telemetry-spec.md (general usage/adoption reporting) and
2026-08-01-environment-survey-design.md (hardware-capability data,
motivated by the now-resolved NumPy SSE4.2 issue #13429) proposed two
overlapping opt-in phone-home mechanisms. Merges them into a single
paperless_survey app design with three independent, explicit opt-in
gates: the app isn't installed unless PAPERLESS_ENVIRONMENT_SURVEY_ENABLED
is set, the send path is unreachable without --submit, and the
confirmation prompt still defaults to declining.
Section 2 assumed a bare documents/export.py module, but PRs #13490/#13661
already refactored the exporter into a documents/export/ package with
ExportSink abstractions and zip-compression options. Reworks the export
extraction (ExportOptions/ExportError/ExportRunner/run_export) to fit the
actual current architecture, including the progress-bar and CryptMixin
coupling the original spec didn't account for.
Spec and implementation plan for rasterizing PDF thumbnails with
pdftoppm+pikepdf+Pillow instead of ImageMagick's convert/gs delegate,
cutting subprocess calls and using narrower-scoped tools already
vendored in the image.
Adds the extensibility design that hoists the bulk-edit operation
definition (today smeared across serialisers.py, views.py, bulk_edit.py
and keyed three different ways) behind a BulkEditOperation registry +
PermissionRequirements value object, with per-operation OpenAPI examples.
Contract-preserving refactor; both docs reviewed across multiple passes
(permission matrix verified, both view call sites accounted for).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the search-error-shapes stub with a full design spec and a TDD
implementation plan for friendlier advanced-search error messages.
Empirically validated against a live Tantivy index: three error families
(UnknownFieldError, InvalidFieldValueError, MalformedQueryError),
proactive numeric validation plus a parse_query backstop, comparison
operators confirmed working, and a parse-based field drift guard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
AI Suggestions previously invented near-duplicate metadata because the classification
prompt had no knowledge of the installation's own taxonomy. This surfaces
a small, ranked, permission-filtered set of existing tags/document
types/correspondents/storage paths - drawn from the document's RAG
neighbors plus its own already-assigned metadata - so the model prefers
reusing what already exists.
The LLM response schema now returns existing_ids (IDs of reused
candidates) separately from new_names (genuinely new suggestions).
Only new_names goes through localization and fuzzy name-matching;
existing_ids is resolved deterministically and never touched by the
localization pass, so exact matches can no longer be silently
corrupted by translation.