Allow device routing without pinning

test/server/device-inventory.test.js

@@ -360,7 +360,7 @@ test('a proxy regression rejects every device in that proxy sample atomically',
   assert.equal(snapshot.devices.find(({ mac }) => mac === macs[0]).uploadBytes, '11');
 });
 
-test('pinned device policy persists, reconciles the full set, and keeps the last applied mode on failure', async (t) => {
+test('device policy is independent from pinning, persists, and keeps the last applied mode on failure', async (t) => {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'harbor-device-policy-'));
   t.after(() => fs.rmSync(directory, { recursive: true, force: true }));
   const store = createJsonStore({
@@ -412,7 +412,6 @@ test('pinned device policy persists, reconciles the full set, and keeps the last
   assert.equal(snapshot.devices[0].desiredPolicy, 'vpn');
   assert.equal(snapshot.devices[0].appliedPolicy, 'vpn');
 
-  snapshot = service.update(id, { pinned: true }, snapshot.revision);
   snapshot = await service.setPolicy(id, 'direct', snapshot.revision);
   assert.deepEqual(appliedSets.at(-1), [{ id, ip: '192.168.50.7', mac, interface: 'eth0' }]);
   assert.equal(snapshot.devices[0].desiredPolicy, 'direct');
@@ -424,10 +423,9 @@ test('pinned device policy persists, reconciles the full set, and keeps the last
   service = createService();
   snapshot = await service.reconcilePolicies();
   assert.equal(snapshot.devices[0].appliedPolicy, 'direct');
-  assert.throws(
-    () => service.update(id, { pinned: false }, snapshot.revision),
-    (error) => error.code === 'REQUEST_INVALID',
-  );
+  snapshot = service.update(id, { pinned: true }, snapshot.revision);
+  snapshot = service.update(id, { pinned: false }, snapshot.revision);
+  assert.equal(snapshot.devices[0].appliedPolicy, 'direct');
 
   policyEpoch = 'policy-epoch-b';
   activeDevices = [];
@@ -467,7 +465,6 @@ test('pinned device policy persists, reconciles the full set, and keeps the last
   });
   snapshot = await service.refresh();
   const secondId = snapshot.devices.find((device) => device.mac === secondMac).id;
-  snapshot = service.update(secondId, { pinned: true }, snapshot.revision);
   failApply = true;
   await assert.rejects(
     service.setPolicy(secondId, 'direct', snapshot.revision),