A structured logging field added in 2023, never queried, and the one week it was the only thing that helped.
the field: deploy_sha, on every log line.
queries against it, 2023-2025: zero.
removed from the field list in the January 2025 audit
as unused. restored in March 2025 after an argument.
March 2026: an error appearing on 3% of requests,
correlating with nothing — not a route, not a
consumer, not a time of day.
grouped by deploy_sha: 100% on one commit, which
was live on two of four workers because a rolling
update had half-failed.A field with no queries against it for three years is exactly the field an audit removes, and the value of a diagnostic dimension is not visible until the day nothing else explains the data. The honest position is that the 2025 audit was right on the evidence and wrong in outcome, which is not the same as being wrong.