diff --git a/application/single_app/config.py b/application/single_app/config.py
index a21fa6be3..7378b2436 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -101,7 +101,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.277"
+VERSION = "0.261.278"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform
diff --git a/application/single_app/functions_activity_logging.py b/application/single_app/functions_activity_logging.py
index 173ef3daa..636b4baf6 100644
--- a/application/single_app/functions_activity_logging.py
+++ b/application/single_app/functions_activity_logging.py
@@ -16,14 +16,21 @@
 from config import cosmos_activity_logs_container
 
 
+def build_activity_log_id(activity_type, user_id, idempotency_key):
+    """Build the stable activity record ID used for idempotent writes."""
+    if not isinstance(idempotency_key, str) or not idempotency_key or len(idempotency_key) > 512:
+        raise ValueError("The activity idempotency key is invalid.")
+    return str(uuid.uuid5(
+        uuid.NAMESPACE_URL,
+        f"simplechat:{activity_type}:{user_id}:{idempotency_key}",
+    ))
+
+
 def _create_activity_record(record, idempotency_key=None):
     if idempotency_key is not None:
-        if not isinstance(idempotency_key, str) or not idempotency_key or len(idempotency_key) > 512:
-            raise ValueError("The activity idempotency key is invalid.")
-        record["id"] = str(uuid.uuid5(
-            uuid.NAMESPACE_URL,
-            f"simplechat:{record['activity_type']}:{record['user_id']}:{idempotency_key}",
-        ))
+        record["id"] = build_activity_log_id(
+            record['activity_type'], record['user_id'], idempotency_key
+        )
     try:
         cosmos_activity_logs_container.create_item(body=record)
     except CosmosResourceExistsError:
@@ -33,6 +40,37 @@ def _create_activity_record(record, idempotency_key=None):
     return record
 
 
+def has_activity_log_for_resource(user_id, activity_type, resource_id, workspace_type=None):
+    """Check for an existing creation record within its user partition."""
+    if not user_id or not resource_id:
+        return False
+
+    if activity_type == 'conversation_creation':
+        resource_path = 'c.conversation.conversation_id'
+    elif activity_type == 'document_creation':
+        resource_path = 'c.document.document_id'
+    else:
+        raise ValueError("Unsupported activity type for resource lookup.")
+
+    query = (
+        "SELECT TOP 1 VALUE c.id FROM c "
+        f"WHERE c.activity_type = @activity_type AND {resource_path} = @resource_id"
+    )
+    parameters = [
+        {'name': '@activity_type', 'value': activity_type},
+        {'name': '@resource_id', 'value': resource_id},
+    ]
+    if workspace_type:
+        query += " AND c.workspace_type = @workspace_type"
+        parameters.append({'name': '@workspace_type', 'value': workspace_type})
+    matches = cosmos_activity_logs_container.query_items(
+        query=query,
+        parameters=parameters,
+        partition_key=user_id,
+    )
+    return next(iter(matches), None) is not None
+
+
 def coerce_activity_log_user_id(user_id: Any) -> str:
     """Extract a stable string user id from a scalar or session-style identity payload."""
     if user_id is None:
diff --git a/application/single_app/functions_authentication.py b/application/single_app/functions_authentication.py
index 8a31cb179..8d65a9ee2 100644
--- a/application/single_app/functions_authentication.py
+++ b/application/single_app/functions_authentication.py
@@ -959,6 +959,47 @@ def decorated_function(*args, **kwargs):
             return "Forbidden", 403
     return decorated_function
 
+def get_control_center_capabilities(user=None, settings=None):
+    """Return the Control Center permissions implied by the user's roles and settings."""
+    user = session.get('user', {}) if user is None else user
+    settings = get_settings() if settings is None else settings
+    require_admin_role = settings.get("require_member_of_control_center_admin", False)
+    require_dashboard_reader_role = settings.get(
+        "require_member_of_control_center_dashboard_reader", False
+    )
+
+    has_control_center_admin_role = (
+        'roles' in user and 'ControlCenterAdmin' in user['roles']
+        if isinstance(user, dict)
+        else False
+    )
+    has_dashboard_reader_role = (
+        'roles' in user and 'ControlCenterDashboardReader' in user['roles']
+        if isinstance(user, dict)
+        else False
+    )
+    has_regular_admin_role = (
+        'roles' in user and 'Admin' in user['roles']
+        if isinstance(user, dict)
+        else False
+    )
+
+    has_full_access = (
+        has_control_center_admin_role if require_admin_role else has_regular_admin_role
+    )
+    can_view_dashboard = has_full_access or (
+        require_dashboard_reader_role and has_dashboard_reader_role
+    )
+    return {
+        'can_view_dashboard': bool(can_view_dashboard),
+        'can_manage_users': bool(has_full_access),
+        'can_manage_groups': bool(has_full_access),
+        'can_manage_workspaces': bool(has_full_access),
+        'can_view_activity_logs': bool(has_full_access),
+        'can_run_maintenance': bool(has_full_access),
+    }
+
+
 def control_center_required(access_level='admin'):
     """
     Unified Control Center access control decorator.
@@ -984,48 +1025,34 @@ def decorated_function(*args, **kwargs):
             user = session.get('user', {})
             settings = get_settings()
             require_member_of_control_center_admin = settings.get("require_member_of_control_center_admin", False)
-            require_member_of_control_center_dashboard_reader = settings.get("require_member_of_control_center_dashboard_reader", False)
-
-            has_control_center_admin_role = 'roles' in user and 'ControlCenterAdmin' in user['roles']
-            has_dashboard_reader_role = 'roles' in user and 'ControlCenterDashboardReader' in user['roles']
-            has_regular_admin_role = 'roles' in user and 'Admin' in user['roles']
-            
-            # Check if ControlCenterAdmin role requirement is enforced
-            if require_member_of_control_center_admin:
-                # ControlCenterAdmin role is REQUIRED for access
-                # Only ControlCenterAdmin role grants full access
-                if has_control_center_admin_role:
-                    return f(*args, **kwargs)
-                
-                # For dashboard access, check if DashboardReader role grants access
-                if access_level == 'dashboard':
-                    if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role:
-                        return f(*args, **kwargs)
-                
-                # User doesn't have ControlCenterAdmin role, deny access
-                # Note: Regular Admin role does NOT grant access when this setting is enabled
-                is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/')
-                if is_api_request:
-                    return jsonify({"error": "Forbidden", "message": "Insufficient permissions (ControlCenterAdmin role required)"}), 403
-                else:
-                    return "Forbidden: ControlCenterAdmin role required", 403
-            
-            # ControlCenterAdmin requirement is NOT enforced (default behavior)
-            # Only regular Admin role grants access - ControlCenterAdmin role is IGNORED
-            if has_regular_admin_role:
+            capabilities = get_control_center_capabilities(user, settings)
+            permitted = (
+                capabilities['can_view_dashboard']
+                if access_level == 'dashboard'
+                else capabilities['can_manage_users']
+            )
+            if permitted:
                 return f(*args, **kwargs)
             
-            # For dashboard-only access, check if DashboardReader role is enabled and user has it
-            if access_level == 'dashboard':
-                if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role:
-                    return f(*args, **kwargs)
-            
             # User is not an admin and doesn't have special roles - deny access
             is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/')
             if is_api_request:
-                return jsonify({"error": "Forbidden", "message": "Insufficient permissions (Admin role required)"}), 403
+                required_role = (
+                    "ControlCenterAdmin"
+                    if require_member_of_control_center_admin
+                    else "Admin"
+                )
+                return jsonify({
+                    "error": "Forbidden",
+                    "message": f"Insufficient permissions ({required_role} role required)",
+                }), 403
             else:
-                return "Forbidden: Admin role required", 403
+                required_role = (
+                    "ControlCenterAdmin"
+                    if require_member_of_control_center_admin
+                    else "Admin"
+                )
+                return f"Forbidden: {required_role} role required", 403
         return decorated_function
     return decorator
 
diff --git a/application/single_app/route_backend_control_center.py b/application/single_app/route_backend_control_center.py
index 0b055148c..ebba74e75 100644
--- a/application/single_app/route_backend_control_center.py
+++ b/application/single_app/route_backend_control_center.py
@@ -6208,13 +6208,18 @@ def api_migrate_to_activity_logs():
             results = {
                 'conversations_migrated': 0,
                 'conversations_failed': 0,
+                'conversations_skipped_existing': 0,
                 'personal_documents_migrated': 0,
                 'personal_documents_failed': 0,
+                'personal_documents_skipped_existing': 0,
                 'group_documents_migrated': 0,
                 'group_documents_failed': 0,
+                'group_documents_skipped_existing': 0,
                 'public_documents_migrated': 0,
                 'public_documents_failed': 0,
+                'public_documents_skipped_existing': 0,
                 'total_migrated': 0,
+                'total_skipped_existing': 0,
                 'total_failed': 0,
                 'errors': []
             }
@@ -6236,9 +6241,21 @@ def api_migrate_to_activity_logs():
                 
                 for conv in conversations:
                     try:
+                        if has_activity_log_for_resource(
+                            conv.get('user_id'), 'conversation_creation', conv.get('id')
+                        ):
+                            conv['added_to_activity_log'] = True
+                            cosmos_conversations_container.upsert_item(conv)
+                            results['conversations_skipped_existing'] += 1
+                            continue
+
                         # Create activity log directly to preserve original timestamp
                         activity_log = {
-                            'id': str(uuid.uuid4()),
+                            'id': build_activity_log_id(
+                                'conversation_creation',
+                                conv.get('user_id'),
+                                f"backfill:{conv.get('id')}",
+                            ),
                             'activity_type': 'conversation_creation',
                             'user_id': conv.get('user_id'),
                             'timestamp': conv.get('created_at') or conv.get('last_updated') or datetime.utcnow().isoformat(),
@@ -6288,9 +6305,21 @@ def api_migrate_to_activity_logs():
                 
                 for doc in personal_docs:
                     try:
+                        if has_activity_log_for_resource(
+                            doc.get('user_id'), 'document_creation', doc.get('id'), 'personal'
+                        ):
+                            doc['added_to_activity_log'] = True
+                            cosmos_user_documents_container.upsert_item(doc)
+                            results['personal_documents_skipped_existing'] += 1
+                            continue
+
                         # Create activity log directly to preserve original timestamp
                         activity_log = {
-                            'id': str(uuid.uuid4()),
+                            'id': build_activity_log_id(
+                                'document_creation',
+                                doc.get('user_id'),
+                                f"backfill:personal:{doc.get('id')}",
+                            ),
                             'user_id': doc.get('user_id'),
                             'activity_type': 'document_creation',
                             'workspace_type': 'personal',
@@ -6354,9 +6383,21 @@ def api_migrate_to_activity_logs():
                 
                 for doc in group_docs:
                     try:
+                        if has_activity_log_for_resource(
+                            doc.get('user_id'), 'document_creation', doc.get('id'), 'group'
+                        ):
+                            doc['added_to_activity_log'] = True
+                            cosmos_group_documents_container.upsert_item(doc)
+                            results['group_documents_skipped_existing'] += 1
+                            continue
+
                         # Create activity log directly to preserve original timestamp
                         activity_log = {
-                            'id': str(uuid.uuid4()),
+                            'id': build_activity_log_id(
+                                'document_creation',
+                                doc.get('user_id'),
+                                f"backfill:group:{doc.get('id')}",
+                            ),
                             'user_id': doc.get('user_id'),
                             'activity_type': 'document_creation',
                             'workspace_type': 'group',
@@ -6422,9 +6463,21 @@ def api_migrate_to_activity_logs():
                 
                 for doc in public_docs:
                     try:
+                        if has_activity_log_for_resource(
+                            doc.get('user_id'), 'document_creation', doc.get('id'), 'public'
+                        ):
+                            doc['added_to_activity_log'] = True
+                            cosmos_public_documents_container.upsert_item(doc)
+                            results['public_documents_skipped_existing'] += 1
+                            continue
+
                         # Create activity log directly to preserve original timestamp
                         activity_log = {
-                            'id': str(uuid.uuid4()),
+                            'id': build_activity_log_id(
+                                'document_creation',
+                                doc.get('user_id'),
+                                f"backfill:public:{doc.get('id')}",
+                            ),
                             'user_id': doc.get('user_id'),
                             'activity_type': 'document_creation',
                             'workspace_type': 'public',
@@ -6482,7 +6535,14 @@ def api_migrate_to_activity_logs():
                 results['group_documents_migrated'] +
                 results['public_documents_migrated']
             )
-            
+
+            results['total_skipped_existing'] = (
+                results['conversations_skipped_existing'] +
+                results['personal_documents_skipped_existing'] +
+                results['group_documents_skipped_existing'] +
+                results['public_documents_skipped_existing']
+            )
+
             results['total_failed'] = (
                 results['conversations_failed'] +
                 results['personal_documents_failed'] +
diff --git a/application/single_app/route_backend_users.py b/application/single_app/route_backend_users.py
index edd089156..00a3657c6 100644
--- a/application/single_app/route_backend_users.py
+++ b/application/single_app/route_backend_users.py
@@ -560,6 +560,8 @@ def user_settings():
                     # Whether the V2 Admin Settings categories rail is collapsed to icons.
                     # Separate from the shell and workspace rails so each keeps its own state.
                     'v2AdminRailCollapsed',
+                    # Whether the V2 Control Center section rail is collapsed to icons.
+                    'v2ControlCenterRailCollapsed',
                     # V2 document explorer: how the workspace documents list is presented
                     # (view mode, visible columns, page size, details pane) and the saved
                     # filter combinations pinned in its navigation rail.
diff --git a/application/single_app/route_backend_v2.py b/application/single_app/route_backend_v2.py
index 306ab2d5c..b6468ae01 100644
--- a/application/single_app/route_backend_v2.py
+++ b/application/single_app/route_backend_v2.py
@@ -78,6 +78,7 @@
 )
 from functions_authentication import (
     admin_required,
+    get_control_center_capabilities,
     get_current_user_id,
     get_current_user_info,
     login_required,
@@ -872,6 +873,7 @@ def v2_bootstrap():
                 "navigation": _build_navigation(settings, current_user_roles),
                 "features": _build_feature_flags(public_settings, per_user_overrides),
                 "capabilities": _build_capabilities(settings),
+                "control_center": get_control_center_capabilities(session_user, settings),
                 "orchestration": _build_orchestration(settings, public_settings),
                 "catalogs": {
                     "models": models,
diff --git a/application/single_app/static/js/control-center.js b/application/single_app/static/js/control-center.js
index 99c7a5c06..2c11536c3 100644
--- a/application/single_app/static/js/control-center.js
+++ b/application/single_app/static/js/control-center.js
@@ -4943,172 +4943,6 @@ function showAlert(message, type = 'info') {
     }, 5000);
 }
 
-// Activity Log Migration Functions
-async function checkMigrationStatus() {
-    // Only admins can see migration status
-    if (window.hasControlCenterAdmin !== true) {
-        return;
-    }
-    
-    try {
-        const response = await fetch('/api/admin/control-center/migrate/status');
-        if (!response.ok) {
-            throw new Error('Failed to fetch migration status');
-        }
-        
-        const data = await response.json();
-        
-        if (data.migration_needed) {
-            // Update banner with counts
-            document.getElementById('migrationConversationCount').textContent = data.conversations_without_logs.toLocaleString();
-            document.getElementById('migrationDocumentCount').textContent = data.total_documents_without_logs.toLocaleString();
-            
-            // Show the banner
-            const banner = document.getElementById('migrationBanner');
-            if (banner) {
-                banner.style.display = 'block';
-            }
-        } else {
-            // Hide banner if no migration needed
-            const banner = document.getElementById('migrationBanner');
-            if (banner) {
-                banner.style.display = 'none';
-            }
-        }
-        
-        return data;
-    } catch (error) {
-        console.error('Error checking migration status:', error);
-        return null;
-    }
-}
-
-function showMigrationProgress() {
-    const progressDiv = document.getElementById('migrationProgress');
-    const migrateBtn = document.getElementById('migrateBannerBtn');
-    
-    if (progressDiv) {
-        progressDiv.style.display = 'block';
-    }
-    
-    if (migrateBtn) {
-        migrateBtn.disabled = true;
-        migrateBtn.innerHTML = '<span class="spinner-border spinner-border-sm me-1"></span> Migrating...';
-    }
-}
-
-function hideMigrationProgress() {
-    const progressDiv = document.getElementById('migrationProgress');
-    const migrateBtn = document.getElementById('migrateBannerBtn');
-    
-    if (progressDiv) {
-        progressDiv.style.display = 'none';
-    }
-    
-    if (migrateBtn) {
-        migrateBtn.disabled = false;
-        migrateBtn.innerHTML = '<i class="bi bi-arrow-repeat me-1"></i> Migrate Now';
-    }
-}
-
-function updateMigrationProgress(percent, statusText) {
-    const progressBar = document.getElementById('migrationProgressBar');
-    const progressText = document.getElementById('migrationProgressText');
-    const statusTextEl = document.getElementById('migrationStatusText');
-    
-    if (progressBar) {
-        progressBar.style.width = percent + '%';
-        progressBar.setAttribute('aria-valuenow', percent);
-    }
-    
-    if (progressText) {
-        progressText.textContent = percent + '%';
-    }
-    
-    if (statusTextEl && statusText) {
-        statusTextEl.textContent = statusText;
-    }
-}
-
-function hideMigrationBanner() {
-    const banner = document.getElementById('migrationBanner');
-    if (banner) {
-        banner.style.display = 'none';
-    }
-}
-
-async function performMigration() {
-    // Show confirmation modal
-    const modal = new bootstrap.Modal(document.getElementById('migrationConfirmModal'));
-    modal.show();
-}
-
-async function executeMigration() {
-    // Close the confirmation modal
-    const modal = bootstrap.Modal.getInstance(document.getElementById('migrationConfirmModal'));
-    if (modal) {
-        modal.hide();
-    }
-    
-    try {
-        showMigrationProgress();
-        updateMigrationProgress(10, 'Starting migration...');
-        
-        const response = await fetch('/api/admin/control-center/migrate/all', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json'
-            }
-        });
-        
-        updateMigrationProgress(50, 'Processing records...');
-        
-        if (!response.ok) {
-            throw new Error('Migration request failed');
-        }
-        
-        const result = await response.json();
-        
-        updateMigrationProgress(90, 'Finalizing...');
-        
-        // Show results
-        setTimeout(() => {
-            updateMigrationProgress(100, 'Migration completed!');
-            
-            setTimeout(() => {
-                hideMigrationProgress();
-                hideMigrationBanner();
-                
-                // Show detailed results
-                const totalMigrated = result.total_migrated || 0;
-                const totalFailed = result.total_failed || 0;
-                
-                let message = `Migration completed! Conversations: ${result.conversations_migrated || 0}, Personal docs: ${result.personal_documents_migrated || 0}, Group docs: ${result.group_documents_migrated || 0}, Public docs: ${result.public_documents_migrated || 0}. Total: ${totalMigrated} records migrated`;
-                
-                if (totalFailed > 0) {
-                    message += `. Warning: ${totalFailed} records failed (check logs)`;
-                }
-                
-                showToast(message, 'success');
-                
-                // Refresh activity trends to show new data
-                if (window.controlCenter) {
-                    window.controlCenter.loadActivityTrends();
-                }
-            }, 1500);
-        }, 500);
-        
-    } catch (error) {
-        console.error('Migration error:', error);
-        hideMigrationProgress();
-        showToast(`Migration failed: ${error.message}. Check console and server logs for details.`, 'danger');
-    }
-}
-
-// Make migration functions globally accessible
-window.checkMigrationStatus = checkMigrationStatus;
-window.performMigration = performMigration;
-
 // Make refresh function globally accessible for debugging
 window.refreshControlCenterData = refreshControlCenterData;
 window.loadRefreshStatus = loadRefreshStatus;
@@ -5130,12 +4964,6 @@ document.addEventListener('DOMContentLoaded', function() {
     // Export GroupTableSorter to window for global access
     window.GroupTableSorter = GroupTableSorter;
     
-    // Wire up migration confirmation button
-    const confirmMigrationBtn = document.getElementById('confirmMigrationBtn');
-    if (confirmMigrationBtn) {
-        confirmMigrationBtn.addEventListener('click', executeMigration);
-    }
-    
     // Debug: Log element availability
     console.log('Control Center Elements Check on DOM Ready:');
     window.debugControlCenterElements();
@@ -5148,8 +4976,6 @@ document.addEventListener('DOMContentLoaded', function() {
         setTimeout(() => {
             loadRefreshStatus();
             
-            // Check migration status
-            checkMigrationStatus();
         }, 100);
     }
 });
\ No newline at end of file
diff --git a/application/single_app/templates/control_center.html b/application/single_app/templates/control_center.html
index 294e3e6a7..95959d0f2 100644
--- a/application/single_app/templates/control_center.html
+++ b/application/single_app/templates/control_center.html
@@ -666,48 +666,6 @@ <h2>Control Center</h2>
 
     {% include "_semantic_search_health_warning.html" %}
     
-    <!-- Activity Log Migration Banner -->
-    <div id="migrationBanner" class="alert alert-warning alert-dismissible fade show" role="alert" style="display: none;">
-        <div class="d-flex align-items-start">
-            <div class="flex-grow-1">
-                <h5 class="alert-heading">
-                    <i class="bi bi-database-exclamation me-2"></i>
-                    Activity Log Migration Required
-                </h5>
-                <p class="mb-2" id="migrationMessage">
-                    We found <strong id="migrationConversationCount">0</strong> conversations and 
-                    <strong id="migrationDocumentCount">0</strong> documents that need to be added to activity logs 
-                    for improved reporting and performance.
-                </p>
-                <p class="mb-3">
-                    <small class="text-muted">
-                        <i class="bi bi-info-circle me-1"></i>
-                        <strong>Note:</strong> This migration may take a while for large datasets and could temporarily affect system performance. 
-                        We recommend running this during off-peak hours.
-                    </small>
-                </p>
-                <div class="d-flex align-items-center gap-3">
-                    <button type="button" class="btn btn-warning" id="migrateBannerBtn" onclick="performMigration()">
-                        <i class="bi bi-arrow-repeat me-1"></i>
-                        Migrate Now
-                    </button>
-                    <div id="migrationProgress" style="display: none;" class="flex-grow-1">
-                        <div class="d-flex align-items-center gap-2">
-                            <div class="progress flex-grow-1" style="height: 25px;">
-                                <div id="migrationProgressBar" class="progress-bar progress-bar-striped progress-bar-animated" 
-                                     role="progressbar" style="width: 0%;" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">
-                                    <span id="migrationProgressText">0%</span>
-                                </div>
-                            </div>
-                            <small class="text-muted" id="migrationStatusText">Initializing...</small>
-                        </div>
-                    </div>
-                </div>
-            </div>
-            <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
-        </div>
-    </div>
-    
     <!-- Hide tabs when left navigation is enabled -->
     {% set nav_layout = user_settings.get('settings', {}).get('navLayout') %}
     {% if not (nav_layout == 'sidebar' or (not nav_layout and app_settings.enable_left_nav_default)) %}
@@ -3116,34 +3074,6 @@ <h5 class="modal-title" id="rawLogModalTitle">Activity Log</h5>
         </div>
     </div>
 
-    <!-- Database Migration Confirmation Modal -->
-    <div class="modal fade" id="migrationConfirmModal" tabindex="-1" aria-hidden="true">
-        <div class="modal-dialog">
-            <div class="modal-content">
-                <div class="modal-header bg-warning text-dark">
-                    <h5 class="modal-title">
-                        <i class="bi bi-exclamation-triangle me-2"></i>Confirm Database Migration
-                    </h5>
-                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                </div>
-                <div class="modal-body">
-                    <p class="mb-3">
-                        This migration may take several minutes and could affect system performance during execution.
-                    </p>
-                    <div class="alert alert-warning mb-0">
-                        <i class="bi bi-clock me-2"></i>
-                        <strong>Recommendation:</strong> Run this migration during off-peak hours to minimize impact on users.
-                    </div>
-                </div>
-                <div class="modal-footer">
-                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                    <button type="button" class="btn btn-warning" id="confirmMigrationBtn">
-                        <i class="bi bi-arrow-repeat me-1"></i>Start Migration
-                    </button>
-                </div>
-            </div>
-        </div>
-    </div>
 </div>
 
 <!-- Control Center Scripts -->
diff --git a/application/v2_ui/src/App.tsx b/application/v2_ui/src/App.tsx
index af8e156e4..f3ec3847a 100644
--- a/application/v2_ui/src/App.tsx
+++ b/application/v2_ui/src/App.tsx
@@ -29,6 +29,7 @@ import { PublicWorkspacePage } from './pages/PublicWorkspacePage';
 import { PublicDirectoryPage } from './pages/PublicDirectoryPage';
 import { clearWorkspaceEditorDrafts } from './lib/workspaceEditorDrafts';
 import { ContentReviewPage } from './pages/ContentReviewPage';
+import { ControlCenterPage } from './pages/ControlCenterPage';
 
 // Dev only: the workflow alert lab. Its one dynamic import is created only when
 // import.meta.env.DEV, which a production build replaces with false, so production never
@@ -217,6 +218,8 @@ export function App() {
                 <Route path="/admin/actions" element={<AdminSettingsPage focusSection="actions-config" />} />
                 <Route path="/admin/agents/:resourceId" element={<AdminAgentEditorPage />} />
                 <Route path="/admin/actions/:resourceId" element={<AdminActionEditorPage />} />
+                <Route path="/control-center" element={<ControlCenterPage />} />
+                <Route path="/control-center/:section" element={<ControlCenterPage />} />
                 <Route path="/content-review" element={<ContentReviewPage />} />
                 <Route
                     path="/agents"
diff --git a/application/v2_ui/src/components/controlCenter/ControlCenterPrimitives.tsx b/application/v2_ui/src/components/controlCenter/ControlCenterPrimitives.tsx
new file mode 100644
index 000000000..c0bb2ae0c
--- /dev/null
+++ b/application/v2_ui/src/components/controlCenter/ControlCenterPrimitives.tsx
@@ -0,0 +1,296 @@
+// ControlCenterPrimitives.tsx
+// Reusable building blocks for Control Center management sections.
+
+import { useEffect, useMemo, useState, type ReactNode } from 'react';
+import { clsx } from 'clsx';
+import { Download, Search } from 'lucide-react';
+import { ConfirmDialog } from '../ui/ConfirmDialog';
+import { GlassButton, GlassPanel } from '../ui/primitives';
+
+export interface DataColumn<Row> {
+    id: string;
+    label: string;
+    render: (row: Row) => ReactNode;
+    sortable?: boolean;
+}
+
+export function useCrossPageSelection() {
+    const [selection, setSelection] = useState<{
+        allMatchingSelected: boolean;
+        includedIds: Set<string>;
+        excludedIds: Set<string>;
+    }>(() => ({ allMatchingSelected: false, includedIds: new Set(), excludedIds: new Set() }));
+    return {
+        selectedIds: selection.includedIds,
+        allMatchingSelected: selection.allMatchingSelected,
+        isSelected: (id: string) => selection.allMatchingSelected
+            ? !selection.excludedIds.has(id)
+            : selection.includedIds.has(id),
+        selectAllAcrossPages: () => setSelection({
+            allMatchingSelected: true, includedIds: new Set(), excludedIds: new Set(),
+        }),
+        setSelected: (id: string, selected: boolean) => setSelection((current) => {
+            const includedIds = new Set(current.includedIds);
+            const excludedIds = new Set(current.excludedIds);
+            if (current.allMatchingSelected) {
+                if (selected) excludedIds.delete(id);
+                else excludedIds.add(id);
+            } else if (selected) includedIds.add(id);
+            else includedIds.delete(id);
+            return { ...current, includedIds, excludedIds };
+        }),
+        setPageSelected: (ids: string[], selected: boolean) => setSelection((current) => {
+            const includedIds = new Set(current.includedIds);
+            const excludedIds = new Set(current.excludedIds);
+            ids.forEach((id) => {
+                if (current.allMatchingSelected) {
+                    if (selected) excludedIds.delete(id);
+                    else excludedIds.add(id);
+                } else if (selected) includedIds.add(id);
+                else includedIds.delete(id);
+            });
+            return { ...current, includedIds, excludedIds };
+        }),
+        clear: () => setSelection({
+            allMatchingSelected: false, includedIds: new Set(), excludedIds: new Set(),
+        }),
+    };
+}
+
+export function DataTable<Row extends { id: string }>({
+    rows,
+    columns,
+    total,
+    page,
+    pageSize,
+    sort,
+    sortDirection,
+    loading = false,
+    error,
+    emptyMessage = 'No records found.',
+    selectable = false,
+    selectedIds = new Set<string>(),
+    isRowSelected,
+    allMatchingSelected = false,
+    onSelect,
+    onSelectPage,
+    onSelectAllMatchingPages,
+    onSort,
+    onPageChange,
+}: {
+    rows: Row[];
+    columns: DataColumn<Row>[];
+    total: number;
+    page: number;
+    pageSize: number;
+    sort?: string;
+    sortDirection?: 'asc' | 'desc';
+    loading?: boolean;
+    error?: string | null;
+    emptyMessage?: string;
+    selectable?: boolean;
+    selectedIds?: ReadonlySet<string>;
+    isRowSelected?: (id: string) => boolean;
+    allMatchingSelected?: boolean;
+    onSelect?: (id: string, selected: boolean) => void;
+    onSelectPage?: (ids: string[], selected: boolean) => void;
+    onSelectAllMatchingPages?: () => void;
+    onSort?: (columnId: string, direction: 'asc' | 'desc') => void;
+    onPageChange?: (page: number) => void;
+}) {
+    const pageIds = rows.map((row) => row.id);
+    const rowIsSelected = (id: string) => isRowSelected?.(id) ?? selectedIds.has(id);
+    const allSelected = pageIds.length > 0 && pageIds.every(rowIsSelected);
+    const pageCount = Math.max(1, Math.ceil(total / pageSize));
+    return (
+        <div className="overflow-hidden rounded-2xl border border-edge bg-surface-1">
+            {selectable && total > rows.length && allSelected && !allMatchingSelected && onSelectAllMatchingPages ? (
+                <div className="border-b border-edge bg-accent-soft px-4 py-2 text-center text-sm text-text-2" role="status">
+                    All {rows.length} records on this page are selected.{' '}
+                    <button type="button" className="font-semibold text-accent underline"
+                        onClick={onSelectAllMatchingPages}>
+                        Select all {total.toLocaleString()} matching records
+                    </button>
+                </div>
+            ) : null}
+            <div className="overflow-x-auto">
+                <table className="w-full text-left text-sm">
+                    <thead className="bg-surface-2 text-xs text-text-3">
+                        <tr>
+                            {selectable ? (
+                                <th className="w-10 px-3 py-3">
+                                    <input aria-label="Select all rows on this page" type="checkbox"
+                                        checked={allSelected}
+                                        onChange={(event) => onSelectPage?.(pageIds, event.target.checked)} />
+                                </th>
+                            ) : null}
+                            {columns.map((column) => (
+                                <th key={column.id} scope="col" className="px-4 py-3 font-medium">
+                                    {column.sortable && onSort ? (
+                                        <button type="button" onClick={() => onSort(
+                                            column.id,
+                                            sort === column.id && sortDirection === 'asc' ? 'desc' : 'asc',
+                                        )} aria-label={`Sort by ${column.label}`}>
+                                            {column.label}
+                                            {sort === column.id ? (sortDirection === 'asc' ? ' ↑' : ' ↓') : ''}
+                                        </button>
+                                    ) : column.label}
+                                </th>
+                            ))}
+                        </tr>
+                    </thead>
+                    <tbody className="divide-y divide-edge">
+                        {loading ? (
+                            <tr><td colSpan={columns.length + Number(selectable)} className="px-4 py-8 text-center text-text-3" role="status">Loading records…</td></tr>
+                        ) : error ? (
+                            <tr><td colSpan={columns.length + Number(selectable)} className="px-4 py-8 text-center text-danger" role="alert">{error}</td></tr>
+                        ) : rows.length === 0 ? (
+                            <tr><td colSpan={columns.length + Number(selectable)} className="px-4 py-8 text-center text-text-3">{emptyMessage}</td></tr>
+                        ) : rows.map((row) => (
+                            <tr key={row.id} className="text-text-2 hover:bg-surface-2">
+                                {selectable ? (
+                                    <td className="px-3 py-3">
+                                        <input type="checkbox" aria-label={`Select row ${row.id}`}
+                                            checked={rowIsSelected(row.id)}
+                                            onChange={(event) => onSelect?.(row.id, event.target.checked)} />
+                                    </td>
+                                ) : null}
+                                {columns.map((column) => <td key={column.id} className="px-4 py-3">{column.render(row)}</td>)}
+                            </tr>
+                        ))}
+                    </tbody>
+                </table>
+            </div>
+            <div className="flex items-center justify-between border-t border-edge px-4 py-2 text-xs text-text-3">
+                <span>{total.toLocaleString()} records · Page {page} of {pageCount}</span>
+                <div className="flex gap-2">
+                    <GlassButton size="sm" disabled={page <= 1 || loading} onClick={() => onPageChange?.(page - 1)}>Previous</GlassButton>
+                    <GlassButton size="sm" disabled={page >= pageCount || loading} onClick={() => onPageChange?.(page + 1)}>Next</GlassButton>
+                </div>
+            </div>
+        </div>
+    );
+}
+
+export function FilterBar({
+    search,
+    onSearch,
+    filters,
+    children,
+}: {
+    search: string;
+    onSearch: (value: string) => void;
+    filters?: { id: string; label: string; active: boolean; onRemove: () => void }[];
+    children?: ReactNode;
+}) {
+    return (
+        <div className="flex flex-wrap items-center gap-2" role="search">
+            <label className="flex min-w-52 flex-1 items-center gap-2 rounded-xl border border-edge bg-surface-1 px-3 py-2">
+                <Search size={15} aria-hidden="true" className="text-text-3" />
+                <span className="sr-only">Search records</span>
+                <input className="w-full bg-transparent text-sm text-text-1 outline-none placeholder:text-text-3"
+                    value={search} onChange={(event) => onSearch(event.target.value)} placeholder="Search…" />
+            </label>
+            {filters?.filter((filter) => filter.active).map((filter) => (
+                <button key={filter.id} type="button" onClick={filter.onRemove}
+                    className="rounded-full bg-accent-soft px-3 py-1.5 text-xs text-accent">
+                    {filter.label} <span aria-hidden="true">×</span><span className="sr-only">Remove filter</span>
+                </button>
+            ))}
+            {children}
+        </div>
+    );
+}
+
+export function useUrlQueryParams() {
+    const [search, setSearch] = useState(() => window.location.search);
+    useEffect(() => {
+        const onPopState = () => setSearch(window.location.search);
+        window.addEventListener('popstate', onPopState);
+        return () => window.removeEventListener('popstate', onPopState);
+    }, []);
+    const params = useMemo(() => new URLSearchParams(search), [search]);
+    return {
+        params,
+        setParam: (key: string, value: string | null) => {
+            const next = new URLSearchParams(window.location.search);
+            if (value) next.set(key, value);
+            else next.delete(key);
+            const query = next.toString();
+            window.history.replaceState(null, '', `${window.location.pathname}${query ? `?${query}` : ''}`);
+            setSearch(window.location.search);
+        },
+    };
+}
+
+export function DetailDrawer({ title, onClose, children }: { title: string; onClose: () => void; children: ReactNode }) {
+    return (
+        <div className="fixed inset-0 z-40 flex justify-end bg-black/30" onMouseDown={(event) => {
+            if (event.target === event.currentTarget) onClose();
+        }}>
+            <aside role="dialog" aria-modal="true" aria-label={title}
+                className="glass-modal h-full w-full max-w-xl overflow-y-auto border-l border-edge p-5">
+                <div className="mb-4 flex items-center justify-between">
+                    <h2 className="text-lg font-semibold text-text-1">{title}</h2>
+                    <GlassButton size="sm" onClick={onClose}>Close</GlassButton>
+                </div>
+                {children}
+            </aside>
+        </div>
+    );
+}
+
+export function StatusBadge({ status }: { status: string }) {
+    const tone = /active|approved|complete|enabled/i.test(status)
+        ? 'bg-ok-soft text-ok' : /pending|review|processing/i.test(status)
+            ? 'bg-warn-soft text-warn' : /blocked|denied|failed|disabled/i.test(status)
+                ? 'bg-danger-soft text-danger' : 'bg-surface-2 text-text-2';
+    return <span className={clsx('inline-flex rounded-full px-2 py-0.5 text-xs font-medium', tone)}>{status}</span>;
+}
+
+export function KpiCard({ label, value, detail }: { label: string; value: ReactNode; detail?: string }) {
+    return <GlassPanel className="p-4"><p className="text-xs text-text-3">{label}</p><p className="mt-1 text-2xl font-semibold text-text-1">{value}</p>{detail ? <p className="mt-1 text-xs text-text-3">{detail}</p> : null}</GlassPanel>;
+}
+
+export function ReasonConfirmDialog({
+    title, description, reasonRequired = false, onConfirm, onClose, confirmLabel,
+}: {
+    title: string; description: string; reasonRequired?: boolean; confirmLabel: string;
+    onConfirm: (reason: string) => void; onClose: () => void;
+}) {
+    const [reason, setReason] = useState('');
+    return (
+        <ConfirmDialog title={title} description={description} confirmLabel={confirmLabel}
+            confirmDisabled={reasonRequired && !reason.trim()} tone="primary" onClose={onClose}
+            onConfirm={() => onConfirm(reason.trim())}>
+            <label className="block text-sm text-text-2">
+                Reason {reasonRequired ? '(required)' : '(optional)'}
+                <textarea className="mt-2 min-h-24 w-full rounded-xl border border-edge bg-surface-1 p-3 text-sm text-text-1"
+                    value={reason} onChange={(event) => setReason(event.target.value)} required={reasonRequired} />
+            </label>
+        </ConfirmDialog>
+    );
+}
+
+export const APPROVALS_URL = '/approvals';
+
+export function ApprovalSubmittedNotice({ children }: { children: ReactNode }) {
+    return <GlassPanel role="status" className="border border-warn/30 bg-warn-soft p-4 text-sm text-text-1">
+        <p>{children}</p><a className="mt-2 inline-block text-accent underline" href={APPROVALS_URL}>View approval requests</a>
+    </GlassPanel>;
+}
+
+export function ExportButton({ filename, rows }: { filename: string; rows: Record<string, unknown>[] }) {
+    const exportCsv = () => {
+        const headers = [...new Set(rows.flatMap((row) => Object.keys(row)))];
+        const escape = (value: unknown) => `"${String(value ?? '').replaceAll('"', '""')}"`;
+        const csv = [headers.map(escape).join(','), ...rows.map((row) => headers.map((key) => escape(row[key])).join(','))].join('\r\n');
+        const url = URL.createObjectURL(new Blob([csv], { type: 'text/csv;charset=utf-8' }));
+        const anchor = document.createElement('a');
+        anchor.href = url;
+        anchor.download = filename;
+        anchor.click();
+        URL.revokeObjectURL(url);
+    };
+    return <GlassButton size="sm" onClick={exportCsv}><Download size={14} aria-hidden="true" />Export CSV</GlassButton>;
+}
diff --git a/application/v2_ui/src/components/layout/Sidebar.tsx b/application/v2_ui/src/components/layout/Sidebar.tsx
index 29e19f34b..82c1b2385 100644
--- a/application/v2_ui/src/components/layout/Sidebar.tsx
+++ b/application/v2_ui/src/components/layout/Sidebar.tsx
@@ -145,7 +145,9 @@ function BrandMark({ collapsed }: { collapsed: boolean }) {
 
 function UserMenu({ collapsed }: { collapsed: boolean }) {
     const user = useBootstrapStore((state) => state.data?.user);
+    const controlCenter = useBootstrapStore((state) => state.data?.control_center);
     const isAdmin = Boolean(user?.is_admin);
+    const canOpenControlCenter = Object.values(controlCenter ?? {}).some(Boolean);
     const activeConversationId = useChatStore((state) => state.activeConversationId);
     const [open, setOpen] = useState(false);
     const containerRef = useRef<HTMLDivElement>(null);
@@ -223,6 +225,11 @@ function UserMenu({ collapsed }: { collapsed: boolean }) {
                             <Settings size={15} /> Admin Settings
                         </NavLink>
                     )}
+                    {canOpenControlCenter && (
+                        <NavLink to="/control-center" onClick={() => setOpen(false)} className={itemClass}>
+                            <ShieldCheck size={15} /> Control Center
+                        </NavLink>
+                    )}
                     {/* Carries the open conversation across, since both interfaces read the
                         same parameter. Crossing over otherwise lands on the conversation
                         list, leaving you to find your place again. */}
diff --git a/application/v2_ui/src/lib/types.ts b/application/v2_ui/src/lib/types.ts
index 5df05134a..76d4016aa 100644
--- a/application/v2_ui/src/lib/types.ts
+++ b/application/v2_ui/src/lib/types.ts
@@ -1063,6 +1063,15 @@ export interface BootstrapFeatures extends Record<string, boolean | undefined> {
     enable_workflow_alert_sounds?: boolean;
 }
 
+export interface ControlCenterCapabilities {
+    can_view_dashboard: boolean;
+    can_manage_users: boolean;
+    can_manage_groups: boolean;
+    can_manage_workspaces: boolean;
+    can_view_activity_logs: boolean;
+    can_run_maintenance: boolean;
+}
+
 export interface BootstrapPayload {
     version: string;
     user: {
@@ -1103,6 +1112,7 @@ export interface BootstrapPayload {
         external_links: NavGroup<ExternalLinkNavItem>;
     };
     features: BootstrapFeatures;
+    control_center: ControlCenterCapabilities;
     /**
      * What the deployment can do, where the answer is not an `enable_*` settings flag.
      *
diff --git a/application/v2_ui/src/lib/userSettings.ts b/application/v2_ui/src/lib/userSettings.ts
index b7fa62b3c..9f7047dce 100644
--- a/application/v2_ui/src/lib/userSettings.ts
+++ b/application/v2_ui/src/lib/userSettings.ts
@@ -82,6 +82,9 @@ export interface UserSettings {
      */
     v2AdminRailCollapsed?: boolean;
 
+    /** Whether the V2 Control Center section rail is collapsed to icons. */
+    v2ControlCenterRailCollapsed?: boolean;
+
     /**
      * How the workspace documents explorer is presented, and the views pinned in its rail.
      *
@@ -220,6 +223,8 @@ export const WRITABLE_USER_SETTING_KEYS = [
     // Whether the Admin Settings categories rail is showing icons only. Separate from the
     // shell and workspace rails for the same reason they are separate from each other.
     'v2AdminRailCollapsed',
+    // Separate from the shell and Admin Settings rails so each keeps its own layout.
+    'v2ControlCenterRailCollapsed',
     // Workspace documents explorer: how the list is presented, and the saved filter
     // combinations pinned in its navigation rail.
     'v2DocumentsPrefs',
diff --git a/application/v2_ui/src/pages/ControlCenterPage.tsx b/application/v2_ui/src/pages/ControlCenterPage.tsx
new file mode 100644
index 000000000..f817cb969
--- /dev/null
+++ b/application/v2_ui/src/pages/ControlCenterPage.tsx
@@ -0,0 +1,231 @@
+// ControlCenterPage.tsx
+// THESIS: Put governed administration into its own pane, not the user workspace rail.
+// OWN-WORLD: Inherit SimpleChat V2's semantic glass surfaces, compact workhorse type, and blue accent.
+// STORY: Administrators see which areas are available; Data health is explicitly on-demand.
+// FIRST VIEWPORT: A labeled section rail sits beside a broad page header and one focused work area.
+// FORM: Operate; extend the established Admin Settings pane without changing its visual system.
+
+import { useState } from 'react';
+import { NavLink, useNavigate, useParams } from 'react-router-dom';
+import { Activity, BarChart3, Database, FolderOpen, PanelLeftClose, PanelLeftOpen, Users } from 'lucide-react';
+import { clsx } from 'clsx';
+import { api } from '../lib/apiClient';
+import { PageHeader } from '../components/layout/PageHeader';
+import { ConfirmDialog } from '../components/ui/ConfirmDialog';
+import { GlassButton, GlassPanel } from '../components/ui/primitives';
+import type { ControlCenterCapabilities } from '../lib/types';
+import { useBootstrapStore } from '../stores/bootstrapStore';
+import { useUserSettingsStore } from '../stores/userSettingsStore';
+
+type SectionId = 'dashboard' | 'users' | 'groups' | 'public-workspaces' | 'activity-logs' | 'data-health';
+
+interface MigrationStatus {
+    conversations_without_logs: number;
+    personal_documents_without_logs: number;
+    group_documents_without_logs: number;
+    public_documents_without_logs: number;
+    total_documents_without_logs: number;
+    migration_needed: boolean;
+    estimated_total_records: number;
+}
+
+interface MigrationResult {
+    conversations_migrated: number;
+    conversations_skipped_existing: number;
+    personal_documents_migrated: number;
+    personal_documents_skipped_existing: number;
+    group_documents_migrated: number;
+    group_documents_skipped_existing: number;
+    public_documents_migrated: number;
+    public_documents_skipped_existing: number;
+    total_migrated: number;
+    total_skipped_existing: number;
+    total_failed: number;
+}
+
+const SECTIONS: {
+    id: SectionId;
+    label: string;
+    Icon: typeof BarChart3;
+    capability: keyof ControlCenterCapabilities;
+}[] = [
+    { id: 'dashboard', label: 'Dashboard', Icon: BarChart3, capability: 'can_view_dashboard' },
+    { id: 'users', label: 'Users', Icon: Users, capability: 'can_manage_users' },
+    { id: 'groups', label: 'Groups', Icon: Users, capability: 'can_manage_groups' },
+    { id: 'public-workspaces', label: 'Public Workspaces', Icon: FolderOpen, capability: 'can_manage_workspaces' },
+    { id: 'activity-logs', label: 'Activity Logs', Icon: Activity, capability: 'can_view_activity_logs' },
+    { id: 'data-health', label: 'Data health', Icon: Database, capability: 'can_run_maintenance' },
+];
+
+function MigrationDataHealth() {
+    const [checking, setChecking] = useState(false);
+    const [running, setRunning] = useState(false);
+    const [status, setStatus] = useState<MigrationStatus | null>(null);
+    const [result, setResult] = useState<MigrationResult | null>(null);
+    const [error, setError] = useState<string | null>(null);
+    const [confirmOpen, setConfirmOpen] = useState(false);
+
+    const check = async () => {
+        setChecking(true);
+        setError(null);
+        setResult(null);
+        try {
+            setStatus(await api.get<MigrationStatus>('/api/admin/control-center/migrate/status'));
+        } catch (requestError) {
+            setError(requestError instanceof Error ? requestError.message : 'Unable to check activity-log status.');
+        } finally {
+            setChecking(false);
+        }
+    };
+
+    const runBackfill = async () => {
+        setConfirmOpen(false);
+        setRunning(true);
+        setError(null);
+        setResult(null);
+        try {
+            setResult(await api.post<MigrationResult>('/api/admin/control-center/migrate/all'));
+        } catch (requestError) {
+            setError(requestError instanceof Error ? requestError.message : 'Unable to run the activity-log backfill.');
+        } finally {
+            setRunning(false);
+        }
+    };
+
+    return (
+        <div className="max-w-4xl space-y-5 p-5 md:p-8">
+            <div>
+                <h2 className="text-xl font-semibold text-text-1">Activity-log data health</h2>
+                <p className="mt-2 max-w-3xl text-sm leading-relaxed text-text-2">
+                    The legacy backfill adds conversation and document creation records to activity logs when those
+                    records are missing. Normal application workflows already write activity logs, so this maintenance
+                    operation is usually unnecessary. Check the counts before deciding to run it.
+                </p>
+            </div>
+            <div className="flex flex-wrap gap-2">
+                <GlassButton variant="primary" disabled={checking || running} onClick={() => void check()}>
+                    {checking ? 'Checking…' : 'Check activity-log status'}
+                </GlassButton>
+                <GlassButton variant="subtle" disabled={checking || running} onClick={() => setConfirmOpen(true)}>
+                    {running ? 'Running backfill…' : 'Run backfill'}
+                </GlassButton>
+            </div>
+            {error ? <p role="alert" className="rounded-xl bg-danger-soft p-3 text-sm text-danger">{error}</p> : null}
+            {status ? (
+                <GlassPanel className="space-y-3 p-4" aria-live="polite">
+                    <h3 className="font-medium text-text-1">Check results</h3>
+                    <dl className="grid gap-3 sm:grid-cols-2">
+                        {[
+                            ['Conversations without the legacy flag', status.conversations_without_logs],
+                            ['Personal documents without the legacy flag', status.personal_documents_without_logs],
+                            ['Group documents without the legacy flag', status.group_documents_without_logs],
+                            ['Public documents without the legacy flag', status.public_documents_without_logs],
+                            ['Estimated records', status.estimated_total_records],
+                        ].map(([label, value]) => (
+                            <div key={label} className="rounded-xl bg-surface-2 px-3 py-2">
+                                <dt className="text-xs text-text-3">{label}</dt>
+                                <dd className="mt-1 font-semibold text-text-1">{Number(value).toLocaleString()}</dd>
+                            </div>
+                        ))}
+                    </dl>
+                    <p className="text-sm text-text-2">
+                        {status.migration_needed
+                            ? 'These counts identify records missing the legacy flag, not necessarily missing activity logs.'
+                            : 'No records are missing the legacy flag.'}
+                    </p>
+                </GlassPanel>
+            ) : null}
+            {result ? (
+                <GlassPanel className="space-y-2 p-4" role="status" aria-live="polite">
+                    <h3 className="font-medium text-text-1">Backfill complete</h3>
+                    <p className="text-sm text-text-2">
+                        {result.total_migrated.toLocaleString()} records added;
+                        {' '}{result.total_skipped_existing.toLocaleString()} existing activity records skipped;
+                        {' '}{result.total_failed.toLocaleString()} failures.
+                    </p>
+                </GlassPanel>
+            ) : null}
+            {confirmOpen ? (
+                <ConfirmDialog title="Run activity-log backfill?"
+                    description="This scans conversations and all three document workspaces. Existing creation activity records are skipped."
+                    confirmLabel="Run backfill" tone="primary" onClose={() => setConfirmOpen(false)}
+                    onConfirm={() => void runBackfill()}>
+                    <p className="text-sm text-text-2">The operation can take time on large datasets. It is safe to run again; records already present will be skipped.</p>
+                </ConfirmDialog>
+            ) : null}
+        </div>
+    );
+}
+
+function SectionPlaceholder({ label }: { label: string }) {
+    return (
+        <GlassPanel className="m-5 max-w-3xl p-6 md:m-8">
+            <h2 className="text-lg font-semibold text-text-1">{label}</h2>
+            <p className="mt-2 text-sm leading-relaxed text-text-2">
+                This V2 management section is being built. Until it is available here, use the classic Control Center.
+            </p>
+            <a href="/admin/control-center" className="mt-4 inline-flex rounded-xl bg-accent px-4 py-2 text-sm font-medium text-on-accent hover:bg-accent-hover">
+                Open classic Control Center
+            </a>
+        </GlassPanel>
+    );
+}
+
+export function ControlCenterPage() {
+    const { section: requestedSection } = useParams<{ section?: string }>();
+    const capabilities = useBootstrapStore((state) => state.data?.control_center);
+    const navigate = useNavigate();
+    const railCollapsed = useUserSettingsStore((state) => state.settings.v2ControlCenterRailCollapsed === true);
+    const updateUserSettings = useUserSettingsStore((state) => state.update);
+    const sections: SectionId[] = ['dashboard', 'users', 'groups', 'public-workspaces', 'activity-logs', 'data-health'];
+    const section = (sections.includes(requestedSection as SectionId) ? requestedSection : 'dashboard') as SectionId;
+    const current = SECTIONS.find((item) => item.id === section) ?? SECTIONS[0];
+    const allowed = Boolean(capabilities?.[current.capability]);
+
+    return (
+        <div className="flex h-full min-h-0 flex-col">
+            <PageHeader title="Control Center" description="Manage and monitor SimpleChat." />
+            <div className="flex min-h-0 flex-1">
+                <aside aria-label="Control Center sections"
+                    className={clsx('hidden shrink-0 overflow-y-auto border-r border-edge transition-[width] motion-reduce:transition-none lg:block',
+                        railCollapsed ? 'w-16 px-2 py-3' : 'w-56 p-3')}>
+                    <button type="button" onClick={() => updateUserSettings({ v2ControlCenterRailCollapsed: !railCollapsed })}
+                        aria-label={railCollapsed ? 'Expand Control Center sections' : 'Collapse Control Center sections'}
+                        aria-expanded={!railCollapsed} aria-controls="control-center-section-list"
+                        title={railCollapsed ? 'Expand Control Center sections' : 'Collapse Control Center sections'}
+                        className={clsx('mb-2 flex w-full items-center gap-2 rounded-lg py-1.5 text-xs text-text-3 hover:bg-surface-2 hover:text-text-1',
+                            railCollapsed ? 'justify-center px-2' : 'px-3')}>
+                        {railCollapsed ? <PanelLeftOpen size={15} aria-hidden="true" /> : <><PanelLeftClose size={15} aria-hidden="true" /><span>Collapse</span></>}
+                    </button>
+                    <nav id="control-center-section-list" className="space-y-0.5">
+                        {SECTIONS.filter((item) => capabilities?.[item.capability]).map(({ id, label, Icon }) => (
+                            <NavLink key={id} to={`/control-center/${id}`} aria-current={section === id ? 'page' : undefined}
+                                title={railCollapsed ? label : undefined}
+                                className={({ isActive }) => clsx('flex items-center gap-2.5 rounded-lg py-2.5 text-sm transition-colors',
+                                    railCollapsed ? 'justify-center px-2' : 'px-3',
+                                    isActive ? 'bg-accent-soft font-semibold text-accent' : 'text-text-2 hover:bg-surface-2 hover:text-text-1')}>
+                                <Icon size={16} aria-hidden="true" />
+                                <span className={railCollapsed ? 'sr-only' : undefined}>{label}</span>
+                            </NavLink>
+                        ))}
+                    </nav>
+                </aside>
+                <main className="min-h-0 min-w-0 flex-1 overflow-y-auto">
+                    <div className="p-4 lg:hidden">
+                        <label className="sr-only" htmlFor="control-center-section">Control Center section</label>
+                        <select id="control-center-section" className="w-full rounded-xl border border-edge bg-surface-1 p-2 text-sm text-text-1"
+                            value={section} onChange={(event) => navigate(`/control-center/${event.target.value}`)}>
+                            {SECTIONS.filter((item) => capabilities?.[item.capability]).map((item) => <option key={item.id} value={item.id}>{item.label}</option>)}
+                        </select>
+                    </div>
+                    {!allowed ? (
+                        <GlassPanel role="alert" className="m-5 max-w-2xl p-5 md:m-8">
+                            <h2 className="font-semibold text-text-1">Access unavailable</h2>
+                            <p className="mt-2 text-sm text-text-2">Your Control Center permissions do not include this section.</p>
+                        </GlassPanel>
+                    ) : section === 'data-health' ? <MigrationDataHealth /> : <SectionPlaceholder label={current.label} />}
+                </main>
+            </div>
+        </div>
+    );
+}
diff --git a/docs/explanation/features/V2_CONTROL_CENTER.md b/docs/explanation/features/V2_CONTROL_CENTER.md
new file mode 100644
index 000000000..57e1550c5
--- /dev/null
+++ b/docs/explanation/features/V2_CONTROL_CENTER.md
@@ -0,0 +1,31 @@
+# V2 Control Center
+
+The V2 Control Center is a permission-aware administration pane for managing SimpleChat. The foundation release provides the shared navigation and capability contract, placeholders for management areas that will arrive in later phases, and a manual activity-log data-health tool.
+
+**Implemented in version:** 0.261.278
+
+**Dependencies:** React 18, TypeScript, Vite, Flask session authentication, and the existing Control Center APIs.
+
+## Architecture
+
+The Control Center is a distinct React route (`/control-center` and `/control-center/<section>`), reached from the account menu when the signed-in user has at least one Control Center capability. It is not a primary workspace-navigation item. The internal section rail has a separate per-user collapsed-state preference.
+
+`get_control_center_capabilities()` in `functions_authentication.py` is the shared permission decision for both `control_center_required()` and the `/api/v2/bootstrap` response. When the ControlCenterAdmin role requirement is enabled, that role grants all capabilities; otherwise the regular Admin role grants them. The optional ControlCenterDashboardReader role grants dashboard viewing only when its setting is enabled. The bootstrap payload exposes `can_view_dashboard`, `can_manage_users`, `can_manage_groups`, `can_manage_workspaces`, `can_view_activity_logs`, and `can_run_maintenance`.
+
+## Sections and data health
+
+Dashboard, Users, Groups, Public Workspaces, and Activity Logs are permission-gated placeholders until their V2 implementations are delivered. They link to the classic Control Center at `/admin/control-center`.
+
+Data health is available to users with `can_run_maintenance`. Its Check button calls `GET /api/admin/control-center/migrate/status` only when requested. Run backfill requires confirmation and calls `POST /api/admin/control-center/migrate/all`. The legacy-flag counts do not prove that activity logs are missing: normal application writers already record activity, so the backfill is normally unnecessary. The backfill checks for a matching resource creation record in the user's activity-log partition and uses stable per-resource IDs to avoid duplicate writes on repeated or concurrent runs.
+
+## Usage
+
+Open **Account → Control Center**, then select a section in its internal rail. A bookmarked section URL opens that section directly. The Data health page is intended for explicit diagnosis or a known recovery scenario; check first, and run the backfill only when the result and operational context justify it.
+
+## Testing and limitations
+
+Functional checks cover capability parity, bootstrap exposure, manual-only migration checks, deduplication, and route wiring. Playwright coverage verifies the Data health interaction and capability visibility. This foundation does not implement the dashboard, user/group/workspace administration, or activity-log browser; those sections remain in the classic page until their subsequent phases.
+
+## Version tracking
+
+The application version is defined by `VERSION` in `application/single_app/config.py`. This implementation was added in **0.261.278**.
diff --git a/docs/explanation/fixes/ACTIVITY_LOG_MIGRATION_PROMPT_FIX.md b/docs/explanation/fixes/ACTIVITY_LOG_MIGRATION_PROMPT_FIX.md
new file mode 100644
index 000000000..5261719ea
--- /dev/null
+++ b/docs/explanation/fixes/ACTIVITY_LOG_MIGRATION_PROMPT_FIX.md
@@ -0,0 +1,26 @@
+# Activity Log Migration Prompt Fix
+
+## Issue
+
+The classic Control Center displayed a recurring activity-log migration banner and made a migration-status request whenever the page loaded. The banner could persist because the check counted legacy `added_to_activity_log` flags rather than checking whether an activity record already existed. Several normal conversation writers do not set that flag, and document processing can fail before its flag is written.
+
+## Root cause
+
+The legacy status endpoint scanned all conversations and document containers across partitions for a missing flag. The page interpreted any missing flag as missing activity logs even though normal application workflows already write activity records. Repeated visits therefore repeated expensive scans and prompted administrators to run a migration that was not necessarily needed.
+
+## Resolution
+
+Implemented in version **0.261.278** (`application/single_app/config.py`):
+
+- Removed the migration banner, confirmation modal, automatic status request, and now-dead migration JavaScript from the classic Control Center.
+- Kept the status and backfill APIs for an explicit Data health tool in V2. The status scan now happens only when an administrator chooses Check.
+- Made the backfill check for an existing creation record within the corresponding `user_id` partition and workspace type before writing. New backfill records use stable IDs, so overlapping or repeated runs converge rather than adding duplicate events.
+- Reports existing records skipped separately from newly migrated records.
+
+## Validation
+
+`functional_tests/test_v2_control_center_foundation.py` checks that the classic UI does not call migration status automatically and that the backfill lookup is resource- and workspace-specific. `ui_tests/test_v2_control_center_data_health.py` verifies that the user must request a check and explicitly confirm a backfill.
+
+## Impact
+
+Opening the classic Control Center no longer triggers four cross-partition count scans or a misleading migration prompt. Administrators retain an explicit diagnostic and recovery path in V2. Existing logs are preserved; the manual backfill skips records that already have matching creation events.
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index ae18e9a8c..7b2274e82 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,15 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/features) and [Fixes by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/fixes).
 
+### **(v0.261.278)**
+
+#### New Features
+
+*   **V2 Control Center Foundation**
+    *   Adds the permission-aware V2 Control Center pane, reusable management primitives, and a manually invoked activity-log data-health check and backfill.
+    *   The classic page no longer scans for migration status on every visit; the retained backfill skips existing activity events and uses stable IDs for reruns.
+    *   (Ref: `ControlCenterPage.tsx`, `functions_authentication.py`, `route_backend_v2.py`, [V2 Control Center](features/V2_CONTROL_CENTER.md), [Activity Log Migration Prompt Fix](fixes/ACTIVITY_LOG_MIGRATION_PROMPT_FIX.md))
+
 ### **(v0.261.277)**
 
 #### User Interface Enhancements
diff --git a/docs/guides/v2-control-center.md b/docs/guides/v2-control-center.md
new file mode 100644
index 000000000..e896dc328
--- /dev/null
+++ b/docs/guides/v2-control-center.md
@@ -0,0 +1,32 @@
+---
+layout: page
+title: "Use the V2 Control Center"
+description: "Open the permission-aware Control Center pane and check activity-log data only when needed."
+section: "Guides"
+audience: admin
+---
+
+## What the Control Center provides
+
+The V2 Control Center is a separate administration pane for users assigned Control Center access. It is kept out of the primary workspace navigation and appears in **Account → Control Center** when at least one Control Center capability is available to you.
+
+The section rail is filtered to your permissions. Dashboard, user and group management, public workspaces, and activity logs are being delivered in phases. Until a section is available in V2, open the classic Control Center from its placeholder.
+
+## Check activity-log data health
+
+The **Data health** section is available to users with maintenance access. Its backfill is a legacy repair operation for conversation and document creation events; ordinary application workflows already write activity logs, so the backfill is normally unnecessary.
+
+1. Select **Data health** and choose **Check activity-log status** to request the current legacy-flag counts. The check is not performed automatically when the page opens.
+2. Read the results carefully: they count records missing a legacy flag and do not establish that their activity events are absent.
+3. Use **Run backfill** only when you have a known need. Confirm the operation in the dialog. The backfill checks the relevant user's activity-log partition and skips existing creation records.
+
+The status and backfill APIs remain protected by the Control Center maintenance permission. Running a backfill may take time on large datasets.
+
+## Permission model
+
+The V2 pane uses the same server-side role and setting rules as the existing Control Center endpoints. A dashboard reader can see only the dashboard section when the dashboard-reader role setting is enabled. Management, activity-log, and maintenance sections require full Control Center access. Hiding a section in the browser is not an authorization boundary; the APIs enforce their own access checks.
+
+## Related
+
+- [V2 Control Center foundation](../explanation/features/V2_CONTROL_CENTER.md)
+- [Operate SimpleChat day to day](admin-operate-simplechat.md)
diff --git a/functional_tests/test_control_center_access_logic.py b/functional_tests/test_control_center_access_logic.py
index 087e9e217..25e61511c 100644
--- a/functional_tests/test_control_center_access_logic.py
+++ b/functional_tests/test_control_center_access_logic.py
@@ -1,8 +1,10 @@
 #!/usr/bin/env python3
+# test_control_center_access_logic.py
 """
 Functional test for Control Center access control logic.
-Version: 0.235.011
+Version: 0.261.278
 Implemented in: 0.235.011
+Capability helper regression coverage added in: 0.261.278
 
 This test ensures that Control Center access control works correctly based on
 the require_member_of_control_center_admin setting and user roles.
@@ -38,7 +40,7 @@ def test_control_center_required_decorator_logic():
     tests_passed = 0
     tests_failed = 0
     
-    # Read the functions_authentication.py file to verify the logic
+    # Read the shared helper and decorator to verify the capability contract.
     auth_file = os.path.join(app_path, 'functions_authentication.py')
     
     if not os.path.exists(auth_file):
@@ -47,11 +49,15 @@ def test_control_center_required_decorator_logic():
     
     with open(auth_file, 'r', encoding='utf-8') as f:
         content = f.read()
-    
+
+    helper_content = content.split("def get_control_center_capabilities(", 1)[1].split(
+        "\ndef control_center_required", 1
+    )[0]
+
     # Test 1: Verify the decorator checks for regular Admin role
     print("\n📋 Test 1: Decorator checks for regular Admin role")
-    if "has_regular_admin_role = 'roles' in user and 'Admin' in user['roles']" in content:
-        print("   ✅ Decorator properly checks for regular Admin role")
+    if "'Admin' in user['roles']" in helper_content:
+        print("   ✅ Shared helper properly checks for regular Admin role")
         tests_passed += 1
     else:
         print("   ❌ Decorator missing check for regular Admin role")
@@ -59,8 +65,8 @@ def test_control_center_required_decorator_logic():
     
     # Test 2: Verify the decorator checks for ControlCenterAdmin role
     print("\n📋 Test 2: Decorator checks for ControlCenterAdmin role")
-    if "has_control_center_admin_role = 'roles' in user and 'ControlCenterAdmin' in user['roles']" in content:
-        print("   ✅ Decorator properly checks for ControlCenterAdmin role")
+    if "'ControlCenterAdmin' in user['roles']" in helper_content:
+        print("   ✅ Shared helper properly checks for ControlCenterAdmin role")
         tests_passed += 1
     else:
         print("   ❌ Decorator missing check for ControlCenterAdmin role")
@@ -68,9 +74,12 @@ def test_control_center_required_decorator_logic():
     
     # Test 3: Verify ControlCenterAdmin gets access when setting is ENABLED
     print("\n📋 Test 3: ControlCenterAdmin has access when setting is enabled")
-    # The check for ControlCenterAdmin should be inside the if require_member_of_control_center_admin block
-    if "if require_member_of_control_center_admin:" in content and "if has_control_center_admin_role:" in content:
-        print("   ✅ ControlCenterAdmin role grants access when setting is enabled")
+    if (
+        "has_full_access = (" in helper_content
+        and "if require_admin_role else has_regular_admin_role" in helper_content
+        and "capabilities = get_control_center_capabilities(user, settings)" in content
+    ):
+        print("   ✅ Shared helper preserves the role-setting access decision")
         tests_passed += 1
     else:
         print("   ❌ ControlCenterAdmin access not properly implemented")
@@ -258,7 +267,7 @@ def main():
     """Run all tests."""
     print("\n" + "🔧" * 35)
     print("Control Center Access Control Logic Tests")
-    print("Version: 0.235.010")
+    print("Version: 0.261.278")
     print("🔧" * 35)
     
     all_passed = True
diff --git a/functional_tests/test_v2_control_center_foundation.py b/functional_tests/test_v2_control_center_foundation.py
new file mode 100644
index 000000000..40115b7e3
--- /dev/null
+++ b/functional_tests/test_v2_control_center_foundation.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+# test_v2_control_center_foundation.py
+"""
+Functional test for the V2 Control Center foundation.
+Version: 0.261.278
+Implemented in: 0.261.278
+
+This test covers the shared access capability contract, bootstrap wiring, migration
+deduplication, removal of the legacy automatic migration check, and route/pane structure.
+"""
+
+import ast
+import itertools
+import sys
+from pathlib import Path
+
+sys.path.append(str(Path(__file__).resolve().parent))
+
+from test_support.versioning import assert_app_version_at_least
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP = ROOT / "application" / "single_app"
+V2 = ROOT / "application" / "v2_ui" / "src"
+AUTH = APP / "functions_authentication.py"
+BOOTSTRAP = APP / "route_backend_v2.py"
+BACKFILL = APP / "route_backend_control_center.py"
+ACTIVITY = APP / "functions_activity_logging.py"
+LEGACY_JS = APP / "static" / "js" / "control-center.js"
+LEGACY_HTML = APP / "templates" / "control_center.html"
+PAGE = V2 / "pages" / "ControlCenterPage.tsx"
+
+
+def _source(path):
+    assert path.is_file(), f"Expected file is missing: {path}"
+    return path.read_text(encoding="utf-8")
+
+
+def _capabilities_function():
+    tree = ast.parse(_source(AUTH))
+    function = next(
+        node for node in tree.body
+        if isinstance(node, ast.FunctionDef) and node.name == "get_control_center_capabilities"
+    )
+    namespace = {}
+    exec(compile(ast.Module(body=[function], type_ignores=[]), str(AUTH), "exec"), namespace)
+    return namespace[function.name]
+
+
+def test_capability_helper_matches_legacy_access_rules():
+    """Every relevant role/settings combination has the same dashboard/admin outcome."""
+    capability_helper = _capabilities_function()
+    role_names = ("Admin", "ControlCenterAdmin", "ControlCenterDashboardReader")
+    settings_values = (False, True)
+    for enabled_roles in itertools.chain.from_iterable(
+        itertools.combinations(role_names, size) for size in range(len(role_names) + 1)
+    ):
+        for admin_required, reader_required in itertools.product(settings_values, repeat=2):
+            user = {"roles": list(enabled_roles)}
+            settings = {
+                "require_member_of_control_center_admin": admin_required,
+                "require_member_of_control_center_dashboard_reader": reader_required,
+            }
+            capabilities = capability_helper(user, settings)
+            full_access = (
+                "ControlCenterAdmin" in enabled_roles
+                if admin_required else "Admin" in enabled_roles
+            )
+            dashboard_access = full_access or (
+                reader_required and "ControlCenterDashboardReader" in enabled_roles
+            )
+            assert capabilities == {
+                "can_view_dashboard": bool(dashboard_access),
+                "can_manage_users": bool(full_access),
+                "can_manage_groups": bool(full_access),
+                "can_manage_workspaces": bool(full_access),
+                "can_view_activity_logs": bool(full_access),
+                "can_run_maintenance": bool(full_access),
+            }
+
+    source = _source(AUTH)
+    decorator = source.split("def control_center_required(", 1)[1].split(
+        "\ndef create_group_role_required", 1
+    )[0]
+    assert "get_control_center_capabilities(user, settings)" in decorator
+    assert "capabilities['can_view_dashboard']" in decorator
+    assert "capabilities['can_manage_users']" in decorator
+
+
+def test_bootstrap_publishes_control_center_capabilities():
+    """The SPA receives the same server-computed authorization contract."""
+    source = _source(BOOTSTRAP)
+    assert "get_control_center_capabilities" in source
+    assert '"control_center": get_control_center_capabilities(session_user, settings)' in source
+
+
+def test_migration_is_manual_and_legacy_controls_are_removed():
+    """The classic UI no longer checks or offers the migration automatically."""
+    js = _source(LEGACY_JS)
+    html = _source(LEGACY_HTML)
+    page = _source(PAGE)
+    assert "/api/admin/control-center/migrate/status" not in js
+    assert "checkMigrationStatus" not in js
+    assert "migrationBanner" not in html
+    assert "migrationConfirmModal" not in html
+    assert "Check activity-log status" in page
+    assert "Run backfill" in page
+    assert "useEffect" not in page, "Data health must not check status during page load."
+
+
+def test_backfill_checks_existing_resource_logs_and_uses_stable_ids():
+    """Existing records are skipped and reruns converge on deterministic record IDs."""
+    activity = _source(ACTIVITY)
+    route = _source(BACKFILL)
+    helper_tree = ast.parse(activity)
+    helper_nodes = [
+        node for node in helper_tree.body
+        if isinstance(node, ast.FunctionDef)
+        and node.name in {"build_activity_log_id", "has_activity_log_for_resource"}
+    ]
+
+    class ActivityContainer:
+        def __init__(self, found):
+            self.found = found
+            self.calls = []
+
+        def query_items(self, **kwargs):
+            self.calls.append(kwargs)
+            return iter(["existing-id"] if self.found else [])
+
+    import uuid
+
+    for found in (False, True):
+        container = ActivityContainer(found)
+        namespace = {
+            "uuid": uuid,
+            "cosmos_activity_logs_container": container,
+        }
+        exec(compile(ast.Module(body=helper_nodes, type_ignores=[]), str(ACTIVITY), "exec"), namespace)
+        exists = namespace["has_activity_log_for_resource"](
+            "user-1", "document_creation", "doc-1", "group"
+        )
+        assert exists is found
+        assert container.calls[0]["partition_key"] == "user-1"
+        assert "@workspace_type" in container.calls[0]["query"]
+        assert container.calls[0]["parameters"][-1]["value"] == "group"
+
+    stable_id = namespace["build_activity_log_id"](
+        "document_creation", "user-1", "backfill:group:doc-1"
+    )
+    assert stable_id == namespace["build_activity_log_id"](
+        "document_creation", "user-1", "backfill:group:doc-1"
+    )
+    assert "has_activity_log_for_resource" in route
+    assert "build_activity_log_id" in route
+    assert "total_skipped_existing" in route
+
+
+def test_pane_has_section_routes_and_capability_gating():
+    """Each section is deep-linkable and its menu entry is permission-gated."""
+    app = _source(V2 / "App.tsx")
+    sidebar = _source(V2 / "components" / "layout" / "Sidebar.tsx")
+    page = _source(PAGE)
+    for route in ('path="/control-center"', 'path="/control-center/:section"'):
+        assert route in app
+    for capability in (
+        "can_view_dashboard", "can_manage_users", "can_manage_groups",
+        "can_manage_workspaces", "can_view_activity_logs", "can_run_maintenance",
+    ):
+        assert capability in page
+    assert "canOpenControlCenter" in sidebar
+    assert "v2ControlCenterRailCollapsed" in page
+
+
+def test_version_is_at_least_the_implementing_release():
+    assert_app_version_at_least("0.261.278")
+
+
+TESTS = [
+    test_capability_helper_matches_legacy_access_rules,
+    test_bootstrap_publishes_control_center_capabilities,
+    test_migration_is_manual_and_legacy_controls_are_removed,
+    test_backfill_checks_existing_resource_logs_and_uses_stable_ids,
+    test_pane_has_section_routes_and_capability_gating,
+    test_version_is_at_least_the_implementing_release,
+]
+
+
+if __name__ == "__main__":
+    passed = 0
+    for test in TESTS:
+        test()
+        passed += 1
+    print(f"{passed}/{len(TESTS)} Control Center checks passed")
diff --git a/ui_tests/test_v2_control_center_data_health.py b/ui_tests/test_v2_control_center_data_health.py
new file mode 100644
index 000000000..4d08593c1
--- /dev/null
+++ b/ui_tests/test_v2_control_center_data_health.py
@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+# test_v2_control_center_data_health.py
+"""
+Browser coverage for the V2 Control Center data-health flow.
+Version: 0.261.278
+Implemented in: 0.261.278
+
+Validates capability-based discovery, on-demand status checks and the explicit confirmation
+before the activity-log backfill, without contacting a live SimpleChat deployment.
+"""
+
+import json
+import sys
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import pytest
+from playwright.sync_api import Page, Route, expect
+
+sys.path.insert(0, str(Path(__file__).resolve().parent / "fixtures"))
+
+from playwright_connection import connect_options  # noqa: F401
+from v2_notification_stubs import is_notification_count, notification_count_payload
+
+
+ROOT = Path(__file__).resolve().parents[1]
+STATIC = ROOT / "application" / "single_app" / "static"
+SPA_INDEX = STATIC / "v2" / "index.html"
+ORIGIN = "http://simplechat.test"
+
+
+class ControlCenterFixture:
+    def __init__(self, page: Page, capabilities=None):
+        self.page = page
+        self.capabilities = capabilities or {
+            "can_view_dashboard": True,
+            "can_manage_users": True,
+            "can_manage_groups": True,
+            "can_manage_workspaces": True,
+            "can_view_activity_logs": True,
+            "can_run_maintenance": True,
+        }
+        self.requests = []
+        self.unexpected = []
+        page.route("**/*", self._route)
+
+    def _route(self, route: Route):
+        request = route.request
+        parsed = urlsplit(request.url)
+        path = parsed.path
+        if f"{parsed.scheme}://{parsed.netloc}" != ORIGIN:
+            self.unexpected.append(request.url)
+            route.abort()
+            return
+        if request.method == "GET" and path.startswith("/v2"):
+            route.fulfill(path=str(SPA_INDEX), content_type="text/html")
+        elif request.method == "GET" and path.startswith("/static/"):
+            asset = (STATIC / path.removeprefix("/static/")).resolve()
+            if asset.is_relative_to(STATIC.resolve()) and asset.is_file():
+                route.fulfill(path=str(asset))
+            else:
+                self.unexpected.append(path)
+                route.fulfill(status=404, body="Fixture asset not found")
+        elif path == "/api/v2/bootstrap" and request.method == "GET":
+            route.fulfill(json={
+                "version": "0.261.278",
+                "user": {"id": "test-admin", "display_name": "Test Admin", "is_admin": True, "roles": ["Admin"]},
+                "branding": {"app_title": "SimpleChat", "show_logo": False, "hide_app_title": False},
+                "features": {},
+                "control_center": self.capabilities,
+                "catalogs": {"models": [], "agents": [], "prompts": [], "initial_model_selection": None},
+                "scope": {"groups": [], "public_workspaces": []},
+                "navigation": {
+                    "custom_pages": {"enabled": False, "items": []},
+                    "external_links": {"enabled": False, "items": []},
+                },
+                "workspace": {"sections": {}},
+                "admin_nav": [],
+                "notices": {"ai": {}, "web_search": {}},
+                "settings": {},
+            })
+        elif path == "/api/user/settings" and request.method == "GET":
+            route.fulfill(json={"settings": {}})
+        elif is_notification_count(request.method, path):
+            route.fulfill(json=notification_count_payload())
+        elif path == "/api/admin/control-center/migrate/status" and request.method == "GET":
+            self.requests.append(("GET", path))
+            route.fulfill(json={
+                "conversations_without_logs": 2,
+                "personal_documents_without_logs": 1,
+                "group_documents_without_logs": 0,
+                "public_documents_without_logs": 3,
+                "total_documents_without_logs": 4,
+                "migration_needed": True,
+                "estimated_total_records": 6,
+            })
+        elif path == "/api/admin/control-center/migrate/all" and request.method == "POST":
+            self.requests.append(("POST", path))
+            route.fulfill(json={
+                "conversations_migrated": 0,
+                "conversations_skipped_existing": 2,
+                "personal_documents_migrated": 1,
+                "personal_documents_skipped_existing": 0,
+                "group_documents_migrated": 0,
+                "group_documents_skipped_existing": 0,
+                "public_documents_migrated": 0,
+                "public_documents_skipped_existing": 3,
+                "total_migrated": 1,
+                "total_skipped_existing": 5,
+                "total_failed": 0,
+            })
+        else:
+            self.unexpected.append(f"{request.method} {path}")
+            route.fulfill(status=404, json={"error": "Unexpected fixture request."})
+
+    def open(self, *, width=1440):
+        if not SPA_INDEX.is_file():
+            pytest.fail("Build the V2 SPA first: npm --prefix application/v2_ui run build")
+        self.page.set_viewport_size({"width": width, "height": 900})
+        self.page.goto(f"{ORIGIN}/v2/control-center/data-health", wait_until="networkidle")
+
+    def assert_clean(self):
+        assert not self.unexpected, self.unexpected
+
+
+@pytest.fixture
+def control_center_ui(page):
+    fixture = ControlCenterFixture(page)
+    yield fixture
+    fixture.assert_clean()
+
+
+pytestmark = pytest.mark.ui
+
+
+def test_data_health_checks_only_on_demand(control_center_ui):
+    control_center_ui.open()
+    page = control_center_ui.page
+
+    expect(page.get_by_role("heading", name="Activity-log data health")).to_be_visible()
+    assert control_center_ui.requests == []
+    page.get_by_role("button", name="Check activity-log status").click()
+    expect(page.get_by_text("Estimated records", exact=True)).to_be_visible()
+    expect(page.get_by_text("6", exact=True)).to_be_visible()
+    assert control_center_ui.requests == [
+        ("GET", "/api/admin/control-center/migrate/status"),
+    ]
+
+
+def test_backfill_waits_for_confirmation(control_center_ui):
+    control_center_ui.open()
+    page = control_center_ui.page
+
+    page.get_by_role("button", name="Run backfill").click()
+    dialog = page.get_by_role("dialog", name="Run activity-log backfill?")
+    expect(dialog).to_be_visible()
+    assert control_center_ui.requests == []
+    dialog.get_by_role("button", name="Run backfill").click()
+    expect(page.get_by_text("1 records added; 5 existing activity records skipped; 0 failures.")).to_be_visible()
+    assert control_center_ui.requests == [
+        ("POST", "/api/admin/control-center/migrate/all"),
+    ]
+
+
+def test_control_center_menu_and_sections_follow_capabilities(page):
+    fixture = ControlCenterFixture(page, capabilities={
+        "can_view_dashboard": True,
+        "can_manage_users": False,
+        "can_manage_groups": False,
+        "can_manage_workspaces": False,
+        "can_view_activity_logs": False,
+        "can_run_maintenance": False,
+    })
+    fixture.open()
+    page.locator('button[aria-controls="sidebar-account-menu"]').click()
+    expect(page.get_by_role("link", name="Control Center")).to_be_visible()
+    page.get_by_role("link", name="Control Center").click()
+    expect(page.get_by_role("complementary", name="Control Center sections").get_by_role("link")).to_have_count(1)
+    expect(page.get_by_role("link", name="Dashboard")).to_be_visible()
+    page.goto(f"{ORIGIN}/v2/control-center/data-health", wait_until="networkidle")
+    expect(page.get_by_role("alert")).to_contain_text("permissions do not include this section")
+    assert fixture.requests == []
+    fixture.assert_clean()