the download button stops 404ing, and stops needing a rebuild

FunctionStore_tools_2025.tox has not existed in the bucket since the
v3.0.0 rename -- every "Get FNSTools" button on the site pointed at a
404, in latest/ and in every pinned release alike. The bootstrap is
FNSTools.tox; publish.py and the manifest rails have said so all along.

The hrefs now use the latest/ aliases upload.py publishes for exactly
this, so a release cannot leave them serving stale bytes and a version
bump needs no site rebuild. Installs stay pinned: latest/ is the human
path, and the runtime fetch upgrades hrefs to the manifest's release
once the bucket sends CORS -- neither host does today.

Only the version label is stamped now. A stale label is cosmetic; it
sits beside a download that is still correct.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: function-store

website/README.md

@@ -197,22 +197,30 @@ published than the one the download links point at.
 
 ## Release links
 
-Download buttons are stamped with the published release at build time,
-read from the rolling manifest at
+Download buttons point at the **mutable `latest/` aliases**
+(`latest/FNSTools.tox`, `latest/FNS_Installer.tox`) that `upload.py`
+publishes beside each release. That is deliberate: a release cannot leave
+the buttons serving bytes that are no longer current, so **a version bump
+needs no site rebuild**. `latest/` is for humans only — installs still
+resolve pinned URLs from the manifest, because reproducible installs are
+what make bug reports correlatable (`publish.py`, "Never publish a mutable
+`latest/<Package>.tox`").
+
+Only the visible version **label** is stamped at build time, read from the
+rolling manifest at
 `https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/manifest.json`.
-If that fetch fails the build says so and keeps the release already in
-`index.html`, so the links always point at something real.
-
-The page also tries to refresh them at runtime, but **that fetch is
-currently blocked**: the r2.dev bucket sends no
-`Access-Control-Allow-Origin` header. Enabling CORS on the bucket would
-make the page self-update between deploys. Until then, re-run the build
-after each release.
-
-Note the artifact is still named `FunctionStore_tools_2025.tox` — the
-bucket path is already `fnstools`, but the `.tox` filenames have not been
-renamed. The filename is a constant in `index.html` and in
-`tools/build-site.mjs`; do not assume it tracks the brand.
+A stale label is cosmetic: it sits next to a download that is still
+correct. Rebuild after a release if you want the number to match.
+
+The page also tries to refresh label and hrefs at runtime, but **that fetch
+is currently blocked**: neither the r2.dev bucket nor
+`storage.functionstr.com` sends an `Access-Control-Allow-Origin` header.
+Enabling CORS on the bucket would make the label self-correcting and would
+upgrade the hrefs from `latest/` to the pinned release in the browser.
+
+The bootstrap artifact is `FNSTools.tox`, renamed from
+`FunctionStore_tools_2025.tox` in the v3.0.0 redesign. The filename is a
+constant in `index.html`; do not assume it tracks the brand.
 
 ## Brand assets
 

website/index.html

@@ -349,7 +349,7 @@
       <a href="#credits">Credits</a>
       <a href="https://patreon.com/function_store" target="_blank" rel="noopener">Patreon</a>
       <a class="btn btn-secondary" href="https://github.com/function-store/FunctionStore_tools" target="_blank" rel="noopener">GitHub</a>
-      <a class="btn btn-primary js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/v3.0.1/FunctionStore_tools_2025.tox" download>Get FNSTools<span class="js-fns-ver">v3.0.1</span> →</a>
+      <a class="btn btn-primary js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Get FNSTools<span class="js-fns-ver">v3.0.1</span> →</a>
     </nav>
   </div>
 </header>
@@ -364,7 +364,7 @@ <h1 class="hero-title">TouchDesigner,<br />minus the busywork.</h1>
       Take the whole toolkit or pick the three tools you actually want.
     </p>
     <div class="hero-cta">
-      <a class="btn btn-primary btn-lg js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/v3.0.1/FunctionStore_tools_2025.tox" download>Get FNSTools<span class="js-fns-ver">v3.0.1</span> →</a>
+      <a class="btn btn-primary btn-lg js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Get FNSTools<span class="js-fns-ver">v3.0.1</span> →</a>
       <a class="btn btn-secondary btn-lg" href="/docs/">Read the docs</a>
     </div>
     <ul class="hero-meta">
@@ -402,8 +402,8 @@ <h3>Drop one <code>.tox</code></h3>
           arrives empty — it carries the installer, the updater and nothing else yet.
           The container you drop <em>is</em> the install target.
         </p>
-        <a class="btn btn-primary js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/v3.0.1/FunctionStore_tools_2025.tox" download>Download<span class="js-fns-ver">v3.0.1</span></a>
-        <p class="path-note">Already have a toolkit container? Grab the <a class="js-fns-installer" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/v3.0.1/FNS_Installer.tox" download>bare installer</a> instead (~14 KB).</p>
+        <a class="btn btn-primary js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Download<span class="js-fns-ver">v3.0.1</span></a>
+        <p class="path-note">Already have a toolkit container? Grab the <a class="js-fns-installer" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNS_Installer.tox" download>bare installer</a> instead (~14 KB).</p>
         <p class="path-note">No download at all: <a href="/get/">pick your tools online</a> and paste one line into the Textport — it fetches and verifies everything itself.</p>
       </div>
       <div class="path">
@@ -437,7 +437,7 @@ <h2>Three steps, no setup files</h2>
     </div>
     <div class="quickstart">
       <ol>
-        <li>Drop <code>FunctionStore_tools_2025.tox</code> into the root (<code>/</code>) of a project.</li>
+        <li>Drop <code>FNSTools.tox</code> into the root (<code>/</code>) of a project.</li>
         <li>On the <code>FNS_Installer</code> inside it, pulse <strong>Pick Tools</strong>. On the first run it fetches the catalogue and tells you it is doing so.</li>
         <li>Pick your tools, hit <strong>Review install…</strong>, read the plan, hit <strong>Install</strong>. The packages land in the container you dropped.</li>
       </ol>
@@ -861,7 +861,7 @@ <h2 style="font-size: clamp(28px, 3.6vw, 36px); font-weight: 700; letter-spacing
       One <code>.tox</code>, then pick what you need. It is free, and it takes about a minute.
     </p>
     <div class="hero-cta">
-      <a class="btn btn-primary btn-lg js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/v3.0.1/FunctionStore_tools_2025.tox" download>Get FNSTools<span class="js-fns-ver">v3.0.1</span> →</a>
+      <a class="btn btn-primary btn-lg js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Get FNSTools<span class="js-fns-ver">v3.0.1</span> →</a>
       <a class="btn btn-secondary btn-lg" href="/docs/">Read the docs</a>
     </div>
   </div>
@@ -892,12 +892,15 @@ <h2 style="font-size: clamp(28px, 3.6vw, 36px); font-weight: 700; letter-spacing
   // make the page self-refresh between deploys. Either way the static hrefs
   // point at a release that exists.
   //
-  // The artifact is still named FunctionStore_tools_2025.tox: the bucket path
-  // is already `fnstools` but the .tox filenames have not been renamed yet.
-  // Read the name from here rather than assuming it matches the brand.
+  // The static hrefs point at latest/, the mutable human aliases upload.py
+  // publishes beside each release -- so a release never leaves the download
+  // buttons pointing at bytes that are no longer current, with no rebuild.
+  // Installs still resolve pinned: when the fetch below succeeds it upgrades
+  // every href to the release the manifest names, which is the reproducible
+  // URL. Until the bucket sends CORS the static latest/ href is what serves.
   (function () {
     var BASE = 'https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools';
-    var BOOTSTRAP = 'FunctionStore_tools_2025.tox';
+    var BOOTSTRAP = 'FNSTools.tox';
     var INSTALLER = 'FNS_Installer.tox';
 
     function setAll(sel, fn) {

website/tools/build-site.mjs

@@ -416,13 +416,17 @@ ${items}
       </div>`;
 }).filter(Boolean).join('\n');
 
-// The published release, stamped into the static hrefs at build time.
+// The published release, stamped into the version LABEL at build time.
 //
-// The page also refreshes these at runtime, but that fetch cannot be relied
-// on: the r2.dev bucket serves no Access-Control-Allow-Origin header, so the
-// browser blocks it (TDMap's site has the same silent failure). Stamping here
-// is what actually keeps the download links current — the runtime fetch only
-// helps if CORS is enabled on the bucket later.
+// The hrefs themselves are no longer stamped: they point at the mutable
+// latest/ aliases, so a release cannot leave them serving stale bytes even
+// if nobody rebuilds. Only the visible "v3.0.1" text is stamped, and it is
+// cosmetic — a stale label sits next to a download that is still correct.
+//
+// The page also refreshes both at runtime, but that fetch cannot be relied
+// on: neither the r2.dev bucket nor storage.functionstr.com serves an
+// Access-Control-Allow-Origin header, so the browser blocks it. Enabling
+// CORS on the bucket is what would make the label self-correcting too.
 async function publishedRelease() {
   // CI sets this. Without it the stamped release depends on what is published
   // at the moment the build runs, so a release cut between commit and CI would
@@ -461,20 +465,20 @@ if (fs.existsSync(landing)) {
     `$1${pages.length}$2`);
 
   if (live) {
-    out = out.replace(/(r2\.dev\/fnstools\/)v[^/"]+\//g, `$1${live.release}/`);
+    // Only the label. The hrefs stay on latest/ -- see publishedRelease().
     // No leading space: the span sits inside a .btn, which is inline-flex
     // with its own 8px gap, so one would render as a double space.
     out = out.replace(/(<span class="js-fns-ver">)[^<]*(<\/span>)/g,
       `$1${live.release}$2`);
-    console.log(`stamped release ${live.release} (${live.packages?.length ?? '?'} packages published)`);
+    console.log(`stamped label ${live.release} (${live.packages?.length ?? '?'} packages published)`);
     if (live.packages && live.packages.length !== pages.length) {
       console.log(`note: catalog has ${pages.length} packages but ${live.release} publishes ` +
         `${live.packages.length} — the site lists the catalog, so these align at the next publish`);
     }
   } else if (process.env.FNSTOOLS_NO_RELEASE_FETCH) {
-    console.log('release fetch skipped — download links keep the release already in index.html');
+    console.log('release fetch skipped — version label keeps whatever index.html already says');
   } else {
-    console.log('note: could not reach the release manifest — download links keep the release already in index.html');
+    console.log('note: could not reach the release manifest — version label keeps whatever index.html already says');
   }
   fs.writeFileSync(landing, out);
 } else {