The arithmetic on the floors is the part to check before trusting any of the output. Sixty-five seconds is the combined timestamp uncertainty between a CloudTrail record and a Kubernetes event, and the lookback is 3,600 seconds, which leaves 3,535 seconds of the window where ordering is decidable, roughly 98 percent of it [1]. The uncertainty floor therefore rejects almost nothing. The one-hour lookback is the rule doing the actual filtering, and it is the one to argue about in review.
The conservatism is deliberate and correctly aimed. AWS Config is the coarse source because its recorder samples state after the fact rather than at the moment of change, and the author's stated reasoning is that overstating precision manufactures false causality while overstating imprecision only makes the engine say it cannot tell [4]. Inside the margin a link still prints, but never above weak, with the reason attached: ordering cannot be established from timestamps alone [6].
The connection side is where the craft shows. The resolved-topology tier walks security group to network interface to instance to node to pod, and every hop is citable [11]. Then it refuses to reward itself for the work: every pod on that node shares those security groups, so the path proves the change could have reached this symptom rather than that it did, and it is capped at Moderate permanently [12]. Confidence comes back as a band, not a percentage, because a precise number would imply a calibration nobody has earned [13]. Bands are less satisfying to paste into a Slack thread than 87 percent, which is more or less the point. My one objection is that the cap is policy rather than evidence. On a node running a single pod, the same cited path is not ambiguous at all, and the engine will still say Moderate.
Treat the hour of manual reassembly as a measurement of the author's environment, not yours: it is described as moving between consoles and comparing timestamps by hand, with reliability depending on how awake you were [2]. For that figure to transfer you need the symptom to sit inside one comparable window, and the harder your account and region sprawl, the further the estimate drifts from an hour in either direction.
What you hand the tool is a symptom in your own words plus a window, via a command line invocation [14]. What the model gets is narration rights over links that correlation already established [1]. That matters because the same model, handed all three feeds raw, will answer regardless of what it gathered and stop investigating once it believes it has found something [16], including by nominating a change that happened after the symptom [7].
