diff --git a/README.md b/README.md
index 319f01d..552d00c 100644
--- a/README.md
+++ b/README.md
@@ -168,7 +168,8 @@ needed.
   (System Settings → Privacy & Security → Full Disk Access) to read
   TCC-protected directories; without it the backup aborts with a permission
   error that explains how to fix it
-* `--cron`: Silent unless error (for crontab)
+* `--cron`: Silent on total success; warnings and errors are still printed
+  (for crontab)
 * `--prune`: After backup, drop older snapshots of each backed-up name and
   remove orphaned blobs from remote storage. By default keeps only the latest
   snapshot per name; use `--keep-newer-than` for a rolling window.
diff --git a/TODO.md b/TODO.md
index 1bb83f7..16f67b1 100644
--- a/TODO.md
+++ b/TODO.md
@@ -19,6 +19,16 @@ or delete the branch.
 
 # Completed Steps
 
+- 2026-08-09: Corrected the `Vaultik.UI` doc comment (issue #84). It
+  claimed the cli layer replaces the writer with a discarding one in
+  `--cron` mode; the actual mechanism is `UI.SetQuiet(true)` in
+  `setupGlobals`, which drops Begin/Complete/Info/Notice/Detail/
+  Progress/Banner but still emits Warning and Error. The `--cron` line
+  in `README.md` said "Silent unless error", which understated what
+  survives, and now names warnings too. The other `--cron` comments
+  (`internal/log/log.go`, `internal/cli/snapshot.go`,
+  `internal/vaultik/snapshot.go`) were audited and already accurate.
+  Comments and docs only, no behavior change.
 - 2026-08-09: Made `snapshot list` list the destination store without
   the private key (issue #64). The listing is now the union of the
   local index and a single streamed listing of the `metadata/` prefix,
diff --git a/internal/vaultik/vaultik.go b/internal/vaultik/vaultik.go
index 8ac75d0..e1ffe2a 100644
--- a/internal/vaultik/vaultik.go
+++ b/internal/vaultik/vaultik.go
@@ -49,9 +49,12 @@ type Vaultik struct {
 	Stdin  io.Reader
 
 	// UI is the writer for user-facing status, progress, warnings, errors.
-	// See package internal/ui for formatting conventions. Defaults to a
-	// writer wrapping Stdout; the cli layer replaces it with a discarding
-	// writer in --cron mode.
+	// See package internal/ui for formatting conventions. It always wraps
+	// Stdout and is never swapped out; under --cron (and --quiet) the cli
+	// layer instead calls UI.SetQuiet(true), which drops Begin, Complete,
+	// Info, Notice, Detail, Progress, and Banner messages. Warning and
+	// Error are still emitted in that mode, so callers must not assume
+	// that --cron makes this writer silent.
 	UI *ui.Writer
 
 	// restoreCacheObserver, if non-nil, is invoked once with the