This is a case of “it’s fine until it’s not” — people panic when the update fails in the UI and they don’t know to git pull; ./launcher rebuild app to work around the problem. This happens every time there is a change that invalidates the GUI update, I think. It happened again:
I feel like this panic highlights the value of having a consistent, normal update mechanism that avoids this experience.
At the same time, I encountered the also-infrequent case of the bootstrap breaking the running system: Zero-ish-downtime updates do occasionally break like this, once or twice a year maybe on average? So don’t delay between the bootstrap and the destroy/start.
I should update the text to make that clear, so I’ll do that next.