Firmware policy, out-of-band automation, and runbooks that keep racks patched without touching uptime.