The migration used to notify and finish when that path was a symlink or not a regular file, so it was marked done with the path still in place. Those states stay pending. Later migrations, and with them an update, wait until the path is dealt with.

It also rejects the parent directory when that is a symlink or not a directory. A further migration rechecks a machine that already carries the original completion marker. The notification tells the user to confirm the password works for sudo with the token unplugged before removing and setting up FIDO2 again, so removing the token cannot lock them out.