New Cloud Run services get Google-branded 404 with no server header and zero request logs, despite Ready=True/RoutesReady=True — matches other open reports

Google Cloud Serverless Applications
1

I’m seeing the exact same platform-level routing failure described in other open threads here, and wanted to add a data point plus my own ruled-out-causes list, since there’s no official response yet.

Symptom

Two new Cloud Run services in one of my projects (one in us-central1, a second stood up from scratch in us-east1 purely as a control) are completely unreachable on their public *.run.app URL:

  • Every request gets a generic Google-branded 404 (“That’s all we know”), not my app’s own 404 and not a Cloud-Run-branded error.
    • The response has no server header at all. A working service in the same project returns server: Google Frontend on every response.
      • Cloud Logging’s run.googleapis.com/requests log has zero entries for either broken service across many repeated real requests, while the identical query for the working service in the same project shows every request logged.
        • The Cloud Run control plane reports both broken services as fully healthy the whole time: Ready=True, RoutesReady=True, ConfigurationsReady=True. Container logs show the app (gunicorn/Flask) booting cleanly and listening on the expected port.
      • This looks like Google’s Front End never attributes/routes the request to any backend at all, rather than an application-level or IAM-level failure, since GFE would need to reach the backend to log anything at all.
    • Ruled out
    • IAM / invoker bindings - correct on both services (and moot anyway, since GFE never gets far enough to check IAM).
      • Ingress setting - run.googleapis.com/ingress: all on both.
        • Org policy - checked run.allowedIngress and iam.allowedPolicyMemberDomains; both effectively ALLOW, no matching restrictive org policies found.
          • DNS - resolves to the same Google anycast IP pool as the working service.
            • Propagation delay - waited 20+ minutes and also deployed a brand-new revision; identical failure instantly both times.
              • Region - reproduced in a second, brand-new service in a different region (us-east1) created purely as a control.
                • Project-specific misconfiguration - other threads here show different users, on different projects and accounts, hitting the identical signature (e.g. “Cloud Run services return Google-branded 404 on public run.app URL despite Ready=True, correct IAM, ingress=all - reproduced across 2 projects, 2 accounts, zero request logs” and “Cloud Run run.app URLs return Google frontend 404 before reaching containers”).
              • Related open report
            • The thread “Cloud Run services return Google-branded 404 on public run.app URL despite Ready=True, correct IAM, ingress=all - reproduced across 2 projects, 2 accounts, zero request logs” (in this same category) describes the same no-server-header 404 / zero-request-log signature, from different projects and accounts, with no resolution yet for the base-URL case (one reply there resolved a related-but-different issue involving a path ending in /healthz, which doesn’t match my symptom since my root path is also unreachable).
          • Filing this as its own topic since I have a slightly different ruled-out-causes list and a second, independent repro in a different region - happy to have a moderator merge these if that’s preferred. I’m also filing this as a formal bug report on the public Issue Tracker. Would appreciate any pointers, especially from anyone at Google who can check server-side routing/GFE logs for these projects.