Upload a snapshot of a thumbnail shard, never the live file

Every shard is in WAL mode and every put opens its own connection, so
while thumbnails are being generated on several threads — which is when
the first sync pass runs — the log is never checkpointed and the main
file holds whatever the last quiet moment left in it. For a shard created
seconds earlier that is nothing: a zero-byte file with the schema still
in the log. The sync read that file and uploaded it, and every other
device merging it failed with "no such table: thumbs" on every pass.

Copy the shard through SQLite's backup API into scratch first, which
serialises against writers and carries the log, and upload that.

core/dr-thumbs/src/lib.rs

@@ -481,6 +481,30 @@ impl ThumbStore {
         self.dir.join(format!("shard-{shard:04}.sqlite"))
     }
 
+    /// Write a coherent copy of one shard to `dest`, ready to upload.
+    ///
+    /// Not a file copy. Every shard is in WAL mode and every `put` opens its
+    /// own connection, so while thumbnails are being generated on several
+    /// threads at once — which is exactly when the first sync pass runs —
+    /// there is nearly always a connection open and the log is never
+    /// checkpointed. The main file then holds whatever the *last* quiet
+    /// moment left in it, which for a shard created seconds ago is nothing:
+    /// zero bytes, the schema still in the log. Reading it uploaded an empty
+    /// file, and every other device merging it failed with "no such table:
+    /// thumbs". The backup API serialises against writers and copies the
+    /// database as it is, log included.
+    pub fn snapshot_shard(&self, shard: u32, dest: &Path) -> Result<(), ThumbError> {
+        let source = self.open_shard(shard, false)?;
+        let _ = std::fs::remove_file(dest);
+        let mut out = Connection::open(dest)?;
+        let backup = rusqlite::backup::Backup::new(&source, &mut out)?;
+        // rusqlite asserts a positive page count where SQLite would take -1
+        // for "everything"; a shard is capped well under this many pages.
+        backup.run_to_completion(i32::MAX, std::time::Duration::ZERO, None)?;
+        drop(backup);
+        Ok(())
+    }
+
     pub fn index_path(&self) -> PathBuf {
         self.dir.join("index.sqlite")
     }
@@ -726,6 +750,45 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_snapshot_carries_what_the_shard_file_does_not_yet() {
+        // A thumbnail worker holding the shard open keeps the log from being
+        // checkpointed; the file on disk is then not the database. The
+        // upload used to read that file.
+        let (mut s, _d) = store();
+        s.put(1, ThumbSize::Grid, &thumb(1024)).unwrap();
+        let path = s.shard_path(0);
+        let worker = Connection::open(&path).unwrap();
+        worker.pragma_update(None, "journal_mode", "WAL").unwrap();
+        s.put(2, ThumbSize::Grid, &thumb(2048)).unwrap();
+        s.put(3, ThumbSize::Grid, &thumb(2048)).unwrap();
+
+        // What a byte-for-byte reader sees is at most what the last
+        // checkpoint left; the log is the part a copy misses.
+        let copy = _d.join("copied.sqlite");
+        std::fs::copy(&path, &copy).unwrap();
+        let file_rows = Connection::open(&copy)
+            .ok()
+            .and_then(|c| {
+                c.query_row("SELECT count(*) FROM thumbs", [], |r| r.get::<_, i64>(0))
+                    .ok()
+            })
+            .unwrap_or(0);
+
+        let snap = _d.join("upload.sqlite");
+        s.snapshot_shard(0, &snap).unwrap();
+        let snapshot = Connection::open(&snap).unwrap();
+        let rows: i64 = snapshot
+            .query_row("SELECT count(*) FROM thumbs", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(rows, 3, "the snapshot is the whole shard");
+        assert!(
+            file_rows < 3,
+            "the file alone lagged ({file_rows} rows), which is what the snapshot exists for"
+        );
+        drop(worker);
+    }
+
     #[test]
     fn a_forgotten_thumbnail_is_no_longer_served() {
         // The point of the whole method: a purged photograph must not keep a

docs/gestures.md

@@ -326,7 +326,7 @@ Face indexing reads each face's eyes. The chip drops frames where the chosen peo
 
 There is no wheel on a tablet, so without the pinch the cell size could only be changed by a control a finger cannot reach.
 
-<sub>`ui/dr-ui/ui/library.slint:2789`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2795`</sub>
 
 ### File photographs in a collection
 
@@ -335,7 +335,7 @@ There is no wheel on a tablet, so without the pinch the cell size could only be
 
 The selection is what the drag carries, which is why selecting several is worth the mode: forty photographs file in one gesture.
 
-<sub>`ui/dr-ui/ui/library.slint:2986`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2992`</sub>
 
 ### Open a photograph
 
@@ -344,7 +344,7 @@ The selection is what the drag carries, which is why selecting several is worth
 
 A tap opens; a tap that *moved* does not. Travel is what separates a deliberate tap from a hand brushing past, and it is the only thing that does: the two are the same length. An earlier version required the finger to dwell 120 ms instead, and that rejected ordinary taps — a real tap is often quicker than a brush.
 
-<sub>`ui/dr-ui/ui/library.slint:3254`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3260`</sub>
 
 ### Rate a photograph without opening it
 
@@ -354,7 +354,7 @@ A tap opens; a tap that *moved* does not. Travel is what separates a deliberate
 
 A star has to take the press without it also reaching the cell, or every rating throws the user into develop.
 
-<sub>`ui/dr-ui/ui/library.slint:3374`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3380`</sub>
 
 ### Choose the frame a folded burst shows
 
@@ -363,7 +363,7 @@ A star has to take the press without it also reaching the cell, or every rating
 
 A folded burst draws its earliest frame, which is a fact about the clock and not a judgement about the photograph — nothing in this application ranks a frame (FR-CULL-5). But the point of a burst is that one of the twelve is better than the other eleven, and the photographer is the only one who knows which. So the choice is offered on the frames themselves, while they are open and side by side, which is the one moment the alternatives are on screen to be compared.
 
-<sub>`ui/dr-ui/ui/library.slint:3505`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3511`</sub>
 
 ### Drop the selection but keep selecting
 
@@ -372,7 +372,7 @@ A folded burst draws its earliest frame, which is a fact about the clock and not
 
 Distinct from Done, which leaves the mode entirely. Clearing keeps it, so the next selection can start straight away.
 
-<sub>`ui/dr-ui/ui/library.slint:4166`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4177`</sub>
 
 ### Select everything the grid is showing
 
@@ -381,7 +381,7 @@ Distinct from Done, which leaves the mode entirely. Clearing keeps it, so the ne
 
 A scoped grid of two hundred frames is two hundred taps otherwise, and "all of them, except those three" is a far more common shape than the taps it took to say it.
 
-<sub>`ui/dr-ui/ui/library.slint:4183`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4194`</sub>
 
 ### Take photographs out of a collection
 
@@ -390,4 +390,4 @@ A scoped grid of two hundred frames is two hundred taps otherwise, and "all of t
 
 The badge on a cell says a photograph is filed in three collections and never which. This is the sheet that names them, and the only way out of one the grid is not currently scoped to.
 
-<sub>`ui/dr-ui/ui/library.slint:4307`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4318`</sub>

ui/dr-ui/src/derived_sync.rs

@@ -286,9 +286,20 @@ async fn sync_shards(
 
     // ---- upload ----------------------------------------------------------
     for shard in &local {
-        let path = store.shard_path(shard.id);
+        // A snapshot, never the live file — see `ThumbStore::snapshot_shard`
-        let Ok(bytes) = std::fs::read(&path) else {
+        // for the zero-byte upload that reading the file produced.
-            continue;
+        let snapshot = scratch.join(format!("thumb-shard-{:04}-upload.sqlite", shard.id));
+        let bytes = match store.snapshot_shard(shard.id, &snapshot) {
+            Ok(()) => std::fs::read(&snapshot),
+            Err(e) => Err(std::io::Error::other(e.to_string())),
+        };
+        let _ = std::fs::remove_file(&snapshot);
+        let bytes = match bytes {
+            Ok(b) => b,
+            Err(e) => {
+                log::warn!("snapshotting thumbnail shard {}: {e}", shard.id);
+                continue;
+            }
         };
         let name = shard_name(&client, shard.id);