The pre-deploy verification and the rollback migration check copied the live mealquest.db and its WAL as separate files while the app and Litestream ran, so a checkpoint between the copies could leave an older, readable state: the rollback check could print "none" while the live database held a migration the older SHA does not know. Both now read the live database through /tmp/mqsnap.py, written once in "Count check": SQLite's online backup API from a read-only connection, then PRAGMA integrity_check, exiting nonzero unless it is ok. The pre-deploy verification runs as one fail-fast subshell (set -eu, an EXIT trap that cleans /tmp/mqcheck and the scratch restore while keeping the status), diffs the replica and live count checks, and prints the restore point only after every step has passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>