diff --git a/apps/api/internal/store/identity_pairing.go b/apps/api/internal/store/identity_pairing.go
index d5de66d..8bace2c 100644
--- a/apps/api/internal/store/identity_pairing.go
+++ b/apps/api/internal/store/identity_pairing.go
@@ -320,7 +320,10 @@ FROM gateway_identity_configuration_revisions WHERE id=$1::uuid FOR UPDATE`, exc
 	if revision.State != identity.RevisionDraft && revision.State != identity.RevisionValidated && revision.State != identity.RevisionFailed {
 		return identity.PairingExchange{}, identity.ErrPairingNotCancellable
 	}
-	if _, err := tx.Exec(ctx, `UPDATE gateway_identity_configuration_revisions SET state='failed',
+	// Before Manifest delivery, issuer is NULL and the schema requires the
+	// revision to remain draft. The cancelled pairing is the terminal record.
+	if _, err := tx.Exec(ctx, `UPDATE gateway_identity_configuration_revisions SET
+state=CASE WHEN issuer IS NULL AND state IN ('draft','failed') THEN 'draft' ELSE 'failed' END,
 last_error_category='pairing_cancelled',last_trace_id=NULLIF($2,''),last_audit_id=NULLIF($3,''),
 version=version+1,updated_at=now() WHERE id=$1::uuid`, exchange.RevisionID, traceID, auditID); err != nil {
 		return identity.PairingExchange{}, err
@@ -358,7 +361,10 @@ WHERE id=$1::uuid AND version=$2 AND status='cancelled' AND cleanup_status='pend
 		return identity.PairingExchange{}, err
 	}
 	tag, err := tx.Exec(ctx, `UPDATE gateway_identity_configuration_revisions SET machine_credential_ref=NULL,
-		session_encryption_key_ref=NULL,version=version+1,updated_at=now() WHERE id=$1::uuid AND state='failed'`, revisionID)
+		session_encryption_key_ref=NULL,version=version+1,updated_at=now()
+WHERE id=$1::uuid AND (
+  state='failed' OR (state='draft' AND issuer IS NULL AND last_error_category='pairing_cancelled')
+)`, revisionID)
 	if err != nil {
 		return identity.PairingExchange{}, err
 	}
diff --git a/apps/api/internal/store/identity_pairing_integration_test.go b/apps/api/internal/store/identity_pairing_integration_test.go
index 6837ee2..8e08191 100644
--- a/apps/api/internal/store/identity_pairing_integration_test.go
+++ b/apps/api/internal/store/identity_pairing_integration_test.go
@@ -16,6 +16,51 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
+func TestIdentityPairingCancellationPreservesPreManifestDraftUntilCleanupCompletes(t *testing.T) {
+	db := newIdentityPairingPostgresTestStore(t)
+	ctx := context.Background()
+	revisionID := uuid.NewString()
+	pairingID := uuid.NewString()
+
+	if _, err := db.pool.Exec(ctx, `
+INSERT INTO gateway_identity_configuration_revisions (
+  id,state,auth_center_url,local_tenant_key,public_base_url,web_base_url
+) VALUES ($1::uuid,'draft','https://auth.test.example','','https://gateway.test.example',
+  'https://gateway-web.test.example')`, revisionID); err != nil {
+		t.Fatalf("seed pre-manifest revision: %v", err)
+	}
+	if _, err := db.CreateIdentityPairingExchange(ctx, identity.PairingExchange{
+		ID: pairingID, RevisionID: revisionID, RemoteExchangeID: uuid.NewString(),
+		ExchangeTokenRef: "identity-exchange-" + pairingID,
+		Status:           identity.PairingMetadataPending, CleanupStatus: identity.PairingCleanupNone,
+		RemoteVersion: 1, ExpiresAt: time.Now().Add(time.Hour),
+	}); err != nil {
+		t.Fatalf("seed pre-manifest pairing: %v", err)
+	}
+
+	cancelled, err := db.CancelIdentityPairingExchange(ctx, pairingID, 1, "trace-cancel", "audit-cancel")
+	if err != nil {
+		t.Fatalf("cancel pre-manifest pairing: %v", err)
+	}
+	if cancelled.Status != identity.PairingCancelled || cancelled.CleanupStatus != identity.PairingCleanupPending {
+		t.Fatalf("cancelled pairing state=%#v", cancelled)
+	}
+	cleaned, err := db.CompleteIdentityPairingCleanup(ctx, pairingID, cancelled.Version)
+	if err != nil {
+		t.Fatalf("complete pre-manifest pairing cleanup: %v", err)
+	}
+	if cleaned.CleanupStatus != identity.PairingCleanupCompleted {
+		t.Fatalf("cleaned pairing state=%#v", cleaned)
+	}
+	revision, err := db.IdentityConfigurationRevision(ctx, revisionID)
+	if err != nil {
+		t.Fatalf("load cancelled pre-manifest revision: %v", err)
+	}
+	if revision.State != identity.RevisionDraft || revision.Issuer != "" || revision.LastErrorCategory != "pairing_cancelled" {
+		t.Fatalf("cancelled pre-manifest revision=%#v", revision)
+	}
+}
+
 func TestIdentityPairingCancellationKeepsOlderInactivePairingBlockedUntilEveryCleanupCompletes(t *testing.T) {
 	db := newIdentityPairingPostgresTestStore(t)
 	ctx := context.Background()
@@ -211,9 +256,10 @@ func TestIdentityPairingStartRejectsAnyActiveConfigurationBeforeReservation(t *t
 	db := newIdentityPairingPostgresTestStore(t)
 	ctx := context.Background()
 	if _, err := db.pool.Exec(ctx, `INSERT INTO gateway_identity_configuration_revisions (
-  id,state,auth_center_url,local_tenant_key,public_base_url,web_base_url
-) VALUES ($1::uuid,'active','https://auth.test.example','default','https://gateway.test.example',
-  'https://gateway-web.test.example')`, uuid.NewString()); err != nil {
+  id,state,auth_center_url,issuer,tenant_id,local_tenant_key,public_base_url,web_base_url
+) VALUES ($1::uuid,'active','https://auth.test.example','https://issuer.test.example',$2,
+  'default','https://gateway.test.example','https://gateway-web.test.example')`,
+		uuid.NewString(), uuid.NewString()); err != nil {
 		t.Fatalf("seed active identity revision: %v", err)
 	}
 
@@ -389,9 +435,10 @@ func TestConcurrentIdentityPairingCommitRejectsActiveRevisionCommittedAheadOfLif
 	waitForIdentityLifecycleLockWaiters(t, ctx, db, 1)
 	activeID := uuid.NewString()
 	if _, err := gate.Exec(ctx, `INSERT INTO gateway_identity_configuration_revisions (
-  id,state,auth_center_url,local_tenant_key,public_base_url,web_base_url
-) VALUES ($1::uuid,'active','https://auth.test.example','default','https://active-gateway.test.example',
-  'https://active-gateway-web.test.example')`, activeID); err != nil {
+  id,state,auth_center_url,issuer,tenant_id,local_tenant_key,public_base_url,web_base_url
+) VALUES ($1::uuid,'active','https://auth.test.example','https://issuer.test.example',$2,
+  'default','https://active-gateway.test.example','https://active-gateway-web.test.example')`,
+		activeID, uuid.NewString()); err != nil {
 		t.Fatalf("commit active revision ahead of pairing commit: %v", err)
 	}
 	if err := gate.Commit(ctx); err != nil {
@@ -493,9 +540,10 @@ func TestCompletedIdentityPairingRestoreUsesCanonicalVisibleRevision(t *testing.
 		revisionID, pairingID := uuid.NewString(), uuid.NewString()
 		if _, err := db.pool.Exec(ctx, `
 INSERT INTO gateway_identity_configuration_revisions (
-  id,state,auth_center_url,local_tenant_key,public_base_url,web_base_url,created_at,updated_at
-) VALUES ($1::uuid,'validated','https://auth.test.example','default','https://gateway.test.example',
-  'https://gateway-web.test.example',$2,$2)`, revisionID, createdAt); err != nil {
+  id,state,auth_center_url,issuer,tenant_id,local_tenant_key,public_base_url,web_base_url,created_at,updated_at
+) VALUES ($1::uuid,'validated','https://auth.test.example','https://issuer.test.example',$2,
+  'default','https://gateway.test.example','https://gateway-web.test.example',$3,$3)`,
+			revisionID, uuid.NewString(), createdAt); err != nil {
 			t.Fatalf("seed completed revision %d: %v", index, err)
 		}
 		if _, err := db.CreateIdentityPairingExchange(ctx, identity.PairingExchange{
@@ -687,11 +735,13 @@ func newIdentityPairingPostgresTestStore(t *testing.T) *Store {
 		"0001_init.sql",
 		"0017_task_record_enrichment.sql",
 		"0061_oidc_server_sessions.sql",
+		"0063_oidc_security_events.sql",
 		"0065_identity_configuration_revisions.sql",
 		"0066_identity_onboarding_exchanges.sql",
 		"0067_identity_secret_cleanup_queue.sql",
 		"0068_identity_pairing_start_reservation.sql",
 		"0069_billing_correctness_v2.sql",
+		"0090_oidc_multi_tenant_identity.sql",
 	} {
 		migration, err := os.ReadFile(filepath.Join(migrationDirectory, migrationName))
 		if err != nil {