Fix: Handle Celery enqueue failures when enqueuing files for consumption (#13935 )

Fix: Handle Celery mail task chord errors (#13936 )
* Fix: mail rule loops forever when all attachments are duplicates When every attachment in a mail is rejected as a duplicate, the chord's header tasks all fail. Celery's default task_allow_error_cb_on_chord_header skips the error callback in that case, so no ProcessedMail row is ever created, and the same mail is refetched and reprocessed on every poll for as long as it stays in the rule's maximum_age window. * Minor simplifications and cleanup
2026-09-02 16:07:15 +00:00 · 2026-09-02 15:58:27 +00:00 · 2026-09-02 08:41:30 -07:00 · 2026-09-01 22:07:30 +00:00 · 2026-09-01 15:05:58 -07:00 · 2026-09-01 20:22:10 +00:00
40 changed files with 1046 additions and 519 deletions
@@ -63,7 +63,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -100,7 +100,7 @@ jobs:
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -178,7 +178,7 @@ jobs:
        with:
          python-version: "${{ env.DEFAULT_PYTHON }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -106,9 +106,9 @@ jobs:
          echo "repository=${repo_name}"
          echo "name=${repo_name}" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -182,22 +182,22 @@ jobs:
          echo "Downloaded digests:"
          ls -la /tmp/digests/
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to Quay.io
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -50,7 +50,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -78,7 +78,7 @@ jobs:
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -60,7 +60,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -81,7 +81,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -113,7 +113,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -152,7 +152,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -201,7 +201,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -216,7 +216,7 @@ jobs:
        with:
          python-version: '3.12'
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: '0.12.x'
          enable-cache: false
@@ -255,7 +255,7 @@ jobs:
          fetch-depth: 2
          persist-credentials: false
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -25,4 +25,4 @@ jobs:
        with:
          python-version: "3.14"
      - name: Run prek
-        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2.0.6
@@ -20,7 +20,7 @@ jobs:
      statuses: read
    steps:
      - name: Wait for Docker build
-        uses: lewagon/wait-on-check-action@369769072fe522a3a8a85c03c96af1e5242a1994 # v1.9.1
+        uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773 # v1.9.0
        with:
          ref: ${{ github.sha }}
          check-name: 'Merge and Push Manifest'
@@ -40,7 +40,7 @@ jobs:
          persist-credentials: false
      # ---- Frontend Build ----
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -59,7 +59,7 @@ jobs:
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -171,7 +171,7 @@ jobs:
          fi
      - name: Create release and changelog
        id: create-release
-        uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        with:
          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
          tag: ${{ steps.get-version.outputs.version }}
@@ -182,7 +182,7 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload release archive
-        uses: shogo82148/actions-upload-release-asset@aaba0f56bdbc1071f4af234d5cb16055e8a400de # v1.10.4
+        uses: shogo82148/actions-upload-release-asset@394b3c11c3cfc038b5396ad265c074065cf875c3 # v1.10.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          upload_url: ${{ steps.create-release.outputs.upload_url }}
@@ -212,7 +212,7 @@ jobs:
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -26,7 +26,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
  semgrep:
    name: Semgrep CE
    runs-on: ubuntu-24.04
@@ -44,7 +44,7 @@ jobs:
      - name: Run Semgrep
        run: semgrep scan --config auto --sarif-output results.sarif
      - name: Upload results to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        if: always()
        with:
          sarif_file: results.sarif
@@ -39,7 +39,7 @@ jobs:
          persist-credentials: false
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,4 +47,4 @@ jobs:
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
@@ -22,7 +22,7 @@ jobs:
          token: ${{ secrets.PNGX_BOT_PAT }}
          persist-credentials: false
      - name: crowdin action
-        uses: crowdin/github-action@8f01d54f70f1713ee3f09d82c2bbb2daeac28689 # v2.17.1
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
        with:
          upload_translations: false
          download_translations: true
@@ -19,6 +19,6 @@ jobs:
    if: github.event_name == 'pull_request_target' && (github.event.action == 'opened' || github.event.action == 'reopened') && github.event.pull_request.user.login != 'dependabot'
    steps:
      - name: Label PR with release-drafter
-        uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,7 +14,7 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
        with:
          days-before-stale: 7
          days-before-close: 14
@@ -29,7 +29,7 @@ jobs:
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -43,7 +43,7 @@ jobs:
          PAPERLESS_SECRET_KEY: "ci-translate-not-a-real-secret"
        run: cd src/ && uv run manage.py makemessages -l en_US -i "samples*"
      - name: Install pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          package_json_file: src-ui/package.json
      - name: Use Node.js 24
@@ -2088,6 +2088,12 @@ password. All of these options come from their similarly-named [Django settings]

    Defaults to "always".

+#### [`PAPERLESS_REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS=<bool>`](#PAPERLESS_REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS) {#PAPERLESS_REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS}
+
+: If set to false, Paperless blocks remote OCR endpoint URLs that resolve to non-public addresses (e.g., localhost, etc).
+
+    Defaults to True.
+
 ## AI {#ai}

 #### [`PAPERLESS_AI_ENABLED=<bool>`](#PAPERLESS_AI_ENABLED) {#PAPERLESS_AI_ENABLED}
@@ -41,6 +41,8 @@ export class TrashComponent
  private modalService = inject(NgbModal)
  private settingsService = inject(SettingsService)
  private router = inject(Router)
+  private readonly emptyTrashDelaySetting =
+    this.settingsService.getSignal<number>(SETTINGS_KEYS.EMPTY_TRASH_DELAY)

  readonly documentsInTrash = signal<Document[]>([])
  readonly selectedDocuments = signal<Set<number>>(new Set())
@@ -200,8 +202,7 @@ export class TrashComponent
  }

  getDaysRemaining(document: Document): number {
-    this.settingsService.trackChanges()
-    const delay = this.settingsService.get(SETTINGS_KEYS.EMPTY_TRASH_DELAY)
+    const delay = this.emptyTrashDelaySetting()
    const diff = new Date().getTime() - new Date(document.deleted_at).getTime()
    const days = Math.ceil(diff / (1000 * 3600 * 24))
    return delay - days
@@ -193,6 +193,23 @@ describe('AppFrameComponent', () => {
    expect(savedViewSpy).toHaveBeenCalled()
  })

+  it('should update reinitialized signal-backed settings without manual change detection', async () => {
+    settingsService.initializeSettings().subscribe()
+    httpTestingController
+      .expectOne(`${environment.apiBaseUrl}ui_settings/`)
+      .flush({
+        settings: { app_title: 'Reactive title' },
+        user: {},
+        permissions: [],
+      })
+
+    await fixture.whenStable()
+
+    expect(
+      fixture.nativeElement.querySelector('.brand-title').textContent
+    ).toBe('Reactive title')
+  })
+
  it('should check for update if enabled', () => {
    const updateCheckSpy = jest.spyOn(remoteVersionService, 'checkForUpdates')
    updateCheckSpy.mockImplementation(() => {
@@ -98,6 +98,29 @@ export class AppFrameComponent
  readonly isMenuCollapsed = signal(true)
  readonly slimSidebarAnimating = signal(false)
  readonly mobileSearchHidden = signal(false)
+  private readonly versionSetting = this.settingsService.getSignal<string>(
+    SETTINGS_KEYS.VERSION
+  )
+  private readonly appTitleSetting = this.settingsService.getSignal<string>(
+    SETTINGS_KEYS.APP_TITLE
+  )
+  private readonly appLogoSetting = this.settingsService.getSignal<string>(
+    SETTINGS_KEYS.APP_LOGO
+  )
+  private readonly slimSidebarSetting = this.settingsService.getSignal<boolean>(
+    SETTINGS_KEYS.SLIM_SIDEBAR
+  )
+  private readonly attributesSectionsCollapsedSetting =
+    this.settingsService.getSignal<CollapsibleSection[]>(
+      SETTINGS_KEYS.ATTRIBUTES_SECTIONS_COLLAPSED
+    )
+  private readonly aiEnabledSetting = this.settingsService.getSignal<boolean>(
+    SETTINGS_KEYS.AI_ENABLED
+  )
+  private readonly sidebarViewsShowCountSetting =
+    this.settingsService.getSignal<boolean>(
+      SETTINGS_KEYS.SIDEBAR_VIEWS_SHOW_COUNT
+    )
  private lastScrollY: number = 0

  constructor() {
@@ -191,33 +214,23 @@ export class AppFrameComponent
  }

  get versionString(): string {
-    this.settingsService.trackChanges()
-    return `${environment.appTitle} v${this.settingsService.get(SETTINGS_KEYS.VERSION)}${environment.tag === 'prod' ? '' : ` #${environment.tag}`}`
+    return `${environment.appTitle} v${this.versionSetting()}${environment.tag === 'prod' ? '' : ` #${environment.tag}`}`
  }

  get appTitle(): string {
-    this.settingsService.trackChanges()
-    return (
-      this.settingsService.get(SETTINGS_KEYS.APP_TITLE) || environment.appTitle
-    )
+    return this.appTitleSetting() || environment.appTitle
  }

  get customAppTitle(): string {
-    this.settingsService.trackChanges()
-    return this.settingsService.get(SETTINGS_KEYS.APP_TITLE)
+    return this.appTitleSetting()
  }

  get hasCustomBranding(): boolean {
-    this.settingsService.trackChanges()
-    return !!(
-      this.settingsService.get(SETTINGS_KEYS.APP_TITLE)?.length ||
-      this.settingsService.get(SETTINGS_KEYS.APP_LOGO)?.length
-    )
+    return !!(this.appTitleSetting()?.length || this.appLogoSetting()?.length)
  }

  get customAppLogo(): string {
-    this.settingsService.trackChanges()
-    const logo = this.settingsService.get(SETTINGS_KEYS.APP_LOGO)
+    const logo = this.appLogoSetting()
    return logo?.length
      ? environment.apiBaseUrl.replace(/\/api\/$/, logo)
      : null
@@ -262,8 +275,7 @@ export class AppFrameComponent
  }

  get slimSidebarEnabled(): boolean {
-    this.settingsService.trackChanges()
-    return this.settingsService.get(SETTINGS_KEYS.SLIM_SIDEBAR)
+    return this.slimSidebarSetting()
  }

  set slimSidebarEnabled(enabled: boolean) {
@@ -286,10 +298,9 @@ export class AppFrameComponent
  }

  get attributesSectionsCollapsed(): boolean {
-    this.settingsService.trackChanges()
-    return this.settingsService
-      .get(SETTINGS_KEYS.ATTRIBUTES_SECTIONS_COLLAPSED)
-      ?.includes(CollapsibleSection.ATTRIBUTES)
+    return this.attributesSectionsCollapsedSetting()?.includes(
+      CollapsibleSection.ATTRIBUTES
+    )
  }

  set attributesSectionsCollapsed(collapsed: boolean) {
@@ -312,8 +323,7 @@ export class AppFrameComponent
  }

  get aiEnabled(): boolean {
-    this.settingsService.trackChanges()
-    return this.settingsService.get(SETTINGS_KEYS.AI_ENABLED)
+    return this.aiEnabledSetting()
  }

  @HostListener('window:resize')
@@ -480,9 +490,8 @@ export class AppFrameComponent
  }

  get showSidebarCounts(): boolean {
-    this.settingsService.trackChanges()
    return (
-      this.settingsService.get(SETTINGS_KEYS.SIDEBAR_VIEWS_SHOW_COUNT) &&
+      this.sidebarViewsShowCountSetting() &&
      !this.settingsService.organizingSidebarSavedViews()
    )
  }
@@ -81,6 +81,10 @@ export class GlobalSearchComponent implements OnInit {
  private hotkeyService = inject(HotKeyService)
  private settingsService = inject(SettingsService)
  private locationStrategy = inject(LocationStrategy)
+  private readonly searchFullTypeSetting =
+    this.settingsService.getSignal<GlobalSearchType>(
+      SETTINGS_KEYS.SEARCH_FULL_TYPE
+    )

  public DataType = DataType
  readonly query = signal<string>(null)
@@ -97,11 +101,7 @@ export class GlobalSearchComponent implements OnInit {
  @ViewChildren('secondaryButton') secondaryButtons: QueryList<ElementRef>

  get useAdvancedForFullSearch(): boolean {
-    this.settingsService.trackChanges()
-    return (
-      this.settingsService.get(SETTINGS_KEYS.SEARCH_FULL_TYPE) ===
-      GlobalSearchType.ADVANCED
-    )
+    return this.searchFullTypeSetting() === GlobalSearchType.ADVANCED
  }

  constructor() {
@@ -196,6 +196,16 @@ describe('WorkflowEditDialogComponent', () => {
    fixture.detectChanges()
  })

+  function setActionSettings({
+    email = true,
+    remoteOcr = true,
+    ai = true,
+  } = {}) {
+    settingsService.set(SETTINGS_KEYS.EMAIL_ENABLED, email)
+    settingsService.set(SETTINGS_KEYS.REMOTE_OCR_CONFIGURED, remoteOcr)
+    settingsService.set(SETTINGS_KEYS.AI_ENABLED, ai)
+  }
+
  it('should support create and edit modes, support adding triggers and actions on new workflow', () => {
    component.dialogMode.set(EditDialogMode.CREATE)
    const createTitleSpy = jest.spyOn(component, 'getCreateTitle')
@@ -218,7 +228,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should return source options, type options, type name, schedule date field options', () => {
-    jest.spyOn(settingsService, 'get').mockReturnValue(true)
+    setActionSettings()
    component.ngOnInit()
    expect(component.sourceOptions).toEqual(DOCUMENT_SOURCE_OPTIONS)
    expect(component.triggerTypeOptions).toEqual(WORKFLOW_TYPE_OPTIONS)
@@ -242,7 +252,7 @@ describe('WorkflowEditDialogComponent', () => {
    )

    // Email, remote OCR and AI all disabled
-    jest.spyOn(settingsService, 'get').mockReturnValue(false)
+    setActionSettings({ email: false, remoteOcr: false, ai: false })
    component.ngOnInit()
    expect(component.actionTypeOptions).toEqual(
      WORKFLOW_ACTION_OPTIONS.filter(
@@ -255,7 +265,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should offer remote OCR only for consumption workflows', () => {
-    jest.spyOn(settingsService, 'get').mockReturnValue(true)
+    setActionSettings()

    // A consumption trigger makes the action reachable
    component.object = {
@@ -285,7 +295,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should offer remote OCR on a trigger added to a new workflow', () => {
-    jest.spyOn(settingsService, 'get').mockReturnValue(true)
+    setActionSettings()
    component.ngOnInit()

    // Nothing for the action to apply to yet
@@ -311,7 +321,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should keep remote OCR listed when an action already uses it', () => {
-    jest.spyOn(settingsService, 'get').mockReturnValue(true)
+    setActionSettings()

    // Otherwise changing the trigger would silently blank the selection
    component.object = {
@@ -329,9 +339,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should not offer remote OCR when no engine is configured', () => {
-    jest
-      .spyOn(settingsService, 'get')
-      .mockImplementation((key) => key !== SETTINGS_KEYS.REMOTE_OCR_CONFIGURED)
+    setActionSettings({ remoteOcr: false })

    component.object = {
      name: 'Workflow 1',
@@ -348,7 +356,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should offer apply AI suggestions unless every trigger is consumption', () => {
-    jest.spyOn(settingsService, 'get').mockReturnValue(true)
+    setActionSettings()

    // Consumption runs before the document has been parsed, so there would be
    // no content to make suggestions from
@@ -382,7 +390,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should keep apply AI suggestions listed when an action already uses it', () => {
-    jest.spyOn(settingsService, 'get').mockReturnValue(true)
+    setActionSettings()

    // Otherwise changing the trigger would silently blank the selection
    component.object = {
@@ -400,9 +408,7 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should not offer apply AI suggestions when AI is disabled', () => {
-    jest
-      .spyOn(settingsService, 'get')
-      .mockImplementation((key) => key !== SETTINGS_KEYS.AI_ENABLED)
+    setActionSettings({ ai: false })

    component.object = {
      name: 'Workflow 1',
@@ -537,6 +537,13 @@ export class WorkflowEditDialogComponent
  readonly dateCustomFields = computed(() =>
    this.customFields()?.filter((f) => f.data_type === CustomFieldDataType.Date)
  )
+  private readonly emailEnabledSetting =
+    this.settingsService.getSignal<boolean>(SETTINGS_KEYS.EMAIL_ENABLED)
+  private readonly remoteOcrConfiguredSetting =
+    this.settingsService.getSignal<boolean>(SETTINGS_KEYS.REMOTE_OCR_CONFIGURED)
+  private readonly aiEnabledSetting = this.settingsService.getSignal<boolean>(
+    SETTINGS_KEYS.AI_ENABLED
+  )

  expandedItem: number = null

@@ -589,7 +596,7 @@ export class WorkflowEditDialogComponent
  private getAllowedActionTypes() {
    let allowed = WORKFLOW_ACTION_OPTIONS

-    if (!this.settingsService.get(SETTINGS_KEYS.EMAIL_ENABLED)) {
+    if (!this.emailEnabledSetting()) {
      allowed = allowed.filter((a) => a.id !== WorkflowActionType.Email)
    }

@@ -597,7 +604,7 @@ export class WorkflowEditDialogComponent
    // offered for workflows that run at consumption.
    const formWorkflow: Workflow = this.objectForm?.value
    const remoteOcrUsable =
-      this.settingsService.get(SETTINGS_KEYS.REMOTE_OCR_CONFIGURED) &&
+      this.remoteOcrConfiguredSetting() &&
      (formWorkflow?.triggers?.some(
        (trigger) => trigger.type === WorkflowTriggerType.Consumption
      ) ||
@@ -612,7 +619,7 @@ export class WorkflowEditDialogComponent
    // once every trigger is consumption, so it stays offered on a workflow
    // that has no triggers yet.
    const aiSuggestionsUsable =
-      this.settingsService.get(SETTINGS_KEYS.AI_ENABLED) &&
+      this.aiEnabledSetting() &&
      (!formWorkflow?.triggers?.length ||
        formWorkflow.triggers.some(
          (trigger) => trigger.type !== WorkflowTriggerType.Consumption
@@ -1362,7 +1369,6 @@ export class WorkflowEditDialogComponent
  }

  get actionTypeOptions() {
-    this.settingsService.trackChanges()
    // Computed on read rather than cached
    return this.getAllowedActionTypes()
  }
@@ -839,7 +839,9 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    selectionModel.items = [memoRoot]
    selectionModel.documentCounts = [{ id: memoRoot.id, document_count: 9 }]

-    const getRootDocCount = (selectionModel as any).createRootDocCounter()
+    const getRootDocCount = (selectionModel as any).createRootDocCounter(
+      selectionModel.items
+    )

    expect(getRootDocCount(memoRoot.id)).toEqual(9)
    selectionModel.documentCounts = []
@@ -855,7 +857,9 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    selectionModel.items = [rootWithoutSelection]
    selectionModel.documentCounts = []

-    const getRootDocCount = (selectionModel as any).createRootDocCounter()
+    const getRootDocCount = (selectionModel as any).createRootDocCounter(
+      selectionModel.items
+    )

    expect(getRootDocCount(rootWithoutSelection.id)).toEqual(4)
  })
@@ -865,7 +869,9 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    selectionModel.items = [rootWithoutCounts]
    selectionModel.documentCounts = []

-    const getRootDocCount = (selectionModel as any).createRootDocCounter()
+    const getRootDocCount = (selectionModel as any).createRootDocCounter(
+      selectionModel.items
+    )

    expect(getRootDocCount(rootWithoutCounts.id)).toEqual(0)
  })
@@ -966,7 +972,7 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
    component.selectionModel['temporarySelectionStates'].set(id, state)
    const changedSpy = jest.spyOn(component.selectionModel.changed, 'next')
    component.selectionModel.exclude(id)
-    expect(component.selectionModel.temporaryLogicalOperator).toBe(
+    expect(component.selectionModel.temporaryLogicalOperator()).toBe(
      LogicalOperator.And
    )
    expect(component.selectionModel['temporarySelectionStates'].get(id)).toBe(
@@ -64,43 +64,56 @@ export class FilterableDropdownSelectionModel {

  manyToOne = false
  singleSelect = false
-  private _logicalOperator: LogicalOperator = LogicalOperator.And
-  temporaryLogicalOperator: LogicalOperator = this._logicalOperator
-  private _intersection: Intersection = Intersection.Include
-  temporaryIntersection: Intersection = this._intersection

-  private _documentCounts: SelectionDataItem[] = []
+  private readonly _logicalOperator = signal(LogicalOperator.And)
+  readonly temporaryLogicalOperator = signal(LogicalOperator.And)
+  private readonly _intersection = signal(Intersection.Include)
+  readonly temporaryIntersection = signal(Intersection.Include)
+  private readonly _documentCounts = signal<SelectionDataItem[]>([])
+  private readonly _items = signal<MatchingModel[]>([])
+  private readonly _selectionStates = signal(
+    new Map<number, ToggleableItemState>()
+  )
+  private readonly _temporarySelectionStates = signal(
+    new Map<number, ToggleableItemState>()
+  )
+
  public documentCountSortingEnabled = false

+  private get selectionStates(): ReadonlyMap<number, ToggleableItemState> {
+    return this._selectionStates()
+  }
+
+  private get temporarySelectionStates(): ReadonlyMap<
+    number,
+    ToggleableItemState
+  > {
+    return this._temporarySelectionStates()
+  }
+
  public set documentCounts(counts: SelectionDataItem[]) {
-    this._documentCounts = counts
+    this._documentCounts.set(counts)
    if (this.documentCountSortingEnabled) {
-      this.sortItems()
+      this._items.set(this.sortItems(this.items))
    }
  }

-  private _items: MatchingModel[] = []
  get items(): MatchingModel[] {
-    return this._items
+    return this._items()
  }

  set items(items: MatchingModel[]) {
    if (items) {
-      this._items = Array.from(items)
-      this.sortItems()
-      this.setNullItem()
+      this._items.set(this.withNullItem(this.sortItems(Array.from(items))))
    }
  }

-  private setNullItem() {
+  private withNullItem(items: MatchingModel[]): MatchingModel[] {
    if (this.manyToOne && this.logicalOperator === LogicalOperator.Or) {
-      if (this._items[0]?.id === null) {
-        this._items.shift()
-      }
-      return
+      return items[0]?.id === null ? items.slice(1) : items
    }

-    const item = {
+    const nullItem = {
      name: $localize`:Filter drop down element to filter for documents with no correspondent/type/tag assigned:Not assigned`,
      id:
        this.manyToOne || this.intersection === Intersection.Include
@@ -108,22 +121,17 @@ export class FilterableDropdownSelectionModel {
          : NEGATIVE_NULL_FILTER_VALUE,
    }

-    if (
-      this._items[0]?.id === null ||
-      this._items[0]?.id === NEGATIVE_NULL_FILTER_VALUE
-    ) {
-      this._items[0] = item
-    } else if (this._items) {
-      this._items.unshift(item)
-    }
+    return items[0]?.id === null || items[0]?.id === NEGATIVE_NULL_FILTER_VALUE
+      ? [nullItem, ...items.slice(1)]
+      : [nullItem, ...items]
  }

  constructor(manyToOne: boolean = false) {
    this.manyToOne = manyToOne
  }

-  private sortItems() {
-    this._items.sort((a, b) => {
+  private sortItems(items: MatchingModel[]): MatchingModel[] {
+    const sorted = [...items].sort((a, b) => {
      if (
        (a.id == null && b.id != null) ||
        (a.id == NEGATIVE_NULL_FILTER_VALUE &&
@@ -154,13 +162,13 @@ export class FilterableDropdownSelectionModel {
      ) {
        return -1
      } else if (
-        this._documentCounts.length &&
+        this._documentCounts().length &&
        this.getDocumentCount(b.id) === 0 &&
        this.getDocumentCount(a.id) > this.getDocumentCount(b.id)
      ) {
        return -1
      } else if (
-        this._documentCounts.length &&
+        this._documentCounts().length &&
        this.getDocumentCount(a.id) === 0 &&
        this.getDocumentCount(a.id) < this.getDocumentCount(b.id)
      ) {
@@ -170,14 +178,10 @@ export class FilterableDropdownSelectionModel {
      }
    })

-    if (this._documentCounts.length) {
-      this.promoteBranchesWithDocumentCounts()
+    return this._documentCounts().length
+      ? this.promoteBranchesWithDocumentCounts(sorted)
+      : sorted
  }
-  }
-
-  private selectionStates = new Map<number, ToggleableItemState>()
-
-  private temporarySelectionStates = new Map<number, ToggleableItemState>()

  getSelectedItems() {
    return this.items.filter(
@@ -194,30 +198,33 @@ export class FilterableDropdownSelectionModel {
  }

  set(id: number, state: ToggleableItemState, fireEvent = true) {
+    const states = new Map(this.temporarySelectionStates)
    if (state == ToggleableItemState.NotSelected) {
-      this.temporarySelectionStates.delete(id)
+      states.delete(id)
    } else {
-      this.temporarySelectionStates.set(id, state)
+      states.set(id, state)
    }
+    this._temporarySelectionStates.set(states)
    if (fireEvent) {
      this.changed.next(this)
    }
  }

  toggle(id: number, fireEvent = true) {
-    let state = this.temporarySelectionStates.get(id)
+    const states = new Map(this.temporarySelectionStates)
+    let state = states.get(id)
    if (
      state == undefined ||
      (state != ToggleableItemState.Selected &&
        state != ToggleableItemState.Excluded)
    ) {
      if (this.manyToOne || this.singleSelect) {
-        this.temporarySelectionStates.set(id, ToggleableItemState.Selected)
+        states.set(id, ToggleableItemState.Selected)

        if (this.singleSelect) {
-          for (let key of this.temporarySelectionStates.keys()) {
+          for (let key of states.keys()) {
            if (key != id) {
-              this.temporarySelectionStates.delete(key)
+              states.delete(key)
            }
          }
        }
@@ -233,25 +240,26 @@ export class FilterableDropdownSelectionModel {
        ) {
          newState = ToggleableItemState.NotSelected
        }
-        this.temporarySelectionStates.set(id, newState)
+        states.set(id, newState)
      }
    } else if (
      state == ToggleableItemState.Selected ||
      state == ToggleableItemState.Excluded
    ) {
-      this.temporarySelectionStates.delete(id)
-      this.clearDescendantSelections(id)
+      states.delete(id)
+      this.clearDescendantSelections(states, id)
    }

    if (!id) {
-      for (let key of this.temporarySelectionStates.keys()) {
+      for (let key of states.keys()) {
        if (key) {
-          this.temporarySelectionStates.delete(key)
+          states.delete(key)
        }
      }
    } else {
-      this.temporarySelectionStates.delete(null)
+      states.delete(null)
    }
+    this._temporarySelectionStates.set(states)

    if (fireEvent) {
      this.changed.next(this)
@@ -259,20 +267,21 @@ export class FilterableDropdownSelectionModel {
  }

  exclude(id: number, fireEvent: boolean = true) {
-    let state = this.temporarySelectionStates.get(id)
+    const states = new Map(this.temporarySelectionStates)
+    let state = states.get(id)
    if (id && (state == null || state != ToggleableItemState.Excluded)) {
-      this.temporaryLogicalOperator = this._logicalOperator = this.manyToOne
-        ? LogicalOperator.And
-        : LogicalOperator.Or
+      const operator = this.manyToOne ? LogicalOperator.And : LogicalOperator.Or
+      this.temporaryLogicalOperator.set(operator)
+      this._logicalOperator.set(operator)

      if (this.manyToOne || this.singleSelect) {
-        this.temporarySelectionStates.set(id, ToggleableItemState.Excluded)
-        this.clearDescendantSelections(id)
+        states.set(id, ToggleableItemState.Excluded)
+        this.clearDescendantSelections(states, id)

        if (this.singleSelect) {
-          for (let key of this.temporarySelectionStates.keys()) {
+          for (let key of states.keys()) {
            if (key != id) {
-              this.temporarySelectionStates.delete(key)
+              states.delete(key)
            }
          }
        }
@@ -287,17 +296,18 @@ export class FilterableDropdownSelectionModel {
        ) {
          newState = ToggleableItemState.NotSelected
        }
-        this.temporarySelectionStates.set(id, newState)
+        states.set(id, newState)
        if (newState == ToggleableItemState.Excluded) {
-          this.clearDescendantSelections(id)
+          this.clearDescendantSelections(states, id)
        }
      }
    } else if (!id || state == ToggleableItemState.Excluded) {
-      this.temporarySelectionStates.delete(id)
+      states.delete(id)
      if (id) {
-        this.clearDescendantSelections(id)
+        this.clearDescendantSelections(states, id)
      }
    }
+    this._temporarySelectionStates.set(states)

    if (fireEvent) {
      this.changed.next(this)
@@ -308,9 +318,12 @@ export class FilterableDropdownSelectionModel {
    return this.selectionStates.get(id) || ToggleableItemState.NotSelected
  }

-  private clearDescendantSelections(id: number) {
+  private clearDescendantSelections(
+    states: Map<number, ToggleableItemState>,
+    id: number
+  ) {
    for (const descendantID of this.getDescendantIDs(id)) {
-      this.temporarySelectionStates.delete(descendantID)
+      states.delete(descendantID)
    }
  }

@@ -320,7 +333,7 @@ export class FilterableDropdownSelectionModel {

    while (queue.length) {
      const parentID = queue.shift()
-      for (const item of this._items) {
+      for (const item of this.items) {
        if (
          typeof item?.id === 'number' &&
          typeof (item as any)['parent'] === 'number' &&
@@ -336,12 +349,12 @@ export class FilterableDropdownSelectionModel {
  }

  get logicalOperator(): LogicalOperator {
-    return this.temporaryLogicalOperator
+    return this.temporaryLogicalOperator()
  }

  set logicalOperator(operator: LogicalOperator) {
-    this.temporaryLogicalOperator = operator
-    this.setNullItem()
+    this.temporaryLogicalOperator.set(operator)
+    this._items.set(this.withNullItem(this.items))
  }

  toggleOperator() {
@@ -349,12 +362,12 @@ export class FilterableDropdownSelectionModel {
  }

  get intersection(): Intersection {
-    return this.temporaryIntersection
+    return this.temporaryIntersection()
  }

  set intersection(intersection: Intersection) {
-    this.temporaryIntersection = intersection
-    this.setNullItem()
+    this.temporaryIntersection.set(intersection)
+    this._items.set(this.withNullItem(this.items))
  }

  toggleIntersection() {
@@ -364,18 +377,20 @@ export class FilterableDropdownSelectionModel {
        ? ToggleableItemState.Selected
        : ToggleableItemState.Excluded

-    this.temporarySelectionStates.forEach((state, key) => {
+    const states = new Map(this.temporarySelectionStates)
+    states.forEach((state, key) => {
      if (key === null && this.intersection === Intersection.Exclude) {
-        this.temporarySelectionStates.set(NEGATIVE_NULL_FILTER_VALUE, newState)
+        states.set(NEGATIVE_NULL_FILTER_VALUE, newState)
      } else if (
        key === NEGATIVE_NULL_FILTER_VALUE &&
        this.intersection === Intersection.Include
      ) {
-        this.temporarySelectionStates.set(null, newState)
+        states.set(null, newState)
      } else {
-        this.temporarySelectionStates.set(key, newState)
+        states.set(key, newState)
      }
    })
+    this._temporarySelectionStates.set(states)

    this.changed.next(this)
  }
@@ -395,10 +410,12 @@ export class FilterableDropdownSelectionModel {
  }

  clear(fireEvent = true) {
-    this.temporarySelectionStates.clear()
-    this.temporaryLogicalOperator = this._logicalOperator = LogicalOperator.And
-    this.temporaryIntersection = this._intersection = Intersection.Include
-    this.setNullItem()
+    this._temporarySelectionStates.set(new Map())
+    this.temporaryLogicalOperator.set(LogicalOperator.And)
+    this._logicalOperator.set(LogicalOperator.And)
+    this.temporaryIntersection.set(Intersection.Include)
+    this._intersection.set(Intersection.Include)
+    this._items.set(this.withNullItem(this.items))
    if (fireEvent) {
      this.changed.next(this)
    }
@@ -419,9 +436,9 @@ export class FilterableDropdownSelectionModel {
      )
    ) {
      return true
-    } else if (this.temporaryLogicalOperator !== this._logicalOperator) {
+    } else if (this.temporaryLogicalOperator() !== this._logicalOperator()) {
      return true
-    } else if (this.temporaryIntersection !== this._intersection) {
+    } else if (this.temporaryIntersection() !== this._intersection()) {
      return true
    } else {
      return false
@@ -438,23 +455,29 @@ export class FilterableDropdownSelectionModel {
  }

  getDocumentCount(id: number) {
-    return this._documentCounts.find((c) => c.id === id)?.document_count
+    return this._documentCounts().find((c) => c.id === id)?.document_count
  }

-  private promoteBranchesWithDocumentCounts() {
-    const parentById = this.buildParentById()
+  private promoteBranchesWithDocumentCounts(
+    items: MatchingModel[]
+  ): MatchingModel[] {
+    const parentById = this.buildParentById(items)
    const findRootId = this.createRootFinder(parentById)
-    const getRootDocCount = this.createRootDocCounter()
-    const summaries = this.buildBranchSummaries(findRootId, getRootDocCount)
+    const getRootDocCount = this.createRootDocCounter(items)
+    const summaries = this.buildBranchSummaries(
+      items,
+      findRootId,
+      getRootDocCount
+    )
    const orderedBranches = this.orderBranchesByPriority(summaries)

-    this._items = orderedBranches.flatMap((summary) => summary.items)
+    return orderedBranches.flatMap((summary) => summary.items)
  }

-  private buildParentById(): Map<number, number | null> {
+  private buildParentById(items: MatchingModel[]): Map<number, number | null> {
    const parentById = new Map<number, number | null>()

-    for (const item of this._items) {
+    for (const item of items) {
      if (typeof item?.id === 'number') {
        const parentValue = (item as any)['parent']
        parentById.set(
@@ -492,7 +515,9 @@ export class FilterableDropdownSelectionModel {
    return findRootId
  }

-  private createRootDocCounter(): (rootId: number) => number {
+  private createRootDocCounter(
+    items: MatchingModel[]
+  ): (rootId: number) => number {
    const docCountMemo = new Map<number, number>()

    return (rootId: number): number => {
@@ -507,7 +532,7 @@ export class FilterableDropdownSelectionModel {
        return explicit
      }

-      const rootItem = this._items.find((i) => i.id === rootId)
+      const rootItem = items.find((i) => i.id === rootId)
      const fallback =
        typeof (rootItem as any)?.['document_count'] === 'number'
          ? (rootItem as any)['document_count']
@@ -519,12 +544,13 @@ export class FilterableDropdownSelectionModel {
  }

  private buildBranchSummaries(
+    items: MatchingModel[],
    findRootId: (id: number) => number,
    getRootDocCount: (rootId: number) => number
  ): Map<string, BranchSummary> {
    const summaries = new Map<string, BranchSummary>()

-    for (const [index, item] of this._items.entries()) {
+    for (const [index, item] of items.entries()) {
      const { key, special, rootId } = this.describeBranchItem(
        item,
        index,
@@ -616,28 +642,23 @@ export class FilterableDropdownSelectionModel {
  }

  init(map: Map<number, ToggleableItemState>) {
-    this.temporarySelectionStates = map
+    this._temporarySelectionStates.set(new Map(map))
    this.apply()
  }

  apply() {
-    this.selectionStates.clear()
-    this.temporarySelectionStates.forEach((value, key) => {
-      this.selectionStates.set(key, value)
-    })
-    this._logicalOperator = this.temporaryLogicalOperator
-    this._intersection = this.temporaryIntersection
-    this.sortItems()
+    this._selectionStates.set(new Map(this.temporarySelectionStates))
+    this._logicalOperator.set(this.temporaryLogicalOperator())
+    this._intersection.set(this.temporaryIntersection())
+    this._items.set(this.sortItems(this.items))
  }

  reset(complete: boolean = false) {
-    this.temporarySelectionStates.clear()
    if (complete) {
-      this.selectionStates.clear()
+      this._selectionStates.set(new Map())
+      this._temporarySelectionStates.set(new Map())
    } else {
-      this.selectionStates.forEach((value, key) => {
-        this.temporarySelectionStates.set(key, value)
-      })
+      this._temporarySelectionStates.set(new Map(this.selectionStates))
    }
  }

@@ -7,7 +7,7 @@
    <div class="list-group list-group-flush">
      <button class="list-group-item list-group-item-action d-flex align-items-center p-2 border-top-0 border-start-0 border-end-0 border-bottom" role="menuitem" (click)="setFilter(OwnerFilterType.NONE)" [disabled]="disabled">
        <div class="selected-icon me-1">
-          @if (selectionModel.ownerFilter === OwnerFilterType.NONE) {
+          @if (selectionModel.ownerFilter() === OwnerFilterType.NONE) {
            <i-bs width="1em" height="1em" name="check"></i-bs>
          }
        </div>
@@ -17,7 +17,7 @@
      </button>
      <button class="list-group-item list-group-item-action d-flex align-items-center p-2 border-top-0 border-start-0 border-end-0 border-bottom" role="menuitem" (click)="setFilter(OwnerFilterType.SELF)" [disabled]="disabled">
        <div class="selected-icon me-1">
-          @if (selectionModel.ownerFilter === OwnerFilterType.SELF) {
+          @if (selectionModel.ownerFilter() === OwnerFilterType.SELF) {
            <i-bs width="1em" height="1em" name="check"></i-bs>
          }
        </div>
@@ -27,7 +27,7 @@
      </button>
      <button class="list-group-item list-group-item-action d-flex align-items-center p-2 border-top-0 border-start-0 border-end-0 border-bottom" role="menuitem" (click)="setFilter(OwnerFilterType.NOT_SELF)" [disabled]="disabled">
        <div class="selected-icon me-1">
-          @if (selectionModel.ownerFilter === OwnerFilterType.NOT_SELF) {
+          @if (selectionModel.ownerFilter() === OwnerFilterType.NOT_SELF) {
            <i-bs width="1em" height="1em" name="check"></i-bs>
          }
        </div>
@@ -37,7 +37,7 @@
      </button>
      <button class="list-group-item list-group-item-action d-flex align-items-center p-2 border-top-0 border-start-0 border-end-0 border-bottom" role="menuitem" (click)="setFilter(OwnerFilterType.SHARED_BY_ME)" [disabled]="disabled">
        <div class="selected-icon me-1">
-          @if (selectionModel.ownerFilter === OwnerFilterType.SHARED_BY_ME) {
+          @if (selectionModel.ownerFilter() === OwnerFilterType.SHARED_BY_ME) {
            <i-bs width="1em" height="1em" name="check"></i-bs>
          }
        </div>
@@ -47,7 +47,7 @@
      </button>
      <button class="list-group-item list-group-item-action d-flex align-items-center p-2 border-top-0 border-start-0 border-end-0 border-bottom" role="menuitem" (click)="setFilter(OwnerFilterType.UNOWNED)" [disabled]="disabled">
        <div class="selected-icon me-1">
-          @if (selectionModel.ownerFilter === OwnerFilterType.UNOWNED) {
+          @if (selectionModel.ownerFilter() === OwnerFilterType.UNOWNED) {
            <i-bs width="1em" height="1em" name="check"></i-bs>
          }
        </div>
@@ -57,7 +57,7 @@
      </button>
      <button *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.User }" class="list-group-item list-group-item-action d-flex align-items-center p-2 border-top-0 border-start-0 border-end-0 border-bottom" role="menuitem" [disabled]="disabled">
        <div class="selected-icon me-1">
-          @if (selectionModel.ownerFilter === OwnerFilterType.OTHERS) {
+          @if (selectionModel.ownerFilter() === OwnerFilterType.OTHERS) {
            <i-bs width="1em" height="1em" name="check"></i-bs>
          }
        </div>
@@ -65,7 +65,8 @@
          <ng-select
            name="user"
            class="user-select small"
-            [(ngModel)]="selectionModel.includeUsers"
+            [ngModel]="selectionModel.includeUsers()"
+            (ngModelChange)="selectionModel.includeUsers.set($event)"
            [disabled]="disabled"
            [clearable]="false"
            [items]="users()"
@@ -78,10 +79,10 @@
          </ng-select>
        </div>
      </button>
-      @if (selectionModel.ownerFilter === OwnerFilterType.NONE || selectionModel.ownerFilter === OwnerFilterType.NOT_SELF) {
+      @if (selectionModel.ownerFilter() === OwnerFilterType.NONE || selectionModel.ownerFilter() === OwnerFilterType.NOT_SELF) {
        <div class="list-group-item list-group-item-action d-flex align-items-center p-2 ps-3 border-bottom-0 border-start-0 border-end-0">
          <div class="form-check form-switch w-100">
-            <input type="checkbox" class="form-check-input" id="hideUnowned" [(ngModel)]="this.selectionModel.hideUnowned" (change)="onChange()" [disabled]="disabled">
+            <input type="checkbox" class="form-check-input" id="hideUnowned" [ngModel]="selectionModel.hideUnowned()" (ngModelChange)="selectionModel.hideUnowned.set($event)" (change)="onChange()" [disabled]="disabled">
            <label class="form-check-label w-100" for="hideUnowned"><small i18n>Hide unowned</small></label>
          </div>
        </div>
@@ -90,56 +90,56 @@ describe('PermissionsFilterDropdownComponent', () => {
    component.setFilter(OwnerFilterType.OTHERS)
    expect(component.isActive).toBeTruthy()
    component.setFilter(OwnerFilterType.NONE)
-    component.selectionModel.hideUnowned = true
+    component.selectionModel.hideUnowned.set(true)
    expect(component.isActive).toBeTruthy()
  })

  it('should describe concrete user filters honestly', () => {
-    component.selectionModel.ownerFilter = OwnerFilterType.SELF
-    component.selectionModel.userID = 1
+    component.selectionModel.ownerFilter.set(OwnerFilterType.SELF)
+    component.selectionModel.userID.set(1)
    expect(component.ownerFilterLabel).toEqual('Owned by user1')

-    component.selectionModel.ownerFilter = OwnerFilterType.NOT_SELF
-    component.selectionModel.excludeUsers = [1]
+    component.selectionModel.ownerFilter.set(OwnerFilterType.NOT_SELF)
+    component.selectionModel.excludeUsers.set([1])
    expect(component.ownerExclusionFilterLabel).toEqual('Not owned by user1')

-    component.selectionModel.ownerFilter = OwnerFilterType.SHARED_BY_ME
-    component.selectionModel.userID = 1
+    component.selectionModel.ownerFilter.set(OwnerFilterType.SHARED_BY_ME)
+    component.selectionModel.userID.set(1)
    expect(component.sharedByFilterLabel).toEqual('Shared by user1')
  })

  it('should describe concrete filters when usernames are unavailable', () => {
-    component.selectionModel.ownerFilter = OwnerFilterType.SELF
-    component.selectionModel.userID = 99
+    component.selectionModel.ownerFilter.set(OwnerFilterType.SELF)
+    component.selectionModel.userID.set(99)
    expect(component.ownerFilterLabel).toEqual('Owned by another user')

-    component.selectionModel.ownerFilter = OwnerFilterType.NOT_SELF
-    component.selectionModel.excludeUsers = [99]
+    component.selectionModel.ownerFilter.set(OwnerFilterType.NOT_SELF)
+    component.selectionModel.excludeUsers.set([99])
    expect(component.ownerExclusionFilterLabel).toEqual(
      'Not owned by another user'
    )

-    component.selectionModel.excludeUsers = [98, 99]
+    component.selectionModel.excludeUsers.set([98, 99])
    expect(component.ownerExclusionFilterLabel).toEqual(
      'Not owned by selected users'
    )

-    component.selectionModel.ownerFilter = OwnerFilterType.SHARED_BY_ME
-    component.selectionModel.userID = 99
+    component.selectionModel.ownerFilter.set(OwnerFilterType.SHARED_BY_ME)
+    component.selectionModel.userID.set(99)
    expect(component.sharedByFilterLabel).toEqual('Shared by another user')
  })

  it('should retain relative labels for filters bound to the current user', () => {
-    component.selectionModel.userID = currentUserID
+    component.selectionModel.userID.set(currentUserID)
    expect(component.ownerFilterLabel).toEqual('My documents')
    expect(component.sharedByFilterLabel).toEqual('Shared by me')

-    component.selectionModel.excludeUsers = [currentUserID]
+    component.selectionModel.excludeUsers.set([currentUserID])
    expect(component.ownerExclusionFilterLabel).toEqual('Shared with me')
  })

  it('should retain relative labels for inactive filter choices', () => {
-    component.selectionModel.ownerFilter = OwnerFilterType.NONE
+    component.selectionModel.ownerFilter.set(OwnerFilterType.NONE)

    expect(component.ownerFilterLabel).toEqual('My documents')
    expect(component.ownerExclusionFilterLabel).toEqual('Shared with me')
@@ -148,32 +148,41 @@ describe('PermissionsFilterDropdownComponent', () => {

  it('should support reset', () => {
    component.setFilter(OwnerFilterType.OTHERS)
-    expect(component.selectionModel.ownerFilter).not.toEqual(
+    expect(component.selectionModel.ownerFilter()).not.toEqual(
      OwnerFilterType.NONE
    )
    component.reset()
-    expect(component.selectionModel.ownerFilter).toEqual(OwnerFilterType.NONE)
+    expect(component.selectionModel.ownerFilter()).toEqual(OwnerFilterType.NONE)
  })

  it('should toggle owner filter type when users selected', () => {
-    component.selectionModel.ownerFilter = OwnerFilterType.NONE
+    component.selectionModel.ownerFilter.set(OwnerFilterType.NONE)

    // this would normally be done by select component
-    component.selectionModel.includeUsers = [12]
+    component.selectionModel.includeUsers.set([12])
    component.onUserSelect()
-    expect(component.selectionModel.ownerFilter).toEqual(OwnerFilterType.OTHERS)
+    expect(component.selectionModel.ownerFilter()).toEqual(
+      OwnerFilterType.OTHERS
+    )

    // this would normally be done by select component
-    component.selectionModel.includeUsers = null
+    component.selectionModel.includeUsers.set(null)
    component.onUserSelect()

-    expect(component.selectionModel.ownerFilter).toEqual(OwnerFilterType.NONE)
+    expect(component.selectionModel.ownerFilter()).toEqual(OwnerFilterType.NONE)
  })
  it('should emit a selection model depending on the type of owner filter set', () => {
-    component.selectionModel.ownerFilter = OwnerFilterType.NONE
+    const emitted = () => ({
+      excludeUsers: ownerFilterSetResult.excludeUsers(),
+      hideUnowned: ownerFilterSetResult.hideUnowned(),
+      includeUsers: ownerFilterSetResult.includeUsers(),
+      ownerFilter: ownerFilterSetResult.ownerFilter(),
+      userID: ownerFilterSetResult.userID(),
+    })
+    component.selectionModel.ownerFilter.set(OwnerFilterType.NONE)

    component.setFilter(OwnerFilterType.SELF)
-    expect(ownerFilterSetResult).toEqual({
+    expect(emitted()).toEqual({
      excludeUsers: [],
      hideUnowned: false,
      includeUsers: [],
@@ -182,7 +191,7 @@ describe('PermissionsFilterDropdownComponent', () => {
    })

    component.setFilter(OwnerFilterType.NOT_SELF)
-    expect(ownerFilterSetResult).toEqual({
+    expect(emitted()).toEqual({
      excludeUsers: [currentUserID],
      hideUnowned: false,
      includeUsers: [],
@@ -191,7 +200,7 @@ describe('PermissionsFilterDropdownComponent', () => {
    })

    component.setFilter(OwnerFilterType.NONE)
-    expect(ownerFilterSetResult).toEqual({
+    expect(emitted()).toEqual({
      excludeUsers: [],
      hideUnowned: false,
      includeUsers: [],
@@ -200,7 +209,7 @@ describe('PermissionsFilterDropdownComponent', () => {
    })

    component.setFilter(OwnerFilterType.SHARED_BY_ME)
-    expect(ownerFilterSetResult).toEqual({
+    expect(emitted()).toEqual({
      excludeUsers: [],
      hideUnowned: false,
      includeUsers: [],
@@ -209,7 +218,7 @@ describe('PermissionsFilterDropdownComponent', () => {
    })

    component.setFilter(OwnerFilterType.UNOWNED)
-    expect(ownerFilterSetResult).toEqual({
+    expect(emitted()).toEqual({
      excludeUsers: [],
      hideUnowned: false,
      includeUsers: [],
@@ -25,18 +25,18 @@ import { ComponentWithPermissions } from '../../with-permissions/with-permission
 import { ClearableBadgeComponent } from '../clearable-badge/clearable-badge.component'

 export class PermissionsSelectionModel {
-  ownerFilter: OwnerFilterType
-  hideUnowned: boolean
-  userID: number
-  includeUsers: number[]
-  excludeUsers: number[]
+  readonly ownerFilter = signal(OwnerFilterType.NONE)
+  readonly hideUnowned = signal(false)
+  readonly userID = signal<number>(null)
+  readonly includeUsers = signal<number[]>([])
+  readonly excludeUsers = signal<number[]>([])

  clear() {
-    this.ownerFilter = OwnerFilterType.NONE
-    this.userID = null
-    this.hideUnowned = false
-    this.includeUsers = []
-    this.excludeUsers = []
+    this.ownerFilter.set(OwnerFilterType.NONE)
+    this.userID.set(null)
+    this.hideUnowned.set(false)
+    this.includeUsers.set([])
+    this.excludeUsers.set([])
  }
 }

@@ -84,33 +84,31 @@ export class PermissionsFilterDropdownComponent extends ComponentWithPermissions

  readonly users = signal<User[]>([])

-  hideUnowned: boolean
-
  get isActive(): boolean {
    return (
-      this.selectionModel.ownerFilter !== OwnerFilterType.NONE ||
-      this.selectionModel.hideUnowned
+      this.selectionModel.ownerFilter() !== OwnerFilterType.NONE ||
+      this.selectionModel.hideUnowned()
    )
  }

  get ownerFilterLabel(): string {
    if (
-      this.selectionModel?.ownerFilter !== OwnerFilterType.SELF ||
-      this.selectionModel?.userID === this.settingsService.currentUser()?.id
+      this.selectionModel?.ownerFilter() !== OwnerFilterType.SELF ||
+      this.selectionModel?.userID() === this.settingsService.currentUser()?.id
    ) {
      return $localize`My documents`
    }

-    const username = this.getUsername(this.selectionModel?.userID)
+    const username = this.getUsername(this.selectionModel?.userID())
    return username
      ? $localize`Owned by ${username}`
      : $localize`Owned by another user`
  }

  get ownerExclusionFilterLabel(): string {
-    const excludedUsers = this.selectionModel?.excludeUsers ?? []
+    const excludedUsers = this.selectionModel?.excludeUsers() ?? []
    if (
-      this.selectionModel?.ownerFilter !== OwnerFilterType.NOT_SELF ||
+      this.selectionModel?.ownerFilter() !== OwnerFilterType.NOT_SELF ||
      (excludedUsers.length === 1 &&
        excludedUsers[0] === this.settingsService.currentUser()?.id)
    ) {
@@ -130,13 +128,13 @@ export class PermissionsFilterDropdownComponent extends ComponentWithPermissions

  get sharedByFilterLabel(): string {
    if (
-      this.selectionModel?.ownerFilter !== OwnerFilterType.SHARED_BY_ME ||
-      this.selectionModel?.userID === this.settingsService.currentUser()?.id
+      this.selectionModel?.ownerFilter() !== OwnerFilterType.SHARED_BY_ME ||
+      this.selectionModel?.userID() === this.settingsService.currentUser()?.id
    ) {
      return $localize`Shared by me`
    }

-    const username = this.getUsername(this.selectionModel?.userID)
+    const username = this.getUsername(this.selectionModel?.userID())
    return username
      ? $localize`Shared by ${username}`
      : $localize`Shared by another user`
@@ -169,34 +167,36 @@ export class PermissionsFilterDropdownComponent extends ComponentWithPermissions
  }

  setFilter(type: OwnerFilterType) {
-    this.selectionModel.ownerFilter = type
-    if (this.selectionModel.ownerFilter === OwnerFilterType.SELF) {
-      this.selectionModel.includeUsers = []
-      this.selectionModel.excludeUsers = []
-      this.selectionModel.userID = this.settingsService.currentUser().id
-      this.selectionModel.hideUnowned = false
-    } else if (this.selectionModel.ownerFilter === OwnerFilterType.NOT_SELF) {
-      this.selectionModel.userID = null
-      this.selectionModel.includeUsers = []
-      this.selectionModel.excludeUsers = [this.settingsService.currentUser().id]
-      this.selectionModel.hideUnowned = false
-    } else if (this.selectionModel.ownerFilter === OwnerFilterType.NONE) {
-      this.selectionModel.userID = null
-      this.selectionModel.includeUsers = []
-      this.selectionModel.excludeUsers = []
-      this.selectionModel.hideUnowned = false
+    this.selectionModel.ownerFilter.set(type)
+    if (this.selectionModel.ownerFilter() === OwnerFilterType.SELF) {
+      this.selectionModel.includeUsers.set([])
+      this.selectionModel.excludeUsers.set([])
+      this.selectionModel.userID.set(this.settingsService.currentUser().id)
+      this.selectionModel.hideUnowned.set(false)
+    } else if (this.selectionModel.ownerFilter() === OwnerFilterType.NOT_SELF) {
+      this.selectionModel.userID.set(null)
+      this.selectionModel.includeUsers.set([])
+      this.selectionModel.excludeUsers.set([
+        this.settingsService.currentUser().id,
+      ])
+      this.selectionModel.hideUnowned.set(false)
+    } else if (this.selectionModel.ownerFilter() === OwnerFilterType.NONE) {
+      this.selectionModel.userID.set(null)
+      this.selectionModel.includeUsers.set([])
+      this.selectionModel.excludeUsers.set([])
+      this.selectionModel.hideUnowned.set(false)
    } else if (
-      this.selectionModel.ownerFilter === OwnerFilterType.SHARED_BY_ME
+      this.selectionModel.ownerFilter() === OwnerFilterType.SHARED_BY_ME
    ) {
-      this.selectionModel.userID = this.settingsService.currentUser()?.id
-      this.selectionModel.includeUsers = []
-      this.selectionModel.excludeUsers = []
-      this.selectionModel.hideUnowned = false
-    } else if (this.selectionModel.ownerFilter === OwnerFilterType.UNOWNED) {
-      this.selectionModel.userID = null
-      this.selectionModel.includeUsers = []
-      this.selectionModel.excludeUsers = []
-      this.selectionModel.hideUnowned = false
+      this.selectionModel.userID.set(this.settingsService.currentUser()?.id)
+      this.selectionModel.includeUsers.set([])
+      this.selectionModel.excludeUsers.set([])
+      this.selectionModel.hideUnowned.set(false)
+    } else if (this.selectionModel.ownerFilter() === OwnerFilterType.UNOWNED) {
+      this.selectionModel.userID.set(null)
+      this.selectionModel.includeUsers.set([])
+      this.selectionModel.excludeUsers.set([])
+      this.selectionModel.hideUnowned.set(false)
    }
    this.onChange()
  }
@@ -206,11 +206,11 @@ export class PermissionsFilterDropdownComponent extends ComponentWithPermissions
  }

  onUserSelect() {
-    if (this.selectionModel.includeUsers?.length) {
-      this.selectionModel.ownerFilter = OwnerFilterType.OTHERS
-    } else {
-      this.selectionModel.ownerFilter = OwnerFilterType.NONE
-    }
+    this.selectionModel.ownerFilter.set(
+      this.selectionModel.includeUsers()?.length
+        ? OwnerFilterType.OTHERS
+        : OwnerFilterType.NONE
+    )
    this.onChange()
  }

@@ -1209,24 +1209,53 @@ describe('DocumentDetailComponent', () => {
    expect(fixture.debugElement.queryAll(By.css('textarea.rtl'))).not.toBeNull()
  })

-  it('should display built-in pdf viewer if not disabled', () => {
+  it('should display built-in pdf viewer if not disabled', async () => {
    initNormally()
-    component.document().archived_file_name = 'file.pdf'
+    component.document.update((document) => ({
+      ...document,
+      archived_file_name: 'file.pdf',
+    }))
    settingsService.set(SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER, false)
    expect(component.useNativePdfViewer).toBeFalsy()
-    fixture.detectChanges()
+    await fixture.whenStable()
    expect(fixture.debugElement.query(By.css('pngx-pdf-viewer'))).not.toBeNull()
  })

  it('should display native pdf viewer if enabled', () => {
    initNormally()
-    component.document().archived_file_name = 'file.pdf'
+    component.document.update((document) => ({
+      ...document,
+      archived_file_name: 'file.pdf',
+    }))
    settingsService.set(SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER, true)
    expect(component.useNativePdfViewer).toBeTruthy()
    fixture.detectChanges()
    expect(fixture.debugElement.query(By.css('object'))).not.toBeNull()
  })

+  it('should reflect signal-backed document detail display settings', () => {
+    settingsService.set(SETTINGS_KEYS.DOCUMENT_EDITING_OVERLAY_THUMBNAIL, false)
+    settingsService.set(SETTINGS_KEYS.DOCUMENT_DETAILS_HIDDEN_FIELDS, [
+      component.DocumentDetailFieldID.Correspondent,
+    ])
+
+    expect(component.showThumbnailOverlay).toBeFalsy()
+    expect(
+      component.isFieldHidden(component.DocumentDetailFieldID.Correspondent)
+    ).toBeTruthy()
+    expect(
+      component.isFieldHidden(component.DocumentDetailFieldID.DocumentType)
+    ).toBeFalsy()
+
+    settingsService.set(SETTINGS_KEYS.DOCUMENT_EDITING_OVERLAY_THUMBNAIL, true)
+    settingsService.set(SETTINGS_KEYS.DOCUMENT_DETAILS_HIDDEN_FIELDS, [])
+
+    expect(component.showThumbnailOverlay).toBeTruthy()
+    expect(
+      component.isFieldHidden(component.DocumentDetailFieldID.Correspondent)
+    ).toBeFalsy()
+  })
+
  it('should attempt to retrieve metadata', () => {
    const metadataSpy = jest.spyOn(documentService, 'getMetadata')
    metadataSpy.mockReturnValue(of({ has_archive_version: true }))
@@ -1685,7 +1714,10 @@ describe('DocumentDetailComponent', () => {

  it('should change preview element by render type', () => {
    initNormally()
-    component.document().archived_file_name = 'file.pdf'
+    component.document.update((document) => ({
+      ...document,
+      archived_file_name: 'file.pdf',
+    }))
    fixture.detectChanges()
    expect(component.archiveContentRenderType).toEqual(
      component.ContentRenderType.PDF
@@ -1694,8 +1726,11 @@ describe('DocumentDetailComponent', () => {
      fixture.debugElement.query(By.css('pdf-viewer-container'))
    ).not.toBeUndefined()

-    component.document().archived_file_name = undefined
-    component.document().mime_type = 'text/plain'
+    component.document.update((document) => ({
+      ...document,
+      archived_file_name: undefined,
+      mime_type: 'text/plain',
+    }))
    fixture.detectChanges()
    expect(component.archiveContentRenderType).toEqual(
      component.ContentRenderType.Text
@@ -1704,7 +1739,10 @@ describe('DocumentDetailComponent', () => {
      fixture.debugElement.query(By.css('div.preview-sticky'))
    ).not.toBeUndefined()

-    component.document().mime_type = 'image/jpeg'
+    component.document.update((document) => ({
+      ...document,
+      mime_type: 'image/jpeg',
+    }))
    fixture.detectChanges()
    expect(component.archiveContentRenderType).toEqual(
      component.ContentRenderType.Image
@@ -1712,9 +1750,12 @@ describe('DocumentDetailComponent', () => {
    expect(
      fixture.debugElement.query(By.css('.preview-sticky img'))
    ).not.toBeUndefined()
-    ;((component.document().mime_type =
-      'application/vnd.openxmlformats-officedocument.wordprocessingml.document'),
-      fixture.detectChanges())
+    component.document.update((document) => ({
+      ...document,
+      mime_type:
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    }))
+    fixture.detectChanges()
    expect(component.archiveContentRenderType).toEqual(
      component.ContentRenderType.Other
    )
@@ -227,6 +227,19 @@ export class DocumentDetailComponent
  private deviceDetectorService = inject(DeviceDetectorService)
  private savedViewService = inject(SavedViewService)
  private readonly websocketStatusService = inject(WebsocketStatusService)
+  private readonly useNativePdfViewerSetting = this.settings.getSignal<boolean>(
+    SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER
+  )
+  private readonly aiEnabledSetting = this.settings.getSignal<boolean>(
+    SETTINGS_KEYS.AI_ENABLED
+  )
+  private readonly showThumbnailOverlaySetting =
+    this.settings.getSignal<boolean>(
+      SETTINGS_KEYS.DOCUMENT_EDITING_OVERLAY_THUMBNAIL
+    )
+  private readonly hiddenFieldsSetting = this.settings.getSignal<
+    DocumentDetailFieldID[]
+  >(SETTINGS_KEYS.DOCUMENT_DETAILS_HIDDEN_FIELDS)

  @ViewChild('inputTitle')
  titleInput: TextComponent
@@ -333,8 +346,7 @@ export class DocumentDetailComponent
  }

  get useNativePdfViewer(): boolean {
-    this.settings.trackChanges()
-    return this.settings.get(SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER)
+    return this.useNativePdfViewerSetting()
  }

  get isMobile(): boolean {
@@ -342,12 +354,10 @@ export class DocumentDetailComponent
  }

  get aiEnabled(): boolean {
-    this.settings.trackChanges()
-    return this.settings.get(SETTINGS_KEYS.AI_ENABLED)
+    return this.aiEnabledSetting()
  }

  get archiveContentRenderType(): ContentRenderType {
-    this.settings.trackChanges()
    const hasArchiveVersion =
      this.metadata()?.has_archive_version ??
      !!this.document()?.archived_file_name
@@ -359,22 +369,17 @@ export class DocumentDetailComponent
  }

  get originalContentRenderType(): ContentRenderType {
-    this.settings.trackChanges()
    return this.getRenderType(
      this.metadata()?.original_mime_type || this.document()?.mime_type
    )
  }

  get showThumbnailOverlay(): boolean {
-    this.settings.trackChanges()
-    return this.settings.get(SETTINGS_KEYS.DOCUMENT_EDITING_OVERLAY_THUMBNAIL)
+    return this.showThumbnailOverlaySetting()
  }

  isFieldHidden(fieldId: DocumentDetailFieldID): boolean {
-    this.settings.trackChanges()
-    return this.settings
-      .get(SETTINGS_KEYS.DOCUMENT_DETAILS_HIDDEN_FIELDS)
-      .includes(fieldId)
+    return this.hiddenFieldsSetting().includes(fieldId)
  }

  private getRenderType(mimeType: string): ContentRenderType {
@@ -121,6 +121,8 @@ export class DocumentListComponent
  settingsService = inject(SettingsService)
  private hotKeyService = inject(HotKeyService)
  permissionService = inject(PermissionsService)
+  private readonly notesEnabledSetting =
+    this.settingsService.getSignal<boolean>(SETTINGS_KEYS.NOTES_ENABLED)

  DisplayField = DisplayField
  DisplayMode = DisplayMode
@@ -574,8 +576,7 @@ export class DocumentListComponent
  }

  get notesEnabled(): boolean {
-    this.settingsService.trackChanges()
-    return this.settingsService.get(SETTINGS_KEYS.NOTES_ENABLED)
+    return this.notesEnabledSetting()
  }

  resetFilters() {
@@ -621,6 +621,43 @@ describe('FilterEditorComponent', () => {
    component.toggleTag(2) // coverage
  })

+  it('should reflect ingested tag filter rules in the dropdown toggle', () => {
+    const dropdown = fixture.debugElement.query(
+      By.css('pngx-filterable-dropdown')
+    )
+    const toggle = dropdown.nativeElement.querySelector('#dropdown_tags')
+    expect(toggle.classList.contains('btn-primary')).toBeFalsy()
+    expect(
+      dropdown.nativeElement.querySelector('pngx-clearable-badge')
+    ).toBeNull()
+
+    // switching to a view with a tag filter
+    component.filterRules = [
+      {
+        rule_type: FILTER_HAS_TAGS_ALL,
+        value: '2',
+      },
+    ]
+    fixture.detectChanges()
+    expect(toggle.classList.contains('btn-primary')).toBeTruthy()
+    expect(
+      dropdown.nativeElement.querySelector('pngx-clearable-badge')
+    ).not.toBeNull()
+
+    // and back to a view without one
+    component.filterRules = [
+      {
+        rule_type: FILTER_HAS_CORRESPONDENT_ANY,
+        value: '12',
+      },
+    ]
+    fixture.detectChanges()
+    expect(toggle.classList.contains('btn-primary')).toBeFalsy()
+    expect(
+      dropdown.nativeElement.querySelector('pngx-clearable-badge')
+    ).toBeNull()
+  })
+
  it('should ingest filter rules for has any tags', () => {
    expect(component.tagSelectionModel.getSelectedItems()).toHaveLength(0)
    component.filterRules = [
@@ -1078,7 +1115,7 @@ describe('FilterEditorComponent', () => {
  })

  it('should ingest filter rules for owner', () => {
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.NONE
    )
    component.filterRules = [
@@ -1087,15 +1124,38 @@ describe('FilterEditorComponent', () => {
        value: '100',
      },
    ]
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.SELF
    )
-    expect(component.permissionsSelectionModel.hideUnowned).toBeFalsy()
-    expect(component.permissionsSelectionModel.userID).toEqual(100)
+    expect(component.permissionsSelectionModel.hideUnowned()).toBeFalsy()
+    expect(component.permissionsSelectionModel.userID()).toEqual(100)
+  })
+
+  it('should reflect ingested owner filter rules in the dropdown toggle', () => {
+    const dropdown = fixture.debugElement.query(
+      By.css('pngx-permissions-filter-dropdown')
+    )
+    const toggle = dropdown.nativeElement.querySelector('button')
+    expect(toggle.classList.contains('btn-primary')).toBeFalsy()
+
+    // switching to a view with an owner filter
+    component.filterRules = [
+      {
+        rule_type: FILTER_OWNER,
+        value: '100',
+      },
+    ]
+    fixture.detectChanges()
+    expect(toggle.classList.contains('btn-primary')).toBeTruthy()
+
+    // and back to a view without one
+    component.filterRules = []
+    fixture.detectChanges()
+    expect(toggle.classList.contains('btn-primary')).toBeFalsy()
  })

  it('should ingest filter rules for owner is others', () => {
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.NONE
    )
    component.filterRules = [
@@ -1104,14 +1164,14 @@ describe('FilterEditorComponent', () => {
        value: '50',
      },
    ]
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.OTHERS
    )
-    expect(component.permissionsSelectionModel.includeUsers).toContain(50)
+    expect(component.permissionsSelectionModel.includeUsers()).toContain(50)
  })

  it('should ingest filter rules for owner does not include others', () => {
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.NONE
    )
    component.filterRules = [
@@ -1120,14 +1180,14 @@ describe('FilterEditorComponent', () => {
        value: '50',
      },
    ]
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.NOT_SELF
    )
-    expect(component.permissionsSelectionModel.excludeUsers).toContain(50)
+    expect(component.permissionsSelectionModel.excludeUsers()).toContain(50)
  })

  it('should ingest filter rules for owner is null', () => {
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.NONE
    )
    component.filterRules = [
@@ -1136,10 +1196,10 @@ describe('FilterEditorComponent', () => {
        value: 'true',
      },
    ]
-    expect(component.permissionsSelectionModel.ownerFilter).toEqual(
+    expect(component.permissionsSelectionModel.ownerFilter()).toEqual(
      OwnerFilterType.UNOWNED
    )
-    expect(component.permissionsSelectionModel.hideUnowned).toBeFalsy()
+    expect(component.permissionsSelectionModel.hideUnowned()).toBeFalsy()
  })

  it('should ingest filter rules for owner is not null', () => {
@@ -1149,14 +1209,14 @@ describe('FilterEditorComponent', () => {
        value: 'false',
      },
    ]
-    expect(component.permissionsSelectionModel.hideUnowned).toBeTruthy()
+    expect(component.permissionsSelectionModel.hideUnowned()).toBeTruthy()
    component.filterRules = [
      {
        rule_type: FILTER_OWNER_ISNULL,
        value: '0',
      },
    ]
-    expect(component.permissionsSelectionModel.hideUnowned).toBeTruthy()
+    expect(component.permissionsSelectionModel.hideUnowned()).toBeTruthy()
  })

  it('should ingest filter rules for shared by me', () => {
@@ -1166,7 +1226,7 @@ describe('FilterEditorComponent', () => {
        value: '2',
      },
    ]
-    expect(component.permissionsSelectionModel.userID).toEqual(2)
+    expect(component.permissionsSelectionModel.userID()).toEqual(2)
  })

  // GET filterRules
@@ -1932,7 +1992,10 @@ describe('FilterEditorComponent', () => {
        value: '1',
      },
    ])
-    component.permissionsSelectionModel.excludeUsers.push(2)
+    component.permissionsSelectionModel.excludeUsers.update((users) => [
+      ...users,
+      2,
+    ])
    fixture.detectChanges()
    expect(component.filterRules).toEqual([
      {
@@ -1982,8 +2045,11 @@ describe('FilterEditorComponent', () => {
    // TODO: mock input in code
    // userSelect.query(By.css('input')).nativeElement.value = '3'
    // userSelect.triggerEventHandler('change')
-    component.permissionsSelectionModel.ownerFilter = OwnerFilterType.OTHERS
-    component.permissionsSelectionModel.includeUsers.push(3)
+    component.permissionsSelectionModel.ownerFilter.set(OwnerFilterType.OTHERS)
+    component.permissionsSelectionModel.includeUsers.update((users) => [
+      ...users,
+      3,
+    ])
    fixture.detectChanges()
    expect(component.filterRules).toEqual([
      {
@@ -2003,7 +2069,7 @@ describe('FilterEditorComponent', () => {
    ownerToggle.nativeElement.checked = true
    // ownerToggle.triggerEventHandler('change')
    // TODO: ngModel isn't doing this here
-    component.permissionsSelectionModel.hideUnowned = true
+    component.permissionsSelectionModel.hideUnowned.set(true)
    fixture.detectChanges()
    expect(component.filterRules).toEqual([
      {
@@ -735,38 +735,50 @@ export class FilterEditorComponent
          this._textFilter = rule.value
          break
        case FILTER_OWNER:
-          this.permissionsSelectionModel.ownerFilter = OwnerFilterType.SELF
-          this.permissionsSelectionModel.hideUnowned = false
+          this.permissionsSelectionModel.ownerFilter.set(OwnerFilterType.SELF)
+          this.permissionsSelectionModel.hideUnowned.set(false)
          if (rule.value)
-            this.permissionsSelectionModel.userID = parseInt(rule.value, 10)
+            this.permissionsSelectionModel.userID.set(
+              Number.parseInt(rule.value, 10)
+            )
          break
        case FILTER_OWNER_ANY:
-          this.permissionsSelectionModel.ownerFilter = OwnerFilterType.OTHERS
+          this.permissionsSelectionModel.ownerFilter.set(OwnerFilterType.OTHERS)
          if (rule.value)
-            this.permissionsSelectionModel.includeUsers.push(
-              parseInt(rule.value, 10)
-            )
+            this.permissionsSelectionModel.includeUsers.update((users) => [
+              ...users,
+              Number.parseInt(rule.value, 10),
+            ])
          break
        case FILTER_OWNER_DOES_NOT_INCLUDE:
-          this.permissionsSelectionModel.ownerFilter = OwnerFilterType.NOT_SELF
-          if (rule.value)
-            this.permissionsSelectionModel.excludeUsers.push(
-              parseInt(rule.value, 10)
+          this.permissionsSelectionModel.ownerFilter.set(
+            OwnerFilterType.NOT_SELF
          )
+          if (rule.value)
+            this.permissionsSelectionModel.excludeUsers.update((users) => [
+              ...users,
+              Number.parseInt(rule.value, 10),
+            ])
          break
        case FILTER_SHARED_BY_USER:
-          this.permissionsSelectionModel.ownerFilter =
+          this.permissionsSelectionModel.ownerFilter.set(
            OwnerFilterType.SHARED_BY_ME
+          )
          if (rule.value)
-            this.permissionsSelectionModel.userID = parseInt(rule.value, 10)
+            this.permissionsSelectionModel.userID.set(
+              Number.parseInt(rule.value, 10)
+            )
          break
        case FILTER_OWNER_ISNULL:
          if (rule.value === 'true' || rule.value === '1') {
-            this.permissionsSelectionModel.hideUnowned = false
-            this.permissionsSelectionModel.ownerFilter = OwnerFilterType.UNOWNED
+            this.permissionsSelectionModel.hideUnowned.set(false)
+            this.permissionsSelectionModel.ownerFilter.set(
+              OwnerFilterType.UNOWNED
+            )
          } else {
-            this.permissionsSelectionModel.hideUnowned =
+            this.permissionsSelectionModel.hideUnowned.set(
              rule.value === 'false' || rule.value === '0'
+            )
            break
          }
      }
@@ -1074,34 +1086,35 @@ export class FilterEditorComponent
        })
      }
    }
-    if (this.permissionsSelectionModel.ownerFilter == OwnerFilterType.SELF) {
+    if (this.permissionsSelectionModel.ownerFilter() == OwnerFilterType.SELF) {
      filterRules.push({
        rule_type: FILTER_OWNER,
-        value: this.permissionsSelectionModel.userID.toString(),
+        value: this.permissionsSelectionModel.userID().toString(),
      })
    } else if (
-      this.permissionsSelectionModel.ownerFilter == OwnerFilterType.NOT_SELF
+      this.permissionsSelectionModel.ownerFilter() == OwnerFilterType.NOT_SELF
    ) {
      filterRules.push({
        rule_type: FILTER_OWNER_DOES_NOT_INCLUDE,
-        value: this.permissionsSelectionModel.excludeUsers?.join(','),
+        value: this.permissionsSelectionModel.excludeUsers()?.join(','),
      })
    } else if (
-      this.permissionsSelectionModel.ownerFilter == OwnerFilterType.OTHERS
+      this.permissionsSelectionModel.ownerFilter() == OwnerFilterType.OTHERS
    ) {
      filterRules.push({
        rule_type: FILTER_OWNER_ANY,
-        value: this.permissionsSelectionModel.includeUsers?.join(','),
+        value: this.permissionsSelectionModel.includeUsers()?.join(','),
      })
    } else if (
-      this.permissionsSelectionModel.ownerFilter == OwnerFilterType.SHARED_BY_ME
+      this.permissionsSelectionModel.ownerFilter() ==
+      OwnerFilterType.SHARED_BY_ME
    ) {
      filterRules.push({
        rule_type: FILTER_SHARED_BY_USER,
-        value: this.permissionsSelectionModel.userID.toString(),
+        value: this.permissionsSelectionModel.userID().toString(),
      })
    } else if (
-      this.permissionsSelectionModel.ownerFilter == OwnerFilterType.UNOWNED
+      this.permissionsSelectionModel.ownerFilter() == OwnerFilterType.UNOWNED
    ) {
      filterRules.push({
        rule_type: FILTER_OWNER_ISNULL,
@@ -1109,7 +1122,7 @@ export class FilterEditorComponent
      })
    }

-    if (this.permissionsSelectionModel.hideUnowned) {
+    if (this.permissionsSelectionModel.hideUnowned()) {
      filterRules.push({
        rule_type: FILTER_OWNER_ISNULL,
        value: 'false',
@@ -210,6 +210,48 @@ describe('SettingsService', () => {
    expect(settingsService.get(SETTINGS_KEYS.THEME_COLOR)).toEqual('#000000')
  })

+  it('provides stable signals that update when settings change', () => {
+    const req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}ui_settings/`
+    )
+    req.flush(ui_settings)
+
+    const notesEnabled = settingsService.getSignal<boolean>(
+      SETTINGS_KEYS.NOTES_ENABLED
+    )
+
+    expect(notesEnabled()).toBeTruthy()
+    expect(
+      settingsService.getSignal<boolean>(SETTINGS_KEYS.NOTES_ENABLED)
+    ).toBe(notesEnabled)
+
+    settingsService.set(SETTINGS_KEYS.NOTES_ENABLED, false)
+
+    expect(notesEnabled()).toBeFalsy()
+  })
+
+  it('updates setting signals when settings are reinitialized', () => {
+    let req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}ui_settings/`
+    )
+    req.flush(ui_settings)
+    const appTitle = settingsService.getSignal<string>(SETTINGS_KEYS.APP_TITLE)
+
+    settingsService.initializeSettings().subscribe()
+    req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}ui_settings/`
+    )
+    req.flush({
+      ...ui_settings,
+      settings: {
+        ...ui_settings.settings,
+        app_title: 'Updated title',
+      },
+    })
+
+    expect(appTitle()).toBe('Updated title')
+  })
+
  it('sets django cookie for languages', () => {
    httpTestingController
      .expectOne(`${environment.apiBaseUrl}ui_settings/`)
@@ -2,6 +2,8 @@ import { HttpClient } from '@angular/common/http'
 import {
  DOCUMENT,
  EventEmitter,
+  Signal,
+  computed,
  inject,
  Injectable,
  LOCALE_ID,
@@ -297,6 +299,7 @@ export class SettingsService {

  private settings: Record<string, any> = {}
  private readonly settingsVersion = signal(0)
+  private readonly settingSignals = new Map<string, Signal<unknown>>()
  readonly currentUser = signal<User>(undefined)

  public settingsSaved: EventEmitter<any> = new EventEmitter()
@@ -326,10 +329,6 @@ export class SettingsService {
    return !UNSAFE_OBJECT_KEYS.has(key)
  }

-  public trackChanges(): void {
-    this.settingsVersion()
-  }
-
  private assignSafeSettings(source: Record<string, any>) {
    if (!source || typeof source !== 'object' || Array.isArray(source)) {
      return
@@ -339,6 +338,7 @@ export class SettingsService {
      if (!this.isSafeObjectKey(key)) continue
      this.settings[key] = source[key]
    }
+    this.settingsVersion.update((version) => version + 1)
  }

  // this is called by the app initializer in app.module
@@ -594,6 +594,18 @@ export class SettingsService {
    }
  }

+  getSignal<T = any>(key: string): Signal<T> {
+    let settingSignal = this.settingSignals.get(key)
+    if (!settingSignal) {
+      settingSignal = computed(() => {
+        this.settingsVersion()
+        return this.get(key)
+      })
+      this.settingSignals.set(key, settingSignal)
+    }
+    return settingSignal as Signal<T>
+  }
+
  set(key: string, value: any) {
    // parse key:key:key into nested object
    let settingObj = this.settings
@@ -314,7 +314,7 @@ def _consume_file(
    consumption_dir: Path,
    *,
    subdirs_as_tags: bool,
-) -> None:
+) -> bool:
    """
    Queue a file for consumption.

@@ -322,15 +322,20 @@ def _consume_file(
        filepath: Path to the file to consume.
        consumption_dir: Base consumption directory.
        subdirs_as_tags: Whether to create tags from subdirectory names.
+
+    Returns:
+        True if the file was successfully handed to Celery, False otherwise.
+        Callers must not record the file as queued on failure, or the rescan
+        will never retry it.
    """
    # Verify file still exists and is accessible
    try:
        if not filepath.is_file():
            logger.debug(f"Not consuming {filepath}: not a file or doesn't exist")
-            return
+            return False
    except OSError as e:
        logger.warning(f"Not consuming {filepath}: {e}")
-        return
+        return False

    # Get tags from path if configured
    tag_ids: list[int] | None = None
@@ -355,6 +360,9 @@ def _consume_file(
        )
    except Exception:
        logger.exception(f"Error while queuing document {filepath}")
+        return False
+
+    return True


 class Command(BaseCommand):
@@ -492,11 +500,11 @@ class Command(BaseCommand):
            if not consumer_filter(Change.added, str(filepath)):
                continue

-            _consume_file(
+            if _consume_file(
                filepath=filepath,
                consumption_dir=directory,
                subdirs_as_tags=subdirs_as_tags,
-            )
+            ):
                queued.add(filepath.resolve())

        return queued
@@ -651,13 +659,15 @@ class Command(BaseCommand):

                    # Check for stable files
                    for stable_path in tracker.get_stable_files():
-                        _consume_file(
+                        # Only remember files that were actually queued, so the
+                        # rescan does not re-queue them while the consume task
+                        # has yet to remove them from disk, but does retry a
+                        # failed publish instead of stranding it
+                        if _consume_file(
                            filepath=stable_path,
                            consumption_dir=directory,
                            subdirs_as_tags=subdirs_as_tags,
-                        )
-                        # Remember it so the rescan does not re-queue it while
-                        # the consume task has yet to remove it from disk
+                        ):
                            queued.add(stable_path)

                    # Exit watch loop to reconfigure timeout
@@ -1063,3 +1063,79 @@ class TestApiAppConfig(DirectoriesMixin, APITestCase):
        )
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
        self.assertIn("non-public address", str(response.data).lower())
+
+    @override_settings(REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS=False)
+    def test_update_remote_ocr_endpoint_blocks_internal_endpoint_when_disallowed(
+        self,
+    ) -> None:
+        """
+        GIVEN:
+            - Internal remote OCR endpoints are disallowed
+        WHEN:
+            - The config is updated with a remote OCR endpoint resolving internally
+        THEN:
+            - The request is rejected
+        """
+        response = self.client.patch(
+            f"{self.ENDPOINT}1/",
+            json.dumps(
+                {
+                    "remote_ocr_endpoint": "http://127.0.0.1:5000",
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("non-public address", str(response.data).lower())
+
+    @override_settings(REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS=True)
+    def test_update_remote_ocr_endpoint_allows_internal_endpoint_by_default(
+        self,
+    ) -> None:
+        """
+        GIVEN:
+            - Internal remote OCR endpoints are allowed (the default)
+        WHEN:
+            - The config is updated with a remote OCR endpoint resolving internally
+        THEN:
+            - The request is accepted, preserving existing self-hosted deployments
+        """
+        response = self.client.patch(
+            f"{self.ENDPOINT}1/",
+            json.dumps(
+                {
+                    "remote_ocr_endpoint": "http://127.0.0.1:5000",
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(
+            response.data["remote_ocr_endpoint"],
+            "http://127.0.0.1:5000",
+        )
+
+    @override_settings(REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS=False)
+    def test_update_remote_ocr_endpoint_empty_value_skips_validation(
+        self,
+    ) -> None:
+        """
+        GIVEN:
+            - Internal remote OCR endpoints are disallowed
+        WHEN:
+            - The config is updated with an empty remote OCR endpoint
+        THEN:
+            - The request is accepted; clearing the field never needs
+              outbound URL validation
+        """
+        response = self.client.patch(
+            f"{self.ENDPOINT}1/",
+            json.dumps(
+                {
+                    "remote_ocr_endpoint": "",
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["remote_ocr_endpoint"], "")
@@ -445,12 +445,13 @@ class TestConsumeFile:
        target = consumption_dir / "document.pdf"
        shutil.copy(sample_pdf, target)

-        _consume_file(
+        result = _consume_file(
            filepath=target,
            consumption_dir=consumption_dir,
            subdirs_as_tags=False,
        )

+        assert result is True
        mock_consume_file_delay.apply_async.assert_called_once()
        call_args = mock_consume_file_delay.apply_async.call_args
        consumable_doc = call_args.kwargs["kwargs"]["input_doc"]
@@ -464,11 +465,12 @@ class TestConsumeFile:
        mock_consume_file_delay: MagicMock,
    ) -> None:
        """Test _consume_file handles nonexistent files gracefully."""
-        _consume_file(
+        result = _consume_file(
            filepath=consumption_dir / "nonexistent.pdf",
            consumption_dir=consumption_dir,
            subdirs_as_tags=False,
        )
+        assert result is False
        mock_consume_file_delay.apply_async.assert_not_called()

    def test_consume_directory(
@@ -480,11 +482,12 @@ class TestConsumeFile:
        subdir = consumption_dir / "subdir"
        subdir.mkdir()

-        _consume_file(
+        result = _consume_file(
            filepath=subdir,
            consumption_dir=consumption_dir,
            subdirs_as_tags=False,
        )
+        assert result is False
        mock_consume_file_delay.apply_async.assert_not_called()

    def test_consume_with_permission_error(
@@ -499,13 +502,33 @@ class TestConsumeFile:
        shutil.copy(sample_pdf, target)

        mocker.patch.object(Path, "is_file", side_effect=PermissionError("denied"))
-        _consume_file(
+        result = _consume_file(
            filepath=target,
            consumption_dir=consumption_dir,
            subdirs_as_tags=False,
        )
+        assert result is False
        mock_consume_file_delay.apply_async.assert_not_called()

+    def test_consume_with_apply_async_failure(
+        self,
+        consumption_dir: Path,
+        sample_pdf: Path,
+        mock_consume_file_delay: MagicMock,
+    ) -> None:
+        """Test _consume_file reports failure when apply_async raises."""
+        target = consumption_dir / "document.pdf"
+        shutil.copy(sample_pdf, target)
+
+        mock_consume_file_delay.apply_async.side_effect = Exception("broker down")
+
+        result = _consume_file(
+            filepath=target,
+            consumption_dir=consumption_dir,
+            subdirs_as_tags=False,
+        )
+        assert result is False
+
    def test_consume_with_tags_error(
        self,
        consumption_dir: Path,
@@ -522,11 +545,12 @@ class TestConsumeFile:
            side_effect=DatabaseError("Something happened"),
        )

-        _consume_file(
+        result = _consume_file(
            filepath=target,
            consumption_dir=consumption_dir,
            subdirs_as_tags=True,
        )
+        assert result is True
        mock_consume_file_delay.apply_async.assert_called_once()
        call_args = mock_consume_file_delay.apply_async.call_args
        overrides = call_args.kwargs["kwargs"]["overrides"]
@@ -1249,6 +1273,52 @@ class TestProcessExistingFilesQueued:
        assert target.resolve() in queued


+@pytest.mark.management
+@pytest.mark.django_db
+class TestCommandRetryAfterQueueFailure:
+    """
+    Regression test for GH #13923.
+
+    A file whose ``apply_async`` publish fails (e.g. broker briefly down)
+    must not be marked as queued, so the periodic rescan retries it once
+    the broker recovers, instead of stranding it until the consumer
+    process is restarted.
+    """
+
+    def test_watch_loop_retries_failed_publish_on_rescan(
+        self,
+        consumption_dir: Path,
+        sample_pdf: Path,
+        mock_consume_file_delay: MagicMock,
+        start_consumer: Callable[..., ConsumerThread],
+    ) -> None:
+        """A publish failure from the watch loop is retried by the rescan."""
+        apply_async = mock_consume_file_delay.apply_async
+
+        def fail_first_call(*args: object, **kwargs: object) -> None:
+            if apply_async.call_count == 1:
+                raise Exception("broker down")
+
+        apply_async.side_effect = fail_first_call
+
+        thread = start_consumer(stability_delay=0.1, rescan_interval=0.3)
+
+        target = consumption_dir / "document.pdf"
+        shutil.copy(sample_pdf, target)
+
+        deadline = monotonic() + 5.0
+        while apply_async.call_count < 2 and monotonic() < deadline:
+            sleep(0.1)
+
+        if thread.exception:
+            raise thread.exception
+
+        assert apply_async.call_count >= 2, (
+            "Expected the failed publish to be retried by the rescan, "
+            f"but apply_async was only called {apply_async.call_count} time(s)"
+        )
+
+
@pytest.mark.management
@pytest.mark.django_db
 class TestCommandRescanRecovery:
@@ -32,6 +32,8 @@ if TYPE_CHECKING:
    import datetime
    from types import TracebackType

+    from azure.core.pipeline import PipelineRequest
+
    from paperless.parsers import MetadataEntry
    from paperless.parsers import ParserContext

@@ -436,9 +438,45 @@ class RemoteDocumentParser:
        from azure.ai.documentintelligence.models import DocumentContentFormat
        from azure.core.credentials import AzureKeyCredential

+        from paperless.network import validate_outbound_http_url
+
+        allow_internal = settings.REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS
+
+        try:
+            validate_outbound_http_url(config.endpoint, allow_internal=allow_internal)
+        except ValueError as e:
+            raise ParseError(f"Invalid remote OCR endpoint: {e}") from e
+
+        def _revalidate_request_host(request: PipelineRequest) -> None:
+            """Re-validates the destination host of every request sent.
+
+            The check above only covers the moment the client is built. A
+            single analysis involves several requests spread over the
+            polling loop below, and any one of them can be redirected.
+            Wiring this through ``raw_request_hook`` (Azure's built-in
+            CustomHookPolicy) rather than a custom policy means it runs
+            *after* RedirectPolicy in the pipeline, so it sees - and
+            re-checks - every actual outbound URL, including redirect
+            targets, not just the original request.
+            """
+            validate_outbound_http_url(
+                request.http_request.url,
+                allow_internal=allow_internal,
+            )
+
        client = DocumentIntelligenceClient(
            endpoint=config.endpoint,
            credential=AzureKeyCredential(config.api_key),
+            raw_request_hook=_revalidate_request_host,
+            # AzureKeyCredential is sent as Ocp-Apim-Subscription-Key, which
+            # Azure's default SensitiveHeaderCleanupPolicy does not strip on
+            # a cross-domain redirect (only Authorization and
+            # x-ms-authorization-auxiliary are, by default).
+            blocked_redirect_headers=[
+                "Authorization",
+                "x-ms-authorization-auxiliary",
+                "Ocp-Apim-Subscription-Key",
+            ],
        )

        try:
@@ -305,6 +305,22 @@ class ApplicationConfigurationSerializer(

    validate_llm_embedding_endpoint = validate_llm_endpoint

+    def validate_remote_ocr_endpoint(self, value: str | None) -> str | None:
+        if not value:
+            return value
+
+        try:
+            validate_outbound_http_url(
+                value,
+                allow_internal=settings.REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS,
+            )
+        except ValueError as e:
+            raise serializers.ValidationError(
+                f"Invalid remote OCR endpoint: {e.args[0]}, see logs for details",
+            ) from e
+
+        return value
+
    class Meta:
        model = ApplicationConfiguration
        fields = "__all__"
@@ -705,6 +705,12 @@ CELERY_BROKER_TRANSPORT_OPTIONS = {
 CELERY_TASK_TRACK_STARTED = True
 CELERY_TASK_TIME_LIMIT: Final[int] = get_int_from_env("PAPERLESS_WORKER_TIMEOUT", 1800)

+# https://docs.celeryq.dev/en/stable/userguide/configuration.html#std-setting-task_allow_error_cb_on_chord_header
+# Without this, a failing chord header never triggers the errback, so a mail
+# whose attachments all fail is never recorded and is re-fetched forever.
+# The errback runs once per failed header task, so it must be idempotent.
+CELERY_TASK_ALLOW_ERROR_CB_ON_CHORD_HEADER = True
+
 CELERY_CACHE_BACKEND = "default"

 # https://docs.celeryq.dev/en/stable/userguide/configuration.html#task-serializer
@@ -1208,6 +1214,10 @@ REMOTE_OCR_MODE = get_choice_from_env(
    {"always", "workflow_only"},
    default="always",
 )
+REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS = get_bool_from_env(
+    "PAPERLESS_REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS",
+    "true",
+)

 ################################################################################
 # AI Settings                                                                  #
@@ -334,18 +334,24 @@ def error_callback(
    """
    A shared task that is called whenever something goes wrong during
    consumption of a file. See queue_consumption_tasks.
+
+    With CELERY_TASK_ALLOW_ERROR_CB_ON_CHORD_HEADER enabled this runs once per
+    failed header task, not once per chord, so it must be idempotent.
    """
    rule = MailRule.objects.get(pk=rule_id)
+    received = make_aware(message_date) if is_naive(message_date) else message_date

-    ProcessedMail.objects.create(
+    ProcessedMail.objects.get_or_create(
        rule=rule,
        folder=rule.folder,
        uid=message_uid,
        uid_validity=uid_validity,
-        subject=message_subject,
-        received=make_aware(message_date) if is_naive(message_date) else message_date,
-        status="FAILED",
-        error=traceback.format_exc(),
+        defaults={
+            "subject": message_subject,
+            "received": received,
+            "status": "FAILED",
+            "error": traceback.format_exc(),
+        },
    )


@@ -36,6 +36,7 @@ from paperless_mail.mail import MailAccountHandler
 from paperless_mail.mail import MailError
 from paperless_mail.mail import TagMailAction
 from paperless_mail.mail import apply_mail_action
+from paperless_mail.mail import error_callback
 from paperless_mail.mail import get_mailbox
 from paperless_mail.models import MailAccount
 from paperless_mail.models import MailRule
@@ -2045,6 +2046,44 @@ class TestPostConsumeAction(TestCase):
        self.assertIn("Test Exception", processed_mail.error)


+@pytest.mark.django_db
+class TestErrorCallback:
+    def test_error_callback_is_idempotent_for_same_mail(self) -> None:
+        """
+        GIVEN:
+            - A mail rule and a mail that failed to be consumed
+        WHEN:
+            - error_callback is invoked more than once for the same mail, as
+              happens when task_allow_error_cb_on_chord_header fires the
+              errback once per failed header task in a chord
+        THEN:
+            - Only one ProcessedMail row is created for that mail
+        """
+        rule = MailRuleFactory()
+        message_uid = "12345"
+
+        for _ in range(2):
+            error_callback(
+                None,
+                Exception("Test Exception"),
+                None,
+                rule_id=rule.pk,
+                message_uid=message_uid,
+                message_subject="Test Subject",
+                message_date=timezone.make_aware(
+                    timezone.datetime(2023, 1, 1, 12, 0, 0),
+                ),
+            )
+
+        processed_mails = ProcessedMail.objects.filter(
+            rule=rule,
+            uid=message_uid,
+            folder=rule.folder,
+        )
+        assert processed_mails.count() == 1
+        assert processed_mails.get().status == "FAILED"
+
+
 class TestManagementCommand(TestCase):
    @mock.patch(
        "paperless_mail.management.commands.mail_fetcher.tasks.process_mail_accounts",
Author	SHA1	Message	Date
Trenton H	c2a9532b8f	Fix: Handle Celery enqueue failures when enqueuing files for consumption (#13935 )	2026-09-02 15:58:27 +00:00
Trenton H	713c857a08	Fix: Handle Celery mail task chord errors (#13936 ) * Fix: mail rule loops forever when all attachments are duplicates When every attachment in a mail is rejected as a duplicate, the chord's header tasks all fail. Celery's default task_allow_error_cb_on_chord_header skips the error callback in that case, so no ProcessedMail row is ever created, and the same mail is refetched and reprocessed on every poll for as long as it stays in the rule's maximum_age window. * Minor simplifications and cleanup	2026-09-02 08:41:30 -07:00
GitHub Actions	912c6eb52e	Auto translate strings	2026-09-01 22:07:30 +00:00
shamoon	73ef14f37a	Fix/chore: refactor some signal-backed conversion technical debt (#13902 )	2026-09-01 15:05:58 -07:00
Trenton H	d78754bff1	Security: validate remote OCR endpoint against internal SSRF (#13897 ) * Security: validate remote OCR endpoint against internal SSRF Adds PAPERLESS_REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS (default true) and validates remote_ocr_endpoint via validate_outbound_http_url on the config serializer, matching the existing LLM endpoint handling. * Validates te outbound url again right before use * cover empty-value branch of validate_remote_ocr_endpoint because coverage * re-validate remote OCR endpoint on every outbound request	2026-09-01 20:22:10 +00:00