A customer complained about something our agent told them three weeks ago. We couldn't reconstruct it

Support forwarded the ticket on a Tuesday. The customer had a screenshot, so we knew the exact output. Confident, specific, and wrong in a way that would have cost them real money if they had acted on it. So we went looking for why. We had the output logged. We had the timestamp. What we did not have was the prompt that produced it. Our system prompt lived in a config file that two people had edited that month, and the edits went in as part of larger commits with messages like "copy tweaks." Somewhere in there the instruction about not giving specific figures had been softened. Nobody remembered doing it. Then it got worse, because we had also bumped the model version around the same window. So even if I found the right prompt text, I could not tell you whether that output came from the old model with the new prompt, or the new model with the old one. We ended up apologising to the customer without being able to explain what happened. That is the part that still bugs me. Not the bad answer, every system gives a bad answer eventually. It was sitting in a room full of engineers and not being able to answer what did we tell it to do on July 2nd. We fixed the obvious thing after. Prompts got versioned properly and pinned to a model version, and config changes stopped riding along inside unrelated commits. I am curious how other people handle the forensics side though. When a complaint lands about something that happened weeks ago, can you actually reconstruct the exact inputs? Or does everyone quietly hope it does not come up.