The investigation instructions previously separated analysis and field work without explaining how passed recovery evidence completes an incident. Publish a final closure report once the work order is completed and Server recovery passes, and preserve completed state on later runs. Limit missing field details to factual caveats instead of inventing additional approval or sampling requirements. Update the investigation prompt version and descriptor.