User abandonment is measured and deliberately excluded from the availability error budget: a user who changes their mind is not an outage.
The bottom row is what a tenant administrator reads, and most of the pipeline has nothing to say to them — which is why those cells are empty rather than filled with platform metrics.
A hash-chain gap in the evidence store is an alert, not a report. Evidence that can be silently truncated is not evidence.
Origin mismatch is logged per tenant because it is almost always a tenant misconfiguration, and it needs to surface in their console rather than in an on-call log.
SLO targets (assumed)
Verification p99 60 ms, alerting after 10 minutes above it.
Platform-attributable ceremony failure rate at or below 0.05%, excluding abandonment and authenticator-side cancellation.
Recovery completion at or above 95% within 10 minutes, excluding the assisted route.
Risks
Credential coverage is the only signal that tells a tenant whether the migration is real, and it is the slowest-moving number in the set. It will be ignored until a cutover is requested.
