Sure, that makes sense. But I feel like we are missing an opportunity to help people understand the distinction between the different options here. I don’t see the harm in telling self-hosters that the default is tests-passed which is ideal for most sites, and ensures you get the latest security fixes and updates. If you are risk averse you can leave it at tests-passed and update only when prompted to do so in the software, or a week or so after you get the prompt. That way other people discover any problems first and they are fixed before you update.
Given the above, are there legit reasons for self-hosters to switch from tests-passed? I guess if your site is heavily modded and will break if core discourse or official plugins are updated, and you don’t trust yourself or your admins to not update? Or if you are setting up a dev or staging environment?
Another place to explain this could be in app.yml which currently is fairly cryptic because it only refers to tests-passed and doesn’t mention the options or when you might switch to a different one.
## Which Git revision should this container use? (default: tests-passed)
#version: tests-passed