AI OnAI Off
Because we run non-EPiServer content together with our site in this case, <episerver.framework> and <episerver.shell> are surrounded by <location> tags with the inheritInChildApplications="false" set to make sure sub-paths don't get any of the episerver stuff.
This causes any upgrade to fail, in the unlikely event that someone else gets the same problem as us.