A dashboard can show a healthy deployment while users still receive an error. The two observations are not contradictory: they are measuring different parts of the system.
Deployment health can confirm that a desired revision exists and that a process is ready. It does not, by itself, prove that an incoming request reaches the application listener on the expected port and returns a valid response.
Follow the request path
For a read-only investigation, trace the route from the outside in:
Gateway → Service → Endpoint → Application listener
At each boundary, compare the configured destination with the observed next hop. A ready process can listen on one port while a Service directs traffic to another. An endpoint can exist while its upstream application is unavailable. A gateway can be configured while the resulting route still fails.
Keep the first pass non-destructive
The purpose of an initial investigation is to build evidence, not to make the status look green. Avoid syncing, restarting, editing, or deleting resources until the request path and the proposed change are understood.
The most useful incident note separates what was observed, what is inferred, what remains uncertain, and the smallest safe change to test next.
Specific infrastructure identifiers and exploit-relevant configuration details belong in private incident records, not in a public technical note.