fix(packaging): an upgrade must not stop and disable the agent — 0.1.9

dpkg calls the OLD package's prerm on an UPGRADE as well as on a removal (rpm passes a
remaining-instance count), and preremove.sh ran `systemctl disable --now monky-deployd.timer`
unconditionally. Upgrading env-dev-01 and env-dev-08 to 0.1.8 today stopped and disabled both
agents.

The failure is silent, which is the dangerous part: the box stays reachable, the containers keep
running, and nothing reports that check-ins have ceased — the backend just stops converging. A
fleet upgrade would have taken every agent offline at once and looked like a success.

preremove.sh now returns early for every upgrade shape (upgrade, failed-upgrade, deconfigure,
rpm's 1) and only disables on a real removal. postinstall.sh try-restarts the long-lived proxy
unit so it picks up the new code; the timer needs nothing, since each tick is a fresh process.

Tests drive the script with a fake systemctl on PATH and assert an upgrade touches no units.
OPERATIONS.md warns that a box coming FROM 0.1.8 or earlier still needs its timer re-enabled by
hand, because the old prerm has already run by then.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

packaging/scripts/postinstall.sh

@@ -22,6 +22,9 @@ if getent group ziti >/dev/null; then usermod -a -G ziti monky-deployd || true;
 /opt/monky-deployd/venv/bin/python -c 'import monky_deployd' || { echo "monky-deployd: venv unusable (python3 mismatch?)" >&2; exit 1; }
 if [ -d /run/systemd/system ]; then
   systemctl daemon-reload || true
-  # do NOT enable the timer here: install.sh / the ansible role do it after the config exists
+  # do NOT enable the timer here: install.sh / the ansible role do it after the config exists.
+  # An UPGRADE is different — the timer is already enabled and must keep running, so restart the
+  # long-lived proxy unit onto the new code. `try-restart` is a no-op when it is not running.
+  systemctl try-restart monky-deployd-proxy.service 2>/dev/null || true
 fi
 exit 0

packaging/scripts/preremove.sh

@@ -1,5 +1,14 @@
 #!/bin/sh
 set -e
+# dpkg calls the OLD package's prerm on an UPGRADE as well as on a removal, and rpm calls it with
+# an install count. Disabling the timer unconditionally therefore stopped the agent on every
+# upgrade and left it disabled — silently, because the box stays reachable and nothing else
+# notices that check-ins have ceased (env-dev-01 and env-dev-08, 2026-09-09).
+#   dpkg: "$1" is `remove`, `upgrade <new-version>`, `deconfigure …` or `failed-upgrade`
+#   rpm : "$1" is the number of instances that will remain — 1 on upgrade, 0 on uninstall
+case "${1:-}" in
+  upgrade | failed-upgrade | deconfigure | 1) exit 0 ;;
+esac
 if [ -d /run/systemd/system ]; then
   systemctl disable --now monky-deployd.timer 2>/dev/null || true
   systemctl disable --now monky-deployd-proxy.service 2>/dev/null || true