Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

shaker/cacher/apt-cacher-ng user here.

I’ve read through this entire thread several times, but can’t seem to figure out how/why only my fedora templates detect updates, except that they are the only ones that bypass cacher.

My Dom0 /etc/qubes/policy.d/30-user.policy has

### Route Fedora TemplateVMs to bypass apt-cacher-ng 
qubes.UpdatesProxy  *  @tag:bypass-cacher     @default  allow target=sys-net

# Default rules for all TemplateVMs
qubes.UpdatesProxy  *  @type:TemplateVM  @default  allow target=cacher
qubes.UpdatesProxy  *  @tag:whonix-updatevm  @default  allow target=sys-whonix

### Default denies
qubes.UpdatesProxy  *   @anyvm            @anyvm    deny

According to qvm-service on dom0, only cacher had the qubes-updates-proxy. None of the other TemplateVMs, AppVMs, AppVM-as-a-DispVM-Template had that service or the updates-proxy-setup service listed or enabled.

All of the AppVMs and App-VM-as-a-DispVM-Template had the qubes-update-check.timer and the qubes-update-check.service enabled and active.

It seems like I am missing something basic here. Can someone point me in the right direction?