A trust policy validates the new OIDC issuer while one condition key still matches the old claim path during a failover rehearsal

The provider migration is half-complete and federated access still fails on the detail that matters. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.