_shortcuts() {
    for h in /home/*; do
        [ -d "$h" ] || continue
        u=$(basename "$h"); id "$u" >/dev/null 2>&1 || continue
        d="$h/Desktop"; [ -d "$d" ] || mkdir -p "$d" 2>/dev/null || continue
        cp -f /usr/share/applications/codesk.desktop "$d/codesk.desktop" 2>/dev/null || true
        chmod 0755 "$d/codesk.desktop" 2>/dev/null || true
        chown "$u:" "$d/codesk.desktop" 2>/dev/null || true
        su - "$u" -c "gio set '$d/codesk.desktop' metadata::trusted true" 2>/dev/null || true
    done
}
_teardown_service() {
    # Mirror the .deb prerm: stop+disable+remove the root pre-login system unit
    # (else it keeps respawning `codesk --service` from the old inode after the
    # payload is removed), each user's per-user unit, and any leftover process.
    systemctl disable --now codesk-system.service 2>/dev/null || true
    rm -f /etc/systemd/system/codesk-system.service 2>/dev/null || true
    systemctl daemon-reload 2>/dev/null || true
    for h in /home/*; do
        [ -d "$h" ] || continue
        u=$(basename "$h"); id "$u" >/dev/null 2>&1 || continue
        uid=$(id -u "$u" 2>/dev/null) || continue
        su - "$u" -c "XDG_RUNTIME_DIR=/run/user/$uid systemctl --user disable --now codesk.service" 2>/dev/null || true
        rm -f "$h/.config/systemd/user/codesk.service" 2>/dev/null || true
    done
    pkill -x codesk 2>/dev/null || true
}
post_install() { _shortcuts; update-desktop-database -q 2>/dev/null || true; }
post_upgrade() {
    _shortcuts
    systemctl is-active --quiet codesk-system.service 2>/dev/null && systemctl restart codesk-system.service 2>/dev/null || true
}
pre_remove()   { _teardown_service; }
post_remove()  { for h in /home/*; do rm -f "$h/Desktop/codesk.desktop" 2>/dev/null || true; done; update-desktop-database -q 2>/dev/null || true; }
