Fuse every detector's faces into one population per embedder

Choosing "Thorough" made the library look empty. The detector setting
writes under its own faces.model_id, and every reader of "the faces"
keyed on that exact id: the clustering pass, the coverage figure, the
sweep's work list, the shard export and import, and the sync merge's
face matching. On the reference library that restarted coverage at
1,834 of 19,140, drew a People rail of 36 faces for a person with 520,
queued a ~400 GB re-fetch on each device, and stranded the desktop's
3,583 confirmations under the old id: the tablet held the same faces
under the new one and the merge refused to match them. Same photograph,
same box, same embedder, two ids — that is one face, not two libraries.

The embedder half of the id is now the key. embedder_of and embedder_sql
give it to every query; writes keep the full id, so which detector drew
a box stays on record. record_detections is unchanged and is where the
generations meet: an image holds one pipeline's faces at a time, and a
re-detection carries confirmations across by box overlap. The merge's
match_faces applies the same rule within an embedder. The calibration
is keyed on the embedder too, since the similarity space did not change.

Shards travel every generation, each under its own id, and a peer adopts
whichever it is sent — including a stronger detector's pass over an
image it indexed itself with a weaker one, which is the re-detection its
own sweep would otherwise queue, already done. Never downwards: a tablet
on Fast keeps the desktop's Thorough faces. The sweep gains the same
tail — images a weaker detector indexed, after the ones nothing has —
driven by FaceDetector::supersedes, so choosing a stronger detector still
improves the library over time without first making it disappear.

core/dr-catalog/src/merge.rs

@@ -991,9 +991,13 @@ fn remote_has_column(tx: &Connection, table: &str, column: &str) -> Result<bool,
 /// Remote face row id to local face row id, by photograph and box overlap.
 ///
 /// See [`merge_people_within`] for why a face has no shared identity and this
-/// has to be derived. Only faces from the same model are compared: boxes from
-/// two different detectors are not the same measurement, and matching across
-/// them would attach a judgement to a face nobody looked at.
+/// has to be derived. Faces are compared within an *embedder*
+/// (`faces::embedder_of`), not within an exact pipeline id: two detectors in
+/// front of the same embedder draw boxes around the same faces, and a
+/// confirmation made on one device's box is about the face, not the
+/// rectangle — the same judgement `faces::record_detections` makes when it
+/// carries a confirmation across a re-detection. Keying on the exact id was
+/// what let a detector change strand every name on the device that made it.
 fn match_faces(tx: &Connection) -> Result<std::collections::HashMap<i64, i64>, CatalogError> {
     /// Loose on purpose — "the same face in the frame", not "the same
     /// rectangle". The figure `record_detections` uses for the same job.
@@ -1026,7 +1030,8 @@ fn match_faces(tx: &Connection) -> Result<std::collections::HashMap<i64, i64>, C
         })?;
         for row in rows {
             let (file_id, model, boxed) = row?;
-            local.entry((file_id, model)).or_default().push(boxed);
+            let embedder = crate::faces::embedder_of(&model).to_string();
+            local.entry((file_id, embedder)).or_default().push(boxed);
         }
     }
     if local.is_empty() {
@@ -1056,7 +1061,8 @@ fn match_faces(tx: &Connection) -> Result<std::collections::HashMap<i64, i64>, C
 
     for row in rows {
         let (remote_id, file_id, model, rbox) = row?;
-        let Some(candidates) = local.get(&(file_id, model)) else {
+        let embedder = crate::faces::embedder_of(&model).to_string();
+        let Some(candidates) = local.get(&(file_id, embedder)) else {
             continue;
         };
         let best = candidates
@@ -1977,6 +1983,54 @@ mod tests {
         assert_eq!(person_of(&c, local), Some(("Anna".to_string(), true)));
     }
 
+    /// The bug this rule exists for: the desktop switched to a stronger
+    /// detector and confirmed 3,500 faces under the old pipeline id; the
+    /// tablet held the same faces under the new one, and not one name
+    /// crossed, because the match demanded the exact id. Same photograph,
+    /// same box, same embedder — that is the same face.
+    #[test]
+    fn a_confirmation_crosses_a_detector_change() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let local = add_face(&c, "main", 7, 1, 0.30);
+        c.execute(
+            "UPDATE main.faces SET model_id = 'scrfd_10g+w600k_mbf' WHERE id = ?1",
+            [local],
+        )
+        .unwrap();
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.31);
+        add_person(&c, "remote_cat", 3, "u-anna", "Anna", false);
+        assign(&c, "remote_cat", remote, 3, true);
+
+        let report = merge_all(&c).unwrap();
+        assert_eq!(report.faces_assigned, 1);
+        assert_eq!(person_of(&c, local), Some(("Anna".to_string(), true)));
+    }
+
+    /// A different embedder is a different space, and a box there is a face
+    /// nobody here has a vector for.
+    #[test]
+    fn a_confirmation_does_not_cross_an_embedder_change() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let local = add_face(&c, "main", 7, 1, 0.30);
+        c.execute(
+            "UPDATE main.faces SET model_id = 'scrfd_10g+other_embedder' WHERE id = ?1",
+            [local],
+        )
+        .unwrap();
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.31);
+        add_person(&c, "remote_cat", 3, "u-anna", "Anna", false);
+        assign(&c, "remote_cat", remote, 3, true);
+
+        merge_all(&c).unwrap();
+        assert_eq!(person_of(&c, local), None, "matched across embedders");
+    }
+
     /// Boxes from two devices are close but not identical. Matching has to be
     /// by overlap, not equality, or nothing ever lines up.
     #[test]