@@ -5,6 +5,41 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.1] - 2026-10-09
+
+### Added
+- **The macOS updater is wired in.** 1.1.0 shipped the signed update feed
+  and the `UpdateService` engine, but nothing invoked it. `Settings ▸
+  Check for Updates…` now checks the Ed25519-signed manifest on demand,
+  and one silent check runs shortly after launch (throttled to once per
+  4 hours via the `last-update-check` config key, bypassed by the menu).
+  An available update is offered by version, downloads with visible
+  progress, re-verifies the artifact sha256 and the unpacked bundle
+  version, swaps the app in place and relaunches; a failed swap restores
+  the previous bundle and the running version keeps working. Development
+  copies (not under /Applications) get an honest "auto-update
+  unavailable" answer instead of a network error.
+
+### Fixed
+- **`set_setting` never persisted anything.** The RPC built the new
+  config with the immutable-only `hash-set` on the mutable hash that
+  `read-config` returns, so every write threw and the hosts silently
+  swallowed the RPC error — theme, language and last-selected list never
+  survived a relaunch. It now uses `hash-set!`; a new backend contract
+  test (`racket/tests/backend-test.rkt`) covers the write path, growing
+  the suite from 62 to 69 checks.
+
+### Changed
+- Backend: a new `get_setting` RPC exposes raw config values to hosts
+  (the macOS update throttle reads `last-update-check` through it, and
+  the future Windows/Linux updaters will share it); `set_setting`
+  accepts the integer-as-string `last-update-check` key and the config
+  writer persists it (DATA-FORMAT §7).
+- The [UPDATE](shared/spec/UPDATE.md) status table reflects reality:
+  the macOS updater is fully wired; Windows and Linux host updaters
+  remain documented follow-ups — until they land, update those hosts by
+  manual download from the releases page.
+
 ## [1.1.0] - 2026-10-08
 
 ### Added
 
@@ -1 +1 @@
-1.1.0
+1.1.1
@@ -18,7 +18,7 @@ namespace rivet_app {
 inline constexpr char kModuleName[] = "backend";
 inline constexpr char kEntryName[] = "start";
 inline constexpr char kDisplayName[] = "taskly";
-inline constexpr char kVersion[] = "1.1.0";
+inline constexpr char kVersion[] = "1.1.1";
 inline constexpr std::int64_t kBuild = 1;
 inline constexpr char kIdentifier[] = "app.taskly.Taskly";
 inline constexpr char kReleaseChannel[] = "stable";
@@ -142,6 +142,8 @@ class API {
   [[nodiscard]] std::uint64_t delete_list_async(std::int64_t id, std::function<void(Result<bool>)> completion) { if (!completion) throw std::invalid_argument("Rivet async completion handler is empty"); return backend_.request_async("delete_list", rivet::Value::List{detail::encode_Int64(id)}, [completion = std::move(completion)](rivet::linux_runtime::CallResult raw) mutable { Result<bool> result; if (raw.error) { result.error = raw.error; } else { try { if (!raw.value) throw std::runtime_error("Rivet async call completed without a value"); result.value = detail::decode_Bool(*raw.value); } catch (...) { result.error = std::current_exception(); } } completion(std::move(result)); }); }
   std::future<bool> delete_task(std::int64_t id) { auto raw = backend_.call("delete_task", rivet::Value::List{detail::encode_Int64(id)}); return std::async(std::launch::deferred, [raw = std::move(raw)]() mutable -> bool { return detail::decode_Bool(raw.get()); }); }
   [[nodiscard]] std::uint64_t delete_task_async(std::int64_t id, std::function<void(Result<bool>)> completion) { if (!completion) throw std::invalid_argument("Rivet async completion handler is empty"); return backend_.request_async("delete_task", rivet::Value::List{detail::encode_Int64(id)}, [completion = std::move(completion)](rivet::linux_runtime::CallResult raw) mutable { Result<bool> result; if (raw.error) { result.error = raw.error; } else { try { if (!raw.value) throw std::runtime_error("Rivet async call completed without a value"); result.value = detail::decode_Bool(*raw.value); } catch (...) { result.error = std::current_exception(); } } completion(std::move(result)); }); }
+  std::future<std::string> get_setting(std::string key) { auto raw = backend_.call("get_setting", rivet::Value::List{detail::encode_String(key)}); return std::async(std::launch::deferred, [raw = std::move(raw)]() mutable -> std::string { return detail::decode_String(raw.get()); }); }
+  [[nodiscard]] std::uint64_t get_setting_async(std::string key, std::function<void(Result<std::string>)> completion) { if (!completion) throw std::invalid_argument("Rivet async completion handler is empty"); return backend_.request_async("get_setting", rivet::Value::List{detail::encode_String(key)}, [completion = std::move(completion)](rivet::linux_runtime::CallResult raw) mutable { Result<std::string> result; if (raw.error) { result.error = raw.error; } else { try { if (!raw.value) throw std::runtime_error("Rivet async call completed without a value"); result.value = detail::decode_String(*raw.value); } catch (...) { result.error = std::current_exception(); } } completion(std::move(result)); }); }
   std::future<Settings> get_settings() { auto raw = backend_.call("get_settings", rivet::Value::List{}); return std::async(std::launch::deferred, [raw = std::move(raw)]() mutable -> Settings { return detail::decode_Settings(raw.get()); }); }
   [[nodiscard]] std::uint64_t get_settings_async(std::function<void(Result<Settings>)> completion) { if (!completion) throw std::invalid_argument("Rivet async completion handler is empty"); return backend_.request_async("get_settings", rivet::Value::List{}, [completion = std::move(completion)](rivet::linux_runtime::CallResult raw) mutable { Result<Settings> result; if (raw.error) { result.error = raw.error; } else { try { if (!raw.value) throw std::runtime_error("Rivet async call completed without a value"); result.value = detail::decode_Settings(*raw.value); } catch (...) { result.error = std::current_exception(); } } completion(std::move(result)); }); }
   std::future<Snapshot> load_snapshot(std::string view, std::optional<std::int64_t> list_id, bool show_completed) { auto raw = backend_.call("load_snapshot", rivet::Value::List{detail::encode_String(view), detail::encode__Optional_Int64_(list_id), detail::encode_Bool(show_completed)}); return std::async(std::launch::deferred, [raw = std::move(raw)]() mutable -> Snapshot { return detail::decode_Snapshot(raw.get()); }); }
 
@@ -37,6 +37,18 @@ enum SmartView: Hashable {
     }
 }
 
+/// Update-sheet phase machine (shared/spec/UPDATE.md behavior contract):
+/// check → offer → download → install; silent checks open the sheet only
+/// for an offer.
+enum UpdatePhase: Equatable {
+    case idle
+    case checking
+    case available
+    case downloading
+    case upToDate
+    case failed
+}
+
 /// Application state: embedded-backend lifecycle, settings, lists, current
 /// view, tasks, status line. All data flows through the typed RivetAPI;
 /// every backend mutation publishes `changed`, which re-reads the snapshot.
@@ -96,12 +108,23 @@ final class AppModel {
     var confirmContext: ConfirmContext?
     var aboutVisible = false
 
+    // Updater (shared/spec/UPDATE.md)
+    var updateSheetVisible = false
+    var updatePhase: UpdatePhase = .idle
+    var updateProgressPercent = 0
+    var updateAvailableVersion = ""
+    var updateErrorMessage = ""
+
     /// Transient delete banner with a one-step undo (Reminders-style).
     var undoBannerText: String?
     var undoBannerAction: (() -> Void)?
     @ObservationIgnored private var undoBannerTask: _Concurrency.Task<Void, Never>?
     @ObservationIgnored private var transientDeadline: _Concurrency.Task<Void, Never>?
     @ObservationIgnored private var appearanceObserver: NSKeyValueObservation?
+    /// Update offer accepted but not yet installed (lost on relaunch — the
+    /// user re-offers on the next check).
+    @ObservationIgnored private var pendingUpdateManifest: UpdateService.Manifest?
+    @ObservationIgnored private lazy var updateService = UpdateService(i18n: i18n)
 
     init() {
         statusMessage = i18n.t("statusDatabaseNotConnected")
@@ -167,6 +190,7 @@ final class AppModel {
             refreshStatusPersistent()
             flashStatus(i18n.t("statusDatabaseConnected"))
             reminder?.start()
+            autoCheckForUpdates()
         } catch {
             statusMessage = "\(error)"
         }
@@ -210,6 +234,118 @@ final class AppModel {
         }
     }
 
+    // MARK: - Updates (shared/spec/UPDATE.md)
+
+    /// Silent checks run at most once per 4 hours (UPDATE.md triggers).
+    static let updateThrottleInterval: TimeInterval = 4 * 60 * 60
+
+    /// Manual entry point: Settings ▸ Check for Updates…. The sheet reports
+    /// every outcome (up to date, offer, failure, dev copy).
+    func checkForUpdates() {
+        guard updatePhase != .downloading else { return }
+        updateSheetVisible = true
+        updatePhase = .checking
+        _Concurrency.Task { await runUpdateCheck(present: true) }
+    }
+
+    /// Silent launch check: once shortly after startup, throttled to one
+    /// attempt per 4 h (config `last-update-check`); failures never nag.
+    func autoCheckForUpdates() {
+        _Concurrency.Task {
+            try? await _Concurrency.Task.sleep(nanoseconds: 3_000_000_000)
+            await runUpdateCheck(present: false)
+        }
+    }
+
+    private func runUpdateCheck(present: Bool) async {
+        guard updatePhase != .downloading else { return }
+        if !present {
+            guard await updateThrottleElapsed() else { return }
+        }
+        do {
+            let result = try await updateService.check()
+            await recordUpdateCheck()
+            switch result {
+            case .available(let manifest):
+                pendingUpdateManifest = manifest
+                updateAvailableVersion = manifest.version
+                updatePhase = .available
+                updateSheetVisible = true
+            case .upToDate:
+                updatePhase = present ? .upToDate : .idle
+                if present { updateSheetVisible = true }
+            }
+        } catch {
+            await recordUpdateCheck()
+            guard present else {
+                updatePhase = .idle
+                return
+            }
+            if case UpdateService.UpdateError.notInstalled = error {
+                updateErrorMessage = t("updateNotInstalled")
+            } else {
+                updateErrorMessage = t("updateCheckFailed", Self.cleanError(error))
+            }
+            updatePhase = .failed
+            updateSheetVisible = true
+        }
+    }
+
+    /// The throttle lives in config.ini (DATA-FORMAT §7 `last-update-check`,
+    /// unix epoch seconds), shared with the future Windows/Linux updaters.
+    private func updateThrottleElapsed() async -> Bool {
+        guard let api else { return false }
+        let raw = (try? await api.get_setting(key: "last-update-check")) ?? ""
+        let last = TimeInterval(raw.trimmingCharacters(in: .whitespaces)) ?? 0
+        return Date().timeIntervalSince1970 - last >= Self.updateThrottleInterval
+    }
+
+    private func recordUpdateCheck() async {
+        guard let api else { return }
+        _ = try? await api.set_setting(
+            key: "last-update-check",
+            value: String(Int(Date().timeIntervalSince1970)))
+    }
+
+    /// Offer accepted: download (progress in the sheet) → sha256 + Ed25519
+    /// already verified → in-place swap → relaunch. UpdateService terminates
+    /// the app on success; any earlier throw leaves this version running.
+    func installUpdate() {
+        guard updatePhase == .available, let manifest = pendingUpdateManifest else { return }
+        updatePhase = .downloading
+        updateProgressPercent = 0
+        updateErrorMessage = ""
+        _Concurrency.Task { [weak self] in
+            guard let self else { return }
+            do {
+                try await updateService.downloadAndInstall(manifest) { [weak self] percent in
+                    self?.updateProgressPercent = percent
+                }
+            } catch {
+                updateErrorMessage = t("updateInstallFailed", Self.cleanError(error))
+                updatePhase = .failed
+            }
+        }
+    }
+
+    func dismissUpdateSheet() {
+        updateSheetVisible = false
+        if updatePhase != .downloading {
+            updatePhase = .idle
+            updateErrorMessage = ""
+            pendingUpdateManifest = nil
+        }
+    }
+
+    static func cleanError(_ error: Error) -> String {
+        let text = error.localizedDescription
+        // RVT1 failures arrive as "...error: <message>"; keep the message.
+        if let range = text.range(of: "error: ") {
+            return String(text[range.upperBound...])
+        }
+        return text
+    }
+
     // MARK: - Database lifecycle (File menu)
 
     /// Full snapshot of the planned view — every dated incomplete task,
 
@@ -7,7 +7,7 @@ public enum RivetGeneratedConfig {
     public static let moduleName = "backend"
     public static let entryName = "start"
     public static let displayName = "taskly"
-    public static let version = "1.1.0"
+    public static let version = "1.1.1"
     public static let build: Int64 = 1
     public static let identifier = "app.taskly.Taskly"
     public static let releaseChannel = "stable"
@@ -172,6 +172,10 @@ public struct RivetAPI: Sendable {
         let result = try await client.call("delete_task", arguments: [encode_Int64(id)])
         return try decode_Bool(result)
     }
+    public func get_setting(key: String) async throws -> String {
+        let result = try await client.call("get_setting", arguments: [encode_String(key)])
+        return try decode_String(result)
+    }
     public func get_settings() async throws -> Settings {
         let result = try await client.call("get_settings", arguments: [])
         return try decode_Settings(result)
 
@@ -33,6 +33,14 @@ struct MainWindowView: View {
             set: { model.aboutVisible = $0 })) {
             AboutSheet()
         }
+        .sheet(isPresented: Binding(
+            get: { model.updateSheetVisible },
+            set: { newValue in
+                model.updateSheetVisible = newValue
+                if !newValue { model.dismissUpdateSheet() }
+            })) {
+            UpdateSheet()
+        }
         .confirmationDialog(
             model.confirmContext?.title ?? "",
             isPresented: Binding(
 
@@ -279,3 +279,79 @@ struct AboutSheet: View {
         .background(model.theme.background)
     }
 }
+
+/// Update sheet (shared/spec/UPDATE.md): one phase machine driving check →
+/// offer → download → install. A failed install leaves the running version
+/// untouched; the download phase cannot be dismissed (no cancel support).
+struct UpdateSheet: View {
+    @Environment(AppModel.self) private var model
+    @Environment(\.dismiss) private var dismiss
+
+    var body: some View {
+        VStack(spacing: 16) {
+            Image(systemName: "arrow.down.circle")
+                .font(.system(size: 44))
+                .foregroundStyle(model.theme.accent)
+
+            switch model.updatePhase {
+            case .checking:
+                ProgressView()
+
+            case .available:
+                Text(model.t("updateAvailableTitle"))
+                    .font(.system(size: 15, weight: .semibold))
+                    .foregroundStyle(model.theme.onSurface)
+                Text(model.t("updateAvailableBody", model.updateAvailableVersion))
+                    .font(.system(size: 13))
+                    .foregroundStyle(model.theme.secondaryText)
+                    .multilineTextAlignment(.center)
+                HStack(spacing: 12) {
+                    Button(model.t("dialogCancel")) { dismiss() }
+                    Button(model.t("updateRestart")) { model.installUpdate() }
+                        .keyboardShortcut(.defaultAction)
+                        .buttonStyle(.borderedProminent)
+                        .tint(model.theme.accent)
+                }
+
+            case .downloading:
+                Text(model.t("updateDownloading"))
+                    .font(.system(size: 13))
+                    .foregroundStyle(model.theme.onSurface)
+                ProgressView(value: Double(model.updateProgressPercent), total: 100)
+                    .frame(width: 240)
+                    .tint(model.theme.accent)
+                Text("\(model.updateProgressPercent)%")
+                    .font(.system(size: 12))
+                    .foregroundStyle(model.theme.secondaryText)
+
+            case .upToDate:
+                Text(model.t("updateUpToDate"))
+                    .font(.system(size: 14, weight: .medium))
+                    .foregroundStyle(model.theme.onSurface)
+                Button(model.t("dialogConfirm")) { dismiss() }
+                    .keyboardShortcut(.defaultAction)
+                    .buttonStyle(.borderedProminent)
+                    .tint(model.theme.accent)
+
+            case .failed:
+                Text(model.updateErrorMessage)
+                    .font(.system(size: 13))
+                    .foregroundStyle(model.theme.secondaryText)
+                    .multilineTextAlignment(.center)
+                    .frame(maxWidth: 320)
+                    .fixedSize(horizontal: false, vertical: true)
+                HStack(spacing: 12) {
+                    Button(model.t("dialogCancel")) { dismiss() }
+                    Button(model.t("menuCheckUpdates")) { model.checkForUpdates() }
+                }
+
+            case .idle:
+                EmptyView()
+            }
+        }
+        .padding(28)
+        .frame(width: 360)
+        .background(model.theme.background)
+        .interactiveDismissDisabled(model.updatePhase == .downloading)
+    }
+}
@@ -95,6 +95,8 @@ struct TasklyCommands: Commands {
                     model.setTheme("dark")
                 }
             }
+            Divider()
+            Button(model.t("menuCheckUpdates")) { model.checkForUpdates() }
         }
     }
 
 
@@ -189,8 +189,10 @@ public final class UpdateService {
 
     /// Downloads, verifies (sha256, then unpacked bundle version), swaps the
     /// bundle in place and relaunches. Throws before touching the running
-    /// install when anything is off.
-    public func downloadAndInstall(_ manifest: Manifest) async throws {
+    /// install when anything is off. `onProgress` reports download percent
+    /// (0…100) on the main actor for the update sheet.
+    public func downloadAndInstall(_ manifest: Manifest,
+                                   onProgress: ((Int) -> Void)? = nil) async throws {
         guard let bundleURL = installedBundleURL else { throw UpdateError.notInstalled }
         guard let artifact = manifest.platforms["macos"] else {
             throw UpdateError.manifestMissing
@@ -211,9 +213,18 @@ public final class UpdateService {
             var hasher = SHA256()
             var data = Data()
             data.reserveCapacity(artifact.size)
+            let total = max(artifact.size, 1)
+            var lastPercent = -1
             for try await byte in bytes {
                 hasher.update(data: [byte])
                 data.append(byte)
+                if onProgress != nil {
+                    let percent = min(100, data.count * 100 / total)
+                    if percent != lastPercent {
+                        lastPercent = percent
+                        onProgress?(percent)
+                    }
+                }
             }
             let digest = hasher.finalize().map { String(format: "%02x", $0) }.joined()
             guard digest == artifact.sha256.lowercased() else {
Original file line number	Diff line number	Diff line change
`@@ -95,6 +95,8 @@ struct TasklyCommands: Commands {`
`95`	`95`	`model.setTheme("dark")`
`96`	`96`	`}`
`97`	`97`	`}`
	`98`	`+ Divider()`
	`99`	`+ Button(model.t("menuCheckUpdates")) { model.checkForUpdates() }`
`98`	`100`	`}`
`99`	`101`	`}`
`100`	`102`