Problem

The update.sh fallback file downloader (used when no release archive is available) has two issues that can leave an installation in a mixed-version state, causing import tracebacks on next startup:

1. Silent download failures — individual file downloads that fail are swallowed by || true, so the update continues and completes "successfully" even when critical files are missing or stale.
2. Stale file leftovers — the rsync used to copy extracted archive contents into the install directory does not use
   --delete, so files removed in a newer release persist from the previous version and can cause mixed-version imports.

Once in this state, PegaProx crashes on startup with an unhelpful Python traceback (e.g. ModuleNotFoundError) with no guidance on how to recover.

There is also no way to validate installation integrity without fully launching the server.

Fix

1. Harden update.sh against partial updates

• Track per-file download failures instead of silently continuing.
• If any file fails to download, abort the update and restore from the pre-update backup.
• Add --delete to the rsync command so removed upstream files do not linger as stale leftovers.

2. Add startup blueprint integrity check

• Before registering blueprints, validate_blueprint_modules() verifies every required API module is importable via importlib.util.find_spec.
• If any modules are missing, startup raises a RuntimeError with an actionable message naming the missing modules and suggesting ./update.sh --force.
• app.py catches this specific error and prints a clean one-liner instead of a full traceback, then exits with code 1 for systemd/journal visibility.

3. Add --check-startup CLI preflight mode

• New --check-startup flag runs the integrity check and exits without launching services.
• Useful for CI, post-update validation, and manual troubleshooting.

Impact

• Partial updates no longer silently corrupt the install — update.sh now aborts and rolls back when any file download fails in fallback mode.
• Stale files from previous versions are cleaned up — rsync --delete ensures the install directory mirrors upstream exactly (user config, SSL, logs, and backups are still excluded).
• Startup failures are actionable — users see a clear error message with remediation steps instead of a raw Python traceback.
• Preflight validation without downtime — --check-startup lets operators verify installation integrity without starting the server.
• No new dependencies or config keys introduced.
• Unit tests included for both the module validation logic and the CLI preflight mode.

Files Changed