lifecycle: stop before update for boot-style apply (mara@#372)

hive-c0re/src/lifecycle.rs

@@ -336,14 +336,34 @@ pub async fn rebuild_no_meta(
     let container = container_name(name);
     let flake_ref = format!("{}#{name}", crate::meta::meta_dir().display());
     if container_exists(name).await {
-        // Existing container: update nspawn flags, then rebuild + restart
+        // Existing container: preserve the prior running state across
-        // so any bind-mount / networking changes take effect.
+        // rebuild (closes #371) and apply both the new system profile
+        // AND any `/etc/nixos-containers/<c>.conf` / drop-in changes
+        // in a single start rather than `update`'s reload-then-outer-
+        // restart double-bounce.
+        //
+        // `nixos-container update` only runs `systemctl reload
+        // container@<c>` when the container is up (per the
+        // `isContainerRunning` check in nixos-container.pl), so
+        // stopping first makes `update` boot-style: build + nix-env
+        // --set the new profile, skip the in-container
+        // switch-to-configuration, let the next `start` apply both
+        // the new profile and the new EXTRA_NSPAWN_FLAGS in one go.
+        // If the container was already stopped, `update` builds + sets
+        // the profile and we leave it stopped.
+        let was_running = is_running(name).await;
         set_nspawn_flags(&container, agent_dir, claude_dir, notes_dir)?;
         set_resource_limits(&container)?;
         systemd_daemon_reload().await?;
+        if was_running {
+            run(&["stop", &container]).await?;
+        }
         run(&["update", &container, "--flake", &flake_ref]).await?;
-        run(&["stop", &container]).await?;
+        if was_running {
-        run(&["start", &container]).await
+            run(&["start", &container]).await
+        } else {
+            Ok(())
+        }
     } else {
         // First spawn: create the container first (which writes the nspawn
         // conf file), then overwrite with our flags and start.