structural-investigating

Pin controlled inputs and measure an actual failure rate instead of chasing a deterministic repro. Form one falsifiable hypothesis, bisect the search space with targeted probes, and treat silence after a fix as no proof of resolution.

Name one question, set a time box, and decide upfront what happens if the box expires. End with a diagnosis plus a failing test or decision record, and throw spike code away unless you are ready to harden and own it.

An investigation should produce a diagnosis, a red test or spike finding, a list of ruled-out causes, and follow-up actions. Recording what was ruled out prevents the next person from rerunning the same dig.

Cash in existing observability such as traces, logs, and commit or config diffs before adding new probes. If you add debug logging, scope it narrowly and remove it afterward rather than leaving broad instrumentation in place.

Common failure modes include starting without a named question or clock, changing multiple layers at once, and trusting wall-clock ordering or narratives over artifacts. Use causal ids, traces, and diffs as evidence instead.