Read the sidecars other editors write, and write them back on request

FR-CAT-13 asked for standard XMP and `core/dr-xmp` answered the file: it
has read and written `dc:subject`, `xmp:Rating`, `xmp:Label` and the IPTC
core since 5fa4c07, under an ownership rule that leaves everything else in
the document untouched. What nothing did was call it. No scan found an
`.xmp` beside a raw, no catalog row was filled from one, no judgement
wrote one back, and the "external modification detected, reload offered"
clause had no mechanism. A library imported from Lightroom came in and
could not go back out.

The scan collects `.xmp` beside `.drsc` from the listings it was already
paying for, and the pull reads each one whose ETag has moved. Both
namings resolve: darktable's `IMG_0001.CR3.xmp` names its file exactly,
Lightroom's `IMG_0001.xmp` names the stem, and under the stem the JPEG
beside a RAW is the same photograph and takes the same document, as
DarkRoom's own sidecar already does. Each is reconciled with the catalog
winning — keywords union, a rating or label taken only where the catalog
has none — because a standard XMP carries nothing that could say whether
its value is newer. A genuine disagreement is not resolved; it is written
to a table, and the settings page offers the sidecars' values against it.
That button is the reload the requirement asks to be offered, and the
ETag that moved is the detection it asks for: an `.xmp` edited elsewhere
is exactly a file the pull's ordinary incrementality re-reads.

Writing goes the other way behind a setting that starts off, since NFR-R4
makes writes beside somebody's originals theirs to switch on. With it on,
a judgement or a keyword rewrites the sidecar of whichever spelling
exists, or creates Lightroom's. The record is read from the catalog
whole at that moment rather than carried from the gesture, so a rating
and a keyword a second apart are two writes of one file that agree. And
the file's own title, caption, copyright and hierarchy come through the
rewrite: the catalog has no columns for them, `rewrite` replaces the
owned set wholesale, and a record that said nothing about them would have
deleted them from a Lightroom sidecar on every star.

The rating's two axes cross the format's one field both ways: a
rejection is Adobe's `-1` and stars are stars, and stars arriving on a
rejected frame lift the rejection, since the file said it was worth a
number. An unrated file says nothing and clears nothing, on the rule the
`.drsc` merge keeps. `versions.label` finally has a reader and a writer,
with the code table moved out of the query so the two cannot drift.

ui/dr-ui/src/library.rs

@@ -1498,6 +1498,34 @@ async fn pull_sidecars(
         };
 
         let text = String::from_utf8_lossy(&bytes);
+
+        // TRACES: FR-CAT-13
+        // A standard XMP beside the photograph — Lightroom's, darktable's,
+        // anybody's — takes the other branch: reconciled field by field with
+        // the catalog winning, and a disagreement recorded for the reload
+        // the requirement asks to be offered. See `xmp_sync`.
+        if crate::xmp_sync::is_xmp(path) {
+            match crate::xmp_sync::take_in(conn, root_id, path, &text, now_secs()) {
+                Ok(taken) => {
+                    applied += taken.changed;
+                    if !taken.conflicts.is_empty() {
+                        log::info!(
+                            "xmp sidecar {path} disagrees with the catalog on {:?}; \
+                             a reload is offered in Settings",
+                            taken.conflicts
+                        );
+                    }
+                    // Recorded only once it reached a photograph: a sidecar
+                    // that arrived before its image is read again next time.
+                    if taken.described > 0 {
+                        record_sidecar_read(conn, root_id, path, &entry.validator);
+                    }
+                }
+                Err(e) => log::warn!("xmp sidecar at {path} is unreadable ({e})"),
+            }
+            continue;
+        }
+
         let mut sidecar = match dr_pipeline::Sidecar::parse(&text) {
             Ok(s) => s,
             // Unreadable is not empty. Recording the ETag would mean never
@@ -1534,6 +1562,191 @@ async fn pull_sidecars(
     Ok(applied)
 }
 
+/// TRACES: FR-CAT-13 | NFR-R4
+/// One image's ratings, label and keywords, on their way to the `.xmp`
+/// beside it.
+///
+/// Distinct from [`SidecarWrite`], which amends DarkRoom's own document
+/// through the cache and the outbox. This is best-effort in the other
+/// direction: the catalog and the `.drsc` are authoritative, the `.xmp` is a
+/// courtesy to whatever else reads the folder, and a write that cannot
+/// happen now is written again — from the catalog, whole — the next time
+/// anything about the photograph is judged. So nothing is queued.
+#[derive(Debug, Clone)]
+pub struct XmpWrite {
+    pub image_path: String,
+    pub record: dr_xmp::Xmp,
+}
+
+/// TRACES: FR-CAT-13 | NFR-R4
+/// Write each record into the XMP sidecar beside its image.
+///
+/// An existing sidecar of either spelling is rewritten in place, which is the
+/// whole point of `dr_xmp::rewrite`: only the properties DarkRoom owns move,
+/// and another application's settings, comments and namespaces come through
+/// byte for byte. A photograph with neither gets a new file under Lightroom's
+/// name. Reported once at the end, as the judgement writes are.
+pub fn spawn_xmp_writes(conn: Connection, writes: Vec<XmpWrite>) -> Receiver<XmpMessage> {
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut written = 0usize;
+        let mut failed = 0usize;
+        let mut last_error = None;
+        let rt = match crate::net_runtime::build() {
+            Ok(rt) => rt,
+            Err(e) => {
+                let _ = tx.send(XmpMessage::Finished {
+                    written: 0,
+                    failed: writes.len(),
+                    last_error: Some(e.to_string()),
+                });
+                return;
+            }
+        };
+        rt.block_on(async {
+            let backend = match crate::remote::connect(&conn) {
+                Ok(b) => b,
+                Err(e) => {
+                    failed = writes.len();
+                    last_error = Some(e.to_string());
+                    return;
+                }
+            };
+            for w in &writes {
+                match write_one_xmp(&*backend, w).await {
+                    Ok(()) => written += 1,
+                    Err(e) => {
+                        log::warn!("xmp sidecar for {}: {e}", w.image_path);
+                        last_error = Some(e);
+                        failed += 1;
+                    }
+                }
+            }
+        });
+        let _ = tx.send(XmpMessage::Finished {
+            written,
+            failed,
+            last_error,
+        });
+    });
+    rx
+}
+
+/// The outcome of a batch of XMP writes.
+#[derive(Debug)]
+pub enum XmpMessage {
+    Finished {
+        written: usize,
+        failed: usize,
+        last_error: Option<String>,
+    },
+}
+
+/// Read-modify-write one image's XMP sidecar on the server.
+async fn write_one_xmp(backend: &dyn RemoteBackend, w: &XmpWrite) -> Result<(), String> {
+    let [darktable, lightroom] = crate::xmp_sync::candidate_paths(&w.image_path);
+    // Whichever exists is the one rewritten; neither existing means the
+    // Lightroom spelling is created. An existing file this build cannot
+    // parse is left alone rather than replaced — it is somebody else's
+    // document, and a refusal is recoverable where an overwrite is not.
+    let mut target = lightroom.clone();
+    let mut existing: Option<String> = None;
+    for path in [&darktable, &lightroom] {
+        if let Ok(bytes) = backend
+            .get(&RemoteId::Path(RemotePath::new(path.clone())), None)
+            .await
+        {
+            if !bytes.is_empty() {
+                target = path.clone();
+                existing = Some(String::from_utf8_lossy(&bytes).into_owned());
+                break;
+            }
+        }
+    }
+    let text = match existing {
+        Some(text) => {
+            // The file's caption, copyright and hierarchy come through: the
+            // catalog has nowhere to keep them, and a rewrite that said
+            // nothing about them would remove them.
+            let theirs = dr_xmp::Xmp::parse(&text)
+                .map_err(|e| format!("{target} is not a sidecar this build can read: {e}"))?;
+            let mut record = w.record.clone();
+            crate::xmp_sync::carry_through(&mut record, &theirs);
+            record
+                .rewrite(&text)
+                .map_err(|e| format!("{target} is not a sidecar this build can rewrite: {e}"))?
+        }
+        None => w.record.to_text(),
+    };
+    backend
+        .put(&RemotePath::new(target), text.into_bytes(), None)
+        .await
+        .map(|_| ())
+        .map_err(|e| e.to_string())
+}
+
+/// TRACES: FR-CAT-13
+/// The offered reload: re-read the sidecars a person chose to trust, with
+/// the sidecar winning. One fetch per path, the catalog opened on this
+/// thread as the scan opens it.
+pub fn spawn_xmp_reload(
+    conn: Connection,
+    root: String,
+    catalog_path: PathBuf,
+    paths: Vec<String>,
+) -> Receiver<XmpMessage> {
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut written = 0usize;
+        let mut failed = 0usize;
+        let mut last_error = None;
+        let outcome: Result<(), String> = (|| {
+            let catalog = Catalog::open(&catalog_path).map_err(|e| e.to_string())?;
+            let root_id: i64 = catalog
+                .connection()
+                .query_row(
+                    "SELECT id FROM roots WHERE label = ?1 AND kind = 'remote'",
+                    [&root],
+                    |r| r.get(0),
+                )
+                .map_err(|e| e.to_string())?;
+            let rt = crate::net_runtime::build().map_err(|e| e.to_string())?;
+            rt.block_on(async {
+                let backend = crate::remote::connect(&conn).map_err(|e| e.to_string())?;
+                for path in &paths {
+                    let fetched = backend
+                        .get(&RemoteId::Path(RemotePath::new(path.clone())), None)
+                        .await
+                        .map_err(|e| e.to_string())
+                        .and_then(|bytes| {
+                            let text = String::from_utf8_lossy(&bytes);
+                            crate::xmp_sync::reload(catalog.connection(), root_id, path, &text)
+                        });
+                    match fetched {
+                        Ok(taken) => written += taken.changed,
+                        Err(e) => {
+                            log::warn!("reloading {path}: {e}");
+                            last_error = Some(e);
+                            failed += 1;
+                        }
+                    }
+                }
+                Ok(())
+            })
+        })();
+        if let Err(e) = outcome {
+            failed = paths.len();
+            last_error = Some(e);
+        }
+        let _ = tx.send(XmpMessage::Finished {
+            written,
+            failed,
+            last_error,
+        });
+    });
+    rx
+}
+
 /// What this device has already read, so a pull fetches only what changed.
 fn load_sidecar_etags(
     catalog: &Catalog,