A new certificate chain validates while one appliance still pins the previous intermediate or key hash and rejects the same service after a retention policy refresh

The chain is globally right and one trust consumer is still anchored to the past. The operational object still exists somewhere in the system, but the lifecycle policy around its supporting state no longer matches reality.