Best-effort by design: refusing the change because one instance was unreachable would leave the customer holding the password they were trying to replace. A failure is flagged and hqsync repairs it. Also corrects two pieces of copy this makes false — CreateInstance's doc comment and the instance-ready email both claimed the two passwords diverge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>