Domain and username investigations run different discovery pipelines. Both preserve evidence, expose uncertainty, and expand only from supported public connections.