Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

[Insurgo]

EDIT: massively and repeateady edited.
Edit2: wrong conclusions here!!! As corrected below by @AndyZ :

@AndyZ

The help for qvm-service says that -d (lowercase) is “disable service (same as setting “off” value)”
It is -D (uppercase) that is used to “unset service (default to VM preference)”

Corrected under Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on? - #17 by Insurgo

Summary

This is wrong and was hidden so others don’t take this as a truism.

@enmus

But according to @Insurgo’s terrifying conclusion. even this isn’t enough, so I’m not clear if disabling update-check in vault would have implications on overall system in every possible way imagined

As said, qvm-features reports on deviation on defaults.
Conclusion is that qubes-update-check and qubes-proxy-setup are off by default. @adw @enmus: Sorry for the noise.

Can be confirmed by setting back an appvm to default (qvm-service AppVM ServiceName -d) and then checking its status qvm-service AppVM ServiceName) :

[user@dom0 ~]$ qvm-service untrusted qubes-update-check -d
[user@dom0 ~]$ qvm-service untrusted qubes-update-check
off
[user@dom0 ~]$ qvm-service untrusted qubes-proxy-setup -d
[user@dom0 ~]$ qvm-service untrusted qubes-proxy-setup
off