[Frontend] Version-truth residuals from PR #1956: telemetry appVersion literal (already wrong), duplicated root derivation, demo-build stamp decision

[Chris0Jeky]

Residuals from the PR #1956 review (fresh-context pass, 2026-08-22). #1956 fixed the sidebar (#1948); these are the adjacent version-truth surfaces it deliberately did not absorb.

1. telemetryStore.appVersion is a hand-maintained literal and already wrong

frontend/taskdeck-web/src/store/telemetryStore.ts:158 ships appVersion: '0.1.0' ("Will be set from build config in future") on every telemetry event (api/telemetryApi.ts:32, pinned by two specs). The shipped release is v0.1.1 — the exact misattribution failure mode #1948 was about, on a reporting surface. Fix: source it from useProductVersion (or the same /health/live truth), with a null-safe fallback that omits the field rather than lying.

2. Server-root derivation is duplicated

api/versionApi.ts resolveApiRoot() copies the regex from composables/useBoardRealtime.ts:22-26 verbatim. Extract a shared utils/apiRoot.ts consumed by both so the two cannot drift (the #1956 fix round adds a pure apiRootFrom() + table test — move it there and point the hub at it).

3. Demo build renders no version at all (recorded trade-off)

The Pages demo builds with VITE_API_BASE_URL: '' → demo-mode short-circuit → empty footer. Internally consistent ("no version beats a wrong version") but the public demo is where beta testers file reports. If wanted: a build-time Vite define stamped from the tag is not a hand-maintained literal and would cover the demo. Decision, not a defect.

Acceptance criteria

• Telemetry events carry the real product version or omit the field; the '0.1.0' literal is gone; specs updated.
• One shared root-derivation util consumed by versionApi + useBoardRealtime, table-tested.
• Maintainer decision recorded on the demo-build version (define-stamp vs stay empty).

Refs: #1948, PR #1956 review thread, tracker #1947.

[Chris0Jeky]

Coordinator disposition (2026-09-06, Codex-session PR carried under the standing D-12 route: fresh-context review, MEDIUM+ fixed in-PR, merged as a merge commit).

PR #2744 (Unify frontend API root normalization) merged as 2a8c45a15, review SHIP, nothing fixed in-PR. LOWs: the moved regex lost versionApi's testability rationale; the VITE_API_BASE_URL || 'http://localhost:5000/api' default is still duplicated in five files (worth its own issue); resolveHubUrl exported solely for the spec and the ['/', '/'] row codifies the pre-existing protocol-relative //hubs/boards shape.