Only protected branches should be published
I've used both GitLab itself and GitHub, relying on both protected branches and routine force-pushes to unprotected branches. Essentially, both consider a protected branch something that you can neither delete nor force-push. The closest equivalence to this “branch protection” — which isn't really a Git concept — is public changesets in Mercurial. The same guarantees apply; once a public changeset is pushed, that's it, and you can never unpublish it, short of administrative action.
So, when first using Heptapod, I was rather surprised to learn that it's auto-publishing except for topics. What is the point of exposing “protected branches” in the UI, if it has no effect?
(As an aside, this also makes it harder to interact with any remote repositories using hg-git, as that requires bookmarks and draft changesets. But I have no actual use for that right now.)