A canary job compares median latency while one percentile tail explodes only for a tenant class routed through a different auth provider during a staged decommission

Aggregate health stays green while a routed subset proves the release is unsafe. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.