Upgrade service should not be eternally disabled if it fails once

Made upgrade service restart if it fails, otherwise all upgrades cease forever if there's ever a single failure

Note: this one is going to trunk, which will be published publically