Fan out display-name rename to every cohort (ARB-513)

[crthpl]

Summary

• Renaming fans out to every cohort. Updating your display name now propagates global_user.display_name plus every non-read-only cohort's account.name in one shot, via a shared apply_user_rename helper used by both PUT /api/users/me/display-name and PUT /api/admin/users/:id/display-name.
• Per-cohort -N collision suffixes. When a cohort already has an account with the target name, the backend picks the smallest available -2/-3/… suffix. The old -g{global_user_id} scheme in ensure_user_created_by_global_id is gone.
• Preflight + confirmation flow. Before any writes, the server computes the target name in each cohort. If any would need a suffix, it responds 409 { status: 'needs_confirmation', conflicts: [...] } and writes nothing. The frontend opens an AlertDialog listing the suggested per-cohort names; on confirm it resubmits with a confirmed_overrides map. A TOCTOU race during commit bubbles back out as a plain 409 — the client retries from scratch.
• Same-name requests rejected with 400 "Display name unchanged", so a double-click doesn't ratchet suffixes.
• Live broadcast. After each cohort rename, the server sends a single-entry SM::Accounts { accounts: [updated] } via cohort.subscriptions.send_public(...). The frontend handler for msg.accounts had a latent bug (it cleared the whole map before looping, so single-element broadcasts wiped out state); fixed to upsert. Full resets still happen through resetServerState() on disconnect.
• Accounts page layout — shows a single Name: Theo Reinsberg line when the current cohort's account name matches the global name, and two lines (Name for {cohort}: Theo Reinsberg-2 + Name: Theo Reinsberg) when they diverge. Only the global name is editable; the edit prefills from the global name, not the suffixed cohort-local one.
• New GET /api/users/me returning { id, display_name, email, is_admin } for the caller, so the accounts page can show the global name even when it differs from the current cohort's account.name.
• Admin rename goes through the same preflight/commit flow with its own confirmation modal on the admin page.
• Out of scope: historical -g{N}-style cohort account names from earlier code paths aren't rewritten; a subsequent rename clears them out naturally. Also removes a stale top-level DEPLOY.md that was already unused.

Fixes ARB-513

Test plan

• cd backend && cargo clippy --features dev-mode --tests -- -D warnings — no warnings (verified locally)
• cd backend && cargo test-all — all 62 tests pass (verified locally)
• cd frontend && pnpm run check && pnpm run lint — 0 errors (verified locally)
• Manual: log in as Alice in cohort main, rename her to "Bob" (no collision). Expect single Name: Bob line, other connected clients see the rename live.
• Manual: create a second account named "Bob" in cohort willow, then as Alice submit a rename to "Bob". Expect the confirmation modal listing Willow: Bob-2. Confirm → main shows Name: Bob, willow shows two lines (Name for willow: Bob-2 / Name: Bob).
• Manual: submit the same name twice (Bob → Bob) — expect 400 "Display name unchanged".
• Manual: two-tab simultaneous rename to the same target to exercise the TOCTOU 409 path.
• Manual (admin page): rename another user with a deliberate collision → admin sees the parallel confirmation modal and the rename applies across their cohorts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
platform	Ready	Preview, Comment	Apr 13, 2026 11:20pm