[AbirAbbas]

Summary

Two bugs from a post-merge manual check of #1971 and #1977. The check drove the release binary through the desktop's Rust core and rendered the Devices screen.

1. sync.changed could arrive before hello (from #1971). The desktop refuses a connection whose first line isn't hello. One real start failed with first event is "sync.changed", expected "hello".

The backend is built on the appwire server before Serve sends hello. On a slow start, the 30-second idle sweep can run first, and its first sync-status read emits sync.changed.

appwire.Server now holds every frame queued before the hello and writes it right after, in order, so sequence numbers still follow write order. That guarantee holds for any early emitter, not just this one. A server closed without ever saying hello still writes what it held, which keeps TestSequenceNumbersAreConsecutiveAcrossGoroutines' behaviour.

2. The removal confirmation was in the past tense (from #1977). remove_line is shown before the person confirms, but it reused pair.ChatsRevokedLine: "Home was removed — it can no longer sync your chats…".

It now uses pair.ChatsRemoveLine: "Home will no longer sync your chats.", followed by the same warning about what removal can't undo. The devices.remove receipt and the terminal's codeaf devices remove keep the after-removal sentence.

Test plan

• New TestAnEventEmittedBeforeTheHelloFollowsIt: fails without the fix (line 0 = sync.changed seq 1, want hello seq 1); passes 5/5 under -race with it
• go test -race ./internal/appwire/: only the two known PROTOCOL.md failures, which are already on the app/v3 baseline list
• go test ./internal/pair/ ok
• go test -tags=engine ./cmd/codeaf -run '^(TestAppDevices|TestC[0-9]+App|TestAppNote|TestAnUnknownNote)' ok, including the updated remove_line assertions (it must differ from the receipt)
• go vet, gofmt clean
• CI gate (dispatched by hand; PRs into app/v3 do not trigger it)

The desktop side of the duplicated-receipt display is a separate codeaf-desk PR. It works with both the old and the new wording.

🤖 Generated with Claude Code

[AbirAbbas]

CI evidence, judged against a fresh app/v3 baseline (PRs into app/v3 don't trigger CI, so both were dispatched by hand):

• Full check on this branch (run 40419272253): 99 failing test names. app/v3 baseline Full at 1e254a7 (run 40419275937): 96 failing.
• Every failure on this branch except three is also in the baseline. The three are temp-folder cleanup flakes in packages this PR doesn't touch:
  • TestSeniorDevCustomShellModelNeedsKnownOrConfiguredCapacity/missing-window: TempDir RemoveAll cleanup … directory not empty. A different subtest of it flaked the same way on test(app): warm the sync status test's backend before its wire starts #1981's gate.
  • TestTheNodeDoorCommitsARunRowNotesKeyInTheStore (internal/session): TempDir RemoveAll cleanup … .git/worktrees/61: directory not empty.
• The PR gate (run 40418627054) tested no packages: a hand-dispatched gate only covers what HEAD~1 touched, which here was the change entry. Its only failure is lint in internal/factory/run/chatstage.go (reportCancel possible context leak), which is already failing on app/v3 and isn't touched here.