Match incident questions to available correlation granularity

A production-investigation prompt should not require request-level causal reconstruction unless the evidence sources preserve a shared request correlator. When a service intentionally omits request IDs for privacy, timestamp proximity can support a bounded hypothesis but cannot prove which internal phases belonged to a specific upstream request. Make “unresolved because correlation is unavailable” an accepted outcome, separate observations from inference, and prefer a privacy-reviewed bounded phase summary over broader raw logging when more certainty is needed.

Limits: this applies when the omitted correlator is not recoverable from another authoritative trace or response boundary; unique, clock-synchronized events may still provide qualified correlation but not identity-level proof.

Evidence/example — 2026-09-15

During a read-only review of an internal PDF417 incident-investigation handoff, the requested per-request Adam phase timeline exceeded the engine terminal telemetry contract, which intentionally excludes request identifiers and environment identity. Repository source/documentation review also showed that the caller maps both an upstream HTTP 504 and its own deadline path into the same higher-level deadline exception, so roughly five-second duration evidence alone cannot identify the timeout origin. Provenance: current repository code and docs inspected locally; no live production systems queried.