docs: add views/serialisers split spec and implementation plan

Specifies splitting documents/views.py and documents/serialisers.py (5,395 and 3,532 lines) into per-domain-area packages, pure move/reorganize with no behavior change. Scoped as its own branch against dev, to land after the in-flight feature-ai-taxonomy-hints-v2 work merges rather than layering on top of it.
Auto translate strings
2026-08-14 14:53:18 +00:00 · 2026-08-13 13:35:06 -07:00 · 2026-08-13 19:48:40 +00:00 · 2026-08-13 12:46:57 -07:00 · 2026-08-13 18:29:33 +00:00 · 2026-08-13 10:57:16 -07:00
313 changed files with 22753 additions and 13939 deletions
@@ -1,49 +1,51 @@
 categories:
  - type: 'pre-include'
    when:
      - label: 'enhancement'
      - label: 'bug'
      - label: 'chore'
      - label: 'deployment'
      - label: 'translation'
      - label: 'dependencies'
      - label: 'documentation'
      - label: 'frontend'
      - label: 'backend'
      - label: 'ci-cd'
      - label: 'breaking-change'
      - label: 'notable'
  - type: 'pre-exclude'
    when:
      - label: 'skip-changelog'
  - title: 'Breaking Changes'
-    labels:
+    when:
-      - 'breaking-change'
+      - label: 'breaking-change'
  - title: 'Notable Changes'
-    labels:
+    when:
-      - 'notable'
+      - label: 'notable'
  - title: 'Features / Enhancements'
-    labels:
+    when:
-      - 'enhancement'
+      - label: 'enhancement'
  - title: 'Bug Fixes'
-    labels:
+    when:
-      - 'bug'
+      - label: 'bug'
  - title: 'Documentation'
-    labels:
+    when:
-      - 'documentation'
+      - label: 'documentation'
  - title: 'Maintenance'
-    labels:
+    when:
-      - 'chore'
+      - label: 'chore'
-      - 'deployment'
+      - label: 'deployment'
-      - 'translation'
+      - label: 'translation'
-      - 'ci-cd'
+      - label: 'ci-cd'
  - title: 'Dependencies'
    collapse-after: 3
-    labels:
+    when:
-      - 'dependencies'
+      - label: 'dependencies'
  - title: 'All App Changes'
    labels:
      - 'frontend'
      - 'backend'
    collapse-after: 1
-include-labels:
+    when:
-  - 'enhancement'
+      - label: 'frontend'
-  - 'bug'
+      - label: 'backend'
  - 'chore'
  - 'deployment'
  - 'translation'
  - 'dependencies'
  - 'documentation'
  - 'frontend'
  - 'backend'
  - 'ci-cd'
  - 'breaking-change'
  - 'notable'
 exclude-labels:
  - 'skip-changelog'
 filter-by-commitish: true
 category-template: '### $TITLE'
 change-template: '- $TITLE @$AUTHOR ([#$NUMBER]($URL))'
@@ -24,7 +24,7 @@ jobs:
      backend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.backend == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -63,7 +63,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -87,7 +87,7 @@ jobs:
      fail-fast: false
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Start containers
@@ -96,11 +96,11 @@ jobs:
          docker compose --file docker/compose/docker-compose.ci-test.yml up --detach
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -169,16 +169,16 @@ jobs:
      PAPERLESS_SECRET_KEY: "ci-typing-not-a-real-secret"
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "${{ env.DEFAULT_PYTHON }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -41,7 +41,7 @@ jobs:
      ref-name: ${{ steps.ref.outputs.name }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Determine ref name
@@ -106,9 +106,9 @@ jobs:
          echo "repository=${repo_name}"
          echo "name=${repo_name}" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -121,7 +121,7 @@ jobs:
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
      - name: Docker metadata
        id: docker-meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
@@ -132,7 +132,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
@@ -182,29 +182,29 @@ jobs:
          echo "Downloaded digests:"
          ls -la /tmp/digests/
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to Quay.io
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
      - name: Docker metadata
        id: docker-meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
@@ -21,7 +21,7 @@ jobs:
      docs_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.docs == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -50,7 +50,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -69,16 +69,16 @@ jobs:
    steps:
      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -21,7 +21,7 @@ jobs:
      frontend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.frontend == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -77,7 +77,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -85,7 +85,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -109,7 +109,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -117,7 +117,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -129,8 +129,8 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
+      - name: Install dependencies
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run lint
        run: cd src-ui && pnpm run lint
  unit-tests:
@@ -148,7 +148,7 @@ jobs:
        shard-count: [4]
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -156,7 +156,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -168,8 +168,8 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
+      - name: Install dependencies
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run Jest unit tests
        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
      - name: Upload test results to Codecov
@@ -191,7 +191,7 @@ jobs:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
-    container: mcr.microsoft.com/playwright:v1.61.1-noble
+    container: mcr.microsoft.com/playwright:v1.62.0-noble
    env:
      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
@@ -203,7 +203,7 @@ jobs:
        shard-count: [2]
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -211,7 +211,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -223,23 +223,20 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular CLI
        run: cd src-ui && pnpm link @angular/cli
      - name: Install dependencies
-        run: cd src-ui && pnpm install --no-frozen-lockfile
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run Playwright E2E tests
        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
-  bundle-analysis:
+  frontend-build:
-    name: Bundle Analysis
+    name: Frontend Build
    needs: [changes, unit-tests, e2e-tests]
    if: needs.changes.outputs.frontend_changed == 'true'
    runs-on: ubuntu-24.04
    environment: bundle-analysis
    permissions:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false
@@ -248,7 +245,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -260,21 +257,19 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
+      - name: Install dependencies
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
-      - name: Build and analyze
+      - name: Build
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: cd src-ui && pnpm run build --configuration=production
  gate:
    name: Frontend CI Gate
-    needs: [changes, install-dependencies, lint, unit-tests, e2e-tests, bundle-analysis]
+    needs: [changes, install-dependencies, lint, unit-tests, e2e-tests, frontend-build]
    if: always()
    runs-on: ubuntu-slim
    steps:
      - name: Check gate
        env:
-          BUNDLE_ANALYSIS_RESULT: ${{ needs['bundle-analysis'].result }}
+          BUILD_RESULT: ${{ needs['frontend-build'].result }}
          E2E_RESULT: ${{ needs['e2e-tests'].result }}
          FRONTEND_CHANGED: ${{ needs.changes.outputs.frontend_changed }}
          INSTALL_RESULT: ${{ needs['install-dependencies'].result }}
@@ -306,8 +301,8 @@ jobs:
            exit 1
          fi
-          if [[ "${BUNDLE_ANALYSIS_RESULT}" != "success" ]]; then
+          if [[ "${BUILD_RESULT}" != "success" ]]; then
-            echo "::error::Frontend bundle-analysis job result: ${BUNDLE_ANALYSIS_RESULT}"
+            echo "::error::Frontend build job result: ${BUILD_RESULT}"
            exit 1
          fi
@@ -17,12 +17,12 @@ jobs:
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Run prek
-        uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2.0.6
@@ -20,7 +20,7 @@ jobs:
      statuses: read
    steps:
      - name: Wait for Docker build
-        uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0
+        uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773 # v1.9.0
        with:
          ref: ${{ github.sha }}
          check-name: 'Merge and Push Manifest'
@@ -35,7 +35,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # ---- Frontend Build ----
@@ -44,7 +44,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          package-manager-cache: false
@@ -55,11 +55,11 @@ jobs:
      # ---- Backend Setup ----
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -86,7 +86,7 @@ jobs:
      # ---- Prepare Release ----
      - name: Generate requirements file
        run: |
-          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
+          uv export --quiet --no-dev --all-extras --emit-index-url --format requirements-txt --output-file requirements.txt
      - name: Compile messages
        env:
          PAPERLESS_SECRET_KEY: "ci-release-not-a-real-secret"
@@ -171,7 +171,7 @@ jobs:
          fi
      - name: Create release and changelog
        id: create-release
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        with:
          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
          tag: ${{ steps.get-version.outputs.version }}
@@ -202,17 +202,17 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: true # for pushing changelog branch
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -22,11 +22,11 @@ jobs:
      security-events: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
  semgrep:
    name: Semgrep CE
    runs-on: ubuntu-24.04
@@ -38,13 +38,13 @@ jobs:
      security-events: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run Semgrep
        run: semgrep scan --config auto --sarif-output results.sarif
      - name: Upload results to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        if: always()
        with:
          sarif_file: results.sarif
@@ -34,12 +34,12 @@ jobs:
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,4 +47,4 @@ jobs:
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
@@ -17,12 +17,12 @@ jobs:
    environment: translation-sync
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
          persist-credentials: false
      - name: crowdin action
-        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
        with:
          upload_translations: false
          download_translations: true
@@ -31,7 +31,7 @@ jobs:
    steps:
      - name: Label PR by file path or branch name
        # see .github/labeler.yml for the labeler config
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Label by size
@@ -19,6 +19,6 @@ jobs:
    if: github.event_name == 'pull_request_target' && (github.event.action == 'opened' || github.event.action == 'reopened') && github.event.pull_request.user.login != 'dependabot'
    steps:
      - name: Label PR with release-drafter
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,7 +14,7 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
        with:
          days-before-stale: 7
          days-before-close: 14
@@ -14,7 +14,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        env:
          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
        with:
@@ -23,13 +23,13 @@ jobs:
          persist-credentials: true # for pushing translation branch
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -47,7 +47,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -61,16 +61,13 @@ jobs:
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Install frontend dependencies
-        if: steps.cache-frontend-deps.outputs.cache-hit != 'true'
+        run: cd src-ui && pnpm install --frozen-lockfile
        run: cd src-ui && pnpm install
      - name: Re-link Angular cli
        run: cd src-ui && pnpm link @angular/cli
      - name: Generate frontend translation strings
        run: |
          cd src-ui
          pnpm run ng extract-i18n
      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          file_pattern: 'src-ui/messages.xlf src/locale/en_US/LC_MESSAGES/django.po'
          commit_message: "Auto translate strings"
@@ -29,7 +29,7 @@ repos:
      - id: check-case-conflict
      - id: detect-private-key
  - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
    hooks:
      - id: codespell
        additional_dependencies: [tomli]
@@ -38,7 +38,7 @@ repos:
          - json
  # See https://github.com/prettier/prettier/issues/15742 for the fork reason
  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 'v3.9.4'
+    rev: 'v3.9.6'
    hooks:
      - id: prettier
        types_or:
@@ -46,16 +46,16 @@ repos:
          - ts
          - markdown
        additional_dependencies:
-          - prettier@3.9.4
+          - prettier@3.9.6
          - 'prettier-plugin-organize-imports@4.3.0'
  # Python hooks
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.1
    hooks:
      - id: ruff-check
      - id: ruff-format
  - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.25.1"
+    rev: "v2.26.0"
    hooks:
      - id: pyproject-fmt
        additional_dependencies: [tomli]
@@ -30,7 +30,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.11.28-python3.12-trixie-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.11.32-python3.12-trixie-slim AS s6-overlay-base
 WORKDIR /usr/src/s6
@@ -24,7 +24,7 @@ services:
    network_mode: host
    restart: unless-stopped
  greenmail:
-    image: docker.io/greenmail/standalone:2.1.9
+    image: docker.io/greenmail/standalone:2.1.11
    hostname: greenmail
    container_name: greenmail
    environment:
@@ -35,7 +35,7 @@ services:
      - "3143:3143" # IMAP
    restart: unless-stopped
  nginx:
-    image: docker.io/nginx:1.31.2-alpine
+    image: docker.io/nginx:1.31.3-alpine
    hostname: nginx
    container_name: nginx
    ports:
@@ -0,0 +1,12 @@
 #!/command/with-contenv /usr/bin/bash
 # shellcheck shell=bash
 declare -r log_prefix="[init-llmindex-migrate]"
 echo "${log_prefix} Checking for pending LLM index migrations..."
 cd "${PAPERLESS_SRC_DIR}"
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
 	python3 manage.py document_llmindex migrate
 else
 	s6-setuidgid paperless python3 manage.py document_llmindex migrate
 fi
@@ -0,0 +1 @@
 oneshot
@@ -0,0 +1 @@
 /etc/s6-overlay/s6-rc.d/init-llmindex-migrate/run
@@ -151,6 +151,23 @@ the background.
 ### Bare Metal Route {#bare-metal-updating}
 !!! warning
    Extracting a new release archive on top of an existing installation
    (e.g. `tar -xf paperless-ngx-vX.Y.Z.tar.xz -C /opt/paperless`) only adds
    and overwrites files -- it does not remove files that were deleted in
    the new release. Leftover files from an old version, such as
    superseded database migrations, can remain on disk and cause errors
    like `NodeNotFoundError` during `manage.py migrate`.
    Before unpacking a new release over an existing bare-metal
    installation, remove the previous source tree first (everything
    except your `media`, `data`, and `consume` directories and your
    `paperless.conf`/`.env`), or unpack into a fresh directory and move
    your persistent data and configuration over. Installations updated via
    `git pull` on a clean checkout are not affected, since Git removes
    files that no longer exist upstream.
 After grabbing the new release and unpacking the contents, do the
 following:
@@ -195,6 +212,16 @@ following:
    This is a no-op if the index is already up to date, so it is safe to
    run on every upgrade.
 5.  Migrate the LLM index if needed.
    ```shell-session
    cd src
    python3 manage.py document_llmindex migrate
    ```
    This is a no-op if the index schema is already current, so it is safe
    to run on every upgrade.
 ### Database Upgrades
 Paperless-ngx is compatible with Django-supported versions of PostgreSQL and MariaDB and it is generally
@@ -272,6 +299,8 @@ optional arguments:
 -sm, --split-manifest
 -z,  --zip
 -zn, --zip-name
 --zip-compression
 --zip-compression-level
 --data-only
 --no-progress-bar
 --passphrase
@@ -334,6 +363,19 @@ If `-z` or `--zip` is provided, the export will be a zip file
 in the target directory, named according to the current local date or the
 value set in `-zn` or `--zip-name`.
 The compression method for the zip can be set with `--zip-compression`
 (`stored`, `deflated` (default), `bzip2`, `lzma`, or `zstd`) and tuned with
 `--zip-compression-level` (deflated: 0–9, bzip2: 1–9, zstd: -22–22; ignored
 for `stored` and `lzma`). Both options require `--zip`.
 !!! warning
    `zstd` compression requires Python 3.14 or newer on **both** the machine
    creating the export and any machine importing it. An archive compressed with
    `zstd` (or `lzma`/`bzip2` where those modules are unavailable) cannot be
    imported on a runtime that lacks the codec; the importer will refuse it with
    a clear error. The default `deflated` is universally readable.
 If `--data-only` is provided, only the database will be exported. This option is intended
 to facilitate database upgrades without needing to clean documents and thumbnails from the media directory.
@@ -515,7 +557,7 @@ index is updated automatically on the schedule set by
 can manage it manually:
 ```
-document_llmindex {rebuild,update,compact}
+document_llmindex {rebuild,update,compact,migrate}
 ```
 Specify `rebuild` to build the index from scratch from all documents in the database. Use
@@ -672,6 +714,7 @@ document_fuzzy_match [--ratio] [--processes N]
 | --ratio     | No       | 85.0                | a number between 0 and 100, setting how similar a document must be for it to be reported. Higher numbers mean more similarity. |
 | --processes | No       | 1/4 of system cores | Number of processes to use for matching. Setting 1 disables multiple processes                                                 |
 | --delete    | No       | False               | If provided, one document of a matched pair above the ratio will be deleted.                                                   |
 | --url       | No       | blank               | If an instance URL is provided, the output table will show URLs to each documents instead of the document ID and name.         |
 !!! warning
@@ -1,5 +1,204 @@
 # Changelog
 ## paperless-ngx 3.0.5
 ### Bug Fixes
 - Fix: accept Whoosh-era abbreviated relative-date units (yrs, mos, wks, etc) in search queries [@stumpylog](https://github.com/stumpylog) ([#13486](https://github.com/paperless-ngx/paperless-ngx/pull/13486))
 - Fix: fix edit dialog error change detection [@shamoon](https://github.com/shamoon) ([#13483](https://github.com/paperless-ngx/paperless-ngx/pull/13483))
 - Fix: key the AI suggestion cache by model and endpoint [@lunetics](https://github.com/lunetics) ([#13449](https://github.com/paperless-ngx/paperless-ngx/pull/13449))
 - Fix: validate custom field values in bulk operations [@shamoon](https://github.com/shamoon) ([#13457](https://github.com/paperless-ngx/paperless-ngx/pull/13457))
 - Fixhancement: better handle empty fields from AI suggestions [@shamoon](https://github.com/shamoon) ([#13454](https://github.com/paperless-ngx/paperless-ngx/pull/13454))
 - Fix: normalize monetary decimal symbol by locale [@shamoon](https://github.com/shamoon) ([#13427](https://github.com/paperless-ngx/paperless-ngx/pull/13427))
 - Fix: fold overflowing path text in sanity checker [@stumpylog](https://github.com/stumpylog) ([#13426](https://github.com/paperless-ngx/paperless-ngx/pull/13426))
 - Fix: correct delayed add field button for custom fields [@shamoon](https://github.com/shamoon) ([#13424](https://github.com/paperless-ngx/paperless-ngx/pull/13424))
 - Fix: hide attributes collapse / show button without UI settings [@shamoon](https://github.com/shamoon) ([#13425](https://github.com/paperless-ngx/paperless-ngx/pull/13425))
 - Fix: consolidate born-digital PDF detection between archive decision and OCR [@stumpylog](https://github.com/stumpylog) ([#13409](https://github.com/paperless-ngx/paperless-ngx/pull/13409))
 - Fix: prevent scale vs page loop in pngx PDF viewer [@shamoon](https://github.com/shamoon) ([#13406](https://github.com/paperless-ngx/paperless-ngx/pull/13406))
 - Fix: handle hidden line breaks in email subjects when sending email [@shamoon](https://github.com/shamoon) ([#13402](https://github.com/paperless-ngx/paperless-ngx/pull/13402))
 - Fix: avoid NotSupportedError from document\_importer on MariaDB [@stumpylog](https://github.com/stumpylog) ([#13400](https://github.com/paperless-ngx/paperless-ngx/pull/13400))
 - Fix: exclude next-period start from relative date-range filters [@stumpylog](https://github.com/stumpylog) ([#13381](https://github.com/paperless-ngx/paperless-ngx/pull/13381))
 - Fix: close non-atomic db connections in before\_task\_publish [@shamoon](https://github.com/shamoon) ([#13366](https://github.com/paperless-ngx/paperless-ngx/pull/13366))
 - Chore/fix: refactor frontend task service [@shamoon](https://github.com/shamoon) ([#13365](https://github.com/paperless-ngx/paperless-ngx/pull/13365))
 - Fix: fix Enter selection in search autocomplete [@shamoon](https://github.com/shamoon) ([#13361](https://github.com/paperless-ngx/paperless-ngx/pull/13361))
 ### Documentation
 - Documentation: PAPERLESS\_CONSUMER\_IGNORE\_PATTERNS clarifications [@shamoon](https://github.com/shamoon) ([#13489](https://github.com/paperless-ngx/paperless-ngx/pull/13489))
 - Documentation: Add Password Removal workflow action documentation [@stumpylog](https://github.com/stumpylog) ([#13377](https://github.com/paperless-ngx/paperless-ngx/pull/13377))
 ### Dependencies
 - Chore(deps): Bump pymdown-extensions from 10.21.3 to 11.0 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13378](https://github.com/paperless-ngx/paperless-ngx/pull/13378))
 ### All App Changes
 <details>
 <summary>21 changes</summary>
 - Fix: accept Whoosh-era abbreviated relative-date units (yrs, mos, wks, etc) in search queries [@stumpylog](https://github.com/stumpylog) ([#13486](https://github.com/paperless-ngx/paperless-ngx/pull/13486))
 - Fix: fix edit dialog error change detection [@shamoon](https://github.com/shamoon) ([#13483](https://github.com/paperless-ngx/paperless-ngx/pull/13483))
 - Performance: sqlite-vec point-delete for document chunks [@stumpylog](https://github.com/stumpylog) ([#13438](https://github.com/paperless-ngx/paperless-ngx/pull/13438))
 - Fix: key the AI suggestion cache by model and endpoint [@lunetics](https://github.com/lunetics) ([#13449](https://github.com/paperless-ngx/paperless-ngx/pull/13449))
 - Fix: validate custom field values in bulk operations [@shamoon](https://github.com/shamoon) ([#13457](https://github.com/paperless-ngx/paperless-ngx/pull/13457))
 - Fixhancement: better handle empty fields from AI suggestions [@shamoon](https://github.com/shamoon) ([#13454](https://github.com/paperless-ngx/paperless-ngx/pull/13454))
 - Performance: Use server side iterators during LLM index updating [@stumpylog](https://github.com/stumpylog) ([#13430](https://github.com/paperless-ngx/paperless-ngx/pull/13430))
 - Fix: normalize monetary decimal symbol by locale [@shamoon](https://github.com/shamoon) ([#13427](https://github.com/paperless-ngx/paperless-ngx/pull/13427))
 - Fix: fold overflowing path text in sanity checker [@stumpylog](https://github.com/stumpylog) ([#13426](https://github.com/paperless-ngx/paperless-ngx/pull/13426))
 - Fix: correct delayed add field button for custom fields [@shamoon](https://github.com/shamoon) ([#13424](https://github.com/paperless-ngx/paperless-ngx/pull/13424))
 - Fix: hide attributes collapse / show button without UI settings [@shamoon](https://github.com/shamoon) ([#13425](https://github.com/paperless-ngx/paperless-ngx/pull/13425))
 - Fix: consolidate born-digital PDF detection between archive decision and OCR [@stumpylog](https://github.com/stumpylog) ([#13409](https://github.com/paperless-ngx/paperless-ngx/pull/13409))
 - Fix: prevent scale vs page loop in pngx PDF viewer [@shamoon](https://github.com/shamoon) ([#13406](https://github.com/paperless-ngx/paperless-ngx/pull/13406))
 - Fix: handle hidden line breaks in email subjects when sending email [@shamoon](https://github.com/shamoon) ([#13402](https://github.com/paperless-ngx/paperless-ngx/pull/13402))
 - Fix: avoid NotSupportedError from document\_importer on MariaDB [@stumpylog](https://github.com/stumpylog) ([#13400](https://github.com/paperless-ngx/paperless-ngx/pull/13400))
 - Tweak: adjust doc details button toolbar flow [@shamoon](https://github.com/shamoon) ([#13382](https://github.com/paperless-ngx/paperless-ngx/pull/13382))
 - Fix: exclude next-period start from relative date-range filters [@stumpylog](https://github.com/stumpylog) ([#13381](https://github.com/paperless-ngx/paperless-ngx/pull/13381))
 - Chore(deps): Bump pymdown-extensions from 10.21.3 to 11.0 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13378](https://github.com/paperless-ngx/paperless-ngx/pull/13378))
 - Fix: close non-atomic db connections in before\_task\_publish [@shamoon](https://github.com/shamoon) ([#13366](https://github.com/paperless-ngx/paperless-ngx/pull/13366))
 - Chore/fix: refactor frontend task service [@shamoon](https://github.com/shamoon) ([#13365](https://github.com/paperless-ngx/paperless-ngx/pull/13365))
 - Fix: fix Enter selection in search autocomplete [@shamoon](https://github.com/shamoon) ([#13361](https://github.com/paperless-ngx/paperless-ngx/pull/13361))
 </details>
 ## paperless-ngx 3.0.4
 ### Bug Fixes
 - Fix: prevent pdfjs highlight scrolling from affecting the entire page [@shamoon](https://github.com/shamoon) ([#13355](https://github.com/paperless-ngx/paperless-ngx/pull/13355))
 - Fix: don't skip OCR/archive for tagged PDFs with no actual text [@stumpylog](https://github.com/stumpylog) ([#13351](https://github.com/paperless-ngx/paperless-ngx/pull/13351))
 - Performance: more efficient diacritic normalization in dropdown filtering [@shamoon](https://github.com/shamoon) ([#13347](https://github.com/paperless-ngx/paperless-ngx/pull/13347))
 - Fix: dedupe permission-visible documents when combined with multi-tag filters [@stumpylog](https://github.com/stumpylog) ([#13345](https://github.com/paperless-ngx/paperless-ngx/pull/13345))
 - Fixhancement: pass LLM output language to chat if specified [@shamoon](https://github.com/shamoon) ([#13340](https://github.com/paperless-ngx/paperless-ngx/pull/13340))
 - Fix: ensure preview reload on live changes [@shamoon](https://github.com/shamoon) ([#13321](https://github.com/paperless-ngx/paperless-ngx/pull/13321))
 - Fix: clamp all out out-of-range possible fields [@stumpylog](https://github.com/stumpylog) ([#13316](https://github.com/paperless-ngx/paperless-ngx/pull/13316))
 - Fix: add docstring to DocumentClassifierSchema for cleaner LLM tool description [@stumpylog](https://github.com/stumpylog) ([#13315](https://github.com/paperless-ngx/paperless-ngx/pull/13315))
 - Fix: guard build\_document\_node against stale FK on deleted correspondent/doc type [@stumpylog](https://github.com/stumpylog) ([#13318](https://github.com/paperless-ngx/paperless-ngx/pull/13318))
 - Fix: prevent search filter loss when closing document with Escape key [@shamoon](https://github.com/shamoon) ([#13317](https://github.com/paperless-ngx/paperless-ngx/pull/13317))
 - Fix: fix frontend permissions display for stats/system perms [@shamoon](https://github.com/shamoon) ([#13305](https://github.com/paperless-ngx/paperless-ngx/pull/13305))
 ### Documentation
 - Documentation: fix PAPERLESS\_AI\_LLM\_OUTPUT\_LANGUAGE heading level [@SuperSandro2000](https://github.com/SuperSandro2000) ([#13341](https://github.com/paperless-ngx/paperless-ngx/pull/13341))
 ### Dependencies
 - Chore: resolve npm provenance issues with chokidar and semver [@shamoon](https://github.com/shamoon) ([#13323](https://github.com/paperless-ngx/paperless-ngx/pull/13323))
 ### All App Changes
 <details>
 <summary>14 changes</summary>
 - Fix: prevent pdfjs highlight scrolling from affecting the entire page [@shamoon](https://github.com/shamoon) ([#13355](https://github.com/paperless-ngx/paperless-ngx/pull/13355))
 - Fix: don't skip OCR/archive for tagged PDFs with no actual text [@stumpylog](https://github.com/stumpylog) ([#13351](https://github.com/paperless-ngx/paperless-ngx/pull/13351))
 - Performance: more efficient diacritic normalization in dropdown filtering [@shamoon](https://github.com/shamoon) ([#13347](https://github.com/paperless-ngx/paperless-ngx/pull/13347))
 - Performance: prefetch notes and custom fields for LLM index text building [@stumpylog](https://github.com/stumpylog) ([#13350](https://github.com/paperless-ngx/paperless-ngx/pull/13350))
 - Fix: dedupe permission-visible documents when combined with multi-tag filters [@stumpylog](https://github.com/stumpylog) ([#13345](https://github.com/paperless-ngx/paperless-ngx/pull/13345))
 - Performance: Scope llm index updates to actually modified documents [@stumpylog](https://github.com/stumpylog) ([#13322](https://github.com/paperless-ngx/paperless-ngx/pull/13322))
 - Fixhancement: pass LLM output language to chat if specified [@shamoon](https://github.com/shamoon) ([#13340](https://github.com/paperless-ngx/paperless-ngx/pull/13340))
 - Chore: resolve npm provenance issues with chokidar and semver [@shamoon](https://github.com/shamoon) ([#13323](https://github.com/paperless-ngx/paperless-ngx/pull/13323))
 - Fix: ensure preview reload on live changes [@shamoon](https://github.com/shamoon) ([#13321](https://github.com/paperless-ngx/paperless-ngx/pull/13321))
 - Fix: clamp all out out-of-range possible fields [@stumpylog](https://github.com/stumpylog) ([#13316](https://github.com/paperless-ngx/paperless-ngx/pull/13316))
 - Fix: add docstring to DocumentClassifierSchema for cleaner LLM tool description [@stumpylog](https://github.com/stumpylog) ([#13315](https://github.com/paperless-ngx/paperless-ngx/pull/13315))
 - Fix: guard build\_document\_node against stale FK on deleted correspondent/doc type [@stumpylog](https://github.com/stumpylog) ([#13318](https://github.com/paperless-ngx/paperless-ngx/pull/13318))
 - Fix: prevent search filter loss when closing document with Escape key [@shamoon](https://github.com/shamoon) ([#13317](https://github.com/paperless-ngx/paperless-ngx/pull/13317))
 - Fix: fix frontend permissions display for stats/system perms [@shamoon](https://github.com/shamoon) ([#13305](https://github.com/paperless-ngx/paperless-ngx/pull/13305))
 </details>
 ## paperless-ngx 3.0.3
 ### Bug Fixes
 - Fixhancement: PAPERLESS\_ALLAUTH\_TRUSTED\_PROXY\_COUNT [@shamoon](https://github.com/shamoon) ([#13281](https://github.com/paperless-ngx/paperless-ngx/pull/13281))
 - Fix: preserve document fields during Gotenberg conversion to PDF [@stumpylog](https://github.com/stumpylog) ([#13271](https://github.com/paperless-ngx/paperless-ngx/pull/13271))
 - Fix: Makes the email date aware as soon as possible during parsing [@stumpylog](https://github.com/stumpylog) ([#13266](https://github.com/paperless-ngx/paperless-ngx/pull/13266))
 - Fix: Handle a plain string as Celery sometimes provides for the traceback [@stumpylog](https://github.com/stumpylog) ([#13267](https://github.com/paperless-ngx/paperless-ngx/pull/13267))
 - Fix: Emit the torch index into the requirements.txt for people still using it [@stumpylog](https://github.com/stumpylog) ([#13265](https://github.com/paperless-ngx/paperless-ngx/pull/13265))
 - Fix: handle notes without a user when building the search index [@matthiasmast](https://github.com/matthiasmast) ([#13260](https://github.com/paperless-ngx/paperless-ngx/pull/13260))
 ### Documentation
 - Docs: warn bare-metal users about stale files when upgrading [@stumpylog](https://github.com/stumpylog) ([#13296](https://github.com/paperless-ngx/paperless-ngx/pull/13296))
 - Documentation: Add the NumPy CPU baseline increase to the migration guide [@stumpylog](https://github.com/stumpylog) ([#13269](https://github.com/paperless-ngx/paperless-ngx/pull/13269))
 ### Maintenance
 - Fix: Emit the torch index into the requirements.txt for people still using it [@stumpylog](https://github.com/stumpylog) ([#13265](https://github.com/paperless-ngx/paperless-ngx/pull/13265))
 ### All App Changes
 <details>
 <summary>6 changes</summary>
 - Fixhancement: PAPERLESS\_ALLAUTH\_TRUSTED\_PROXY\_COUNT [@shamoon](https://github.com/shamoon) ([#13281](https://github.com/paperless-ngx/paperless-ngx/pull/13281))
 - Tweak: adjust top navbar wrapping when AI chat button visible [@shamoon](https://github.com/shamoon) ([#13280](https://github.com/paperless-ngx/paperless-ngx/pull/13280))
 - Fix: preserve document fields during Gotenberg conversion to PDF [@stumpylog](https://github.com/stumpylog) ([#13271](https://github.com/paperless-ngx/paperless-ngx/pull/13271))
 - Fix: Makes the email date aware as soon as possible during parsing [@stumpylog](https://github.com/stumpylog) ([#13266](https://github.com/paperless-ngx/paperless-ngx/pull/13266))
 - Fix: Handle a plain string as Celery sometimes provides for the traceback [@stumpylog](https://github.com/stumpylog) ([#13267](https://github.com/paperless-ngx/paperless-ngx/pull/13267))
 - Fix: handle notes without a user when building the search index [@matthiasmast](https://github.com/matthiasmast) ([#13260](https://github.com/paperless-ngx/paperless-ngx/pull/13260))
 </details>
 ## paperless-ngx 3.0.2
 ### Bug Fixes
 - Fix: fix broken migration in 3.0.1 [@shamoon](https://github.com/shamoon) ([#13242](https://github.com/paperless-ngx/paperless-ngx/pull/13242))
 ### All App Changes
 - Fix: fix broken migration in 3.0.1 [@shamoon](https://github.com/shamoon) ([#13242](https://github.com/paperless-ngx/paperless-ngx/pull/13242))
 ## paperless-ngx 3.0.1
 ### Bug Fixes
 - Fix: selection\_data re-derives the filtered document set 5 times over [@stumpylog](https://github.com/stumpylog) ([#13229](https://github.com/paperless-ngx/paperless-ngx/pull/13229))
 - Fix: exclude source document from its own RAG similarity results [@stumpylog](https://github.com/stumpylog) ([#13233](https://github.com/paperless-ngx/paperless-ngx/pull/13233))
 - Fix: split mailrule maximum\_age clamp into its own migration [@stumpylog](https://github.com/stumpylog) ([#13231](https://github.com/paperless-ngx/paperless-ngx/pull/13231))
 - Chore: mark yes in confirm button for translation [@shamoon](https://github.com/shamoon) ([#13225](https://github.com/paperless-ngx/paperless-ngx/pull/13225))
 - Fix: correct URL for W001 check [@shamoon](https://github.com/shamoon) ([#13220](https://github.com/paperless-ngx/paperless-ngx/pull/13220))
 - Fix: ensure create dialog uses correct attribute type [@shamoon](https://github.com/shamoon) ([#13221](https://github.com/paperless-ngx/paperless-ngx/pull/13221))
 - Fix: correct database engine from postgres to postgresql [@OberstVonGatow](https://github.com/OberstVonGatow) ([#13213](https://github.com/paperless-ngx/paperless-ngx/pull/13213))
 - Fix: remove unnecessary .distinct() dominating document list queries [@stumpylog](https://github.com/stumpylog) ([#13205](https://github.com/paperless-ngx/paperless-ngx/pull/13205))
 - Fix: also wrap non-breaking words in chat messages, handle whitespace [@shamoon](https://github.com/shamoon) ([#13211](https://github.com/paperless-ngx/paperless-ngx/pull/13211))
 - Fix: tag/custom-field document\_count scales badly with tag count [@stumpylog](https://github.com/stumpylog) ([#13203](https://github.com/paperless-ngx/paperless-ngx/pull/13203))
 - Fix: batch document user\_can\_change checks to avoid per-row N+1 [@stumpylog](https://github.com/stumpylog) ([#13204](https://github.com/paperless-ngx/paperless-ngx/pull/13204))
 - Fix: fix app title restoration [@shamoon](https://github.com/shamoon) ([#13208](https://github.com/paperless-ngx/paperless-ngx/pull/13208))
 - Fix: handle long wrapping titles in AI chat document list [@shamoon](https://github.com/shamoon) ([#13206](https://github.com/paperless-ngx/paperless-ngx/pull/13206))
 ### Dependencies
 - Chore(deps-dev): Bump postcss from 8.5.6 to 8.5.22 in /src/paperless\_mail/templates in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13236](https://github.com/paperless-ngx/paperless-ngx/pull/13236))
 - Chore(deps): Bump pyasn1 from 0.6.3 to 0.6.4 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13237](https://github.com/paperless-ngx/paperless-ngx/pull/13237))
 - Chore(deps): Bump the uv group across 1 directory with 8 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13189](https://github.com/paperless-ngx/paperless-ngx/pull/13189))
 ### All App Changes
 <details>
 <summary>17 changes</summary>
 - Chore(deps-dev): Bump postcss from 8.5.6 to 8.5.22 in /src/paperless\_mail/templates in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13236](https://github.com/paperless-ngx/paperless-ngx/pull/13236))
 - Fix: selection\_data re-derives the filtered document set 5 times over [@stumpylog](https://github.com/stumpylog) ([#13229](https://github.com/paperless-ngx/paperless-ngx/pull/13229))
 - Chore: reword "Settings > Default permissions" description for clarity [@NotaInutilis](https://github.com/NotaInutilis) ([#13232](https://github.com/paperless-ngx/paperless-ngx/pull/13232))
 - Chore(deps): Bump pyasn1 from 0.6.3 to 0.6.4 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13237](https://github.com/paperless-ngx/paperless-ngx/pull/13237))
 - Chore(deps): Bump the uv group across 1 directory with 8 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13189](https://github.com/paperless-ngx/paperless-ngx/pull/13189))
 - Fix: exclude source document from its own RAG similarity results [@stumpylog](https://github.com/stumpylog) ([#13233](https://github.com/paperless-ngx/paperless-ngx/pull/13233))
 - Fix: split mailrule maximum\_age clamp into its own migration [@stumpylog](https://github.com/stumpylog) ([#13231](https://github.com/paperless-ngx/paperless-ngx/pull/13231))
 - Chore: mark yes in confirm button for translation [@shamoon](https://github.com/shamoon) ([#13225](https://github.com/paperless-ngx/paperless-ngx/pull/13225))
 - Fix: correct URL for W001 check [@shamoon](https://github.com/shamoon) ([#13220](https://github.com/paperless-ngx/paperless-ngx/pull/13220))
 - Fix: ensure create dialog uses correct attribute type [@shamoon](https://github.com/shamoon) ([#13221](https://github.com/paperless-ngx/paperless-ngx/pull/13221))
 - Fix: correct database engine from postgres to postgresql [@OberstVonGatow](https://github.com/OberstVonGatow) ([#13213](https://github.com/paperless-ngx/paperless-ngx/pull/13213))
 - Fix: remove unnecessary .distinct() dominating document list queries [@stumpylog](https://github.com/stumpylog) ([#13205](https://github.com/paperless-ngx/paperless-ngx/pull/13205))
 - Fix: also wrap non-breaking words in chat messages, handle whitespace [@shamoon](https://github.com/shamoon) ([#13211](https://github.com/paperless-ngx/paperless-ngx/pull/13211))
 - Fix: tag/custom-field document\_count scales badly with tag count [@stumpylog](https://github.com/stumpylog) ([#13203](https://github.com/paperless-ngx/paperless-ngx/pull/13203))
 - Fix: batch document user\_can\_change checks to avoid per-row N+1 [@stumpylog](https://github.com/stumpylog) ([#13204](https://github.com/paperless-ngx/paperless-ngx/pull/13204))
 - Fix: fix app title restoration [@shamoon](https://github.com/shamoon) ([#13208](https://github.com/paperless-ngx/paperless-ngx/pull/13208))
 - Fix: handle long wrapping titles in AI chat document list [@shamoon](https://github.com/shamoon) ([#13206](https://github.com/paperless-ngx/paperless-ngx/pull/13206))
 </details>
 ## paperless-ngx 3.0.0
 ### Breaking Changes
@@ -522,22 +522,36 @@ do CORS calls. Set this to your public domain name.
 fail2ban with log entries for failed authorization attempts. Value should be
 IP address(es).
-    This setting also controls allauth's
+    By default, this setting also controls allauth's trusted proxy count,
-    [`ALLAUTH_TRUSTED_PROXY_COUNT`](https://docs.allauth.org/en/latest/account/configuration.html),
+    which is set to the number of proxies listed here. Override that default
-    which is set to the number of proxies listed here. Without this,
+    with [`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT`](#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT)
-    allauth cannot determine the client IP address for rate limiting when
+    when the list length does not match the number of proxy hops.
    running behind a reverse proxy, resulting in a `403 Forbidden` on login.
    Defaults to empty string.
 #### [`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT=<integer>`](#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT) {#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT}
 : Sets allauth's
 [`ALLAUTH_TRUSTED_PROXY_COUNT`](https://docs.allauth.org/en/latest/common/rate_limits.html#configuration).
 This is the number of trusted proxy **hops** represented in each
 `X-Forwarded-For` header, not the number of IP addresses through which those
 proxies may be reached. For example, a single dual-stack proxy is one hop even
 when its IPv4 and IPv6 addresses are both listed in
 [`PAPERLESS_TRUSTED_PROXIES`](#PAPERLESS_TRUSTED_PROXIES).
    Only trust `X-Forwarded-For` when untrusted clients cannot connect directly
    to Paperless-ngx.
    Defaults to the number of entries in `PAPERLESS_TRUSTED_PROXIES`.
 #### [`PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER=<header-name>`](#PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER) {#PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER}
 : Sets allauth's
-[`ALLAUTH_TRUSTED_CLIENT_IP_HEADER`](https://docs.allauth.org/en/latest/account/configuration.html).
+[`ALLAUTH_TRUSTED_CLIENT_IP_HEADER`](https://docs.allauth.org/en/latest/common/rate_limits.html#configuration).
 Use this when your reverse proxy sets a dedicated header for the real
 client IP instead of `X-Forwarded-For`, for example `X-Real-IP` (nginx)
 or `CF-Connecting-IP` (Cloudflare). When set, this takes precedence over
-[`PAPERLESS_TRUSTED_PROXIES`](#PAPERLESS_TRUSTED_PROXIES).
+`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT`.
    Defaults to none.
@@ -918,8 +932,8 @@ for display in the web interface.
    | Document type              | `never` | `auto` (default)           | `always` |
    | -------------------------- | ------- | -------------------------- | -------- |
    | Scanned image (TIFF, JPEG) | No      | **Yes**                    | Yes      |
-    | Image-based PDF            | No      | **Yes** (short/no text, untagged) | Yes |
+    | Image-based PDF            | No      | **Yes** (no embedded text) | Yes |
-    | Born-digital PDF           | No      | No (tagged or has embedded text)  | Yes |
+    | Born-digital PDF           | No      | No (has embedded text, optionally confirmed by tag) | Yes |
    | Plain text, email, HTML    | No      | No                         | No       |
    | DOCX / ODT (via Tika)      | Yes\*   | Yes\*                      | Yes\*    |
@@ -934,10 +948,11 @@ for display in the web interface.
    !!! note
-        The **remote OCR parser** (Azure AI) always produces a searchable
+        The **remote OCR parser** (Azure AI) also honors this setting: when
-        PDF and stores it as the archive copy, regardless of this setting.
+        no archive is requested (`never`, or `auto` with a born-digital PDF),
-        `ARCHIVE_FILE_GENERATION=never` has no effect when the remote
+        the remote engine is skipped entirely and locally-extracted text is
-        parser handles a document.
+        used instead, avoiding an unnecessary API call and a duplicate text
        layer.
 #### [`PAPERLESS_OCR_CLEAN=<mode>`](#PAPERLESS_OCR_CLEAN) {#PAPERLESS_OCR_CLEAN}
@@ -1346,13 +1361,16 @@ don't exist yet.
 #### [`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`](#PAPERLESS_CONSUMER_IGNORE_PATTERNS) {#PAPERLESS_CONSUMER_IGNORE_PATTERNS}
 : Additional regex patterns for files to ignore in the consumption directory. Patterns are matched against filenames only (not full paths)
-using Python's `re.match()`, which anchors at the start of the filename.
+using Python's `re.search()`. Use `^` to anchor a pattern to the start of the filename and `$` to anchor it to the end.
    See the [watchfiles documentation](https://watchfiles.helpmanual.io/api/filters/#watchfiles.BaseFilter.ignore_entity_patterns)
    This setting is for additional patterns beyond the built-in defaults. Common system files and directories are already ignored automatically.
    The patterns will be compiled via Python's standard `re` module.
    These are regular expressions, not glob patterns. For example, the glob pattern `._*` does not mean "starts with `._`" when used as a
    regular expression; it matches nearly any non-empty filename. Use `^\._.*` for that behavior instead.
    Example custom patterns:
    ```json
@@ -1367,7 +1385,11 @@ using Python's `re.match()`, which anchors at the start of the filename.
    Defaults to `[]` (empty list, uses only built-in defaults).
-    The default ignores are `[.DS_Store, .DS_STORE, ._*, desktop.ini, Thumbs.db]` and cannot be overridden.
+    The built-in file patterns are equivalent to the following regular expressions and cannot be overridden:
    ```json
    ["^\\.DS_Store$", "^\\.DS_STORE$", "^\\._.*", "^desktop\\.ini$", "^Thumbs\\.db$"]
    ```
 #### [`PAPERLESS_CONSUMER_IGNORE_DIRS=<json>`](#PAPERLESS_CONSUMER_IGNORE_DIRS) {#PAPERLESS_CONSUMER_IGNORE_DIRS}
@@ -2121,7 +2143,7 @@ used with the OpenAI-compatible backend to target a custom provider or local gat
    Defaults to None.
-### [`PAPERLESS_AI_LLM_OUTPUT_LANGUAGE=<str>`](#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE) {#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE}
+#### [`PAPERLESS_AI_LLM_OUTPUT_LANGUAGE=<str>`](#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE) {#PAPERLESS_AI_LLM_OUTPUT_LANGUAGE}
 : The language to use for AI suggestions (results may vary by LLM model). If not supplied, defaults to the user's UI language setting or None.
@@ -133,7 +133,7 @@ PAPERLESS_DB_OPTIONS="sslmode=require,sslrootcert=/certs/ca.pem,pool.max_size=10
 ## OCR and Archive File Generation Settings
-The settings that control OCR behaviour and archive file generation have been redesigned. The old settings that coupled these two concerns together are **removed** — old values are not silently honoured; a startup warning is logged if any removed variable is still set in your environment.
+The settings that control OCR behaviour and archive file generation have been redesigned. The old settings that coupled these two concerns together are **removed** - old values are not silently honoured; a startup warning is logged if any removed variable is still set in your environment.
 ### Removed settings
@@ -166,7 +166,7 @@ Remove any `PAPERLESS_OCR_SKIP_ARCHIVE_FILE` variable from your environment. If
 # v2: skip OCR when text present, always archive
 PAPERLESS_OCR_MODE=skip
 # v3: equivalent (auto is the new default)
-# No change needed — auto is the default
+# No change needed - auto is the default
 # v2: skip OCR when text present, skip archive too
 PAPERLESS_OCR_MODE=skip_noarchive
@@ -187,10 +187,11 @@ PAPERLESS_ARCHIVE_FILE_GENERATION=auto
 ### Remote OCR parser
-If you use the **remote OCR parser** (Azure AI), note that it always produces a
+If you use the **remote OCR parser** (Azure AI), `ARCHIVE_FILE_GENERATION` is
-searchable PDF and stores it as the archive copy. `ARCHIVE_FILE_GENERATION=never`
+honored the same way as for the local engine: when no archive is requested
-has no effect for documents handled by the remote parser — the archive is produced
+(`never`, or `auto` with a born-digital PDF), the remote engine is skipped
-unconditionally by the remote engine.
+entirely and locally-extracted text is used instead, avoiding an unnecessary
 API call and a duplicate text layer.
 ## Search Index (Whoosh -> Tantivy)
@@ -324,8 +325,69 @@ option since v1.8.0.
 Allauth changed how it determines the client IP address for login rate limiting. Users running
 behind a reverse proxy may need to set
 [`PAPERLESS_TRUSTED_PROXIES`](configuration.md#PAPERLESS_TRUSTED_PROXIES),
 [`PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT`](configuration.md#PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT),
 [`PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER`](configuration.md#PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER),
-or both, to avoid `403 Forbidden` errors on login.
+or a combination of these settings to avoid `403 Forbidden` errors on login.
 The proxy count is the number of proxy hops in `X-Forwarded-For`, which may
 differ from the number of configured proxy IP addresses.
 ## Minimum CPU Requirements (NumPy Baseline)
 Starting with NumPy 2.4.0, official `manylinux` x86_64 wheels are compiled with a minimum
 CPU baseline of `x86-64-v2`, which requires SSE3, SSSE3, SSE4.1, SSE4.2, POPCNT, and
 CMPXCHG16B. This is a [deliberate upstream change](https://github.com/numpy/numpy/issues/27851)
 citing that these instructions have been present in over 99.7% of CPUs since 2008
 ([Intel](<https://en.wikipedia.org/wiki/Nehalem_(microarchitecture)>)) or 2011
 ([AMD](<https://en.wikipedia.org/wiki/Bulldozer_(microarchitecture)>)).
 NumPy is a dependency of the document classifier (via scikit-learn), so any CPU that
 predates SSE4.2 support will crash with `SIGILL` (illegal instruction) when the classifier
 is loaded or trained, regardless of whether AI features are enabled.
 This differs from NumPy's optional SIMD dispatch (e.g. AVX2, AVX512), which is detected and
 selected safely at runtime - the `x86-64-v2` requirement above is a hard floor baked into the
 wheel, with no runtime fallback.
 ### Affected hardware
 CPUs older than roughly 2008 (Intel) or 2011 (AMD) that lack SSE4.2 support. This is more
 likely to affect low-power or embedded hardware - e.g. early Atom, Celeron, or pre-Bulldozer
 AMD chips - than typical desktop or server hardware from the last decade.
 Check for SSE4.2 support with:
 ```bash
 grep -o -m1 sse4_2 /proc/cpuinfo
 ```
 If this prints nothing, your CPU is affected.
 ### Symptoms
 The Celery worker (and potentially the web server) repeatedly crashes and restarts with a
 `SIGILL` error, typically visible in `dmesg`/`journalctl` as a `trap invalid opcode` inside
 `_multiarray_umath...so`. Because the classifier is trained on a periodic schedule
 (hourly, by default), affected instances see intermittent, hard-to-reproduce document
 consumption failures whenever that scheduled task runs and takes down the worker process
 mid-task.
 ### Action Required (for affected hardware only)
 There is no way to make the classifier itself work on such CPUs - it requires an unofficial
 NumPy build with `cpu-baseline=none`, which is not something we can ship. The practical
 path forward is to stop the classifier from ever loading or training, which avoids
 importing NumPy at all:
 ```bash
 PAPERLESS_TRAIN_TASK_CRON=disable
 ```
 This disables the periodic classifier training task (see
 [`PAPERLESS_TRAIN_TASK_CRON`](configuration.md#PAPERLESS_TRAIN_TASK_CRON)). Automatic
 matching based on the classifier (suggested correspondents, document types, tags, and
 storage paths from trained rules) will no longer be available, but rule-based matching is
 unaffected, and document consumption itself will no longer be at risk of crashing the
 worker.
 ## Database Migrations
@@ -262,6 +262,14 @@ to a positive number to enable polling and disable native filesystem notificatio
    and copy the contents to the home directory of the user you created
    earlier (`/opt/paperless`).
    !!! note
        If you are updating an existing bare-metal installation rather than
        installing for the first time, see the
        [bare metal update instructions](administration.md#bare-metal-updating)
        instead -- extracting a new release on top of an old one can leave
        behind stale files from the previous version.
    Optional: If you cloned the Git repository, you will need to
    compile the frontend yourself. See [here](development.md#front-end-development)
    and use the `build` step, not `serve`.
@@ -0,0 +1,428 @@
 # Split views.py and serialisers.py Implementation Plan
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 **Goal:** Split `src/documents/views.py` (5,395 lines) and `src/documents/serialisers.py` (3,532 lines) into domain-based module packages, with zero behavior change.
 **Architecture:** Both files become packages (`documents/views/`, `documents/serialisers/`), one module per domain area. Serialisers split first (views depend on serialisers, never the reverse), then views, then the three external call sites (`paperless/urls.py`, `paperless_mail/views.py`, `paperless_mail/serialisers.py`) are pointed at the new submodules. No `__init__.py` re-exports in either package — every internal and external consumer imports the exact submodule.
 **Tech Stack:** Django REST Framework (viewsets/serializers), ruff (lint/format), pytest via the project's VM test runner.
 **Spec:** `docs/superpowers/specs/2026-08-13-views-serialisers-split-design.md`
 ## Global Constraints
 - No behavior change: class/function bodies, names, and public API responses are unchanged — pure move/reorganize. (spec: Non-goals)
 - Domain module names are identical across both packages (`bulk_edit.py` exists in both, etc.). (spec: Import direction)
 - Import direction is one-way: `documents/views/*` may import from `documents/serialisers/*`; `documents/serialisers/*` must never import from `documents/views/*`. (spec: Import direction)
 - Neither package's `__init__.py` re-exports submodule contents — every consumer, internal or external, imports the specific submodule (e.g. `from documents.views.workflows import WorkflowViewSet`). (spec: Architecture)
 - `src/documents/tests/test_views.py` and `src/documents/tests/test_api_documents.py` are not modified — they must pass unchanged, proving the move didn't alter behavior. (spec: Non-goals, Testing)
 - This branch targets `dev` and is separate from `feature-ai-taxonomy-hints-v2`. (spec: Non-goals)
 - Backend tests run on the Linux VM via the helper script, never locally: `bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "<pytest targets>"`. `ruff check` / `ruff format` run locally (global binary, not `uv run ruff`).
 ---
 ## Reference: symbol-to-module maps
 These tables (from the spec) are the authoritative source for which class/function goes to which new file. Copy them exactly — do not improvise groupings.
 ### `documents/serialisers/` map
 | Module           | Symbols                                                                                                                                                                                                                                                                                                                                                                                            |
 | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer` |
 | `metadata.py`    | `CorrespondentSerializer`, `DocumentTypeSerializer`, `DeprecatedColors`, `ColorField`, `TagSerializer`, `CorrespondentField`, `TagsField`, `DocumentTypeField`, `StoragePathField`, `StoragePathSerializer`, `StoragePathTestSerializer`, `CustomFieldSerializer`, `CustomFieldInstanceSerializer`, `validate_documentlink_targets`                                                                |
 | `documents.py`   | `DocumentSerializer`, `SearchResultListSerializer`, `SearchResultSerializer`, `DuplicateDocumentSummarySerializer`, `_DocumentVersionInfo`, `DocumentVersionInfoSerializer`, `DocumentVersionSerializer`, `DocumentVersionLabelSerializer`, `_get_viewable_duplicates`                                                                                                                             |
 | `upload.py`      | `PostDocumentSerializer`                                                                                                                                                                                                                                                                                                                                                                           |
 | `saved_views.py` | `SavedViewFilterRuleSerializer`, `SavedViewSerializer`                                                                                                                                                                                                                                                                                                                                             |
 | `bulk_edit.py`   | `RotateDocumentsSerializer`, `MergeDocumentsSerializer`, `EditPdfDocumentsSerializer`, `RemovePasswordDocumentsSerializer`, `DeleteDocumentsSerializer`, `ReprocessDocumentsSerializer`, `BulkEditSerializer`, `BulkDownloadSerializer`, `BulkEditObjectsSerializer`                                                                                                                               |
 | `sharing.py`     | `EmailSerializer`, `ShareLinkSerializer`, `ShareLinkBundleSerializer`                                                                                                                                                                                                                                                                                                                              |
 | `tasks.py`       | `TaskSerializerV10`, `TaskSerializerV9`, `TaskSummarySerializer`, `RunTaskSerializer`, `AcknowledgeTasksViewSerializer`                                                                                                                                                                                                                                                                            |
 | `workflows.py`   | `WorkflowTriggerSerializer`, `WorkflowActionEmailSerializer`, `WorkflowActionWebhookSerializer`, `WorkflowActionSerializer`, `WorkflowSerializer`                                                                                                                                                                                                                                                  |
 | `system.py`      | `UiSettingsViewSerializer`, `TrashSerializer`                                                                                                                                                                                                                                                                                                                                                      |
 Extraction order matters (later modules reference earlier ones): `base` → `metadata` → `documents` → `upload` → `saved_views` → `bulk_edit` → `sharing` → `tasks` → `workflows` → `system`.
 ### `documents/views/` map
 | Module           | Symbols                                                                                                                                                                                                                                                                 |
 | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`, `SearchResultPage`, `ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file` |
 | `index.py`       | `IndexView`, `serve_logo`                                                                                                                                                                                                                                               |
 | `metadata.py`    | `CorrespondentViewSet`, `TagViewSet`, `DocumentTypeViewSet`, `StoragePathViewSet`, `CustomFieldViewSet`, `_get_llm_output_language`                                                                                                                                     |
 | `documents.py`   | `EmailDocumentDetailSchema`, `DocumentViewSet`, `UnifiedSearchViewSet`                                                                                                                                                                                                  |
 | `upload.py`      | `PostDocumentView`                                                                                                                                                                                                                                                      |
 | `chat.py`        | `ChatStreamingSerializer`, `ChatStreamingView`                                                                                                                                                                                                                          |
 | `search.py`      | `SearchAutoCompleteView`, `GlobalSearchView`, `SelectionDataView`, `StatisticsView`                                                                                                                                                                                     |
 | `bulk_edit.py`   | `BulkEditView`, `RotateDocumentsView`, `MergeDocumentsView`, `DeleteDocumentsView`, `ReprocessDocumentsView`, `EditPdfDocumentsView`, `RemovePasswordDocumentsView`, `BulkEditObjectsView`, `BulkDownloadView`                                                          |
 | `sharing.py`     | `ShareLinkViewSet`, `ShareLinkBundleViewSet`, `SharedLinkView`                                                                                                                                                                                                          |
 | `saved_views.py` | `SavedViewViewSet`                                                                                                                                                                                                                                                      |
 | `tasks.py`       | `_TasksViewSetSchema`, `TasksViewSet`                                                                                                                                                                                                                                   |
 | `workflows.py`   | `WorkflowTriggerViewSet`, `WorkflowActionViewSet`, `WorkflowViewSet`                                                                                                                                                                                                    |
 | `system.py`      | `UiSettingsView`, `RemoteVersionView`, `SystemStatusView`, `TrashView`                                                                                                                                                                                                  |
 | `logs.py`        | `LogViewSet`                                                                                                                                                                                                                                                            |
 Extraction order: `base` → `index` → `metadata` → `documents` → `upload` → `chat` → `search` → `bulk_edit` → `sharing` → `saved_views` → `tasks` → `workflows` → `system` → `logs`. Note `ChatStreamingSerializer` is defined in `views.py` today, directly above `ChatStreamingView` — it moves with it into `views/chat.py`, not into the serialisers package.
 ### Mechanical extraction recipe (applies to every task below)
 For each module being created:
 1. `grep -n "^class |^def " src/documents/<serialisers|views>.py` to get current line numbers for every symbol still in the monolith (numbers shift as earlier modules are extracted, so re-run this each time, don't reuse stale numbers).
 2. Create the new file. Start it by copying the **entire top-of-file import block** from the monolith verbatim, plus a relative `from .base import ...` line if the module isn't `base.py` itself.
 3. Cut each listed symbol (including any decorators/comments immediately above it) from the monolith and paste it into the new file, preserving original order.
 4. Remove the cut symbols from the monolith.
 5. Run `ruff check --select F401,F811,F821 <new file> <monolith file>` and fix everything reported:
   - `F401` (unused import) → delete the import line.
   - `F821` (undefined name) → the symbol lives in a sibling module already extracted; add `from .<sibling> import <Symbol>`. If it hasn't been extracted yet, that's an ordering bug — stop and re-check the extraction order table.
   - `F811` (redefinition) → duplicate import, delete one.
 6. Run `ruff format <new file> <monolith file>`.
 ## Task 1: Scaffold `documents/serialisers/` and extract `base.py`
 **Agent:** django-expert — **Model:** sonnet (mechanical extraction, but sets the foundation every later serialiser module imports from — get the base set right or every later task inherits the mistake)
 **Files:**
 - Create: `src/documents/serialisers/__init__.py` (empty — no re-exports, per Global Constraints)
 - Create: `src/documents/serialisers/base.py`
 - Modify: `src/documents/serialisers.py` (shrinks; stays in place as the monolith for the remaining tasks in this phase — it is only deleted in Task 2 once empty)
 - Test: `src/documents/tests/` (full app suite), `src/paperless_mail/tests/`
 **Interfaces:**
 - Produces: `documents.serialisers.base` exporting `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer` — every later serialiser/view module that needs one of these imports `from documents.serialisers.base import <Symbol>`.
 - [ ] **Step 1: Create the package directory and empty `__init__.py`**
 ```bash
 mkdir -p src/documents/serialisers
 touch src/documents/serialisers/__init__.py
 ```
 - [ ] **Step 2: Extract `base.py` per the mechanical extraction recipe above**
 Move exactly these 14 symbols (in their current relative order) out of `src/documents/serialisers.py` into `src/documents/serialisers/base.py`: `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer`.
 Run the ruff fix-up (`ruff check --select F401,F811,F821 src/documents/serialisers/base.py src/documents/serialisers.py` then `ruff format` both files) as described in the recipe.
 - [ ] **Step 3: Verify `documents.serialisers` (the monolith module, still at `src/documents/serialisers.py`) still imports cleanly and the app still boots**
 Note: at this point Python resolves `documents.serialisers` to the package `src/documents/serialisers/__init__.py` (empty), **not** to `src/documents/serialisers.py` — having both a `serialisers.py` file and a `serialisers/` directory in the same parent package is invalid and Python will pick the package. So before running anything, rename the monolith out of the way so it's importable as a submodule of the new package for the rest of Phase A:
 ```bash
 git mv src/documents/serialisers.py src/documents/serialisers/_monolith.py
 ```
 Everywhere else in this phase, "the monolith file" now means `src/documents/serialisers/_monolith.py`. Because nothing outside this package imports the monolith directly by its old dotted path (`documents.serialisers` resolved to the file before; now it's the package), you must update every consumer of `documents.serialisers` symbols still owned by the monolith to import from `documents.serialisers._monolith` for the remainder of this phase. Concretely, in `src/documents/views.py`, change every `from documents.serialisers import <Symbol>` line for a symbol _not yet extracted_ (i.e., not one of the 14 `base.py` symbols) to `from documents.serialisers._monolith import <Symbol>`, and change the 14 now-extracted symbols' import lines to `from documents.serialisers.base import <Symbol>`. Do the same in `src/paperless_mail/serialisers.py` for `OwnedObjectSerializer` (→ `documents.serialisers.base`); its other three imports (`CorrespondentField`, `DocumentTypeField`, `TagsField`) stay pointed at `documents.serialisers._monolith` until Task 2 moves them into `metadata.py`.
 This `_monolith` re-pointing is scaffolding only — Task 2 finishes emptying and deletes `_monolith.py`, and every import that currently says `._monolith` gets its final home then.
 - [ ] **Step 4: Run the full test suite for this app boundary**
 ```bash
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS, no collection errors (a collection error here almost always means a missed import update in `views.py` or `paperless_mail/serialisers.py`).
 - [ ] **Step 5: Commit**
 ```bash
 git add src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 git commit -m "refactor: extract documents/serialisers/base.py from the serialisers monolith"
 ```
 ## Task 2: Extract the remaining 8 serialiser domain modules and delete the monolith
 **Agent:** django-expert — **Model:** sonnet (repetitive but each of the 8 modules needs its own cross-reference check against `base.py` and previously-extracted siblings; DocumentSerializer in particular is large and central)
 **Files:**
 - Create: `src/documents/serialisers/metadata.py`, `src/documents/serialisers/documents.py`, `src/documents/serialisers/upload.py`, `src/documents/serialisers/saved_views.py`, `src/documents/serialisers/bulk_edit.py`, `src/documents/serialisers/sharing.py`, `src/documents/serialisers/tasks.py`, `src/documents/serialisers/workflows.py`, `src/documents/serialisers/system.py`
 - Delete: `src/documents/serialisers/_monolith.py` (once empty)
 - Modify: `src/documents/views.py` (finish re-pointing every `from documents.serialisers._monolith import X` line at the correct new submodule), `src/paperless_mail/serialisers.py` (re-point `CorrespondentField`, `DocumentTypeField`, `TagsField` at `documents.serialisers.metadata`)
 - Test: `src/documents/tests/` (full app suite), `src/paperless_mail/tests/`
 **Interfaces:**
 - Consumes: `documents.serialisers.base` from Task 1 (relative import `.base` within the package).
 - Produces: the full `documents/serialisers/` package as specified in the Reference map above — this is what Task 3/4 (views split) and Task 5 (external call sites) import from.
 - [ ] **Step 1: Extract the 8 remaining domain modules in order**
 Following the mechanical extraction recipe, and in this exact order (each may depend on symbols extracted earlier in this same order, plus anything in `base.py`):
 1. `metadata.py` — `CorrespondentSerializer`, `DocumentTypeSerializer`, `DeprecatedColors`, `ColorField`, `TagSerializer`, `CorrespondentField`, `TagsField`, `DocumentTypeField`, `StoragePathField`, `StoragePathSerializer`, `StoragePathTestSerializer`, `CustomFieldSerializer`, `CustomFieldInstanceSerializer`, `validate_documentlink_targets`
 2. `documents.py` — `DocumentSerializer`, `SearchResultListSerializer`, `SearchResultSerializer`, `DuplicateDocumentSummarySerializer`, `_DocumentVersionInfo`, `DocumentVersionInfoSerializer`, `DocumentVersionSerializer`, `DocumentVersionLabelSerializer`, `_get_viewable_duplicates`
 3. `upload.py` — `PostDocumentSerializer`
 4. `saved_views.py` — `SavedViewFilterRuleSerializer`, `SavedViewSerializer`
 5. `bulk_edit.py` — `RotateDocumentsSerializer`, `MergeDocumentsSerializer`, `EditPdfDocumentsSerializer`, `RemovePasswordDocumentsSerializer`, `DeleteDocumentsSerializer`, `ReprocessDocumentsSerializer`, `BulkEditSerializer`, `BulkDownloadSerializer`, `BulkEditObjectsSerializer`
 6. `sharing.py` — `EmailSerializer`, `ShareLinkSerializer`, `ShareLinkBundleSerializer`
 7. `tasks.py` — `TaskSerializerV10`, `TaskSerializerV9`, `TaskSummarySerializer`, `RunTaskSerializer`, `AcknowledgeTasksViewSerializer`
 8. `workflows.py` — `WorkflowTriggerSerializer`, `WorkflowActionEmailSerializer`, `WorkflowActionWebhookSerializer`, `WorkflowActionSerializer`, `WorkflowSerializer`
 9. `system.py` — `UiSettingsViewSerializer`, `TrashSerializer`
 After each individual module extraction, run the ruff fix-up from the recipe against that new file and `_monolith.py` before moving to the next module (don't batch all 8 and fix imports once at the end — F821 errors compound and get harder to attribute to the right module).
 - [ ] **Step 2: Confirm the monolith is empty and delete it**
 ```bash
 grep -n "^class |^def " src/documents/serialisers/_monolith.py
 ```
 Expected: no output. If anything remains, it wasn't in the Reference map — stop and reconcile with the spec rather than deleting a symbol.
 ```bash
 git rm src/documents/serialisers/_monolith.py
 ```
 - [ ] **Step 3: Re-point every remaining `._monolith` import**
 Search for any import left pointing at the now-deleted module:
 ```bash
 grep -rn "serialisers\._monolith\|serialisers/_monolith" src/
 ```
 Expected: no output. Fix any that remain by pointing them at the correct submodule per the Reference map (e.g. `from documents.serialisers._monolith import DocumentSerializer` → `from documents.serialisers.documents import DocumentSerializer`).
 - [ ] **Step 4: Update `paperless_mail/serialisers.py`'s remaining imports**
 ```python
 # was: from documents.serialisers import CorrespondentField, DocumentTypeField, OwnedObjectSerializer, TagsField
 from documents.serialisers.base import OwnedObjectSerializer
 from documents.serialisers.metadata import CorrespondentField, DocumentTypeField, TagsField
 ```
 - [ ] **Step 5: Ruff and full test suite**
 ```bash
 ruff check src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 ruff format src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 ```
 ```bash
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS.
 - [ ] **Step 6: Commit**
 ```bash
 git add src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 git commit -m "refactor: finish splitting serialisers.py into documents/serialisers/"
 ```
 ## Task 3: Scaffold `documents/views/` and extract `base.py`
 **Agent:** django-expert — **Model:** sonnet (same shape as Task 1, one level up — views/base.py is imported by every other view module)
 **Files:**
 - Create: `src/documents/views/__init__.py` (empty), `src/documents/views/base.py`
 - Modify: `src/documents/views.py` → `src/documents/views/_monolith.py` (renamed, same reasoning as Task 1 Step 3)
 - Modify: `src/paperless/urls.py`, `src/paperless_mail/views.py` (re-point the 1 symbol each currently pulls from `documents.views` that now lives in `base.py`, if any — see step 3)
 - Test: `src/documents/tests/` (full app suite, includes URL-resolution-dependent tests), `src/paperless_mail/tests/`
 **Interfaces:**
 - Consumes: `documents.serialisers.*` submodules from Tasks 1–2 (already at final locations — import these directly, e.g. `from documents.serialisers.documents import DocumentSerializer`, never through a monolith or shim).
 - Produces: `documents.views.base` exporting `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`, `SearchResultPage`, `ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file`.
 - [ ] **Step 1: Create the package directory, empty `__init__.py`, and rename the monolith**
 ```bash
 mkdir -p src/documents/views
 touch src/documents/views/__init__.py
 git mv src/documents/views.py src/documents/views/_monolith.py
 ```
 - [ ] **Step 2: Extract `base.py` per the mechanical extraction recipe**
 Move exactly these 11 symbols out of `_monolith.py` into `views/base.py`: `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`, `SearchResultPage`, `ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file`.
 Within `_monolith.py`, every reference to these 11 symbols needs `from .base import <Symbol>` added (they're used throughout the rest of the file by the not-yet-extracted viewsets).
 - [ ] **Step 3: Re-point external consumers of the now-moved symbol**
 ```bash
 grep -n "from documents.views import PassUserMixin" src/paperless_mail/views.py
 ```
 Update it to `from documents.views.base import PassUserMixin`.
 `paperless/urls.py` doesn't import any of the 11 `base.py` symbols directly (it only imports viewsets/views, which are all still in `_monolith.py` at this point) — confirm with:
 ```bash
 grep -nE "from documents\.views import (PassUserMixin|BulkPermissionMixin|PermissionsAwareDocumentCountMixin|DocumentSelectionMixin|DocumentOperationPermissionMixin|serve_file)" src/paperless/urls.py
 ```
 Expected: no output. If something does match, re-point it at `documents.views.base` the same way.
 - [ ] **Step 4: Ruff and test**
 ```bash
 ruff check src/documents/views src/paperless_mail/views.py
 ruff format src/documents/views src/paperless_mail/views.py
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS.
 - [ ] **Step 5: Commit**
 ```bash
 git add src/documents/views src/paperless_mail/views.py
 git commit -m "refactor: extract documents/views/base.py from the views monolith"
 ```
 ## Task 4: Extract the remaining 13 view domain modules and delete the monolith
 **Agent:** django-expert — **Model:** opus (highest blast radius in the plan — `DocumentViewSet` alone is ~1,300 lines and central to the whole API; this task also rewires `paperless/urls.py`'s ~34 import lines that drive URL routing for the entire backend, where a mistake breaks the app at startup, not just in one test)
 **Files:**
 - Create: `src/documents/views/index.py`, `src/documents/views/metadata.py`, `src/documents/views/documents.py`, `src/documents/views/upload.py`, `src/documents/views/chat.py`, `src/documents/views/search.py`, `src/documents/views/bulk_edit.py`, `src/documents/views/sharing.py`, `src/documents/views/saved_views.py`, `src/documents/views/tasks.py`, `src/documents/views/workflows.py`, `src/documents/views/system.py`, `src/documents/views/logs.py`
 - Delete: `src/documents/views/_monolith.py` (once empty)
 - Modify: `src/paperless/urls.py` (all ~34 `from documents.views import X` lines)
 - Test: `src/documents/tests/` (full app suite — includes `test_views.py`, `test_api_documents.py`), `src/paperless_mail/tests/`
 **Interfaces:**
 - Consumes: `documents.serialisers.*` (Tasks 1–2) and `documents.views.base` (Task 3).
 - Produces: the full `documents/views/` package as specified in the Reference map above.
 - [ ] **Step 1: Extract the 13 remaining domain modules in order**
 Following the mechanical extraction recipe, in this exact order:
 1. `index.py` — `IndexView`, `serve_logo`
 2. `metadata.py` — `CorrespondentViewSet`, `TagViewSet`, `DocumentTypeViewSet`, `StoragePathViewSet`, `CustomFieldViewSet`, `_get_llm_output_language`
 3. `documents.py` — `EmailDocumentDetailSchema`, `DocumentViewSet`, `UnifiedSearchViewSet`
 4. `upload.py` — `PostDocumentView`
 5. `chat.py` — `ChatStreamingSerializer`, `ChatStreamingView`
 6. `search.py` — `SearchAutoCompleteView`, `GlobalSearchView`, `SelectionDataView`, `StatisticsView`
 7. `bulk_edit.py` — `BulkEditView`, `RotateDocumentsView`, `MergeDocumentsView`, `DeleteDocumentsView`, `ReprocessDocumentsView`, `EditPdfDocumentsView`, `RemovePasswordDocumentsView`, `BulkEditObjectsView`, `BulkDownloadView`
 8. `sharing.py` — `ShareLinkViewSet`, `ShareLinkBundleViewSet`, `SharedLinkView`
 9. `saved_views.py` — `SavedViewViewSet`
 10. `tasks.py` — `_TasksViewSetSchema`, `TasksViewSet`
 11. `workflows.py` — `WorkflowTriggerViewSet`, `WorkflowActionViewSet`, `WorkflowViewSet`
 12. `system.py` — `UiSettingsView`, `RemoteVersionView`, `SystemStatusView`, `TrashView`
 13. `logs.py` — `LogViewSet`
 After each module, run the ruff fix-up from the recipe before continuing to the next (same rationale as Task 2 Step 1 — attribute F821s to the right module while context is fresh). `documents.py` is the biggest single extraction in this whole plan (`DocumentViewSet` is ~1,300 lines) — expect the most F821 fix-ups here, mostly resolved by adding `from documents.serialisers.documents import ...`, `from documents.serialisers.metadata import ...`, and `from .base import ...` as needed.
 - [ ] **Step 2: Confirm the monolith is empty and delete it**
 ```bash
 grep -n "^class |^def " src/documents/views/_monolith.py
 ```
 Expected: no output.
 ```bash
 git rm src/documents/views/_monolith.py
 ```
 - [ ] **Step 3: Re-point every remaining `._monolith` import**
 ```bash
 grep -rn "views\._monolith\|views/_monolith" src/
 ```
 Expected: no output. Fix any stragglers per the Reference map.
 - [ ] **Step 4: Update `paperless/urls.py`**
 Replace each of the ~34 `from documents.views import X` lines with `from documents.views.<domain> import X` per the Reference map. For example:
 ```python
 # was:
 from documents.views import CorrespondentViewSet
 from documents.views import WorkflowViewSet
 from documents.views import serve_logo
 # becomes:
 from documents.views.metadata import CorrespondentViewSet
 from documents.views.workflows import WorkflowViewSet
 from documents.views.index import serve_logo
 ```
 Do this for every import in that block — check off against the full symbol list in the Reference map above so none are missed.
 - [ ] **Step 5: Ruff and test**
 ```bash
 ruff check src/documents/views src/paperless/urls.py
 ruff format src/documents/views src/paperless/urls.py
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS, including `test_views.py` and `test_api_documents.py` — these exercise URL routing end-to-end, so a broken `urls.py` import shows up here as a collection error.
 - [ ] **Step 6: Commit**
 ```bash
 git add src/documents/views src/paperless/urls.py
 git commit -m "refactor: finish splitting views.py into documents/views/"
 ```
 ## Task 5: Repo-wide verification sweep
 **Agent:** general-purpose — **Model:** sonnet (an audit/verification pass: run targeted checks, read the output, fix anything found — moderate judgment, not novel design work)
 **Files:**
 - Modify: any file a grep in this task turns up beyond the ones already handled in Tasks 1–4 (expected: none, per the spec's stated blast radius of exactly `paperless/urls.py`, `paperless_mail/views.py`, `paperless_mail/serialisers.py` — this task exists to confirm that, not to find new work)
 - Test: full backend suite (all apps, not just `documents`/`paperless_mail`)
 **Interfaces:**
 - Consumes: the finished `documents/views/` and `documents/serialisers/` packages from Tasks 1–4.
 - [ ] **Step 1: Grep the whole repo for any remaining bare-module reference**
 ```bash
 grep -rn "from documents\.views import\|from documents\.serialisers import\|documents\.views\.\_monolith\|documents\.serialisers\.\_monolith\|import documents\.views$\|import documents\.serialisers$" src/
 ```
 Expected: no output. `documents/views/__init__.py` and `documents/serialisers/__init__.py` should still be empty (`0` bytes or a single blank line) — confirm with:
 ```bash
 wc -l src/documents/views/__init__.py src/documents/serialisers/__init__.py
 ```
 - [ ] **Step 2: Confirm import direction was never violated**
 ```bash
 grep -rln "from documents\.views" src/documents/serialisers/
 ```
 Expected: no output (no file in `serialisers/` imports from `views/`).
 - [ ] **Step 3: Full ruff pass**
 ```bash
 ruff check src/documents/views src/documents/serialisers src/paperless/urls.py src/paperless_mail/views.py src/paperless_mail/serialisers.py
 ruff format --check src/documents/views src/documents/serialisers src/paperless/urls.py src/paperless_mail/views.py src/paperless_mail/serialisers.py
 ```
 Expected: clean.
 - [ ] **Step 4: Full backend test suite**
 ```bash
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "-v"
 ```
 (No path filter — this runs the whole backend suite, confirming nothing outside `documents`/`paperless_mail` was quietly relying on the old module shape, e.g. a management command or a script under `scripts/`.)
 Expected: PASS.
 - [ ] **Step 5: If Steps 1–4 found nothing to fix, commit is a no-op — skip it. If they found strays, fix and commit**
 ```bash
 git add -A
 git commit -m "refactor: fix stray documents.views/serialisers references found in repo sweep"
 ```
@@ -0,0 +1,158 @@
 # Split `documents/views.py` and `documents/serialisers.py` into modules
 ## Problem
 `src/documents/views.py` (5,395 lines) and `src/documents/serialisers.py`
 (3,532 lines) have grown into monolithic files covering every REST resource
 in the `documents` app: correspondents, tags, document types, storage paths,
 custom fields, the core document viewset and search, chat, bulk-edit
 operations, sharing, saved views, tasks, workflows, and system/UI settings.
 Their size makes them hard to navigate, hard to review incrementally, and
 increases the chance of unrelated changes colliding in the same file.
 This document specifies splitting both files into packages, one module per
 domain area, with no behavior change.
 ## Non-goals
 - No behavior change. Class names, method bodies, and public API responses
  are unchanged — this is a pure move/reorganize.
 - No change to `test_views.py` or `test_api_documents.py`. They exercise the
  moved classes via imports or via the live API; class names and behavior
  don't change, so they need no edits. Splitting those test files is a
  separate, later task if desired.
 - No change to the frontend, migrations, or any other app beyond the three
  files that import from `documents.views` / `documents.serialisers`
  (`paperless/urls.py`, `paperless_mail/views.py`,
  `paperless_mail/serialisers.py`).
 - This work happens as its own branch/PR against `dev`, after the in-flight
  `feature-ai-taxonomy-hints-v2` work merges — not layered on top of it.
 ## Architecture
 `documents/views.py` becomes the package `documents/views/`, and
 `documents/serialisers.py` becomes `documents/serialisers/`. Each gets one
 module per domain area (table below). Neither package's `__init__.py`
 re-exports its submodules' contents — it stays empty (or a short docstring
 only). The three external call sites that currently do
 `from documents.views import X` / `from documents.serialisers import X` are
 updated to import from the specific submodule instead
 (`from documents.views.workflows import WorkflowViewSet`, etc.). This avoids
 adding an indirection layer that could quietly regrow into a second dumping
 ground, at the cost of touching those three files.
 ### Import direction
 `views/*` modules may import from `serialisers/*` modules; `serialisers/*`
 modules never import from `views/*`. This keeps the dependency graph acyclic
 by construction — there is no case in the current code where a serializer
 needs a view.
 Domain module names are the same across both packages (e.g. `bulk_edit.py`
 exists in both), which makes the natural import `from documents.serialisers.bulk_edit import BulkEditSerializer`
 inside `documents/views/bulk_edit.py` easy to find, but a view is free to
 import a serializer from a different domain module when needed (e.g. a
 `documents.py` view using a `metadata.py` field serializer) — that's a plain
 cross-module import, not a cycle risk, since the reverse direction never
 happens.
 ## Module breakdown — `documents/views/`
 | Module           | Contents                                                                                                                                                                                                                                                                                     |
 | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | Shared mixins/helpers: `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`/`SearchResultPage`/`ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file` |
 | `index.py`       | `IndexView`, `serve_logo`                                                                                                                                                                                                                                                                    |
 | `metadata.py`    | `CorrespondentViewSet`, `TagViewSet`, `DocumentTypeViewSet`, `StoragePathViewSet`, `CustomFieldViewSet`, `_get_llm_output_language`                                                                                                                                                          |
 | `documents.py`   | `EmailDocumentDetailSchema`, `DocumentViewSet`, `UnifiedSearchViewSet`                                                                                                                                                                                                                       |
 | `upload.py`      | `PostDocumentView`                                                                                                                                                                                                                                                                           |
 | `chat.py`        | `ChatStreamingSerializer`, `ChatStreamingView`                                                                                                                                                                                                                                               |
 | `search.py`      | `SearchAutoCompleteView`, `GlobalSearchView`, `SelectionDataView`, `StatisticsView`                                                                                                                                                                                                          |
 | `bulk_edit.py`   | `BulkEditView`, `RotateDocumentsView`, `MergeDocumentsView`, `DeleteDocumentsView`, `ReprocessDocumentsView`, `EditPdfDocumentsView`, `RemovePasswordDocumentsView`, `BulkEditObjectsView`, `BulkDownloadView`                                                                               |
 | `sharing.py`     | `ShareLinkViewSet`, `ShareLinkBundleViewSet`, `SharedLinkView`                                                                                                                                                                                                                               |
 | `saved_views.py` | `SavedViewViewSet`                                                                                                                                                                                                                                                                           |
 | `tasks.py`       | `_TasksViewSetSchema`, `TasksViewSet`                                                                                                                                                                                                                                                        |
 | `workflows.py`   | `WorkflowTriggerViewSet`, `WorkflowActionViewSet`, `WorkflowViewSet`                                                                                                                                                                                                                         |
 | `system.py`      | `UiSettingsView`, `RemoteVersionView`, `SystemStatusView`, `TrashView`                                                                                                                                                                                                                       |
 | `logs.py`        | `LogViewSet`                                                                                                                                                                                                                                                                                 |
 `documents.py` remains the largest module at roughly 1,600 lines
 (`DocumentViewSet` alone is ~1,300 lines in the current file); every other
 module is well under 500 lines.
 ## Module breakdown — `documents/serialisers/`
 | Module           | Contents                                                                                                                                                                                                                                                                                                                                                                                           |
 | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer` |
 | `metadata.py`    | `CorrespondentSerializer`, `DocumentTypeSerializer`, `DeprecatedColors`, `ColorField`, `TagSerializer`, `CorrespondentField`, `TagsField`, `DocumentTypeField`, `StoragePathField`, `StoragePathSerializer`, `StoragePathTestSerializer`, `CustomFieldSerializer`, `CustomFieldInstanceSerializer`, `validate_documentlink_targets`                                                                |
 | `documents.py`   | `DocumentSerializer`, `SearchResultListSerializer`, `SearchResultSerializer`, `DuplicateDocumentSummarySerializer`, `_DocumentVersionInfo`, `DocumentVersionInfoSerializer`, `DocumentVersionSerializer`, `DocumentVersionLabelSerializer`, `_get_viewable_duplicates`                                                                                                                             |
 | `upload.py`      | `PostDocumentSerializer`                                                                                                                                                                                                                                                                                                                                                                           |
 | `saved_views.py` | `SavedViewFilterRuleSerializer`, `SavedViewSerializer`                                                                                                                                                                                                                                                                                                                                             |
 | `bulk_edit.py`   | `RotateDocumentsSerializer`, `MergeDocumentsSerializer`, `EditPdfDocumentsSerializer`, `RemovePasswordDocumentsSerializer`, `DeleteDocumentsSerializer`, `ReprocessDocumentsSerializer`, `BulkEditSerializer`, `BulkDownloadSerializer`, `BulkEditObjectsSerializer`                                                                                                                               |
 | `sharing.py`     | `EmailSerializer`, `ShareLinkSerializer`, `ShareLinkBundleSerializer`                                                                                                                                                                                                                                                                                                                              |
 | `tasks.py`       | `TaskSerializerV10`, `TaskSerializerV9`, `TaskSummarySerializer`, `RunTaskSerializer`, `AcknowledgeTasksViewSerializer`                                                                                                                                                                                                                                                                            |
 | `workflows.py`   | `WorkflowTriggerSerializer`, `WorkflowActionEmailSerializer`, `WorkflowActionWebhookSerializer`, `WorkflowActionSerializer`, `WorkflowSerializer`                                                                                                                                                                                                                                                  |
 | `system.py`      | `UiSettingsViewSerializer`, `TrashSerializer`                                                                                                                                                                                                                                                                                                                                                      |
 Note: `ChatStreamingSerializer` is defined in `views.py` today (not
 `serialisers.py`), directly above `ChatStreamingView`. It moves with
 `ChatStreamingView` into `documents/views/chat.py` rather than into the
 serialisers package, preserving its current co-location.
 ## External call sites to update
 Only three files import from these two modules today, and all move to
 importing from the specific new submodule:
 - `src/paperless/urls.py` — ~34 `from documents.views import X` lines, one
  per viewset/view used in URL routing. Each becomes
  `from documents.views.<domain> import X`.
 - `src/paperless_mail/views.py` — `from documents.views import PassUserMixin`
  becomes `from documents.views.base import PassUserMixin`.
 - `src/paperless_mail/serialisers.py` — `CorrespondentField`,
  `DocumentTypeField`, `OwnedObjectSerializer`, `TagsField` move to
  `from documents.serialisers.metadata import CorrespondentField, DocumentTypeField, TagsField`
  and `from documents.serialisers.base import OwnedObjectSerializer`.
 ## Migration order
 1. Split `serialisers.py` into `documents/serialisers/` first — serializers
   have no dependency on views, so this half can be verified in isolation.
   Run the full backend test suite after this step.
 2. Split `views.py` into `documents/views/`, importing from the new
   `documents/serialisers/*` modules per the table above. Run the full
   backend test suite.
 3. Update the three external call sites (`paperless/urls.py`,
   `paperless_mail/views.py`, `paperless_mail/serialisers.py`).
 4. Run `ruff check` / `ruff format` and the full backend test suite once
   more end to end.
 Splitting serialisers before views (rather than in parallel) means step 2
 can immediately import finished, correctly-located serializer modules
 instead of guessing at not-yet-final paths.
 ## Risks / error handling
 - **Circular imports**: prevented by construction (serialisers never import
  from views — see Import direction above). If a genuine cross-domain need
  is discovered during implementation that seems to require a
  views→views import cycle (e.g. `UnifiedSearchViewSet` extending
  `DocumentViewSet` from a different module — both already live in
  `documents.py` so this doesn't arise), resolve it by moving the shared
  piece to `base.py` rather than introducing a cycle.
 - **Missed re-export consumers**: verified via a full-repo grep for
  `from documents.views import` / `from documents.serialisers import` /
  `documents.views.` / `documents.serialisers.` before considering the split
  complete, in case something beyond the three known call sites appears
  (e.g. in a management command or a rarely-run script).
 - **Silent behavior drift during move**: since this is a pure reorganization,
  the full test suite passing after each step (rather than only at the end)
  is the primary safety net; no new tests are required for this refactor
  itself.
 ## Testing
 No new tests. Existing coverage (`test_views.py`, `test_api_documents.py`,
 and the rest of the `documents` test suite) is run after each migration step
 per the ordering above, and must pass unchanged — a failure indicates the
 move altered behavior, not that new coverage is needed.
@@ -576,7 +576,9 @@ The following workflow action types are available:
 - Tags, correspondent, document type and storage path
 - Document owner
 - View and / or edit permissions to users or groups
- Custom fields. Note that no value for the field will be set
+- Custom fields, optionally with a value. If no value is set, the field is only added to the
  document and any value it may already have is left untouched. If a value is set, it will
  overwrite an existing value of that field on the document.
 ##### Removal {#workflow-action-removal}
@@ -620,6 +622,34 @@ no other workflow will be executed on the document.
 If a "Move to Trash" action is executed in a consume pipeline, the consumption
 will be aborted and the file will be deleted.
 ##### Password Removal {#workflow-action-password-removal}
 "Password Removal" actions attempt to remove password protection from encrypted PDF documents. You can specify:
 - One or more passwords to try, separated by commas or new lines
 - Each password is tried in order until one successfully unlocks the document
 Password removal never modifies a file in place. Instead, once a working password is found, the
 decrypted content is consumed as a new [document version](#document-file-versions), leaving the
 original (still encrypted) version in the document's version history.
 **Consumption Started**: because this trigger fires before the document exists yet, the password
 removal itself is deferred until after the initial consumption of the encrypted file has completed.
 OCR engines cannot process an encrypted PDF, so this first version is typically stored with no
 extracted text (unless the file already contained extractable text outside of OCR). Immediately
 afterwards, the password is removed and the decrypted file is automatically re-consumed as a second,
 new version of the same document, this time with normal OCR/text extraction applied. In other words,
 a password-protected file added with this trigger will briefly exist as an un-OCR'd version before
 the properly processed version is created.
 **Document Added**, **Document Updated**, **Scheduled**: these triggers run against a document that
 already exists, so password removal happens immediately: the decrypted content is queued for
 consumption as a new version right away. Note that if the document's initial consumption also
 happened while it was still encrypted, that original version will likewise be missing OCR text.
 **Current limitation**: Passwords are stored as a simple list without descriptions. To handle
 multiple PDF types with different passwords, create separate workflows for each use case.
 #### Workflow placeholders
 Titles and webhook payloads can be generated by workflows using [Jinja templates](https://jinja.palletsprojects.com/en/3.1.x/templates/).
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.0.2"
+version = "3.0.5"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -21,7 +21,7 @@ dependencies = [
  "channels~=4.2",
  "channels-redis~=4.2",
  "concurrent-log-handler~=0.9.25",
-  "dateparser~=1.2",
+  "dateparser~=1.4",
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.13",
@@ -32,33 +32,32 @@ dependencies = [
  "django-cors-headers~=4.9.0",
  "django-extensions~=4.1",
  "django-filter~=25.1",
-  "django-guardian~=3.3.0",
+  "django-guardian~=3.3.3",
  "django-multiselectfield~=1.0.1",
  "django-rich~=2.2.0",
  "django-soft-delete~=1.0.18",
  "django-treenode>=0.24",
  "djangorestframework~=3.16",
-  "djangorestframework-guardian~=0.4.0",
+  "drf-spectacular~=0.30",
-  "drf-spectacular~=0.28",
+  "drf-spectacular-sidecar~=2026.7.1",
  "drf-spectacular-sidecar~=2026.5.1",
  "drf-writable-nested~=0.7.1",
-  "filelock~=3.29.0",
+  "filelock~=3.32.0",
  "flower~=2.0.1",
  "gotenberg-client~=0.14.0",
-  "httpx-oauth~=0.16",
+  "httpx-oauth~=0.17",
-  "ijson>=3.2",
+  "ijson>=3.5.1",
-  "imap-tools~=1.13.0",
+  "imap-tools~=1.14.0",
  "jinja2~=3.1.5",
  "langdetect~=1.0.9",
-  "llama-index-core>=0.14.22",
+  "llama-index-core>=0.14.23",
  "llama-index-embeddings-huggingface>=0.6.1",
  "llama-index-embeddings-ollama>=0.9",
  "llama-index-embeddings-openai-like>=0.2.2",
  "llama-index-llms-ollama>=0.9.1",
  "llama-index-llms-openai-like>=0.7.1",
  "nltk~=3.10.0",
-  "ocrmypdf~=17.4.2",
+  "ocrmypdf~=17.7.0",
-  "openai>=2.32",
+  "openai>=2.48",
  "pathvalidate~=3.3.1",
  "pdf2image~=1.17.0",
  "python-dateutil~=2.9.0",
@@ -68,17 +67,17 @@ dependencies = [
  "python-magic~=0.4.27",
  "rapidfuzz~=3.14.5",
  "redis[hiredis]~=5.2.1",
-  "regex>=2026.4.4",
+  "regex>=2026.7.19",
-  "scikit-learn~=1.8.0",
+  "scikit-learn~=1.9.0",
-  "sentence-transformers>=5.4.1",
+  "sentence-transformers>=5.6.1",
  "setproctitle~=1.3.4",
  "sqlite-vec==0.1.9",
  "tantivy~=0.26.0",
  "tika-client~=0.11.0",
  "torch~=2.13.0",
-  "watchfiles>=1.1.1",
+  "watchfiles>=1.2",
  "whitenoise~=6.11",
-  "zxing-cpp~=3.0.0",
+  "zxing-cpp~=3.1.0",
 ]
 [project.optional-dependencies]
 mariadb = [
@@ -101,25 +100,25 @@ dev = [
  { include-group = "testing" },
 ]
 docs = [
-  "zensical>=0.0.47",
+  "zensical>=0.0.51",
 ]
 lint = [
-  "prek~=0.3.10",
+  "prek~=0.4.11",
-  "ruff~=0.15.20",
+  "ruff~=0.16.1",
 ]
 testing = [
  "daphne",
  "factory-boy~=3.3.1",
-  "faker~=40.15.0",
+  "faker~=40.36.0",
  "imagehash",
-  "pytest~=9.0.3",
+  "pytest~=9.1.1",
  "pytest-cov~=7.1.0",
  "pytest-django~=4.12.0",
-  "pytest-env~=1.6.0",
+  "pytest-env~=1.7.0",
  "pytest-httpx",
  "pytest-mock~=3.15.1",
  # "pytest-randomly~=4.0.1",
-  "pytest-rerunfailures~=16.1",
+  "pytest-rerunfailures~=16.4",
  "pytest-sugar",
  "pytest-xdist~=3.8.0",
  "time-machine>=2.13",
@@ -183,6 +182,7 @@ output-format = "grouped"
 line-ending = "lf"
 [tool.ruff.lint]
 # https://docs.astral.sh/ruff/rules/
 select = [ "E4", "E7", "E9", "F" ]
 extend-select = [
  "COM",  # https://docs.astral.sh/ruff/rules/#flake8-commas-com
  "DJ",   # https://docs.astral.sh/ruff/rules/#flake8-django-dj
@@ -56,13 +56,13 @@
      },
      "architect": {
        "build": {
-          "builder": "@angular-builders/custom-webpack:browser",
+          "builder": "@angular/build:application",
          "options": {
-            "customWebpackConfig": {
+            "outputPath": {
-                "path": "./extra-webpack.config.ts"
+              "base": "dist/paperless-ui",
              "browser": ""
            },
-            "outputPath": "dist/paperless-ui",
+            "browser": "src/main.ts",
            "main": "src/main.ts",
            "outputHashing": "none",
            "index": "src/index.html",
            "polyfills": [
@@ -97,6 +97,7 @@
            "scripts": [],
            "allowedCommonJsDependencies": [
              "file-saver",
              "mime-names",
              "utif"
            ],
            "extractLicenses": false,
@@ -117,11 +118,13 @@
                  "with": "src/environments/environment.prod.ts"
                }
              ],
-              "outputPath": "../src/documents/static/frontend/",
+              "outputPath": {
                "base": "../src/documents/static/frontend/",
                "browser": ""
              },
              "optimization": true,
              "outputHashing": "none",
              "sourceMap": false,
              "namedChunks": false,
              "extractLicenses": true,
              "budgets": [
                {
@@ -145,7 +148,7 @@
          "defaultConfiguration": ""
        },
        "serve": {
-          "builder": "@angular-builders/custom-webpack:dev-server",
+          "builder": "@angular/build:dev-server",
          "options": {
            "buildTarget": "paperless-ui:build:en-US"
          },
@@ -156,7 +159,7 @@
          }
        },
        "extract-i18n": {
-          "builder": "@angular-builders/custom-webpack:extract-i18n",
+          "builder": "@angular/build:extract-i18n",
          "options": {
            "buildTarget": "paperless-ui:build"
          }
@@ -1,4 +1,4 @@
-import { expect, test } from '@playwright/test'
+import { expect, test, type WebSocketRoute } from '@playwright/test'
 import path from 'node:path'
 const REQUESTS_HAR = path.join(__dirname, 'requests/api-document-detail.har')
@@ -95,3 +95,60 @@ test('should support quick filters', async ({ page }) => {
    .click()
  await expect(page).toHaveURL(/tags__id__all=4&sort=created&reverse=1&page=1/)
 })
 test('should finish reloading the preview after a remote document update', async ({
  page,
 }) => {
  let resolveStatusSocket: (socket: WebSocketRoute) => void
  const statusSocketReady = new Promise<WebSocketRoute>((resolve) => {
    resolveStatusSocket = resolve
  })
  await page.routeWebSocket(/\/ws\/status\/$/, (socket) => {
    resolveStatusSocket(socket)
  })
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
  let previewRequestCount = 0
  page.on('request', (request) => {
    if (request.url().includes('/api/documents/175/preview/')) {
      previewRequestCount++
    }
  })
  await page.goto('/documents/175/details')
  await page.locator('pngx-document-detail').waitFor()
  await expect(page.getByTitle('Storage path', { exact: true })).toHaveText(
    /\w+/
  )
  const previewWasLoaded = await page.evaluate(() => {
    const detail = document.querySelector('pngx-document-detail')
    const component = (window as any).ng.getComponent(detail)
    component.pdfPreviewLoaded({ numPages: 1 })
    return component.previewLoaded()
  })
  expect(previewWasLoaded).toBe(true)
  const previewRequestsBeforeReload = previewRequestCount
  const statusSocket = await statusSocketReady
  const documentReloaded = page.waitForResponse(
    (response) =>
      response.url().includes('/api/documents/175/?full_perms=true') &&
      response.request().method() === 'GET'
  )
  statusSocket.send(
    JSON.stringify({
      type: 'document_updated',
      data: {
        document_id: 175,
        modified: '2026-07-26T20:00:00Z',
      },
    })
  )
  await documentReloaded
  await expect(
    page.getByText('Document reloaded with latest changes.').first()
  ).toBeVisible()
  await expect
    .poll(() => previewRequestCount)
    .toBeGreaterThan(previewRequestsBeforeReload + 1)
 })
@@ -1,24 +0,0 @@
 import {
  CustomWebpackBrowserSchema,
  TargetOptions,
 } from '@angular-builders/custom-webpack'
 import * as webpack from 'webpack'
 const { codecovWebpackPlugin } = require('@codecov/webpack-plugin')
 export default (
  config: webpack.Configuration,
  options: CustomWebpackBrowserSchema,
  targetOptions: TargetOptions
 ) => {
  if (config.plugins) {
    config.plugins.push(
      codecovWebpackPlugin({
        enableBundleAnalysis: process.env.CODECOV_TOKEN !== undefined,
        bundleName: 'paperless-ngx',
        uploadToken: process.env.CODECOV_TOKEN,
      })
    )
  }
  return config
 }
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.0.2",
+  "version": "3.0.5",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -11,16 +11,16 @@
  },
  "private": true,
  "dependencies": {
-    "@angular/cdk": "^22.0.3",
+    "@angular/cdk": "^22.0.6",
-    "@angular/common": "~22.0.5",
+    "@angular/common": "~22.1.0",
-    "@angular/compiler": "~22.0.5",
+    "@angular/compiler": "~22.1.0",
-    "@angular/core": "~22.0.5",
+    "@angular/core": "~22.1.0",
-    "@angular/forms": "~22.0.5",
+    "@angular/forms": "~22.1.0",
-    "@angular/localize": "~22.0.5",
+    "@angular/localize": "~22.1.0",
-    "@angular/platform-browser": "~22.0.5",
+    "@angular/platform-browser": "~22.1.0",
-    "@angular/router": "~22.0.5",
+    "@angular/router": "~22.1.0",
    "@ng-bootstrap/ng-bootstrap": "^21.0.0",
-    "@ng-select/ng-select": "^23.2.0",
+    "@ng-select/ng-select": "^23.5.0",
    "@ngneat/dirty-check-forms": "^3.0.3",
    "@popperjs/core": "^2.11.8",
    "bootstrap": "^5.3.8",
@@ -32,33 +32,31 @@
    "ngx-device-detector": "^12.0.0",
    "ngx-ui-tour-ng-bootstrap": "^19.0.0",
    "normalize-diacritics": "^5.0.0",
-    "pdfjs-dist": "^6.0.227",
+    "pdfjs-dist": "^6.2.108",
    "rxjs": "^7.8.2",
    "tslib": "^2.8.1",
    "utif": "^3.1.0",
    "uuid": "^14.0.1"
  },
  "devDependencies": {
    "@angular-builders/custom-webpack": "^22.0.1",
    "@angular-builders/jest": "^22.0.1",
-    "@angular-devkit/core": "^22.0.5",
+    "@angular-devkit/core": "^22.1.2",
-    "@angular-devkit/schematics": "^22.0.5",
+    "@angular-devkit/schematics": "^22.1.2",
-    "@angular-eslint/builder": "22.0.0",
+    "@angular-eslint/builder": "22.1.0",
-    "@angular-eslint/eslint-plugin": "22.0.0",
+    "@angular-eslint/eslint-plugin": "22.1.0",
-    "@angular-eslint/eslint-plugin-template": "22.0.0",
+    "@angular-eslint/eslint-plugin-template": "22.1.0",
-    "@angular-eslint/schematics": "22.0.0",
+    "@angular-eslint/schematics": "22.1.0",
-    "@angular-eslint/template-parser": "22.0.0",
+    "@angular-eslint/template-parser": "22.1.0",
-    "@angular/build": "^22.0.5",
+    "@angular/build": "22.1.2",
-    "@angular/cli": "~22.0.5",
+    "@angular/cli": "22.1.2",
-    "@angular/compiler-cli": "~22.0.5",
+    "@angular/compiler-cli": "~22.1.0",
-    "@codecov/webpack-plugin": "^2.0.1",
+    "@playwright/test": "^1.62.0",
    "@playwright/test": "^1.61.1",
    "@types/jest": "^30.0.0",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.1.1",
-    "@typescript-eslint/eslint-plugin": "^8.62.0",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
-    "@typescript-eslint/parser": "^8.62.0",
+    "@typescript-eslint/parser": "^8.65.0",
-    "@typescript-eslint/utils": "^8.62.0",
+    "@typescript-eslint/utils": "^8.65.0",
-    "eslint": "^10.5.0",
+    "eslint": "^10.8.0",
    "jest": "30.4.2",
    "jest-environment-jsdom": "^30.4.1",
    "jest-junit": "^17.0.0",
@@ -66,8 +64,7 @@
    "jest-websocket-mock": "^2.5.0",
    "prettier-plugin-organize-imports": "^4.3.0",
    "ts-node": "~10.9.1",
-    "typescript": "^6.0.3",
+    "typescript": "^6.0.3"
    "webpack": "^5.107.2"
  },
-  "packageManager": "pnpm@10.26.0"
+  "packageManager": "pnpm@11.15.1"
 }
@@ -2,6 +2,10 @@ packages:
  - "."
 minimumReleaseAge: 10080
 trustPolicy: no-downgrade
 trustPolicyExclude:
  - "chokidar@4.0.3"
  - "semver@6.3.1 || 5.7.2"
 blockExoticSubdeps: true
 allowBuilds:
  "@parcel/watcher": true
  canvas: true
@@ -21,7 +21,7 @@
  </div>
 </pngx-page-header>
-@if (!tasksService.completedFileTasks && tasksService.loading) {
+@if (loading() && pagedTasks().length === 0) {
  <div class="spinner-border spinner-border-sm fw-normal ms-2 me-auto" role="status"></div>
  <div class="visually-hidden" i18n>Loading...</div>
 }
@@ -576,7 +576,7 @@ describe('TasksComponent', () => {
    expect(dismissSpy).toHaveBeenCalledWith(new Set([tasks[0].id, tasks[1].id]))
    expect(toastSpy).toHaveBeenCalledWith('Error dismissing tasks', error)
-    expect(modal.componentInstance.buttonsEnabled).toBe(true)
+    expect(modal.componentInstance.buttonsEnabled()).toBe(true)
    expect(component.selectedTasks.size).toBe(0)
  })
@@ -642,7 +642,7 @@ describe('TasksComponent', () => {
    expect(dismissSpy).toHaveBeenCalled()
    expect(toastSpy).toHaveBeenCalledWith('Error dismissing tasks', error)
-    expect(modal.componentInstance.buttonsEnabled).toBe(true)
+    expect(modal.componentInstance.buttonsEnabled()).toBe(true)
  })
  it('should dismiss the currently visible scoped and filtered tasks', () => {
@@ -316,7 +316,7 @@ export class TasksComponent
      modal.componentInstance.btnClass = 'btn-warning'
      modal.componentInstance.btnCaption = $localize`Dismiss`
      modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        modal.close()
        this.tasksService.dismissTasks(tasks).subscribe({
          next: () => {
@@ -324,7 +324,7 @@ export class TasksComponent
          },
          error: (e) => {
            this.toastService.showError($localize`Error dismissing tasks`, e)
-            modal.componentInstance.buttonsEnabled = true
+            modal.componentInstance.buttonsEnabled.set(true)
          },
        })
        this.clearSelection()
@@ -350,7 +350,7 @@ export class TasksComponent
    modal.componentInstance.btnClass = 'btn-warning'
    modal.componentInstance.btnCaption = $localize`Dismiss`
    modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      modal.close()
      this.tasksService.dismissAllTasks().subscribe({
        next: () => {
@@ -358,7 +358,7 @@ export class TasksComponent
        },
        error: (e) => {
          this.toastService.showError($localize`Error dismissing tasks`, e)
-          modal.componentInstance.buttonsEnabled = true
+          modal.componentInstance.buttonsEnabled.set(true)
        },
      })
      this.clearSelection()
@@ -82,7 +82,7 @@ export class TrashComponent
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        this.trashService.emptyTrash([document.id]).subscribe({
          next: () => {
            this.toastService.showInfo(
@@ -146,7 +146,7 @@ export class UsersAndGroupsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.usersService.delete(user).subscribe({
        next: () => {
          modal.close()
@@ -199,7 +199,7 @@ export class UsersAndGroupsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.groupsService.delete(group).subscribe({
        next: () => {
          modal.close()
@@ -104,14 +104,14 @@
            </h6>
            <ul class="nav flex-column mb-2" cdkDropList (cdkDropListDropped)="onDrop($event)">
              @for (view of savedViewService.sidebarViews; track view.id) {
-                <li class="nav-item w-100 app-link" cdkDrag [cdkDragDisabled]="!settingsService.organizingSidebarSavedViews()"
+                <li class="nav-item w-100 app-link" cdkDrag [cdkDragDisabled]="!settingsService.organizingSidebarSavedViews() || !canSaveSettings"
                  cdkDragPreviewContainer="parent" cdkDragPreviewClass="navItemDrag" (cdkDragStarted)="onDragStart($event)"
                  (cdkDragEnded)="onDragEnd($event)">
                  <a class="nav-link" routerLink="view/{{view.id}}"
                    routerLinkActive="active" (click)="closeMenu()" [ngbPopover]="view.name"
                    [disablePopover]="!slimSidebarEnabled" placement="end" container="body" triggers="mouseenter:mouseleave"
                    popoverClass="popover-slim">
-                    <i-bs class="me-2" name="funnel"></i-bs><span><div class="d-inline-flex view-name"><span class="overflow-hidden" [class.text-wrap]="!slimSidebarEnabled">{{view.name}}</span></div>
+                    <i-bs class="me-2" [name]="view.icon || 'funnel'"></i-bs><span><div class="d-inline-flex view-name"><span class="overflow-hidden" [class.text-wrap]="!slimSidebarEnabled">{{view.name}}</span></div>
                        @if (showSidebarCounts && !slimSidebarEnabled) {
                          <span class="badge bg-info text-dark ms-2 d-inline">{{ savedViewService.getDocumentCount(view) }}</span>
                        }
@@ -120,7 +120,7 @@
                      <span class="badge bg-info text-dark position-absolute top-0 end-0 d-none d-md-block">{{ savedViewService.getDocumentCount(view) }}</span>
                    }
                  </a>
-                  @if (settingsService.organizingSidebarSavedViews()) {
+                  @if (settingsService.organizingSidebarSavedViews() && canSaveSettings) {
                    <div class="position-absolute end-0 top-0 px-3 py-2" [class.me-n3]="slimSidebarEnabled" cdkDragHandle>
                      <i-bs name="grip-vertical"></i-bs>
                    </div>
@@ -182,7 +182,7 @@
                    container="body" triggers="mouseenter:mouseleave" popoverClass="popover-slim">
                    <i-bs class="me-2" name="stack"></i-bs><span><ng-container i18n>Attributes</ng-container></span>
                  </a>
-                  @if (!slimSidebarEnabled) {
+                  @if (!slimSidebarEnabled && canSaveSettings) {
                    <button
                      type="button"
                      class="btn btn-link btn-sm text-muted p-0 me-3 attributes-expand-btn"
@@ -47,11 +47,12 @@
  .search-container {
    max-height: 4.5rem;
-    overflow: hidden;
+    overflow: visible;
    transition: max-height .2s ease, opacity .2s ease, padding-top .2s ease, padding-bottom .2s ease;
    &.mobile-hidden {
      max-height: 0;
      overflow: hidden;
      opacity: 0;
      padding-top: 0 !important;
      padding-bottom: 0 !important;
@@ -280,10 +281,52 @@ main {
  }
 }
-@media screen and (min-width: 376px) and (max-width: 768px) {
+@media screen and (max-width: 575.98px) {
  .navbar {
    display: grid;
    grid-template-columns: 1fr auto 1fr;
    grid-template-areas:
      "toggler brand actions"
      "search search search";
  }
  .navbar-toggler {
-    // compensate for 2 buttons on the right
+    grid-area: toggler;
-    margin-right: 45px;
+    text-align: left;
  }
  .navbar-brand {
    grid-area: brand;
    min-width: 0;
    max-width: 100%;
    justify-self: center;
    overflow: hidden;
    > div,
    .custom-title {
      min-width: 0;
      max-width: 100%;
      overflow: hidden;
    }
    .title,
    .byline {
      max-width: 100%;
      overflow: hidden;
      text-overflow: ellipsis;
      white-space: nowrap;
    }
  }
  .search-container {
    grid-area: search;
    width: 100%;
  }
  .navbar > ul {
    grid-area: actions;
    justify-self: end;
    flex-wrap: nowrap;
  }
 }
@@ -293,13 +336,6 @@ main {
  }
 }
@media screen and (max-width: 345px) {
  .custom-title {
    max-width: 110px;
    overflow: hidden;
  }
 }
 :host ::ng-deep .dropdown.show .dropdown-toggle,
 :host ::ng-deep .dropdown-toggle:hover {
  opacity: 0.7;
@@ -12,10 +12,10 @@
  }
 </div>
 <div class="modal-footer">
-  <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+  <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">
        <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
      </button>
-  <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled">
+  <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled()">
    <span>
      {{btnCaption}}
      <span class="visually-hidden">{{ seconds | number: '1.0-0' }} seconds</span>
@@ -25,7 +25,7 @@
    }
  </button>
  @if (alternativeBtnCaption) {
-    <button type="button" class="btn" [class]="alternativeBtnClass" (click)="alternative()" [disabled]="!alternativeButtonEnabled || !buttonsEnabled">
+    <button type="button" class="btn" [class]="alternativeBtnClass" (click)="alternative()" [disabled]="!alternativeButtonEnabled || !buttonsEnabled()">
      {{alternativeBtnCaption}}
    </button>
  }
@@ -64,6 +64,22 @@ describe('ConfirmDialogComponent', () => {
    expect(confirmSubjectResult).toBeTruthy()
  })
  it('should re-render the buttons when they are toggled from outside', async () => {
    const confirmButton: HTMLButtonElement =
      fixture.nativeElement.querySelectorAll('.modal-footer button')[1]
    expect(confirmButton.disabled).toBeFalsy()
    // Deliberately no detectChanges: a request callback toggling this is all
    // that happens, and nothing else schedules a render for the modal
    component.buttonsEnabled.set(false)
    await fixture.whenStable()
    expect(confirmButton.disabled).toBeTruthy()
    component.buttonsEnabled.set(true)
    await fixture.whenStable()
    expect(confirmButton.disabled).toBeFalsy()
  })
  it('should support cancel & close modal', () => {
    let confirmSubjectResult
    const closeModalSpy = jest.spyOn(modal, 'close')
@@ -1,5 +1,12 @@
 import { DecimalPipe } from '@angular/common'
-import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
+import {
  Component,
  EventEmitter,
  Input,
  Output,
  inject,
  signal,
 } from '@angular/core'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
@@ -46,8 +53,7 @@ export class ConfirmDialogComponent extends LoadingComponentWithPermissions {
  @Input()
  cancelBtnCaption = $localize`Cancel`
-  @Input()
+  readonly buttonsEnabled = signal(true)
  buttonsEnabled = true
  confirmButtonEnabled = true
  alternativeButtonEnabled = true
@@ -56,10 +56,10 @@
    }
 </div>
 <div class="modal-footer">
-    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">
        <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
    </button>
-    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled">
+    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled()">
        {{btnCaption}}
    </button>
 </div>
@@ -57,7 +57,7 @@
    class="btn"
    [class]="cancelBtnClass"
    (click)="cancel()"
-    [disabled]="!buttonsEnabled"
+    [disabled]="!buttonsEnabled()"
  >
    <span class="d-inline-block" style="padding-bottom: 1px;">
      {{cancelBtnCaption}}
@@ -68,7 +68,7 @@
    class="btn"
    [class]="btnClass"
    (click)="confirm()"
-    [disabled]="!confirmButtonEnabled || !buttonsEnabled"
+    [disabled]="!confirmButtonEnabled || !buttonsEnabled()"
  >
    {{btnCaption}}
  </button>
@@ -34,10 +34,10 @@
          <p class="mb-0 small"><b>{{messageBold}}</b></p>
        }
    </div>
-    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">
        <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
    </button>
-    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled || degrees === 0">
+    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled() || degrees === 0">
      {{btnCaption}}
      @if (!confirmButtonEnabled) {
          <ngb-progressbar style="height: 1px;" type="dark" [max]="secondsTotal" [value]="seconds"></ngb-progressbar>
@@ -68,6 +68,11 @@
    ></ng-select>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.DocumentLink) {
    <pngx-input-document-link [(ngModel)]="atom.value" class="w-25 form-select doc-link-select p-0" placeholder="Search docs..." i18n-placeholder [minimal]="true"></pngx-input-document-link>
  } @else if (getCustomFieldByID(atom.field)?.data_type === CustomFieldDataType.Monetary) {
    <input class="w-25 form-control rounded-end" type="text" inputmode="decimal"
      [ngModel]="atom.value"
      (ngModelChange)="setMonetaryValue(atom, $event)"
      [disabled]="disabled">
  } @else {
    <input class="w-25 form-control rounded-end" type="text" [(ngModel)]="atom.value" [disabled]="disabled">
  }
@@ -1,5 +1,6 @@
 import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { LOCALE_ID } from '@angular/core'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
@@ -41,6 +42,12 @@ const customFields = [
      ],
    },
  },
  {
    id: 3,
    name: 'Test Monetary Field',
    data_type: CustomFieldDataType.Monetary,
    extra_data: { default_currency: 'EUR' },
  },
 ]
 describe('CustomFieldsQueryDropdownComponent', () => {
@@ -61,6 +68,7 @@ describe('CustomFieldsQueryDropdownComponent', () => {
      providers: [
        provideHttpClient(withInterceptorsFromDi()),
        provideHttpClientTesting(),
        { provide: LOCALE_ID, useValue: 'de' },
      ],
    }).compileComponents()
@@ -150,6 +158,22 @@ describe('CustomFieldsQueryDropdownComponent', () => {
    expect(options2).toEqual([])
  })
  it('should normalize localized monetary comparison values', () => {
    const atom = new CustomFieldQueryAtom([3, 'exact', null])
    component.setMonetaryValue(atom, '1.234,56')
    expect(atom.value).toEqual('1234.56')
  })
  it('should preserve API-formatted monetary comparison values', () => {
    const atom = new CustomFieldQueryAtom([3, 'exact', null])
    component.setMonetaryValue(atom, '1234.56')
    expect(atom.value).toEqual('1234.56')
  })
  it('should remove an element from the selection model', () => {
    const expression = new CustomFieldQueryExpression()
    const atom = new CustomFieldQueryAtom()
@@ -1,9 +1,14 @@
-import { NgTemplateOutlet } from '@angular/common'
+import {
  getLocaleNumberSymbol,
  NgTemplateOutlet,
  NumberSymbol,
 } from '@angular/common'
 import {
  Component,
  EventEmitter,
  inject,
  Input,
  LOCALE_ID,
  Output,
  QueryList,
  signal,
@@ -212,6 +217,7 @@ export class CustomFieldQueriesModel {
 })
 export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPermissions {
  protected customFieldsService = inject(CustomFieldsService)
  private readonly locale = inject(LOCALE_ID)
  public CustomFieldQueryComponentType = CustomFieldQueryElementType
  public CustomFieldQueryOperator = CustomFieldQueryOperator
@@ -376,4 +382,18 @@ export class CustomFieldsQueryDropdownComponent extends LoadingComponentWithPerm
    }
    return []
  }
  setMonetaryValue(atom: CustomFieldQueryAtom, value: string) {
    // Normalize the decimal symbol e.g. . vs , by locale
    const decimalSymbol = getLocaleNumberSymbol(
      this.locale,
      NumberSymbol.Decimal
    )
    if (decimalSymbol !== '.' && value.includes(decimalSymbol)) {
      const groupSymbol = getLocaleNumberSymbol(this.locale, NumberSymbol.Group)
      value = value.split(groupSymbol).join('').split(decimalSymbol).join('.')
    }
    atom.value = value
  }
 }
@@ -32,6 +32,8 @@ import { EditDialogComponent, EditDialogMode } from './edit-dialog.component'
  template: `
    <div>
      <h4 class="modal-title" id="modal-basic-title">{{ getTitle() }}</h4>
      <span class="error">{{ error?.name }}</span>
      <button [disabled]="networkActive" (click)="save()">Save</button>
    </div>
  `,
  imports: [FormsModule, ReactiveFormsModule],
@@ -276,4 +278,22 @@ describe('EditDialogComponent', () => {
    expect(failedSpy).toHaveBeenCalled()
    expect(component.error).toEqual('error')
  })
  it('should update the view after a failed save', async () => {
    const button: HTMLButtonElement =
      fixture.nativeElement.querySelector('button')
    button.click()
    await fixture.whenStable()
    expect(button.disabled).toBe(true)
    httpTestingController
      .expectOne(`${environment.apiBaseUrl}tags/`)
      .flush({ name: ['Name is required.'] }, { status: 400, statusText: '' })
    await fixture.whenStable()
    expect(button.disabled).toBe(false)
    expect(fixture.nativeElement.querySelector('.error').textContent).toContain(
      'Name is required.'
    )
  })
 })
@@ -1,4 +1,5 @@
 import {
  ChangeDetectorRef,
  Directive,
  EventEmitter,
  Input,
@@ -45,6 +46,7 @@ export abstract class EditDialogComponent<
  protected userService = inject(UserService)
  protected settingsService = inject(SettingsService)
  protected permissionsService = inject(PermissionsService)
  protected changeDetector = inject(ChangeDetectorRef)
  dialogMode = model(EditDialogMode.CREATE)
@@ -108,10 +110,12 @@ export abstract class EditDialogComponent<
    // wait to enable close button so it doesn't steal focus from input since its the first clickable element in the DOM
    setTimeout(() => {
      this.closeEnabled = true
      this.changeDetector.markForCheck()
    })
    this.userService.listAll().subscribe((r) => {
      this.users = r.results
      this.changeDetector.markForCheck()
    })
  }
@@ -191,6 +195,7 @@ export abstract class EditDialogComponent<
        this.error = error.error
        this.networkActive = false
        this.failed.next(error)
        this.changeDetector.markForCheck()
      },
    })
  }
@@ -1019,4 +1019,28 @@ describe('WorkflowEditDialogComponent', () => {
      'pass3',
    ])
  })
  it('should parse passwords again when retrying a failed save', () => {
    component.object = {
      name: 'Workflow with blank Passwords',
      id: 1,
      order: null,
      enabled: true,
      triggers: [],
      actions: [
        {
          id: 1,
          type: WorkflowActionType.PasswordRemoval,
          passwords: [],
        },
      ],
    }
    component.ngOnInit()
    component.save()
    component.objectForm.get('order').setValue(1)
    expect(() => component.save()).not.toThrow()
    expect(component.objectForm.get('actions').value[0].passwords).toEqual([])
  })
 })
@@ -1207,9 +1207,8 @@ export class WorkflowEditDialogComponent
    return passwords.join('\n')
  }
-  private parsePasswords(value: string = ''): string[] {
+  private parsePasswords(value: string | string[] = ''): string[] {
-    return value
+    return (Array.isArray(value) ? value : value.split(/[\n,]+/))
      .split(/[\n,]+/)
      .map((entry) => entry.trim())
      .filter((entry) => entry.length > 0)
  }
@@ -52,10 +52,10 @@ describe('CustomFieldsValuesComponent', () => {
  })
  it('should set selectedFields and map values correctly', () => {
-    component.value = { 1: 'value1' }
+    component.value = { 1: 'value1', 3: 0, 4: false }
-    component.selectedFields = [1, 2]
+    component.selectedFields = [1, 2, 3, 4]
-    expect(component.selectedFields).toEqual([1, 2])
+    expect(component.selectedFields).toEqual([1, 2, 3, 4])
-    expect(component.value).toEqual({ 1: 'value1', 2: null })
+    expect(component.value).toEqual({ 1: 'value1', 2: null, 3: 0, 4: false })
  })
  it('should return the correct custom field by id', () => {
@@ -77,7 +77,7 @@ export class CustomFieldsValuesComponent extends AbstractInputComponent<Object>
    this._selectedFields = newFields
    // map the selected fields to an object with field_id as key and value as value
    this.value = newFields.reduce((acc, fieldId) => {
-      acc[fieldId] = this.value?.[fieldId] || null
+      acc[fieldId] = this.value?.[fieldId] ?? null
      return acc
    }, {})
    this.onChange(this.value)
@@ -36,7 +36,16 @@
          (focus)="clearLastSearchTerm()"
          (clear)="clearLastSearchTerm()"
          (blur)="onBlur()">
          <ng-template ng-label-tmp let-item="item">
            @if (iconField && item[iconField]) {
              <i-bs class="me-2" [name]="item[iconField]"></i-bs>
            }
            <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
          </ng-template>
          <ng-template ng-option-tmp let-item="item">
              @if (iconField && item[iconField]) {
                <i-bs class="me-2" [name]="item[iconField]"></i-bs>
              }
              <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
          </ng-template>
        </ng-select>
@@ -35,7 +35,7 @@ import { AbstractInputComponent } from '../abstract-input'
    NgxBootstrapIconsModule,
  ],
 })
-export class SelectComponent extends AbstractInputComponent<number> {
+export class SelectComponent extends AbstractInputComponent<number | string> {
  constructor() {
    super()
    this.addItemRef = this.addItem.bind(this)
@@ -100,6 +100,9 @@ export class SelectComponent extends AbstractInputComponent<number> {
  @Input()
  bindLabel: string = 'name'
  @Input()
  iconField: string
  public searchFn = (term: string, item: any): boolean =>
    matchesSearchText(item?.[this.bindLabel], term)
@@ -100,7 +100,7 @@
      </div>
    }
    <div class="form-group ms-md-auto">
-      <button type="button" class="btn me-2" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">{{ cancelBtnCaption }}</button>
+      <button type="button" class="btn me-2" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">{{ cancelBtnCaption }}</button>
      <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="pages.length === 0">{{ btnCaption }}</button>
    </div>
  </div>
@@ -151,6 +151,13 @@
  inset: 0;
  pointer-events: none;
  & section {
    position: absolute;
    text-align: initial;
    box-sizing: border-box;
    transform-origin: 0 0;
  }
  & .annotationTextContent {
    opacity: 0;
  }
@@ -90,6 +90,7 @@ describe('PngxPdfViewerComponent', () => {
    }
    expect(viewer).toBeInstanceOf(PDFSinglePageViewer)
    expect(viewer.options.textLayerMode).toBe(0)
    expect(viewer.options.enableSelectionRendering).toBe(false)
  })
  it('applies zoom, rotation, and page changes', async () => {
@@ -129,13 +130,25 @@ describe('PngxPdfViewerComponent', () => {
    ;(component as any).applyScale()
    expect(viewer.currentScaleValue).toBe(PdfZoomScale.PageFit)
    expect(viewer.currentScale).toBe(2)
  })
  it('does not reapply scale for page-only changes', async () => {
    await initComponent()
    const pdf = (component as any).pdf as { numPages: number }
    pdf.numPages = 3
    const viewer = (component as any).pdfViewer as PDFViewer
    viewer.setDocument(pdf)
    const applyScaleSpy = jest.spyOn(component as any, 'applyScale')
    component.page = 2
-    ;(component as any).lastViewerPage = 2
+
-    ;(component as any).applyViewerState()
+    component.ngOnChanges({
      page: new SimpleChange(1, 2, false),
    })
    expect(viewer.currentPageNumber).toBe(2)
    expect((component as any).lastViewerPage).toBeUndefined()
-    expect(applyScaleSpy).toHaveBeenCalled()
+    expect(applyScaleSpy).not.toHaveBeenCalled()
  })
  it('does not reset the viewer when it is already on the requested page', async () => {
@@ -283,6 +296,22 @@ describe('PngxPdfViewerComponent', () => {
    expect(mockViewer.currentPageNumber).toBe(1)
  })
  it('reloads when the source revision changes', () => {
    const resetSpy = jest.spyOn(component as any, 'resetViewerState')
    const loadSpy = jest
      .spyOn(component as any, 'loadDocument')
      .mockImplementation(() => {})
    component.src = 'test.pdf'
    component.sourceRevision = 1
    component.ngOnChanges({
      sourceRevision: new SimpleChange(0, 1, false),
    })
    expect(resetSpy).toHaveBeenCalled()
    expect(loadSpy).toHaveBeenCalled()
  })
  it('applies viewer state after view init when already loaded', () => {
    const applySpy = jest.spyOn(component as any, 'applyViewerState')
    ;(component as any).hasLoaded = true
@@ -13,6 +13,7 @@ import {
  ViewChild,
 } from '@angular/core'
 import {
  AnnotationMode,
  getDocument,
  GlobalWorkerOptions,
  PDFDocumentLoadingTask,
@@ -43,6 +44,7 @@ export class PngxPdfViewerComponent
  private readonly document = inject<Document>(DOCUMENT)
  @Input() src!: string
  @Input() sourceRevision = 0
  @Input() password?: string
  @Input() page?: number
  @Output() pageChange = new EventEmitter<number>()
@@ -93,7 +95,7 @@ export class PngxPdfViewerComponent
  }
  ngOnChanges(changes: SimpleChanges): void {
-    if (changes['src'] || changes['password']) {
+    if (changes['src'] || changes['sourceRevision'] || changes['password']) {
      this.resetViewerState()
      if (this.src) {
        this.loadDocument()
@@ -115,7 +117,10 @@ export class PngxPdfViewerComponent
      changes['zoomScale'] ||
      changes['rotation']
    ) {
-      this.applyViewerState()
+      // Prevent loop with page / scale application see https://github.com/paperless-ngx/paperless-ngx/issues/13404
      this.applyViewerState(
        !!(changes['zoom'] || changes['zoomScale'] || changes['rotation'])
      )
    }
    if (changes['searchQuery']) {
@@ -217,6 +222,8 @@ export class PngxPdfViewerComponent
      linkService: this.linkService,
      findController: this.findController,
      textLayerMode,
      annotationMode: AnnotationMode.ENABLE,
      enableSelectionRendering: false,
      removePageBorders: true,
    }
@@ -239,7 +246,7 @@ export class PngxPdfViewerComponent
    }
  }
-  private applyViewerState(): void {
+  private applyViewerState(applyScale = true): void {
    if (!this.pdfViewer) {
      return
    }
@@ -263,7 +270,7 @@ export class PngxPdfViewerComponent
    if (this.page === this.lastViewerPage) {
      this.lastViewerPage = undefined
    }
-    if (hasPages) {
+    if (hasPages && applyScale) {
      this.applyScale()
    }
    this.dispatchFindIfReady()
@@ -17,6 +17,10 @@ const permissions = [
  'view_document',
  'change_document',
  'delete_document',
  'add_sharelinkbundle',
  'view_sharelinkbundle',
  'change_sharelinkbundle',
  'delete_sharelinkbundle',
  'change_tag',
  'view_documenttype',
 ]
@@ -75,6 +79,7 @@ describe('PermissionsSelectComponent', () => {
    component.ngOnInit()
    component.writeValue(permissions)
    expect(component.typesWithAllActions).toContain('Document')
    expect(component.typesWithAllActions).toContain('ShareLinkBundle')
  })
  it('should update checkboxes on permissions set', () => {
@@ -85,6 +90,10 @@ describe('PermissionsSelectComponent', () => {
    expect(input1.nativeElement.checked).toBeTruthy()
    const input2 = fixture.debugElement.query(By.css('input#Tag_Change'))
    expect(input2.nativeElement.checked).toBeTruthy()
    const bundleInput = fixture.debugElement.query(
      By.css('input#ShareLinkBundle_Add')
    )
    expect(bundleInput.nativeElement.checked).toBeTruthy()
  })
  it('disable checkboxes when permissions are inherited', () => {
@@ -1,6 +1,7 @@
 <a [href]="link ?? previewUrl" class="{{linkClasses}}" [target]="linkTarget" [title]="linkTitle"
  [ngbPopover]="previewContent" [popoverTitle]="document.title | documentTitle" container="body"
-  autoClose="true" [popoverClass]="popoverClass()" (mouseenter)="mouseEnterPreview()" (mouseleave)="mouseLeavePreview()" #popover="ngbPopover">
+  autoClose="true" [popoverClass]="popoverClass()" [popperOptions]="popperOptions"
  (mouseenter)="mouseEnterPreview()" (mouseleave)="mouseLeavePreview()" #popover="ngbPopover">
  <ng-content></ng-content>
 </a>
 <ng-template #previewContent>
@@ -67,6 +67,10 @@ describe('PreviewPopupComponent', () => {
    expect(component.useNativePdfViewer).toBeTruthy()
  })
  it('should use fixed positioning for the preview popover', () => {
    expect(component.popperOptions({}).strategy).toEqual('fixed')
  })
  it('should render object if native PDF viewer enabled', () => {
    settingsService.set(SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER, true)
    component.popover.open()
@@ -8,6 +8,7 @@ import {
  ViewChild,
 } from '@angular/core'
 import { NgbPopover, NgbPopoverModule } from '@ng-bootstrap/ng-bootstrap'
 import { Options } from '@popperjs/core'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { first, Subject, takeUntil } from 'rxjs'
 import { Document } from 'src/app/data/document'
@@ -74,6 +75,11 @@ export class PreviewPopupComponent implements OnDestroy {
  readonly popoverClass = signal('shadow popover-preview')
  readonly popperOptions = (options: Partial<Options>): Partial<Options> => ({
    ...options,
    strategy: 'fixed',
  })
  get renderAsObject(): boolean {
    return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
  }
@@ -119,7 +119,7 @@
        type="button"
        class="btn btn-primary btn-sm d-inline-flex align-items-center gap-2 text-nowrap"
        (click)="submit()"
-        [disabled]="loading() || !buttonsEnabled">
+        [disabled]="loading() || !buttonsEnabled()">
        @if (loading()) {
          <span class="spinner-border spinner-border-sm" role="status" aria-hidden="true"></span>
        }
@@ -69,7 +69,7 @@ describe('ShareLinkBundleDialogComponent', () => {
      file_version: FileVersion.Original,
      expiration_days: 3,
    })
-    expect(component.buttonsEnabled).toBe(false)
+    expect(component.buttonsEnabled()).toBe(false)
    expect(confirmSpy).toHaveBeenCalled()
    component.form.setValue({
@@ -78,7 +78,7 @@ export class ShareLinkBundleDialogComponent extends ConfirmDialogComponent {
        : FileVersion.Original,
      expiration_days: this.form.value.expirationDays,
    }
-    this.buttonsEnabled = false
+    this.buttonsEnabled.set(false)
    super.confirm()
  }
@@ -2,10 +2,16 @@
  <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading() || (suggestions() && !aiEnabled())">
    @if (loading()) {
      <div class="spinner-border spinner-border-sm" role="status"></div>
    } @else if (noSuggestions) {
      <i-bs width="1.2em" height="1.2em" name="check-circle"></i-bs>
    } @else {
      <i-bs width="1.2em" height="1.2em" name="stars"></i-bs>
    }
    @if (noSuggestions) {
      <span class="d-none d-lg-inline ps-1" i18n>No suggestions</span>
    } @else {
      <span class="d-none d-lg-inline ps-1" i18n>Suggest</span>
    }
    @if (totalSuggestions > 0) {
      <span class="badge bg-primary ms-2">{{ totalSuggestions }}</span>
    }
@@ -19,7 +25,7 @@
      <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
        <div class="list-group list-group-flush small pb-0">
-          @if (!suggestions()?.suggested_tags && !suggestions()?.suggested_document_types && !suggestions()?.suggested_correspondents) {
+          @if (totalSuggestions === 0) {
            <div class="list-group-item text-muted fst-italic">
              <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
            </div>
@@ -30,6 +30,34 @@ describe('SuggestionsDropdownComponent', () => {
    expect(component.totalSuggestions).toBe(4)
  })
  it('should show when a completed request returned no suggestions', () => {
    fixture.componentRef.setInput('suggestions', {
      correspondents: [],
      tags: [],
      document_types: [],
      storage_paths: [],
      dates: [],
    })
    fixture.detectChanges()
    expect(component.noSuggestions).toBeTruthy()
    expect(fixture.nativeElement.textContent).toContain('No suggestions')
  })
  it('should not show the empty state before a request or with suggestions', () => {
    expect(component.noSuggestions).toBeFalsy()
    fixture.componentRef.setInput('suggestions', {
      correspondents: [],
      tags: [42],
      document_types: [],
      storage_paths: [],
      dates: [],
    })
    expect(component.noSuggestions).toBeFalsy()
  })
  it('should emit getSuggestions when clickSuggest is called and suggestions are null', () => {
    jest.spyOn(component.getSuggestions, 'emit')
    fixture.componentRef.setInput('suggestions', null)
@@ -59,5 +87,6 @@ describe('SuggestionsDropdownComponent', () => {
    })
    component.clickSuggest()
    expect(component.dropdown.open).toBeTruthy()
    expect(fixture.nativeElement.textContent).toContain('No novel suggestions')
  })
 })
@@ -61,4 +61,21 @@ export class SuggestionsDropdownComponent {
        this.suggestions()?.suggested_document_types?.length || 0
    )
  }
  get noSuggestions(): boolean {
    const suggestions = this.suggestions()
    return (
      suggestions != null &&
      !suggestions.title &&
      !suggestions.tags?.length &&
      !suggestions.suggested_tags?.length &&
      !suggestions.correspondents?.length &&
      !suggestions.suggested_correspondents?.length &&
      !suggestions.document_types?.length &&
      !suggestions.suggested_document_types?.length &&
      !suggestions.storage_paths?.length &&
      !suggestions.suggested_storage_paths?.length &&
      !suggestions.dates?.length
    )
  }
 }
@@ -1,6 +1,7 @@
 <pngx-widget-frame
  *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }"
  [title]="savedView.name"
  [titleIcon]="savedView.icon || 'funnel'"
  [loading]="false"
  [draggable]="savedView"
  >
@@ -8,7 +8,12 @@
              <i-bs name="grip-vertical"></i-bs>
            </div>
          }
-          <h6 class="card-title mb-0">{{title()}}</h6>
+          <h6 class="card-title mb-0">
            @if (titleIcon()) {
              <i-bs class="me-2" [name]="titleIcon()"></i-bs>
            }
            {{title()}}
          </h6>
          <ng-content select="[title-badge]"></ng-content>
          @if (badge() !== null && badge() !== undefined) {
            <span class="badge bg-info text-dark ms-2">{{badge()}}</span>
@@ -16,6 +16,8 @@ export class WidgetFrameComponent implements AfterViewInit {
  title = input<string>()
  titleIcon = input<string>()
  draggable = input<any>()
  cardless = input(false)
@@ -113,8 +113,8 @@
    <form [formGroup]='documentForm' (ngSubmit)="save()">
-      <div class="btn-toolbar mb-1 border-bottom">
+      <div class="btn-toolbar justify-content-end mb-1 pb-3 gap-2 row-gap-2 border-bottom">
-        <div class="btn-group pb-3">
+        <div class="btn-group me-auto">
          <button type="button" class="btn btn-sm btn-outline-secondary" i18n-title title="Close" (click)="close()">
            <i-bs width="1.2em" height="1.2em" name="x"></i-bs>
          </button>
@@ -127,7 +127,8 @@
        </div>
        <ng-container *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
-          <div class="btn-group pb-3 ms-auto">
+          <div class="d-flex gap-2">
            <div class="btn-group">
              <pngx-suggestions-dropdown *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }"
                [disabled]="!userCanEdit || suggestionsLoading()"
                [loading]="suggestionsLoading()"
@@ -140,7 +141,7 @@
              </pngx-suggestions-dropdown>
            </div>
-          <div class="btn-group pb-3 ms-2">
+            <div class="btn-group">
              <pngx-custom-fields-dropdown
                *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.CustomField }"
                [documentId]="documentId()"
@@ -150,10 +151,13 @@
                (added)="addField($event)">
              </pngx-custom-fields-dropdown>
            </div>
-        </ng-container>
+          </div>
          <div class="ps-3">
            <ng-container *ngTemplateOutlet="saveButtons"></ng-container>
          </div>
        </ng-container>
      </div>
      <ul ngbNav #nav="ngbNav" class="nav-underline flex-nowrap flex-md-wrap overflow-auto" (navChange)="onNavChange($event)" [activeId]="activeNavID()" (activeIdChange)="activeNavID.set($event)">
        <li [ngbNavItem]="DocumentDetailNavIDs.Details">
@@ -276,7 +280,7 @@
              }
            </div>
-            <div class="d-flex border-top pt-3">
+            <div class="d-flex justify-content-end border-top pt-3">
              <ng-container *ngTemplateOutlet="saveButtons"></ng-container>
            </div>
          </ng-template>
@@ -440,7 +444,7 @@
 </div>
 <ng-template #saveButtons>
-  <div class="btn-group pb-3 ms-4">
+  <div class="btn-group">
    <ng-container *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
      <button type="submit" class="order-3 btn btn-sm btn-primary" i18n [disabled]="!userCanEdit || networkActive() || (isDirty$ | async) !== true">Save</button>
      @if (hasNext()) {
@@ -472,6 +476,7 @@
          <div class="preview-sticky pdf-viewer-container">
            <pngx-pdf-viewer
              [src]="pdfSource()"
              [sourceRevision]="previewRevision()"
              [password]="pdfPassword()"
              [renderMode]="PdfRenderMode.All"
              [page]="previewCurrentPage()" (pageChange)="previewCurrentPage.set($event)"
@@ -1564,7 +1564,7 @@ describe('DocumentDetailComponent', () => {
    dialog.confirmClicked.next()
    await openModal.result
-    expect(dialog.buttonsEnabled).toBe(false)
+    expect(dialog.buttonsEnabled()).toBe(false)
    expect(reloadSpy).toHaveBeenCalled()
    expect((component as any).incomingUpdateModal).toBeNull()
  })
@@ -1602,6 +1602,7 @@ describe('DocumentDetailComponent', () => {
    expect(openDoc.__changedFields).toEqual([])
    expect(setDirtySpy).toHaveBeenCalledWith(openDoc, false)
    expect(saveSpy).toHaveBeenCalled()
    expect(component.previewRevision()).toBe(1)
  })
  it('should ignore incoming update for a different document id', () => {
@@ -1788,7 +1789,7 @@ describe('DocumentDetailComponent', () => {
    expect(errorSpy).toHaveBeenCalled()
    expect(component.networkActive()).toBe(false)
-    expect(dialog.buttonsEnabled).toBe(true)
+    expect(dialog.buttonsEnabled()).toBe(true)
  })
  it('should refresh the document when removing password in update mode', () => {
@@ -2160,8 +2161,14 @@ describe('DocumentDetailComponent', () => {
  it('should support open share links and email modals', () => {
    const modalSpy = jest.spyOn(modalService, 'open')
    initNormally()
    component.selectedVersionId.set(10)
    component.openShareLinks()
    expect(modalSpy).toHaveBeenCalled()
    expect(
      (
        modalSpy.mock.results[0].value as NgbModalRef
      ).componentInstance.documentId()
    ).toBe(10)
    component.openEmailDocument()
    expect(modalSpy).toHaveBeenCalled()
  })
@@ -2190,9 +2197,6 @@ describe('DocumentDetailComponent', () => {
    const appendChildSpy = jest
      .spyOn(document.body, 'appendChild')
      .mockImplementation((node: Node) => node)
    const removeChildSpy = jest
      .spyOn(document.body, 'removeChild')
      .mockImplementation((node: Node) => node)
    const createObjectURLSpy = jest
      .spyOn(URL, 'createObjectURL')
      .mockReturnValue('blob:mock-url')
@@ -2211,6 +2215,7 @@ describe('DocumentDetailComponent', () => {
      src: '',
      onload: null,
      contentWindow: mockContentWindow,
      remove: jest.fn(),
    }
    const createElementSpy = jest
@@ -2254,12 +2259,11 @@ describe('DocumentDetailComponent', () => {
      mockContentWindow.onafterprint(new Event('afterprint'))
    }
-    expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
+    expect(mockIframe.remove).toHaveBeenCalled()
    expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
    createElementSpy.mockRestore()
    appendChildSpy.mockRestore()
    removeChildSpy.mockRestore()
    createObjectURLSpy.mockRestore()
    revokeObjectURLSpy.mockRestore()
  })
@@ -2306,9 +2310,6 @@ describe('DocumentDetailComponent', () => {
      const appendChildSpy = jest
        .spyOn(document.body, 'appendChild')
        .mockImplementation((node: Node) => node)
      const removeChildSpy = jest
        .spyOn(document.body, 'removeChild')
        .mockImplementation((node: Node) => node)
      const createObjectURLSpy = jest
        .spyOn(URL, 'createObjectURL')
        .mockReturnValue('blob:mock-url')
@@ -2331,6 +2332,7 @@ describe('DocumentDetailComponent', () => {
        src: '',
        onload: null,
        contentWindow: mockContentWindow,
        remove: jest.fn(),
      }
      const createElementSpy = jest
@@ -2353,15 +2355,21 @@ describe('DocumentDetailComponent', () => {
      if (expectToast) {
        expect(toastSpy).toHaveBeenCalled()
        expect(mockIframe.remove).toHaveBeenCalled()
        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      } else {
        expect(toastSpy).not.toHaveBeenCalled()
-      }
+        expect(mockIframe.remove).not.toHaveBeenCalled()
-      expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
+        expect(revokeObjectURLSpy).not.toHaveBeenCalled()
        component.ngOnDestroy()
        expect(mockIframe.remove).toHaveBeenCalled()
        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      }
      createElementSpy.mockRestore()
      appendChildSpy.mockRestore()
      removeChildSpy.mockRestore()
      createObjectURLSpy.mockRestore()
      revokeObjectURLSpy.mockRestore()
    })
@@ -249,6 +249,7 @@ export class DocumentDetailComponent
  titleSubject: Subject<string> = new Subject()
  readonly previewUrl = signal<string>(undefined)
  readonly pdfSource = signal<string>(undefined)
  readonly previewRevision = signal(0)
  readonly pdfPassword = signal<string>(undefined)
  readonly thumbUrl = signal<string>(undefined)
  readonly previewText = signal<string>(undefined)
@@ -288,6 +289,8 @@ export class DocumentDetailComponent
  private incomingUpdateModal: NgbModalRef
  private pendingIncomingUpdate: IncomingDocumentUpdate
  private lastLocalSaveModified: string | null = null
  private printIframe: HTMLIFrameElement | null = null
  private printBlobUrl: string | null = null
  requiresPassword: boolean = false
  password: string
@@ -609,6 +612,9 @@ export class DocumentDetailComponent
              .subscribe()
          }
          this.updateComponent(useDoc)
          if (forceRemote) {
            this.previewRevision.update((revision) => revision + 1)
          }
          this.titleSubject
            .pipe(
              debounceTime(1000),
@@ -653,7 +659,7 @@ export class DocumentDetailComponent
    modal.componentInstance.cancelBtnCaption = $localize`Dismiss`
    modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      modal.close()
      this.reloadRemoteVersion()
    })
@@ -864,6 +870,7 @@ export class DocumentDetailComponent
  }
  ngOnDestroy(): void {
    this.cleanupPrintDocument()
    this.unsubscribeNotifier.next(this)
    this.unsubscribeNotifier.complete()
  }
@@ -1367,7 +1374,7 @@ export class DocumentDetailComponent
    modal.componentInstance.confirmClicked
      .pipe(
        switchMap(() => {
-          modal.componentInstance.buttonsEnabled = false
+          modal.componentInstance.buttonsEnabled.set(false)
          return this.documentsService.delete(this.document())
        })
      )
@@ -1379,7 +1386,7 @@ export class DocumentDetailComponent
        },
        error: (error) => {
          this.toastService.showError($localize`Error deleting document`, error)
-          modal.componentInstance.buttonsEnabled = true
+          modal.componentInstance.buttonsEnabled.set(true)
          this.subscribeModalDelete(modal)
        },
      })
@@ -1404,7 +1411,7 @@ export class DocumentDetailComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.documentsService
        .reprocessDocuments({ documents: [this.document().id] })
        .subscribe({
@@ -1418,7 +1425,7 @@ export class DocumentDetailComponent
          },
          error: (error) => {
            if (modal) {
-              modal.componentInstance.buttonsEnabled = true
+              modal.componentInstance.buttonsEnabled.set(true)
            }
            this.toastService.showError(
              $localize`Error executing operation`,
@@ -1791,7 +1798,7 @@ export class DocumentDetailComponent
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        this.documentsService
          .editPdfDocuments([sourceDocumentId], {
            operations: modal.componentInstance.getOperations(),
@@ -1814,7 +1821,7 @@ export class DocumentDetailComponent
            },
            error: (error) => {
              if (modal) {
-                modal.componentInstance.buttonsEnabled = true
+                modal.componentInstance.buttonsEnabled.set(true)
              }
              this.toastService.showError(
                $localize`Error executing PDF edit operation`,
@@ -1848,7 +1855,7 @@ export class DocumentDetailComponent
        const sourceDocumentId = this.selectedVersionId() ?? this.document().id
        const dialog =
          modal.componentInstance as PasswordRemovalConfirmDialogComponent
-        dialog.buttonsEnabled = false
+        dialog.buttonsEnabled.set(false)
        this.networkActive.set(true)
        this.documentsService
          .removePasswordDocuments([sourceDocumentId], {
@@ -1873,7 +1880,7 @@ export class DocumentDetailComponent
              }
            },
            error: (error) => {
-              dialog.buttonsEnabled = true
+              dialog.buttonsEnabled.set(true)
              this.networkActive.set(false)
              this.toastService.showError(
                $localize`Error executing password removal operation`,
@@ -1885,6 +1892,7 @@ export class DocumentDetailComponent
  }
  printDocument() {
    this.cleanupPrintDocument()
    const selectedVersionId = this.getSelectedNonLatestVersionId()
    const printUrl = this.documentsService.getDownloadUrl(
      this.document().id,
@@ -1898,6 +1906,8 @@ export class DocumentDetailComponent
        next: (blob) => {
          const blobUrl = URL.createObjectURL(blob)
          const iframe = document.createElement('iframe')
          this.printIframe = iframe
          this.printBlobUrl = blobUrl
          iframe.style.position = 'fixed'
          iframe.style.right = '0'
          iframe.style.bottom = '0'
@@ -1913,22 +1923,19 @@ export class DocumentDetailComponent
                iframe.contentWindow.focus()
                iframe.contentWindow.print()
                iframe.contentWindow.onafterprint = () => {
-                  document.body.removeChild(iframe)
+                  this.cleanupPrintDocument()
                  URL.revokeObjectURL(blobUrl)
                }
              } catch (err) {
                // FF throws cross-origin error on onafterprint
                const isCrossOriginAfterPrintError =
                  err instanceof DOMException &&
                  err.message.includes('onafterprint')
                // FF throws here while print preview is still reading the iframe
                // so keep it alive until the next print or teardown
                if (!isCrossOriginAfterPrintError) {
                  this.toastService.showError($localize`Print failed.`, err)
                  timer(100).subscribe(() => this.cleanupPrintDocument())
                }
                timer(100).subscribe(() => {
                  // delay to avoid FF print failure
                  document.body.removeChild(iframe)
                  URL.revokeObjectURL(blobUrl)
                })
              }
            })
          }
@@ -1941,9 +1948,20 @@ export class DocumentDetailComponent
      })
  }
  private cleanupPrintDocument() {
    if (this.printIframe) this.printIframe.remove()
    this.printIframe = null
    if (this.printBlobUrl) {
      URL.revokeObjectURL(this.printBlobUrl)
      this.printBlobUrl = null
    }
  }
  public openShareLinks() {
    const modal = this.modalService.open(ShareLinksDialogComponent)
-    modal.componentInstance.documentId.set(this.document().id)
+    modal.componentInstance.documentId.set(
      this.selectedVersionId() ?? this.document().id
    )
    modal.componentInstance.hasArchiveVersion.set(
      this.metadata()?.has_archive_version ??
        !!this.document()?.archived_file_name
@@ -1683,7 +1683,7 @@ describe('BulkEditorComponent', () => {
          expiration_days: 7,
        },
        loading: signal(false),
-        buttonsEnabled: true,
+        buttonsEnabled: signal(true),
        copied: signal(false),
      },
    }
@@ -1715,7 +1715,7 @@ describe('BulkEditorComponent', () => {
      expiration_days: 7,
    })
    expect(dialogInstance.loading()).toBe(false)
-    expect(dialogInstance.buttonsEnabled).toBe(false)
+    expect(dialogInstance.buttonsEnabled()).toBe(false)
    expect(dialogInstance.createdBundle).toEqual({ id: 42 })
    expect(typeof dialogInstance.onOpenManage).toBe('function')
    expect(toastInfoSpy).toHaveBeenCalledWith(
@@ -1755,7 +1755,7 @@ describe('BulkEditorComponent', () => {
          expiration_days: null,
        },
        loading: signal(false),
-        buttonsEnabled: true,
+        buttonsEnabled: signal(true),
      },
    }
@@ -1777,7 +1777,7 @@ describe('BulkEditorComponent', () => {
      expect.any(Error)
    )
    expect(dialogInstance.loading()).toBe(false)
-    expect(dialogInstance.buttonsEnabled).toBe(true)
+    expect(dialogInstance.buttonsEnabled()).toBe(true)
    openSpy.mockRestore()
  })
@@ -273,7 +273,7 @@ export class BulkEditorComponent
    overrideSelection?: DocumentSelectionQuery
  ) {
    if (modal) {
-      this.setModalButtonsEnabled(modal, false)
+      modal.componentInstance.buttonsEnabled.set(false)
    }
    this.documentService
      .bulkEdit(overrideSelection ?? this.getSelectionQuery(), method, args)
@@ -290,7 +290,7 @@ export class BulkEditorComponent
    options: { deleteOriginals?: boolean } = {}
  ) {
    if (modal) {
-      this.setModalButtonsEnabled(modal, false)
+      modal.componentInstance.buttonsEnabled.set(false)
    }
    request.pipe(first()).subscribe({
      next: () => {
@@ -320,7 +320,7 @@ export class BulkEditorComponent
  private handleOperationError(modal: NgbModalRef, error: any) {
    if (modal) {
-      this.setModalButtonsEnabled(modal, true)
+      modal.componentInstance.buttonsEnabled.set(true)
    }
    this.toastService.showError(
      $localize`Error executing bulk operation`,
@@ -328,15 +328,6 @@ export class BulkEditorComponent
    )
  }
  private setModalButtonsEnabled(modal: NgbModalRef, enabled: boolean) {
    const buttonsEnabled = modal.componentInstance.buttonsEnabled
    if (typeof buttonsEnabled?.set === 'function') {
      buttonsEnabled.set(enabled)
    } else {
      modal.componentInstance.buttonsEnabled = enabled
    }
  }
  private applySelectionData(
    items: SelectionDataItem[],
    selectionModel: FilterableDropdownSelectionModel
@@ -872,7 +863,7 @@ export class BulkEditorComponent
      modal.componentInstance.confirmClicked
        .pipe(takeUntil(this.unsubscribeNotifier))
        .subscribe(() => {
-          modal.componentInstance.buttonsEnabled = false
+          modal.componentInstance.buttonsEnabled.set(false)
          this.executeDocumentAction(
            modal,
            this.documentService.deleteDocuments(this.getSelectionQuery())
@@ -920,7 +911,7 @@ export class BulkEditorComponent
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        this.executeDocumentAction(
          modal,
          this.documentService.reprocessDocuments(this.getSelectionQuery())
@@ -957,7 +948,7 @@ export class BulkEditorComponent
    rotateDialog.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        rotateDialog.buttonsEnabled = false
+        rotateDialog.buttonsEnabled.set(false)
        this.executeDocumentAction(
          modal,
          this.documentService.rotateDocuments(
@@ -990,7 +981,7 @@ export class BulkEditorComponent
        if (mergeDialog.archiveFallback()) {
          args.archive_fallback = true
        }
-        mergeDialog.buttonsEnabled = false
+        mergeDialog.buttonsEnabled.set(false)
        this.executeDocumentAction(
          modal,
          this.documentService.mergeDocuments(mergeDialog.documentIDs(), args),
@@ -1063,14 +1054,14 @@ export class BulkEditorComponent
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
        dialog.loading.set(true)
-        dialog.buttonsEnabled = false
+        dialog.buttonsEnabled.set(false)
        this.shareLinkBundleService
          .createBundle(dialog.payload)
          .pipe(first())
          .subscribe({
            next: (result) => {
              dialog.loading.set(false)
-              dialog.buttonsEnabled = false
+              dialog.buttonsEnabled.set(false)
              dialog.createdBundle = result
              dialog.copied.set(false)
              dialog.payload = null
@@ -1084,7 +1075,7 @@ export class BulkEditorComponent
            },
            error: (error) => {
              dialog.loading.set(false)
-              dialog.buttonsEnabled = true
+              dialog.buttonsEnabled.set(true)
              this.toastService.showError(
                $localize`Share link bundle creation is not available yet.`,
                error
@@ -97,7 +97,9 @@
    <div class="dropdown-menu shadow dropdown-menu-right" ngbDropdownMenu>
      @if (!list.activeSavedViewId) {
        @for (view of savedViewService.allViews; track view) {
-          <button ngbDropdownItem (click)="loadViewConfig(view.id)">{{view.name}}</button>
+          <button ngbDropdownItem (click)="loadViewConfig(view.id)">
            <i-bs class="me-2" [name]="view.icon || 'funnel'"></i-bs>{{view.name}}
          </button>
        }
        @if (savedViewService.allViews.length > 0) {
          <div class="dropdown-divider"></div>
@@ -457,6 +457,7 @@ export class DocumentListComponent
      modal.componentInstance.buttonsEnabled.set(false)
      let savedView: SavedView = {
        name: formValue.name,
        icon: formValue.icon,
        filter_rules: this.list.filterRules,
        sort_reverse: this.list.sortReverse,
        sort_field: this.list.sortField,
@@ -25,7 +25,7 @@
        <input #textFilterInput class="form-control form-control-sm" type="text"
        [disabled]="textFilterModifierIsNull"
        [(ngModel)]="textFilter"
-        (keyup)="textFilterKeyup($event)"
+        (keydown)="textFilterKeydown($event)"
        [ngbTypeahead]="searchAutoComplete"
        (selectItem)="itemSelected($event)"
        [readonly]="textFilterTarget === 'fulltext-morelike'">
@@ -1697,6 +1697,24 @@ describe('FilterEditorComponent', () => {
    ])
  })
  it('should carry over text filtering once with created and added relative dates', () => {
    component.textFilter = 'foo'
    const datesDropdown = fixture.debugElement.query(
      By.directive(DatesDropdownComponent)
    )
    component.dateCreatedRelativeDate = RelativeDate.WITHIN_1_WEEK
    component.dateAddedRelativeDate = RelativeDate.WITHIN_1_MONTH
    datesDropdown.triggerEventHandler('datesSet')
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
      {
        rule_type: FILTER_FULLTEXT_QUERY,
        value: 'foo,created:[-1 week to now],added:[-1 month to now]',
      },
    ])
  })
  it('should convert legacy title filters into full text query when adding a created relative date', () => {
    component.filterRules = [
      {
@@ -2180,21 +2198,35 @@ describe('FilterEditorComponent', () => {
  it('should support Enter / Esc key on text field', () => {
    component.textFilterInput.nativeElement.value = 'foo'
    component.textFilterInput.nativeElement.dispatchEvent(
-      new KeyboardEvent('keyup', { key: 'Enter' })
+      new KeyboardEvent('keydown', { key: 'Enter' })
    )
    expect(component.textFilter).toEqual('foo')
    component.textFilterInput.nativeElement.value = 'foo bar'
    component.textFilterInput.nativeElement.dispatchEvent(
-      new KeyboardEvent('keyup', { key: 'Escape' })
+      new KeyboardEvent('keydown', { key: 'Escape' })
    )
    expect(component.textFilter).toEqual('')
    const blurSpy = jest.spyOn(component.textFilterInput.nativeElement, 'blur')
    component.textFilterInput.nativeElement.dispatchEvent(
-      new KeyboardEvent('keyup', { key: 'Escape' })
+      new KeyboardEvent('keydown', { key: 'Escape' })
    )
    expect(blurSpy).toHaveBeenCalled()
  })
  it('should only dismiss open autocomplete suggestions on Escape, keeping the query', () => {
    component.textFilter = 'foo bar'
    component.textFilterInput.nativeElement.value = 'foo bar'
    jest.spyOn(component.searchTypeahead, 'isPopupOpen').mockReturnValue(true)
    const dismissSpy = jest
      .spyOn(component.searchTypeahead, 'dismissPopup')
      .mockImplementation(() => {})
    component.textFilterInput.nativeElement.dispatchEvent(
      new KeyboardEvent('keydown', { key: 'Escape' })
    )
    expect(dismissSpy).toHaveBeenCalled()
    expect(component.textFilter).toEqual('foo bar')
  })
  it('should adjust text filter targets if more like search', () => {
    const TEXT_FILTER_TARGET_FULLTEXT_MORELIKE = 'fulltext-morelike' // private const
    component.textFilterTarget = TEXT_FILTER_TARGET_FULLTEXT_MORELIKE
@@ -2269,4 +2301,34 @@ describe('FilterEditorComponent', () => {
    component.itemSelected({ item: 'world', preventDefault: () => true })
    expect(component.textFilter).toEqual('hello world ')
  })
  it('should choose the active autocomplete item with Enter', () => {
    component.textFilterTarget = 'fulltext-query'
    jest
      .spyOn(searchService, 'autocomplete')
      .mockReturnValue(of(['hello', 'help']))
    const input = component.textFilterInput.nativeElement as HTMLInputElement
    input.value = 'he'
    input.dispatchEvent(new Event('input'))
    tick(250)
    input.dispatchEvent(
      new KeyboardEvent('keydown', {
        key: 'ArrowDown',
        bubbles: true,
        cancelable: true,
      })
    )
    input.dispatchEvent(
      new KeyboardEvent('keydown', {
        key: 'Enter',
        bubbles: true,
        cancelable: true,
      })
    )
    fixture.detectChanges()
    expect(component.textFilter).toEqual('help ')
  })
 })
@@ -15,6 +15,7 @@ import {
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import {
  NgbDropdownModule,
  NgbTypeahead,
  NgbTypeaheadModule,
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
@@ -351,6 +352,9 @@ export class FilterEditorComponent
  @ViewChild('textFilterInput')
  textFilterInput: ElementRef
  @ViewChild(NgbTypeahead)
  searchTypeahead: NgbTypeahead
  readonly customFields = signal<CustomField[]>([])
  tagDocumentCounts: SelectionDataItem[]
@@ -1016,7 +1020,6 @@ export class FilterEditorComponent
      this.dateAddedRelativeDate !== null ||
      this.dateCreatedRelativeDate !== null
    ) {
      let queryArgs: Array<string> = []
      let existingRule = filterRules.find(
        (fr) => fr.rule_type == FILTER_FULLTEXT_QUERY
      )
@@ -1038,32 +1041,28 @@ export class FilterEditorComponent
        existingRule.rule_type = FILTER_FULLTEXT_QUERY
      }
-      let existingRuleArgs = existingRule?.value.split(',')
+      let queryArgs = existingRule?.value.split(',') ?? []
      if (this.dateCreatedRelativeDate !== null) {
        const rd = RELATIVE_DATE_QUERYSTRINGS.find(
          (qS) => qS.relativeDate == this.dateCreatedRelativeDate
        )
        queryArgs = queryArgs.filter(
          (arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_CREATED)
        )
        queryArgs.push(
          `created:${rd.isRange ? `[${rd.dateQuery}]` : `"${rd.dateQuery}"`}`
        )
        if (existingRule) {
          queryArgs = existingRuleArgs
            .filter((arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_CREATED))
            .concat(queryArgs)
        }
      }
      if (this.dateAddedRelativeDate !== null) {
        const rd = RELATIVE_DATE_QUERYSTRINGS.find(
          (qS) => qS.relativeDate == this.dateAddedRelativeDate
        )
        queryArgs = queryArgs.filter(
          (arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_ADDED)
        )
        queryArgs.push(
          `added:${rd.isRange ? `[${rd.dateQuery}]` : `"${rd.dateQuery}"`}`
        )
        if (existingRule) {
          queryArgs = existingRuleArgs
            .filter((arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_ADDED))
            .concat(queryArgs)
        }
      }
      if (existingRule) {
@@ -1155,6 +1154,7 @@ export class FilterEditorComponent
  }
  set textFilter(value) {
    this._textFilter = value // set immediately to prevent loss of keystrokes
    this.textFilterDebounce.next(value)
  }
@@ -1247,9 +1247,9 @@ export class FilterEditorComponent
        distinctUntilChanged(),
        filter((query) => !query.length || query.length > 2)
      )
-      .subscribe((text) =>
+      .subscribe(() =>
        this.updateTextFilter(
-          text,
+          this._textFilter, // use the current value, not the debounced (possibly stale) one
          this.textFilterTarget !== TEXT_FILTER_TARGET_FULLTEXT_QUERY
        )
      )
@@ -1312,8 +1312,12 @@ export class FilterEditorComponent
    }
  }
-  textFilterKeyup(event: KeyboardEvent) {
+  textFilterKeydown(event: KeyboardEvent) {
    if (event.key == 'Enter') {
      if (event.defaultPrevented) {
        // NgbTypeahead calls preventDefault, so use that to detect if the Enter key was for the dropdown
        return
      }
      const filterString = (
        this.textFilterInput.nativeElement as HTMLInputElement
      ).value
@@ -1321,6 +1325,11 @@ export class FilterEditorComponent
        this.updateTextFilter(filterString)
      }
    } else if (event.key === 'Escape') {
      if (this.searchTypeahead?.isPopupOpen()) {
        // only dismiss the suggestions, so longer query can use Enter
        this.searchTypeahead.dismissPopup()
        return
      }
      if (this._textFilter?.length) {
        this.resetTextField()
      } else {
@@ -6,6 +6,14 @@
  </div>
  <div class="modal-body">
    <pngx-input-text i18n-title title="Name" formControlName="name" [error]="error()?.name" autocomplete="off"></pngx-input-text>
    <pngx-input-select
      i18n-title
      title="Icon"
      formControlName="icon"
      [items]="savedViewIcons"
      iconField="icon"
      [error]="error()?.icon">
    </pngx-input-select>
    <pngx-input-check i18n-title title="Show in sidebar" formControlName="showInSideBar"></pngx-input-check>
    <pngx-input-check i18n-title title="Show on dashboard" formControlName="showOnDashboard"></pngx-input-check>
    <pngx-permissions-form accordion="true" formControlName="permissions_form"></pngx-permissions-form>
@@ -9,6 +9,7 @@ import { CheckComponent } from '../../common/input/check/check.component'
 import { PermissionsFormComponent } from '../../common/input/permissions/permissions-form/permissions-form.component'
 import { PermissionsGroupComponent } from '../../common/input/permissions/permissions-group/permissions-group.component'
 import { PermissionsUserComponent } from '../../common/input/permissions/permissions-user/permissions-user.component'
 import { SelectComponent } from '../../common/input/select/select.component'
 import { TextComponent } from '../../common/input/text/text.component'
 import { SaveViewConfigDialogComponent } from './save-view-config-dialog.component'
@@ -40,6 +41,7 @@ describe('SaveViewConfigDialogComponent', () => {
        ReactiveFormsModule,
        SaveViewConfigDialogComponent,
        TextComponent,
        SelectComponent,
        CheckComponent,
        PermissionsFormComponent,
        PermissionsUserComponent,
@@ -63,6 +65,7 @@ describe('SaveViewConfigDialogComponent', () => {
    expect(component.defaultName()).toEqual(name)
    expect(result).toEqual({
      name,
      icon: 'funnel',
      showInSideBar: false,
      showOnDashboard: false,
    })
@@ -94,6 +97,7 @@ describe('SaveViewConfigDialogComponent', () => {
    component.save()
    expect(result).toEqual({
      name,
      icon: 'funnel',
      showInSideBar: true,
      showOnDashboard: true,
    })
@@ -113,6 +117,7 @@ describe('SaveViewConfigDialogComponent', () => {
    component.save()
    expect(result).toEqual({
      name: '',
      icon: 'funnel',
      showInSideBar: false,
      showOnDashboard: false,
      permissions_form: permissions,
@@ -13,9 +13,14 @@ import {
  ReactiveFormsModule,
 } from '@angular/forms'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import {
  DEFAULT_SAVED_VIEW_ICON,
  SAVED_VIEW_ICONS,
 } from 'src/app/data/saved-view-icons'
 import { User } from 'src/app/data/user'
 import { CheckComponent } from '../../common/input/check/check.component'
 import { PermissionsFormComponent } from '../../common/input/permissions/permissions-form/permissions-form.component'
 import { SelectComponent } from '../../common/input/select/select.component'
 import { TextComponent } from '../../common/input/text/text.component'
@Component({
@@ -24,6 +29,7 @@ import { TextComponent } from '../../common/input/text/text.component'
  styleUrls: ['./save-view-config-dialog.component.scss'],
  imports: [
    CheckComponent,
    SelectComponent,
    TextComponent,
    PermissionsFormComponent,
    FormsModule,
@@ -41,6 +47,7 @@ export class SaveViewConfigDialogComponent implements OnInit {
  public saveClicked = new EventEmitter()
  users: User[]
  readonly savedViewIcons = SAVED_VIEW_ICONS
  setDefaultName(value: string) {
    this.defaultName.set(value)
@@ -49,6 +56,7 @@ export class SaveViewConfigDialogComponent implements OnInit {
  saveViewConfigForm = new FormGroup({
    name: new FormControl(''),
    icon: new FormControl(DEFAULT_SAVED_VIEW_ICON),
    showInSideBar: new FormControl(false),
    showOnDashboard: new FormControl(false),
    permissions_form: new FormControl(null),
@@ -65,6 +73,7 @@ export class SaveViewConfigDialogComponent implements OnInit {
    const formValue = this.saveViewConfigForm.value
    const saveViewConfig = {
      name: formValue.name,
      icon: formValue.icon,
      showInSideBar: formValue.showInSideBar,
      showOnDashboard: formValue.showOnDashboard,
    }
@@ -105,7 +105,7 @@ export class CustomFieldsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.customFieldsService.delete(field).subscribe({
        next: () => {
          modal.close()
@@ -51,8 +51,8 @@
      *pngxIfPermissions="{ action: PermissionAction.Add, type: activeManagementList.permissionType }">
      <i-bs name="plus-circle" class="me-1"></i-bs><ng-container i18n>Create</ng-container>
    </button>
-  } @else if (activeCustomFields) {
+  } @else if (customFieldsActive) {
-    <button type="button" class="btn btn-sm btn-outline-primary" (click)="activeCustomFields.editField()"
+    <button type="button" class="btn btn-sm btn-outline-primary" (click)="addCustomField()"
      *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.CustomField }">
      <i-bs name="plus-circle" class="me-1"></i-bs><ng-container i18n>Add Field</ng-container>
    </button>
@@ -18,6 +18,7 @@ import {
  DocumentAttributesComponent,
  DocumentAttributesSectionKind,
 } from './document-attributes.component'
 import { CustomFieldsComponent } from './custom-fields/custom-fields.component'
 import { ManagementListComponent } from './management-list/management-list.component'
@Component({
@@ -207,6 +208,29 @@ describe('DocumentAttributesComponent', () => {
    expect(component.activeSection.kind).toBe(
      DocumentAttributesSectionKind.CustomFields
    )
-    expect(component.activeCustomFields).toBeDefined()
+    const customFields = Object.create(CustomFieldsComponent.prototype)
    customFields.editField = jest.fn()
    component.activeOutlet = {
      componentInstance: customFields,
    } as any
    expect(component.activeCustomFields).toBe(customFields)
    component.addCustomField()
    expect(customFields.editField).toHaveBeenCalled()
  })
  it('should show the add field button before the custom fields instance is available', async () => {
    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
    fixture.detectChanges()
    component.activeNavID.set(2)
    await fixture.whenStable()
    expect(component.activeCustomFields).toBeNull()
    expect(
      fixture.nativeElement.querySelector(
        'pngx-page-header .btn-outline-primary'
      )?.textContent
    ).toContain('Add Field')
  })
 })
@@ -163,12 +163,17 @@ export class DocumentAttributesComponent implements OnInit, OnDestroy {
  }
  get activeCustomFields(): CustomFieldsComponent | null {
-    if (this.activeSection?.kind !== DocumentAttributesSectionKind.CustomFields)
+    if (!this.customFieldsActive) return null
      return null
    const instance = this.activeOutlet?.componentInstance
    return instance instanceof CustomFieldsComponent ? instance : null
  }
  get customFieldsActive(): boolean {
    return (
      this.activeSection?.kind === DocumentAttributesSectionKind.CustomFields
    )
  }
  get activeTabLabel(): string {
    return this.activeSection?.label ?? ''
  }
@@ -224,6 +229,10 @@ export class DocumentAttributesComponent implements OnInit, OnDestroy {
    this.router.navigate(['attributes', nextSection])
  }
  addCustomField(): void {
    this.activeCustomFields?.editField(null)
  }
  private getDefaultNavID(): DocumentAttributesNavIDs | null {
    return this.visibleSections[0]?.id ?? null
  }
@@ -88,7 +88,7 @@
      @if (depth > 0) {
        <div class="indicator"></div>
      }
-      <button class="btn btn-link ms-0 ps-0 text-start" (click)="userCanEdit(object) ? openEditDialog(object) : null; $event.stopPropagation()">{{ object.name }}</button>
+      <button class="btn btn-link ms-0 ps-0 text-start" style="user-select: text;" [disabled]="!userCanEdit(object)" (click)="userCanEdit(object) ? openEditDialog(object) : null; $event.stopPropagation()">{{ object.name }}</button>
    </td>
    <td class="d-none d-sm-table-cell">{{ getMatching(object) }}</td>
    <td>{{ getDocumentCount(object) }}</td>
@@ -274,7 +274,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
    activeModal.componentInstance.btnClass = 'btn-danger'
    activeModal.componentInstance.btnCaption = $localize`Delete`
    activeModal.componentInstance.confirmClicked.subscribe(() => {
-      activeModal.componentInstance.buttonsEnabled = false
+      activeModal.componentInstance.buttonsEnabled.set(false)
      this.service
        .delete(object)
        .pipe(takeUntil(this.unsubscribeNotifier))
@@ -284,7 +284,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
            this.reloadData()
          },
          error: (error) => {
-            activeModal.componentInstance.buttonsEnabled = true
+            activeModal.componentInstance.buttonsEnabled.set(true)
            this.toastService.showError(
              $localize`Error while deleting element`,
              error
@@ -455,7 +455,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.service
        .bulk_edit_objects(
          this.allSelectionActive ? [] : Array.from(this.selectedObjects),
@@ -472,7 +472,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
            this.reloadData()
          },
          error: (error) => {
-            modal.componentInstance.buttonsEnabled = true
+            modal.componentInstance.buttonsEnabled.set(true)
            this.toastService.showError(
              $localize`Error deleting objects`,
              error
@@ -196,7 +196,7 @@ export class MailComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.mailAccountService.delete(account).subscribe({
        next: () => {
          modal.close()
@@ -298,7 +298,7 @@ export class MailComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.mailRuleService.delete(rule).subscribe({
        next: () => {
          modal.close()
@@ -7,14 +7,24 @@
 </pngx-page-header>
 <form [formGroup]="savedViewsForm" (ngSubmit)="save()">
  <ul class="list-group mb-3" formGroupName="savedViews">
-    @for (view of savedViews(); track view) {
+    @for (view of pagedSavedViews(); track view) {
      <li class="list-group-item py-3">
      <div [formGroupName]="view.id">
        <div class="row">
-          <div class="col">
+          <div class="col-md">
            <pngx-input-text title="Name" formControlName="name"></pngx-input-text>
          </div>
-          <div class="col">
+          <div class="col-md">
            <pngx-input-select
            i18n-title
            title="Icon"
            formControlName="icon"
            [items]="savedViewIcons"
            iconField="icon">
            </pngx-input-select>
          </div>
          @if (canSaveSettings) {
            <div class="col-md">
              <div class="form-check form-switch mt-3">
                <input type="checkbox" class="form-check-input" id="show_on_dashboard_{{view.id}}" formControlName="show_on_dashboard">
                <label class="form-check-label" for="show_on_dashboard_{{view.id}}" i18n>Show on dashboard</label>
@@ -24,6 +34,7 @@
                <label class="form-check-label" for="show_in_sidebar_{{view.id}}" i18n>Show in sidebar</label>
              </div>
            </div>
          }
          <div class="col-auto">
            @if (canDeleteSavedView(view)) {
              <label class="form-label" for="name_{{view.id}}" i18n>Actions</label>
@@ -79,6 +90,11 @@
    }
  </ul>
  <div class="d-flex align-items-center mb-3">
    <button type="button" (click)="reset()" class="btn btn-outline-secondary mb-2" [disabled]="(isDirty$ | async) === false" i18n>Cancel</button>
    <button type="submit" class="btn btn-primary ms-2 mb-2" [disabled]="(isDirty$ | async) === false" i18n>Save</button>
    @if (savedViews()?.length > pageSize) {
      <ngb-pagination class="ms-auto" [pageSize]="pageSize" [collectionSize]="savedViews().length" [page]="page()" [maxSize]="5" (pageChange)="page.set($event)" size="sm" aria-label="Pagination"></ngb-pagination>
    }
  </div>
 </form>
--- a/Show More
+++ b/Show More
		`@@ -0,0 +1 @@`
							`/etc/s6-overlay/s6-rc.d/init-llmindex-migrate/run`