How does ZCO decide there's an upgrade available?

[rayb2001]

We have a cluster of systems. I know from trial/error that if I change the file link in index.html, I can force an upgrade or prevent one (depending on whether the linked file is newer than the currently installed ZCO or not. Newer in index.html causes ZCO to prompt for an upgrade).
Presumably, the ZCO parses the index.html looking for the link to the new ZCO. If the filename is newer than the current ZCO, it prompts. (Can someone confirm this is how this works?)
What I don't understand is:
1. How do I make this permanent? Whenever I reboot, index.html gets overwriten. The index.html.in file has a variable. Anyone know where that variable comes from?
For historical reasons, we'd like to have the older versions available at that location for users to download if the upgrade fails.
2. Which server in the cluster needs the index.html updated? All of them? Or is it just the one that this user's mailbox is on?
I've looked for details on how this works but not found it on the Zimbra website.
Can someone from Zimbra give us the details on how this works?