feat(cockpit-server): serve baked artifacts from the object store

cockpit/src/BodyHelix2.tsx

@@ -3,16 +3,22 @@
 // FMA v4 bake work — re-addressed cascade, laterality on the edge, vessel radii —
 // can NEVER regress the working /helix anatomy body.
 //
-// It differs from BodyHelix in exactly ONE line of behaviour: the manifest key.
-// /helix reads `helix_latest`; /helix2 reads `helix_v4_latest`. Both resolve
-// through the SAME loader, the SAME BSO2 ver-6 decoder and the SAME Signed360
-// shading, so a v4 bake is compared against v3 with the renderer held constant —
-// any visible difference is the BAKE, never the viewer.
+// It differs from BodyHelix in exactly ONE line of behaviour: WHERE the bake
+// comes from. /helix reads the manifest's `helix_latest` and the copy baked into
+// dist/ at image build; /helix2 reads `/api/bake/v4`, the artifact the server
+// hydrated from the object store at boot. Both resolve through the SAME loader,
+// the SAME BSO2 ver-6 decoder and the SAME Signed360 shading, so a v4 bake is
+// compared against v3 with the renderer held constant — any visible difference
+// is the BAKE, never the viewer.
 //
-// Until a v4 bake exists and `helix_v4_latest` is set in /body.manifest.json,
-// /helix2 says so verbatim (the CANONICAL-ONLY no-fallback rule below is
-// deliberately inherited: silently falling back to the v3 artifact would make
-// /helix2 a copy of /helix that LOOKS like a successful v4 render).
+// That split is what makes a NEW bake reachable without an image rebuild, and
+// it is deliberately ONE-SIDED: the deploy's own `BODY_BAKE_V4_*` variables are
+// the only names involved, and they are v4's alone — this route shares no
+// variable, directory, module, or line of code with /helix or with the map. Until a v4 bake
+// is hydrated, /helix2 reports what the server said (the CANONICAL-ONLY
+// no-fallback rule below is deliberately inherited: silently falling back to
+// the v3 artifact would make /helix2 a copy of /helix that LOOKS like a
+// successful v4 render).
 //
 // Nothing here writes: `helix_latest` is untouched, so /helix keeps working and
 // the release asset medcare-rs SHA256-pins stays exactly as published.
@@ -725,13 +731,35 @@ async function fetchSoa(): Promise<ArrayBuffer> {
     }
     return inflate(r);
   }
-  const key = scene ? `${scene}_latest` : 'helix_v4_latest';
+  // THE BAKE THIS DEPLOY SERVES HAS ONE NAME, AND THE SERVER HOLDS IT.
+  //
+  // `/api/bake/v4` is v4's own route, backed by v4's own module, v4's own
+  // directory and v4's own BODY_BAKE_V4_* variables. It cannot serve, fall back
+  // to, or be defaulted to the v3 bake — an earlier version defaulted to exactly
+  // that and would have rendered v3 here as if it were v4.
+  //
+  // The coordinates live ONLY in the server's environment. An earlier version
+  // also read a filename and tag from the manifest, so a deploy could satisfy
+  // one place and not the other and 404 with both halves looking correct.
+  if (!scene) {
+    const o = await fetch('/api/bake/v4').catch(() => null);
+    if (o && o.ok) return inflate(o);
+    const why = o ? await o.text().catch(() => `HTTP ${o.status}`) : 'the request failed';
+    throw new Error(`no v4 bake on this deploy: ${why}`);
+  }
+  // A named scene still resolves through the manifest — those bakes ship in
+  // dist/ and are not what the object-store hydrate is for.
+  const key = `${scene}_latest`;
   const stamped: string | undefined = man?.[key];
   if (!stamped) {
-    throw new Error(`no bake for scene="${scene ?? 'body'}" — set ${key} in /body.manifest.json (soabake → helix::encode_signed; osm → geo/osm_helix)`);
+    throw new Error(`no bake for scene="${scene}" — set ${key} in /body.manifest.json (soabake → helix::encode_signed; osm → geo/osm_helix)`);
   }
   const s = await fetch(`/${stamped}`).catch(() => null);
   if (s && s.ok) return inflate(s);
+  // The GitHub release. Kept last and expected to fail in a browser: the
+  // releases/download redirect sends no CORS header (see the Dockerfile note
+  // at the same asset). It is a fallback for same-origin contexts, not a
+  // working browser path.
   const rel = await fetch(`${REL}/${stamped}`);
   if (!rel.ok) throw new Error(`HTTP ${rel.status} fetching ${stamped}`);
   return inflate(rel);