Offer the merge when two people turn out to share a name

Over-clustering is the normal state of a freshly indexed library — FR-CULL-10
says so — which means one person arrives as several groups and the user names
each of them the same thing. Until now that produced several people called Anna
and no way to join them: `identity::merge` existed, `faces::merge_people`
existed with its redirect tombstone, and `merge-into(int)` sat in identity.slint
declared, never emitted and never wired. The screen had a split button and no
merge.

So a rename that collides now offers one. Type a name another person already
carries and a strip appears under the field: "Someone else is already called
Anna (14 faces). Merge them?"

Offered, not performed. `people.uuid` is the identity and the name is not — the
schema comment on that column is explicit that two devices naming the same
cluster independently is the case it was built for — so two people sharing a
name is legal, and folding them together on a keystroke would be the screen
making an identity decision on the user's behalf. That is the thing this screen
spends a whole button avoiding.

The rename always lands first, and declining leaves it exactly as typed. There
is nothing to undo because nothing was done.

Details that are not arbitrary:

The comparison is trimmed and case-insensitive. "anna" on a phone keyboard and
"Anna" on a desktop are one intention, and an offer that appeared only when the
capitalisation matched would read as a bug.

An empty name collides with nothing. Every unnamed cluster renders as "Unnamed
(n faces)"; if that counted as a collision the offer would appear on every
cluster in a fresh library, and accepting it would fold the library into one
person.

The newly-named person folds into the one that already held the name, not the
reverse. The older person is the one other devices have seen and the one whose
confirmations are more likely to be real. Selection follows the merge, because
landing on an empty screen after a successful action reads as a failure.

The offer is retired when the person changes, and when a refresh finds its
target gone — merged from the other side of a sync, or deleted. An offer left
standing would fold whoever happens to be selected now.

A merged-away person is not a namesake: `faces::people` already excludes
redirects, so the offer does not reappear the instant it is accepted.

Four tests over the collision rules, and the existing 467 still pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/dr-ui/src/identity.rs

@@ -449,6 +449,45 @@ pub fn reject(
     faces::reject(catalog.connection(), face, person)
 }
 
+/// Another person already carrying this name, if there is one.
+///
+/// A name is not an identity here — `people.uuid` is, which is what lets two
+/// devices name the same cluster independently and still merge cleanly
+/// (catalog.md, `people.uuid`). So this reports a *collision* for the screen to
+/// offer a merge on and does nothing else: two people are allowed to share a
+/// name, and a library with two Annas in it is a real library, not a mistake to
+/// be corrected without being asked.
+///
+/// Compared case-insensitively and trimmed. "anna" typed on a phone keyboard
+/// and "Anna" typed on a desktop are one intention, and an offer that appeared
+/// only when the capitalisation happened to match would read as a bug.
+///
+/// Merged-away people cannot come back: `faces::people` already excludes them,
+/// so a name freed by an earlier merge collides with nothing.
+pub fn namesake(
+    catalog: &Catalog,
+    person: PersonId,
+    name: &str,
+) -> Result<Option<PersonRow>, dr_catalog::CatalogError> {
+    let key = name.trim().to_lowercase();
+    // An unnamed cluster is not a namesake of every other unnamed cluster.
+    // They all render as "Unnamed (n faces)" and folding them together on that
+    // basis would merge the whole library into one person.
+    if key.is_empty() {
+        return Ok(None);
+    }
+    Ok(dr_catalog::faces::people(catalog.connection())?
+        .into_iter()
+        .find(|p| p.id != person && p.name.trim().to_lowercase() == key)
+        .map(|p| PersonRow {
+            id: p.id,
+            name: p.name,
+            confirmed_faces: p.confirmed_faces,
+            suggested_faces: p.suggested_faces,
+            cover: None,
+        }))
+}
+
 /// Fold one person into another.
 pub fn merge(
     catalog: &Catalog,
@@ -753,6 +792,66 @@ mod tests {
         assert_eq!(people[0].id, anna);
     }
 
+    #[test]
+    fn a_namesake_is_found_whatever_the_capitalisation() {
+        let c = catalog();
+        let anna = faces::create_person(c.connection(), "Anna Smith").unwrap();
+        let other = faces::create_person(c.connection(), "").unwrap();
+
+        rename(&c, other, "  anna smith ").unwrap();
+        let found = namesake(&c, other, "  anna smith ")
+            .unwrap()
+            .expect("a namesake");
+        assert_eq!(found.id, anna);
+        assert_eq!(
+            found.name, "Anna Smith",
+            "the existing spelling is reported"
+        );
+    }
+
+    #[test]
+    fn a_person_is_not_their_own_namesake() {
+        let c = catalog();
+        let anna = faces::create_person(c.connection(), "Anna").unwrap();
+        assert!(
+            namesake(&c, anna, "Anna").unwrap().is_none(),
+            "renaming someone to the name they already have offered a merge with themselves"
+        );
+    }
+
+    /// Every unnamed cluster renders as "Unnamed (n faces)". If an empty name
+    /// counted as a collision, the offer would appear on every cluster in a
+    /// freshly indexed library and accepting it would fold the library into one
+    /// person.
+    #[test]
+    fn an_empty_name_collides_with_nothing() {
+        let c = catalog();
+        faces::create_person(c.connection(), "").unwrap();
+        let second = faces::create_person(c.connection(), "").unwrap();
+        assert!(namesake(&c, second, "").unwrap().is_none());
+        assert!(namesake(&c, second, "   ").unwrap().is_none());
+    }
+
+    /// A merge leaves a redirect behind rather than deleting the row, so the
+    /// name it carried must not keep colliding — otherwise the offer would
+    /// reappear immediately after being accepted, pointing at a person the
+    /// rail no longer shows.
+    #[test]
+    fn a_merged_away_person_is_not_a_namesake() {
+        let c = catalog();
+        let anna = faces::create_person(c.connection(), "Anna").unwrap();
+        let dup = faces::create_person(c.connection(), "Anna").unwrap();
+        merge(&c, anna, dup).unwrap();
+
+        let third = faces::create_person(c.connection(), "").unwrap();
+        rename(&c, third, "Anna").unwrap();
+        let found = namesake(&c, third, "Anna").unwrap().expect("a namesake");
+        assert_eq!(
+            found.id, anna,
+            "the offer pointed at the merged-away person"
+        );
+    }
+
     #[test]
     fn merging_folds_one_person_into_the_other() {
         let c = catalog();