Changes to Complete or drop a single enrollment — the same write-through ProgramService.setStatus applies for the automatic client-enrollment-expiry sweep, so a manual fix here can never disagree with what the sweep would have done.