Each update mechanism required by SUM-1 installs software only after confirming, at the moment of installation, that the software is intact and comes from an authentic source.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.