BGP route selection doing opposite of what I expected

I am threat modeling our edge routers and found something that breaks my assumptions. We have two paths to the same prefix from different peers. One path has MED 50, the other MED 100. Cisco is preferring the MED 100 path.

I have checked the usual: weight is equal, local-pref is equal, AS-path length is equal. The MED 100 path has a longer IGP cost to the next-hop but that should not matter until step 8. MED is step 6.

I assume compromise on my understanding here. What am I missing? The blast radius is small (lab environment) but I need to understand this before production.

This is not email related but for what it's worth, Cisco's BGP path selection is not fully RFC-compliant in default configuration. The RFC 4271 step 6 comparison assumes all paths from the same neighboring AS. Cisco's default behavior does not enforce this strictly.

Check if you have bgp deterministic-med disabled. Without it, Cisco compares MEDs across different AS paths depending on arrival order. This is a known quirk, not a bug, but it surprises everyone.