Tagged v0.4.3, ran the release pipeline, watched it land on PyPI. Customer pip-installed 0.4.3, ran VP.__version__, got '0.4.2'. Spent a confused minute checking I'd published the right tag.
The release script bumped pyproject.toml and the git tag. It did not bump src/veep/init.py. So the wheel was correctly labeled 0.4.3 in its package metadata, and the package's runtime self-report claimed 0.4.2. Two sources of truth, only one of which the release process touched.
Fixed by collapsing to one. pyproject.toml is canonical, the package now reads its version with importlib.metadata at import time. No internal string left to fall out of sync.