Comment # 3 on bug 1162143 from Stefan Hundhammer

The selected version in the "versions" tab is the candidate version that you
will get if and when the package will be installed or upgraded.

When you click on a package version manually that is different to the one that
is currently installed, this automatically also changes the package status to
"upgrade" (which may also be a downgrade). I think it's similar with packages
that are not installed yet: If you click on a specific version, this will also
set the package status to "install".

But that's all just convenience. The rationale is that if you explicitly select
a specific version, you probably want that version to be installed, so the
package selector also does the other action: Change the package status
accordingly.

For retracted package versions, things are different, though: We cannot
automatically decide that it's best for the user to install a different
version. In the typical use case this means a version downgrade which in turn
may trigger other package downgrades because of package version dependencies.
This may easily lead to dependency problem reports that may be hard to resolve.

Having retracted package versions in the first place means that doomsday is
near; something went terribly wrong. Having retracted package versions
installed means you are in the middle of doomsday, and meteorites are impacting
all around you.

When the concept of retracting patches was brought up (and thus retracted
package versions became a possibility as a consequence), it was decided not to
automatically downgrade anything.

Solutions how to handle the case that a user was quicker installing patches
than our maintenance team could realize that they are broken and need to be
retracted included anything from "the user needs to reinstall that system"
(ouch!) to "tell the user to sit tight and wait until we release a fixed
version".

A user may decide to try to downgrade individual packages manually. This may or
may not work as desired; it may lead to the aforementioned dependency problems.

But the desired behavior was not to make the package selector do anything that
would initiate such a downgrade half-automatically which is the behavior you
observed here.

The only consolation is that all this is a very unlikely scenario which we are
doing our best to avoid. Once users are in that scenario, we need advice on a
case-by-case basis and publish that advice (as a security advisory?) in a
high-visibility public place.