Two independent layers.
Layer 1: the hot update (interface and local server)
Replaces the built interface and the Node server. Not the shell, not the bundled tools.
- Checks 20 seconds after start, then every 5 minutes.
- Applies completely silently, and only when you are not mid-gesture; the page simply reloads. No banner, no version number, no consent.
- Packages are signature-verified against a public key baked into the app; without that key the channel is inert.
- Cannot be disabled, and there is no manual check button.
- If an update fails to start you get "Update N didn't start — reverted to the previous version.", and Settings offers Revert to the bundled version (a one-way door: that version is blocklisted for good).
Layer 2: the native updater (the whole app)
Replaces the entire signed .app.
- Checks on three triggers: at launch; when the window regains focus (at most once every 15 minutes); and on a timer every 6 hours. The third exists because on macOS closing a window does not end the process, so a user could sit on an old version for a week without ever seeing a banner.
- Manual check: Settings → App.
- A banner appears bottom-right, currently all in Russian: version available, Update / Later, then a download percentage, then a restart notice.
- The restart is automatic once the download completes; you are not asked twice.
- Later is not remembered: the next check offers the same version again.
- Errors are completely silent. A failed check or download shows nothing at all.
- Release notes are downloaded and then never displayed.
- Cannot be disabled.
Something here wrong, or something missing? Tell us — the manual is corrected against the app, not the other way round.