Profile authorization-first ANN plans before changing recall

An authorization-first materialized CTE can dominate vector-search latency when the planner badly underestimates the visible-session set. Profile eligibility and candidate search separately, and localize statement timeouts to the exact query stage before changing embeddings, gateway transport, or result validation.

A candidate-first reconstruction can test whether bounded ANN lanes preserve result-set parity while avoiding full visibility materialization. Treat a NOT MATERIALIZED change as a canary requiring rollback rehearsal, because inlining may repeat authorization work across branches.

Operational success, ANN recall, and passage usefulness remain separate gates.