v24.7.10: upgrader — survive the console tab closing before the post-install restart fires

Sponsor report (PapaSchlumpf, 2026-05-25): upgrading from 24.7.7 to
24.7.9 via the in-app console finishes the install but the dashboard
still shows the OLD version on every node. Closing the upgrade
console tab leaves the node at 24.7.7.

## Root cause

setup.sh ends with:

    nohup bash -c "sleep 3 && systemctl restart wolfstack" \
        >/dev/null 2>&1 &

The 3-second sleep gives the operator time to read the "**** UPGRADE
COMPLETE ****" + "Please Refresh your browser…" lines before the
service blinks. But the upgrade console is a pty spawned by
WolfStack itself; when the operator closes the browser tab, the
websocket closes, the pty is torn down, and every child in the pty
session is signalled. `nohup` only ignores SIGHUP — SIGTERM/SIGKILL
from cgroup teardown or session cleanup still land. If the operator
closes the tab within the 3 seconds, the pending restart dies with
the pty. The new binary is on disk; the service keeps running the
old one. Dashboard stays at 24.7.7.

PapaSchlumpf's screenshot shows the script reached "UPGRADE COMPLETE"
and "Please Refresh your browser if upgrading…" — exactly the
moment a reasonable operator closes the tab, before the 3-second
restart fires.

## Fix

Schedule the restart via a transient systemd timer so it's owned
by PID 1, not our pty shell. `systemd-run --on-active=3s` creates
a one-shot transient timer that fires in 3 seconds independently
of whatever spawned it — closing the browser tab cannot kill it.

Fallback for hosts without systemd-run (containers, minimal images):
`setsid bash -c "sleep 3 && systemctl restart wolfstack"
</dev/null >/dev/null 2>&1 &` — `setsid` puts the child in a new
session detached from the pty's controlling terminal, the best
a plain shell can do.

Applied to both setup.sh (the canonical installer) and
ibmsetup.sh (the IBM Cloud variant). Both are fetched fresh from
GitHub `master` by the upgrade console on every run, so once
this commit is on master the very next upgrade attempt picks up
the fix — PapaSchlumpf doesn't need to do anything manual to
recover, just re-run the upgrade from the console.

## Safety

  * `bash -n setup.sh` and `bash -n ibmsetup.sh` parse clean.
  * `cargo build` clean (2 pre-existing dead-code warnings unrelated).
  * If `systemd-run` itself fails for any reason (e.g. dbus down),
    the `||` falls back to `setsid` — same outcome as today,
    minus the SIGHUP immunity that nohup provided. setsid is
    strictly stronger than nohup against pty teardown.
  * The new binary is already on disk before the restart logic
    runs; if neither path fires the service, the operator's
    existing fallback ("sudo systemctl restart wolfstack" printed
    in the Manage section above) still works.

## Operator recovery

PapaSchlumpf can re-run the upgrade from the console — the 24.7.7
binary fetches a fresh setup.sh from master on every run, so the
fixed restart path kicks in immediately.

Author: Paul C

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wolfstack"
-version = "24.7.9"
+version = "24.7.10"
 edition = "2024"
 authors = ["Wolf Software Systems Ltd"]
 description = "Server management platform for the Wolf software suite"

ibmsetup.sh

@@ -1273,6 +1273,21 @@ echo ""
 echo "Please Refresh your browser if upgrading..."
 
 # ─── Restart service if upgrading (must be last!) ────────────────────────────
+#
+# See setup.sh for the rationale. PapaSchlumpf 2026-05-25:
+# closing the upgrade-console browser tab before the sleep
+# elapsed killed the pending restart along with the pty.
+# systemd-run is owned by PID 1, so the restart survives.
 if [ "$RESTART_SERVICE" = "true" ]; then
-    nohup bash -c "sleep 3 && systemctl restart wolfstack" &>/dev/null &
+    if command -v systemd-run >/dev/null 2>&1; then
+        systemd-run --quiet --no-block \
+            --on-active=3s \
+            --unit="wolfstack-self-restart-$$.timer" \
+            /bin/systemctl restart wolfstack >/dev/null 2>&1 || \
+        setsid bash -c "sleep 3 && systemctl restart wolfstack" \
+            </dev/null >/dev/null 2>&1 &
+    else
+        setsid bash -c "sleep 3 && systemctl restart wolfstack" \
+            </dev/null >/dev/null 2>&1 &
+    fi
 fi

setup.sh

@@ -2176,6 +2176,35 @@ echo ""
 echo "Please Refresh your browser if upgrading..."
 
 # ─── Restart service if upgrading (must be last!) ────────────────────────────
+#
+# Detach properly. PapaSchlumpf 2026-05-25: upgrading from 24.7.7 to
+# 24.7.9 via the in-app console, closing the browser tab before the
+# 3-second sleep elapsed killed the pending restart along with the
+# pty session — the new binary was installed but the service kept
+# running the old one, so the dashboard kept showing 24.7.7.
+#
+# `nohup ... &` is NOT enough. The console session is a pty spawned
+# by wolfstack itself; when the browser closes, wolfstack tears down
+# the pty and every child in its session/cgroup is signalled. `nohup`
+# only ignores SIGHUP, not SIGTERM/SIGKILL that come from cgroup
+# cleanup. Schedule via a transient systemd timer so the restart is
+# owned by PID 1 and cannot be killed by the pty closing.
+#
+# Fallback (no systemd-run) uses `setsid` to start a new session
+# detached from the pty plus full stdio redirection — the best a
+# plain shell can do.
 if [ "$RESTART_SERVICE" = "true" ]; then
-    nohup bash -c "sleep 3 && systemctl restart wolfstack" >/dev/null 2>&1 &
+    if command -v systemd-run >/dev/null 2>&1; then
+        # Transient one-shot timer owned by systemd; survives the pty
+        # closing because its parent is PID 1, not our shell.
+        systemd-run --quiet --no-block \
+            --on-active=3s \
+            --unit="wolfstack-self-restart-$$.timer" \
+            /bin/systemctl restart wolfstack >/dev/null 2>&1 || \
+        setsid bash -c "sleep 3 && systemctl restart wolfstack" \
+            </dev/null >/dev/null 2>&1 &
+    else
+        setsid bash -c "sleep 3 && systemctl restart wolfstack" \
+            </dev/null >/dev/null 2>&1 &
+    fi
 fi