Remove the sensitive logging.
A security request identified application logs containing sensitive session details. A merged change removed two INFO statements; the test and integration-test CI jobs both passed.
The next question was which revision was serving traffic, and whether its logs met the required condition.
Read three sources separately.
Change and checks- Two statements removed.
The merged diff and both CI results were read back.
Serving-system readback- The running revision included the fix.
Commit ancestry connected the serving revision to the change. The health response returned HTTP 200.
Later metadata read- 401. The runtime counts were unknown.
The metadata request did not return the aggregate observation needed to establish route activity or sensitive-message counts.
What would establish the runtime result?
Observe positive activity on the relevant route and no sensitive-message matches in the same post-deployment window. A zero count without activity could simply mean that nothing happened.
The historical readback did not establish those conditions.
Keep the missing observation open.
The engineering fix was already in production. Repeating that request would have duplicated completed work.
The remaining check needed positive route activity and no sensitive-message matches in the same post-deployment window. The later metadata request returned 401, leaving both runtime counts unknown.