PaperPilot 1.0.1 — cold-start workbench fix

PaperPilot 1.0.1 — cold-start library fix

After restarting Web, opening /workbench directly could show an empty or incomplete library until legacy category/Reading List requests populated the cache. The all-papers endpoint now loads the current owner's existing category and Reading List assets itself. Direct detail/file lookups also load on cache misses. A single upsert or move no longer marks a whole category as scanned; completeness is recorded after scanning finishes.

Regression fixtures retain metadata and synthetic PDFs while discarding the process cache. They cover populated and empty accounts, root/subcategory/Reading List assets, partial caches, direct detail/file access, repeated restarts and cross-owner rejection. No production database is copied and no model or parsing task is launched.

Only Web advances to 1.0.1. Reuse Translation ifzzh520/paperpilot-translation-worker:0.10.5@sha256:a7b4a90f214d8628e40c4aa7b919bb6ecb178835e40a10303450634d6b4b609c and Document ifzzh520/paperpilot-document-worker:1.0.0@sha256:b2aa87d58c9bdff3b50f1e3323beab227e4237e5b88a4b42cecd83887df89c50. The release attachment records the exact Web digest, revision, validation and security reports/SBOMs for the compatible combination. Historical Worker tags remain untouched.

v1.0.0's immutable tag/images remain available with an appended defect/rollback notice. Its Web latest channel was rolled back to verified 0.11.0 before preparing this patch. Keep the legacy homepage as default; production enables the experimental workbench flag. P1 (1.1.0) and P2 (1.2.0/M1) remain future work. Existing inline-style cleanup moves to P1; license metadata inconsistency remains documented and no upstream AGPL code is copied.

Deployment requires a fresh consistent SQLite backup and restricted configuration backup from the three-repository production configuration. Preserve port 7191, owner asset paths, Worker isolation and Translation Worker digest. Enable the previously verified exact MinerU transfer origins and workbench flag in effective Compose configuration. On failed acceptance, restore saved Web/Document references and configuration using the new Worker repositories; also restore Web latest. Do not restore an old database over normal user writes. No schema or public API/stream protocol change is included.

Validation results are recorded with the released artifacts after candidate testing. Earlier v1.0.0 real-chat and Worker HTTP evidence is historical evidence for unchanged capabilities, not a new real-model invocation or a substitute for this patch's tests.

Candidate verification

Commit 3486135782b640befd905e4814e431dde714fe13, linux/amd64. Docker: 252 passed, 1 deselected, 84 subtests. Browser: 8 passed against the candidate Web image, including direct cold startup with populated/empty accounts and owner isolation. Frontend clean install/typecheck/test/build and npm audit passed. Worker HTTP replay passed using the existing synthetic cloud ZIP; no new cloud/model task.

Four dependency audits, source scanning and all three image gates passed. Each image retains 55 MEDIUM and 9 LOW findings; fixable HIGH/CRITICAL and secrets are zero under the unchanged exception policy. The official vulnerability database was updated today and remains before NextUpdate; verified database provenance and metadata accompany the reports.

Production acceptance follows publication and is recorded separately.

Verified component manifests

• web: ifzzh520/paperpilot:1.0.1@sha256:1d438e264ab104a66130e6b378302f5f19b24d180894402473fbf9100a4d558d
• translation_worker: ifzzh520/paperpilot-translation-worker:0.10.5@sha256:a7b4a90f214d8628e40c4aa7b919bb6ecb178835e40a10303450634d6b4b609c
• document_worker: ifzzh520/paperpilot-document-worker:1.0.0@sha256:b2aa87d58c9bdff3b50f1e3323beab227e4237e5b88a4b42cecd83887df89c50

Published and deployed verification (2026-09-11)

Web ifzzh520/paperpilot:1.0.1@sha256:1d438e264ab104a66130e6b378302f5f19b24d180894402473fbf9100a4d558d, linux/amd64, revision 3486135782b640befd905e4814e431dde714fe13. Version and latest manifests were pulled back and checked. The unchanged Worker references above were reused; no Worker image was republished.

Docker non-integration: 252 passed, 1 deselected, 84 subtests. Frontend: clean install, typecheck, 8 unit tests, build and audit passed. Candidate-image browser: 8 passed. Replayed Worker HTTP submission/manifest/promotion/cleanup and network isolation passed. Four dependency audits and source/image security gates passed; each image retains 55 MEDIUM and 9 LOW findings under the unchanged exception policy, with zero fixable HIGH/CRITICAL findings and zero secrets. SBOMs and detailed reports are attached to the Release.

Production acceptance passed before any legacy-homepage warm-up and again after a graceful Web restart: complete existing library, original/translated PDF rendering, stored chat history and refresh recovery, CSRF rejection, logout and cross-tab clearing. No script CSP violations, external resource requests or page errors were observed. The experimental entry is enabled; the legacy homepage remains the default. The Translation container, asset paths, port, isolation and runtime permissions are unchanged. Production screenshots stay private; sanitized results are attached as production-verification.json. No new model or MinerU call was made.

A fresh consistent database backup and restricted configuration backup were taken before deployment. The saved rollback procedure restores the previous Web and Document digests using independent Worker repositories and also restores Web latest; it leaves the current database and normal user writes intact. P0 is complete; P1/1.1.0 and P2/1.2.0 remain future stages.