Both steps are verified: migrations applied without inconsistency, blueprints unchanged, and a real login recorded server-side on each version. Outside a migration window an automatic rollback is the right behaviour, so remediation goes back to three retries.