           },
+          "ControlAdminGrantMissing": {
+            "clause": "surface.apply.served-admin-grant",
+            "gloss": "A served control request lacking an untenanted Admin grant over every table."
+          },
           "ControlAttestationUnavailable": {
             "clause": "surface.apply.attestation-unavailable",
             "gloss": "A synced control claim lacks an admitted admin capability or signing port."
           },
+          "ControlDraftAbsent": {
+            "clause": "surface.apply.draft-absent",
+            "gloss": "An Admin apply with no validated store draft."
+          },
+          "ControlOperatorAttestationInvalid": {
+            "clause": "surface.apply.operator-attestation",
+            "gloss": "An Admin mutation without a fresh single-use console signature for its verified operator and request."
+          },
           "ControlPointerMalformed": {
             "clause": "surface.reconcile.pointer-malformed",
             "gloss": "A snapshot pointer body that is not wholly a version."
           },
+          "ControlRequestMalformed": {
+            "clause": "surface.apply.served-malformed",
+            "gloss": "A served control edit or apply body outside its route's exact fields."
+          },
           "ControlSnapshotUnreadable": {
             "clause": "surface.reconcile.fail-static",
             "gloss": "A poll that could not read its pointer or parse the named document."
@@ -30208,6 +30301,10 @@
             "clause": "surface.reconcile.loopback-only",
             "gloss": "A control URL whose host is not a loopback address."
           },
+          "ControlUnavailable": {
+            "clause": "surface.apply.served-unavailable",
+            "gloss": "A served control request failing without an authority or surface refusal."
+          },
           "CycleControlSourceUnresolved": {
             "clause": "surface.fire.cycle-control-source",
             "gloss": "A control source that does not resolve under one-shot evaluation."
diff --git a/spec/status.md b/spec/status.md
index eb28f0837..7f0efa35e 100644
--- a/spec/status.md
+++ b/spec/status.md
@@ -13,9 +13,9 @@ An unpinned clause is `committed`; a pinned one is `performed` when its Rust, Le
 | `read` | 2 | 15 | 206 | 35 | 22 | 9 | 183 | 0 | 183 |
 | `run` | 3 | 26 | 406 | 102 | 39 | 28 | 306 | 0 | 306 |
 | `store` | 1 | 17 | 252 | 59 | 13 | 19 | 216 | 0 | 216 |
-| `surface` | 2 | 20 | 119 | 54 | 22 | 0 | 81 | 0 | 81 |
+| `surface` | 2 | 20 | 126 | 59 | 22 | 0 | 86 | 0 | 86 |
 | `topology` | 1 | 6 | 70 | 24 | 5 | 5 | 38 | 0 | 38 |
-| **total** | 19 | 155 | 2131 | 602 | 191 | 103 | 1512 | 0 | |
+| **total** | 19 | 155 | 2138 | 607 | 191 | 103 | 1517 | 0 | |
 
 Decision records: 18.
 
@@ -35,9 +35,9 @@ A milestone reads `closed` when its acceptance test computes `passing` and every
 | 7 — Memory | 6 | 54 | 45 | passing | closed |
 | 8 — Accountability | 5 | 60 | 47 | passing | open |
 | 9 — Visibility | 6 | 41 | 3 | open | open |
-| 10 — Cadence and the operator plane | 11 | 76 | 64 | passing | open |
+| 10 — Cadence and the operator plane | 11 | 83 | 69 | passing | open |
 | 11 — The derive tier | 7 | 88 | 79 | passing | closed |
-| 12 — The operator console | 12 | 54 | 22 | open | open |
+| 12 — The operator console | 12 | 54 | 22 | passing | open |
 | 13 — Disclosure | 5 | 33 | 13 | open | open |
 | 14 — Assurance | 7 | 146 | 91 | passing | closed |
 
@@ -1441,12 +1441,16 @@ Unscheduled operations: 10.
 | `store.reserve.taint` | `crates/contextful-context/tests/integration/reserve.rs::a_model_output_row_carries_the_engine_taint_and_no_other_row_does` | performed |
 | `store.reserve.underscore-namespace` | `crates/contextful-core/tests/integration/store/reserve.rs::the_underscore_namespace_is_the_injected_and_optional_sets` | performed |
 | `surface.apply.attestation-unavailable` | `crates/contextful-cli/tests/integration/pipeline.rs::a_synced_import_requires_admin_and_writes_a_verifiable_receipt` | performed |
+| `surface.apply.draft-absent` | `spec/pins.toml` | performed |
+| `surface.apply.draft-claim` | `spec/pins.toml` | performed |
 | `surface.apply.guarded-import` | `crates/contextful-cli/tests/integration/pipeline.rs::the_import_claims_the_first_version_once` | performed |
 | `surface.apply.local-claim` | `crates/contextful-cli/tests/integration/pipeline.rs::apply_claims_a_version_in_the_local_snapshot_directory` | performed |
+| `surface.apply.operator-attestation` | `spec/pins.toml` | performed |
 | `surface.apply.owner-unconfigured` | `crates/contextful-cli/tests/integration/pipeline.rs::an_owner_with_nothing_behind_it_is_refused` | performed |
 | `surface.apply.receipt-digest` | `crates/contextful-policy/tests/integration/control_receipt.rs::a_receipt_digest_uses_canonical_json_for_its_successor` | performed |
 | `surface.apply.receipt-file` | `crates/contextful-engine/tests/integration/control.rs::an_attested_claim_commits_the_snapshot_and_receipt_together` | performed |
 | `surface.apply.receipt-message` | `crates/contextful-policy/tests/integration/control_receipt.rs::a_control_receipt_binds_every_signed_field_and_the_snapshot_bytes` | performed |
+| `surface.apply.served-admin-grant` | `crates/contextful-agent/tests/integration/http.rs::control_refuses_a_tenant_scoped_admin_grant_over_every_table` | performed |
 | `surface.apply.synced-attestation` | `crates/contextful-cli/tests/integration/pipeline.rs::a_synced_import_requires_admin_and_writes_a_verifiable_receipt` | performed |
 | `surface.apply.uninitialized-store` | `crates/contextful-cli/tests/integration/pipeline.rs::an_apply_before_the_import_is_refused` | performed |
 | `surface.apply.validation` | `crates/contextful-cli/tests/integration/pipeline.rs::an_invalid_document_claims_no_version` | performed |
@@ -1486,6 +1490,7 @@ Unscheduled operations: 10.
 | `surface.dispatch.worker-target` | `crates/contextful-cli/tests/integration/worker.rs::a_killed_worker_s_step_moves_once_and_its_late_callback_is_rejected` | performed |
 | `surface.edit.connector-upload` | `crates/contextful-cli/tests/integration/pipeline.rs::an_artifact_in_the_document_is_refused` | performed |
 | `surface.edit.secret-in-document` | `crates/contextful-cli/tests/integration/pipeline.rs::a_credential_in_the_document_is_refused` | performed |
+| `surface.edit.store-draft` | `spec/pins.toml` | performed |
 | `surface.fire.cycle` | `crates/contextful-cli/tests/integration/pipeline.rs::a_cycle_fires_what_is_due_once_and_reports_the_next_instant` | performed |
 | `surface.fire.cycle-control-source` | `crates/contextful-cli/tests/integration/pipeline.rs::a_cycle_with_no_applied_snapshot_is_refused` | performed |
 | `surface.fire.cycle-exit` | `crates/contextful-cli/tests/integration/pipeline.rs::a_cycle_with_a_failed_fire_exits_non_zero` | performed |
diff --git a/spec/terms/surface.toml b/spec/terms/surface.toml
index 8a97c4cb6..42a3433bd 100644
--- a/spec/terms/surface.toml
+++ b/spec/terms/surface.toml
@@ -45,6 +45,11 @@ DispatchCallbackRejected      = { clause = "surface.dispatch.callback-rejected",
 DispatchSubmitRejected        = { clause = "surface.dispatch.submit-signed", gloss = "A worker submission unsigned, skewed, or naming a callback off the worker's relay." }
 SecretMaterialInDocument      = { clause = "surface.edit.secret-in-document", gloss = "A credential value written into the configuration document." }
 ConnectorUploadRefused        = { clause = "surface.edit.connector-upload", gloss = "A connector artifact offered through the operator surface." }
+ControlAdminGrantMissing      = { clause = "surface.apply.served-admin-grant", gloss = "A served control request lacking an untenanted Admin grant over every table." }
+ControlRequestMalformed       = { clause = "surface.apply.served-malformed", gloss = "A served control edit or apply body outside its route's exact fields." }
+ControlUnavailable            = { clause = "surface.apply.served-unavailable", gloss = "A served control request failing without an authority or surface refusal." }
+ControlDraftAbsent            = { clause = "surface.apply.draft-absent", gloss = "An Admin apply with no validated store draft." }
+ControlOperatorAttestationInvalid = { clause = "surface.apply.operator-attestation", gloss = "An Admin mutation without a fresh single-use console signature for its verified operator and request." }
 ManifestVersionConflict       = { clause = "surface.apply.version-race", gloss = "An apply whose pointer compare-and-swap lost to a concurrent apply." }
 ApplyValidationRefused        = { clause = "surface.apply.validation", gloss = "A document engine validation refused; no version was claimed." }
 ConfigOwnerUnconfigured       = { clause = "surface.apply.owner-unconfigured", gloss = "A configuration owner with no storage or no credential behind it." }
diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index 5bb579006..82ab380b9 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -662,6 +662,13 @@ fn cli_partition(args: &mut Vec<&str>, ordinary: bool, formal: bool) {
 /// (`assurance.build.target-dir-per-stage`).
 fn features(root: &Path, only: Option<&[String]>) -> Result<()> {
     let featured = featured_packages(root)?;
+    let formal = featured.iter().filter(|package| package.name == topology::BINARY).any(|package| {
+        package.runs().iter().any(|(label, _)| only.is_none_or(|parts| parts.iter().any(|part| part.strip_prefix("formal-") == Some(label.as_str()))))
+    });
+    if formal {
+        provision_lean(root)?;
+        provision_wasm(root)?;
+    }
     if featured.is_empty() {
         eprintln!("features: no workspace package declares a feature");
     }
diff --git a/tools/ci/tests/integration/main.rs b/tools/ci/tests/integration/main.rs
index 0697665cd..c45b5b31f 100644
--- a/tools/ci/tests/integration/main.rs
+++ b/tools/ci/tests/integration/main.rs
@@ -15,6 +15,7 @@ mod image;
 mod lean;
 mod measure;
 mod mirrors;
+mod mandatory_toolchains;
 mod probe;
 mod release;
 mod secrets;
diff --git a/tools/ci/tests/integration/mandatory_toolchains.rs b/tools/ci/tests/integration/mandatory_toolchains.rs
new file mode 100644
index 000000000..2ef10c5df
--- /dev/null
+++ b/tools/ci/tests/integration/mandatory_toolchains.rs
@@ -0,0 +1,132 @@
+use crate::{manifest, stderr, Repo};
+use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
+use std::process::Command;
+
+const PIN: &str = "leanprover/lean4:v4.29.1";
+
+fn executable(path: &Path, script: &str) {
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    std::fs::write(path, format!("#!/bin/sh\nset -eu\n{script}")).unwrap();
+    std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o755)).unwrap();
+}
+
+/// The child command consumes a pinned toolchain and a provisioned target, rather than
+/// inheriting either from the host. Mock executables keep provisioning deterministic.
+fn run(part: &str, required: bool) {
+    run_with_package(part, required, Some("contextful-cli"));
+}
+
+fn run_with_package(part: &str, required: bool, package: Option<&str>) {
+    let r = Repo::init();
+    let tools = tempfile::tempdir().unwrap();
+    let elan = tools.path().join("elan");
+    let bin = tools.path().join("bin");
+    let wasm = tools.path().join("wasm-lib");
+    r.write("formal/lean-toolchain", &format!("{PIN}\n"));
+    if let Some(package) = package {
+        r.write(&format!("crates/{package}/Cargo.toml"), &manifest(package, ""));
+        r.write(&format!("crates/{package}/tests/integration/main.rs"), "mod measured;\n");
+        r.write(&format!("crates/{package}/tests/integration/measured.rs"), "#[test]\nfn emits() {}\n");
+    }
+    r.write("spec/spec.lock.json", "{\"clauses\":[{\"id\":\"assurance.measure.record\"}]}\n");
+    r.write("evals/ledger.toml", "[entry.mandatory-proof]\nclause = \"assurance.measure.record\"\nmetric = \"proof.value\"\nkind = \"test\"\ntier = \"gate\"\nmethod = { test = \"contextful_cli::measured::emits\" }\ntarget = { op = \"==\", value = 0 }\n");
+    let packages: Vec<_> = package.into_iter().map(|name| serde_json::json!({
+        "name": name, "manifest_path": r.root.join(format!("crates/{name}/Cargo.toml")),
+        "features": {"data-plane": [], "contextful-edge": []},
+        "metadata": {"contextful": {"feature-runs": ["data-plane", "contextful-edge"]}}
+    })).collect();
+    let meta = serde_json::json!({"packages": packages});
+    r.write("metadata.json", &meta.to_string());
+    r.commit("a method requiring pinned Lean and WebAssembly");
+    executable(&elan.join("bin/elan"), r#"
+case "$1 $2" in
+  'toolchain list') if test -f "$ELAN_HOME/installed"; then cat "$ELAN_HOME/installed"; fi ;;
+  'toolchain install') test "$3" = "$EXPECTED_PIN"; printf '%s\n' "$3" > "$ELAN_HOME/installed" ;;
+  *) exit 91 ;;
+esac
+"#);
+    executable(&elan.join("bin/lean"), r#"
+test "$ELAN_TOOLCHAIN" = "$EXPECTED_PIN"
+test "$(cat "$ELAN_HOME/installed")" = "$EXPECTED_PIN"
+printf '%s\n' "$ELAN_TOOLCHAIN"
+"#);
+    executable(&bin.join("rustc"), "printf '%s\\n' \"$WASM_LIB\"\n");
+    executable(&bin.join("rustup"), r#"
+test "$*" = 'target add wasm32-unknown-unknown'
+mkdir -p "$WASM_LIB"
+touch "$WASM_LIB/libstd.rlib"
+"#);
+    executable(&bin.join("cargo"), r#"
+if test "$1" = metadata; then cat metadata.json; exit 0; fi
+test "$1" = test
+if test "$EXPECT_REQUIRED" = 1; then
+  test "${CONTEXTFUL_REQUIRE_LEAN:-}" = 1 || { echo 'mandatory Lean flag absent' >&2; exit 92; }
+  test "${CONTEXTFUL_REQUIRE_WASM:-}" = 1 || { echo 'mandatory Wasm flag absent' >&2; exit 93; }
+  test "$(lean --version)" = "$EXPECTED_PIN"
+  test -f "$(rustc --print target-libdir --target wasm32-unknown-unknown)/libstd.rlib"
+else
+  test -z "${CONTEXTFUL_REQUIRE_LEAN:-}"
+  test -z "${CONTEXTFUL_REQUIRE_WASM:-}"
+fi
+printf '%s\n' "$*" >> child-commands
+if test -n "${CONTEXTFUL_MEASURE_DIR:-}"; then
+  mkdir -p "$CONTEXTFUL_MEASURE_DIR"
+  printf '%s\n' '{"id":"mandatory-proof","value":0,"n":1,"seed":7,"run":{"processor":"fixture","nproc":1,"memory_limit":null}}' > "$CONTEXTFUL_MEASURE_DIR/mandatory-proof.json"
+fi
+"#);
+    let host_path = std::env::var("PATH").unwrap();
+    let path = std::env::join_paths(std::iter::once(bin).chain(std::env::split_paths(&host_path))).unwrap();
+    let output = Command::new(env!("CARGO_BIN_EXE_contextful-ci"))
+        .args(["gate", "--stage", part])
+        .current_dir(&r.root)
+        .env("PATH", path)
+        .env("ELAN_HOME", &elan)
+        .env("WASM_LIB", &wasm)
+        .env("EXPECTED_PIN", PIN)
+        .env("EXPECT_REQUIRED", if required { "1" } else { "0" })
+        .env_remove("ELAN_TOOLCHAIN")
+        .env_remove("CONTEXTFUL_REQUIRE_LEAN")
+        .env_remove("CONTEXTFUL_REQUIRE_WASM")
+        .env_remove("CARGO_TARGET_DIR")
+        .output().unwrap();
+    assert!(output.status.success(), "{part}: {}", stderr(&output));
+    let commands = std::fs::read_to_string(r.root.join("child-commands")).unwrap_or_default();
+    assert_eq!(!commands.is_empty(), package.is_some(), "{part} selected child tests");
+    assert_eq!(elan.join("installed").exists(), required, "{part} toolchain provisioning");
+    assert_eq!(wasm.join("libstd.rlib").exists(), required, "{part} target provisioning");
+    if part == "evaluate" {
+        assert!(stderr(&output).contains("measure: mandatory-proof = 0"), "{}", stderr(&output));
+    }
+}
+
+#[test]
+fn evaluate_requires_pinned_lean_and_wasm_before_collecting_a_record() { run("evaluate", true); }
+
+#[test]
+fn formal_none_requires_pinned_lean_and_wasm() { run("features.formal-none", true); }
+
+#[test]
+fn formal_all_requires_pinned_lean_and_wasm() { run("features.formal-all", true); }
+
+#[test]
+fn formal_data_plane_requires_pinned_lean_and_wasm() { run("features.formal-data-plane", true); }
+
+#[test]
+fn formal_contextful_edge_requires_pinned_lean_and_wasm() { run("features.formal-contextful-edge", true); }
+
+#[test]
+fn whole_features_requires_pinned_lean_and_wasm() { run("features", true); }
+
+#[test]
+fn binary_only_features_preserve_the_narrow_toolchain_cost() { run("features.binary-none", false); }
+
+#[test]
+fn whole_features_without_a_binary_preserve_the_narrow_toolchain_cost() {
+    run_with_package("features", false, Some("demo"));
+}
+
+#[test]
+fn whole_features_without_featured_packages_provision_no_toolchains() {
+    run_with_package("features", false, None);
+}