Feature/Chore: Replaces all usages of ImageMagik's convert binary with a simple Pillow based helper

This removes ImageMagik as a dependency entirly and all documentation is cleaned up from it. We no longer need to install it, have a policy for it to allow PDFs and no longer shell out to it either.
Chore: Supersample the PDF thumbnail render 2x
2026-10-13 19:47:13 +00:00 · 2026-10-13 10:24:44 -07:00 · 2026-10-10 15:09:59 -07:00 · 2026-10-10 15:09:59 -07:00 · 2026-10-10 07:17:54 -07:00
37 changed files with 1086 additions and 1228 deletions
@@ -39,7 +39,6 @@ ARG RUNTIME_PACKAGES="\
  ghostscript \
  gnupg \
  icc-profiles-free \
-  imagemagick \
  # PostgreSQL
  postgresql-client \
  # MySQL / MariaDB
@@ -93,21 +92,6 @@ RUN set -eux \
        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb

-# setup docker-specific things
-# These change sometimes, but rarely
-WORKDIR /usr/src/paperless/src/docker/
-
-COPY [ \
-  "docker/rootfs/etc/ImageMagick-6/paperless-policy.xml", \
-  "./" \
-]
-
-RUN set -eux \
-  && echo "Configuring ImageMagick" \
-    && mkdir -p /etc/ImageMagick-6 \
-    && mv paperless-policy.xml /etc/ImageMagick-6/policy.xml
-
-
 # Packages needed only for building a few quick Python
 # dependencies
 ARG BUILD_PACKAGES="\
@@ -111,10 +111,7 @@ jobs:
        timeout-minutes: 12
        uses: $/.github/actions/apt-install
        with:
-          packages: unpaper tesseract-ocr imagemagick ghostscript poppler-utils
-      - name: Configure ImageMagick
-        run: |
-          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-7/policy.xml
+          packages: unpaper tesseract-ocr ghostscript poppler-utils qpdf
      - name: Install Python dependencies
        env:
          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
@@ -129,7 +129,6 @@ ARG RUNTIME_PACKAGES="\
  ghostscript \
  gnupg \
  icc-profiles-free \
-  imagemagick \
  # PostgreSQL
  postgresql-client \
  # MySQL / MariaDB
@@ -167,8 +166,6 @@ RUN set -eux \
        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
      && echo "Installing jbig2enc" \
        && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
-      && echo "Configuring imagemagick" \
-        && cp /etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml \
      && echo "Cleaning up image layer" \
        && rm --force --verbose *.deb \
    && rm --recursive --force --verbose /var/lib/apt/lists/* \
@@ -1,101 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE policymap [
-  <!ELEMENT policymap (policy)+>
-  <!ATTLIST policymap xmlns CDATA #FIXED ''>
-  <!ELEMENT policy EMPTY>
-  <!ATTLIST policy xmlns CDATA #FIXED '' domain NMTOKEN #REQUIRED
-    name NMTOKEN #IMPLIED pattern CDATA #IMPLIED rights NMTOKEN #IMPLIED
-    stealth NMTOKEN #IMPLIED value CDATA #IMPLIED>
-]>
-<!--
-  Configure ImageMagick policies.
-
-  Domains include system, delegate, coder, filter, path, or resource.
-
-  Rights include none, read, write, execute and all.  Use | to combine them,
-  for example: "read | write" to permit read from, or write to, a path.
-
-  Use a glob expression as a pattern.
-
-  Suppose we do not want users to process MPEG video images:
-
-    <policy domain="delegate" rights="none" pattern="mpeg:decode" />
-
-  Here we do not want users reading images from HTTP:
-
-    <policy domain="coder" rights="none" pattern="HTTP" />
-
-  The /repository file system is restricted to read only.  We use a glob
-  expression to match all paths that start with /repository:
-
-    <policy domain="path" rights="read" pattern="/repository/*" />
-
-  Lets prevent users from executing any image filters:
-
-    <policy domain="filter" rights="none" pattern="*" />
-
-  Any large image is cached to disk rather than memory:
-
-    <policy domain="resource" name="area" value="1GP"/>
-
-  Define arguments for the memory, map, area, width, height and disk resources
-  with SI prefixes (.e.g 100MB).  In addition, resource policies are maximums
-  for each instance of ImageMagick (e.g. policy memory limit 1GB, -limit 2GB
-  exceeds policy maximum so memory limit is 1GB).
-
-  Rules are processed in order.  Here we want to restrict ImageMagick to only
-  read or write a small subset of proven web-safe image types:
-
-    <policy domain="delegate" rights="none" pattern="*" />
-    <policy domain="filter" rights="none" pattern="*" />
-    <policy domain="coder" rights="none" pattern="*" />
-    <policy domain="coder" rights="read|write" pattern="{GIF,JPEG,PNG,WEBP}" />
-->
-<policymap>
-  <!-- <policy domain="system" name="shred" value="2"/> -->
-  <!-- <policy domain="system" name="precision" value="6"/> -->
-  <!-- <policy domain="system" name="memory-map" value="anonymous"/> -->
-  <!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
-  <!-- <policy domain="resource" name="temporary-path" value="/tmp"/> -->
-  <policy domain="resource" name="memory" value="256MiB"/>
-  <policy domain="resource" name="map" value="512MiB"/>
-  <policy domain="resource" name="width" value="16KP"/>
-  <policy domain="resource" name="height" value="16KP"/>
-  <!-- <policy domain="resource" name="list-length" value="128"/> -->
-  <policy domain="resource" name="area" value="128MB"/>
-  <policy domain="resource" name="disk" value="1GiB"/>
-  <!-- <policy domain="resource" name="file" value="768"/> -->
-  <!-- <policy domain="resource" name="thread" value="4"/> -->
-  <!-- <policy domain="resource" name="throttle" value="0"/> -->
-  <!-- <policy domain="resource" name="time" value="3600"/> -->
-  <!-- Paperless does not process SVG or ImageMagick scripting formats. -->
-  <policy domain="coder" rights="none" pattern="SVG" />
-  <policy domain="coder" rights="none" pattern="SVGZ" />
-  <policy domain="coder" rights="none" pattern="MSVG" />
-  <policy domain="coder" rights="none" pattern="RSVG" />
-  <policy domain="coder" rights="none" pattern="MSL" />
-  <policy domain="coder" rights="none" pattern="MVG" />
-  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
-  <!-- <policy domain="module" rights="none" pattern="{PS,PDF,XPS}" /> -->
-  <!-- <policy domain="delegate" rights="none" pattern="HTTPS" /> -->
-  <!-- <policy domain="path" rights="none" pattern="@*" /> -->
-  <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
-  <!-- <policy domain="cache" name="synchronize" value="True"/> -->
-  <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
-  <!-- <policy domain="system" name="pixel-cache-memory" value="anonymous"/> -->
-  <!-- <policy domain="system" name="shred" value="2"/> -->
-  <!-- <policy domain="system" name="precision" value="6"/> -->
-  <!-- use curl -->
-  <policy domain="delegate" rights="none" pattern="URL" />
-  <policy domain="delegate" rights="none" pattern="HTTPS" />
-  <policy domain="delegate" rights="none" pattern="HTTP" />
-  <!-- in order to avoid to get image with password text -->
-  <policy domain="path" rights="none" pattern="@*"/>
-  <!-- disable ghostscript format types -->
-  <policy domain="coder" rights="none" pattern="PS" />
-  <policy domain="coder" rights="none" pattern="PS2" />
-  <policy domain="coder" rights="none" pattern="PS3" />
-  <policy domain="coder" rights="none" pattern="EPS" />
-  <policy domain="coder" rights="read|write" pattern="PDF" />
-  <policy domain="coder" rights="none" pattern="XPS" />
-</policymap>
@@ -1315,29 +1315,17 @@ valid crontab(5) expression describing when to run.

 #### [`PAPERLESS_CONVERT_MEMORY_LIMIT=<num>`](#PAPERLESS_CONVERT_MEMORY_LIMIT) {#PAPERLESS_CONVERT_MEMORY_LIMIT}

-: On smaller systems, or even in the case of Very Large Documents, the
-consumer may explode, complaining about how it's "unable to extend
-pixel cache". In such cases, try setting this to a reasonably low
-value, like 32. The default is to use whatever is necessary to do
-everything without writing to disk, and units are in megabytes.
+!!! warning

-    For more information on how to use this value, you should search the
-    web for "MAGICK_MEMORY_LIMIT".
-
-    Defaults to 0, which disables the limit.
+    Deprecated and has no effect, since PDF thumbnails no longer use
+    ImageMagick. It will be removed in a future release.

 #### [`PAPERLESS_CONVERT_TMPDIR=<path>`](#PAPERLESS_CONVERT_TMPDIR) {#PAPERLESS_CONVERT_TMPDIR}

-: Similar to the memory limit, if you've got a small system and your
-OS mounts /tmp as tmpfs, you should set this to a path that's on a
-physical disk, like /home/your_user/tmp or something. ImageMagick
-will use this as scratch space when crunching through very large
-documents.
+!!! warning

-    For more information on how to use this value, you should search the
-    web for "MAGICK_TMPDIR".
-
-    Default is none, which disables the temporary directory.
+    Deprecated and has no effect, since PDF thumbnails no longer use
+    ImageMagick. It will be removed in a future release.

 #### [`PAPERLESS_APPS=<string>`](#PAPERLESS_APPS) {#PAPERLESS_APPS}

@@ -1885,7 +1873,10 @@ the literal path for that program.

 #### [`PAPERLESS_CONVERT_BINARY=<path>`](#PAPERLESS_CONVERT_BINARY) {#PAPERLESS_CONVERT_BINARY}

-: Defaults to "convert".
+!!! warning
+
+    Deprecated and has no effect, since Paperless-ngx no longer uses
+    ImageMagick. It will be removed in a future release.

 #### [`PAPERLESS_GS_BINARY=<path>`](#PAPERLESS_GS_BINARY) {#PAPERLESS_GS_BINARY}

@@ -177,17 +177,16 @@ to a positive number to enable polling and disable native filesystem notificatio
    - `pkg-config` for mysqlclient (python dependency)
    - `fonts-liberation` for generating thumbnails for plain text
      files
-    - `imagemagick` >= 6 for PDF conversion
    - `gnupg` for decrypting GPG-encrypted email
    - `libpq-dev` for PostgreSQL
    - `libmagic-dev` for mime type detection
    - `mariadb-client` for MariaDB compile time
-    - `poppler-utils` for barcode detection
+    - `poppler-utils` for thumbnail generation and barcode detection

    Use this list for your preferred package management:

    ```
-    python3 python3-pip python3-dev imagemagick fonts-liberation gnupg libpq-dev default-libmysqlclient-dev pkg-config libmagic-dev poppler-utils
+    python3 python3-pip python3-dev fonts-liberation gnupg libpq-dev default-libmysqlclient-dev pkg-config libmagic-dev poppler-utils
    ```

    These dependencies are required for OCRmyPDF, which is used for text
@@ -416,16 +415,6 @@ to a positive number to enable polling and disable native filesystem notificatio
        You may need to change the path in the files. Example:
        `ExecStart=/opt/paperless/.local/bin/celery --app paperless worker --loglevel INFO`

-12. Configure ImageMagick to allow processing of PDF documents and disable
-    formats that Paperless-ngx does not use. Most distributions disable PDF
-    processing by default, since PDF documents can contain malware. If you
-    don't enable it, Paperless-ngx will fall back to Ghostscript for certain
-    steps such as thumbnail generation.
-
-    Configure the active ImageMagick policy file (commonly
-    `/etc/ImageMagick-6/policy.xml` or `/etc/ImageMagick-7/policy.xml`) and
-    adjust similar to [the docker policy file](https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/refs/heads/main/docker/rootfs/etc/ImageMagick-6/paperless-policy.xml). You should also include restrictions as noted there.
-
 **Optional: Install the [jbig2enc](https://ocrmypdf.readthedocs.io/en/latest/jbig2.html) encoder.**
 This will reduce the size of generated PDF documents. You'll most likely need to compile this yourself, because this
 software has been patented until around 2017 and binary packages are not available for most distributions.
@@ -50,8 +50,6 @@ PAPERLESS_SECRET_KEY=change-me
 #PAPERLESS_OCR_ROTATE_PAGES=true
 #PAPERLESS_OCR_ROTATE_PAGES_THRESHOLD=12.0
 #PAPERLESS_OCR_USER_ARGS={}
-#PAPERLESS_CONVERT_MEMORY_LIMIT=0
-#PAPERLESS_CONVERT_TMPDIR=/var/tmp/paperless

 # Software tweaks

@@ -90,5 +88,4 @@ PAPERLESS_SECRET_KEY=change-me

 # Binaries

-#PAPERLESS_CONVERT_BINARY=/usr/bin/convert
 #PAPERLESS_GS_BINARY=/usr/bin/gs
@@ -1,12 +1,11 @@
 from pathlib import Path

 import img2pdf
-from django.conf import settings
 from PIL import Image

 from documents.utils import copy_basic_file_stats
 from documents.utils import maybe_override_pixel_limit
-from documents.utils import run_subprocess
+from documents.utils import remove_alpha_channel


 def convert_from_tiff_to_pdf(tiff_path: Path, target_directory: Path) -> Path:
@@ -27,15 +26,7 @@ def convert_from_tiff_to_pdf(tiff_path: Path, target_directory: Path) -> Path:
        # Note the save into the temp folder, so as not to trigger a new
        # consume
        scratch_image = target_directory / tiff_path.name
-        run_subprocess(
-            [
-                settings.CONVERT_BINARY,
-                "-alpha",
-                "off",
-                tiff_path,
-                scratch_image,
-            ],
-        )
+        remove_alpha_channel(tiff_path, scratch_image)
    else:
        # Not modifying the original, safe to use in place
        scratch_image = tiff_path
@@ -67,22 +67,18 @@ class Command(PaperlessCommand):
                if options.get("recreate"):
                    wipe_index(settings.INDEX_DIR)

-                documents = (
-                    Document.objects.filter(root_document__isnull=True)
-                    .select_related(
-                        "correspondent",
-                        "document_type",
-                        "storage_path",
-                        "owner",
-                    )
-                    .prefetch_related(
-                        "tags",
-                        "notes__user",
-                        "custom_fields__field",
-                        "versions",
-                        "barcodes",
-                        "versions__barcodes",
-                    )
+                documents = Document.objects.select_related(
+                    "correspondent",
+                    "document_type",
+                    "storage_path",
+                    "owner",
+                ).prefetch_related(
+                    "tags",
+                    "notes__user",
+                    "custom_fields__field",
+                    "versions",
+                    "barcodes",
+                    "versions__barcodes",
                )
                total = documents.count()
                rebuild_kwargs = {}
@@ -1,8 +1,8 @@
 from __future__ import annotations

 import logging
+import math
 import mimetypes
-import os
 import shutil
 import subprocess
 import tempfile
@@ -68,58 +68,6 @@ def get_supported_file_extensions() -> set[str]:
    return extensions


-def run_convert(
-    input_file,
-    output_file,
-    *,
-    density=None,
-    scale=None,
-    alpha=None,
-    strip=False,
-    trim=False,
-    type=None,
-    depth=None,
-    auto_orient=False,
-    use_cropbox=False,
-    extra=None,
-    logging_group=None,
-) -> None:
-    environment = os.environ.copy()
-    if settings.CONVERT_MEMORY_LIMIT:
-        # MAGICK_MEMORY_LIMIT sets the maximum amount of RAM the pixel cache can use.
-        # MAGICK_MAP_LIMIT sets the maximum amount of memory-mapped I/O allowed.
-        #
-        # For large-format documents  ImageMagick will hit the RAM limit and
-        # immediately try to "map" the remaining data. If MAGICK_MAP_LIMIT isn't
-        # also set, the process may trigger an OOM kill because the default
-        # system/policy map limit is often too restrictive for these massive bitmaps.
-        environment["MAGICK_MEMORY_LIMIT"] = settings.CONVERT_MEMORY_LIMIT
-        environment["MAGICK_MAP_LIMIT"] = settings.CONVERT_MEMORY_LIMIT
-    if settings.CONVERT_TMPDIR:
-        environment["MAGICK_TMPDIR"] = settings.CONVERT_TMPDIR
-
-    args = [settings.CONVERT_BINARY]
-    args += ["-density", str(density)] if density else []
-    args += ["-scale", str(scale)] if scale else []
-    args += ["-alpha", str(alpha)] if alpha else []
-    args += ["-strip"] if strip else []
-    args += ["-trim"] if trim else []
-    args += ["-type", str(type)] if type else []
-    args += ["-depth", str(depth)] if depth else []
-    args += ["-auto-orient"] if auto_orient else []
-    args += ["-define", "pdf:use-cropbox=true"] if use_cropbox else []
-    args += [str(input_file), str(output_file)]
-
-    logger.debug("Execute: " + " ".join(args), extra={"group": logging_group})
-
-    try:
-        run_subprocess(args, environment, logger)
-    except subprocess.CalledProcessError as e:
-        raise ParseError(f"Convert failed at {args}") from e
-    except Exception as e:  # pragma: no cover
-        raise ParseError("Unknown error running convert") from e
-
-
 def get_default_thumbnail() -> Path:
    """
    Returns the path to a generic thumbnail
@@ -127,46 +75,168 @@ def get_default_thumbnail() -> Path:
    return (Path(__file__).parent / "resources" / "document.webp").resolve()


-def make_thumbnail_from_pdf_gs_fallback(in_path, temp_dir, logging_group=None) -> Path:
-    out_path: Path = Path(temp_dir) / "convert_gs.webp"
+_THUMBNAIL_MAX_WIDTH = 500
+_THUMBNAIL_MAX_HEIGHT = 5000
+# Used only when the page geometry cannot be read
+_THUMBNAIL_FALLBACK_DPI = 150
+# Applied before supersampling, so tiny pages are not enlarged
+_THUMBNAIL_MAX_DPI = 300
+# Rendering at a multiple and downsampling keeps text crisper
+_THUMBNAIL_SUPERSAMPLE = 2

-    # if convert fails, fall back to extracting
-    # the first PDF page as a PNG using Ghostscript
-    logger.warning(
-        "Thumbnail generation with ImageMagick failed, falling back "
-        "to ghostscript. Check your /etc/ImageMagick-x/policy.xml!",
-        extra={"group": logging_group},
-    )
-    # Ghostscript doesn't handle WebP outputs
-    gs_out_path: Path = Path(temp_dir) / "gs_out.png"
-    cmd = [settings.GS_BINARY, "-q", "-sDEVICE=pngalpha", "-o", gs_out_path, in_path]
+
+def rasterize_pdf_page_to_png(
+    in_path: Path,
+    out_path: Path,
+    *,
+    dpi: int,
+    logging_group=None,
+) -> None:
+    """
+    Rasterizes the first page of a PDF to a PNG with pdftoppm.
+    """
+    # -singlefile drops the page number and -png appends ".png", so pass the
+    # path without its suffix
+    args = [
+        "pdftoppm",
+        "-f",
+        "1",
+        "-l",
+        "1",
+        "-r",
+        str(dpi),
+        "-png",
+        "-singlefile",
+        "-cropbox",
+        str(in_path),
+        str(out_path.with_suffix("")),
+    ]
+
+    logger.debug("Execute: " + " ".join(args), extra={"group": logging_group})

    try:
-        try:
-            run_subprocess(cmd, logger=logger)
-        except subprocess.CalledProcessError as e:
-            raise ParseError(f"Thumbnail (gs) failed at {cmd}") from e
-        # then run convert on the output from gs to make WebP
-        run_convert(
-            density=300,
-            scale="500x5000>",
-            alpha="remove",
-            strip=True,
-            trim=False,
-            auto_orient=True,
-            input_file=gs_out_path,
-            output_file=out_path,
-            logging_group=logging_group,
-        )
+        run_subprocess(args, logger=logger)
+    except subprocess.CalledProcessError as e:
+        raise ParseError(f"pdftoppm failed at {args}") from e
+    except Exception as e:  # pragma: no cover
+        raise ParseError("Unknown error running pdftoppm") from e

+
+def encode_thumbnail_webp(
+    png_path: Path,
+    out_path: Path,
+    *,
+    supersample: int = 1,
+) -> None:
+    """
+    Flattens alpha onto white, undoes supersampling, shrinks to fit and saves as WebP.
+    """
+    from PIL import Image
+
+    try:
+        with Image.open(png_path) as im:
+            if im.mode in ("RGBA", "LA"):
+                flattened = Image.new("RGB", im.size, (255, 255, 255))
+                flattened.paste(im, mask=im.split()[-1])
+            else:
+                flattened = im.convert("RGB")
+
+        if supersample > 1:
+            flattened = flattened.resize(
+                (
+                    max(1, round(flattened.width / supersample)),
+                    max(1, round(flattened.height / supersample)),
+                ),
+                Image.Resampling.LANCZOS,
+            )
+
+        flattened.thumbnail((_THUMBNAIL_MAX_WIDTH, _THUMBNAIL_MAX_HEIGHT))
+        flattened.save(out_path, format="WEBP")
+    except (OSError, Image.DecompressionBombError) as e:
+        raise ParseError(f"Unable to encode thumbnail from {png_path}") from e
+
+
+def _compute_thumbnail_dpi(in_path: Path, logging_group=None) -> tuple[int, int]:
+    """
+    Returns (dpi, supersample). Unknown geometry is not supersampled, since
+    the render size cannot be bounded.
+    """
+    from paperless.parsers.utils import get_pdf_first_page_size_points
+
+    size = get_pdf_first_page_size_points(in_path)
+    if size is None:
+        logger.debug(
+            "Could not read PDF page size, using fallback DPI",
+            extra={"group": logging_group},
+        )
+        return _THUMBNAIL_FALLBACK_DPI, 1
+
+    width_pts, height_pts = size
+    dpi_for_width = _THUMBNAIL_MAX_WIDTH * 72 / width_pts
+    dpi_for_height = _THUMBNAIL_MAX_HEIGHT * 72 / height_pts
+    # Round up so the downsampled render is never a few pixels short of the
+    # target; the shrink-only clamp in encode_thumbnail_webp trims the excess.
+    dpi = max(
+        1,
+        math.ceil(min(_THUMBNAIL_MAX_DPI, dpi_for_width, dpi_for_height)),
+    )
+    # At the 1 DPI floor the page is already oversized, so do not supersample
+    return dpi, 1 if dpi == 1 else _THUMBNAIL_SUPERSAMPLE
+
+
+def _render_pdf_thumbnail(
+    in_path: Path,
+    png_path: Path,
+    out_path: Path,
+    logging_group=None,
+) -> None:
+    dpi, supersample = _compute_thumbnail_dpi(in_path, logging_group=logging_group)
+    rasterize_pdf_page_to_png(
+        in_path,
+        png_path,
+        dpi=dpi * supersample,
+        logging_group=logging_group,
+    )
+    encode_thumbnail_webp(png_path, out_path, supersample=supersample)
+
+
+def _repair_pdf_with_qpdf(in_path: Path, out_path: Path) -> None:
+    # qpdf exits 3 after a repair; --warning-exit-0 keeps that from failing
+    try:
+        shutil.copy(in_path, out_path)
+        run_subprocess(
+            ["qpdf", "--warning-exit-0", "--replace-input", str(out_path)],
+            logger=logger,
+        )
+    except (subprocess.CalledProcessError, OSError) as e:
+        raise ParseError(f"qpdf repair failed for {in_path}") from e
+
+
+def make_thumbnail_from_pdf_qpdf_fallback(
+    in_path: Path,
+    temp_dir: Path,
+    logging_group=None,
+) -> Path:
+    png_path = temp_dir / "page1_repaired.png"
+    out_path = temp_dir / "convert_qpdf.webp"
+    repaired_path = temp_dir / "repaired.pdf"
+
+    logger.warning(
+        "Thumbnail generation with pdftoppm failed, attempting qpdf repair and retry.",
+        extra={"group": logging_group},
+    )
+
+    try:
+        _repair_pdf_with_qpdf(in_path, repaired_path)
+        _render_pdf_thumbnail(repaired_path, png_path, out_path, logging_group)
        return out_path

    except ParseError as e:
-        logger.error(f"Unable to make thumbnail with Ghostscript: {e}")
+        logger.error(f"Unable to make thumbnail after qpdf repair: {e}")
        # The caller might expect a generated thumbnail that can be moved,
        # so we need to copy it before it gets moved.
        # https://github.com/paperless-ngx/paperless-ngx/issues/3631
-        default_thumbnail_path: Path = Path(temp_dir) / "document.webp"
+        default_thumbnail_path = temp_dir / "document.webp"
        copy_file_with_basic_stats(get_default_thumbnail(), default_thumbnail_path)
        return default_thumbnail_path

@@ -175,25 +245,18 @@ def make_thumbnail_from_pdf(in_path: Path, temp_dir: Path, logging_group=None) -
    """
    The thumbnail of a PDF is just a 500px wide image of the first page.
    """
+    png_path: Path = temp_dir / "page1.png"
    out_path: Path = temp_dir / "convert.webp"

-    # Run convert to get a decent thumbnail
    try:
-        run_convert(
-            density=300,
-            scale="500x5000>",
-            alpha="remove",
-            strip=True,
-            trim=False,
-            auto_orient=True,
-            use_cropbox=True,
-            input_file=f"{in_path}[0]",
-            output_file=str(out_path),
-            logging_group=logging_group,
-        )
+        _render_pdf_thumbnail(in_path, png_path, out_path, logging_group)
    except ParseError as e:
-        logger.error(f"Unable to make thumbnail with convert: {e}")
-        out_path = make_thumbnail_from_pdf_gs_fallback(in_path, temp_dir, logging_group)
+        logger.error(f"Unable to make thumbnail with pdftoppm: {e}")
+        out_path = make_thumbnail_from_pdf_qpdf_fallback(
+            in_path,
+            temp_dir,
+            logging_group,
+        )

    return out_path

@@ -6,13 +6,9 @@ from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Case
-from django.db.models import CharField
 from django.db.models import Count
-from django.db.models import Exists
-from django.db.models import F
 from django.db.models import IntegerField
 from django.db.models import Model
-from django.db.models import OuterRef
 from django.db.models import Q
 from django.db.models import QuerySet
 from django.db.models import Value
@@ -30,7 +26,6 @@ from rest_framework.permissions import BasePermission
 from rest_framework.permissions import DjangoObjectPermissions

 from documents.models import Document
-from documents.versioning import get_root_document


 class PaperlessObjectPermissions(DjangoObjectPermissions):
@@ -354,7 +349,6 @@ def permitted_object_ids(
    perm: str,
    *,
    include_deleted: bool = False,
-    parent_field: str | None = None,
 ) -> QuerySet[int]:
    """
    Generic version of ``permitted_document_ids`` for any model with an
@@ -363,20 +357,6 @@ def permitted_object_ids(
    soft-delete pattern (currently only ``Document``); for every other model
    it is accepted but has no effect, since those models have no soft-delete
    concept.
-
-    ``parent_field`` names a self-referencing foreign key whose target
-    authorizes the row (``Document.root_document``). A row with a parent is
-    visible exactly when its parent is, judged by the parent's owner and
-    grants, so the row's own owner and grants are ignored.
-
-    Guardian stores ``object_pk`` as a string, so each grant is an ``EXISTS``
-    keyed on the row's id cast to a string, which can use guardian's
-    (user, permission, object_pk) unique index. Casting every ``object_pk`` to
-    an integer for an ``id IN (...)`` is not indexable, and MariaDB cannot
-    materialize it inside the owner ``OR``, so it re-scans the user's grants
-    for every row. The user's groups are matched with an ``IN`` subquery
-    rather than a join through the membership table, which SQLite plans badly
-    once the grant tables grow.
    """
    has_soft_delete = hasattr(model, "global_objects")
    manager = (
@@ -384,21 +364,8 @@ def permitted_object_ids(
    )
    base_qs = manager.all().only("id", "owner")

-    owner_field, key_field = "owner", "pk"
-    if parent_field is not None:
-        owner_field, key_field = "authorizing_owner", "authorizing_id"
-        base_qs = base_qs.annotate(
-            authorizing_id=Coalesce(f"{parent_field}_id", "id"),
-            authorizing_owner=Case(
-                When(**{f"{parent_field}_id__isnull": True}, then=F("owner_id")),
-                default=F(f"{parent_field}__owner_id"),
-                output_field=IntegerField(),
-            ),
-        )
-    unowned = Q(**{f"{owner_field}__isnull": True})
-
    if user is None or not getattr(user, "is_authenticated", False):
-        return base_qs.filter(unowned).values_list("id", flat=True)
+        return base_qs.filter(owner__isnull=True).values_list("id", flat=True)

    # Deactivated users get nothing, deactivated superusers included, so this
    # has to come before the superuser shortcut. guardian's
@@ -422,24 +389,20 @@ def permitted_object_ids(
        "permission__content_type": content_type,
    }

-    key_as_text = Cast(OuterRef(key_field), CharField(max_length=64))
-    granted_to_user = Exists(
-        UserObjectPermission.objects.filter(
-            user=user,
-            object_pk=key_as_text,
-            **perm_filter,
-        ),
+    user_perm_ids = (
+        UserObjectPermission.objects.filter(user=user, **perm_filter)
+        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
+        .values_list("object_pk_int", flat=True)
    )
-    granted_to_group = Exists(
-        GroupObjectPermission.objects.filter(
-            group_id__in=user.groups.values("id"),
-            object_pk=key_as_text,
-            **perm_filter,
-        ),
+    group_perm_ids = (
+        GroupObjectPermission.objects.filter(group__user=user, **perm_filter)
+        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
+        .values_list("object_pk_int", flat=True)
    )
+    permitted_ids = user_perm_ids.union(group_perm_ids)

    return base_qs.filter(
-        Q(**{owner_field: user.pk}) | unowned | granted_to_user | granted_to_group,
+        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_ids),
    ).values_list("id", flat=True)


@@ -508,16 +471,30 @@ def permitted_document_ids(
    ``include_deleted=True`` for callers that need to check permission on
    soft-deleted documents (e.g. trash restore). This intentionally avoids
    ``get_objects_for_user`` to keep the subquery small and index-friendly.
-
-    A version is authorized by its root document, so a version's own owner and
-    grants never matter.
    """
-    return permitted_object_ids(
-        user,
-        Document,
-        perm,
-        include_deleted=include_deleted,
-        parent_field="root_document",
+    return permitted_object_ids(user, Document, perm, include_deleted=include_deleted)
+
+
+def documents_without_permitted_root(
+    documents: QuerySet[Document],
+    user: User | None,
+    *,
+    perm: str = "view_document",
+    include_deleted: bool = False,
+) -> QuerySet[Document]:
+    """
+    The documents the user lacks ``perm`` on. Versions are authorized by their
+    root document, so a version's own owner is ignored. A single query, without
+    loading the documents or joining the root.
+    """
+    return documents.annotate(
+        root_id=Coalesce("root_document_id", "id"),
+    ).exclude(
+        root_id__in=permitted_document_ids(
+            user,
+            perm=perm,
+            include_deleted=include_deleted,
+        ),
    )


@@ -677,14 +654,7 @@ def has_perms_owner_aware(user, perms, obj):
    single-object check still has many production callers. Several callers
    remain across ``documents/``, ``paperless_mail/``, and ``paperless_ai/``
    -- grep for this function name before removing it.
-
-    A document version is authorized by its root document, like in
-    ``permitted_document_ids``, so a version's own owner and grants never
-    matter. Fetch the root with ``select_related("root_document__owner")`` to
-    avoid extra queries.
    """
-    if isinstance(obj, Document):
-        obj = get_root_document(obj)
    checker = ObjectPermissionChecker(user)
    return obj.owner is None or obj.owner == user or checker.has_perm(perms, obj)

@@ -284,14 +284,9 @@ class WriteBatch:
        and adding the new version. This ensures stale document data (e.g., after
        permission changes) doesn't persist in the index.

-        Only root documents are indexed, with their effective content, so a
-        version is indexed as its root document.
-
        Args:
            document: Django Document instance to index
        """
-        if document.root_document_id is not None:
-            document = document.root_document
        self.remove(document.pk)
        doc = self._backend._build_tantivy_doc(document)
        self._writer.add_document(doc)
@@ -316,22 +311,20 @@ class WriteBatch:
        An id with no matching document (e.g. deleted between the caller
        collecting ids and the batch running) is silently skipped, matching
        ``add_or_update()``'s existing single-document deferred-task behavior
-        rather than erroring or leaving a stale index entry. The id of a
-        version stands for its root document.
+        rather than erroring or leaving a stale index entry.

        Args:
            ids: Primary keys of Document instances to index
        """
        from documents.models import Document
        from documents.versioning import annotate_effective_content
-        from documents.versioning import root_document_ids

        ids = list(ids)
        if not ids:
            return

        queryset = annotate_effective_content(
-            Document.objects.filter(pk__in=root_document_ids(ids))
+            Document.objects.filter(pk__in=ids)
            .select_related("correspondent", "document_type", "storage_path", "owner")
            .prefetch_related(
                "tags",
@@ -90,6 +90,7 @@ from documents.templating.utils import convert_format_str_to_template_format
 from documents.templating.workflows import validate_workflow_template
 from documents.validators import uri_validator
 from documents.validators import url_validator
+from documents.versioning import get_root_document
 from documents.versioning import has_prefetched_effective_content
 from documents.versioning import sort_versions_newest_first

@@ -2894,7 +2895,7 @@ class ShareLinkSerializer(OwnedObjectSerializer):
            and has_perms_owner_aware(
                self.user,
                "view_document",
-                document,
+                get_root_document(document),
            )
        ):
            return document
@@ -490,20 +490,23 @@ def update_document_content_maybe_archive_file(
                    shutil.move(thumbnail, document.thumbnail_path)

            document.refresh_from_db()
+            root_document = (
+                document.root_document if document.root_document_id else document
+            )
            logger.info(
-                f"Updating index for document {document_id} ({document.archive_checksum})",
+                f"Updating index for document {root_document.pk} ({document.archive_checksum})",
            )
            from documents.search import get_backend

-            get_backend().add_or_update(document)
+            get_backend().add_or_update(root_document)

            ai_config = AIConfig()
            if ai_config.llm_index_enabled:
-                llm_index_add_or_update_document(document)
+                llm_index_add_or_update_document(root_document)

            clear_document_caches(document.pk)
-            if document.root_document_id is not None:
-                clear_document_caches(document.root_document_id)
+            if root_document.pk != document.pk:
+                clear_document_caches(root_document.pk)

        except Exception:
            logger.exception(
@@ -293,80 +293,6 @@ class TestAddOrUpdateIds:
        assert backend.search_ids("updated", user=None) == [doc.pk]


-class TestVersionsAreIndexedAsTheirRoot:
-    """Only root documents are indexed, with their effective content, so
-    every write path that is handed a version indexes its root instead."""
-
-    @staticmethod
-    def _root_with_version() -> tuple[Document, Document]:
-        root = DocumentFactory(title="Statement", content="stale text")
-        version = DocumentFactory(
-            title="Statement",
-            content="latest text",
-            root_document=root,
-            version_index=1,
-        )
-        return root, version
-
-    def test_add_or_update_indexes_the_root_of_a_version(
-        self,
-        backend: TantivyBackend,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - The version is passed to add_or_update
-        THEN:
-            - The root is indexed with the version's text, and the version is not
-        """
-        root, version = self._root_with_version()
-
-        backend.add_or_update(version)
-
-        assert backend.search_ids("latest", user=None) == [root.pk]
-        assert backend.search_ids("stale", user=None) == []
-
-    def test_add_or_update_ids_indexes_each_root_once(
-        self,
-        backend: TantivyBackend,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - Both ids are passed to add_or_update_ids
-        THEN:
-            - The root is indexed once and the version is not indexed
-        """
-        root, version = self._root_with_version()
-
-        with backend.batch_update() as batch:
-            batch.add_or_update_ids([version.pk, root.pk])
-
-        assert backend.search_ids("Statement", user=None) == [root.pk]
-        assert backend.search_ids("latest", user=None) == [root.pk]
-
-    def test_add_or_update_ids_resolves_a_lone_version(
-        self,
-        backend: TantivyBackend,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - Only the version's id is passed to add_or_update_ids
-        THEN:
-            - The root is indexed
-        """
-        root, version = self._root_with_version()
-
-        with backend.batch_update() as batch:
-            batch.add_or_update_ids([version.pk])
-
-        assert backend.search_ids("latest", user=None) == [root.pk]
-
-
 class TestSearch:
    """Test search query parsing and matching via search_ids."""

@@ -1196,59 +1196,6 @@ class TestDocumentSearchApi(DirectoriesMixin, APITestCase):
        self.assertIn(d3.id, result_ids)
        self.assertNotIn(d4.id, result_ids)

-    def test_search_more_like_version_uses_its_root(self) -> None:
-        """
-        GIVEN:
-            - A document similar in content to a root document, and one that is not
-            - A version of the root document, which is never indexed
-        WHEN:
-            - API request for more like the version
-        THEN:
-            - The documents similar to the root are returned, not the version
-        """
-        indexed = {}
-        for name, title, content, day in (
-            ("root", "bank statement 1", "things i paid for in august", (2019, 3, 4)),
-            (
-                "similar",
-                "bank statement 3",
-                "things i paid for in september",
-                (2020, 7, 9),
-            ),
-            (
-                "other",
-                "Quarterly Report",
-                "quarterly revenue profit margin",
-                (2021, 11, 30),
-            ),
-        ):
-            with time_machine.travel(
-                timezone.make_aware(datetime.datetime(*day)),
-                tick=False,
-            ):
-                indexed[name] = DocumentFactory(
-                    title=title,
-                    content=content,
-                    created=datetime.date(*day),
-                    added=timezone.make_aware(datetime.datetime(*day)),
-                )
-        version = DocumentFactory(
-            root_document=indexed["root"],
-            version_index=1,
-            content="things i paid for in august",
-        )
-        backend = get_backend()
-        for document in indexed.values():
-            backend.add_or_update(document)
-
-        response = self.client.get(f"/api/documents/?more_like_id={version.id}")
-
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        result_ids = [r["id"] for r in response.data["results"]]
-        self.assertIn(indexed["similar"].id, result_ids)
-        self.assertNotIn(indexed["other"].id, result_ids)
-        self.assertNotIn(version.id, result_ids)
-
    def test_more_like_requires_id_of_existing_document(self) -> None:
        """
        GIVEN:
@@ -22,7 +22,6 @@ from documents.models import Document
 from documents.tasks import update_document_content_maybe_archive_file
 from paperless_testing.assertions import FileSystemAssertsMixin
 from paperless_testing.dirs import DirectoriesMixin
-from paperless_testing.factories import DocumentFactory

 sample_file: Path = Path(__file__).parent / "samples" / "simple.pdf"

@@ -117,27 +116,6 @@ class TestMakeIndex:
        call_command("document_index", "reindex", skip_checks=True)
        mock_get_backend.return_value.rebuild.assert_called_once()

-    def test_reindex_skips_versions(self, mocker: MockerFixture) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - The reindex command runs
-        THEN:
-            - Only the root document is handed to the rebuild, since a version
-              is indexed as its root
-        """
-        root = DocumentFactory()
-        DocumentFactory(root_document=root, version_index=1)
-        mock_get_backend = mocker.patch(
-            "documents.management.commands.document_index.get_backend",
-        )
-
-        call_command("document_index", "reindex", skip_checks=True)
-
-        documents = mock_get_backend.return_value.rebuild.call_args.args[0]
-        assert list(documents.values_list("pk", flat=True)) == [root.pk]
-
    def test_optimize(self) -> None:
        """Optimize command must execute without error (Tantivy handles optimization automatically)."""
        call_command("document_index", "optimize", skip_checks=True)
@@ -1,11 +1,22 @@
+import subprocess
 from collections.abc import Generator
+from pathlib import Path

+import pikepdf
 import pytest
+from PIL import Image
 from pytest_django.fixtures import Settings
+from pytest_mock import MockerFixture

+from documents.parsers import ParseError
+from documents.parsers import _compute_thumbnail_dpi
+from documents.parsers import encode_thumbnail_webp
 from documents.parsers import get_default_file_extension
+from documents.parsers import get_default_thumbnail
 from documents.parsers import get_supported_file_extensions
 from documents.parsers import is_file_ext_supported
+from documents.parsers import make_thumbnail_from_pdf
+from documents.parsers import rasterize_pdf_page_to_png
 from paperless.parsers.registry import get_parser_registry
 from paperless.parsers.registry import reset_parser_registry
 from paperless.parsers.tesseract import RasterisedDocumentParser
@@ -125,3 +136,374 @@ class TestParserAvailability:
        assert is_file_ext_supported(".pdf")
        assert not is_file_ext_supported(".hsdfh")
        assert not is_file_ext_supported("")
+
+
+class TestComputeThumbnailDpi:
+    @pytest.mark.parametrize(
+        ("size", "expected"),
+        [
+            pytest.param((612.0, 792.0), (59, 2), id="letter-width-bound"),
+            pytest.param((792.0, 612.0), (46, 2), id="landscape-rounded-up"),
+            pytest.param((612.0, 100000.0), (4, 2), id="tall-strip-height-bound"),
+            pytest.param((200.0, 300.0), (180, 2), id="small-page-width-bound"),
+            pytest.param((72.0, 72.0), (300, 2), id="tiny-page-capped-at-300"),
+            pytest.param(
+                (1000000.0, 1000000.0),
+                (1, 1),
+                id="huge-page-minimum-one-unsupersampled",
+            ),
+            pytest.param(None, (150, 1), id="unreadable-geometry-fallback"),
+        ],
+    )
+    def test_dpi_from_page_size(
+        self,
+        mocker: MockerFixture,
+        tmp_path: Path,
+        size: tuple[float, float] | None,
+        expected: tuple[int, int],
+    ) -> None:
+        """
+        GIVEN:
+            - A first page of the given size, or unreadable geometry
+        WHEN:
+            - The thumbnail DPI is computed
+        THEN:
+            - The expected DPI and supersample factor are returned
+        """
+        mocker.patch(
+            "paperless.parsers.utils.get_pdf_first_page_size_points",
+            return_value=size,
+        )
+        assert _compute_thumbnail_dpi(tmp_path / "doc.pdf") == expected
+
+
+class TestMakeThumbnailFromPdf:
+    @pytest.fixture
+    def work_dir(self, tmp_path: Path) -> Path:
+        path = tmp_path / "work"
+        path.mkdir()
+        return path
+
+    @staticmethod
+    def _write_blank_pdf(path: Path, page_size: tuple[int, int] = (612, 792)) -> Path:
+        pdf = pikepdf.new()
+        pdf.add_blank_page(page_size=page_size)
+        pdf.save(path, object_stream_mode=pikepdf.ObjectStreamMode.disable)
+        return path
+
+    @pytest.mark.parametrize(
+        ("size", "expected_dpi", "expected_supersample"),
+        [
+            pytest.param((612.0, 792.0), 118, 2, id="known-geometry-2x"),
+            pytest.param(None, 150, 1, id="unreadable-geometry-plain-fallback"),
+        ],
+    )
+    def test_render_dpi_requested(
+        self,
+        mocker: MockerFixture,
+        tmp_path: Path,
+        work_dir: Path,
+        size: tuple[float, float] | None,
+        expected_dpi: int,
+        expected_supersample: int,
+    ) -> None:
+        """
+        GIVEN:
+            - Readable or unreadable page geometry
+        WHEN:
+            - A thumbnail is made
+        THEN:
+            - Rasterize and encode get the matching DPI and supersample factor
+        """
+        mocker.patch(
+            "paperless.parsers.utils.get_pdf_first_page_size_points",
+            return_value=size,
+        )
+        rasterize = mocker.patch("documents.parsers.rasterize_pdf_page_to_png")
+        encode = mocker.patch("documents.parsers.encode_thumbnail_webp")
+
+        make_thumbnail_from_pdf(tmp_path / "in.pdf", work_dir)
+
+        assert rasterize.call_args.kwargs["dpi"] == expected_dpi
+        assert encode.call_args.kwargs["supersample"] == expected_supersample
+
+    @pytest.mark.parametrize(
+        ("page_size", "expected_width"),
+        [
+            pytest.param((612, 792), 500, id="letter"),
+            pytest.param((792, 612), 500, id="landscape-letter"),
+            pytest.param((595, 842), 500, id="a4"),
+            pytest.param((200, 300), 500, id="small-page"),
+            pytest.param((72, 72), 300, id="tiny-page-capped"),
+        ],
+    )
+    def test_thumbnail_width(
+        self,
+        tmp_path: Path,
+        work_dir: Path,
+        page_size: tuple[int, int],
+        expected_width: int,
+    ) -> None:
+        """
+        GIVEN:
+            - A PDF whose first page has the given size in points
+        WHEN:
+            - A thumbnail is made from it
+        THEN:
+            - The thumbnail has the expected width
+        """
+        pdf_path = self._write_blank_pdf(tmp_path / "in.pdf", page_size)
+
+        thumb = make_thumbnail_from_pdf(pdf_path, work_dir)
+
+        assert thumb == work_dir / "convert.webp"
+        with Image.open(thumb) as im:
+            assert im.format == "WEBP"
+            assert im.width == expected_width
+
+    @classmethod
+    def _write_pdf_without_xref(cls, path: Path) -> Path:
+        """
+        Cuts off the xref and trailer, which pdftoppm cannot recover from but qpdf can.
+        """
+        cls._write_blank_pdf(path)
+        data = path.read_bytes()
+        path.write_bytes(data[: data.rindex(b"\nxref")])
+        return path
+
+    def test_qpdf_repair_produces_real_thumbnail(
+        self,
+        tmp_path: Path,
+        work_dir: Path,
+    ) -> None:
+        """
+        GIVEN:
+            - A PDF with its xref table and trailer cut off
+        WHEN:
+            - A thumbnail is made from it
+        THEN:
+            - The thumbnail is rendered from a qpdf repaired copy
+            - The original file is unchanged
+        """
+        pdf_path = self._write_pdf_without_xref(tmp_path / "broken.pdf")
+        original_bytes = pdf_path.read_bytes()
+
+        with pytest.raises(ParseError):
+            rasterize_pdf_page_to_png(pdf_path, work_dir / "probe.png", dpi=50)
+
+        thumb = make_thumbnail_from_pdf(pdf_path, work_dir)
+
+        assert thumb == work_dir / "convert_qpdf.webp"
+        with Image.open(thumb) as im:
+            assert im.format == "WEBP"
+            assert im.width == 500
+        assert pdf_path.read_bytes() == original_bytes
+
+    @pytest.mark.parametrize(
+        "qpdf_error",
+        [
+            pytest.param(subprocess.CalledProcessError(2, "qpdf"), id="qpdf-fails"),
+            pytest.param(None, id="repaired-still-unrenderable"),
+        ],
+    )
+    def test_double_failure_uses_default_thumbnail(
+        self,
+        mocker: MockerFixture,
+        tmp_path: Path,
+        work_dir: Path,
+        qpdf_error: subprocess.CalledProcessError | None,
+    ) -> None:
+        """
+        GIVEN:
+            - A PDF that cannot be rendered, even after qpdf repair
+        WHEN:
+            - A thumbnail is made from it
+        THEN:
+            - A copy of the default thumbnail is returned
+        """
+        mocker.patch(
+            "documents.parsers.rasterize_pdf_page_to_png",
+            side_effect=ParseError("Does not compute."),
+        )
+        if qpdf_error is not None:
+            mocker.patch("documents.parsers.run_subprocess", side_effect=qpdf_error)
+        pdf_path = self._write_blank_pdf(tmp_path / "in.pdf")
+
+        thumb = make_thumbnail_from_pdf(pdf_path, work_dir)
+
+        assert thumb == work_dir / "document.webp"
+        assert thumb.read_bytes() == get_default_thumbnail().read_bytes()
+
+
+class TestRasterizePdfPageToPng:
+    @staticmethod
+    def _write_pdf(
+        path: Path,
+        *,
+        crop_box: tuple[float, float, float, float] | None = None,
+        rotate: int | None = None,
+    ) -> Path:
+        pdf = pikepdf.new()
+        pdf.add_blank_page(page_size=(144, 72))
+        pdf.add_blank_page(page_size=(300, 300))
+        page = pdf.pages[0]
+        if crop_box is not None:
+            page.obj.CropBox = pikepdf.Array(crop_box)
+        if rotate is not None:
+            page.obj.Rotate = rotate
+        pdf.save(path)
+        return path
+
+    @pytest.mark.parametrize(
+        ("crop_box", "rotate", "expected_size"),
+        [
+            pytest.param(None, None, (144, 72), id="plain"),
+            pytest.param(None, 90, (72, 144), id="rotated-90"),
+            pytest.param((0, 0, 72, 36), None, (72, 36), id="crop-box"),
+        ],
+    )
+    def test_renders_first_page_to_exact_path(
+        self,
+        tmp_path: Path,
+        crop_box: tuple[float, float, float, float] | None,
+        rotate: int | None,
+        expected_size: tuple[int, int],
+    ) -> None:
+        """
+        GIVEN:
+            - A two page PDF, first page optionally cropped or rotated
+        WHEN:
+            - The first page is rasterized at 72 DPI
+        THEN:
+            - Only out_path is written, sized to the first page's crop and rotation
+        """
+        pdf_path = self._write_pdf(
+            tmp_path / "in.pdf",
+            crop_box=crop_box,
+            rotate=rotate,
+        )
+        out_dir = tmp_path / "out"
+        out_dir.mkdir()
+        out_path = out_dir / "page1.png"
+
+        rasterize_pdf_page_to_png(pdf_path, out_path, dpi=72)
+
+        assert list(out_dir.iterdir()) == [out_path]
+        with Image.open(out_path) as im:
+            assert im.format == "PNG"
+            assert im.size == expected_size
+
+    def test_failure_raises_parse_error(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - A file that is not a PDF
+        WHEN:
+            - Rasterization is attempted
+        THEN:
+            - A ParseError is raised
+        """
+        bad = tmp_path / "bad.pdf"
+        bad.write_bytes(b"not a pdf")
+
+        with pytest.raises(ParseError):
+            rasterize_pdf_page_to_png(bad, tmp_path / "page1.png", dpi=72)
+
+
+class TestEncodeThumbnailWebp:
+    @pytest.mark.parametrize(
+        ("mode", "color"),
+        [
+            pytest.param("RGBA", (0, 0, 0, 0), id="rgba"),
+            pytest.param("LA", (0, 0), id="la"),
+        ],
+    )
+    def test_alpha_flattened_onto_white(
+        self,
+        tmp_path: Path,
+        mode: str,
+        color: tuple[int, ...],
+    ) -> None:
+        """
+        GIVEN:
+            - A fully transparent PNG with an alpha channel
+        WHEN:
+            - It is encoded as a thumbnail
+        THEN:
+            - The WebP output is RGB with the transparency flattened to white
+        """
+        png_path = tmp_path / "in.png"
+        Image.new(mode, (20, 10), color).save(png_path)
+        out_path = tmp_path / "out.webp"
+
+        encode_thumbnail_webp(png_path, out_path)
+
+        with Image.open(out_path) as im:
+            assert im.format == "WEBP"
+            assert im.mode == "RGB"
+            assert im.size == (20, 10)
+            red, green, blue = im.getpixel((10, 5))
+            assert min(red, green, blue) >= 250
+
+    @pytest.mark.parametrize(
+        ("in_size", "supersample", "expected_size"),
+        [
+            pytest.param((1000, 2000), 1, (500, 1000), id="too-wide-shrunk"),
+            pytest.param((100, 10000), 1, (50, 5000), id="too-tall-shrunk"),
+            pytest.param((100, 200), 1, (100, 200), id="small-not-enlarged"),
+            pytest.param((1000, 1400), 2, (500, 700), id="2x-halved"),
+            pytest.param((1001, 1401), 2, (500, 700), id="2x-odd-rounded"),
+            pytest.param((600, 800), 2, (300, 400), id="2x-small-not-enlarged"),
+            pytest.param((900, 1200), 2, (450, 600), id="2x-below-clamp"),
+        ],
+    )
+    def test_size_clamped_and_downsampled(
+        self,
+        tmp_path: Path,
+        in_size: tuple[int, int],
+        supersample: int,
+        expected_size: tuple[int, int],
+    ) -> None:
+        """
+        GIVEN:
+            - A rendered image and its supersample factor
+        WHEN:
+            - It is encoded as a thumbnail with that factor
+        THEN:
+            - It is downsampled, fit within 500x5000 and never enlarged
+        """
+        png_path = tmp_path / "in.png"
+        Image.new("RGB", in_size, (255, 255, 255)).save(png_path)
+        out_path = tmp_path / "out.webp"
+
+        encode_thumbnail_webp(png_path, out_path, supersample=supersample)
+
+        with Image.open(out_path) as im:
+            assert im.size == expected_size
+
+    @pytest.mark.parametrize(
+        "error",
+        [
+            pytest.param(OSError("broken image"), id="os-error"),
+            pytest.param(Image.DecompressionBombError("too large"), id="bomb"),
+        ],
+    )
+    def test_decode_failure_raises_parse_error(
+        self,
+        tmp_path: Path,
+        mocker: MockerFixture,
+        error: Exception,
+    ) -> None:
+        """
+        GIVEN:
+            - Opening the rendered image fails
+        WHEN:
+            - It is encoded as a thumbnail
+        THEN:
+            - A ParseError is raised
+        """
+        png_path = tmp_path / "in.png"
+        Image.new("RGB", (10, 10)).save(png_path)
+        mocker.patch("PIL.Image.open", side_effect=error)
+
+        with pytest.raises(ParseError):
+            encode_thumbnail_webp(png_path, tmp_path / "out.webp")
@@ -18,7 +18,6 @@ from documents.models import Correspondent
 from documents.models import DocumentType
 from documents.models import StoragePath
 from documents.models import Tag
-from documents.permissions import has_perms_owner_aware
 from documents.permissions import permitted_document_ids
 from documents.permissions import permitted_object_ids
 from documents.permissions import restrict_queryset_to_visible
@@ -33,8 +32,6 @@ from paperless_testing.permissions import grant_global
 from paperless_testing.permissions import grant_object

 if TYPE_CHECKING:
-    from django.contrib.auth.models import User
-
    from paperless_testing.dirs import PaperlessDirs


@@ -181,382 +178,6 @@ class TestPermittedDocumentIdsIncludeDeleted:
        )


-@pytest.mark.django_db
-class TestPermittedDocumentIdsVersions:
-    """
-    A version is authorized by its root document: the version's own owner and
-    grants never matter.
-    """
-
-    @pytest.mark.parametrize(
-        ("root_owner", "version_owner", "expected_visible"),
-        [
-            pytest.param(
-                "other",
-                "nobody",
-                False,
-                id="unowned-version-of-private-root",
-            ),
-            pytest.param("other", "user", False, id="own-version-of-private-root"),
-            pytest.param("user", "other", True, id="foreign-version-of-own-root"),
-            pytest.param("user", "nobody", True, id="unowned-version-of-own-root"),
-            pytest.param("nobody", "other", True, id="private-version-of-unowned-root"),
-        ],
-    )
-    def test_version_follows_root_owner(
-        self,
-        root_owner: str,
-        version_owner: str,
-        *,
-        expected_visible: bool,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document and a version with differing owners
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - The version is visible exactly when its root is
-        """
-        user = UserFactory()
-        owners = {"user": user, "other": UserFactory(), "nobody": None}
-        root = DocumentFactory(owner=owners[root_owner])
-        version = DocumentFactory(root_document=root, owner=owners[version_owner])
-
-        visible = set(permitted_document_ids(user))
-
-        assert (version.pk in visible) is expected_visible
-        assert (root.pk in visible) is expected_visible
-
-    @staticmethod
-    def grantee(user: User, kind: str) -> User | Group:
-        """The user itself, or a new group the user belongs to."""
-        if kind == "user":
-            return user
-        group = Group.objects.create(name="shared")
-        user.groups.add(group)
-        return group
-
-    @pytest.mark.parametrize(
-        "grantee_kind",
-        [pytest.param("user", id="user"), pytest.param("group", id="group")],
-    )
-    def test_grant_on_root_applies_to_version(self, grantee_kind: str) -> None:
-        """
-        GIVEN:
-            - A private root document shared with a user or one of their groups
-            - A version of it owned by someone else
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - Both the root and the version are visible
-            - A user without the grant sees neither
-        """
-        user = UserFactory()
-        stranger = UserFactory()
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-        grant_object(self.grantee(user, grantee_kind), root, "view_document")
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[root.pk, version.pk],
-            expected_hidden=[],
-        )
-        assert_visible_document_ids(
-            permitted_document_ids(stranger),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    @pytest.mark.parametrize(
-        "grantee_kind",
-        [pytest.param("user", id="user"), pytest.param("group", id="group")],
-    )
-    def test_grant_on_version_is_ignored(self, grantee_kind: str) -> None:
-        """
-        GIVEN:
-            - A private root document
-            - A version with an explicit grant for the user or one of their groups
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - Neither the root nor the version is visible
-        """
-        user = UserFactory()
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-        grant_object(self.grantee(user, grantee_kind), version, "view_document")
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    def test_grant_on_one_root_does_not_reach_another_roots_version(self) -> None:
-        """
-        GIVEN:
-            - Two private roots, each with a version
-            - The user may view only the first root
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - Only the first root and its version are visible
-        """
-        user = UserFactory()
-        first = DocumentFactory(owner=UserFactory())
-        first_version = DocumentFactory(root_document=first, owner=UserFactory())
-        second = DocumentFactory(owner=UserFactory())
-        second_version = DocumentFactory(root_document=second, owner=user)
-        grant_object(user, first, "view_document")
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[first.pk, first_version.pk],
-            expected_hidden=[second.pk, second_version.pk],
-        )
-
-    def test_user_in_several_groups(self) -> None:
-        """
-        GIVEN:
-            - A user in two groups
-            - Two private roots shared with one group each, and a third shared with nobody
-            - A version of each root
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - The two shared roots and their versions are visible
-            - The third root and its version are not
-        """
-        user = UserFactory()
-        groups = [Group.objects.create(name=f"group{i}") for i in range(2)]
-        user.groups.add(*groups)
-        shared = [DocumentFactory(owner=UserFactory()) for _ in groups]
-        for root, group in zip(shared, groups, strict=True):
-            grant_object(group, root, "view_document")
-        unshared = DocumentFactory(owner=UserFactory())
-        shared_versions = [
-            DocumentFactory(root_document=root, owner=UserFactory()) for root in shared
-        ]
-        unshared_version = DocumentFactory(root_document=unshared, owner=None)
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[
-                *(root.pk for root in shared),
-                *(version.pk for version in shared_versions),
-            ],
-            expected_hidden=[unshared.pk, unshared_version.pk],
-        )
-
-    def test_permission_is_resolved_through_the_root(self) -> None:
-        """
-        GIVEN:
-            - A private root document where the user may view and change
-        WHEN:
-            - The permitted ids are resolved for view, change and delete
-        THEN:
-            - The version is visible for view and change only
-        """
-        user = UserFactory()
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-        grant_object(user, root, "view_document", "change_document")
-
-        assert version.pk in set(permitted_document_ids(user))
-        assert version.pk in set(permitted_document_ids(user, perm="change_document"))
-        assert version.pk in set(
-            permitted_document_ids(user, perm="documents.change_document"),
-        )
-        assert version.pk not in set(
-            permitted_document_ids(user, perm="delete_document"),
-        )
-
-    def test_anonymous_sees_versions_of_unowned_roots_only(self) -> None:
-        """
-        GIVEN:
-            - A version owned by nobody under a private root
-            - A version owned by someone under an unowned root
-        WHEN:
-            - The permitted document ids are resolved for an anonymous user
-        THEN:
-            - Only the version of the unowned root is visible
-        """
-        private_root = DocumentFactory(owner=UserFactory())
-        private_version = DocumentFactory(root_document=private_root, owner=None)
-        open_root = DocumentFactory(owner=None)
-        open_version = DocumentFactory(root_document=open_root, owner=UserFactory())
-
-        assert_visible_document_ids(
-            permitted_document_ids(AnonymousUser()),
-            expected_visible=[open_root.pk, open_version.pk],
-            expected_hidden=[private_root.pk, private_version.pk],
-        )
-
-    def test_deleted_versions_follow_their_deleted_root(self) -> None:
-        """
-        GIVEN:
-            - A soft-deleted root document and its version, which deleting the
-              root soft-deletes too; the version is owned by someone else
-        WHEN:
-            - The permitted document ids are resolved with and without deleted
-              documents
-        THEN:
-            - Nothing is visible by default
-            - With deleted documents included, the version is visible to the
-              root's owner and not to the version's own owner
-        """
-        owner = UserFactory()
-        version_owner = UserFactory()
-        root = DocumentFactory(owner=owner)
-        version = DocumentFactory(root_document=root, owner=version_owner)
-        root.delete()
-
-        assert not {root.pk, version.pk} & set(permitted_document_ids(owner))
-        assert_visible_document_ids(
-            permitted_document_ids(owner, include_deleted=True),
-            expected_visible=[root.pk, version.pk],
-            expected_hidden=[],
-        )
-        assert_visible_document_ids(
-            permitted_document_ids(version_owner, include_deleted=True),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    @pytest.mark.parametrize(
-        "is_superuser",
-        [
-            pytest.param(False, id="regular-user"),
-            pytest.param(True, id="superuser"),
-        ],
-    )
-    def test_inactive_user_sees_no_versions(self, *, is_superuser: bool) -> None:
-        """
-        GIVEN:
-            - An inactive user, possibly a superuser, who owns a root and its version
-        WHEN:
-            - The permitted document ids are resolved for them
-        THEN:
-            - Nothing is visible
-        """
-        user = UserFactory(is_active=False, is_superuser=is_superuser)
-        root = DocumentFactory(owner=user)
-        version = DocumentFactory(root_document=root, owner=user)
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    def test_superuser_sees_all_versions(self) -> None:
-        """
-        GIVEN:
-            - A private root owned by someone else, with a version
-        WHEN:
-            - The permitted document ids are resolved for a superuser
-        THEN:
-            - Both the root and the version are visible
-        """
-        superuser = UserFactory(superuser=True)
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-
-        assert_visible_document_ids(
-            permitted_document_ids(superuser),
-            expected_visible=[root.pk, version.pk],
-            expected_hidden=[],
-        )
-
-
-@pytest.mark.django_db
-class TestHasPermsOwnerAwareVersions:
-    """
-    The single-object check agrees with permitted_document_ids: a version is
-    authorized by its root document.
-    """
-
-    @pytest.mark.parametrize(
-        ("root_owner", "version_owner", "expected"),
-        [
-            pytest.param(
-                "other",
-                "nobody",
-                False,
-                id="unowned-version-of-private-root",
-            ),
-            pytest.param("other", "user", False, id="own-version-of-private-root"),
-            pytest.param("user", "other", True, id="foreign-version-of-own-root"),
-            pytest.param("nobody", "other", True, id="private-version-of-unowned-root"),
-        ],
-    )
-    def test_version_follows_root_owner(
-        self,
-        root_owner: str,
-        version_owner: str,
-        *,
-        expected: bool,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document and a version with differing owners
-        WHEN:
-            - The single-object check runs for the version
-        THEN:
-            - The version is allowed exactly when its root is
-        """
-        user = UserFactory()
-        owners = {"user": user, "other": UserFactory(), "nobody": None}
-        root = DocumentFactory(owner=owners[root_owner])
-        version = DocumentFactory(root_document=root, owner=owners[version_owner])
-
-        assert has_perms_owner_aware(user, "view_document", version) is expected
-        assert has_perms_owner_aware(user, "view_document", root) is expected
-
-    def test_grant_on_root_applies_and_grant_on_version_does_not(self) -> None:
-        """
-        GIVEN:
-            - A private root with a version, and a second private root with a version
-            - The user may change only the first root, and was granted the second
-              root's version directly
-        WHEN:
-            - The single-object check runs for each version
-        THEN:
-            - Only the first root's version is allowed
-        """
-        user = UserFactory()
-        shared_root = DocumentFactory(owner=UserFactory())
-        shared_version = DocumentFactory(root_document=shared_root, owner=UserFactory())
-        private_root = DocumentFactory(owner=UserFactory())
-        private_version = DocumentFactory(
-            root_document=private_root,
-            owner=UserFactory(),
-        )
-        grant_object(user, shared_root, "change_document")
-        grant_object(user, private_version, "change_document")
-
-        assert has_perms_owner_aware(user, "change_document", shared_version)
-        assert not has_perms_owner_aware(user, "change_document", private_version)
-
-    def test_other_models_use_their_own_owner(self) -> None:
-        """
-        GIVEN:
-            - A tag owned by someone else, and one owned by the user
-        WHEN:
-            - The single-object check runs for each
-        THEN:
-            - Only the user's own tag is allowed without a grant
-        """
-        user = UserFactory()
-        mine = TagFactory(owner=user)
-        theirs = TagFactory(owner=UserFactory())
-
-        assert has_perms_owner_aware(user, "view_tag", mine)
-        assert not has_perms_owner_aware(user, "view_tag", theirs)
-
-
@pytest.mark.django_db
 class TestAiChatAllDocumentsPermissionBoundary:
    """
@@ -310,7 +310,7 @@ class TestUpdateContent(DirectoriesMixin, TestCase):

    @mock.patch("documents.tasks.clear_document_caches")
    @mock.patch("documents.search.get_backend")
-    def test_update_content_version_clears_caches_for_root(
+    def test_update_content_version_indexes_root(
        self,
        mock_get_backend: mock.Mock,
        mock_clear_caches: mock.Mock,
@@ -321,8 +321,8 @@ class TestUpdateContent(DirectoriesMixin, TestCase):
        WHEN:
            - Update content task is called for the version
        THEN:
-            - The version's content is updated, not the root's
-            - The document is indexed
+            - The version's content is updated
+            - The root document is indexed rather than the version
            - Caches are cleared for both
        """
        root, version = self._create_root_with_version()
@@ -334,7 +334,8 @@ class TestUpdateContent(DirectoriesMixin, TestCase):
            "my document",
        )
        self.assertEqual(Document.objects.get(pk=root.pk).content, "root content")
-        mock_get_backend.return_value.add_or_update.assert_called_once()
+        indexed = mock_get_backend.return_value.add_or_update.call_args.args[0]
+        self.assertEqual(indexed.pk, root.pk)
        mock_clear_caches.assert_has_calls(
            [mock.call(version.pk), mock.call(root.pk)],
        )
@@ -342,7 +343,7 @@ class TestUpdateContent(DirectoriesMixin, TestCase):
    @override_settings(AI_ENABLED=True, LLM_EMBEDDING_BACKEND="huggingface")
    @mock.patch("documents.tasks.llm_index_add_or_update_document")
    @mock.patch("documents.search.get_backend")
-    def test_update_content_version_updates_llm_index(
+    def test_update_content_version_updates_llm_index_for_root(
        self,
        mock_get_backend: mock.Mock,
        mock_llm_index: mock.Mock,
@@ -354,13 +355,14 @@ class TestUpdateContent(DirectoriesMixin, TestCase):
        WHEN:
            - Update content task is called for the version
        THEN:
-            - The LLM index is updated
+            - The LLM index is updated for the root document, not the version
        """
-        _, version = self._create_root_with_version()
+        root, version = self._create_root_with_version()

        tasks.update_document_content_maybe_archive_file(version.pk)

        mock_llm_index.assert_called_once()
+        self.assertEqual(mock_llm_index.call_args.args[0].pk, root.pk)


 class TestUpdateContentRemoteOCR(DirectoriesMixin, TestCase):
@@ -1,6 +1,11 @@
+from pathlib import Path
+
+import pytest
 import pytest_mock
+from PIL import Image

 from documents.utils import QuerySetStream
+from documents.utils import remove_alpha_channel


 class TestQuerySetStream:
@@ -33,3 +38,99 @@ class TestQuerySetStream:
        # the thing being verified here.
        mock_queryset.count.assert_called_with()
        mock_queryset.iterator.assert_called_once_with(chunk_size=1000)
+
+
+class TestRemoveAlphaChannel:
+    @pytest.mark.parametrize(
+        ("image_format", "mode", "expected_mode", "color", "expected_pixel"),
+        [
+            pytest.param(
+                "PNG",
+                "RGBA",
+                "RGB",
+                (10, 20, 30, 0),
+                (10, 20, 30),
+                id="png-rgba",
+            ),
+            pytest.param(
+                "TIFF",
+                "RGBA",
+                "RGB",
+                (10, 20, 30, 128),
+                (10, 20, 30),
+                id="tiff-rgba",
+            ),
+            pytest.param("PNG", "LA", "L", (40, 0), 40, id="png-la"),
+        ],
+    )
+    def test_drops_alpha_and_keeps_format(
+        self,
+        tmp_path: Path,
+        image_format: str,
+        mode: str,
+        expected_mode: str,
+        color: tuple[int, ...],
+        expected_pixel: int | tuple[int, ...],
+    ) -> None:
+        """
+        GIVEN:
+            - An image with an alpha channel
+        WHEN:
+            - The alpha channel is removed to a destination without an extension
+        THEN:
+            - The destination has the matching opaque mode, the same size and
+              format, and the color values are kept rather than composited
+        """
+        source = tmp_path / "source"
+        Image.new(mode, (8, 6), color).save(source, format=image_format)
+        dest = tmp_path / "no-alpha"
+
+        result = remove_alpha_channel(source, dest)
+
+        assert result == dest
+        with Image.open(dest) as out:
+            assert out.mode == expected_mode
+            assert out.size == (8, 6)
+            assert out.format == image_format
+            assert out.getpixel((0, 0)) == expected_pixel
+
+    def test_keeps_every_frame_of_a_multi_page_tiff(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - A multi-page TIFF where every page has an alpha channel
+        WHEN:
+            - The alpha channel is removed
+        THEN:
+            - All pages are kept and none has an alpha channel
+        """
+        source = tmp_path / "multi.tiff"
+        first = Image.new("RGBA", (8, 6), (255, 0, 0, 50))
+        rest = [Image.new("RGBA", (8, 6), (0, 255, 0, 50)) for _ in range(2)]
+        first.save(source, save_all=True, append_images=rest)
+        dest = tmp_path / "multi-no-alpha.tiff"
+
+        remove_alpha_channel(source, dest)
+
+        with Image.open(dest) as out:
+            assert out.n_frames == 3
+            for index in range(out.n_frames):
+                out.seek(index)
+                assert out.mode == "RGB"
+
+    def test_keeps_dpi(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - An alpha image with a DPI set
+        WHEN:
+            - The alpha channel is removed
+        THEN:
+            - The DPI is unchanged, since OCR scaling depends on it
+        """
+        source = tmp_path / "source.png"
+        Image.new("RGBA", (8, 6)).save(source, dpi=(300, 300))
+        dest = tmp_path / "dest.png"
+
+        remove_alpha_channel(source, dest)
+
+        with Image.open(dest) as out:
+            assert round(out.info["dpi"][0]) == 300
@@ -9,11 +9,13 @@ from pathlib import Path
 from subprocess import CompletedProcess
 from subprocess import run
 from typing import TYPE_CHECKING
+from typing import Any
 from typing import Generic
 from typing import TypeVar

 from django.conf import settings
 from PIL import Image
+from PIL import ImageSequence

 if TYPE_CHECKING:
    from django.db.models import Model
@@ -128,6 +130,30 @@ def maybe_override_pixel_limit() -> None:
        Image.MAX_IMAGE_PIXELS = pixel_count


+def remove_alpha_channel(source: Path, dest: Path) -> Path:
+    """
+    Writes a copy of the image with its alpha channel dropped, keeping the
+    format, every frame, the DPI and any ICC profile.
+
+    The channel is dropped, not composited, so transparent pixels keep their
+    underlying color. Returns dest.
+    """
+    with Image.open(source) as im:
+        image_format = im.format
+        opaque_mode = "L" if im.mode == "LA" else "RGB"
+        frames = [frame.convert(opaque_mode) for frame in ImageSequence.Iterator(im)]
+        save_kwargs: dict[str, Any] = {}
+        if "dpi" in im.info:
+            save_kwargs["dpi"] = im.info["dpi"]
+        if "icc_profile" in im.info:
+            save_kwargs["icc_profile"] = im.info["icc_profile"]
+        if len(frames) > 1:
+            save_kwargs["save_all"] = True
+            save_kwargs["append_images"] = frames[1:]
+    frames[0].save(dest, format=image_format, **save_kwargs)
+    return dest
+
+
 def run_subprocess(
    arguments: list[str],
    env: dict[str, str] | None = None,
@@ -17,26 +17,9 @@ from django.db.models.functions import RowNumber
 from documents.models import Document

 if TYPE_CHECKING:
-    from collections.abc import Iterable
-
    from rest_framework.request import Request


-def root_document_ids(ids: Iterable[int]) -> QuerySet[int]:
-    """
-    The ids of the root documents of the given documents: a root stands for
-    itself and a version for its root. Only the indexes' bookkeeping needs
-    this, since they hold root documents only.
-    """
-    return (
-        Document.objects.filter(pk__in=ids)
-        .annotate(root_id=Coalesce("root_document_id", "id"))
-        .order_by()
-        .values_list("root_id", flat=True)
-        .distinct()
-    )
-
-
 def versions_newest_first(documents: QuerySet[Document]) -> QuerySet[Document]:
    """
    Sorts versions so the newest one comes first using version_index and not on id,
@@ -174,6 +174,7 @@ from documents.permissions import TrashPermissions
 from documents.permissions import ViewDocumentsPermissions
 from documents.permissions import annotate_document_count_by_ids
 from documents.permissions import annotate_document_count_for_related_queryset
+from documents.permissions import documents_without_permitted_root
 from documents.permissions import get_document_count_filter_for_user
 from documents.permissions import get_objects_for_user_owner_aware
 from documents.permissions import has_global_statistics_permission
@@ -329,10 +330,9 @@ def _get_tantivy_query_and_mode(params):
 def _get_more_like_id(query_params: dict[str, Any], user: User | None) -> int:
    try:
        more_like_doc_id = int(query_params["more_like_id"])
-        more_like_doc = Document.objects.select_related(
-            "owner",
-            "root_document__owner",
-        ).get(pk=more_like_doc_id)
+        more_like_doc = Document.objects.select_related("owner").get(
+            pk=more_like_doc_id,
+        )
    except (TypeError, ValueError, Document.DoesNotExist):
        raise PermissionDenied(_("Invalid more_like_id"))

@@ -343,8 +343,7 @@ def _get_more_like_id(query_params: dict[str, Any], user: User | None) -> int:
    ):
        raise PermissionDenied(_("Insufficient permissions."))

-    # Only root documents are indexed, a version stands for its root
-    return more_like_doc.root_document_id or more_like_doc.pk
+    return more_like_doc_id


 class SearchParams(NamedTuple):
@@ -1561,7 +1560,7 @@ class DocumentViewSet(
        if request.user is not None and not has_perms_owner_aware(
            request.user,
            "change_document",
-            doc,
+            get_root_document(doc),
        ):
            return HttpResponseForbidden("Insufficient permissions")

@@ -1624,7 +1623,7 @@ class DocumentViewSet(
        if request.user is not None and not has_perms_owner_aware(
            request.user,
            "change_document",
-            doc,
+            get_root_document(doc),
        ):
            return HttpResponseForbidden("Insufficient permissions")

@@ -1877,7 +1876,7 @@ class DocumentViewSet(
            if currentUser is not None and not has_perms_owner_aware(
                currentUser,
                "view_document",
-                doc,
+                get_root_document(doc),
            ):
                return HttpResponseForbidden("Insufficient permissions to view notes")
        except Document.DoesNotExist:
@@ -1899,7 +1898,7 @@ class DocumentViewSet(
                if currentUser is not None and not has_perms_owner_aware(
                    currentUser,
                    "change_document",
-                    doc,
+                    get_root_document(doc),
                ):
                    return HttpResponseForbidden(
                        "Insufficient permissions to create notes",
@@ -1942,7 +1941,7 @@ class DocumentViewSet(
            if currentUser is not None and not has_perms_owner_aware(
                currentUser,
                "change_document",
-                doc,
+                get_root_document(doc),
            ):
                return HttpResponseForbidden("Insufficient permissions to delete notes")

@@ -1992,7 +1991,7 @@ class DocumentViewSet(
            if currentUser is not None and not has_perms_owner_aware(
                currentUser,
                "change_document",
-                doc,
+                get_root_document(doc),
            ):
                return HttpResponseForbidden(
                    "Insufficient permissions to add share link",
@@ -2118,7 +2117,7 @@ class DocumentViewSet(
        documents = Document.objects.filter(pk__in=document_ids)
        if (
            request.user is not None
-            and documents.exclude(id__in=permitted_document_ids(request.user)).exists()
+            and documents_without_permitted_root(documents, request.user).exists()
        ):
            return HttpResponseForbidden("Insufficient permissions")

@@ -2453,7 +2452,7 @@ class ChatStreamingView(GenericAPIView[Any]):
            if not has_perms_owner_aware(
                request.user,
                "view_document",
-                document,
+                get_root_document(document),
            ):
                return HttpResponseForbidden("Insufficient permissions")

@@ -3010,8 +3009,12 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
            user.has_perm(
                "documents.change_document",
            )
-            and not Document.global_objects.filter(pk__in=documents)
-            .exclude(pk__in=permitted_document_ids(user, perm="change_document"))
+            and not Document.global_objects.filter(
+                pk__in=[doc.pk for doc in root_docs],
+            )
+            .exclude(
+                pk__in=permitted_document_ids(user, perm="change_document"),
+            )
            .exists()
        )

@@ -3624,7 +3627,7 @@ class SelectionDataView(DocumentSelectionMixin, GenericAPIView[Any]):
        documents = Document.objects.filter(pk__in=ids)
        if (
            documents.count() != len(ids)
-            or documents.exclude(id__in=permitted_document_ids(request.user)).exists()
+            or documents_without_permitted_root(documents, request.user).exists()
        ):
            return HttpResponseForbidden("Insufficient permissions")

@@ -4121,16 +4124,21 @@ class BulkDownloadView(DocumentSelectionMixin, GenericAPIView[Any]):
            validated_data=serializer.validated_data,
        )
        documents = Document.objects.filter(pk__in=ids)
+        versioned_documents = []
        compression = serializer.validated_data.get("compression")
        content = serializer.validated_data.get("content")
        follow_filename_format = serializer.validated_data.get("follow_formatting")

-        if documents.exclude(id__in=permitted_document_ids(request.user)).exists():
-            return HttpResponseForbidden("Insufficient permissions")
-        versioned_documents = [
-            get_latest_version_for_root(get_root_document(document))
-            for document in documents
-        ]
+        permitted_ids = set(permitted_document_ids(request.user))
+        for document in documents:
+            root_doc = get_root_document(document)
+            if root_doc.pk not in permitted_ids:
+                return HttpResponseForbidden("Insufficient permissions")
+            versioned_documents.append(
+                get_latest_version_for_root(
+                    root_doc,
+                ),
+            )

        if content == "both":
            strategy_class = OriginalAndArchiveStrategy
@@ -4803,7 +4811,7 @@ class ShareLinkBundleViewSet(PassUserMixin, ModelViewSet[ShareLinkBundle]):
            )

        denied_id = (
-            documents_qs.exclude(id__in=permitted_document_ids(request.user))
+            documents_without_permitted_root(documents_qs, request.user)
            .order_by("pk")
            .values_list("pk", flat=True)
            .first()
@@ -5649,12 +5657,11 @@ class TrashView(ListModelMixin, PassUserMixin):
            if doc_ids is not None
            else self.filter_queryset(self.get_queryset()).all()
        )
-        if docs.exclude(
-            id__in=permitted_document_ids(
-                request.user,
-                perm="delete_document",
-                include_deleted=True,
-            ),
+        if documents_without_permitted_root(
+            docs,
+            request.user,
+            perm="delete_document",
+            include_deleted=True,
        ).exists():
            return HttpResponseForbidden("Insufficient permissions")
        action = serializer.validated_data.get("action")
@@ -82,7 +82,7 @@ def binaries_check(app_configs: Any, **kwargs: Any) -> list[Error]:
    error = "Paperless can't find {}. Without it, consumption is impossible."
    hint = "Either it's not in your ${PATH} or it's not installed."

-    binaries = (settings.CONVERT_BINARY, "tesseract", "gs")
+    binaries = ("tesseract", "gs")

    check_messages = []
    for binary in binaries:
@@ -272,27 +272,26 @@ def check_deprecated_db_settings(
    Detects legacy advanced options that should be migrated to
    PAPERLESS_DB_OPTIONS. Returns one Warning per deprecated variable found.
    """
-    deprecated_vars: dict[str, str] = {
-        "PAPERLESS_DB_TIMEOUT": "timeout",
-        "PAPERLESS_DB_POOLSIZE": "pool.min_size / pool.max_size",
-        "PAPERLESS_DBSSLMODE": "sslmode",
-        "PAPERLESS_DBSSLROOTCERT": "sslrootcert",
-        "PAPERLESS_DBSSLCERT": "sslcert",
-        "PAPERLESS_DBSSLKEY": "sslkey",
-    }
+    deprecated_vars = (
+        "PAPERLESS_DB_TIMEOUT",
+        "PAPERLESS_DB_POOLSIZE",
+        "PAPERLESS_DBSSLMODE",
+        "PAPERLESS_DBSSLROOTCERT",
+        "PAPERLESS_DBSSLCERT",
+        "PAPERLESS_DBSSLKEY",
+    )

    warnings: list[Warning] = []

-    for var_name, db_option_key in deprecated_vars.items():
+    for var_name in deprecated_vars:
        if not os.getenv(var_name):
            continue
        warnings.append(
            Warning(
                f"Deprecated environment variable: {var_name}",
                hint=(
-                    f"{var_name} is no longer supported and will be removed in v3.2. "
+                    f"{var_name} is deprecated. "
                    f"Set the equivalent option via PAPERLESS_DB_OPTIONS instead. "
-                    f'Example: PAPERLESS_DB_OPTIONS=\'{{"{db_option_key}": "<value>"}}\'. '
                    "See https://docs.paperless-ngx.com/migration-v3/ for the full reference."
                ),
                id="paperless.W001",
@@ -19,7 +19,7 @@ from documents.parsers import ParseError
 from documents.parsers import make_thumbnail_from_pdf
 from documents.utils import copy_file_with_basic_stats
 from documents.utils import maybe_override_pixel_limit
-from documents.utils import run_subprocess
+from documents.utils import remove_alpha_channel
 from paperless.config import OcrConfig
 from paperless.models import CleanChoices
 from paperless.models import ModeChoices
@@ -197,18 +197,7 @@ class RasterisedDocumentParser:
            return im.mode in ("RGBA", "LA")

    def remove_alpha(self, image_path: Path) -> Path:
-        no_alpha_image = Path(self.tempdir) / "image-no-alpha"
-        run_subprocess(
-            [
-                settings.CONVERT_BINARY,
-                "-alpha",
-                "off",
-                str(image_path),
-                str(no_alpha_image),
-            ],
-            logger=self.log,
-        )
-        return no_alpha_image
+        return remove_alpha_channel(image_path, Path(self.tempdir) / "image-no-alpha")

    def get_dpi(self, image: Path) -> int | None:
        try:
@@ -265,6 +265,52 @@ def get_page_count_for_pdf(
        return None


+def get_pdf_first_page_size_points(
+    path: Path,
+    log: logging.Logger | None = None,
+) -> tuple[float, float] | None:
+    """Return the first page's (width, height) in PDF points, post-rotation.
+
+    Uses the CropBox (MediaBox if absent), which must match pdftoppm's
+    ``-cropbox`` or the computed DPI targets the wrong box.
+
+    Swaps width and height for 90/270 rotation. ``page.rotation`` resolves
+    inherited and negative ``/Rotate`` values, a raw lookup does not.
+
+    Parameters
+    ----------
+    path:
+        Absolute path to the PDF file.
+    log:
+        Logger for warnings.  Falls back to the module-level logger when omitted.
+
+    Returns
+    -------
+    tuple[float, float] | None
+        ``(width_points, height_points)``, or ``None`` if the file cannot be
+        opened, has no pages, or the page box is degenerate.
+    """
+    import pikepdf
+
+    _log = log or logger
+    try:
+        with pikepdf.Pdf.open(path) as pdf:
+            if len(pdf.pages) == 0:
+                return None
+            page = pdf.pages[0]
+            llx, lly, urx, ury = (float(v) for v in page.cropbox)
+            width = abs(urx - llx)
+            height = abs(ury - lly)
+            if width <= 0 or height <= 0:
+                return None
+            if page.rotation in (90, 270):
+                width, height = height, width
+            return width, height
+    except Exception as e:
+        _log.warning("Could not determine PDF page size for %s: %s", path, e)
+        return None
+
+
 def extract_pdf_metadata(
    document_path: Path,
    log: logging.Logger | None = None,
@@ -984,11 +984,6 @@ MAX_IMAGE_PIXELS: Final[int | None] = get_int_from_env(
 # GNUPG needs a home directory for some reason
 GNUPG_HOME = os.getenv("HOME", "/tmp")

-# Convert is part of the ImageMagick package
-CONVERT_BINARY = os.getenv("PAPERLESS_CONVERT_BINARY", "convert")
-CONVERT_TMPDIR = os.getenv("PAPERLESS_CONVERT_TMPDIR")
-CONVERT_MEMORY_LIMIT = os.getenv("PAPERLESS_CONVERT_MEMORY_LIMIT")
-
 GS_BINARY = os.getenv("PAPERLESS_GS_BINARY", "gs")

 # Fallback layout for .eml consumption
@@ -15,9 +15,10 @@ from typing import TYPE_CHECKING

 import pytest
 from ocrmypdf import SubprocessOutputError
+from PIL import Image

 from documents.parsers import ParseError
-from documents.parsers import run_convert
+from documents.parsers import rasterize_pdf_page_to_png
 from paperless.models import ModeChoices
 from paperless.parsers import ParserProtocol
 from paperless.parsers.tesseract import RasterisedDocumentParser
@@ -280,24 +281,71 @@ class TestGetThumbnail:
        )
        assert thumb.is_file()

-    def test_thumbnail_fallback_on_convert_error(
+    @pytest.mark.parametrize(
+        ("filename", "expected_height"),
+        [
+            pytest.param("simple-digital.pdf", 647, id="portrait-letter"),
+            pytest.param("rotated.pdf", 386, id="landscape"),
+        ],
+    )
+    def test_thumbnail_is_correct_format_and_size(
+        self,
+        tesseract_parser: RasterisedDocumentParser,
+        tesseract_samples_dir: Path,
+        filename: str,
+        expected_height: int,
+    ) -> None:
+        """
+        GIVEN:
+            - A portrait or landscape PDF
+        WHEN:
+            - A thumbnail is generated
+        THEN:
+            - A 500px wide WebP keeping the page's aspect ratio
+        """
+        thumb = tesseract_parser.get_thumbnail(
+            tesseract_samples_dir / filename,
+            "application/pdf",
+        )
+        with Image.open(thumb) as im:
+            assert im.format == "WEBP"
+            assert im.width == 500
+            assert im.height == pytest.approx(expected_height, abs=2)
+
+    def test_thumbnail_fallback_on_pdftoppm_error(
        self,
        mocker: MockerFixture,
        tesseract_parser: RasterisedDocumentParser,
        tesseract_samples_dir: Path,
    ) -> None:
-        def _raise_on_pdf(input_file, output_file, **kwargs) -> None:
-            if ".pdf" in str(input_file):
+        """
+        GIVEN:
+            - Rasterizing the original PDF fails
+        WHEN:
+            - A thumbnail is generated
+        THEN:
+            - The PDF is repaired with qpdf and a real thumbnail is rendered
+        """
+        original = tesseract_samples_dir / "simple-digital.pdf"
+
+        def _fail_on_original(in_path: Path, out_path: Path, **kwargs) -> None:
+            if in_path == original:
                raise ParseError("Does not compute.")
-            run_convert(input_file=input_file, output_file=output_file, **kwargs)
+            rasterize_pdf_page_to_png(in_path, out_path, **kwargs)

-        mocker.patch("documents.parsers.run_convert", side_effect=_raise_on_pdf)
-
-        thumb = tesseract_parser.get_thumbnail(
-            tesseract_samples_dir / "simple-digital.pdf",
-            "application/pdf",
+        rasterize = mocker.patch(
+            "documents.parsers.rasterize_pdf_page_to_png",
+            side_effect=_fail_on_original,
        )
+
+        thumb = tesseract_parser.get_thumbnail(original, "application/pdf")
+
+        assert rasterize.call_count == 2
        assert thumb.is_file()
+        assert thumb.name == "convert_qpdf.webp"
+        with Image.open(thumb) as im:
+            assert im.format == "WEBP"
+            assert im.width == 500

    def test_thumbnail_encrypted_pdf(
        self,
@@ -25,9 +25,17 @@ class TestChecks:
    def test_binaries(self) -> None:
        assert binaries_check(None) == []

-    def test_binaries_fail(self, settings: Settings) -> None:
-        settings.CONVERT_BINARY = "uuuhh"
-        assert len(binaries_check(None)) == 1
+    def test_binaries_fail(self, mocker: MockerFixture) -> None:
+        """
+        GIVEN:
+            - Neither tesseract nor ghostscript can be found
+        WHEN:
+            - The binaries check runs
+        THEN:
+            - One warning is raised per missing binary
+        """
+        mocker.patch("paperless.checks.shutil.which", return_value=None)
+        assert len(binaries_check(None)) == 2

    @pytest.mark.usefixtures("paperless_dirs")
    def test_paths_check(self) -> None:
@@ -211,14 +219,14 @@ class TestAuditLogChecks:
        assert "auditlog table was found but audit log is disabled." in msgs[0].msg


-DEPRECATED_VARS: dict[str, str] = {
-    "PAPERLESS_DB_TIMEOUT": "timeout",
-    "PAPERLESS_DB_POOLSIZE": "pool.min_size / pool.max_size",
-    "PAPERLESS_DBSSLMODE": "sslmode",
-    "PAPERLESS_DBSSLROOTCERT": "sslrootcert",
-    "PAPERLESS_DBSSLCERT": "sslcert",
-    "PAPERLESS_DBSSLKEY": "sslkey",
-}
+DEPRECATED_VARS = (
+    "PAPERLESS_DB_TIMEOUT",
+    "PAPERLESS_DB_POOLSIZE",
+    "PAPERLESS_DBSSLMODE",
+    "PAPERLESS_DBSSLROOTCERT",
+    "PAPERLESS_DBSSLCERT",
+    "PAPERLESS_DBSSLKEY",
+)


 class TestDeprecatedDbSettings:
@@ -234,26 +242,11 @@ class TestDeprecatedDbSettings:
        result = check_deprecated_db_settings(None)
        assert result == []

-    @pytest.mark.parametrize(
-        ("env_var", "db_option_key"),
-        [
-            pytest.param("PAPERLESS_DB_TIMEOUT", "timeout", id="db-timeout"),
-            pytest.param(
-                "PAPERLESS_DB_POOLSIZE",
-                "pool.min_size / pool.max_size",
-                id="db-poolsize",
-            ),
-            pytest.param("PAPERLESS_DBSSLMODE", "sslmode", id="ssl-mode"),
-            pytest.param("PAPERLESS_DBSSLROOTCERT", "sslrootcert", id="ssl-rootcert"),
-            pytest.param("PAPERLESS_DBSSLCERT", "sslcert", id="ssl-cert"),
-            pytest.param("PAPERLESS_DBSSLKEY", "sslkey", id="ssl-key"),
-        ],
-    )
+    @pytest.mark.parametrize("env_var", DEPRECATED_VARS)
    def test_single_deprecated_var_produces_one_warning(
        self,
        mocker: MockerFixture,
        env_var: str,
-        db_option_key: str,
    ) -> None:
        """Each deprecated var in isolation produces exactly one warning."""
        mocker.patch.dict(os.environ, {env_var: "some_value"}, clear=True)
@@ -264,7 +257,8 @@ class TestDeprecatedDbSettings:
        assert isinstance(warning, Warning)
        assert warning.id == "paperless.W001"
        assert env_var in warning.hint
-        assert db_option_key in warning.hint
+        assert "PAPERLESS_DB_OPTIONS" in warning.hint
+        assert "https://docs.paperless-ngx.com/migration-v3/" in warning.hint

    def test_multiple_deprecated_vars_produce_one_warning_each(
        self,
@@ -6,8 +6,10 @@ import codecs
 from pathlib import Path
 from typing import TYPE_CHECKING

+import pikepdf
 import pytest

+from paperless.parsers.utils import get_pdf_first_page_size_points
 from paperless.parsers.utils import is_tagged_pdf
 from paperless.parsers.utils import pdf_born_digital_text
 from paperless.parsers.utils import post_process_text
@@ -70,6 +72,149 @@ class TestIsTaggedPdf:
        assert is_tagged_pdf(bad) is False


+class TestGetPdfFirstPageSizePoints:
+    @staticmethod
+    def _write_pdf(
+        path: Path,
+        *,
+        media_box: tuple[float, float, float, float] = (0, 0, 600, 800),
+        crop_box: tuple[float, float, float, float] | None = None,
+        page_rotate: int | None = None,
+        inherited_rotate: int | None = None,
+    ) -> Path:
+        pdf = pikepdf.new()
+        pdf.add_blank_page(page_size=(media_box[2], media_box[3]))
+        page = pdf.pages[0]
+        page.obj.MediaBox = pikepdf.Array(media_box)
+        if crop_box is not None:
+            page.obj.CropBox = pikepdf.Array(crop_box)
+        if page_rotate is not None:
+            page.obj.Rotate = page_rotate
+        if inherited_rotate is not None:
+            pdf.Root.Pages.Rotate = inherited_rotate
+        pdf.save(path)
+        return path
+
+    def test_letter_sample(self) -> None:
+        """
+        GIVEN:
+            - A US Letter sample PDF with no CropBox and no rotation
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - The MediaBox size in points is returned
+        """
+        assert get_pdf_first_page_size_points(SAMPLES / "simple-digital.pdf") == (
+            612.0,
+            792.0,
+        )
+
+    @pytest.mark.parametrize(
+        ("rotate", "expected"),
+        [
+            pytest.param(0, (600.0, 800.0), id="rotate-0"),
+            pytest.param(90, (800.0, 600.0), id="rotate-90"),
+            pytest.param(180, (600.0, 800.0), id="rotate-180"),
+            pytest.param(270, (800.0, 600.0), id="rotate-270"),
+            pytest.param(-90, (800.0, 600.0), id="rotate-negative-90"),
+        ],
+    )
+    def test_page_rotation_swaps_dimensions(
+        self,
+        tmp_path: Path,
+        rotate: int,
+        expected: tuple[float, float],
+    ) -> None:
+        """
+        GIVEN:
+            - A portrait PDF page with /Rotate set directly on the page
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - Width and height are swapped for quarter-turn rotations only
+        """
+        pdf_path = self._write_pdf(tmp_path / "rotated.pdf", page_rotate=rotate)
+        assert get_pdf_first_page_size_points(pdf_path) == expected
+
+    def test_inherited_rotation_swaps_dimensions(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - A page inheriting /Rotate 90 from the /Pages node
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - Width and height are swapped
+        """
+        pdf_path = self._write_pdf(tmp_path / "inherited.pdf", inherited_rotate=90)
+        assert get_pdf_first_page_size_points(pdf_path) == (800.0, 600.0)
+
+    def test_crop_box_preferred_over_media_box(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - A PDF page with a CropBox smaller than its MediaBox
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - The CropBox size is returned
+        """
+        pdf_path = self._write_pdf(
+            tmp_path / "cropped.pdf",
+            crop_box=(50, 100, 350, 500),
+        )
+        assert get_pdf_first_page_size_points(pdf_path) == (300.0, 400.0)
+
+    def test_degenerate_box_returns_none(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - A PDF page whose box has zero width
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - None is returned
+        """
+        pdf_path = self._write_pdf(
+            tmp_path / "degenerate.pdf",
+            media_box=(0, 0, 600, 800),
+            crop_box=(100, 0, 100, 800),
+        )
+        assert get_pdf_first_page_size_points(pdf_path) is None
+
+    def test_nonexistent_path_returns_none(self) -> None:
+        """
+        GIVEN:
+            - A path that does not exist
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - None is returned and nothing is raised
+        """
+        assert get_pdf_first_page_size_points(Path("/nonexistent/file.pdf")) is None
+
+    def test_corrupt_pdf_returns_none(self, tmp_path: Path) -> None:
+        """
+        GIVEN:
+            - A file that is not a PDF
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - None is returned and nothing is raised
+        """
+        bad = tmp_path / "bad.pdf"
+        bad.write_bytes(b"not a pdf")
+        assert get_pdf_first_page_size_points(bad) is None
+
+    def test_encrypted_pdf_returns_none(self) -> None:
+        """
+        GIVEN:
+            - A password protected PDF
+        WHEN:
+            - The first page size is requested
+        THEN:
+            - None is returned and nothing is raised
+        """
+        assert get_pdf_first_page_size_points(SAMPLES / "encrypted.pdf") is None
+
+
 class TestPostProcessText:
    @pytest.mark.parametrize(
        ("source", "expected"),
@@ -7,7 +7,6 @@ from documents.models import Document
 from documents.permissions import permitted_object_ids
 from documents.permissions import restrict_queryset_to_visible
 from documents.permissions import user_is_unrestricted
-from documents.versioning import annotate_effective_content
 from paperless.config import AIConfig
 from paperless_ai.base_model import ClassificationSuggestions
 from paperless_ai.base_model import TaxonomyChoiceDict
@@ -114,7 +113,7 @@ def build_prompt_without_rag(
 ) -> str:
    filename = document.filename or ""
    content = truncate_content(
-        (document.get_effective_content() or "")[:4000],
+        document.content[:4000] or "",
        chunk_size=config.llm_embedding_chunk_size,
        context_size=config.llm_context_size,
    )
@@ -228,9 +227,7 @@ def get_taxonomy_context(

        # similar_documents is already ordered by descending weight; don't lose it.
        similar_document_ids = [s["document_id"] for s in similar_documents]
-        similar_documents_by_id = annotate_effective_content(
-            Document.objects.all(),
-        ).in_bulk(similar_document_ids)
+        similar_documents_by_id = Document.objects.in_bulk(similar_document_ids)
        similar_docs = [
            similar_documents_by_id[document_id]
            for document_id in similar_document_ids
@@ -238,7 +235,7 @@ def get_taxonomy_context(
        ][:max_docs]
        context_blocks = []
        for similar in similar_docs:
-            text = (similar.get_effective_content() or "")[:1000]
+            text = similar.content[:1000] or ""
            title = similar.title or similar.filename or "Untitled"
            context_blocks.append(f"TITLE: {title}\n{text}")
    except Exception:
@@ -135,6 +135,6 @@ def build_llm_index_text(doc: Document) -> str:
        lines.append(f"Custom Field - {instance.field.name}: {instance}")

    lines.append("\nContent:\n")
-    lines.append(doc.get_effective_content() or "")
+    lines.append(doc.content or "")

    return _normalize_llm_index_text("\n".join(lines))
@@ -17,8 +17,6 @@ from documents.models import PaperlessTask
 from documents.utils import IterWrapper
 from documents.utils import QuerySetStream
 from documents.utils import identity
-from documents.versioning import annotate_effective_content
-from documents.versioning import root_document_ids
 from paperless.config import AIConfig
 from paperless_ai.db import db_connection_released
 from paperless_ai.embedding import build_llm_index_text
@@ -445,11 +443,11 @@ def update_llm_index(
                "Skipping LLM index update: migration check deferred; "
                "will retry next run."
            )
-    documents = annotate_effective_content(
-        Document.objects.filter(root_document__isnull=True)
-        .select_related("correspondent", "document_type", "storage_path")
-        .prefetch_related("tags", "notes", "custom_fields__field"),
-    )
+    documents = Document.objects.select_related(
+        "correspondent",
+        "document_type",
+        "storage_path",
+    ).prefetch_related("tags", "notes", "custom_fields__field")
    no_documents = not documents.exists()

    # Fast exit before touching config: nothing to index and no existing index.
@@ -485,7 +483,7 @@ def update_llm_index(
            msg = "LLM index rebuilt successfully."
        else:
            scoped_documents = (
-                documents.filter(id__in=root_document_ids(document_ids))
+                documents.filter(id__in=document_ids)
                if document_ids is not None
                else documents
            )
@@ -512,12 +510,7 @@ def update_llm_index(


 def llm_index_add_or_update_document(document: Document):
-    """
-    Add or atomically replace a document's chunks in the index. Only root
-    documents are indexed, so a version is indexed as its root document.
-    """
-    if document.root_document_id is not None:
-        document = document.root_document
+    """Add or atomically replace a document's chunks in the index."""
    config = AIConfig()
    new_nodes = build_document_node(
        document,
@@ -695,7 +688,7 @@ def retrieve_similar_nodes(
    )

    query_text = truncate_embedding_query(
-        (document.title or "") + "\n" + (document.get_effective_content() or ""),
+        (document.title or "") + "\n" + (document.content or ""),
        chunk_size=config.llm_embedding_chunk_size,
    )
    # Hold the shared read lock for the whole retrieval so the connection is
@@ -55,7 +55,6 @@ def mock_document():
    doc.storage_path = None
    doc.archive_serial_number = "12345"
    doc.content = "This is the document content."
-    doc.get_effective_content.return_value = "This is the document content."

    cf1 = MagicMock(__str__=lambda x: "Value1")
    cf1.field = MagicMock()
@@ -435,55 +434,6 @@ def test_get_taxonomy_context_preserves_similarity_order_and_distinct_documents(
    )


-@pytest.mark.django_db
-class TestClassifierEffectiveContent:
-    """A root document's text for the LLM is its newest version's content."""
-
-    @staticmethod
-    def _root_with_version() -> Document:
-        root = DocumentFactory(title="Statement", content="stale text")
-        DocumentFactory(root_document=root, version_index=1, content="latest text")
-        return root
-
-    def test_prompt_uses_the_newest_versions_content(self) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - The classification prompt is built for the root
-        THEN:
-            - It contains the newest version's content
-        """
-        prompt = build_prompt_without_rag(self._root_with_version(), AIConfig())
-
-        assert "latest text" in prompt
-        assert "stale text" not in prompt
-
-    @override_settings(LLM_EMBEDDING_BACKEND="huggingface")
-    def test_similar_document_context_uses_the_newest_versions_content(self) -> None:
-        """
-        GIVEN:
-            - A similar root document with a version
-        WHEN:
-            - The similar-document context is built
-        THEN:
-            - It contains the newest version's content
-        """
-        similar = self._root_with_version()
-        document = DocumentFactory(content="Some content")
-        fake_nodes = [
-            SimpleNamespace(metadata={"document_id": str(similar.pk)}, score=0.9),
-        ]
-
-        with patch(
-            "paperless_ai.ai_classifier.retrieve_similar_nodes",
-            return_value=fake_nodes,
-        ):
-            _candidates, context = get_taxonomy_context(document, user=None)
-
-        assert context == "TITLE: Statement\nlatest text"
-
-
@pytest.mark.django_db
@override_settings(LLM_EMBEDDING_BACKEND="huggingface")
 def test_get_taxonomy_context_no_similar_docs():
@@ -388,108 +388,6 @@ def test_update_llm_index_partial_update(
    assert after[str(doc2.pk)] == before[str(doc2.pk)]


-@pytest.mark.django_db
-class TestLlmIndexVersions:
-    """The LLM index holds root documents only: a version is indexed as its root."""
-
-    def test_add_or_update_document_indexes_a_version_as_its_root(
-        self,
-        temp_llm_index_dir: Path,
-        mock_embed_model: FakeEmbedding,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - The version is passed to llm_index_add_or_update_document
-        THEN:
-            - Only the root document is in the index
-        """
-        root = DocumentFactory(content="root content")
-        version = DocumentFactory(root_document=root, version_index=1)
-
-        indexing.llm_index_add_or_update_document(version)
-
-        with indexing.get_vector_store() as store:
-            indexed = store.get_modified_times()
-
-        assert set(indexed) == {str(root.pk)}
-
-    def test_rebuild_skips_versions(
-        self,
-        temp_llm_index_dir: Path,
-        mock_embed_model: FakeEmbedding,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - The LLM index is rebuilt
-        THEN:
-            - Only the root document is in the index
-        """
-        root = DocumentFactory()
-        DocumentFactory(root_document=root, version_index=1)
-
-        indexing.update_llm_index(rebuild=True)
-
-        with indexing.get_vector_store() as store:
-            indexed = store.get_modified_times()
-
-        assert set(indexed) == {str(root.pk)}
-
-    def test_rebuild_indexes_the_newest_versions_content(
-        self,
-        temp_llm_index_dir: Path,
-        mock_embed_model: FakeEmbedding,
-        mocker: pytest_mock.MockerFixture,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - The LLM index is rebuilt
-        THEN:
-            - The root's text for the index is the version's content, answered
-              from the query rather than a query per document
-        """
-        root = DocumentFactory(content="stale text")
-        DocumentFactory(root_document=root, version_index=1, content="latest text")
-        spy = mocker.spy(indexing, "build_document_node")
-
-        indexing.update_llm_index(rebuild=True)
-
-        indexed = spy.call_args.args[0]
-        assert indexed.pk == root.pk
-        assert indexed.effective_content == "latest text"
-
-    def test_incremental_update_by_version_id_refreshes_the_root(
-        self,
-        temp_llm_index_dir: Path,
-        mock_embed_model: FakeEmbedding,
-    ) -> None:
-        """
-        GIVEN:
-            - An indexed root document with a version whose root was modified since
-        WHEN:
-            - An incremental update is scoped to the version's id
-        THEN:
-            - The root's entry is refreshed and no entry exists for the version
-        """
-        root = DocumentFactory()
-        version = DocumentFactory(root_document=root, version_index=1)
-        indexing.update_llm_index(rebuild=True)
-        Document.objects.filter(pk=root.pk).update(modified=timezone.now())
-        root.refresh_from_db()
-
-        indexing.update_llm_index(document_ids=[version.pk])
-
-        with indexing.get_vector_store() as store:
-            indexed = store.get_modified_times()
-
-        assert indexed == {str(root.pk): root.modified.isoformat()}
-
-
@pytest.mark.django_db
 def test_add_or_update_document_updates_existing_entry(
    temp_llm_index_dir: Path,
@@ -739,7 +637,6 @@ class TestLlmIndexAddOrUpdateDocumentEmptyContent:

        doc = MagicMock(spec=Document)
        doc.id = 42
-        doc.root_document_id = None
        # Must not raise
        indexing.llm_index_add_or_update_document(doc)

@@ -12,7 +12,6 @@ from paperless_ai.embedding import _normalize_llm_index_text
 from paperless_ai.embedding import build_llm_index_text
 from paperless_ai.embedding import get_configured_model_name
 from paperless_ai.embedding import get_embedding_model
-from paperless_testing.factories import DocumentFactory


@pytest.fixture
@@ -47,7 +46,6 @@ def mock_document():
    doc.correspondent.name = "Test Correspondent"
    doc.archive_serial_number = "12345"
    doc.content = "This is the document content."
-    doc.get_effective_content.return_value = "This is the document content."

    cf1 = MagicMock(__str__=lambda x: "Value1")
    cf1.field = MagicMock()
@@ -282,7 +280,7 @@ def test_build_llm_index_text(mock_document):


 def test_build_llm_index_text_normalizes_ocr_punctuation_runs(mock_document):
-    mock_document.get_effective_content.return_value = (
+    mock_document.content = (
        "Introduction ................................................ 7\n"
        "Hardware Limitation ________________________________________ 9\n"
        "Keep short punctuation like INV-100 and ellipses..."
@@ -296,43 +294,6 @@ def test_build_llm_index_text_normalizes_ocr_punctuation_runs(mock_document):
    assert "ellipses..." in result


-@pytest.mark.django_db
-class TestBuildLlmIndexTextVersions:
-    """A root document is indexed with its effective content, like in the search index."""
-
-    def test_root_uses_the_newest_versions_content(self) -> None:
-        """
-        GIVEN:
-            - A root document with two versions
-        WHEN:
-            - The LLM index text is built for the root
-        THEN:
-            - It contains the newest version's content and not the others'
-        """
-        root = DocumentFactory(content="stale text")
-        DocumentFactory(root_document=root, version_index=1, content="older text")
-        DocumentFactory(root_document=root, version_index=2, content="latest text")
-
-        text = build_llm_index_text(root)
-
-        assert "latest text" in text
-        assert "stale text" not in text
-        assert "older text" not in text
-
-    def test_root_without_versions_uses_its_own_content(self) -> None:
-        """
-        GIVEN:
-            - A root document without versions
-        WHEN:
-            - The LLM index text is built for it
-        THEN:
-            - It contains the document's own content
-        """
-        root = DocumentFactory(content="own text")
-
-        assert "own text" in build_llm_index_text(root)
-
-
 def test_normalize_llm_index_text_collapses_ocr_leaders_without_joining_lines():
    assert _normalize_llm_index_text("A........B\nC____D----E") == "A B\nC D E"
Author	SHA1	Message	Date
stumpylog	ea08908879	Feature/Chore: Replaces all usages of ImageMagik's convert binary with a simple Pillow based helper This removes ImageMagik as a dependency entirly and all documentation is cleaned up from it. We no longer need to install it, have a policy for it to allow PDFs and no longer shell out to it either.	2026-10-13 10:24:44 -07:00
stumpylogandClaude Sonnet 5.5	4c5927a45f	Chore: Supersample the PDF thumbnail render 2x Render the PDF page at twice the target size and downsample, with edge case handling for small and odd sized pages, simplified helpers and tests, and trimmed comments. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-10 15:09:59 -07:00
stumpylogandClaude Sonnet 5.5	884ddc401c	Chore: Generate PDF thumbnails with pdftoppm and Pillow instead of ImageMagick Replace the ImageMagick convert based PDF thumbnail path with pdftoppm and Pillow. Keeps thumbnails at 500px wide for small and odd sized pages, covers the qpdf repair and double failure paths, removes the unused run_convert helper, hardens thumbnail encoding, deprecates PAPERLESS_CONVERT_MEMORY_LIMIT and PAPERLESS_CONVERT_TMPDIR, and corrects the related docs and CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-10 15:09:59 -07:00
shamoon	e606dbffcd	Chore: update the db options warning (#14398 )	2026-10-10 07:17:54 -07:00