Triage a metric anomaly without jumping to a cause

Triage this metric anomaly.

Metric definition and observed change:
Signup-to-first-project activation fell from 42% last week to 34% this week. Activation means creating a project within seven days of signup; the newest cohort may not have completed its full observation window.
Available data and baseline history:
Daily counts of signups and activations for 12 weeks, with acquisition channel, device type, and signup cohort date. No raw event logs provided yet.
Known releases, campaigns, incidents, or calendar effects:
A mobile onboarding redesign shipped four days ago. A paid campaign began two days ago. Event ingestion usually lags by up to six hours.

Return a concise investigation brief:
1. Restate the anomaly with its numerator, denominator, units, time window, and comparison period. Mark missing details.
2. Check measurement explanations first: delayed ingestion, missing events, changed definitions, timezone boundaries, deduplication, and instrumentation changes. For each relevant check, state the evidence needed.
3. Describe a comparable baseline that accounts for volume, weekday or seasonal patterns, and population changes. Do not apply a universal deviation threshold or invent normal variability.
4. Propose the most informative segment cuts and a small set of competing explanations. For each, separate facts from hypotheses and identify a result that would support or weaken it.
5. Prioritize the next three analyses by the uncertainty they resolve and the data required. Include a proposed escalation or monitoring rule only if its threshold has a stated rationale.

If raw data is present, show transparent calculations and their limits. If only summary notes are supplied, produce a plan rather than invented results. Do not infer user psychology, fraud, or causality solely from a correlation. End with what is known, what remains unresolved, and the next observable result to collect.