@@ -210,13 +210,17 @@ For Electron development, also run
 ## Release notifications
 
 Starting with v0.0.7, installed macOS builds check for a newer stable release at launch and hourly while the
-workspace is visible, with a check when you return to it. A small banner links to the
-release page; dismissing it hides that version across relaunches. A later release appears
-again. Checks use public GitHub release metadata and require an uploaded installer for
-your Mac. Offline failures stay quiet. From v0.0.12 the banner also offers **Download update**:
-Modex verifies the archive and its publisher, then offers **Restart to update** and keeps your
-drafts. Builds before v0.0.12 install it manually once. Windows and Linux show no update banner;
-install a newer release by hand. See [update preparation and draft recovery](docs/update-recovery.md).
+workspace is visible, with a check when you return to it. Checks use public GitHub release
+metadata and require an uploaded installer for your Mac. Offline failures stay quiet.
+
+After v0.2.0, updates arrive over the air. When a check finds a newer release, Modex downloads
+it and verifies the archive and its publisher in the background. The banner then offers
+**Restart to update**, which keeps your drafts. If you never click it, the update installs the
+next time you quit Modex. **What’s new** opens the release notes; you never need the release
+page to update. Dismissing the banner hides that version across relaunches, and a dismissed
+update still installs when you quit. v0.0.12 through v0.2.0 ask you to click **Download update**
+first, and builds before v0.0.12 install a newer release manually once. Windows and Linux show no
+update banner; install a newer release by hand. See [update preparation and draft recovery](docs/update-recovery.md).
 
 If you are on v0.0.6 or earlier, install v0.0.7 from the release page once to enable future
 update notifications; older builds do not contain the banner.
 
@@ -22,10 +22,16 @@ safeStorage.encryptString = value => Buffer.from(value);
 safeStorage.decryptString = value => value.toString();
 shell.openExternal = async () => { throw new Error("External navigation is disabled in this fixture."); };
 globalThis.fetch = async () => { throw new Error("Network is disabled in this fixture."); };
-const scenario = globalThis.__updateScenario = { downloads: 0, downloadedDisposed: 0, stagedDisposed: 0, nativeCalls: 0 };
+const scenario = globalThis.__updateScenario = { downloads: 0, downloadedDisposed: 0, stagedDisposed: 0, nativeCalls: 0, quitStages: 0 };
 const forbidNative = () => { scenario.nativeCalls++; throw new Error("Native installation is forbidden in this fixture."); };
 for (const name of ["setFeedURL", "checkForUpdates", "quitAndInstall"]) autoUpdater[name] = forbidNative;
-MacUpdateHandoff.prototype.stage = forbidNative;
+// Install-on-quit reaches this boundary after the real preflight and drain. Record the
+// durable receipt as Squirrel's handoff would, but never touch the native updater.
+MacUpdateHandoff.prototype.stage = async (snapshot, recordAttempt) => {
+  scenario.quitStages++;
+  await recordAttempt({ version: snapshot.version, sha512: snapshot.sha512, startedAt: new Date().toISOString() });
+  return "staged";
+};
 const release = { version: "999.0.0", url: "https://github.com/TypeSafeAI/modex/releases/tag/v999.0.0" };
 ReleaseChecker.prototype.check = async () => release;
 ReleaseChecker.prototype.archive = () => ({ version: release.version, arch: process.arch, size: 100, sha256: "ab".repeat(32) });
 
@@ -26,16 +26,19 @@ async function counts(app: ElectronApplication) {
   });
 }
 
+/** Quits, checks the evidence every test shares and returns it for the test's own checks. */
 async function cleanup(app: ElectronApplication, home: string, repo: string) {
+  let final: { nativeCalls: number; downloadedDisposed: number; stagedDisposed: number; quitStages: number } | undefined;
   try {
     // An assertion can fail while the fake verifier is suspended. Release it so
     // production disposal can finish and the failed test cannot retain Electron.
     await app.evaluate(() => (globalThis as any).__updateScenario?.finishVerification?.(false));
   } finally {
     try {
       await app.close();
-      const final = JSON.parse(fs.readFileSync(path.join(home, "final-installation-evidence.json"), "utf8"));
-      expect(final.nativeCalls).toBe(0); expect(final.downloadedDisposed).toBe(final.stagedDisposed);
+      final = JSON.parse(fs.readFileSync(path.join(home, "final-installation-evidence.json"), "utf8"));
+      // quitAndInstall relaunches; install-on-quit only stages and lets the quit finish.
+      expect(final!.nativeCalls).toBe(0); expect(final!.downloadedDisposed).toBe(final!.stagedDisposed);
       const receipt = test.info().outputPath("installation-controller-evidence.json");
       fs.writeFileSync(receipt, JSON.stringify(final));
       await test.info().attach("installation-controller-evidence", { path: receipt, contentType: "application/json" });
@@ -45,28 +48,34 @@ async function cleanup(app: ElectronApplication, home: string, repo: string) {
       fs.rmSync(repo, { recursive: true, force: true });
     }
   }
+  return final!;
 }
 
-test("installation UI shows progress, cancels and retries, then refuses restart with open Settings", async () => {
+test("installation downloads by itself, cancels and retries, refuses restart with open Settings, then installs on quit", async () => {
   test.skip(process.platform !== "darwin", "macOS native update controller");
   const { home, repo, app, page } = await launchInstallation();
+  let final;
   try {
     const banner = tid(page, "update-banner");
-    await expect(banner.getByRole("button", { name: "Download update", exact: true })).toBeVisible();
-    await banner.getByRole("button", { name: "Download update", exact: true }).click();
+    // Nobody clicks: finding the release starts the download.
     await expect(page.getByRole("progressbar", { name: "Update download" })).toHaveAttribute("value", "25");
     await expect(banner).toContainText("Downloading the update…");
     await expect(banner.getByRole("button", { name: "Dismiss update notification" })).toHaveCount(0);
     await banner.getByRole("button", { name: "Cancel download", exact: true }).click();
     await expect(banner).toContainText("Update preparation cancelled.");
+    // A cancelled version stays cancelled when the window regains focus.
+    await page.evaluate(() => window.dispatchEvent(new Event("focus")));
+    await expect(banner.getByRole("button", { name: "Download update", exact: true })).toBeVisible();
+    expect((await counts(app)).downloads).toBe(1);
     await banner.getByRole("button", { name: "Download update", exact: true }).click();
     await expect(banner).toContainText("Downloading the update…");
     await finishDownload(app);
     await expect(banner).toContainText("Verifying the publisher and update…");
     await finishVerification(app, true);
     await expect(banner.getByRole("button", { name: "Restart to update", exact: true })).toBeEnabled();
-    await expect(banner).toContainText("Verified and ready.");
-    await expect(banner.getByRole("button", { name: "Dismiss update notification" })).toHaveCount(0);
+    await expect(banner).toContainText("Modex 999.0.0 is ready to install");
+    await expect(banner).toContainText("installs the next time you quit");
+    await expect(banner.getByRole("link", { name: "What’s new" })).toHaveAttribute("href", "https://github.com/TypeSafeAI/modex/releases/tag/v999.0.0");
     await tid(page, "open-settings").click();
     await expect(page.getByRole("dialog", { name: "Settings" })).toBeVisible();
     // Settings may still have admitted a model/health request. Its ordinary-work
@@ -84,25 +93,24 @@ test("installation UI shows progress, cancels and retries, then refuses restart
     expect(await counts(app)).toEqual({ downloads: 2, downloadedDisposed: 1, stagedDisposed: 0, nativeCalls: 0 });
     await banner.screenshot({ path: test.info().outputPath("update-ready-after-refusal.png") });
   } finally {
-    await cleanup(app, home, repo);
+    final = await cleanup(app, home, repo);
   }
+  expect(final.quitStages).toBe(1);
 });
 
 test("failed publisher verification offers retry and never exposes an install action", async () => {
   test.skip(process.platform !== "darwin", "macOS native update controller");
   const { home, repo, app, page } = await launchInstallation();
   try {
     const banner = tid(page, "update-banner");
-    await expect(banner.getByRole("button", { name: "Download update", exact: true })).toBeVisible();
-    await banner.getByRole("button", { name: "Download update", exact: true }).click();
     await expect(banner).toContainText("Downloading the update…");
     await finishDownload(app);
     await expect(banner).toContainText("Verifying the publisher and update…");
     await finishVerification(app, false);
     await expect(banner).toContainText("could not be downloaded or verified");
     await expect(tid(banner, "update-error-detail")).toHaveText("Publisher verification failed");
     await expect(banner.getByRole("button", { name: "Restart to update", exact: true })).toHaveCount(0);
-    await expect(banner.getByRole("link", { name: "View update" })).toHaveAttribute("href", "https://github.com/TypeSafeAI/modex/releases/tag/v999.0.0");
+    await expect(banner.getByRole("link", { name: "What’s new" })).toHaveAttribute("href", "https://github.com/TypeSafeAI/modex/releases/tag/v999.0.0");
     await expect.poll(() => counts(app)).toEqual({ downloads: 1, downloadedDisposed: 1, stagedDisposed: 1, nativeCalls: 0 });
     await banner.getByRole("button", { name: "Download update", exact: true }).click();
     await expect(banner).toContainText("Downloading the update…");
 
@@ -17,9 +17,14 @@ test("renderer reload after an updater partial drain opens read-only and ordinar
     const page = await app.firstWindow(); await page.waitForLoadState("domcontentloaded");
     page.on("dialog", dialog => { if (dialog.type() !== "beforeunload") void dialog.dismiss(); });
     await tid(page, "composer-input").fill(raw);
-    await page.getByRole("button", { name: "Download update", exact: true }).click();
-    await page.getByRole("button", { name: "Restart to update", exact: true }).click();
-    await expect(tid(page, "update-restart-status")).toContainText("could not finish preparing to restart");
+    // The update downloaded by itself; only the restart needs a click. Right after launch a
+    // startup request can still be admitted, and that refusal keeps the update ready to retry.
+    const restart = page.getByRole("button", { name: "Restart to update", exact: true }), status = tid(page, "update-restart-status");
+    await expect(async () => {
+      if (await restart.isVisible()) await restart.click();
+      await expect(status).toBeVisible({ timeout: 2000 });
+    }).toPass({ timeout: 20_000 });
+    await expect(status).toContainText("could not finish preparing to restart");
     const before = fs.readFileSync(file); expect(JSON.parse(before.toString()).drafts.projects[0].text).toBe(raw);
     await page.reload();
     await expect(tid(page, "update-recovery")).toBeVisible();
@@ -77,7 +82,7 @@ test("actual main restart retains drafts after partial drain and retries fresh r
     await page.getByRole("textbox", { name: "Page title" }).fill("Dirty page saved through main restart admission");
     await expect(page.getByLabel("Save status")).toHaveText("Not saved");
     await page.getByRole("button", { name: "Chat", exact: true }).click();
-    await page.getByRole("button", { name: "Download update", exact: true }).click();
+    await expect(page.getByRole("button", { name: "Restart to update", exact: true })).toBeVisible();
     unblockNoteWrites(home);
     await page.getByRole("button", { name: "Restart to update", exact: true }).click();
     const panel = tid(page, "update-restart-status");
 
@@ -30,7 +30,7 @@ for (const theme of ["jev", "coven"] as const) test(`${theme}: update banner ope
   await offer("999.0.0");
   const banner = tid(page, "update-banner");
   await expect(banner).toContainText("Modex 999.0.0 is available");
-  const download = banner.getByRole("link", { name: "View update" });
+  const download = banner.getByRole("link", { name: "What’s new" });
   await expect(download).toHaveAttribute("href", "https://github.com/TypeSafeAI/modex/releases/tag/v999.0.0");
   await app.evaluate(({ BrowserWindow }) => {
     BrowserWindow.getAllWindows()[0]!.webContents.setWindowOpenHandler(({ url }) => {
@@ -59,8 +59,8 @@ for (const theme of ["jev", "coven"] as const) test(`${theme}: update banner ope
   await page.evaluate(() => window.dispatchEvent(new Event("focus")));
   await expect(restored).toContainText("Modex 999.0.2 is available");
   await resizeWindow(app, page, 900, 600);
-  await restored.getByRole("link", { name: "View update" }).focus();
-  await expect(restored.getByRole("link", { name: "View update" })).toBeFocused();
+  await restored.getByRole("link", { name: "What’s new" }).focus();
+  await expect(restored.getByRole("link", { name: "What’s new" })).toBeFocused();
   await page.keyboard.press("Tab");
   await expect(restored.getByRole("button", { name: "Dismiss update notification" })).toBeFocused();
   const fits = await restored.evaluate((element) => {
@@ -73,7 +73,7 @@ for (const theme of ["jev", "coven"] as const) test(`${theme}: update banner ope
   expect(fits).toBe(true);
   await page.screenshot({ path: test.info().outputPath(`update-banner-${theme}-compact.png`) });
   await page.emulateMedia({ reducedMotion: "reduce" });
-  await expect(restored.getByRole("link", { name: "View update" })).toHaveCSS("transition-duration", "0s");
+  await expect(restored.getByRole("link", { name: "What’s new" })).toHaveCSS("transition-duration", "0s");
   await offer(null);
   await expect(restored).toHaveCount(0);
 });
@@ -181,11 +181,13 @@ export async function runNativeUpdateAcceptance({ sourceApp, candidateArchive, v
     await page.evaluate(() => window.modex.invoke("updates:check", undefined));
     const banner = page.getByTestId("update-banner");
     await page.getByTestId("composer-input").fill(draft);
-    await banner.getByRole("button", { name: "Download update", exact: true }).click();
+    // Finding the release starts the download without a click; the tampered archive is refused.
+    const transport = () => fs.existsSync(transportFile) ? fs.readFileSync(transportFile, "utf8").trim().split("\n").filter(Boolean).map(line => JSON.parse(line)) : [];
+    await expect.poll(() => transport().some(entry => entry.request === "candidate-archive" && entry.corrupt), { timeout: 180_000 }).toBe(true);
     await expect(banner).toContainText("could not be downloaded or verified", { timeout: 180_000 });
     assert.equal(JSON.parse(fs.readFileSync(receiptFile, "utf8")).attempt, null);
     assert.equal(fs.existsSync(eventsFile), false);
-    proof.checks.push("tampered download refused before native admission");
+    proof.checks.push("automatic download of a tampered archive refused before native admission");
     await app.evaluate(() => { globalThis.__nativeUpdateAcceptance.corrupt = false; });
     await banner.getByRole("button", { name: "Download update", exact: true }).click();
     await expect(banner.getByRole("button", { name: "Restart to update", exact: true })).toBeEnabled({ timeout: 180_000 });