What Public Incident Reports Can and Cannot Support: A Three-Lens Evidence Protocol for Shared-Infrastructure Fragility

Public incident reports are frequently used to reason about resilience, concentration, and systemic fragility, although they are produced for operational explanation, regulatory accountability, or public communication rather than for a common research instrument. This article develops a three-lens evidence protocol for reading such records without substituting impact magnitude, recovery speed, or common-cause failure for the constructs of interest. The protocol distinguishes evidence bearing on buffer provision and fallback independence, shared-substrate dependence, and cross-actor response alignment. It separates bibliographic identity, document access, passage-level entailment, and analytical coding, and preserves source silence as unknown rather than as evidence of absence. A transparent audit universe of sixteen candidate episodes yielded four core applications with inspectable operator or regulatory records: the 2017 Amazon S3 disruption, the 2021 Fastly outage, the 2021 Meta outage, and the 2018 TSB migration disruption. None contained direct support for all three lenses. AWS and Meta supplied direct evidence bearing on buffer and shared-dependency questions. Fastly and TSB supported narrower dependency or preparedness readings. All four sources were silent on cross-actor response alignment under a definition requiring comparable responses by independent actors to a shared rule, signal, model, or incentive. A proposed timing descriptor was also withdrawn after its candidate criterion proved operationally entangled with the intervention being ordered. The resulting claim ceiling is taxonomic readability, not recurrence, association, prediction, necessity, sufficiency, or causation. The contribution is a reproducible construct-boundary and evidence-admissibility protocol, a complete screening record, and an explicit specification of the data required for stronger inference.