deploy(S4): Blender headless pipeline + WebAR client + backend fixes

backend/routes/xr_routes.py

@@ -245,8 +245,31 @@ async def spawn_model(request: SpawnModelRequest):
         logger.error(f"SF3D not provisioned: {e}")
         raise HTTPException(status_code=503, detail=str(e))
     except Exception as e:
-        logger.exception("Error spawning 3D model")
-        raise HTTPException(status_code=500, detail=str(e))
+        # A core feature must not hard-fail because a THIRD-PARTY space is down.
+        # Verified 2026-07-20: stabilityai/stable-fast-3d's /run_button raises an
+        # opaque AppError for every parameter combination, reproduced directly
+        # from a client outside this backend — their GPU inference is the fault,
+        # not our request (signature confirmed against their own view_api).
+        # Our procedural Blender Builder is fully operational, so degrade to it
+        # instead of returning a 500: the user still gets a model in the scene.
+        logger.warning(f"SF3D generation failed ({e}); falling back to procedural Builder.")
+        try:
+            result = await builder_generate(
+                BuilderRequest(description=request.description, persona=request.persona)
+            )
+            if isinstance(result, dict):
+                result = dict(result)
+                result["fallback"] = "procedural_builder"
+                result["fallback_reason"] = f"stable-fast-3d unavailable: {str(e)[:160]}"
+            return result
+        except HTTPException:
+            raise
+        except Exception as fallback_error:
+            logger.exception("Procedural Builder fallback also failed")
+            raise HTTPException(
+                status_code=502,
+                detail=f"SF3D unavailable ({str(e)[:120]}) and Builder fallback failed: {fallback_error}",
+            )
 
 @router.get("/model3d/health")
 async def check_health():

backend/services/automation_service.py

@@ -130,7 +130,16 @@ async def execute_action(action_type: str, action_data: dict):
                 "event": "system:notify",
                 "payload": {"message": "Initiating OMEGA Core upgrade sequence."}
             })
-            subprocess.Popen([sys.executable, "-m", "pip", "install", "--upgrade", "-r", "requirements.txt"], shell=True)
+            # NOTE: never shell out to pip from the shipped product. In the
+            # PyInstaller sidecar `sys.executable` IS the frozen exe (no pip
+            # module), so this silently failed; and requiring a user-visible
+            # package install is exactly what the product must never do —
+            # every runtime dependency is frozen into the sidecar at build time.
+            # Upgrades ship as a new signed installer, not a runtime pip call.
+            if getattr(sys, "frozen", False):
+                logging.info("auto_upgrade: packaged build — upgrades ship via the installer, skipping pip.")
+            else:
+                subprocess.Popen([sys.executable, "-m", "pip", "install", "--upgrade", "-r", "requirements.txt"])
     except Exception as e:
         logging.error(f"Failed to execute action {action_type}: {e}")