@@ -2598,6 +2598,7 @@
 # Apps.yaml validation schema
 APPS_SCHEMA = {
     "control_handoff": {"type": "dict"},
+    "saas_config_version": {"type": "integer", "min": 1},
     "currency_symbols": {"type": "string|string_list"},
     "db_enable": {"type": "boolean"},
     "db_days": {"type": "integer"},
 
@@ -276,9 +276,14 @@ def _binding(self, data):
 
     def attach(self):
         """Claim the pre-enrolled epoch before any component can be constructed."""
+        loaded_version = self.base.args.get("saas_config_version")
+        if type(loaded_version) is not int or not 1 <= loaded_version <= 2147483647:
+            raise ControlAttachFailed("Loaded controller configuration revision unavailable")
         started, data, status = self._request("attach")
         if status != 200 or not self._binding(data) or data.get("state") != "active":
             raise ControlAttachFailed("Controller service attach unavailable")
+        if data["config_version"] != loaded_version:
+            raise ControlAttachFailed("Loaded controller configuration revision changed")
         lease = data.get("lease_for_s")
         if type(lease) is not int or not 1 <= lease <= 90 or started + lease <= self._clock():
             raise ControlAttachFailed("Controller service attach lease invalid")
 
@@ -416,7 +416,7 @@ class ControlServiceTests(unittest.TestCase):
     def setUp(self):
         """Use a deterministic monotonic clock and synthetic service credentials."""
         self.now = 100.0
-        self.base = SimpleNamespace(args={"control_handoff": {"enabled": True}, "user_id": self.instance, "ge_cloud_direct": True, "ge_cloud_key": "synthetic-inverter-key"}, log=lambda *_: None)
+        self.base = SimpleNamespace(args={"control_handoff": {"enabled": True}, "saas_config_version": 7, "user_id": self.instance, "ge_cloud_direct": True, "ge_cloud_key": "synthetic-inverter-key"}, log=lambda *_: None)
         self.service = ControlHandoffService(self.base, self.instance, self.boot, "https://service.invalid", "synthetic-service-key", clock=lambda: self.now)
 
     def active(self, **changes):
@@ -437,6 +437,35 @@ def closing(self):
         data.pop("lease_for_s")
         return data
 
+    def test_loaded_revision_is_required_before_claiming_a_boot(self):
+        """An absent or malformed emitted revision cannot make a service request."""
+        for value in (None, True, False, 0, -1, "7", 7.0, 2147483648):
+            self.base.args["saas_config_version"] = value
+            with patch("control_handoff.requests.post") as post, self.assertRaises(ControlAttachFailed):
+                self.service.attach()
+            post.assert_not_called()
+            self.assertIsNone(self.service.gate)
+
+    def test_stale_loaded_revision_cannot_start_components(self):
+        """A server epoch at another revision leaves startup's sentinel sealed."""
+        from datetime import datetime, timezone
+        import predbat as predbat_module
+
+        self.base.update_time = lambda **_kwargs: None
+        self.base.now_utc_real = datetime.now(timezone.utc)
+        self.base.reset = lambda: None
+        self.base.record_status = lambda *_args, **_kwargs: None
+        environment = {"SUPABASE_URL": "https://service.invalid", "SUPABASE_KEY": "synthetic-service-key"}
+        with patch.dict("os.environ", environment), patch("control_handoff.uuid.uuid4", return_value=self.boot), patch("control_handoff.requests.post", return_value=ServiceResponse(self.active(config_version=8))), patch(
+            "control_handoff.ControlHandoffService.start"
+        ) as worker, patch.object(predbat_module, "Components") as components, self.assertRaises(ControlAttachFailed):
+            predbat_module.PredBat.initialize(self.base)
+        worker.assert_not_called()
+        components.assert_not_called()
+        self.assertTrue(self.base.control_write_gate.snapshot()["closed"])
+        with self.assertRaises(ControlWriteBlocked):
+            self.base.control_write_gate.admit("givenergy")
+
     def test_attach_uses_service_credentials_and_exact_boot(self):
         """Bind only the service-issued epoch and never follow credential redirects."""
         with patch("control_handoff.requests.post", return_value=ServiceResponse(self.active())) as post:
 
@@ -75,11 +75,19 @@ current engine lease and reservation; expired reports cannot be accepted.
 Shutdown and startup exceptions seal before stopping components, without a
 success report in cleanup.
 
-Current engine arguments do not expose their loaded configuration revision.
-The worker pins the service-issued revision and fences all supported provider
-transports, but this is not evidence that local arguments applied that revision.
-The image wrapper must bind emitted configuration and exact inverter identity
-before any target readiness or write release is authorised.
+Enrolled engine arguments must include `saas_config_version`, emitted from the
+SaaS response revision by the operator or legacy image wrapper. Before claiming
+a boot, startup rejects an absent or malformed revision. After attaching, it
+requires that loaded revision to equal the service-issued revision before
+starting the worker or constructing components. Stale configuration therefore
+leaves startup's admission sentinel closed. Ordinary, unenrolled startup does
+not require this field.
+
+This comparison binds the loaded revision number, not a configuration content
+hash or the physical inverter identity. Exact inverter identity and target
+readiness still require independent evidence before any write release is
+authorised. The paired operator and image-wrapper changes must be deployed
+before explicit enrollment; this feature remains disabled by default.
 
 Enrollment requires the selected supported writer to be configured. Every actual
 `Components.initialize`, including restarts, rejects eligible unsupported inverter