Downgrading a Server below the enforcement release turns Device enforcement off silently#4070

A round trip through a release older than device enforcement turns enforcement off, and nothing says so.

Seen on a 3-Server Cloud Cluster with enforcement on. F1 lane 9 (#4068) ran ployz server upgrade 0.3.16 <server> --allow-downgrade over the Server's local socket, then reinstalled 0.3.17. Afterwards an Operator Leave sent as Cloud was admitted, and the Server reset. Before the round trip the same Leave was refused naming ployz.machine.leave.v1.

Cause. v0.3.16's record wire has no device_enforcement field, so it rewrites machine.json without it. Back on 0.3.17 the field reads as false.

Why it's not a hole. Only a Full caller (the local socket or SSH) can downgrade, and a Full caller can turn enforcement off directly. The problem is that the setting goes away without anyone saying so.

Possible fixes.

• Refuse a downgrade below the release that introduced enforcement while it's on.
• Or warn in server upgrade --allow-downgrade that enforcement will be off afterwards.

F 2 (downgrades below that release are rare) × S 5 (a security setting is silently lost; turning it back on is the workaround) = 10.