Troubleshooting

Use this map with the Canadian traffic path to identify which control an observation concerns. It identifies boundaries and useful checks; it is not a recovery procedure.

Symptom	Relevant control	Useful observation
Public name does not resolve as expected	Tenant-managed DNS	A record and reserved allocation address; public AAAA remains absent
Unexpected public serving region	RE selector and allocation binding	Actual virtual-site selectees and serving RE event/header
Canadian user receives denial	Actual-source classification	Observed VPN/proxy egress and XC country classification
Classified foreign source succeeds	Explicit service-policy selection	COUNTRY_CA, default denial and disabled header trust on this listener
Forwarding headers alter authorization	Client-IP header trust	Same actual source and policy event across header variants
Unexpected application body	Pool reference and CE origin discovery	Pool endpoint, owned CE selectees and origin control body
Internal VIP fails	Internal routes and relay sessions	Effective routes and CE/FRR/Route-Server inventory
Console connection fails	Separate console frontend and private path	Correct frontend, TCP reachability and valid console login
CE stays pending	Registration/configured phase	Observed NIC MACs, registration mapping and owned site state
Frozen initialization fails	Artifact/lockfile identity	Signed provider/API receipt and readonly initialization result

Origin infrastructure ingress is a separate boundary: an ACL failure can prevent delivery even when client authorization succeeds. The verification tools page explains what the observations prove, and the deployment guide identifies the implementation phases. Private state, source addresses and events are not published in diagnostic material.