diff --git a/.vercelignore b/.vercelignore
index 47993be2..a3c7bf52 100644
--- a/.vercelignore
+++ b/.vercelignore
@@ -17,6 +17,7 @@ supabase/functions/gem-auth-gateway/*
 
 supabase/functions/gem-admin-write/*
 !supabase/functions/gem-admin-write/index.ts
+!supabase/functions/gem-admin-write/tokmetric-command.ts
 
 supabase/functions/gem-tokmetric-gpt-gateway/*
 !supabase/functions/gem-tokmetric-gpt-gateway/index.ts
diff --git a/src/__tests__/password-recovery-gateway.test.ts b/src/__tests__/password-recovery-gateway.test.ts
index c6933a71..b2585bd5 100644
--- a/src/__tests__/password-recovery-gateway.test.ts
+++ b/src/__tests__/password-recovery-gateway.test.ts
@@ -69,12 +69,12 @@ describe("canonical password recovery and session authority", () => {
     expect(resetPageSource).not.toContain("searchParams.get(\"token\")")
   })
 
-  it("uses the gateway only for credential verification and issues a canonical GEM session", () => {
+  it("validates and preserves gateway-issued session authority", () => {
     expect(loginRouteSource).toContain("loginWithGateway(email, password)")
-    expect(loginRouteSource).toContain("gateway_credential_verification")
-    expect(loginRouteSource).toContain("signSession(sessionPayload)")
-    expect(loginRouteSource).toContain("setSessionCookie(response, token)")
-    expect(loginRouteSource).not.toContain("wrapGatewayToken")
-    expect(gatewaySource).toContain("loginWithGateway")
+    expect(loginRouteSource).toContain("validGatewaySession(result.session)")
+    expect(loginRouteSource).toContain('session.authSource === "supabase_gateway"')
+    expect(loginRouteSource).toContain("setSessionCookie(response, wrapGatewayToken(token))")
+    expect(gatewaySource).toContain("wrapGatewayToken")
+    expect(gatewaySource).toContain("verifyGatewaySession")
   })
-})
\ No newline at end of file
+})
diff --git a/src/__tests__/tokmetric-activation-approval-safety.test.ts b/src/__tests__/tokmetric-activation-approval-safety.test.ts
new file mode 100644
index 00000000..a3fbe344
--- /dev/null
+++ b/src/__tests__/tokmetric-activation-approval-safety.test.ts
@@ -0,0 +1,66 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+function source(path: string) {
+  return readFileSync(join(process.cwd(), path), "utf8");
+}
+
+describe("TokMetric activation approval safety", () => {
+  const command = source(
+    "supabase/functions/gem-admin-write/tokmetric-command.ts",
+  );
+  const gateway = source("supabase/functions/gem-admin-write/index.ts");
+
+  it("requires an explicit operation at application and gateway layers", () => {
+    const route = source("src/app/api/tokmetric/command/route.ts");
+    expect(route).toContain("TokMetric command operation is required.");
+    expect(command).toContain(
+      'requiredText(input.body.operation, "operation", 3, 100)',
+    );
+    expect(command).toContain('"INVALID_OPERATION"');
+    expect(gateway).toContain('action === "tokmetric_command"');
+  });
+
+  it("requires compliance evidence before approval", () => {
+    expect(command).toContain('"COMPLIANCE_REVIEW_REQUIRED"');
+    expect(command).toContain('["PASS", "HUMAN_REVIEW_REQUIRED"]');
+    expect(command).toContain('"COMPLIANCE_BLOCKED"');
+  });
+
+  it("prevents self-approval and enforces the requested role", () => {
+    expect(command).toContain("approval.requestedById === actor.id");
+    expect(command).toContain('"APPROVAL_SEPARATION_REQUIRED"');
+    expect(command).toContain("roleCanDecide(actor.role, approval.requiredRole)");
+    expect(command).toContain('"APPROVER_ROLE_REQUIRED"');
+  });
+
+  it("binds approval to the current exact version and object hash", () => {
+    expect(command).toContain(
+      "content.currentVersionId !== approval.contentVersionId",
+    );
+    expect(command).toContain("version.objectHash !== approval.objectHash");
+    expect(command).toContain('"APPROVAL_VERSION_MISMATCH"');
+    expect(command).toContain('"APPROVAL_HASH_MISMATCH"');
+  });
+
+  it("requires a connected posting connector and authorized publishing scope", () => {
+    expect(command).toContain('"TIKTOK_CONTENT_POSTING_API"');
+    expect(command).toContain('scopes.has("video.publish")');
+    expect(command).toContain('scopes.has("video.upload")');
+    expect(command).toContain('"CONTENT_POSTING_SCOPE_NOT_AUTHORIZED"');
+    expect(command).toContain('"LIVE_PUBLISHING_GATE_DISABLED"');
+  });
+
+  it("enforces session revocation for every administrator command", () => {
+    expect(gateway).toContain("validSessionVersion(sessionVersion)");
+    expect(gateway).toContain("user.sessionVersion !== sessionVersion");
+    expect(gateway).toContain('"SESSION_REVOKED"');
+  });
+
+  it("never performs an external TikTok write", () => {
+    expect(command).toContain("externalActionTaken: false");
+    expect(command).not.toContain("open.tiktokapis.com");
+    expect(gateway).not.toContain("open.tiktokapis.com");
+  });
+});
diff --git a/src/__tests__/tokmetric-activation-command-center.test.ts b/src/__tests__/tokmetric-activation-command-center.test.ts
new file mode 100644
index 00000000..4352de47
--- /dev/null
+++ b/src/__tests__/tokmetric-activation-command-center.test.ts
@@ -0,0 +1,104 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+function source(path: string) {
+  return readFileSync(join(process.cwd(), path), "utf8");
+}
+
+describe("TokMetric activation command center", () => {
+  it("retains the approved administrator gateway and TokMetric module", () => {
+    const ignore = source(".vercelignore");
+    expect(ignore).toContain("!supabase/functions/gem-admin-write/");
+    expect(ignore).toContain("!supabase/functions/gem-admin-write/index.ts");
+    expect(ignore).toContain(
+      "!supabase/functions/gem-admin-write/tokmetric-command.ts",
+    );
+  });
+
+  it("requires a versioned GEM administrator session", () => {
+    const gateway = source("supabase/functions/gem-admin-write/index.ts");
+    expect(gateway).toContain("sessionVersion");
+    expect(gateway).toContain('"SESSION_REVOKED"');
+    expect(gateway).toContain('payload.iss !== "gem-auth-gateway"');
+    expect(gateway).toContain('payload.aud !== "gem-enterprise"');
+    expect(gateway).toContain("ADMIN_ROLES.includes");
+  });
+
+  it("keeps activation operations internal and fail closed", () => {
+    const command = source(
+      "supabase/functions/gem-admin-write/tokmetric-command.ts",
+    );
+    expect(command).toContain('controlledWriteMode: "COMMAND_CENTER_ONLY"');
+    expect(command).toContain("externalActionTaken: false");
+    expect(command).toContain('"LIVE_PUBLISHING_GATE_DISABLED"');
+    expect(command).not.toContain("PUBLISHED_CONFIRMED");
+    expect(command).not.toContain("open.tiktokapis.com");
+  });
+
+  it("supports the complete controlled activation sequence", () => {
+    const command = source(
+      "supabase/functions/gem-admin-write/tokmetric-command.ts",
+    );
+    for (const operation of [
+      "snapshot",
+      "create_draft",
+      "create_version",
+      "run_review",
+      "request_approval",
+      "decide_approval",
+      "publish_preflight",
+    ]) {
+      expect(command).toContain(`operation === "${operation}"`);
+    }
+    const gateway = source("supabase/functions/gem-admin-write/index.ts");
+    expect(gateway).toContain('action === "tokmetric_command"');
+    expect(gateway).toContain("dispatchTokMetricCommand");
+  });
+
+  it("proxies commands only through the HttpOnly GEM session", () => {
+    const route = source("src/app/api/tokmetric/command/route.ts");
+    const client = source("src/lib/tokmetric/command-gateway.ts");
+    expect(route).toContain("getGatewaySessionToken");
+    expect(route).toContain("GEM_SESSION_REQUIRED");
+    expect(route).toContain("invokeTokMetricCommandGateway");
+    expect(route).toContain('"Cache-Control": "no-store, max-age=0"');
+    expect(client).toContain("adminWriteGateway");
+    expect(client).toContain('"tokmetric_command"');
+    expect(client).not.toContain("DEFAULT_COMMAND_GATEWAY_URL");
+    expect(client).not.toContain("GEM_SUPABASE_GATEWAY_ANON_KEY");
+    expect(route).not.toContain("POSTGRES_PRISMA_URL");
+    expect(route).not.toContain("SUPABASE_SERVICE_ROLE_KEY");
+  });
+
+  it("preserves existing administrator, retention, and credential actions", () => {
+    const gateway = source("supabase/functions/gem-admin-write/index.ts");
+    for (const action of [
+      "update_user",
+      "retention_policy_list",
+      "retention_policy_create",
+      "retention_policy_action",
+      "tokmetric_credential_list",
+      "tokmetric_credential_issue_hash",
+      "tokmetric_credential_revoke",
+    ]) {
+      expect(gateway).toContain(`action === "${action}"`);
+    }
+  });
+
+  it("exposes real operator controls in the protected command center", () => {
+    const panel = source(
+      "src/components/tokmetric/TokMetricActivationPanel.tsx",
+    );
+    const page = source("src/app/app/command-center/tokmetric/page.tsx");
+    expect(panel).toContain('fetch("/api/tokmetric/command"');
+    expect(panel).toContain("Connect Login Kit");
+    expect(panel).toContain("Connect Posting API");
+    expect(panel).toContain("Create internal content draft");
+    expect(panel).toContain("Run review");
+    expect(panel).toContain("Request approval");
+    expect(panel).toContain("Preflight");
+    expect(panel).toContain("External actions taken: none");
+    expect(page).toContain("<TokMetricActivationPanel />");
+  });
+});
diff --git a/src/app/api/tokmetric/command/route.ts b/src/app/api/tokmetric/command/route.ts
new file mode 100644
index 00000000..13004fe4
--- /dev/null
+++ b/src/app/api/tokmetric/command/route.ts
@@ -0,0 +1,121 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getGatewaySessionToken } from "@/lib/auth";
+import { GatewayRequestError } from "@/lib/supabase-gateway";
+import {
+  invokeTokMetricCommandGateway,
+  type TokMetricCommandOperation,
+} from "@/lib/tokmetric/command-gateway";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const OPERATIONS = new Set<TokMetricCommandOperation>([
+  "snapshot",
+  "create_draft",
+  "create_version",
+  "run_review",
+  "request_approval",
+  "decide_approval",
+  "publish_preflight",
+]);
+
+function json(body: unknown, status = 200) {
+  return NextResponse.json(body, {
+    status,
+    headers: {
+      "Cache-Control": "no-store, max-age=0",
+      "X-Content-Type-Options": "nosniff",
+      "Referrer-Policy": "no-referrer",
+    },
+  });
+}
+
+async function requireToken() {
+  const token = await getGatewaySessionToken();
+  if (!token) {
+    throw new GatewayRequestError(
+      401,
+      "GEM_SESSION_REQUIRED",
+      "Authentication required.",
+    );
+  }
+  return token;
+}
+
+async function run(
+  operation: TokMetricCommandOperation,
+  payload: Record<string, unknown> = {},
+) {
+  try {
+    const token = await requireToken();
+    const result = await invokeTokMetricCommandGateway(
+      token,
+      operation,
+      payload,
+    );
+    const created = operation === "create_draft" || operation === "request_approval";
+    return json(result, created ? 201 : 200);
+  } catch (error) {
+    if (error instanceof GatewayRequestError) {
+      return json(
+        { error: error.message, code: error.code },
+        error.statusCode,
+      );
+    }
+    console.error("[tokmetric command route] internal error", {
+      name: error instanceof Error ? error.name : "unknown",
+    });
+    return json(
+      {
+        error: "TokMetric command service is unavailable.",
+        code: "TOKMETRIC_COMMAND_UNAVAILABLE",
+      },
+      503,
+    );
+  }
+}
+
+export async function GET() {
+  return run("snapshot");
+}
+
+export async function POST(request: NextRequest) {
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return json(
+      { error: "Request body must be valid JSON.", code: "INVALID_JSON" },
+      400,
+    );
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return json(
+      { error: "TokMetric request is invalid.", code: "INVALID_REQUEST" },
+      400,
+    );
+  }
+  const payload = body as Record<string, unknown>;
+  if (typeof payload.operation !== "string") {
+    return json(
+      {
+        error: "TokMetric command operation is required.",
+        code: "INVALID_OPERATION",
+      },
+      400,
+    );
+  }
+  const operation = payload.operation as TokMetricCommandOperation;
+  if (!OPERATIONS.has(operation)) {
+    return json(
+      {
+        error: "TokMetric command operation is invalid.",
+        code: "INVALID_OPERATION",
+      },
+      400,
+    );
+  }
+  const commandPayload = { ...payload };
+  delete commandPayload.operation;
+  return run(operation, commandPayload);
+}
diff --git a/src/app/app/command-center/tokmetric/page.tsx b/src/app/app/command-center/tokmetric/page.tsx
index bbdc3d69..9a9df366 100644
--- a/src/app/app/command-center/tokmetric/page.tsx
+++ b/src/app/app/command-center/tokmetric/page.tsx
@@ -16,6 +16,7 @@ import {
   UsersRound,
   Video,
 } from "lucide-react";
+import { TokMetricActivationPanel } from "@/components/tokmetric/TokMetricActivationPanel";
 import { TokMetricConnectorPanel } from "@/components/tokmetric/TokMetricConnectorPanel";
 import { TokMetricGptCredentialManager } from "@/components/tokmetric/TokMetricGptCredentialManager";
 
@@ -86,6 +87,7 @@ const controlState = [
   ["Native GEM Enterprise module", "READY"],
   ["Custom GPT Action contracts", "READY"],
   ["Bearer credential management", "READY"],
+  ["Command Center workflow gateway", "READY"],
   ["TikTok OAuth authorization", "AUTHORIZATION_REQUIRED"],
   ["Human approval enforcement", "ENABLED"],
   ["Live publishing", "LOCKED"],
@@ -160,6 +162,8 @@ export default function TokMetricCommandCenterPage() {
         ))}
       </section>
 
+      <TokMetricActivationPanel />
+
       <section className="grid gap-6 xl:grid-cols-[1.15fr_0.85fr]">
         <TokMetricConnectorPanel />
 
diff --git a/src/components/tokmetric/TokMetricActivationPanel.tsx b/src/components/tokmetric/TokMetricActivationPanel.tsx
new file mode 100644
index 00000000..2f86a2e5
--- /dev/null
+++ b/src/components/tokmetric/TokMetricActivationPanel.tsx
@@ -0,0 +1,502 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+  AlertTriangle,
+  CheckCircle2,
+  ClipboardCheck,
+  KeyRound,
+  Loader2,
+  PlayCircle,
+  RefreshCw,
+  Send,
+  ShieldCheck,
+  Video,
+} from "lucide-react";
+
+const WORKSPACE_ID = "ws_60488340ded94dcfab3b875ef9ae591c";
+
+type Connector = {
+  id: string;
+  provider: string;
+  state: string;
+  displayName: string;
+  externalAccountId: string | null;
+  grantedScopes: string[];
+  lastHealthAt: string | null;
+};
+
+type ContentRecord = {
+  id: string;
+  title: string;
+  state: string;
+  currentVersionId: string | null;
+  updatedAt: string;
+};
+
+type ApprovalRecord = {
+  id: string;
+  contentId: string | null;
+  contentVersionId: string | null;
+  requiredRole: string;
+  state: string;
+  expiresAt: string | null;
+};
+
+type Snapshot = {
+  ok: true;
+  workspace: {
+    id: string;
+    name: string;
+    globalEmergencyLock: boolean;
+    publishingDisabled: boolean;
+    advertisingDisabled: boolean;
+    shopWriteDisabled: boolean;
+    connectorDisabled: boolean;
+  };
+  counts: {
+    connectors: number;
+    connectedConnectors: number;
+    contents: number;
+    approvedContents: number;
+    pendingApprovals: number;
+    publishJobs: number;
+    analyticsSnapshots: number;
+    activeGptCredentials: number;
+  };
+  activation: {
+    productionActivation: "READY" | "BLOCKED";
+    controlledWriteMode: string;
+    oauthEnabled: boolean;
+    livePublishingEnabled: boolean;
+    connectedPublishingConnector: boolean;
+    configMissing: string[];
+    blockers: string[];
+  };
+  connectors: Connector[];
+  contents: ContentRecord[];
+  approvals: ApprovalRecord[];
+  externalActionTaken: false;
+};
+
+type CommandError = { error?: string; code?: string };
+
+async function readJson<T>(response: Response): Promise<T> {
+  return (await response.json().catch(() => ({}))) as T;
+}
+
+function stateLabel(value: string) {
+  return value.replaceAll("_", " ");
+}
+
+function StateBadge({ value }: { value: string }) {
+  const ready = ["READY", "CONNECTED", "APPROVED", "PASS"].includes(value);
+  return (
+    <span
+      className={`inline-flex items-center gap-1.5 rounded-full border px-2.5 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] ${
+        ready
+          ? "border-emerald-500/25 bg-emerald-500/10 text-emerald-300"
+          : "border-amber-500/25 bg-amber-500/10 text-amber-200"
+      }`}
+    >
+      {ready ? (
+        <CheckCircle2 className="h-3.5 w-3.5" />
+      ) : (
+        <AlertTriangle className="h-3.5 w-3.5" />
+      )}
+      {stateLabel(value)}
+    </span>
+  );
+}
+
+export function TokMetricActivationPanel() {
+  const [snapshot, setSnapshot] = useState<Snapshot | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [working, setWorking] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [title, setTitle] = useState("");
+  const [script, setScript] = useState("");
+  const [caption, setCaption] = useState("");
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const response = await fetch("/api/tokmetric/command", {
+        method: "GET",
+        cache: "no-store",
+      });
+      const body = await readJson<Snapshot & CommandError>(response);
+      if (!response.ok || body.ok !== true) {
+        throw new Error(body.error || "TokMetric workspace could not be loaded.");
+      }
+      setSnapshot(body);
+    } catch (requestError) {
+      setSnapshot(null);
+      setError(
+        requestError instanceof Error
+          ? requestError.message
+          : "TokMetric workspace could not be loaded.",
+      );
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  async function command(
+    operation: string,
+    payload: Record<string, unknown>,
+    successMessage: string,
+  ) {
+    setWorking(`${operation}:${String(payload.contentId || payload.approvalId || "global")}`);
+    setError(null);
+    setNotice(null);
+    try {
+      const response = await fetch("/api/tokmetric/command", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ operation, ...payload }),
+      });
+      const body = await readJson<Record<string, unknown> & CommandError>(response);
+      if (!response.ok) {
+        throw new Error(body.error || "TokMetric operation failed.");
+      }
+      setNotice(successMessage);
+      await load();
+      return body;
+    } catch (requestError) {
+      setError(
+        requestError instanceof Error
+          ? requestError.message
+          : "TokMetric operation failed.",
+      );
+      return null;
+    } finally {
+      setWorking(null);
+    }
+  }
+
+  async function createDraft() {
+    if (title.trim().length < 1) {
+      setError("A draft title is required.");
+      return;
+    }
+    const result = await command(
+      "create_draft",
+      {
+        title: title.trim(),
+        script: script.trim() || undefined,
+        caption: caption.trim() || undefined,
+      },
+      "Internal TokMetric draft created. No external TikTok action occurred.",
+    );
+    if (result) {
+      setTitle("");
+      setScript("");
+      setCaption("");
+    }
+  }
+
+  function startOAuth(provider: string) {
+    const params = new URLSearchParams({ workspaceId: WORKSPACE_ID, provider });
+    window.location.assign(`/api/tokmetric/oauth/start?${params.toString()}`);
+  }
+
+  const publishingConnector = useMemo(
+    () =>
+      snapshot?.connectors.find(
+        (connector) => connector.provider === "TIKTOK_CONTENT_POSTING_API",
+      ) ?? null,
+    [snapshot],
+  );
+
+  return (
+    <section className="rounded-2xl border border-violet-500/20 bg-card/80 p-5">
+      <div className="flex flex-col gap-4 lg:flex-row lg:items-start lg:justify-between">
+        <div>
+          <div className="flex items-center gap-2">
+            <PlayCircle className="h-5 w-5 text-violet-300" />
+            <h2 className="text-lg font-bold text-white">Production activation console</h2>
+          </div>
+          <p className="mt-2 max-w-3xl text-sm leading-6 text-slate-400">
+            Work through the controlled activation sequence using real workspace records.
+            Drafts, reviews, approvals, and preflight are internal. External TikTok
+            publishing remains blocked until every activation gate passes.
+          </p>
+        </div>
+        <button
+          type="button"
+          onClick={() => void load()}
+          disabled={loading}
+          className="inline-flex items-center justify-center gap-2 rounded-xl border border-white/10 px-3 py-2 text-sm font-semibold text-slate-200 hover:bg-white/[0.05] disabled:opacity-50"
+        >
+          <RefreshCw className={`h-4 w-4 ${loading ? "animate-spin" : ""}`} />
+          Refresh
+        </button>
+      </div>
+
+      {error ? (
+        <div className="mt-4 rounded-xl border border-rose-500/25 bg-rose-500/10 p-3 text-sm text-rose-200">
+          {error}
+        </div>
+      ) : null}
+      {notice ? (
+        <div className="mt-4 rounded-xl border border-emerald-500/25 bg-emerald-500/10 p-3 text-sm text-emerald-200">
+          {notice}
+        </div>
+      ) : null}
+
+      {loading && !snapshot ? (
+        <div className="mt-5 flex items-center gap-2 py-8 text-sm text-slate-400">
+          <Loader2 className="h-4 w-4 animate-spin" /> Loading production workspace…
+        </div>
+      ) : snapshot ? (
+        <div className="mt-5 space-y-5">
+          <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
+            {[
+              ["Activation", snapshot.activation.productionActivation],
+              ["Connected connectors", String(snapshot.counts.connectedConnectors)],
+              ["Approved content", String(snapshot.counts.approvedContents)],
+              ["Pending approvals", String(snapshot.counts.pendingApprovals)],
+            ].map(([label, value]) => (
+              <article key={label} className="rounded-xl border border-white/10 bg-black/15 p-4">
+                <p className="text-xs uppercase tracking-[0.14em] text-slate-500">{label}</p>
+                <div className="mt-3">
+                  {label === "Activation" ? (
+                    <StateBadge value={value} />
+                  ) : (
+                    <p className="text-2xl font-bold text-white">{value}</p>
+                  )}
+                </div>
+              </article>
+            ))}
+          </div>
+
+          <div className="grid gap-5 xl:grid-cols-[0.9fr_1.1fr]">
+            <article className="rounded-2xl border border-white/10 bg-black/15 p-4">
+              <div className="flex items-center gap-2">
+                <KeyRound className="h-4 w-4 text-cyan-300" />
+                <h3 className="font-semibold text-white">TikTok authorization</h3>
+              </div>
+              <p className="mt-2 text-sm leading-6 text-slate-400">
+                OAuth starts through GEM and stores tokens only in the encrypted backend.
+              </p>
+              <div className="mt-4 grid gap-2 sm:grid-cols-2">
+                <button
+                  type="button"
+                  onClick={() => startOAuth("TIKTOK_LOGIN_KIT")}
+                  disabled={snapshot.workspace.connectorDisabled}
+                  className="rounded-xl border border-white/10 px-3 py-2.5 text-sm font-semibold text-white hover:bg-white/[0.05] disabled:opacity-50"
+                >
+                  Connect Login Kit
+                </button>
+                <button
+                  type="button"
+                  onClick={() => startOAuth("TIKTOK_CONTENT_POSTING_API")}
+                  disabled={snapshot.workspace.connectorDisabled}
+                  className="rounded-xl border border-white/10 px-3 py-2.5 text-sm font-semibold text-white hover:bg-white/[0.05] disabled:opacity-50"
+                >
+                  Connect Posting API
+                </button>
+              </div>
+              <div className="mt-4 space-y-2">
+                {snapshot.connectors.length === 0 ? (
+                  <p className="text-sm text-slate-500">No authorized TikTok connectors.</p>
+                ) : (
+                  snapshot.connectors.map((connector) => (
+                    <div key={connector.id} className="flex items-center justify-between gap-3 rounded-xl border border-white/8 p-3">
+                      <div>
+                        <p className="text-sm font-semibold text-white">{connector.displayName}</p>
+                        <p className="mt-1 text-xs text-slate-500">{connector.provider}</p>
+                      </div>
+                      <StateBadge value={connector.state} />
+                    </div>
+                  ))
+                )}
+              </div>
+            </article>
+
+            <article className="rounded-2xl border border-white/10 bg-black/15 p-4">
+              <div className="flex items-center gap-2">
+                <Video className="h-4 w-4 text-cyan-300" />
+                <h3 className="font-semibold text-white">Create internal content draft</h3>
+              </div>
+              <div className="mt-4 grid gap-3">
+                <input
+                  value={title}
+                  onChange={(event) => setTitle(event.target.value)}
+                  placeholder="Draft title"
+                  maxLength={200}
+                  className="rounded-xl border border-white/10 bg-black/20 px-3 py-2.5 text-sm text-white outline-none focus:border-cyan-500/50"
+                />
+                <textarea
+                  value={script}
+                  onChange={(event) => setScript(event.target.value)}
+                  placeholder="Script"
+                  rows={5}
+                  maxLength={10000}
+                  className="resize-y rounded-xl border border-white/10 bg-black/20 px-3 py-2.5 text-sm text-white outline-none focus:border-cyan-500/50"
+                />
+                <textarea
+                  value={caption}
+                  onChange={(event) => setCaption(event.target.value)}
+                  placeholder="Caption"
+                  rows={3}
+                  maxLength={2200}
+                  className="resize-y rounded-xl border border-white/10 bg-black/20 px-3 py-2.5 text-sm text-white outline-none focus:border-cyan-500/50"
+                />
+                <button
+                  type="button"
+                  onClick={() => void createDraft()}
+                  disabled={working !== null}
+                  className="inline-flex items-center justify-center gap-2 rounded-xl bg-cyan-400 px-4 py-3 text-sm font-bold text-black hover:bg-cyan-300 disabled:opacity-50"
+                >
+                  {working?.startsWith("create_draft") ? (
+                    <Loader2 className="h-4 w-4 animate-spin" />
+                  ) : (
+                    <Video className="h-4 w-4" />
+                  )}
+                  Create draft
+                </button>
+              </div>
+            </article>
+          </div>
+
+          <article className="rounded-2xl border border-white/10 bg-black/15 p-4">
+            <div className="flex items-center gap-2">
+              <ClipboardCheck className="h-4 w-4 text-cyan-300" />
+              <h3 className="font-semibold text-white">Content review and approval flow</h3>
+            </div>
+            <div className="mt-4 space-y-3">
+              {snapshot.contents.length === 0 ? (
+                <p className="py-5 text-sm text-slate-500">No content records exist yet.</p>
+              ) : (
+                snapshot.contents.map((content) => {
+                  const approval = snapshot.approvals.find(
+                    (item) => item.contentId === content.id,
+                  );
+                  return (
+                    <div key={content.id} className="rounded-xl border border-white/8 p-3">
+                      <div className="flex flex-col gap-3 lg:flex-row lg:items-center lg:justify-between">
+                        <div>
+                          <p className="font-semibold text-white">{content.title}</p>
+                          <p className="mt-1 break-all font-mono text-[10px] text-slate-600">{content.id}</p>
+                        </div>
+                        <div className="flex flex-wrap items-center gap-2">
+                          <StateBadge value={content.state} />
+                          <button
+                            type="button"
+                            onClick={() =>
+                              void command(
+                                "run_review",
+                                { contentId: content.id },
+                                "Compliance review completed.",
+                              )
+                            }
+                            disabled={working !== null}
+                            className="rounded-lg border border-white/10 px-3 py-2 text-xs font-semibold text-white hover:bg-white/[0.05] disabled:opacity-50"
+                          >
+                            Run review
+                          </button>
+                          <button
+                            type="button"
+                            onClick={() =>
+                              void command(
+                                "request_approval",
+                                { contentId: content.id, requiredRole: "approver" },
+                                "Human approval requested for the exact content version.",
+                              )
+                            }
+                            disabled={working !== null}
+                            className="rounded-lg border border-white/10 px-3 py-2 text-xs font-semibold text-white hover:bg-white/[0.05] disabled:opacity-50"
+                          >
+                            Request approval
+                          </button>
+                          <button
+                            type="button"
+                            onClick={() =>
+                              void command(
+                                "publish_preflight",
+                                {
+                                  contentId: content.id,
+                                  connectorId: publishingConnector?.id,
+                                },
+                                "Publishing preflight completed. No external action occurred.",
+                              )
+                            }
+                            disabled={working !== null}
+                            className="rounded-lg border border-violet-500/30 bg-violet-500/10 px-3 py-2 text-xs font-semibold text-violet-200 hover:bg-violet-500/15 disabled:opacity-50"
+                          >
+                            Preflight
+                          </button>
+                        </div>
+                      </div>
+                      {approval?.state === "APPROVAL_REQUIRED" ? (
+                        <div className="mt-3 flex flex-wrap items-center gap-2 border-t border-white/8 pt-3">
+                          <span className="text-xs text-slate-500">Approval {approval.id}</span>
+                          <button
+                            type="button"
+                            onClick={() =>
+                              void command(
+                                "decide_approval",
+                                { approvalId: approval.id, decision: "approve", reason: "Approved in the controlled GEM Command Center." },
+                                "Exact-version approval recorded.",
+                              )
+                            }
+                            disabled={working !== null}
+                            className="inline-flex items-center gap-1.5 rounded-lg bg-emerald-500 px-3 py-2 text-xs font-bold text-white disabled:opacity-50"
+                          >
+                            <ShieldCheck className="h-3.5 w-3.5" /> Approve
+                          </button>
+                          <button
+                            type="button"
+                            onClick={() =>
+                              void command(
+                                "decide_approval",
+                                { approvalId: approval.id, decision: "reject", reason: "Rejected in the controlled GEM Command Center." },
+                                "Approval rejection recorded.",
+                              )
+                            }
+                            disabled={working !== null}
+                            className="rounded-lg border border-rose-500/30 bg-rose-500/10 px-3 py-2 text-xs font-semibold text-rose-200 disabled:opacity-50"
+                          >
+                            Reject
+                          </button>
+                        </div>
+                      ) : null}
+                    </div>
+                  );
+                })
+              )}
+            </div>
+          </article>
+
+          <article className="rounded-2xl border border-amber-500/20 bg-amber-500/[0.06] p-4">
+            <div className="flex items-center gap-2 font-semibold text-amber-200">
+              <AlertTriangle className="h-4 w-4" /> Activation blockers
+            </div>
+            {snapshot.activation.blockers.length === 0 ? (
+              <p className="mt-3 text-sm text-emerald-200">All internal activation gates pass.</p>
+            ) : (
+              <ul className="mt-3 grid gap-2 text-sm text-amber-100/75 sm:grid-cols-2">
+                {snapshot.activation.blockers.map((blocker) => (
+                  <li key={blocker} className="rounded-lg border border-amber-500/15 bg-black/10 px-3 py-2">
+                    {stateLabel(blocker)}
+                  </li>
+                ))}
+              </ul>
+            )}
+            <div className="mt-4 flex items-center gap-2 text-xs text-amber-100/60">
+              <Send className="h-3.5 w-3.5" /> External actions taken: none
+            </div>
+          </article>
+        </div>
+      ) : null}
+    </section>
+  );
+}
diff --git a/src/lib/tokmetric/command-gateway.ts b/src/lib/tokmetric/command-gateway.ts
new file mode 100644
index 00000000..6b922dcf
--- /dev/null
+++ b/src/lib/tokmetric/command-gateway.ts
@@ -0,0 +1,25 @@
+import {
+  adminWriteGateway,
+  type AdminWriteGatewayAction,
+} from "@/lib/supabase-gateway";
+
+export type TokMetricCommandOperation =
+  | "snapshot"
+  | "create_draft"
+  | "create_version"
+  | "run_review"
+  | "request_approval"
+  | "decide_approval"
+  | "publish_preflight";
+
+export async function invokeTokMetricCommandGateway<T>(
+  token: string,
+  operation: TokMetricCommandOperation,
+  payload: Record<string, unknown> = {},
+): Promise<T> {
+  return adminWriteGateway<T>(
+    "tokmetric_command" as AdminWriteGatewayAction,
+    token,
+    { operation, ...payload },
+  );
+}
diff --git a/supabase/functions/gem-admin-write/index.ts b/supabase/functions/gem-admin-write/index.ts
index 8e4b2724..fa5e06b3 100644
--- a/supabase/functions/gem-admin-write/index.ts
+++ b/supabase/functions/gem-admin-write/index.ts
@@ -1,10 +1,16 @@
 import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "npm:@supabase/supabase-js@2.49.8";
+import {
+  dispatchTokMetricCommand,
+  TokMetricCommandError,
+} from "./tokmetric-command.ts";
 
 const SUPABASE_URL = Deno.env.get("SUPABASE_URL") ?? "";
 const SERVICE_ROLE_KEY = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "";
 const TOKMETRIC_WORKSPACE_ID = "ws_60488340ded94dcfab3b875ef9ae591c";
 const MAX_ACTIVE_TOKMETRIC_CREDENTIALS = 5;
+const ADMIN_ROLES = ["admin", "super_admin", "internal"] as const;
+
 if (!SUPABASE_URL || !SERVICE_ROLE_KEY) {
   throw new Error("Missing Supabase runtime configuration");
 }
@@ -14,7 +20,6 @@ const db = createClient(SUPABASE_URL, SERVICE_ROLE_KEY, {
 });
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
-const ADMIN_ROLES = ["admin", "super_admin", "internal"] as const;
 const CORS_HEADERS = {
   "Access-Control-Allow-Origin": "https://www.gemcybersecurityassist.com",
   "Access-Control-Allow-Headers":
@@ -40,6 +45,7 @@ function json(body: unknown, status = 200) {
       "Content-Type": "application/json",
       "Cache-Control": "no-store",
       "X-Content-Type-Options": "nosniff",
+      "Referrer-Policy": "no-referrer",
     },
   });
 }
@@ -61,6 +67,10 @@ async function signingKey() {
   );
 }
 
+function validSessionVersion(value: unknown): value is number {
+  return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+
 async function requireAdmin(token: unknown) {
   if (typeof token !== "string") {
     throw new GatewayError(401, "UNAUTHORIZED", "Authentication required");
@@ -79,12 +89,24 @@ async function requireAdmin(token: unknown) {
   if (!valid) {
     throw new GatewayError(401, "INVALID_SESSION", "Invalid session token");
   }
-  const payload = JSON.parse(
-    decoder.decode(decodeB64url(parts[1])),
-  ) as Record<string, unknown>;
+
+  let payload: Record<string, unknown>;
+  try {
+    payload = JSON.parse(
+      decoder.decode(decodeB64url(parts[1])),
+    ) as Record<string, unknown>;
+  } catch {
+    throw new GatewayError(401, "INVALID_SESSION", "Invalid session token");
+  }
+
   const userId = typeof payload.sub === "string" ? payload.sub : "";
   const exp = typeof payload.exp === "number" ? payload.exp : 0;
-  if (!userId || exp <= Math.floor(Date.now() / 1000)) {
+  const sessionVersion = payload.sessionVersion;
+  if (
+    !userId ||
+    exp <= Math.floor(Date.now() / 1000) ||
+    !validSessionVersion(sessionVersion)
+  ) {
     throw new GatewayError(401, "SESSION_EXPIRED", "Session expired");
   }
   if (
@@ -96,7 +118,9 @@ async function requireAdmin(token: unknown) {
 
   const { data: user, error } = await db
     .from("users")
-    .select("id,email,role,status,isActive,isEmailVerified")
+    .select(
+      "id,email,role,status,isActive,isEmailVerified,sessionVersion",
+    )
     .eq("id", userId)
     .maybeSingle();
   if (error) {
@@ -108,10 +132,28 @@ async function requireAdmin(token: unknown) {
   if (!user.isActive || user.status !== "active") {
     throw new GatewayError(403, "ACCOUNT_DISABLED", "Account is not active");
   }
+  if (!validSessionVersion(user.sessionVersion)) {
+    throw new GatewayError(
+      503,
+      "INVALID_SESSION_VERSION",
+      "Session authority unavailable",
+    );
+  }
+  if (user.sessionVersion !== sessionVersion) {
+    throw new GatewayError(401, "SESSION_REVOKED", "Session revoked");
+  }
   if (!ADMIN_ROLES.includes(user.role as (typeof ADMIN_ROLES)[number])) {
     throw new GatewayError(403, "FORBIDDEN", "Administrator access required");
   }
-  return user;
+  return user as {
+    id: string;
+    email: string;
+    role: string;
+    status: string;
+    isActive: boolean;
+    isEmailVerified: boolean;
+    sessionVersion: number;
+  };
 }
 
 function assignableRoles(actorRole: string) {
@@ -165,7 +207,9 @@ async function updateUser(
 
   const { data: target, error } = await db
     .from("users")
-    .select("id,email,role,status,isActive,isEmailVerified")
+    .select(
+      "id,email,role,status,isActive,isEmailVerified,sessionVersion",
+    )
     .eq("id", id)
     .maybeSingle();
   if (error) throw new GatewayError(503, "DATABASE_ERROR", error.message);
@@ -242,12 +286,16 @@ async function updateUser(
       "Requested update does not change the account",
     );
   }
+  update.sessionVersion =
+    (validSessionVersion(target.sessionVersion) ? target.sessionVersion : 0) + 1;
 
   const { data, error: updateError } = await db
     .from("users")
     .update(update)
     .eq("id", target.id)
-    .select("id,email,role,status,isActive,isEmailVerified,updatedAt")
+    .select(
+      "id,email,role,status,isActive,isEmailVerified,sessionVersion,updatedAt",
+    )
     .single();
   if (updateError) {
     throw new GatewayError(503, "DATABASE_ERROR", updateError.message);
@@ -279,6 +327,7 @@ async function updateUser(
         previousIsActive: target.isActive,
         newIsActive: update.isActive,
         reason,
+        targetMustReauthenticate: true,
       },
     });
   }
@@ -286,7 +335,7 @@ async function updateUser(
   return {
     ok: true,
     user: data,
-    reauthenticationRequired: Boolean(update.role),
+    reauthenticationRequired: true,
   };
 }
 
@@ -758,6 +807,7 @@ Deno.serve(async (req) => {
   if (req.method !== "POST") {
     return json({ error: "Method not allowed" }, 405);
   }
+
   try {
     const body = (await req.json()) as Record<string, unknown>;
     const actor = await requireAdmin(body.token);
@@ -781,12 +831,34 @@ Deno.serve(async (req) => {
     if (action === "tokmetric_credential_revoke") {
       return json(await revokeTokMetricCredential(actor, body));
     }
+    if (action === "tokmetric_command") {
+      try {
+        const result = await dispatchTokMetricCommand({
+          db,
+          actor,
+          workspaceId: TOKMETRIC_WORKSPACE_ID,
+          body,
+        });
+        const created =
+          body.operation === "create_draft" ||
+          body.operation === "request_approval";
+        return json(result, created ? 201 : 200);
+      } catch (error) {
+        if (error instanceof TokMetricCommandError) {
+          throw new GatewayError(error.status, error.code, error.message);
+        }
+        throw error;
+      }
+    }
     throw new GatewayError(400, "UNKNOWN_ACTION", "Unknown action");
   } catch (error) {
     if (error instanceof GatewayError) {
       return json({ error: error.message, code: error.code }, error.status);
     }
-    console.error(error);
+    console.error(
+      "gem_admin_write_internal_error",
+      error instanceof Error ? error.name : "unknown",
+    );
     return json({ error: "Internal gateway error", code: "INTERNAL_ERROR" }, 500);
   }
 });
diff --git a/supabase/functions/gem-admin-write/tokmetric-command.ts b/supabase/functions/gem-admin-write/tokmetric-command.ts
new file mode 100644
index 00000000..fb76e035
--- /dev/null
+++ b/supabase/functions/gem-admin-write/tokmetric-command.ts
@@ -0,0 +1,1190 @@
+type DatabaseClient = any;
+
+export type TokMetricOperator = {
+  id: string;
+  role: string;
+};
+
+export class TokMetricCommandError extends Error {
+  constructor(
+    public status: number,
+    public code: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+function requiredText(
+  value: unknown,
+  field: string,
+  minLength: number,
+  maxLength: number,
+) {
+  if (typeof value !== "string") {
+    throw new TokMetricCommandError(400, "INVALID_REQUEST", `${field} is required`);
+  }
+  const normalized = value.trim();
+  if (normalized.length < minLength || normalized.length > maxLength) {
+    throw new TokMetricCommandError(400, "INVALID_REQUEST", `${field} is invalid`);
+  }
+  return normalized;
+}
+
+function optionalText(value: unknown, maxLength: number) {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "string" || value.length > maxLength) {
+    throw new TokMetricCommandError(400, "INVALID_REQUEST", "Text value is invalid");
+  }
+  return value.trim() || null;
+}
+
+function uniqueStrings(value: unknown, maxItems: number, maxLength: number) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > maxItems) {
+    throw new TokMetricCommandError(400, "INVALID_REQUEST", "List value is invalid");
+  }
+  return [...new Set(
+    value
+      .map((item) => {
+        if (typeof item !== "string" || item.length > maxLength) {
+          throw new TokMetricCommandError(
+            400,
+            "INVALID_REQUEST",
+            "List item is invalid",
+          );
+        }
+        return item.trim();
+      })
+      .filter(Boolean),
+  )];
+}
+
+function canonical(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, canonical(entry)]),
+    );
+  }
+  return value;
+}
+
+async function objectHash(value: unknown) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(JSON.stringify(canonical(value))),
+  );
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+function recordId(prefix: string) {
+  return `${prefix}_${crypto.randomUUID().replaceAll("-", "")}`;
+}
+
+async function requireWorkspace(db: DatabaseClient, workspaceId: string) {
+  const { data, error } = await db
+    .from("tokmetric_workspaces")
+    .select(
+      "id,name,slug,globalEmergencyLock,publishingDisabled,advertisingDisabled,shopWriteDisabled,connectorDisabled,createdAt,updatedAt",
+    )
+    .eq("id", workspaceId)
+    .maybeSingle();
+  if (error) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", error.message);
+  }
+  if (!data) {
+    throw new TokMetricCommandError(404, "WORKSPACE_NOT_FOUND", "Workspace not found");
+  }
+  return data;
+}
+
+async function audit(
+  db: DatabaseClient,
+  workspaceId: string,
+  actorId: string,
+  action: string,
+  entityType: string,
+  entityId: string | null,
+  outcome: string,
+  metadata: Record<string, unknown> = {},
+) {
+  const { error } = await db.from("tokmetric_audit_events").insert({
+    id: recordId("audit"),
+    workspaceId,
+    actorId,
+    action,
+    entityType,
+    entityId,
+    correlationId: crypto.randomUUID(),
+    outcome,
+    sourceChannel: "command_center",
+    safeMetadata: metadata,
+    createdAt: new Date().toISOString(),
+  });
+  if (error) console.error("tokmetric_activation_audit_failed", error.message);
+}
+
+async function domainEvent(
+  db: DatabaseClient,
+  workspaceId: string,
+  aggregateType: string,
+  aggregateId: string,
+  eventType: string,
+  metadata: Record<string, unknown> = {},
+) {
+  const { error } = await db.from("tokmetric_domain_events").insert({
+    id: recordId("event"),
+    workspaceId,
+    aggregateType,
+    aggregateId,
+    eventType,
+    correlationId: crypto.randomUUID(),
+    safeMetadata: metadata,
+    createdAt: new Date().toISOString(),
+  });
+  if (error) console.error("tokmetric_domain_event_failed", error.message);
+}
+
+async function snapshot(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+) {
+  const workspace = await requireWorkspace(db, workspaceId);
+  const [
+    connectorsResult,
+    contentsResult,
+    reviewsResult,
+    approvalsResult,
+    jobsResult,
+    analyticsResult,
+    auditsResult,
+    credentialsResult,
+  ] = await Promise.all([
+    db.from("tokmetric_connectors")
+      .select(
+        "id,provider,state,displayName,externalAccountId,grantedScopes,lastHealthAt,updatedAt,disabledAt",
+      )
+      .eq("workspaceId", workspaceId)
+      .order("updatedAt", { ascending: false }),
+    db.from("tokmetric_contents")
+      .select("id,title,state,currentVersionId,campaignId,createdAt,updatedAt")
+      .eq("workspaceId", workspaceId)
+      .order("updatedAt", { ascending: false })
+      .limit(50),
+    db.from("tokmetric_compliance_reviews")
+      .select("id,contentId,contentVersionId,result,findings,createdAt")
+      .eq("workspaceId", workspaceId)
+      .order("createdAt", { ascending: false })
+      .limit(50),
+    db.from("tokmetric_approval_requests")
+      .select(
+        "id,contentId,contentVersionId,requestedById,requiredRole,action,objectHash,state,expiresAt,createdAt,updatedAt",
+      )
+      .eq("workspaceId", workspaceId)
+      .order("updatedAt", { ascending: false })
+      .limit(50),
+    db.from("tokmetric_publish_jobs")
+      .select(
+        "id,connectorId,contentId,contentVersionId,internalState,externalState,scheduledFor,createdAt,updatedAt",
+      )
+      .eq("workspaceId", workspaceId)
+      .order("updatedAt", { ascending: false })
+      .limit(50),
+    db.from("tokmetric_analytics_snapshots")
+      .select("id,source,metric,value,dimensions,capturedAt")
+      .eq("workspaceId", workspaceId)
+      .order("capturedAt", { ascending: false })
+      .limit(100),
+    db.from("tokmetric_audit_events")
+      .select(
+        "id,action,entityType,entityId,outcome,sourceChannel,safeMetadata,createdAt",
+      )
+      .eq("workspaceId", workspaceId)
+      .order("createdAt", { ascending: false })
+      .limit(50),
+    db.from("tokmetric_gpt_credentials")
+      .select("id", { count: "exact", head: true })
+      .eq("workspace_id", workspaceId)
+      .eq("status", "active"),
+  ]);
+
+  const queryResults = [
+    connectorsResult,
+    contentsResult,
+    reviewsResult,
+    approvalsResult,
+    jobsResult,
+    analyticsResult,
+    auditsResult,
+  ];
+  const failed = queryResults.find((result) => result.error);
+  if (failed?.error) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", failed.error.message);
+  }
+  if (credentialsResult.error) {
+    throw new TokMetricCommandError(
+      503,
+      "DATABASE_ERROR",
+      credentialsResult.error.message,
+    );
+  }
+
+  const connectors = connectorsResult.data ?? [];
+  const contents = contentsResult.data ?? [];
+  const reviews = reviewsResult.data ?? [];
+  const approvals = approvalsResult.data ?? [];
+  const publishJobs = jobsResult.data ?? [];
+  const analytics = analyticsResult.data ?? [];
+  const audits = auditsResult.data ?? [];
+  const oauthEnabled =
+    Deno.env.get("TOKMETRIC_TIKTOK_OAUTH_ENABLED") === "true";
+  const livePublishingEnabled =
+    Deno.env.get("TOKMETRIC_LIVE_PUBLISHING_ENABLED") === "true";
+  const configurationMissing = [
+    !Deno.env.get("TIKTOK_CLIENT_KEY") ? "TIKTOK_CLIENT_KEY" : null,
+    !Deno.env.get("TIKTOK_CLIENT_SECRET") ? "TIKTOK_CLIENT_SECRET" : null,
+    !Deno.env.get("TIKTOK_REDIRECT_URI") ? "TIKTOK_REDIRECT_URI" : null,
+    !Deno.env.get("TOKMETRIC_TOKEN_ENCRYPTION_KEY")
+      ? "TOKMETRIC_TOKEN_ENCRYPTION_KEY"
+      : null,
+  ].filter((value): value is string => Boolean(value));
+  const postingConnector = connectors.find(
+    (connector: Record<string, unknown>) =>
+      connector.provider === "TIKTOK_CONTENT_POSTING_API" &&
+      connector.state === "CONNECTED" &&
+      !connector.disabledAt,
+  );
+  const postingScopes = new Set(
+    (postingConnector?.grantedScopes as string[] | undefined) ?? [],
+  );
+  const publishingScopeReady =
+    postingScopes.has("video.publish") || postingScopes.has("video.upload");
+  const approvedContentCount = contents.filter(
+    (content: Record<string, unknown>) => content.state === "APPROVED",
+  ).length;
+  const pendingApprovalCount = approvals.filter(
+    (approval: Record<string, unknown>) =>
+      approval.state === "APPROVAL_REQUIRED",
+  ).length;
+
+  const blockers: string[] = [];
+  if (workspace.globalEmergencyLock) blockers.push("GLOBAL_EMERGENCY_LOCK");
+  if (workspace.connectorDisabled) blockers.push("CONNECTORS_DISABLED");
+  if (workspace.publishingDisabled) blockers.push("WORKSPACE_PUBLISHING_DISABLED");
+  if (configurationMissing.length > 0) {
+    blockers.push("TIKTOK_CONFIGURATION_MISSING");
+  }
+  if (!oauthEnabled) blockers.push("TIKTOK_OAUTH_DISABLED");
+  if (!postingConnector) {
+    blockers.push("CONTENT_POSTING_CONNECTOR_NOT_CONNECTED");
+  }
+  if (postingConnector && !publishingScopeReady) {
+    blockers.push("CONTENT_POSTING_SCOPE_NOT_AUTHORIZED");
+  }
+  if (approvedContentCount === 0) {
+    blockers.push("NO_APPROVED_CONTENT_VERSION");
+  }
+  if (!livePublishingEnabled) blockers.push("LIVE_PUBLISHING_GATE_DISABLED");
+
+  return {
+    ok: true,
+    viewer: { id: actor.id, role: actor.role },
+    workspace,
+    counts: {
+      connectors: connectors.length,
+      connectedConnectors: connectors.filter(
+        (connector: Record<string, unknown>) => connector.state === "CONNECTED",
+      ).length,
+      contents: contents.length,
+      approvedContents: approvedContentCount,
+      pendingApprovals: pendingApprovalCount,
+      publishJobs: publishJobs.length,
+      analyticsSnapshots: analytics.length,
+      activeGptCredentials: credentialsResult.count ?? 0,
+    },
+    activation: {
+      productionActivation: blockers.length === 0 ? "READY" : "BLOCKED",
+      controlledWriteMode: "COMMAND_CENTER_ONLY",
+      oauthEnabled,
+      livePublishingEnabled,
+      connectedPublishingConnector: Boolean(postingConnector),
+      publishingScopeReady,
+      configMissing: configurationMissing,
+      blockers,
+    },
+    connectors,
+    contents,
+    complianceReviews: reviews,
+    approvals,
+    publishJobs,
+    analytics,
+    auditEvents: audits,
+    externalActionTaken: false,
+  };
+}
+
+async function createDraft(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+  body: Record<string, unknown>,
+) {
+  await requireWorkspace(db, workspaceId);
+  const title = requiredText(body.title, "title", 1, 200);
+  const script = optionalText(body.script, 10_000);
+  const caption = optionalText(body.caption, 2_200);
+  const hashtags = uniqueStrings(body.hashtags, 50, 100);
+  const settings =
+    body.settings && typeof body.settings === "object" && !Array.isArray(body.settings)
+      ? body.settings as Record<string, unknown>
+      : {};
+  const contentId = recordId("content");
+  const versionId = recordId("contentver");
+  const payload = { script, caption, hashtags, settings, mediaAssetIds: [] };
+  const hash = await objectHash(payload);
+  const now = new Date().toISOString();
+
+  const contentInsert = await db.from("tokmetric_contents").insert({
+    id: contentId,
+    workspaceId,
+    campaignId: null,
+    ownerId: actor.id,
+    title,
+    state: "DRAFT",
+    currentVersionId: null,
+    createdAt: now,
+    updatedAt: now,
+  });
+  if (contentInsert.error) {
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_CREATE_FAILED",
+      contentInsert.error.message,
+    );
+  }
+
+  const versionInsert = await db.from("tokmetric_content_versions").insert({
+    id: versionId,
+    contentId,
+    version: 1,
+    objectHash: hash,
+    script,
+    caption,
+    hashtags,
+    settings,
+    mediaAssetIds: [],
+    createdById: actor.id,
+    createdAt: now,
+  });
+  if (versionInsert.error) {
+    await db.from("tokmetric_contents").delete().eq("id", contentId);
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_VERSION_CREATE_FAILED",
+      versionInsert.error.message,
+    );
+  }
+
+  const contentUpdate = await db.from("tokmetric_contents")
+    .update({ currentVersionId: versionId, updatedAt: now })
+    .eq("id", contentId);
+  if (contentUpdate.error) {
+    await db.from("tokmetric_content_versions").delete().eq("id", versionId);
+    await db.from("tokmetric_contents").delete().eq("id", contentId);
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_UPDATE_FAILED",
+      contentUpdate.error.message,
+    );
+  }
+
+  await Promise.all([
+    audit(
+      db,
+      workspaceId,
+      actor.id,
+      "tokmetric.content.created",
+      "content",
+      contentId,
+      "success",
+      { versionId, objectHash: hash },
+    ),
+    domainEvent(db, workspaceId, "content", contentId, "CONTENT_DRAFT_CREATED", {
+      versionId,
+      objectHash: hash,
+    }),
+  ]);
+  return {
+    ok: true,
+    content: {
+      id: contentId,
+      title,
+      state: "DRAFT",
+      currentVersionId: versionId,
+    },
+    version: { id: versionId, version: 1, objectHash: hash },
+    externalActionTaken: false,
+  };
+}
+
+async function createVersion(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+  body: Record<string, unknown>,
+) {
+  const contentId = requiredText(body.contentId, "contentId", 3, 200);
+  const { data: content, error: contentError } = await db
+    .from("tokmetric_contents")
+    .select("id,state,currentVersionId")
+    .eq("workspaceId", workspaceId)
+    .eq("id", contentId)
+    .maybeSingle();
+  if (contentError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", contentError.message);
+  }
+  if (!content) {
+    throw new TokMetricCommandError(404, "CONTENT_NOT_FOUND", "Content not found");
+  }
+  if (["APPROVED", "ARCHIVED"].includes(content.state)) {
+    throw new TokMetricCommandError(
+      409,
+      "CONTENT_IMMUTABLE",
+      "Approved or archived content cannot be edited directly",
+    );
+  }
+
+  const script = optionalText(body.script, 10_000);
+  const caption = optionalText(body.caption, 2_200);
+  const hashtags = uniqueStrings(body.hashtags, 50, 100);
+  const settings =
+    body.settings && typeof body.settings === "object" && !Array.isArray(body.settings)
+      ? body.settings as Record<string, unknown>
+      : {};
+  const payload = { script, caption, hashtags, settings, mediaAssetIds: [] };
+  const hash = await objectHash(payload);
+  const { data: existing, error: existingError } = await db
+    .from("tokmetric_content_versions")
+    .select("id,version,objectHash")
+    .eq("contentId", contentId)
+    .eq("objectHash", hash)
+    .maybeSingle();
+  if (existingError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", existingError.message);
+  }
+  if (existing) {
+    return { ok: true, reused: true, version: existing, externalActionTaken: false };
+  }
+
+  const { data: latest, error: latestError } = await db
+    .from("tokmetric_content_versions")
+    .select("version")
+    .eq("contentId", contentId)
+    .order("version", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (latestError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", latestError.message);
+  }
+  const version = (latest?.version ?? 0) + 1;
+  const versionId = recordId("contentver");
+  const now = new Date().toISOString();
+  const insert = await db.from("tokmetric_content_versions").insert({
+    id: versionId,
+    contentId,
+    version,
+    objectHash: hash,
+    script,
+    caption,
+    hashtags,
+    settings,
+    mediaAssetIds: [],
+    createdById: actor.id,
+    createdAt: now,
+  });
+  if (insert.error) {
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_VERSION_CREATE_FAILED",
+      insert.error.message,
+    );
+  }
+  const update = await db.from("tokmetric_contents")
+    .update({ currentVersionId: versionId, state: "DRAFT", updatedAt: now })
+    .eq("id", contentId);
+  if (update.error) {
+    await db.from("tokmetric_content_versions").delete().eq("id", versionId);
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_UPDATE_FAILED",
+      update.error.message,
+    );
+  }
+  await db.from("tokmetric_approval_requests")
+    .update({ state: "REVOKED", updatedAt: now })
+    .eq("contentId", contentId)
+    .in("state", ["APPROVAL_REQUIRED", "APPROVED"]);
+  await domainEvent(db, workspaceId, "content", contentId, "CONTENT_VERSION_CREATED", {
+    versionId,
+    objectHash: hash,
+    version,
+  });
+  return {
+    ok: true,
+    reused: false,
+    version: { id: versionId, version, objectHash: hash },
+    externalActionTaken: false,
+  };
+}
+
+async function runReview(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+  body: Record<string, unknown>,
+) {
+  const contentId = requiredText(body.contentId, "contentId", 3, 200);
+  const { data: content, error: contentError } = await db
+    .from("tokmetric_contents")
+    .select("id,currentVersionId")
+    .eq("workspaceId", workspaceId)
+    .eq("id", contentId)
+    .maybeSingle();
+  if (contentError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", contentError.message);
+  }
+  if (!content?.currentVersionId) {
+    throw new TokMetricCommandError(
+      404,
+      "CONTENT_NOT_FOUND",
+      "Content or active version not found",
+    );
+  }
+  const { data: version, error: versionError } = await db
+    .from("tokmetric_content_versions")
+    .select("id,script,caption,hashtags")
+    .eq("id", content.currentVersionId)
+    .maybeSingle();
+  if (versionError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", versionError.message);
+  }
+  if (!version) {
+    throw new TokMetricCommandError(
+      409,
+      "CONTENT_VERSION_MISSING",
+      "Content version not found",
+    );
+  }
+
+  const findings: Array<{ code: string; severity: string; message: string }> = [];
+  const combined = `${version.script ?? ""}\n${version.caption ?? ""}`.toLowerCase();
+  if (!combined.trim()) {
+    findings.push({
+      code: "EMPTY_CONTENT",
+      severity: "block",
+      message: "Content script and caption are empty.",
+    });
+  }
+  if (
+    combined.includes("guaranteed profit") ||
+    combined.includes("risk-free return")
+  ) {
+    findings.push({
+      code: "MISLEADING_FINANCIAL_CLAIM",
+      severity: "block",
+      message: "Unsupported guaranteed or risk-free financial claim detected.",
+    });
+  }
+  if (combined.includes("100% secure") || combined.includes("unhackable")) {
+    findings.push({
+      code: "ABSOLUTE_SECURITY_CLAIM",
+      severity: "warning",
+      message: "Absolute cybersecurity claims require substantiation or revision.",
+    });
+  }
+  if ((version.hashtags ?? []).length > 30) {
+    findings.push({
+      code: "HASHTAG_LIMIT",
+      severity: "warning",
+      message: "Hashtag count exceeds the review threshold.",
+    });
+  }
+
+  const hasBlock = findings.some((finding) => finding.severity === "block");
+  const hasWarning = findings.some((finding) => finding.severity === "warning");
+  const result = hasBlock
+    ? "BLOCKED"
+    : hasWarning
+      ? "HUMAN_REVIEW_REQUIRED"
+      : "PASS";
+  const nextState = hasBlock
+    ? "BLOCKED"
+    : hasWarning
+      ? "REVIEW_READY"
+      : "APPROVAL_REQUIRED";
+  const reviewId = recordId("review");
+  const now = new Date().toISOString();
+  const insert = await db.from("tokmetric_compliance_reviews").insert({
+    id: reviewId,
+    workspaceId,
+    contentId,
+    contentVersionId: version.id,
+    policyVersionId: null,
+    result,
+    findings,
+    reviewerId: actor.id,
+    createdAt: now,
+  });
+  if (insert.error) {
+    throw new TokMetricCommandError(
+      503,
+      "COMPLIANCE_REVIEW_FAILED",
+      insert.error.message,
+    );
+  }
+  const update = await db.from("tokmetric_contents")
+    .update({ state: nextState, updatedAt: now })
+    .eq("id", contentId);
+  if (update.error) {
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_UPDATE_FAILED",
+      update.error.message,
+    );
+  }
+  await audit(
+    db,
+    workspaceId,
+    actor.id,
+    "tokmetric.compliance.reviewed",
+    "compliance_review",
+    reviewId,
+    hasBlock ? "blocked" : "success",
+    { contentId, contentVersionId: version.id, result, findings },
+  );
+  return {
+    ok: true,
+    review: {
+      id: reviewId,
+      contentId,
+      contentVersionId: version.id,
+      result,
+      findings,
+    },
+    contentState: nextState,
+    externalActionTaken: false,
+  };
+}
+
+async function requestApproval(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+  body: Record<string, unknown>,
+) {
+  const contentId = requiredText(body.contentId, "contentId", 3, 200);
+  const requiredRole =
+    typeof body.requiredRole === "string" && body.requiredRole.trim()
+      ? body.requiredRole.trim().slice(0, 100)
+      : "approver";
+  const expiresAt = typeof body.expiresAt === "string"
+    ? new Date(body.expiresAt)
+    : null;
+  if (expiresAt && !Number.isFinite(expiresAt.getTime())) {
+    throw new TokMetricCommandError(
+      400,
+      "INVALID_EXPIRY",
+      "Approval expiry is invalid",
+    );
+  }
+
+  const { data: content, error: contentError } = await db
+    .from("tokmetric_contents")
+    .select("id,currentVersionId")
+    .eq("workspaceId", workspaceId)
+    .eq("id", contentId)
+    .maybeSingle();
+  if (contentError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", contentError.message);
+  }
+  if (!content?.currentVersionId) {
+    throw new TokMetricCommandError(
+      404,
+      "CONTENT_NOT_FOUND",
+      "Content or active version not found",
+    );
+  }
+  const { data: version, error: versionError } = await db
+    .from("tokmetric_content_versions")
+    .select("id,objectHash")
+    .eq("id", content.currentVersionId)
+    .maybeSingle();
+  if (versionError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", versionError.message);
+  }
+  if (!version) {
+    throw new TokMetricCommandError(
+      409,
+      "CONTENT_VERSION_MISSING",
+      "Content version not found",
+    );
+  }
+
+  const { data: review, error: reviewError } = await db
+    .from("tokmetric_compliance_reviews")
+    .select("id,result,findings,createdAt")
+    .eq("workspaceId", workspaceId)
+    .eq("contentVersionId", version.id)
+    .order("createdAt", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (reviewError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", reviewError.message);
+  }
+  if (!review) {
+    throw new TokMetricCommandError(
+      409,
+      "COMPLIANCE_REVIEW_REQUIRED",
+      "Run compliance review for the exact content version first",
+    );
+  }
+  if (!["PASS", "HUMAN_REVIEW_REQUIRED"].includes(review.result)) {
+    throw new TokMetricCommandError(
+      409,
+      "COMPLIANCE_BLOCKED",
+      "Resolve blocking compliance findings first",
+    );
+  }
+
+  const { data: existing, error: existingError } = await db
+    .from("tokmetric_approval_requests")
+    .select("id,state,contentId,contentVersionId,requiredRole,objectHash,expiresAt")
+    .eq("workspaceId", workspaceId)
+    .eq("contentVersionId", version.id)
+    .eq("objectHash", version.objectHash)
+    .in("state", ["APPROVAL_REQUIRED", "APPROVED"])
+    .order("updatedAt", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (existingError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", existingError.message);
+  }
+  if (existing) {
+    return { ok: true, reused: true, approval: existing, externalActionTaken: false };
+  }
+
+  const approvalId = recordId("approval");
+  const now = new Date().toISOString();
+  const insert = await db.from("tokmetric_approval_requests").insert({
+    id: approvalId,
+    workspaceId,
+    contentId,
+    contentVersionId: version.id,
+    requestedById: actor.id,
+    requiredRole,
+    action: "publish_tiktok_content",
+    objectHash: version.objectHash,
+    state: "APPROVAL_REQUIRED",
+    expiresAt: expiresAt?.toISOString() ?? null,
+    createdAt: now,
+    updatedAt: now,
+  });
+  if (insert.error) {
+    throw new TokMetricCommandError(
+      503,
+      "APPROVAL_CREATE_FAILED",
+      insert.error.message,
+    );
+  }
+  const update = await db.from("tokmetric_contents")
+    .update({ state: "APPROVAL_REQUIRED", updatedAt: now })
+    .eq("id", contentId);
+  if (update.error) {
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_UPDATE_FAILED",
+      update.error.message,
+    );
+  }
+  await audit(
+    db,
+    workspaceId,
+    actor.id,
+    "tokmetric.approval.requested",
+    "approval",
+    approvalId,
+    "success",
+    {
+      contentId,
+      contentVersionId: version.id,
+      requiredRole,
+      complianceReviewId: review.id,
+    },
+  );
+  return {
+    ok: true,
+    reused: false,
+    approval: {
+      id: approvalId,
+      contentId,
+      contentVersionId: version.id,
+      state: "APPROVAL_REQUIRED",
+      requiredRole,
+    },
+    externalActionTaken: false,
+  };
+}
+
+function roleCanDecide(actorRole: string, requiredRole: string) {
+  if (requiredRole === "super_admin") {
+    return actorRole === "super_admin" || actorRole === "internal";
+  }
+  return ["admin", "super_admin", "internal"].includes(actorRole);
+}
+
+async function decideApproval(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+  body: Record<string, unknown>,
+) {
+  const approvalId = requiredText(body.approvalId, "approvalId", 3, 200);
+  const decision = requiredText(body.decision, "decision", 3, 20).toLowerCase();
+  if (!["approve", "reject", "revoke"].includes(decision)) {
+    throw new TokMetricCommandError(
+      400,
+      "INVALID_DECISION",
+      "Approval decision is invalid",
+    );
+  }
+  const reason = requiredText(body.reason, "reason", 10, 2_000);
+
+  const { data: approval, error: approvalError } = await db
+    .from("tokmetric_approval_requests")
+    .select(
+      "id,contentId,contentVersionId,requestedById,requiredRole,objectHash,state,expiresAt",
+    )
+    .eq("workspaceId", workspaceId)
+    .eq("id", approvalId)
+    .maybeSingle();
+  if (approvalError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", approvalError.message);
+  }
+  if (!approval?.contentId || !approval.contentVersionId) {
+    throw new TokMetricCommandError(
+      404,
+      "APPROVAL_NOT_FOUND",
+      "Approval request not found",
+    );
+  }
+  if (approval.state !== "APPROVAL_REQUIRED") {
+    throw new TokMetricCommandError(
+      409,
+      "APPROVAL_STATE_INVALID",
+      "Approval is not awaiting a decision",
+    );
+  }
+  if (approval.requestedById === actor.id) {
+    throw new TokMetricCommandError(
+      403,
+      "APPROVAL_SEPARATION_REQUIRED",
+      "The requester cannot decide the same approval",
+    );
+  }
+  if (!roleCanDecide(actor.role, approval.requiredRole)) {
+    throw new TokMetricCommandError(
+      403,
+      "APPROVER_ROLE_REQUIRED",
+      "Required approver role is missing",
+    );
+  }
+  if (approval.expiresAt && new Date(approval.expiresAt).getTime() <= Date.now()) {
+    await db.from("tokmetric_approval_requests")
+      .update({ state: "EXPIRED", updatedAt: new Date().toISOString() })
+      .eq("id", approvalId);
+    throw new TokMetricCommandError(
+      409,
+      "APPROVAL_EXPIRED",
+      "Approval request has expired",
+    );
+  }
+
+  const [{ data: content, error: contentError }, { data: version, error: versionError }] =
+    await Promise.all([
+      db.from("tokmetric_contents")
+        .select("id,currentVersionId,state")
+        .eq("workspaceId", workspaceId)
+        .eq("id", approval.contentId)
+        .maybeSingle(),
+      db.from("tokmetric_content_versions")
+        .select("id,objectHash")
+        .eq("id", approval.contentVersionId)
+        .maybeSingle(),
+    ]);
+  if (contentError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", contentError.message);
+  }
+  if (versionError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", versionError.message);
+  }
+  if (!content || content.currentVersionId !== approval.contentVersionId) {
+    await db.from("tokmetric_approval_requests")
+      .update({ state: "REVOKED", updatedAt: new Date().toISOString() })
+      .eq("id", approvalId);
+    throw new TokMetricCommandError(
+      409,
+      "APPROVAL_VERSION_MISMATCH",
+      "Approval no longer matches the current content version",
+    );
+  }
+  if (!version || version.objectHash !== approval.objectHash) {
+    await db.from("tokmetric_approval_requests")
+      .update({ state: "REVOKED", updatedAt: new Date().toISOString() })
+      .eq("id", approvalId);
+    throw new TokMetricCommandError(
+      409,
+      "APPROVAL_HASH_MISMATCH",
+      "Approval object hash no longer matches",
+    );
+  }
+
+  const nextState = decision === "approve"
+    ? "APPROVED"
+    : decision === "reject"
+      ? "REJECTED"
+      : "REVOKED";
+  const now = new Date().toISOString();
+  const decisionInsert = await db.from("tokmetric_approval_decisions").insert({
+    id: recordId("decision"),
+    approvalRequestId: approvalId,
+    actorId: actor.id,
+    decision,
+    objectHash: approval.objectHash,
+    reason,
+    createdAt: now,
+  });
+  if (decisionInsert.error) {
+    throw new TokMetricCommandError(
+      503,
+      "APPROVAL_DECISION_FAILED",
+      decisionInsert.error.message,
+    );
+  }
+  const approvalUpdate = await db.from("tokmetric_approval_requests")
+    .update({ state: nextState, updatedAt: now })
+    .eq("id", approvalId)
+    .eq("state", "APPROVAL_REQUIRED");
+  if (approvalUpdate.error) {
+    throw new TokMetricCommandError(
+      503,
+      "APPROVAL_UPDATE_FAILED",
+      approvalUpdate.error.message,
+    );
+  }
+  const contentUpdate = await db.from("tokmetric_contents")
+    .update({ state: nextState, updatedAt: now })
+    .eq("id", approval.contentId)
+    .eq("currentVersionId", approval.contentVersionId);
+  if (contentUpdate.error) {
+    throw new TokMetricCommandError(
+      503,
+      "CONTENT_UPDATE_FAILED",
+      contentUpdate.error.message,
+    );
+  }
+
+  await Promise.all([
+    audit(
+      db,
+      workspaceId,
+      actor.id,
+      `tokmetric.approval.${decision}`,
+      "approval",
+      approvalId,
+      "success",
+      {
+        contentId: approval.contentId,
+        contentVersionId: approval.contentVersionId,
+        nextState,
+      },
+    ),
+    domainEvent(
+      db,
+      workspaceId,
+      "approval",
+      approvalId,
+      `APPROVAL_${decision.toUpperCase()}`,
+      {
+        contentId: approval.contentId,
+        contentVersionId: approval.contentVersionId,
+      },
+    ),
+  ]);
+  return { ok: true, approvalId, state: nextState, externalActionTaken: false };
+}
+
+async function publishPreflight(
+  db: DatabaseClient,
+  actor: TokMetricOperator,
+  workspaceId: string,
+  body: Record<string, unknown>,
+) {
+  const contentId = requiredText(body.contentId, "contentId", 3, 200);
+  const connectorId =
+    typeof body.connectorId === "string" ? body.connectorId.trim() : "";
+  const workspace = await requireWorkspace(db, workspaceId);
+  const { data: content, error: contentError } = await db
+    .from("tokmetric_contents")
+    .select("id,title,state,currentVersionId")
+    .eq("workspaceId", workspaceId)
+    .eq("id", contentId)
+    .maybeSingle();
+  if (contentError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", contentError.message);
+  }
+  if (!content?.currentVersionId) {
+    throw new TokMetricCommandError(
+      404,
+      "CONTENT_NOT_FOUND",
+      "Content or active version not found",
+    );
+  }
+  const { data: version, error: versionError } = await db
+    .from("tokmetric_content_versions")
+    .select("id,objectHash")
+    .eq("id", content.currentVersionId)
+    .maybeSingle();
+  if (versionError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", versionError.message);
+  }
+  if (!version) {
+    throw new TokMetricCommandError(
+      409,
+      "CONTENT_VERSION_MISSING",
+      "Content version not found",
+    );
+  }
+
+  let connectorQuery = db.from("tokmetric_connectors")
+    .select("id,provider,state,grantedScopes,disabledAt")
+    .eq("workspaceId", workspaceId)
+    .eq("provider", "TIKTOK_CONTENT_POSTING_API");
+  if (connectorId) connectorQuery = connectorQuery.eq("id", connectorId);
+  const { data: connector, error: connectorError } = await connectorQuery
+    .order("updatedAt", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (connectorError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", connectorError.message);
+  }
+  const { data: approval, error: approvalError } = await db
+    .from("tokmetric_approval_requests")
+    .select("id,state,objectHash,expiresAt")
+    .eq("workspaceId", workspaceId)
+    .eq("contentId", contentId)
+    .eq("contentVersionId", version.id)
+    .eq("objectHash", version.objectHash)
+    .eq("state", "APPROVED")
+    .order("updatedAt", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (approvalError) {
+    throw new TokMetricCommandError(503, "DATABASE_ERROR", approvalError.message);
+  }
+
+  const scopes = new Set((connector?.grantedScopes as string[] | undefined) ?? []);
+  const blockers: string[] = [];
+  if (workspace.globalEmergencyLock) blockers.push("GLOBAL_EMERGENCY_LOCK");
+  if (workspace.connectorDisabled) blockers.push("CONNECTORS_DISABLED");
+  if (workspace.publishingDisabled) blockers.push("WORKSPACE_PUBLISHING_DISABLED");
+  if (content.state !== "APPROVED") blockers.push("CONTENT_NOT_APPROVED");
+  if (!approval) blockers.push("EXACT_VERSION_APPROVAL_MISSING");
+  if (approval?.expiresAt && new Date(approval.expiresAt).getTime() <= Date.now()) {
+    blockers.push("APPROVAL_EXPIRED");
+  }
+  if (!connector) blockers.push("CONTENT_POSTING_CONNECTOR_MISSING");
+  if (connector && connector.state !== "CONNECTED") {
+    blockers.push("CONTENT_POSTING_CONNECTOR_NOT_CONNECTED");
+  }
+  if (connector?.disabledAt) blockers.push("CONTENT_POSTING_CONNECTOR_DISABLED");
+  if (
+    connector &&
+    !scopes.has("video.publish") &&
+    !scopes.has("video.upload")
+  ) {
+    blockers.push("CONTENT_POSTING_SCOPE_NOT_AUTHORIZED");
+  }
+  if (Deno.env.get("TOKMETRIC_LIVE_PUBLISHING_ENABLED") !== "true") {
+    blockers.push("LIVE_PUBLISHING_GATE_DISABLED");
+  }
+
+  await audit(
+    db,
+    workspaceId,
+    actor.id,
+    "tokmetric.publish.preflight",
+    "content",
+    contentId,
+    blockers.length === 0 ? "pass" : "blocked",
+    {
+      connectorId: connector?.id ?? null,
+      contentVersionId: version.id,
+      blockers,
+    },
+  );
+  return {
+    ok: true,
+    preflight: {
+      ready: blockers.length === 0,
+      blockers,
+      content: { id: content.id, title: content.title, state: content.state },
+      contentVersionId: version.id,
+      connector: connector ?? null,
+      approval: approval ?? null,
+      livePublishingEnabled:
+        Deno.env.get("TOKMETRIC_LIVE_PUBLISHING_ENABLED") === "true",
+    },
+    externalActionTaken: false,
+  };
+}
+
+export async function dispatchTokMetricCommand(input: {
+  db: DatabaseClient;
+  actor: TokMetricOperator;
+  workspaceId: string;
+  body: Record<string, unknown>;
+}) {
+  const operation = requiredText(input.body.operation, "operation", 3, 100);
+  if (operation === "snapshot") {
+    return snapshot(input.db, input.actor, input.workspaceId);
+  }
+  if (operation === "create_draft") {
+    return createDraft(input.db, input.actor, input.workspaceId, input.body);
+  }
+  if (operation === "create_version") {
+    return createVersion(input.db, input.actor, input.workspaceId, input.body);
+  }
+  if (operation === "run_review") {
+    return runReview(input.db, input.actor, input.workspaceId, input.body);
+  }
+  if (operation === "request_approval") {
+    return requestApproval(input.db, input.actor, input.workspaceId, input.body);
+  }
+  if (operation === "decide_approval") {
+    return decideApproval(input.db, input.actor, input.workspaceId, input.body);
+  }
+  if (operation === "publish_preflight") {
+    return publishPreflight(input.db, input.actor, input.workspaceId, input.body);
+  }
+  throw new TokMetricCommandError(
+    400,
+    "INVALID_OPERATION",
+    "Unknown TokMetric operation",
+  );
+}