Stage S2 — Investigation

P Stage correspondence. S2 Investigation. These are the same stage identities used by the product overview and case walkthrough. A checkpoint or nested task conversation stays inside its owning stage.

Purpose

P The stage is entered from S3, not before it (Support Root § 1, D83): a case reaches investigation because the take found no ready solution — no skill covers the operation and memory does not answer it. What it then works is the databases, stored code, or both.

A request says what the customer sees. Investigation establishes what the system does — the mechanism, named at its layer, supported by evidence that survives someone else re-deriving it. This is the stage where v1's quality actually lives, and also where v1's worst failures happened: three full retraction cycles (SD-1627, SD-1636, SD-1651), each from pattern-matching a past ticket into a confident root cause without verifying the mechanism (Baseline § 5).

The stage's job is therefore not "find an explanation". It is produce a mechanism that an isolated validator, given the evidence and none of the reasoning, arrives at independently.

Inputs → Outputs

In: the classified case — symptom, systems, environment, contract classification, and whatever the experience index surfaced at S1. Out: the mechanism (one sentence, layer named), the evidence supporting it, what was ruled out and how, and the open items that remain — feeding the solution take.

What runs this stage

P Root owns questions and authority. Investigation has no effect applier. It prepares an evidence-led mechanism or an explicit missing-evidence request; later approved actions use their own execution path.

P Investigators read through connectors (oracle-ipal read, oracle-insis read, kibana) and diagnostic skills; they hold no effect applier.

Fresh investigation when experience does not fit

P Empty search, stale evidence and a contradicted match all enter the same fresh-investigation mode. A known symptom domain uses its existing investigator. An unknown domain starts with support.investigator, which uses the shared investigation skeleton, owns no new memory domain and does not default to transfers. It establishes expected versus observed behaviour, identifiers/timestamps and lifecycle, then traces current request/log/source/data evidence and compares a valid same-state peer.

P A matched mechanism must survive a separating check. Otherwise retain the uncertainty and ask root for the missing source, permission or owner-operated observation. A manual investigation means assembling and interpreting that evidence from scratch; it does not grant manual database writes. Once a domain is identified, the parent passes the original brief, evidence, attempted checks, rejected hypotheses and open questions into the selected specialist task. No reset to a ticket-title summary.

See the full recurring-operation inventory for concrete triggers, evidence, methods and automation candidates. Operation variants generally reuse a profile; a new permanent agent requires a distinct responsibility or isolation boundary.

1. The methodologies are mechanics, not advice

Why: v1's disciplines exist as memory files that must happen to fire, and the audit of 20.05.2026 measured them failing at author time — four families recurring after their rule already existed F: [write-time discipline]. The fix is not a better-written rule. It is making the discipline a phase the pipeline runs, whose output is a required field.

P Each mechanic is a phase with a required output. A phase that produced nothing is recorded as ran, found nothing — which is evidence — and never as skipped, which is a gap. The v1 failure mode was checklists that halted silently mid-walk F: [audit].

2. Domain investigators

P Investigators are profiled by symptom, not by system (decision 01.09.2026) — transfers and sync, pricing, printing, access, health, master data — each booting from its own memory domain (Agents). The reason is that a customer reports a symptom and never a system; shaping the agents the other way would make every case start with a routing argument.

P System knowledge is therefore not duplicated across investigators: it lives in the connectors/* and configuration/* domains, which every investigator reads but none owns. P The lead is two-phase (Challenge Rounds § R2 § 6): a provisional lead at S1 by supported symptom vocabulary, recorded as symptom_domain on the route packet — the field that selects the S2 profile variant of the Data manifest; unresolved domains carry unknown and use the general investigator, never an arbitrary default. For a known domain the existing precedence applies (transfers → printing → pricing → access → master data → health — a configuration value), so no case starts with a routing argument; then a hypothesis checkpoint after mechanics 0–2 or at 20 % of the investigation budget, where the lead emits mechanism_hypothesis {layer, system, domain, confidence} as a required output — if the domain differs, the root reassigns the lead once (plan revision, reason hypothesis_reassignment), the first investigator becomes a consult; a second disagreement is a DeadEnd → H6, never ping-pong. P Measured on the first ten cross-system cases: reassignments ≤ 2/10 keep the precedence, 3–5 rewrite it from the observed final leads, > 5 drop the provisional lead for a triage hypothesis; spend before reassignment < 15 % of the case. An investigator consults another domain's agent laterally on mechanism questions; a lateral consult is evidence, never authority (Architecture § 2).

F Standing rule on the edges: a sub-agent's convenient "missing" or "inaccessible" that contradicts established evidence is re-asked with the how, not believed (the PC 9951 run).

3. The isolated validator

P Before any mechanism is published — to the customer, to a Jira comment, or into memory — the validator re-derives it. The validator's profile denies it the author's transcript and identity; evidence provenance is retained; it receives the evidence and the symptom, and produces its own mechanism (Agents § 0.2).

• Agreement → the mechanism stands, and the agreement is recorded.
• Disagreement → the case returns to investigation. It does not go to the human as "the agents disagree"; it goes back as what evidence would separate these two mechanisms.

Why: this is the direct countermeasure to the three retraction cycles. Author and validator being the same context is the proven failure mode (Baseline § 7).

P The validator is tiered (SG-10; Case Studies G-3). Mandatory before a mechanism reaches the customer or memory, and for the first three cases of a new shape; sampled (one in N for skill runs and memory answers on known shapes; N is a platform-policy value, default 5, tuned from the ledger — Whitelabel Catalogue), where a full re-derivation would double a thirty-minute ticket. The sampling decision is a ledger record, so the validator's coverage is a metric.

4. When to stop

P Investigation ends in one of three states, all legitimate:

1. Mechanism found — verified, layer named → solution take.
2. Mechanism not found, containment known — the symptom's trigger and a workaround are established. Under the contract a workaround downgrades severity (§ 1.5.3) F: [contract]; the case continues at the lower severity.
3. Dead end — gate H6. What was checked, what it cost, and what would be needed to go further.

P The report names the level reached and never implies a higher one (Architecture CR-3). "Likely" and "verified" are different words with different consequences.

Facts to hold F

• Flashback has limits; historical reconstruction has a horizon, and beyond it the answer is unknown, not inferred (DB investigation discipline).
• A second identical manual fix means a configuration gap: escalate, do not repair a third time (rule).
• XX_, Z_, ZZ_ tables are operator scratch, not system data — never evidence.
• Environment defaults: PROD unless stated; QA for feature-gated work; TEST only when explicit.

Challenges

• P The catalogue is larger than the nine mechanics above — 166 v1 feedback files (memory/feedback/*.md, counted 07.09.2026). Triaging which become mechanics, which become domain articles and which are dropped is Agents Memory wave 3.
• P Time and token budget of the isolated validator per case (Metrics § Spend envelope) — initial estimations recorded there (D68); measured and re-analysed after the first ten cases.