From time to time there are issues that during RPM package update
the new package would need to fix or clean up stuff
after the old package was removed.

See /usr/share/doc/packages/rpm/manual/triggers
for the order in which scripts are executed on a single
package upgrade, in particular (excerpt):
----------------------------------------------------------------------------
new-%pre      for new version of package being installed
...           (all new files are installed)
new-%post     for new version of package being installed
...
old-%preun    for old version of package being removed
...           (all old files are removed)
old-%postun   for old version of package being removed
----------------------------------------------------------------------------

Currently all RPM scriptlets of the new package are run before
the old package stuff is done (in particular before the files
of the old package get actually removed).

If there was a scriptlet in the new package that is run
after the old package stuff was done, that scriptlet could be used
to fix or clean up stuff at the very end of a package update.

Assume such a scriptlet is called "finalize".

It is run only by the new package after all stuff of the old package
was done so that the new workflow would be as follows:
----------------------------------------------------------------------------
new-%pre      for new version of package being installed
...           (all new files are installed)
new-%post     for new version of package being installed
...
old-%preun    for old version of package being removed
...           (all old files are removed)
old-%postun   for old version of package being removed

new-%finalize for new version of package being installed
----------------------------------------------------------------------------