Begin (or reuse) a bounded production investigation.

Returns a compact, source-linked evidence capsule. If a matching investigation
already exists it is REUSED (no re-query) and flagged; if a related-but-not-
identical one exists, candidates are returned for you to choose — never merged
silently. `symptom_signature` is the error signature, e.g. "HTTP_502:checkout".

Find existing capsules matching a service/environment/symptom/time window. Returns candidates and the reason for the match. Never merges automatically.

Fetch a capsule: situation, typed claims (facts / comparisons / correlations / hypotheses / known-unknowns / action-candidates), evidence references, freshness, and consumers. Respects the capsule's redaction policy.

Return only what CHANGED since the latest capsule version (a delta), not a reprint. Re-queries the backend for the minimum needed and creates a new version.

Show the supporting and contradicting source evidence for one claim, with the exact query fingerprint, source time range, and deep link. Use to challenge an answer.

Retrieve the bounded raw evidence behind a reference (redacted, field-limited). This is the explicit cost path; the response reports estimated source bytes examined.

Structured difference between two capsule versions. Does not infer causality.

Estimated avoided work: capsule reuse, duplicate source queries avoided, source bytes vs response bytes (context compression), and a labelled token-savings estimate.