fix(update): quiesce daemon before lifecycle lock

src/cli.rs

@@ -341,6 +341,9 @@ pub enum Commands {
         /// Lifecycle lease token passed only by the parent updater.
         #[arg(long, hide = true)]
         lifecycle_lease_token: Option<String>,
+        /// Service state captured before the parent updater stopped the daemon.
+        #[arg(long, hide = true)]
+        previous_daemon_state: Option<tracedecay::daemon::DaemonServiceState>,
     },
     /// Show or switch the update channel (stable or beta)
     #[command(long_about = CHANNEL_LONG_ABOUT, after_help = CHANNEL_AFTER_HELP)]

src/cli/parse_tests.rs

@@ -298,6 +298,7 @@ fn update_and_post_update_parse_no_heal_flag() {
             no_heal: true,
             no_reinstall: false,
             lifecycle_lease_token: None,
+            previous_daemon_state: None,
         })
     ));
     assert!(matches!(
@@ -306,6 +307,7 @@ fn update_and_post_update_parse_no_heal_flag() {
             no_heal: false,
             no_reinstall: false,
             lifecycle_lease_token: None,
+            previous_daemon_state: None,
         })
     ));
 }
@@ -362,6 +364,22 @@ fn upgrade_update_and_post_update_parse_no_reinstall_flag() {
             no_heal: false,
             no_reinstall: true,
             lifecycle_lease_token: None,
+            previous_daemon_state: None,
+        })
+    ));
+
+    let inherited_state = Cli::try_parse_from([
+        "tracedecay",
+        "post-update",
+        "--previous-daemon-state",
+        "running-enabled",
+    ])
+    .expect("post-update should accept the daemon state handed off by update");
+    assert!(matches!(
+        inherited_state.command,
+        Some(Commands::PostUpdate {
+            previous_daemon_state: Some(tracedecay::daemon::DaemonServiceState::RunningEnabled),
+            ..
         })
     ));
 

src/daemon/service.rs

@@ -1,10 +1,11 @@
-use std::fmt::Write;
+use std::fmt::{self, Write};
 #[cfg(target_os = "macos")]
 use std::os::unix::fs::PermissionsExt;
 #[cfg(unix)]
 use std::os::unix::net::UnixStream as StdUnixStream;
 use std::path::{Path, PathBuf};
 use std::process::Command;
+use std::str::FromStr;
 
 use crate::errors::{Result, TraceDecayError};
 
@@ -43,6 +44,35 @@ impl DaemonServiceState {
     }
 }
 
+impl fmt::Display for DaemonServiceState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::Missing => "missing",
+            Self::RunningEnabled => "running-enabled",
+            Self::RunningDisabled => "running-disabled",
+            Self::StoppedEnabled => "stopped-enabled",
+            Self::StoppedDisabled => "stopped-disabled",
+            Self::Masked => "masked",
+        })
+    }
+}
+
+impl FromStr for DaemonServiceState {
+    type Err = String;
+
+    fn from_str(value: &str) -> std::result::Result<Self, Self::Err> {
+        match value {
+            "missing" => Ok(Self::Missing),
+            "running-enabled" => Ok(Self::RunningEnabled),
+            "running-disabled" => Ok(Self::RunningDisabled),
+            "stopped-enabled" => Ok(Self::StoppedEnabled),
+            "stopped-disabled" => Ok(Self::StoppedDisabled),
+            "masked" => Ok(Self::Masked),
+            _ => Err(format!("unknown daemon service state '{value}'")),
+        }
+    }
+}
+
 impl DaemonServiceSpec {
     pub fn render_systemd_user_unit(&self) -> String {
         let service_path = daemon_service_path_env(&self.tracedecay_bin);

src/main.rs

@@ -620,12 +620,19 @@ async fn dispatch_command(command: Commands) -> tracedecay::errors::Result<()> {
             no_heal,
             no_reinstall,
             lifecycle_lease_token,
+            previous_daemon_state,
         } => {
             let lifecycle_lease = tracedecay::lifecycle_lease::acquire_exclusive_or_inherited(
                 "post-update",
                 lifecycle_lease_token.as_deref(),
             )?;
-            update_cmd::run_post_update_tasks(no_heal, no_reinstall, &lifecycle_lease).await?;
+            update_cmd::run_post_update_tasks(
+                no_heal,
+                no_reinstall,
+                &lifecycle_lease,
+                previous_daemon_state,
+            )
+            .await?;
         }
         Commands::Channel { channel } => match channel {
             Some(target) => {

src/startup_tests.rs

@@ -36,6 +36,7 @@ fn explicit_agent_config_commands_skip_startup_maintenance() {
         no_heal: false,
         no_reinstall: false,
         lifecycle_lease_token: None,
+        previous_daemon_state: None,
     }));
     assert!(should_skip_startup_maintenance(&Commands::Uninstall {
         agent: Some("kiro".to_string()),
@@ -101,6 +102,7 @@ fn agent_install_maintenance_is_selective() {
             no_heal: false,
             no_reinstall: false,
             lifecycle_lease_token: None,
+            previous_daemon_state: None,
         }
     ));
     // Also skip for uninstall (about to remove configs) and doctor (a