A route binds to the right listener while a cross-namespace backend reference is still unauthorized during a failover rehearsal

The object graph looks connected and the security boundary still prevents end-to-end flow. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.