diff --git a/crates/omnigraph/src/db/omnigraph/schema_apply.rs b/crates/omnigraph/src/db/omnigraph/schema_apply.rs
index cdb0677..39b1bfd 100644
--- a/crates/omnigraph/src/db/omnigraph/schema_apply.rs
+++ b/crates/omnigraph/src/db/omnigraph/schema_apply.rs
@@ -443,11 +443,11 @@ pub(super) async fn apply_schema_with_lock(
     }
 
     db.refresh_coordinator_only().await?;
-    if db.version().await != base_manifest_version {
+    let current_manifest_version = db.version().await;
+    if current_manifest_version != base_manifest_version {
         return Err(OmniError::manifest_conflict(format!(
             "schema apply lost its write lease: main advanced from v{} to v{} while schema apply was in progress",
-            base_manifest_version,
-            db.version().await
+            base_manifest_version, current_manifest_version,
         )));
     }
 
diff --git a/docs/server.md b/docs/server.md
index a20c5a7..ba2130e 100644
--- a/docs/server.md
+++ b/docs/server.md
@@ -99,6 +99,9 @@ See [deployment.md](deployment.md) for token-source operational details.
 ## Not implemented (by design or "TBD")
 
 - CORS — not configured; add `tower_http::cors` if needed.
-- Rate limiting — none.
+- Rate limiting — per-actor admission control gates `/change`, `/ingest`,
+  `/branches/{create,delete,merge}`, `/schema/apply` (see "Per-actor
+  admission control" above). No global rate limiter is configured;
+  add `tower_http::limit` if a graph-wide cap is needed.
 - Pagination — none (commits/branches return everything; export streams).
 - Multi-tenant routing — one repo per process.