The one-click updater is now fail-safe.
A bad release can no longer break the app. Before ToneCommand restarts into an update, it proves the new code actually loads (imports and builds the app) in a throwaway check. If the pull, the reinstall, or that check fails, the checkout is reverted to the version that was already running and the failure is reported plainly. The working server is never stopped for code that has not been shown to start, and if a restart somehow does not come back, the page gives a clear recovery step instead of a blank error.
Everything from 1.2.1 (one-click hands-off updates) is included. Update from the banner or Settings with one click.