Function replication_identity_overlap 

pub fn replication_identity_overlap(
    include: &[IdentityMatcher],
    exclude: &[IdentityMatcher],
    identities: &[ResolvedIdentity],
) -> Vec<String>

The destination-side identities (rendered as kopia’s username@hostname[:path]) that include/exclude would select — i.e. identities this replication would copy INTO while a destination policy also writes them directly. Empty means no overlap. Sorted and de-duplicated so the admission message (and any test) is deterministic.

use kopiur_api::common::ResolvedIdentity;
use kopiur_api::snapshot_replication::IdentityMatcher;
use kopiur_api::validate::replication_identity_overlap;

let dest = vec![ResolvedIdentity {
    username: "pg".into(),
    hostname: "billing".into(),
    source_path: Some("/pvc/data".into()),
}];
// An absent selection (empty include) selects everything → overlap.
assert_eq!(
    replication_identity_overlap(&[], &[], &dest),
    vec!["pg@billing:/pvc/data".to_string()],
);
// Excluding the identity clears it.
let exclude = vec![IdentityMatcher { username: Some("pg".into()), ..Default::default() }];
assert!(replication_identity_overlap(&[], &exclude, &dest).is_empty());