diff --git a/supabase/drift-manifest.json b/supabase/drift-manifest.json
index ca34076e2..c54ee62fd 100644
--- a/supabase/drift-manifest.json
+++ b/supabase/drift-manifest.json
@@ -1,9 +1,9 @@
 {
-  "generated_at": "2026-07-14T06:09:26.377Z",
+  "generated_at": "2026-07-17T06:06:10.141Z",
   "generator": "scripts/generate-drift-manifest.ts",
   "postgres_image": "supabase/postgres:17.6.1.127",
-  "schema_sha256": "cb0ddc6b9c5926d6c959fdb561a0ecf0fdc644da20dcea732f2353cb7cf44111",
-  "replay_seconds": 17,
+  "schema_sha256": "b9faccf4dac098def5d9547ca1b4cf0bb24621f1b76e9aed1b57d2495b65d72b",
+  "replay_seconds": 60,
   "snapshot": {
     "views": [
       {
@@ -6337,7 +6337,7 @@
           "postgres=X/postgres",
           "service_role=X/postgres"
         ],
-        "def_hash": "8f1094c4e0c40dfd99a87a455037a62e",
+        "def_hash": "a5ebdd1ec14008cdf0c8601a32b4d24c",
         "signature": "public.correct_clinical_query_terms(text,real)"
       },
       {
diff --git a/supabase/schema.sql b/supabase/schema.sql
index 9171df2fc..163495444 100644
--- a/supabase/schema.sql
+++ b/supabase/schema.sql
@@ -3487,15 +3487,19 @@ begin
     return input_query;
   end if;
 
-  -- Build the known-term vocabulary once per call.
+  -- Build the known-term vocabulary once per call. Every source is scoped to the
+  -- public (null-owner) corpus: this function is SECURITY DEFINER and bypasses RLS, and
+  -- both rag_aliases and documents carry owner-scoped private rows (deep-memory persists
+  -- owner-scoped aliases/canonicals), so an unscoped read would leak private-document
+  -- terms across tenants. Mirrors migration 20260717120000_corrector_public_titles_only.
   select array_agg(distinct term) into vocab
   from (
-    select lower(alias) as term from public.rag_aliases where enabled and length(alias) between 4 and 40
+    select lower(alias) as term from public.rag_aliases where enabled and owner_id is null and length(alias) between 4 and 40
     union
-    select lower(canonical) from public.rag_aliases where enabled and length(canonical) between 4 and 40
+    select lower(canonical) from public.rag_aliases where enabled and owner_id is null and length(canonical) between 4 and 40
     union
     select w from public.documents d, lateral unnest(regexp_split_to_array(lower(d.title), '[^a-z]+')) as w
-    where d.status = 'indexed' and length(w) between 4 and 40
+    where d.status = 'indexed' and d.owner_id is null and length(w) between 4 and 40
   ) t;
 
   tokens := regexp_split_to_array(lower(input_query), '\s+');