chore(release): bring the version fields back into agreement (DOPE-601)

CLAUDE.md

@@ -290,11 +290,26 @@ The About modal renders it directly; the web build writes it into `version.json`
 **Bump `APP_VERSION` — never `package.json` alone.** Make the identical one-line
 edit in BOTH repos, and set `package.json.version` to the same value in both so
 they can't drift. Roles: `APP_VERSION` is what the user sees in the About dialog;
-`package.json.version` is what electron-builder stamps on the desktop binary and
-what the release tag `vX.Y.Z` must match. Bumping only `package.json` leaves the
-About dialog stuck on the old version — **this mistake shipped 4.2.7 and 4.2.8
-with About still showing 4.2.6.** If the two ever disagree, `APP_VERSION` is
-authoritative; fix it to match.
+`package.json.version` is what a local build stamps. Bumping only `package.json`
+leaves the About dialog stuck on the old version — **this mistake shipped 4.2.7
+and 4.2.8 with About still showing 4.2.6.** If those two disagree, `APP_VERSION`
+is authoritative; fix `package.json` to match.
+
+**The release tag must equal `APP_VERSION` too.** `release.yml` stamps the binary
+from the tag while About renders `APP_VERSION`, so tagging `v4.3.0` while
+`APP_VERSION` is 4.2.12 ships an installer named 4.3.0 whose About dialog says
+4.2.12 — the same failure in a different disguise. Check before tagging: a pushed
+tag cannot be "fixed to match".
+
+In the editor, electron-builder reads **`release/app/package.json`**, not the root
+one — `electron-builder.json` sets `directories.app` to `release/app`. The release
+workflow runs `npm version <tag>` at the root AND in `release/app`, so a
+*tag-triggered* release is always correct. Two cases are not: a LOCAL package
+build takes whatever `release/app/package.json` says, and a `workflow_dispatch`
+run with an empty `version` input falls back to root `package.json`
+(`release.yml`, version resolution). Use `npm version <v> --no-git-tag-version
+--allow-same-version` in both places rather than editing by hand: it updates each
+lockfile too, which hand edits miss (see DOPE-601).
 
 Release order: bump `APP_VERSION` + `package.json` (both repos, same value) → PR
 to `development` → merge → promote `development`→`main` on both → tag `vX.Y.Z` on

release/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-plc-editor",
-  "version": "4.2.2",
+  "version": "4.2.12",
   "description": "OpenPLC Editor - IDE capable of creating programs for the OpenPLC Runtime",
   "license": "MIT",
   "author": {

src/frontend/data/constants/app-version.ts

@@ -1,3 +1,3 @@
 /**
  * Single source of truth for the OpenPLC application version, SHARED
  * byte-for-byte between openplc-web and openplc-editor.
@@ -11,8 +11,10 @@
  * Consumers:
  *  - the About modal renders this directly (both apps);
  *  - the web build writes it into `version.json` (`version` field);
- *  - the editor's electron-builder reads `package.json.version`, kept equal
- *    to this value by `release.yml`.
+ *  - the editor's electron-builder reads `release/app/package.json`
+ *    (`electron-builder.json` sets `directories.app`), which `release.yml`
+ *    keeps equal to the tag — NOT this constant. Keep the tag equal to this
+ *    value, or the installer and the About dialog disagree.
  *
  * NOTE: this is the human-facing semver only. The web "force update" check
  * compares a per-deploy `BUILD_ID` (git commit SHA), not this version, so a