Test sequence

The Canadian traffic path introduces the configuration in request order. This sequence pairs each control with an observation so readers can explain what the result establishes.

1. Name and placement. Resolve the application name to the retained allocation, then inspect the allocation binding and Toronto/Montreal selectees. DNS mapping and regional advertisement answer separate questions.
2. Allowed source. Join the observed egress to an XC CA classification and a response matching the Canadian origin control body. A source’s Azure region or VPN label is insufficient.
3. Denied source. Join a classified non-Canadian source to a denial and its selected-policy event. Repeat with X-Forwarded-For, Forwarded, and X-Real-IP claiming Canadian egress; header trust is disabled.
4. Origin identity. Compare the allowed public response with the origin control body and check pool references, CE selectees and Azure origin placement.
5. Recovery. Observe routes and application traffic during an owned CE failure and an independent FRR failure, then observe restored sessions. This is the Canada Central node exercise.

Each observation describes its tested path and time. Internal application or console reachability cannot establish public authorization, and public success cannot establish comprehensive residency or cross-region availability. The verification tools page explains the evidence tools. Shared material uses sanitized outcomes; private events and deployment inputs stay in protected storage.