diff --git a/docker-compose.yml b/docker-compose.yml
index 52cc8206..a10b970c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -90,7 +90,7 @@ services:
       - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
 
       # Semantic search configuration (ADR-007, ADR-021)
-      #- ENABLE_SEMANTIC_SEARCH=true
+      - ENABLE_SEMANTIC_SEARCH=true
       - VECTOR_SYNC_SCAN_INTERVAL=60
       - VECTOR_SYNC_PROCESSOR_WORKERS=1
 
@@ -100,7 +100,7 @@ services:
       # 1. Network mode: Set QDRANT_URL=http://qdrant:6333 (requires qdrant service)
       # 2. In-memory mode: Set QDRANT_LOCATION=:memory: (default if nothing set)
       # 3. Persistent local: Set QDRANT_LOCATION=/app/data/qdrant (stored in mcp-data volume)
-      #- QDRANT_LOCATION=/app/data/qdrant  # In-memory mode used if not set
+      - QDRANT_LOCATION=":memory:"
       #- QDRANT_URL=http://qdrant:6333  # Uncomment for network mode
       #- QDRANT_API_KEY=${QDRANT_API_KEY:-my_secret_api_key}  # Only for network mode
 
diff --git a/nextcloud_mcp_server/app.py b/nextcloud_mcp_server/app.py
index 8a8523ca..5d602eaf 100644
--- a/nextcloud_mcp_server/app.py
+++ b/nextcloud_mcp_server/app.py
@@ -2187,11 +2187,9 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
     logger.info("Test webhook endpoint enabled: /webhooks/nextcloud")
 
     # Add management API endpoints for Nextcloud PHP app
-    # Available in: OAuth modes OR multi-user BasicAuth with offline access (for Astrolabe integration)
-    enable_management_apis = oauth_enabled or (
-        settings.enable_multi_user_basic_auth and settings.enable_offline_access
-    )
-    if enable_management_apis:
+    # Tier 1: Public endpoints (no auth required) - available in all non-Smithery modes
+    # These let Astrolabe show basic server status even in single-user BasicAuth mode
+    if deployment_mode != DeploymentMode.SMITHERY_STATELESS:
         routes.append(Route("/api/v1/status", get_server_status, methods=["GET"]))
         routes.append(
             Route(
@@ -2200,6 +2198,16 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                 methods=["GET"],
             )
         )
+        logger.info(
+            "Public management API endpoints enabled: /api/v1/status, /api/v1/vector-sync/status"
+        )
+
+    # Tier 2+: Authenticated management endpoints (OAuth required)
+    # Available in: OAuth modes OR multi-user BasicAuth with offline access
+    enable_authenticated_management_apis = oauth_enabled or (
+        settings.enable_multi_user_basic_auth and settings.enable_offline_access
+    )
+    if enable_authenticated_management_apis:
         routes.append(
             Route(
                 "/api/v1/users/{user_id}/session",
@@ -2270,7 +2278,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
         )
         routes.append(Route("/api/v1/scopes", list_supported_scopes, methods=["GET"]))
         logger.info(
-            "Management API endpoints enabled: /api/v1/status, /api/v1/vector-sync/status, "
+            "Authenticated management API endpoints enabled: "
             "/api/v1/users/{user_id}/session, /api/v1/users/{user_id}/revoke, "
             "/api/v1/users/{user_id}/app-password, /api/v1/users/{user_id}/access, "
             "/api/v1/users/{user_id}/scopes, /api/v1/scopes, "
diff --git a/third_party/astrolabe b/third_party/astrolabe
index af53f1c0..41d4a409 160000
--- a/third_party/astrolabe
+++ b/third_party/astrolabe
@@ -1 +1 @@
-Subproject commit af53f1c02fbdb6db07c20e8f068069d994e14030
+Subproject commit 41d4a409c526f3db173885636b637c0f050932da