Skip to main content
The web app opens on the working archive. This guide describes its current controls; Frontend architecture covers implementation.

Current filing system

Before the first prefixed taxonomy import, there is no system selector. That import can name the original archive or preserve it under another code and create the incoming system separately. Preview explains the destination and initial access; Apply selects the result. After introduction, one accessible system gets a code/name label; multiple systems get a switcher. Unqualified collection links select the accessible original, otherwise the first accessible system, before loading data. An explicitly unavailable system never falls back. Without membership, Suchi offers account/ sign-out controls and asks an administrator to grant access. Switching clears displayed data, selections, Reveal, research, import previews and share/pairing/OAuth dialogs. Late responses cannot refill the new screen. Accepted upload batches retain their starting destination without showing receipts in the new system. Permissions explains the server-enforced boundary. The Index lists normal filing areas/categories after a tree is chosen. The protected Inbox appears only in its dedicated navigation item. Password-unlocked documents show an open-padlock icon in lists and Password unlocked in detail. This includes manual and saved-password unlocks without identifying a password; Suchi uses an unlocked working copy while preserving the protected original. Trash is opened from the navigation rail rather than a duplicate Documents toolbar control. Documents keeps full-width search above one options row: filters stay left while list/grid display, refresh and sorting remain grouped right. Any date opens the From/To added-date controls. Document detail keeps All documents on the left and groups Download, Rescan, access, sharing, phone, and Trash actions on the right. Rescan reads and processes the original file again. It is hidden while the document is still waiting for its password; it disables while that document is already processing and reports completion through the existing processing status. Live documents show Similar documents, Linked documents, Versions, and Notes in one tabbed card; Notes is last and the first tab is selected whenever a document opens. Linked documents separates links added on the open document from links added elsewhere. The metadata card always shows filing, sensitivity, dates, sources, an assigned archive serial number, the original, tags, correspondents, and languages. Custom fields and an unset archive serial number sit behind the card’s last row, More, which counts custom fields that have values. Opening it reveals those rows, scrolls them into view, and focuses the first control. The Correspondents row lists every attached role. Edit chooses an existing catalog entry as the primary sender; No sender removes sender roles without removing recipient, cc, or other relations. The Notes tab adds attributed working context to this exact version. Authors can edit/delete their own notes and administrators can moderate any note; Trash shows Notes read-only. A note is visible to everyone who can open the document. Notes and typed custom fields do not copy to a replacement version. The metadata card shows an assigned archive serial number as ASN n. Edit accepts one positive integer or an empty value to clear it; a conflict explains that the number remains held by a live, trashed, or historical document in this filing system. Replacement upload moves the ASN to the new head. Folder-layout assignment is intentionally absent from Document Detail; administrators manage definitions under Advanced > Folder layouts, while controlled bulk/API and automation workflows assign them. On wide screens the preview and detail column keep one viewport-filling height; longer metadata, notes, and extracted text scroll inside the detail column instead of resizing the document view. The top bar provides search, Upload and theme controls. Opened empty, the search menu lists Recent documents you opened in this browser, then Commands and Pages. Typing two or more characters adds the best-matching Documents and saved Views; Search everything for submits the complete text. Commands include New view, Pair a phone, and Add a mailbox for people who manage mailboxes. Recent documents are kept per user and filing system, omit titles of Confidential and Restricted documents, and are forgotten on sign-out. The empty search field shows its platform shortcut: ⌘ K on Apple devices or Ctrl K on Windows and Linux. Query suggestions appear in Search/Documents fields, separately from this menu. Press ? outside a text field, or choose Keyboard shortcuts in the search menu, for the shortcuts Suchi handles. The Search page offers two example queries before the first search. While the archive is empty, the Dashboard’s getting-started card also links to watched folders and mailboxes (where you can manage them) and to phone pairing. Confirmations appear in the top bar beside the status markers rather than over the page. Filing or refiling a document, and moving documents to Trash, offer Undo for eight seconds, or while the pointer or focus rests on the notice; ⌘ Z or Ctrl Z does the same when no text field has focus. Bulk refiling offers undo when every selected document is on the current page. Date controls use the locale-independent ISO yyyy-mm-dd format. Controls that also capture a time append Thh:mm. Upload opens one full-page queue from the top bar, command menu or a file drop anywhere in the archive. Every selected file appears immediately, in order, as Waiting, Uploading, Processing, Ready or a clear failure. The summary and progress bar count completed transfers. An ordinary accepted row links to its document; a feeder scan split by ASN labels changes to Created n documents with an ordered link and ASN chip for every child. Network and server failures retain the file for Retry. An oversized file instead asks for a smaller file or a changed server limit. Each accepted row is checked once, then again only when the top bar’s status refresh reports finished work, so the page runs no timer of its own. A check made while the server is unavailable says so instead of claiming completion; Check again retries it or a failed one. Focus the drop area to paste a screenshot, then choose Upload image or Discard. Accepted batches keep their original filing system and continue while the same account remains signed in; closing the browser can interrupt them. Document/selection sharing displays the created link. Copy link retries without creating another; blocked clipboard access leaves the URL selectable. Show QR code locally encodes that same link, retaining expiry/password/revocation. Document sharing’s Show link reopens an existing active link. Open on my phone displays a live document’s private browser URL/QR without publishing it or issuing credentials. The phone needs network access and an account authorized for the document. A localhost link works only on the original computer; open Suchi through its network address first.

Extracted text

Detail previews 2,000 characters. Read all expands the complete text; Show less collapses it. Copy text copies the whole extraction and offers a selectable field if copying fails. Confidential/Restricted text requires Reveal. These controls do not change saved document text. Use Upload replacement on a live document to add a newer version. The selected file and original file date remain in the form after a network or server failure so the same upload can be retried safely. The Versions tab badge counts other versions, so a document with no replacement history shows 0. The history labels the newest visible version Latest, the open row Viewing, and other rows Earlier. Opening an earlier version never redirects to the newest one. Replacement preserves filing/access continuity while extraction results, classifier metadata, dates, and custom-field values start fresh. A concise note beside the upload control lists this ownership boundary. Linked documents keeps editable links and documents linking to the open version in separate plain-language sections. Link types remain visible on both sides, and a titled document omits its raw numeric ID. See Document versions and links for exact-link semantics, relationship limits, permissions, and Trash/purge behavior.

Dashboard behavior

Total documents, Inbox, Approvals and Failed jobs share one status request. Loading or unavailable counts show —, not zero or a healthy status. While documents are still being read or classified, a pulsing Processing N of M marker sits in the top bar on every page. M is the size of the current run, so it starts at the number waiting when you first see the marker and resets once the queue is empty; hover for the reading and classifying counts, or select it to list those documents (is:processing). That list refreshes as each one finishes. Narrow screens show the remaining count. An open document that is still processing says so under its title and refreshes once the work finishes, keeping any edit in progress. Recently added shows the seven most recently added visible documents, by when Suchi added them; dates in the current year omit the year. For people who can see Calendar, Coming up lists the next three accepted, exact-day due, expiry and renewal dates within 30 days, with how far away each is. When more are due, the heading counts them all, for example Coming up · 18. With none due it says Nothing in the next 30 days., and a failed load hides the card. Views shows up to four shortcuts with filter summaries, including at least one shared view when available. New view starts creation; the empty message is No saved views yet. Read failures show Retry rather than an empty archive.

Document URLs and filters

Combine system=CODE with other filters after introduction. Reload, Back/Forward, copied links and new tabs retain it. An old unqualified numeric document URL first resolves its authorized document, then updates system context. Search and Omnibox resolve SYS.AC category addresses and open Documents with the runtime jd category ID; an address with no reachable category searches as text. Numeric IDs and document links remain the exact-document mechanism. Collection rows show the category address, or the category code in a single archive, as an aligned blue chip that deepens with the hovered or focused row, and cards pair it with the category name in their metadata line. A view of one category, including the Inbox, leaves it out because every row would repeat it. Document Detail shows it as a blue chip beside the title. The API/saved-view field jd_category_id translates to browser jd; it is not a supported browser parameter itself. Documents/Inbox keep pagination in the URL. Opening detail and using Back restores the page and filters. The compact footer provides nearby pages, first/last and Previous/Next; page one may omit page. Changing a filter/sort starts at page one; explicit historical URLs restore their page. Invalid values become page one and out-of-range values become the last page without adding history. Only the newest request updates the screen. Live Documents, Search, Calendar, and Ask your documents show only the newest live version visible to the caller by default. The version: query selector can show all or only older versions; direct document URLs and exact saved snapshots continue to address the selected version. The dedicated Shared by me toggle includes each document once while at least one link created by the current user is unexpired, unrevoked, and still permitted by current ownership and ACLs. On narrow screens, Filters (n) collapses tag, correspondent, sharing, sensitivity and added-date controls. Active filters remain visible as removable chips above the results, and Clear all removes that disclosed set without discarding text search, filing category or sort order. List and grid results keep the named document link separate from selection, filing and Trash controls, so assistive technology does not announce one oversized interactive link. Mouse/trackpad devices have hover quick actions; on touchscreens open the document for filing/Trash actions. Search and Documents share the query language: suggestions appear while typing, validation occurs on Apply, and rejected queries remain visible with their error. Search architecture covers retrieval.

Document tags and correspondents

Select Edit beside Tags, type a name or slug to narrow existing tags, then click a suggestion or use Arrow Down and Enter to add it immediately. Remove a tag with ×; Done closes the editor. Failed additions keep the typed query for retry, and failures never change the visible tags. Trash remains read-only. In Documents, select rows and choose Add tags to apply an existing tag to the selection; a partial failure keeps the selection for retry. Inbox has no bulk tag action. In Documents, selected rows also offer Correspondent…. Choosing an existing entry promotes it to primary sender for every selected document; Clear sender removes their sender roles. The correspondent filter includes No correspondent, which matches documents with no correspondent relation of any role. That URL scope also remains in effect for Ask your documents. After a successful document metadata or tag edit, Suchi removes a classifier-created needs-review tag automatically. A tag added by a person, rule, import or older version stays until explicitly removed; Trash, restore and rescan do not count as review. Admins can open Manage tags beside Tags on a document. This links directly to Settings > Archive configuration > Metadata > Tags, the only catalog editor. There, search names or slugs, select matching tags (at most 500), and confirm Delete selected. A row’s Delete action uses the same confirmation. Deleting removes document-tag links, re-roots surviving child tags, and cannot be undone. Creating and renaming tags also happen there; document screens only assign existing tags.

Document custom fields

Document Detail keeps custom fields under More, using controls that match each field’s declared type. Opening it shows fields that have values and a final Custom fields row whose Edit reveals Add custom field with ordinary user-created definitions. Extraction-managed e-invoice definitions are not offered there: they appear when extraction wrote a value and remain editable for corrections. Their readable labels, such as Invoice seller and Seller VAT number, are also used in Settings, Views, and Automations, while the stable invoice_* names remain in API requests, saved-view queries, and storage. Users with Create share links can share one document from Document Detail or one selected bundle from Documents. New links default to Private network: they use the normal Suchi address and are private only when that address is private. When the operator enables public sharing, Public internet creates an internet-facing link with a required expiry; seven days is the default and the available choices are 1, 7, 30, 90 and 365 days. Passwords are optional. Suchi recommends one for Confidential or Restricted documents but does not silently change access policy from sensitivity metadata. The link and password should travel separately. Document Detail lists active links with their surface, expiry, password state, and Copy, Show and Revoke actions. History expands expired and revoked links five at a time. Revocation stops later access immediately but cannot retract a file the recipient already downloaded. The recipient landing page shows the expiry and always offers the real download; Suchi does not claim that browser-delivered files can be made non-downloadable.

Approvals

The default By document queue shows every metadata change once as struck current value → bold proposed value, or + tag for an added tag. Aligned columns keep the action, change, reason chip, n similar disclosure, and row decisions in predictable positions. Each document is one block with no internal dividers; documents with several decisions add Approve all and Dismiss all beside the title. Show suggestion groups opens the synchronized grouped queue beside it on wide screens and below it on narrow screens. An Inbox row with an applicable filing suggestion also shows it as a one-click button, such as ✓ 21 Banking, before File under…. Choosing it applies the same suggestion as Approvals, and the notice offers Undo, which files the document back to the Inbox. Other rows keep the plain File under… choice. Date suggestions show the exact document text; How this was suggested expands Model confidence and Suggested by. A model-backed automation card names the automation and suggested fixed metadata effect without exposing or retaining the raw question/answer conversation. Rescan document links are under Affected documents. Internal workflow identifiers and repetitive review boilerplate are omitted. See Approvals for workflow behavior and Document dates for date review.

Trash

Open a Trash row to use its normal document URL in read-only recovery mode. Within an enterable system, owners/admins can preview/download, read metadata/text, restore within 30 days or confirm permanent deletion. Sensitive content still requires Reveal; public shares cannot serve trashed documents. Document in Trash shows the deletion deadline and hides editing, filing, sharing, access, versions and similarity until restoration. A trashed link target also disappears from outgoing fields, Linked documents, and field-presence matches; restoration makes the stored link visible again. Permanent deletion removes incoming links to that exact row. Restore keeps the document open; Back to Trash returns to the list. An empty Trash shows only Trash is empty. On phones, row titles/deadlines sit above Restore and Delete permanently.

Saved views

Views opens as a compact list. Each row shows the saved name, one plain-language filter sentence, its current document count, and Shared when applicable. Select the row to open its documents; Edit is available only for your views. An empty list offers up to three category starters drawn from different areas of the active filing tree. Trees with fewer categories fill the remaining positions with Waiting to file, This year’s taxes, and From one correspondent patterns. New view, a starter pattern, or Edit replaces the list with a focused builder. Filters appear only after Add a filter and cover search text, category, tag, correspondent, one Custom field value presence choice, sensitivity, and document dates. The custom-field choice can require Has value or Missing value and serializes to the same has-field: query used by Search/Documents. Empty choices mean all values; date ranges use yyyy-mm-dd. The footer reports the current matching-document count. Save changes updates in place; Cancel/Escape discards the draft. Rich filters reopen as search text for editing/removal, except the custom-field presence token, which reopens in its dedicated control. Older flat filters retain selections, multiple values, and ordering; exact document snapshots can be renamed or shared without changing their document set. New Views store a normalized rich query; untouched legacy fields survive edits. Validation failures remain in the builder. Choices load when needed, not for an empty View. See Saved-view query rules. Admins and members with Share saved views can select Share this view. Shared views appear within their system and still obey document ACLs. Only the owner can edit/delete; revoking sharing capability makes their views private without deleting them.

Settings

The running version stays in a footer at the bottom of Settings, outside the scrolling content. Development builds add build details and append .dirty for modified source; missing details are labelled build details unavailable. Tagged releases show only their version. Include this offline status in bug reports; it performs no update check. Settings > My account contains Profile, Security, Mobile app, API tokens, Saved decryption passwords, and Mailboxes for capable members. Profile saves the display name/photo and shows the canonical sign-in email and method. Saved decryption passwords show a user-editable label separately from the last use date and the most recent document unlocked with that password. Select the pencil to rename only the saved-password label; document titles and encrypted password contents are unchanged. Language defaults to the browser preference. Choosing a supported language saves it to the account and applies it across signed-in browsers; choosing Automatic resumes browser negotiation. Unsupported languages and missing messages fall back to English. The selection covers the SPA plus bootstrap, sign-in, setup, and public share pages. For a local-password account, Change email opens a focused dialog for the new address, exact confirmation, and current password. The change is immediate: Suchi sends no confirmation, recovery, or old-address notification email. It is the same numeric account, so documents, memberships, permissions, API tokens, and connected mobile apps stay attached. Every old browser session is revoked and the current browser receives a replacement session. For an OIDC-managed account, Suchi accepts no typed address or local password. Sync from identity provider submits a same-origin request and forces a fresh provider login. It can bind an eligible unbound account, adopt a changed provider email for an already bound issuer/subject, or confirm that nothing changed. A successful binding or email change rotates browser sessions just like the local flow. Identity/email conflicts fail closed instead of merging accounts. Local-password accounts use Security > Set up authenticator to scan an otpauth QR code or enter its setup secret manually, then confirm one current six-digit code. Suchi shows ten recovery codes once. Copy or download them and confirm they are saved before closing; each code replaces the authenticator for one sign-in and is consumed on use. Regenerating recovery codes invalidates every older unused code. After two-factor authentication is enabled, browser sign-in, direct password-to-API-token exchange, and changing the sign-in email require either a current authenticator code or one recovery code. A six-digit code signs in as soon as it is typed or pasted. After repeated wrong codes, sign-in shows how long to wait; after 100 in a row it stays locked until an administrator resets it. Security warns when two or fewer recovery codes remain. Enable, regenerate, and disable sign out every other browser session and replace the current session. Existing API tokens and paired mobile apps remain valid, and the recovery-code screen says how many there are so you can review them under API tokens. OIDC accounts use their provider’s authentication policy and do not show local two-factor controls. An administrator sees a 2FA badge in Archive configuration > People > Users and can reset another user’s factor after entering the administrator’s own password and, when enabled, second factor. The reset signs out the target’s browsers but preserves API/mobile tokens. If no administrator can sign in, stop the server and use the offline reset command. Demo visitors and the fixed development account have a read-only email with no mutation control. Profile fields sit side by side on wide screens and stack on phones. The account pane scrolls with clearance between its content and scrollbar, while the Settings tabs and version footer stay visible. Pair mobile app generates a private, single-use QR code that expires in five minutes. Scan it in Suchi and confirm the server address. A new code replaces the old one; closing cancels unused codes. If scanning/copying fails, manually select the link and use Paste pairing link in the app. Manual server/password/API-token sign-in remains available. Pairing is part of the v0.1.0 Companion contract. Each successful exchange adds a separate Mobile app entry showing device name, read/write access, connection and last-use dates. Updated apps let you name the device during confirmation, replacing the browser label. Existing entries keep their name until paired again. Matching names do not merge connections. The list refreshes during/after pairing and on window focus. Revoke, or signing out in the app, removes the connection; generating, cancelling or expiring a code creates no device entry. Token, mobile-app, saved-password, mailbox, metadata, View, and Automation removals use an in-app confirmation dialog; Suchi does not open browser confirmation popups. Pairing/token rows retain their system binding; changing systems requires a new pairing. Membership removal revokes system credentials/shares permanently. Manual connections stay under API tokens. Admins also have Settings > Archive configuration: The configuration frame fills the available screen height. Long sections scroll inside the right pane without moving section navigation or the version footer. On narrow screens, section navigation becomes a horizontally scrolling rail. People contains Users and Groups. Groups expands its members beside the selected group. User capabilities are under Additional access; hidden member choices are not saved when creating an admin. Archive Configuration reuses the same user-creation form. When OIDC is configured, People cannot create password accounts: users self-provision through browser sign-in only when their verified provider email is unused. ADMIN_EMAIL can grant the first matching provisioned identity the administrator role; it does not find or merge a returning account. Metadata manages tags, correspondents, and custom fields through one type selector. Metadata types have navigable URLs, so reload and Back/Forward restore the selected catalog. Metadata is scoped to the current filing system; People is server-wide. Custom fields marked Managed are required by document extraction: their definitions are read-only and cannot be deleted, while their per-document values remain editable. Filing tree owns presets, custom tree construction, and taxonomy import/export. Preview precedes taxonomy Apply; export contains the tree only. What is included? explains why it does not replace a full backup. Advanced > Scan processing controls retained ASN QR handling for future PDF processing jobs. Administrators choose off, one-ASN assignment, or feeder-PDF splitting, plus the case-sensitive QR prefix and detection DPI. Saves apply without a restart. Deployment environment or config-file values appear read-only; removing an override reveals the previously stored value. Advanced > Folder layouts controls paths in the local rendered filesystem. The editor shows supported variables and a server-rendered sample before save. Leave the file extension out: preview and save reject it because Suchi appends each linked file’s own extension. jd.address is a category address and can repeat; include doc_pk for a collision-safe custom layout, or asn only when that layout requires a unique archive serial number. Default layouts always keep the independent document-ID suffix. Saved rows can be edited or deleted; deleting returns assigned documents to the default filing-tree projection. Suchi refuses the delete while an automation still assigns the layout and names those rules, so remove the action from them first. Both Automations entry points open the same list-first workspace. Compact rows summarize each rule as a sentence, expose its enabled state, and run from top to bottom; drag the handle or focus it and use the arrow keys to reorder custom rules. An empty list offers starter patterns, while New automation or Edit replaces the list with a focused builder. The builder adds trigger filters progressively, keeps the optional document-model question separate, and retains Edit as JSON for full contract access. Folder-layout, eligible-owner, and custom-field actions use named selectors rather than asking for numeric IDs; custom-field values use the chosen field’s real type. A document-model question can use one bounded Yes/No or multiple-choice answer and a branch selector on each supported action. It uses the existing classifier call and automatic/review-first setting. Custom rules appear first and filing-tree rules stay in the collapsed Built-in automations section below them. After introduction, Filing system · CODE edits a nonblank name of at most 80 characters and the complete direct membership set, including off-page people. Codes are permanent; admin entry is implicit/read-only. New systems initially admit admins only. Membership and document ACLs remain separate. Filing trees, metadata, rules, Views, mailboxes/password records, and memberships use the current system. Accounts/groups, global capabilities, profiles, watched folders, OCR/models, and backups are server-wide. Watched folder names its read-only contract and shows whether server configuration includes subfolders. The source directory must already exist and be readable by the Suchi process; a failed live reload reports permission failures and restores the previous settings. Invalid sidecars remain atomic and blocked, retried hourly rather than every five minutes, and never partially applied. Editing the sidecar, or correcting its custom-field definition under Metadata, retries it at once. Suchi does not move, rename, delete or write files and sidecars. Classification keeps its controls in separate cards. Under Suggestions, choose Review first or Apply when confident, then use Save application mode. Similar documents and its review/automatic thresholds expand under Adjust and use Save matching options. Similar documents uses model-free matching against already-filed documents; it does not send text outside the archive. Document model opens its own setup dialog. The default model/date Model confidence threshold is 0.70; local automatic and review-suggestion thresholds default to 0.90 and 0.50. Explicit rules remain independent, and changing these settings does not accept existing pending suggestions. Admins manage system mailboxes and owners in Email intake; capable members manage only their own under My account > Mailboxes.

Archive setup

A fresh archive has only System/Inbox, without an implicit preset or filing Index. Administrators complete archive setup in Settings > Archive configuration, whose shared sidebar exposes Filing tree, People, Metadata, Watched folder, Email intake, Classification, Automations, OCR and backups, plus every other enabled option. Every section is usable before a tree is chosen. Filing tree is the only setup requirement. Apply a preset or import, or explicitly confirm Blank to start from scratch. That selection satisfies archive setup; all other configuration remains optional. Import a file sits beside preset cards and shares Settings’ importer. Choose TOML (the default) or HuML, or paste content, then Preview and Apply. Preview separates your tree from generated System/49, explains 00.00 and shows additions and collision choices. A blank tree needs confirmation; stale previews preserve input and require re-preview. Success refreshes archive state and the sidebar. Later applications merge, without resetting existing filing. Validation checks supported structure, not domain correctness or rule trust. See Filing trees for destination, collision and export rules. Incomplete setup shows Choose your filing tree on Dashboard and in the sidebar on other screens, with Continue setup. The action opens Archive configuration > Filing tree. The reminder has no dismissal control and remains visible across navigation and browser reloads until an administrator chooses a preset, confirms Blank, or imports a tree. If setup status cannot be verified, Dashboard keeps the step visible and offers Retry setup status. While setup is incomplete, Settings shows the same reminder and Continue setup above the ordinary content. It never replaces or locks Archive Configuration sections. After the filing tree is chosen, an empty archive advances to Add your first document. One document still awaiting review, filing, or processing advances to the final step. The guide disappears once that first document is ready; the normal Dashboard counters and lists remain visible throughout.

Capabilities and sensitive documents

Admins have all capabilities. Grant members additional access in People > Users: Permissions owns revocation and object-access rules. With a model enabled, capable users see Ask your documents beside the Omnibox; Enter remains search. Ask your documents opens a side drawer, or a full-screen drawer on phones, and names the current document context. Following a document link parks it as Question open; the ribbon restores it. Escape/Close ends the parked state. Clear removes the conversation and resets sensitive consent. Changing the document context or model resets the conversation; turning sensitive consent off clears it. The background is inert while the drawer is open. Save these documents as a view preserves the exact document IDs. Suggested dates link to Approvals; accepted dates open the listed documents’ all-dates agenda. Questions are read-only and do not themselves extract or save data. See Ask your documents for the complete workflow and contracts. Manage document dates enables selection extraction, review and Calendar/query use. Calendar shares the Views and Automations workspace width and defaults to the current month, with rolling 30 Days and 2 Weeks controls. Selecting a grid day highlights it and scrolls the adjacent date group without changing the range. Document dates owns filters, direct-date routes, status treatments, and local .ics export. Sensitivity choices are Public, Internal, Confidential and Restricted; absent values show Unset. Confidential/Restricted thumbnails blur and previews/text require Reveal. Create share links controls share actions without bypassing document access.

Loading and failures

Data-dependent screens distinguish loading, empty and failure states. Failed Inbox lookup never opens all documents; failed settings reads never expose default-filled editable forms. Superseded route/search/autocomplete responses are discarded. Late metadata saves cannot change another document’s displayed values or Reveal state after navigation.