feat: add macOS launchd daemon support

README.md

@@ -701,17 +701,19 @@ chmod +x .git/hooks/post-commit
 
 ### Daemon Debugging
 
-The daemon is a long-running MCP server for clients that share one local socket. Its logs go to stderr; when installed as a Linux user service, systemd captures them in journald.
+The daemon is a long-running MCP server for clients that share one local socket. It is opt-in: `tracedecay daemon install-service` installs a per-user service on Linux systemd or a per-user LaunchAgent on macOS.
 
 ```bash
-tracedecay daemon install-service     # install/start Linux systemd user service
+tracedecay daemon install-service     # install/start per-user daemon service
 tracedecay daemon status              # service path, socket state, log command
 systemctl --user status tracedecay.service --no-pager
 journalctl --user -u tracedecay.service -f
+launchctl print "gui/$(id -u)/com.tracedecay.daemon"
+tail -f ~/.tracedecay/daemon.err.log
 tracedecay status --runtime --json    # process + DB/WAL/SHM telemetry snapshot
 ```
 
-Scheduler logs use stable `event=... key=value` fields such as `event=scheduler_tick`, `event=scheduler_task`, `task=memory_curator`, `outcome=skipped`, and `reason=not_configured`, so they can be filtered directly from journald.
+Scheduler logs use stable `event=... key=value` fields such as `event=scheduler_tick`, `event=scheduler_task`, `task=memory_curator`, `outcome=skipped`, and `reason=not_configured`, so they can be filtered directly from journald on Linux or the daemon log file on macOS.
 
 ### Upgrading from 5.x
 
@@ -760,7 +762,7 @@ tracedecay update-plugin            # Refresh generated plugin code/assets only;
 tracedecay uninstall [--agent NAME] [--profile NAME] # Remove agent integration
 tracedecay serve                    # Start MCP server
 tracedecay daemon status            # Show daemon service/socket/log hints
-tracedecay daemon install-service   # Install/start Linux systemd user service
+tracedecay daemon install-service   # Install/start per-user daemon service
 tracedecay monitor                  # Live TUI showing MCP calls across all projects
 tracedecay update                   # Refresh binary, generated plugins, and daemon
 tracedecay upgrade                  # Self-update to latest version

SECURITY.md

@@ -100,9 +100,9 @@ The edit tools target a single file with a unique anchor and re-index in place.
 
 **Windows:** Authenticode code signing via the [SignPath.io Foundation](https://signpath.io/foundation) program is being rolled out so Windows binaries are signed as part of the release workflow (addresses the Smart App Control block reported in #79). Until that lands in a published release, Windows binaries remain unsigned.
 
-### No background daemon
+### Opt-in background daemon
 
-tracedecay runs **no background daemon, system service, or autostart process**. The standalone `tracedecay daemon` command and its launchd/systemd/Windows-Service autostart were removed in 6.0.0. Index freshness is maintained entirely on demand: an on-demand staleness check on each MCP tool call (30-second cooldown) plus a catch-up sync when the MCP server connects. The server lives only for the lifetime of the attached agent and runs with **standard user privileges** — it never requests elevation.
+tracedecay installs **no background daemon, system service, or autostart process by default**. Users can explicitly opt in with `tracedecay daemon install-service`, which installs a per-user systemd service on Linux or a per-user LaunchAgent on macOS. The daemon runs with **standard user privileges** and never requests elevation. Index freshness still relies on on-demand staleness checks, catch-up syncs when MCP clients connect, and bounded hook notifications; the daemon provides shared MCP process/socket reuse and scheduled automation for projects that connect to it.
 
 ### Subprocess-isolated extraction
 

docs/USER-GUIDE.md

@@ -462,6 +462,21 @@ chmod +x .git/hooks/post-commit
 
 The MCP server does not run a background file watcher. Instead, MCP tool calls perform a lightweight staleness check and run an incremental sync when indexed files are stale. Agent file/shell hooks notify the daemon about targeted edits and branch-affecting commands, and the daemon's MCP server schedules the resulting sync/branch work. Multiple MCP servers on the same project coordinate via a per-project sync lock: only one sync runs at a time.
 
+### Optional daemon service
+
+If you want the daemon available across terminal sessions and after login, install the per-user service:
+
+```bash
+tracedecay daemon install-service
+tracedecay daemon status
+```
+
+On Linux this installs a systemd user service. On macOS this installs a LaunchAgent at `~/Library/LaunchAgents/com.tracedecay.daemon.plist`. Remove it with:
+
+```bash
+tracedecay daemon uninstall-service
+```
+
 ### CLI-Only Workflows
 
 If you don't keep an agent attached, use a git post-commit hook to refresh the index on commit: