The region offers its binary (version, arch, sha256) in each rack's state and serves it over mutual TLS; the rack stages it after checking checksum and version; a root path unit installs it, restarts the rack and rolls back if it does not register within a minute. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>