investigate

Reproduce the failure deterministically, localize the smallest failing layer, then form hypotheses and run tests that separate them. Confirm the root cause only by directly observing the bad value, branch, or state on the failing path, not by reading code and guessing.

Document exactly when the failure appears, since deterministic reproduction may not be possible. Hold two to three competing hypotheses such as race conditions or state pollution, and name the fastest test that distinguishes them. If reproduction stays impossible, cap the report status at PROBABLE or INCONCLUSIVE.

CONFIRMED means the suspected condition was directly observed on the failing path or isolated by a targeted test. PROBABLE means strong static evidence exists but nothing was directly verified, such as with intermittent bugs or restricted environments.

Stop after three refuted hypotheses in a row, when more than five files are affected, when the bug cannot be reproduced, or when the root cause sits inside a third-party dependency. Document what was ruled out and mark the status INCONCLUSIVE or PROBABLE.

No. The workflow explicitly forbids source changes and only produces an investigation report with recommended actions. Any temporary instrumentation added during debugging must be removed before the report is saved and handed off.