Restart after upgrade is an operations decision, reporter restart_pending.

incus-lxcfs provides a FUSE filesystem that RUNNING containers use. Measured on gitlabrunner-1 on 24.09.2026: the unit has been running for 104 days and holds /var/lib/incus-lxcfs and /var/lib/lxcfs, with at least five running containers depending on it. A restart pulls the mounts out from under them. I HAD MISTAKENLY CLASSIFIED THIS UNIT AS A 'stateless observer' IN CLASS (1) and recommended removing .norestart; the measurement disproved that before it was implemented.

RULE (dh-s6 >= 1.2.4, POD "Choosing between .noenable and .norestart"):
.noenable answers "first installation", .norestart answers "upgrade of a
running service" -- two questions, two files. .noenable ALONE already suffices
against a start on first installation, because dh-s6 only touches what
'svctl isenabled || svctl isup' confirms. So this file is not here "just to be
safe", but because the TIMING of the outage belongs to operations.

The state it creates -- new package, old process -- is invisible without
help. It is reported by the field restart_pending in aep-zabbix-checks
(>= 0.4.5), per unit, with a WARNING trigger after 1 h. Whoever removes this
file takes the choice away from operations; whoever keeps it must watch the
reporter.

CAUTION, common mistake: .norestart does NOT protect against a restart by
s6-rc-update. Measured on 24.09.2026: a STRUCTURAL change (dependencies,
bundles) restarts the affected longruns, even those nobody changed anything
about -- a dependency change on keepalived took cron down with it. Therefore
an s6-policy bump on a hypervisor is a maintenance window, and this file does
not help against that.

This file is removed by dh_installs6 during the build and does NOT end up in
the package -- its content is pure documentation for the next session.
