diff --git a/controller/model/api_session_certificate_manager.go b/controller/model/api_session_certificate_manager.go
index b6bf62ece..f732bc062 100644
--- a/controller/model/api_session_certificate_manager.go
+++ b/controller/model/api_session_certificate_manager.go
@@ -46,7 +46,7 @@ func (self *ApiSessionCertificateManager) newModelEntity() *ApiSessionCertificat
 }
 
 func (self *ApiSessionCertificateManager) Create(entity *ApiSessionCertificate, ctx *change.Context) (string, error) {
-	return self.createEntity(entity, ctx)
+	return self.createEntity(entity, ctx.NewMutateContext())
 }
 
 func (self *ApiSessionCertificateManager) CreateFromCSR(apiSessionId string, lifespan time.Duration, csrPem []byte, ctx *change.Context) (string, error) {
diff --git a/controller/model/api_session_manager.go b/controller/model/api_session_manager.go
index 3f81bfc31..04079fbd4 100644
--- a/controller/model/api_session_manager.go
+++ b/controller/model/api_session_manager.go
@@ -114,16 +114,16 @@ func (self *ApiSessionManager) IsUpdated(_ string) bool {
 }
 
 func (self *ApiSessionManager) Update(apiSession *ApiSession, ctx *change.Context) error {
-	return self.updateEntity(apiSession, self, ctx)
+	return self.updateEntity(apiSession, self, ctx.NewMutateContext())
 }
 
 func (self *ApiSessionManager) UpdateWithFieldChecker(apiSession *ApiSession, fieldChecker boltz.FieldChecker, ctx *change.Context) error {
-	return self.updateEntity(apiSession, fieldChecker, ctx)
+	return self.updateEntity(apiSession, fieldChecker, ctx.NewMutateContext())
 }
 
 func (self *ApiSessionManager) MfaCompleted(apiSession *ApiSession, ctx *change.Context) error {
 	apiSession.MfaComplete = true
-	return self.updateEntity(apiSession, &OrFieldChecker{NewFieldChecker(persistence.FieldApiSessionMfaComplete), self}, ctx)
+	return self.updateEntity(apiSession, &OrFieldChecker{NewFieldChecker(persistence.FieldApiSessionMfaComplete), self}, ctx.NewMutateContext())
 }
 
 func (self *ApiSessionManager) Delete(id string, ctx *change.Context) error {
diff --git a/controller/model/auth_policy_manager.go b/controller/model/auth_policy_manager.go
index b065e1015..c7332d528 100644
--- a/controller/model/auth_policy_manager.go
+++ b/controller/model/auth_policy_manager.go
@@ -50,7 +50,7 @@ func (self *AuthPolicyManager) Create(entity *AuthPolicy, ctx *change.Context) e
 	return network.DispatchCreate[*AuthPolicy](self, entity, ctx)
 }
 
-func (self *AuthPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*AuthPolicy]) error {
+func (self *AuthPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*AuthPolicy], ctx boltz.MutateContext) error {
 	entity := cmd.Entity
 	if entity.Secondary.RequiredExtJwtSigner != nil {
 		if err := self.verifyExtJwt(*entity.Secondary.RequiredExtJwtSigner, "secondary.requiredExtJwtSigner"); err != nil {
@@ -64,7 +64,7 @@ func (self *AuthPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*Aut
 		}
 	}
 
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -72,8 +72,8 @@ func (self *AuthPolicyManager) Update(entity *AuthPolicy, checker fields.Updated
 	return network.DispatchUpdate[*AuthPolicy](self, entity, checker, ctx)
 }
 
-func (self *AuthPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*AuthPolicy]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *AuthPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*AuthPolicy], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *AuthPolicyManager) newModelEntity() *AuthPolicy {
diff --git a/controller/model/authenticator_manager.go b/controller/model/authenticator_manager.go
index 37e8378ce..c46b280f2 100644
--- a/controller/model/authenticator_manager.go
+++ b/controller/model/authenticator_manager.go
@@ -111,7 +111,7 @@ func (self *AuthenticatorManager) Create(entity *Authenticator, ctx *change.Cont
 	return network.DispatchCreate[*Authenticator](self, entity, ctx)
 }
 
-func (self *AuthenticatorManager) ApplyCreate(cmd *command.CreateEntityCommand[*Authenticator]) error {
+func (self *AuthenticatorManager) ApplyCreate(cmd *command.CreateEntityCommand[*Authenticator], ctx boltz.MutateContext) error {
 	authenticator := cmd.Entity
 	if authenticator.Method != persistence.MethodAuthenticatorUpdb && authenticator.Method != persistence.MethodAuthenticatorCert {
 		return errorz.NewFieldError("method must be updb or cert", "method", authenticator.Method)
@@ -166,7 +166,7 @@ func (self *AuthenticatorManager) ApplyCreate(cmd *command.CreateEntityCommand[*
 		}
 	}
 
-	_, err = self.createEntity(authenticator, cmd.Context)
+	_, err = self.createEntity(authenticator, ctx)
 	return err
 }
 
@@ -183,7 +183,7 @@ func (self *AuthenticatorManager) Update(entity *Authenticator, unrestricted boo
 	return self.Dispatch(cmd)
 }
 
-func (self *AuthenticatorManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Authenticator]) error {
+func (self *AuthenticatorManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Authenticator], ctx boltz.MutateContext) error {
 	authenticator := cmd.Entity
 	if updb := authenticator.ToUpdb(); updb != nil {
 		if cmd.UpdatedFields == nil || cmd.UpdatedFields.IsUpdated("password") {
@@ -209,7 +209,7 @@ func (self *AuthenticatorManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*
 			checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 		}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *AuthenticatorManager) getRootPool() *x509.CertPool {
@@ -609,7 +609,11 @@ func (self *AuthenticatorManager) ReEnroll(id string, expiresAt time.Time, ctx *
 		return "", err
 	}
 
+	enrollmentId := eid.New()
 	enrollment := &Enrollment{
+		BaseEntity: models.BaseEntity{
+			Id: enrollmentId,
+		},
 		IdentityId: &authenticator.IdentityId,
 		Token:      uuid.NewString(),
 	}
@@ -638,8 +642,7 @@ func (self *AuthenticatorManager) ReEnroll(id string, expiresAt time.Time, ctx *
 		return "", err
 	}
 
-	enrollmentId, err := self.env.GetManagers().Enrollment.createEntity(enrollment, ctx)
-	if err != nil {
+	if err = self.env.GetManagers().Enrollment.Create(enrollment, ctx); err != nil {
 		return "", err
 	}
 
diff --git a/controller/model/base_manager.go b/controller/model/base_manager.go
index d51841a31..604b61877 100644
--- a/controller/model/base_manager.go
+++ b/controller/model/base_manager.go
@@ -134,9 +134,9 @@ func (self *baseEntityManager[ME, PE]) PreparedListAssociatedWithHandler(id stri
 	})
 }
 
-func (self *baseEntityManager[ME, PE]) createEntity(modelEntity edgeEntity[PE], ctx *change.Context) (string, error) {
+func (self *baseEntityManager[ME, PE]) createEntity(modelEntity edgeEntity[PE], ctx boltz.MutateContext) (string, error) {
 	var id string
-	err := self.GetDb().Update(ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+	err := self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		var err error
 		id, err = self.createEntityInTx(ctx, modelEntity)
 		return err
@@ -198,8 +198,8 @@ func (self *baseEntityManager[ME, PE]) updateEntityBatch(modelEntity edgeEntity[
 	})
 }
 
-func (self *baseEntityManager[ME, PE]) updateEntity(modelEntity ME, checker boltz.FieldChecker, changeCtx *change.Context) error {
-	return self.GetDb().Update(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+func (self *baseEntityManager[ME, PE]) updateEntity(modelEntity ME, checker boltz.FieldChecker, ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		existing, found, err := self.GetStore().FindById(ctx.Tx(), modelEntity.GetId())
 		if err != nil {
 			return err
@@ -297,8 +297,8 @@ func (self *baseEntityManager[ME, PE]) Delete(id string, ctx *change.Context) er
 	return self.Dispatch(cmd)
 }
 
-func (self *baseEntityManager[ME, PE]) ApplyDelete(cmd *command.DeleteEntityCommand) error {
-	return self.GetDb().Update(cmd.Context.NewMutateContext(), func(ctx boltz.MutateContext) error {
+func (self *baseEntityManager[ME, PE]) ApplyDelete(cmd *command.DeleteEntityCommand, ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		return self.Store.DeleteById(ctx, cmd.Id)
 	})
 }
diff --git a/controller/model/ca_manager.go b/controller/model/ca_manager.go
index 6d869e029..ab9d0b01a 100644
--- a/controller/model/ca_manager.go
+++ b/controller/model/ca_manager.go
@@ -55,8 +55,8 @@ func (self *CaManager) Create(entity *Ca, ctx *change.Context) error {
 	return network.DispatchCreate[*Ca](self, entity, ctx)
 }
 
-func (self *CaManager) ApplyCreate(cmd *command.CreateEntityCommand[*Ca]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *CaManager) ApplyCreate(cmd *command.CreateEntityCommand[*Ca], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -67,7 +67,7 @@ func (self *CaManager) Update(entity *Ca, checker fields.UpdatedFields, ctx *cha
 	return network.DispatchUpdate[*Ca](self, entity, checker, ctx)
 }
 
-func (self *CaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Ca]) error {
+func (self *CaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Ca], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 
 	// isVerified should only be set by the Verified method. We remove isVerified
@@ -80,7 +80,7 @@ func (self *CaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Ca]) error
 		}
 	}
 
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *CaManager) Read(id string) (*Ca, error) {
diff --git a/controller/model/config_manager.go b/controller/model/config_manager.go
index 5076b75f0..355cd6d73 100644
--- a/controller/model/config_manager.go
+++ b/controller/model/config_manager.go
@@ -54,8 +54,8 @@ func (self *ConfigManager) Create(entity *Config, ctx *change.Context) error {
 	return network.DispatchCreate[*Config](self, entity, ctx)
 }
 
-func (self *ConfigManager) ApplyCreate(cmd *command.CreateEntityCommand[*Config]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *ConfigManager) ApplyCreate(cmd *command.CreateEntityCommand[*Config], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -63,12 +63,12 @@ func (self *ConfigManager) Update(entity *Config, checker fields.UpdatedFields,
 	return network.DispatchUpdate[*Config](self, entity, checker, ctx)
 }
 
-func (self *ConfigManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Config]) error {
+func (self *ConfigManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Config], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 	if cmd.UpdatedFields != nil {
 		checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *ConfigManager) Read(id string) (*Config, error) {
diff --git a/controller/model/config_type_manager.go b/controller/model/config_type_manager.go
index abc22b960..8d993b582 100644
--- a/controller/model/config_type_manager.go
+++ b/controller/model/config_type_manager.go
@@ -27,6 +27,7 @@ import (
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
 	"github.com/openziti/foundation/v2/stringz"
+	"github.com/openziti/storage/boltz"
 	"go.etcd.io/bbolt"
 	"google.golang.org/protobuf/proto"
 )
@@ -58,8 +59,8 @@ func (self *ConfigTypeManager) Create(entity *ConfigType, ctx *change.Context) e
 	return network.DispatchCreate[*ConfigType](self, entity, ctx)
 }
 
-func (self *ConfigTypeManager) ApplyCreate(cmd *command.CreateEntityCommand[*ConfigType]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *ConfigTypeManager) ApplyCreate(cmd *command.CreateEntityCommand[*ConfigType], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -67,8 +68,8 @@ func (self *ConfigTypeManager) Update(entity *ConfigType, checker fields.Updated
 	return network.DispatchUpdate[*ConfigType](self, entity, checker, ctx)
 }
 
-func (self *ConfigTypeManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ConfigType]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *ConfigTypeManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ConfigType], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *ConfigTypeManager) Read(id string) (*ConfigType, error) {
diff --git a/controller/model/create_terminator_cmd.go b/controller/model/create_terminator_cmd.go
index 3ed229265..817c2d9f2 100644
--- a/controller/model/create_terminator_cmd.go
+++ b/controller/model/create_terminator_cmd.go
@@ -21,15 +21,14 @@ type CreateEdgeTerminatorCmd struct {
 	Context *change.Context
 }
 
-func (self *CreateEdgeTerminatorCmd) Apply(raftIndex uint64) error {
+func (self *CreateEdgeTerminatorCmd) Apply(ctx boltz.MutateContext) error {
 	createCmd := &command.CreateEntityCommand[*network.Terminator]{
 		Creator:        self.Env.GetManagers().Terminator,
 		Entity:         self.Entity,
 		PostCreateHook: self.validateTerminatorIdentity,
 		Context:        self.Context,
 	}
-	createCmd.Context.RaftIndex = raftIndex
-	return self.Env.GetManagers().Terminator.ApplyCreate(createCmd)
+	return self.Env.GetManagers().Terminator.ApplyCreate(createCmd, ctx)
 }
 
 func (self *CreateEdgeTerminatorCmd) validateTerminatorIdentity(ctx boltz.MutateContext, terminator *network.Terminator) error {
@@ -63,6 +62,10 @@ func (self *CreateEdgeTerminatorCmd) validateTerminatorIdentity(ctx boltz.Mutate
 	return nil
 }
 
+func (self *CreateEdgeTerminatorCmd) GetChangeContext() *change.Context {
+	return self.Context
+}
+
 type terminator interface {
 	GetId() string
 	GetInstanceId() string
diff --git a/controller/model/edge_router_manager.go b/controller/model/edge_router_manager.go
index e54bd7de4..e2a20d963 100644
--- a/controller/model/edge_router_manager.go
+++ b/controller/model/edge_router_manager.go
@@ -97,11 +97,11 @@ func (self *EdgeRouterManager) Create(edgeRouter *EdgeRouter, ctx *change.Contex
 	return self.Dispatch(cmd)
 }
 
-func (self *EdgeRouterManager) ApplyCreate(cmd *CreateEdgeRouterCmd) error {
+func (self *EdgeRouterManager) ApplyCreate(cmd *CreateEdgeRouterCmd, ctx boltz.MutateContext) error {
 	edgeRouter := cmd.edgeRouter
 	enrollment := cmd.enrollment
 
-	return self.GetDb().Update(cmd.ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		boltEdgeRouter, err := edgeRouter.toBoltEntityForCreate(ctx.Tx(), self.env)
 		if err != nil {
 			return err
@@ -138,7 +138,7 @@ func (self *EdgeRouterManager) Update(entity *EdgeRouter, unrestricted bool, che
 	return self.Dispatch(cmd)
 }
 
-func (self *EdgeRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouter]) error {
+func (self *EdgeRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouter], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = cmd.UpdatedFields
 	if cmd.Flags != updateUnrestricted {
 		if checker == nil {
@@ -147,7 +147,7 @@ func (self *EdgeRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Edg
 			checker = &AndFieldChecker{first: self.allowedFieldsChecker, second: cmd.UpdatedFields}
 		}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *EdgeRouterManager) Read(id string) (*EdgeRouter, error) {
@@ -557,9 +557,8 @@ type CreateEdgeRouterCmd struct {
 	ctx        *change.Context
 }
 
-func (self *CreateEdgeRouterCmd) Apply(raftIndex uint64) error {
-	self.ctx.RaftIndex = raftIndex
-	return self.manager.ApplyCreate(self)
+func (self *CreateEdgeRouterCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyCreate(self, ctx)
 }
 
 func (self *CreateEdgeRouterCmd) Encode() ([]byte, error) {
@@ -600,3 +599,7 @@ func (self *CreateEdgeRouterCmd) Decode(env Env, msg *edge_cmd_pb.CreateEdgeRout
 
 	return nil
 }
+
+func (self *CreateEdgeRouterCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}
diff --git a/controller/model/edge_router_policy_manager.go b/controller/model/edge_router_policy_manager.go
index 8a18ece47..f8e3ad095 100644
--- a/controller/model/edge_router_policy_manager.go
+++ b/controller/model/edge_router_policy_manager.go
@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
+	"github.com/openziti/storage/boltz"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -50,8 +51,8 @@ func (self *EdgeRouterPolicyManager) Create(entity *EdgeRouterPolicy, ctx *chang
 	return network.DispatchCreate[*EdgeRouterPolicy](self, entity, ctx)
 }
 
-func (self *EdgeRouterPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*EdgeRouterPolicy]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *EdgeRouterPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*EdgeRouterPolicy], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -59,8 +60,8 @@ func (self *EdgeRouterPolicyManager) Update(entity *EdgeRouterPolicy, checker fi
 	return network.DispatchUpdate[*EdgeRouterPolicy](self, entity, checker, ctx)
 }
 
-func (self *EdgeRouterPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouterPolicy]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *EdgeRouterPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouterPolicy], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *EdgeRouterPolicyManager) Marshall(entity *EdgeRouterPolicy) ([]byte, error) {
diff --git a/controller/model/edge_service_manager.go b/controller/model/edge_service_manager.go
index 7ddd298c4..de3bedf14 100644
--- a/controller/model/edge_service_manager.go
+++ b/controller/model/edge_service_manager.go
@@ -66,8 +66,8 @@ func (self *EdgeServiceManager) Create(entity *Service, ctx *change.Context) err
 	return network.DispatchCreate[*Service](self, entity, ctx)
 }
 
-func (self *EdgeServiceManager) ApplyCreate(cmd *command.CreateEntityCommand[*Service]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *EdgeServiceManager) ApplyCreate(cmd *command.CreateEntityCommand[*Service], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -78,8 +78,8 @@ func (self *EdgeServiceManager) Update(entity *Service, checker fields.UpdatedFi
 	return network.DispatchUpdate[*Service](self, entity, checker, ctx)
 }
 
-func (self *EdgeServiceManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Service]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *EdgeServiceManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Service], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *EdgeServiceManager) ReadByName(name string) (*Service, error) {
diff --git a/controller/model/enrollment_manager.go b/controller/model/enrollment_manager.go
index b771f88a0..ec5af2a32 100644
--- a/controller/model/enrollment_manager.go
+++ b/controller/model/enrollment_manager.go
@@ -60,11 +60,11 @@ func (self *EnrollmentManager) Create(entity *Enrollment, ctx *change.Context) e
 	return network.DispatchCreate[*Enrollment](self, entity, ctx)
 }
 
-func (self *EnrollmentManager) ApplyCreate(cmd *command.CreateEntityCommand[*Enrollment]) error {
+func (self *EnrollmentManager) ApplyCreate(cmd *command.CreateEntityCommand[*Enrollment], ctx boltz.MutateContext) error {
 	model := cmd.Entity
 
 	if model.EdgeRouterId != nil || model.TransitRouterId != nil {
-		_, err := self.createEntity(model, cmd.Context)
+		_, err := self.createEntity(model, ctx)
 		return err
 	}
 
@@ -121,7 +121,7 @@ func (self *EnrollmentManager) ApplyCreate(cmd *command.CreateEntityCommand[*Enr
 		return err
 	}
 
-	_, err = self.createEntity(model, cmd.Context)
+	_, err = self.createEntity(model, ctx)
 	return err
 }
 
@@ -129,8 +129,8 @@ func (self *EnrollmentManager) Update(entity *Enrollment, checker fields.Updated
 	return network.DispatchUpdate[*Enrollment](self, entity, checker, ctx)
 }
 
-func (self *EnrollmentManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Enrollment]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *EnrollmentManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Enrollment], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *EnrollmentManager) newModelEntity() *Enrollment {
@@ -232,8 +232,8 @@ func (self *EnrollmentManager) GetClientCertChain(certRaw []byte) (string, error
 	return string(clientChainPem), nil
 }
 
-func (self *EnrollmentManager) ApplyReplaceEncoderWithAuthenticatorCommand(cmd *ReplaceEnrollmentWithAuthenticatorCmd) error {
-	return self.env.GetDbProvider().GetDb().Update(cmd.ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+func (self *EnrollmentManager) ApplyReplaceEncoderWithAuthenticatorCommand(cmd *ReplaceEnrollmentWithAuthenticatorCmd, ctx boltz.MutateContext) error {
+	return self.env.GetDbProvider().GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		err := self.env.GetStores().Enrollment.DeleteById(ctx, cmd.enrollmentId)
 		if err != nil {
 			return err
@@ -375,9 +375,8 @@ type ReplaceEnrollmentWithAuthenticatorCmd struct {
 	authenticator *Authenticator
 }
 
-func (self *ReplaceEnrollmentWithAuthenticatorCmd) Apply(raftIndex uint64) error {
-	self.ctx.RaftIndex = raftIndex
-	return self.manager.ApplyReplaceEncoderWithAuthenticatorCommand(self)
+func (self *ReplaceEnrollmentWithAuthenticatorCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyReplaceEncoderWithAuthenticatorCommand(self, ctx)
 }
 
 func (self *ReplaceEnrollmentWithAuthenticatorCmd) Encode() ([]byte, error) {
@@ -405,3 +404,7 @@ func (self *ReplaceEnrollmentWithAuthenticatorCmd) Decode(env Env, msg *edge_cmd
 	self.authenticator = authenticator
 	return nil
 }
+
+func (self *ReplaceEnrollmentWithAuthenticatorCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}
diff --git a/controller/model/external_jwt_signer_manager.go b/controller/model/external_jwt_signer_manager.go
index 11d288ebf..024d103f4 100644
--- a/controller/model/external_jwt_signer_manager.go
+++ b/controller/model/external_jwt_signer_manager.go
@@ -25,6 +25,7 @@ import (
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
 	"github.com/openziti/storage/ast"
+	"github.com/openziti/storage/boltz"
 	"github.com/pkg/errors"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -53,8 +54,8 @@ func (self *ExternalJwtSignerManager) Create(entity *ExternalJwtSigner, ctx *cha
 	return network.DispatchCreate[*ExternalJwtSigner](self, entity, ctx)
 }
 
-func (self *ExternalJwtSignerManager) ApplyCreate(cmd *command.CreateEntityCommand[*ExternalJwtSigner]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *ExternalJwtSignerManager) ApplyCreate(cmd *command.CreateEntityCommand[*ExternalJwtSigner], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -62,8 +63,8 @@ func (self *ExternalJwtSignerManager) Update(entity *ExternalJwtSigner, checker
 	return network.DispatchUpdate[*ExternalJwtSigner](self, entity, checker, ctx)
 }
 
-func (self *ExternalJwtSignerManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ExternalJwtSigner]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *ExternalJwtSignerManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ExternalJwtSigner], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *ExternalJwtSignerManager) Marshall(entity *ExternalJwtSigner) ([]byte, error) {
diff --git a/controller/model/identity_manager.go b/controller/model/identity_manager.go
index 94c14b89c..ee538fcb5 100644
--- a/controller/model/identity_manager.go
+++ b/controller/model/identity_manager.go
@@ -81,8 +81,8 @@ func (self *IdentityManager) Create(entity *Identity, ctx *change.Context) error
 	return network.DispatchCreate[*Identity](self, entity, ctx)
 }
 
-func (self *IdentityManager) ApplyCreate(cmd *command.CreateEntityCommand[*Identity]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *IdentityManager) ApplyCreate(cmd *command.CreateEntityCommand[*Identity], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -108,11 +108,11 @@ func (self *IdentityManager) CreateWithEnrollments(identityModel *Identity, enro
 	return self.Dispatch(cmd)
 }
 
-func (self *IdentityManager) ApplyCreateWithEnrollments(cmd *CreateIdentityWithEnrollmentsCmd) error {
+func (self *IdentityManager) ApplyCreateWithEnrollments(cmd *CreateIdentityWithEnrollmentsCmd, ctx boltz.MutateContext) error {
 	identityModel := cmd.identity
 	enrollmentsModels := cmd.enrollments
 
-	return self.GetDb().Update(cmd.ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		boltEntity, err := identityModel.toBoltEntityForCreate(ctx.Tx(), self.env)
 		if err != nil {
 			return err
@@ -141,12 +141,12 @@ func (self *IdentityManager) Update(entity *Identity, checker fields.UpdatedFiel
 	return network.DispatchUpdate[*Identity](self, entity, checker, ctx)
 }
 
-func (self *IdentityManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Identity]) error {
+func (self *IdentityManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Identity], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 	if cmd.UpdatedFields != nil {
 		checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *IdentityManager) IsUpdated(field string) bool {
@@ -415,9 +415,9 @@ func (self *IdentityManager) RemoveServiceConfigs(id string, serviceConfigs []Se
 	return self.Dispatch(cmd)
 }
 
-func (self *IdentityManager) ApplyUpdateServiceConfigs(cmd *UpdateServiceConfigsCmd) error {
+func (self *IdentityManager) ApplyUpdateServiceConfigs(cmd *UpdateServiceConfigsCmd, ctx boltz.MutateContext) error {
 	if cmd.add {
-		return self.GetDb().Update(cmd.ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+		return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 			boltServiceConfigs, err := toBoltServiceConfigs(ctx.Tx(), self.env, cmd.serviceConfigs)
 			if err != nil {
 				return err
@@ -426,7 +426,7 @@ func (self *IdentityManager) ApplyUpdateServiceConfigs(cmd *UpdateServiceConfigs
 		})
 	}
 
-	return self.GetDb().Update(cmd.ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		boltServiceConfigs, err := toBoltServiceConfigs(ctx.Tx(), self.env, cmd.serviceConfigs)
 		if err != nil {
 			return err
@@ -709,9 +709,8 @@ type CreateIdentityWithEnrollmentsCmd struct {
 	ctx         *change.Context
 }
 
-func (self *CreateIdentityWithEnrollmentsCmd) Apply(raftIndex uint64) error {
-	self.ctx.RaftIndex = raftIndex
-	return self.manager.ApplyCreateWithEnrollments(self)
+func (self *CreateIdentityWithEnrollmentsCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyCreateWithEnrollments(self, ctx)
 }
 
 func (self *CreateIdentityWithEnrollmentsCmd) Encode() ([]byte, error) {
@@ -756,6 +755,10 @@ func (self *CreateIdentityWithEnrollmentsCmd) Decode(env Env, msg *edge_cmd_pb.C
 	return nil
 }
 
+func (self *CreateIdentityWithEnrollmentsCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}
+
 type identityStatusMap struct {
 	identityIdToStatus cmap.ConcurrentMap[string, *status]
 	initOnce           sync.Once
@@ -815,9 +818,8 @@ type UpdateServiceConfigsCmd struct {
 	ctx            *change.Context
 }
 
-func (self *UpdateServiceConfigsCmd) Apply(raftIndex uint64) error {
-	self.ctx.RaftIndex = raftIndex
-	return self.manager.ApplyUpdateServiceConfigs(self)
+func (self *UpdateServiceConfigsCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyUpdateServiceConfigs(self, ctx)
 }
 
 func (self *UpdateServiceConfigsCmd) Encode() ([]byte, error) {
@@ -853,3 +855,7 @@ func (self *UpdateServiceConfigsCmd) Decode(env Env, msg *edge_cmd_pb.UpdateServ
 
 	return nil
 }
+
+func (self *UpdateServiceConfigsCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}
diff --git a/controller/model/mfa_manager.go b/controller/model/mfa_manager.go
index f9e6b5caa..114661846 100644
--- a/controller/model/mfa_manager.go
+++ b/controller/model/mfa_manager.go
@@ -91,8 +91,8 @@ func (self *MfaManager) Create(entity *Mfa, ctx *change.Context) error {
 	return network.DispatchCreate[*Mfa](self, entity, ctx)
 }
 
-func (self *MfaManager) ApplyCreate(cmd *command.CreateEntityCommand[*Mfa]) error {
-	return self.GetDb().Update(cmd.Context.NewMutateContext(), func(ctx boltz.MutateContext) error {
+func (self *MfaManager) ApplyCreate(cmd *command.CreateEntityCommand[*Mfa], ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		result := &MfaListResult{manager: self}
 		err := self.ListWithTx(ctx.Tx(), fmt.Sprintf(`identity = "%s"`, cmd.Entity.IdentityId), result.collect)
 
@@ -114,12 +114,12 @@ func (self *MfaManager) Update(entity *Mfa, checker fields.UpdatedFields, ctx *c
 	return network.DispatchUpdate[*Mfa](self, entity, checker, ctx)
 }
 
-func (self *MfaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Mfa]) error {
+func (self *MfaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Mfa], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 	if cmd.UpdatedFields != nil {
 		checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *MfaManager) IsUpdated(field string) bool {
diff --git a/controller/model/posture_check_manager.go b/controller/model/posture_check_manager.go
index 90ff7947a..a01fed630 100644
--- a/controller/model/posture_check_manager.go
+++ b/controller/model/posture_check_manager.go
@@ -71,8 +71,8 @@ func (self *PostureCheckManager) Create(entity *PostureCheck, ctx *change.Contex
 	return network.DispatchCreate[*PostureCheck](self, entity, ctx)
 }
 
-func (self *PostureCheckManager) ApplyCreate(cmd *command.CreateEntityCommand[*PostureCheck]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *PostureCheckManager) ApplyCreate(cmd *command.CreateEntityCommand[*PostureCheck], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -80,12 +80,12 @@ func (self *PostureCheckManager) Update(entity *PostureCheck, checker fields.Upd
 	return network.DispatchUpdate[*PostureCheck](self, entity, checker, ctx)
 }
 
-func (self *PostureCheckManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*PostureCheck]) error {
+func (self *PostureCheckManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*PostureCheck], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 	if cmd.UpdatedFields != nil {
 		checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *PostureCheckManager) Read(id string) (*PostureCheck, error) {
diff --git a/controller/model/service_edge_router_policy_manager.go b/controller/model/service_edge_router_policy_manager.go
index 0258d9ab2..6fb85e192 100644
--- a/controller/model/service_edge_router_policy_manager.go
+++ b/controller/model/service_edge_router_policy_manager.go
@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
+	"github.com/openziti/storage/boltz"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -50,8 +51,8 @@ func (self *ServiceEdgeRouterPolicyManager) Create(entity *ServiceEdgeRouterPoli
 	return network.DispatchCreate[*ServiceEdgeRouterPolicy](self, entity, ctx)
 }
 
-func (self *ServiceEdgeRouterPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*ServiceEdgeRouterPolicy]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *ServiceEdgeRouterPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*ServiceEdgeRouterPolicy], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -59,8 +60,8 @@ func (self *ServiceEdgeRouterPolicyManager) Update(entity *ServiceEdgeRouterPoli
 	return network.DispatchUpdate[*ServiceEdgeRouterPolicy](self, entity, checker, ctx)
 }
 
-func (self *ServiceEdgeRouterPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ServiceEdgeRouterPolicy]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *ServiceEdgeRouterPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ServiceEdgeRouterPolicy], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *ServiceEdgeRouterPolicyManager) Marshall(entity *ServiceEdgeRouterPolicy) ([]byte, error) {
diff --git a/controller/model/service_policy_manager.go b/controller/model/service_policy_manager.go
index ccbf1b8fa..11af0a0de 100644
--- a/controller/model/service_policy_manager.go
+++ b/controller/model/service_policy_manager.go
@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
+	"github.com/openziti/storage/boltz"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -50,8 +51,8 @@ func (self *ServicePolicyManager) Create(entity *ServicePolicy, ctx *change.Cont
 	return network.DispatchCreate[*ServicePolicy](self, entity, ctx)
 }
 
-func (self *ServicePolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*ServicePolicy]) error {
-	_, err := self.createEntity(cmd.Entity, cmd.Context)
+func (self *ServicePolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*ServicePolicy], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
@@ -59,8 +60,8 @@ func (self *ServicePolicyManager) Update(entity *ServicePolicy, checker fields.U
 	return network.DispatchUpdate[*ServicePolicy](self, entity, checker, ctx)
 }
 
-func (self *ServicePolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ServicePolicy]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, cmd.Context)
+func (self *ServicePolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ServicePolicy], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *ServicePolicyManager) Marshall(entity *ServicePolicy) ([]byte, error) {
diff --git a/controller/model/transit_router_manager.go b/controller/model/transit_router_manager.go
index f7aec6dda..cc3187d29 100644
--- a/controller/model/transit_router_manager.go
+++ b/controller/model/transit_router_manager.go
@@ -87,11 +87,11 @@ func (self *TransitRouterManager) Create(txRouter *TransitRouter, ctx *change.Co
 	return self.Dispatch(cmd)
 }
 
-func (self *TransitRouterManager) ApplyCreate(cmd *CreateTransitRouterCmd) error {
+func (self *TransitRouterManager) ApplyCreate(cmd *CreateTransitRouterCmd, ctx boltz.MutateContext) error {
 	txRouter := cmd.router
 	enrollment := cmd.enrollment
 
-	return self.GetDb().Update(cmd.ctx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		boltEntity, err := txRouter.toBoltEntityForCreate(ctx.Tx(), self.env)
 		if err != nil {
 			return err
@@ -133,7 +133,7 @@ func (self *TransitRouterManager) Update(entity *TransitRouter, unrestricted boo
 	return self.Dispatch(cmd)
 }
 
-func (self *TransitRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*TransitRouter]) error {
+func (self *TransitRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*TransitRouter], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = cmd.UpdatedFields
 	if cmd.Flags != updateUnrestricted {
 		if checker == nil {
@@ -142,7 +142,7 @@ func (self *TransitRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*
 			checker = &AndFieldChecker{first: self.allowedFields, second: cmd.UpdatedFields}
 		}
 	}
-	return self.updateEntity(cmd.Entity, checker, cmd.Context)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *TransitRouterManager) ReadOneByFingerprint(fingerprint string) (*TransitRouter, error) {
@@ -352,9 +352,8 @@ type CreateTransitRouterCmd struct {
 	ctx        *change.Context
 }
 
-func (self *CreateTransitRouterCmd) Apply(raftIndex uint64) error {
-	self.ctx.RaftIndex = raftIndex
-	return self.manager.ApplyCreate(self)
+func (self *CreateTransitRouterCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyCreate(self, ctx)
 }
 
 func (self *CreateTransitRouterCmd) Encode() ([]byte, error) {
@@ -396,3 +395,7 @@ func (self *CreateTransitRouterCmd) Decode(env Env, msg *edge_cmd_pb.CreateTrans
 
 	return nil
 }
+
+func (self *CreateTransitRouterCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}