The pull request says the Thunderbolt authorization service was turned on by its setup command, by a migration, and by first-run, but the settings packages put the file where systemd does not look. On an edge image, migration stopped there and later migrations stayed pending. First-run then enabled none of its services, because one unknown service makes the enable command reject the list. The USB authorization service was in the same position on a fresh install.

The merged step enables each service alone. A service missing from a build affects only that service, and the step still fails so first-run tries again. emirb opened and merged the change. emirb wrote in the pull request that the service files are shipped by a merged package change, and that after that package was installed on the test machine the pending migrations ran.