diff --git a/scripts/eval-quality.ts b/scripts/eval-quality.ts
index 0bde64faf..0c1749ceb 100644
--- a/scripts/eval-quality.ts
+++ b/scripts/eval-quality.ts
@@ -45,6 +45,7 @@ type EvalQualityArgs = {
   retrievalOnly: boolean;
   ragOnly: boolean;
   skipPreflight: boolean;
+  forceEmbedding: boolean;
 };
 
 export type RagQualityResult = {
@@ -150,6 +151,7 @@ function parseArgs(argv: string[]): EvalQualityArgs {
     retrievalOnly: false,
     ragOnly: false,
     skipPreflight: false,
+    forceEmbedding: false,
   };
 
   for (let index = 0; index < argv.length; index += 1) {
@@ -176,6 +178,10 @@ function parseArgs(argv: string[]): EvalQualityArgs {
       args.skipPreflight = true;
       continue;
     }
+    if (token === "--force-embedding") {
+      args.forceEmbedding = true;
+      continue;
+    }
 
     const value = argv[index + 1];
     if (!value || value.startsWith("--")) throw new Error(`Missing value for ${token}`);
@@ -476,6 +482,11 @@ export function buildEvalQualityReport(args: {
         `retrieval content_recall_at_5 ${retrievalSummary.content_recall_at_5} below ${qualityThresholds.retrievalContentRecallAt5}`,
       );
     }
+    if (retrievalSummary.force_embedding_failure_count > 0) {
+      thresholdFailures.push(
+        `retrieval force_embedding_failure_count ${retrievalSummary.force_embedding_failure_count} above 0`,
+      );
+    }
     if (governance.stale_rate > qualityThresholds.staleTopResultRate) {
       thresholdFailures.push(
         `top-result stale_rate ${governance.stale_rate} above ${qualityThresholds.staleTopResultRate}`,
@@ -664,6 +675,8 @@ ${markdownTable([
 ## Retrieval Decision Metrics
 
 ${markdownTable([
+  ["Force-embedding cases", retrieval.force_embedding_case_count],
+  ["Force-embedding failures", retrieval.force_embedding_failure_count],
   ["Embedding skipped rate", retrieval.embedding_skipped_rate],
   ["Median text candidate budget", retrieval.median_text_candidate_budget],
   ["Second-stage rerank rate", retrieval.second_stage_rerank_rate],
@@ -728,6 +741,7 @@ async function runRetrievalQualityCases(args: {
   ownerId?: string;
   limit?: number;
   query?: string;
+  forceEmbedding?: boolean;
   supabase: Awaited<ReturnType<typeof loadAdminClient>>;
 }) {
   const [{ searchChunksWithTelemetry }, capturedCases] = await Promise.all([
@@ -756,7 +770,7 @@ async function runRetrievalQualityCases(args: {
         topK: retrievalLimitForGoldenCase(testCase),
         minSimilarity: 0.12,
         skipCache: true,
-        forceEmbedding: testCase.forceEmbedding,
+        forceEmbedding: testCase.forceEmbedding || args.forceEmbedding,
       }),
     );
     const latencyMs =
diff --git a/scripts/eval-retrieval.ts b/scripts/eval-retrieval.ts
index edeb89564..2a46d96f2 100644
--- a/scripts/eval-retrieval.ts
+++ b/scripts/eval-retrieval.ts
@@ -47,6 +47,7 @@ type EvalArgs = {
 export type GoldenRetrievalResult = {
   id: string;
   query: string;
+  forceEmbedding: boolean;
   expectedQueryClass: string;
   actualQueryClass: string | null;
   expectedDocumentSubstrings: string[];
@@ -516,6 +517,11 @@ export function evaluateGoldenRetrievalCase(args: {
   const tableEvidenceFoundAtK = hasTableEvidence(args.results, topK);
   const actualQueryClass = args.telemetry.query_class ?? null;
   const failures: string[] = [];
+  const vectorLayerCount = Object.entries(args.telemetry.retrieval_layer_counts ?? {}).reduce(
+    (sum, [layer, count]) =>
+      ["embedding_fields", "index_units", "hybrid_vector", "vector_fallback"].includes(layer) ? sum + count : sum,
+    0,
+  );
   const hitAtK =
     documentHitsAtK.missing.length === 0 &&
     contentHitsAtK.missing.length === 0 &&
@@ -533,10 +539,23 @@ export function evaluateGoldenRetrievalCase(args: {
   if (args.testCase.expectTableEvidence && !tableEvidenceFound) {
     failures.push("expected table evidence in top 5");
   }
+  if (args.testCase.forceEmbedding) {
+    if (args.telemetry.embedding_skipped) failures.push("forceEmbedding expected embedding to run");
+    if (args.telemetry.retrieval_strategy === "search_cache") failures.push("forceEmbedding served search cache");
+    if (
+      args.telemetry.retrieval_strategy === "text_fast_path" ||
+      args.telemetry.retrieval_strategy === "document_lookup_fast_path"
+    ) {
+      failures.push(`forceEmbedding returned lexical strategy ${args.telemetry.retrieval_strategy}`);
+    }
+    if (args.telemetry.coverage_gate_decision === "accepted") failures.push("forceEmbedding returned coverage gate");
+    if (vectorLayerCount <= 0) failures.push("forceEmbedding found no vector-layer candidates");
+  }
 
   return {
     id: args.testCase.id,
     query: args.testCase.query,
+    forceEmbedding: args.testCase.forceEmbedding ?? false,
     expectedQueryClass: args.testCase.expectedQueryClass,
     actualQueryClass,
     expectedDocumentSubstrings: args.testCase.expectedDocumentSubstrings,
@@ -612,6 +631,7 @@ export function summarizeGoldenRetrievalResults(results: GoldenRetrievalResult[]
     }
     return counts;
   }, {});
+  const forceEmbeddingResults = results.filter((result) => result.forceEmbedding);
   return {
     case_count: results.length,
     document_recall_at_5: Number(
@@ -647,6 +667,8 @@ export function summarizeGoldenRetrievalResults(results: GoldenRetrievalResult[]
     embedding_skip_reason_counts: embeddingSkipReasonCounts,
     text_fast_path_reason_counts: textFastPathReasonCounts,
     retrieval_layer_counts: layerCounts,
+    force_embedding_case_count: forceEmbeddingResults.length,
+    force_embedding_failure_count: forceEmbeddingResults.filter((result) => result.failures.length > 0).length,
     median_text_candidate_budget: percentile(textCandidateBudgets, 50),
     second_stage_rerank_rate: Number(
       (results.filter((result) => result.secondStageRerankUsed).length / Math.max(results.length, 1)).toFixed(4),
@@ -723,6 +745,8 @@ function printHumanSummary(summary: ReturnType<typeof summarizeGoldenRetrievalRe
   console.log(`  retrieval_strategy_counts=${JSON.stringify(summary.retrieval_strategy_counts)}`);
   console.log(`  retrieval_plan_counts=${JSON.stringify(summary.retrieval_plan_counts)}`);
   console.log(`  retrieval_layer_counts=${JSON.stringify(summary.retrieval_layer_counts)}`);
+  console.log(`  force_embedding_case_count=${summary.force_embedding_case_count}`);
+  console.log(`  force_embedding_failure_count=${summary.force_embedding_failure_count}`);
   console.log(`  embedding_skipped_rate=${summary.embedding_skipped_rate}`);
   console.log(`  embedding_skip_reason_counts=${JSON.stringify(summary.embedding_skip_reason_counts)}`);
   console.log(`  text_fast_path_reason_counts=${JSON.stringify(summary.text_fast_path_reason_counts)}`);
diff --git a/src/app/api/documents/[id]/route.ts b/src/app/api/documents/[id]/route.ts
index 55d6a1558..4f404a004 100644
--- a/src/app/api/documents/[id]/route.ts
+++ b/src/app/api/documents/[id]/route.ts
@@ -8,6 +8,7 @@ import { invalidateRagCachesForDocumentMutation } from "@/lib/rag";
 import { committedIndexGeneration, isCommittedGenerationMetadata } from "@/lib/reindex-pipeline";
 import { createAdminClient } from "@/lib/supabase/admin";
 import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 import { writeAuditLog } from "@/lib/audit";
 import { parseJsonBody } from "@/lib/validation/body";
 import { parseRouteParams } from "@/lib/validation/params";
@@ -280,13 +281,11 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
 
     const { id } = parseRouteParams({ id: rawId }, documentRouteParamsSchema, "Invalid document id.");
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(request, supabase);
-    const { data: document, error } = await supabase
-      .from("documents")
-      .select("*")
-      .eq("id", id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const access = await publicAccessContext(request, supabase);
+    const { data: document, error } = await withOwnerReadScope(
+      supabase.from("documents").select("*").eq("id", id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (error) throw new Error(error.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });
diff --git a/src/app/api/documents/[id]/search/route.ts b/src/app/api/documents/[id]/search/route.ts
index 4ab60b1ed..d153f9859 100644
--- a/src/app/api/documents/[id]/search/route.ts
+++ b/src/app/api/documents/[id]/search/route.ts
@@ -5,7 +5,8 @@ import { isDemoMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
 import { committedIndexGeneration, isCommittedGenerationMetadata } from "@/lib/reindex-pipeline";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 import { parseRouteParams } from "@/lib/validation/params";
 import { parseRequestQuery, queryInteger } from "@/lib/validation/query";
 
@@ -181,13 +182,11 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
 
     const { id } = parseRouteParams({ id: rawId }, documentSearchParamsSchema, "Invalid document id.");
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(request, supabase);
-    const { data: document, error: documentError } = await supabase
-      .from("documents")
-      .select("id,metadata")
-      .eq("id", id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const access = await publicAccessContext(request, supabase);
+    const { data: document, error: documentError } = await withOwnerReadScope(
+      supabase.from("documents").select("id,metadata").eq("id", id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (documentError) throw new Error(documentError.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });
@@ -197,7 +196,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
       p_document_id: id,
       p_query: query,
       match_count: limit,
-      p_owner_id: user.id,
+      p_owner_id: access.ownerId,
     });
 
     if (!rpcError) {
diff --git a/src/app/api/documents/[id]/signed-url/route.ts b/src/app/api/documents/[id]/signed-url/route.ts
index 043d01118..5dd6dc8ea 100644
--- a/src/app/api/documents/[id]/signed-url/route.ts
+++ b/src/app/api/documents/[id]/signed-url/route.ts
@@ -5,7 +5,8 @@ import { env } from "@/lib/env";
 import { isDemoMode } from "@/lib/env";
 import { jsonError, PublicApiError } from "@/lib/http";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 
 export const runtime = "nodejs";
 
@@ -31,13 +32,11 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (!routeIdSchema.safeParse(id).success) throw new PublicApiError("Invalid document id.");
 
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(_request, supabase);
-    const { data: document, error } = await supabase
-      .from("documents")
-      .select("storage_path,file_type")
-      .eq("id", id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const access = await publicAccessContext(_request, supabase);
+    const { data: document, error } = await withOwnerReadScope(
+      supabase.from("documents").select("storage_path,file_type").eq("id", id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (error) throw new Error(error.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });
diff --git a/src/app/api/documents/route.ts b/src/app/api/documents/route.ts
index 52814c3a6..8fa0958be 100644
--- a/src/app/api/documents/route.ts
+++ b/src/app/api/documents/route.ts
@@ -4,7 +4,8 @@ import { demoDocuments } from "@/lib/demo-data";
 import { isDemoMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 import { parseRequestQuery, queryBoolean, queryInteger } from "@/lib/validation/query";
 
 export const runtime = "nodejs";
@@ -130,11 +131,11 @@ export async function GET(request: Request) {
     } = parseRequestQuery(request, documentListQuerySchema, "Invalid document list query.");
 
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(request, supabase);
-    let query = supabase
-      .from("documents")
-      .select(DOCUMENT_LIST_COLUMNS, { count: "exact" })
-      .eq("owner_id", user.id)
+    const access = await publicAccessContext(request, supabase);
+    let query = withOwnerReadScope(
+      supabase.from("documents").select(DOCUMENT_LIST_COLUMNS, { count: "exact" }),
+      access.ownerId,
+    )
       .order("created_at", { ascending: false })
       .range(offset, offset + limit - 1);
 
diff --git a/src/app/api/images/[id]/signed-url/route.ts b/src/app/api/images/[id]/signed-url/route.ts
index b061aaf8a..9ca925d49 100644
--- a/src/app/api/images/[id]/signed-url/route.ts
+++ b/src/app/api/images/[id]/signed-url/route.ts
@@ -6,7 +6,8 @@ import { isDemoMode } from "@/lib/env";
 import { jsonError, PublicApiError } from "@/lib/http";
 import { committedIndexGeneration, isCommittedGenerationMetadata } from "@/lib/reindex-pipeline";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 
 export const runtime = "nodejs";
 
@@ -31,7 +32,7 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (!routeIdSchema.safeParse(id).success) throw new PublicApiError("Invalid image id.");
 
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(_request, supabase);
+    const access = await publicAccessContext(_request, supabase);
     const { data: image, error } = await supabase
       .from("document_images")
       .select("document_id,storage_path,mime_type,caption,metadata")
@@ -41,12 +42,10 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (error) throw new Error(error.message);
     if (!image) return NextResponse.json({ error: "Image not found." }, { status: 404 });
 
-    const { data: document, error: documentError } = await supabase
-      .from("documents")
-      .select("id,metadata")
-      .eq("id", image.document_id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const { data: document, error: documentError } = await withOwnerReadScope(
+      supabase.from("documents").select("id,metadata").eq("id", image.document_id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (documentError) throw new Error(documentError.message);
     if (!document) return NextResponse.json({ error: "Image not found." }, { status: 404 });
diff --git a/src/app/api/registry/records/[slug]/route.ts b/src/app/api/registry/records/[slug]/route.ts
index bfa21c873..a966ab37a 100644
--- a/src/app/api/registry/records/[slug]/route.ts
+++ b/src/app/api/registry/records/[slug]/route.ts
@@ -4,7 +4,7 @@ import { z } from "zod";
 import { consumeSubjectApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
-import { publicAccessContext } from "@/lib/public-api-access";
+import { hasPublicApiAuthSignal, publicAccessContext } from "@/lib/public-api-access";
 import { getFormRecord } from "@/lib/forms";
 import {
   deriveGovernanceColumns,
@@ -62,6 +62,15 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
       });
     }
 
+    if (!hasPublicApiAuthSignal(request)) {
+      const payload = publicRegistryDetailPayload(kind, normalizedSlug);
+      if (!payload) return notFoundResponse(normalizedSlug);
+      return registryResponse({
+        ...payload,
+        publicAccess: true,
+      });
+    }
+
     const supabase = createAdminClient();
     const access = await publicAccessContext(request, supabase);
 
diff --git a/src/app/api/registry/records/route.ts b/src/app/api/registry/records/route.ts
index 5897a1525..ab07badfb 100644
--- a/src/app/api/registry/records/route.ts
+++ b/src/app/api/registry/records/route.ts
@@ -4,7 +4,7 @@ import { z } from "zod";
 import { consumeSubjectApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
-import { publicAccessContext } from "@/lib/public-api-access";
+import { hasPublicApiAuthSignal, publicAccessContext } from "@/lib/public-api-access";
 import { rankFormRecords, formRecords } from "@/lib/forms";
 import {
   deriveGovernanceColumns,
@@ -78,6 +78,13 @@ export async function GET(request: Request) {
       });
     }
 
+    if (!hasPublicApiAuthSignal(request)) {
+      return registryResponse({
+        ...publicRegistryPayload(kind, q, limit),
+        publicAccess: true,
+      });
+    }
+
     const supabase = createAdminClient();
     const access = await publicAccessContext(request, supabase);
 
diff --git a/src/components/ClinicalDashboard.tsx b/src/components/ClinicalDashboard.tsx
index 2545d2b24..eb89aa177 100644
--- a/src/components/ClinicalDashboard.tsx
+++ b/src/components/ClinicalDashboard.tsx
@@ -1,18 +1,15 @@
 "use client";
 
-import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";
 import dynamic from "next/dynamic";
 import {
   AlertCircle,
   Bell,
   BookOpen,
-  CheckCircle2,
   ChevronDown,
   ChevronRight,
   CircleUserRound,
   Clock3,
-  Copy,
   ExternalLink,
   FileImage,
   FileText,
@@ -21,7 +18,6 @@ import {
   HelpCircle,
   Heart,
   Keyboard,
-  Layers,
   ListChecks,
   Loader2,
   LogOut,
@@ -29,7 +25,6 @@ import {
   LockKeyhole,
   Palette,
   PanelTop,
-  Plus,
   Quote,
   RefreshCw,
   Search,
@@ -45,69 +40,32 @@ import {
   Wrench,
   X,
 } from "lucide-react";
-import {
-  type CSSProperties,
-  type FormEvent,
-  type RefObject,
-  useCallback,
-  useEffect,
-  useMemo,
-  useRef,
-  useState,
-} from "react";
-import { AccessibleTable } from "@/components/AccessibleTable";
-import {
-  DocumentOrganizationBadges,
-  documentDisplayTitle,
-  documentOrganizationProfile,
-} from "@/components/DocumentOrganizationBadges";
-import { DocumentTagCloud } from "@/components/DocumentTagCloud";
-import { DocumentManagementActions, type DocumentDeleteResult } from "@/components/DocumentManagementActions";
+import { type CSSProperties, type FormEvent, useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { type DocumentDeleteResult } from "@/components/DocumentManagementActions";
 import { useDismissableLayer } from "@/components/use-dismissable-layer";
-import { formatCompactCitationLabel } from "@/lib/citations";
 import { extractSafetyFindings } from "@/lib/clinical-safety";
 import { readLocalProjectIdentity, unsafeLocalProjectMessage } from "@/lib/local-project-identity";
 import { isLocalNoAuthMode } from "@/lib/env";
 import {
   appBackdrop,
   answerSurface,
-  chatMicroAction,
-  clinicalDivider,
   cn,
-  EmptyState,
-  fieldControlPlain,
   fieldControlWithIcon,
   fieldIcon,
   floatingControl,
-  iconTilePremium,
-  metadataPill,
-  panelSubtle,
   primaryControl,
-  SourceProvenance,
-  SourceStatusBadge,
-  sourceCard,
-  subtleStatusPill,
-  tableCard,
-  tableCardHeader,
-  tableMicroActionRow,
   textMuted,
-  toneDanger,
-  toneInfo,
-  toneNeutral,
   toneSuccess,
   toneWarning,
 } from "@/components/ui-primitives";
 import { useAuthSession } from "@/lib/supabase/client";
-import { SafeBoldText } from "@/components/SafeBoldText";
 import { Sheet } from "@/components/ui/sheet";
 import { AccountSetupDialog } from "@/components/clinical-dashboard/account-setup-dialog";
 import { StagedAnswerResultSurface } from "@/components/clinical-dashboard/answer-result-surface";
 import { RelatedDocumentsPanel } from "@/components/clinical-dashboard/document-results";
-import { AnswerFollowUpSuggestions } from "@/components/clinical-dashboard/answer-follow-up-suggestions";
 import { AuthPanel } from "@/components/clinical-dashboard/auth-panel";
 import { useSidebarCollapsed } from "@/components/clinical-dashboard/use-sidebar-collapsed";
 import { useTheme } from "@/components/clinical-dashboard/use-theme";
-import { StatusBadge } from "@/components/clinical-dashboard/badges";
 import {
   type SidebarIdentity,
   deriveSidebarIdentity,
@@ -126,45 +84,18 @@ import {
   type SetupCheck,
   type IngestionQualityReviewItem,
 } from "@/components/clinical-dashboard/DocumentManagerPanel";
-import {
-  GuideDialog,
-  GuideTrigger,
-  SectionHeading,
-  UtilityDrawer,
-} from "@/components/clinical-dashboard/dashboard-shell";
-import {
-  cleanDisplayTitle,
-  sanitizeAnswerDisplayText,
-  sanitizeDisplayText,
-} from "@/components/clinical-dashboard/display-text";
+import { GuideDialog, GuideTrigger, UtilityDrawer } from "@/components/clinical-dashboard/dashboard-shell";
+import { sanitizeAnswerDisplayText, sanitizeDisplayText } from "@/components/clinical-dashboard/display-text";
 import {
   NaturalLanguageAnswer,
   ScopeAndGovernanceNotice,
-  SourceImage,
   UserQuestionBubble,
 } from "@/components/clinical-dashboard/answer-content";
 import { AnswerEmptyState, AnswerSkeleton } from "@/components/clinical-dashboard/answer-status";
-import {
-  AnswerFeedbackPanel,
-  AnswerSafetyNotice,
-  AnswerSupportSummaryCard,
-  answerHasCentralTable,
-  answerSupportPriority,
-  ClinicalNotesChecklistPanel,
-  clinicalNotesCount,
-  clinicalNotesDisplayCountForAnswer,
-  compactEvidenceSummary,
-  type EvidenceTabName,
-  simpleClinicalTableProps,
-  evidenceMapRowsFromRenderModel,
-  evidenceTabCount,
-  evidenceTabOrder,
-  QuoteCards,
-  SafetyFindingsListContent,
-} from "@/components/clinical-dashboard/evidence-panels";
+import { evidenceMapRowsFromRenderModel } from "@/components/clinical-dashboard/evidence-panels";
 import { MasterSearchHeader } from "@/components/clinical-dashboard/master-search-header";
 import { SearchCommandProvider } from "@/components/clinical-dashboard/search-command-context";
-import { emptyStates, errorCopy } from "@/lib/ui-copy";
+import { errorCopy } from "@/lib/ui-copy";
 import { applicationsLauncherItemCount } from "@/components/applications-launcher-page";
 import {
   DrawerGroupLabel,
@@ -198,7 +129,7 @@ const DocumentDrawer = dynamic(
 );
 
 import { DocumentSearchResultsPanel, type SearchFacets } from "@/components/clinical-dashboard/document-search-results";
-import { isWeakRelevance, QueryCoverageChips } from "@/components/clinical-dashboard/relevance";
+import { isWeakRelevance } from "@/components/clinical-dashboard/relevance";
 import {
   answerPayloadIsUsable,
   isRetryableError,
@@ -236,21 +167,13 @@ import {
   maxStoredAnswerTurns,
   savePersistedAnswerThread,
 } from "@/lib/answer-thread-storage";
-import { buildAnswerRenderModel, type AnswerRenderModel } from "@/lib/answer-render-policy";
-import { sourceTextForCompactDisplay } from "@/lib/source-text-sanitizer";
+import { buildAnswerRenderModel } from "@/lib/answer-render-policy";
 import {
   frontendSourceGovernanceWarnings,
   groupSourceGovernanceWarnings,
   type SourceGovernanceWarning,
 } from "@/lib/source-governance";
-import { smartEvidenceTags } from "@/lib/evidence-tags";
-import {
-  tagSearchText,
-  type SmartDocumentTag,
-  type SmartDocumentTagFacet,
-  type SmartDocumentTagTier,
-  type SmartDocumentTagQualityIssueKind,
-} from "@/lib/document-tags";
+import { type SmartDocumentTag, type SmartDocumentTagFacet } from "@/lib/document-tags";
 import type {
   ClinicalDocument,
   DocumentMatch,
@@ -263,19 +186,12 @@ import type {
   RelatedDocument,
   SearchResult,
   SearchScopeSummary,
-  VisualEvidenceCard,
   ClinicalQueryMode,
   DocumentLabel,
-  DocumentLabelType,
 } from "@/lib/types";
 import type { SearchScopeFilters } from "@/lib/search-scope";
 import { differentialsMobileCompareAddonSlotId, modeHomeDesktopComposerSlotId } from "@/lib/mode-home-composer";
-import {
-  createQuoteFollowUp,
-  type AnswerEvidenceMapRow,
-  type AnswerViewMode,
-  shouldPollForUpdates,
-} from "@/lib/ward-output";
+import { createQuoteFollowUp, type AnswerViewMode, shouldPollForUpdates } from "@/lib/ward-output";
 
 export const navigationHashes = ["#search", "#quotes", "#images", "#sources"] as const;
 export const mobileSectionFabMediaQuery =
@@ -487,367 +403,6 @@ async function readAnswerStream(response: Response, onProgress: (message: string
 function normalizeNavigationHash(hash: string) {
   return navigationHashes.includes(hash as (typeof navigationHashes)[number]) ? hash : "#search";
 }
-
-function compactClinicalTableCaption(item: VisualEvidenceCard) {
-  const raw = item.tableTitle || item.tableLabel || item.caption || "Clinical table";
-  const cleaned = sourceTextForCompactDisplay(raw)
-    .replace(/\btable\s+\d+\s*[:.-]?\s*/i, "")
-    .replace(/\b(?:page|p\.)\s*\d+\b/gi, "")
-    .replace(/\s{2,}/g, " ")
-    .trim();
-  const caption = cleaned || "Clinical table";
-  return caption.length <= 72 ? caption : `${caption.slice(0, 69).trim()}...`;
-}
-
-function visualEvidenceHeader(item: VisualEvidenceCard) {
-  const titleSource = [item.tableLabel, item.tableTitle].filter(Boolean).join(" · ");
-  const titleText = sourceTextForCompactDisplay(titleSource).trim();
-  const captionText = sourceTextForCompactDisplay(item.caption ?? "").trim();
-  const normalizedTitle = titleText.toLowerCase();
-  const normalizedCaption = captionText.toLowerCase();
-  const isDuplicateCaption =
-    Boolean(normalizedCaption) &&
-    (normalizedCaption.startsWith(normalizedTitle) || normalizedCaption === normalizedTitle);
-  return {
-    title: titleText || captionText || "Visual evidence",
-    caption: isDuplicateCaption ? null : captionText,
-  };
-}
-
-function VisualEvidenceStrip({
-  evidence,
-  collapsed = false,
-  embedded = false,
-}: {
-  evidence: VisualEvidenceCard[];
-  collapsed?: boolean;
-  embedded?: boolean;
-}) {
-  function looksLikeTableText(value?: string | null) {
-    return Boolean(value?.includes("|") && value.split("|").filter((cell) => cell.trim()).length >= 3);
-  }
-
-  if (collapsed) {
-    return (
-      <section id="images" className="space-y-3 scroll-mt-4 sm:scroll-mt-6">
-        <UtilityDrawer
-          icon={FileImage}
-          title="Nearby visual evidence"
-          summary="Nearby source support only."
-          mobileSummary={`${evidence.length} visuals`}
-        >
-          <VisualEvidenceStrip evidence={evidence} embedded />
-        </UtilityDrawer>
-      </section>
-    );
-  }
-
-  const content = (
-    <>
-      <SectionHeading
-        icon={FileImage}
-        title="Tables and diagrams"
-        description="Clinical tables, diagrams, and images from indexed documents."
-        hideDescriptionOnMobile
-        compactMobile
-      />
-      {evidence.length === 0 ? (
-        <EmptyState icon={FileImage} title={emptyStates.indexedVisuals.title} body={emptyStates.indexedVisuals.body} />
-      ) : (
-        <div className="grid gap-3 md:grid-cols-2">
-          {evidence.map((item) => {
-            const tableMarkdown = item.accessibleTableMarkdown?.trim()
-              ? item.accessibleTableMarkdown
-              : looksLikeTableText(item.tableTextSnippet)
-                ? item.tableTextSnippet
-                : null;
-            const hasStructuredTable = Boolean(tableMarkdown || item.tableRows?.length || item.tableColumns?.length);
-            const tableCaption = compactClinicalTableCaption(item);
-            const sourceHeader = visualEvidenceHeader(item);
-            const displayLabels = smartEvidenceTags(
-              item.labels,
-              [[item.tableLabel, item.tableTitle].filter(Boolean).join(": "), item.caption, item.tableTextSnippet]
-                .filter(Boolean)
-                .join(" "),
-            );
-            return (
-              <figure key={item.id} className={cn(sourceCard, "overflow-hidden p-2.5 sm:p-3")}>
-                <div className="rounded-lg bg-[color:var(--surface-inset)] p-2.5 sm:p-3">
-                  <SourceImage
-                    endpoint={item.signed_url_endpoint}
-                    caption={sourceHeader.caption || sourceHeader.title}
-                  />
-                </div>
-                <figcaption className="mt-2 space-y-1.5 text-[15px] leading-6 text-[color:var(--text)] sm:mt-3">
-                  {!hasStructuredTable ? <p className="font-semibold">{sourceHeader.title}</p> : null}
-                  {!hasStructuredTable && sourceHeader.caption ? <p>{sourceHeader.caption}</p> : null}
-                  <AccessibleTable
-                    caption={tableCaption}
-                    markdown={tableMarkdown}
-                    rows={item.tableRows}
-                    columns={item.tableColumns}
-                    {...simpleClinicalTableProps}
-                    clinicalOnly
-                    dialogTitle={tableCaption || "Clinical table"}
-                  />
-                  {!hasStructuredTable && item.tableTextSnippet ? (
-                    <p className={cn("line-clamp-3 text-sm leading-6", textMuted)}>
-                      {sourceTextForCompactDisplay(item.tableTextSnippet)}
-                    </p>
-                  ) : null}
-                  {displayLabels.length ? (
-                    <div className="flex flex-wrap gap-1.5">
-                      {displayLabels.map((label) => (
-                        <span key={`${item.id}:${label}`} className={cn(metadataPill, "min-h-6 px-2 text-[10px]")}>
-                          {label}
-                        </span>
-                      ))}
-                    </div>
-                  ) : null}
-                </figcaption>
-                <div
-                  className={cn(
-                    "mt-2 flex flex-wrap items-center justify-between gap-2 pt-3 text-xs sm:mt-3 sm:gap-3",
-                    clinicalDivider,
-                  )}
-                >
-                  <span className={cn("text-[15px] font-semibold leading-6 sm:hidden", textMuted)}>
-                    {formatCompactCitationLabel(item)}
-                  </span>
-                  <span className={cn("hidden text-xs font-semibold leading-5 sm:inline", textMuted)}>
-                    {cleanDisplayTitle(item.title)}, page {item.page_number ?? "n/a"}
-                  </span>
-                  {item.image_type && (
-                    <span className={cn(metadataPill, "min-h-7 px-2 text-[11px]")}>
-                      {item.image_type.replaceAll("_", " ")}
-                    </span>
-                  )}
-                  {!hasStructuredTable ? <QueryCoverageChips relevance={item.relevance} limit={2} /> : null}
-                  <Link href={item.viewer_href} className={cn(floatingControl, "min-h-[44px] px-4 text-xs")}>
-                    <ExternalLink className="h-4 w-4" />
-                    Open source
-                  </Link>
-                </div>
-              </figure>
-            );
-          })}
-        </div>
-      )}
-    </>
-  );
-
-  if (embedded) return <div className="space-y-3">{content}</div>;
-
-  return (
-    <section id="images" className="space-y-3 scroll-mt-4 sm:scroll-mt-6">
-      {content}
-    </section>
-  );
-}
-
-const evidenceTabIconMap: Record<EvidenceTabName, typeof Layers> = {
-  Claims: CheckCircle2,
-  Quotes: Quote,
-  Tables: ListChecks,
-  Images: FileImage,
-  Gaps: AlertCircle,
-};
-
-function supportDotClass(supportLevel: string) {
-  const normalized = supportLevel.toLowerCase();
-  if (normalized.includes("unsupported") || normalized.includes("none")) return "bg-[color:var(--danger)]";
-  if (normalized.includes("partial") || normalized.includes("limited") || normalized.includes("nearby")) {
-    return "bg-[color:var(--warning)]";
-  }
-  return "bg-[color:var(--clinical-accent)]";
-}
-
-function supportLabel(supportLevel: string) {
-  const normalized = supportLevel.toLowerCase();
-  if (normalized.includes("unsupported") || normalized.includes("none")) return "Unsupported";
-  if (normalized.includes("partial") || normalized.includes("limited") || normalized.includes("nearby"))
-    return "Partial";
-  return "Direct";
-}
-
-function claimRowsForEvidencePanel(rows: AnswerEvidenceMapRow[], renderModel: AnswerRenderModel) {
-  if (rows.length) return rows.slice(0, 6);
-  return renderModel.primarySources.slice(0, 6).map((source, index) => ({
-    id: source.id,
-    section: source.label || cleanDisplayTitle(source.title || source.file_name) || `Source ${index + 1}`,
-    detail: source.snippet || source.reason || "Open source passage to review the cited evidence.",
-    supportLevel: source.sourceStrength === "none" ? "partial" : source.sourceStrength,
-    citationCount: 1,
-    sourceStatus:
-      source.sourceStrength === "none" ? "Source requires review" : `${source.sourceStrength} source support`,
-    bestSourceLabel: source.label,
-    bestLinkedPassage: source.snippet || source.reason,
-    href: source.href,
-  }));
-}
-
-function EvidenceClaimsList({ rows, renderModel }: { rows: AnswerEvidenceMapRow[]; renderModel: AnswerRenderModel }) {
-  const claimRows = claimRowsForEvidencePanel(rows, renderModel);
-  const directCount = claimRows.filter((row) => supportLabel(row.supportLevel) === "Direct").length;
-  const partialCount = claimRows.filter((row) => supportLabel(row.supportLevel) === "Partial").length;
-
-  if (!claimRows.length) {
-    return <EmptyState icon={BookOpen} title={emptyStates.evidenceMap.title} body={emptyStates.evidenceMap.body} />;
-  }
-
-  return (
-    <div data-testid="evidence-claims-panel" className="space-y-3">
-      <div className="flex min-w-0 items-center justify-between gap-3">
-        <div>
-          <p className="text-sm font-semibold text-[color:var(--text-heading)]">Claims checked</p>
-          <div className="mt-2 flex flex-wrap items-center gap-3 text-xs font-semibold text-[color:var(--text-muted)]">
-            <span className="inline-flex items-center gap-1.5">
-              <span className="h-2.5 w-2.5 rounded-full bg-[color:var(--clinical-accent)]" />
-              Direct
-            </span>
-            <span className="inline-flex items-center gap-1.5">
-              <span className="h-2.5 w-2.5 rounded-full bg-[color:var(--warning)]" />
-              Partial
-            </span>
-            <span className="inline-flex items-center gap-1.5">
-              <span className="h-2.5 w-2.5 rounded-full bg-[color:var(--danger)]" />
-              Unsupported
-            </span>
-          </div>
-        </div>
-        <p className="shrink-0 text-xs font-semibold text-[color:var(--text-muted)]">
-          {directCount} direct <span className="mx-1">·</span> {partialCount} partial
-        </p>
-      </div>
-
-      <div className="overflow-hidden rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)]">
-        {claimRows.map((row, index) => (
-          <Link
-            key={`${row.id}:${index}`}
-            href={row.href ?? "#"}
-            data-testid={row.href ? "evidence-map-open-source" : undefined}
-            aria-disabled={!row.href}
-            className={cn(
-              "grid min-h-[76px] grid-cols-[auto_auto_minmax(0,1fr)_auto] items-center gap-3 border-b border-[color:var(--border)] px-3 py-3 text-left last:border-b-0 transition hover:bg-[color:var(--surface-subtle)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-[color:var(--focus)]",
-              !row.href && "pointer-events-none",
-            )}
-            aria-label={`Open source for ${row.section}`}
-          >
-            <span className="grid h-7 w-7 place-items-center rounded-full border border-[color:var(--border)] bg-[color:var(--surface-raised)]" />
-            <span className={cn("h-2.5 w-2.5 rounded-full", supportDotClass(row.supportLevel))} />
-            <span className="min-w-0">
-              <span className="block text-sm font-semibold text-[color:var(--text-heading)]">{row.section}</span>
-              <span className={cn("mt-1 line-clamp-2 block text-xs leading-5", textMuted)}>
-                {row.detail || row.bestLinkedPassage || row.bestSourceLabel}
-              </span>
-            </span>
-            <ChevronDown className="h-4 w-4 -rotate-90 text-[color:var(--text-muted)]" />
-          </Link>
-        ))}
-      </div>
-    </div>
-  );
-}
-
-function EvidenceGapsPanel({ warnings }: { warnings: string[] }) {
-  if (!warnings.length) {
-    return (
-      <EmptyState icon={CheckCircle2} title="No evidence gaps" body="No source gaps were attached to this answer." />
-    );
-  }
-
-  return (
-    <div className="grid gap-2">
-      {warnings.map((warning, index) => (
-        <article
-          key={`${warning}:${index}`}
-          className="grid grid-cols-[auto_minmax(0,1fr)] gap-3 rounded-lg border border-[color:var(--warning-border)] bg-[color:var(--warning-soft)]/45 p-3"
-        >
-          <AlertCircle className="mt-0.5 h-5 w-5 shrink-0 text-[color:var(--warning)]" />
-          <div className="min-w-0">
-            <p className="text-sm font-semibold text-[color:var(--warning)]">Gap {index + 1}</p>
-            <p className="mt-1 text-sm leading-6 text-[color:var(--text)]">{warning}</p>
-          </div>
-        </article>
-      ))}
-    </div>
-  );
-}
-
-function MobileEvidenceTabPanel({
-  tab,
-  renderModel,
-  visualEvidence,
-  answerEvidenceMapRows,
-  copiedQuotes,
-  onCopyQuotes,
-  onFollowUpQuote,
-  onScopeDocument,
-}: {
-  tab: EvidenceTabName;
-  renderModel: AnswerRenderModel;
-  visualEvidence: VisualEvidenceCard[];
-  answerEvidenceMapRows: AnswerEvidenceMapRow[];
-  copiedQuotes: boolean;
-  onCopyQuotes: () => void;
-  onFollowUpQuote?: (quote: QuoteCard) => void;
-  onScopeDocument: (documentId: string) => void;
-}) {
-  if (tab === "Claims") {
-    return <EvidenceClaimsList rows={answerEvidenceMapRows} renderModel={renderModel} />;
-  }
-
-  if (tab === "Tables") {
-    const tableEvidence = visualEvidence.filter((item) => item.accessibleTableMarkdown || item.tableRows?.length);
-    return tableEvidence.length ? (
-      <div className="grid gap-2">
-        {tableEvidence.slice(0, 4).map((item, index) => (
-          <article key={item.id} className={cn(sourceCard, "grid grid-cols-[auto_minmax(0,1fr)_auto] gap-3 p-3")}>
-            <span className={iconTilePremium}>
-              <ListChecks className="h-4 w-4" />
-            </span>
-            <div className="min-w-0">
-              <p className="line-clamp-2 text-sm font-semibold text-[color:var(--text-heading)]">
-                {compactClinicalTableCaption(item)}
-              </p>
-              <p className={cn("mt-1 text-xs", textMuted)}>
-                Table {index + 1} · p.{item.page_number ?? "n/a"}
-              </p>
-            </div>
-            <Link href={item.viewer_href} className={chatMicroAction} aria-label={`Open table source ${index + 1}`}>
-              <ExternalLink className="h-3.5 w-3.5" />
-            </Link>
-          </article>
-        ))}
-      </div>
-    ) : (
-      <EmptyState icon={ListChecks} title={emptyStates.tablesUsed.title} body={emptyStates.tablesUsed.body} />
-    );
-  }
-
-  if (tab === "Images") {
-    return visualEvidence.length ? (
-      <VisualEvidenceStrip evidence={visualEvidence} embedded />
-    ) : (
-      <EmptyState icon={FileImage} title={emptyStates.imagesUsed.title} body={emptyStates.imagesUsed.body} />
-    );
-  }
-
-  if (tab === "Quotes") {
-    return (
-      <QuoteCards
-        quotes={renderModel.quoteCards}
-        copiedQuotes={copiedQuotes}
-        onCopyQuotes={onCopyQuotes}
-        onFollowUp={onFollowUpQuote}
-        onScopeDocument={onScopeDocument}
-      />
-    );
-  }
-
-  return <EvidenceGapsPanel warnings={renderModel.warnings} />;
-}
-
 /**
  * A completed Q&A exchange kept on screen after a newer answer arrives, so
  * Answer mode reads as a conversation thread instead of replacing each result.
@@ -4009,17 +3564,17 @@ export function ClinicalDashboard({
   const showDegradedNotice = !isOnline || apiUnavailable;
   const hasMobileBottomSearch = searchMode !== "answer";
   const showDesktopHomeComposer =
-    !loading &&
     !error &&
-    ((activeModeResultKind === "answer" && !answer && !modeSearchSubmitted) ||
-      (searchMode === "documents" &&
-        activeModeResultKind === "documents" &&
-        documentMatches.length === 0 &&
-        !modeSearchSubmitted) ||
-      (searchMode === "prescribing" && activeModeResultKind === "documents" && !modeSearchSubmitted) ||
-      (activeModeResultKind === "differentials" && !modeSearchSubmitted) ||
+    (activeModeResultKind === "tools" ||
       activeModeResultKind === "favourites" ||
-      activeModeResultKind === "tools");
+      (!loading &&
+        ((activeModeResultKind === "answer" && !answer && !modeSearchSubmitted) ||
+          (searchMode === "documents" &&
+            activeModeResultKind === "documents" &&
+            documentMatches.length === 0 &&
+            !modeSearchSubmitted) ||
+          (searchMode === "prescribing" && activeModeResultKind === "documents" && !modeSearchSubmitted) ||
+          (activeModeResultKind === "differentials" && !modeSearchSubmitted))));
   const desktopHomeComposerSlotId = showDesktopHomeComposer ? modeHomeDesktopComposerSlotId : undefined;
   // Favourites and Tools are content-rich hubs: they share the centred hero but
   // stay top-aligned so their lists start in a stable position.
@@ -4037,6 +3592,7 @@ export function ClinicalDashboard({
   const compactMobileBottomSearch = hasMobileBottomSearch && modeSearchSubmitted;
   const differentialsCompareAddonActive =
     searchMode === "differentials" && modeSearchSubmitted && Boolean(query.trim());
+  const isDeployedApp = process.env.NODE_ENV === "production";
   const renderDegradedNotice = () => (
     <UtilityDrawer
       icon={!isOnline ? WifiOff : AlertCircle}
@@ -4044,14 +3600,18 @@ export function ClinicalDashboard({
       summary={
         !isOnline
           ? "Your browser is offline. Existing content may remain visible, but private search and uploads need network access."
-          : "The local API did not respond. Check the app server and setup status before retrying."
+          : isDeployedApp
+            ? "The app could not reach its API. Try again in a moment."
+            : "The local API did not respond. Check the app server and setup status before retrying."
       }
       mobileSummary={!isOnline ? "Offline" : "API unavailable"}
     >
       <p className="text-[15px] leading-6 text-[color:var(--warning)]">
         {!isOnline
           ? "Reconnect before uploading documents, refreshing source URLs, or generating answers."
-          : "The app will preserve the current view. Retry after confirming the local server, Supabase, OpenAI, and worker setup."}
+          : isDeployedApp
+            ? "The app will preserve the current view. If this keeps happening, check your connection and try again shortly."
+            : "The app will preserve the current view. Retry after confirming the local server, Supabase, OpenAI, and worker setup."}
       </p>
     </UtilityDrawer>
   );
diff --git a/src/components/DocumentViewer.tsx b/src/components/DocumentViewer.tsx
index bd4c4d222..8d875334f 100644
--- a/src/components/DocumentViewer.tsx
+++ b/src/components/DocumentViewer.tsx
@@ -1914,7 +1914,6 @@ export function DocumentViewer({
   const [documentSearchError, setDocumentSearchError] = useState<string | null>(null);
   const [reviewingTableFactId, setReviewingTableFactId] = useState<string | null>(null);
   const [isOnline, setIsOnline] = useState(true);
-  const [authLoadingTimedOut, setAuthLoadingTimedOut] = useState(false);
   const [localProjectReady, setLocalProjectReady] = useState(true);
   const [mobileActionsOpen, setMobileActionsOpen] = useState(false);
   const [useNativePdfViewer, setUseNativePdfViewer] = useState(() => getInitialPdfViewerMode().useNativePdfViewer);
@@ -1927,6 +1926,7 @@ export function DocumentViewer({
   const [serverDemoMode, setServerDemoMode] = useState(process.env.NEXT_PUBLIC_DEMO_MODE === "true");
   const localNoAuthMode = isLocalNoAuthMode();
   const clientDemoMode = localNoAuthMode || serverDemoMode;
+  const canViewSourceDocuments = localProjectReady;
   const canUsePrivateApis = localProjectReady && (clientDemoMode || authStatus === "authenticated");
 
   useEffect(() => {
@@ -2002,10 +2002,10 @@ export function DocumentViewer({
   }, [isConfigured]);
 
   useEffect(() => {
-    if (!canUsePrivateApis && authStatus === "loading") {
+    if (!canViewSourceDocuments && authStatus === "loading") {
       return () => undefined;
     }
-    if (!canUsePrivateApis) {
+    if (!canViewSourceDocuments) {
       return () => undefined;
     }
 
@@ -2141,7 +2141,7 @@ export function DocumentViewer({
   }, [
     authStatus,
     authorizationHeader,
-    canUsePrivateApis,
+    canViewSourceDocuments,
     clientDemoMode,
     documentId,
     chunkId,
@@ -2208,15 +2208,6 @@ export function DocumentViewer({
     };
   }, []);
 
-  useEffect(() => {
-    if (canUsePrivateApis || authStatus !== "loading") {
-      return () => undefined;
-    }
-
-    const timeout = window.setTimeout(() => setAuthLoadingTimedOut(true), 3000);
-    return () => window.clearTimeout(timeout);
-  }, [authStatus, canUsePrivateApis]);
-
   async function summarize() {
     if (!canSummarizeDocument) {
       setSummaryError("Load a source document before summarising.");
@@ -2247,15 +2238,8 @@ export function DocumentViewer({
     }
   }
 
-  const authViewerError =
-    !canUsePrivateApis && (authStatus !== "loading" || authLoadingTimedOut)
-      ? isConfigured
-        ? "Sign in to open private source documents."
-        : "Supabase browser authentication is not configured for private source documents."
-      : null;
-  const effectiveLoadingDocument = !canUsePrivateApis
-    ? authStatus === "loading" && !authLoadingTimedOut && loadingDocument
-    : loadingDocument;
+  const authViewerError = null;
+  const effectiveLoadingDocument = loadingDocument;
   const effectiveViewerError = authViewerError ?? viewerError;
   const viewerState = effectiveLoadingDocument
     ? "loading"
diff --git a/src/components/applications-launcher-page.tsx b/src/components/applications-launcher-page.tsx
index b47b1267a..a362bc811 100644
--- a/src/components/applications-launcher-page.tsx
+++ b/src/components/applications-launcher-page.tsx
@@ -906,12 +906,17 @@ export function ApplicationsLauncherWorkspace({
 }: ApplicationsLauncherWorkspaceProps) {
   const [uncontrolledQuery, setUncontrolledQuery] = useState("");
   const [activeFilter, setActiveFilter] = useState<LauncherFilter>("all");
-  const [selectedId, setSelectedId] = useState(() => initialToolId(controlledQuery));
   const isDashboardTools = variant === "dashboard-tools";
   const [detailOpen, setDetailOpen] = useState(!isDashboardTools && showDetailPanel === true);
   const copy = isDashboardTools ? dashboardToolsLauncherCopy : standaloneLauncherCopy;
   const query = controlledQuery ?? uncontrolledQuery;
   const normalizedQuery = query.trim().toLowerCase();
+  const queryDerivedId = useMemo(() => initialToolId(query), [query]);
+  const [selection, setSelection] = useState(() => ({
+    queryKey: (controlledQuery ?? "").trim().toLowerCase(),
+    id: initialToolId(controlledQuery),
+  }));
+  const selectedId = selection.queryKey === normalizedQuery ? selection.id : queryDerivedId;
 
   const filteredApps = useMemo(() => {
     return launcherApps.filter((app) => {
@@ -941,7 +946,7 @@ export function ApplicationsLauncherWorkspace({
   }
 
   function openTool(id: string) {
-    setSelectedId(id);
+    setSelection({ queryKey: normalizedQuery, id });
     setDetailOpen(true);
   }
 
diff --git a/src/components/clinical-dashboard/favourites-hub.tsx b/src/components/clinical-dashboard/favourites-hub.tsx
index c1b2835a3..68072f029 100644
--- a/src/components/clinical-dashboard/favourites-hub.tsx
+++ b/src/components/clinical-dashboard/favourites-hub.tsx
@@ -22,7 +22,6 @@ import {
   favouriteItems,
   favouriteSets,
   favouriteTabs,
-  favouriteTypeCount,
   type FavouriteItem,
   type FavouriteSet,
   type FavouriteTabId,
diff --git a/src/components/clinical-dashboard/visual-evidence.tsx b/src/components/clinical-dashboard/visual-evidence.tsx
index 2f84e2134..5dcca9e54 100644
--- a/src/components/clinical-dashboard/visual-evidence.tsx
+++ b/src/components/clinical-dashboard/visual-evidence.tsx
@@ -29,7 +29,6 @@ import {
   evidenceTabOrder,
   QuoteCards,
   simpleClinicalTableProps,
-  VerificationWorkspace,
 } from "@/components/clinical-dashboard/evidence-panels";
 import { QueryCoverageChips } from "@/components/clinical-dashboard/relevance";
 import {
diff --git a/src/components/services/services-navigator-page.tsx b/src/components/services/services-navigator-page.tsx
index ec53f934c..d07f9b17f 100644
--- a/src/components/services/services-navigator-page.tsx
+++ b/src/components/services/services-navigator-page.tsx
@@ -435,8 +435,10 @@ export function ServicesNavigatorPage() {
   const [localQuery, setLocalQuery] = useState(() => ({ urlQuery, value: initialQuery }));
   const query = localQuery.urlQuery === urlQuery ? localQuery.value : initialQuery;
   const registry = useRegistryRecords("service");
-  const searchableRecords =
-    registry.status === "ready" ? registry.records : registry.status === "loading" ? [] : serviceRecords;
+  const searchableRecords = useMemo(
+    () => (registry.status === "ready" ? registry.records : registry.status === "loading" ? [] : serviceRecords),
+    [registry.records, registry.status],
+  );
   const matches = useMemo(() => {
     const ranked = rankServiceRecords(searchableRecords, query);
     return ranked.length ? ranked.map((match) => match.service) : query.trim() ? [] : searchableRecords;
diff --git a/src/lib/public-api-access.ts b/src/lib/public-api-access.ts
index 26b80f3fc..8ae3473e1 100644
--- a/src/lib/public-api-access.ts
+++ b/src/lib/public-api-access.ts
@@ -33,6 +33,17 @@ export function hasPublicApiAuthSignal(request: Request) {
   return cookieHeader.includes("sb-");
 }
 
+type OwnerScopedQuery<T> = {
+  eq(column: string, value: unknown): T;
+  is(column: string, value: null): T;
+};
+
+/** Scope document reads to the authenticated owner or public (owner_id IS NULL) rows. */
+export function withOwnerReadScope<T extends OwnerScopedQuery<T>>(query: T, ownerId: string | undefined): T {
+  if (ownerId) return query.eq("owner_id", ownerId);
+  return query.is("owner_id", null);
+}
+
 export async function publicAccessContext(request: Request, supabase: AdminClient) {
   const user = await getOptionalAuthenticatedUser(request, supabase);
   if (user) {
diff --git a/src/lib/rag.ts b/src/lib/rag.ts
index 6adea390f..e43a125e6 100644
--- a/src/lib/rag.ts
+++ b/src/lib/rag.ts
@@ -1456,6 +1456,7 @@ export function retrievalPlanCacheQuery(
     `mode:${modeKey(args)}`,
     `topK:${args.topK ?? 8}`,
     `min:${args.minSimilarity ?? 0.15}`,
+    `forceEmbedding:${args.forceEmbedding ? "1" : "0"}`,
     `rag:${ragDeepMemoryVersion}`,
     `force:${args.forceEmbedding ? 1 : 0}`,
   ].join("|");
@@ -1554,7 +1555,7 @@ type SharedCacheMissReason =
 function sharedCacheSelector(
   supabase: ReturnType<typeof createAdminClient>,
   kind: SharedCacheKind,
-  args: Pick<SearchChunksArgs, "query" | "documentId" | "documentIds" | "ownerId" | "queryMode">,
+  args: Pick<SearchChunksArgs, "query" | "documentId" | "documentIds" | "ownerId" | "queryMode" | "forceEmbedding">,
   indexingVersion: string,
   normalizedQuery: string = queryCacheKeyForStorage(normalizedCacheQuery(`${modeKey(args)} ${args.query}`)),
 ) {
@@ -1719,7 +1720,10 @@ async function getSharedCachedSearch(
 }
 
 async function getSharedCachedAnswer(
-  args: Pick<SearchChunksArgs, "query" | "documentId" | "documentIds" | "ownerId" | "skipCache" | "queryMode">,
+  args: Pick<
+    SearchChunksArgs,
+    "query" | "documentId" | "documentIds" | "ownerId" | "skipCache" | "queryMode" | "forceEmbedding"
+  >,
   startedAt: number,
 ) {
   if (args.skipCache || env.RAG_ANSWER_CACHE_TTL_MS <= 0) return null;
@@ -1752,7 +1756,7 @@ async function getSharedCachedAnswer(
 
 async function replaceSharedCacheRow(
   kind: SharedCacheKind,
-  args: Pick<SearchChunksArgs, "query" | "documentId" | "documentIds" | "ownerId" | "queryMode">,
+  args: Pick<SearchChunksArgs, "query" | "documentId" | "documentIds" | "ownerId" | "queryMode" | "forceEmbedding">,
   payload: unknown,
   ttlMs: number,
   normalizedQuery: string = queryCacheKeyForStorage(normalizedCacheQuery(`${modeKey(args)} ${args.query}`)),
@@ -1804,7 +1808,10 @@ function setSharedCachedSearch(
 }
 
 function setSharedCachedAnswer(
-  args: Pick<SearchChunksArgs, "query" | "documentId" | "documentIds" | "ownerId" | "skipCache" | "queryMode">,
+  args: Pick<
+    SearchChunksArgs,
+    "query" | "documentId" | "documentIds" | "ownerId" | "skipCache" | "queryMode" | "forceEmbedding"
+  >,
   answer: RagAnswer,
 ) {
   if (args.skipCache || env.RAG_ANSWER_CACHE_TTL_MS <= 0) return;
@@ -5386,6 +5393,9 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
   // When the provider is source-only (offline mode, or auto mode without a usable key) we must
   // never call OpenAI for embeddings; retrieval falls back to the lexical text-fast-path only.
   const sourceOnlyRetrieval = isSourceOnlyMode();
+  if (args.forceEmbedding && sourceOnlyRetrieval) {
+    throw new Error("forceEmbedding requires embedding-capable retrieval; source-only mode cannot exercise vectors.");
+  }
   // A3: shared across every withMemoryBoostedCandidates call in this request so the same
   // owner/query memory cards are fetched at most once per (query, embedding-present, count).
   const memoryCardCache: MemoryCardCache = new Map();
@@ -5463,7 +5473,10 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
     telemetry.shared_cache_miss_reason = sharedCached.reason;
   }
 
-  if (shouldApplyUnsupportedSearchShortCircuit(retrievalQuery, queryAnalysis, ragAliasExpansions)) {
+  if (
+    !args.forceEmbedding &&
+    shouldApplyUnsupportedSearchShortCircuit(retrievalQuery, queryAnalysis, ragAliasExpansions)
+  ) {
     // Item 10 follow-up (RC6): a typo can make an on-topic query ("schizophrenai management") look
     // unsupported and short-circuit before any layer runs. Before giving up, trigram-correct the
     // query against the known clinical-term vocabulary; if it changes, re-run the whole retrieval
@@ -5722,7 +5735,7 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
       telemetry,
     });
     const coverageGate = evaluateEvidenceCoverageGate(args.query, coverageGateResults, queryClassification.queryClass);
-    applyCoverageGateTelemetry(telemetry, coverageGate, coverageGate.accepted);
+    applyCoverageGateTelemetry(telemetry, coverageGate, !args.forceEmbedding && coverageGate.accepted);
     if (!args.forceEmbedding && coverageGate.accepted) {
       telemetry.retrieval_strategy = coverageGate.strategy;
       recordSearchScoreTelemetry(telemetry, coverageGateResults);
@@ -5752,7 +5765,7 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
     } catch (error) {
       // In auto mode a failed embedding call (e.g. quota exhausted) degrades to the lexical
       // results already gathered rather than failing the whole search. "openai" mode rethrows.
-      if (!allowsAutoDegrade()) throw error;
+      if (args.forceEmbedding || !allowsAutoDegrade()) throw error;
       telemetry.embedding_skipped = true;
       telemetry.embedding_skip_reason = sourceOnlyReason(error);
       telemetry.vector_skipped_reason = classifyProviderFailure(error);
@@ -5854,10 +5867,14 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
     latencyMs: hybridResult.latencyMs,
     topScore: layerTopScore((hybridData ?? []) as SearchResult[]),
   });
+  const vectorCandidates = mergeSearchResults(
+    mergeSearchResults((hybridData ?? []) as SearchResult[], embeddingFieldCandidates),
+    indexUnitCandidates,
+  );
 
   if (!hybridError) {
     const rerankStartedAt = Date.now();
-    const merged = mergeSearchResults((hybridData ?? []) as SearchResult[], textFastResults);
+    const merged = args.forceEmbedding ? vectorCandidates : mergeSearchResults(vectorCandidates, textFastResults);
     const mergedWithMetadata = await attachDocumentRankingMetadata(supabase, merged, args.ownerId);
     const memoryBoost = await withMemoryBoostedCandidates({
       supabase,
@@ -5918,7 +5935,7 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
       return (data ?? []) as SearchResult[];
     }),
   ).catch((error) => {
-    if (textFastResults.length > 0) return [] as SearchResult[][];
+    if (!args.forceEmbedding && textFastResults.length > 0) return [] as SearchResult[][];
     throw error;
   });
   const fallbackLatencyMs = Date.now() - fallbackRpcStartedAt;
@@ -5930,9 +5947,13 @@ export async function searchChunksWithTelemetry(args: SearchChunksArgs) {
   });
 
   const rerankStartedAt = Date.now();
+  const fallbackVectorCandidates = mergeSearchResults(
+    mergeSearchResults(resultSets.flat(), embeddingFieldCandidates),
+    indexUnitCandidates,
+  );
   const mergedWithMetadata = await attachDocumentRankingMetadata(
     supabase,
-    mergeSearchResults(resultSets.flat(), textFastResults),
+    args.forceEmbedding ? fallbackVectorCandidates : mergeSearchResults(fallbackVectorCandidates, textFastResults),
     args.ownerId,
   );
   const memoryBoost = await withMemoryBoostedCandidates({
diff --git a/src/lib/supabase/auth.ts b/src/lib/supabase/auth.ts
index db67f2cbe..044384b07 100644
--- a/src/lib/supabase/auth.ts
+++ b/src/lib/supabase/auth.ts
@@ -128,10 +128,10 @@ export async function getOptionalAuthenticatedUser(
   const token = extractSessionAccessToken(request);
   if (token) {
     const { data, error } = await supabase.auth.getUser(token);
-    if (error || !data.user?.id) {
-      throw new AuthenticationError();
+    if (!error && data.user?.id) {
+      return { id: data.user.id };
     }
-    return { id: data.user.id };
+    // Invalid or expired Bearer token: fall through to cookie session, then anonymous.
   }
 
   return getUserFromRequestCookies(request);
diff --git a/supabase/migrations/20260705180000_reconcile_search_health_indexes.sql b/supabase/migrations/20260705180000_reconcile_search_health_indexes.sql
new file mode 100644
index 000000000..21e0c281d
--- /dev/null
+++ b/supabase/migrations/20260705180000_reconcile_search_health_indexes.sql
@@ -0,0 +1,202 @@
+-- Reconcile live index drift reported by search_schema_health() on 2026-07-05.
+-- Creates canonical retrieval-support indexes that are missing on live (or only
+-- present under legacy names) and teaches search_schema_health() to accept
+-- verified functional equivalents so replays do not false-fail mid-rollout.
+
+set search_path = public, extensions, pg_catalog;
+
+create index if not exists documents_title_trgm_idx
+  on public.documents using gin (lower(coalesce(title, '') || ' ' || coalesce(file_name, '')) gin_trgm_ops);
+
+create index if not exists document_chunks_content_trgm_idx
+  on public.document_chunks using gin (lower(coalesce(section_heading, '') || ' ' || coalesce(content, '')) gin_trgm_ops);
+
+create index if not exists document_labels_label_trgm_idx
+  on public.document_labels using gin (lower(label) gin_trgm_ops);
+
+create index if not exists document_summaries_summary_trgm_idx
+  on public.document_summaries using gin (lower(summary) gin_trgm_ops);
+
+create index if not exists document_table_facts_owner_document_page_idx
+  on public.document_table_facts(owner_id, document_id, page_number);
+
+create index if not exists document_index_units_owner_chunk_type_idx
+  on public.document_index_units(owner_id, source_chunk_id, unit_type)
+  where source_chunk_id is not null;
+
+create index if not exists document_pages_document_idx
+  on public.document_pages(document_id, page_number);
+
+create index if not exists document_sections_document_idx
+  on public.document_sections(document_id, section_index);
+
+create index if not exists rag_retrieval_logs_owner_created_idx
+  on public.rag_retrieval_logs(owner_id, created_at desc);
+
+create index if not exists rag_retrieval_logs_miss_idx
+  on public.rag_retrieval_logs(is_miss, created_at desc)
+  where is_miss = true;
+
+create or replace function public.search_schema_health()
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = public, extensions, pg_catalog, pg_temp
+as $$
+declare
+  missing text[] := array[]::text[];
+  vector_type_oid oid;
+  vector_schema text;
+  index_name text;
+  legacy_ivfflat_indexes text[];
+  zero_vec extensions.vector(1536);
+  probe_text text := 'schema health probe zzznomatch';
+  hybrid_rpcs text[] := array[
+    'match_document_chunks_hybrid',
+    'match_document_index_units_hybrid',
+    'match_document_embedding_fields_hybrid',
+    'match_document_memory_cards_hybrid'
+  ];
+  rpc_name text;
+  required_indexes constant text[] := array[
+    'documents_title_trgm_idx',
+    'document_chunks_content_trgm_idx',
+    'document_labels_label_trgm_idx',
+    'document_summaries_summary_trgm_idx',
+    'document_chunks_embedding_hnsw_idx',
+    'document_embedding_fields_embedding_hnsw_idx',
+    'document_memory_cards_embedding_hnsw_idx',
+    'documents_indexed_owner_title_idx',
+    'document_table_facts_owner_document_page_idx',
+    'document_embedding_fields_owner_chunk_idx',
+    'document_index_units_owner_chunk_type_idx',
+    'document_table_facts_source_image_idx',
+    'document_pages_document_idx',
+    'document_sections_document_idx',
+    'document_chunks_document_idx',
+    'document_memory_cards_document_idx',
+    'document_embedding_fields_document_idx',
+    'document_table_facts_document_idx',
+    'document_index_units_document_idx',
+    'rag_retrieval_logs_owner_created_idx',
+    'rag_retrieval_logs_miss_idx',
+    'rag_retrieval_logs_strategy_idx'
+  ];
+  -- Verified live equivalents: same table/column intent, different migration-era name.
+  index_aliases constant jsonb := jsonb_build_object(
+    'documents_title_trgm_idx', jsonb_build_array('documents_title_search_tsv_idx', 'documents_title_search_idx'),
+    'document_chunks_content_trgm_idx', jsonb_build_array('document_chunks_search_tsv_idx', 'document_chunks_search_idx'),
+    'document_table_facts_owner_document_page_idx', jsonb_build_array('document_table_facts_owner_idx'),
+    'document_pages_document_idx', jsonb_build_array('document_pages_document_id_page_number_key'),
+    'document_sections_document_idx', jsonb_build_array('document_sections_document_id_idx'),
+    'rag_retrieval_logs_owner_created_idx', jsonb_build_array('rag_retrieval_logs_owner_id_idx')
+  );
+begin
+  select t.oid, n.nspname
+  into vector_type_oid, vector_schema
+  from pg_type t
+  join pg_namespace n on n.oid = t.typnamespace
+  where t.typname = 'vector'
+    and n.nspname = 'extensions'
+  limit 1;
+
+  if vector_type_oid is null then
+    missing := array_append(missing, 'extensions.vector_type');
+  end if;
+
+  if to_regprocedure('public.match_document_chunks(extensions.vector, integer, double precision, uuid, uuid)') is null then
+    missing := array_append(missing, 'match_document_chunks.extensions_vector_signature');
+  end if;
+  if to_regprocedure('public.match_document_chunks_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_chunks_hybrid.extensions_vector_signature');
+  end if;
+  if to_regprocedure('public.match_document_chunks_text(text, integer, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_chunks_text.signature');
+  end if;
+  if to_regprocedure('public.match_document_lookup_chunks_text(text, uuid[], integer, uuid)') is null then
+    missing := array_append(missing, 'match_document_lookup_chunks_text.signature');
+  end if;
+  if to_regprocedure('public.match_document_memory_cards_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_memory_cards_hybrid.extensions_vector_signature');
+  end if;
+  if to_regprocedure('public.match_document_memory_cards_hybrid_v2(extensions.vector, text, integer, double precision, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_memory_cards_hybrid_v2.extensions_vector_signature');
+  end if;
+  if to_regprocedure('public.match_document_index_units_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_index_units_hybrid.extensions_vector_signature');
+  end if;
+  if to_regprocedure('public.match_document_embedding_fields_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_embedding_fields_hybrid.extensions_vector_signature');
+  end if;
+  if to_regprocedure('public.match_documents_for_query(text, integer, uuid)') is null then
+    missing := array_append(missing, 'match_documents_for_query.signature');
+  end if;
+  if to_regprocedure('public.match_document_table_facts_text(text, integer, uuid[], uuid)') is null then
+    missing := array_append(missing, 'match_document_table_facts_text.signature');
+  end if;
+  if to_regprocedure('public.explain_retrieval_rpc(text, text, integer, uuid, uuid[], boolean)') is null then
+    missing := array_append(missing, 'explain_retrieval_rpc.signature');
+  end if;
+  if to_regclass('public.rag_retrieval_logs') is null then
+    missing := array_append(missing, 'rag_retrieval_logs.table');
+  end if;
+
+  foreach index_name in array required_indexes loop
+    if not exists (
+      select 1
+      from pg_class c
+      join pg_namespace ns on ns.oid = c.relnamespace
+      where ns.nspname = 'public'
+        and c.relname = index_name
+        and c.relkind = 'i'
+    )
+    and not (
+      index_aliases ? index_name
+      and exists (
+        select 1
+        from pg_class c
+        join pg_namespace ns on ns.oid = c.relnamespace
+        where ns.nspname = 'public'
+          and c.relkind = 'i'
+          and c.relname in (
+            select jsonb_array_elements_text(index_aliases -> index_name)
+          )
+      )
+    ) then
+      missing := array_append(missing, index_name);
+    end if;
+  end loop;
+
+  if vector_type_oid is not null then
+    zero_vec := (select ('[' || string_agg('0', ',') || ']') from generate_series(1, 1536))::extensions.vector(1536);
+    foreach rpc_name in array hybrid_rpcs loop
+      begin
+        execute format(
+          'select 1 from public.%I($1, $2, 1, 0.1, null::uuid[], null::uuid) limit 1',
+          rpc_name
+        ) using zero_vec, probe_text;
+      exception
+        when undefined_function then
+          missing := array_append(missing, rpc_name || '.execution_signature');
+        when others then
+          missing := array_append(missing, rpc_name || '.execution:' || SQLSTATE);
+      end;
+    end loop;
+  end if;
+
+  select public.detect_legacy_ivfflat_indexes() into legacy_ivfflat_indexes;
+
+  return jsonb_build_object(
+    'ok', cardinality(missing) = 0,
+    'missing', missing,
+    'vector_extension_schema', vector_schema,
+    'legacy_ivfflat_indexes', coalesce(legacy_ivfflat_indexes, array[]::text[]),
+    'deferred_hnsw_indexes', array[]::text[],
+    'checked_at', now()
+  );
+end;
+$$;
+
+revoke execute on function public.search_schema_health() from public, anon, authenticated;
+grant execute on function public.search_schema_health() to service_role;
diff --git a/supabase/schema.sql b/supabase/schema.sql
index 63657b132..16ce2230c 100644
--- a/supabase/schema.sql
+++ b/supabase/schema.sql
@@ -2396,6 +2396,15 @@ declare
     'rag_retrieval_logs_miss_idx',
     'rag_retrieval_logs_strategy_idx'
   ];
+  -- Verified live equivalents: same table/column intent, different migration-era name.
+  index_aliases constant jsonb := jsonb_build_object(
+    'documents_title_trgm_idx', jsonb_build_array('documents_title_search_tsv_idx', 'documents_title_search_idx'),
+    'document_chunks_content_trgm_idx', jsonb_build_array('document_chunks_search_tsv_idx', 'document_chunks_search_idx'),
+    'document_table_facts_owner_document_page_idx', jsonb_build_array('document_table_facts_owner_idx'),
+    'document_pages_document_idx', jsonb_build_array('document_pages_document_id_page_number_key'),
+    'document_sections_document_idx', jsonb_build_array('document_sections_document_id_idx'),
+    'rag_retrieval_logs_owner_created_idx', jsonb_build_array('rag_retrieval_logs_owner_id_idx')
+  );
 begin
   select t.oid, n.nspname
   into vector_type_oid, vector_schema
@@ -2454,6 +2463,19 @@ begin
       where ns.nspname = 'public'
         and c.relname = index_name
         and c.relkind = 'i'
+    )
+    and not (
+      index_aliases ? index_name
+      and exists (
+        select 1
+        from pg_class c
+        join pg_namespace ns on ns.oid = c.relnamespace
+        where ns.nspname = 'public'
+          and c.relkind = 'i'
+          and c.relname in (
+            select jsonb_array_elements_text(index_aliases -> index_name)
+          )
+      )
     ) then
       missing := array_append(missing, index_name);
     end if;
diff --git a/tests/api-validation-contract.test.ts b/tests/api-validation-contract.test.ts
index 4bdbf8834..5d68487d8 100644
--- a/tests/api-validation-contract.test.ts
+++ b/tests/api-validation-contract.test.ts
@@ -180,6 +180,13 @@ function mockRuntime(client: ReturnType<typeof createSupabaseMock>) {
   vi.doMock("@/lib/supabase/auth", () => ({
     AuthenticationError: class AuthenticationError extends Error {},
     requireAuthenticatedUser,
+    getOptionalAuthenticatedUser: vi.fn(async (request: Request) => {
+      const authorization = request.headers.get("authorization") ?? "";
+      if (/^Bearer\s+\S+/i.test(authorization)) return { id: userId };
+      const cookieHeader = request.headers.get("cookie") ?? "";
+      if (cookieHeader.includes("sb-")) return { id: userId };
+      return null;
+    }),
     unauthorizedResponse: () =>
       new Response(JSON.stringify({ error: "Authentication required." }), {
         status: 401,
diff --git a/tests/eval-quality.test.ts b/tests/eval-quality.test.ts
index d4888a935..fa4c7e48c 100644
--- a/tests/eval-quality.test.ts
+++ b/tests/eval-quality.test.ts
@@ -9,12 +9,13 @@ import {
   sourceWarningsForRagQualityAnswer,
   type RagQualityResult,
 } from "../scripts/eval-quality";
-import type { GoldenRetrievalResult } from "../scripts/eval-retrieval";
+import { evaluateGoldenRetrievalCase, type GoldenRetrievalResult } from "../scripts/eval-retrieval";
 
 function retrievalResult(overrides: Partial<GoldenRetrievalResult> = {}): GoldenRetrievalResult {
   const base: GoldenRetrievalResult = {
     id: "retrieval-1",
     query: "What ANC threshold should withhold clozapine?",
+    forceEmbedding: false,
     expectedQueryClass: "table_threshold",
     actualQueryClass: "table_threshold",
     expectedDocumentSubstrings: ["clozapine.pdf"],
@@ -166,6 +167,8 @@ describe("eval quality reporting", () => {
       structured_threshold_text_match: 1,
     });
     expect(report.retrieval.summary.second_stage_rerank_rate).toBe(0.5);
+    expect(report.retrieval.summary.force_embedding_case_count).toBe(0);
+    expect(report.retrieval.summary.force_embedding_failure_count).toBe(0);
     expect(report.rag.summary.unsupported_correct_rate).toBe(0);
     expect(report.rag.summary.numeric_grounding_failure_rate).toBeCloseTo(0.3333, 4);
     expect(report.rag.summary.source_governance_danger_failure_rate).toBeCloseTo(0.3333, 4);
@@ -180,6 +183,53 @@ describe("eval quality reporting", () => {
     );
   });
 
+  it("fails forced-embedding retrieval cases that return from cache, coverage, or lexical paths", () => {
+    const result = evaluateGoldenRetrievalCase({
+      testCase: {
+        id: "vector-regression",
+        query: "How is panic disorder managed?",
+        expectedQueryClass: "broad_summary",
+        expectedDocumentSubstrings: [],
+        expectedContentTerms: [],
+        topK: 8,
+        expectTableEvidence: false,
+        forceEmbedding: true,
+      },
+      results: [],
+      telemetry: {
+        query_class: "broad_summary",
+        retrieval_strategy: "text_fast_path",
+        embedding_skipped: true,
+        embedding_skip_reason: "strong_document_text_score",
+        text_fast_path_reason: "strong_document_text_score",
+        text_candidate_budget: 32,
+        text_candidate_count: 5,
+        vector_candidate_count: 0,
+        retrieval_layer_counts: { text_candidates: 5 },
+        coverage_gate_decision: "accepted",
+        coverage_gate_reason: "document_title_evidence_gate",
+        second_stage_rerank_used: false,
+      },
+      latencyMs: 10,
+    });
+
+    expect(result.forceEmbedding).toBe(true);
+    expect(result.failures).toEqual(
+      expect.arrayContaining([
+        "forceEmbedding expected embedding to run",
+        "forceEmbedding returned lexical strategy text_fast_path",
+        "forceEmbedding returned coverage gate",
+        "forceEmbedding found no vector-layer candidates",
+      ]),
+    );
+    const report = buildEvalQualityReport({ retrievalResults: [result], ragResults: [] });
+    expect(report.retrieval.summary.force_embedding_case_count).toBe(1);
+    expect(report.retrieval.summary.force_embedding_failure_count).toBe(1);
+    expect(report.blocking_threshold_failures).toEqual(
+      expect.arrayContaining([expect.stringContaining("retrieval force_embedding_failure_count 1 above 0")]),
+    );
+  });
+
   it("derives source governance warnings for direct RAG answers without precomputed warnings", () => {
     const warnings = sourceWarningsForRagQualityAnswer({
       sourceGovernanceWarnings: undefined,
diff --git a/tests/private-access-routes.test.ts b/tests/private-access-routes.test.ts
index 45b5b1e61..9d91205f7 100644
--- a/tests/private-access-routes.test.ts
+++ b/tests/private-access-routes.test.ts
@@ -376,14 +376,18 @@ afterEach(() => {
 });
 
 describe("private document API access", () => {
-  it("still requires a valid token even when local no-auth mode is enabled", async () => {
-    const client = createSupabaseMock();
+  it("lists public documents without auth in local no-auth mode", async () => {
+    const documents = [{ id: documentId, owner_id: null, title: "Public guideline" }];
+    const client = createSupabaseMock((call) => (call.table === "documents" ? ok(documents) : ok([])));
     mockRuntime(client, undefined, { localNoAuth: true });
     const { GET } = await import("../src/app/api/documents/route");
 
     const response = await GET(localPortRequest(4298, "/api/documents"));
+    const body = await payload(response);
 
-    expect(response.status).toBe(401);
+    expect(response.status).toBe(200);
+    expect(body.documents).toEqual(documents.map((document) => ({ ...document, labels: [], summary: null })));
+    expect(client.calls[0].filters).toContainEqual({ column: "owner_id", value: null });
     expect(client.auth.getUser).not.toHaveBeenCalled();
   });
 
@@ -398,28 +402,39 @@ describe("private document API access", () => {
     expect(response.status).toBe(200);
     expect(client.auth.getUser).toHaveBeenCalledTimes(1);
   });
-  it("rejects local no-auth private calls from unmanaged localhost ports before Supabase access", async () => {
+  it("rejects local no-auth upload calls from unmanaged localhost ports before Supabase access", async () => {
     const client = createSupabaseMock();
     mockRuntime(client, undefined, { localNoAuth: true });
-    const { GET } = await import("../src/app/api/documents/route");
+    const { POST } = await import("../src/app/api/upload/route");
+    const formData = new FormData();
+    formData.set("file", new File(["hello"], "guideline.txt", { type: "text/plain" }));
 
-    const response = await GET(localPortRequest(3000, "/api/documents"));
+    const response = await POST(
+      localPortRequest(3000, "/api/upload", {
+        method: "POST",
+        body: formData,
+      }),
+    );
 
     expect(response.status).toBe(401);
     expect(client.auth.getUser).not.toHaveBeenCalled();
     expect(client.from).not.toHaveBeenCalled();
   });
 
-  it("rejects managed-port private calls with stale localhost referers before Supabase access", async () => {
+  it("rejects managed-port upload calls with stale localhost referers before Supabase access", async () => {
     const client = createSupabaseMock();
     mockRuntime(client, undefined, { localNoAuth: true });
-    const { GET } = await import("../src/app/api/documents/route");
+    const { POST } = await import("../src/app/api/upload/route");
+    const formData = new FormData();
+    formData.set("file", new File(["hello"], "guideline.txt", { type: "text/plain" }));
 
-    const response = await GET(
-      localPortRequest(4298, "/api/documents", {
+    const response = await POST(
+      localPortRequest(4298, "/api/upload", {
+        method: "POST",
         headers: {
           referer: "http://localhost:3000/",
         },
+        body: formData,
       }),
     );
 
@@ -428,66 +443,20 @@ describe("private document API access", () => {
     expect(client.from).not.toHaveBeenCalled();
   });
 
-  it("resolves local no-auth owner from documents before listing auth users", async () => {
-    const documents = [{ id: documentId, owner_id: userId, title: "Owned document" }];
-    const client = createSupabaseMock((call) => {
-      if (call.table === "documents" && call.selected === "owner_id") {
-        return ok({ owner_id: userId });
-      }
-      if (call.table === "documents") {
-        return ok(documents);
-      }
-      return ok([]);
-    });
-    mockRuntime(client, undefined, { localNoAuth: true });
+  it("lists public documents for unauthenticated callers", async () => {
+    const documents = [{ id: documentId, owner_id: null, title: "Public guideline", status: "indexed" }];
+    const client = createSupabaseMock((call) => (call.table === "documents" ? ok(documents) : ok([])));
+    mockRuntime(client);
     const { GET } = await import("../src/app/api/documents/route");
 
-    const response = await GET(localPortRequest(4298, "/api/documents"));
+    const response = await GET(request("/api/documents?includeMeta=false"));
     const body = await payload(response);
 
-    expect(response.status).toBe(401);
-    expect(body).toEqual({ error: "Authentication required." });
+    expect(response.status).toBe(200);
+    expect(body.documents).toEqual(documents);
     expect(client.auth.getUser).not.toHaveBeenCalled();
-    expect(client.from).not.toHaveBeenCalled();
-  });
-
-  it("resolves configured local no-auth owner email before document fallback", async () => {
-    const documents = [{ id: documentId, owner_id: userId, title: "Configured owner document" }];
-    const client = createSupabaseMock((call) => {
-      if (call.table === "documents" && call.selected === "owner_id") {
-        return ok({ owner_id: otherUserId });
-      }
-      if (call.table === "documents") {
-        return ok(documents);
-      }
-      return ok([]);
-    });
-    client.auth.admin.listUsers.mockResolvedValueOnce({
-      data: { users: [{ id: userId, email: "clinician@example.test" }], nextPage: 0 },
-      error: null,
-    });
-    mockRuntime(client, undefined, { localNoAuth: true, localOwnerEmail: "clinician@example.test" });
-    const { GET } = await import("../src/app/api/documents/route");
-
-    const response = await GET(localPortRequest(4298, "/api/documents"));
-    const body = await payload(response);
-
-    expect(response.status).toBe(401);
-    expect(body).toEqual({ error: "Authentication required." });
-    expect(client.auth.admin.listUsers).not.toHaveBeenCalled();
-    expect(client.from).not.toHaveBeenCalled();
-  });
-
-  it("rejects unauthenticated document listing", async () => {
-    const client = createSupabaseMock();
-    mockRuntime(client);
-    const { GET } = await import("../src/app/api/documents/route");
-
-    const response = await GET(request("/api/documents"));
-
-    expect(response.status).toBe(401);
-    expect(await payload(response)).toEqual({ error: "Authentication required." });
-    expect(client.from).not.toHaveBeenCalled();
+    expect(client.calls[0].filters).toContainEqual({ column: "owner_id", value: null });
+    expect(client.calls[0].filters).not.toContainEqual({ column: "owner_id", value: userId });
   });
 
   it("filters authenticated document listing by owner", async () => {
@@ -602,6 +571,48 @@ describe("private document API access", () => {
     expect(client.storageMocks.createSignedUrl).not.toHaveBeenCalled();
   });
 
+  it("allows anonymous signed URLs for public documents", async () => {
+    const client = createSupabaseMock((call) => {
+      if (
+        call.table === "documents" &&
+        call.filters.some((filter) => filter.column === "owner_id" && filter.value === null)
+      ) {
+        return ok({ storage_path: "public/documents/guideline.pdf", file_type: "application/pdf" });
+      }
+      return ok(null);
+    });
+    mockRuntime(client);
+    const { GET } = await import("../src/app/api/documents/[id]/signed-url/route");
+
+    const response = await GET(request(`/api/documents/${documentId}/signed-url`), {
+      params: Promise.resolve({ id: documentId }),
+    });
+    const body = await payload(response);
+
+    expect(response.status).toBe(200);
+    expect(body.url).toContain("public/documents/guideline.pdf");
+    expect(client.auth.getUser).not.toHaveBeenCalled();
+  });
+
+  it("rejects anonymous signed URLs for private documents", async () => {
+    const client = createSupabaseMock((call) => {
+      if (call.table === "documents" && call.filters.some((filter) => filter.column === "owner_id")) {
+        return ok(null);
+      }
+      return ok(null);
+    });
+    mockRuntime(client);
+    const { GET } = await import("../src/app/api/documents/[id]/signed-url/route");
+
+    const response = await GET(request(`/api/documents/${otherDocumentId}/signed-url`), {
+      params: Promise.resolve({ id: otherDocumentId }),
+    });
+
+    expect(response.status).toBe(404);
+    expect(await payload(response)).toEqual({ error: "Document not found." });
+    expect(client.storageMocks.createSignedUrl).not.toHaveBeenCalled();
+  });
+
   it("allows image signed URLs only when the parent document is owned", async () => {
     const client = createSupabaseMock((call) => {
       if (call.table === "document_images") {
@@ -2788,6 +2799,41 @@ describe("private document API access", () => {
     );
   });
 
+  it("degrades invalid bearer tokens to anonymous search scope", async () => {
+    const searchChunksWithTelemetry = vi.fn(async () => ({
+      results: [],
+      telemetry: {
+        search_cache_hit: false,
+        text_fast_path_latency_ms: 0,
+        embedding_skipped: true,
+        embedding_latency_ms: 0,
+        embedding_cache_hit: false,
+        supabase_rpc_latency_ms: 0,
+        rerank_latency_ms: 0,
+        retrieval_strategy: "text_fast_path",
+      },
+    }));
+    const client = createSupabaseMock();
+    mockRuntime(client, { searchChunksWithTelemetry });
+    const searchRoute = await import("../src/app/api/search/route");
+
+    const response = await searchRoute.POST(
+      request("/api/search", {
+        method: "POST",
+        headers: {
+          authorization: "Bearer expired-token",
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({ query: "monitoring" }),
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(searchChunksWithTelemetry).toHaveBeenCalledWith(
+      expect.objectContaining({ ownerId: undefined, allowGlobalSearch: true }),
+    );
+  });
+
   it("rate limits anonymous answer bursts before generation", async () => {
     const answerQuestionWithScope = vi.fn(async () => ({
       answer: "Public evidence.",
diff --git a/tests/public-access-deep.test.ts b/tests/public-access-deep.test.ts
new file mode 100644
index 000000000..9d0cf39d1
--- /dev/null
+++ b/tests/public-access-deep.test.ts
@@ -0,0 +1,224 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const publicDocumentId = "11111111-1111-4111-8111-111111111111";
+
+beforeEach(() => {
+  vi.resetModules();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.resetModules();
+  vi.unstubAllEnvs();
+});
+
+describe("public access deep checks", () => {
+  it("rejects unauthenticated access to operator-only routes", async () => {
+    vi.doMock("@/lib/env", () => ({ isDemoMode: () => false, env: {} }));
+    const auth = {
+      AuthenticationError: class AuthenticationError extends Error {},
+      requireAuthenticatedUser: vi.fn(async () => {
+        throw new auth.AuthenticationError();
+      }),
+      unauthorizedResponse: () => Response.json({ error: "Authentication required." }, { status: 401 }),
+    };
+    vi.doMock("@/lib/supabase/admin", () => ({
+      createAdminClient: vi.fn(() => ({ auth: { getUser: vi.fn() } })),
+    }));
+    vi.doMock("@/lib/supabase/auth", () => auth);
+
+    const cases = [
+      {
+        routePath: "../src/app/api/jobs/route",
+        handler: "GET" as const,
+        request: new Request("http://localhost/api/jobs"),
+      },
+      {
+        routePath: "../src/app/api/ingestion/jobs/route",
+        handler: "GET" as const,
+        request: new Request("http://localhost/api/ingestion/jobs"),
+      },
+      {
+        routePath: "../src/app/api/ingestion/batches/route",
+        handler: "GET" as const,
+        request: new Request("http://localhost/api/ingestion/batches"),
+      },
+      {
+        routePath: "../src/app/api/documents/bulk/route",
+        handler: "POST" as const,
+        request: new Request("http://localhost/api/documents/bulk", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ action: "delete", documentIds: [publicDocumentId] }),
+        }),
+      },
+      {
+        routePath: "../src/app/api/documents/[id]/summarize/route",
+        handler: "POST" as const,
+        request: new Request(`http://localhost/api/documents/${publicDocumentId}/summarize`, { method: "POST" }),
+        params: { id: publicDocumentId },
+      },
+      {
+        routePath: "../src/app/api/eval-cases/route",
+        handler: "POST" as const,
+        request: new Request("http://localhost/api/eval-cases", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            query: "What monitoring is needed?",
+            rating: "good",
+            answer: "Monitor FBC.",
+            queryMode: "auto",
+            queryClass: "table_threshold",
+          }),
+        }),
+      },
+    ] as const;
+
+    for (const testCase of cases) {
+      vi.resetModules();
+      vi.doMock("@/lib/env", () => ({ isDemoMode: () => false, env: {} }));
+      vi.doMock("@/lib/supabase/admin", () => ({
+        createAdminClient: vi.fn(() => ({ auth: { getUser: vi.fn() } })),
+      }));
+      vi.doMock("@/lib/supabase/auth", () => auth);
+      const mod = await import(testCase.routePath);
+      const handler = mod[testCase.handler];
+      const response = await handler(
+        testCase.request,
+        "params" in testCase ? { params: Promise.resolve(testCase.params) } : undefined,
+      );
+      expect(response.status, testCase.routePath).toBe(401);
+    }
+  });
+
+  it("does not expose secret values from the health endpoint", async () => {
+    vi.doMock("@/lib/env", () => ({
+      env: {
+        NEXT_PUBLIC_SUPABASE_URL: "https://sjrfecxgysukkwxsowpy.supabase.co",
+        SUPABASE_SERVICE_ROLE_KEY: "super-secret-service-role-key",
+        OPENAI_API_KEY: "sk-super-secret-openai-key",
+      },
+      isDemoMode: () => false,
+    }));
+    const { GET } = await import("../src/app/api/health/route");
+    const response = await GET(new Request("https://clinical.example/api/health?deep=1"));
+    const body = await response.json();
+    const serialized = JSON.stringify(body);
+
+    expect(serialized).not.toContain("super-secret-service-role-key");
+    expect(serialized).not.toContain("sk-super-secret-openai-key");
+    expect(body.checks.supabaseConfig).toBe("ok");
+    expect(body.checks.openaiConfig).toBe("ok");
+  });
+});
+
+describe("production anonymous retrieval scope", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.resetModules();
+    vi.unstubAllEnvs();
+  });
+
+  it("fails closed in production when anonymous global retrieval omits owner scope", async () => {
+    vi.doUnmock("@/lib/rag");
+    vi.stubEnv("NODE_ENV", "production");
+    vi.doMock("@/lib/env", () => ({
+      env: {
+        OPENAI_API_KEY: "sk-test",
+        RAG_PROVIDER_MODE: "offline",
+        RAG_SEARCH_CACHE_TTL_MS: 0,
+        RAG_ANSWER_CACHE_TTL_MS: 0,
+      },
+      isDemoMode: () => false,
+      isLocalNoAuthMode: () => false,
+      requestedOpenAIAnswerModels: () => ({ fast: "gpt-test", strong: "gpt-test" }),
+    }));
+    vi.doMock("@/lib/supabase/admin", () => ({
+      createAdminClient: vi.fn(() => ({
+        from: vi.fn(() => ({
+          select: vi.fn(() => ({
+            eq: vi.fn(() => ({
+              is: vi.fn(() => ({
+                order: vi.fn(() => ({
+                  limit: vi.fn(async () => ({ data: [], error: null })),
+                })),
+              })),
+            })),
+          })),
+        })),
+        rpc: vi.fn(async () => ({ data: [], error: null })),
+      })),
+    }));
+
+    const { searchChunksWithTelemetry } = await import("../src/lib/rag");
+
+    await expect(
+      searchChunksWithTelemetry({
+        query: "clozapine monitoring",
+        allowGlobalSearch: true,
+      }),
+    ).rejects.toThrow(/ownerId|tenant/i);
+  });
+});
+
+describe("test-runtime anonymous retrieval scope", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.resetModules();
+    vi.unstubAllEnvs();
+  });
+
+  it("allows anonymous global retrieval in test runtime where owner scope stays permissive", async () => {
+    vi.doUnmock("@/lib/rag");
+    vi.doMock("@/lib/env", () => ({
+      env: {
+        OPENAI_API_KEY: undefined,
+        RAG_PROVIDER_MODE: "offline",
+        RAG_SEARCH_CACHE_TTL_MS: 0,
+        RAG_ANSWER_CACHE_TTL_MS: 0,
+      },
+      isDemoMode: () => false,
+      isLocalNoAuthMode: () => false,
+      requestedOpenAIAnswerModels: () => ({ fast: "gpt-test", strong: "gpt-test" }),
+    }));
+    vi.doMock("@/lib/supabase/admin", () => ({
+      createAdminClient: vi.fn(() => ({
+        from: vi.fn(() => ({
+          select: vi.fn(() => ({
+            eq: vi.fn(() => ({
+              is: vi.fn(() => ({
+                order: vi.fn(() => ({
+                  limit: vi.fn(async () => ({ data: [], error: null })),
+                })),
+                in: vi.fn(() => ({
+                  order: vi.fn(() => ({
+                    limit: vi.fn(async () => ({ data: [], error: null })),
+                  })),
+                })),
+              })),
+            })),
+          })),
+        })),
+        rpc: vi.fn(async () => ({ data: [], error: null })),
+      })),
+    }));
+
+    const { searchChunksWithTelemetry } = await import("../src/lib/rag");
+    const result = await searchChunksWithTelemetry({
+      query: "clozapine monitoring",
+      allowGlobalSearch: true,
+    });
+
+    expect(result.results).toEqual([]);
+    expect(result.telemetry).toBeDefined();
+  });
+});
diff --git a/tests/registry-records-route.test.ts b/tests/registry-records-route.test.ts
index 388bd52e5..5571c270c 100644
--- a/tests/registry-records-route.test.ts
+++ b/tests/registry-records-route.test.ts
@@ -198,11 +198,8 @@ describe("registry records API", () => {
     expect(payload.records.some((record) => record.slug === "13yarn")).toBe(true);
     expect(payload.matches?.[0]?.record.slug).toBe("13yarn");
     expect(client.from).not.toHaveBeenCalled();
-    expect(client.rpc).toHaveBeenCalledWith(
-      "consume_api_subject_rate_limit",
-      expect.objectContaining({ p_bucket: "registry" }),
-    );
-    expect(client.rpc).not.toHaveBeenCalledWith("consume_api_rate_limit", expect.anything());
+    expect(client.rpc).not.toHaveBeenCalled();
+    expect(client.auth.getUser).not.toHaveBeenCalled();
   });
 
   it("rejects an invalid kind with a validation error", async () => {
@@ -311,11 +308,8 @@ describe("registry records API", () => {
     expect(payload.record.slug).toBe("13yarn");
     expect(payload.linkedDocuments).toEqual([]);
     expect(client.from).not.toHaveBeenCalled();
-    expect(client.rpc).toHaveBeenCalledWith(
-      "consume_api_subject_rate_limit",
-      expect.objectContaining({ p_bucket: "registry" }),
-    );
-    expect(client.rpc).not.toHaveBeenCalledWith("consume_api_rate_limit", expect.anything());
+    expect(client.rpc).not.toHaveBeenCalled();
+    expect(client.auth.getUser).not.toHaveBeenCalled();
   });
 
   it("returns 404 for an unknown slug", async () => {
diff --git a/tests/retrieval-query-variants.test.ts b/tests/retrieval-query-variants.test.ts
index ddb62411e..a2f06474e 100644
--- a/tests/retrieval-query-variants.test.ts
+++ b/tests/retrieval-query-variants.test.ts
@@ -127,6 +127,18 @@ describe("retrieval query variants", () => {
     expect(textCandidateBudgetForQueryClass("unsupported_or_general", 12)).toBe(24);
   });
 
+  it("keeps forced-embedding retrieval out of the ordinary search cache key", () => {
+    const baseArgs = {
+      query: "How is panic disorder managed?",
+      topK: 8,
+      minSimilarity: 0.12,
+    };
+
+    expect(retrievalPlanCacheQuery(baseArgs, "broad_summary")).not.toBe(
+      retrievalPlanCacheQuery({ ...baseArgs, forceEmbedding: true }, "broad_summary"),
+    );
+  });
+
   it("allows direct document title hits to skip embedding retrieval", () => {
     expect(
       decideTextFastPath(
diff --git a/tests/supabase-schema.test.ts b/tests/supabase-schema.test.ts
index 68cd98773..6dd16d6c9 100644
--- a/tests/supabase-schema.test.ts
+++ b/tests/supabase-schema.test.ts
@@ -80,6 +80,10 @@ const registryCatalogPayloadMigration = readFileSync(
   new URL("../supabase/migrations/20260705030000_registry_catalog_payload.sql", import.meta.url),
   "utf8",
 ).replace(/\s+/g, " ");
+const searchHealthIndexesMigration = readFileSync(
+  new URL("../supabase/migrations/20260705180000_reconcile_search_health_indexes.sql", import.meta.url),
+  "utf8",
+).replace(/\s+/g, " ");
 const ragQueriesRetentionMigration = readFileSync(
   new URL("../supabase/migrations/20260629060603_rag_queries_retention.sql", import.meta.url),
   "utf8",
@@ -739,6 +743,17 @@ describe("Supabase schema Data API grants", () => {
       "add column if not exists catalog_payload jsonb not null default '{}'::jsonb",
     );
   });
+
+  it("reconciles search_schema_health index drift with canonical creates and live aliases", () => {
+    expect(searchHealthIndexesMigration).toContain("create index if not exists documents_title_trgm_idx");
+    expect(searchHealthIndexesMigration).toContain("create index if not exists document_labels_label_trgm_idx");
+    expect(searchHealthIndexesMigration).toContain("create index if not exists rag_retrieval_logs_miss_idx");
+    expect(searchHealthIndexesMigration).toContain("index_aliases constant jsonb := jsonb_build_object(");
+    expect(searchHealthIndexesMigration).toContain("'documents_title_search_tsv_idx'");
+    expect(searchHealthIndexesMigration).toContain("'document_pages_document_id_page_number_key'");
+    expect(schema).toContain("index_aliases constant jsonb := jsonb_build_object(");
+    expect(schema).toContain("jsonb_array_elements_text(index_aliases -> index_name)");
+  });
 });
 
 describe("RC9 — lexical text path must not fabricate a cosine similarity", () => {