version: every surface can say which build it is, and two of them were lying

Note 3127 §5 removed version tags, so an artifact's self-report is now the only
answer to "which build is this?" — and nothing exists to contradict it when it
is wrong. Three surfaces gain a dim build line: the foot of the web rail, the
login screen, and the foot of Sync on Android.

The login screen because "I can't sign in" is a bug report like any other, and
requiring an account to read a build number withholds it from exactly the people
who can't get past that page. `/api/config` is already public.

Two of the values it was going to show were wrong, which is the part worth
knowing about.

The DESKTOP reported `env!("CARGO_PKG_VERSION")` from `config_get` and from the
startup log. `cargo tauri build --config '{"version": ...}'` overrides
tauri.conf.json, not Cargo's own metadata — so both read the literal `0.2.0` in
Cargo.toml, on every build ever shipped. They now read a display version baked in
by the lane through `option_env!`, hoisted to the crate root because two readers
of one fact is how this repo keeps producing 2181-2183. Not the ordering key
either: `1.0.<minutes>` is the opaque value Tauri's updater compares and must
never be shown to a person, and `update.rs` still reads it because a comparator
is exactly what it is (rule 149).

The SERVER fell back to `__version__` when APP_VERSION was absent, so a server
run from a checkout reported `0.2.0` — a real-looking version naming no build
anybody could obtain. `__init__.py` already asserted the honest answer was
"APP_VERSION being missing, which app.py already handles"; it did not, and a
comment claiming a behaviour two files away is how that stayed true-sounding.
Now an explicit "unknown", with the packaging version left where "unknown" is
not a legal value.

Android reads the INSTALLED package's versionName rather than BuildConfig, so it
reports what is actually on the phone.

Everything renders "unknown" rather than blank when it cannot say. A blank looks
like a layout bug; a plausible default cannot be caught by anything.

build.rs gets `rerun-if-env-changed` for the baked value: cargo does not track an
`option_env!` variable on its own, and the desktop lane having no cache today is
what makes that easy to forget the day one is added.

desktop/src-tauri/src/commands/local.rs

@@ -31,7 +31,9 @@ pub fn config_get(db: State<'_, Db>) -> PublicConfig {
     PublicConfig {
         site_name: "ThoughtSync".to_string(),
         allow_registration: false,
-        version: env!("CARGO_PKG_VERSION").to_string(),
+        // The build a person reads, baked at compile time — see crate::display_version
+        // for why this is neither CARGO_PKG_VERSION nor the updater's ordering key.
+        version: crate::display_version().to_string(),
         enable_url_unfurl: false,
         trash_retention_days: retention_days.max(0) as u32,
     }

desktop/src-tauri/src/lib.rs

@@ -13,6 +13,37 @@ mod commands;
 mod integration;
 mod update;
 
+/// The build a PERSON reads, baked in by the desktop lane at compile time.
+///
+/// Lives at the crate root because it has two readers — `config_get`, which puts it
+/// in the UI, and `log_environment`, which puts it in the log — and this repo has
+/// spent several issues on one fact held in two places (2181, 2182, 2183).
+///
+/// `option_env!`, not `env!`: a local `cargo tauri build` sets nothing, and this has
+/// to keep compiling. `None` becomes "unknown" at each call site rather than a
+/// plausible-looking default — note 3127 §5 makes this string the only answer to
+/// "which build is this?" now that there are no version tags, so there is nothing
+/// left to contradict it if it lies. An honest "I cannot say" is the only safe wrong
+/// answer.
+///
+/// NOT `CARGO_PKG_VERSION`, which both readers used to use, and which was wrong on
+/// every build ever shipped: `cargo tauri build --config '{"version": ...}'`
+/// overrides `tauri.conf.json`, not Cargo's own metadata, so the literal `0.2.0` in
+/// Cargo.toml is what reached the UI and the log regardless of what was built.
+///
+/// NOT the ordering key either. That value — `1.0.<minutes>`, which the override
+/// above does set — is the opaque value Tauri's updater compares; it lands in bundle
+/// filenames and `latest.json` and must never be shown to a person (#3144). Two
+/// values, two audiences. `update.rs` deliberately still reads the key, through
+/// `app.package_info().version`, because a comparator is exactly what it is.
+const DISPLAY_VERSION: Option<&str> = option_env!("THOUGHTSYNC_DISPLAY_VERSION");
+
+/// The baked build, or the honest "I cannot say". The only way in — the const is
+/// private so no caller can reach past the fallback.
+pub(crate) fn display_version() -> &'static str {
+    DISPLAY_VERSION.unwrap_or("unknown")
+}
+
 // The store and the sync engine live in the shared `thoughtsync-core` crate, which
 // the Android client binds through uniffi (Scribe note 2730). Aliased to their old
 // names so every call site below reads exactly as it did when they were modules of
@@ -219,8 +250,8 @@ fn log_event(level: String, message: String) {
 fn log_environment(app: &tauri::App) {
     use tauri::Manager;
     log::info!(
-        "ThoughtSync desktop v{} starting ({} {})",
-        env!("CARGO_PKG_VERSION"),
+        "ThoughtSync desktop {} starting ({} {})",
+        display_version(),
         std::env::consts::OS,
         std::env::consts::ARCH,
     );