diff --git a/src/app/api/admin/entry/overview/route.ts b/src/app/api/admin/entry/overview/route.ts
index 4b7eb5f..ba68f91 100644
--- a/src/app/api/admin/entry/overview/route.ts
+++ b/src/app/api/admin/entry/overview/route.ts
@@ -7,7 +7,7 @@ import { badRequest, entryAuthFailure, entryRateLimited, entryRpcFailure } from
 
 export const runtime = 'nodejs';
 
-// The dashboard polls every ~12 s; this leaves room for searching and paging on top.
+// The dashboard polls every 30 s; this leaves room for searching and paging on top.
 const overviewLimiter = createRateLimiter({ limit: 60, windowMs: 60 * 1000 });
 
 const PAGE_SIZE = 30;
diff --git a/src/app/api/admin/registrations/route.ts b/src/app/api/admin/registrations/route.ts
index b4eb4da..fd84ff4 100644
--- a/src/app/api/admin/registrations/route.ts
+++ b/src/app/api/admin/registrations/route.ts
@@ -35,21 +35,30 @@ async function rowsById(supabase: SupabaseClient, table: string, columns: string
  * is a rejected one (only one may be pending or confirmed), so the user's rejected rows are enough, whatever the
  * filters list.
  */
-async function withAttempts(supabase: SupabaseClient, registrations: Record<string, unknown>[]) {
+async function withAttempts(supabase: SupabaseClient, registrations: Record<string, unknown>[], isWholeTable: boolean) {
   const userIds = [...new Set(registrations.map((r) => r.user_id).filter((v): v is string => typeof v === 'string'))];
   const rejected: Record<string, string>[] = [];
-  for (let i = 0; i < userIds.length; i += LOOKUP_CHUNK) {
-    // '*' rather than naming rejection_reason, so the list keeps loading on a database without section 17 yet.
-    const { data, error } = await supabase
-      .from('registrations')
-      .select('*')
-      .eq('status', 'rejected')
-      .in('user_id', userIds.slice(i, i + LOOKUP_CHUNK));
-    if (error) return { error, registrations };
-    rejected.push(...((data ?? []) as Record<string, string>[]));
+  if (isWholeTable) {
+    // The dashboard's list: every rejected row is already here, so this costs no request.
+    rejected.push(...(registrations.filter((r) => r.status === 'rejected' && typeof r.user_id === 'string') as Record<string, string>[]));
+  } else {
+    for (let i = 0; i < userIds.length; i += LOOKUP_CHUNK) {
+      // '*' rather than naming rejection_reason, so the list keeps loading on a database without section 17 yet.
+      const { data, error } = await supabase
+        .from('registrations')
+        .select('*')
+        .eq('status', 'rejected')
+        .in('user_id', userIds.slice(i, i + LOOKUP_CHUNK));
+      if (error) return { error, registrations };
+      rejected.push(...((data ?? []) as Record<string, string>[]));
+    }
   }
   const byUser = new Map<string, Record<string, string>[]>();
-  for (const r of rejected) byUser.set(r.user_id, [...(byUser.get(r.user_id) ?? []), r]);
+  for (const r of rejected) {
+    const mine = byUser.get(r.user_id);
+    if (mine) mine.push(r);
+    else byUser.set(r.user_id, [r]);
+  }
   return {
     error: null,
     registrations: registrations.map((r) => {
@@ -68,12 +77,14 @@ async function withAttempts(supabase: SupabaseClient, registrations: Record<stri
 /** referred_via for every row: the referrer's code and name, looked up whether or not the filters list the referrer. */
 async function withReferredVia(supabase: SupabaseClient, registrations: Record<string, unknown>[]) {
   const ids = (key: string) => [...new Set(registrations.map((r) => r[key]).filter((v): v is string => typeof v === 'string'))];
+  // A referrer already in this list needs no lookup, which on the dashboard's unfiltered list is all of them.
+  const listed = new Map(registrations.map((r) => [r.id as string, r as Record<string, string>]));
   const [friends, ambassadors] = await Promise.all([
-    rowsById(supabase, 'registrations', 'id, referral_code, name', ids('referred_by')),
+    rowsById(supabase, 'registrations', 'id, referral_code, name', ids('referred_by').filter((id) => !listed.has(id))),
     rowsById(supabase, 'campus_ambassadors', 'id, code, name', ids('ambassador_id')),
   ]);
   if (friends.error || ambassadors.error) return { error: friends.error || ambassadors.error, registrations };
-  const friendById = new Map(friends.rows.map((f) => [f.id, f]));
+  const friendById = new Map([...listed, ...friends.rows.map((f) => [f.id, f] as const)]);
   const ambassadorById = new Map(ambassadors.rows.map((a) => [a.id, a]));
   return {
     error: null,
@@ -189,7 +200,9 @@ export async function GET(req: NextRequest) {
       console.error('/api/admin/registrations referrer lookup error:', enriched.error);
       return NextResponse.json({ error: 'Database operation failed.' }, { status: 500 });
     }
-    const counted = await withAttempts(supabase, enriched.registrations);
+    const isWholeTable =
+      (!status || status === 'all') && (!studentType || studentType === 'all') && !ambassador && !query;
+    const counted = await withAttempts(supabase, enriched.registrations, isWholeTable);
     if (counted.error) {
       console.error('/api/admin/registrations attempts lookup error:', counted.error);
       return NextResponse.json({ error: 'Database operation failed.' }, { status: 500 });
diff --git a/src/app/api/admin/users/route.ts b/src/app/api/admin/users/route.ts
index 42d3151..0272197 100644
--- a/src/app/api/admin/users/route.ts
+++ b/src/app/api/admin/users/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { verifyAdmin } from '@/lib/auth-server';
+import { forgetCachedRole, verifyAdmin } from '@/lib/auth-server';
 import { isUuid, readJsonObject } from '@/lib/security';
 
 export const runtime = 'nodejs';
@@ -117,6 +117,7 @@ export async function PATCH(req: NextRequest) {
       return NextResponse.json({ error: 'Database operation failed.' }, { status: 500 });
     }
 
+    forgetCachedRole(userId);
     return NextResponse.json({ success: true, user: updated });
   } catch (err: unknown) {
     console.error('/api/admin/users error:', err);
diff --git a/src/app/api/auth/session/route.ts b/src/app/api/auth/session/route.ts
index 8aadfb0..664de67 100644
--- a/src/app/api/auth/session/route.ts
+++ b/src/app/api/auth/session/route.ts
@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getSupabaseAdmin } from '@/lib/supabase';
 import { safeHttpUrl } from '@/lib/validation';
 import { hashSessionToken, readJsonObject } from '@/lib/security';
+import { isTokenExpired } from '@/lib/auth-server';
 
 export const runtime = 'nodejs';
 
@@ -24,7 +25,8 @@ export async function GET(req: NextRequest) {
     let currentAccessToken = accessToken;
     let currentRefreshToken = refreshToken;
 
-    if (accessToken) {
+    // An expired token goes straight to the refresh below: Supabase Auth could only refuse it.
+    if (accessToken && !isTokenExpired(accessToken)) {
       const userResult = await supabase.auth.getUser(accessToken);
       if (userResult.data?.user) {
         activeUser = userResult.data.user;
diff --git a/src/app/api/events/route.ts b/src/app/api/events/route.ts
index d8b3175..f9262e2 100644
--- a/src/app/api/events/route.ts
+++ b/src/app/api/events/route.ts
@@ -5,9 +5,10 @@ import { PUBLIC_EVENT_COLUMNS } from '@/lib/events';
 export const runtime = 'nodejs';
 
 // Public, unauthenticated endpoint: serve from a short in-process cache and let the CDN cache it too, so floods of
-// anonymous requests don't each become a service-role database query.
+// anonymous requests don't each become a service-role database query. The CDN keeps it as long as the /events pages
+// keep theirs (revalidate = 300).
 const CACHE_TTL_MS = 30 * 1000;
-const CACHE_HEADERS = { 'Cache-Control': 'public, max-age=30, s-maxage=60, stale-while-revalidate=300' };
+const CACHE_HEADERS = { 'Cache-Control': 'public, max-age=30, s-maxage=300, stale-while-revalidate=300' };
 let cached: { body: unknown; expires: number } | null = null;
 
 // Public GET route to fetch all published events
diff --git a/src/app/api/gallery/route.ts b/src/app/api/gallery/route.ts
index 58d2ab1..33ec8eb 100644
--- a/src/app/api/gallery/route.ts
+++ b/src/app/api/gallery/route.ts
@@ -6,7 +6,7 @@ export const runtime = 'nodejs';
 // Public, unauthenticated endpoint: serve from a short in-process cache and let the CDN cache it too, so floods of
 // anonymous requests don't each become a service-role database query.
 const CACHE_TTL_MS = 30 * 1000;
-const CACHE_HEADERS = { 'Cache-Control': 'public, max-age=30, s-maxage=60, stale-while-revalidate=300' };
+const CACHE_HEADERS = { 'Cache-Control': 'public, max-age=30, s-maxage=300, stale-while-revalidate=300' };
 let cached: { body: unknown; expires: number } | null = null;
 
 // Public GET route to fetch all gallery photos
diff --git a/src/app/api/pass/route.ts b/src/app/api/pass/route.ts
index d0bd359..b014287 100644
--- a/src/app/api/pass/route.ts
+++ b/src/app/api/pass/route.ts
@@ -28,7 +28,8 @@ interface MyEntryPass {
  */
 export async function POST(req: NextRequest) {
   try {
-    const auth = await getAuthenticatedUser(req);
+    // Polled while MY PASS is open. A POST only because the first call after approval writes.
+    const auth = await getAuthenticatedUser(req, { cached: true });
     if (!auth) {
       return NextResponse.json({ error: 'Your session has expired. Please log in again.' }, { status: 401 });
     }
@@ -48,8 +49,9 @@ export async function POST(req: NextRequest) {
     const mine = data as MyEntryPass;
 
     // '*' rather than naming rejection_reason, so the pass keeps loading on a database without section 17 yet.
-    const details = await db.from('registrations').select('*')
-      .eq('user_id', auth.user.id).eq('registration_id', mine.registration_id ?? '').maybeSingle();
+    const details = mine.registration_id
+      ? await db.from('registrations').select('*').eq('user_id', auth.user.id).eq('registration_id', mine.registration_id).maybeSingle()
+      : { data: null, error: null };
     if (details.error) return NextResponse.json({ error: 'Could not load your registration.' }, { status: 500 });
     const pass: ParticipantPass = {
       registrationStatus: mine.registration_status,
diff --git a/src/app/api/seats/route.ts b/src/app/api/seats/route.ts
index 39981f8..b88cbf8 100644
--- a/src/app/api/seats/route.ts
+++ b/src/app/api/seats/route.ts
@@ -5,10 +5,10 @@ export const runtime = 'nodejs';
 
 // Public, unauthenticated endpoint polled by every open registration form: serve from a short in-process cache and let
 // the CDN cache it too, so a crowd watching the counter doesn't turn into one database query each. Short enough that
-// the number still visibly moves while someone is on the form. Display only: POST /api/register/start-payment reads the
+// the number still visibly moves on the form's 30-second poll. Display only: POST /api/register/start-payment reads the
 // database live to decide who may pay. Excluded from the global no-store API header in next.config.ts.
-const CACHE_TTL_MS = 5 * 1000;
-const CACHE_HEADERS = { 'Cache-Control': 'public, max-age=5, s-maxage=5, stale-while-revalidate=10' };
+const CACHE_TTL_MS = 15 * 1000;
+const CACHE_HEADERS = { 'Cache-Control': 'public, max-age=5, s-maxage=15, stale-while-revalidate=15' };
 const NO_STORE = { 'Cache-Control': 'no-store' };
 let cached: { body: { total: number; left: number; closed: boolean; femaleFull: boolean }; expires: number } | null = null;
 
diff --git a/src/components/innovision/AdminDashboard.tsx b/src/components/innovision/AdminDashboard.tsx
index 4091066..27fa8e4 100644
--- a/src/components/innovision/AdminDashboard.tsx
+++ b/src/components/innovision/AdminDashboard.tsx
@@ -1,9 +1,9 @@
 'use client';
 
-import React, { useState, useEffect, useCallback } from 'react';
+import React, { useState, useEffect, useCallback, useMemo, useRef } from 'react';
 import type { UserProfile, Registration } from '@/lib/supabase';
 import { getSupabase, fetchSessionFromDatabase, getCookie } from '@/lib/supabase';
-import { csvCell, formatReferralCode, GENDER_OPTIONS, safeHttpUrl } from '@/lib/validation';
+import { csvCell, formatReferralCode, GENDER_OPTIONS, matchesRegistrationSearch, safeHttpUrl, searchTerm } from '@/lib/validation';
 
 const genderLabel = (value: string) => GENDER_OPTIONS.find((g) => g.value === value)?.label ?? value;
 import EventsManager from './admin/EventsManager';
@@ -19,6 +19,9 @@ import { ID_CARD_REUPLOAD_REASONS, idCardReuploadLabel, type IdCardReuploadReaso
 /** A registration that still needs its college ID card (supabase/schema.sql section 19); rejected ones never do. */
 const idCardMissing = (r: Registration) => r.status !== 'rejected' && !r.id_card_path;
 
+/** A filter or search change reloads the list in the background only if it was last loaded longer ago than this. */
+const REGS_FRESH_MS = 60_000;
+
 /** Roles an admin can give from the USERS tab (/api/admin/users); 'admin' is set in the database only. */
 type AssignableRole = 'user' | 'it-team' | 'registration-team' | 'viewer';
 
@@ -47,7 +50,10 @@ export default function AdminDashboard({
 
   const defaultTab = canViewRegistrations ? 'registrations' : 'events';
   const [tab, setTab] = useState<'registrations' | 'referrals' | 'ambassadors' | 'events' | 'gallery' | 'users' | 'entry'>(defaultTab);
-  const [registrations, setRegistrations] = useState<Registration[]>([]);
+  // Every registration, loaded once: the filters and search below work over it without asking the server again.
+  const [allRegistrations, setRegistrations] = useState<Registration[]>([]);
+  // Each row's status when loaded: the status filter uses it, so a row just reviewed stays in view until the next load.
+  const [loadedStatus, setLoadedStatus] = useState<Map<string, string>>(new Map());
   const [users, setUsers] = useState<UserProfile[]>([]);
   const [loadingRegs, setLoadingRegs] = useState(false);
   const [loadingUsers, setLoadingUsers] = useState(false);
@@ -80,6 +86,16 @@ export default function AdminDashboard({
   const [searchReg, setSearchReg] = useState<string>('');
   const [searchUser, setSearchUser] = useState<string>('');
 
+  const registrations = useMemo(() => {
+    const search = searchTerm(searchReg);
+    return allRegistrations.filter(
+      (r) =>
+        (statusFilter === 'all' || (loadedStatus.get(r.id ?? '') ?? r.status) === statusFilter) &&
+        (typeFilter === 'all' || r.student_type === typeFilter) &&
+        (!search || matchesRegistrationSearch(r, search))
+    );
+  }, [allRegistrations, loadedStatus, statusFilter, typeFilter, searchReg]);
+
   // Pagination states (30 items per page)
   const [regPage, setRegPage] = useState<number>(1);
   const [userPage, setUserPage] = useState<number>(1);
@@ -156,39 +172,48 @@ export default function AdminDashboard({
     }
   };
 
-  // Fetch registrations
-  const fetchRegistrations = useCallback(async () => {
-    if (!canViewRegistrations) return;
+  const regsRequest = useRef(0);
+  const regsLoading = useRef(false);
+  const regsLoadedAt = useRef(0);
+
+  // Fetch every registration. `background` keeps the table on screen; `opening`: the SEAT COUNTER card loads by itself as
+  // the dashboard opens, so it needn't be told to reload.
+  const fetchRegistrations = useCallback(async ({ background = false, opening = false } = {}) => {
+    if (!canViewRegistrations || (background && regsLoading.current)) return;
+    const request = ++regsRequest.current;
+    regsLoading.current = true;
     try {
-      setLoadingRegs(true);
+      if (!background) setLoadingRegs(true);
       setErrorMsg('');
       const token = await getAuthToken();
 
-      const params = new URLSearchParams();
-      if (statusFilter !== 'all') params.set('status', statusFilter);
-      if (typeFilter !== 'all') params.set('student_type', typeFilter);
-      if (searchReg.trim()) params.set('q', searchReg.trim());
-
       const headers: Record<string, string> = {};
       if (token) {
         headers['Authorization'] = `Bearer ${token}`;
       }
 
-      const res = await fetch(`/api/admin/registrations?${params.toString()}`, {
+      const res = await fetch('/api/admin/registrations', {
         headers,
         credentials: 'include',
       });
       const data = await res.json().catch(() => ({}));
+      if (request !== regsRequest.current) return; // a newer request superseded this one
       if (!res.ok) throw new Error(httpErrorMessage(res) || data.error || 'Failed to fetch registrations');
       setRegistrations(data.registrations || []);
-      setSeatsKey((k) => k + 1);
+      setLoadedStatus(new Map((data.registrations || []).map((r: Registration) => [r.id ?? '', r.status])));
+      regsLoadedAt.current = Date.now();
+      if (!opening) setSeatsKey((k) => k + 1);
     } catch (err: unknown) {
+      if (request !== regsRequest.current) return;
       const message = err instanceof Error ? err.message : 'Error loading registrations';
       setErrorMsg(message);
     } finally {
-      setLoadingRegs(false);
+      if (request === regsRequest.current) {
+        regsLoading.current = false;
+        setLoadingRegs(false);
+      }
     }
-  }, [statusFilter, typeFilter, searchReg, canViewRegistrations]);
+  }, [canViewRegistrations]);
 
   // Fetch users (Admin only: IT-Team cannot access users)
   const fetchUsers = useCallback(async () => {
@@ -221,11 +246,33 @@ export default function AdminDashboard({
   useEffect(() => {
     if (!isOpen) return;
     const timer = setTimeout(() => {
-      if (canViewRegistrations) fetchRegistrations();
-      if (isAdmin) fetchUsers();
+      if (canViewRegistrations) fetchRegistrations({ opening: true });
+    }, 0);
+    return () => clearTimeout(timer);
+  }, [isOpen, fetchRegistrations, canViewRegistrations]);
+
+  // Filtering costs no request, but changing a filter used to bring in other staff's reviews too: still does, if the
+  // list is more than a minute old.
+  useEffect(() => {
+    if (!isOpen || !regsLoadedAt.current || Date.now() - regsLoadedAt.current < REGS_FRESH_MS) return;
+    const timer = setTimeout(() => fetchRegistrations({ background: true }), 0);
+    return () => clearTimeout(timer);
+  }, [isOpen, statusFilter, typeFilter, searchReg, fetchRegistrations]);
+
+  // The user directory loads when the USERS tab first opens, and again the next time the dashboard is opened.
+  const usersLoaded = useRef(false);
+  useEffect(() => {
+    if (!isOpen) {
+      usersLoaded.current = false;
+      return;
+    }
+    if (!isAdmin || tab !== 'users' || usersLoaded.current) return;
+    const timer = setTimeout(() => {
+      usersLoaded.current = true;
+      fetchUsers();
     }, 0);
     return () => clearTimeout(timer);
-  }, [isOpen, fetchRegistrations, fetchUsers, isAdmin, canViewRegistrations]);
+  }, [isOpen, isAdmin, tab, fetchUsers]);
 
   // Active tab: 'users' is strictly admin-only; staff have their own tabs
   let activeTab = tab;
@@ -1109,7 +1156,7 @@ export default function AdminDashboard({
                   cursor: 'pointer',
                 }}
               >
-                USERS & ROLES ({users.length})
+                USERS & ROLES{users.length > 0 ? ` (${users.length})` : ''}
               </button>
             )}
 
@@ -1375,7 +1422,7 @@ export default function AdminDashboard({
 
                 <button
                   type="button"
-                  onClick={fetchRegistrations}
+                  onClick={() => fetchRegistrations()}
                   style={{
                     height: '40px',
                     padding: '0 16px',
diff --git a/src/components/innovision/AuthOverlay.tsx b/src/components/innovision/AuthOverlay.tsx
index 464ac26..b3e2e52 100644
--- a/src/components/innovision/AuthOverlay.tsx
+++ b/src/components/innovision/AuthOverlay.tsx
@@ -230,9 +230,9 @@ export default function AuthOverlay({ v }: { v: V }) {
                       </label>
                       <label data-s-in="" style={{ display: "flex", flexDirection: "column", gap: "8px" }}>
                         <span style={{ fontSize: "12px", fontWeight: "700", letterSpacing: ".16em", color: "rgba(236,232,223,.86)" }}>
-                          COLLEGE ROLL / ENROLLMENT NUMBER / EMPLOYEE ID
+                          ROLL NUMBER / EMPLOYEE ID
                         </span>
-                        <input name="enrollment_no" defaultValue={v.regVals.enrollment_no} autoComplete="off" required placeholder="Your roll / enrollment number or employee ID"aria-invalid={v.inv.enrollment_no} style={{ height: "54px", padding: "0 16px", borderRadius: "0", background: "rgba(236,232,223,.04)", fontSize: "16px", color: "#ECE8DF", outline: "none", transition: "border-color .3s,background-color .3s", border: `1.5px solid ${v.bc.enrollment_no}` }} style-focus="border-color:oklch(0.78 0.075 85);background:rgba(236,232,223,.08)" />
+                        <input name="enrollment_no" defaultValue={v.regVals.enrollment_no} autoComplete="off" required placeholder="Your roll number or employee ID" aria-invalid={v.inv.enrollment_no} style={{ height: "54px", padding: "0 16px", borderRadius: "0", background: "rgba(236,232,223,.04)", fontSize: "16px", color: "#ECE8DF", outline: "none", transition: "border-color .3s,background-color .3s", border: `1.5px solid ${v.bc.enrollment_no}` }} style-focus="border-color:oklch(0.78 0.075 85);background:rgba(236,232,223,.08)" />
                         {v.err.enrollment_no ? (<span role="alert" style={{ fontSize: "14px", lineHeight: "1.4", color: "oklch(0.76 0.14 35)" }}>{v.err.enrollment_no}</span>) : null}
                       </label>
                       <div style={{ display: "flex", flexDirection: "column", gap: "10px" }}>
diff --git a/src/components/innovision/EntryPassCard.tsx b/src/components/innovision/EntryPassCard.tsx
index 090a2af..b1567bb 100644
--- a/src/components/innovision/EntryPassCard.tsx
+++ b/src/components/innovision/EntryPassCard.tsx
@@ -9,6 +9,12 @@ import styles from './PassIssued.module.css';
 import { REGISTRATION_PREVIEW_ENABLED } from '@/config/launch';
 import { rejectionMessage } from '@/lib/rejections';
 
+// Each load is several Supabase requests, and every one adds to the project's log quota. A student waiting on a review
+// gets the answer soonest; other states rarely change. Coming back to the tab reloads at once.
+const POLL_WAITING_MS = 30_000;
+const POLL_SETTLED_MS = 60_000;
+const MIN_GAP_MS = 10_000;
+
 interface EntryPassCardProps {
   onContinue?: () => void;
   previewPass?: ParticipantPass;
@@ -36,14 +42,18 @@ function AuthenticatedEntryPassCard({ onContinue, onRegisterAgain, onIdCardUploa
   useEffect(() => {
     let cancelled = false;
     let busy = false;
+    let lastAt = 0;
+    let pollMs = POLL_WAITING_MS;
 
     const load = async () => {
-      if (busy || document.visibilityState !== 'visible') return;
+      if (busy || document.visibilityState !== 'visible' || Date.now() - lastAt < MIN_GAP_MS) return;
       busy = true;
+      lastAt = Date.now();
 
       try {
         const data = await passRequest('/api/pass');
         if (!data.pass) throw new Error('Could not load your registration details.');
+        pollMs = data.pass.registrationStatus === 'pending' ? POLL_WAITING_MS : POLL_SETTLED_MS;
         if (!cancelled) {
           setPass(data.pass);
           setError('');
@@ -61,7 +71,11 @@ function AuthenticatedEntryPassCard({ onContinue, onRegisterAgain, onIdCardUploa
     };
 
     void load();
-    const interval = setInterval(() => void load(), 15_000);
+    // Ticks at the shorter period, and only loads once the current state's period has passed. The 1 s margin keeps a
+    // tick that lands just early from waiting a whole extra period.
+    const interval = setInterval(() => {
+      if (Date.now() - lastAt >= pollMs - 1000) void load();
+    }, POLL_WAITING_MS);
     window.addEventListener('focus', load);
     document.addEventListener('visibilitychange', load);
 
diff --git a/src/components/innovision/Innovision.tsx b/src/components/innovision/Innovision.tsx
index 3c643e9..fc8fdbb 100644
--- a/src/components/innovision/Innovision.tsx
+++ b/src/components/innovision/Innovision.tsx
@@ -47,6 +47,7 @@ import {
   signOutUser,
   cleanAuthUrl,
   saveSessionToDatabase,
+  isSessionAlreadySaved,
   fetchSessionFromDatabase,
   getCookie,
   purgeLocalStorageTokens,
@@ -1881,12 +1882,17 @@ export class Innovision extends Component<Props, State> {
       purgeLocalStorageTokens();
 
       if (session?.user) {
-        const { data: { user }, error: userError } = await supabase.auth.getUser();
-        if (userError || !user) {
-          console.warn('Cached session is invalid or user was removed. Signing out...');
-          this._authEpoch++;
-          await signOutUser();
-          return;
+        // Once per token per tab: a reload of a session the server has already validated skips this request.
+        let user = session.user;
+        if (!isSessionAlreadySaved(session)) {
+          const checked = await supabase.auth.getUser();
+          if (checked.error || !checked.data.user) {
+            console.warn('Cached session is invalid or user was removed. Signing out...');
+            this._authEpoch++;
+            await signOutUser();
+            return;
+          }
+          user = checked.data.user;
         }
         await Promise.all([saveSessionToDatabase(session), this.handleUserSession(user)]);
       } else {
@@ -2646,7 +2652,7 @@ export class Innovision extends Component<Props, State> {
         err.college = ITER_SOA_ERROR_MESSAGE;
       }
       if (!/^[6-9]\d{9}$/.test(phone)) err.phone = 'Use a 10-digit Indian mobile number.';
-      if (!enrollment_no) err.enrollment_no = 'Enter your college roll / enrollment number or employee ID.';
+      if (!enrollment_no) err.enrollment_no = 'Enter your roll number or employee ID.';
       else if (enrollment_no.length > 50 || (enrollment_no && !/^[A-Za-z0-9/_ -]+$/.test(enrollment_no))) {
         err.enrollment_no = 'Use only letters, numbers, spaces and / _ - (up to 50 characters).';
       }
diff --git a/src/components/innovision/RegistrationStatusSync.tsx b/src/components/innovision/RegistrationStatusSync.tsx
index d8b548c..dbcaf00 100644
--- a/src/components/innovision/RegistrationStatusSync.tsx
+++ b/src/components/innovision/RegistrationStatusSync.tsx
@@ -3,15 +3,22 @@ import { useEffect } from 'react';
 import { getSupabase, type Registration } from '@/lib/supabase';
 import { REGISTRATION_PREVIEW_ENABLED } from '@/config/launch';
 
+// Each refresh is several Supabase requests, and every one adds to the project's log quota. MY PASS polls the live
+// status on its own (EntryPassCard), so this background sync can be slow. Coming back to the tab refreshes at once.
+const POLL_MS = 60_000;
+const MIN_GAP_MS = 10_000;
+
 /** Publish fresh server status to React; the previous background cache refresh did not. */
 export default function RegistrationStatusSync({ userId, onChange }: { userId: string; onChange: (registration: Registration | null) => void }) {
   useEffect(() => {
     if (REGISTRATION_PREVIEW_ENABLED && userId === 'dev-preview-user') return;
     let cancelled = false;
     let busy = false;
+    let lastAt = 0;
     const refresh = async () => {
-      if (busy || document.visibilityState !== 'visible') return;
+      if (busy || document.visibilityState !== 'visible' || Date.now() - lastAt < MIN_GAP_MS) return;
       busy = true;
+      lastAt = Date.now();
       try {
         const token = (await getSupabase().auth.getSession()).data.session?.access_token;
         const response = await fetch('/api/register', { cache: 'no-store', headers: token ? { Authorization: `Bearer ${token}` } : {} });
@@ -21,7 +28,7 @@ export default function RegistrationStatusSync({ userId, onChange }: { userId: s
       } catch { /* Preserve the last status during an outage; the pass independently revalidates. */ }
       finally { busy = false; }
     };
-    void refresh(); const timer = setInterval(() => void refresh(), 15_000);
+    void refresh(); const timer = setInterval(() => void refresh(), POLL_MS);
     window.addEventListener('focus', refresh); document.addEventListener('visibilitychange', refresh);
     return () => { cancelled = true; clearInterval(timer); window.removeEventListener('focus', refresh); document.removeEventListener('visibilitychange', refresh); };
   }, [userId, onChange]);
diff --git a/src/components/innovision/admin/EntryManager.tsx b/src/components/innovision/admin/EntryManager.tsx
index b087308..c2b505b 100644
--- a/src/components/innovision/admin/EntryManager.tsx
+++ b/src/components/innovision/admin/EntryManager.tsx
@@ -6,7 +6,7 @@ import { REJECT_REASON_LABELS } from '@/lib/entry-shared';
 
 /*
  * Admin "Entry" tab: venue check-in numbers and records. Read from GET /api/admin/entry/overview (admin only); voiding a
- * wrong check-in and reissuing a QR go through POST /api/admin/entry/{void,reissue}. Refreshes every 12 s by polling
+ * wrong check-in and reissuing a QR go through POST /api/admin/entry/{void,reissue}. Refreshes every 30 s by polling
  * (no realtime subscription). Counts are per registration: active passes and non-voided check-ins only.
  */
 
@@ -34,7 +34,7 @@ const LISTS: { key: List; label: string }[] = [
   { key: 'audit', label: 'AUDIT LOG' },
 ];
 const AUDIT_ACTIONS = ['', 'lookup', 'manual_lookup', 'check_in', 'reject', 'void', 'reissue'];
-const POLL_MS = 12_000;
+const POLL_MS = 30_000;
 const GOLD = 'oklch(0.8 0.12 85)';
 
 const s = (v: unknown) => (v === null || v === undefined || v === '' ? '—' : String(v));
@@ -184,7 +184,7 @@ export default function EntryManager({ getAuthToken, showToast, setConfirmModal
     <div style={{ display: 'flex', flexDirection: 'column', gap: '24px' }}>
       <div style={{ display: 'flex', flexWrap: 'wrap', alignItems: 'center', justifyContent: 'space-between', gap: '12px' }}>
         <p style={{ margin: 0, fontSize: '13px', color: 'rgba(236,232,223,0.6)' }}>
-          Venue check-in · refreshes every 12 s{updatedAt ? ` · updated ${updatedAt.toLocaleTimeString('en-IN', { timeZone: 'Asia/Kolkata' })}` : ''}
+          Venue check-in · refreshes every 30 s{updatedAt ? ` · updated ${updatedAt.toLocaleTimeString('en-IN', { timeZone: 'Asia/Kolkata' })}` : ''}
         </p>
         <a href="/admin/scan" target="_blank" rel="noopener" style={{ ...smallBtn, textDecoration: 'none', color: GOLD, borderColor: GOLD }}>
           OPEN SCANNER ↗
diff --git a/src/lib/ambassadors.ts b/src/lib/ambassadors.ts
index dd22ccd..c1ad1f9 100644
--- a/src/lib/ambassadors.ts
+++ b/src/lib/ambassadors.ts
@@ -1,5 +1,5 @@
 import type { SupabaseClient } from '@supabase/supabase-js';
-import { REFERRAL_CODE_FORMAT_ERROR, referralCodeKind } from '@/lib/security';
+import { isFilterSafeEmail, REFERRAL_CODE_FORMAT_ERROR, referralCodeKind } from '@/lib/security';
 
 /**
  * Campus ambassadors and the referral codes a registrant may enter (supabase/schema.sql, sections 14 and 16).
@@ -97,6 +97,21 @@ export async function findOwnAmbassador(
   registrant: Registrant
 ): Promise<{ ambassador: OwnAmbassador | null; error: unknown }> {
   const columns = 'id, code, name, status, user_id';
+  // One request for both lookups (GET /api/register runs this on every poll). The email match wins, as below.
+  if (isFilterSafeEmail(registrant.email)) {
+    const { data, error } = await client
+      .from('campus_ambassadors')
+      .select('id, code, name, status, user_id, email')
+      .or(`email.eq.${registrant.email},user_id.eq.${registrant.userId}`)
+      .limit(2);
+    if (error) return { ambassador: null, error };
+    const match = data?.find((a) => a.email === registrant.email) ?? data?.[0];
+    if (!match) return { ambassador: null, error: null };
+    return {
+      ambassador: { id: match.id, code: match.code, name: match.name, status: match.status, user_id: match.user_id },
+      error: null,
+    };
+  }
   const byEmail = await client.from('campus_ambassadors').select(columns).eq('email', registrant.email).maybeSingle();
   if (byEmail.error || byEmail.data) return { ambassador: byEmail.data as OwnAmbassador | null, error: byEmail.error };
   const byUser = await client.from('campus_ambassadors').select(columns).eq('user_id', registrant.userId).maybeSingle();
diff --git a/src/lib/auth-server.ts b/src/lib/auth-server.ts
index d60d41f..dacf580 100644
--- a/src/lib/auth-server.ts
+++ b/src/lib/auth-server.ts
@@ -1,4 +1,5 @@
 import { getSupabaseAdmin } from '@/lib/supabase';
+import { hashSessionToken } from '@/lib/security';
 import type { SupabaseClient, User } from '@supabase/supabase-js';
 
 export type StaffRole = 'admin' | 'it-team' | 'registration-team' | 'viewer';
@@ -23,6 +24,8 @@ export type StaffAuthResult = StaffAuthSuccess | StaffAuthFailure;
  * await cookies() }` in a server component (next/headers).
  */
 export interface AuthSource {
+  /** Set on a route handler's NextRequest: GET requests may use the short auth caches below. */
+  method?: string;
   headers: { get(name: string): string | null };
   cookies: {
     get(name: string): { value: string } | undefined;
@@ -74,22 +77,115 @@ export interface AuthenticatedUser {
   token: string;
 }
 
+/**
+ * True when a JWT's own `exp` has passed. Lets callers skip a request Supabase Auth could only refuse: old cookies
+ * outlive their hour-long tokens by days. Only ever rejects: a token that looks valid still goes to Supabase Auth, and
+ * one that can't be read is left for Supabase Auth to judge.
+ */
+export function isTokenExpired(token: string, now = Date.now()): boolean {
+  const exp = tokenExp(token);
+  return exp !== null && exp * 1000 <= now;
+}
+
+function tokenExp(token: string): number | null {
+  try {
+    const exp = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf-8'))?.exp;
+    return typeof exp === 'number' ? exp : null;
+  } catch {
+    return null;
+  }
+}
+
+/*
+ * Short in-process caches for read-only requests. Every call to Supabase adds to the project's Logs Ingest quota, and
+ * the dashboard and MY PASS poll, so each poll re-validating its token and re-reading the role adds up quickly. Writes
+ * and the check-in scanner always ask Supabase live. Kept on globalThis because route bundles may not share module
+ * state. Per server instance, so a cold instance just asks Supabase again.
+ *   - Identity: a signed-out or deleted account keeps reading for at most IDENTITY_TTL_MS on an instance that saw it.
+ *   - Role: a staff member who loses a role keeps read access for at most ROLE_TTL_MS on such an instance.
+ */
+const IDENTITY_TTL_MS = 5 * 60 * 1000;
+const ROLE_TTL_MS = 60 * 1000;
+const MAX_CACHE_ENTRIES = 5000;
+
+interface AuthCaches {
+  identities: Map<string, { user: User; expires: number }>;
+  roles: Map<string, { role: string; expires: number }>;
+}
+const globals = globalThis as typeof globalThis & { __innovisionAuthCaches?: AuthCaches };
+const caches: AuthCaches = (globals.__innovisionAuthCaches ??= { identities: new Map(), roles: new Map() });
+
+function remember<T extends { expires: number }>(cache: Map<string, T>, key: string, entry: T) {
+  if (cache.size >= MAX_CACHE_ENTRIES) {
+    const now = Date.now();
+    for (const [k, v] of cache) if (v.expires <= now) cache.delete(k);
+    // Still full: drop the oldest entries (a Map iterates in insertion order).
+    for (const k of cache.keys()) {
+      if (cache.size < MAX_CACHE_ENTRIES) break;
+      cache.delete(k);
+    }
+  }
+  cache.set(key, entry);
+}
+
+/** Drops a cached role at once on this instance (the role was just changed here). */
+export function forgetCachedRole(userId: string) {
+  caches.roles.delete(userId);
+}
+
 /**
  * Validates the caller's access token with Supabase Auth (signature + expiry + revocation) and returns the user.
  * Never spends refresh tokens: rotating them here without re-issuing cookies would revoke the user's real session
  * (Supabase refresh-token reuse detection). Clients refresh via the Supabase SDK or GET /api/auth/session.
+ *
+ * A GET request may reuse a recent validation of the same token (see the caches above), as may a polled route that
+ * passes `cached`. An entry never outlives the token's own expiry.
  */
-export async function getAuthenticatedUser(req: AuthSource): Promise<AuthenticatedUser | null> {
+export async function getAuthenticatedUser(
+  req: AuthSource,
+  { cached = req.method === 'GET' }: { cached?: boolean } = {}
+): Promise<AuthenticatedUser | null> {
   const verifier = getSupabaseAdmin();
+  const now = Date.now();
 
   for (const token of extractAccessTokens(req)) {
+    if (isTokenExpired(token, now)) continue;
+
+    const key = hashSessionToken(token);
+    if (cached) {
+      const hit = caches.identities.get(key);
+      if (hit && hit.expires > now) return { user: hit.user, token };
+    }
+
     const { data, error } = await verifier.auth.getUser(token);
-    if (!error && data?.user) return { user: data.user, token };
+    if (!error && data?.user) {
+      const exp = tokenExp(token);
+      remember(caches.identities, key, {
+        user: data.user,
+        expires: Math.min(now + IDENTITY_TTL_MS, exp === null ? now + IDENTITY_TTL_MS : exp * 1000),
+      });
+      return { user: data.user, token };
+    }
+    // Refused by Supabase Auth (signed out, say): a validation cached earlier no longer stands.
+    caches.identities.delete(key);
   }
 
   return null;
 }
 
+/** The caller's role row. A GET request may reuse a recent read (see the caches above); a write always reads it live. */
+async function readProfileRole(req: AuthSource, supabase: SupabaseClient, userId: string) {
+  const now = Date.now();
+  if (req.method === 'GET') {
+    const hit = caches.roles.get(userId);
+    if (hit && hit.expires > now) return { data: { role: hit.role }, error: null };
+  }
+  const { data, error } = await supabase.from('profiles').select('role').eq('id', userId).maybeSingle();
+  if (data && !error) remember(caches.roles, userId, { role: data.role, expires: now + ROLE_TTL_MS });
+  else caches.roles.delete(userId);
+  return { data, error };
+}
+
 /**
  * Server-side helper to verify that the request originates from an authorized
  * IT Team member or Administrator ('admin' or 'it-team' role).
@@ -101,11 +197,7 @@ export async function verifyEventStaff(req: AuthSource): Promise<StaffAuthResult
   }
 
   const supabase = getSupabaseAdmin(auth.token);
-  const { data: profile, error: profErr } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', auth.user.id)
-    .maybeSingle();
+  const { data: profile, error: profErr } = await readProfileRole(req, supabase, auth.user.id);
 
   if (profErr || !profile || !['admin', 'it-team'].includes(profile.role)) {
     return { error: 'Forbidden: Admin or IT-Team authorization required.', status: 403 };
@@ -125,11 +217,7 @@ export async function verifyRegistrationStaff(req: AuthSource): Promise<StaffAut
   }
 
   const supabase = getSupabaseAdmin(auth.token);
-  const { data: profile, error: profErr } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', auth.user.id)
-    .maybeSingle();
+  const { data: profile, error: profErr } = await readProfileRole(req, supabase, auth.user.id);
 
   if (profErr || !profile || !['admin', 'registration-team'].includes(profile.role)) {
     return { error: 'Forbidden: Admin or Registration-Team authorization required.', status: 403 };
@@ -150,11 +238,7 @@ export async function verifyRegistrationViewer(req: AuthSource): Promise<StaffAu
   }
 
   const supabase = getSupabaseAdmin(auth.token);
-  const { data: profile, error: profErr } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', auth.user.id)
-    .maybeSingle();
+  const { data: profile, error: profErr } = await readProfileRole(req, supabase, auth.user.id);
 
   if (profErr || !profile || !['admin', 'registration-team', 'viewer'].includes(profile.role)) {
     return { error: 'Forbidden: Admin, Registration-Team or Viewer authorization required.', status: 403 };
@@ -171,11 +255,7 @@ export async function verifyAdmin(req: AuthSource): Promise<StaffAuthResult> {
   }
 
   const supabase = getSupabaseAdmin(auth.token);
-  const { data: profile, error: profErr } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', auth.user.id)
-    .maybeSingle();
+  const { data: profile, error: profErr } = await readProfileRole(req, supabase, auth.user.id);
 
   if (profErr || !profile || profile.role !== 'admin') {
     return { error: 'Forbidden: Superadmin access required to modify user roles', status: 403 };
diff --git a/src/lib/security.ts b/src/lib/security.ts
index 0698d8a..60e9128 100644
--- a/src/lib/security.ts
+++ b/src/lib/security.ts
@@ -243,6 +243,7 @@ export function isImageKitPathInFolder(filePath: unknown, folder: string): boole
 /**
  * Makes free text safe to interpolate into a PostgREST `.or()` / `ilike` filter string. Characters with filter
  * meaning (`,` `(` `)` `"` `\` `:` and the `*`/`%` wildcards) are removed so a search can't add extra conditions.
+ * The admin dashboard's search cleans its text the same way (searchTerm in validation.ts): keep the two in step.
  */
 export function sanitizeFilterValue(input: unknown, maxLength = 100): string {
   if (typeof input !== 'string') return '';
@@ -400,10 +401,10 @@ export function validateRegistrationInput(
 
   const enrollment_no = enrollment ? enrollment.trim() : '';
   if (!enrollment_no) {
-    return { ok: false, error: 'Enter your college roll / enrollment number or employee ID.', field: 'enrollment_no' };
+    return { ok: false, error: 'Enter your roll number or employee ID.', field: 'enrollment_no' };
   }
   if (enrollment_no.length > 50 || (enrollment_no && !/^[A-Za-z0-9/_ -]+$/.test(enrollment_no))) {
-    return { ok: false, error: 'Roll / enrollment number or employee ID contains invalid characters.', field: 'enrollment_no' };
+    return { ok: false, error: 'Roll number or employee ID contains invalid characters.', field: 'enrollment_no' };
   }
 
   // Optional: a registrant's or a campus ambassador's code. Same normalization as the form: case, spaces and dashes
diff --git a/src/lib/supabase.ts b/src/lib/supabase.ts
index aeea2ce..48c1b36 100644
--- a/src/lib/supabase.ts
+++ b/src/lib/supabase.ts
@@ -411,6 +411,7 @@ export async function signOutUser() {
 
   if (typeof window !== 'undefined') {
     sessionStorage.removeItem('inv_login_intent');
+    sessionStorage.removeItem(SESSION_SAVED_KEY);
     purgeLocalStorageTokens();
     // Cached registrations hold personal data (phone, UTR, proof references): don't leave them on shared computers.
     try {
@@ -423,12 +424,30 @@ export async function signOutUser() {
   return result;
 }
 
+/**
+ * sessionStorage: the session this tab last saved through POST /api/auth/session (user id and token expiry, no token).
+ * Supabase reports SIGNED_IN every time a tab regains focus, and each save is three Supabase requests, so the same token
+ * is saved and validated once per tab, and again after a token refresh.
+ */
+const SESSION_SAVED_KEY = 'inv_session_saved';
+const sessionStamp = (session: Session) => `${session.user.id}:${session.expires_at ?? ''}`;
+
+/** True when the server has already validated and saved this exact session for this tab. */
+export function isSessionAlreadySaved(session: Session): boolean {
+  try {
+    return sessionStorage.getItem(SESSION_SAVED_KEY) === sessionStamp(session);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Persists the user's active session and tokens into the database (user_sessions)
  * Sets an HttpOnly cookie so tokens never live in browser localStorage.
  */
 export async function saveSessionToDatabase(session: Session | null): Promise<boolean> {
   if (!session || !session.access_token || !session.user) return false;
+  if (isSessionAlreadySaved(session)) return true;
   try {
     const res = await fetch('/api/auth/session', {
       method: 'POST',
@@ -440,6 +459,11 @@ export async function saveSessionToDatabase(session: Session | null): Promise<bo
         userId: session.user.id,
       }),
     });
+    if (res.ok) {
+      try {
+        sessionStorage.setItem(SESSION_SAVED_KEY, sessionStamp(session));
+      } catch {}
+    }
     return res.ok;
   } catch (err) {
     console.warn('saveSessionToDatabase error:', err);
@@ -629,6 +653,8 @@ export async function fetchUserRegistrationServer(userId: string, email?: string
         }
         return result.registration as Registration;
       }
+      // The server answered that there is none: the direct query below is only for when it couldn't answer.
+      if (result.success) return null;
     }
   } catch (apiErr) {
     console.warn('API /api/register GET error, falling back to direct query:', apiErr);
diff --git a/src/lib/validation.ts b/src/lib/validation.ts
index be7f954..f981866 100644
--- a/src/lib/validation.ts
+++ b/src/lib/validation.ts
@@ -2,6 +2,29 @@
  * Client & Server safe validation utilities for Innovision 2026.
  */
 
+/**
+ * The admin dashboard's search over its loaded list: the same fields and matching as `?q=` on GET
+ * /api/admin/registrations. `search` comes from searchTerm.
+ */
+export function matchesRegistrationSearch(
+  r: { name?: string | null; email?: string | null; registration_id?: string | null; college?: string | null; utr?: string | null; enrollment_no?: string | null },
+  search: string
+): boolean {
+  return [r.name, r.email, r.registration_id, r.college, r.utr, r.enrollment_no].some((v) => v?.toLowerCase().includes(search));
+}
+
+/**
+ * What matchesRegistrationSearch expects from what the user typed; empty means no search. Cleans the text as the server
+ * does for `?q=` (sanitizeFilterValue in security.ts, which browsers can't import): keep the two in step.
+ */
+export const searchTerm = (input: string): string =>
+  input
+    .replace(/[,()"'\\:*%]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 100)
+    .toLowerCase();
+
 export const ITER_SOA_ERROR_MESSAGE =
   "Students of ITER / SOA (Siksha 'O' Anusandhan) are not allowed to register for Innovision 2026.";
 
diff --git a/supabase/manual/log_volume_diagnostics.sql b/supabase/manual/log_volume_diagnostics.sql
new file mode 100644
index 0000000..690d081
--- /dev/null
+++ b/supabase/manual/log_volume_diagnostics.sql
@@ -0,0 +1,53 @@
+-- Read-only: changes nothing. Shows where the Logs Ingest quota goes, to compare before and after a deploy.
+
+-- 1. SQL Editor: the Postgres settings that decide how much Postgres itself logs.
+SELECT name, setting, unit
+FROM pg_settings
+WHERE name IN ('log_statement', 'log_min_duration_statement', 'log_min_messages', 'log_connections', 'log_disconnections')
+ORDER BY name;
+
+-- 2. SQL Editor: the statements that run most often. Needs the pg_stat_statements extension, which Supabase enables by
+--    default. Run each statement on its own: the editor may only show the last result.
+SELECT calls, round(total_exec_time::numeric) AS total_ms, round(mean_exec_time::numeric, 1) AS mean_ms, left(query, 120) AS query
+FROM pg_stat_statements
+ORDER BY calls DESC
+LIMIT 25;
+
+-- 2a. The period those counts cover: they add up from this moment.
+SELECT stats_reset FROM pg_stat_statements_info;
+
+-- 2b. The statements that take the most total time. Rare but slow ones, like the portal's list, only show up here.
+SELECT calls, round(total_exec_time::numeric) AS total_ms, round(mean_exec_time::numeric, 1) AS mean_ms, left(query, 120) AS query
+FROM pg_stat_statements
+ORDER BY total_exec_time DESC
+LIMIT 25;
+
+-- The next three are NOT for the SQL Editor: paste them, without the leading "-- ", into Logs & Analytics -> Logs Explorer.
+--
+-- 3. Log lines per source:
+-- select 'edge' as source, count(*) as lines from edge_logs
+-- union all select 'postgres', count(*) from postgres_logs
+-- union all select 'auth', count(*) from auth_logs
+-- union all select 'postgrest', count(*) from postgrest_logs
+-- union all select 'storage', count(*) from storage_logs
+-- order by lines desc
+--
+-- 4. Which API paths produce the most requests:
+-- select r.path as path, count(*) as requests
+-- from edge_logs
+-- cross join unnest(metadata) as m
+-- cross join unnest(m.request) as r
+-- group by path
+-- order by requests desc
+-- limit 30
+--
+-- 5. Who validates tokens: a "node" user agent is the app's server, a browser name is a visitor's tab.
+-- select h.user_agent as user_agent, count(*) as requests
+-- from edge_logs
+-- cross join unnest(metadata) as m
+-- cross join unnest(m.request) as r
+-- cross join unnest(r.headers) as h
+-- where r.path = '/auth/v1/user'
+-- group by user_agent
+-- order by requests desc
+-- limit 20
diff --git a/supabase/manual/performance_indexes.sql b/supabase/manual/performance_indexes.sql
new file mode 100644
index 0000000..7d669a0
--- /dev/null
+++ b/supabase/manual/performance_indexes.sql
@@ -0,0 +1,7 @@
+-- From section 2 of supabase/schema.sql, for a database that already has the rest. Safe to run more than once. The app works
+-- without it: these only make two frequent reads faster.
+--   idx_registrations_email:         GET /api/register looks a user up by id OR email on every poll; without an index on
+--                                    email, each lookup scans the whole table.
+--   idx_registrations_created_at_id: the admin list reads in (created_at, id) order, a page at a time.
+CREATE INDEX IF NOT EXISTS idx_registrations_email ON public.registrations(email);
+CREATE INDEX IF NOT EXISTS idx_registrations_created_at_id ON public.registrations(created_at, id);
diff --git a/supabase/schema.sql b/supabase/schema.sql
index 4692c45..8e1adee 100644
--- a/supabase/schema.sql
+++ b/supabase/schema.sql
@@ -80,6 +80,10 @@ END $$;
 CREATE INDEX IF NOT EXISTS idx_registrations_user_id ON public.registrations(user_id);
 CREATE INDEX IF NOT EXISTS idx_registrations_status ON public.registrations(status);
 CREATE INDEX IF NOT EXISTS idx_registrations_reg_id ON public.registrations(registration_id);
+-- GET /api/register looks a user up by id OR email on every poll.
+CREATE INDEX IF NOT EXISTS idx_registrations_email ON public.registrations(email);
+-- The admin list reads in (created_at, id) order, a page at a time.
+CREATE INDEX IF NOT EXISTS idx_registrations_created_at_id ON public.registrations(created_at, id);
 
 -- The old ITER - SOA college CHECK: trg_refuse_iter_soa_registration (section 18) refuses them now, without blocking
 -- staff from reviewing a registration made before the ban.