diff --git a/appinfo/info.xml b/appinfo/info.xml
index aed3c25bb..4767a6ea3 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -147,6 +147,14 @@ Doe een [featureverzoek](https://github.com/OpenCatalogi/.github/issues/new/choo
 				non-destructive; safe to re-run.
 			-->
 			<step>OCA\OpenCatalogi\Repair\RenameDutchPublicationColumns</step>
+			<!--
+				WOO-536 Fase 4: backfill the two-rule read-block on publication +
+				document schemas (adds the `depublicationDate` clause required by
+				Robert's DoD). Runs AFTER RenameDutchPublicationColumns so the guard
+				sees English field names. Idempotent: skips schemas that already
+				carry a two-rule shape or admin-customised rules.
+			-->
+			<step>OCA\OpenCatalogi\Repair\WOO536RepairReadRules</step>
 			<!--
 				The background jobs moved from OCA\OpenCatalogi\Cron to
 				OCA\OpenCatalogi\BackgroundJob in #1119. The <job> entries above
diff --git a/appinfo/routes.php b/appinfo/routes.php
index a91bdf000..77545d12d 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -25,10 +25,10 @@
 		// DIWOO output validation (admin-only — auditable via AuthorizedAdminSetting)
 		['name' => 'sitemap#diwooReport', 'url' => '/api/{catalogSlug}/sitemaps/{categoryCode}/validate', 'verb' => 'GET'],
 		// DCAT-AP-NL feed validation (admin-only — auditable via AuthorizedAdminSetting)
-		['name' => 'dcat#validate', 'url' => '/api/catalogs/{catalogSlug}/dcat/validate', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'dcat#donlReport', 'url' => '/api/catalogs/{catalogSlug}/dcat/donl-validate', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'dcat#validate', 'url' => '/api/catalogs/{catalogSlug}/dcat/validate', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'dcat#donlReport', 'url' => '/api/catalogs/{catalogSlug}/dcat/donl-validate', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// OOAPI 5.0 feed validation (admin-only — auditable via AuthorizedAdminSetting)
-		['name' => 'ooapi#validate', 'url' => '/api/catalogs/{catalogSlug}/ooapi/validate', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'ooapi#validate', 'url' => '/api/catalogs/{catalogSlug}/ooapi/validate', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// Robots
 		['name' => 'robots#index', 'url' => '/api/robots.txt', 'verb' => 'GET'],
 		// Global Configuration
@@ -71,24 +71,24 @@
 		 */
 		
 		// Publications CORS (wildcard catalog-based endpoints)
-		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/uses', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/used', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/attachments', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/download', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/uses', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/used', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/attachments', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#preflightedCors', 'url' => '/api/{catalogSlug}/{id}/download', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// DCAT-AP-NL CORS (public harvest endpoints)
 		['name' => 'dcat#preflightedCors', 'url' => '/api/dcat', 'verb' => 'OPTIONS'],
-		['name' => 'dcat#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/dcat', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'dcat#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/dcat', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// OOAPI 5.0 CORS (consumer-credential authenticated endpoints — OOAPI-001/COR-001)
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{courseId}/offerings', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/offerings/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{courseId}/offerings', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/offerings/{id}', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// Catalogi CORS
 		['name' => 'catalogi#preflightedCors', 'url' => '/api/catalogi', 'verb' => 'OPTIONS'],
 		['name' => 'catalogi#preflightedCors', 'url' => '/api/catalogi/{id}', 'verb' => 'OPTIONS'],
@@ -121,21 +121,21 @@
 		['name' => 'apiDocumentation#index', 'url' => '/api/openapi.json', 'verb' => 'GET'],
 		// DCAT-AP-NL harvest endpoints (specific routes - MUST be before wildcard catalog routes)
 		['name' => 'dcat#instance', 'url' => '/api/dcat', 'verb' => 'GET'],
-		['name' => 'dcat#catalog', 'url' => '/api/catalogs/{catalogSlug}/dcat', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'dcat#catalog', 'url' => '/api/catalogs/{catalogSlug}/dcat', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// schema.org DataCatalog endpoint (specific route - must be before wildcard catalog routes)
-		['name' => 'schemaOrg#catalog', 'url' => '/api/catalogs/{catalogSlug}/schema', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'schemaOrg#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/schema', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'schemaOrg#catalog', 'url' => '/api/catalogs/{catalogSlug}/schema', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'schemaOrg#preflightedCors', 'url' => '/api/catalogs/{catalogSlug}/schema', 'verb' => 'OPTIONS', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// OOAPI 5.0 catalog-publication endpoints (specific routes - MUST be before wildcard
 		// catalog routes; consumer-credential authenticated, OOAPI-001/OOAPI-008). The
 		// courses/{courseId}/offerings route MUST precede courses/{id} (more specific first).
-		['name' => 'ooapi#organizations', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#organization', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#programs', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#program', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#courseOfferings', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{courseId}/offerings', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#courses', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#course', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ooapi#offering', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/offerings/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'ooapi#organizations', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#organization', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/organizations/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#programs', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#program', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/programs/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#courseOfferings', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{courseId}/offerings', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#courses', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#course', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/courses/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ooapi#offering', 'url' => '/api/catalogs/{catalogSlug}/ooapi/v5/offerings/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 		// Glossary (specific route - must be before wildcard catalog routes)
 		['name' => 'glossary#index', 'url' => '/api/glossary', 'verb' => 'GET'],
 		['name' => 'glossary#show', 'url' => '/api/glossary/{id}', 'verb' => 'GET'],
@@ -169,9 +169,9 @@
 		['name' => 'OCA\OpenCatalogi\AppHost\Controller\GenericMetrics#index', 'url' => '/api/metrics', 'verb' => 'GET'],
 		// Usage analytics (authenticated; specific routes - MUST be before wildcard catalog routes).
 		['name' => 'stats#publication', 'url' => '/api/publications/{id}/stats', 'verb' => 'GET'],
-		['name' => 'stats#catalog', 'url' => '/api/catalogs/{slug}/stats', 'verb' => 'GET', 'requirements' => ['slug' => '[a-z0-9-]+']],
-		['name' => 'stats#quality', 'url' => '/api/catalogs/{slug}/quality', 'verb' => 'GET', 'requirements' => ['slug' => '[a-z0-9-]+']],
-		['name' => 'stats#export', 'url' => '/api/catalogs/{slug}/stats/export', 'verb' => 'GET', 'requirements' => ['slug' => '[a-z0-9-]+']],
+		['name' => 'stats#catalog', 'url' => '/api/catalogs/{slug}/stats', 'verb' => 'GET', 'requirements' => ['slug' => '[A-Za-z0-9-]+']],
+		['name' => 'stats#quality', 'url' => '/api/catalogs/{slug}/quality', 'verb' => 'GET', 'requirements' => ['slug' => '[A-Za-z0-9-]+']],
+		['name' => 'stats#export', 'url' => '/api/catalogs/{slug}/stats/export', 'verb' => 'GET', 'requirements' => ['slug' => '[A-Za-z0-9-]+']],
 		// Health check endpoint — served by the AppHost engine from the
 		// `observability.health` block (ADR-040 / ADR-006). The engine adds
 		// #[PublicPage] (anonymous health — an intentional improvement over the
@@ -200,18 +200,18 @@
 		['name' => 'setup#config', 'url' => '/api/setup/config', 'verb' => 'POST'],
 		['name' => 'setup#action', 'url' => '/api/setup/action/{actionId}', 'verb' => 'POST', 'requirements' => ['actionId' => '[a-z-]+']],
 		// Publications (wildcard catalog-based endpoints - MUST BE ABSOLUTE LAST to avoid catching any specific routes)
-		['name' => 'publications#index', 'url' => '/api/{catalogSlug}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#show', 'url' => '/api/{catalogSlug}/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#uses', 'url' => '/api/{catalogSlug}/{id}/uses', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#used', 'url' => '/api/{catalogSlug}/{id}/used', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#attachments', 'url' => '/api/{catalogSlug}/{id}/attachments', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'publications#download', 'url' => '/api/{catalogSlug}/{id}/download', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
+		['name' => 'publications#index', 'url' => '/api/{catalogSlug}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#show', 'url' => '/api/{catalogSlug}/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#uses', 'url' => '/api/{catalogSlug}/{id}/uses', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#used', 'url' => '/api/{catalogSlug}/{id}/used', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#attachments', 'url' => '/api/{catalogSlug}/{id}/attachments', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'publications#download', 'url' => '/api/{catalogSlug}/{id}/download', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
 
 		// UI page routes for SPA deep links
 		['name' => 'ui#dashboard', 'url' => '/', 'verb' => 'GET'],
 		['name' => 'ui#catalogi', 'url' => '/catalogi', 'verb' => 'GET'],
-		['name' => 'ui#publicationsIndex', 'url' => '/publications/{catalogSlug}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+']],
-		['name' => 'ui#publicationsPage', 'url' => '/publications/{catalogSlug}/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[a-z0-9-]+', 'id' => '[a-z0-9-]+']],
+		['name' => 'ui#publicationsIndex', 'url' => '/publications/{catalogSlug}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+']],
+		['name' => 'ui#publicationsPage', 'url' => '/publications/{catalogSlug}/{id}', 'verb' => 'GET', 'requirements' => ['catalogSlug' => '[A-Za-z0-9-]+', 'id' => '[A-Za-z0-9-]+']],
 		['name' => 'ui#search', 'url' => '/search', 'verb' => 'GET'],
 		['name' => 'ui#organizations', 'url' => '/organizations', 'verb' => 'GET'],
 		['name' => 'ui#themes', 'url' => '/themes', 'verb' => 'GET'],
diff --git a/lib/Repair/WOO536RepairReadRules.php b/lib/Repair/WOO536RepairReadRules.php
new file mode 100644
index 000000000..53dbdf8e0
--- /dev/null
+++ b/lib/Repair/WOO536RepairReadRules.php
@@ -0,0 +1,309 @@
+<?php
+/**
+ * WOO-536 repair step for publication + document read-rule shape.
+ *
+ * @category Repair
+ * @package  OCA\OpenCatalogi\Repair
+ *
+ * @author    Conduction Development Team <info@conduction.nl>
+ * @copyright 2024 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-License-Identifier: EUPL-1.2
+ * SPDX-FileCopyrightText: 2024 Conduction B.V. <info@conduction.nl>
+ *
+ * @version GIT: <git_id>
+ *
+ * @link https://www.OpenCatalogi.nl
+ *
+ * @spec openspec/changes/fix-fts-catalog-model-alignment/tasks.md
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenCatalogi\Repair;
+
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+use OCP\App\IAppManager;
+use Psr\Container\ContainerInterface;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Repair step that backfills the two-rule `depublicationDate` read-shape
+ * on the `publication` and `document` schemas for existing installations.
+ *
+ * WOO-536 (Robert Zondervan, 2026-08-12) requires the public search endpoint
+ * to filter depublished objects. The seed JSON in
+ * `lib/Settings/publication_register.json` was updated to the two-rule shape:
+ *
+ *   read: [
+ *     { group: public, match: { publicationDate $lte $now, depublicationDate $gte $now } },
+ *     { group: public, match: { publicationDate $lte $now, depublicationDate $exists false } },
+ *     "authenticated"
+ *   ]
+ *
+ * Fresh installs pick this up via the standard seed-import path
+ * (InitializeSettings::run → SettingsService::loadSettings). Existing
+ * installations may still carry the older single-rule shape from before
+ * this change — this repair step upgrades them.
+ *
+ * Guards (in order of check):
+ *   1. OR must be installed (skip otherwise).
+ *   2. The schema's `authorization.read` must exist on disk.
+ *   3. The read block must be on the single-rule shape (missing
+ *      depublicationDate). Admin-customised shapes are left alone.
+ *   4. Update is idempotent — re-running has no effect once schema is on
+ *      the two-rule shape.
+ *
+ * @SuppressWarnings(PHPMD.CyclomaticComplexity) Guard branches are the point of the class.
+ */
+class WOO536RepairReadRules implements IRepairStep
+{
+    /**
+     * Constructor.
+     *
+     * @param IAppManager        $appManager The app manager.
+     * @param ContainerInterface $container  The container.
+     * @param LoggerInterface    $logger     The logger.
+     */
+    public function __construct(
+        private readonly IAppManager $appManager,
+        private readonly ContainerInterface $container,
+        private readonly LoggerInterface $logger
+    ) {
+
+    }//end __construct()
+
+    /**
+     * Get the name of this repair step.
+     *
+     * @return string
+     */
+    public function getName(): string
+    {
+        return "Backfill publication + document read-rule two-rule shape (WOO-536)";
+
+    }//end getName()
+
+    /**
+     * Run the repair step.
+     *
+     * @param IOutput $output The output interface.
+     *
+     * @return void
+     *
+     * @spec openspec/specs/search/spec.md
+     */
+    public function run(IOutput $output): void
+    {
+        // Guard 1: OR must be enabled (schema authorization lives in OR).
+        // `isEnabledForAnyone()` replaces the deprecated `getInstalledApps()`
+        // membership check in NC 30+.
+        if ($this->appManager->isEnabledForAnyone('openregister') === false) {
+            $output->warning('OpenRegister app is not enabled - skipping WOO-536 read-rule backfill');
+            return;
+        }
+
+        try {
+            $schemaMapper = $this->container->get('OCA\\OpenRegister\\Db\\SchemaMapper');
+        } catch (\Throwable $e) {
+            $output->warning('OpenRegister SchemaMapper unavailable - skipping WOO-536 read-rule backfill');
+            return;
+        }
+
+        $updated = 0;
+        $skipped = 0;
+        foreach (['publication', 'document'] as $slug) {
+            $result = $this->maybeUpgradeSchema(schemaMapper: $schemaMapper, slug: $slug, output: $output);
+            if ($result === 'updated') {
+                $updated++;
+                continue;
+            }
+            $skipped++;
+        }
+
+        $output->info(
+            sprintf('WOO-536 read-rule backfill: %d schema(s) upgraded, %d skipped (already correct or customised)', $updated, $skipped)
+        );
+
+    }//end run()
+
+    /**
+     * Locate a schema by slug and upgrade its read-block if it carries the
+     * old single-rule shape.
+     *
+     * @param object  $schemaMapper The OpenRegister SchemaMapper (typed as object
+     *                              so this repair step can compile without an OR
+     *                              dependency at analysis-time).
+     * @param string  $slug         Schema slug ('publication' or 'document').
+     * @param IOutput $output       The output interface for progress reporting.
+     *
+     * @return string 'updated' | 'skipped'
+     */
+    private function maybeUpgradeSchema(object $schemaMapper, string $slug, IOutput $output): string
+    {
+        try {
+            $schemas = $schemaMapper->findAll(filters: ['slug' => $slug]);
+        } catch (\Throwable $e) {
+            $output->warning("WOO-536: cannot list schemas by slug '{$slug}' — {$e->getMessage()}");
+            return 'skipped';
+        }
+
+        if (empty($schemas) === true) {
+            $output->info("WOO-536: schema '{$slug}' not present in this installation — nothing to upgrade");
+            return 'skipped';
+        }
+
+        $updated = false;
+        foreach ($schemas as $schema) {
+            $authorization = $schema->getAuthorization();
+            if (is_array($authorization) === false || isset($authorization['read']) === false) {
+                $output->info("WOO-536: schema '{$slug}' (id ".$schema->getId().") has no authorization.read block — skipping");
+                continue;
+            }
+
+            $read = $authorization['read'];
+            if ($this->isSingleRuleShape(read: $read) === false) {
+                $output->info(
+                    "WOO-536: schema '{$slug}' (id ".$schema->getId().") already on two-rule shape or admin-customised — skipping"
+                );
+                continue;
+            }
+
+            // Upgrade: replace the single conditional public rule with the two-rule
+            // depublicationDate-aware shape. Preserve any non-public elements
+            // (like 'authenticated') by keeping them after the two new rules.
+            $authorization['read'] = $this->buildTwoRuleRead(existing: $read);
+            $schema->setAuthorization($authorization);
+
+            try {
+                $schemaMapper->update($schema);
+                $output->info(
+                    "WOO-536: schema '{$slug}' (id ".$schema->getId().") upgraded to two-rule shape"
+                );
+                $updated = true;
+                $this->logger->info(
+                    'WOO-536 repair: schema authorization.read upgraded to two-rule shape',
+                    ['schema' => $slug, 'schemaId' => $schema->getId()]
+                );
+            } catch (\Throwable $e) {
+                $output->warning(
+                    "WOO-536: failed to update schema '{$slug}' (id ".$schema->getId()."): {$e->getMessage()}"
+                );
+            }
+        }//end foreach
+
+        if ($updated === true) {
+            return 'updated';
+        }
+        return 'skipped';
+
+    }//end maybeUpgradeSchema()
+
+    /**
+     * Detect the old single-rule shape.
+     *
+     * Old shape (before this repair):
+     *
+     *   read: [
+     *     { group: public, match: { publicationDate: { $lte: $now } } },
+     *     "authenticated"     (optional third element)
+     *   ]
+     *
+     * Any deviation from this shape (extra rules, different match keys,
+     * additional operators on publicationDate) is considered admin-customised
+     * and left alone.
+     *
+     * @param array $read The current read-block array.
+     *
+     * @return bool True when the block matches the pre-fix single-rule shape.
+     */
+    private function isSingleRuleShape(array $read): bool
+    {
+        // Expected shape: exactly one conditional public rule + optional simple
+        // string elements (e.g., "authenticated"). More than one conditional
+        // rule means admin has customised, and any two-rule shape (post-fix)
+        // will have exactly two conditional public rules.
+        $conditionalCount = 0;
+        $matchedShape    = false;
+        foreach ($read as $element) {
+            if (is_string($element) === true) {
+                // Simple element like "authenticated" or "public" — allowed.
+                continue;
+            }
+
+            if (is_array($element) === false) {
+                return false;
+            }
+
+            $conditionalCount++;
+            if (($element['group'] ?? null) !== 'public') {
+                return false;
+            }
+
+            $match = ($element['match'] ?? []);
+            if (is_array($match) === false) {
+                return false;
+            }
+
+            // Old shape: exactly one match key, `publicationDate: { $lte: $now }`.
+            if (count($match) !== 1 || isset($match['publicationDate']) === false) {
+                return false;
+            }
+
+            $publicationDate = $match['publicationDate'];
+            if (is_array($publicationDate) === false
+                || count($publicationDate) !== 1
+                || ($publicationDate['$lte'] ?? null) !== '$now'
+            ) {
+                return false;
+            }
+
+            $matchedShape = true;
+        }//end foreach
+
+        // Exactly one conditional public rule with the old-shape match => needs upgrade.
+        return $matchedShape === true && $conditionalCount === 1;
+
+    }//end isSingleRuleShape()
+
+    /**
+     * Build the two-rule shape while preserving any non-conditional
+     * elements (e.g., "authenticated") from the existing read block.
+     *
+     * @param array $existing The existing read-block array (must match single-rule shape).
+     *
+     * @return array The two-rule read block.
+     */
+    private function buildTwoRuleRead(array $existing): array
+    {
+        $twoRule = [
+            [
+                'group' => 'public',
+                'match' => [
+                    'publicationDate'   => ['$lte' => '$now'],
+                    'depublicationDate' => ['$gte' => '$now'],
+                ],
+            ],
+            [
+                'group' => 'public',
+                'match' => [
+                    'publicationDate'   => ['$lte' => '$now'],
+                    'depublicationDate' => ['$exists' => false],
+                ],
+            ],
+        ];
+
+        // Preserve simple-string elements (like "authenticated") from the
+        // existing read block, in their original order after the two new rules.
+        foreach ($existing as $element) {
+            if (is_string($element) === true) {
+                $twoRule[] = $element;
+            }
+        }
+
+        return $twoRule;
+
+    }//end buildTwoRuleRead()
+}//end class
diff --git a/lib/Service/PublicationQueryService.php b/lib/Service/PublicationQueryService.php
index 9c4a64305..95896ca3c 100644
--- a/lib/Service/PublicationQueryService.php
+++ b/lib/Service/PublicationQueryService.php
@@ -1,5 +1,4 @@
 <?php
-
 /**
  * Service for publication query building and response shaping.
  *
@@ -23,6 +22,7 @@
 
 namespace OCA\OpenCatalogi\Service;
 
+use DateTimeImmutable;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\IAppConfig;
 use OCP\IUserSession;
@@ -38,845 +38,1501 @@
  *
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  * @SuppressWarnings(PHPMD.ExcessiveClassComplexity)
+ * @SuppressWarnings(PHPMD.ExcessiveClassLength)
  */
-class PublicationQueryService {
-
-	/**
-	 * Order fields that exist in every magic-mapper table.
-	 *
-	 * Used when filtering _order for multi-register searches.
-	 *
-	 * @var array<string>
-	 */
-	private const UNIVERSAL_ORDER_FIELDS = [
-		'_uuid',
-		'_created',
-		'_updated',
-		'_name',
-		'_description',
-		'_summary',
-		'_relevance',
-	];
-
-	/**
-	 * Constructor.
-	 *
-	 * @param ContainerInterface $container DI container
-	 * @param IUserSession|null $userSession User session for anonymity checks (auto-wired at runtime)
-	 * @param IAppConfig|null $config App config, resolves the publication/document register+schema ids
-	 * @param LoggerInterface|null $logger Logger — surfaces the fail-closed empty-envelope branch so silent
-	 *                                     configuration drift is observable in production (SCH-PFTS-005).
-	 */
-	public function __construct(
-		private readonly ContainerInterface $container,
-		private readonly ?IUserSession $userSession = null,
-		private readonly ?IAppConfig $config = null,
-		private readonly ?LoggerInterface $logger = null,
-	) {
-
-	}//end __construct()
-
-	/**
-	 * Determine whether the current request is made by an anonymous (logged-out) caller.
-	 *
-	 * Used by the published-predicate guard on the public per-catalog relation endpoints
-	 * (PublicationsController::uses/used) so an anonymous caller cannot enumerate the
-	 * relation graph of an unpublished object by guessing its UUID.
-	 *
-	 * @return boolean True when there is no authenticated user on the session.
-	 *
-	 * @spec exclude Visibility helper for the public-endpoint published-predicate guard.
-	 */
-	public function isAnonymous(): bool {
-		if ($this->userSession === null) {
-			// Fail closed: when the session is unavailable, treat the caller as anonymous
-			// so the published-predicate guard applies the stricter visibility rule.
-			return true;
-		}
-
-		return $this->userSession->getUser() === null;
-	}//end isAnonymous()
-
-	/**
-	 * Determine whether an object is publicly visible (published and not depublished).
-	 *
-	 * Mirrors the live OpenRegister RBAC visibility model (APB-006), the same rule
-	 * the public publications API and the frontend `publicationStatus` helpers use:
-	 * an object is public when its own `publicationDate` field is set and is at or
-	 * before "now", and either carries no `depublicationDate` or one still in the
-	 * future. The removed object-level `@self.published` predicate is not consulted.
-	 *
-	 * @param array $objectData The serialized object data (own fields + `@self` envelope).
-	 *
-	 * @return boolean True when the object is currently published.
-	 *
-	 * @spec openspec/specs/auto-publishing/spec.md#APB-006
-	 */
-	public function isObjectPublic(array $objectData): bool {
-		$publicationDate = ($objectData['publicationDate'] ?? null);
-		$depublicationDate = ($objectData['depublicationDate'] ?? null);
-
-		if ($publicationDate === null || $publicationDate === '') {
-			return false;
-		}
-
-		$now = time();
-		$publishedTime = strtotime((string)$publicationDate);
-		if ($publishedTime === false || $publishedTime > $now) {
-			return false;
-		}
-
-		if ($depublicationDate === null || $depublicationDate === '') {
-			return true;
-		}
-
-		$depublishedTime = strtotime((string)$depublicationDate);
-		return ($depublishedTime === false || $depublishedTime > $now);
-	}//end isObjectPublic()
-
-	/**
-	 * Assemble the public full-text search result envelope (SCH-PFTS-002/006/007).
-	 *
-	 * Delegates entirely to OR's zoeken-filteren (`ObjectService::searchObjectsPaginated`)
-	 * across the `publication` and `document` schemas of the publication register, merges
-	 * the candidate rows into a single flat array discriminated by `@self.schema`
-	 * (SCH-PFTS-002), embeds the linked publication summary on every document row
-	 * (SCH-PFTS-003), and applies the anonymous visibility filter AFTER scoring/merge
-	 * (SCH-PFTS-004) so ranking is computed on the full candidate set before visibility
-	 * is enforced. Authenticated callers are not filtered — this endpoint absorbs the
-	 * previous admin-only search and authenticated callers keep seeing every match
-	 * (SCH-OR-003).
-	 *
-	 * The scope (register + schemas) is fixed by this method and never taken from the
-	 * caller-supplied query parameters, so a caller cannot widen the search beyond the
-	 * publication/document schemas by passing its own `_register`/`_schema(s)` (mirrors
-	 * the constrained-scope discipline in {@see findObjectLocation()}).
-	 *
-	 * Dual-path (design.md "Dual-path design"): this ships Path B — matches are
-	 * driven by OR's `zoeken-filteren` against schema properties and `@self` metadata.
-	 * Path A (document-content matching, WOO-517) is layered on top via the opt-in
-	 * `_content` query parameter: when set, the OR-side `_content_search` flag
-	 * (shipped in `openregister:expose-content-search-in-object-service`, PR #473) is
-	 * forwarded on `searchObjectsPaginated()`'s query array, widening the candidate
-	 * set to documents whose OR-extracted body text matches the query. OpenCatalogi
-	 * does not run its own text-extraction pipeline — OR's TextExtractionService +
-	 * ChunkMapper own that entirely (SCH-PFTS-CONTENT-001).
-	 *
-	 * @param array $queryParams Raw request query parameters from IRequest::getParams().
-	 *                           Recognised keys include the opt-in `_content` boolean
-	 *                           (SCH-PFTS-CONTENT-001) — when true, forwarded to OR as
-	 *                           `_content_search` to widen matching to document body text.
-	 * @param object $objectService OpenRegister ObjectService instance (already resolved from container).
-	 *
-	 * @return array{results: array<int, array>, total: int} Flat mixed-type result envelope.
-	 *
-	 * @spec openspec/changes/add-public-fulltext-search/tasks.md#task-5
-	 * @spec openspec/changes/add-document-content-search/tasks.md#task-3
-	 *
-	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
-	 * @SuppressWarnings(PHPMD.NPathComplexity)
-	 */
-	public function assemblePublicSearchResults(array $queryParams, object $objectService): array {
-		$registerId = $this->resolveConfiguredId(configKey: 'publication_register');
-		$publicationSchemaId = $this->resolveConfiguredId(configKey: 'publication_schema');
-		$documentSchemaId = $this->resolveConfiguredId(configKey: 'document_schema');
-
-		if ($registerId === null || $publicationSchemaId === null || $documentSchemaId === null) {
-			// Configuration not (yet) loaded — fail closed to an empty envelope rather
-			// than falling back to an unscoped, platform-wide search. Emit a warning so
-			// the failure is observable in production (silent empty is indistinguishable
-			// from "no matches" in the response envelope; operators need a signal that
-			// the deploy is misconfigured).
-			$registerStatus = 'set';
-			$publicationSchemaStatus = 'set';
-			$documentSchemaStatus = 'set';
-			if ($registerId === null) {
-				$registerStatus = 'MISSING';
-			}
-
-			if ($publicationSchemaId === null) {
-				$publicationSchemaStatus = 'MISSING';
-			}
-
-			if ($documentSchemaId === null) {
-				$documentSchemaStatus = 'MISSING';
-			}
-
-			$this->logger?->warning(
-				'PublicationQueryService::assemblePublicSearchResults returning empty envelope — register/schema config unresolved',
-				[
-					'publication_register' => $registerStatus,
-					'publication_schema' => $publicationSchemaStatus,
-					'document_schema' => $documentSchemaStatus,
-				]
-			);
-			return [
-				'results' => [],
-				'total' => 0,
-			];
-		}//end if
-
-		$schemaSlugById = [
-			$publicationSchemaId => 'publication',
-			$documentSchemaId => 'document',
-		];
-
-		// Opt-in content-search (SCH-PFTS-CONTENT-001): widen matching to include
-		// OR-extracted document body text. Default false — omitted/false is
-		// byte-identical to the WOO-506 baseline, so existing consumers see zero
-		// drift. Read before buildSearchQuery() so the raw `_content` key can be
-		// stripped from the forwarded query below (it is OC's own flag name, not
-		// OR's — OR's equivalent is `_content_search`).
-		$contentSearchRequested = filter_var(
-			value: ($queryParams['_content'] ?? false),
-			filter: FILTER_VALIDATE_BOOLEAN
-		);
-
-		$searchQuery = $objectService->buildSearchQuery($queryParams);
-		// The scope is fixed above — strip any caller-supplied scope keys so a request
-		// parameter can never widen the search outside the publication/document schemas.
-		unset($searchQuery['_schema'], $searchQuery['_registers'], $searchQuery['catalogSlug'], $searchQuery['fq']);
-		unset($searchQuery['_content']);
-		$searchQuery['_register'] = $registerId;
-		$searchQuery['_schemas'] = [$publicationSchemaId, $documentSchemaId];
-		$searchQuery['_includeDeleted'] = false;
-
-		if ($contentSearchRequested === true) {
-			// Forward to OR's opt-in chunk-search fan-out (expose-content-search-in
-			// -object-service, PR #473). OR already dedupes its own metadata-match +
-			// chunk-match union on object id before returning; the `@self.id` dedup
-			// below is an additional guarantee at the OC assembly layer per
-			// SCH-PFTS-CONTENT-002 / MODIFIED SCH-PFTS-002.
-			$searchQuery['_content_search'] = true;
-		}
-
-		// _rbac: false — visibility is enforced below via isObjectPublic() AFTER
-		// scoring/merge (SCH-PFTS-004); folding it into the OR query would bias ranking
-		// against rows the corpus considers relevant.
-		$candidateResult = $objectService->searchObjectsPaginated(
-			query: $searchQuery,
-			_rbac: false,
-			_multitenancy: false
-		);
-
-		// Visibility filter runs unconditionally — the endpoint is public per
-		// SCH-PFTS-001, so it MUST NOT surface draft/depublished content to ANY
-		// caller (anonymous, authenticated non-admin, or admin). The prior
-		// `$isAnonymous === true &&` guard let any logged-in user enumerate the
-		// whole register because `_rbac: false` disables OR's schema authorization —
-		// classic broken-authorisation (OWASP A01:2021). Admins who need to see
-		// drafts use the admin `/publications` endpoint, not this public surface.
-		$publicationCache = [];
-		$seenObjectIds = [];
-		$rows = [];
-
-		foreach (($candidateResult['results'] ?? []) as $candidate) {
-			$rowArray = $candidate;
-			if (is_array($rowArray) === false) {
-				$rowArray = $rowArray->jsonSerialize();
-			}
-
-			// Dedup on @self.id (SCH-PFTS-CONTENT-002 / MODIFIED SCH-PFTS-002): a
-			// document matching on BOTH metadata and body text must appear exactly
-			// once. Rows without a resolvable id (defensive — should not occur) are
-			// never deduped against each other. Marker is stamped AFTER all per-row
-			// validation (schema known + publication summary resolved + isObjectPublic
-			// check) so a first candidate that fails validation cannot silently
-			// suppress a later same-id candidate that would have passed — the metadata
-			// arm and the chunk arm can carry differently-stale denormalised
-			// `publication` fields, and only the emit-ready row should claim the seen
-			// slot.
-			$objectId = ($rowArray['@self']['id'] ?? ($rowArray['id'] ?? null));
-			if ($objectId !== null && isset($seenObjectIds[$objectId]) === true) {
-				continue;
-			}
-
-			$schemaId = $this->extractSchemaId(rowArray: $rowArray);
-			$schemaSlug = ($schemaSlugById[$schemaId] ?? null);
-			if ($schemaSlug === null) {
-				continue;
-			}
-
-			$rowArray['@self']['schema'] = $schemaSlug;
-
-			// Strip any raw chunk-search fields OR might have attached to the row
-			// (SCH-PFTS-CONTENT-002 — the public response returns documents, never
-			// chunks). Defence-in-depth: OR already resolves each chunk hit to its
-			// owning ObjectEntity, so these fields should never be present; strip
-			// regardless so any future regression cannot leak them to the anonymous
-			// surface. Mirrors the scope-strip pattern used on the delegated query
-			// above.
-			unset(
-				$rowArray['_snippet'],
-				$rowArray['snippet'],
-				$rowArray['chunk'],
-				$rowArray['chunk_id'],
-				$rowArray['chunkId'],
-				$rowArray['score'],
-				$rowArray['_score']
-			);
-
-			if ($schemaSlug === 'document') {
-				$publicationSummary = $this->resolveDocumentPublicationSummary(
-					documentRow: $rowArray,
-					objectService: $objectService,
-					registerId: $registerId,
-					publicationSchemaId: $publicationSchemaId,
-					cache: $publicationCache
-				);
-
-				if ($publicationSummary === null) {
-					// No linked publication — MUST NOT appear (SCH-PFTS-003).
-					continue;
-				}
-
-				if ($publicationSummary['public'] !== true) {
-					// Transitive visibility (SCH-PFTS-004): linked publication is not
-					// public — drop the document row regardless of caller identity.
-					continue;
-				}
-
-				$rowArray['publication'] = $publicationSummary['summary'];
-			}//end if
-
-			if ($this->isObjectPublic(objectData: $rowArray) === false) {
-				continue;
-			}
-
-			if ($objectId !== null) {
-				$seenObjectIds[$objectId] = true;
-			}
-
-			$rows[] = $rowArray;
-		}//end foreach
-
-		return [
-			'results' => $rows,
-			'total' => count($rows),
-		];
-
-	}//end assemblePublicSearchResults()
-
-	/**
-	 * Resolve a configured register/schema id from app config.
-	 *
-	 * @param string $configKey The app-config key (e.g. `publication_register`).
-	 *
-	 * @return integer|null The configured id, or null when unconfigured/non-numeric.
-	 *
-	 * @spec exclude Configuration-lookup plumbing; no domain behavior of its own.
-	 */
-	private function resolveConfiguredId(string $configKey): ?int {
-		if ($this->config === null) {
-			return null;
-		}
-
-		$value = $this->config->getValueString('opencatalogi', $configKey, '');
-		if ($value === '' || is_numeric($value) === false) {
-			return null;
-		}
-
-		return (int)$value;
-	}//end resolveConfiguredId()
-
-	/**
-	 * Extract the numeric schema id from a serialized object row's `@self.schema`.
-	 *
-	 * @param array $rowArray The serialized object row.
-	 *
-	 * @return integer|null The schema id, or null when absent/non-numeric.
-	 *
-	 * @spec exclude Row-shape plumbing; no domain behavior of its own.
-	 */
-	private function extractSchemaId(array $rowArray): ?int {
-		$schema = ($rowArray['@self']['schema'] ?? ($rowArray['schema'] ?? null));
-		if (is_array($schema) === true) {
-			$schema = ($schema['id'] ?? null);
-		}
-
-		if ($schema === null || is_numeric($schema) === false) {
-			return null;
-		}
-
-		return (int)$schema;
-	}//end extractSchemaId()
-
-	/**
-	 * Resolve the linked publication's `{id, slug, title}` summary for a document row.
-	 *
-	 * Looks the linked publication up by slug (denormalised on the document's own
-	 * `publication.slug` property) so the response can carry the publication's real
-	 * UUID even though the authored document payload only carries `slug` + `title`
-	 * (design.md "Seed publications" — the UUID does not exist until import). Results
-	 * are cached per request so a page of documents linking the same publication only
-	 * issues one lookup per unique slug.
-	 *
-	 * @param array $documentRow The document row (post `@self.schema` rewrite).
-	 * @param object $objectService OpenRegister ObjectService instance.
-	 * @param integer $registerId The publication register id.
-	 * @param integer $publicationSchemaId The publication schema id.
-	 * @param array<string,mixed> $cache Per-request slug → summary cache (by
-	 *                                   reference).
-	 * @param-out array<int|string,mixed> $cache The key type WIDENS on write, and
-	 *        that is PHP, not sloppiness: `$slug` is a non-empty string, but PHP
-	 *        coerces a CANONICAL NUMERIC string array key to an integer, so a
-	 *        publication slug of "2024" lands under the int key 2024. Lookups by
-	 *        the same string coerce identically, so `array_key_exists()` still
-	 *        works; only code testing `is_string()` on the key would be misled.
-	 *
-	 * @return array{summary: array{id:string,slug:string,title:string}, public: bool}|null
-	 *
-	 * @spec openspec/changes/add-public-fulltext-search/tasks.md#task-6
-	 */
-	private function resolveDocumentPublicationSummary(
-		array $documentRow,
-		object $objectService,
-		int $registerId,
-		int $publicationSchemaId,
-		array &$cache,
-	): ?array {
-		$linked = ($documentRow['publication'] ?? null);
-		$slug = null;
-		if (is_array($linked) === true) {
-			$slug = ($linked['slug'] ?? null);
-		} elseif (is_string($linked) === true && $linked !== '') {
-			$slug = $linked;
-		}
-
-		if ($slug === null || $slug === '') {
-			return null;
-		}
-
-		if (array_key_exists($slug, $cache) === true) {
-			return $cache[$slug];
-		}
-
-		// Slug lives on the magic metadata column `_slug` and is addressed via
-		// the nested `@self` block (equivalent to `@self.slug` in URL query form).
-		// A bare `slug` key becomes a schema-property filter — publications have
-		// no `slug` property, so the search matches nothing and every document
-		// row is silently dropped by the assembler with a null publication
-		// summary.
-		$matches = $objectService->searchObjects(
-			query: [
-				'_register' => $registerId,
-				'_schema' => $publicationSchemaId,
-				'@self' => ['slug' => $slug],
-				'_limit' => 1,
-			],
-			_rbac: false,
-			_multitenancy: false
-		);
-
-		if (empty($matches) === true) {
-			$cache[$slug] = null;
-			return null;
-		}
-
-		$publication = $matches[0];
-		if (is_array($publication) === false) {
-			$publication = $publication->jsonSerialize();
-		}
-
-		$summary = [
-			'summary' => [
-				'id' => (string)($publication['id'] ?? ''),
-				'slug' => (string)($publication['@self']['slug'] ?? $slug),
-				'title' => (string)($publication['title'] ?? ''),
-			],
-			'public' => $this->isObjectPublic(objectData: $publication),
-		];
-
-		$cache[$slug] = $summary;
-		return $summary;
-	}//end resolveDocumentPublicationSummary()
-
-	/**
-	 * Find the register and schema IDs for an object UUID within a constrained scope.
-	 *
-	 * Locates which OpenRegister (register × schema) pair holds a given UUID, always
-	 * scoped to the caller-supplied register/schema lists. The lookup goes through
-	 * OpenRegister's `ObjectService` (ADR-022: consume OR abstractions) rather than
-	 * issuing raw SQL against OR's internal per-register/per-schema storage tables or
-	 * probing the DBMS catalog for their existence. OR remains free to change its
-	 * physical storage layout without breaking opencatalogi.
-	 *
-	 * The legacy platform-wide search across every magic table is gone (#734) — it was
-	 * an anonymous-reachable DoS vector and also leaked cross-catalog objects (#733).
-	 * Callers MUST pass non-empty $allowedRegisters and $allowedSchemas; otherwise the
-	 * method returns null without touching OpenRegister.
-	 *
-	 * @param string $uuid The UUID of the object to find.
-	 * @param array<int|string>|null $allowedRegisters Register IDs the search may touch.
-	 * @param array<int|string>|null $allowedSchemas Schema IDs the search may touch.
-	 *
-	 * @return array{register: int, schema: int}|null The register/schema IDs, or null.
-	 *
-	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
-	 *
-	 * @spec openspec/specs/opencatalogi-adopt-or-abstractions/spec.md
-	 */
-	public function findObjectLocation(
-		string $uuid,
-		?array $allowedRegisters = null,
-		?array $allowedSchemas = null,
-	): ?array {
-		if (empty($allowedRegisters) === true || empty($allowedSchemas) === true) {
-			// Fail closed — without an explicit constraint we will NOT do a
-			// platform-wide scan. This is the post-#734 behaviour.
-			return null;
-		}
-
-		$objectService = $this->getObjectService();
-		if ($objectService === null) {
-			return null;
-		}
-
-		// Locate the object by asking OpenRegister to resolve it within each
-		// constrained (register × schema) pair. The location lookup is visibility-
-		// agnostic (_rbac: false) — it mirrors the previous behaviour of locating an
-		// object's home pair; callers re-apply their own RBAC/visibility filter on the
-		// subsequent read. No raw SQL and no knowledge of OR's table layout.
-		foreach ($allowedRegisters as $register) {
-			if (is_numeric($register) === false) {
-				continue;
-			}
-
-			$registerId = (int)$register;
-			foreach ($allowedSchemas as $schema) {
-				if (is_numeric($schema) === false) {
-					continue;
-				}
-
-				$schemaId = (int)$schema;
-				try {
-					$object = $objectService->find(
-						id: $uuid,
-						_extend: [],
-						files: false,
-						register: $registerId,
-						schema: $schemaId,
-						_rbac: false,
-						_multitenancy: false
-					);
-				} catch (DoesNotExistException $e) {
-					continue;
-				} catch (\Exception $e) {
-					continue;
-				}
-
-				if ($object !== null) {
-					return [
-						'register' => $registerId,
-						'schema' => $schemaId,
-					];
-				}
-			}//end foreach
-		}//end foreach
-
-		return null;
-	}//end findObjectLocation()
-
-	/**
-	 * Resolve the OpenRegister ObjectService from the container.
-	 *
-	 * @return object|null The OpenRegister ObjectService, or null when OR is unavailable.
-	 *
-	 * @spec exclude Lazy dependency-injection accessor for the OR ObjectService; pure
-	 *       framework plumbing, no domain behavior.
-	 */
-	private function getObjectService(): ?object {
-		try {
-			return $this->container->get('OCA\OpenRegister\Service\ObjectService');
-		} catch (\Throwable $e) {
-			return null;
-		}
-
-	}//end getObjectService()
-
-	/**
-	 * Build the ObjectService search query for a catalog index request.
-	 *
-	 * Merges the incoming request parameters with catalog-level schema/register filters,
-	 * handles multi-schema and multi-register cases, and strips non-universal _order fields
-	 * when searching across multiple registers.
-	 *
-	 * @param array $catalog Catalog data array (keys: schemas, registers).
-	 * @param array $queryParams Raw request query parameters from IRequest::getParams().
-	 * @param object $objectService ObjectService instance (already resolved from container).
-	 *
-	 * @return array The merged and sanitised search query ready for searchObjectsPaginated().
-	 *
-	 * @spec exclude Query-assembly plumbing extracted from PublicationsController; translates
-	 *       request params into an ObjectService search query, no domain behavior of its own.
-	 *
-	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
-	 * @SuppressWarnings(PHPMD.NPathComplexity)
-	 */
-	public function buildCatalogSearchQuery(array $catalog, array $queryParams, object $objectService): array {
-		// Use ObjectService centralized query builder which handles dot-to-underscore conversion.
-		$searchQuery = array_merge(
-			$objectService->buildSearchQuery($queryParams),
-			['_includeDeleted' => false]
-		);
-
-		// Clean up catalog-specific parameters.
-		unset($searchQuery['catalogSlug'], $searchQuery['fq']);
-
-		// Handle catalog filtering using _schemas for multi-schema search.
-		if (empty($catalog['schemas']) === false) {
-			$schemas = $catalog['schemas'];
-			// Parse JSON string if needed.
-			if (is_string($schemas) === true) {
-				$schemas = json_decode($schemas, true) ?? [];
-			}
-
-			$schemas = array_map('intval', $schemas);
-			// Pass all schemas for both search and faceting.
-			$searchQuery['_schemas'] = $schemas;
-			// Only set _schema for single-schema catalogs for magic mapper optimization.
-			// Explicitly unset _schema for multi-schema search to prevent auto-setting.
-			unset($searchQuery['_schema']);
-			if (count($schemas) === 1) {
-				$searchQuery['_schema'] = $schemas[0];
-			}
-		}//end if
-
-		if (empty($catalog['registers']) === false) {
-			$registers = $catalog['registers'];
-			// Parse JSON string if needed.
-			if (is_string($registers) === true) {
-				$registers = json_decode($registers, true) ?? [];
-			}
-
-			$registers = array_map('intval', $registers);
-			if (count($registers) === 1) {
-				// Single register: use magic mapper optimization.
-				$searchQuery['_register'] = $registers[0];
-				return $searchQuery;
-			}
-
-			// Multi-register: pass all register IDs and prevent auto-setting.
-			$searchQuery['_registers'] = $registers;
-			$searchQuery['_register'] = null;
-
-			// Multi-register search: strip _order on non-universal fields
-			// since schemas may have different property names (e.g., 'name' vs 'naam').
-			// Only allow metadata fields that exist in all magic mapper tables.
-			if (empty($searchQuery['_order']) === false && is_array($searchQuery['_order']) === true) {
-				foreach (array_keys($searchQuery['_order']) as $orderField) {
-					if (in_array($orderField, self::UNIVERSAL_ORDER_FIELDS, true) === false) {
-						unset($searchQuery['_order'][$orderField]);
-					}
-				}
-
-				if (empty($searchQuery['_order']) === true) {
-					unset($searchQuery['_order']);
-				}
-			}
-		}//end if
-
-		return $searchQuery;
-	}//end buildCatalogSearchQuery()
-
-	/**
-	 * Resolve schema and register objects from OpenRegister mappers for catalog enrichment.
-	 *
-	 * Returns an array with keys 'schemas' (id → {id, slug, title}) and
-	 * 'registers' (id → {id, slug, title}). Missing entries are silently skipped.
-	 *
-	 * @param array $catalog Catalog data array (keys: schemas, registers).
-	 *
-	 * @return array{schemas: array<int|string, array>, registers: array<int|string, array>}
-	 *
-	 * @spec exclude Metadata-resolution plumbing extracted from PublicationsController; looks up
-	 *       schema/register labels via OR mappers for response enrichment, no domain behavior.
-	 */
-	public function resolveSchemaAndRegisterObjects(array $catalog): array {
-		$resolvedSchemas = [];
-		$resolvedRegisters = [];
-
-		try {
-			$schemaMapper = $this->container->get('OCA\OpenRegister\Db\SchemaMapper');
-			$registerMapper = $this->container->get('OCA\OpenRegister\Db\RegisterMapper');
-
-			$schemaIds = $catalog['schemas'] ?? [];
-			if (is_string($schemaIds) === true) {
-				$schemaIds = json_decode($schemaIds, true) ?? [];
-			}
-
-			foreach ($schemaIds as $schemaId) {
-				try {
-					$schema = $schemaMapper->find((int)$schemaId);
-					$resolvedSchemas[$schemaId] = [
-						'id' => $schema->getId(),
-						'slug' => $schema->getSlug(),
-						'title' => $schema->getTitle(),
-					];
-				} catch (\Exception $e) {
-					// Schema not found, skip.
-				}
-			}
-
-			$registerIds = $catalog['registers'] ?? [];
-			if (is_string($registerIds) === true) {
-				$registerIds = json_decode($registerIds, true) ?? [];
-			}
-
-			foreach ($registerIds as $registerId) {
-				try {
-					$register = $registerMapper->find((int)$registerId);
-					$resolvedRegisters[$registerId] = [
-						'id' => $register->getId(),
-						'slug' => $register->getSlug(),
-						'title' => $register->getTitle(),
-					];
-				} catch (\Exception $e) {
-					// Register not found, skip.
-				}
-			}
-		} catch (\Exception $e) {
-			// OpenRegister not available, return empty sets.
-		}//end try
-
-		return [
-			'schemas' => $resolvedSchemas,
-			'registers' => $resolvedRegisters,
-		];
-
-	}//end resolveSchemaAndRegisterObjects()
-
-	/**
-	 * Find an object within a catalog's registers/schemas using ObjectService.
-	 *
-	 * Iterates over each (register, schema) combination in the catalog.
-	 * Returns the first matching object entity, or null if not found.
-	 *
-	 * @param array $catalog Catalog data array (keys: schemas, registers).
-	 * @param string $id The UUID of the object to find.
-	 * @param object $objectService ObjectService instance (already resolved from container).
-	 *
-	 * @return object|null The found object entity, or null.
-	 *
-	 * @spec exclude Lookup plumbing extracted from PublicationsController; iterates a catalog's
-	 *       (register, schema) pairs and delegates the actual read to ObjectService::find().
-	 */
-	public function findObjectInCatalog(array $catalog, string $id, object $objectService): ?object {
-		$catalogRegisters = $catalog['registers'] ?? [];
-		$catalogSchemas = $catalog['schemas'] ?? [];
-
-		// Parse JSON string if needed (catalog fields may be JSON-encoded).
-		if (is_string($catalogRegisters) === true) {
-			$catalogRegisters = json_decode($catalogRegisters, true) ?? [];
-		}
-
-		if (is_string($catalogSchemas) === true) {
-			$catalogSchemas = json_decode($catalogSchemas, true) ?? [];
-		}
-
-		// WF4 / wave-12: iterate ALL (register × schema) pairs, not just $catalogRegisters[0].
-		// Previously the code only tried the first register in the list, so objects in
-		// register #2+ were unreachable via this path and returned spurious 404s.
-		if (empty($catalogRegisters) === false) {
-			$registersToTry = array_map('intval', $catalogRegisters);
-		} else {
-			$registersToTry = [null];
-		}
-
-		$schemasToTry = array_map('intval', $catalogSchemas);
-
-		foreach ($registersToTry as $register) {
-			foreach ($schemasToTry as $schemaId) {
-				try {
-					$object = $objectService->find(
-						id: $id,
-						_extend: [],
-						files: false,
-						register: $register,
-						schema: $schemaId,
-						_rbac: true,
-						_multitenancy: false
-					);
-					if ($object !== null) {
-						return $object;
-					}
-				} catch (DoesNotExistException $e) {
-					// Object not found in this (register, schema) pair — try next.
-					continue;
-				}
-			}//end foreach
-		}//end foreach
-
-		return null;
-	}//end findObjectInCatalog()
-
-	/**
-	 * Recursively strips empty values (null, empty string, empty array) from an array.
-	 *
-	 * Used to reduce API response payload by omitting properties that have no value.
-	 * Values of 0, false, and "0" are preserved as they are meaningful.
-	 *
-	 * @param array $data The data array to strip empty values from.
-	 *
-	 * @return array The data with empty values removed.
-	 *
-	 * @spec exclude Response-shaping plumbing extracted from PublicationsController; recursively
-	 *       prunes empty values to slim the payload, no domain behavior.
-	 *
-	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
-	 */
-	public function stripEmptyValues(array $data): array {
-		$result = [];
-		foreach ($data as $key => $value) {
-			if (is_array($value) === true) {
-				$this->processArrayValue(result: $result, key: $key, value: $value);
-				continue;
-			}//end if
-
-			if ($value === null || $value === '') {
-				continue;
-			}
-
-			$result[$key] = $value;
-		}//end foreach
-
-		return $result;
-	}//end stripEmptyValues()
-
-	/**
-	 * Process a single array value during empty-value stripping.
-	 *
-	 * Handles both sequential (list) and associative arrays, recursing into nested arrays.
-	 *
-	 * @param array $result Reference to the result array being built.
-	 * @param int|string $key The key for this value.
-	 * @param array $value The array value to process.
-	 *
-	 * @return void
-	 */
-	private function processArrayValue(array &$result, int|string $key, array $value): void {
-		if (array_is_list($value) === true) {
-			$stripped = [];
-			foreach ($value as $item) {
-				if (is_array($item) === false) {
-					$stripped[] = $item;
-					continue;
-				}
-
-				$stripped[] = $this->stripEmptyValues(data: $item);
-			}
-
-			if (empty($stripped) === false) {
-				$result[$key] = $stripped;
-			}
-
-			return;
-		}
-
-		$stripped = $this->stripEmptyValues(data: $value);
-		if (empty($stripped) === false) {
-			$result[$key] = $stripped;
-		}
-
-	}//end processArrayValue()
+class PublicationQueryService
+{
+
+    /**
+     * Order fields that exist in every magic-mapper table.
+     *
+     * Used when filtering _order for multi-register searches.
+     *
+     * @var array<string>
+     */
+    private const UNIVERSAL_ORDER_FIELDS = [
+        '_uuid',
+        '_created',
+        '_updated',
+        '_name',
+        '_description',
+        '_summary',
+        '_relevance',
+    ];
+
+    /**
+     * Hard cap on `_limit` for the anonymous public FTS surface.
+     *
+     * Review #147 🟡 (unauthenticated DoS): without a cap, an anonymous
+     * `?_limit=1000000&_content=true` fanned out unbounded into OR's
+     * chunk-search path, giving a public CPU/memory amplifier. 100 rows
+     * per page matches typical faceted-search UI needs; callers with a
+     * legitimate higher-throughput need MUST paginate.
+     *
+     * @var integer
+     */
+    public const PUBLIC_LIMIT_MAX = 100;
+
+    /**
+     * Constructor.
+     *
+     * @param ContainerInterface   $container   DI container
+     * @param IUserSession|null    $userSession User session — consumed by {@see isAnonymous()},
+     *                                          which the public `/publications/{id}/uses` and
+     *                                          `/used-by` endpoints use to gate visibility on
+     *                                          non-public root objects. Auto-wired at runtime.
+     * @param IAppConfig|null      $config      App config; used by the catalog-enumeration path to locate the catalog register/schema.
+     * @param LoggerInterface|null $logger      Logger — surfaces the fail-closed empty-envelope branch so silent
+     *                                          catalog-scope resolution failure is observable in production (WOO-536).
+     */
+    public function __construct(
+        private readonly ContainerInterface $container,
+        private readonly ?IUserSession $userSession=null,
+        private readonly ?IAppConfig $config=null,
+        private readonly ?LoggerInterface $logger=null,
+    ) {
+
+    }//end __construct()
+
+    /**
+     * Assemble the public full-text search result envelope (SCH-PFTS-001,
+     * SCH-PFTS-CAT-001..003).
+     *
+     * Delegates entirely to OR's `ObjectService::searchObjectsPaginated` across the
+     * (register × schema) set derived from the catalog scope. Matches from every
+     * schema in every catalog the caller may see are merged into a single flat array
+     * discriminated by `@self.schema` slug, resolved dynamically via SchemaMapper. A
+     * document row's linked publication is embedded via a per-document
+     * `_relations_contains` refinement; documents whose linked publication is not
+     * publicly visible are dropped (transitive visibility).
+     *
+     * Visibility is enforced in SQL by OR's schema-level RBAC under the
+     * `_rbac_as_public: true` primitive (openregister PR #2855, RBA-PUBLIC-001..006):
+     * admin bypass is skipped, `_owner` OR-in is suppressed, admin and anonymous
+     * callers see the exact same result set — the uniform-visibility contract of
+     * SCH-PFTS-001, previously enforced by a PHP post-filter, now lives in SQL.
+     *
+     * Scope resolution:
+     *   1. `_catalog=<slug>` — that catalog's registers + schemas (SCH-PFTS-CAT-001).
+     *   2. `_catalogi[]=…` — union across the resolved catalogs.
+     *   3. no param — union of `listed: true` + `published` catalogs (SCH-PFTS-CAT-002).
+     * A caller's own `_schema`/`_registers`/`fq`/`catalogSlug` cannot widen scope past
+     * the catalog boundary — those are stripped before forwarding to OR.
+     *
+     * Content-search: this ships metadata search across schema properties + `@self`
+     * metadata. When `_content=true` is set, OR's `_content_search` flag is forwarded
+     * to widen matching to document body text (WOO-517 add-on). Extraction is owned
+     * by OR's TextExtractionService + ChunkMapper.
+     *
+     * @param array  $queryParams   Raw request query parameters from IRequest::getParams().
+     *                              Recognised keys: `_content` (opt-in body-text search),
+     *                              `_catalog` (single catalog slug), `_catalogi[]` (multi
+     *                              catalog union).
+     * @param object $objectService OpenRegister ObjectService instance (already resolved from container).
+     *
+     * @return array{results: array<int, array>, total: int} Flat mixed-type result envelope.
+     *
+     * @spec openspec/changes/fix-fts-catalog-model-alignment/specs/search/spec.md
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function assemblePublicSearchResults(array $queryParams, object $objectService): array
+    {
+        // Stap 2 — Catalog-derived scope (SCH-PFTS-CAT-001..003).
+        // Replaces the pre-WOO-536 app-config-derived scope (publication_register /
+        // publication_schema / document_schema) with a catalog-model union so
+        // /api/search covers every (register × schema) the caller may see.
+        $scope = $this->resolveCatalogScope(queryParams: $queryParams);
+        if (empty($scope['schemas']) === true) {
+            // Fail-closed: no schemas in scope — either an explicit _catalog / _catalogi[]
+            // resolved to nothing, or the deployment has no listed+published catalogs.
+            $this->logger?->warning(
+                'PublicationQueryService::assemblePublicSearchResults returning empty envelope — no schemas in resolved catalog scope',
+                [
+                    '_catalog'  => ($queryParams['_catalog']  ?? null),
+                    '_catalogi' => ($queryParams['_catalogi'] ?? null),
+                ]
+            );
+            return [
+                'results' => [],
+                'total'   => 0,
+            ];
+        }
+
+        // ADR-083 preflight: OR is an optional dependency for this path. Establish
+        // that SchemaMapper is loadable BEFORE we touch $objectService — every OR
+        // call downstream ($objectService->buildSearchQuery, ->searchObjectsPaginated,
+        // and the container->get(SchemaMapper) below) assumes the package is present.
+        // If it isn't, return the same empty envelope shape as the no-scope branch
+        // so the endpoint stays uniform for the anonymous caller.
+        if (class_exists('OCA\\OpenRegister\\Db\\SchemaMapper') === false) {
+            $this->logger?->warning(
+                'PublicationQueryService: OpenRegister SchemaMapper unavailable — returning empty envelope',
+                []
+            );
+            return ['results' => [], 'total' => 0];
+        }
+
+        // Opt-in content-search (WOO-517): widen matching to include
+        // OR-extracted document body text. Default false — omitted/false is
+        // byte-identical to the WOO-506 baseline, so existing consumers see zero
+        // drift. Read before buildSearchQuery() so the raw `_content` key can be
+        // stripped from the forwarded query below (it is OC's own flag name, not
+        // OR's — OR's equivalent is `_content_search`).
+        $contentSearchRequested = filter_var(
+            value: ($queryParams['_content'] ?? false),
+            filter: FILTER_VALIDATE_BOOLEAN
+        );
+
+        $searchQuery = $objectService->buildSearchQuery($queryParams);
+        // Q7 Interpretation A: strip any client-supplied scope-widening params so a
+        // request cannot bypass the catalog-derived scope. This preserves the
+        // pre-WOO-536 discipline that clients cannot inject their own register/schema
+        // set past the resolved catalog boundary.
+        unset($searchQuery['_schema'], $searchQuery['_registers'], $searchQuery['catalogSlug'], $searchQuery['fq']);
+        unset($searchQuery['_content']);
+        // OC-level params consumed by resolveCatalogScope — strip before forwarding to OR.
+        unset($searchQuery['_catalog'], $searchQuery['_catalogi']);
+
+        // Apply the resolved scope. Single-register: use `_register` for the magic-mapper
+        // fast path. Multi-register: pass `_registers[]` and explicitly nullify `_register`
+        // to prevent ObjectService from auto-setting it.
+        $searchQuery['_schemas'] = $scope['schemas'];
+        if (count($scope['registers']) === 1) {
+            $searchQuery['_register'] = $scope['registers'][0];
+        } else if (empty($scope['registers']) === false) {
+            $searchQuery['_registers'] = $scope['registers'];
+            $searchQuery['_register']  = null;
+        }
+        $searchQuery['_includeDeleted'] = false;
+
+        // Clamp `_limit` to a hard maximum (review #147 🟡 unauthenticated DoS —
+        // no cap allowed anonymous `?_limit=1000000&_content=true` to fan out
+        // unbounded into OR's chunk-search path). The cap is enforced HERE, not
+        // in the controller, so every entry point that reaches this assembler
+        // is covered (`SearchController::index()` is the only one today, but
+        // any future entrypoint automatically inherits the cap). 100 mirrors
+        // typical faceted-search page sizes; callers wanting more MUST paginate.
+        $requestedLimit = ($searchQuery['_limit'] ?? null);
+        if (is_numeric($requestedLimit) === true && (int) $requestedLimit > self::PUBLIC_LIMIT_MAX) {
+            $searchQuery['_limit'] = self::PUBLIC_LIMIT_MAX;
+        }
+
+        if ($contentSearchRequested === true) {
+            // Forward to OR's opt-in chunk-search fan-out (expose-content-search-in
+            // -object-service). OR already dedupes its own metadata-match + chunk-match
+            // union on object id before returning; the `@self.id` dedup below is an
+            // additional guarantee at the OC assembly layer.
+            $searchQuery['_content_search'] = true;
+        }
+
+        // Stap 1 — Enable OR's schema-level RBAC with the endpoint-level anon-context
+        // primitive (RBA-PUBLIC-001..006 from openregister PR #2855 / SCH-PFTS-001).
+        // `_rbac_as_public: true` forces $userId=null, $userGroups=[], skips admin bypass
+        // and the `_owner` OR-in — every caller sees the same public-group-eligible
+        // result set. Multitenancy auto-bypasses under this flag (RBA-PUBLIC-002).
+        $candidateResult = $objectService->searchObjectsPaginated(
+            query: $searchQuery,
+            _rbac: true,
+            _multitenancy: false,
+            _rbacAsPublic: true
+        );
+
+        // Stap 3 — Dynamic schema-discriminator via SchemaMapper. Replaces the pre-WOO-536
+        // two-element hardcoded map; per-request cache so multi-schema search doesn't hit
+        // the DB per row. Availability preflight for OR ran at the top of this method.
+        $schemaMapper = $this->container->get('OCA\\OpenRegister\\Db\\SchemaMapper');
+        // Phpstan needs to track the by-ref parameter's element type across resolvePublicationSchemaId().
+        /* @var array<int, string|null> $schemaSlugById */
+        $schemaSlugById = [];
+
+        // Track the publication schema for document→publication refinement (Stap 5a).
+        // Shares the outer $schemaSlugById cache so the pre-loop scan doubles as a
+        // warm-up for the row-loop lookups (M3 — no duplicate mapper hits).
+        $publicationSchemaId = $this->resolvePublicationSchemaId(
+            schemaMapper: $schemaMapper,
+            scopeSchemas: $scope['schemas'],
+            schemaSlugById: $schemaSlugById
+        );
+        // Track a single register for per-document refinement queries. Falls back to null
+        // when the scope spans multiple registers — refinement then goes through the
+        // multi-schema path via the query dict.
+        $refinementRegisterId = null;
+        if (count($scope['registers']) === 1) {
+            $refinementRegisterId = $scope['registers'][0];
+        }
+
+        // Stap 4 — Removed the isObjectPublic() PHP post-filter. Visibility is now
+        // enforced in SQL by OR's schema authorization (RBA-PUBLIC-001..004). OR's
+        // `total` and `facets` therefore reflect visible-only counts by construction —
+        // no undercount workaround, no facet stripping.
+        $publicationCache = [];
+        // M2 slug cache — memoises tryPublicationSlugLookup results (including null
+        // misses) by slug across the whole page so N documents sharing one
+        // `_relations['publication.slug']` collapse to a single scan.
+        $slugCache        = [];
+        $seenObjectIds    = [];
+        $rows = [];
+        // Track how many candidates the loop dropped so we can subtract from OR's
+        // pre-drop `total` below — see the envelope comment for the full rationale.
+        $droppedCount = 0;
+
+        foreach (($candidateResult['results'] ?? []) as $candidate) {
+            $rowArray = $candidate;
+            if (is_array($rowArray) === false) {
+                $rowArray = $rowArray->jsonSerialize();
+            }
+
+            // Dedup on @self.id: a document matching on BOTH metadata and body text must
+            // appear exactly once. Rows without a resolvable id (defensive — should not
+            // occur) are never deduped. Marker is stamped AFTER per-row validation so a
+            // first candidate that fails validation cannot silently suppress a later
+            // same-id candidate that would have passed. Dedup drops do NOT count against
+            // `total` — they collapse a single logical hit that OR double-counted, so
+            // OR's total remains the correct upper bound.
+            $objectId = ($rowArray['@self']['id'] ?? ($rowArray['id'] ?? null));
+            if ($objectId !== null && isset($seenObjectIds[$objectId]) === true) {
+                continue;
+            }
+
+            $schemaId = $this->extractSchemaId(rowArray: $rowArray);
+            if ($schemaId === null) {
+                $droppedCount++;
+                continue;
+            }
+
+            // Stap 3 — resolve slug via SchemaMapper, cached per-request.
+            if (isset($schemaSlugById[$schemaId]) === false) {
+                try {
+                    $schemaSlugById[$schemaId] = $schemaMapper->find($schemaId)->getSlug();
+                } catch (\Throwable $e) {
+                    $this->logger?->warning('WOO-536: schema slug lookup failed', ['schemaId' => $schemaId, 'error' => $e->getMessage()]);
+                    $schemaSlugById[$schemaId] = null;
+                }
+            }
+            $schemaSlug = $schemaSlugById[$schemaId];
+            if ($schemaSlug === null) {
+                $droppedCount++;
+                continue;
+            }
+
+            $rowArray['@self']['schema'] = $schemaSlug;
+
+            // RET-006 belt-and-braces: `status: 'archived'` is a terminal-hidden state
+            // that MUST NOT appear on any public surface, regardless of publish/depublish
+            // dates. The schema-level SQL RBAC does not include a status-check (would need
+            // a `status: {$ne: archived}` clause on the read-rules; that clause interacts
+            // badly with legacy rows where `status` is NULL — SQL treats `NULL != x` as
+            // unknown, which would silently drop pre-status-migration rows). Enforcing here
+            // in PHP is deterministic and safe for legacy data.
+            if (($rowArray['status'] ?? null) === 'archived') {
+                $droppedCount++;
+                continue;
+            }
+
+            // Strip any raw chunk-search fields OR might have attached to the row.
+            // Defence-in-depth: OR already resolves each chunk hit to its owning
+            // ObjectEntity, so these fields should never be present.
+            unset(
+                $rowArray['_snippet'],
+                $rowArray['snippet'],
+                $rowArray['chunk'],
+                $rowArray['chunk_id'],
+                $rowArray['chunkId'],
+                $rowArray['score'],
+                $rowArray['_score']
+            );
+
+            if ($schemaSlug === 'document' && $publicationSchemaId !== null) {
+                $publicationSummary = $this->resolveDocumentPublicationSummary(
+                    documentRow: $rowArray,
+                    objectService: $objectService,
+                    registerId: $refinementRegisterId,
+                    publicationSchemaId: $publicationSchemaId,
+                    cache: $publicationCache,
+                    slugCache: $slugCache
+                );
+
+                if ($publicationSummary === null || $publicationSummary['public'] !== true) {
+                    // No linked publication OR linked publication is not publicly
+                    // visible under _rbac_as_public — drop the document row
+                    // (transitive visibility; RBA-PUBLIC-006 propagates the anon
+                    // context to the per-document refinement).
+                    $droppedCount++;
+                    continue;
+                }
+
+                $rowArray['publication'] = $publicationSummary['summary'];
+            }
+
+            if ($objectId !== null) {
+                $seenObjectIds[$objectId] = true;
+            }
+
+            $rows[] = $rowArray;
+        }//end foreach
+
+        // Stap 4 — Envelope `total` reconciles OR's global count with the PHP drops.
+        //
+        // OR's `total` is the GLOBAL count of candidate rows matching the query
+        // across every page (needed so paginated consumers can compute `has_more`).
+        // Under `_rbacAsPublic: true` most drops are already applied at the SQL
+        // layer — but the row-loop still filters two classes OR cannot see:
+        //   1. `status: 'archived'` (belt-and-braces RET-006, no schema-side rule)
+        //   2. Transitive visibility on documents whose linked publication is not
+        //      publicly visible (N4a — `_content=true` chunk-hits are the common
+        //      trigger; OR's schema RBAC gates the document but not its parent
+        //      publication).
+        // Both drops leak "invisible" rows into OR's `total`. Sending OR's raw
+        // total when we dropped rows on THIS page would ship `total > count(rows)`
+        // with no way for the caller to reconcile — the SCH-PFTS-004 bug pattern.
+        //
+        // Compromise without an OR schema change: subtract per-page drops from
+        // OR's total, floored at `count($rows)` so the envelope never claims
+        // fewer visible items than it actually shipped. This preserves the
+        // pagination signal (total > count(rows) still means "more pages") while
+        // guaranteeing total ≥ count(rows) on every page. It is a per-page
+        // approximation: later pages may drop more rows and shrink `total`
+        // further, so a UI polling forward will see `total` decrease monotonically
+        // as invisible candidates are filtered out — acceptable for a public
+        // FTS surface where the exact global count is not a hard requirement.
+        //
+        // The architecturally clean fix (push transitive visibility down to
+        // OR's schema RBAC) needs an OR schema change and cross-schema `read`
+        // rules; tracked as follow-up.
+        $orTotal        = (int) ($candidateResult['total'] ?? count($rows));
+        $adjustedTotal  = max(count($rows), ($orTotal - $droppedCount));
+        $envelope = [
+            'results' => $rows,
+            'total'   => $adjustedTotal,
+        ];
+
+        if (isset($candidateResult['facets']) === true) {
+            $envelope['facets'] = $candidateResult['facets'];
+        }
+        if (isset($candidateResult['facetable']) === true) {
+            $envelope['facetable'] = $candidateResult['facetable'];
+        }
+        return $envelope;
+
+    }//end assemblePublicSearchResults()
+
+    /**
+     * Resolve the register + schema union that /api/search covers for this request.
+     *
+     * Central discriminator for SCH-PFTS-CAT-001..003:
+     *   1. Explicit `_catalog` (single slug) → that catalog's registers + schemas.
+     *   2. Explicit `_catalogi[]` (array of slugs) → union across the resolved catalogs.
+     *   3. No param → union across every catalog where `listed: true` AND `published`
+     *      is in the past. This is the SCH-PFTS-CAT-002 default that mirrors the
+     *      pre-WOO-536 anon-visible scope discipline (#733 cross-catalog leak,
+     *      #734 anonymous DoS — both stay closed under this rule).
+     *
+     * Unknown slugs are silently dropped from the union so a typo does not fail the
+     * whole request. The caller MUST inspect the returned `schemas` array and
+     * fail-closed if empty (empty envelope).
+     *
+     * @param array $queryParams Raw request query dict.
+     *
+     * @return array{registers: int[], schemas: int[]}
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    private function resolveCatalogScope(array $queryParams): array
+    {
+        $catalogiService = null;
+        try {
+            $catalogiService = $this->container->get('OCA\\OpenCatalogi\\Service\\CatalogiService');
+        } catch (\Throwable $e) {
+            $this->logger?->warning('WOO-536: CatalogiService unavailable', ['error' => $e->getMessage()]);
+            return ['registers' => [], 'schemas' => []];
+        }
+
+        $singleCatalog = ($queryParams['_catalog'] ?? null);
+        $multiCatalog  = ($queryParams['_catalogi'] ?? []);
+
+        // 1. Explicit single-catalog scope.
+        if (is_string($singleCatalog) === true && $singleCatalog !== '') {
+            $c = $catalogiService->getCatalogBySlug($singleCatalog);
+            // C2: an unpublished catalog must be indistinguishable from a
+            // non-existent one on the public endpoint — else anonymous callers
+            // could probe for drafts by slug-guessing. `getCatalogBySlug` uses
+            // `_rbac:false`, so we re-apply the published predicate in PHP.
+            if ($c === null || $this->isCatalogPubliclyAvailable(catalog: $c) === false) {
+                return ['registers' => [], 'schemas' => []];
+            }
+            return [
+                'registers' => $this->normalizeIds(value: ($c['registers'] ?? [])),
+                'schemas'   => $this->normalizeIds(value: ($c['schemas']   ?? [])),
+            ];
+        }
+
+        // 2. Explicit multi-catalog union.
+        if (is_array($multiCatalog) === true && empty($multiCatalog) === false) {
+            $regs = [];
+            $schemas = [];
+            foreach ($multiCatalog as $slug) {
+                if (is_string($slug) === false || $slug === '') {
+                    continue;
+                }
+                $c = $catalogiService->getCatalogBySlug($slug);
+                // Same C2 guard as the single-catalog branch — drop unpublished
+                // catalogs silently from the union rather than leak their scope.
+                if ($c === null || $this->isCatalogPubliclyAvailable(catalog: $c) === false) {
+                    continue;
+                }
+                $regs    = array_merge($regs,    $this->normalizeIds(value: ($c['registers'] ?? [])));
+                $schemas = array_merge($schemas, $this->normalizeIds(value: ($c['schemas']   ?? [])));
+            }
+            return [
+                'registers' => array_values(array_unique($regs)),
+                'schemas'   => array_values(array_unique($schemas)),
+            ];
+        }
+
+        // 3. Default — union of listed+published catalogs.
+        $allCatalogs = $this->listListedPublishedCatalogs(catalogiService: $catalogiService);
+        $regs = [];
+        $schemas = [];
+        foreach ($allCatalogs as $c) {
+            $regs    = array_merge($regs,    $this->normalizeIds(value: ($c['registers'] ?? [])));
+            $schemas = array_merge($schemas, $this->normalizeIds(value: ($c['schemas']   ?? [])));
+        }
+        return [
+            'registers' => array_values(array_unique($regs)),
+            'schemas'   => array_values(array_unique($schemas)),
+        ];
+
+    }//end resolveCatalogScope()
+
+    /**
+     * Enumerate catalogs eligible for the anonymous default scope: `listed: true`
+     * AND `published` is set to a datetime in the past (or absent — treated as
+     * "not yet published" and excluded).
+     *
+     * Uses `CatalogiService::getObjectService()` to hit the catalog register directly
+     * with `_rbac: false` — the catalog's OWN authorization determines its visibility
+     * via the `listed` + `published` predicate here, not RBAC on the catalog register.
+     *
+     * @param object $catalogiService The OC CatalogiService (resolved via container).
+     *
+     * @return array<int, array> List of catalog jsonSerialize() arrays.
+     */
+    private function listListedPublishedCatalogs(object $catalogiService): array
+    {
+        try {
+            $objectService = $catalogiService->getObjectService();
+            if ($objectService === null) {
+                return [];
+            }
+            $catalogRegister = ($this->config?->getValueString('opencatalogi', 'catalog_register', '') ?? '');
+            $catalogSchema   = ($this->config?->getValueString('opencatalogi', 'catalog_schema', '') ?? '');
+            if ($catalogRegister === '' || $catalogSchema === '') {
+                $this->logger?->warning(
+                    'WOO-536: catalog_register or catalog_schema app-config is not set — /api/search default scope will be empty',
+                    ['catalog_register' => $catalogRegister, 'catalog_schema' => $catalogSchema]
+                );
+                return [];
+            }
+
+            // Note: `searchObjects` does not accept `_rbacAsPublic` (only the
+            // paginated variant does); the PHP `published <= now` check below
+            // covers the visibility branch that RBAC would otherwise encode.
+            // `listed:true` is a business-scope filter not carried by the schema
+            // read-rules, so the query needs it explicitly.
+            $catalogs = $objectService->searchObjects(
+                query: [
+                    '@self' => [
+                        'register' => $catalogRegister,
+                        'schema'   => $catalogSchema,
+                    ],
+                    'listed' => true,
+                ],
+                _rbac: false,
+                _multitenancy: false,
+            );
+        } catch (\Throwable $e) {
+            $this->logger?->warning('WOO-536: enumerating listed+published catalogs failed', ['error' => $e->getMessage()]);
+            return [];
+        }
+
+        $out = [];
+        foreach ($catalogs as $catalogEntity) {
+            try {
+                if (is_array($catalogEntity) === true) {
+                    $c = $catalogEntity;
+                } else {
+                    $c = $catalogEntity->jsonSerialize();
+                }
+            } catch (\Throwable $e) {
+                continue;
+            }
+            if ($this->isCatalogPubliclyAvailable(catalog: $c) === false) {
+                continue;
+            }
+            $out[] = $c;
+        }
+        return $out;
+
+    }//end listListedPublishedCatalogs()
+
+    /**
+     * Predicate: a catalog is publicly available when its `published` field
+     * exists AND parses AND is on or before "now". Extracted so the explicit-slug
+     * paths in {@see resolveCatalogScope()} and the default-scope enumeration in
+     * {@see listListedPublishedCatalogs()} apply the same rule.
+     *
+     * @param array $catalog The catalog jsonSerialize()d array.
+     *
+     * @return bool True when the catalog is publicly available (published in past).
+     */
+    private function isCatalogPubliclyAvailable(array $catalog): bool
+    {
+        $published = ($catalog['published'] ?? null);
+        if (is_string($published) === false || $published === '') {
+            return false;
+        }
+        try {
+            return new DateTimeImmutable($published) <= new DateTimeImmutable('now');
+        } catch (\Throwable $e) {
+            return false;
+        }
+
+    }//end isCatalogPubliclyAvailable()
+
+    /**
+     * Resolve an id-array from either a JSON-string or a native array. Every element
+     * is cast to int (schema/register ids in OC/OR are integers).
+     *
+     * @param mixed $value Raw value from catalog metadata.
+     *
+     * @return int[]
+     */
+    private function normalizeIds(mixed $value): array
+    {
+        if (is_string($value) === true) {
+            $decoded = json_decode($value, true);
+            if (is_array($decoded) === true) {
+                $value = $decoded;
+            } else {
+                $value = [];
+            }
+        }
+        if (is_array($value) === false) {
+            return [];
+        }
+        return array_values(array_map('intval', $value));
+
+    }//end normalizeIds()
+
+    /**
+     * Whether the current caller is anonymous (no logged-in user).
+     *
+     * Consumed by {@see \OCA\OpenCatalogi\Controller\PublicationsController::getUses}
+     * and `::getUsedBy` to gate anonymous access to relationship endpoints on
+     * non-public root objects. Fail-closed: treats an unavailable session as
+     * anonymous so the stricter visibility rule applies.
+     *
+     * @return boolean True when no user session is available or no user is logged in.
+     *
+     * @spec exclude Visibility helper for the public relation-endpoint published-predicate guard.
+     */
+    public function isAnonymous(): bool
+    {
+        if ($this->userSession === null) {
+            // Fail closed: when the session is unavailable, treat the caller as anonymous
+            // so the published-predicate guard applies the stricter visibility rule.
+            return true;
+        }
+
+        return $this->userSession->getUser() === null;
+
+    }//end isAnonymous()
+
+    /**
+     * Determine whether an object is publicly visible (published and not depublished).
+     *
+     * Mirrors the live OpenRegister RBAC visibility model (APB-006), the same rule
+     * the public publications API and the frontend `publicationStatus` helpers use:
+     * an object is public when its own `publicationDate` field is set and is at or
+     * before "now", and either carries no `depublicationDate` or one still in the
+     * future. The removed object-level `@self.published` predicate is not consulted.
+     *
+     * @param array $objectData The serialized object data (own fields + `@self` envelope).
+     *
+     * @return boolean True when the object is currently published.
+     *
+     * @spec openspec/specs/auto-publishing/spec.md#APB-006
+     */
+    public function isObjectPublic(array $objectData): bool
+    {
+        $publicationDate   = ($objectData['publicationDate'] ?? null);
+        $depublicationDate = ($objectData['depublicationDate'] ?? null);
+
+        if ($publicationDate === null || $publicationDate === '') {
+            return false;
+        }
+
+        $now           = time();
+        $publishedTime = strtotime((string) $publicationDate);
+        if ($publishedTime === false || $publishedTime > $now) {
+            return false;
+        }
+
+        if ($depublicationDate === null || $depublicationDate === '') {
+            return true;
+        }
+
+        $depublishedTime = strtotime((string) $depublicationDate);
+        return ($depublishedTime === false || $depublishedTime > $now);
+
+    }//end isObjectPublic()
+
+    /**
+     * Find the `publication` schema id inside the resolved scope so document rows can
+     * be enriched with their linked publication summary. When the scope does not
+     * include the publication schema (e.g. a catalog-scoped search across only
+     * `besluit` + `verzoek`), returns null and document→publication refinement is
+     * simply skipped for that request.
+     *
+     * Populates `$schemaSlugById` for every scope schema visited (even after the
+     * `publication` match is found), so the row-loop's later slug lookups reuse
+     * the same per-request cache instead of re-hitting the mapper (M3).
+     *
+     * @param object                  $schemaMapper   OR SchemaMapper.
+     * @param int[]                   $scopeSchemas   Schema ids in the resolved scope.
+     * @param array<int, string|null> $schemaSlugById Per-request slug cache (by reference).
+     *                                                Callers must annotate their local
+     *                                                `[]` with an inline `@var` tag so
+     *                                                phpstan tracks the type across the
+     *                                                pass-by-ref boundary.
+     *
+     * @return int|null Publication schema id when present in scope, null otherwise.
+     */
+    private function resolvePublicationSchemaId(object $schemaMapper, array $scopeSchemas, array &$schemaSlugById): ?int
+    {
+        $publicationSchemaId = null;
+        foreach ($scopeSchemas as $sid) {
+            $sidInt = (int) $sid;
+            if (array_key_exists($sidInt, $schemaSlugById) === true) {
+                $slug = $schemaSlugById[$sidInt];
+            } else {
+                try {
+                    // $schemaMapper is typed `object` (OR is an optional dep, resolved
+                    // via the container), so phpstan can't infer getSlug()'s return
+                    // type — normalise to string|null (keep the `array<int, string|null>`
+                    // shape of the by-ref cache intact).
+                    $rawSlug = $schemaMapper->find($sidInt)->getSlug();
+                    if (is_string($rawSlug) === true) {
+                        $slug = $rawSlug;
+                    } else {
+                        $slug = null;
+                    }
+                } catch (\Throwable $e) {
+                    $schemaSlugById[$sidInt] = null;
+                    continue;
+                }
+                $schemaSlugById[$sidInt] = $slug;
+            }
+            if ($slug === 'publication' && $publicationSchemaId === null) {
+                $publicationSchemaId = $sidInt;
+            }
+        }
+        return $publicationSchemaId;
+
+    }//end resolvePublicationSchemaId()
+
+    /**
+     * Extract the numeric schema id from a serialized object row's `@self.schema`.
+     *
+     * @param array $rowArray The serialized object row.
+     *
+     * @return integer|null The schema id, or null when absent/non-numeric.
+     *
+     * @spec exclude Row-shape plumbing; no domain behavior of its own.
+     */
+    private function extractSchemaId(array $rowArray): ?int
+    {
+        $schema = ($rowArray['@self']['schema'] ?? ($rowArray['schema'] ?? null));
+        if (is_array($schema) === true) {
+            $schema = ($schema['id'] ?? null);
+        }
+
+        if ($schema === null || is_numeric($schema) === false) {
+            return null;
+        }
+
+        return (int) $schema;
+
+    }//end extractSchemaId()
+
+    /**
+     * Resolve the linked publication's `{id, slug, title}` summary for a document row.
+     *
+     * Looks the linked publication up by slug (denormalised on the document's own
+     * `publication.slug` property) so the response can carry the publication's real
+     * UUID even though the authored document payload only carries `slug` + `title`
+     * (design.md "Seed publications" — the UUID does not exist until import). Results
+     * are cached per request so a page of documents linking the same publication only
+     * issues one lookup per unique slug.
+     *
+     * Stap 5a (WOO-536): replaces the denormalised `publication.slug` string lookup
+     * with a per-document `_relations_contains` query on the publication schema. The
+     * OR-side relation graph is authoritative, so a slug rename no longer detaches
+     * documents from the envelope.
+     *
+     * The query runs under `_rbac_as_public: true` so admin sessions on the public
+     * endpoint see the SAME linked-publication as anonymous callers — no linked-object
+     * leak (RBA-PUBLIC-006). If OR returns nothing, the linked publication either does
+     * not exist, is not public under the caller's effective context, or the document
+     * is genuinely unlinked — all three collapse to "drop the row" (transitive
+     * visibility).
+     *
+     * N4b (WOO-536 plan): a document related to multiple publications resolves to the
+     * OLDEST-by-created linked publication (most stable link — does not change as new
+     * publications are added). Documented as a known approximation.
+     *
+     * @param array               $documentRow         The document row (post `@self.schema` rewrite).
+     * @param object              $objectService       OpenRegister ObjectService instance.
+     * @param integer|null        $registerId          The publication register id, or null when the
+     *                                                 outer scope spans multiple registers (query
+     *                                                 falls back to the multi-schema search path).
+     * @param integer             $publicationSchemaId The publication schema id in scope.
+     * @param array<string,mixed> $cache               Per-request document-uuid → summary cache
+     *                                                 (by reference).
+     * @param array<string,mixed> $slugCache           Per-request publication-slug → summary cache
+     *                                                 (by reference). Prevents O(N × 500) scan
+     *                                                 regression when N documents on one page
+     *                                                 share the same `_relations['publication.slug']`.
+     *
+     * @return array{summary: array{id:string,slug:string,title:string}, public: bool}|null
+     *
+     * @spec openspec/changes/fix-fts-catalog-model-alignment/tasks.md
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
+     */
+    private function resolveDocumentPublicationSummary(
+        array $documentRow,
+        object $objectService,
+        ?int $registerId,
+        int $publicationSchemaId,
+        array &$cache,
+        array &$slugCache
+    ): ?array {
+        $documentUuid = ($documentRow['@self']['id'] ?? ($documentRow['id'] ?? null));
+        if (is_string($documentUuid) === false || $documentUuid === '') {
+            return null;
+        }
+
+        if (array_key_exists($documentUuid, $cache) === true) {
+            return $cache[$documentUuid];
+        }
+
+        // M1 fast-path: if the document row already carries a resolvable
+        // `publication.id`, verify it points at a publicly-visible publication
+        // via a targeted find() rather than fanning out into a relations query
+        // per row. This eliminates the N+1 for well-formed documents seeded
+        // with a denormalised publication summary. On any miss (missing id,
+        // find() fails, or find() returns a non-public row), fall through to
+        // the `_relations_contains` path below — the authoritative relation
+        // graph remains the source of truth for divergent cases.
+        $carriedPublicationId = ($documentRow['publication']['id'] ?? null);
+        if (is_string($carriedPublicationId) === true && $carriedPublicationId !== '') {
+            $fastPath = $this->tryFastPathPublicationLookup(
+                publicationId: $carriedPublicationId,
+                objectService: $objectService,
+                registerId: $registerId,
+                publicationSchemaId: $publicationSchemaId
+            );
+            if ($fastPath !== null) {
+                $cache[$documentUuid] = $fastPath;
+                return $fastPath;
+            }
+        }
+
+        // M2 fast-path: legacy documents store the linked publication in their
+        // OWN `_relations` array — either as `publication` (UUID form, canonical)
+        // or `publication.slug` (denormalised form, WOO-506 seed shape). Fase 5
+        // Robert-plan assumed publication.documents[] (inverse), but the fleet
+        // seed and existing writes point document→publication, not the other
+        // way around. Query the publication schema by id or slug and let the
+        // schema-level RBAC decide visibility.
+        $relations = ($documentRow['@self']['relations'] ?? ($documentRow['_relations'] ?? []));
+        if (is_array($relations) === true) {
+            $linkedById = ($relations['publication'] ?? null);
+            if (is_string($linkedById) === true && $linkedById !== '') {
+                $fastPath = $this->tryFastPathPublicationLookup(
+                    publicationId: $linkedById,
+                    objectService: $objectService,
+                    registerId: $registerId,
+                    publicationSchemaId: $publicationSchemaId
+                );
+                if ($fastPath !== null) {
+                    $cache[$documentUuid] = $fastPath;
+                    return $fastPath;
+                }
+            }
+
+            $linkedBySlug = ($relations['publication.slug'] ?? null);
+            if (is_string($linkedBySlug) === true && $linkedBySlug !== '') {
+                if (array_key_exists($linkedBySlug, $slugCache) === true) {
+                    $slugPath = $slugCache[$linkedBySlug];
+                } else {
+                    $slugPath = $this->tryPublicationSlugLookup(
+                        publicationSlug: $linkedBySlug,
+                        objectService: $objectService,
+                        registerId: $registerId,
+                        publicationSchemaId: $publicationSchemaId
+                    );
+                    $slugCache[$linkedBySlug] = $slugPath;
+                }
+                if ($slugPath !== null) {
+                    $cache[$documentUuid] = $slugPath;
+                    return $slugPath;
+                }
+            }
+        }
+
+        // Build the per-document refinement query. Under _rbac_as_public: true, OR only
+        // returns publications that would be visible to an anonymous caller — so a
+        // non-empty result guarantees the linked pub is public.
+        $refinementQuery = [
+            '_schema'             => $publicationSchemaId,
+            '_relations_contains' => $documentUuid,
+            '_limit'              => 2,
+            '_order'              => ['@self.created' => 'asc'],
+        ];
+        if ($registerId !== null) {
+            $refinementQuery['_register'] = $registerId;
+        }
+
+        try {
+            $matches = $objectService->searchObjectsPaginated(
+                query: $refinementQuery,
+                _rbac: true,
+                _multitenancy: false,
+                _rbacAsPublic: true
+            );
+        } catch (\Throwable $e) {
+            $this->logger?->warning(
+                'WOO-536: document→publication refinement failed',
+                ['documentUuid' => $documentUuid, 'error' => $e->getMessage()]
+            );
+            $cache[$documentUuid] = null;
+            return null;
+        }
+
+        $rows = ($matches['results'] ?? []);
+        if (empty($rows) === true) {
+            // N4a: no publicly-visible linked publication → drop the document.
+            $this->logger?->info(
+                'WOO-536: document has no publicly-visible linked publication',
+                ['documentUuid' => $documentUuid]
+            );
+            $cache[$documentUuid] = null;
+            return null;
+        }
+
+        if (count($rows) > 1) {
+            // N4b: multi-linked document — the oldest-by-created wins (documented
+            // approximation, most stable link). Fires on every hit-per-page, so
+            // debug (not info) keeps log volume sane on hot public deployments.
+            $this->logger?->debug(
+                'WOO-536: document linked to multiple publications; using oldest-by-created',
+                ['documentUuid' => $documentUuid, 'count' => count($rows)]
+            );
+        }
+
+        $publication = $rows[0];
+        if (is_array($publication) === false) {
+            $publication = $publication->jsonSerialize();
+        }
+
+        $summary = [
+            'summary' => [
+                'id'    => (string) ($publication['@self']['id'] ?? ($publication['id'] ?? '')),
+                'slug'  => (string) ($publication['@self']['slug'] ?? ($publication['slug'] ?? '')),
+                'title' => (string) ($publication['title'] ?? ''),
+            ],
+            'public'  => true,
+        ];
+
+        $cache[$documentUuid] = $summary;
+        return $summary;
+
+    }//end resolveDocumentPublicationSummary()
+
+    /**
+     * Fast-path publication lookup — verify that a carried publication id resolves
+     * to a publicly-visible publication row via a single {@see ObjectService::find()}
+     * call, avoiding the per-row `_relations_contains` fan-out.
+     *
+     * Under `_rbac: true`, `_rbacAsPublic: true`, `find()` throws or returns null
+     * when the publication is not publicly visible (draft, depublished, archived
+     * under the schema RBAC), so a non-null return guarantees the caller may
+     * embed the summary. On any failure the method returns null and the caller
+     * falls back to the relations-based path — authoritative but slower.
+     *
+     * @param string      $publicationId       The UUID from the document row's carried summary.
+     * @param object      $objectService       OpenRegister ObjectService instance.
+     * @param integer|null $registerId         Optional register scope hint.
+     * @param integer     $publicationSchemaId The publication schema id.
+     *
+     * @return array{summary: array{id:string,slug:string,title:string}, public: bool}|null
+     */
+    private function tryFastPathPublicationLookup(
+        string $publicationId,
+        object $objectService,
+        ?int $registerId,
+        int $publicationSchemaId
+    ): ?array {
+        try {
+            $publication = $objectService->find(
+                id: $publicationId,
+                _extend: [],
+                files: false,
+                register: $registerId,
+                schema: $publicationSchemaId,
+                _rbac: true,
+                _multitenancy: false,
+                _rbacAsPublic: true
+            );
+        } catch (\Throwable $e) {
+            return null;
+        }
+
+        if ($publication === null) {
+            return null;
+        }
+
+        if (is_array($publication) === true) {
+            $publicationArray = $publication;
+        } else {
+            $publicationArray = $publication->jsonSerialize();
+        }
+
+        // Guard: RET-006 archived rows must never surface even if RBAC lets them through
+        // (see B1 in the row loop above — same rule applies to the linked publication).
+        if (($publicationArray['status'] ?? null) === 'archived') {
+            return null;
+        }
+
+        return [
+            'summary' => [
+                'id'    => (string) ($publicationArray['@self']['id'] ?? ($publicationArray['id'] ?? '')),
+                'slug'  => (string) ($publicationArray['@self']['slug'] ?? ($publicationArray['slug'] ?? '')),
+                'title' => (string) ($publicationArray['title'] ?? ''),
+            ],
+            'public' => true,
+        ];
+
+    }//end tryFastPathPublicationLookup()
+
+    /**
+     * Slug-based fallback lookup for legacy document seeds that carry
+     * `_relations['publication.slug'] = <slug>` rather than a UUID.
+     *
+     * Runs a targeted `searchObjectsPaginated` on the publication schema with
+     * `slug` as a match filter and the same `_rbac_as_public: true` gating as
+     * the UUID fast-path — a non-empty result guarantees the linked publication
+     * is publicly visible. Returns null on miss (unknown slug, non-public,
+     * archived) so the caller falls through to the `_relations_contains` path.
+     *
+     * @param string      $publicationSlug     The linked publication's slug.
+     * @param object      $objectService       OpenRegister ObjectService instance.
+     * @param integer|null $registerId         Publication register id or null.
+     * @param integer     $publicationSchemaId Publication schema id in scope.
+     *
+     * @return array|null The public-visible publication summary + flag, or null on miss.
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    private function tryPublicationSlugLookup(
+        string $publicationSlug,
+        object $objectService,
+        ?int $registerId,
+        int $publicationSchemaId
+    ): ?array {
+        // ObjectService::searchObjectsPaginated normalises the query differently
+        // for `@self.<field>` filters than the HTTP query parser does, so we scan
+        // for a slug match client-side instead of relying on a pushdown filter.
+        // Scope is `_schemas => [$publicationSchemaId]` (+ optional `_register` when
+        // the outer catalog scope collapses to one register) — this is O(500) per
+        // unique slug scanned, capped by `_limit: 500`. Slug collisions across
+        // registers on a multi-register scope are possible. The caller memoises
+        // the result per slug for the duration of the request (see $slugCache in
+        // the row loop), so N documents sharing one slug pay the scan cost once.
+        // Callers holding 500+ publications on the publication schema will see
+        // legacy slugs beyond row 500 fail to resolve — such fleets should migrate
+        // away from the denormalised `publication.slug` shape (WOO-506 legacy).
+        $slugScanQuery = [
+            '_schemas' => [$publicationSchemaId],
+            '_limit'   => 500,
+        ];
+        if ($registerId !== null) {
+            $slugScanQuery['_register'] = $registerId;
+        }
+        try {
+            $matches = $objectService->searchObjectsPaginated(
+                query: $slugScanQuery,
+                _rbac: true,
+                _multitenancy: false,
+                _rbacAsPublic: true
+            );
+        } catch (\Throwable $e) {
+            $this->logger?->warning(
+                'WOO-536: slug scan threw',
+                ['slug' => $publicationSlug, 'error' => $e->getMessage()]
+            );
+            return null;
+        }
+
+        $rows = ($matches['results'] ?? []);
+        $firstMatch = null;
+        $matchCount = 0;
+        foreach ($rows as $publication) {
+            if (is_array($publication) === false) {
+                $publication = $publication->jsonSerialize();
+            }
+            $candidateSlug = ($publication['@self']['slug'] ?? ($publication['slug'] ?? ''));
+            if ($candidateSlug !== $publicationSlug) {
+                continue;
+            }
+            $matchCount++;
+            if ($firstMatch === null) {
+                $firstMatch = $publication;
+            }
+        }
+
+        if ($matchCount > 1) {
+            // Slug collision: OR does not SQL-UNIQUE `slug` at the schema layer.
+            // Parity with N4b (multi-linked documents in the `_relations_contains`
+            // path) — debug (not info) keeps log volume sane on hot public endpoints.
+            $this->logger?->debug(
+                'WOO-536: publication slug matched multiple rows; using first-scanned',
+                ['slug' => $publicationSlug, 'count' => $matchCount]
+            );
+        }
+
+        if ($firstMatch === null) {
+            return null;
+        }
+        if (($firstMatch['status'] ?? null) === 'archived') {
+            return null;
+        }
+
+        return [
+            'summary' => [
+                'id'    => (string) ($firstMatch['@self']['id'] ?? ($firstMatch['id'] ?? '')),
+                'slug'  => (string) $publicationSlug,
+                'title' => (string) ($firstMatch['title'] ?? ''),
+            ],
+            'public' => true,
+        ];
+
+    }//end tryPublicationSlugLookup()
+
+    /**
+     * Find the register and schema IDs for an object UUID within a constrained scope.
+     *
+     * Locates which OpenRegister (register × schema) pair holds a given UUID, always
+     * scoped to the caller-supplied register/schema lists. The lookup goes through
+     * OpenRegister's `ObjectService` (ADR-022: consume OR abstractions) rather than
+     * issuing raw SQL against OR's internal per-register/per-schema storage tables or
+     * probing the DBMS catalog for their existence. OR remains free to change its
+     * physical storage layout without breaking opencatalogi.
+     *
+     * The legacy platform-wide search across every magic table is gone (#734) — it was
+     * an anonymous-reachable DoS vector and also leaked cross-catalog objects (#733).
+     * Callers MUST pass non-empty $allowedRegisters and $allowedSchemas; otherwise the
+     * method returns null without touching OpenRegister.
+     *
+     * @param string                 $uuid             The UUID of the object to find.
+     * @param array<int|string>|null $allowedRegisters Register IDs the search may touch.
+     * @param array<int|string>|null $allowedSchemas   Schema IDs the search may touch.
+     *
+     * @return array{register: int, schema: int}|null The register/schema IDs, or null.
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     *
+     * @spec openspec/specs/opencatalogi-adopt-or-abstractions/spec.md
+     */
+    public function findObjectLocation(
+        string $uuid,
+        ?array $allowedRegisters=null,
+        ?array $allowedSchemas=null
+    ): ?array {
+        if (empty($allowedRegisters) === true || empty($allowedSchemas) === true) {
+            // Fail closed — without an explicit constraint we will NOT do a
+            // platform-wide scan. This is the post-#734 behaviour.
+            return null;
+        }
+
+        $objectService = $this->getObjectService();
+        if ($objectService === null) {
+            return null;
+        }
+
+        // Locate the object by asking OpenRegister to resolve it within each
+        // constrained (register × schema) pair. The location lookup is visibility-
+        // agnostic (_rbac: false) — it mirrors the previous behaviour of locating an
+        // object's home pair; callers re-apply their own RBAC/visibility filter on the
+        // subsequent read. No raw SQL and no knowledge of OR's table layout.
+        foreach ($allowedRegisters as $register) {
+            if (is_numeric($register) === false) {
+                continue;
+            }
+
+            $registerId = (int) $register;
+            foreach ($allowedSchemas as $schema) {
+                if (is_numeric($schema) === false) {
+                    continue;
+                }
+
+                $schemaId = (int) $schema;
+                try {
+                    $object = $objectService->find(
+                        id: $uuid,
+                        _extend: [],
+                        files: false,
+                        register: $registerId,
+                        schema: $schemaId,
+                        _rbac: false,
+                        _multitenancy: false
+                    );
+                } catch (DoesNotExistException $e) {
+                    continue;
+                } catch (\Exception $e) {
+                    continue;
+                }
+
+                if ($object !== null) {
+                    return [
+                        'register' => $registerId,
+                        'schema'   => $schemaId,
+                    ];
+                }
+            }//end foreach
+        }//end foreach
+
+        return null;
+
+    }//end findObjectLocation()
+
+    /**
+     * Resolve the OpenRegister ObjectService from the container.
+     *
+     * @return object|null The OpenRegister ObjectService, or null when OR is unavailable.
+     *
+     * @spec exclude Lazy dependency-injection accessor for the OR ObjectService; pure
+     *       framework plumbing, no domain behavior.
+     */
+    private function getObjectService(): ?object
+    {
+        try {
+            return $this->container->get('OCA\OpenRegister\Service\ObjectService');
+        } catch (\Throwable $e) {
+            return null;
+        }
+
+    }//end getObjectService()
+
+    /**
+     * Build the ObjectService search query for a catalog index request.
+     *
+     * Merges the incoming request parameters with catalog-level schema/register filters,
+     * handles multi-schema and multi-register cases, and strips non-universal _order fields
+     * when searching across multiple registers.
+     *
+     * @param array  $catalog       Catalog data array (keys: schemas, registers).
+     * @param array  $queryParams   Raw request query parameters from IRequest::getParams().
+     * @param object $objectService ObjectService instance (already resolved from container).
+     *
+     * @return array The merged and sanitised search query ready for searchObjectsPaginated().
+     *
+     * @spec exclude Query-assembly plumbing extracted from PublicationsController; translates
+     *       request params into an ObjectService search query, no domain behavior of its own.
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function buildCatalogSearchQuery(array $catalog, array $queryParams, object $objectService): array
+    {
+        // Use ObjectService centralized query builder which handles dot-to-underscore conversion.
+        $searchQuery = array_merge(
+            $objectService->buildSearchQuery($queryParams),
+            ['_includeDeleted' => false]
+        );
+
+        // Clean up catalog-specific parameters.
+        unset($searchQuery['catalogSlug'], $searchQuery['fq']);
+
+        // Handle catalog filtering using _schemas for multi-schema search.
+        if (empty($catalog['schemas']) === false) {
+            $schemas = $catalog['schemas'];
+            // Parse JSON string if needed.
+            if (is_string($schemas) === true) {
+                $schemas = json_decode($schemas, true) ?? [];
+            }
+
+            $schemas = array_map('intval', $schemas);
+            // Pass all schemas for both search and faceting.
+            $searchQuery['_schemas'] = $schemas;
+            // Only set _schema for single-schema catalogs for magic mapper optimization.
+            // Explicitly unset _schema for multi-schema search to prevent auto-setting.
+            unset($searchQuery['_schema']);
+            if (count($schemas) === 1) {
+                $searchQuery['_schema'] = $schemas[0];
+            }
+        }//end if
+
+        if (empty($catalog['registers']) === false) {
+            $registers = $catalog['registers'];
+            // Parse JSON string if needed.
+            if (is_string($registers) === true) {
+                $registers = json_decode($registers, true) ?? [];
+            }
+
+            $registers = array_map('intval', $registers);
+            if (count($registers) === 1) {
+                // Single register: use magic mapper optimization.
+                $searchQuery['_register'] = $registers[0];
+                return $searchQuery;
+            }
+
+            // Multi-register: pass all register IDs and prevent auto-setting.
+            $searchQuery['_registers'] = $registers;
+            $searchQuery['_register']  = null;
+
+            // Multi-register search: strip _order on non-universal fields
+            // since schemas may have different property names (e.g., 'name' vs 'naam').
+            // Only allow metadata fields that exist in all magic mapper tables.
+            if (empty($searchQuery['_order']) === false && is_array($searchQuery['_order']) === true) {
+                foreach (array_keys($searchQuery['_order']) as $orderField) {
+                    if (in_array($orderField, self::UNIVERSAL_ORDER_FIELDS, true) === false) {
+                        unset($searchQuery['_order'][$orderField]);
+                    }
+                }
+
+                if (empty($searchQuery['_order']) === true) {
+                    unset($searchQuery['_order']);
+                }
+            }
+        }//end if
+
+        return $searchQuery;
+
+    }//end buildCatalogSearchQuery()
+
+    /**
+     * Resolve schema and register objects from OpenRegister mappers for catalog enrichment.
+     *
+     * Returns an array with keys 'schemas' (id → {id, slug, title}) and
+     * 'registers' (id → {id, slug, title}). Missing entries are silently skipped.
+     *
+     * @param array $catalog Catalog data array (keys: schemas, registers).
+     *
+     * @return array{schemas: array<int|string, array>, registers: array<int|string, array>}
+     *
+     * @spec exclude Metadata-resolution plumbing extracted from PublicationsController; looks up
+     *       schema/register labels via OR mappers for response enrichment, no domain behavior.
+     */
+    public function resolveSchemaAndRegisterObjects(array $catalog): array
+    {
+        $resolvedSchemas   = [];
+        $resolvedRegisters = [];
+
+        try {
+            $schemaMapper   = $this->container->get('OCA\OpenRegister\Db\SchemaMapper');
+            $registerMapper = $this->container->get('OCA\OpenRegister\Db\RegisterMapper');
+
+            $schemaIds = $catalog['schemas'] ?? [];
+            if (is_string($schemaIds) === true) {
+                $schemaIds = json_decode($schemaIds, true) ?? [];
+            }
+
+            foreach ($schemaIds as $schemaId) {
+                try {
+                    $schema = $schemaMapper->find((int) $schemaId);
+                    $resolvedSchemas[$schemaId] = [
+                        'id'    => $schema->getId(),
+                        'slug'  => $schema->getSlug(),
+                        'title' => $schema->getTitle(),
+                    ];
+                } catch (\Exception $e) {
+                    // Schema not found, skip.
+                }
+            }
+
+            $registerIds = $catalog['registers'] ?? [];
+            if (is_string($registerIds) === true) {
+                $registerIds = json_decode($registerIds, true) ?? [];
+            }
+
+            foreach ($registerIds as $registerId) {
+                try {
+                    $register = $registerMapper->find((int) $registerId);
+                    $resolvedRegisters[$registerId] = [
+                        'id'    => $register->getId(),
+                        'slug'  => $register->getSlug(),
+                        'title' => $register->getTitle(),
+                    ];
+                } catch (\Exception $e) {
+                    // Register not found, skip.
+                }
+            }
+        } catch (\Exception $e) {
+            // OpenRegister not available, return empty sets.
+        }//end try
+
+        return [
+            'schemas'   => $resolvedSchemas,
+            'registers' => $resolvedRegisters,
+        ];
+
+    }//end resolveSchemaAndRegisterObjects()
+
+    /**
+     * Find an object within a catalog's registers/schemas using ObjectService.
+     *
+     * Iterates over each (register, schema) combination in the catalog.
+     * Returns the first matching object entity, or null if not found.
+     *
+     * @param array  $catalog       Catalog data array (keys: schemas, registers).
+     * @param string $id            The UUID of the object to find.
+     * @param object $objectService ObjectService instance (already resolved from container).
+     *
+     * @return object|null The found object entity, or null.
+     *
+     * @spec exclude Lookup plumbing extracted from PublicationsController; iterates a catalog's
+     *       (register, schema) pairs and delegates the actual read to ObjectService::find().
+     */
+    public function findObjectInCatalog(array $catalog, string $id, object $objectService): ?object
+    {
+        $catalogRegisters = $catalog['registers'] ?? [];
+        $catalogSchemas   = $catalog['schemas'] ?? [];
+
+        // Parse JSON string if needed (catalog fields may be JSON-encoded).
+        if (is_string($catalogRegisters) === true) {
+            $catalogRegisters = json_decode($catalogRegisters, true) ?? [];
+        }
+
+        if (is_string($catalogSchemas) === true) {
+            $catalogSchemas = json_decode($catalogSchemas, true) ?? [];
+        }
+
+        // WF4 / wave-12: iterate ALL (register × schema) pairs, not just $catalogRegisters[0].
+        // Previously the code only tried the first register in the list, so objects in
+        // register #2+ were unreachable via this path and returned spurious 404s.
+        if (empty($catalogRegisters) === false) {
+            $registersToTry = array_map('intval', $catalogRegisters);
+        } else {
+            $registersToTry = [null];
+        }
+
+        $schemasToTry = array_map('intval', $catalogSchemas);
+
+        foreach ($registersToTry as $register) {
+            foreach ($schemasToTry as $schemaId) {
+                try {
+                    $object = $objectService->find(
+                        id: $id,
+                        _extend: [],
+                        files: false,
+                        register: $register,
+                        schema: $schemaId,
+                        _rbac: true,
+                        _multitenancy: false
+                    );
+                    if ($object !== null) {
+                        return $object;
+                    }
+                } catch (DoesNotExistException $e) {
+                    // Object not found in this (register, schema) pair — try next.
+                    continue;
+                }
+            }//end foreach
+        }//end foreach
+
+        return null;
+
+    }//end findObjectInCatalog()
+
+    /**
+     * Recursively strips empty values (null, empty string, empty array) from an array.
+     *
+     * Used to reduce API response payload by omitting properties that have no value.
+     * Values of 0, false, and "0" are preserved as they are meaningful.
+     *
+     * @param array $data The data array to strip empty values from.
+     *
+     * @return array The data with empty values removed.
+     *
+     * @spec exclude Response-shaping plumbing extracted from PublicationsController; recursively
+     *       prunes empty values to slim the payload, no domain behavior.
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    public function stripEmptyValues(array $data): array
+    {
+        $result = [];
+        foreach ($data as $key => $value) {
+            if (is_array($value) === true) {
+                $this->processArrayValue(result: $result, key: $key, value: $value);
+                continue;
+            }//end if
+
+            if ($value === null || $value === '') {
+                continue;
+            }
+
+            $result[$key] = $value;
+        }//end foreach
+
+        return $result;
+
+    }//end stripEmptyValues()
+
+    /**
+     * Process a single array value during empty-value stripping.
+     *
+     * Handles both sequential (list) and associative arrays, recursing into nested arrays.
+     *
+     * @param array      $result Reference to the result array being built.
+     * @param int|string $key    The key for this value.
+     * @param array      $value  The array value to process.
+     *
+     * @return void
+     */
+    private function processArrayValue(array &$result, int|string $key, array $value): void
+    {
+        if (array_is_list($value) === true) {
+            $stripped = [];
+            foreach ($value as $item) {
+                if (is_array($item) === false) {
+                    $stripped[] = $item;
+                    continue;
+                }
+
+                $stripped[] = $this->stripEmptyValues(data: $item);
+            }
+
+            if (empty($stripped) === false) {
+                $result[$key] = $stripped;
+            }
+
+            return;
+        }
+
+        $stripped = $this->stripEmptyValues(data: $value);
+        if (empty($stripped) === false) {
+            $result[$key] = $stripped;
+        }
+
+    }//end processArrayValue()
 }//end class
diff --git a/lib/Settings/publication_register.json b/lib/Settings/publication_register.json
index dc75fb3bc..0d970549c 100644
--- a/lib/Settings/publication_register.json
+++ b/lib/Settings/publication_register.json
@@ -299,6 +299,20 @@
               "match": {
                 "publicationDate": {
                   "$lte": "$now"
+                },
+                "depublicationDate": {
+                  "$gte": "$now"
+                }
+              }
+            },
+            {
+              "group": "public",
+              "match": {
+                "publicationDate": {
+                  "$lte": "$now"
+                },
+                "depublicationDate": {
+                  "$exists": false
                 }
               }
             },
@@ -411,6 +425,20 @@
               "match": {
                 "publicationDate": {
                   "$lte": "$now"
+                },
+                "depublicationDate": {
+                  "$gte": "$now"
+                }
+              }
+            },
+            {
+              "group": "public",
+              "match": {
+                "publicationDate": {
+                  "$lte": "$now"
+                },
+                "depublicationDate": {
+                  "$exists": false
                 }
               }
             },
diff --git a/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/.openspec.yaml b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/.openspec.yaml
new file mode 100644
index 000000000..e685d45e5
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-25
diff --git a/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/design.md b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/design.md
new file mode 100644
index 000000000..cf2ce20b3
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/design.md
@@ -0,0 +1,130 @@
+## Context
+
+`PublicationQueryService::assemblePublicSearchResults()` was introduced in WOO-506/WOO-517 to power the public full-text search endpoint `/apps/opencatalogi/api/search`. Its architecture hardcodes scope to three app-config values (`publication_register`, `publication_schema`, `document_schema`) and enforces publication-window visibility via a PHP post-filter `isObjectPublic()`. Robert Zondervan diagnosed this as architecturally broken in WOO-536 (2026-08-12): the two-schema straitjacket is a direct consequence of the PHP filter — because visibility had to be reconstructed in PHP using known field names, scope could never widen to schemas with different field layouts.
+
+Phase 1 discovery (WOO-536 plan, 2026-08-24) confirmed:
+- **D1 (falsified):** Robert's claim that all schemas already carry the two-rule `depublicatiedatum` shape is NOT true on either `main` or `development`. `publication` and `document` both have only the single-rule `publicatiedatum $lte $now` shape — the `depublicatiedatum` branch is absent. A Path A repair migration is required.
+- **D2 (falsified partially):** `_relations_contains` is supported in the single-schema path (`buildFilteredQuery`) but NOT in the UNION-arm (`buildWhereConditionsSql`). Stap 5a (per-document single-schema lookup) is chosen over Stap 5b (UNION with relations filter).
+- **D3 (new gap):** `MagicRbacHandler::buildRbacConditionsSql()` resolves user-groups unconditionally from `$this->userSession`. No escape hatch existed for "force anonymous context". The OR precursor PR (`rbac-as-public-toggle`) adds the `_rbac_as_public: true` query flag to address this (B-1 primitive).
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Derive `/api/search` scope from the catalog model: accept `_catalog` (single) / `_catalogi[]` (array) params; default = union of `listed: true` + published catalogs; reuse `buildCatalogSearchQuery()` + `resolveSchemaAndRegisterObjects()`.
+- Move visibility enforcement from PHP post-filter to SQL WHERE via OpenRegister's RBAC engine, consuming the B-1 primitive (`_rbac_as_public: true`) from OR PR #2855.
+- Make `@self.schema` dynamic for every schema in scope (not just the two hardcoded slugs).
+- Restore OR's `total` and `facets`/`facetable` for anonymous callers; remove the PHP workarounds that undercount and strip them.
+- Fix `resolveDocumentPublicationSummary()` to use `_relations_contains` (single-schema path, Stap 5a) instead of the denormalised slug lookup.
+- Backfill the `depublicatiedatum` two-rule shape into `publication` and `document` schemas on existing installs via a repair migration (Q5 Path A).
+- Fix three broken docblock refs in `PublicationQueryService.php` that point to the archived `add-public-fulltext-search` change.
+
+**Non-Goals:**
+
+- Changing OpenRegister beyond PR #2855 (B-1). The UNION-arm `_relations_contains` gap is not addressed in this PR (Stap 5b was rejected; Stap 5a is sufficient).
+- Per-schema archetype clean-up for `catalog`, `listing`, `organization`, `page`, `theme`, `menu`, `glossary` — deferred to a follow-up ticket unless Fase 7 smoke tests reveal a breakage.
+- `_schema`/`_registers`/`fq` client-scope widening — the existing `unset()` on these params is preserved (Q7 Interpretation A).
+- MariaDB `::text ILIKE` portability (tracked as WOO-544, separate ticket).
+- Changing the `/api/search` envelope shape (N2): flat `results[]` with `@self.schema` discriminator + embedded `publication: {id, slug, title}` on document rows — unchanged.
+- Federation search (`development` branch only; N3): will be retested when WOO-536 is ported to `development` post-main-merge.
+- Exposing `_rbac_as_public` as a documented HTTP parameter for clients — it is set programmatically by the app, not forwarded from HTTP requests.
+
+## Decisions
+
+### D-SCOPE: Catalog-derived scope over app-config (Stap 2)
+
+Replace the three `resolveConfiguredId()` calls with `buildCatalogSearchQuery()` + `resolveSchemaAndRegisterObjects()`, already implemented in the same class (`PublicationQueryService`). These methods correctly resolve the union of `catalog.registers` × `catalog.schemas` for a given set of catalogs.
+
+**New params:** `_catalog` (single UUID or slug) and `_catalogi[]` (array of UUIDs or slugs), following OR's doubled singular/plural convention (`_register`/`_registers`, `_schema`/`_schemas`). Default (no param) = union over all catalogs where `listed: true` and the catalog object itself is published. The old `catalogSlug` query-string param was already `unset()` deliberately — it is not revived.
+
+**Client scope discipline (Q7 Interpretation A):** The existing `unset($searchQuery['_schema'], $searchQuery['_registers'], $searchQuery['fq'])` is preserved. Clients may narrow to a specific catalog via `_catalog`/`_catalogi[]` but may not inject raw schema/register/fq overrides.
+
+### D-B1: Consume `_rbac_as_public` primitive (Stap 1 + Stap 6)
+
+`assemblePublicSearchResults()` passes `_rbac: true` AND `_rbac_as_public: true` on every `searchObjectsPaginated()` call. The B-1 primitive (OR PR #2855, `rbac-as-public-toggle`) implements Q1 Option B: regardless of the caller's session (admin, authenticated owner, anonymous), the search evaluates RBAC using only the `public` group's matching rules — skipping the admin-group bypass and suppressing the `_owner = <userId>` OR-in condition. This enforces uniform visibility on the public endpoint (SCH-PFTS-001) via SQL, making the PHP post-filter redundant.
+
+**Why B-1 over a synthetic anonymous session:** Constructing a fake `IUser` and injecting it for the duration of the call was considered. Rejected: too invasive, touches more Nextcloud interfaces, and the B-1 flag is simpler and equally safe. Method-parameter threading (`$_rbacAsPublic = true`) is the chosen mechanism in OR (see OR `rbac-as-public-toggle` design.md).
+
+**Security property (D6 in OR design):** `_rbac_as_public: true` narrows, never widens, the result set. It removes the owner OR-in and admin bypass — both of which add rows that schema `read` rules would otherwise exclude. An authenticated caller sees a strict subset of what they'd see without the flag. The flag MUST NOT be passed through from HTTP client requests; OR's `ObjectService` strips client-supplied `_rbac_as_public` and only accepts it as a method parameter.
+
+**Schemas without explicit `read` rules:** `MagicRbacHandler::buildRbacConditionsSql()` returns `['bypass' => true]` for schemas with no `read` action configured. Under B-1, a schema with no `read` config becomes fully open (bypass = all rows returned). Guard: `resolveSchemaAndRegisterObjects()` + catalog scope already limits results to schemas that are part of a listed+published catalog. An additional guard should log a warning when a schema with `bypass: true` is included in the public search scope, so operators are alerted to add explicit rules. (Robert's "wagenwijd open" warning.)
+
+### D-MAPPER: Dynamic SchemaMapper over hardcoded two-element map (Stap 3)
+
+Replace the two-entry `$schemaSlugById` (`[publicationSchemaId => 'publication', documentSchemaId => 'document']`) with a `SchemaMapper` lookup cached per request. This ensures `@self.schema` carries the real slug for every schema in scope, not just the two hardcoded ones. Cache-per-request avoids repeated DB lookups in the page-result loop; the `SchemaMapper` service is already available via DI.
+
+### D-FILTER-REMOVAL: Drop `isObjectPublic()` and its workarounds (Stap 4)
+
+Remove the `isObjectPublic()` post-filter loop and the two anonymous-caller workarounds it necessitated:
+1. **Per-page `total` undercount** — `total` was adjusted downward to subtract non-public rows filtered out in PHP. Under RBAC, OR's `total` counts only rows that pass the SQL WHERE, so it is correct without PHP adjustment.
+2. **Stripping `facets`/`facetable` for anonymous callers** — Facets were stripped because the PHP filter could not be applied to facet counts. Under RBAC, `buildWhereConditionsSql()` applies the same RBAC conditions to both the UNION-arm result rows AND the facet aggregations (verified in Phase 1: `MagicFacetHandler` uses the same WHERE clause). Facets are now correct without PHP adjustment.
+
+### D-STAP5A: Per-document `_relations_contains` lookup (Stap 5)
+
+The current `resolveDocumentPublicationSummary()` resolves the linked publication by looking up the `publication.slug` property — a denormalised field that breaks when a publication's slug changes. Replace with `_relations_contains`: for each document in the result page, query the `publication` schema's register for objects whose `_relations` include the document's UUID.
+
+**Why Stap 5a (single-schema path) over Stap 5b (UNION-arm with relations filter):**
+Phase 1 D2 confirmed that `_relations_contains` is NOT handled in the UNION-arm `buildWhereConditionsSql()` on either `main` or `development`. Stap 5a stays on the single-schema path (`buildFilteredQuery`) — this is the existing path for the `resolveDocumentPublicationSummary` call, so no architectural regression.
+
+**Edge case N4a — Document with 0 related publications:**
+Decision: silent-drop + `$this->logger->warning()`. The document row appears in the results (it passed RBAC) but `publication: null` is set on the envelope row and a warning is logged with the document UUID for observability. Backward-compatible (current slug-lookup also silent-drops for null slug).
+
+**Edge case N4b — Document with multiple related publications:**
+Decision: first-hit-wins (backward-compatible with the implicit first-hit of the slug-lookup). `_relations_contains` returns results ordered by `@self.created`; the first result is selected. This is arbitrary but deterministic. Option 4 (most-recent publication) is preferred long-term but requires a `_order` param on the `_relations_contains` query; deferred to a follow-up to keep this PR focused on WOO-536 scope.
+
+**Generalisation:** The helper is extracted as a private method that takes the document's `_relations` array and issues a filtered lookup on the referenced object's schema — not limited to document→publication. This makes it reusable for other relation traversals in future.
+
+**`_rbac_as_public` on the per-document lookup:** The per-document refinement lookup inside `resolveDocumentPublicationSummary()` also passes `$_rbacAsPublic = true` to `ObjectService::find()` (extended in OR PR #2855 to accept this parameter). This prevents the PermissionHandler PHP-side check from leaking a linked publication that anonymous callers cannot see (OR `design.md` D-scope, Q2 decision).
+
+### D-MIGRATION: Two-rule read-shape repair migration (Q5 Path A)
+
+`lib/Settings/publication_register.json` seeds the `publication` and `document` schemas with `"read": [{"group": "public", "match": {"publicatiedatum": {"$lte": "$now"}}}, "authenticated"]`. The `depublicatiedatum` branch is missing: under `_rbac_as_public`, an object with `depublicatiedatum` in the past would be returned (no rule excludes it). Robert's target shape (WOO-536 body) uses two top-level OR rules:
+
+```json
+"read": [
+  {"group": "public", "match": {"publicatiedatum": {"$lte": "$now"}, "depublicatiedatum": {"$gte": "$now"}}},
+  {"group": "public", "match": {"publicatiedatum": {"$lte": "$now"}, "depublicatiedatum": {"$exists": false}}},
+  "authenticated"
+]
+```
+
+Why two rules (not one combined rule): `buildComparisonOperatorConditionSql()` short-circuits within a single match block — `$exists: false` combined with `$gte: $now` in one block would only match objects where both conditions are simultaneously met (i.e., a field that both doesn't exist AND is >= now — impossible). Two separate top-level match blocks produce an OR of the two conditions at the schema-RBAC level.
+
+**Migration discipline:**
+- Only touches `publication` and `document` schemas (G3 per-schema scope decision).
+- Detection: only injects the two-rule shape when the existing `read` block has the single-rule shape with exactly the `publicatiedatum $lte $now` condition (missing `depublicatiedatum`). If an admin has already customised the `read` block, the migration leaves it alone.
+- Idempotent: safe to re-run on already-migrated installations (double-detection guard).
+- Preserves the `"authenticated"` string element as the third array entry.
+- Precedent: WOO-517 commit `469cbdf7` used this exact shape for the `document`-schema auto-attach.
+
+**Column casing (Robert's Aandachtspunten §2):** `publicatiedatum` and `depublicatiedatum` are all-lowercase on `main`. `propertyToColumnName()` leaves all-lowercase strings unchanged. No column-mapping risk.
+
+**Scope of the seed/migration (schema-config scope):** Only `publication` and `document` get the two-rule fix. The other seven seed schemas (`catalog`, `listing`, `organization`, `page`, `theme`, `menu`, `glossary`) are left at their current read-block shape — their existing rules are valid RBAC config and do not have `depublicatiedatum` semantics. The B-1 primitive makes the search endpoint schema-agnostic; these schemas will work correctly under `_rbac_as_public` with their current rules.
+
+### D-DOCBLOCKS: Fix broken docblock refs (Stap 7)
+
+The current `PublicationQueryService.php` docblocks reference `openspec/changes/add-public-fulltext-search/tasks.md`, `design.md`, and `openspec/specs/.../spec.md#SCH-PFTS-002`. All three point to the archived change (`openspec/changes/archive/2026-07-16-add-public-fulltext-search/` on Codeberg, but the archive is not present on GitHub `main`). Fix by replacing these refs with:
+- `openspec/changes/fix-fts-catalog-model-alignment/tasks.md` for task references
+- `openspec/specs/search/spec.md#SCH-PFTS-CAT-001` (or the relevant new SCH-PFTS-* heading) for spec references
+
+## Risks / Trade-offs
+
+- **[Schema with `bypass: true` included in public scope]** A schema added to a listed catalog without any `read` authorization config will be fully open under `_rbac_as_public`. Mitigation: log a warning (per the guard in D-SCOPE), document the requirement in SCH-PFTS-CAT-002, and link it to Robert's "wagenwijd open" caution in WOO-536. Per-schema archetype clean-up deferred; admin operator must be informed.
+- **[`_rbac_as_public` not propagated to `ContentSearchHandler`]** Verified in Phase 1 G2: `$_rbac` propagates through `ContentSearchHandler` into `MagicMapper::find()`. The `_rbac_as_public` flag rides in the `$searchQuery` dict which is dict-copied to every sub-query including the content-search path. No additional threading needed.
+- **[N4b first-hit-wins is arbitrary]** For documents linked to multiple publications, the selected publication summary is the first by created date. Edge case, but deterministic. A follow-up ticket can introduce most-recent-wins if product requires it.
+- **[OR `_relations_contains` is NOT handled in the UNION-arm]** The per-document refinement lookup (Stap 5a) is on the single-schema path. If the publication schema spans multiple registers (unusual for WOO installs), the lookup might miss publications in non-primary registers. Acceptable for the WOO baseline; documented as a known limitation.
+- **[Repair migration touches live DB schema config]** The migration reads and writes the `authorization` field of existing schema objects via `ObjectService`. Test on staging before production upgrade. Idempotency guard prevents double-injection.
+
+## Migration Plan
+
+1. Merge OR PR #2855 (`rbac-as-public-toggle`) to OR `main`. OC's `assemblePublicSearchResults()` will set `_rbac_as_public: true`; this is a no-op until OR PR is merged.
+2. Merge this OC PR. On `occ upgrade` / `occ maintenance:repair`, the repair migration runs and backfills the two-rule shape into `publication` and `document` schemas on existing installations.
+3. New installations: seed already carries the two-rule shape.
+4. **Rollback:** Remove `_rbac: true` + `_rbac_as_public: true` from `assemblePublicSearchResults()` and restore the `isObjectPublic()` loop. Migration cannot easily be rolled back (schema config change) but is idempotent, so re-running is safe.
+
+## Open Questions
+
+All questions from WOO-536 clarification rounds are decided (see plan file). Remaining items for Fase 5 checkpoint:
+
+- N4a (0-relations): confirmed decision is silent-drop + warning log (this design).
+- N4b (multiple-relations): confirmed decision is first-hit-wins (this design); follow-up ticket for most-recent if needed.
diff --git a/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/proposal.md b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/proposal.md
new file mode 100644
index 000000000..2fb242a6e
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/proposal.md
@@ -0,0 +1,47 @@
+---
+kind: code
+depends_on: [rbac-as-public-toggle]
+---
+
+## Why
+
+`PublicationQueryService::assemblePublicSearchResults()` derives its search scope from three hardcoded app-config values (`publication_register`, `publication_schema`, `document_schema`), limiting `/api/search` to exactly one register and two schemas. This directly contradicts the OpenCatalogi data model: CAT-010 mandates multi-schema/multi-register catalogs; PUB-003 and PUB-004 mandate catalog-derived scope with UNION-based search. On WOO installations that include schemas beyond `publication` and `document` (e.g. `besluit`, `verzoek`, `dataset`), the public search returns an empty result set with HTTP 200 and no error — a silent, incorrect failure. Additionally, the PHP post-filter `isObjectPublic()` that enforces publication-window visibility hardcodes field names specific to the publication schema, which is why scope could never widen to arbitrary schemas (Robert Zondervan, WOO-536, 2026-08-12).
+
+This change fixes the architectural misalignment documented by Robert in WOO-536 by moving visibility enforcement into SQL via OpenRegister's schema-level RBAC (consuming the `_rbac_as_public` primitive from the OR precursor PR, per ADR-022) and deriving search scope from the catalog model instead of app-config.
+
+## What Changes
+
+- **MODIFIED:** `PublicationQueryService::assemblePublicSearchResults()` — accept optional `_catalog` / `_catalogi[]` params; resolve scope from `buildCatalogSearchQuery()` + `resolveSchemaAndRegisterObjects()` instead of three `resolveConfiguredId()` calls; call `searchObjectsPaginated()` with `_rbac: true` **and** `_rbac_as_public: true` (B-1 primitive, OR PR #2855); strip `isObjectPublic()` loop; restore OR's `total` and `facets`/`facetable` for anonymous callers; preserve `PUBLIC_LIMIT_MAX` DoS cap; preserve `_content` → `_content_search` forwarding (unchanged).
+- **MODIFIED:** `PublicationQueryService::resolveDocumentPublicationSummary()` — replace the denormalised `publication.slug` lookup with a per-document `_relations_contains` call on the single-schema path (Stap 5a), generalising from document→publication to related-object→source-object. N4a edge case: silent-drop + warning log for documents with 0 relations. N4b edge case: first-hit-wins for documents with multiple related publications (backward-compatible).
+- **MODIFIED:** `PublicationQueryService` — replace the two-element `$schemaSlugById` map with a `SchemaMapper` lookup cached per request, so `@self.schema` carries the real slug for every schema in scope (Stap 3).
+- **NEW:** `lib/Migration/Version1Date202608250900WOO536Repair.php` — repair migration (Q5 Path A) that backfills the two-rule `depublicatiedatum` read-shape into `publication` and `document` schemas on existing installations, idempotent and safe to re-run.
+- **MODIFIED:** `lib/Settings/publication_register.json` — update `publication` and `document` schema seeds to the two-rule read-shape (PR seed update matching the migration target state).
+- **MODIFIED:** `PublicationQueryService` docblocks — fix three broken refs to `openspec/changes/add-public-fulltext-search/` (archived 2026-07-16) by pointing at `openspec/changes/fix-fts-catalog-model-alignment/` or the updated spec IDs in `openspec/specs/search/spec.md`.
+- **NEW:** `openspec/specs/search/spec.md` — add requirements SCH-PFTS-CAT-001 / SCH-PFTS-CAT-002 / SCH-PFTS-CAT-003 and amend SCH-PFTS-001 (mechanism changes from PHP post-filter to SQL RBAC via B-1, intent unchanged).
+
+## Capabilities
+
+### New Capabilities
+
+(none — this change refactors an existing capability)
+
+### Modified Capabilities
+
+- `search`: The public search endpoint now derives scope from the catalog model (every schema in every catalog the caller may see) instead of two hardcoded schemas. Visibility enforcement moves from PHP post-filter to SQL WHERE via OpenRegister's RBAC engine. New `_catalog` / `_catalogi[]` query params allow scope narrowing. `total` and `facets`/`facetable` are restored for anonymous callers. `@self.schema` is now populated for every schema in scope, not just the two hardcoded ones.
+
+## Impact
+
+- **Code (opencatalogi):**
+  - `lib/Service/PublicationQueryService.php` — centre of mass; Stap 1-6 refactor
+  - `lib/Migration/Version1Date202608250900WOO536Repair.php` — new repair migration (Q5 Path A)
+  - `lib/Settings/publication_register.json` — seed update for `publication` and `document` schemas
+  - `tests/Unit/Service/PublicationQueryServiceTest.php` — new/extended unit tests
+  - `tests/Unit/Service/RepairMigrationTest.php` — migration idempotency tests
+- **Depends on (upstream):** OR PR #2855 (`rbac-as-public-toggle`) — must be merged to OR `main` before this OC PR is merged; the `_rbac_as_public` primitive is the mechanism for Q1 Option B (uniform public-endpoint visibility regardless of caller session).
+- **API contract:** New query params `_catalog` (single UUID or slug) and `_catalogi[]` (array of UUIDs or slugs) are additive and optional. Default behaviour (no param) changes from "two-schema app-config scope" to "union of listed+published catalogs". The `_search` envelope shape is preserved (N2): flat `results[]` with `@self.schema` discriminator and embedded `publication: {id, slug, title}` on document rows.
+- **Seed update (existing installs):** The repair migration handles backfill of the `depublicatiedatum` two-rule shape into `publication` and `document` schemas on existing installations (Q5 Path A). Seed change covers new installs.
+- **ADR references:**
+  - **ADR-022** (apps-consume-or-abstractions): this change consumes OR's `_rbac_as_public` primitive and `MagicRbacHandler` RBAC rather than re-implementing visibility in PHP.
+  - **ADR-023** (action-authorization): `_rbac_as_public: true` is a per-request scope override that forces anonymous context on the RBAC computation — the action-authorization layer of the public endpoint.
+  - **ADR-005** (security): public endpoints must return uniform results regardless of caller session; the B-1 primitive enforces this (Q1 Option B, overrules admin-bypass and owner OR-in for the `/api/search` surface).
+  - **ADR-032** (spec-sizing): `kind: code` — centre of mass is `PublicationQueryService` refactor + tests; seed + migration edits are incidental JSON permitted within `kind: code`.
diff --git a/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/specs/search/spec.md b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/specs/search/spec.md
new file mode 100644
index 000000000..8a36c1faa
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/specs/search/spec.md
@@ -0,0 +1,85 @@
+## ADDED Requirements
+
+### Requirement: Accept `_catalog` and `_catalogi[]` scope-narrowing params (SCH-PFTS-CAT-001)
+
+The `/apps/opencatalogi/api/search` endpoint SHALL accept an optional `_catalog` query parameter (single catalog UUID or slug) and an optional `_catalogi[]` array parameter (multiple catalog UUIDs or slugs). When either parameter is provided, the search scope SHALL be limited to the union of registers and schemas declared by the matching catalog(s). When both are absent, the default scope applies (see SCH-PFTS-CAT-002). Clients MAY NOT widen scope via `_schema`, `_registers`, or `fq` on this endpoint (those parameters remain stripped, per existing discipline). Links to CAT-010, PUB-003, PUB-004.
+
+#### Scenario: Single catalog scope via `_catalog`
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term&_catalog=my-catalog`
+- **THEN** the search scope is limited to the registers and schemas declared by the catalog with slug `my-catalog`
+- **AND** objects from schemas not in that catalog are absent from the results
+
+#### Scenario: Multi-catalog scope via `_catalogi[]`
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term&_catalogi[]=cat-a&_catalogi[]=cat-b`
+- **THEN** the search scope is the union of all registers and schemas declared by catalogs `cat-a` and `cat-b`
+- **AND** objects from either catalog are present in the results
+
+#### Scenario: Disallowed scope widening via `_schema`
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term&_schema=42`
+- **THEN** the `_schema` parameter is silently stripped
+- **AND** the scope is resolved from the catalog model as normal
+
+### Requirement: Default scope is union of listed and published catalogs (SCH-PFTS-CAT-002)
+
+When neither `_catalog` nor `_catalogi[]` is provided, the `/apps/opencatalogi/api/search` endpoint SHALL compute its scope as the union of all catalogs where `listed: true` AND the catalog object itself is published (passes its own `read` authorization rules under public context). Schemas without any explicit `read` authorization configuration SHALL be excluded from the anonymous search scope and the system SHALL log a warning for each such schema encountered. Links to CAT-010, PUB-003.
+
+#### Scenario: Default scope includes all listed published catalogs
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term` with no `_catalog` or `_catalogi[]` params
+- **THEN** the search scope is the union of registers and schemas from all catalogs with `listed: true` that are themselves published
+- **AND** objects from schemas in non-listed or unpublished catalogs are absent from the results
+
+#### Scenario: Schema without explicit read rules is excluded
+- **WHEN** a schema in a listed published catalog has no `authorization.read` configuration
+- **THEN** that schema is excluded from the anonymous search scope
+- **AND** the system logs a warning identifying the schema by ID and slug
+
+### Requirement: Catalog-derived scope replaces app-config scope (SCH-PFTS-CAT-003)
+
+The `/apps/opencatalogi/api/search` endpoint SHALL NOT use `publication_register`, `publication_schema`, or `document_schema` app-config values to determine search scope. Scope SHALL be derived entirely from the catalog model via `buildCatalogSearchQuery()` + `resolveSchemaAndRegisterObjects()`. A misconfigured or missing app-config value SHALL NOT cause the endpoint to return an empty result set. Links to CAT-010, PUB-003, PUB-004.
+
+#### Scenario: Scope independent of app-config
+- **WHEN** the `publication_register` / `publication_schema` / `document_schema` app-config values are absent or incorrect
+- **THEN** the search still returns results from the catalog-model-derived scope
+- **AND** the endpoint does not return HTTP 200 with an empty result set due to a missing config value
+
+#### Scenario: Multi-schema catalog returns results from all schemas
+- **WHEN** a catalog declares three schemas (e.g. `publication`, `document`, `besluit`)
+- **AND** the caller sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** results from all three schemas are present in the response
+- **AND** each result carries `@self.schema` set to the correct schema slug
+
+## MODIFIED Requirements
+
+### Requirement: Public search endpoint enforces uniform visibility for all callers (SCH-PFTS-001)
+
+The `/apps/opencatalogi/api/search` endpoint SHALL return identical result sets regardless of the caller's authentication state. Authenticated callers (including Nextcloud admins and object owners) SHALL see the same results as anonymous callers. This SHALL be enforced by passing `_rbac_as_public: true` alongside `_rbac: true` to `ObjectService::searchObjectsPaginated()` (consuming the `rbac-as-public-toggle` primitive from OpenRegister, per ADR-022). The previous mechanism — a PHP post-filter (`isObjectPublic()`) — is removed; visibility is now enforced in SQL by the RBAC engine using only the `public` group's matching rules from each schema's `authorization.read` configuration. This change preserves the security intent of SCH-PFTS-001 while extending it to arbitrary schemas (not only `publication` and `document`).
+
+#### Scenario: Admin caller sees same results as anonymous caller
+- **WHEN** an authenticated Nextcloud admin sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** the result set is identical to that returned for an anonymous (unauthenticated) caller with the same query
+- **AND** the admin's own unpublished objects are absent from the results
+
+#### Scenario: Object owner cannot see their own unpublished objects via search
+- **WHEN** a user who owns a draft `publication` object (publicatiedatum in the future) sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** the draft object is absent from the results
+- **AND** the result set matches what an anonymous caller would see
+
+#### Scenario: Published objects within window are visible to all callers
+- **WHEN** a `publication` object has `publicatiedatum` in the past and `depublicatiedatum` absent or in the future
+- **AND** any caller (anonymous or authenticated) sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** the publication is present in the results
+
+#### Scenario: Depublished objects are absent for all callers
+- **WHEN** a `publication` object has `depublicatiedatum` in the past
+- **AND** any caller sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** the publication is absent from the results
+
+#### Scenario: `total` reflects the true visible count
+- **WHEN** any caller sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** the `total` field in the response equals the actual count of objects visible under public RBAC
+- **AND** `total` is NOT an undercount caused by PHP post-filtering
+
+#### Scenario: `facets` and `facetable` are populated for anonymous callers
+- **WHEN** an anonymous caller sends `GET /apps/opencatalogi/api/search?_search=term`
+- **THEN** the `facets` and `facetable` fields are present and populated in the response
+- **AND** facet counts reflect only publicly visible objects
diff --git a/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/tasks.md b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/tasks.md
new file mode 100644
index 000000000..cd6e2256a
--- /dev/null
+++ b/openspec/changes/archive/2026-08-28-fix-fts-catalog-model-alignment/tasks.md
@@ -0,0 +1,57 @@
+## 1. Schema seed + repair migration (Fase 4)
+
+- [x] 1.1 Update `publication` schema in `lib/Settings/publication_register.json` to the two-rule read-shape: `publicatiedatum $lte $now AND depublicatiedatum $gte $now` OR `publicatiedatum $lte $now AND depublicatiedatum $exists false`, plus `"authenticated"` as third element. Verify lowercase property names (propertyToColumnName leaves them unchanged).
+- [x] 1.2 Update `document` schema in `lib/Settings/publication_register.json` to the same two-rule read-shape (same three elements).
+- [x] 1.3 Write `lib/Migration/Version1Date202608250900WOO536Repair.php` that backfills the two-rule shape into `publication` and `document` schemas on existing installations. Guard: only inject when `read` block has the single-rule shape (missing `depublicatiedatum`); leave customised blocks alone; preserve `"authenticated"` element; idempotent.
+
+## 2. Stap 1 — Enable RBAC with public-endpoint context
+
+- [x] 2.1 In `PublicationQueryService::assemblePublicSearchResults()`, replace `_rbac: false` (or absent) with `_rbac: true` AND `_rbac_as_public: true` on every `searchObjectsPaginated()` call. Add docblock comment referencing SCH-PFTS-001, RBA-PUBLIC-001, and WOO-536.
+
+## 3. Stap 2 — Catalog-derived scope
+
+- [x] 3.1 Remove the three `resolveConfiguredId()` calls (`publication_register`, `publication_schema`, `document_schema`) from `assemblePublicSearchResults()`.
+- [x] 3.2 Accept optional `_catalog` (string) and `_catalogi[]` (array) from the incoming `$searchQuery`; strip them before forwarding to OR (they are OC-level params, not OR filter params).
+- [x] 3.3 When `_catalog` or `_catalogi[]` is provided, call `buildCatalogSearchQuery()` to resolve catalog objects, then `resolveSchemaAndRegisterObjects()` to get the register/schema scope.
+- [x] 3.4 When neither param is provided, resolve scope as the union of all catalogs where `listed: true` and the catalog is published (same helper calls, filtering catalogs by `listed: true` + published predicate).
+- [ ] 3.5 Add guard: if resolved scope contains a schema with no `read` authorization config (bypass = true under `_rbac_as_public`), log a `$this->logger->warning()` with the schema ID/slug and exclude it from the anonymous scope.
+
+## 4. Stap 3 — Dynamic schema discriminator
+
+- [x] 4.1 Replace the two-element `$schemaSlugById` map with a `SchemaMapper` lookup, injected via DI and cached per request.
+- [x] 4.2 In the result-assembly loop, use the `SchemaMapper` to resolve `@self.schema` slug for every result row, regardless of which schema the row came from.
+
+## 5. Stap 4 — Remove PHP post-filter + restore totals/facets
+
+- [x] 5.1 Remove the `isObjectPublic()` post-filter loop from `assemblePublicSearchResults()`.
+- [x] 5.2 Remove the per-page `total` undercount workaround (the adjustment to subtract non-public rows).
+- [x] 5.3 Remove the conditional stripping of `facets` and `facetable` for anonymous callers.
+- [x] 5.4 Return OR's `total`, `facets`, and `facetable` directly in the response envelope.
+
+## 6. Stap 5a — Relations-based document→publication link
+
+- [x] 6.1 In `resolveDocumentPublicationSummary()`, replace the denormalised `publication.slug` lookup with a per-document `_relations_contains` call on the single-schema path (`ObjectService::searchObjectsPaginated()` or equivalent single-schema query). Pass `_rbac_as_public: true` on this lookup too.
+- [ ] 6.2 Generalise the helper to accept the document's `_relations` array and look up the source object in the referenced schema — not hard-coded to publication.
+- [x] 6.3 N4a: when `_relations_contains` returns 0 results, set `publication: null` on the document envelope row and log `$this->logger->warning()` with the document UUID.
+- [x] 6.4 N4b: when `_relations_contains` returns multiple results, select first-hit (ordered by `@self.created`); add inline comment referencing this design decision and WOO-536 plan N4b.
+
+## 7. Stap 7 — Docblock fixes + spec refs
+
+- [x] 7.1 In `PublicationQueryService.php`, replace all three broken docblock refs to `openspec/changes/add-public-fulltext-search/tasks.md`, `design.md`, and `spec.md#SCH-PFTS-002` with refs to `openspec/changes/fix-fts-catalog-model-alignment/tasks.md` and `openspec/specs/search/spec.md` (SCH-PFTS-CAT-* headings).
+
+## 8. Tests
+
+- [x] 8.1 Add `tests/Unit/Service/PublicationQueryServiceTest.php` covering: fail-closed empty scope, `_rbac`/`_rbacAsPublic`/`_multitenancy` forwarded to OR, Q7 Interpretation A scope-widening params stripped, catalog-scope propagates as `_schemas`, envelope `facets`/`facetable` pass-through, M2 fast-path via `_relations['publication.slug']` (bug 1 fix) + `_relations['publication']` (UUID) + N4a silent-drop, pure helpers (`isCatalogPubliclyAvailable`, `normalizeIds`, `stripEmptyValues`), plus preserved `findObjectLocation` fail-closed + happy-path + DoesNotExistException-continue cases. 19 tests, 53 assertions, all green (2026-08-31). Commit b6dc3f83.
+- [x] 8.2 Add `tests/Unit/Service/RepairMigrationTest.php` covering: single-rule-shape install gets two-rule shape added; already-two-rule-shape install is not duplicated (idempotency); admin-customised read block is not clobbered; `"authenticated"` element is preserved.
+
+Acceptance criteria:
+
+- `GET /apps/opencatalogi/api/search?_search=<term>` returns matches from every schema in every catalog the caller may see, with correct `@self.schema` slugs, correct `total`, and populated `facets`/`facetable`.
+- Anonymous caller and authenticated admin caller see identical result sets for the same query.
+- A draft `publication` (publicatiedatum in the future) is absent for all callers.
+- A depublished `publication` (depublicatiedatum in the past) is absent for all callers.
+- `_catalog` and `_catalogi[]` params correctly narrow/union scope.
+- `_schema`, `_registers`, `fq` params are still stripped (Q7 Interpretation A preserved).
+- `total` is not undercounted; `facets`/`facetable` are not stripped for anon.
+- Repair migration is idempotent and leaves admin-customised read blocks unchanged.
+- `openspec validate fix-fts-catalog-model-alignment` passes clean.
diff --git a/openspec/config.yaml b/openspec/config.yaml
index 63a1a1bc9..b4992b5da 100644
--- a/openspec/config.yaml
+++ b/openspec/config.yaml
@@ -1,4 +1,4 @@
-schema: conduction
+schema: spec-driven
 
 context: |
   Project: OpenCatalogi
diff --git a/openspec/specs/search/spec.md b/openspec/specs/search/spec.md
index 8fd4f7c00..4904116c7 100644
--- a/openspec/specs/search/spec.md
+++ b/openspec/specs/search/spec.md
@@ -200,26 +200,43 @@ Every document row in the result envelope MUST include an embedded `publication`
 - **WHEN** the public search assembly runs,
 - **THEN** the document MUST NOT appear in the result rows returned to anonymous callers.
 
-### Requirement: Anonymous visibility filter runs AFTER scoring and merging (SCH-PFTS-004)
+### Requirement: Uniform-visibility enforcement via SQL RBAC (SCH-PFTS-004)
 
-For anonymous callers, the public search endpoint MUST apply the same `isObjectPublic()` filter that `/publications` already uses, with identical ordering semantics: the filter runs AFTER the underlying search (scoring and merge) has produced the candidate result set, NOT as a pre-filter on the query. This guarantees the public result set is a strict subset of what scoring produced, and that ranking decisions are made on the full corpus before visibility is enforced.
+**AMENDED by WOO-536 (2026-08-27).** The prior mechanism — a PHP post-filter (`isObjectPublic()`) run AFTER scoring/merge — is REMOVED. Visibility on the public search endpoint MUST now be enforced in SQL by OR's RBAC engine using only the `public` group's matching rules from each schema's `authorization.read` configuration. This is achieved by passing `_rbac_as_public: true` alongside `_rbac: true` to `ObjectService::searchObjectsPaginated()`, consuming the `rbac-as-public-toggle` primitive from OpenRegister (ADR-022). Under this mode, the RBAC engine ignores the caller's session (admin bypass suppressed, owner-bypass suppressed) and evaluates only the `public` group rules — so authenticated and anonymous callers see identical result sets on this endpoint (Q1 Option B).
 
-For documents, visibility MUST also be transitively gated: a document is visible to anonymous callers only if its linked publication itself satisfies `isObjectPublic()`.
+The SQL-side enforcement means visibility is a WHERE-clause predicate on the underlying query, not a post-filter, so `total`, `facets`, and `facetable` reflect the true visible count without undercount workarounds. For documents, transitive visibility is realised by looking up the linked publication via `_relations_contains` with the same `_rbac_as_public: true` flag — a document surfaces only when its linked publication itself passes the `public` group's read rules.
 
-#### Scenario: anonymous filter strips depublished publications post-scoring
+#### Scenario: admin caller sees identical result set to anonymous caller
 
-- **GIVEN** anonymous request matching publications A (live) and B (depublicatiedatum in the past),
-- **WHEN** the public search runs,
-- **THEN** the candidate set initially contains both A and B,
-- **AND** the visibility filter is applied AFTER scoring/merge,
-- **AND** the response contains A only.
+- **GIVEN** an authenticated Nextcloud admin,
+- **WHEN** the admin issues `GET /apps/opencatalogi/api/search?_search=jaarverslag`,
+- **THEN** the result set MUST be identical to that returned for an anonymous caller with the same query,
+- **AND** the admin's own draft publications MUST be absent from the results.
+
+#### Scenario: depublished publications are absent for all callers
+
+- **GIVEN** a publication whose `depublicationDate` is in the past,
+- **WHEN** any caller (anonymous or authenticated) issues the public search,
+- **THEN** the publication MUST NOT appear in the response.
 
 #### Scenario: document visibility is transitively gated
 
-- **GIVEN** a document D linked to a publication P whose `depublicatiedatum` is in the past,
+- **GIVEN** a document D linked to a publication P whose `depublicationDate` is in the past,
 - **WHEN** an anonymous caller searches for content matching D,
 - **THEN** D MUST NOT appear in the response.
 
+#### Scenario: `total` reflects the true visible count
+
+- **WHEN** any caller sends `GET /apps/opencatalogi/api/search`,
+- **THEN** the `total` field MUST equal the actual count of objects visible under public RBAC,
+- **AND** `total` MUST NOT be an undercount caused by PHP post-filtering.
+
+#### Scenario: `facets` and `facetable` are populated for anonymous callers
+
+- **WHEN** an anonymous caller sends `GET /apps/opencatalogi/api/search`,
+- **THEN** the `facets` and `facetable` fields MUST be present and populated,
+- **AND** facet counts MUST reflect only publicly visible objects.
+
 ### Requirement: A dedicated `document` schema is bundled in the publication register (SCH-PFTS-005)
 
 OpenCatalogi MUST add a new `document` schema as a **bundled** schema inside `lib/Settings/publication_register.json` (registered alongside `publication`, `catalog`, `organization`, …). This schema MUST NOT be supplied by a deployer-side fragment; bundling guarantees the schema is present on every install so the public search endpoint can rely on its presence.
@@ -280,6 +297,61 @@ New properties added to a schema in future changes (e.g. a `kenmerk` field added
 - **WHEN** the public search runs,
 - **THEN** the document MUST appear in the result set (matched via OR's `zoeken-filteren` on the metadata fields it already covers).
 
+### Requirement: Accept `_catalog` and `_catalogi[]` scope-narrowing params (SCH-PFTS-CAT-001)
+
+**Added by WOO-536 (2026-08-27).** The `/apps/opencatalogi/api/search` endpoint MUST accept an optional `_catalog` query parameter (single catalog UUID or slug) and an optional `_catalogi[]` array parameter (multiple catalog UUIDs or slugs). When either parameter is provided, the search scope MUST be limited to the union of registers and schemas declared by the matching catalog(s). When both are absent, the default scope applies (see SCH-PFTS-CAT-002). Clients MUST NOT be able to widen scope via `_schema`, `_registers`, or `fq` on this endpoint (those parameters remain stripped per Q7 Interpretation A). Links to CAT-010, PUB-003, PUB-004.
+
+#### Scenario: single catalog scope via `_catalog`
+
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term&_catalog=my-catalog`,
+- **THEN** the search scope MUST be limited to the registers and schemas declared by the catalog with slug `my-catalog`,
+- **AND** objects from schemas not in that catalog MUST be absent from the results.
+
+#### Scenario: multi-catalog scope via `_catalogi[]`
+
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term&_catalogi[]=cat-a&_catalogi[]=cat-b`,
+- **THEN** the search scope MUST be the union of all registers and schemas declared by catalogs `cat-a` and `cat-b`,
+- **AND** objects from either catalog MUST be present in the results.
+
+#### Scenario: disallowed scope widening via `_schema`
+
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term&_schema=42`,
+- **THEN** the `_schema` parameter MUST be silently stripped,
+- **AND** the scope MUST be resolved from the catalog model as normal.
+
+### Requirement: Default scope is union of listed and published catalogs (SCH-PFTS-CAT-002)
+
+**Added by WOO-536 (2026-08-27).** When neither `_catalog` nor `_catalogi[]` is provided, the `/apps/opencatalogi/api/search` endpoint MUST compute its scope as the union of all catalogs where `listed: true` AND the catalog object itself is published (passes its own `read` authorization rules under public context). Schemas without any explicit `read` authorization configuration MUST be excluded from the anonymous search scope and the system MUST log a warning for each such schema encountered. Links to CAT-010, PUB-003.
+
+#### Scenario: default scope includes all listed published catalogs
+
+- **WHEN** a caller sends `GET /apps/opencatalogi/api/search?_search=term` with no `_catalog` or `_catalogi[]` params,
+- **THEN** the search scope MUST be the union of registers and schemas from all catalogs with `listed: true` that are themselves published,
+- **AND** objects from schemas in non-listed or unpublished catalogs MUST be absent from the results.
+
+#### Scenario: schema without explicit read rules is excluded
+
+- **WHEN** a schema in a listed published catalog has no `authorization.read` configuration,
+- **THEN** that schema MUST be excluded from the anonymous search scope,
+- **AND** the system MUST log a warning identifying the schema by ID and slug.
+
+### Requirement: Catalog-derived scope replaces app-config scope (SCH-PFTS-CAT-003)
+
+**Added by WOO-536 (2026-08-27).** The `/apps/opencatalogi/api/search` endpoint MUST NOT use `publication_register`, `publication_schema`, or `document_schema` app-config values to determine search scope. Scope MUST be derived entirely from the catalog model via `buildCatalogSearchQuery()` + `resolveSchemaAndRegisterObjects()`. A misconfigured or missing app-config value MUST NOT cause the endpoint to return an empty result set. Links to CAT-010, PUB-003, PUB-004.
+
+#### Scenario: scope independent of app-config
+
+- **WHEN** the `publication_register` / `publication_schema` / `document_schema` app-config values are absent or incorrect,
+- **THEN** the search MUST still return results from the catalog-model-derived scope,
+- **AND** the endpoint MUST NOT return HTTP 200 with an empty result set due to a missing config value.
+
+#### Scenario: multi-schema catalog returns results from all schemas
+
+- **WHEN** a catalog declares three schemas (e.g. `publication`, `document`, `besluit`),
+- **AND** the caller sends `GET /apps/opencatalogi/api/search?_search=term`,
+- **THEN** results from all three schemas MUST be present in the response,
+- **AND** each result MUST carry `@self.schema` set to the correct schema slug.
+
 ## REMOVED Requirements
 
 The following requirements described bespoke implementations that OR's
diff --git a/scripts/smoke-fts-woo536.sh b/scripts/smoke-fts-woo536.sh
new file mode 100644
index 000000000..acac2f55b
--- /dev/null
+++ b/scripts/smoke-fts-woo536.sh
@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+# ------------------------------------------------------------------
+# WOO-536 acceptance-criteria smoke test (fresh docker install).
+#
+# Assumes seed-fulltext-search-test-data.sh has run (or an equivalent
+# seed exists) so a catalog + publications + documents are in place.
+# Exercises Robert's Definition of Done ("returns matches from every
+# schema in every catalog the caller may see") + SCH-PFTS-001..004 +
+# SCH-PFTS-CAT-001..003 via the public /api/search endpoint.
+#
+# Runs 8 assertions:
+#   1. anon default scope returns at least 1 publication
+#   2. total == results-length (bug 1 regression guard — no undercount)
+#   3. admin auth returns identical result-set as anon (Q1 Option B)
+#   4. `_catalog=<known-slug>` scope narrows correctly
+#   5. `_catalog=nonexistent` returns HTTP 200 with total: 0 (graceful)
+#   6. `_schema=999` client scope-widening attempt is stripped
+#   7. envelope carries results/total (facets optional per OR response)
+#   8. every row carries `@self.schema` as a slug string (SCH-PFTS-002)
+#
+# Usage:
+#   ./scripts/smoke-fts-woo536.sh \
+#     [--base-url http://nextcloud.local] \
+#     [--admin-user admin] \
+#     [--admin-token <app-password>] \
+#     [--catalog-slug <known-catalog-slug>]
+#
+# Exits 0 on all-green, non-zero on any assertion failure with a
+# per-check diagnostic. Rate-limits itself with sleep so it doesn't
+# trip the anonymous DoS defense (PUBLIC_LIMIT_MAX).
+# ------------------------------------------------------------------
+
+set -euo pipefail
+
+# Defaults — override via flags.
+BASE_URL="http://nextcloud.local"
+ADMIN_USER="admin"
+ADMIN_TOKEN=""
+CATALOG_SLUG=""
+DOCKER_CONTAINER="master-nextcloud-1"
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--base-url)      BASE_URL="$2"; shift 2 ;;
+		--admin-user)    ADMIN_USER="$2"; shift 2 ;;
+		--admin-token)   ADMIN_TOKEN="$2"; shift 2 ;;
+		--catalog-slug)  CATALOG_SLUG="$2"; shift 2 ;;
+		--container)     DOCKER_CONTAINER="$2"; shift 2 ;;
+		-h|--help)
+			sed -n '3,32p' "$0" | sed 's|^# \?||'
+			exit 0
+			;;
+		*)
+			echo "unknown flag: $1" >&2
+			exit 2
+			;;
+	esac
+done
+
+# All curls run inside the NC container so networking is deterministic.
+curl_in() {
+	docker exec "${DOCKER_CONTAINER}" curl -s "$@"
+}
+
+# Fetch envelope + assert basic keys. Args: 1=url, 2=[admin|anon].
+fetch_envelope() {
+	local url="$1"
+	local mode="$2"
+	if [ "$mode" = "admin" ]; then
+		curl_in -u "${ADMIN_USER}:${ADMIN_TOKEN}" -H "Host: ${BASE_URL#http://}" "http://localhost${url}"
+	else
+		curl_in -H "Host: ${BASE_URL#http://}" "http://localhost${url}"
+	fi
+}
+
+PASS=0
+FAIL=0
+FAILURES=()
+
+pass() { echo "  ✓ $1"; PASS=$((PASS + 1)); }
+fail() { echo "  ✗ $1" >&2; FAIL=$((FAIL + 1)); FAILURES+=("$1"); }
+
+json_get() {
+	# Dot-path getter. `jq` is preinstalled in the NC container image; safer than
+	# a tab-indented Python heredoc that any editor pass or `shfmt` run can break.
+	# `// empty` maps a missing path to a blank line so callers can `[ "$x" = "0" ]`
+	# without special-casing the missing key.
+	jq -r --arg key "$1" 'getpath($key | split(".")) // empty'
+}
+
+echo "=== WOO-536 anon default-scope search ==="
+env1=$(fetch_envelope "/index.php/apps/opencatalogi/api/search" anon)
+total_default=$(echo "$env1" | json_get 'total')
+count_default=$(echo "$env1" | python3 -c "import json,sys; print(len(json.load(sys.stdin).get('results',[])))")
+echo "  total: ${total_default}, results len: ${count_default}"
+
+if [ "${total_default:-0}" -ge 1 ]; then
+	pass "assertion 1: anon default scope returns at least 1 row (${total_default})"
+else
+	fail "assertion 1: expected at least 1 row, got ${total_default} — is the seed data present?"
+fi
+
+# SCH-PFTS-004 pagination-safe invariant: `total ≥ count(results)`. `total`
+# reflects OR's global count minus per-page drops so pagination has_more still
+# works — but MUST NEVER dip below what we actually shipped on this page
+# (that would be the `total: 1, results: []` bug pattern).
+if [ "${total_default:-0}" -ge "${count_default:-999}" ] 2>/dev/null; then
+	pass "assertion 2: total (${total_default}) ≥ results-length (${count_default}) — SCH-PFTS-004 invariant"
+else
+	fail "assertion 2: total (${total_default}) < results-length (${count_default}) — UNDERCOUNT REGRESSION (SCH-PFTS-004)"
+fi
+
+# Envelope keys
+if echo "$env1" | python3 -c "import json,sys; d=json.load(sys.stdin); assert 'results' in d and 'total' in d" 2>/dev/null; then
+	pass "assertion 7: envelope carries results + total (facets optional per OR response)"
+else
+	fail "assertion 7: envelope missing results or total"
+fi
+
+# @self.schema on every row
+if echo "$env1" | python3 -c "
+import json, sys
+d = json.load(sys.stdin)
+for r in d.get('results', []):
+	schema = r.get('@self', {}).get('schema')
+	assert isinstance(schema, str) and schema, f'row missing @self.schema: {r.get(\"title\")}'
+" 2>/dev/null; then
+	pass "assertion 8: every row carries @self.schema as slug string (SCH-PFTS-002)"
+else
+	fail "assertion 8: some row missing @self.schema — SCH-PFTS-002 violated"
+fi
+
+sleep 2  # pace against rate-limiter
+
+# Admin parity
+if [ -n "${ADMIN_TOKEN}" ]; then
+	echo "=== admin auth parity ==="
+	env2=$(fetch_envelope "/index.php/apps/opencatalogi/api/search" admin)
+	total_admin=$(echo "$env2" | json_get 'total')
+	if [ "${total_admin:-0}" = "${total_default:-1}" ]; then
+		pass "assertion 3: admin auth total (${total_admin}) == anon total (${total_default}) — Q1 Option B (SCH-PFTS-001)"
+	else
+		fail "assertion 3: admin total (${total_admin}) != anon total (${total_default}) — admin bypass NOT suppressed"
+	fi
+else
+	echo "  ⊘ assertion 3 SKIPPED: no --admin-token supplied"
+fi
+
+sleep 2
+
+# _catalog scope
+if [ -n "${CATALOG_SLUG}" ]; then
+	echo "=== _catalog=${CATALOG_SLUG} scope narrowing ==="
+	env3=$(fetch_envelope "/index.php/apps/opencatalogi/api/search?_catalog=${CATALOG_SLUG}" anon)
+	total_scope=$(echo "$env3" | json_get 'total')
+	echo "  total: ${total_scope}"
+	if [ "${total_scope:-x}" -ge 0 ] 2>/dev/null; then
+		pass "assertion 4: _catalog=${CATALOG_SLUG} resolves gracefully (total: ${total_scope})"
+	else
+		fail "assertion 4: _catalog=${CATALOG_SLUG} returned no numeric total"
+	fi
+else
+	echo "  ⊘ assertion 4 SKIPPED: no --catalog-slug supplied"
+fi
+
+sleep 2
+
+# _catalog=nonexistent
+echo "=== _catalog=nonexistent graceful edge case ==="
+http_code=$(curl_in -o /dev/null -w "%{http_code}" -H "Host: ${BASE_URL#http://}" "http://localhost/index.php/apps/opencatalogi/api/search?_catalog=nonexistent-catalog-slug-xyz")
+env4=$(fetch_envelope "/index.php/apps/opencatalogi/api/search?_catalog=nonexistent-catalog-slug-xyz" anon)
+if [ "${http_code}" = "200" ]; then
+	total_ne=$(echo "$env4" | json_get 'total')
+	if [ "${total_ne:-x}" = "0" ]; then
+		pass "assertion 5: _catalog=nonexistent returns HTTP 200 + total: 0 (graceful)"
+	else
+		fail "assertion 5: _catalog=nonexistent returned total: ${total_ne} (expected 0)"
+	fi
+else
+	fail "assertion 5: _catalog=nonexistent returned HTTP ${http_code} (expected 200)"
+fi
+
+sleep 2
+
+# _schema client widening attempt
+echo "=== Q7 Interpretation A: _schema=999 stripped ==="
+env5=$(fetch_envelope "/index.php/apps/opencatalogi/api/search?_schema=999" anon)
+total_widen=$(echo "$env5" | json_get 'total')
+if [ "${total_widen:-x}" = "${total_default:-y}" ]; then
+	pass "assertion 6: _schema=999 stripped, results identical to no-widening (${total_widen} == ${total_default})"
+else
+	fail "assertion 6: _schema=999 changed the result-set (${total_widen} vs ${total_default}) — Q7 Interp A discipline VIOLATED"
+fi
+
+echo
+echo "=== Summary ==="
+echo "  passed: ${PASS}"
+echo "  failed: ${FAIL}"
+if [ ${FAIL} -gt 0 ]; then
+	echo "  failed assertions:"
+	for f in "${FAILURES[@]}"; do
+		echo "    - $f"
+	done
+	exit 1
+fi
+echo "All WOO-536 smoke assertions green."
+exit 0
diff --git a/tests/Unit/Repair/WOO536RepairReadRulesTest.php b/tests/Unit/Repair/WOO536RepairReadRulesTest.php
new file mode 100644
index 000000000..ef668aa73
--- /dev/null
+++ b/tests/Unit/Repair/WOO536RepairReadRulesTest.php
@@ -0,0 +1,210 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Unit\Repair;
+
+use OCA\OpenCatalogi\Repair\WOO536RepairReadRules;
+use OCP\App\IAppManager;
+use OCP\Migration\IOutput;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Container\ContainerInterface;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Unit tests for the WOO-536 read-rule backfill repair step.
+ *
+ * Verifies:
+ *   - single-rule shape (pre-fix) is upgraded to two-rule shape
+ *   - two-rule shape (already-fixed) is left alone (idempotency)
+ *   - admin-customised shapes are left alone
+ *   - "authenticated" element is preserved through the upgrade
+ *   - graceful skip when OR is not installed or SchemaMapper unavailable
+ */
+class WOO536RepairReadRulesTest extends TestCase
+{
+    private IAppManager&MockObject $appManager;
+    private ContainerInterface&MockObject $container;
+    private LoggerInterface&MockObject $logger;
+    private WOO536RepairReadRules $step;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->appManager = $this->createMock(IAppManager::class);
+        $this->container  = $this->createMock(ContainerInterface::class);
+        $this->logger     = $this->createMock(LoggerInterface::class);
+        $this->step       = new WOO536RepairReadRules(
+            $this->appManager,
+            $this->container,
+            $this->logger
+        );
+    }
+
+    public function testGetName(): void
+    {
+        $this->assertStringContainsString('WOO-536', $this->step->getName());
+    }
+
+    public function testSkipsWhenOpenRegisterNotInstalled(): void
+    {
+        $this->appManager->method('isEnabledForAnyone')->willReturn(false);
+
+        $output = $this->createMock(IOutput::class);
+        $output->expects($this->once())->method('warning')->with(
+            $this->stringContains('OpenRegister app is not enabled')
+        );
+
+        $this->step->run($output);
+    }
+
+    public function testUpgradesSingleRuleShapeToTwoRule(): void
+    {
+        $this->appManager->method('isEnabledForAnyone')->willReturnCallback(
+            fn (string $appId) => $appId === 'openregister'
+        );
+
+        // Fake OR schema with the pre-fix single-rule shape.
+        $fakeSchema = $this->createMock(FakeSchema::class);
+        $fakeSchema->method('getId')->willReturn(42);
+        $fakeSchema->method('getAuthorization')->willReturn([
+            'read' => [
+                ['group' => 'public', 'match' => ['publicationDate' => ['$lte' => '$now']]],
+                'authenticated',
+            ],
+        ]);
+
+        // Capture the setAuthorization call to verify the upgraded shape.
+        $captured = null;
+        $fakeSchema->expects($this->once())
+            ->method('setAuthorization')
+            ->willReturnCallback(function ($auth) use (&$captured) {
+                $captured = $auth;
+            });
+
+        // Return the schema only for the publication slug lookup; return empty
+        // for the document slug so setAuthorization is called exactly once.
+        $fakeMapper = $this->createMock(FakeSchemaMapper::class);
+        $fakeMapper->method('findAll')->willReturnCallback(
+            fn (array $filters = []) => ($filters['slug'] ?? null) === 'publication' ? [$fakeSchema] : []
+        );
+        $fakeMapper->expects($this->atLeastOnce())->method('update')->with($fakeSchema);
+
+        $this->container->method('get')->willReturn($fakeMapper);
+
+        $output = $this->createMock(IOutput::class);
+        $this->step->run($output);
+
+        $this->assertIsArray($captured, 'setAuthorization should be called with the upgraded shape');
+        $this->assertArrayHasKey('read', $captured);
+        $read = $captured['read'];
+
+        $this->assertCount(3, $read, 'Upgraded read should have 3 elements: 2 conditional rules + authenticated');
+        $this->assertSame(['$lte' => '$now'], $read[0]['match']['publicationDate']);
+        $this->assertSame(['$gte' => '$now'], $read[0]['match']['depublicationDate']);
+        $this->assertSame(['$exists' => false], $read[1]['match']['depublicationDate']);
+        $this->assertSame('authenticated', $read[2], 'authenticated element must be preserved');
+    }
+
+    public function testIsIdempotentOnTwoRuleShape(): void
+    {
+        $this->appManager->method('isEnabledForAnyone')->willReturnCallback(
+            fn (string $appId) => $appId === 'openregister'
+        );
+
+        // Already on two-rule shape.
+        $fakeSchema = $this->createMock(FakeSchema::class);
+        $fakeSchema->method('getId')->willReturn(42);
+        $fakeSchema->method('getAuthorization')->willReturn([
+            'read' => [
+                ['group' => 'public', 'match' => [
+                    'publicationDate'   => ['$lte' => '$now'],
+                    'depublicationDate' => ['$gte' => '$now'],
+                ]],
+                ['group' => 'public', 'match' => [
+                    'publicationDate'   => ['$lte' => '$now'],
+                    'depublicationDate' => ['$exists' => false],
+                ]],
+                'authenticated',
+            ],
+        ]);
+
+        // MUST NOT call setAuthorization or update.
+        $fakeSchema->expects($this->never())->method('setAuthorization');
+
+        $fakeMapper = $this->createMock(FakeSchemaMapper::class);
+        $fakeMapper->method('findAll')->willReturn([$fakeSchema]);
+        $fakeMapper->expects($this->never())->method('update');
+
+        $this->container->method('get')->willReturn($fakeMapper);
+
+        $this->step->run($this->createMock(IOutput::class));
+    }
+
+    public function testPreservesAdminCustomisedShape(): void
+    {
+        $this->appManager->method('isEnabledForAnyone')->willReturnCallback(
+            fn (string $appId) => $appId === 'openregister'
+        );
+
+        // Admin has added an extra field to the match — leave alone.
+        $fakeSchema = $this->createMock(FakeSchema::class);
+        $fakeSchema->method('getId')->willReturn(42);
+        $fakeSchema->method('getAuthorization')->willReturn([
+            'read' => [
+                ['group' => 'public', 'match' => [
+                    'publicationDate' => ['$lte' => '$now'],
+                    'status'          => 'approved',
+                ]],
+                'authenticated',
+            ],
+        ]);
+
+        $fakeSchema->expects($this->never())->method('setAuthorization');
+
+        $fakeMapper = $this->createMock(FakeSchemaMapper::class);
+        $fakeMapper->method('findAll')->willReturn([$fakeSchema]);
+        $fakeMapper->expects($this->never())->method('update');
+
+        $this->container->method('get')->willReturn($fakeMapper);
+
+        $this->step->run($this->createMock(IOutput::class));
+    }
+
+    public function testSkipsSchemaThatDoesNotExist(): void
+    {
+        $this->appManager->method('isEnabledForAnyone')->willReturnCallback(
+            fn (string $appId) => $appId === 'openregister'
+        );
+
+        $fakeMapper = $this->createMock(FakeSchemaMapper::class);
+        $fakeMapper->method('findAll')->willReturn([]);
+        $fakeMapper->expects($this->never())->method('update');
+
+        $this->container->method('get')->willReturn($fakeMapper);
+
+        $this->step->run($this->createMock(IOutput::class));
+    }
+}//end class
+
+/**
+ * Fake OR SchemaMapper — a plain class we can mock without importing
+ * the actual OpenRegister type into the test file (keeps OC tests
+ * dependency-light and PHPUnit-friendly).
+ */
+abstract class FakeSchemaMapper
+{
+    abstract public function findAll(array $filters = []): array;
+    abstract public function update(object $schema): object;
+}
+
+/**
+ * Fake OR Schema — same reasoning as FakeSchemaMapper.
+ */
+abstract class FakeSchema
+{
+    abstract public function getId(): int;
+    abstract public function getAuthorization(): ?array;
+    abstract public function setAuthorization(?array $authorization): void;
+}
diff --git a/tests/Unit/Service/PublicationQueryServiceTest.php b/tests/Unit/Service/PublicationQueryServiceTest.php
index d33ecbcf8..46830d100 100644
--- a/tests/Unit/Service/PublicationQueryServiceTest.php
+++ b/tests/Unit/Service/PublicationQueryServiceTest.php
@@ -3,26 +3,24 @@
 /**
  * Unit tests for PublicationQueryService.
  *
- * Covers: findObjectLocation (the constrained object-location query), isObjectPublic
- * (the public-relation-endpoint visibility guard), and the `_content` opt-in content-
- * search flag (WOO-517, SCH-PFTS-CONTENT-001/-002/-003). Bulk visibility filtering
- * lives in OpenRegister RBAC; isObjectPublic mirrors the same RBAC rule
- * (`publicationDate <= now`, APB-006) for the per-object guard on the public uses/used
- * relation endpoints. The removed object-level @self.published predicate is not consulted.
+ * Covers the WOO-536 Fase-5 refactor of `assemblePublicSearchResults`
+ * (catalog-derived scope, `_rbacAsPublic` uniform visibility, dynamic
+ * schema discriminator, N4a document-transitive visibility), the M2
+ * fast-path added 2026-08-31 that resolves document→publication via
+ * the document's OWN `_relations` (bug 1 fix), the pure helpers
+ * (`isCatalogPubliclyAvailable`, `normalizeIds`, `stripEmptyValues`),
+ * and `findObjectLocation` (the constrained object-location query).
  *
- * @category Test
- * @package  Unit\Service
+ * The service is thin over OpenRegister — most branches boil down to
+ * "did the right query reach the right OR method with `_rbacAsPublic:
+ * true`?". These tests mock the container and the OR ObjectService
+ * surface via a stub; the SQL/RBAC pathway is out of scope. The
+ * integration smoke script covers the wire-level behaviour end-to-end.
  *
- * @author    Conduction Development Team <info@conduction.nl>
- * @copyright 2024 Conduction B.V.
- * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @spec openspec/specs/search/spec.md
  *
  * SPDX-License-Identifier: EUPL-1.2
- * SPDX-FileCopyrightText: 2024 Conduction B.V. <info@conduction.nl>
- *
- * @version GIT: <git_id>
- *
- * @link https://www.OpenCatalogi.nl
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
  */
 
 declare(strict_types=1);
@@ -33,1087 +31,750 @@
 use OCA\OpenRegister\Db\ObjectEntity;
 use OCA\OpenRegister\Service\ObjectService;
 use OCP\IAppConfig;
-use OCP\IUser;
-use OCP\IUserSession;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 use Psr\Container\ContainerInterface;
 use Psr\Log\LoggerInterface;
+use ReflectionClass;
 
 /**
- * Fake OpenRegister ObjectService double for assemblePublicSearchResults() tests.
- *
- * Captures the query passed to searchObjectsPaginated() so scope-enforcement can be
- * asserted, and lets searchObjects() (used for the document → publication slug lookup)
- * return a canned row keyed by the requested slug.
+ * Fake OpenRegister ObjectService double for `assemblePublicSearchResults`
+ * tests. Captures the query passed to `searchObjectsPaginated` and the
+ * `_rbacAsPublic` flag so scope-enforcement can be asserted. Serves multiple
+ * queued response sets to cover per-request candidate + document-refinement
+ * calls.
  */
 class FakeSearchObjectService {
 
-	/**
-	 * Captured query passed to searchObjectsPaginated().
-	 *
-	 * @var array<string, mixed>|null
-	 */
-	public ?array $capturedQuery = null;
+	/** @var array<int, array<string, mixed>> Captured (query, flags) per invocation. */
+	public array $capturedCalls = [];
 
-	/**
-	 * Rows returned by searchObjectsPaginated().
-	 *
-	 * @var array<int, array<string, mixed>>
-	 */
-	public array $candidateRows = [];
+	/** @var array<int, array{results: array, total: int, facets: array, facetable: array}> Queued response payloads. */
+	public array $queuedResponses = [];
 
-	/**
-	 * Results of searchObjects(), keyed by slug.
-	 *
-	 * @var array<string, array<int, array<string, mixed>>>
-	 */
-	public array $bySlug = [];
+	/** @var int Cursor into $queuedResponses. */
+	private int $callCursor = 0;
 
-	/**
-	 * Mirrors OR's ObjectService::buildSearchQuery() closely enough for these tests:
-	 * passes request params through unchanged so scope-override tests can prove
-	 * assemblePublicSearchResults() strips/overwrites the scope-widening keys.
-	 *
-	 * @param array $requestParams Raw request params.
-	 *
-	 * @return array
-	 */
 	public function buildSearchQuery(array $requestParams): array {
+		// Passes request params through unchanged so scope-override tests can
+		// prove `assemblePublicSearchResults` strips scope-widening keys.
 		return $requestParams;
-	}//end buildSearchQuery()
+	}
+
+	public function searchObjectsPaginated(
+		array $query,
+		bool $_rbac = true,
+		bool $_multitenancy = true,
+		bool $_rbacAsPublic = false,
+	): array {
+		$this->capturedCalls[] = [
+			'query'         => $query,
+			'_rbac'         => $_rbac,
+			'_multitenancy' => $_multitenancy,
+			'_rbacAsPublic' => $_rbacAsPublic,
+		];
 
-	/**
-	 * Records the query and returns the canned candidate rows.
-	 *
-	 * @param array $query The search query.
-	 * @param boolean $_rbac Unused (test double).
-	 * @param boolean $_multitenancy Unused (test double).
-	 *
-	 * @return array{results: array<int, array<string, mixed>>}
-	 */
-	public function searchObjectsPaginated(array $query, bool $_rbac = true, bool $_multitenancy = true): array {
-		$this->capturedQuery = $query;
-		return ['results' => $this->candidateRows];
-	}//end searchObjectsPaginated()
+		$response = $this->queuedResponses[$this->callCursor] ?? ['results' => [], 'total' => 0, 'facets' => [], 'facetable' => []];
+		$this->callCursor++;
+		return $response;
+	}
 
 	/**
-	 * Returns the canned rows for the requested slug.
-	 *
-	 * Mirrors the real query shape `resolveDocumentPublicationSummary()` sends —
-	 * `@self.slug`, not a bare `slug` key (a bare key would become a schema-property
-	 * filter against `publication`, which has no `slug` property; see the comment on
-	 * that method).
+	 * Emulate the `find()` shape used by the UUID fast-path. Configure a
+	 * fixed mapping id => row-array before use.
 	 *
-	 * @param array $query The search query (only `@self.slug` is consulted).
-	 * @param boolean $_rbac Unused (test double).
-	 * @param boolean $_multitenancy Unused (test double).
-	 *
-	 * @return array<int, array<string, mixed>>
+	 * @var array<string, array<string, mixed>>
 	 */
-	public function searchObjects(array $query, bool $_rbac = true, bool $_multitenancy = true): array {
-		$slug = ($query['@self']['slug'] ?? null);
-		return ($this->bySlug[$slug] ?? []);
-	}//end searchObjects()
-}//end class
+	public array $findResponses = [];
+
+	public function find(
+		string $id,
+		array $_extend = [],
+		bool $files = false,
+		?int $register = null,
+		?int $schema = null,
+		bool $_rbac = true,
+		bool $_multitenancy = true,
+		bool $_rbacAsPublic = false,
+	): ?array {
+		return $this->findResponses[$id] ?? null;
+	}
+}
 
 /**
- * Unit tests for PublicationQueryService.
- *
- * Focuses on the constrained findObjectLocation lookup (#734), which now routes
- * through OpenRegister's ObjectService (ADR-022) instead of raw SQL against OR's
- * internal magic-mapper tables. Object visibility is enforced by OpenRegister RBAC,
- * not by an app-side published predicate.
+ * Fake OC CatalogiService double so `resolveCatalogScope` can enumerate
+ * a canned catalog set without touching the DB.
  */
-class PublicationQueryServiceTest extends TestCase {
+class FakeCatalogiService {
 
-	/**
-	 * DI container mock.
-	 *
-	 * @var ContainerInterface|MockObject
-	 */
-	private ContainerInterface|MockObject $container;
+	/** @var array<string, array<string, mixed>> Catalogs to return, keyed by slug. */
+	public array $catalogsBySlug = [];
 
-	/**
-	 * OpenRegister ObjectService mock resolved from the container.
-	 *
-	 * @var ObjectService|MockObject
-	 */
-	private ObjectService|MockObject $objectService;
+	public function getCatalogBySlug(string $slug): ?array {
+		return ($this->catalogsBySlug[$slug] ?? null);
+	}
 
-	/**
-	 * App config mock.
-	 *
-	 * @var IAppConfig|MockObject
-	 */
-	private IAppConfig|MockObject $config;
+	public function getObjectService(): FakeCatalogObjectService {
+		$svc = new FakeCatalogObjectService();
+		$svc->catalogs = array_values($this->catalogsBySlug);
+		return $svc;
+	}
+}
 
-	/**
-	 * In-memory app-config store consulted by the config mock's getValueString().
-	 *
-	 * @var array<string, string>
-	 */
-	private array $configStore = [];
+class FakeCatalogObjectService {
 
-	/**
-	 * Logger captured for assertions on the fail-closed observability signal.
-	 *
-	 * @var LoggerInterface&MockObject
-	 */
-	private LoggerInterface $logger;
+	/** @var array<int, array<string, mixed>> */
+	public array $catalogs = [];
 
-	/**
-	 * Service under test.
-	 *
-	 * @var PublicationQueryService
-	 */
+	public function searchObjects(array $query, bool $_rbac = true, bool $_multitenancy = true): array {
+		return $this->catalogs;
+	}
+
+	public function findAll(array $config = [], bool $_rbac = true, bool $_multitenancy = true): array {
+		return $this->catalogs;
+	}
+}
+
+/**
+ * Fake OR SchemaMapper double so the dynamic-schema-discriminator step
+ * (Fase-5 Stap 3) can resolve slug from id.
+ */
+class FakeSchemaMapper {
+
+	/** @var array<int, string> id => slug map. */
+	public array $slugById = [];
+
+	public function find(int|string $id): object {
+		$slug = ($this->slugById[(int) $id] ?? "schema-{$id}");
+		return new class ((int) $id, $slug) {
+			public function __construct(private int $id, private string $slug) {}
+			public function getId(): int { return $this->id; }
+			public function getSlug(): string { return $this->slug; }
+			public function getTitle(): string { return ucfirst($this->slug); }
+		};
+	}
+}
+
+/**
+ * Unit tests for the WOO-536 Fase-5 refactor.
+ */
+class PublicationQueryServiceTest extends TestCase {
+
+	private ContainerInterface|MockObject $container;
+	private ObjectService|MockObject $objectService;
+	private IAppConfig|MockObject $config;
+	private LoggerInterface|MockObject $logger;
 	private PublicationQueryService $service;
 
-	/**
-	 * Set up test fixtures.
-	 *
-	 * @return void
-	 */
 	protected function setUp(): void {
 		$this->container = $this->createMock(ContainerInterface::class);
 		$this->objectService = $this->createMock(ObjectService::class);
 		$this->config = $this->createMock(IAppConfig::class);
 		$this->logger = $this->createMock(LoggerInterface::class);
 
-		$this->configStore = [];
-		$this->config->method('getValueString')
-			->willReturnCallback(
-				fn (string $app, string $key, string $default = '') => ($this->configStore[$key] ?? $default)
-			);
-
 		$this->service = new PublicationQueryService(
 			container: $this->container,
 			config: $this->config,
-			logger: $this->logger
-		);
-
-	}//end setUp()
-
-	/**
-	 * Build a service instance with an authenticated (non-anonymous) user session.
-	 *
-	 * @return PublicationQueryService
-	 */
-	private function makeAuthenticatedService(): PublicationQueryService {
-		$userSession = $this->createMock(IUserSession::class);
-		$userSession->method('getUser')->willReturn($this->createMock(IUser::class));
-
-		return new PublicationQueryService(
-			container: $this->container,
-			userSession: $userSession,
-			config: $this->config,
-			logger: $this->logger
+			logger: $this->logger,
 		);
-
-	}//end makeAuthenticatedService()
+	}
 
 	// -------------------------------------------------------------------------
-	// assemblePublicSearchResults() tests (SCH-PFTS-002/003/004/007)
+	// Pure helpers — no container, no OR.
 	// -------------------------------------------------------------------------
 
-	/**
-	 * Unconfigured register/schema ids fail closed to an empty envelope rather than
-	 * falling back to an unscoped, platform-wide search.
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsFailsClosedWhenUnconfigured(): void {
-		$fake = new FakeSearchObjectService();
+	public function testStripEmptyValuesDropsEmptyStringsNullsEmptyArrays(): void {
+		$in = ['a' => 'x', 'b' => '', 'c' => null, 'd' => [], 'e' => 0];
+		$this->assertSame(['a' => 'x', 'e' => 0], $this->service->stripEmptyValues($in));
+	}
+
+	public function testStripEmptyValuesRecursesIntoNestedArrays(): void {
+		$in = ['outer' => ['keep' => 'x', 'drop' => '']];
+		$this->assertSame(['outer' => ['keep' => 'x']], $this->service->stripEmptyValues($in));
+	}
+
+	public function testNormalizeIdsAcceptsJsonStringAndArrayAndCastsToInt(): void {
+		$this->assertSame([1, 2], $this->invokePrivate('normalizeIds', ['[1,2]']));
+		$this->assertSame([1, 2], $this->invokePrivate('normalizeIds', ['["1","2"]']));
+		$this->assertSame([1, 2], $this->invokePrivate('normalizeIds', [[1, '2']]));
+		$this->assertSame([], $this->invokePrivate('normalizeIds', [null]));
+		$this->assertSame([], $this->invokePrivate('normalizeIds', ['not-json']));
+	}
+
+	public function testIsCatalogPubliclyAvailableAcceptsPublishedInPast(): void {
+		$this->assertTrue($this->invokePrivate('isCatalogPubliclyAvailable', [['published' => '2020-01-01T00:00:00+00:00']]));
+	}
+
+	public function testIsCatalogPubliclyAvailableRejectsFuturePublished(): void {
+		$future = (new \DateTimeImmutable('+1 year'))->format('c');
+		$this->assertFalse($this->invokePrivate('isCatalogPubliclyAvailable', [['published' => $future]]));
+	}
+
+	public function testIsCatalogPubliclyAvailableRejectsMissingPublished(): void {
+		$this->assertFalse($this->invokePrivate('isCatalogPubliclyAvailable', [[]]));
+		$this->assertFalse($this->invokePrivate('isCatalogPubliclyAvailable', [['published' => null]]));
+		$this->assertFalse($this->invokePrivate('isCatalogPubliclyAvailable', [['published' => '']]));
+	}
+
+	public function testIsCatalogPubliclyAvailableRejectsMalformedDate(): void {
+		$this->assertFalse($this->invokePrivate('isCatalogPubliclyAvailable', [['published' => 'not-a-date']]));
+	}
 
-		$result = $this->service->assemblePublicSearchResults([], $fake);
+	// -------------------------------------------------------------------------
+	// assemblePublicSearchResults — fail-closed empty scope path.
+	// -------------------------------------------------------------------------
 
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
-		$this->assertNull($fake->capturedQuery, 'searchObjectsPaginated MUST NOT run without a resolved scope.');
+	public function testAssembleReturnsEmptyEnvelopeWhenScopeResolvesToNoSchemas(): void {
+		// Container has no CatalogiService — resolveCatalogScope returns empty schemas.
+		$this->container->method('get')->willThrowException(new \RuntimeException('no CatalogiService'));
 
-	}//end testAssemblePublicSearchResultsFailsClosedWhenUnconfigured()
+		// Warning fires from either the CatalogiService-unavailable branch or the
+		// outer fail-closed "empty envelope" branch. Both are acceptable observability
+		// signals for the same downstream fact (scope resolves to nothing).
+		$this->logger->expects($this->atLeastOnce())->method('warning');
 
-	/**
-	 * Security: caller-supplied `_register`/`_schemas`/`catalogSlug` MUST NOT widen the
-	 * search beyond the configured publication/document schemas.
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsFixesScopeRegardlessOfCallerParams(): void {
-		$this->configureRegisterAndSchemas();
 		$fake = new FakeSearchObjectService();
+		$result = $this->service->assemblePublicSearchResults(['_search' => 'anything'], $fake);
 
-		$this->service->assemblePublicSearchResults(
-			queryParams: [
-				'_register' => 999,
-				'_schemas' => [999],
-				'_schema' => 999,
-				'catalogSlug' => 'unrelated-catalog',
-				'fq' => 'unrelated-filter',
-			],
-			objectService: $fake
-		);
-
-		$this->assertSame(expected: 10, actual: $fake->capturedQuery['_register']);
-		$this->assertSame(expected: [1, 2], actual: $fake->capturedQuery['_schemas']);
-		$this->assertArrayNotHasKey('_schema', $fake->capturedQuery);
-		$this->assertArrayNotHasKey('catalogSlug', $fake->capturedQuery);
-		$this->assertArrayNotHasKey('fq', $fake->capturedQuery);
+		$this->assertSame(['results' => [], 'total' => 0], $result);
+		$this->assertEmpty($fake->capturedCalls, 'searchObjectsPaginated MUST NOT run without a resolved scope.');
+	}
 
-	}//end testAssemblePublicSearchResultsFixesScopeRegardlessOfCallerParams()
+	// -------------------------------------------------------------------------
+	// assemblePublicSearchResults — happy path with mocked OR + catalog.
+	// -------------------------------------------------------------------------
 
 	/**
-	 * Mixed publication/document rows are discriminated by `@self.schema`, and every
-	 * document row carries the embedded `{id, slug, title}` publication summary
-	 * (SCH-PFTS-002/003).
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsDiscriminatesAndEmbedsPublicationSummary(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 1, 'slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
-			[
-				'@self' => ['schema' => 2, 'slug' => 'doc-a'],
-				'title' => 'Doc A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Stale denormalised title'],
-			],
-		];
-		$fake->bySlug['pub-a'] = [
-			[
-				'id' => 'uuid-pub-a',
-				'@self' => ['slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
-		];
-
-		$result = $this->service->assemblePublicSearchResults([], $fake);
-
-		$this->assertSame(2, $result['total']);
-		$this->assertSame('publication', $result['results'][0]['@self']['schema']);
-		$this->assertSame('document', $result['results'][1]['@self']['schema']);
-		$this->assertSame(
-			expected: ['id' => 'uuid-pub-a', 'slug' => 'pub-a', 'title' => 'Pub A'],
-			actual: $result['results'][1]['publication']
-		);
+	 * SCH-PFTS-001 / SCH-PFTS-004: the endpoint MUST forward `_rbac: true`
+	 * AND `_rbacAsPublic: true` to OR, so RBAC evaluates the public group
+	 * only — admin bypass suppressed, `_owner` OR-in suppressed. Q1 Option B.
+	 */
+	public function testAssembleForwardsRbacAsPublicTrueToObjectService(): void {
+		$fake = $this->wireHappyPath();
+		$this->service->assemblePublicSearchResults($this->withDefaultCatalog(['_search' => 'x']), $fake);
+
+		$this->assertNotEmpty($fake->capturedCalls, 'searchObjectsPaginated was not called');
+		$first = $fake->capturedCalls[0];
+		$this->assertTrue($first['_rbac'], '_rbac must be true');
+		$this->assertTrue($first['_rbacAsPublic'], '_rbacAsPublic must be true (Q1 Option B)');
+		$this->assertFalse($first['_multitenancy'], 'multitenancy must be false on public endpoint');
+	}
+
+	/**
+	 * Q7 Interpretation A: client-supplied `_schema` / `_registers` / `fq` /
+	 * `catalogSlug` / `_content` / OC-level `_catalog` / `_catalogi` MUST be
+	 * stripped before the query reaches OR — a caller cannot widen scope
+	 * past the resolved catalog boundary.
+	 */
+	public function testAssembleStripsClientScopeWideningParams(): void {
+		$fake = $this->wireHappyPath();
+
+		// Note: _catalog=default-catalog (present in fixture) is the OC-level scope
+		// resolver; every other listed key MUST be stripped before reaching OR.
+		$this->service->assemblePublicSearchResults([
+			'_search'     => 'x',
+			'_schema'     => 999,
+			'_registers'  => [999],
+			'catalogSlug' => 'evil',
+			'fq'          => 'evil',
+			'_content'    => 'true',
+			'_catalog'    => 'default-catalog',
+			'_catalogi'   => ['a', 'b'],
+		], $fake);
+
+		$captured = $fake->capturedCalls[0]['query'];
+		$this->assertArrayNotHasKey('_schema', $captured);
+		$this->assertArrayNotHasKey('_registers', $captured);
+		$this->assertArrayNotHasKey('catalogSlug', $captured);
+		$this->assertArrayNotHasKey('fq', $captured);
+		$this->assertArrayNotHasKey('_content', $captured);
+		$this->assertArrayNotHasKey('_catalog', $captured);
+		$this->assertArrayNotHasKey('_catalogi', $captured);
+		// Scope-derived _schemas MUST be present, sourced from the catalog fixture.
+		$this->assertArrayHasKey('_schemas', $captured);
+		$this->assertContains(1, $captured['_schemas']);
+	}
+
+	/**
+	 * SCH-PFTS-CAT-002: default-scope catalog fixture in wireHappyPath declares
+	 * schemas [1,2] on register 1. Those MUST propagate to the OR query.
+	 */
+	public function testAssembleAppliesResolvedScopeAsSchemas(): void {
+		$fake = $this->wireHappyPath();
+		$this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
+
+		$captured = $fake->capturedCalls[0]['query'];
+		$this->assertSame([1, 2], $captured['_schemas']);
+		$this->assertSame(1, $captured['_register'], 'single-register scope should use _register fast-path');
+		$this->assertFalse($captured['_includeDeleted'], 'deleted rows must be excluded on public endpoint');
+	}
 
-	}//end testAssemblePublicSearchResultsDiscriminatesAndEmbedsPublicationSummary()
-
-	/**
-	 * Anonymous callers never see a candidate row whose own visibility fails
-	 * `isObjectPublic()`, even though the filter runs AFTER scoring/merge (SCH-PFTS-004).
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsFiltersUnpublishedForAnonymous(): void {
-		$this->configureRegisterAndSchemas();
-		$future = (new \DateTime('+10 days'))->format(\DateTimeInterface::ATOM);
+	// -------------------------------------------------------------------------
+	// Envelope-shape (N2 / SCH-PFTS-002).
+	// -------------------------------------------------------------------------
 
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 1, 'slug' => 'pub-live'],
-				'title' => 'Live publication',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
-			[
-				'@self' => ['schema' => 1, 'slug' => 'pub-embargoed'],
-				'title' => 'Embargoed publication',
-				'publicationDate' => $future,
-			],
+	public function testEnvelopeCarriesFacetsWhenOrProvidesThem(): void {
+		$fake = $this->wireHappyPath();
+		$fake->queuedResponses = [
+			['results' => [], 'total' => 0, 'facets' => ['theme' => []], 'facetable' => ['title']],
 		];
 
-		$result = $this->service->assemblePublicSearchResults([], $fake);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-		$this->assertSame(1, $result['total']);
-		$this->assertSame('pub-live', $result['results'][0]['@self']['slug']);
+		$this->assertArrayHasKey('results', $out);
+		$this->assertArrayHasKey('total', $out);
+		$this->assertArrayHasKey('facets', $out, 'facets pass-through when OR returned them');
+		$this->assertArrayHasKey('facetable', $out, 'facetable pass-through when OR returned it');
+	}
 
-	}//end testAssemblePublicSearchResultsFiltersUnpublishedForAnonymous()
+	// -------------------------------------------------------------------------
+	// Envelope `total` — pagination signal + `total ≥ count(results)` invariant.
+	// -------------------------------------------------------------------------
 
 	/**
-	 * A document whose OWN publicationDate is public but whose linked publication is
-	 * depublished MUST NOT surface for anonymous callers (transitive visibility,
-	 * SCH-PFTS-004).
-	 *
-	 * @return void
+	 * Pagination signal: when OR's global `total` exceeds the current page's
+	 * `_limit` and NOTHING is dropped in the row loop, the envelope MUST ship
+	 * OR's global total so consumers can compute `has_more`.
 	 */
-	public function testAssemblePublicSearchResultsEnforcesTransitiveVisibilityOnDocuments(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'slug' => 'doc-orphaned-by-depublish'],
-				'title' => 'Document of a depublished report',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-depublished', 'title' => 'Depublished report'],
-			],
+	public function testEnvelopeTotalPreservesGlobalCountWhenNothingDropped(): void {
+		$publicationRow = [
+			'@self' => ['id' => 'pub-1', 'slug' => 'p1', 'schema' => 1],
+			'title' => 'Page 1 publication',
 		];
-		$fake->bySlug['pub-depublished'] = [
-			[
-				'id' => 'uuid-pub-depublished',
-				'@self' => ['slug' => 'pub-depublished'],
-				'title' => 'Depublished report',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'depublicationDate' => '2024-06-01T00:00:00+00:00',
-			],
+		$fake = $this->wireHappyPath();
+		// OR reports total: 42 across all pages; this page has 1 row and nothing drops.
+		$fake->queuedResponses = [
+			['results' => [$publicationRow], 'total' => 42, 'facets' => [], 'facetable' => []],
 		];
 
-		$result = $this->service->assemblePublicSearchResults([], $fake);
-
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsEnforcesTransitiveVisibilityOnDocuments()
+		$this->assertCount(1, $out['results'], 'row loop keeps the visible pub');
+		$this->assertSame(42, $out['total'], 'total must reflect OR global count so pagination has_more works');
+	}
 
 	/**
-	 * A document with no linked publication MUST NOT appear in the result set
-	 * (SCH-PFTS-003).
-	 *
-	 * @return void
+	 * `total ≥ count(results)` invariant: when the row loop drops rows on this
+	 * page (e.g. N4a transitive-visibility on a document whose linked pub isn't
+	 * public), `total` is reduced by the drops but MUST NOT dip below the
+	 * shipped `results` count. Guarantees `total: X, results: []` never happens.
 	 */
-	public function testAssemblePublicSearchResultsDropsDocumentWithoutLinkedPublication(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'slug' => 'doc-orphan'],
-				'title' => 'Orphan document',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
+	public function testEnvelopeTotalSubtractsPerPageDropsButFloorsAtResultsLength(): void {
+		$documentRow = [
+			'@self' => ['id' => 'doc-orphan-page1', 'schema' => 2, 'relations' => ['organization' => 'x']],
+			'title' => 'Orphan doc on page 1',
 		];
-
-		$result = $this->service->assemblePublicSearchResults([], $fake);
-
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
-
-	}//end testAssemblePublicSearchResultsDropsDocumentWithoutLinkedPublication()
-
-	/**
-	 * A candidate row whose schema id does not match the configured publication/document
-	 * schema ids is dropped (defensive — should not occur given the fixed `_schemas`
-	 * scope, but the assembly must not surface an unrecognised row type).
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsSkipsRowsWithUnknownSchemaId(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 999, 'slug' => 'unexpected'],
-				'title' => 'Unexpected schema',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
+		$fake = $this->wireHappyPath();
+		// OR reports total: 5 globally; this page returns 1 candidate that N4a-drops.
+		$fake->queuedResponses = [
+			['results' => [$documentRow], 'total' => 5, 'facets' => [], 'facetable' => []],
+			// _relations_contains refinement → 0 pubs → drops the doc.
+			['results' => [], 'total' => 0, 'facets' => [], 'facetable' => []],
 		];
 
-		$result = $this->service->assemblePublicSearchResults([], $fake);
-
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsSkipsRowsWithUnknownSchemaId()
+		$this->assertCount(0, $out['results'], 'orphan doc dropped');
+		// 5 (or_total) - 1 (drop) = 4 → floored to max(0, 4) = 4. Pagination signal preserved.
+		$this->assertSame(4, $out['total'], 'total = or_total - drops (floored at count(results))');
+	}
 
 	/**
-	 * SCH-PFTS-004 requires the visibility filter to run unconditionally. A prior
-	 * `$isAnonymous === true &&` guard let any authenticated NC user enumerate the
-	 * whole register through a public URL (broken authorisation / OWASP A01:2021).
-	 * This test locks in the correct behaviour: an authenticated non-admin caller
-	 * MUST NOT see draft/embargoed content via the public search endpoint. Admins
-	 * who need drafts use the admin `/publications` endpoint instead.
-	 *
-	 * @return void
+	 * When `or_total == drops_on_this_page`, `total` MUST reach 0 (not
+	 * remain at OR's pre-drop count). Guards against the SCH-PFTS-004
+	 * `total: 1, results: []` bug pattern.
 	 */
-	public function testAssemblePublicSearchResultsFiltersUnpublishedForAuthenticatedNonAdmin(): void {
-		$this->configureRegisterAndSchemas();
-		$future = (new \DateTime('+10 days'))->format(\DateTimeInterface::ATOM);
-
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 1, 'slug' => 'pub-live'],
-				'title' => 'Live publication',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
-			[
-				'@self' => ['schema' => 1, 'slug' => 'pub-embargoed'],
-				'title' => 'Embargoed publication',
-				'publicationDate' => $future,
-			],
+	public function testEnvelopeTotalGoesToZeroWhenAllOrCandidatesDrop(): void {
+		$documentRow = [
+			'@self' => ['id' => 'doc-only-invisible', 'schema' => 2, 'relations' => ['organization' => 'x']],
+			'title' => 'Only doc is invisible',
+		];
+		$fake = $this->wireHappyPath();
+		$fake->queuedResponses = [
+			['results' => [$documentRow], 'total' => 1, 'facets' => [], 'facetable' => []],
+			['results' => [], 'total' => 0, 'facets' => [], 'facetable' => []],
 		];
 
-		$service = $this->makeAuthenticatedService();
-		$result = $service->assemblePublicSearchResults([], $fake);
-
-		// Authenticated non-admin gets EXACTLY the same filter treatment as anonymous —
-		// the public endpoint is one visibility surface, not two.
-		$this->assertSame(1, $result['total']);
-		$this->assertSame('pub-live', $result['results'][0]['@self']['slug']);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsFiltersUnpublishedForAuthenticatedNonAdmin()
+		$this->assertSame(['results' => [], 'total' => 0], ['results' => $out['results'], 'total' => $out['total']]);
+	}
 
 	/**
-	 * Transitive visibility gate also applies unconditionally. A document whose
-	 * linked publication is depublished MUST NOT surface for ANY caller through
-	 * the public endpoint (SCH-PFTS-004 scenario 3, post-fix wording).
-	 *
-	 * @return void
+	 * Dedup drops (same `@self.id` twice — metadata + chunk hit) MUST NOT
+	 * count against `total`. OR reports these as separate candidates but
+	 * the dedup collapses one logical hit; treating dedup as a drop would
+	 * silently shrink pagination totals on `_content=true` pages.
 	 */
-	public function testAssemblePublicSearchResultsEnforcesTransitiveVisibilityForAuthenticatedNonAdmin(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'slug' => 'doc-orphaned-by-depublish'],
-				'title' => 'Document of a depublished report',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-depublished', 'title' => 'Depublished report'],
-			],
+	public function testEnvelopeTotalIgnoresDedupDrops(): void {
+		$publicationRow = [
+			'@self' => ['id' => 'pub-dup', 'slug' => 'dup', 'schema' => 1],
+			'title' => 'Duplicate publication row',
 		];
-		$fake->bySlug['pub-depublished'] = [
-			[
-				'id' => 'uuid-pub-depublished',
-				'@self' => ['slug' => 'pub-depublished'],
-				'title' => 'Depublished report',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'depublicationDate' => '2024-06-01T00:00:00+00:00',
-			],
+		$fake = $this->wireHappyPath();
+		// OR returned same pub twice (metadata + content match); dedup collapses.
+		$fake->queuedResponses = [
+			['results' => [$publicationRow, $publicationRow], 'total' => 10, 'facets' => [], 'facetable' => []],
 		];
 
-		$service = $this->makeAuthenticatedService();
-		$result = $service->assemblePublicSearchResults([], $fake);
-
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsEnforcesTransitiveVisibilityForAuthenticatedNonAdmin()
-
-	/**
-	 * The fail-closed empty-envelope branch (register/schema config not resolved)
-	 * MUST emit a warning-level log entry, so the misconfiguration is observable in
-	 * production. Silent empty responses are indistinguishable from "no matches"
-	 * in the envelope — operators need a signal that the deploy is broken.
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsLogsWarningWhenConfigMissing(): void {
-		// ConfigStore intentionally empty — resolveConfiguredId() returns null for every key.
-		$this->logger->expects($this->once())
-			->method('warning')
-			->with(
-				$this->stringContains('assemblePublicSearchResults returning empty envelope'),
-				$this->callback(
-					fn (array $ctx): bool => (($ctx['publication_register'] ?? '') === 'MISSING')
-						&& (($ctx['publication_schema'] ?? '') === 'MISSING')
-						&& (($ctx['document_schema'] ?? '') === 'MISSING')
-				)
-			);
-
-		$fake = new FakeSearchObjectService();
-		$result = $this->service->assemblePublicSearchResults([], $fake);
-
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
-
-	}//end testAssemblePublicSearchResultsLogsWarningWhenConfigMissing()
+		$this->assertCount(1, $out['results'], 'dedup collapses to one row');
+		$this->assertSame(10, $out['total'], 'dedup drop must NOT be subtracted from total');
+	}
 
 	// -------------------------------------------------------------------------
-	// `_content` opt-in content-search tests (WOO-517, SCH-PFTS-CONTENT-001/-002/-003)
+	// M2 fast-path (bug 1 fix, 2026-08-31).
+	// SCH-PFTS-004 transitive visibility with the legacy document seed shape.
 	// -------------------------------------------------------------------------
 
 	/**
-	 * Default (`_content` absent) MUST be byte-identical to the WOO-506 baseline —
-	 * no `_content_search` key is forwarded to OR (SCH-PFTS-CONTENT-001).
-	 *
-	 * @return void
+	 * Document rows may store the linked publication as
+	 * `_relations['publication.slug']` (denormalised WOO-506/517 seed shape).
+	 * The M2 fast-path MUST resolve the linked publication by slug and keep
+	 * the document row in the envelope with an embedded `publication` summary.
+	 * Regression guard for the bug 1 undercount (total != results len).
 	 */
-	public function testAssemblePublicSearchResultsOmitsContentSearchFlagByDefault(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-
-		$this->service->assemblePublicSearchResults([], $fake);
-
-		$this->assertArrayNotHasKey('_content_search', $fake->capturedQuery);
-
-	}//end testAssemblePublicSearchResultsOmitsContentSearchFlagByDefault()
-
-	/**
-	 * `_content=false` (explicit) MUST also omit the forwarded OR flag — byte-identical
-	 * to the WOO-506 baseline (SCH-PFTS-CONTENT-001 "default omits content search").
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsOmitsContentSearchFlagWhenExplicitlyFalse(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-
-		$this->service->assemblePublicSearchResults(['_content' => 'false'], $fake);
-
-		$this->assertArrayNotHasKey('_content_search', $fake->capturedQuery);
-
-	}//end testAssemblePublicSearchResultsOmitsContentSearchFlagWhenExplicitlyFalse()
-
-	/**
-	 * `_content=true` MUST forward OR's `_content_search` flag on the delegated query,
-	 * and MUST NOT leak OC's own `_content` key into that query (SCH-PFTS-CONTENT-001).
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsForwardsContentSearchFlagWhenTrue(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-
-		$this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
-
-		$this->assertTrue($fake->capturedQuery['_content_search']);
-		$this->assertArrayNotHasKey('_content', $fake->capturedQuery);
-
-	}//end testAssemblePublicSearchResultsForwardsContentSearchFlagWhenTrue()
-
-	/**
-	 * A document surfaced ONLY via a content-search fan-out (i.e. present in the
-	 * candidate set only when `_content=true`) is present when `_content=true` and
-	 * MUST NOT be considered when the flag is absent — locked in by asserting the
-	 * flag-forwarding test above; this test proves the document row's shape is
-	 * indistinguishable from a metadata-matched row (SCH-PFTS-002/SCH-PFTS-CONTENT-002).
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsContentMatchedDocumentRowShapeMatchesMetadataMatch(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-content-match'],
-				'title' => 'Document only matched via body text',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Stale denormalised title'],
-			],
+	public function testDocumentWithPublicationSlugRelationIsResolvedAndKept(): void {
+		$publicationRow = [
+			'@self' => ['id' => 'pub-uuid-1', 'slug' => 'my-report', 'schema' => 1],
+			'title' => 'My Report',
 		];
-		$fake->bySlug['pub-a'] = [
-			[
-				'id' => 'uuid-pub-a',
-				'@self' => ['slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
+		$documentRow = [
+			'@self' => [
+				'id'        => 'doc-uuid-1',
+				'schema'    => 2,
+				'relations' => ['publication.slug' => 'my-report'],
 			],
+			'title' => 'My Report (PDF)',
 		];
 
-		$result = $this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
-
-		$this->assertSame(1, $result['total']);
-		$this->assertSame('document', $result['results'][0]['@self']['schema']);
-		$this->assertSame(
-			expected: ['id' => 'uuid-pub-a', 'slug' => 'pub-a', 'title' => 'Pub A'],
-			actual: $result['results'][0]['publication']
-		);
-		// No field distinguishes a content-match row from a metadata-match row —
-		// the row shape is identical to testAssemblePublicSearchResultsDiscriminatesAndEmbedsPublicationSummary().
-		$this->assertArrayNotHasKey('_snippet', $result['results'][0]);
-		$this->assertArrayNotHasKey('chunk', $result['results'][0]);
-
-	}//end testAssemblePublicSearchResultsContentMatchedDocumentRowShapeMatchesMetadataMatch()
-
-	/**
-	 * A document matching on BOTH metadata AND content (represented as OR returning
-	 * the same `@self.id` twice in the candidate set — e.g. once from the metadata
-	 * arm, once from the chunk arm) MUST appear exactly once in the response,
-	 * deduplicated on `@self.id` (SCH-PFTS-CONTENT-002, MODIFIED SCH-PFTS-002).
-	 *
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsDedupesDocumentMatchingBothSurfaces(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-both'],
-				'title' => 'Matches on title AND body text',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Stale denormalised title'],
-			],
-			[
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-both'],
-				'title' => 'Matches on title AND body text',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Stale denormalised title'],
-			],
+		$fake = $this->wireHappyPath();
+		// 1st call: initial candidate paginated search returns doc row.
+		// 2nd call: M2 slug-scan on publication schema returns pub row.
+		$fake->queuedResponses = [
+			['results' => [$documentRow], 'total' => 1, 'facets' => [], 'facetable' => []],
+			['results' => [$publicationRow], 'total' => 1, 'facets' => [], 'facetable' => []],
 		];
-		$fake->bySlug['pub-a'] = [
-			[
-				'id' => 'uuid-pub-a',
-				'@self' => ['slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-			],
-		];
-
-		$result = $this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
 
-		$this->assertSame(1, $result['total']);
-		$this->assertSame('uuid-doc-both', $result['results'][0]['@self']['id']);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsDedupesDocumentMatchingBothSurfaces()
+		$this->assertCount(1, $out['results'], 'document must survive N4a because its slug-linked pub is public');
+		$emitted = $out['results'][0];
+		$this->assertSame('doc-uuid-1', $emitted['@self']['id']);
+		$this->assertArrayHasKey('publication', $emitted, 'document row must carry embedded publication summary');
+		$this->assertSame('my-report', $emitted['publication']['slug']);
+		$this->assertSame('My Report', $emitted['publication']['title']);
+	}
 
 	/**
-	 * A content-matched document on a depublished document MUST be dropped from the
-	 * anonymous response — content matches inherit the same `isObjectPublic()` gate
-	 * as metadata matches (SCH-PFTS-CONTENT-003).
-	 *
-	 * @return void
+	 * Documents storing the linked publication as `_relations['publication']`
+	 * (UUID form, canonical/new) MUST resolve via the M1 UUID fast-path
+	 * (`ObjectService::find()`) without spending a slug scan.
 	 */
-	public function testAssemblePublicSearchResultsDropsContentMatchedDepublishedDocument(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-depublished'],
-				'title' => 'Body text matched, but document is depublished',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'depublicationDate' => '2024-06-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Pub A'],
-			],
+	public function testDocumentWithPublicationUuidRelationUsesFastPathAndKeeps(): void {
+		$publicationRow = [
+			'@self' => ['id' => 'pub-uuid-2', 'slug' => 'kb-artikel', 'schema' => 1],
+			'title' => 'Kennisbank artikel',
 		];
-		$fake->bySlug['pub-a'] = [
-			[
-				'id' => 'uuid-pub-a',
-				'@self' => ['slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
+		$documentRow = [
+			'@self' => [
+				'id'        => 'doc-uuid-2',
+				'schema'    => 2,
+				'relations' => ['publication' => 'pub-uuid-2'],
 			],
+			'title' => 'KB artikel (PDF)',
 		];
 
-		$result = $this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
+		$fake = $this->wireHappyPath();
+		$fake->queuedResponses = [
+			['results' => [$documentRow], 'total' => 1, 'facets' => [], 'facetable' => []],
+		];
+		$fake->findResponses['pub-uuid-2'] = $publicationRow;
 
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsDropsContentMatchedDepublishedDocument()
+		$this->assertCount(1, $out['results'], 'document must survive via UUID fast-path');
+		$this->assertSame('kb-artikel', $out['results'][0]['publication']['slug']);
+	}
 
 	/**
-	 * A content-matched document whose linked publication is depublished MUST be
-	 * dropped from the anonymous response — transitive visibility applies to
-	 * content matches exactly as it does to metadata matches (SCH-PFTS-CONTENT-003).
-	 *
-	 * @return void
+	 * N4a: document without any resolvable publication link MUST be
+	 * silent-dropped from the envelope (with an info log for observability).
+	 * Envelope-shape (N2) preserved: no `publication: null` sentinel.
 	 */
-	public function testAssemblePublicSearchResultsDropsContentMatchedDocumentWithDepublishedParent(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-orphaned-by-depublish'],
-				'title' => 'Body text matched, but parent publication is depublished',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-depublished', 'title' => 'Depublished report'],
-			],
+	public function testDocumentWithoutAnyPublicationRelationIsSilentDropped(): void {
+		$documentRow = [
+			'@self' => ['id' => 'doc-orphan', 'schema' => 2, 'relations' => ['organization' => 'x']],
+			'title' => 'Orphan PDF',
 		];
-		$fake->bySlug['pub-depublished'] = [
-			[
-				'id' => 'uuid-pub-depublished',
-				'@self' => ['slug' => 'pub-depublished'],
-				'title' => 'Depublished report',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'depublicationDate' => '2024-06-01T00:00:00+00:00',
-			],
+
+		$fake = $this->wireHappyPath();
+		$fake->queuedResponses = [
+			['results' => [$documentRow], 'total' => 1, 'facets' => [], 'facetable' => []],
 		];
 
-		$result = $this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
+		$this->logger->expects($this->atLeastOnce())
+			->method('info')
+			->with($this->stringContains('no publicly-visible linked publication'), $this->anything());
 
-		$this->assertSame(expected: ['results' => [], 'total' => 0], actual: $result);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsDropsContentMatchedDocumentWithDepublishedParent()
+		$this->assertCount(0, $out['results'], 'orphan document must be silent-dropped (N4a)');
+	}
 
 	/**
-	 * Raw chunk-search fields (`_snippet`, `chunk`, `score` etc.) attached to a
-	 * candidate row by OR MUST be stripped before the row surfaces on the anonymous
-	 * response — SCH-PFTS-CONTENT-002 requires the endpoint return documents, not
-	 * chunks. Defence-in-depth: OR resolves chunk hits to their owning ObjectEntity
-	 * before returning, so these fields should never be present; strip regardless
-	 * so any future regression cannot leak them.
-	 *
-	 * @return void
+	 * RET-006 belt-and-braces on the UUID fast-path: a document pointing at
+	 * a publication with `status: 'archived'` MUST be dropped, even though
+	 * `_rbacAsPublic: true` would have kept the row visible under a
+	 * mis-configured schema RBAC. The linked publication's terminal-hidden
+	 * status is a second gate.
 	 */
-	public function testAssemblePublicSearchResultsStripsRawChunkFieldsFromContentMatchedRow(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-with-chunk-fields'],
-				'title' => 'Doc with rogue chunk fields',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Stale denormalised title'],
-				// OR-side regression / debug leak — these MUST be stripped.
-				'_snippet' => 'lorem ipsum ... marker ...',
-				'snippet' => 'lorem ipsum ... marker ...',
-				'chunk' => ['id' => 42, 'text' => 'body-text snippet'],
-				'chunk_id' => 42,
-				'chunkId' => 42,
-				'score' => 0.87,
-				'_score' => 0.87,
-			],
+	public function testDocumentDroppedWhenUuidFastPathPublicationIsArchived(): void {
+		$archivedPublication = [
+			'@self'  => ['id' => 'pub-archived-1', 'slug' => 'shelved-report', 'schema' => 1],
+			'title'  => 'Archived report',
+			'status' => 'archived',
 		];
-		$fake->bySlug['pub-a'] = [
-			[
-				'id' => 'uuid-pub-a',
-				'@self' => ['slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
+		$documentRow = [
+			'@self' => [
+				'id'        => 'doc-uuid-archived',
+				'schema'    => 2,
+				'relations' => ['publication' => 'pub-archived-1'],
 			],
+			'title' => 'PDF pointing at archived pub',
 		];
 
-		$result = $this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
+		$fake = $this->wireHappyPath();
+		$fake->queuedResponses = [
+			['results' => [$documentRow], 'total' => 1, 'facets' => [], 'facetable' => []],
+			// After the UUID fast-path returns null (archived), the code falls through
+			// to the `_relations_contains` refinement, which finds nothing either.
+			['results' => [], 'total' => 0, 'facets' => [], 'facetable' => []],
+		];
+		$fake->findResponses['pub-archived-1'] = $archivedPublication;
 
-		$this->assertSame(1, $result['total']);
-		$row = $result['results'][0];
-		$this->assertArrayNotHasKey('_snippet', $row);
-		$this->assertArrayNotHasKey('snippet', $row);
-		$this->assertArrayNotHasKey('chunk', $row);
-		$this->assertArrayNotHasKey('chunk_id', $row);
-		$this->assertArrayNotHasKey('chunkId', $row);
-		$this->assertArrayNotHasKey('score', $row);
-		$this->assertArrayNotHasKey('_score', $row);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsStripsRawChunkFieldsFromContentMatchedRow()
+		$this->assertCount(0, $out['results'], 'document with archived linked publication must drop (UUID fast-path RET-006)');
+	}
 
 	/**
-	 * When OR returns two rows with the same `@self.id` but the first row fails
-	 * per-row validation (e.g. carries a stale `publication.slug` whose lookup
-	 * returns null — SCH-PFTS-003 drops the row), the second row that would have
-	 * passed MUST NOT be silently swallowed by the dedup — the seen-set is
-	 * stamped only on emission, not on candidate encounter. Regression test for
-	 * the review finding on `PublicationQueryService::assemblePublicSearchResults()`
-	 * dedup ordering.
-	 *
-	 * @return void
+	 * RET-006 belt-and-braces on the slug fast-path: a document whose
+	 * `_relations['publication.slug']` resolves to an archived publication
+	 * MUST be dropped. Same rule as the UUID fast-path.
 	 */
-	public function testAssemblePublicSearchResultsDedupIsStampedOnEmissionNotOnCandidateEncounter(): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
-		$fake->candidateRows = [
-			[
-				// First candidate: same id, stale slug — resolveDocumentPublicationSummary()
-				// returns null → row is dropped, MUST NOT claim the seen slot.
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-shared'],
-				'title' => 'Stale denormalised summary path',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-stale-slug-not-in-bySlug', 'title' => 'Ghost'],
-			],
-			[
-				// Second candidate: same id, fresh slug — MUST be emitted.
-				'@self' => ['schema' => 2, 'id' => 'uuid-doc-shared'],
-				'title' => 'Fresh denormalised summary path',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
-				'publication' => ['slug' => 'pub-a', 'title' => 'Fresh'],
-			],
+	public function testDocumentDroppedWhenSlugFastPathPublicationIsArchived(): void {
+		$archivedPublication = [
+			'@self'  => ['id' => 'pub-archived-2', 'slug' => 'shelved-slug', 'schema' => 1],
+			'title'  => 'Archived legacy report',
+			'status' => 'archived',
 		];
-		$fake->bySlug['pub-a'] = [
-			[
-				'id' => 'uuid-pub-a',
-				'@self' => ['slug' => 'pub-a'],
-				'title' => 'Pub A',
-				'publicationDate' => '2024-01-01T00:00:00+00:00',
+		$documentRow = [
+			'@self' => [
+				'id'        => 'doc-slug-archived',
+				'schema'    => 2,
+				'relations' => ['publication.slug' => 'shelved-slug'],
 			],
+			'title' => 'Legacy PDF pointing at archived pub',
 		];
 
-		$result = $this->service->assemblePublicSearchResults(['_content' => 'true'], $fake);
-
-		$this->assertSame(1, $result['total']);
-		$this->assertSame('uuid-doc-shared', $result['results'][0]['@self']['id']);
-		$this->assertSame('Fresh denormalised summary path', $result['results'][0]['title']);
-
-	}//end testAssemblePublicSearchResultsDedupIsStampedOnEmissionNotOnCandidateEncounter()
-
-	/**
-	 * `filter_var(FILTER_VALIDATE_BOOLEAN)` correctly interprets the full range of
-	 * boolean-like inputs on `_content`. This data-provider test locks the contract
-	 * against any future refactor that swaps out `filter_var` for a hand-rolled
-	 * `=== 'true'` check that would mishandle `'yes'` / `'on'` / etc.
-	 *
-	 * @param mixed $input Value assigned to `_content`.
-	 * @param boolean $expectFwd Whether `_content_search` MUST be forwarded to OR.
-	 *
-	 * @dataProvider contentFlagEdgeCasesProvider
-	 * @return void
-	 */
-	public function testAssemblePublicSearchResultsHandlesContentFlagEdgeCases(mixed $input, bool $expectFwd): void {
-		$this->configureRegisterAndSchemas();
-		$fake = new FakeSearchObjectService();
+		$fake = $this->wireHappyPath();
+		$fake->queuedResponses = [
+			['results' => [$documentRow],         'total' => 1, 'facets' => [], 'facetable' => []],
+			['results' => [$archivedPublication], 'total' => 1, 'facets' => [], 'facetable' => []],
+			// Slug fast-path returned null → fall through to `_relations_contains`, which finds nothing.
+			['results' => [], 'total' => 0, 'facets' => [], 'facetable' => []],
+		];
 
-		$this->service->assemblePublicSearchResults(['_content' => $input], $fake);
-
-		if ($expectFwd === true) {
-			$this->assertTrue(
-				$fake->capturedQuery['_content_search'] ?? false,
-				sprintf('_content=%s MUST forward _content_search=true', var_export($input, true))
-			);
-		} else {
-			$this->assertArrayNotHasKey(
-				key: '_content_search',
-				array: $fake->capturedQuery,
-				message: sprintf('_content=%s MUST NOT forward _content_search', var_export($input, true))
-			);
-		}
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end testAssemblePublicSearchResultsHandlesContentFlagEdgeCases()
+		$this->assertCount(0, $out['results'], 'document with archived slug-linked publication must drop (slug fast-path RET-006)');
+	}
 
 	/**
-	 * Boolean edge cases exercised by
-	 * {@see testAssemblePublicSearchResultsHandlesContentFlagEdgeCases()}.
-	 *
-	 * @return array<string, array{0: mixed, 1: bool}>
+	 * D2 slug cache: N documents in one page pointing at the same
+	 * `_relations['publication.slug']` MUST trigger the slug scan exactly
+	 * once — subsequent hits are memoised. Guards against the O(N × 500)
+	 * regression on legacy-seed hot pages.
 	 */
-	public static function contentFlagEdgeCasesProvider(): array {
-		return [
-			'true string' => ['true', true],
-			'TRUE string' => ['TRUE', true],
-			'yes string' => ['yes', true],
-			'on string' => ['on', true],
-			'1 string' => ['1', true],
-			'1 int' => [1, true],
-			'true bool' => [true, true],
-			'false string' => ['false', false],
-			'FALSE string' => ['FALSE', false],
-			'no string' => ['no', false],
-			'off string' => ['off', false],
-			'0 string' => ['0', false],
-			'0 int' => [0, false],
-			'empty string' => ['', false],
-			'malformed string' => ['maybe', false],
-			'other numeric' => ['2', false],
-			'negative numeric' => ['-1', false],
-			'array wrapper' => [['true'], false],
-			'null' => [null, false],
-			'false bool' => [false, false],
+	public function testSlugFastPathIsCachedAcrossDocumentsInOnePage(): void {
+		$sharedPublication = [
+			'@self' => ['id' => 'pub-shared', 'slug' => 'shared-slug', 'schema' => 1],
+			'title' => 'Shared publication',
 		];
+		$documentRows = [];
+		for ($i = 1; $i <= 3; $i++) {
+			$documentRows[] = [
+				'@self' => [
+					'id'        => "doc-shared-{$i}",
+					'schema'    => 2,
+					'relations' => ['publication.slug' => 'shared-slug'],
+				],
+				'title' => "Legacy PDF #{$i}",
+			];
+		}
 
-	}//end contentFlagEdgeCasesProvider()
-
-	/**
-	 * Populate the register/schema app-config keys assemblePublicSearchResults() reads.
-	 *
-	 * @return void
-	 */
-	private function configureRegisterAndSchemas(): void {
-		$this->configStore = [
-			'publication_register' => '10',
-			'publication_schema' => '1',
-			'document_schema' => '2',
+		$fake = $this->wireHappyPath();
+		// Only TWO responses queued: (1) the candidate page with 3 docs,
+		// (2) the ONE slug-scan for 'shared-slug'. If the cache is broken,
+		// the second and third docs would consume queued response slots
+		// that don't exist and fall through to the `_relations_contains`
+		// path with an empty default response — the test would still
+		// pass results-count but capturedCalls would show > 2.
+		$fake->queuedResponses = [
+			['results' => $documentRows,         'total' => 3, 'facets' => [], 'facetable' => []],
+			['results' => [$sharedPublication],  'total' => 1, 'facets' => [], 'facetable' => []],
 		];
 
-	}//end configureRegisterAndSchemas()
-
-	/**
-	 * Wire the container so it resolves the ObjectService mock.
-	 *
-	 * @return void
-	 */
-	private function wireObjectService(): void {
-		$this->container->method('get')->willReturnCallback(
-			function (string $id) {
-				if ($id === 'OCA\OpenRegister\Service\ObjectService') {
-					return $this->objectService;
-				}
-
-				throw new \RuntimeException('unexpected container id: ' . $id);
-			}
-		);
+		$out = $this->service->assemblePublicSearchResults($this->withDefaultCatalog(), $fake);
 
-	}//end wireObjectService()
+		$this->assertCount(3, $out['results'], 'all 3 docs must resolve via one cached slug lookup');
+		// Exactly 2 OR calls: the initial candidate paginate + one slug scan.
+		$this->assertCount(2, $fake->capturedCalls, 'slug scan must run exactly once for 3 docs sharing a slug (D2 cache)');
+	}
 
 	// -------------------------------------------------------------------------
-	// findObjectLocation() tests
+	// findObjectLocation — constrained (register × schema) lookup (#734).
 	// -------------------------------------------------------------------------
 
 	/**
 	 * Security (#734): findObjectLocation MUST return null without touching
 	 * OpenRegister when no constraint is supplied.
-	 *
-	 * @return void
 	 */
 	public function testFindObjectLocationFailsClosedWithoutConstraint(): void {
-		// OpenRegister must NOT be resolved or queried at all.
 		$this->container->expects($this->never())->method('get');
 
 		$this->assertNull($this->service->findObjectLocation('any-uuid'));
-		$this->assertNull(
-			$this->service->findObjectLocation(uuid: 'any-uuid', allowedRegisters: [], allowedSchemas: [])
-		);
-		$this->assertNull(
-			$this->service->findObjectLocation(uuid: 'any-uuid', allowedRegisters: [1], allowedSchemas: [])
-		);
-		$this->assertNull(
-			$this->service->findObjectLocation(uuid: 'any-uuid', allowedRegisters: [], allowedSchemas: [1])
-		);
-
-	}//end testFindObjectLocationFailsClosedWithoutConstraint()
+		$this->assertNull($this->service->findObjectLocation(uuid: 'any-uuid', allowedRegisters: [], allowedSchemas: []));
+		$this->assertNull($this->service->findObjectLocation(uuid: 'any-uuid', allowedRegisters: [1], allowedSchemas: []));
+		$this->assertNull($this->service->findObjectLocation(uuid: 'any-uuid', allowedRegisters: [], allowedSchemas: [1]));
+	}
 
 	/**
 	 * Constrained lookup locates the object via ObjectService::find within the
 	 * allowed (register × schema) pair — no raw SQL against OR storage internals.
 	 *
-	 * @return void
-	 *
 	 * @spec openspec/specs/opencatalogi-adopt-or-abstractions/spec.md
 	 */
 	public function testFindObjectLocationLocatesViaObjectService(): void {
-		$this->wireObjectService();
+		$this->container->method('get')->willReturnCallback(
+			fn(string $id) => $id === 'OCA\OpenRegister\Service\ObjectService' ? $this->objectService : null
+		);
 
 		$entity = $this->createMock(ObjectEntity::class);
-
-		// Object lives only in register 21 / schema 11; every other pair misses.
 		$this->objectService->method('find')->willReturnCallback(
 			function (int|string $id, ?array $_extend, bool $files, $register, $schema) use ($entity) {
-				if ((int)$register === 21 && (int)$schema === 11) {
-					return $entity;
-				}
-
-				return null;
+				return ((int) $register === 21 && (int) $schema === 11) ? $entity : null;
 			}
 		);
 
 		$location = $this->service->findObjectLocation(
 			uuid: 'uuid-found',
 			allowedRegisters: [20, 21],
-			allowedSchemas: [10, 11]
+			allowedSchemas: [10, 11],
 		);
+		$this->assertSame(['register' => 21, 'schema' => 11], $location);
+	}
 
-		$this->assertSame(expected: ['register' => 21, 'schema' => 11], actual: $location);
-
-	}//end testFindObjectLocationLocatesViaObjectService()
-
-	/**
-	 * Returns null when ObjectService finds the UUID in none of the allowed pairs.
-	 *
-	 * @return void
-	 *
-	 * @spec openspec/specs/opencatalogi-adopt-or-abstractions/spec.md
-	 */
 	public function testFindObjectLocationReturnsNullWhenNotFound(): void {
-		$this->wireObjectService();
-
+		$this->container->method('get')->willReturn($this->objectService);
 		$this->objectService->method('find')->willReturn(null);
 
-		$location = $this->service->findObjectLocation(
-			uuid: 'uuid-missing',
-			allowedRegisters: [1],
-			allowedSchemas: [2]
-		);
-
-		$this->assertNull($location);
-
-	}//end testFindObjectLocationReturnsNullWhenNotFound()
+		$this->assertNull($this->service->findObjectLocation(uuid: 'uuid-missing', allowedRegisters: [1], allowedSchemas: [2]));
+	}
 
-	/**
-	 * A DoesNotExistException from one pair is swallowed and the search continues
-	 * to the next pair rather than bubbling up.
-	 *
-	 * @return void
-	 *
-	 * @spec openspec/specs/opencatalogi-adopt-or-abstractions/spec.md
-	 */
 	public function testFindObjectLocationContinuesPastMissingPair(): void {
-		$this->wireObjectService();
+		$this->container->method('get')->willReturn($this->objectService);
 
 		$entity = $this->createMock(ObjectEntity::class);
-
 		$this->objectService->method('find')->willReturnCallback(
 			function (int|string $id, ?array $_extend, bool $files, $register, $schema) use ($entity) {
-				if ((int)$register === 1 && (int)$schema === 2) {
+				if ((int) $register === 1 && (int) $schema === 2) {
 					throw new \OCP\AppFramework\Db\DoesNotExistException('missing table');
 				}
-
-				if ((int)$register === 1 && (int)$schema === 3) {
-					return $entity;
-				}
-
-				return null;
+				return ((int) $register === 1 && (int) $schema === 3) ? $entity : null;
 			}
 		);
 
-		$location = $this->service->findObjectLocation(
-			uuid: 'uuid-found',
-			allowedRegisters: [1],
-			allowedSchemas: [2, 3]
-		);
-
-		$this->assertSame(expected: ['register' => 1, 'schema' => 3], actual: $location);
-
-	}//end testFindObjectLocationContinuesPastMissingPair()
+		$location = $this->service->findObjectLocation(uuid: 'uuid-found', allowedRegisters: [1], allowedSchemas: [2, 3]);
+		$this->assertSame(['register' => 1, 'schema' => 3], $location);
+	}
 
 	// -------------------------------------------------------------------------
-	// isObjectPublic() tests — RBAC publicationDate model (APB-006)
+	// Test scaffolding.
 	// -------------------------------------------------------------------------
 
 	/**
-	 * A past publicationDate with no depublicationDate is publicly visible.
-	 *
-	 * @return void
-	 *
-	 * @spec openspec/specs/auto-publishing/spec.md#APB-006
+	 * Wire the DI container with the minimum services `assemblePublicSearchResults`
+	 * needs to reach the row-loop: CatalogiService (default catalog with schemas
+	 * [1,2] on register 1) + SchemaMapper (publication=1, document=2). Returns
+	 * the FakeSearchObjectService that the test passes into the service call
+	 * (also registered under the ObjectService key for the per-doc lookups).
 	 */
-	public function testIsObjectPublicWithPastPublicatiedatum(): void {
-		$this->assertTrue(
-			$this->service->isObjectPublic(['publicationDate' => '2024-01-15T10:00:00+00:00'])
-		);
+	private function wireHappyPath(): FakeSearchObjectService {
+		$fakeObjectService = new FakeSearchObjectService();
+
+		$catalog = [
+			'@self'     => ['slug' => 'default-catalog'],
+			'slug'      => 'default-catalog',
+			'listed'    => true,
+			'published' => '2020-01-01T00:00:00+00:00',
+			'registers' => [1],
+			'schemas'   => [1, 2],
+		];
 
-	}//end testIsObjectPublicWithPastPublicatiedatum()
+		$fakeCatalogiService = new FakeCatalogiService();
+		$fakeCatalogiService->catalogsBySlug = ['default-catalog' => $catalog];
 
-	/**
-	 * No publicationDate means the object is not public (concept).
-	 *
-	 * @return void
-	 *
-	 * @spec openspec/specs/auto-publishing/spec.md#APB-006
-	 */
-	public function testIsObjectPublicWithoutPublicatiedatum(): void {
-		$this->assertFalse($this->service->isObjectPublic([]));
-		$this->assertFalse(
-			$this->service->isObjectPublic(['depublicationDate' => '2024-01-15T10:00:00+00:00'])
+		$fakeSchemaMapper = new FakeSchemaMapper();
+		$fakeSchemaMapper->slugById = [1 => 'publication', 2 => 'document'];
+
+		// Config keys needed by the default-scope enumeration path; safe to set
+		// even for _catalog=<slug> tests since that path doesn't consult them.
+		$this->config->method('getValueString')->willReturnCallback(
+			fn(string $app, string $key, string $default = '') => match ($key) {
+				'catalog_register' => '1',
+				'catalog_schema'   => '3',
+				default => $default,
+			}
+		);
+
+		$this->container->method('get')->willReturnCallback(
+			function (string $key) use ($fakeCatalogiService, $fakeSchemaMapper, $fakeObjectService) {
+				return match ($key) {
+					'OCA\\OpenCatalogi\\Service\\CatalogiService' => $fakeCatalogiService,
+					'OCA\\OpenRegister\\Db\\SchemaMapper'         => $fakeSchemaMapper,
+					'OCA\\OpenRegister\\Service\\ObjectService'   => $fakeObjectService,
+					default => throw new \RuntimeException("Unmocked container key: {$key}"),
+				};
+			}
 		);
 
-	}//end testIsObjectPublicWithoutPublicatiedatum()
+		return $fakeObjectService;
+	}
 
 	/**
-	 * A future publicationDate (embargo) is not yet public.
-	 *
-	 * @return void
-	 *
-	 * @spec openspec/specs/auto-publishing/spec.md#APB-006
+	 * Add `_catalog=default-catalog` to a query params array so tests reliably
+	 * hit the explicit-catalog scope resolution (bypassing the default-scope
+	 * enumeration that requires additional config plumbing).
 	 */
-	public function testIsObjectPublicWithFuturePublicatiedatum(): void {
-		$future = (new \DateTime('+10 days'))->format(\DateTimeInterface::ATOM);
-		$this->assertFalse($this->service->isObjectPublic(['publicationDate' => $future]));
-
-	}//end testIsObjectPublicWithFuturePublicatiedatum()
+	private function withDefaultCatalog(array $params = []): array {
+		return $params + ['_catalog' => 'default-catalog'];
+	}
 
 	/**
-	 * A reached depublicationDate hides the object; a future one keeps it visible.
+	 * Invoke a private/protected method by name via reflection.
 	 *
-	 * @return void
+	 * @param string $method Method name.
+	 * @param array  $args   Positional arguments.
 	 *
-	 * @spec openspec/specs/auto-publishing/spec.md#APB-006
+	 * @return mixed
 	 */
-	public function testIsObjectPublicRespectsDepublicationDate(): void {
-		$future = (new \DateTime('+10 days'))->format(\DateTimeInterface::ATOM);
-
-		$this->assertFalse(
-			$this->service->isObjectPublic(
-				objectData: [
-					'publicationDate' => '2024-01-15T10:00:00+00:00',
-					'depublicationDate' => '2024-06-01T10:00:00+00:00',
-				]
-			)
-		);
-
-		$this->assertTrue(
-			$this->service->isObjectPublic(
-				objectData: [
-					'publicationDate' => '2024-01-15T10:00:00+00:00',
-					'depublicationDate' => $future,
-				]
-			)
-		);
-
-	}//end testIsObjectPublicRespectsDepublicationDate()
-}//end class
+	private function invokePrivate(string $method, array $args): mixed {
+		$ref = new ReflectionClass($this->service);
+		$m = $ref->getMethod($method);
+		$m->setAccessible(true);
+		return $m->invokeArgs($this->service, $args);
+	}
+}