We have the policy that the setFCV command "always succeeds and is always fast". In practice we want this to mean that the transition to the transitional downgrading FCV state is fast and always succeeds (barring command validation errors).

It is easy for server engineers to introduce code that violates this policy without our knowledge. We should explore if there are any ways we can enforce this policy without manual oversight.