I didn't read up far enough. I see now that the file itself IS the actual download, not just an indicator of the downloading/downloaded upgrade. So, if the file is there, it's either in the process of downloading or already has. And I imagine if that file were deleted, it wouldn't be long before it's right back there, having burned through another 2.6GB of bandwidth to replace it. Ugh. Thanks.
tried to look at Glasswire, no go, thought maybe because of the holiday, lots of traffic, been on here since 5:30 AM, nothing, barely able to post this. Was OK til 5/28/16, next day nothing,