What Our Canary Caught When a RAG Pipeline Leaked

Three weeks into running canary tokens across a client's RAG pipeline, one fired at 4:47am on a Tuesday. Not the system prompt canary. The RAG one. Which meant somebody wasn't just poking at instructi