Auto-Upgrade and Delegated Upgrade Flow

This document describes how nodes upgrade themselves through Celery, how the delegated systemd unit is launched, and what to check if something fails.

Prerequisites

• ./env-refresh.sh has been run so /usr/local/bin/watch-upgrade exists and is executable.
• .locks/service.lck contains the managed service name (for example arthexis) so the watcher knows which unit to stop and restart.
• The service user can run systemd-run (with passwordless sudo when required).
• upgrade.sh remains executable in the project root.
• The Celery beat schedule is kept in sync with .locks/auto_upgrade.lck; when the lock is removed, the periodic task is removed as well, and any environment override set with ARTHEXIS_UPGRADE_FREQ is ignored unless it is a positive integer.
• Stable auto-upgrades run once per week on Thursday mornings before 5:00 AM, while latest runs daily at the same hour unless overridden with ARTHEXIS_UPGRADE_FREQ.