fix(desktop): sync tauri.conf.json version to the release tag, stop swallowing install failures

v0.1.1 was tagged but tauri.conf.json's own "version" field (what Tauri
bakes into the bundle filename/internal version) stayed at 0.1.0 — the
signed binary didn't match what latest.json claimed to describe, so every
update download failed signature verification. desktop-updater.ts's single
catch{} swallowed that identically to "offline", so it looked like nothing
happened at all. release.yml now syncs tauri.conf.json's version from the
git tag before building; the updater now logs a real post-accept failure
instead of silently reverting.

wiki/decisions/desktop-shell-tauri.md

@@ -232,3 +232,25 @@ The desktop bundle now runs in CI under **two distinct workflows** — keep the
     The unsigned CI build therefore overrides it off with
     `--config '{"bundle":{"createUpdaterArtifacts":false}}'` (a JSON patch merged over the config),
     so no `.sig` is attempted and no key is required. `release.yml` keeps the config default (signs).
+  - **Gotcha (tag ≠ tauri.conf.json version — found + fixed 2026-09-03, v0.1.1).** The git tag
+    (`v0.1.1`) and `tauri.conf.json`'s own `"version"` field are two independent values with nothing
+    syncing them. Tauri bakes `"version"` into the bundle filename, the app's internal version, AND
+    what the updater compares against — NOT the git tag. Bumping only the tag (as the release
+    procedure implied) left the file at the prior `0.1.0`: the signed binary was built and named as
+    `0.1.0`, `latest.json` (built from `TAG`) correctly claimed `0.1.1`, and the updater found an
+    "update," downloaded it, then failed signature verification against a manifest that didn't
+    actually describe the file it pointed at. Compounded by a second bug (below) that made this
+    failure completely invisible to the operator. **Fix:** `release.yml` now has a "Sync
+    tauri.conf.json version to the git tag" step (`sed`-patches `"version"` from `TAG` right before
+    `tauri build`) — the checked-in value is now only a placeholder for local dev builds; every real
+    release derives its version from the tag automatically.
+  - **Gotcha (silent updater failure — found + fixed 2026-09-03).** `desktop-updater.ts`'s
+    `checkForDesktopUpdate` wrapped the ENTIRE check-download-install-relaunch sequence in one
+    `catch {}` that swallowed everything, by design, for the offline/no-server case. But that meant
+    a REAL failure after the operator already accepted the prompt (bad signature, corrupted
+    download, disk/permission error) failed exactly the same way as "endpoint unreachable" — no
+    error, no log, the app just silently reverted to the old version and re-showed the same "update
+    available" prompt on next launch, forever. This is what actually surfaced the tag-sync bug
+    above (download traffic visible, then nothing). Fixed by nesting `downloadAndInstall()` in its
+    own try/catch that logs and rethrows — offline/no-update still no-ops silently (outer catch),
+    but a failure *after* the operator accepted now logs to the console instead of vanishing.

wiki/log.md

@@ -2754,3 +2754,16 @@ mirror-repo debugging session. Fixed by setting `VITE_API_BASE=http://127.0.0.1:
 `tauri.conf.json`'s `beforeBuildCommand`, overriding the shared `.env.production` for the desktop
 build only (process env wins in Vite's load order) — verified both builds independently. Full
 detail on [[desktop-shell-tauri]].
+
+## [2026-09-03] fix | Desktop updater silently failed: tag/version drift + swallowed install errors
+
+Two compounding bugs, both closed out on [[desktop-shell-tauri]] §"Desktop in CI": (1) the v0.1.1
+release bumped only the git tag — tauri.conf.json's own "version" field (what Tauri actually bakes
+into the bundle filename and internal version) stayed at 0.1.0, so the signed binary didn't match
+what latest.json claimed to describe, and signature verification failed on every download; (2)
+desktop-updater.ts's single blanket try/catch swallowed that failure identically to "offline/no
+update," so the operator saw the prompt, watched it download, then nothing — repeating forever with
+zero diagnostic trail. Fixed release.yml to sed-patch tauri.conf.json's version from the git tag
+right before building (checked-in value is now dev-only, never hand-maintained for releases), and
+split desktop-updater.ts's catch so a real post-accept failure logs instead of vanishing. Full
+detail on [[desktop-shell-tauri]].