I would like to maintain the invariant 'installed not null implies installed_at is not null' - that's why I put that there. I don't see much danger in making this up for the current installed base