The labelling doesn't really matter much, but I think it would be best if CB could be accurate about version numbers and up/downgrade path.
Case #1
OS: 3.3
CB: 3.7
Offer to upgrade to 3.7
Case #2
OS: 3.3
CB: 3.3
Let the user know that he has the latest version
Case #3
OS: 3.3
CB: 3.2 *recommended version
Recommend to downgrade only if there is a reason for it, otherwise do nothing. I figure that those downgrade cases would be quite rare. Could be if something really wrong was detected and it was recommended for all to downgrade.
Case #4
OS: 3.3.3
CB: 3.3.1
Let the user know that there is nothing to do. A downgrade should not be forced as there could be a reason for the difference or an outdated versions.txt.
As ditto has mentioned, I think it would be quite rare, after a "build update" for the installed version to be ahead of what CB offers, but there are cases where maybe someone has installed a pre-release version of something and CB should not automatically downgrade.
Also, maybe a "build update" should be performed as part of "build versions" in order to avoid some false positives?
And if I'm not mistaken, a "build update_versions" doesn't ask for any confirmation before trying to upgrade everything. Maybe it would be a good idea to get confirmation first, unless y is used?