version: every surface can say which build it is, and two of them were lying

Note 3127 §5 removed version tags, so an artifact's self-report is now the only
answer to "which build is this?" — and nothing exists to contradict it when it
is wrong. Three surfaces gain a dim build line: the foot of the web rail, the
login screen, and the foot of Sync on Android.

The login screen because "I can't sign in" is a bug report like any other, and
requiring an account to read a build number withholds it from exactly the people
who can't get past that page. `/api/config` is already public.

Two of the values it was going to show were wrong, which is the part worth
knowing about.

The DESKTOP reported `env!("CARGO_PKG_VERSION")` from `config_get` and from the
startup log. `cargo tauri build --config '{"version": ...}'` overrides
tauri.conf.json, not Cargo's own metadata — so both read the literal `0.2.0` in
Cargo.toml, on every build ever shipped. They now read a display version baked in
by the lane through `option_env!`, hoisted to the crate root because two readers
of one fact is how this repo keeps producing 2181-2183. Not the ordering key
either: `1.0.<minutes>` is the opaque value Tauri's updater compares and must
never be shown to a person, and `update.rs` still reads it because a comparator
is exactly what it is (rule 149).

The SERVER fell back to `__version__` when APP_VERSION was absent, so a server
run from a checkout reported `0.2.0` — a real-looking version naming no build
anybody could obtain. `__init__.py` already asserted the honest answer was
"APP_VERSION being missing, which app.py already handles"; it did not, and a
comment claiming a behaviour two files away is how that stayed true-sounding.
Now an explicit "unknown", with the packaging version left where "unknown" is
not a legal value.

Android reads the INSTALLED package's versionName rather than BuildConfig, so it
reports what is actually on the phone.

Everything renders "unknown" rather than blank when it cannot say. A blank looks
like a layout bug; a plausible default cannot be caught by anything.

build.rs gets `rerun-if-env-changed` for the baked value: cargo does not track an
`option_env!` variable on its own, and the desktop lane having no cache today is
what makes that easy to forget the day one is added.

src/thoughtsync/__init__.py

@@ -1,10 +1,16 @@
 """ThoughtSync — self-hosted personal thought-capture web app (FabledSword family)."""
 
-# The FALLBACK version, used only when APP_VERSION is absent from the environment —
-# i.e. running from a checkout rather than from an image. A built image always has
-# it, derived from the server's own shipped file set (packaging/version.sh), so this
-# string never reaches a deployed instance and bumping it changes nothing a user
-# sees. Kept because a package needs a version and "unknown" is not a valid one for
-# packaging metadata; the honest "I cannot say" for a running server is APP_VERSION
-# being missing, which app.py already handles.
+# PACKAGING METADATA, and nothing else. Not the version any running server reports.
+#
+# A built image carries APP_VERSION in the environment, derived from the server's
+# own shipped file set (packaging/version.sh); `app.py` reads that and reports an
+# explicit "unknown" when it is absent, so this string never reaches a user and
+# bumping it changes nothing anybody sees.
+#
+# It exists because a Python package needs a version and "unknown" is not a legal
+# one here. It used to double as app.py's fallback, which meant a server run from a
+# checkout confidently reported `0.2.0` — a real-looking version naming no build
+# that exists. Note 3127 §5 is why that matters more than it reads: with version
+# tags gone, a build's self-report is the only answer to "which build is this?",
+# and there is nothing left to catch it lying.
 __version__ = "0.2.0"

src/thoughtsync/app.py

@@ -11,7 +11,6 @@ from datetime import timedelta
 from quart import Quart, jsonify, send_from_directory
 from quart.sessions import SecureCookieSessionInterface
 
-from . import __version__
 from .auth import bp as auth_bp
 from .client_dist import advertisement as client_advertisement, bp as client_bp
 from .config import Config
@@ -64,7 +63,20 @@ def create_app() -> Quart:
     # Ephemeral/env secret so the app (and DB-free unit tests) construct without a
     # database. before_serving swaps in the real, DB-persisted key before serving.
     app.secret_key = Config.secret_key_env() or secrets.token_urlsafe(48)
-    app.config["APP_VERSION"] = os.environ.get("APP_VERSION", __version__)
+    # The RUNNING build, or an explicit "unknown" — never the packaging fallback.
+    #
+    # This read `os.environ.get("APP_VERSION", __version__)`, so a server started
+    # from a checkout reported `0.2.0`: a real-looking version that names no build
+    # anybody could get. `__init__.py` already claimed the honest answer was
+    # "APP_VERSION being missing, which app.py already handles" — it did not, and a
+    # comment asserting a behaviour two files away from the code is how that stayed
+    # true-sounding for months.
+    #
+    # It matters more than it used to. Note 3127 §5 removed version tags, so this
+    # string is the only answer to "which build is this?" and nothing exists to
+    # contradict it when it is wrong. `__version__` stays where it belongs, as
+    # packaging metadata, which is the one place "unknown" is not a legal value.
+    app.config["APP_VERSION"] = os.environ.get("APP_VERSION") or "unknown"
     app.config["SESSION_COOKIE_HTTPONLY"] = True
     app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
     # Auto-mark the session cookie Secure on HTTPS requests (see the interface above).