The “please retry” example shows why error handling is part of product behavior, not just observability. I would test the boundary in both directions: the internal event retains the cause and correlation ID, while the public response avoids exposing account balances or identifiers the caller should not see. That makes the contract precise without turning “preserve the diagnostic” into “return every diagnostic field to every client.”