SaltStack and template management: discrepanies between `update.qubes-vm` and in-(Fedora)template `dnf update`?

Thank you.
First feedback: changing updateVM to sys-firewall didn’t fix this. But I now see an error Could not create DNF metadata cache - this error does NOT shop up when using sys-whonix.

I looked around and found an old post of yours here:

Changing the repo lines for fedora to http://HTTPS/// did not seem to fix it either.

On to salt debugging.