sync: the client header said "desktop" from every phone, and named the wrong version

`client_headers()` built `thoughtsync-desktop/{CARGO_PKG_VERSION}`, and both
halves were wrong.

This crate is compiled into the Android app as well as the desktop one, so
every phone in the field announced itself as a desktop. And CARGO_PKG_VERSION
here is the CORE crate's version — a number no build stamps and no user has
ever seen — where the thing a reader of that header wants is the app's own
build (note 3127 §5: with no version tags, the artifact's self-report is the
only answer to "which build is this?").

The core cannot know either value, so the host says them. `set_client_agent`
is a OnceLock the desktop fills in `run()` and Android fills in
`ThoughtSyncApplication.onCreate`, before anything can sync. A host that never
introduces itself sends `thoughtsync-unidentified/unknown` rather than a
plausible default: nothing reads this header today, which is exactly why a
wrong value could sit in it for months — the first person to look at a server
log is the first who could catch it, and only if what they see is obviously a
host that never said who it was.

Android's version comes from the INSTALLED package, through a new
`Context.installedVersionName()` that the foot of the Sync screen now shares.
One answer to "which build is on this phone", so the line a person quotes in a
bug report and the line in the server's log cannot disagree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c

core/src/sync/compat.rs

@@ -17,6 +17,7 @@
 //! `docs/sync.md` for the policy that governs when those numbers move.
 
 use serde::{Deserialize, Serialize};
+use std::sync::OnceLock;
 
 /// The sync wire protocol this client speaks.
 ///
@@ -172,10 +173,41 @@ pub fn evaluate(info: &ServerInfo) -> Compatibility {
     }
 }
 
+/// Who this client says it is, set once by the host application at startup.
+///
+/// THE CORE CANNOT KNOW THIS, and the value it used to invent was wrong twice. It
+/// was `thoughtsync-desktop/{CARGO_PKG_VERSION}`, and this crate is compiled into
+/// the desktop app AND the Android app — so every phone in the field announced
+/// itself as a desktop. The version was worse: `CARGO_PKG_VERSION` here is the
+/// version of the CORE crate, a number no build stamps and no user has ever seen,
+/// while the thing a reader of that header wants is the app's own build (note 3127
+/// §5 — with no version tags, the artifact's self-report is the only answer to
+/// "which build is this?").
+///
+/// So the host names itself. `OnceLock` because identity is fixed for the life of
+/// the process and a second caller should be ignored rather than race the first.
+static CLIENT_AGENT: OnceLock<String> = OnceLock::new();
+
+/// Name this client for the servers it talks to — `("thoughtsync-android", "2026.08.31.1204")`.
+///
+/// Call once at startup, before any sync. Calling twice is not an error and the
+/// first name wins; not calling it at all is visible in the header rather than
+/// silently plausible.
+pub fn set_client_agent(name: &str, version: &str) {
+    let _ = CLIENT_AGENT.set(format!("{name}/{version}"));
+}
+
 /// Headers this client puts on every request to a linked server, so the server can
 /// log or gate on client identity without a separate handshake round-trip.
 pub fn client_headers() -> [(&'static str, String); 2] {
-    let agent = format!("thoughtsync-desktop/{}", env!("CARGO_PKG_VERSION"));
+    // `unidentified/unknown`, never a plausible default. Nothing reads this header
+    // today, which is exactly why a wrong value could sit in it for months: the
+    // first person to look at a server log is the first person who could catch it,
+    // and only if what they see is obviously a host that never introduced itself.
+    let agent = CLIENT_AGENT
+        .get()
+        .cloned()
+        .unwrap_or_else(|| "thoughtsync-unidentified/unknown".to_string());
     [
         ("X-ThoughtSync-Client", agent),
         (
@@ -374,10 +406,24 @@ mod tests {
 
     #[test]
     fn client_headers_identify_app_and_protocol() {
+        // Sets the process-wide agent, which is why this test also owns the
+        // assertion about it: a second test calling `set_client_agent` would race
+        // this one for the OnceLock, and whichever lost would see the other's name.
+        // One test, both branches, in order.
+        assert!(
+            client_headers()[0].1.starts_with("thoughtsync-unidentified/"),
+            "a host that never introduced itself must say so"
+        );
+
+        set_client_agent("thoughtsync-test", "2026.08.31.1204");
         let headers = client_headers();
         assert_eq!(headers[0].0, "X-ThoughtSync-Client");
-        assert!(headers[0].1.starts_with("thoughtsync-desktop/"));
+        assert_eq!(headers[0].1, "thoughtsync-test/2026.08.31.1204");
         assert_eq!(headers[1].1, CLIENT_PROTOCOL_VERSION.to_string());
+
+        // First name wins — a second host cannot rename a running process.
+        set_client_agent("thoughtsync-impostor", "0");
+        assert_eq!(client_headers()[0].1, "thoughtsync-test/2026.08.31.1204");
     }
 
     #[test]