diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 854a858..1c2d0c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,3 +51,20 @@ jobs:
           name: coverage-updater
           path: updater/coverage.out
           retention-days: 30
+
+  # The macOS restart path (launchctl, the daemon's IPC socket) runs natively
+  # here. launchctl and the daemon are fakes: TestMain stubs both, and the
+  # exec-level test puts a script launchctl alone on PATH.
+  test-macos:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Run tests
+        run: go test -race ./...
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 29014ef..2ad99b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **macOS: the daemon is restarted onto the new binaries only when launchd
+  runs it, and the restart is confirmed.** Before, the updater ran `launchctl
+  kickstart -k gui/<uid>/network.pilotprotocol.pilot-daemon` blindly and
+  reported success as soon as launchctl returned. It now reads the job with
+  `launchctl print` first and kickstarts it only when the job is running and
+  its program is the `pilot-daemon` that was just replaced. It then waits (up
+  to 60 s) for launchd to run a new process and for that process to answer
+  over IPC (`info`) with the installed version. Otherwise the daemon is left
+  running and `restart_error` says why and how to restart it: no launchd job
+  runs it (started by hand), the job runs another binary, kickstart failed,
+  launchd did not start the job again, or the new daemon did not answer with
+  the installed version in time. A daemon that is not running is not an
+  error: its next start uses the new binary. The old `com.vulturelabs.*`
+  label and the `user/<uid>` domain are found too, and under `sudo` the
+  invoking user's domain (`SUDO_UID`) is used.
+- **macOS: a one-shot update (`pilotctl update`) that replaces
+  `pilot-updater` restarts the updater service** (launchd job
+  `network.pilotprotocol.pilot-updater`) after the daemon, so the service
+  runs the new binary instead of the old one until the next login. It is
+  restarted only when its program is the replaced binary, and never when the
+  caller is the service itself. The result is recorded in
+  `updater_restart_error` / `updater_restarted_at`.
+- A one-shot update that replaced `pilot-updater` (every release does) now
+  records the daemon restart it made. Before, `restart_error` from an earlier
+  run was kept even though this run restarted the daemon.
+- On macOS a check clears `restart_error` once the daemon answers over IPC
+  with the installed version, as Linux already did from `/proc`. Before, it
+  stayed until the next release. The daemon is only asked while a
+  `restart_error` is on record.
+- Writers of `update-state.json` keep the fields they do not define. The
+  file is shared by `pilotctl update` and the updater service, which can run
+  different updater versions. On a macOS runner the freshly restarted
+  updater service (updater v0.2.5, from v1.13.10) rewrote the file 40 ms
+  after `pilotctl update` and dropped `daemon_restarted_*` and
+  `updater_restarted_at`. From this version on, an older writer passes newer
+  fields through. v0.2.5 and earlier still drop them.
+
+### Added
+
+- `daemon_restarted_at`, `daemon_restarted_by` and `daemon_restarted_version`
+  in `update-state.json`: when the updater last restarted the daemon onto new
+  binaries and saw it come back, which service manager did it (`launchd
+  gui/501/network.pilotprotocol.pilot-daemon`, `systemd pilot-daemon.service`)
+  and, on macOS, the version the daemon reported.
+- `updater_restart_error` and `updater_restarted_at` in `update-state.json`
+  (see above).
+
+### Changed
+
+- The updater now connects to the daemon's IPC socket (the job's `-socket`
+  argument, default `/tmp/pilot.sock`) to read its version on macOS. It still
+  runs no external tool other than `launchctl`, now `print` as well as
+  `kickstart`.
+
+## [v0.2.5] - 2026-09-24
+
 ### Added
 
 - `update-state.json` status file written after every check (`Config.StatusPath`,
diff --git a/README.md b/README.md
index 95aab45..6e8b118 100644
--- a/README.md
+++ b/README.md
@@ -48,23 +48,33 @@ if st.RestartError != "" {
 
 `RunOnce` returns the check's error. It never exits the calling process. If
 the release replaced `pilot-updater`, the daemon is still restarted onto the
-new binaries. A running updater service switches to its new binary the next
-time its service manager restarts it.
+new binaries. On macOS the updater service (launchd job
+`network.pilotprotocol.pilot-updater`) is then restarted onto the new
+`pilot-updater` as well. On Linux a running updater service switches to its
+new binary the next time systemd restarts it.
 
 A `RunOnce` caller writes the status file only when it sets `StatusPath` (or
-`StatePath`); otherwise only `LastStatus()` has the result. **`pilotctl
-update` does not do this yet.** As of web4 `main` on 2026-09-24,
-`cmd/pilotctl/updates.go` sets neither path and ignores the error `RunOnce`
-returns. So manual updates are not recorded in `update-state.json`, and a
-failed `pilotctl update` still prints success and exits 0. That stays true
-until pilotctl passes `StatusPath: ~/.pilot/update-state.json` and checks the
-error, which needs a web4 change after this version is released.
+`StatePath`); otherwise only `LastStatus()` has the result. `pilotctl update`
+(web4 `cmd/pilotctl/updates.go`, since updater v0.2.5) passes
+`StatusPath: ~/.pilot/update-state.json` and exits non-zero when `RunOnce`
+returns an error.
 
 ### Restarting the daemon
 
-After installing new binaries the updater restarts the daemon onto them:
-
-- **macOS:** `launchctl kickstart -k gui/<uid>/network.pilotprotocol.pilot-daemon`.
+After installing new binaries the updater restarts the daemon onto them, but
+only when a service manager will start it again:
+
+- **macOS:** `launchctl kickstart -k gui/<uid>/network.pilotprotocol.pilot-daemon`,
+  but only when that launchd job runs the daemon. The updater reads the job
+  with `launchctl print` and kickstarts it only when it is running and its
+  program is the `pilot-daemon` that was just replaced. launchd sends the
+  daemon SIGTERM (its graceful shutdown stops the apps it runs) and starts
+  the job again on the new binary, whatever its `KeepAlive` policy. The
+  updater then waits up to 60 s for launchd to run a new process and for that
+  process to answer over IPC (`info`, on the job's `-socket`) with the
+  installed version. The old `com.vulturelabs.pilot-daemon` label and the
+  `user/<uid>` domain are found too; under `sudo` the invoking user's
+  (`SUDO_UID`) domain is used.
 - **Linux:** SIGTERM, but only when systemd will start the daemon again. The
   daemon must run as the main program (`ExecStart=`) of a system service whose
   unit restarts it after a clean exit. pilot-daemon exits 0 on SIGTERM, so
@@ -73,6 +83,28 @@ After installing new binaries the updater restarts the daemon onto them:
   not run `systemctl`. After the SIGTERM it waits up to 30 s for a new daemon
   process on the new binary.
 
+On macOS the daemon is left running the old version, with `restart_error`
+saying how to restart it, when:
+
+- no launchd job runs it: it was started by hand (`pilot-daemon ...`) while
+  the job was not loaded, or the job is loaded but runs no process. The
+  updater tells this from a daemon answering on the socket with an older
+  version. When no daemon answers, it is not running and its next start uses
+  the new binary, which is not an error;
+- the job starts another `pilot-daemon` (a second installation), so a
+  restart would not run the new release.
+
+It is also reported when `launchctl kickstart` fails, when launchd does not
+start the job again, or when the new daemon does not answer with the
+installed version within 60 s.
+
+When a one-shot `RunOnce` (`pilotctl update`) replaced `pilot-updater`, it
+restarts the updater job `network.pilotprotocol.pilot-updater` the same way,
+after the daemon and only when the job runs the replaced binary. It never
+restarts itself: the loop (`Start`) exits instead, and launchd starts it
+again (`KeepAlive`). The result goes to `updater_restart_error` /
+`updater_restarted_at`.
+
 On Linux the daemon is left running the old version, with `restart_error`
 saying how to restart it, when:
 
@@ -121,12 +153,14 @@ set, it goes next to the control file. For a standard install that is
 set, nothing is written.
 
 The long-running updater and any one-shot `RunOnce` caller configured with
-the same path share the file. `pilotctl update` does not pass one yet (see
-above). Each writer takes an advisory lock on `update-state.json.lock` and
+the same path share the file, as the updater service and `pilotctl update`
+do. Each writer takes an advisory lock on `update-state.json.lock` and
 merges its fields into what is already there, so concurrent writers from
 different processes do not lose each other's changes. Writes are atomic
 (temp file + rename). A writer that cannot get the lock within 5 s writes
-anyway and logs a warning.
+anyway and logs a warning. A writer keeps the fields it does not define, so
+an older updater sharing the file (for example the updater service while a
+newer `pilotctl` runs) does not drop fields a newer one wrote.
 
 ```json
 {
@@ -142,6 +176,9 @@ anyway and logs a warning.
   "latest_version": "v1.13.10",
   "last_update_at": "2026-09-01T12:35:40Z",
   "last_update_version": "v1.13.9",
+  "daemon_restarted_at": "2026-09-01T12:35:47Z",
+  "daemon_restarted_by": "launchd gui/501/network.pilotprotocol.pilot-daemon",
+  "daemon_restarted_version": "v1.13.9",
   "loop_pid": 812,
   "loop_started_at": "2026-09-20T08:11:02Z",
   "next_check_at": "2026-09-24T11:00:12Z"
@@ -155,7 +192,9 @@ anyway and logs a warning.
 | `consecutive_failures` | Failed checks since the last success. |
 | `last_success_at` | The last check that completed without error. |
 | `current_version` / `latest_version` | The installed release, and the release it was compared against (the pin, when pinned). |
-| `restart_error` | New binaries were installed but the daemon is not running them. Either it was left on the old version because stopping it would have left it down (see [Restarting the daemon](#restarting-the-daemon)) or the restart failed, or it was stopped and did not come back. Says how to restart it. Cleared by the next successful restart, and on Linux by the next check that finds the daemon running the installed binary. |
+| `restart_error` | New binaries were installed but the daemon is not running them. Either it was left on the old version because stopping it would have left it down (see [Restarting the daemon](#restarting-the-daemon)) or the restart failed, or it was stopped and did not come back. Says how to restart it. Cleared by the next successful restart, and by the next check that finds the daemon running the installed release (Linux: from `/proc`; macOS: the daemon's IPC `info` version). |
+| `daemon_restarted_at`, `daemon_restarted_by`, `daemon_restarted_version` | The last restart the updater made that brought the daemon back on new binaries, the service manager and job that did it, and (macOS) the version the daemon then reported over IPC. |
+| `updater_restart_error`, `updater_restarted_at` | macOS only: a one-shot update replaced `pilot-updater` and could not (error) or did (time) restart the updater service's launchd job onto it. |
 | `loop_pid`, `loop_started_at` | The long-running updater process. |
 | `next_check_at` | When the loop wakes next. It is updated even while auto-update is disabled, so it doubles as a heartbeat. |
 
@@ -210,9 +249,11 @@ The SHA-256 match against the attested `checksums.txt` still gates every install
 
 The updater never runs `gh` or any other external tool. It checks the SLSA
 provenance of `checksums.txt` in-process with sigstore-go
-(`attestation.go`). The only command it runs is `launchctl kickstart`, which
-restarts the daemon under launchd on macOS. On Linux it reads `/proc` and the
-systemd unit files directly instead of running `systemctl`.
+(`attestation.go`). The only command it runs is `launchctl` (`print` and
+`kickstart`), which reads and restarts the daemon and updater jobs under
+launchd on macOS. It asks the daemon for its version over its IPC socket
+directly. On Linux it reads `/proc` and the systemd unit files directly
+instead of running `systemctl`.
 `TestNoExternalToolDependency` fails the build if another exec is added.
 
 ### Nodes stuck on v1.12.2–v1.13.4 (updater v0.2.3)
@@ -253,6 +294,7 @@ because that switches off provenance checks.
 |---|---|
 | `updater.go` | `Updater`: check loop, `RunOnce`, release polling, install, daemon restart. |
 | `supervisor.go` | Linux restart safety: finds the daemon's systemd service and checks its restart policy before any SIGTERM. |
+| `launchd.go` | macOS restart: finds the daemon and updater launchd jobs (`launchctl print`), kickstarts them and confirms the daemon's version over IPC. |
 | `download.go` | Resumable asset downloads with idle and total-duration limits. |
 | `github.go` | GitHub API calls: optional `GITHUB_TOKEN`, rate-limit errors. |
 | `attestation.go` | In-process SLSA provenance verification of `checksums.txt` (sigstore-go). |
diff --git a/launchd.go b/launchd.go
new file mode 100644
index 0000000..aac3cee
--- /dev/null
+++ b/launchd.go
@@ -0,0 +1,560 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package updater
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/common/driver"
+)
+
+// Restarting the daemon on macOS.
+//
+// install.sh runs the daemon as the LaunchAgent
+// network.pilotprotocol.pilot-daemon (KeepAlive SuccessfulExit=false) and the
+// updater as network.pilotprotocol.pilot-updater (KeepAlive true). After an
+// update the updater restarts the daemon with
+//
+//	launchctl kickstart -k gui/<uid>/network.pilotprotocol.pilot-daemon
+//
+// launchd sends the running daemon SIGTERM (its graceful shutdown stops the
+// apps it runs) and starts the job again, which execs the new binary.
+// kickstart restarts the job whatever its KeepAlive policy says.
+//
+// That is only safe, and only useful, when launchd runs this daemon. So the
+// updater first reads the job with `launchctl print` and restarts it only when
+// the job is running and its program is the binary that was just replaced.
+// Afterwards it waits for launchd to run a new process and for that process to
+// answer over IPC with the installed version. Otherwise, as on Linux, the
+// daemon is left running and restart_error in the status file says why and
+// how to restart it:
+//
+//   - no launchd job is loaded (the daemon was started by hand, or not at
+//     all): a daemon that answers on the socket with an older version is
+//     reported; one that does not answer is not running, and its next start
+//     uses the new binary;
+//   - the job starts another pilot-daemon (a second installation): restarting
+//     it would not run the new release;
+//   - the job did not come back, or the new process did not answer with the
+//     installed version in time.
+//
+// A one-shot RunOnce (`pilotctl update`) that replaced pilot-updater also
+// restarts the updater job, so the updater service runs the new binary too.
+// The loop never restarts its own job: it exits and launchd starts it again.
+
+// Labels of the LaunchAgents install.sh writes, current first. install.sh
+// renamed com.vulturelabs.* to network.pilotprotocol.*; pilotctl and the
+// uninstaller still accept the old names, and so does the updater.
+var (
+	daemonLaunchdLabels  = []string{"network.pilotprotocol.pilot-daemon", "com.vulturelabs.pilot-daemon"}
+	updaterLaunchdLabels = []string{"network.pilotprotocol.pilot-updater", "com.vulturelabs.pilot-updater"}
+)
+
+const (
+	// defaultLaunchdRestartWait bounds how long the updater waits, after
+	// `launchctl kickstart -k`, for launchd to start the job again and (for
+	// the daemon) for the new daemon to answer over IPC. The daemon's
+	// shutdown takes up to ~5 s, and a daemon that starts installed apps
+	// first can take well over 10 s to open its socket (`pilotctl daemon
+	// start` waits 30 s for it).
+	defaultLaunchdRestartWait = 60 * time.Second
+
+	// daemonProbeTimeout bounds one IPC info call, so a wedged daemon cannot
+	// hang the updater.
+	daemonProbeTimeout = 3 * time.Second
+)
+
+// launchdJob is the part of `launchctl print <target>` the updater uses.
+type launchdJob struct {
+	target  string   // domain/label, e.g. gui/501/network.pilotprotocol.pilot-daemon
+	state   string   // "running", "not running", "spawn scheduled", ...
+	program string   // "program = ..." (the executable launchd starts)
+	args    []string // "arguments = { ... }"
+	pid     int      // 0 when no process is running
+	// lastExit is "last exit code = ..." (or "last exit reason"), for messages.
+	lastExit string
+}
+
+// programPath is the executable the job starts.
+func (j launchdJob) programPath() string {
+	if j.program != "" {
+		return j.program
+	}
+	if len(j.args) > 0 {
+		return j.args[0]
+	}
+	return ""
+}
+
+// socket is the daemon's IPC socket: the -socket argument of the job, or the
+// daemon's default.
+func (j launchdJob) socket() string {
+	return socketFromArgs(j.args)
+}
+
+// describe summarises the job's state for error messages.
+func (j launchdJob) describe() string {
+	s := "state = " + orNone(j.state)
+	if j.pid > 0 {
+		s += fmt.Sprintf(", pid = %d", j.pid)
+	}
+	if j.lastExit != "" {
+		s += ", last exit = " + j.lastExit
+	}
+	return s
+}
+
+func orNone(s string) string {
+	if s == "" {
+		return "unknown"
+	}
+	return s
+}
+
+// socketFromArgs returns the value of the daemon's -socket flag in args (Go
+// flag syntax: -socket X, --socket X, -socket=X), or the daemon's default
+// socket when the flag is absent.
+func socketFromArgs(args []string) string {
+	for i := 1; i < len(args); i++ {
+		a := args[i]
+		switch {
+		case a == "-socket" || a == "--socket":
+			if i+1 < len(args) {
+				return args[i+1]
+			}
+		case strings.HasPrefix(a, "-socket="):
+			return strings.TrimPrefix(a, "-socket=")
+		case strings.HasPrefix(a, "--socket="):
+			return strings.TrimPrefix(a, "--socket=")
+		}
+	}
+	return driver.DefaultSocketPath()
+}
+
+// parseLaunchdPrint parses the output of `launchctl print <domain>/<label>`:
+//
+//	gui/501/network.pilotprotocol.pilot-daemon = {
+//		active count = 1
+//		path = /Users/u/Library/LaunchAgents/network.pilotprotocol.pilot-daemon.plist
+//		state = running
+//		program = /Users/u/.pilot/bin/pilot-daemon
+//		arguments = {
+//			/Users/u/.pilot/bin/pilot-daemon
+//			-socket
+//			/tmp/pilot.sock
+//		}
+//		pid = 812
+//		last exit code = 0
+//		resource coalition = {
+//			state = active
+//		}
+//	}
+//
+// Only keys of the job itself (depth 1) are read: nested blocks repeat names
+// such as "state". ok is false when out is not a job description.
+func parseLaunchdPrint(out string) (job launchdJob, ok bool) {
+	depth := 0
+	inArgs := false
+	for _, raw := range strings.Split(out, "\n") {
+		line := strings.TrimSpace(raw)
+		if line == "" {
+			continue
+		}
+		if depth == 0 {
+			// The header: "<target> = {".
+			if !strings.HasSuffix(line, "= {") {
+				return launchdJob{}, false
+			}
+			depth = 1
+			continue
+		}
+		if line == "}" {
+			depth--
+			inArgs = false
+			if depth == 0 {
+				break
+			}
+			continue
+		}
+		if inArgs {
+			job.args = append(job.args, line)
+			continue
+		}
+		key, value, hasEq := strings.Cut(line, " = ")
+		opens := strings.HasSuffix(line, "{")
+		if depth == 1 && hasEq {
+			switch key {
+			case "state":
+				job.state = value
+			case "program":
+				job.program = value
+			case "pid":
+				job.pid, _ = strconv.Atoi(value)
+			case "last exit code", "last exit reason":
+				if job.lastExit == "" {
+					job.lastExit = value
+				}
+			case "arguments":
+				if opens {
+					inArgs = true
+					depth++
+					continue
+				}
+			}
+		}
+		if opens {
+			depth++
+		}
+	}
+	if job.programPath() == "" {
+		return launchdJob{}, false
+	}
+	return job, true
+}
+
+// launchctl runs launchctl through the injectable command hook. It is the
+// only external command the updater runs.
+func (u *Updater) launchctl(args ...string) ([]byte, error) {
+	return u.command("launchctl", args...)
+}
+
+// uid is the user whose launchd domains hold the Pilot jobs.
+func (u *Updater) uid() int {
+	if u.getuid != nil {
+		return u.getuid()
+	}
+	return os.Getuid()
+}
+
+// launchdDomains lists the launchd domains to look for the Pilot jobs in, in
+// order: the login session (gui/<uid>), where install.sh and `pilotctl daemon
+// start` load them, then the background session (user/<uid>). Under sudo
+// (uid 0) the invoking user's domains come first.
+func (u *Updater) launchdDomains() []string {
+	uids := []int{u.uid()}
+	if uids[0] == 0 {
+		if s := os.Getenv("SUDO_UID"); s != "" {
+			if n, err := strconv.Atoi(s); err == nil && n > 0 {
+				uids = []int{n, 0}
+			}
+		}
+	}
+	var domains []string
+	for _, id := range uids {
+		domains = append(domains, fmt.Sprintf("gui/%d", id), fmt.Sprintf("user/%d", id))
+	}
+	return domains
+}
+
+// printLaunchdJob reads target with `launchctl print`. ok is false when the
+// job is not loaded there (or launchctl is unavailable).
+func (u *Updater) printLaunchdJob(target string) (launchdJob, bool) {
+	out, err := u.launchctl("print", target)
+	if err != nil {
+		return launchdJob{}, false
+	}
+	job, ok := parseLaunchdPrint(string(out))
+	if !ok {
+		return launchdJob{}, false
+	}
+	job.target = target
+	return job, true
+}
+
+// findLaunchdJob returns the first loaded job with one of labels, looking in
+// every domain of launchdDomains.
+func (u *Updater) findLaunchdJob(labels []string) (launchdJob, bool) {
+	for _, label := range labels {
+		for _, domain := range u.launchdDomains() {
+			if job, ok := u.printLaunchdJob(domain + "/" + label); ok {
+				return job, true
+			}
+		}
+	}
+	return launchdJob{}, false
+}
+
+// launchdWait is how long to wait for a job restarted with kickstart -k.
+func (u *Updater) launchdWait() time.Duration {
+	if u.restartWait > 0 {
+		return u.restartWait
+	}
+	return defaultLaunchdRestartWait
+}
+
+// pollInterval is the pause between checks while waiting for a restart.
+func (u *Updater) pollInterval() time.Duration {
+	if u.restartPoll > 0 {
+		return u.restartPoll
+	}
+	return defaultRestartPoll
+}
+
+// pause sleeps for d. It returns false when the updater was stopped.
+func (u *Updater) pause(d time.Duration) bool {
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+	select {
+	case <-timer.C:
+		return true
+	case <-u.stopCh:
+		return false
+	}
+}
+
+// waitForLaunchdRespawn waits until launchd runs a process for target other
+// than oldPid, and returns its pid.
+func (u *Updater) waitForLaunchdRespawn(target string, oldPid int, deadline time.Time) (int, error) {
+	last := "not loaded"
+	for {
+		if job, ok := u.printLaunchdJob(target); ok {
+			if job.pid > 0 && job.pid != oldPid {
+				return job.pid, nil
+			}
+			last = job.describe()
+		} else {
+			last = "not loaded"
+		}
+		if !time.Now().Before(deadline) {
+			return 0, fmt.Errorf("launchd shows %s", last)
+		}
+		if !u.pause(u.pollInterval()) {
+			return 0, fmt.Errorf("updater stopped while waiting (launchd shows %s)", last)
+		}
+	}
+}
+
+// probeDaemonVersion asks the daemon listening on socket for its version (IPC
+// info). running reports whether a daemon answered on the socket; version is
+// "" when the info call failed or timed out. Tests replace it so they never
+// reach a real daemon.
+var probeDaemonVersion = func(socket string) (version string, running bool) {
+	d, err := driver.Connect(socket)
+	if err != nil {
+		return "", false
+	}
+	ch := make(chan string, 1)
+	go func() {
+		info, err := d.Info()
+		v := ""
+		if err == nil {
+			v, _ = info["version"].(string)
+		}
+		ch <- v
+	}()
+	timer := time.NewTimer(daemonProbeTimeout)
+	defer timer.Stop()
+	select {
+	case v := <-ch:
+		_ = d.Close()
+		return v, true
+	case <-timer.C:
+		_ = d.Close() // unblocks the Info call
+		return "", true
+	}
+}
+
+// probe asks the daemon on socket for its version via the injectable hook.
+func (u *Updater) probe(socket string) (string, bool) {
+	if u.probeFn != nil {
+		return u.probeFn(socket)
+	}
+	return probeDaemonVersion(socket)
+}
+
+// installedVersion is the release recorded in InstallDir/.pilot-version, or
+// "" when there is none.
+func (u *Updater) installedVersion() string {
+	data, err := os.ReadFile(filepath.Join(u.config.InstallDir, ".pilot-version"))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+// sameRelease reports whether two version strings name the same release
+// ("v1.13.10" and "1.13.10" do). A version that does not parse, such as a
+// "dev" build, matches nothing.
+func sameRelease(a, b string) bool {
+	va, errA := ParseSemver(a)
+	vb, errB := ParseSemver(b)
+	return errA == nil && errB == nil && va.Compare(vb) == 0
+}
+
+// runsInstalled reports whether a daemon that answered with version runs the
+// installed release. With no installed version recorded, any answer counts.
+func runsInstalled(version, installed string) bool {
+	return installed == "" || sameRelease(version, installed)
+}
+
+func versionOrUnknown(v string) string {
+	if v == "" {
+		return "unknown version"
+	}
+	return v
+}
+
+// waitForDaemonVersion waits until the daemon on socket answers with the
+// installed version, and returns the version it reported.
+func (u *Updater) waitForDaemonVersion(socket, installed string, deadline time.Time) (string, error) {
+	last := "no daemon answered"
+	for {
+		ver, running := u.probe(socket)
+		if running && runsInstalled(ver, installed) {
+			return ver, nil
+		}
+		if running {
+			last = "the daemon answered with " + versionOrUnknown(ver)
+		}
+		if !time.Now().Before(deadline) {
+			return "", fmt.Errorf("%s", last)
+		}
+		if !u.pause(u.pollInterval()) {
+			return "", fmt.Errorf("updater stopped while waiting (%s)", last)
+		}
+	}
+}
+
+// daemonNotUnderLaunchd handles a daemon that launchd does not run: why says
+// how the launchd job was found. A daemon answering on socket with another
+// version is left running and reported; one that does not answer is not
+// running, and its next start uses the new binary.
+func (u *Updater) daemonNotUnderLaunchd(socket, installed, why string) restartOutcome {
+	ver, running := u.probe(socket)
+	switch {
+	case !running:
+		slog.Info("daemon not running; its next start uses the new binary", "socket", socket, "launchd", why)
+		return restartOutcome{}
+	case sameRelease(ver, installed):
+		slog.Info("daemon already runs the installed version", "version", ver, "socket", socket)
+		return restartOutcome{}
+	}
+	slog.Warn("daemon not restarted onto the new binary: launchd does not run it", "socket", socket, "version", ver, "launchd", why)
+	return restartOutcome{err: fmt.Errorf(
+		"daemon on %s left running the old version (%s): %s, so nothing would start it again after a stop; restart it with: pilotctl daemon stop && pilotctl daemon start",
+		socket, versionOrUnknown(ver), why)}
+}
+
+// signalDaemonRestartDarwin restarts the daemon through its launchd job and
+// confirms the new daemon answers with the installed version. See the comment
+// at the top of this file for when it leaves the daemon running instead.
+func (u *Updater) signalDaemonRestartDarwin() restartOutcome {
+	daemonPath := filepath.Join(u.config.InstallDir, "pilot-daemon")
+	installed := u.installedVersion()
+
+	job, found := u.findLaunchdJob(daemonLaunchdLabels)
+	if !found {
+		return u.daemonNotUnderLaunchd(driver.DefaultSocketPath(), installed,
+			fmt.Sprintf("no launchd job %s is loaded in %s", daemonLaunchdLabels[0], strings.Join(u.launchdDomains(), " or ")))
+	}
+	if job.pid == 0 {
+		return u.daemonNotUnderLaunchd(job.socket(), installed,
+			fmt.Sprintf("the launchd job %s is loaded but runs no process (%s)", job.target, job.describe()))
+	}
+	if !sameFile(job.programPath(), daemonPath) {
+		slog.Warn("daemon not restarted: its launchd job runs another binary", "target", job.target, "program", job.programPath(), "updated", daemonPath)
+		return restartOutcome{err: fmt.Errorf(
+			"daemon (pid %d) not restarted: the launchd job %s runs %q, not the updated %s, so a restart would not run the new release; re-run install.sh, which points the job at %s, then restart it with: launchctl kickstart -k %s",
+			job.pid, job.target, job.programPath(), daemonPath, daemonPath, job.target)}
+	}
+	if job.pid == os.Getpid() {
+		return restartOutcome{err: fmt.Errorf("daemon (pid %d) not restarted: the updater runs inside it; restart it with: launchctl kickstart -k %s", job.pid, job.target)}
+	}
+
+	oldPid, socket := job.pid, job.socket()
+	wait := u.launchdWait()
+	deadline := time.Now().Add(wait)
+	slog.Info("restarting daemon via launchd", "target", job.target, "pid", oldPid)
+	if out, err := u.launchctl("kickstart", "-k", job.target); err != nil {
+		output := strings.TrimSpace(string(out))
+		slog.Warn("launchctl kickstart failed — restart daemon manually", "target", job.target, "err", err, "output", output)
+		return restartOutcome{err: fmt.Errorf("restart daemon (launchctl kickstart -k %s): %v %s", job.target, err, output)}
+	}
+	newPid, err := u.waitForLaunchdRespawn(job.target, oldPid, deadline)
+	if err != nil {
+		slog.Error("launchd did not start the daemon again", "target", job.target, "error", err)
+		return restartOutcome{err: fmt.Errorf(
+			"sent launchctl kickstart -k %s (daemon pid %d), but launchd did not start the daemon again within %s (%v); check `launchctl print %s` and the daemon log, and start it with: launchctl kickstart %s",
+			job.target, oldPid, wait, err, job.target, job.target)}
+	}
+	ver, err := u.waitForDaemonVersion(socket, installed, deadline)
+	if err != nil {
+		slog.Error("restarted daemon did not answer with the installed version", "target", job.target, "pid", newPid, "socket", socket, "error", err)
+		want := installed
+		if want == "" {
+			want = "its version"
+		}
+		return restartOutcome{err: fmt.Errorf(
+			"launchd restarted the daemon (pid %d -> %d) but it did not answer on %s with %s within %s (%v); check the daemon log and restart it with: launchctl kickstart -k %s",
+			oldPid, newPid, socket, want, wait, err, job.target)}
+	}
+	slog.Info("daemon restarted on the new binary", "target", job.target, "pid", newPid, "version", ver)
+	return restartOutcome{restarted: true, by: "launchd " + job.target, version: ver}
+}
+
+// restartUpdaterService restarts the updater service onto a pilot-updater
+// binary that this process replaced. It is used by a one-shot RunOnce: the
+// loop exits instead, and its service manager starts it again. Only the macOS
+// launchd job is restarted. attempted is false when there was nothing to
+// restart: no updater job runs the replaced binary, or this process is the
+// job.
+func (u *Updater) restartUpdaterService() (restartOutcome, bool) {
+	if u.targetOS() != "darwin" {
+		slog.Info("pilot-updater binary replaced; a running updater service uses it after its next restart")
+		return restartOutcome{}, false
+	}
+	updaterPath := filepath.Join(u.config.InstallDir, "pilot-updater")
+	job, found := u.findLaunchdJob(updaterLaunchdLabels)
+	switch {
+	case !found:
+		slog.Info("pilot-updater binary replaced; no launchd updater job is loaded")
+		return restartOutcome{}, false
+	case job.pid == 0:
+		slog.Info("pilot-updater binary replaced; the launchd updater job runs no process and starts the new binary next", "target", job.target)
+		return restartOutcome{}, false
+	case job.pid == os.Getpid():
+		return restartOutcome{}, false
+	case !sameFile(job.programPath(), updaterPath):
+		slog.Warn("updater service not restarted: its launchd job runs another binary", "target", job.target, "program", job.programPath(), "updated", updaterPath)
+		return restartOutcome{err: fmt.Errorf(
+			"updater service %s (pid %d) not restarted: it runs %q, not the updated %s; re-run install.sh, which points the job at %s",
+			job.target, job.pid, job.programPath(), updaterPath, updaterPath)}, true
+	}
+
+	wait := u.launchdWait()
+	deadline := time.Now().Add(wait)
+	slog.Info("restarting updater service via launchd", "target", job.target, "pid", job.pid)
+	if out, err := u.launchctl("kickstart", "-k", job.target); err != nil {
+		output := strings.TrimSpace(string(out))
+		return restartOutcome{err: fmt.Errorf("restart updater service (launchctl kickstart -k %s): %v %s", job.target, err, output)}, true
+	}
+	newPid, err := u.waitForLaunchdRespawn(job.target, job.pid, deadline)
+	if err != nil {
+		return restartOutcome{err: fmt.Errorf(
+			"sent launchctl kickstart -k %s (updater pid %d), but launchd did not start the updater again within %s (%v); start it with: launchctl kickstart %s",
+			job.target, job.pid, wait, err, job.target)}, true
+	}
+	slog.Info("updater service restarted on the new binary", "target", job.target, "pid", newPid)
+	return restartOutcome{restarted: true, by: "launchd " + job.target}, true
+}
+
+// daemonOnInstalledVersionDarwin reports whether the daemon answers over IPC
+// with the installed version.
+func (u *Updater) daemonOnInstalledVersionDarwin() bool {
+	installed := u.installedVersion()
+	if installed == "" {
+		return false
+	}
+	socket := driver.DefaultSocketPath()
+	if job, ok := u.findLaunchdJob(daemonLaunchdLabels); ok {
+		socket = job.socket()
+	}
+	ver, running := u.probe(socket)
+	return running && sameRelease(ver, installed)
+}
diff --git a/status.go b/status.go
index 5ca8cb6..030e8c9 100644
--- a/status.go
+++ b/status.go
@@ -3,12 +3,16 @@
 package updater
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
 	"os"
 	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
 	"syscall"
 	"time"
 )
@@ -82,13 +86,34 @@ type Status struct {
 	LastUpdateVersion string    `json:"last_update_version,omitempty"`
 	// RestartError is set when new binaries were installed but the daemon
 	// is not running them: it was left on the old version, or it was
-	// stopped and did not come back. It says how to restart it. On Linux the
-	// updater stops the daemon only when systemd will start it again, so a
-	// daemon without such a service (e.g. `pilotctl daemon start` in a
-	// container) is left running and reported here. Cleared by the next
-	// successful restart and, on Linux, by the next check that finds the
-	// daemon running the installed binary.
+	// stopped and did not come back. It says how to restart it. The updater
+	// stops the daemon only when a service manager will start it again: a
+	// systemd service on Linux, the launchd job on macOS. A daemon without
+	// one (e.g. `pilotctl daemon start` in a container) is left running and
+	// reported here. Cleared by the next successful restart and by the next
+	// check that finds the daemon running the installed release.
 	RestartError string `json:"restart_error,omitempty"`
+	// DaemonRestartedAt is when the updater last restarted the daemon onto
+	// installed binaries and saw it come back: a new process on the
+	// installed binary under systemd (Linux), or a new launchd process that
+	// answered over IPC with the installed version (macOS).
+	DaemonRestartedAt time.Time `json:"daemon_restarted_at,omitzero"`
+	// DaemonRestartedBy names the service that restarted it, e.g.
+	// "launchd gui/501/network.pilotprotocol.pilot-daemon" or
+	// "systemd pilot-daemon.service".
+	DaemonRestartedBy string `json:"daemon_restarted_by,omitempty"`
+	// DaemonRestartedVersion is the version the daemon reported over IPC
+	// after that restart (macOS; empty on Linux).
+	DaemonRestartedVersion string `json:"daemon_restarted_version,omitempty"`
+
+	// UpdaterRestartError is set when a one-shot update (RunOnce, e.g.
+	// `pilotctl update`) replaced pilot-updater but could not move the
+	// running updater service (the macOS launchd job) onto it. Cleared by the
+	// next successful restart.
+	UpdaterRestartError string `json:"updater_restart_error,omitempty"`
+	// UpdaterRestartedAt is when a one-shot update last restarted the
+	// updater service onto a new pilot-updater binary.
+	UpdaterRestartedAt time.Time `json:"updater_restarted_at,omitzero"`
 
 	// LoopPID and LoopStartedAt identify the long-running updater process
 	// (the service started via Start). Absent when no loop ever ran.
@@ -103,15 +128,50 @@ type Status struct {
 // returns an error satisfying errors.Is(err, fs.ErrNotExist), which callers
 // should read as "the updater has never recorded a check here".
 func ReadStatus(path string) (Status, error) {
+	s, _, err := readStatus(path)
+	return s, err
+}
+
+// statusFields is the set of JSON keys Status defines.
+var statusFields = func() map[string]bool {
+	fields := map[string]bool{}
+	t := reflect.TypeOf(Status{})
+	for i := 0; i < t.NumField(); i++ {
+		name, _, _ := strings.Cut(t.Field(i).Tag.Get("json"), ",")
+		if name == "" {
+			name = t.Field(i).Name
+		}
+		fields[name] = true
+	}
+	return fields
+}()
+
+// readStatus loads the status file and also returns the fields in it that
+// this version's Status does not define (written by a newer updater), so a
+// read-merge-write can keep them.
+func readStatus(path string) (Status, map[string]json.RawMessage, error) {
 	var s Status
 	data, err := os.ReadFile(path)
 	if err != nil {
-		return s, err
+		return s, nil, err
 	}
 	if err := json.Unmarshal(data, &s); err != nil {
-		return Status{}, fmt.Errorf("parse %s: %w", path, err)
+		return Status{}, nil, fmt.Errorf("parse %s: %w", path, err)
+	}
+	var all map[string]json.RawMessage
+	if json.Unmarshal(data, &all) != nil {
+		return s, nil, nil
+	}
+	var extra map[string]json.RawMessage
+	for k, v := range all {
+		if !statusFields[k] {
+			if extra == nil {
+				extra = map[string]json.RawMessage{}
+			}
+			extra[k] = v
+		}
 	}
-	return s, nil
+	return s, extra, nil
 }
 
 // statusPath returns where this updater records its status, or "" when it
@@ -148,6 +208,10 @@ func (u *Updater) updateStatus(mutate func(*Status)) {
 
 	path := u.statusPath()
 	base := u.status
+	// Fields on disk that this version does not know, written by a newer
+	// updater sharing the file (e.g. a newer pilotctl than the updater
+	// service). They are written back unchanged.
+	var extra map[string]json.RawMessage
 	if path != "" {
 		wait := u.statusLockWait
 		if wait <= 0 {
@@ -155,8 +219,8 @@ func (u *Updater) updateStatus(mutate func(*Status)) {
 		}
 		unlock := lockStatusFile(path, wait)
 		defer unlock()
-		if onDisk, err := ReadStatus(path); err == nil {
-			base = onDisk
+		if onDisk, unknown, err := readStatus(path); err == nil {
+			base, extra = onDisk, unknown
 		}
 	}
 	mutate(&base)
@@ -167,7 +231,7 @@ func (u *Updater) updateStatus(mutate func(*Status)) {
 	if path == "" {
 		return
 	}
-	if err := writeStatusFile(path, base); err != nil {
+	if err := writeStatus(path, base, extra); err != nil {
 		slog.Warn("failed to write update status file", "path", path, "error", err)
 	}
 }
@@ -219,7 +283,47 @@ func lockStatusFile(path string, wait time.Duration) (unlock func()) {
 // writeStatusFile writes s to path atomically (temp file + rename in the same
 // directory) so a reader never sees a torn file.
 func writeStatusFile(path string, s Status) error {
+	return writeStatus(path, s, nil)
+}
+
+// marshalStatus renders s as indented JSON followed by the extra fields (ones
+// this version's Status does not define), in key order.
+func marshalStatus(s Status, extra map[string]json.RawMessage) ([]byte, error) {
 	data, err := json.MarshalIndent(s, "", "  ")
+	if err != nil || len(extra) == 0 {
+		return data, err
+	}
+	keys := make([]string, 0, len(extra))
+	for k := range extra {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	body := bytes.TrimRight(bytes.TrimSuffix(data, []byte("}")), "\n")
+	sep := ","
+	if bytes.Equal(bytes.TrimSpace(body), []byte("{")) {
+		sep = ""
+	}
+	var b bytes.Buffer
+	b.Write(body)
+	for _, k := range keys {
+		var v bytes.Buffer
+		if json.Indent(&v, extra[k], "  ", "  ") != nil {
+			continue
+		}
+		name, _ := json.Marshal(k)
+		b.WriteString(sep + "\n  ")
+		b.Write(name)
+		b.WriteString(": ")
+		b.Write(v.Bytes())
+		sep = ","
+	}
+	b.WriteString("\n}")
+	return b.Bytes(), nil
+}
+
+// writeStatus writes s, plus extra fields, to path atomically.
+func writeStatus(path string, s Status, extra map[string]json.RawMessage) error {
+	data, err := marshalStatus(s, extra)
 	if err != nil {
 		return err
 	}
@@ -261,12 +365,15 @@ type checkOutcome struct {
 	// updaterReplaced reports that the pilot-updater binary itself was
 	// swapped, so the running updater process is now stale.
 	updaterReplaced bool
-	// restartErr is the error from restarting the daemon onto the new
-	// binaries, if that failed.
-	restartErr error
+	// restart is the daemon restart this check made (nil = none: nothing
+	// was installed, or the loop left it to its successor process).
+	restart *restartOutcome
+	// updaterRestart is the updater service restart this check made (nil =
+	// none).
+	updaterRestart *restartOutcome
 	// daemonCurrent reports that, with nothing installed by this check, the
-	// daemon was found running the installed binary (Linux only), so an
-	// earlier restart_error no longer applies.
+	// daemon was found running the installed release, so an earlier
+	// restart_error no longer applies.
 	daemonCurrent bool
 }
 
@@ -305,25 +412,58 @@ func (u *Updater) recordCheck(trigger string, out checkOutcome, checkErr error)
 		s.LastResult = ResultUpdated
 		s.LastUpdateAt = now
 		s.LastUpdateVersion = out.installed
-		if out.restartErr != nil {
-			s.RestartError = out.restartErr.Error()
-		} else if !out.updaterReplaced {
-			// The daemon was restarted onto the new binaries. (When the
-			// updater replaced itself, the restart happens in the new
-			// process — see recoverPendingRestart — which records it.)
-			s.RestartError = ""
+		// When the loop replaced its own binary it exits without restarting
+		// the daemon: the new process does that (recoverPendingRestart) and
+		// records it.
+		if out.restart != nil {
+			applyDaemonRestart(s, *out.restart, now)
+		}
+		if out.updaterRestart != nil {
+			applyUpdaterRestart(s, *out.updaterRestart, now)
 		}
 	})
 }
 
+// applyDaemonRestart records a daemon restart attempt in s.
+func applyDaemonRestart(s *Status, r restartOutcome, now time.Time) {
+	if r.err != nil {
+		s.RestartError = r.err.Error()
+		return
+	}
+	s.RestartError = ""
+	if r.restarted {
+		s.DaemonRestartedAt = now
+		s.DaemonRestartedBy = r.by
+		s.DaemonRestartedVersion = r.version
+	}
+}
+
+// applyUpdaterRestart records an updater service restart attempt in s.
+func applyUpdaterRestart(s *Status, r restartOutcome, now time.Time) {
+	if r.err != nil {
+		s.UpdaterRestartError = r.err.Error()
+		return
+	}
+	s.UpdaterRestartError = ""
+	if r.restarted {
+		s.UpdaterRestartedAt = now
+	}
+}
+
 // recordRestart records the outcome of a daemon restart made outside a
 // check (recoverPendingRestart).
-func (u *Updater) recordRestart(err error) {
-	u.updateStatus(func(s *Status) {
-		if err != nil {
-			s.RestartError = err.Error()
-		} else {
-			s.RestartError = ""
+func (u *Updater) recordRestart(r restartOutcome) {
+	now := time.Now().UTC()
+	u.updateStatus(func(s *Status) { applyDaemonRestart(s, r, now) })
+}
+
+// recordedRestartError is the restart_error currently on record: in the
+// status file when there is one, else in this Updater's last status.
+func (u *Updater) recordedRestartError() string {
+	if path := u.statusPath(); path != "" {
+		if s, err := ReadStatus(path); err == nil {
+			return s.RestartError
 		}
-	})
+	}
+	return u.LastStatus().RestartError
 }
diff --git a/supervisor.go b/supervisor.go
index a9706a2..daea0f1 100644
--- a/supervisor.go
+++ b/supervisor.go
@@ -138,11 +138,15 @@ func scanDaemonProcs(procRoot, exePath string) (current, replaced []int, err err
 }
 
 // daemonOnInstalledBinary reports whether the daemon is known to be running
-// the installed binary: a process runs daemonPath itself and none still runs
-// a replaced copy. Only Linux can tell (from /proc); elsewhere it returns
-// false.
+// the installed release. On Linux a process runs daemonPath itself and none
+// still runs a replaced copy (from /proc). On macOS the daemon answers over
+// IPC with the installed version. Elsewhere it returns false.
 func (u *Updater) daemonOnInstalledBinary() bool {
-	if u.targetOS() != "linux" {
+	switch u.targetOS() {
+	case "linux":
+	case "darwin":
+		return u.daemonOnInstalledVersionDarwin()
+	default:
 		return false
 	}
 	daemonPath := filepath.Join(u.config.InstallDir, "pilot-daemon")
diff --git a/updater.go b/updater.go
index dcb9906..49f4bff 100644
--- a/updater.go
+++ b/updater.go
@@ -101,8 +101,12 @@ type Updater struct {
 	procRoot    string        // "" = /proc
 	goos        string        // "" = runtime.GOOS; selects the restart mechanism
 	systemdDirs []string      // nil = systemdSystemUnitDirs
-	restartWait time.Duration // 0 = defaultRestartWait
+	restartWait time.Duration // 0 = defaultRestartWait (Linux), defaultLaunchdRestartWait (macOS)
 	restartPoll time.Duration // 0 = defaultRestartPoll
+	getuid      func() int    // nil = os.Getuid; selects the launchd domains
+	// probeFn asks the daemon on a socket for its version (IPC info); nil =
+	// probeDaemonVersion.
+	probeFn func(socket string) (version string, running bool)
 
 	statusMu       sync.Mutex
 	status         Status
@@ -110,8 +114,9 @@ type Updater struct {
 }
 
 // runCommand runs an external command and returns its combined output. The
-// only command the updater ever runs is launchctl (daemon restart on macOS);
-// it never runs gh or any other tool. Tests replace this so the suite cannot
+// only command the updater ever runs is launchctl (`print` and `kickstart`,
+// to restart the daemon and the updater service under launchd on macOS); it
+// never runs gh or any other tool. Tests replace this so the suite cannot
 // restart a real daemon on a developer machine.
 var runCommand = func(name string, args ...string) ([]byte, error) {
 	return exec.Command(name, args...).CombinedOutput()
@@ -167,9 +172,10 @@ func (u *Updater) Stop() {
 // to the status file when one is configured.
 //
 // RunOnce never exits the calling process. When the release replaces the
-// pilot-updater binary, the daemon is still restarted onto the new binaries;
-// a separately running updater service picks up its new binary the next
-// time its service manager restarts it.
+// pilot-updater binary, the daemon is still restarted onto the new binaries.
+// On macOS the updater service (its launchd job) is then restarted onto the
+// new pilot-updater too; elsewhere a separately running updater service picks
+// up its new binary the next time its service manager restarts it.
 func (u *Updater) RunOnce() error {
 	u.recoverPendingRestart()
 	return u.runCheck(TriggerManual)
@@ -269,7 +275,7 @@ func (u *Updater) checkOnce() error {
 // error.
 func (u *Updater) runCheck(trigger string) error {
 	out, err := u.check()
-	if out.installed == "" {
+	if out.installed == "" && u.recordedRestartError() != "" {
 		// A daemon now running the installed binary (restarted by hand after
 		// an earlier restart failure) settles restart_error.
 		out.daemonCurrent = u.daemonOnInstalledBinary()
@@ -288,8 +294,9 @@ func (u *Updater) runCheck(trigger string) error {
 	if out.updaterReplaced && trigger == TriggerAuto {
 		// This process is now running a stale updater. Record the update,
 		// then exit so launchd/systemd restarts the process with the new
-		// binary. On startup the new process runs recoverPendingRestart(),
-		// which restarts the daemon (and records the result).
+		// binary (install.sh runs it with KeepAlive true / Restart=always).
+		// On startup the new process runs recoverPendingRestart(), which
+		// restarts the daemon (and records the result).
 		u.recordCheck(trigger, out, nil)
 		slog.Info("updater binary replaced — exiting for process manager to restart with new binary")
 		exit := u.exitFn
@@ -299,13 +306,20 @@ func (u *Updater) runCheck(trigger string) error {
 		exit(0)
 		return nil
 	}
-	if out.updaterReplaced {
-		slog.Info("pilot-updater binary replaced; a running updater service uses it after its next restart")
-	}
 
 	// Restart the daemon onto the new binaries (SIGTERM / launchctl).
-	out.restartErr = u.signalDaemonRestart()
+	restart := u.signalDaemonRestart()
+	out.restart = &restart
 	u.touchRestartRecord()
+
+	// A one-shot run that replaced pilot-updater also moves the updater
+	// service onto it. This comes after the restart record is written, so
+	// the restarted updater does not restart the daemon a second time.
+	if out.updaterReplaced {
+		if r, attempted := u.restartUpdaterService(); attempted {
+			out.updaterRestart = &r
+		}
+	}
 	u.recordCheck(trigger, out, nil)
 	return nil
 }
@@ -765,9 +779,9 @@ func (u *Updater) recoverPendingRestart() {
 	recordStat, err := os.Stat(restartRecord)
 	if err != nil || binStat.ModTime().After(recordStat.ModTime()) {
 		slog.Info("daemon binary updated since last restart, triggering restart")
-		err := u.signalDaemonRestart()
+		restart := u.signalDaemonRestart()
 		u.touchRestartRecord()
-		u.recordRestart(err)
+		u.recordRestart(restart)
 	}
 }
 
@@ -796,11 +810,29 @@ func writeFileSync(path string, data []byte, perm os.FileMode) error {
 	return f.Close()
 }
 
+// restartOutcome is what one attempt to move a running service onto newly
+// installed binaries did.
+type restartOutcome struct {
+	// restarted reports that the service was stopped and came back on the
+	// new binary.
+	restarted bool
+	// by names the service manager and job that restarted it, e.g.
+	// "launchd gui/501/network.pilotprotocol.pilot-daemon".
+	by string
+	// version is the version the daemon reported over IPC after the restart
+	// ("" = not asked).
+	version string
+	// err is set when the service may still run the old binary. It says how
+	// to restart it. A service that is not running at all is not an error:
+	// its next start uses the new binary.
+	err error
+}
+
 // signalDaemonRestart restarts the daemon so it runs the newly installed
-// binaries. It returns an error when the daemon may still be running the old
-// binary; a daemon that is not running at all is not an error (its next
-// start uses the new binary).
-func (u *Updater) signalDaemonRestart() error {
+// binaries. The outcome's err is set when the daemon may still be running
+// the old binary; a daemon that is not running at all is not an error (its
+// next start uses the new binary).
+func (u *Updater) signalDaemonRestart() restartOutcome {
 	if u.targetOS() == "darwin" {
 		return u.signalDaemonRestartDarwin()
 	}
@@ -815,25 +847,7 @@ func (u *Updater) command(name string, args ...string) ([]byte, error) {
 	return runCommand(name, args...)
 }
 
-func (u *Updater) signalDaemonRestartDarwin() error {
-	// On macOS the daemon is managed by launchd. Use launchctl kickstart -k
-	// to kill the running instance and restart it immediately. The label
-	// matches the plist written by install.sh.
-	uid := os.Getuid()
-	label := "network.pilotprotocol.pilot-daemon"
-	target := fmt.Sprintf("gui/%d/%s", uid, label)
-	out, err := u.command("launchctl", "kickstart", "-k", target)
-	if err != nil {
-		output := strings.TrimSpace(string(out))
-		slog.Warn("launchctl kickstart failed — restart daemon manually",
-			"target", target, "err", err, "output", output)
-		return fmt.Errorf("restart daemon (launchctl kickstart -k %s): %v %s", target, err, output)
-	}
-	slog.Info("daemon restarted via launchctl", "target", target)
-	return nil
-}
-
-func (u *Updater) signalDaemonRestartLinux() error {
+func (u *Updater) signalDaemonRestartLinux() restartOutcome {
 	// On Linux, find the daemon process via /proc/<pid>/exe. When systemd
 	// will start it again (see supervisor.go), send SIGTERM and wait for the
 	// new process; otherwise leave it running and say how to restart it.
@@ -842,17 +856,17 @@ func (u *Updater) signalDaemonRestartLinux() error {
 	pid, err := findProcessByExe(procRoot, daemonPath)
 	if err != nil {
 		slog.Warn("cannot read /proc — restart daemon manually", "error", err)
-		return fmt.Errorf("restart daemon: find process: %w", err)
+		return restartOutcome{err: fmt.Errorf("restart daemon: find process: %w", err)}
 	}
 	if pid == 0 {
 		// Not running: its next start uses the new binary.
 		slog.Warn("daemon process not found — restart daemon manually if it is running", "path", daemonPath)
-		return nil
+		return restartOutcome{}
 	}
 	unit, err := u.daemonSupervisor(procRoot, pid, daemonPath)
 	if err != nil {
 		slog.Warn("daemon not restarted onto the new binary", "pid", pid, "reason", err)
-		return fmt.Errorf("restart daemon: %w", err)
+		return restartOutcome{err: fmt.Errorf("restart daemon: %w", err)}
 	}
 	slog.Info("sending SIGTERM to daemon; systemd starts it again", "pid", pid, "unit", unit)
 	kill := u.killFn
@@ -860,15 +874,15 @@ func (u *Updater) signalDaemonRestartLinux() error {
 		kill = syscall.Kill
 	}
 	if err := kill(pid, syscall.SIGTERM); err != nil {
-		return fmt.Errorf("restart daemon: signal pid %d: %w", pid, err)
+		return restartOutcome{err: fmt.Errorf("restart daemon: signal pid %d: %w", pid, err)}
 	}
 	newPid, err := u.waitForDaemonRestart(procRoot, daemonPath, pid, unit)
 	if err != nil {
 		slog.Error("daemon did not come back after SIGTERM", "unit", unit, "error", err)
-		return fmt.Errorf("restart daemon: %w", err)
+		return restartOutcome{err: fmt.Errorf("restart daemon: %w", err)}
 	}
 	slog.Info("daemon restarted on the new binary", "unit", unit, "pid", newPid)
-	return nil
+	return restartOutcome{restarted: true, by: "systemd " + unit}
 }
 
 // findProcessByExe returns the pid of a process (other than this one) whose
diff --git a/zz_launchctl_exec_test.go b/zz_launchctl_exec_test.go
new file mode 100644
index 0000000..6fcf0ce
--- /dev/null
+++ b/zz_launchctl_exec_test.go
@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package updater
+
+import (
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pilot-protocol/common/ipcutil"
+)
+
+// IPC commands of the daemon's info call (common/driver).
+const (
+	ipcCmdInfo   byte = 0x0D
+	ipcCmdInfoOK byte = 0x0E
+)
+
+// shortTempDir returns a temp dir with a short path: unix socket paths are
+// limited to 104 bytes on macOS, which t.TempDir() can exceed.
+func shortTempDir(t *testing.T) string {
+	t.Helper()
+	dir, err := os.MkdirTemp("/tmp", "pu-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	return dir
+}
+
+// serveFakeDaemonIPC answers the daemon's IPC info call on socket with the
+// version version() returns. When silent, it accepts connections but never
+// answers (a wedged daemon).
+func serveFakeDaemonIPC(t *testing.T, socket string, version func() string, silent bool) {
+	t.Helper()
+	ln, err := net.Listen("unix", socket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { ln.Close() })
+	go func() {
+		for {
+			c, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go func(c net.Conn) {
+				defer c.Close()
+				for {
+					msg, err := ipcutil.Read(c)
+					if err != nil {
+						return
+					}
+					if silent || len(msg) == 0 || msg[0] != ipcCmdInfo {
+						continue
+					}
+					body, _ := json.Marshal(map[string]interface{}{"version": version(), "node_id": 42})
+					if err := ipcutil.Write(c, append([]byte{ipcCmdInfoOK}, body...)); err != nil {
+						return
+					}
+				}
+			}(c)
+		}
+	}()
+}
+
+// TestProbeDaemonVersion exercises the real IPC probe against a fake daemon
+// socket: an answer, no daemon, and a daemon that never answers (bounded by
+// daemonProbeTimeout).
+func TestProbeDaemonVersion(t *testing.T) {
+	t.Parallel()
+	dir := shortTempDir(t)
+
+	answering := filepath.Join(dir, "a.sock")
+	serveFakeDaemonIPC(t, answering, func() string { return "v1.13.10" }, false)
+	if v, running := realProbeDaemonVersion(answering); !running || v != "v1.13.10" {
+		t.Errorf("answering daemon = %q, %v", v, running)
+	}
+
+	if v, running := realProbeDaemonVersion(filepath.Join(dir, "none.sock")); running || v != "" {
+		t.Errorf("no daemon = %q, %v; want not running", v, running)
+	}
+
+	silent := filepath.Join(dir, "s.sock")
+	serveFakeDaemonIPC(t, silent, func() string { return "" }, true)
+	start := time.Now()
+	if v, running := realProbeDaemonVersion(silent); !running || v != "" {
+		t.Errorf("wedged daemon = %q, %v; want running, unknown version", v, running)
+	}
+	if took := time.Since(start); took > daemonProbeTimeout+2*time.Second {
+		t.Errorf("wedged daemon probe took %s", took)
+	}
+}
+
+// fakeLaunchctlScript is a launchctl stand-in for one job, kept in state
+// files under $S. It uses only shell builtins: PATH holds nothing else.
+const fakeLaunchctlScript = `#!/bin/sh
+S='@STATE@'
+printf '%s\n' "$*" >> "$S/calls"
+read -r target < "$S/target"
+if [ "$2" != "$target" ] && [ "$3" != "$target" ]; then
+	echo "Could not find service \"${2##*/}\" in domain for user gui: 501" >&2
+	exit 113
+fi
+case "$1" in
+print)
+	read -r program < "$S/program"
+	read -r socket < "$S/socket"
+	read -r pid < "$S/pid"
+	printf '%s = {\n\tactive count = 1\n\ttype = LaunchAgent\n' "$target"
+	if [ "$pid" -gt 0 ]; then printf '\tstate = running\n'; else printf '\tstate = not running\n'; fi
+	printf '\n\tprogram = %s\n\targuments = {\n\t\t%s\n\t\t-registry\n\t\t34.71.57.205:9000\n\t\t-socket\n\t\t%s\n\t\t-encrypt\n\t}\n\n' "$program" "$program" "$socket"
+	printf '\tdomain = gui/501 [100023]\n\texit timeout = 5\n\truns = 2\n'
+	if [ "$pid" -gt 0 ]; then printf '\tpid = %s\n' "$pid"; fi
+	printf '\tlast exit code = 0\n\n\tresource coalition = {\n\t\tID = 2814\n\t\tstate = active\n\t}\n}\n'
+	;;
+kickstart)
+	[ "$2" = "-k" ] || exit 64
+	read -r pid < "$S/pid"
+	echo $((pid + 1)) > "$S/pid"
+	read -r next < "$S/next-version"
+	echo "$next" > "$S/version"
+	;;
+*)
+	exit 64
+	;;
+esac
+`
+
+// TestDarwinRestart_ThroughLaunchctlExecutable runs the macOS restart the
+// way production does: runCommand execs `launchctl` found on PATH and the
+// probe speaks the daemon's IPC protocol over a unix socket. launchctl is a
+// shell script and the daemon a fake IPC server. PATH holds only the
+// script's directory, so the real /bin/launchctl cannot be reached, and the
+// probe refuses any socket but the fake daemon's. Not parallel: it sets
+// PATH.
+func TestDarwinRestart_ThroughLaunchctlExecutable(t *testing.T) {
+	dir := shortTempDir(t)
+	installDir := filepath.Join(dir, "bin")
+	state := filepath.Join(dir, "launchd")
+	pathDir := filepath.Join(dir, "path")
+	socket := filepath.Join(dir, "d.sock")
+	for _, d := range []string{installDir, state, pathDir} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write := func(p, content string, mode os.FileMode) {
+		t.Helper()
+		if err := os.WriteFile(p, []byte(content), mode); err != nil {
+			t.Fatal(err)
+		}
+	}
+	daemon := filepath.Join(installDir, "pilot-daemon")
+	write(daemon, "new-daemon", 0o755)
+	write(filepath.Join(installDir, ".pilot-version"), "v2.0.0\n", 0o644)
+	for name, v := range map[string]string{
+		"target":       daemonTarget,
+		"program":      daemon,
+		"socket":       socket,
+		"pid":          "700",
+		"version":      "v1.0.0",
+		"next-version": "v2.0.0",
+	} {
+		write(filepath.Join(state, name), v+"\n", 0o644)
+	}
+	write(filepath.Join(pathDir, "launchctl"), strings.ReplaceAll(fakeLaunchctlScript, "@STATE@", state), 0o755)
+	serveFakeDaemonIPC(t, socket, func() string {
+		data, _ := os.ReadFile(filepath.Join(state, "version"))
+		return strings.TrimSpace(string(data))
+	}, false)
+	t.Setenv("PATH", pathDir)
+
+	u := &Updater{
+		config:      Config{InstallDir: installDir},
+		goos:        "darwin",
+		runCmd:      realRunCommand,
+		getuid:      func() int { return fakeUID },
+		restartWait: 15 * time.Second,
+		restartPoll: 10 * time.Millisecond,
+		probeFn: func(s string) (string, bool) {
+			if s != socket {
+				t.Errorf("probed %s; only the fake daemon's socket may be probed", s)
+				return "", false
+			}
+			return realProbeDaemonVersion(s)
+		},
+	}
+
+	r := u.signalDaemonRestart()
+	if r.err != nil || !r.restarted || r.version != "v2.0.0" || r.by != "launchd "+daemonTarget {
+		t.Fatalf("outcome = %+v, want restarted on v2.0.0 by launchd", r)
+	}
+	// No updater job is loaded: nothing to restart.
+	if _, attempted := u.restartUpdaterService(); attempted {
+		t.Error("restartUpdaterService attempted without an updater job")
+	}
+
+	data, err := os.ReadFile(filepath.Join(state, "calls"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	calls := strings.Split(strings.TrimSpace(string(data)), "\n")
+	var kicks []string
+	for _, c := range calls {
+		if strings.HasPrefix(c, "kickstart") {
+			kicks = append(kicks, c)
+		}
+	}
+	if calls[0] != "print "+daemonTarget || len(kicks) != 1 || kicks[0] != "kickstart -k "+daemonTarget {
+		t.Errorf("launchctl calls = %q", calls)
+	}
+}
diff --git a/zz_launchd_test.go b/zz_launchd_test.go
new file mode 100644
index 0000000..b53ce14
--- /dev/null
+++ b/zz_launchd_test.go
@@ -0,0 +1,978 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package updater
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// fakeUID is the user the fake launchd serves (gui/501, user/501).
+const fakeUID = 501
+
+const (
+	daemonTarget  = "gui/501/network.pilotprotocol.pilot-daemon"
+	updaterTarget = "gui/501/network.pilotprotocol.pilot-updater"
+	fakeSocket    = "/tmp/pilot-fake-test.sock"
+)
+
+// fakeLaunchd plays launchd and launchctl for the macOS restart path, and the
+// daemon's IPC socket. It answers `launchctl print <target>` like the real
+// launchctl (including nested blocks that repeat keys such as "state") and
+// `launchctl kickstart -k <target>` by stopping the job's process and, unless
+// told otherwise, starting a new one. A daemon job's process answers IPC on
+// its -socket with its version.
+type fakeLaunchd struct {
+	t *testing.T
+
+	mu      sync.Mutex
+	jobs    map[string]*fakeJob // by target
+	manual  map[string]string   // socket -> version of a daemon launchd does not run
+	calls   []string
+	nextPid int
+	// installDir, when set, is where a restarted daemon without a newVersion
+	// reads its version from (.pilot-version), like a real new process.
+	installDir string
+	// onKickstart runs before a kickstart is carried out; an error fails it.
+	onKickstart func(target string) ([]byte, error)
+}
+
+type fakeJob struct {
+	program  string
+	args     []string
+	pid      int // 0 = no process
+	socket   string
+	version  string // what the running process reports over IPC
+	answers  bool   // the running process answers IPC
+	lastExit string
+
+	// What kickstart -k does.
+	respawn    bool   // launchd starts a new process
+	newVersion string // version of the new process ("" = installed version)
+	newAnswers bool   // the new process answers IPC
+	// respawnDelay is how long launchd still shows the old process after
+	// kickstart returns.
+	respawnDelay time.Duration
+	kickErr      error
+	kickOut      string
+}
+
+func newFakeLaunchd(t *testing.T) *fakeLaunchd {
+	return &fakeLaunchd{
+		t:       t,
+		jobs:    map[string]*fakeJob{},
+		manual:  map[string]string{},
+		nextPid: 9000,
+	}
+}
+
+// addDaemonJob loads a running daemon job at target that runs program with
+// -socket socket and reports version over IPC.
+func (fl *fakeLaunchd) addDaemonJob(target, program string, pid int, socket, version string) *fakeJob {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	j := &fakeJob{
+		program: program,
+		args: []string{program, "-registry", "34.71.57.205:9000", "-beacon", "34.71.57.205:9001",
+			"-listen", ":4000", "-socket", socket, "-identity", "/Users/test/.pilot/identity.json", "-encrypt"},
+		pid: pid, socket: socket, version: version, answers: pid > 0,
+		respawn: true, newAnswers: true, lastExit: "0",
+	}
+	fl.jobs[target] = j
+	return j
+}
+
+// addUpdaterJob loads a running updater job at target that runs program.
+func (fl *fakeLaunchd) addUpdaterJob(target, program string, pid int) *fakeJob {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	j := &fakeJob{
+		program: program,
+		args:    []string{program, "-install-dir", filepath.Dir(program)},
+		pid:     pid, respawn: true, lastExit: "0",
+	}
+	fl.jobs[target] = j
+	return j
+}
+
+// addManualDaemon runs a daemon launchd does not manage on socket.
+func (fl *fakeLaunchd) addManualDaemon(socket, version string) {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	fl.manual[socket] = version
+}
+
+// wire routes u's launchctl and IPC calls to the fake without changing the
+// OS u restarts for.
+func (fl *fakeLaunchd) wire(u *Updater) {
+	u.runCmd = fl.run
+	u.probeFn = fl.probe
+	u.getuid = func() int { return fakeUID }
+	u.restartWait = 2 * time.Second
+	u.restartPoll = time.Millisecond
+}
+
+// attach wires u to the fake and puts it on the macOS restart path.
+func (fl *fakeLaunchd) attach(u *Updater) {
+	fl.wire(u)
+	u.goos = "darwin"
+}
+
+func (fl *fakeLaunchd) kickstarts() []string {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	var out []string
+	for _, c := range fl.calls {
+		if strings.HasPrefix(c, "kickstart") {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+func (fl *fakeLaunchd) job(target string) fakeJob {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	return *fl.jobs[target]
+}
+
+func notFound(target string) ([]byte, error) {
+	label := target[strings.LastIndexByte(target, '/')+1:]
+	return []byte(fmt.Sprintf("Could not find service %q in domain for user gui: %d\n", label, fakeUID)),
+		errors.New("exit status 113")
+}
+
+func (fl *fakeLaunchd) run(name string, args ...string) ([]byte, error) {
+	if name != "launchctl" {
+		fl.t.Errorf("ran %s %q; the updater may only run launchctl", name, args)
+		return nil, errors.New("not launchctl")
+	}
+	fl.mu.Lock()
+	fl.calls = append(fl.calls, strings.Join(args, " "))
+	fl.mu.Unlock()
+
+	switch {
+	case len(args) == 2 && args[0] == "print":
+		fl.mu.Lock()
+		defer fl.mu.Unlock()
+		j, ok := fl.jobs[args[1]]
+		if !ok {
+			return notFound(args[1])
+		}
+		return []byte(fl.render(args[1], j)), nil
+
+	case len(args) == 3 && args[0] == "kickstart" && args[1] == "-k":
+		target := args[2]
+		if hook := fl.onKickstart; hook != nil {
+			if out, err := hook(target); err != nil {
+				return out, err
+			}
+		}
+		fl.mu.Lock()
+		defer fl.mu.Unlock()
+		j, ok := fl.jobs[target]
+		if !ok {
+			return notFound(target)
+		}
+		if j.kickErr != nil {
+			return []byte(j.kickOut), j.kickErr
+		}
+		// launchd sends SIGTERM; the daemon exits 0.
+		j.answers, j.lastExit = false, "0"
+		if !j.respawn {
+			j.pid = 0
+			return nil, nil
+		}
+		oldPid := j.pid
+		j.pid = fl.nextPid
+		fl.nextPid++
+		j.answers = j.newAnswers
+		j.version = j.newVersion
+		if j.version == "" && fl.installDir != "" {
+			data, _ := os.ReadFile(filepath.Join(fl.installDir, ".pilot-version"))
+			j.version = strings.TrimSpace(string(data))
+		}
+		if j.respawnDelay > 0 {
+			newPid := j.pid
+			j.pid = oldPid
+			time.AfterFunc(j.respawnDelay, func() {
+				fl.mu.Lock()
+				defer fl.mu.Unlock()
+				j.pid = newPid
+			})
+		}
+		return nil, nil
+	}
+	fl.t.Errorf("unexpected launchctl %q", args)
+	return []byte("Unrecognized subcommand"), errors.New("exit status 64")
+}
+
+// render prints j like `launchctl print` does.
+func (fl *fakeLaunchd) render(target string, j *fakeJob) string {
+	state := "not running"
+	if j.pid > 0 {
+		state = "running"
+	}
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s = {\n", target)
+	fmt.Fprintf(&b, "\tactive count = 1\n\tpath = /Users/test/Library/LaunchAgents/%s.plist\n", target[strings.LastIndexByte(target, '/')+1:])
+	fmt.Fprintf(&b, "\ttype = LaunchAgent\n\tstate = %s\n\n", state)
+	fmt.Fprintf(&b, "\tprogram = %s\n\targuments = {\n", j.program)
+	for _, a := range j.args {
+		fmt.Fprintf(&b, "\t\t%s\n", a)
+	}
+	b.WriteString("\t}\n\n")
+	b.WriteString("\tinherited environment = {\n\t\tSSH_AUTH_SOCK => /private/tmp/com.apple.launchd.x/Listeners\n\t}\n\n")
+	b.WriteString("\tdefault environment = {\n\t\tPATH => /usr/bin:/bin:/usr/sbin:/sbin\n\t}\n\n")
+	b.WriteString("\tdomain = gui/501 [100023]\n\tasid = 100023\n\tminimum runtime = 10\n\texit timeout = 5\n\truns = 4\n")
+	if j.pid > 0 {
+		fmt.Fprintf(&b, "\tpid = %d\n", j.pid)
+	}
+	b.WriteString("\timmediate reason = inefficient\n\tforks = 0\n\texecs = 1\n")
+	fmt.Fprintf(&b, "\tlast exit code = %s\n\n", j.lastExit)
+	// Nested blocks repeat top-level key names.
+	b.WriteString("\tresource coalition = {\n\t\tID = 2814\n\t\ttype = resource\n\t\tstate = active\n\t\tactive count = 1\n\t\tname = x\n\t}\n\n")
+	b.WriteString("\tevent triggers = {\n\t\tx => {\n\t\t\tkeepalive = 0\n\t\t\tdescriptor = {\n\t\t\t\t\"pid\" => 1\n\t\t\t}\n\t\t}\n\t}\n\n")
+	b.WriteString("\tproperties = keepalive | runatload | inferred program\n}\n")
+	return b.String()
+}
+
+// probe answers an IPC info call on socket.
+func (fl *fakeLaunchd) probe(socket string) (string, bool) {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	for _, j := range fl.jobs {
+		if j.socket == socket && j.pid > 0 && j.answers {
+			return j.version, true
+		}
+	}
+	if v, ok := fl.manual[socket]; ok {
+		return v, true
+	}
+	return "", false
+}
+
+// darwinUpdater returns an Updater on the macOS restart path whose install
+// dir holds release installed, with the fake launchd attached.
+func darwinUpdater(t *testing.T, installed string) (*Updater, *fakeLaunchd) {
+	t.Helper()
+	installDir := t.TempDir()
+	for _, name := range []string{"pilot-daemon", "pilot-updater", "pilotctl"} {
+		if err := os.WriteFile(filepath.Join(installDir, name), []byte(name), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if installed != "" {
+		if err := os.WriteFile(filepath.Join(installDir, ".pilot-version"), []byte(installed+"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	fl := newFakeLaunchd(t)
+	u := &Updater{config: Config{InstallDir: installDir}}
+	fl.attach(u)
+	return u, fl
+}
+
+// --- launchctl print parsing ---------------------------------------------
+
+// A real `launchctl print` of a running LaunchAgent (macOS 26), trimmed.
+const realPrintRunning = `gui/501/com.apple.bird = {
+	active count = 8
+	path = /System/Library/LaunchAgents/com.apple.bird.plist
+	type = LaunchAgent
+	state = running
+
+	program = /System/Library/PrivateFrameworks/iCloudDriveCore.framework/Versions/A/Support/bird
+	arguments = {
+		/System/Library/PrivateFrameworks/iCloudDriveCore.framework/Versions/A/Support/bird
+	}
+
+	inherited environment = {
+		SSH_AUTH_SOCK => /private/tmp/com.apple.launchd.PJSgmVbv5P/Listeners
+	}
+
+	domain = gui/501 [100023]
+	asid = 100023
+	minimum runtime = 10
+	exit timeout = 5
+	runs = 7
+	pid = 46144
+	immediate reason = ipc (mach)
+	last exit code = 0
+
+	event triggers = {
+		com.apple.bird.finish-salting-partially-salted-directories => {
+			keepalive = 0
+			descriptor = {
+				"RelatedApplications" => [
+					0 = "com.apple.bird"
+				]
+				"NonRepeatingTask" => {
+					"TrySchedulingBefore" => 86400
+				}
+			}
+		}
+	}
+
+	resource coalition = {
+		ID = 2814
+		type = resource
+		state = active
+		active count = 1
+	}
+}
+`
+
+// A real `launchctl print` of a loaded LaunchAgent with no process.
+const realPrintNotRunning = `gui/501/com.google.GoogleUpdater.wake = {
+	active count = 0
+	path = /Users/u/Library/LaunchAgents/com.google.GoogleUpdater.wake.plist
+	type = LaunchAgent
+	state = not running
+
+	program = /Users/u/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
+	arguments = {
+		/Users/u/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
+		--wake-all
+		--enable-logging
+	}
+
+	domain = gui/501 [100023]
+	runs = 168
+	last exit code = 0
+}
+`
+
+func TestParseLaunchdPrint(t *testing.T) {
+	t.Parallel()
+	j, ok := parseLaunchdPrint(realPrintRunning)
+	if !ok {
+		t.Fatal("running job not parsed")
+	}
+	if j.state != "running" || j.pid != 46144 || j.lastExit != "0" ||
+		j.program != "/System/Library/PrivateFrameworks/iCloudDriveCore.framework/Versions/A/Support/bird" ||
+		len(j.args) != 1 || j.args[0] != j.program {
+		t.Errorf("running job = %+v", j)
+	}
+
+	j, ok = parseLaunchdPrint(realPrintNotRunning)
+	if !ok {
+		t.Fatal("not-running job not parsed")
+	}
+	wantProg := "/Users/u/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"
+	if j.state != "not running" || j.pid != 0 || j.program != wantProg ||
+		strings.Join(j.args[1:], " ") != "--wake-all --enable-logging" {
+		t.Errorf("not-running job = %+v", j)
+	}
+
+	// The fake renders nested blocks that repeat "state" and "pid".
+	fl := newFakeLaunchd(t)
+	fj := fl.addDaemonJob(daemonTarget, "/Users/u/.pilot/bin/pilot-daemon", 812, "/tmp/pilot.sock", "v1.0.0")
+	j, ok = parseLaunchdPrint(fl.render(daemonTarget, fj))
+	if !ok || j.state != "running" || j.pid != 812 || j.program != "/Users/u/.pilot/bin/pilot-daemon" || j.socket() != "/tmp/pilot.sock" {
+		t.Errorf("fake job = %+v (%v)", j, ok)
+	}
+
+	// Without "program = ", the first argument is the program.
+	j, ok = parseLaunchdPrint("gui/1/x = {\n\targuments = {\n\t\t/bin/x\n\t\t-y\n\t}\n}\n")
+	if !ok || j.programPath() != "/bin/x" {
+		t.Errorf("arguments-only job = %+v (%v)", j, ok)
+	}
+
+	for _, bad := range []string{
+		"",
+		"Could not find service \"network.pilotprotocol.pilot-daemon\" in domain for user gui: 501\n",
+		"Bad request.\nCould not find domain for port identifier.\n",
+		"gui/1/x = {\n\tstate = running\n}\n", // no program
+	} {
+		if j, ok := parseLaunchdPrint(bad); ok {
+			t.Errorf("parseLaunchdPrint(%q) = %+v, want not a job", bad, j)
+		}
+	}
+}
+
+func TestSocketFromArgs(t *testing.T) {
+	t.Parallel()
+	def := socketFromArgs(nil)
+	cases := []struct {
+		args []string
+		want string
+	}{
+		{[]string{"/bin/pilot-daemon", "-listen", ":4000", "-socket", "/tmp/a.sock", "-encrypt"}, "/tmp/a.sock"},
+		{[]string{"/bin/pilot-daemon", "--socket", "/tmp/b.sock"}, "/tmp/b.sock"},
+		{[]string{"/bin/pilot-daemon", "-socket=/tmp/c.sock"}, "/tmp/c.sock"},
+		{[]string{"/bin/pilot-daemon", "--socket=/tmp/d.sock"}, "/tmp/d.sock"},
+		{[]string{"/bin/pilot-daemon", "-encrypt"}, def},
+		{[]string{"/bin/pilot-daemon", "-socket"}, def},
+		{[]string{"-socket"}, def}, // args[0] is the program, never a flag
+	}
+	for _, tc := range cases {
+		if got := socketFromArgs(tc.args); got != tc.want {
+			t.Errorf("socketFromArgs(%q) = %q, want %q", tc.args, got, tc.want)
+		}
+	}
+}
+
+// --- daemon restart on macOS ----------------------------------------------
+
+// TestDarwinRestart_KickstartsJobAndConfirmsVersion is the fix for the
+// reported gap: the daemon runs under its launchd job from the replaced
+// binary, so the updater kickstarts it and waits for the new process to
+// answer over IPC with the installed version.
+func TestDarwinRestart_KickstartsJobAndConfirmsVersion(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v1.13.10")
+	daemon := filepath.Join(u.config.InstallDir, "pilot-daemon")
+	j := fl.addDaemonJob(daemonTarget, daemon, 700, fakeSocket, "v1.13.9")
+	j.newVersion = "v1.13.10"
+	j.respawnDelay = 20 * time.Millisecond // launchd still shows the old pid for a while
+
+	r := u.signalDaemonRestart()
+	if r.err != nil || !r.restarted {
+		t.Fatalf("outcome = %+v, want restarted", r)
+	}
+	if r.by != "launchd "+daemonTarget || r.version != "v1.13.10" {
+		t.Errorf("by/version = %q/%q", r.by, r.version)
+	}
+	if ks := fl.kickstarts(); len(ks) != 1 || ks[0] != "kickstart -k "+daemonTarget {
+		t.Errorf("kickstarts = %q, want one of %s", ks, daemonTarget)
+	}
+	if got := fl.job(daemonTarget); got.pid == 700 {
+		t.Error("daemon still on the old pid")
+	}
+}
+
+// TestDarwinRestart_AcceptsSymlinkedProgram: the job may name the binary
+// through a symlink (e.g. a Homebrew-style bin link).
+func TestDarwinRestart_AcceptsSymlinkedProgram(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v2.0.0")
+	link := filepath.Join(t.TempDir(), "pilot-daemon")
+	if err := os.Symlink(filepath.Join(u.config.InstallDir, "pilot-daemon"), link); err != nil {
+		t.Fatal(err)
+	}
+	fl.addDaemonJob(daemonTarget, link, 700, fakeSocket, "v1.0.0").newVersion = "v2.0.0"
+	if r := u.signalDaemonRestart(); r.err != nil || !r.restarted {
+		t.Fatalf("outcome = %+v, want restarted", r)
+	}
+}
+
+// TestDarwinRestart_LegacyLabelInUserDomain: the job is found under the old
+// com.vulturelabs label and in the background (user/<uid>) domain.
+func TestDarwinRestart_LegacyLabelInUserDomain(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v2.0.0")
+	const target = "user/501/com.vulturelabs.pilot-daemon"
+	fl.addDaemonJob(target, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v1.0.0").newVersion = "v2.0.0"
+	r := u.signalDaemonRestart()
+	if r.err != nil || r.by != "launchd "+target {
+		t.Fatalf("outcome = %+v", r)
+	}
+	if ks := fl.kickstarts(); len(ks) != 1 || ks[0] != "kickstart -k "+target {
+		t.Errorf("kickstarts = %q", ks)
+	}
+}
+
+// TestDarwinRestart_SudoUsesInvokingUsersDomain: `sudo pilotctl update` runs
+// as uid 0; the jobs live in the invoking user's domain. Not parallel:
+// it sets SUDO_UID.
+func TestDarwinRestart_SudoUsesInvokingUsersDomain(t *testing.T) {
+	t.Setenv("SUDO_UID", "501")
+	u, fl := darwinUpdater(t, "v2.0.0")
+	u.getuid = func() int { return 0 }
+	fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v1.0.0").newVersion = "v2.0.0"
+	if r := u.signalDaemonRestart(); r.err != nil || r.by != "launchd "+daemonTarget {
+		t.Fatalf("outcome = %+v", r)
+	}
+	if got := u.launchdDomains(); strings.Join(got, " ") != "gui/501 user/501 gui/0 user/0" {
+		t.Errorf("domains = %q", got)
+	}
+}
+
+// TestDarwinRestart_NoJob covers a daemon launchd does not run: never
+// kickstarted; reported only when it answers with an older version.
+func TestDarwinRestart_NoJob(t *testing.T) {
+	t.Parallel()
+	def := socketFromArgs(nil)
+	cases := []struct {
+		name    string
+		manual  string // version of a hand-started daemon on the default socket ("" = none)
+		wantErr string
+	}{
+		{"daemon not running", "", ""},
+		{"hand-started daemon on the old version", "v1.0.0", "no launchd job network.pilotprotocol.pilot-daemon is loaded"},
+		{"hand-started daemon that does not report a version", "-", "unknown version"},
+		{"hand-started daemon already on the installed version", "v2.0.0", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			u, fl := darwinUpdater(t, "v2.0.0")
+			if tc.manual != "" {
+				fl.addManualDaemon(def, strings.TrimPrefix(tc.manual, "-"))
+			}
+			r := u.signalDaemonRestart()
+			if r.restarted {
+				t.Error("restarted = true, want false")
+			}
+			switch {
+			case tc.wantErr == "" && r.err != nil:
+				t.Errorf("err = %v, want nil", r.err)
+			case tc.wantErr != "" && (r.err == nil || !strings.Contains(r.err.Error(), tc.wantErr) ||
+				!strings.Contains(r.err.Error(), "restart it with: pilotctl daemon stop && pilotctl daemon start")):
+				t.Errorf("err = %v, want mention of %q and the restart command", r.err, tc.wantErr)
+			}
+			if ks := fl.kickstarts(); len(ks) != 0 {
+				t.Errorf("kickstarts = %q; a daemon launchd does not run must never be restarted", ks)
+			}
+		})
+	}
+}
+
+// TestDarwinRestart_JobLoadedButNotRunning: the job exited (or was never
+// started), so launchd starts the new binary next time; a daemon answering
+// on the job's socket was started by hand and is reported instead.
+func TestDarwinRestart_JobLoadedButNotRunning(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v2.0.0")
+	fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 0, fakeSocket, "")
+	if r := u.signalDaemonRestart(); r.err != nil || r.restarted {
+		t.Errorf("idle job: outcome = %+v, want nothing to do", r)
+	}
+
+	fl.addManualDaemon(fakeSocket, "v1.0.0")
+	r := u.signalDaemonRestart()
+	if r.err == nil || !strings.Contains(r.err.Error(), "is loaded but runs no process") || !strings.Contains(r.err.Error(), fakeSocket) {
+		t.Errorf("hand-started daemon: err = %v", r.err)
+	}
+	if ks := fl.kickstarts(); len(ks) != 0 {
+		t.Errorf("kickstarts = %q, want none", ks)
+	}
+}
+
+// TestDarwinRestart_JobRunsAnotherBinary: the job starts some other
+// pilot-daemon, so restarting it would not run the new release.
+func TestDarwinRestart_JobRunsAnotherBinary(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v2.0.0")
+	fl.addDaemonJob(daemonTarget, "/usr/local/bin/pilot-daemon", 700, fakeSocket, "v1.0.0")
+	r := u.signalDaemonRestart()
+	if r.err == nil || !strings.Contains(r.err.Error(), `runs "/usr/local/bin/pilot-daemon"`) {
+		t.Errorf("err = %v, want the other program named", r.err)
+	}
+	if ks := fl.kickstarts(); len(ks) != 0 {
+		t.Errorf("kickstarts = %q, want none", ks)
+	}
+}
+
+// TestDarwinRestart_Failures: kickstart fails, launchd does not start the
+// job again, or the new daemon never answers with the installed version.
+// Each is recorded with how to restart the daemon.
+func TestDarwinRestart_Failures(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name  string
+		setup func(j *fakeJob)
+		want  []string
+	}{
+		{"kickstart refused", func(j *fakeJob) {
+			j.kickErr, j.kickOut = errors.New("exit status 150"), "Operation not permitted while System Integrity Protection is engaged"
+		}, []string{"launchctl kickstart -k " + daemonTarget, "exit status 150", "Operation not permitted"}},
+		{"launchd does not start it again", func(j *fakeJob) { j.respawn = false },
+			[]string{"did not start the daemon again", "state = not running", "start it with: launchctl kickstart " + daemonTarget}},
+		{"new daemon never answers", func(j *fakeJob) { j.newAnswers = false },
+			[]string{"did not answer on " + fakeSocket + " with v2.0.0", "no daemon answered", "restart it with: launchctl kickstart -k"}},
+		{"new daemon reports another version", func(j *fakeJob) { j.newVersion = "v1.0.0" },
+			[]string{"the daemon answered with v1.0.0"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			u, fl := darwinUpdater(t, "v2.0.0")
+			u.restartWait = 50 * time.Millisecond
+			j := fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v1.0.0")
+			j.newVersion = "v2.0.0"
+			tc.setup(j)
+			r := u.signalDaemonRestart()
+			if r.err == nil || r.restarted {
+				t.Fatalf("outcome = %+v, want a failure", r)
+			}
+			for _, w := range tc.want {
+				if !strings.Contains(r.err.Error(), w) {
+					t.Errorf("err = %v\nwant it to contain %q", r.err, w)
+				}
+			}
+		})
+	}
+}
+
+// TestDarwinRestart_StopAbortsWait: Stop() must not wait out the restart
+// window.
+func TestDarwinRestart_StopAbortsWait(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v2.0.0")
+	u.restartWait = time.Minute
+	fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v1.0.0").respawn = false
+	u.stopCh = make(chan struct{})
+	close(u.stopCh)
+	done := make(chan error, 1)
+	go func() { done <- u.signalDaemonRestart().err }()
+	select {
+	case err := <-done:
+		if err == nil || !strings.Contains(err.Error(), "updater stopped") {
+			t.Errorf("err = %v, want stopped", err)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("did not return after Stop")
+	}
+}
+
+// TestDarwinRestart_NeverRestartsItsOwnProcess: if the daemon job's process
+// is this process, kickstart would kill the caller.
+func TestDarwinRestart_NeverRestartsItsOwnProcess(t *testing.T) {
+	t.Parallel()
+	u, fl := darwinUpdater(t, "v2.0.0")
+	fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), os.Getpid(), fakeSocket, "v1.0.0")
+	if r := u.signalDaemonRestart(); r.err == nil || !strings.Contains(r.err.Error(), "the updater runs inside it") {
+		t.Errorf("outcome = %+v", r)
+	}
+	if ks := fl.kickstarts(); len(ks) != 0 {
+		t.Errorf("kickstarts = %q, want none", ks)
+	}
+}
+
+// --- updater service restart on macOS -------------------------------------
+
+func TestRestartUpdaterService(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name      string
+		setup     func(u *Updater, fl *fakeLaunchd)
+		attempted bool
+		restarted bool
+		wantErr   string
+	}{
+		{"restarts the launchd job", func(u *Updater, fl *fakeLaunchd) {
+			fl.addUpdaterJob(updaterTarget, filepath.Join(u.config.InstallDir, "pilot-updater"), 600)
+		}, true, true, ""},
+		{"no job loaded", func(*Updater, *fakeLaunchd) {}, false, false, ""},
+		{"job loaded, no process", func(u *Updater, fl *fakeLaunchd) {
+			fl.addUpdaterJob(updaterTarget, filepath.Join(u.config.InstallDir, "pilot-updater"), 0)
+		}, false, false, ""},
+		{"this process is the job", func(u *Updater, fl *fakeLaunchd) {
+			fl.addUpdaterJob(updaterTarget, filepath.Join(u.config.InstallDir, "pilot-updater"), os.Getpid())
+		}, false, false, ""},
+		{"job runs another binary", func(u *Updater, fl *fakeLaunchd) {
+			fl.addUpdaterJob(updaterTarget, "/opt/other/pilot-updater", 600)
+		}, true, false, `runs "/opt/other/pilot-updater"`},
+		{"kickstart fails", func(u *Updater, fl *fakeLaunchd) {
+			j := fl.addUpdaterJob(updaterTarget, filepath.Join(u.config.InstallDir, "pilot-updater"), 600)
+			j.kickErr, j.kickOut = errors.New("exit status 1"), "boom"
+		}, true, false, "restart updater service (launchctl kickstart -k " + updaterTarget + "): exit status 1 boom"},
+		{"launchd does not start it again", func(u *Updater, fl *fakeLaunchd) {
+			fl.addUpdaterJob(updaterTarget, filepath.Join(u.config.InstallDir, "pilot-updater"), 600).respawn = false
+		}, true, false, "did not start the updater again"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			u, fl := darwinUpdater(t, "v2.0.0")
+			u.restartWait = 50 * time.Millisecond
+			tc.setup(u, fl)
+			r, attempted := u.restartUpdaterService()
+			if attempted != tc.attempted || r.restarted != tc.restarted {
+				t.Errorf("attempted/restarted = %v/%v, want %v/%v (%+v)", attempted, r.restarted, tc.attempted, tc.restarted, r)
+			}
+			switch {
+			case tc.wantErr == "" && r.err != nil:
+				t.Errorf("err = %v", r.err)
+			case tc.wantErr != "" && (r.err == nil || !strings.Contains(r.err.Error(), tc.wantErr)):
+				t.Errorf("err = %v, want %q", r.err, tc.wantErr)
+			}
+			if !tc.attempted || tc.wantErr == `runs "/opt/other/pilot-updater"` {
+				if ks := fl.kickstarts(); len(ks) != 0 {
+					t.Errorf("kickstarts = %q, want none", ks)
+				}
+			}
+		})
+	}
+
+	// Not macOS: nothing to do.
+	u := &Updater{config: Config{InstallDir: t.TempDir()}, goos: "linux"}
+	if _, attempted := u.restartUpdaterService(); attempted {
+		t.Error("linux: attempted = true")
+	}
+}
+
+// --- end to end through RunOnce / the loop --------------------------------
+
+// darwinReleaseUpdater is a RunOnce-ready Updater on the macOS restart path
+// whose install is at v1.0.0 and whose release server offers v2.0.0 with
+// new daemon and updater binaries. The daemon and updater launchd jobs run
+// the installed binaries.
+func darwinReleaseUpdater(t *testing.T) (*Updater, *fakeLaunchd, string) {
+	t.Helper()
+	srv := newReleaseServer(t, "v2.0.0", map[string]string{
+		"daemon":   "new-daemon",
+		"updater":  "new-updater",
+		"pilotctl": "new-pilotctl",
+	})
+	u, statusPath := newTestUpdater(t, srv.Server, "v1.0.0")
+	fl := newFakeLaunchd(t)
+	fl.installDir = u.config.InstallDir
+	fl.attach(u)
+	fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v1.0.0")
+	fl.addUpdaterJob(updaterTarget, filepath.Join(u.config.InstallDir, "pilot-updater"), 600)
+	return u, fl, statusPath
+}
+
+// TestRunOnce_DarwinRestartsDaemonAndUpdaterService reproduces the report
+// end to end: `pilotctl update` installs a release that replaces
+// pilot-daemon, pilotctl and pilot-updater. The daemon's launchd job is
+// kickstarted and confirmed on the new version over IPC, then the updater
+// job is kickstarted so the updater service runs the new binary too. The
+// status file records both, and a restart_error left by an earlier run is
+// cleared although the release replaced pilot-updater (updater v0.2.5 kept
+// it).
+func TestRunOnce_DarwinRestartsDaemonAndUpdaterService(t *testing.T) {
+	t.Parallel()
+	u, fl, statusPath := darwinReleaseUpdater(t)
+	if err := writeStatusFile(statusPath, Status{RestartError: "restart daemon (launchctl kickstart -k x): exit status 113"}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := u.RunOnce(); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	if ks := fl.kickstarts(); len(ks) != 2 || ks[0] != "kickstart -k "+daemonTarget || ks[1] != "kickstart -k "+updaterTarget {
+		t.Errorf("kickstarts = %q, want the daemon then the updater", ks)
+	}
+	st := mustReadStatus(t, statusPath)
+	if st.LastResult != ResultUpdated || st.CurrentVersion != "v2.0.0" {
+		t.Errorf("result = %s %s", st.LastResult, st.CurrentVersion)
+	}
+	if st.RestartError != "" || st.UpdaterRestartError != "" {
+		t.Errorf("restart errors = %q / %q, want none", st.RestartError, st.UpdaterRestartError)
+	}
+	if st.DaemonRestartedAt.IsZero() || st.DaemonRestartedBy != "launchd "+daemonTarget || st.DaemonRestartedVersion != "v2.0.0" {
+		t.Errorf("daemon restart = %v %q %q", st.DaemonRestartedAt, st.DaemonRestartedBy, st.DaemonRestartedVersion)
+	}
+	if st.UpdaterRestartedAt.IsZero() {
+		t.Error("updater_restarted_at not recorded")
+	}
+	// The restart record is newer than the daemon binary, so the restarted
+	// updater service does not restart the daemon a second time.
+	before := len(fl.kickstarts())
+	u.recoverPendingRestart()
+	if after := len(fl.kickstarts()); after != before {
+		t.Errorf("recoverPendingRestart kickstarted again (%d -> %d)", before, after)
+	}
+}
+
+// TestRunOnce_DarwinDaemonNotUnderLaunchd: a hand-started daemon is left
+// running and reported; the updater service is still restarted.
+func TestRunOnce_DarwinDaemonNotUnderLaunchd(t *testing.T) {
+	t.Parallel()
+	u, fl, statusPath := darwinReleaseUpdater(t)
+	fl.mu.Lock()
+	delete(fl.jobs, daemonTarget)
+	fl.mu.Unlock()
+	fl.addManualDaemon(socketFromArgs(nil), "v1.0.0")
+
+	if err := u.RunOnce(); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	if ks := fl.kickstarts(); len(ks) != 1 || ks[0] != "kickstart -k "+updaterTarget {
+		t.Errorf("kickstarts = %q, want only the updater job", ks)
+	}
+	st := mustReadStatus(t, statusPath)
+	if st.LastResult != ResultUpdated || !strings.Contains(st.RestartError, "left running the old version (v1.0.0)") {
+		t.Errorf("status = %s / %q", st.LastResult, st.RestartError)
+	}
+	if !st.DaemonRestartedAt.IsZero() {
+		t.Error("daemon_restarted_at recorded without a restart")
+	}
+}
+
+// TestRunOnce_DarwinUpdaterRestartFailureRecorded: the daemon restart works
+// but the updater job cannot be restarted.
+func TestRunOnce_DarwinUpdaterRestartFailureRecorded(t *testing.T) {
+	t.Parallel()
+	u, fl, statusPath := darwinReleaseUpdater(t)
+	fl.onKickstart = func(target string) ([]byte, error) {
+		if target == updaterTarget {
+			return []byte("Could not kickstart service"), errors.New("exit status 5")
+		}
+		return nil, nil
+	}
+	if err := u.RunOnce(); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	st := mustReadStatus(t, statusPath)
+	if st.RestartError != "" || !strings.Contains(st.UpdaterRestartError, "exit status 5 Could not kickstart service") {
+		t.Errorf("restart errors = %q / %q", st.RestartError, st.UpdaterRestartError)
+	}
+	if !st.UpdaterRestartedAt.IsZero() {
+		t.Error("updater_restarted_at recorded for a failed restart")
+	}
+}
+
+// TestLoop_DarwinSelfUpdateLeavesRestartsToSuccessor: the loop (the updater
+// service itself) replaced its own binary. It exits for launchd to start it
+// again and restarts nothing: the new process does the daemon.
+func TestLoop_DarwinSelfUpdateLeavesRestartsToSuccessor(t *testing.T) {
+	t.Parallel()
+	u, fl, statusPath := darwinReleaseUpdater(t)
+	var exits atomic.Int32
+	u.exitFn = func(int) { exits.Add(1) }
+	if err := u.checkOnce(); err != nil {
+		t.Fatalf("checkOnce: %v", err)
+	}
+	if exits.Load() != 1 {
+		t.Errorf("exits = %d, want 1", exits.Load())
+	}
+	if ks := fl.kickstarts(); len(ks) != 0 {
+		t.Errorf("kickstarts = %q, want none from the stale updater", ks)
+	}
+
+	// Its successor restarts the daemon on startup and records it. (The
+	// test's restart record is dated in the future; date it before the
+	// update, as it would be.)
+	past := time.Now().Add(-time.Hour)
+	if err := os.Chtimes(filepath.Join(u.config.InstallDir, ".daemon-last-restart"), past, past); err != nil {
+		t.Fatal(err)
+	}
+	u2 := &Updater{config: u.config}
+	fl.attach(u2)
+	u2.recoverPendingRestart()
+	if ks := fl.kickstarts(); len(ks) != 1 || ks[0] != "kickstart -k "+daemonTarget {
+		t.Errorf("kickstarts = %q, want the daemon", ks)
+	}
+	if st := mustReadStatus(t, statusPath); st.RestartError != "" || st.DaemonRestartedVersion != "v2.0.0" {
+		t.Errorf("status = %q / %q", st.RestartError, st.DaemonRestartedVersion)
+	}
+}
+
+// TestRunCheck_DarwinClearsRestartErrorOnceDaemonIsCurrent: after a
+// restart failure, a later check that finds the daemon answering with the
+// installed version clears restart_error (before, macOS kept it until the
+// next release).
+func TestRunCheck_DarwinClearsRestartErrorOnceDaemonIsCurrent(t *testing.T) {
+	t.Parallel()
+	srv := newReleaseServer(t, "v1.0.0", map[string]string{"daemon": "d"})
+	u, statusPath := newTestUpdater(t, srv.Server, "v1.0.0")
+	fl := newFakeLaunchd(t)
+	fl.attach(u)
+	j := fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v0.9.0")
+	const restartErr = "daemon left running the old version"
+	if err := writeStatusFile(statusPath, Status{RestartError: restartErr}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := u.RunOnce(); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	if st := mustReadStatus(t, statusPath); st.RestartError != restartErr {
+		t.Fatalf("restart_error = %q, want kept while the daemon reports v0.9.0", st.RestartError)
+	}
+
+	fl.mu.Lock()
+	j.version = "v1.0.0" // restarted by hand
+	fl.mu.Unlock()
+	if err := u.RunOnce(); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	if st := mustReadStatus(t, statusPath); st.RestartError != "" {
+		t.Errorf("restart_error = %q, want cleared", st.RestartError)
+	}
+	if ks := fl.kickstarts(); len(ks) != 0 {
+		t.Errorf("kickstarts = %q; an up-to-date check restarts nothing", ks)
+	}
+
+	// With no restart_error on record, an up-to-date check does not even
+	// ask launchd or the daemon.
+	fl.mu.Lock()
+	fl.calls = nil
+	fl.mu.Unlock()
+	if err := u.RunOnce(); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	fl.mu.Lock()
+	calls := fl.calls
+	fl.mu.Unlock()
+	if len(calls) != 0 {
+		t.Errorf("launchctl calls = %q, want none", calls)
+	}
+}
+
+// TestUpdateStatus_KeepsFieldsOfNewerWriters: pilotctl and the updater
+// service share update-state.json and can run different updater versions.
+// Seen on a macOS runner: the updater service of the release just installed
+// (an older updater) rewrote the file right after `pilotctl update` and
+// dropped daemon_restarted_* and updater_restarted_at, which it did not
+// know. A writer must keep fields it does not define, while its own fields
+// (including ones it clears) are written as it decides.
+func TestUpdateStatus_KeepsFieldsOfNewerWriters(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(t.TempDir(), StatusFileName)
+	onDisk := `{
+  "last_result": "updated",
+  "restart_error": "left running",
+  "future_restart": {"by": "launchd", "pids": [1, 2]},
+  "zz_flag": true
+}
+`
+	if err := os.WriteFile(path, []byte(onDisk), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	u := &Updater{config: Config{StatusPath: path, Version: "v0.2.6"}}
+	u.updateStatus(func(s *Status) { s.RestartError = ""; s.LoopPID = 42 })
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !json.Valid(data) {
+		t.Fatalf("status file is not valid JSON:\n%s", data)
+	}
+	var all map[string]json.RawMessage
+	if err := json.Unmarshal(data, &all); err != nil {
+		t.Fatal(err)
+	}
+	if string(all["zz_flag"]) != "true" {
+		t.Errorf("zz_flag = %s, want kept", all["zz_flag"])
+	}
+	var fr struct {
+		By   string `json:"by"`
+		Pids []int  `json:"pids"`
+	}
+	if err := json.Unmarshal(all["future_restart"], &fr); err != nil || fr.By != "launchd" || len(fr.Pids) != 2 {
+		t.Errorf("future_restart = %s (%v), want kept", all["future_restart"], err)
+	}
+	if _, ok := all["restart_error"]; ok {
+		t.Error("restart_error kept; this writer cleared it")
+	}
+	st := mustReadStatus(t, path)
+	if st.LoopPID != 42 || st.LastResult != ResultUpdated || st.UpdaterVersion != "v0.2.6" {
+		t.Errorf("status = %+v", st)
+	}
+
+	// Without unknown fields the file is exactly the indented struct.
+	plain := Status{LastResult: ResultUpToDate}
+	got, err := marshalStatus(plain, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want, _ := json.MarshalIndent(plain, "", "  ")
+	if string(got) != string(want) {
+		t.Errorf("marshalStatus without extras = %s, want %s", got, want)
+	}
+}
diff --git a/zz_no_gh_test.go b/zz_no_gh_test.go
index d070d22..5a2e42c 100644
--- a/zz_no_gh_test.go
+++ b/zz_no_gh_test.go
@@ -20,9 +20,10 @@ import (
 // v1.12.2–v1.13.4 refused every update for as long as it ran that updater.
 //
 // The updater must verify and apply releases with no external tools. The one
-// allowed exec is `launchctl` (restarting the daemon under launchd on
-// macOS), and it must go through runCommand so tests can stub it. This test
-// parses the package's non-test sources and fails on any other exec.
+// allowed exec is `launchctl` (reading and restarting the daemon and updater
+// jobs under launchd on macOS), and it must go through runCommand so tests
+// can stub it. This test parses the package's non-test sources and fails on
+// any other exec.
 func TestNoExternalToolDependency(t *testing.T) {
 	t.Parallel()
 	files, err := filepath.Glob("*.go")
@@ -77,12 +78,19 @@ func TestNoExternalToolDependency(t *testing.T) {
 	}
 
 	// Every command actually run goes through Updater.command; the only
-	// program named anywhere is launchctl.
-	src, err := os.ReadFile("updater.go")
-	if err != nil {
-		t.Fatal(err)
+	// program named anywhere is launchctl (Updater.launchctl).
+	var src strings.Builder
+	for _, name := range files {
+		if strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		data, err := os.ReadFile(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		src.Write(data)
 	}
-	if n := strings.Count(string(src), `u.command(`); n != 1 || !strings.Contains(string(src), `u.command("launchctl"`) {
+	if n := strings.Count(src.String(), `u.command(`); n != 1 || !strings.Contains(src.String(), `u.command("launchctl"`) {
 		t.Errorf("expected exactly one u.command(\"launchctl\", ...) call, found %d u.command calls", n)
 	}
 }
diff --git a/zz_restart_test.go b/zz_restart_test.go
index 2523547..91773ae 100644
--- a/zz_restart_test.go
+++ b/zz_restart_test.go
@@ -80,7 +80,7 @@ func TestSignalDaemonRestartLinux_Paths(t *testing.T) {
 		gotPid, gotSig = pid, sig
 		return nil
 	}
-	if err := u.signalDaemonRestartLinux(); err != nil {
+	if err := u.signalDaemonRestartLinux().err; err != nil {
 		t.Fatalf("signalDaemonRestartLinux: %v", err)
 	}
 	if gotPid != 77 || gotSig != syscall.SIGTERM {
@@ -89,48 +89,18 @@ func TestSignalDaemonRestartLinux_Paths(t *testing.T) {
 
 	// The restarted daemon (on the installed binary) is found next time.
 	sys.onKill = func(int, syscall.Signal) error { return errors.New("operation not permitted") }
-	if err := u.signalDaemonRestartLinux(); err == nil || !strings.Contains(err.Error(), "operation not permitted") {
+	if err := u.signalDaemonRestartLinux().err; err == nil || !strings.Contains(err.Error(), "operation not permitted") {
 		t.Errorf("kill failure = %v, want reported", err)
 	}
 
 	root := u.procRoot
 	u.procRoot = fakeProc(t, nil)
-	if err := u.signalDaemonRestartLinux(); err != nil {
+	if err := u.signalDaemonRestartLinux().err; err != nil {
 		t.Errorf("daemon not running must not be an error, got %v", err)
 	}
 
 	u.procRoot = filepath.Join(root, "does-not-exist")
-	if err := u.signalDaemonRestartLinux(); err == nil {
+	if err := u.signalDaemonRestartLinux().err; err == nil {
 		t.Error("unreadable /proc must be reported")
 	}
 }
-
-// TestSignalDaemonRestartDarwin_Paths: the launchctl invocation and its
-// failure are reported (a daemon started by hand, not by launchd, keeps
-// running the old binary).
-func TestSignalDaemonRestartDarwin_Paths(t *testing.T) {
-	t.Parallel()
-	var got []string
-	u := &Updater{
-		config: Config{InstallDir: t.TempDir()},
-		runCmd: func(name string, args ...string) ([]byte, error) {
-			got = append([]string{name}, args...)
-			return nil, nil
-		},
-	}
-	if err := u.signalDaemonRestartDarwin(); err != nil {
-		t.Fatalf("signalDaemonRestartDarwin: %v", err)
-	}
-	if len(got) != 4 || got[0] != "launchctl" || got[1] != "kickstart" || got[2] != "-k" ||
-		!strings.HasSuffix(got[3], "/network.pilotprotocol.pilot-daemon") {
-		t.Errorf("command = %q", got)
-	}
-
-	u.runCmd = func(string, ...string) ([]byte, error) {
-		return []byte("Could not find service"), errors.New("exit status 113")
-	}
-	err := u.signalDaemonRestartDarwin()
-	if err == nil || !strings.Contains(err.Error(), "Could not find service") || !strings.Contains(err.Error(), "exit status 113") {
-		t.Errorf("launchctl failure = %v, want reported with output", err)
-	}
-}
diff --git a/zz_status_test.go b/zz_status_test.go
index b10a475..fc0c1fb 100644
--- a/zz_status_test.go
+++ b/zz_status_test.go
@@ -21,12 +21,15 @@ import (
 	"time"
 )
 
-// restartSpy captures daemon-restart attempts on both platforms: launchctl
-// on macOS (runCmd) and SIGTERM on Linux (killFn). On Linux the daemon is a
-// fake /proc entry whose exe reads "<path> (deleted)", which is what a real
-// daemon looks like right after its binary was renamed over. It runs in
-// pilot-daemon.service with Restart=always, and after a successful SIGTERM
-// the fake systemd starts it again on the installed binary.
+// restartSpy captures daemon-restart attempts on both platforms: `launchctl
+// kickstart -k` on macOS and SIGTERM on Linux (killFn). On macOS the daemon
+// runs under its launchd job from the installed binary; after a kickstart
+// the fake launchd starts it again and it answers over IPC with the
+// installed version. On Linux the daemon is a fake /proc entry whose exe
+// reads "<path> (deleted)", which is what a real daemon looks like right
+// after its binary was renamed over. It runs in pilot-daemon.service with
+// Restart=always, and after a successful SIGTERM the fake systemd starts it
+// again on the installed binary.
 type restartSpy struct {
 	mu    sync.Mutex
 	calls []string
@@ -35,15 +38,19 @@ type restartSpy struct {
 
 func (r *restartSpy) install(t *testing.T, u *Updater) {
 	t.Helper()
-	u.runCmd = func(name string, args ...string) ([]byte, error) {
+	fl := newFakeLaunchd(t)
+	fl.installDir = u.config.InstallDir
+	fl.addDaemonJob(daemonTarget, filepath.Join(u.config.InstallDir, "pilot-daemon"), 700, fakeSocket, "v0.0.1")
+	fl.onKickstart = func(target string) ([]byte, error) {
 		r.mu.Lock()
 		defer r.mu.Unlock()
-		r.calls = append(r.calls, name+" "+strings.Join(args, " "))
+		r.calls = append(r.calls, "launchctl kickstart -k "+target)
 		if r.fail != nil {
 			return []byte("launchd says no"), r.fail
 		}
 		return nil, nil
 	}
+	fl.wire(u)
 	sys := newFakeSystem(t, u.config.InstallDir)
 	sys.addReplacedDaemon(3999999, cgroupPilotService)
 	sys.writeFile("pilot-daemon.service", daemonUnit(sys.daemon, "always"))
diff --git a/zz_supervisor_test.go b/zz_supervisor_test.go
index f6dddae..88eff47 100644
--- a/zz_supervisor_test.go
+++ b/zz_supervisor_test.go
@@ -238,7 +238,7 @@ func TestSignalDaemonRestartLinux_UnsupervisedDaemonIsLeftRunning(t *testing.T)
 			u := &Updater{config: Config{InstallDir: installDir}, goos: "linux"}
 			fs.attach(u)
 
-			err := u.signalDaemonRestart()
+			err := u.signalDaemonRestart().err
 			if err == nil {
 				t.Fatal("signalDaemonRestart = nil; an unsupervised daemon must be reported, not stopped")
 			}
@@ -344,7 +344,7 @@ func TestSignalDaemonRestartLinux_RestartPolicy(t *testing.T) {
 			u := &Updater{config: Config{InstallDir: installDir}, goos: "linux"}
 			fs.attach(u)
 
-			err := u.signalDaemonRestart()
+			err := u.signalDaemonRestart().err
 			if tc.signal {
 				if err != nil {
 					t.Fatalf("signalDaemonRestart: %v", err)
@@ -369,7 +369,7 @@ func TestSignalDaemonRestartLinux_RestartPolicy(t *testing.T) {
 func TestSignalDaemonRestartLinux_OnFailureMessage(t *testing.T) {
 	t.Parallel()
 	u, fs := supervisedLinuxUpdater(t, "on-failure")
-	err := u.signalDaemonRestart()
+	err := u.signalDaemonRestart().err
 	if err == nil {
 		t.Fatal("want an error")
 	}
@@ -395,7 +395,7 @@ func TestSignalDaemonRestartLinux_ReportsDaemonThatDoesNotComeBack(t *testing.T)
 	fs.restarts = false
 	u.restartWait = 50 * time.Millisecond
 
-	err := u.signalDaemonRestart()
+	err := u.signalDaemonRestart().err
 	if err == nil {
 		t.Fatal("signalDaemonRestart = nil although the daemon never came back")
 	}
@@ -426,7 +426,7 @@ func TestSignalDaemonRestartLinux_WaitsForNewDaemon(t *testing.T) {
 	}
 
 	start := time.Now()
-	if err := u.signalDaemonRestart(); err != nil {
+	if err := u.signalDaemonRestart().err; err != nil {
 		t.Fatalf("signalDaemonRestart: %v", err)
 	}
 	if time.Since(start) < fs.delay {
@@ -451,7 +451,7 @@ func TestSignalDaemonRestartLinux_StopAbortsWait(t *testing.T) {
 	close(u.stopCh)
 
 	done := make(chan error, 1)
-	go func() { done <- u.signalDaemonRestart() }()
+	go func() { done <- u.signalDaemonRestart().err }()
 	select {
 	case err := <-done:
 		if err == nil || !strings.Contains(err.Error(), "updater stopped") {
@@ -613,7 +613,9 @@ func TestRunCheck_ClearsRestartErrorOnceDaemonIsCurrent(t *testing.T) {
 		t.Errorf("restart_error = %q, want cleared once the daemon runs the installed binary", st.RestartError)
 	}
 
-	// macOS has no /proc to check, so the error is kept there.
+	// macOS has no /proc: it asks the daemon over IPC instead (see
+	// TestRunCheck_DarwinClearsRestartErrorOnceDaemonIsCurrent). With no
+	// daemon answering, the error is kept.
 	if err := writeStatusFile(statusPath, Status{RestartError: restartErr}); err != nil {
 		t.Fatal(err)
 	}
@@ -622,7 +624,7 @@ func TestRunCheck_ClearsRestartErrorOnceDaemonIsCurrent(t *testing.T) {
 		t.Fatalf("RunOnce: %v", err)
 	}
 	if st := mustReadStatus(t, statusPath); st.RestartError != restartErr {
-		t.Errorf("darwin: restart_error = %q, want kept (no /proc to check)", st.RestartError)
+		t.Errorf("darwin: restart_error = %q, want kept while no daemon answers", st.RestartError)
 	}
 }
 
diff --git a/zz_systemd_e2e_test.go b/zz_systemd_e2e_test.go
index 07f6421..f048b1e 100644
--- a/zz_systemd_e2e_test.go
+++ b/zz_systemd_e2e_test.go
@@ -153,7 +153,7 @@ func TestSystemdE2E_RestartAlways(t *testing.T) {
 		t.Fatalf("after replace, exe = %q", got)
 	}
 
-	if err := u.signalDaemonRestart(); err != nil {
+	if err := u.signalDaemonRestart().err; err != nil {
 		t.Fatalf("signalDaemonRestart: %v", err)
 	}
 	newPid := mainPID(t, unit)
@@ -177,7 +177,7 @@ func TestSystemdE2E_RestartOnFailure(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err := u.signalDaemonRestart()
+	err := u.signalDaemonRestart().err
 	if err == nil || !strings.Contains(err.Error(), "Restart=on-failure") {
 		t.Fatalf("signalDaemonRestart = %v, want the Restart=on-failure error", err)
 	}
@@ -215,7 +215,7 @@ func TestSystemdE2E_Unsupervised(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err := u.signalDaemonRestart()
+	err := u.signalDaemonRestart().err
 	if err == nil || !strings.Contains(err.Error(), "pilotctl daemon stop && pilotctl daemon start") {
 		t.Fatalf("signalDaemonRestart = %v, want the unsupervised error", err)
 	}
diff --git a/zz_test.go b/zz_test.go
index ab35374..0da07cd 100644
--- a/zz_test.go
+++ b/zz_test.go
@@ -28,6 +28,11 @@ import (
 // developer Mac with Pilot installed, `launchctl kickstart -k
 // gui/<uid>/network.pilotprotocol.pilot-daemon` would restart the developer's
 // running daemon. Tests that care about the command use Updater.runCmd.
+//
+// For the same reason it replaces probeDaemonVersion, which would otherwise
+// connect to the developer's daemon on /tmp/pilot.sock. Tests that care about
+// the daemon's answer use Updater.probeFn (or call realProbeDaemonVersion on
+// a socket of their own).
 func TestMain(m *testing.M) {
 	verifyChecksumsAttestationFn = func(repo, tag, checksumsPath string) error {
 		return nil
@@ -35,9 +40,17 @@ func TestMain(m *testing.M) {
 	runCommand = func(name string, args ...string) ([]byte, error) {
 		return nil, nil
 	}
+	probeDaemonVersion = func(string) (string, bool) { return "", false }
 	os.Exit(m.Run())
 }
 
+// The real implementations, saved before TestMain replaces them. Package
+// variables are initialised before TestMain runs.
+var (
+	realRunCommand         = runCommand
+	realProbeDaemonVersion = probeDaemonVersion
+)
+
 func TestParseSemver(t *testing.T) {
 	t.Parallel()
 	tests := []struct {