An install that cannot read its update policy no longer updates itself

An install records whether it should update itself automatically. If that setting went missing — and it could, under the install's own routine bookkeeping — the install read it back as "yes, update automatically". The most permissive answer, arrived at by losing information rather than by anyone choosing it. That is how one portal rolled itself onto a version line that had been withdrawn.

A missing setting now reads as do not update. The install waits to be told instead of guessing, and an explicitly chosen setting — including never update — is always recorded, so "someone chose this" and "this went missing" are no longer the same thing.