Release 0.18.0

catalog.md §8.2 still said confirmed and rejected faces were matched to
local faces "by box", and that the merge reads only a remote face's box
and model; faces.md said `match_faces` "still matches by overlap alone
across devices". Since #77 the match falls back to embeddings, on the
photographs where a box leaves a remote face over, and since #78
`dedup_people` folds people of one name whose faces agree after every
sync. Both now say so, with the thresholds and the reason a less
decisive pair stays unmatched, taken from the code's own documentation.

Cargo.lock

@@ -1265,7 +1265,7 @@ checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
 [[package]]
 name = "darkroom-android"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "android_logger",
  "dr-plat",
@@ -1278,7 +1278,7 @@ dependencies = [
 
 [[package]]
 name = "darkroom-desktop"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "anyhow",
  "dr-plat",
@@ -1454,7 +1454,7 @@ checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
 [[package]]
 name = "dr-bench"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "anyhow",
  "dr-catalog",
@@ -1471,7 +1471,7 @@ dependencies = [
 
 [[package]]
 name = "dr-catalog"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-face",
  "dr-plat",
@@ -1486,7 +1486,7 @@ dependencies = [
 
 [[package]]
 name = "dr-decode"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-types",
  "env_logger",
@@ -1500,7 +1500,7 @@ dependencies = [
 
 [[package]]
 name = "dr-export"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-decode",
  "dr-gpu",
@@ -1519,7 +1519,7 @@ dependencies = [
 
 [[package]]
 name = "dr-face"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-inference-engine",
  "env_logger",
@@ -1532,7 +1532,7 @@ dependencies = [
 
 [[package]]
 name = "dr-film"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "log",
  "serde",
@@ -1541,7 +1541,7 @@ dependencies = [
 
 [[package]]
 name = "dr-gpu"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "bytemuck",
  "dr-decode",
@@ -1559,7 +1559,7 @@ dependencies = [
 
 [[package]]
 name = "dr-inference-engine"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "env_logger",
  "libloading",
@@ -1574,7 +1574,7 @@ dependencies = [
 
 [[package]]
 name = "dr-ingest"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-plat",
  "dr-types",
@@ -1586,7 +1586,7 @@ dependencies = [
 
 [[package]]
 name = "dr-lens"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "lensfun",
  "log",
@@ -1594,7 +1594,7 @@ dependencies = [
 
 [[package]]
 name = "dr-pano"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-decode",
  "dr-inference-engine",
@@ -1608,7 +1608,7 @@ dependencies = [
 
 [[package]]
 name = "dr-pipeline"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-types",
  "log",
@@ -1617,7 +1617,7 @@ dependencies = [
 
 [[package]]
 name = "dr-plat"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "android-native-keyring-store",
  "dr-types",
@@ -1633,7 +1633,7 @@ dependencies = [
 
 [[package]]
 name = "dr-preset-xmp"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-pipeline",
  "log",
@@ -1643,7 +1643,7 @@ dependencies = [
 
 [[package]]
 name = "dr-segment"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-inference-engine",
  "env_logger",
@@ -1656,7 +1656,7 @@ dependencies = [
 
 [[package]]
 name = "dr-sync"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "async-trait",
  "dr-plat",
@@ -1670,7 +1670,7 @@ dependencies = [
 
 [[package]]
 name = "dr-sync-folder"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "async-trait",
  "dr-sync",
@@ -1682,7 +1682,7 @@ dependencies = [
 
 [[package]]
 name = "dr-sync-nextcloud"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "async-trait",
  "dr-decode",
@@ -1704,7 +1704,7 @@ dependencies = [
 
 [[package]]
 name = "dr-thumbs"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-types",
  "jpeg-encoder",
@@ -1716,7 +1716,7 @@ dependencies = [
 
 [[package]]
 name = "dr-types"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -1725,7 +1725,7 @@ dependencies = [
 
 [[package]]
 name = "dr-ui"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1773,7 +1773,7 @@ dependencies = [
 
 [[package]]
 name = "dr-xmp"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "dr-types",
  "log",
@@ -7109,7 +7109,7 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "traceability"
-version = "0.17.0"
+version = "0.18.0"
 dependencies = [
  "anyhow",
  "pulldown-cmark",

Cargo.toml

@@ -32,7 +32,7 @@ members = [
 exclude = ["third_party"]
 
 [workspace.package]
-version = "0.17.0"
+version = "0.18.0"
 edition = "2021"
 rust-version = "1.92"
 license = "GPL-3.0-or-later"

README.md

@@ -93,7 +93,7 @@ controls, its place in the chain and its tests.
 
 ## Where it stands
 
-**0.17.0**, twenty-five tagged releases in. 192 numbered requirements in
+**0.18.0**, twenty-six tagged releases in. 192 numbered requirements in
 scope, 84% of them claimed by code and [traced to it](docs/dev/traceability.md);
 the rest are written down rather than merely absent.
 

core/dr-catalog/examples/catalog_bench.rs

@@ -1,6 +1,6 @@
 //! What the catalog's routine reads cost on a real library, off the GUI.
 //!
-//!   cargo run --release -p dr-catalog --example catalog_bench -- CATALOG.sqlite [FACES_DIR]
+//!   cargo run --release -p dr-catalog --example catalog_bench -- CATALOG.sqlite [FACES_DIR] [--remote PEER.sqlite]
 //!
 //! Times `Catalog::open` — which every worker thread pays, including the
 //! develop view's fetch of each original and each neighbour it prefetches —
@@ -13,6 +13,13 @@
 //! count), whose `library` module is private; their SQL is spelled here as
 //! it is spelled there, and has to be kept in step by hand.
 //!
+//! `--remote` also times a merge with another device's catalog — the
+//! server snapshot — which is the pass where the two disagree: faces one
+//! side found and the other did not, boxes that moved. The merge with a copy
+//! of itself matches every face by its box and never reaches that work. The
+//! first of its runs writes what the peer brought; the rest are the steady
+//! state, so compare two builds from two fresh copies of one catalog.
+//!
 //! The figures are for reading side by side before and after a change; they
 //! are not a gate. Compare the `cpu` column when the machine is busy. The
 //! answers are printed too, so two builds can be checked for agreeing.
@@ -23,7 +30,15 @@ use std::time::{Duration, Instant};
 use dr_catalog::{keywords, rating, schema, Catalog};
 
 fn main() {
-    let args: Vec<String> = std::env::args().skip(1).collect();
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    let peer = args.iter().position(|a| a == "--remote").map(|at| {
+        let path = args.get(at + 1).map(PathBuf::from).unwrap_or_else(|| {
+            eprintln!("--remote needs a catalog");
+            std::process::exit(2);
+        });
+        args.drain(at..at + 2);
+        path
+    });
     let Some(path) = args.first().map(PathBuf::from) else {
         eprintln!("usage: catalog_bench CATALOG.sqlite");
         std::process::exit(2);
@@ -117,6 +132,19 @@ fn main() {
     let _ = std::fs::remove_file(&scratch);
     let _ = std::fs::remove_file(&remote);
 
+    if let Some(peer) = &peer {
+        // A copy, so nothing the merge does to its input reaches the file
+        // the caller named.
+        std::fs::copy(peer, &remote).unwrap();
+        let mut first = None;
+        time("merge_remote_catalog (--remote)", 5, || {
+            let report = catalog.merge_remote_catalog(&remote).unwrap();
+            first.get_or_insert(report);
+        });
+        println!("  first pass: {first:?}");
+        let _ = std::fs::remove_file(&remote);
+    }
+
     // The face half of a sync pass, against a copy of the face store: both
     // directions in the steady state, where nothing is new either way.
     if let Some(faces) = args.get(1).map(PathBuf::from) {

core/dr-catalog/examples/dedup_people.rs

@@ -0,0 +1,141 @@
+//! Run the people and face deduplication (#78) on a copy of a real catalog.
+//!
+//!   cargo run --release -p dr-catalog --example dedup_people -- COPY.sqlite [--peer PEER_COPY.sqlite]
+//!
+//! It writes: run it against a *copy* (`sqlite3 catalog.sqlite ".backup
+//! copy.sqlite"`), never the library's own file. Prints the live people and
+//! faces before and after, what the first run merged and kept apart, and
+//! how long the first and a second run took -- the second is the cost the
+//! job adds to every sync once a catalog is clean.
+//!
+//! `--peer` then plays a sync round trip with another device's catalog (a
+//! copy of the server snapshot, which it also writes): the peer merges this
+//! one as the previous release would, with no job after it, then this one
+//! merges the peer back through `sync::merge_remote`, twice. The named
+//! people each side lists are printed after each step; they should agree.
+
+use std::path::PathBuf;
+use std::time::Instant;
+
+use dr_catalog::{dedup_people, merge, schema, sync};
+use rusqlite::Connection;
+
+fn open(path: &std::path::Path) -> Connection {
+    let conn = Connection::open(path).expect("open the catalog copy");
+    schema::configure(&conn).expect("configure");
+    schema::migrate(&conn).expect("migrate");
+    conn
+}
+
+/// The named people a device lists, as `name (uuid prefix)`, sorted.
+fn named(conn: &Connection) -> Vec<String> {
+    let mut v: Vec<String> = conn
+        .prepare(
+            "SELECT name, substr(uuid, 1, 8) FROM people
+              WHERE merged_into IS NULL AND trim(name) <> ''",
+        )
+        .unwrap()
+        .query_map([], |r| {
+            Ok(format!(
+                "{} ({})",
+                r.get::<_, String>(0)?,
+                r.get::<_, String>(1)?
+            ))
+        })
+        .unwrap()
+        .collect::<Result<_, _>>()
+        .unwrap();
+    v.sort();
+    v
+}
+
+fn main() {
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    let peer = args.iter().position(|a| a == "--peer").map(|at| {
+        let p = PathBuf::from(&args[at + 1]);
+        args.drain(at..at + 2);
+        p
+    });
+    let Some(path) = args.first().map(PathBuf::from) else {
+        eprintln!("usage: dedup_people COPY.sqlite [--peer PEER_COPY.sqlite]");
+        std::process::exit(2);
+    };
+    let conn = open(&path);
+
+    let counts = |label: &str| {
+        let q = |sql: &str| -> i64 { conn.query_row(sql, [], |r| r.get(0)).unwrap() };
+        println!(
+            "{label}: {} people listed ({} named), {} redirects, {} faces, {} confirmed",
+            q("SELECT COUNT(*) FROM people WHERE merged_into IS NULL"),
+            q("SELECT COUNT(*) FROM people WHERE merged_into IS NULL AND trim(name) <> ''"),
+            q("SELECT COUNT(*) FROM people WHERE merged_into IS NOT NULL"),
+            q("SELECT COUNT(*) FROM faces"),
+            q("SELECT COUNT(*) FROM face_person WHERE confirmed = 1"),
+        );
+    };
+
+    counts("before");
+    for pass in ["first", "second", "third"] {
+        let started = Instant::now();
+        let report = dedup_people::run(&conn).expect("dedup");
+        let took = started.elapsed();
+        println!("{pass} run: {took:?}, changed: {}", report.changed());
+        if pass == "first" {
+            println!("  merged: {:?}", report.merged);
+            for k in &report.kept_apart {
+                println!(
+                    "  kept apart: {:?} ({}) from {}: {:?}",
+                    k.name, k.uuid, k.survivor, k.why
+                );
+            }
+            println!(
+                "  redirects followed {}, cycles broken {}, faces fused {}, faces confirmed apart {}",
+                report.redirects_followed,
+                report.cycles_broken,
+                report.faces_fused,
+                report.faces_confirmed_apart
+            );
+        }
+    }
+    counts("after");
+
+    let Some(peer_path) = peer else { return };
+    let peer = open(&peer_path);
+    let show = |step: &str| {
+        let (ours, theirs) = (named(&conn), named(&peer));
+        println!(
+            "{step}: this device lists {} named, the peer {}; {}",
+            ours.len(),
+            theirs.len(),
+            if ours == theirs {
+                "the same".to_string()
+            } else {
+                format!("differ:\n  here {ours:?}\n  peer {theirs:?}")
+            }
+        );
+    };
+    show("before the round trip");
+    for round in 1..=2 {
+        peer.execute(
+            "ATTACH DATABASE ?1 AS remote_cat",
+            [path.to_string_lossy().as_ref()],
+        )
+        .unwrap();
+        let theirs = merge::merge_all(&peer).expect("the peer's merge");
+        peer.execute("DETACH DATABASE remote_cat", []).unwrap();
+        println!(
+            "round {round}: the peer took {} people updated, {} inserted",
+            theirs.people_updated, theirs.people_inserted
+        );
+        show(&format!("round {round}, after the peer's merge"));
+        let started = Instant::now();
+        let ours = sync::merge_remote(&conn, &peer_path).expect("our merge");
+        println!(
+            "round {round}: merge_remote with the job took {:?}; {} people updated, {} inserted",
+            started.elapsed(),
+            ours.people_updated,
+            ours.people_inserted
+        );
+        show(&format!("round {round}, after ours"));
+    }
+}

core/dr-catalog/src/faces.rs

@@ -1029,7 +1029,8 @@ fn people_where(conn: &Connection, in_use: bool) -> Result<Vec<Person>, CatalogE
 ///
 /// Confirmations survive the move: a face the user confirmed as the source
 /// person is now a confirmed face of the target, which is what the user meant
-/// by saying they are the same person.
+/// by saying they are the same person. So do rejections — see
+/// [`merge_people_within`].
 pub fn merge_people(
     conn: &Connection,
     target: PersonId,
@@ -1039,7 +1040,53 @@ pub fn merge_people(
         return Ok(0);
     }
     let tx = conn.unchecked_transaction()?;
+    let moved = merge_people_within(&tx, target, source)?;
+    tx.commit()?;
+    Ok(moved)
+}
 
+/// [`merge_people`] inside a transaction the caller holds, so a job that
+/// merges several pairs commits once (`crate::dedup_people`).
+///
+/// **Rejections move with the faces.** "This face is not Annie" is a
+/// judgement about the person, and once Annie is Anna it is one about Anna.
+/// Left on the redirect it binds nothing, and the next grouping pass
+/// suggests the face the user pushed away to the person it now belongs to. Where the
+/// two halves disagree about one face — confirmed as one, rejected as the
+/// other — the confirmation stands, which is the rule [`confirm`] applies
+/// to one face; and a moved rejection takes a suggestion of the same face
+/// with it, the rule [`reject`] applies.
+pub(crate) fn merge_people_within(
+    tx: &Connection,
+    target: PersonId,
+    source: PersonId,
+) -> Result<u64, CatalogError> {
+    if target == source {
+        return Ok(0);
+    }
+    let moved = move_judgements(tx, target, source)?;
+    tx.execute(
+        "UPDATE people SET merged_into = ?1, revision = revision + 1, modified = ?3
+          WHERE id = ?2",
+        rusqlite::params![target.0 as i64, source.0 as i64, now_secs()],
+    )?;
+    Ok(moved)
+}
+
+/// The half of [`merge_people_within`] that moves faces and rejections,
+/// without touching either person's row.
+///
+/// Also what follows a redirect that arrived by sync
+/// (`crate::dedup_people`): the other device merged the people, and this
+/// one still holds judgements on the person merged away. Bumping the
+/// person's revision there would be an edit of this device's own, sent back
+/// on every pass, so the row is left as the merge wrote it.
+pub(crate) fn move_judgements(
+    tx: &Connection,
+    target: PersonId,
+    source: PersonId,
+) -> Result<u64, CatalogError> {
+    let (t, s) = (target.0 as i64, source.0 as i64);
     // A face already assigned to the target must not gain a second row —
     // `face_person` is keyed by face. Where both hold the same face, the
     // target's row wins and the source's is dropped.
@@ -1047,18 +1094,31 @@ pub fn merge_people(
         "DELETE FROM face_person
           WHERE person_id = ?2
             AND face_id IN (SELECT face_id FROM face_person WHERE person_id = ?1)",
-        rusqlite::params![target.0 as i64, source.0 as i64],
+        rusqlite::params![t, s],
     )?;
     let moved = tx.execute(
         "UPDATE face_person SET person_id = ?1 WHERE person_id = ?2",
-        rusqlite::params![target.0 as i64, source.0 as i64],
+        rusqlite::params![t, s],
     )?;
     tx.execute(
-        "UPDATE people SET merged_into = ?1, revision = revision + 1, modified = ?3
-          WHERE id = ?2",
-        rusqlite::params![target.0 as i64, source.0 as i64, now_secs()],
+        "INSERT OR IGNORE INTO face_person_rejected (face_id, person_id)
+         SELECT face_id, ?1 FROM face_person_rejected WHERE person_id = ?2",
+        rusqlite::params![t, s],
+    )?;
+    tx.execute("DELETE FROM face_person_rejected WHERE person_id = ?1", [s])?;
+    tx.execute(
+        "DELETE FROM face_person_rejected
+          WHERE person_id = ?1
+            AND face_id IN (SELECT face_id FROM face_person
+                             WHERE person_id = ?1 AND confirmed = 1)",
+        [t],
+    )?;
+    tx.execute(
+        "DELETE FROM face_person
+          WHERE person_id = ?1 AND confirmed = 0
+            AND face_id IN (SELECT face_id FROM face_person_rejected WHERE person_id = ?1)",
+        [t],
     )?;
-    tx.commit()?;
     Ok(moved as u64)
 }
 
@@ -2518,6 +2578,48 @@ mod tests {
         assert_eq!(people(&c).unwrap().len(), 1);
     }
 
+    /// A rejection left on the redirect bound nothing: the next grouping
+    /// pass suggested the face to the merged person, whom the user had told
+    /// it was somebody else.
+    #[test]
+    fn merging_moves_the_rejections_too() {
+        let c = db();
+        let ids: Vec<FaceId> = (1..=3)
+            .map(|n| {
+                let img = image(&c, n);
+                record_detections(&c, img, "w600k_mbf", 1024, &[face(n as u8)]).unwrap()[0]
+            })
+            .collect();
+        let anna = create_person(&c, "Anna").unwrap();
+        let annie = create_person(&c, "Annie").unwrap();
+        // Rejected as Annie, and nothing said about Anna.
+        reject(&c, ids[0], annie).unwrap();
+        // Rejected as Annie, suggested as Anna: the rejection now covers it.
+        suggest(&c, ids[1], anna, 0.8).unwrap();
+        reject(&c, ids[1], annie).unwrap();
+        // Rejected as Annie, confirmed as Anna: the confirmation stands.
+        confirm(&c, ids[2], anna).unwrap();
+        reject(&c, ids[2], annie).unwrap();
+
+        merge_people(&c, anna, annie).unwrap();
+
+        let rejected: Vec<(i64, i64)> = c
+            .prepare("SELECT face_id, person_id FROM face_person_rejected ORDER BY face_id")
+            .unwrap()
+            .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))
+            .unwrap()
+            .collect::<Result<_, _>>()
+            .unwrap();
+        let anna_id = anna.0 as i64;
+        assert_eq!(
+            rejected,
+            [(ids[0].0 as i64, anna_id), (ids[1].0 as i64, anna_id)]
+        );
+        assert_eq!(for_image(&c, ImageId(2)).unwrap()[0].person, None);
+        let kept = &for_image(&c, ImageId(3)).unwrap()[0];
+        assert_eq!((kept.person, kept.confirmed), (Some(anna), true));
+    }
+
     #[test]
     fn merging_does_not_duplicate_a_face_both_people_hold() {
         let c = db();

core/dr-catalog/src/lib.rs

@@ -42,6 +42,7 @@ pub mod bursts;
 pub mod cache;
 pub mod collections;
 pub mod dedup;
+pub mod dedup_people;
 pub mod duplicates;
 pub mod error;
 pub mod face_shard;

core/dr-catalog/src/merge.rs

@@ -113,6 +113,12 @@ pub struct MergeReport {
     pub faces_kept_local: usize,
     /// "Not this person" judgements taken from the remote.
     pub faces_rejected: usize,
+    /// Remote faces placed on a local one by their embedding, where the
+    /// boxes disagreed or were ambiguous (see `match_faces`).
+    pub faces_matched_by_embedding: usize,
+    /// Assignments from the remote refused because this device already has
+    /// that person on another face of the same photograph.
+    pub faces_one_per_photograph: usize,
 
     /// Redundant identities for one word, retired by
     /// [`crate::keywords::fuse_duplicates`].
@@ -973,15 +979,17 @@ fn attached_has_table(conn: &Connection, schema: &str, table: &str) -> Result<bo
 /// # Faces have no cross-device identity, so one is derived
 ///
 /// `faces.id` is a local row id and means nothing in another catalog; there is
-/// no uuid to fall back on. What both devices *do* agree on is `oc:fileid` and
-/// the box, so a remote face is matched to the local face on the same
-/// photograph whose box overlaps it most, above a floor of 0.5 IoU.
+/// no uuid to fall back on. What both devices *do* agree on is `oc:fileid`,
+/// the box, and the embedding, so a remote face is matched to the local face
+/// on the same photograph whose box overlaps it, above a floor of 0.5 IoU —
+/// or, where no box or two boxes do, whose vector it decisively resembles
+/// ([`match_faces`]).
 ///
 /// That is not a new rule: it is the one
 /// [`crate::faces::record_detections`] already uses to carry a confirmation
 /// across a re-index, and it is loose on purpose — the question is "is this the
 /// same face in the frame", not "is this the same rectangle", and a device
-/// running a newer detector is entitled to have moved the box a little.
+/// running a newer detector is entitled to have moved the box.
 fn merge_people_within(tx: &Connection, report: &mut MergeReport) -> Result<(), CatalogError> {
     // A remote written before faces existed has none of these tables, and one
     // written before V10 has no `ignored`. Both are ordinary — `remote_is_
@@ -1076,7 +1084,14 @@ fn merge_people_within(tx: &Connection, report: &mut MergeReport) -> Result<(),
     }
 
     // ---- match the remote's faces onto this device's ----------------------
-    let face_map = match_faces(tx)?;
+    let matched = match_faces(tx)?;
+    report.faces_matched_by_embedding += matched.by_embedding;
+    let FaceMatch {
+        map: face_map,
+        on_file,
+        file_of,
+        ..
+    } = matched;
     if face_map.is_empty() {
         return Ok(());
     }
@@ -1122,6 +1137,8 @@ fn merge_people_within(tx: &Connection, report: &mut MergeReport) -> Result<(),
                  probability = excluded.probability,
                  confirmed = excluded.confirmed",
         )?;
+        let mut withdraw =
+            tx.prepare_cached("DELETE FROM face_person WHERE face_id = ?1 AND confirmed = 0")?;
 
         for (remote_face, person, probability, confirmed) in incoming {
             let Some(&local_face) = face_map.get(&remote_face) else {
@@ -1148,6 +1165,37 @@ fn merge_people_within(tx: &Connection, report: &mut MergeReport) -> Result<(),
                 continue;
             }
 
+            // One person, one face per photograph -- the cannot-link the
+            // grouping pass already keeps (`dr_face::cluster`), which the
+            // merge did not. When the two devices disagree about *which*
+            // face in a frame is somebody, taking the remote's answer
+            // beside this device's own puts the person on both. The
+            // reference library holds 80 such pairs (79 set-aside
+            // strangers, one named person), the same on both devices. The
+            // face this device already gave the person keeps them, unless
+            // the remote's is a confirmation and this device's only a
+            // suggestion.
+            //
+            // A face that already holds the person adds nothing beside it,
+            // whatever else the photograph holds.
+            let adds_person = current.is_none_or(|(held_person, ..)| held_person != person);
+            let rival = file_of
+                .get(&local_face)
+                .filter(|_| adds_person)
+                .and_then(|file| {
+                    on_file[file].iter().copied().find(|&other| {
+                        other != local_face && held.get(&other).is_some_and(|h| h.0 == person)
+                    })
+                });
+            if let Some(rival) = rival {
+                if !confirmed || held[&rival].2 == 1 {
+                    report.faces_one_per_photograph += 1;
+                    continue;
+                }
+                withdraw.execute([rival])?;
+                held.remove(&rival);
+            }
+
             // Written only when it differs. Rewriting a row with the values it
             // already holds dirtied a page per face, every pass, for nothing;
             // the report still counts it, as it always has.
@@ -1225,7 +1273,45 @@ fn remote_has_column(tx: &Connection, table: &str, column: &str) -> Result<bool,
     Ok(stmt.exists(rusqlite::params![table, column])?)
 }
 
-/// Remote face row id to local face row id, by photograph and box overlap.
+/// The cosine above which two vectors from one embedder, on one
+/// photograph, on two devices, are taken to be the same face when the boxes
+/// do not say so.
+///
+/// Measured on the reference library against the tablet's snapshot
+/// (2026-09-26, #77), both `w600k_mbf`: of the 169,548 pairs of *different*
+/// faces in one photograph, four reach 0.7 and none 0.83 -- lookalikes in
+/// one frame, a parent and child. Of the 18,348 pairs the boxes match, 94%
+/// are above 0.9; the tail below is one face cut by two detectors, which is
+/// why this never overrules a box that matches on its own. At 0.6 two of
+/// the pairs it would claim carry different people on the two devices; at
+/// 0.7 none of the twenty it claims does, and ten carry the same person on
+/// both. Stricter than [`crate::faces::SAME_FACE_COSINE`] because that one
+/// is only asked about boxes that overlap, and this one is asked about boxes
+/// that do not.
+const SAME_FACE_ACROSS_DEVICES: f32 = 0.7;
+
+/// How far a face's best counterpart must lead its second best, on both
+/// sides, for the embedding to decide. A face that two others resemble
+/// almost equally is exactly the one a merge must not guess at; every pair
+/// the rule claims on the reference library leads by more than 0.5.
+const DECISIVE_MARGIN: f32 = 0.2;
+
+/// What [`match_faces`] found.
+#[derive(Default)]
+struct FaceMatch {
+    /// Remote face row id to local face row id; one-to-one.
+    map: std::collections::HashMap<i64, i64>,
+    /// Every local face on a synced photograph, by the photograph's
+    /// cross-device id -- what "another face in the same photograph" means
+    /// to the merge.
+    on_file: std::collections::HashMap<i64, Vec<i64>>,
+    /// The inverse of `on_file`.
+    file_of: std::collections::HashMap<i64, i64>,
+    /// Pairs the boxes could not settle and the embeddings did.
+    by_embedding: usize,
+}
+
+/// Remote face row id to local face row id, by photograph, box and vector.
 ///
 /// See [`merge_people_within`] for why a face has no shared identity and this
 /// has to be derived. Faces are compared within an *embedder*
@@ -1235,25 +1321,42 @@ fn remote_has_column(tx: &Connection, table: &str, column: &str) -> Result<bool,
 /// rectangle — the same judgement `faces::record_detections` makes when it
 /// carries a confirmation across a re-detection. Keying on the exact id was
 /// what let a detector change strand every name on the device that made it.
-fn match_faces(tx: &Connection) -> Result<std::collections::HashMap<i64, i64>, CatalogError> {
+///
+/// # Two passes, and the second is rare
+///
+/// **By box.** A remote face and a local one on the same photograph are the
+/// same face when their boxes overlap by at least 0.5 IoU and neither has
+/// another such candidate. That settles 18,348 of the reference library's
+/// 19,052 remote faces, reads no vector, and is the whole of a steady-state
+/// pass.
+///
+/// **By embedding**, only on the photographs where a remote face is left
+/// over -- no box overlapped it, or two did. Their vectors are read (a few
+/// hundred photographs, not the library's 19 MB of them) and a remote face is
+/// paired with the local face it resembles most when the cosine is at least
+/// [`SAME_FACE_ACROSS_DEVICES`], the pair is each other's best, each leads
+/// its runner-up by [`DECISIVE_MARGIN`], and the local face was not already
+/// claimed by a box. That is the face whose box one device drew somewhere
+/// else -- twenty on the reference library, boxes at IoU 0 with cosines of
+/// 0.72 to 0.96 -- and the face between two overlapping boxes. Anything less
+/// decisive stays unmatched, which is what a new face is: a name that fails
+/// to cross can be given again, a name put on the wrong face is a false
+/// merge the user has to find.
+fn match_faces(tx: &Connection) -> Result<FaceMatch, CatalogError> {
+    use std::collections::HashMap;
+
     /// Loose on purpose — "the same face in the frame", not "the same
     /// rectangle". The figure `record_detections` uses for the same job.
     const MIN_IOU: f32 = 0.5;
 
     type Boxed = (i64, f32, f32, f32, f32);
+    type Key = (i64, String);
 
     ensure_face_box_index(tx);
 
-    // Local faces, grouped by the photograph's cross-device id.
-    let mut local: std::collections::HashMap<(i64, String), Vec<Boxed>> =
-        std::collections::HashMap::new();
-    {
-        let mut stmt = tx.prepare(
-            "SELECT f.id, r.file_id, f.model_id, f.x, f.y, f.w, f.h
-               FROM main.faces f
-               JOIN main.remote r ON r.image_id = f.image_id
-              WHERE r.file_id IS NOT NULL",
-        )?;
+    let read_boxes = |sql: &str| -> Result<HashMap<Key, Vec<Boxed>>, CatalogError> {
+        let mut out: HashMap<Key, Vec<Boxed>> = HashMap::new();
+        let mut stmt = tx.prepare(sql)?;
         let rows = stmt.query_map([], |r| {
             Ok((
                 r.get::<_, i64>(1)?,
@@ -1270,50 +1373,187 @@ fn match_faces(tx: &Connection) -> Result<std::collections::HashMap<i64, i64>, C
         for row in rows {
             let (file_id, model, boxed) = row?;
             let embedder = crate::faces::embedder_of(&model).to_string();
-            local.entry((file_id, embedder)).or_default().push(boxed);
+            out.entry((file_id, embedder)).or_default().push(boxed);
+        }
+        Ok(out)
+    };
+
+    // Local faces, grouped by the photograph's cross-device id.
+    let local = read_boxes(
+        "SELECT f.id, r.file_id, f.model_id, f.x, f.y, f.w, f.h
+           FROM main.faces f
+           JOIN main.remote r ON r.image_id = f.image_id
+          WHERE r.file_id IS NOT NULL",
+    )?;
+    if local.is_empty() {
+        return Ok(FaceMatch::default());
+    }
+    let mut out = FaceMatch::default();
+    for ((file_id, _), faces) in &local {
+        let on = out.on_file.entry(*file_id).or_default();
+        for &(id, ..) in faces {
+            on.push(id);
+            out.file_of.insert(id, *file_id);
         }
     }
-    if local.is_empty() {
-        return Ok(Default::default());
-    }
 
-    let mut map = std::collections::HashMap::new();
-    let mut stmt = tx.prepare(
+    let remote = read_boxes(
         "SELECT f.id, r.file_id, f.model_id, f.x, f.y, f.w, f.h
            FROM remote_cat.faces f
            JOIN remote_cat.remote r ON r.image_id = f.image_id
           WHERE r.file_id IS NOT NULL",
     )?;
-    let rows = stmt.query_map([], |r| {
-        Ok((
-            r.get::<_, i64>(0)?,
-            r.get::<_, i64>(1)?,
-            r.get::<_, String>(2)?,
-            (
-                r.get::<_, f64>(3)? as f32,
-                r.get::<_, f64>(4)? as f32,
-                r.get::<_, f64>(5)? as f32,
-                r.get::<_, f64>(6)? as f32,
-            ),
-        ))
-    })?;
 
-    for row in rows {
-        let (remote_id, file_id, model, rbox) = row?;
-        let embedder = crate::faces::embedder_of(&model).to_string();
-        let Some(candidates) = local.get(&(file_id, embedder)) else {
+    // ---- by box -----------------------------------------------------------
+    // Per group, which local face (by index) each remote face took.
+    let mut left_over: Vec<(&Key, Vec<Option<usize>>)> = Vec::new();
+    for (key, theirs) in &remote {
+        let Some(ours) = local.get(key) else {
             continue;
         };
-        let best = candidates
+        let overlaps: Vec<Vec<bool>> = theirs
             .iter()
-            .map(|&(id, x, y, w, h)| (id, iou(rbox, (x, y, w, h))))
-            .filter(|&(_, score)| score >= MIN_IOU)
-            .max_by(|a, b| a.1.total_cmp(&b.1));
-        if let Some((local_id, _)) = best {
-            map.insert(remote_id, local_id);
+            .map(|&(_, x, y, w, h)| {
+                ours.iter()
+                    .map(|&(_, lx, ly, lw, lh)| iou((x, y, w, h), (lx, ly, lw, lh)) >= MIN_IOU)
+                    .collect()
+            })
+            .collect();
+        let mut taken: Vec<Option<usize>> = vec![None; theirs.len()];
+        for (i, row) in overlaps.iter().enumerate() {
+            let mut hits = row.iter().enumerate().filter(|(_, &hit)| hit);
+            let (Some((j, _)), None) = (hits.next(), hits.next()) else {
+                continue;
+            };
+            if overlaps.iter().filter(|other| other[j]).count() == 1 {
+                taken[i] = Some(j);
+                out.map.insert(theirs[i].0, ours[j].0);
+            }
+        }
+        // Worth reading vectors for only where a remote face is still
+        // unplaced and a local face is still free to be its counterpart.
+        let free = ours.len() > taken.iter().flatten().count();
+        if free && taken.iter().any(Option::is_none) {
+            left_over.push((key, taken));
         }
     }
-    Ok(map)
+    if left_over.is_empty() {
+        return Ok(out);
+    }
+
+    // ---- by embedding, for what the boxes left --------------------------
+    let wanted = |side: &HashMap<Key, Vec<Boxed>>| -> String {
+        let ids: Vec<String> = left_over
+            .iter()
+            .flat_map(|(key, _)| side[*key].iter().map(|b| b.0.to_string()))
+            .collect();
+        format!("[{}]", ids.join(","))
+    };
+    // One statement per side, keyed by row id, for the faces of those
+    // photographs only.
+    let read_vectors = |schema: &str, ids: String| -> Result<HashMap<i64, Vec<u8>>, CatalogError> {
+        let mut stmt = tx.prepare(&format!(
+            "SELECT f.id, f.embedding
+               FROM json_each(?1) j
+               JOIN {schema}.faces f ON f.id = j.value"
+        ))?;
+        let rows = stmt.query_map([ids], |r| Ok((r.get(0)?, r.get(1)?)))?;
+        Ok(rows.collect::<Result<_, _>>()?)
+    };
+    let our_vectors = read_vectors("main", wanted(&local))?;
+    let their_vectors = read_vectors("remote_cat", wanted(&remote))?;
+
+    for (key, taken) in left_over {
+        let model = dr_face::ModelId::new(key.1.as_str());
+        let decode =
+            |vectors: &HashMap<i64, Vec<u8>>, faces: &[Boxed]| -> Vec<Option<dr_face::Embedding>> {
+                faces
+                    .iter()
+                    .map(|b| {
+                        let blob = vectors.get(&b.0)?;
+                        dr_face::Embedding::from_f16_bytes(model.clone(), blob)
+                    })
+                    .collect()
+            };
+        let (theirs, ours) = (&remote[key], &local[key]);
+        let pairs = pair_by_embedding(
+            &decode(&their_vectors, theirs),
+            &decode(&our_vectors, ours),
+            &taken,
+        );
+        for (i, j) in pairs {
+            out.map.insert(theirs[i].0, ours[j].0);
+            out.by_embedding += 1;
+        }
+    }
+    Ok(out)
+}
+
+/// The pairs the embeddings decide, as `(remote index, local index)`, for the
+/// remote faces the boxes left unplaced (`taken[i] == None`).
+///
+/// Both sides are compared in full -- a local face a box already claimed can
+/// still be a remote face's best resemblance, and then that remote face is
+/// not placed elsewhere, because its best counterpart is spoken for and its
+/// second best is not decisive. Vectors that are missing or of another
+/// embedder compare as nothing ([`dr_face::Embedding::cosine`]).
+fn pair_by_embedding(
+    theirs: &[Option<dr_face::Embedding>],
+    ours: &[Option<dr_face::Embedding>],
+    taken: &[Option<usize>],
+) -> Vec<(usize, usize)> {
+    let cos: Vec<Vec<f32>> = theirs
+        .iter()
+        .map(|t| {
+            ours.iter()
+                .map(|o| match (t, o) {
+                    (Some(t), Some(o)) => t.cosine(o).unwrap_or(f32::NEG_INFINITY),
+                    _ => f32::NEG_INFINITY,
+                })
+                .collect()
+        })
+        .collect();
+
+    /// The index of the largest value, and by how much it leads the next.
+    fn best(values: impl Iterator<Item = f32>) -> Option<(usize, f32, f32)> {
+        let mut first: Option<(usize, f32)> = None;
+        let mut second = f32::NEG_INFINITY;
+        for (at, v) in values.enumerate() {
+            match first {
+                Some((_, top)) if v <= top => second = second.max(v),
+                _ => {
+                    if let Some((_, top)) = first {
+                        second = top;
+                    }
+                    first = Some((at, v));
+                }
+            }
+        }
+        first.map(|(at, top)| (at, top, second))
+    }
+    let decisive =
+        |top: f32, second: f32| top >= SAME_FACE_ACROSS_DEVICES && top - second >= DECISIVE_MARGIN;
+
+    let claimed: std::collections::HashSet<usize> = taken.iter().flatten().copied().collect();
+    let mut pairs = Vec::new();
+    for (i, row) in cos.iter().enumerate() {
+        if taken[i].is_some() {
+            continue;
+        }
+        let Some((j, top, second)) = best(row.iter().copied()) else {
+            continue;
+        };
+        if claimed.contains(&j) || !decisive(top, second) {
+            continue;
+        }
+        let Some((back, top, second)) = best(cos.iter().map(|row| row[j])) else {
+            continue;
+        };
+        if back == i && decisive(top, second) {
+            pairs.push((i, j));
+        }
+    }
+    pairs
 }
 
 /// The index the local half of [`match_faces`] is read from: every column
@@ -1332,7 +1572,7 @@ fn match_faces(tx: &Connection) -> Result<std::collections::HashMap<i64, i64>, C
 /// extra index is invisible to them. The first merge after an upgrade pays
 /// for building it, once. A failure is logged and the merge goes on reading
 /// rows, as it did before.
-fn ensure_face_box_index(tx: &Connection) {
+pub(crate) fn ensure_face_box_index(tx: &Connection) {
     if let Err(e) = tx.execute_batch(
         "CREATE INDEX IF NOT EXISTS main.faces_box ON faces(image_id, model_id, x, y, w, h);",
     ) {
@@ -1341,7 +1581,7 @@ fn ensure_face_box_index(tx: &Connection) {
 }
 
 /// Intersection over union of two `(x, y, w, h)` boxes.
-fn iou(a: (f32, f32, f32, f32), b: (f32, f32, f32, f32)) -> f32 {
+pub(crate) fn iou(a: (f32, f32, f32, f32), b: (f32, f32, f32, f32)) -> f32 {
     let x0 = a.0.max(b.0);
     let y0 = a.1.max(b.1);
     let x1 = (a.0 + a.2).min(b.0 + b.2);
@@ -2541,4 +2781,248 @@ mod tests {
             .unwrap();
         assert_eq!(people, 1);
     }
+
+    // ── faces the boxes cannot place, and their vectors ───────────────────
+
+    /// A unit vector in the embedder's space, the same for the same seed.
+    /// Two seeds are near-orthogonal, as two strangers' faces are.
+    fn vector(seed: u32) -> Vec<f32> {
+        let mut s = seed.wrapping_mul(2_654_435_761).wrapping_add(1);
+        let mut v: Vec<f32> = (0..dr_face::EMBEDDING_DIM)
+            .map(|_| {
+                s = s.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+                (s >> 8) as f32 / (1u32 << 23) as f32 - 0.5
+            })
+            .collect();
+        let norm = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+        v.iter_mut().for_each(|x| *x /= norm);
+        v
+    }
+
+    /// Store `v` as `face`'s embedding, as the embedder would.
+    fn embed(c: &Connection, db: &str, face: i64, v: &[f32]) {
+        let e = dr_face::Embedding {
+            model: dr_face::ModelId::new("w600k_mbf"),
+            v: Box::new(v.try_into().unwrap()),
+        };
+        c.execute(
+            &format!("UPDATE {db}.faces SET embedding = ?2 WHERE id = ?1"),
+            rusqlite::params![face, e.to_f16_bytes()],
+        )
+        .unwrap();
+    }
+
+    /// Anna confirmed on the remote's face 42.
+    fn anna_on(c: &Connection, remote: i64) {
+        add_person(c, "remote_cat", 3, "u-anna", "Anna", false);
+        assign(c, "remote_cat", remote, 3, true);
+    }
+
+    /// The case #77 was opened for: one device drew the box somewhere else —
+    /// on the reference library, whole photographs whose boxes sit at IoU 0
+    /// with cosines above 0.9 — and the name stayed behind. The vector says
+    /// it is the same face.
+    #[test]
+    fn a_shifted_box_with_the_same_embedding_matches() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let local = add_face(&c, "main", 7, 1, 0.10);
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.60);
+        embed(&c, "main", local, &vector(1));
+        embed(&c, "remote_cat", remote, &vector(1));
+        anna_on(&c, remote);
+
+        let report = merge_all(&c).unwrap();
+        assert_eq!(report.faces_matched_by_embedding, 1);
+        assert_eq!(person_of(&c, local), Some(("Anna".to_string(), true)));
+    }
+
+    /// Two faces close enough that both boxes overlap the remote's by more
+    /// than half: the box cannot say which, and must not guess. The vector
+    /// can.
+    #[test]
+    fn two_overlapping_faces_are_told_apart_by_embedding() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let front = add_face(&c, "main", 7, 1, 0.30);
+        let behind = add_face(&c, "main", 8, 1, 0.36);
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.33);
+        embed(&c, "main", front, &vector(1));
+        embed(&c, "main", behind, &vector(2));
+        embed(&c, "remote_cat", remote, &vector(2));
+        anna_on(&c, remote);
+
+        merge_all(&c).unwrap();
+        assert_eq!(person_of(&c, behind), Some(("Anna".to_string(), true)));
+        assert_eq!(person_of(&c, front), None);
+    }
+
+    /// The same two overlapping boxes, and vectors that do not decide: the
+    /// face stays unmatched rather than going to the larger overlap.
+    #[test]
+    fn an_ambiguous_box_with_no_decisive_vector_stays_unmatched() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let front = add_face(&c, "main", 7, 1, 0.30);
+        let behind = add_face(&c, "main", 8, 1, 0.35);
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.33);
+        embed(&c, "main", front, &vector(1));
+        embed(&c, "main", behind, &vector(2));
+        // Equally like both: 0.71 each, no margin.
+        let between: Vec<f32> = vector(1)
+            .iter()
+            .zip(vector(2))
+            .map(|(a, b)| (a + b) / 2f32.sqrt())
+            .collect();
+        embed(&c, "remote_cat", remote, &between);
+        anna_on(&c, remote);
+
+        merge_all(&c).unwrap();
+        assert_eq!(person_of(&c, front), None);
+        assert_eq!(person_of(&c, behind), None);
+    }
+
+    /// The same person in another photograph has the same vector — the
+    /// worst lookalike there is — and is not the same face. Nor is a face
+    /// in the right photograph that neither box nor vector ties to it: that
+    /// is a face this device found and the other did not, and it stays new.
+    #[test]
+    fn a_similar_embedding_in_a_different_photograph_never_matches() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+            add_synced_image(&c, db, 2, 6000);
+        }
+        let elsewhere = add_face(&c, "main", 7, 2, 0.10);
+        let stranger = add_face(&c, "main", 8, 1, 0.10);
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.60);
+        embed(&c, "main", elsewhere, &vector(1));
+        embed(&c, "main", stranger, &vector(2));
+        embed(&c, "remote_cat", remote, &vector(1));
+        anna_on(&c, remote);
+
+        let report = merge_all(&c).unwrap();
+        assert_eq!(report.faces_matched_by_embedding, 0);
+        assert_eq!(person_of(&c, elsewhere), None, "matched across photographs");
+        assert_eq!(person_of(&c, stranger), None, "a new face was matched");
+    }
+
+    /// Vectors from two embedders live in two spaces; a cosine between
+    /// them is a number that means nothing.
+    #[test]
+    fn different_embedders_never_compare() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let local = add_face(&c, "main", 7, 1, 0.10);
+        c.execute(
+            "UPDATE main.faces SET model_id = 'scrfd_10g+other_embedder' WHERE id = ?1",
+            [local],
+        )
+        .unwrap();
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.60);
+        embed(&c, "main", local, &vector(1));
+        embed(&c, "remote_cat", remote, &vector(1));
+        anna_on(&c, remote);
+
+        merge_all(&c).unwrap();
+        assert_eq!(person_of(&c, local), None, "matched across embedders");
+    }
+
+    /// A local face its box already placed is not handed to a second remote
+    /// face because that one resembles it: one face, one counterpart.
+    #[test]
+    fn a_face_the_box_placed_is_not_taken_again_by_a_vector() {
+        let c = two_catalogs();
+        for db in ["main", "remote_cat"] {
+            add_synced_image(&c, db, 1, 5000);
+        }
+        let placed = add_face(&c, "main", 7, 1, 0.10);
+        let free = add_face(&c, "main", 8, 1, 0.70);
+        let by_box = add_face(&c, "remote_cat", 41, 1, 0.10);
+        let remote = add_face(&c, "remote_cat", 42, 1, 0.40);
+        embed(&c, "main", placed, &vector(1));
+        embed(&c, "main", free, &vector(3));
+        embed(&c, "remote_cat", by_box, &vector(2));
+        embed(&c, "remote_cat", remote, &vector(1));
+        anna_on(&c, remote);
+
+        merge_all(&c).unwrap();
+        assert_eq!(person_of(&c, placed), None);
+        assert_eq!(person_of(&c, free), None);
+    }
+
+    // ── one person, one face per photograph ───────────────────────────────
+
+    /// Two faces far apart in one photograph, one each side's remote
+    /// counterpart can be matched to by box: (local 7, local 8, remote 42
+    /// over 8).
+    fn two_faces_one_photograph(c: &Connection) -> (i64, i64, i64) {
+        for db in ["main", "remote_cat"] {
+            add_synced_image(c, db, 1, 5000);
+        }
+        let here = add_face(c, "main", 7, 1, 0.10);
+        let there = add_face(c, "main", 8, 1, 0.60);
+        let remote = add_face(c, "remote_cat", 42, 1, 0.60);
+        (here, there, remote)
+    }
+
+    /// The devices disagree about which stranger in a crowd a set-aside
+    /// group holds. Taking the remote's anchor beside this device's own put
+    /// one person on two faces of one frame.
+    #[test]
+    fn a_set_aside_anchor_does_not_land_beside_this_devices_own() {
+        let c = two_catalogs();
+        let (here, there, remote) = two_faces_one_photograph(&c);
+        add_person(&c, "main", 1, "u-stranger", "", true);
+        add_person(&c, "remote_cat", 3, "u-stranger", "", true);
+        assign(&c, "main", here, 1, false);
+        assign(&c, "remote_cat", remote, 3, false);
+
+        let report = merge_all(&c).unwrap();
+        assert_eq!(report.faces_one_per_photograph, 1);
+        assert_eq!(person_of(&c, here), Some((String::new(), false)));
+        assert_eq!(person_of(&c, there), None);
+    }
+
+    /// A confirmation from the other device outranks a suggestion here for
+    /// the same person on another face, which gives the person up.
+    #[test]
+    fn a_remote_confirmation_moves_a_local_suggestion_off_the_other_face() {
+        let c = two_catalogs();
+        let (here, there, remote) = two_faces_one_photograph(&c);
+        add_person(&c, "main", 1, "u-anna", "Anna", false);
+        add_person(&c, "remote_cat", 3, "u-anna", "Anna", false);
+        assign(&c, "main", here, 1, false);
+        assign(&c, "remote_cat", remote, 3, true);
+
+        merge_all(&c).unwrap();
+        assert_eq!(person_of(&c, there), Some(("Anna".to_string(), true)));
+        assert_eq!(person_of(&c, here), None);
+    }
+
+    /// Two confirmations of one person on two faces of one photograph is a
+    /// disagreement no merge can settle; this device's stands, and the
+    /// second is not added beside it.
+    #[test]
+    fn a_remote_confirmation_does_not_double_a_local_one() {
+        let c = two_catalogs();
+        let (here, there, remote) = two_faces_one_photograph(&c);
+        add_person(&c, "main", 1, "u-anna", "Anna", false);
+        add_person(&c, "remote_cat", 3, "u-anna", "Anna", false);
+        assign(&c, "main", here, 1, true);
+        assign(&c, "remote_cat", remote, 3, true);
+
+        let report = merge_all(&c).unwrap();
+        assert_eq!(report.faces_one_per_photograph, 1);
+        assert_eq!(person_of(&c, here), Some(("Anna".to_string(), true)));
+        assert_eq!(person_of(&c, there), None);
+    }
 }

core/dr-catalog/src/sync.rs

@@ -344,6 +344,18 @@ pub fn merge_remote(conn: &Connection, remote: &Path) -> Result<MergeReport, Cat
         log::warn!("failed to detach remote catalog: {e}");
     }
 
+    // After every merge, because a merge is where two devices' people meet:
+    // the same name typed on each, or a redirect one of them made. Its own
+    // transaction, and a failure is logged rather than returned -- what the
+    // merge took is committed and valid whether or not the duplicates were
+    // folded, and the next pass tries again. Runs on the sync worker, never
+    // the UI thread, and costs ~10 ms when there is nothing to do.
+    if result.is_ok() {
+        if let Err(e) = crate::dedup_people::run(conn) {
+            log::warn!("dedup after the catalog merge: {e}");
+        }
+    }
+
     result
 }
 

core/dr-pipeline/presets/skies.drpl

@@ -0,0 +1,52 @@
+drpl 1
+
+# Skies: a bluer, deeper sky without touching the rest of the picture.
+#
+# Written against this pipeline, not derived from anybody's preset. Each
+# works the colour mixer's azure and blue bands — the hues a clear sky
+# occupies, 210° and 240° — darkening them and adding chroma, which is what
+# a polarising filter does to a sky and why it reads as "more blue" rather
+# than "more saturated". A grey sky has no hue for the bands to find, so on
+# an overcast frame these do little, by construction: they cannot invent a
+# sky, and a preset that tinted grey clouds blue would be one nobody trusted.
+#
+# Highlights come down with the sky in the stronger ones, because a darker
+# blue beside a clipped white cloud looks like a mask edge.
+
+[preset Blue sky]
+colour_mixer.azure_lum = -20
+colour_mixer.azure_sat = 25
+colour_mixer.blue_lum = -15
+colour_mixer.blue_sat = 20
+highlights_shadows.highlights = -15
+
+[preset Deep blue sky]
+colour_mixer.azure_hue = 10
+colour_mixer.azure_lum = -30
+colour_mixer.azure_sat = 35
+colour_mixer.blue_lum = -25
+colour_mixer.blue_sat = 30
+colour_mixer.cyan_sat = 10
+highlights_shadows.highlights = -30
+
+[preset Polariser]
+colour_mixer.azure_hue = 10
+colour_mixer.azure_lum = -35
+colour_mixer.azure_sat = 40
+colour_mixer.blue_lum = -30
+colour_mixer.blue_sat = 35
+colour_mixer.cyan_lum = -10
+colour_mixer.cyan_sat = 15
+dehaze.amount = 20
+highlights_shadows.highlights = -35
+vibrance.vibrance = 10
+
+[preset Blue sky, golden land]
+colour_mixer.azure_lum = -20
+colour_mixer.azure_sat = 25
+colour_mixer.blue_lum = -15
+colour_mixer.blue_sat = 20
+colour_mixer.orange_sat = 12
+colour_mixer.yellow_hue = -10
+colour_mixer.yellow_sat = 15
+highlights_shadows.highlights = -20

core/dr-pipeline/src/bundled.rs

@@ -62,6 +62,7 @@ const SECTIONS: &[(&str, &str, &str)] = &[
         "Essentials",
         include_str!("../presets/essentials.drpl"),
     ),
+    ("skies", "Skies", include_str!("../presets/skies.drpl")),
     (
         "colour_film",
         "Colour film",

docs/dev/catalog.md

@@ -723,7 +723,12 @@ merges reuses those rules or keys on the same identities, and each has no other
 - **Collections and their membership** — by uuid and revision, membership as a set union.
 - **Keywords** — the vocabulary by the same verdict, the assignments as a union.
 - **People and identity judgements** — people by uuid and revision, and the confirmed and rejected
-  face assignments matched to local faces by box (`merge::match_faces`).
+  face assignments matched to local faces (`merge::match_faces`): by box first, and — since 0.18.0,
+  only on the photographs where a remote face is left over — by embedding, a pair being accepted
+  at cosine ≥ 0.7 when each is the other's best by a lead of ≥ 0.2 (#77; [faces.md §18.2](faces.md)). After every merge,
+  `dedup_people` folds people of one name whose confirmed faces agree, and a face held twice in
+  one photograph, through the ordinary `merged_into` redirect, which older builds already honour
+  (#78; [faces.md §19](faces.md)).
 - **Albums** (FR-EXP-10, 0.17.0) — by uuid and revision with tombstones, and what went into each as
   a set union keyed on the server's file id (a content hash on a folder library). An album's
   server folder is a column of its row and travels with it; a folder on *this device* is in
@@ -754,7 +759,7 @@ it goes anywhere.
 
 **The face crops stay out of the upload.** A crop is a ~5 KB JPEG on each `faces` row. On a 19k-face
 library they are 96 MB of a 158 MB catalog. The face shards carry them to other devices, once each.
-The merge reads a remote face's box and model to match it to a local one, never its pixels. No
+The merge reads a remote face's box and model to match it to a local one — and, where the boxes cannot decide, its embedding — never its pixels. No
 device adopts a downloaded catalog as its own: a fresh device starts empty and takes faces, crops
 included, from the shards. So the snapshot's `crop` is NULL, and a merge never writes a local
 crop. They were first stripped (2026-08) by copying the whole file with the backup API, setting
@@ -778,6 +783,7 @@ integer ids stay local and are never compared across catalogs.
 | Deletion | Tombstone (`deleted = 1`) carrying a revision | Without it, merging against a device that still holds the collection resurrects it. With a revision, deletion competes on equal footing with a rename |
 | An image the remote has and we do not | Skip the membership row | It joins on a later merge, once a scan has catalogued the file. Not an error |
 | A remote from a newer schema | Decline before attaching | Attempting it would fail mid-transaction rather than declining cleanly |
+| People with the same name | Folded after each merge when their faces agree ([faces.md §19](faces.md)) | Names typed separately on two devices otherwise stay two people for ever |
 
 Merging is idempotent: running it twice reports no changes the second time. That property is tested,
 because a merge that oscillates would upload on every sync forever.

docs/dev/faces.md

@@ -1575,5 +1575,37 @@ It is a match, not an update in place, and that is why the per-face repairs exis
 detection: where nothing about a face but one field needs doing, `record_updates` keeps the id and
 there is nothing to judge.
 
-The merge's `match_faces` still matches by overlap alone across devices. It is the same question,
-and the same answer would serve it; it is not changed here.
+Since #77 (0.18.0) the merge's `match_faces` answers it too, within a photograph's `file_id` and
+one embedder: box IoU ≥ 0.5, unique on both sides, first; then, only for photographs where a remote
+face is left over and a local face is free, embedding cosine ≥ 0.7, mutual best, with a lead of
+≥ 0.2 over the runner-up on both sides. A box match is never overruled by a low cosine (about 150
+genuine cross-device pairs of tiny faces score below 0.45). On the reference desktop/tablet pair this
+recovers 20 of 631 unmatched faces with no false matches; the rest are faces one device alone found.
+The merge also keeps one person to one face per photograph: an incoming assignment is refused when
+another local face already holds that person, unless it is a remote confirmation over a local
+suggestion, which moves the suggestion. Refusals are counted in `faces_one_per_photograph`.
+
+The threshold differs from `SAME_FACE_COSINE` (0.45) above on purpose: re-detection additionally
+requires the boxes to overlap, while the merge's embedding route exists for boxes that don't.
+
+## 19. Deduplicating people · 2026-09-26
+
+`dr_catalog::dedup_people::run` runs after every successful sync merge (`sync::merge_remote`, on the
+sync worker), in one transaction, and logs one `dedup:` line (#78).
+
+**People.** Named people with the same name, trimmed and case-folded, merge into the one with the
+most confirmed faces (ties go to the smaller uuid) when every shared embedder's confirmed-face
+centroids agree at cosine ≥ 0.7 (distance < 0.3). Each side needs at least two confirmed faces to
+compare; a namesake holding no faces merges outright; a face confirmed as one and rejected as the
+other keeps them apart; unnamed and set-aside people are never touched. On the reference library the
+same-person centroid median is 0.91, and different named people have a 99.9th percentile of 0.41.
+
+**Faces.** Two faces in the same image and embedder with IoU ≥ 0.5 and cosine ≥ 0.7 are one: the
+job keeps the stronger detector's face (`FaceDetector::outranks`), then the confirmed one, then the
+lower id, and it takes both faces' assignment and rejections.
+
+**Propagation.** The merge is `faces::merge_people`, whose `merged_into` redirect a 0.17.0 peer
+already honours, so an older device never resurrects the duplicate. The job also follows redirects
+left by earlier manual merges, moving this device's own assignments onto the person kept, and
+breaks a mutual redirect at the smaller uuid, which every device computes alike. A merge now also
+carries the merged-away person's rejections to the person kept.

docs/dev/outstanding.md

@@ -250,12 +250,12 @@ about.
 0.17.0 brought the first real SAF code, for albums (FR-EXP-10): `FolderPicker.java` starts
 `ACTION_OPEN_DOCUMENT_TREE` from a translucent activity of its own (the main activity is
 `NativeActivity`, whose results are not ours) and takes a persistable grant; `Saf.java` writes each
-export through `DocumentsContract`; `ui/dr-ui/src/saf.rs` is the JNI bridge. `saf.rs` and the export
-path now carry `TRACES: FR-PLAT-AND-1`, and the matrix counts the requirement as covered. **That
-overstates it.** The mechanism is the one the requirement names, but its subject is the library, and
-Android still reaches a library through a Nextcloud account or a folder, over paths, like the
-desktop. Either the tags narrow to FR-EXP-10 or the requirement is met for the library too; until
-one of those, read the coverage figure with this one subtracted.
+export through `DocumentsContract`; `ui/dr-ui/src/saf.rs` is the JNI bridge. They shipped tagged
+`TRACES: FR-PLAT-AND-1`, which made the matrix count the requirement as covered, and that overstated
+it: the mechanism is the one the requirement names, but its subject is the library, and Android
+still reaches a library through a Nextcloud account or a folder, over paths, like the desktop. The
+tags now say FR-EXP-10 alone (0.17.1), so FR-PLAT-AND-1 reads as uncovered again until the library
+itself is reached through SAF.
 
 That has a consequence for the rest of the cluster: **FR-PLAT-AND-2** — detecting the loss of a
 granted tree permission and marking images offline rather than deleting rows — is still blocked for

docs/gestures.md

@@ -521,7 +521,7 @@ The right match confidence is a property of your library, not of the model. "Wha
 
 Touch has no ctrl, so without a mode there is no way to select a second photograph — the first tap would open it. The hold is the fast way in and the button is the one that can be found.
 
-<sub>`ui/dr-ui/ui/library.slint:1701`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1706`</sub>
 
 ### Add or remove one photograph
 
@@ -531,7 +531,7 @@ Touch has no ctrl, so without a mode there is no way to select a second photogra
 
 While selecting, a tap never opens. That is the whole point of the mode: one meaning per gesture at a time. Press Done to get tap-to-open back.
 
-<sub>`ui/dr-ui/ui/library.slint:1711`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1716`</sub>
 
 ### Leave selecting
 
@@ -540,7 +540,7 @@ While selecting, a tap never opens. That is the whole point of the mode: one mea
 - **Keyboard** — `Escape`, or `Back`; an open sheet closes first
 - **See it** — [in the manual](manual/README.md#selecting-several)
 
-<sub>`ui/dr-ui/ui/library.slint:1720`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1725`</sub>
 
 ### Pick a photograph up to drag it
 
@@ -550,7 +550,7 @@ While selecting, a tap never opens. That is the whole point of the mode: one mea
 
 A finger on a photograph might be starting a scroll, and for the first half-second the grid assumes it is. Holding says otherwise, and the ring is the grid saying it heard — from there the drag cannot be lost to a scroll. A mouse never waits: the cursor is precise enough that a sideways drag is unambiguous from the first pixel.
 
-<sub>`ui/dr-ui/ui/library.slint:1751`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1756`</sub>
 
 ### Select a range
 
@@ -561,7 +561,7 @@ A finger on a photograph might be starting a scroll, and for the first half-seco
 
 This replaced a double tap, which had no visible state and could take forty photographs by accident. The run is resolved by the catalog rather than by what is on screen, so the grid can scroll between the two taps — the ranges that hurt on a tablet are longer than a screenful, which is exactly where a finger sweep runs out.
 
-<sub>`ui/dr-ui/ui/library.slint:1817`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1822`</sub>
 
 ### Take the blinks out of a burst
 
@@ -571,7 +571,7 @@ This replaced a double tap, which had no visible state and could take forty phot
 
 Face indexing reads each face's eyes. The chip drops frames where the chosen people are caught blinking, and leaves sunglasses and eyes it could not read alone.
 
-<sub>`ui/dr-ui/ui/library.slint:2535`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2540`</sub>
 
 ### Find photographs with two people in them
 
@@ -581,7 +581,7 @@ Face indexing reads each face's eyes. The chip drops frames where the chosen peo
 
 "Any of them" is a union and "all of them" is an intersection. The tray is where both terms and the choice between them live, because a filter belongs on the filter bar.
 
-<sub>`ui/dr-ui/ui/library.slint:2565`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2570`</sub>
 
 ### Show only photographs with one colour label
 
@@ -591,7 +591,7 @@ Face indexing reads each face's eyes. The chip drops frames where the chosen peo
 
 Each chip is the label's mark and its name, so the one you want is found by reading it; tap the lit chip again to show every label.
 
-<sub>`ui/dr-ui/ui/library.slint:2689`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2694`</sub>
 
 ### Export the selection as the last export was
 
@@ -602,7 +602,7 @@ Each chip is the label's mark and its name, so the one you want is found by read
 
 Lightroom's and darktable's chords. Every export runs on the saved defaults, so the plain chord opens them beside an Export button and the shifted one skips straight to exporting.
 
-<sub>`ui/dr-ui/ui/library.slint:3159`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3164`</sub>
 
 ### Paste copied settings onto the selection
 
@@ -611,7 +611,7 @@ Lightroom's and darktable's chords. Every export runs on the saved defaults, so
 - **Keyboard** — `Ctrl+V`
 - **See it** — [in the manual](manual/README.md#copying-settings)
 
-<sub>`ui/dr-ui/ui/library.slint:3183`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3188`</sub>
 
 ### Keyword the selection
 
@@ -621,7 +621,7 @@ Lightroom's and darktable's chords. Every export runs on the saved defaults, so
 
 Lightroom's keywording chord. The sheet opens with its field ready for typing, so the keys that judge in the grid are out of the way until it closes.
 
-<sub>`ui/dr-ui/ui/library.slint:3212`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3217`</sub>
 
 ### Show only photographs with some number of stars
 
@@ -632,7 +632,7 @@ Lightroom's keywording chord. The sheet opens with its field ready for typing, s
 
 The chips say "this many or more". A range with a ceiling — the twos and threes still to be decided — is the keyboard's alone, and the bar says so in words while it holds.
 
-<sub>`ui/dr-ui/ui/library.slint:3246`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3251`</sub>
 
 ### Give photographs a colour label
 
@@ -643,7 +643,7 @@ The chips say "this many or more". A range with a ceiling — the twos and three
 
 Lightroom's keys, so hands that learned them there need not learn them again. Purple has no key there either, and is on the bar. Every mark carries its label's initial, so the label is read without telling the colours apart.
 
-<sub>`ui/dr-ui/ui/library.slint:3296`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3301`</sub>
 
 ### Pick or reject a photograph
 
@@ -653,7 +653,7 @@ Lightroom's keys, so hands that learned them there need not learn them again. Pu
 
 The keys every culling tool uses, so muscle memory built elsewhere works here.
 
-<sub>`ui/dr-ui/ui/library.slint:3320`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3325`</sub>
 
 ### Move photographs to the trash
 
@@ -663,7 +663,7 @@ The keys every culling tool uses, so muscle memory built elsewhere works here.
 
 The bin acts on one photograph, so a stray click cannot trash a selection; the key acts on the selection because that is what every file manager's Delete does. Both are undone from the trash view.
 
-<sub>`ui/dr-ui/ui/library.slint:3347`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3352`</sub>
 
 ### Open this list
 
@@ -671,7 +671,7 @@ The bin acts on one photograph, so a stray click cannot trash a selection; the k
 - **Pointer** — Press Help in the header, and Done to put it away
 - **Keyboard** — `F1`, and `Escape` to put it away
 
-<sub>`ui/dr-ui/ui/library.slint:3372`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3377`</sub>
 
 ### Rename the collection the grid is showing
 
@@ -679,7 +679,7 @@ The bin acts on one photograph, so a stray click cannot trash a selection; the k
 - **Pointer** — Double-click it in the sidebar
 - **Keyboard** — `F2`
 
-<sub>`ui/dr-ui/ui/library.slint:3380`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3385`</sub>
 
 ### Move through the grid
 
@@ -689,7 +689,7 @@ The bin acts on one photograph, so a stray click cannot trash a selection; the k
 
 The cursor selects what it lands on, so walking and judging are one hand's work.
 
-<sub>`ui/dr-ui/ui/library.slint:3400`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3405`</sub>
 
 ### Resize the thumbnails
 
@@ -700,7 +700,7 @@ The cursor selects what it lands on, so walking and judging are one hand's work.
 
 There is no wheel on a tablet, so without the pinch the cell size could only be changed by a control a finger cannot reach.
 
-<sub>`ui/dr-ui/ui/library.slint:3531`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3536`</sub>
 
 ### File photographs in a collection
 
@@ -710,7 +710,7 @@ There is no wheel on a tablet, so without the pinch the cell size could only be
 
 The selection is what the drag carries, which is why selecting several is worth the mode: forty photographs file in one gesture.
 
-<sub>`ui/dr-ui/ui/library.slint:3730`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3735`</sub>
 
 ### Open a photograph
 
@@ -721,7 +721,7 @@ The selection is what the drag carries, which is why selecting several is worth
 
 A tap opens; a tap that *moved* does not. Travel is what separates a deliberate tap from a hand brushing past, and it is the only thing that does: the two are the same length. An earlier version required the finger to dwell 120 ms instead, and that rejected ordinary taps — a real tap is often quicker than a brush.
 
-<sub>`ui/dr-ui/ui/library.slint:4035`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4040`</sub>
 
 ### Rate a photograph without opening it
 
@@ -732,7 +732,7 @@ A tap opens; a tap that *moved* does not. Travel is what separates a deliberate
 
 A star has to take the press without it also reaching the cell, or every rating throws the user into develop.
 
-<sub>`ui/dr-ui/ui/library.slint:4158`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4163`</sub>
 
 ### Choose the frame a folded burst shows
 
@@ -742,7 +742,7 @@ A star has to take the press without it also reaching the cell, or every rating
 
 A folded burst draws its earliest frame, which is a fact about the clock and not a judgement about the photograph — nothing in this application ranks a frame (FR-CULL-5). But the point of a burst is that one of the twelve is better than the other eleven, and the photographer is the only one who knows which. So the choice is offered on the frames themselves, while they are open and side by side, which is the one moment the alternatives are on screen to be compared.
 
-<sub>`ui/dr-ui/ui/library.slint:4291`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4296`</sub>
 
 ### Drop the selection but keep selecting
 
@@ -753,7 +753,7 @@ A folded burst draws its earliest frame, which is a fact about the clock and not
 
 Distinct from Done, which leaves the mode entirely. Clearing keeps it, so the next selection can start straight away.
 
-<sub>`ui/dr-ui/ui/library.slint:4982`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4987`</sub>
 
 ### Select everything the grid is showing
 
@@ -764,7 +764,7 @@ Distinct from Done, which leaves the mode entirely. Clearing keeps it, so the ne
 
 A scoped grid of two hundred frames is two hundred taps otherwise, and "all of them, except those three" is a far more common shape than the taps it took to say it.
 
-<sub>`ui/dr-ui/ui/library.slint:5001`</sub>
+<sub>`ui/dr-ui/ui/library.slint:5006`</sub>
 
 ### Take photographs out of a collection
 
@@ -774,7 +774,7 @@ A scoped grid of two hundred frames is two hundred taps otherwise, and "all of t
 
 The badge on a cell says a photograph is filed in three collections and never which. This is the sheet that names them, and the only way out of one the grid is not currently scoped to.
 
-<sub>`ui/dr-ui/ui/library.slint:5182`</sub>
+<sub>`ui/dr-ui/ui/library.slint:5187`</sub>
 
 ## Settings
 

docs/manual/README.md

@@ -278,7 +278,7 @@ apply elsewhere, and imports Lightroom presets — `Folder…` for a folder of
 them, `.xmp file…` for one.
 
 The sheet lists your own presets first, then the ones DarkRoom ships —
-Essentials, and colour, cinema and black-and-white film, one measured stock
+Essentials, Skies, and colour, cinema and black-and-white film, one measured stock
 each. A shipped preset is a look: it changes what it names and leaves the
 photograph's own corrections alone, as an imported Lightroom preset does.
 Saving under a shipped preset's name makes your version the one that name

docs/manual/index.html

@@ -334,7 +334,7 @@ keeps the current state under a name. <code>Presets…</code> saves the settings
 apply elsewhere, and imports Lightroom presets — <code>Folder…</code> for a folder of
 them, <code>.xmp file…</code> for one.</p>
 <p>The sheet lists your own presets first, then the ones DarkRoom ships —
-Essentials, and colour, cinema and black-and-white film, one measured stock
+Essentials, Skies, and colour, cinema and black-and-white film, one measured stock
 each. A shipped preset is a look: it changes what it names and leaves the
 photograph's own corrections alone, as an imported Lightroom preset does.
 Saving under a shipped preset's name makes your version the one that name

packaging/PKGBUILD

@@ -4,7 +4,7 @@
 # makes `makepkg -si` in this directory install what you are actually working
 # on. Swap `source` for a tagged tarball when there is something to release.
 pkgname=darkroom
-pkgver=0.17.0
+pkgver=0.18.0
 # Back to 1 with the version: a new pkgver is a new archive name, so there is
 # nothing for makepkg to reuse and nothing for a release number to disambiguate.
 pkgrel=1

ui/dr-ui/src/export.rs

@@ -213,7 +213,7 @@ pub fn place(
             if destination.trim().is_empty() {
                 return Err("No export folder is set. Choose an album to export to.".into());
             }
-            // TRACES: FR-EXP-10 | FR-PLAT-AND-1
+            // TRACES: FR-EXP-10
             // A SAF tree on Android: written through the provider, which may
             // rename on a collision, so the name it reports is the one kept.
             #[cfg(target_os = "android")]

ui/dr-ui/src/library_ui/window.rs

@@ -356,6 +356,21 @@ pub(super) fn load_window(window: &AppWindow, ctl: &Rc<LibraryController>) {
     // signal that something was deleted out from under the view.
     let was = window.global::<Library>().get_library_total().max(0) as usize;
     window.global::<Library>().set_library_total(total as i32);
+    // TRACES: FR-CAT-7 | FR-EXP-10
+    // The sidebar's "All photographs" is the whole library whatever is
+    // scoped. The same number as `total` when nothing is — no second count
+    // then — and otherwise read only when the facts above moved, so a
+    // scroll inside an album does not recount the library.
+    if scope.is_none() && !trash {
+        window
+            .global::<Library>()
+            .set_library_whole_total(total as i32);
+    } else if describes_something_new {
+        let whole = library::total_images_scoped(catalog, None, &filter).unwrap_or(0);
+        window
+            .global::<Library>()
+            .set_library_whole_total(whole as i32);
+    }
     let shrank = total < was;
 
     // Clamp so a scrub to the very end still fills the window rather than

ui/dr-ui/src/saf.rs

@@ -1,6 +1,10 @@
-//! TRACES: FR-EXP-10 | FR-PLAT-AND-1
+//! TRACES: FR-EXP-10
 //! Android's Storage Access Framework, for an album's folder on the device.
 //!
+//! Export folders only. FR-PLAT-AND-1 asks for the *library* to be reached
+//! through SAF, and it still is not — a library on the tablet is a server —
+//! so this module does not claim it.
+//!
 //! The folder is chosen in the system's own picker, which can make a new
 //! folder too, and comes back as a tree URI with a persisted grant. Exports
 //! are then written into it through `DocumentsContract` — a tree URI is not a

ui/dr-ui/ui/app.slint

@@ -1404,7 +1404,7 @@ in property <bool> panel-visible: true;
                         height: 100%;
                         rows: Collections.collection-rows;
                         selected-id: root.collection-selected;
-                        total-images: Library.library-total;
+                        total-images: Library.library-whole-total;
                         error: Collections.collection-error;
 
                         // TRACES: FR-NC-6a

ui/dr-ui/ui/library.slint

@@ -500,6 +500,11 @@ export struct LibraryCell {
 export global Library {
     in-out property <[LibraryCell]> library-cells;
     in property <int> library-total: 0;
+    /// The whole library under the current filter, whatever the grid is
+    /// narrowed to — what the sidebar's "All photographs" row counts.
+    /// `library-total` is the scope's, which under a collection or an album
+    /// made that row read as the album's size.
+    in property <int> library-whole-total: 0;
     // Narrows the grid to images whose RAW is stored locally — the ones that
     // can actually be opened while offline. Off by default: the catalog is the
     // library, and hiding most of it the moment a connection drops would read