diff --git a/backend/app/Console/Commands/SyncScheduledPlugins.php b/backend/app/Console/Commands/SyncScheduledPlugins.php
index 8e75b52..cbff507 100644
--- a/backend/app/Console/Commands/SyncScheduledPlugins.php
+++ b/backend/app/Console/Commands/SyncScheduledPlugins.php
@@ -5,6 +5,7 @@
 use App\Jobs\RunPluginVersionIngestion;
 use App\Models\Plugin;
 use App\Services\Ingestion\IngestionService;
+use App\Support\CorrelationId;
 use Illuminate\Console\Command;
 
 class SyncScheduledPlugins extends Command
@@ -27,7 +28,10 @@ public function handle(IngestionService $service): int
                     return;
                 }
 
-                $run = $service->start($pluginVersion, 'scheduled');
+                // Each scheduled run is its own logical operation, not part
+                // of an inbound request, so it gets its own fresh
+                // correlation ID rather than sharing one across the batch.
+                $run = $service->start($pluginVersion, 'scheduled', correlationId: CorrelationId::generate());
 
                 if ($run->wasRecentlyCreated) {
                     RunPluginVersionIngestion::dispatch($pluginVersion->id, $run->id);
diff --git a/backend/app/Http/Controllers/Api/V1/GitHubWebhookController.php b/backend/app/Http/Controllers/Api/V1/GitHubWebhookController.php
index ae0f716..0a7e287 100644
--- a/backend/app/Http/Controllers/Api/V1/GitHubWebhookController.php
+++ b/backend/app/Http/Controllers/Api/V1/GitHubWebhookController.php
@@ -6,6 +6,8 @@
 use App\Jobs\RunPluginVersionIngestion;
 use App\Models\Plugin;
 use App\Services\Ingestion\IngestionService;
+use App\Support\CorrelationId;
+use App\Support\Telemetry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -15,7 +17,14 @@ class GitHubWebhookController extends Controller
 {
     public function __invoke(Request $request, IngestionService $service): JsonResponse
     {
+        $correlationId = CorrelationId::fromRequest($request);
+
         if (! $this->hasValidSignature($request)) {
+            Telemetry::event('webhook.github.rejected', [
+                'correlation_id' => $correlationId,
+                'reason' => 'invalid_signature',
+            ]);
+
             return response()->json([
                 'message' => 'Invalid GitHub webhook signature.',
                 'code' => 'webhook.invalid_signature',
@@ -26,6 +35,13 @@ public function __invoke(Request $request, IngestionService $service): JsonRespo
         $branch = Str::after($request->string('ref')->toString(), 'refs/heads/');
 
         if ($repository === '' || $branch === '') {
+            Telemetry::event('webhook.github.accepted', [
+                'correlation_id' => $correlationId,
+                'repository' => $repository !== '' ? $repository : null,
+                'branch' => $branch !== '' ? $branch : null,
+                'queued' => 0,
+            ]);
+
             return response()->json([
                 'message' => 'Ignored GitHub webhook payload.',
                 'code' => 'webhook.ignored',
@@ -39,14 +55,14 @@ public function __invoke(Request $request, IngestionService $service): JsonRespo
             ->with(['versions' => fn ($query) => $query->orderByDesc('is_latest')->orderByDesc('id')])
             ->get()
             ->filter(fn (Plugin $plugin): bool => $this->matchesPlugin($plugin, $repository, $branch))
-            ->each(function (Plugin $plugin) use ($service, &$queued): void {
+            ->each(function (Plugin $plugin) use ($service, $correlationId, &$queued): void {
                 $pluginVersion = $plugin->versions->first();
 
                 if ($pluginVersion === null) {
                     return;
                 }
 
-                $run = $service->start($pluginVersion, 'webhook');
+                $run = $service->start($pluginVersion, 'webhook', correlationId: $correlationId);
 
                 if ($run->wasRecentlyCreated) {
                     RunPluginVersionIngestion::dispatch($pluginVersion->id, $run->id);
@@ -54,6 +70,13 @@ public function __invoke(Request $request, IngestionService $service): JsonRespo
                 }
             });
 
+        Telemetry::event('webhook.github.accepted', [
+            'correlation_id' => $correlationId,
+            'repository' => $repository,
+            'branch' => $branch,
+            'queued' => $queued,
+        ]);
+
         return response()->json([
             'message' => 'GitHub webhook processed.',
             'code' => 'webhook.processed',
diff --git a/backend/app/Http/Controllers/Api/V1/IngestionController.php b/backend/app/Http/Controllers/Api/V1/IngestionController.php
index 54dd2b5..3cc518c 100644
--- a/backend/app/Http/Controllers/Api/V1/IngestionController.php
+++ b/backend/app/Http/Controllers/Api/V1/IngestionController.php
@@ -94,6 +94,7 @@ private function payload(IngestionRun $run): array
             'id' => $run->id,
             'plugin_version_id' => $run->plugin_version_id,
             'source' => $run->source,
+            'correlation_id' => $run->correlation_id,
             'status' => $run->status,
             'stats' => $run->stats,
             'log' => $run->log,
diff --git a/backend/app/Http/Controllers/Api/V1/PluginSyncController.php b/backend/app/Http/Controllers/Api/V1/PluginSyncController.php
index c0c491f..13f068b 100644
--- a/backend/app/Http/Controllers/Api/V1/PluginSyncController.php
+++ b/backend/app/Http/Controllers/Api/V1/PluginSyncController.php
@@ -6,11 +6,13 @@
 use App\Jobs\RunPluginVersionIngestion;
 use App\Models\Plugin;
 use App\Services\Ingestion\IngestionService;
+use App\Support\CorrelationId;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 
 class PluginSyncController extends Controller
 {
-    public function __invoke(Plugin $plugin, IngestionService $service): JsonResponse
+    public function __invoke(Request $request, Plugin $plugin, IngestionService $service): JsonResponse
     {
         $plugin->loadMissing('versions');
 
@@ -20,7 +22,7 @@ public function __invoke(Plugin $plugin, IngestionService $service): JsonRespons
             ->first()
             ?? $plugin->versions()->latest('id')->firstOrFail();
 
-        $run = $service->start($pluginVersion, 'manual');
+        $run = $service->start($pluginVersion, 'manual', correlationId: CorrelationId::fromRequest($request));
 
         if ($run->wasRecentlyCreated) {
             RunPluginVersionIngestion::dispatch($pluginVersion->id, $run->id);
@@ -31,6 +33,7 @@ public function __invoke(Plugin $plugin, IngestionService $service): JsonRespons
                 'id' => $run->id,
                 'plugin_version_id' => $run->plugin_version_id,
                 'source' => $run->source,
+                'correlation_id' => $run->correlation_id,
                 'status' => $run->status,
                 'stats' => $run->stats,
                 'log' => $run->log,
diff --git a/backend/app/Http/Middleware/AssignCorrelationId.php b/backend/app/Http/Middleware/AssignCorrelationId.php
new file mode 100644
index 0000000..61af5cc
--- /dev/null
+++ b/backend/app/Http/Middleware/AssignCorrelationId.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\CorrelationId;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Assigns every API request a correlation ID: a valid client-supplied
+ * `X-Request-Id` is reused, otherwise one is generated. The ID is exposed
+ * to downstream code via the request attribute bag and echoed back on the
+ * response so a caller can correlate their request with server-side logs
+ * and ingestion runs.
+ */
+class AssignCorrelationId
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $incoming = $request->header(CorrelationId::HEADER);
+        $correlationId = CorrelationId::isValid($incoming) ? $incoming : CorrelationId::generate();
+
+        $request->attributes->set(CorrelationId::REQUEST_ATTRIBUTE, $correlationId);
+
+        $response = $next($request);
+        $response->headers->set(CorrelationId::HEADER, $correlationId);
+
+        return $response;
+    }
+}
diff --git a/backend/app/Models/IngestionRun.php b/backend/app/Models/IngestionRun.php
index 7b0187b..4e4b667 100644
--- a/backend/app/Models/IngestionRun.php
+++ b/backend/app/Models/IngestionRun.php
@@ -18,6 +18,7 @@ class IngestionRun extends Model
     protected $fillable = [
         'plugin_version_id',
         'source',
+        'correlation_id',
         'status',
         'stats',
         'log',
diff --git a/backend/app/Services/Ingestion/IngestionService.php b/backend/app/Services/Ingestion/IngestionService.php
index 9948e4d..f1974bb 100644
--- a/backend/app/Services/Ingestion/IngestionService.php
+++ b/backend/app/Services/Ingestion/IngestionService.php
@@ -15,6 +15,9 @@
 use App\Models\PluginVersion;
 use App\Services\Discovery\DiscoveryCache;
 use App\Services\Markdown\MarkdownParser;
+use App\Support\CorrelationId;
+use App\Support\Telemetry;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Throwable;
@@ -27,9 +30,20 @@ public function __construct(
         private readonly DiscoveryCache $cache,
     ) {}
 
-    public function start(PluginVersion $pluginVersion, string $source = 'manual', bool $force = false): IngestionRun
+    /**
+     * Start (or reuse) an ingestion run.
+     *
+     * The correlation ID identifies the caller's request, not the run: if
+     * an active run is reused, the run keeps the correlation ID of whoever
+     * created it, and this call's own ID is only recorded on the
+     * `ingestion.enqueued` telemetry event, referencing the reused run.
+     * Run history is never rewritten.
+     */
+    public function start(PluginVersion $pluginVersion, string $source = 'manual', bool $force = false, ?string $correlationId = null): IngestionRun
     {
-        $run = DB::transaction(function () use ($pluginVersion, $source, $force): IngestionRun {
+        $requestCorrelationId = $correlationId ?? CorrelationId::generate();
+
+        $run = DB::transaction(function () use ($pluginVersion, $source, $force, $requestCorrelationId): IngestionRun {
             if (! $force) {
                 $existingRun = IngestionRun::query()
                     ->where('plugin_version_id', $pluginVersion->id)
@@ -46,6 +60,7 @@ public function start(PluginVersion $pluginVersion, string $source = 'manual', b
             return IngestionRun::query()->create([
                 'plugin_version_id' => $pluginVersion->id,
                 'source' => $source,
+                'correlation_id' => $requestCorrelationId,
                 'status' => 'queued',
                 'stats' => [
                     'docs_parsed' => 0,
@@ -60,6 +75,17 @@ public function start(PluginVersion $pluginVersion, string $source = 'manual', b
             IngestionRunStatusChanged::dispatch($run);
         }
 
+        Telemetry::event('ingestion.enqueued', [
+            'correlation_id' => $requestCorrelationId,
+            'ingestion_run_id' => $run->id,
+            'plugin_version_id' => $pluginVersion->id,
+            'plugin_id' => $pluginVersion->plugin_id,
+            'community_id' => $pluginVersion->plugin?->community_id,
+            'source' => $source,
+            'reused' => ! $run->wasRecentlyCreated,
+            'user_id' => Auth::id(),
+        ]);
+
         return $run;
     }
 
@@ -67,6 +93,7 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
     {
         $pluginVersion->loadMissing('plugin');
         $run ??= $this->start($pluginVersion);
+        $correlationId = $run->correlation_id ?? CorrelationId::generate();
         $run->update([
             'status' => 'running',
             'started_at' => now(),
@@ -74,6 +101,15 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
         ]);
         IngestionRunStatusChanged::dispatch($run->refresh());
 
+        Telemetry::event('ingestion.started', [
+            'correlation_id' => $correlationId,
+            'ingestion_run_id' => $run->id,
+            'plugin_version_id' => $pluginVersion->id,
+            'plugin_id' => $pluginVersion->plugin_id,
+            'community_id' => $pluginVersion->plugin?->community_id,
+            'source' => $run->source,
+        ]);
+
         $stats = [
             'docs_parsed' => 0,
             'commands_extracted' => 0,
@@ -88,7 +124,8 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
                 'level' => 'error',
                 'code' => $exception->failureCode(),
                 'message' => $exception->getMessage(),
-            ]]);
+                'correlation_id' => $correlationId,
+            ]], $correlationId);
         }
 
         foreach ($files as $file) {
@@ -98,6 +135,7 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
                     'code' => 'document_not_modified',
                     'path' => $file->path,
                     'message' => "Skipped unchanged markdown file [{$file->path}].",
+                    'correlation_id' => $correlationId,
                 ];
 
                 continue;
@@ -117,6 +155,7 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
                         'code' => 'markdown_warning',
                         'path' => $parsedDocument->path,
                         'message' => $warning,
+                        'correlation_id' => $correlationId,
                     ];
                 }
             } catch (Throwable $exception) {
@@ -126,6 +165,7 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
                     'code' => 'document_parse_failed',
                     'path' => $file->path,
                     'message' => $exception->getMessage(),
+                    'correlation_id' => $correlationId,
                 ];
             }
         }
@@ -139,6 +179,18 @@ public function run(PluginVersion $pluginVersion, ?IngestionRun $run = null): In
             'finished_at' => now(),
         ]);
 
+        Telemetry::event('ingestion.completed', [
+            'correlation_id' => $correlationId,
+            'ingestion_run_id' => $run->id,
+            'plugin_version_id' => $pluginVersion->id,
+            'plugin_id' => $pluginVersion->plugin_id,
+            'community_id' => $pluginVersion->plugin?->community_id,
+            'status' => $status,
+            'docs_parsed' => $stats['docs_parsed'],
+            'commands_extracted' => $stats['commands_extracted'],
+            'warnings' => $stats['warnings'],
+        ]);
+
         if ($stats['docs_parsed'] > 0) {
             $pluginVersion->commands()->with(['category', 'pluginVersion.plugin.community'])->get()->searchable();
             $this->cache->invalidate();
@@ -226,7 +278,7 @@ private function categoryId(ParsedCommand $command): ?int
      * @param  array<string, int>  $stats
      * @param  list<array<string, mixed>>  $log
      */
-    private function fail(IngestionRun $run, array $stats, array $log): IngestionRun
+    private function fail(IngestionRun $run, array $stats, array $log, ?string $correlationId = null): IngestionRun
     {
         $run->update([
             'status' => 'failed',
@@ -238,6 +290,21 @@ private function fail(IngestionRun $run, array $stats, array $log): IngestionRun
         $run = $run->refresh();
         IngestionRunStatusChanged::dispatch($run);
 
+        // The failure code is consumed from the `code` key already
+        // persisted in the log entry, per ADR-27/BRAIN-007: never
+        // recomputed, never renamed.
+        $run->loadMissing('pluginVersion.plugin');
+        $pluginVersion = $run->pluginVersion;
+
+        Telemetry::event('ingestion.failed', [
+            'correlation_id' => $correlationId ?? $run->correlation_id,
+            'ingestion_run_id' => $run->id,
+            'plugin_version_id' => $run->plugin_version_id,
+            'plugin_id' => $pluginVersion?->plugin_id,
+            'community_id' => $pluginVersion?->plugin?->community_id,
+            'code' => $log[0]['code'] ?? null,
+        ]);
+
         return $run;
     }
 }
diff --git a/backend/app/Support/CorrelationId.php b/backend/app/Support/CorrelationId.php
new file mode 100644
index 0000000..c85c7ba
--- /dev/null
+++ b/backend/app/Support/CorrelationId.php
@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Support;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+
+/**
+ * Generates and validates correlation IDs used to trace a single logical
+ * operation (HTTP request, webhook delivery, scheduled sync iteration)
+ * across ingestion runs, queued jobs, and structured log events.
+ *
+ * A client-supplied `X-Request-Id` is only trusted when it matches a safe,
+ * bounded character set. This prevents log injection (no control
+ * characters, no newlines) and unbounded input; anything else is replaced
+ * with a freshly generated ID rather than echoed back.
+ */
+final class CorrelationId
+{
+    // The "D" modifier forces "$" to match only at the absolute end of the
+    // subject, not before a trailing newline. Without it, PCRE's default
+    // behavior lets a value like "id\n" pass validation and be echoed back
+    // raw in the response header and persisted on the run row.
+    private const PATTERN = '/^[A-Za-z0-9._:-]{1,128}$/D';
+
+    public const HEADER = 'X-Request-Id';
+
+    public const REQUEST_ATTRIBUTE = 'correlation_id';
+
+    /**
+     * Produce a new, safe-by-construction correlation ID.
+     */
+    public static function generate(): string
+    {
+        return (string) Str::uuid();
+    }
+
+    /**
+     * Determine whether a client-supplied value is safe to reuse as-is.
+     */
+    public static function isValid(?string $value): bool
+    {
+        return $value !== null && preg_match(self::PATTERN, $value) === 1;
+    }
+
+    /**
+     * Resolve the correlation ID assigned to the current request by
+     * `App\Http\Middleware\AssignCorrelationId`, generating one as a
+     * fallback for call sites reached outside that middleware (e.g. Artisan
+     * commands, unit tests exercising services directly).
+     */
+    public static function fromRequest(Request $request): string
+    {
+        $assigned = $request->attributes->get(self::REQUEST_ATTRIBUTE);
+
+        if (is_string($assigned) && $assigned !== '') {
+            return $assigned;
+        }
+
+        return self::generate();
+    }
+}
diff --git a/backend/app/Support/Telemetry.php b/backend/app/Support/Telemetry.php
new file mode 100644
index 0000000..7e4e155
--- /dev/null
+++ b/backend/app/Support/Telemetry.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Support;
+
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Emits structured, JSON-formatted domain events to the dedicated
+ * `telemetry` log channel, keyed by a stable event name from the F-011
+ * taxonomy (see `brain/audits/2026-06-13-system-audit.md`).
+ *
+ * This channel is additive: it never touches the default `stack`/`single`
+ * channels used for framework/application logging. Context values must
+ * already be safe to log (identifiers, codes, counts); this class does not
+ * accept raw request payloads, headers, or Markdown content.
+ */
+final class Telemetry
+{
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public static function event(string $name, array $context = []): void
+    {
+        Log::channel('telemetry')->info($name, array_filter(
+            $context,
+            static fn (mixed $value): bool => $value !== null,
+        ));
+    }
+}
diff --git a/backend/bootstrap/app.php b/backend/bootstrap/app.php
index e93ea80..fdef9b0 100644
--- a/backend/bootstrap/app.php
+++ b/backend/bootstrap/app.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Middleware\AssignCorrelationId;
 use App\Http\Middleware\EnsureCommunityPermission;
 use App\Http\Middleware\EnsurePluginPermission;
 use App\Http\Middleware\ForceJsonResponse;
@@ -30,6 +31,7 @@
         $middleware->append(SecurityHeaders::class);
 
         $middleware->api(prepend: [
+            AssignCorrelationId::class,
             ForceJsonResponse::class,
         ]);
 
diff --git a/backend/config/logging.php b/backend/config/logging.php
index 8d94292..07cbf2c 100644
--- a/backend/config/logging.php
+++ b/backend/config/logging.php
@@ -1,5 +1,6 @@
 <?php
 
+use Monolog\Formatter\JsonFormatter;
 use Monolog\Handler\NullHandler;
 use Monolog\Handler\StreamHandler;
 use Monolog\Handler\SyslogUdpHandler;
@@ -123,6 +124,21 @@
             'handler' => NullHandler::class,
         ],
 
+        // Dedicated structured-event channel for App\Support\Telemetry
+        // (F-011 correlation ID / domain event taxonomy). Additive: does
+        // not participate in the default "stack"/"single" channels, so it
+        // never changes the format or destination of framework logging.
+        'telemetry' => [
+            'driver' => 'monolog',
+            'name' => 'telemetry',
+            'handler' => StreamHandler::class,
+            'with' => [
+                'stream' => storage_path('logs/telemetry.log'),
+            ],
+            'formatter' => JsonFormatter::class,
+            'level' => env('LOG_LEVEL', 'debug'),
+        ],
+
         'emergency' => [
             'path' => storage_path('logs/laravel.log'),
         ],
diff --git a/backend/database/migrations/2026_09_20_000001_add_correlation_id_to_ingestion_runs_table.php b/backend/database/migrations/2026_09_20_000001_add_correlation_id_to_ingestion_runs_table.php
new file mode 100644
index 0000000..8e692ee
--- /dev/null
+++ b/backend/database/migrations/2026_09_20_000001_add_correlation_id_to_ingestion_runs_table.php
@@ -0,0 +1,24 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('ingestion_runs', function (Blueprint $table): void {
+            $table->string('correlation_id')->nullable()->after('source');
+            $table->index('correlation_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('ingestion_runs', function (Blueprint $table): void {
+            $table->dropIndex(['correlation_id']);
+            $table->dropColumn('correlation_id');
+        });
+    }
+};
diff --git a/backend/tests/Feature/IngestionTelemetryTest.php b/backend/tests/Feature/IngestionTelemetryTest.php
new file mode 100644
index 0000000..6961ddc
--- /dev/null
+++ b/backend/tests/Feature/IngestionTelemetryTest.php
@@ -0,0 +1,379 @@
+<?php
+
+use App\Contracts\GitHubClient;
+use App\Data\GitHubMarkdownFile;
+use App\Events\CommandIndexUpdated;
+use App\Events\IngestionRunStatusChanged;
+use App\Exceptions\GitHubRateLimitException;
+use App\Models\Community;
+use App\Models\IngestionRun;
+use App\Models\Plugin;
+use App\Models\PluginVersion;
+use App\Services\Ingestion\IngestionService;
+use App\Support\CorrelationId;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Event;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function (): void {
+    config([
+        'queue.default' => 'sync',
+        'scout.driver' => 'null',
+    ]);
+
+    Event::fake([
+        CommandIndexUpdated::class,
+        IngestionRunStatusChanged::class,
+    ]);
+
+    // Start every test from a clean, real telemetry log so assertions read
+    // only the lines this test produced.
+    @unlink(storage_path('logs/telemetry.log'));
+});
+
+/**
+ * @return list<array<string, mixed>>
+ */
+function readTelemetryEvents(): array
+{
+    $path = storage_path('logs/telemetry.log');
+
+    if (! file_exists($path)) {
+        return [];
+    }
+
+    $lines = array_filter(explode("\n", trim(file_get_contents($path) ?: '')));
+
+    return array_map(fn (string $line): array => json_decode($line, true, flags: JSON_THROW_ON_ERROR), $lines);
+}
+
+/**
+ * @return list<array<string, mixed>>
+ */
+function telemetryEventsNamed(string $name): array
+{
+    return array_values(array_filter(
+        readTelemetryEvents(),
+        fn (array $entry): bool => ($entry['message'] ?? null) === $name,
+    ));
+}
+
+function telemetryPluginVersion(): PluginVersion
+{
+    $community = Community::factory()->create();
+    $plugin = Plugin::factory()->create([
+        'community_id' => $community->id,
+        'name' => 'Telemetry Plugin',
+        'slug' => 'telemetry-plugin',
+        'repository_url' => 'commandsphere/telemetry-plugin',
+        'documentation_path' => 'docs',
+        'default_branch' => 'main',
+    ]);
+
+    return PluginVersion::factory()->latest()->create([
+        'plugin_id' => $plugin->id,
+        'version' => '1.0.0',
+        'git_ref' => 'main',
+    ]);
+}
+
+function telemetryMarkdownFile(): GitHubMarkdownFile
+{
+    return new GitHubMarkdownFile(
+        path: 'docs/commands.md',
+        content: <<<'MARKDOWN'
+---
+title: Telemetry Commands
+commands:
+  - name: Telemetry Status
+    slug: telemetry-status
+    syntax: /telemetry status
+    description: Shows telemetry status.
+    category: diagnostics
+---
+
+# Telemetry Commands
+MARKDOWN,
+        etag: '"telemetry-etag"',
+    );
+}
+
+function telemetryNotModifiedMarkdownFile(): GitHubMarkdownFile
+{
+    return new GitHubMarkdownFile(
+        path: 'docs/unchanged.md',
+        content: null,
+        etag: '"telemetry-unchanged-etag"',
+        notModified: true,
+    );
+}
+
+/**
+ * @param  array<string, mixed>  $payload
+ * @return array{json: string, signature: string}
+ */
+function signedTelemetryPayload(array $payload, string $secret): array
+{
+    $json = json_encode($payload, JSON_THROW_ON_ERROR);
+
+    return [
+        'json' => $json,
+        'signature' => 'sha256='.hash_hmac('sha256', $json, $secret),
+    ];
+}
+
+it('propagates a valid X-Request-Id from a webhook to the run, log entries, and response header', function (): void {
+    telemetryPluginVersion();
+    config(['commandsphere.github.webhook_secret' => 'telemetry-secret']);
+    app()->bind(GitHubClient::class, fn () => new class implements GitHubClient
+    {
+        public function markdownFiles(Plugin $plugin, ?string $branch = null): array
+        {
+            return [telemetryMarkdownFile(), telemetryNotModifiedMarkdownFile()];
+        }
+    });
+
+    $payload = signedTelemetryPayload([
+        'ref' => 'refs/heads/main',
+        'repository' => ['full_name' => 'commandsphere/telemetry-plugin'],
+    ], 'telemetry-secret');
+    $requestId = 'webhook-correlation-12345';
+
+    $response = $this->call(
+        'POST',
+        '/api/v1/webhooks/github',
+        server: [
+            'CONTENT_TYPE' => 'application/json',
+            'HTTP_ACCEPT' => 'application/json',
+            'HTTP_X_HUB_SIGNATURE_256' => $payload['signature'],
+            'HTTP_X_REQUEST_ID' => $requestId,
+        ],
+        content: $payload['json'],
+    );
+
+    $response->assertAccepted()
+        ->assertHeader('X-Request-Id', $requestId);
+
+    $run = IngestionRun::query()->firstOrFail();
+
+    expect($run->correlation_id)->toBe($requestId)
+        ->and($run->status)->toBe('success')
+        ->and($run->log)->not->toBeEmpty()
+        ->and($run->log[0]['code'])->toBe('document_not_modified')
+        ->and(collect($run->log)->pluck('correlation_id')->unique()->all())->toBe([$requestId]);
+
+    $enqueued = telemetryEventsNamed('ingestion.enqueued');
+    $started = telemetryEventsNamed('ingestion.started');
+    $completed = telemetryEventsNamed('ingestion.completed');
+    $accepted = telemetryEventsNamed('webhook.github.accepted');
+
+    expect($enqueued)->toHaveCount(1)
+        ->and($enqueued[0]['context']['correlation_id'])->toBe($requestId)
+        ->and($enqueued[0]['context']['ingestion_run_id'])->toBe($run->id)
+        ->and($started)->toHaveCount(1)
+        ->and($started[0]['context']['correlation_id'])->toBe($requestId)
+        ->and($completed)->toHaveCount(1)
+        ->and($completed[0]['context']['correlation_id'])->toBe($requestId)
+        ->and($completed[0]['context']['status'])->toBe('success')
+        ->and($accepted)->toHaveCount(1)
+        ->and($accepted[0]['context']['correlation_id'])->toBe($requestId)
+        ->and($accepted[0]['context']['queued'])->toBe(1);
+});
+
+it('discards an invalid X-Request-Id and substitutes a generated one everywhere downstream', function (): void {
+    telemetryPluginVersion();
+    config(['commandsphere.github.webhook_secret' => 'telemetry-secret']);
+    app()->bind(GitHubClient::class, fn () => new class implements GitHubClient
+    {
+        public function markdownFiles(Plugin $plugin, ?string $branch = null): array
+        {
+            return [telemetryMarkdownFile()];
+        }
+    });
+
+    $payload = signedTelemetryPayload([
+        'ref' => 'refs/heads/main',
+        'repository' => ['full_name' => 'commandsphere/telemetry-plugin'],
+    ], 'telemetry-secret');
+    $unsafeRequestId = str_repeat('a', 300);
+
+    $response = $this->call(
+        'POST',
+        '/api/v1/webhooks/github',
+        server: [
+            'CONTENT_TYPE' => 'application/json',
+            'HTTP_ACCEPT' => 'application/json',
+            'HTTP_X_HUB_SIGNATURE_256' => $payload['signature'],
+            'HTTP_X_REQUEST_ID' => $unsafeRequestId,
+        ],
+        content: $payload['json'],
+    );
+
+    $response->assertAccepted();
+    $issuedId = $response->headers->get('X-Request-Id');
+
+    expect($issuedId)->not->toBeNull()
+        ->and($issuedId)->not->toBe($unsafeRequestId)
+        ->and(CorrelationId::isValid($issuedId))->toBeTrue();
+
+    $run = IngestionRun::query()->firstOrFail();
+
+    expect($run->correlation_id)->toBe($issuedId);
+});
+
+it('rejects a trailing-terminator X-Request-Id and substitutes a UUID in the header and the run column', function (string $terminator) {
+    telemetryPluginVersion();
+    config(['commandsphere.github.webhook_secret' => 'telemetry-secret']);
+    app()->bind(GitHubClient::class, fn () => new class implements GitHubClient
+    {
+        public function markdownFiles(Plugin $plugin, ?string $branch = null): array
+        {
+            return [telemetryMarkdownFile()];
+        }
+    });
+
+    $payload = signedTelemetryPayload([
+        'ref' => 'refs/heads/main',
+        'repository' => ['full_name' => 'commandsphere/telemetry-plugin'],
+    ], 'telemetry-secret');
+    $injectedRequestId = 'injected-id'.$terminator;
+
+    $response = $this->call(
+        'POST',
+        '/api/v1/webhooks/github',
+        server: [
+            'CONTENT_TYPE' => 'application/json',
+            'HTTP_ACCEPT' => 'application/json',
+            'HTTP_X_HUB_SIGNATURE_256' => $payload['signature'],
+            'HTTP_X_REQUEST_ID' => $injectedRequestId,
+        ],
+        content: $payload['json'],
+    );
+
+    $response->assertAccepted();
+    $issuedId = $response->headers->get('X-Request-Id');
+
+    expect($issuedId)->not->toBeNull()
+        ->and($issuedId)->not->toBe($injectedRequestId)
+        ->and(CorrelationId::isValid($issuedId))->toBeTrue()
+        ->and(preg_match('/\A[0-9a-f-]{36}\z/i', $issuedId))->toBe(1);
+
+    $run = IngestionRun::query()->firstOrFail();
+
+    expect($run->correlation_id)->toBe($issuedId)
+        ->and($run->correlation_id)->not->toContain("\n")
+        ->and($run->correlation_id)->not->toContain("\r");
+})->with([
+    'trailing LF' => ["\n"],
+    'trailing CR' => ["\r"],
+    'trailing CRLF' => ["\r\n"],
+]);
+
+it('rejects an unsigned webhook and logs webhook.github.rejected with a correlation id', function (): void {
+    telemetryPluginVersion();
+    config(['commandsphere.github.webhook_secret' => 'telemetry-secret']);
+
+    $this->call(
+        'POST',
+        '/api/v1/webhooks/github',
+        server: [
+            'CONTENT_TYPE' => 'application/json',
+            'HTTP_ACCEPT' => 'application/json',
+            'HTTP_X_HUB_SIGNATURE_256' => 'sha256=invalid',
+        ],
+        content: json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'commandsphere/telemetry-plugin'],
+        ], JSON_THROW_ON_ERROR),
+    )->assertUnauthorized();
+
+    $rejected = telemetryEventsNamed('webhook.github.rejected');
+
+    expect($rejected)->toHaveCount(1)
+        ->and($rejected[0]['context']['correlation_id'])->not->toBeEmpty()
+        ->and($rejected[0]['context']['reason'])->toBe('invalid_signature');
+});
+
+it('records ingestion.failed with the ADR-27 taxonomy code and the run correlation id', function (): void {
+    $version = telemetryPluginVersion();
+    app()->bind(GitHubClient::class, fn () => new class implements GitHubClient
+    {
+        public function markdownFiles(Plugin $plugin, ?string $branch = null): array
+        {
+            throw GitHubRateLimitException::forRepository($plugin->repository_url ?? 'fixture');
+        }
+    });
+
+    $service = app(IngestionService::class);
+    $run = $service->start($version, 'manual', correlationId: 'failure-correlation-id');
+    $run = $service->run($version, $run);
+
+    expect($run->status)->toBe('failed')
+        ->and($run->correlation_id)->toBe('failure-correlation-id')
+        ->and($run->log[0]['code'])->toBe('git_hub_rate_limit_exception')
+        ->and($run->log[0]['correlation_id'])->toBe('failure-correlation-id');
+
+    $failed = telemetryEventsNamed('ingestion.failed');
+
+    expect($failed)->toHaveCount(1)
+        ->and($failed[0]['context']['correlation_id'])->toBe('failure-correlation-id')
+        ->and($failed[0]['context']['code'])->toBe('git_hub_rate_limit_exception');
+});
+
+it('keeps a reused run correlation id stable while the new request logs its own enqueue event', function (): void {
+    $version = telemetryPluginVersion();
+    $service = app(IngestionService::class);
+
+    $firstRun = $service->start($version, 'manual', correlationId: 'first-caller-id');
+    $secondRun = $service->start($version, 'manual', correlationId: 'second-caller-id');
+
+    expect($secondRun->id)->toBe($firstRun->id)
+        ->and($secondRun->correlation_id)->toBe('first-caller-id');
+
+    $enqueued = telemetryEventsNamed('ingestion.enqueued');
+
+    expect($enqueued)->toHaveCount(2)
+        ->and($enqueued[0]['context']['correlation_id'])->toBe('first-caller-id')
+        ->and($enqueued[0]['context']['reused'])->toBeFalse()
+        ->and($enqueued[1]['context']['correlation_id'])->toBe('second-caller-id')
+        ->and($enqueued[1]['context']['reused'])->toBeTrue()
+        ->and($enqueued[1]['context']['ingestion_run_id'])->toBe($firstRun->id);
+});
+
+it('gives every scheduled plugin sync run its own correlation id', function (): void {
+    telemetryPluginVersion();
+
+    $secondCommunity = Community::factory()->create();
+    $secondPlugin = Plugin::factory()->create([
+        'community_id' => $secondCommunity->id,
+        'name' => 'Telemetry Plugin Two',
+        'slug' => 'telemetry-plugin-two',
+        'repository_url' => 'commandsphere/telemetry-plugin-two',
+        'documentation_path' => 'docs',
+        'default_branch' => 'main',
+    ]);
+    PluginVersion::factory()->latest()->create([
+        'plugin_id' => $secondPlugin->id,
+        'version' => '1.0.0',
+        'git_ref' => 'main',
+    ]);
+
+    app()->bind(GitHubClient::class, fn () => new class implements GitHubClient
+    {
+        public function markdownFiles(Plugin $plugin, ?string $branch = null): array
+        {
+            return [telemetryMarkdownFile()];
+        }
+    });
+
+    Artisan::call('commandsphere:sync-scheduled');
+
+    $runs = IngestionRun::query()->orderBy('id')->get();
+
+    expect($runs)->toHaveCount(2)
+        ->and($runs[0]->correlation_id)->not->toBeNull()
+        ->and($runs[1]->correlation_id)->not->toBeNull()
+        ->and($runs[0]->correlation_id)->not->toBe($runs[1]->correlation_id);
+});
diff --git a/backend/tests/Unit/CorrelationIdTest.php b/backend/tests/Unit/CorrelationIdTest.php
new file mode 100644
index 0000000..624011d
--- /dev/null
+++ b/backend/tests/Unit/CorrelationIdTest.php
@@ -0,0 +1,45 @@
+<?php
+
+use App\Support\CorrelationId;
+use Illuminate\Http\Request;
+
+it('generates a non-empty, format-valid correlation id', function (): void {
+    $id = CorrelationId::generate();
+
+    expect($id)->not->toBeEmpty()
+        ->and(CorrelationId::isValid($id))->toBeTrue();
+});
+
+it('accepts safe, bounded correlation id formats', function (): void {
+    expect(CorrelationId::isValid('abc-123_ok.value:1'))->toBeTrue()
+        ->and(CorrelationId::isValid(str_repeat('a', 128)))->toBeTrue();
+});
+
+it('rejects null, empty, oversized, and unsafe correlation id values', function (): void {
+    expect(CorrelationId::isValid(null))->toBeFalse()
+        ->and(CorrelationId::isValid(''))->toBeFalse()
+        ->and(CorrelationId::isValid(str_repeat('a', 129)))->toBeFalse()
+        ->and(CorrelationId::isValid("abc\r\nX-Injected: 1"))->toBeFalse()
+        ->and(CorrelationId::isValid("line1\nline2"))->toBeFalse()
+        ->and(CorrelationId::isValid('has space'))->toBeFalse()
+        ->and(CorrelationId::isValid('<script>'))->toBeFalse();
+});
+
+it('rejects a value with a trailing newline terminator instead of matching PCRE $ before it', function (): void {
+    // PCRE's "$" matches before a trailing newline unless the "D" modifier
+    // is set. Regression coverage for that specific gap: an otherwise-safe
+    // ID with a trailing \n, \r, or \r\n must never validate as safe.
+    expect(CorrelationId::isValid("injected-id\n"))->toBeFalse()
+        ->and(CorrelationId::isValid("injected-id\r"))->toBeFalse()
+        ->and(CorrelationId::isValid("injected-id\r\n"))->toBeFalse();
+});
+
+it('reuses a valid request-supplied id and falls back to a generated one otherwise', function (): void {
+    $withValidHeader = Request::create('/api/v1/webhooks/github', 'POST');
+    $withValidHeader->attributes->set(CorrelationId::REQUEST_ATTRIBUTE, 'client-supplied-id');
+
+    $withoutAttribute = Request::create('/api/v1/webhooks/github', 'POST');
+
+    expect(CorrelationId::fromRequest($withValidHeader))->toBe('client-supplied-id')
+        ->and(CorrelationId::fromRequest($withoutAttribute))->not->toBeEmpty();
+});
diff --git a/brain/audits/2026-06-13-system-audit.md b/brain/audits/2026-06-13-system-audit.md
index 3af2fef..b63cfef 100644
--- a/brain/audits/2026-06-13-system-audit.md
+++ b/brain/audits/2026-06-13-system-audit.md
@@ -296,6 +296,8 @@ Fix alongside production deployment runbook.
 
 Severity: Medium
 
+Status: Partially mitigated in `feature/ingestion-telemetry-correlation` (ADR-29). Request -> run -> job -> run log -> structured events are correlated by one ID; the GitHub call, Meilisearch indexing, `CommandIndexUpdated`, `plugin.created`, index-updated events, and duration/latency metrics are not yet covered.
+
 Evidence:
 
 - Ingestion logs are persisted as JSON arrays in `IngestionRun.log`.
diff --git a/brain/canonico/CURRENT_STATE.md b/brain/canonico/CURRENT_STATE.md
index f4dec55..e22221e 100644
--- a/brain/canonico/CURRENT_STATE.md
+++ b/brain/canonico/CURRENT_STATE.md
@@ -198,3 +198,16 @@ Latest sanitization hardening phase:
 - A `Document` accessor sanitizes `content_html` on every read, so rows stored before the fix are served sanitized without any data migration.
 - Angular `MarkdownRendererService` is untouched and remains defense in depth.
 - Gates: Pest `VALIDATED` (55 passed), Pint `VALIDATED` (118 files). `composer audit` reports 22 pre-existing advisories in 4 packages, and Jest has 2 pre-existing failures in `runtime-config.spec.ts`; both sets are identical to the `a3a8299` baseline and unrelated to this change.
+
+Active telemetry remediation branch: `feature/ingestion-telemetry-correlation`.
+
+Latest observability phase:
+
+- F-011 correlation IDs and structured events, partially (see ADR-29).
+- `AssignCorrelationId` runs in prepend on the `api` stack: a client `X-Request-Id` is accepted only if it matches `^[A-Za-z0-9._:-]{1,128}$` with the PCRE `D` modifier, otherwise a UUID is generated; the ID is returned in the response header.
+- `ingestion_runs.correlation_id` (nullable, indexed, additive) is written when the run is created; the job reloads the run and reads it. Runs created before the migration keep `null` and stay readable.
+- A run reused by `IngestionService::start()` keeps its creator's ID; the reusing caller's ID appears only in its `ingestion.enqueued` event with `reused: true`.
+- Every `IngestionRun.log` entry carries a `correlation_id` field; no entry is added.
+- Additive `telemetry` channel (Monolog `JsonFormatter`, `storage/logs/telemetry.log`) emits `ingestion.enqueued`, `ingestion.started`, `ingestion.completed`, `ingestion.failed`, `webhook.github.accepted`, and `webhook.github.rejected` through `App\Support\Telemetry::event()`. The default channel is unchanged.
+- Not yet correlated: the GitHub call, Meilisearch indexing, and `CommandIndexUpdated`; `IngestionRunStatusChanged` carries the ID only inside `log` entries. `telemetry.log` has no rotation.
+- Gates: locally on base `25bbb3c`, Pest `VALIDATED` (64 passed) and Pint `VALIDATED` (128 files), with independent audit approved. Combined suite after merging `29a7881`, `VALIDATED` by pull request CI on `3e7b3a1`: 86 tests, 0 failed, 0 skipped. In CI every Feature test reports a warning (`60 warnings, 26 passed`); the same pattern exists on `main` since at least `25bbb3c`, does not occur locally, and its cause is not yet identified.
diff --git a/brain/canonico/DECISIONS.md b/brain/canonico/DECISIONS.md
index 74ee381..ceef071 100644
--- a/brain/canonico/DECISIONS.md
+++ b/brain/canonico/DECISIONS.md
@@ -74,3 +74,15 @@ Consequences:
 - Transient categories are matched by range (`>= 500`), not by an enumerated list, so unseen statuses stay covered.
 - Failure messages carry identifiers and status only. Tokens, authorization headers, and response bodies never reach a log or an exception message.
 - Failing closed raises the cost of a transient outage. Retry belongs to the operator-facing surface, deliberately scoped, never smuggled into the client as silent recovery.
+
+## BRAIN-008 - Correlation IDs Are Validated At The Edge And Owned By The Record That Created Them
+
+Decision: Every API request carries a correlation ID. A client-supplied `X-Request-Id` is accepted only when it matches a fully anchored allowlist pattern; anything else is discarded and replaced by a generated ID, never sanitized in place. An operation record stores the ID of the request that created it, and structured events go to the additive `telemetry` channel, never to the default channel. See ADR-29.
+
+Consequences:
+
+- Anchoring uses the PCRE `D` modifier or `\z`. A bare `$` matches before a trailing newline, so a pattern without `D` accepts `"id\n"` and echoes it raw into response headers and persisted columns. Tests for a validation pattern cover trailing `\n`, `\r`, and `\r\n`, not only embedded line breaks.
+- A reused operation record is never rewritten with a later caller's ID. The later caller's ID appears only in its own event, which references the reused record.
+- The correlation ID is added as a field on existing log entries, not as a new entry, because tests assert log entries by index.
+- Telemetry context carries identifiers, counts, statuses, and failure codes only. Request payloads, headers, signatures, tokens, and Markdown content never reach it.
+- Failure codes in events are read from the `code` key already persisted by BRAIN-007, never recomputed.
diff --git a/brain/canonico/NEXT_ACTIONS.md b/brain/canonico/NEXT_ACTIONS.md
index 4970b2f..6396997 100644
--- a/brain/canonico/NEXT_ACTIONS.md
+++ b/brain/canonico/NEXT_ACTIONS.md
@@ -120,7 +120,7 @@ Risks:
 
 Problem: Analytics period is unbounded and system telemetry is mostly implicit in `IngestionRun.log`.
 
-Status: Analytics period bounds implemented in branch `fix/analytics-bounds`. Broader structured telemetry/correlation IDs remain a future observability phase.
+Status: Analytics period bounds implemented in branch `fix/analytics-bounds`. Correlation IDs and structured ingestion/webhook events implemented in branch `feature/ingestion-telemetry-correlation` (ADR-29). Remaining: propagate the ID to the GitHub call, Meilisearch indexing, and `CommandIndexUpdated`; add the other taxonomy events and duration/latency metrics; define retention for `storage/logs/telemetry.log`.
 
 Recommended direction:
 
@@ -131,7 +131,7 @@ Recommended direction:
 Acceptance criteria:
 
 - Analytics rejects invalid periods and caps expensive windows. `VALIDATED` by `DiscoveryApiTest`.
-- Logs/events include correlation IDs and relevant domain IDs.
+- Logs/events include correlation IDs and relevant domain IDs. `VALIDATED` for request -> run -> job -> run log -> telemetry events by `IngestionTelemetryTest`, `CorrelationIdTest`, and an independent audit.
 - Ingestion run detail can be debugged without server-log archaeology.
 
 Risks:
diff --git a/brain/handoffs/2026-09-20-ingestion-telemetry-correlation.md b/brain/handoffs/2026-09-20-ingestion-telemetry-correlation.md
new file mode 100644
index 0000000..338dfde
--- /dev/null
+++ b/brain/handoffs/2026-09-20-ingestion-telemetry-correlation.md
@@ -0,0 +1,42 @@
+# Handoff - Ingestion Telemetry Correlation
+
+Date: 2026-09-20
+Branch: `feature/ingestion-telemetry-correlation`
+
+## Scope
+
+Audited remediation item C5: F-011, correlation IDs and structured events for the ingestion flow. Depends on the ADR-27 failure-code taxonomy, which `ingestion.failed` consumes through the existing `code` key.
+
+## Implemented
+
+- `App\Support\CorrelationId` validates and generates IDs; `App\Http\Middleware\AssignCorrelationId` applies it to every API request and echoes the ID in the `X-Request-Id` response header.
+- Additive migration `2026_09_20_000001_add_correlation_id_to_ingestion_runs_table.php`: nullable, indexed `correlation_id`.
+- `IngestionService::start()` accepts an optional correlation ID and generates one when absent. `PluginSyncController`, `GitHubWebhookController`, and `SyncScheduledPlugins` pass theirs; scheduled sync generates one per run.
+- Every `IngestionRun.log` entry carries `correlation_id` as a field.
+- `App\Support\Telemetry::event()` writes JSON events to the additive `telemetry` channel. Events and fields are listed in ADR-29.
+- Tests: `backend/tests/Unit/CorrelationIdTest.php`, `backend/tests/Feature/IngestionTelemetryTest.php`.
+
+## Not changed
+
+The default log channel, the webhook HMAC check, `IngestionService::fail()` signature, the `IngestionRun.log` entry keys other than the added field, the `wasRecentlyCreated`/`partial`/`failed` semantics, and every pre-existing test expectation.
+
+## Validation
+
+- First independent audit: REJECTED on hostile input. The validation pattern used a bare `$`, so a `X-Request-Id` ending in `\n` was echoed raw in the response header and persisted in the run column. Fixed in `a388496` with the PCRE `D` modifier plus regression cases for trailing `\n`, `\r`, and `\r\n`.
+- Second independent audit: APPROVED. The auditor rebuilt the image, matched file hashes inside and outside the container, and re-ran every roadmap item with its own probe: end-to-end propagation for webhook, manual, and scheduled sync; seven hostile `X-Request-Id` values replaced by UUIDs; `ingestion.failed` with `github_transient_error` on a forced 500; valid JSON for all six events; no token, `Authorization`, `Bearer`, signature, secret, or Markdown canary in `telemetry.log`, `laravel.log`, or run logs; pre-migration runs returning 200 with `correlation_id: null`.
+- Gates on base `25bbb3c`: Pest 64 passed, Pint 128 files, no `skip`.
+- Combined suite after merging `origin/main` at `29a7881` (server-side sanitization): not run locally because Docker Desktop stopped responding; the merge had no conflicts and touched no C5 file. Pull request CI on `3e7b3a1` passed all 4 checks: Pest 86 tests, 0 failed, 0 skipped, 400 assertions.
+
+## Environment traps
+
+- The `backend` service has no bind mount. Rebuild with `docker compose up -d --build backend` and compare file hashes before trusting any gate.
+- Several worktrees run their own Compose projects on this machine. Port `8000` can already be allocated by another worktree's stack; gates can run in an unpublished container with `docker compose run --rm --no-deps backend ...` against this project's own dependencies. Another session's containers are never stopped to free the port.
+- `origin/main` advanced twice while C5 was in progress. Compare diffs against `git merge-base origin/main HEAD`, not against `origin/main`, or work merged by other branches shows up as false deletions.
+
+## Open
+
+- Propagate the correlation ID to the GitHub call, Meilisearch indexing, and `CommandIndexUpdated`.
+- Remaining taxonomy events (`plugin.created`, `search.executed`, `realtime.broadcast.failed`, and others) and duration/latency metrics.
+- Retention and rotation for `storage/logs/telemetry.log`, which currently uses a plain `StreamHandler`.
+- `composer audit` was not part of this item's verification.
+- In CI, every Feature test reports a Pest warning while Unit tests pass cleanly (`60 warnings, 26 passed` on this branch; `51 warnings, 21 passed` on `main` at `29a7881`; `49 warnings, 1 passed` at `25bbb3c`). Local runs show no warnings. The checks stay green, but the cause is not identified and the warning hides any new one.
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
index e671e1b..83ed257 100644
--- a/docs/DECISIONS.md
+++ b/docs/DECISIONS.md
@@ -340,3 +340,19 @@ Sanitizar no backend em duas camadas, com um allowlist próprio de tags e atribu
 
 ### Consequências
 Documentos antigos ficam cobertos sem migração nem reprocessamento: a coluna armazenada permanece como está e a sanitização acontece na saída, o que satisfaz a lei DATA sem escrita em dado existente. A proteção não depende do filtro interno do `league/commonmark`, o que neutraliza a classe de bypass por bytes de controle do `CVE-2026-71478` (versão instalada 2.8.2) independentemente da atualização daquele pacote — complementar ao ADR-26, que trata a política de advisories por override de dependência. O custo é sanitizar a cada leitura; a operação é idempotente e o resultado de discovery já é cacheado por `DiscoveryCache`. Entradas cacheadas antes do deploy continuam cruas até expirar (300s), então o deploy desta mudança exige invalidar o cache de discovery.
+
+## ADR-29 — Correlation ID e telemetria estruturada no fluxo de ingestão
+
+### Contexto
+Não havia como seguir um incidente de ponta a ponta — request do webhook, run de ingestão, job na fila, falha do GitHub. Não existia nenhuma chamada a `Log::` em `backend/app/`, o canal padrão era `stack` → `single` em texto livre, e as entradas de `IngestionRun.log` não carregavam identificador de correlação (F-011).
+
+### Decisão
+- O middleware `AssignCorrelationId`, em prepend na stack `api`, aceita o `X-Request-Id` recebido apenas se casar `^[A-Za-z0-9._:-]{1,128}$` com o modificador `D`; caso contrário gera um UUID. O ID é devolvido no cabeçalho da resposta. Sem o `D`, o `$` do PCRE casa antes de um newline final e o valor cru seria ecoado no cabeçalho e persistido — o modificador é obrigatório e está coberto por teste de regressão para `\n`, `\r` e `\r\n` finais.
+- A coluna aditiva `ingestion_runs.correlation_id`, nullable e indexada, é gravada na criação do run. O job não carrega o ID: recarrega o run pelo `ingestionRunId` e lê a coluna.
+- Um run reaproveitado por `IngestionService::start()` mantém o ID de quem o criou. A chamada que o reaproveitou registra o próprio ID apenas no evento `ingestion.enqueued`, com `reused: true`. Histórico de run não é reescrito.
+- Cada entrada de `IngestionRun.log` ganha o campo `correlation_id`. Nenhuma entrada nova é acrescentada, o que preserva asserções existentes por índice.
+- Um canal `telemetry` aditivo (Monolog com `JsonFormatter`, arquivo `storage/logs/telemetry.log`) recebe os eventos por `App\Support\Telemetry::event()`: `ingestion.enqueued`, `ingestion.started`, `ingestion.completed`, `ingestion.failed`, `webhook.github.accepted` e `webhook.github.rejected`. O canal `default` não muda. `ingestion.failed` lê o código da chave `code` já persistida, sem recomputar nem criar vocabulário paralelo (ADR-27, BRAIN-007).
+- O sync agendado gera um ID por run, não compartilhado no lote.
+
+### Consequências
+Um incidente pode ser seguido por um único ID da requisição ao run, ao job, a cada entrada do log do run e aos eventos estruturados, sem dependência nova nem infraestrutura externa. Runs anteriores à migration ficam com `correlation_id` nulo e continuam legíveis na API e no admin. O contexto de telemetria é montado apenas com identificadores, contagens, status e códigos: token, cabeçalho `Authorization`, assinatura do webhook, segredo e conteúdo Markdown não entram no log. Limites atuais: a chamada ao GitHub, a indexação no Meilisearch e o evento `CommandIndexUpdated` não carregam o ID, e o broadcast `IngestionRunStatusChanged` o leva apenas indiretamente, dentro das entradas de `log`. Os demais eventos da taxonomia da auditoria (`plugin.created`, `search.executed`, `realtime.broadcast.failed` e outros) e as métricas de duração e latência ficam fora. O `telemetry.log` usa `StreamHandler` sem rotação e cresce sem limite até que uma política de retenção seja definida.