Forced Updates Without a Gun to Your Head
Three buckets, not one hammer: force what's unsafe to leave, nudge everything else, and fail open when the update-checker itself can't reach the network. A version gate driven by Remote Config, and the release loop that keeps the gun holstered.