added container update ability be fore sync. i mean its already down

Master.conf

@@ -24,7 +24,7 @@
 #   ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
 #   RSYNC DEFAULTS                  Global fallback rsync settings
 #   REMOTE HEALTH CHECKS            Rootfs threshold for pre-flight abort
-#   DAILY SYNC SHARES               Media shares synced by daily_sync.sh
+#   DAILY SYNC SHARES               Media shares synced by media_shares_sync.sh
 #   RSYNC PROFILE SYSTEM            Per-profile overrides (appdata profiles)
 #
 #   ── FAILOVER ───────────────────────────────────────────────────────────────────────────────
@@ -153,7 +153,7 @@
     ROOTFS_WARN=75
 
 # ━━━ Daily Sync Shares ━━━
-# Media shares synced once daily by Orchestrators/daily_sync.sh.
+# Media shares synced once daily by Orchestrators/media_shares_sync.sh.
 # Each server only syncs the shares it is source of truth for — direction is automatic.
 # detect_hosts() determines which server is running and picks the correct list.
 #
@@ -230,7 +230,7 @@ HOST2_DAILY_SYNC_SHARES=(
 # ─────────────────────────────────────────────────────────────────────────────────────────────
 
 # HOST1 personal shares synced to HOST2 for offsite backup
-# These sync via daily_sync.sh or on their own schedule
+# These sync via media_shares_sync.sh or on their own schedule
 # Encrypted datasets sync as encrypted — remote cannot read content
 HOST1_PERSONAL_SHARES=(
     # /mnt/user/Gmer4Lfe-Personal     # uncomment after creating encrypted dataset
@@ -630,7 +630,7 @@ HOST2_TIER1_WRITEBACK_DELAY=60  # minutes — skip Tier 1 writeback if outage un
 
 # HOST1 writeback tiers — run by HOST2 during HOST1 handback
 FAILOVER_HOST1_WRITEBACK_TIER1=(
-    "/mnt/user/appdata-Failover/Emby"           # Emby userdata, playstates, metadata
+    "/mnt/user/Media_Server/Emby"           # Emby userdata, playstates, metadata
     "/mnt/user/appdata-Failover/Critical-Data"  # auth stack — Authelia, Mariadb, Redis, LLDAP, NPM
 )
 
@@ -818,7 +818,7 @@ NETWORK_CONNECT_CONTAINERS=(
 )
 
 NETWORK_CONNECT_NETWORKS=(
-    "nextcloud-aio"         # Docker network name — must exist before array start
+    "high-availability"         # Docker network name — must exist before array start
 )
 
 # ==============================================================================================
@@ -948,9 +948,9 @@ MEDIA_MAINTENANCE_JOBS=(
     "Media/media_shares_permissions.sh"     # apply permissions first
     "Media/media_cleaner.sh anime"          # remove junk from anime shares
     "Media/media_cleaner.sh media"          # remove junk from media shares
-    "Media/lidarr_cleanup.sh"               # remove orphaned music files
-    "Media/sonarr_cleanup.sh"               # remove orphaned TV files
-    "Media/radarr_cleanup.sh"               # remove orphaned movie files
+#    "Media/lidarr_cleanup.sh"               # remove orphaned music files
+#    "Media/sonarr_cleanup.sh"               # remove orphaned TV files
+#    "Media/radarr_cleanup.sh"               # remove orphaned movie files
 )
 
 # ━━━ Arr Cleanup ━━━
@@ -1208,8 +1208,22 @@ ZFS_REPORT_IGNORE_POOLS=(
     DIGEST_SMART_ON_CERT_WARN=true   # send if any cert is under CERT_WARN_DAYS
     DIGEST_SMART_ON_BANDWIDTH=true   # send if any transfer exceeded BANDWIDTH_WARN_GB
 
+# ━━━ Critical Shares Maintenance ━━━
+# Controls container update behaviour in critical_shares_maintenance.sh
+# Both local and remote containers are already stopped for the sync window
+# Updates pull new images while containers are down — starts fresh on new version
+#
+# CRITICAL_SYNC_UPDATES        — pull updates on LOCAL server during maintenance window
+# CRITICAL_SYNC_UPDATES_REMOTE — pull updates on REMOTE server during maintenance window
+#
+# Both false → sync only, no updates (sync only, no updates)
+# Both true  → full maintenance both servers — recommended for Sunday window
+# Toggle false temporarily to skip updates without changing the schedule
+
+    CRITICAL_SYNC_UPDATES=true          # pull container updates locally during maintenance
+    CRITICAL_SYNC_UPDATES_REMOTE=true   # pull container updates on remote via SSH
+
 # ━━━ Emby Session Report ━━━
-# Requires API key from Emby Settings → API Keys in the Emby WebUI.
 # No persistent writes — queries fresh each run.
 # Each server has its own Emby instance with its own API key.
 # detect_hosts() selects the correct URL and key at runtime.