From a procedural perspective GM is right that the datix is the event that triggered the investigation: someone (DU) reported a problem that occurred and that needed addressing.
I think there's an additional significance to the datix being what triggered the investigation.
Because (I think from following TT) the datix only contained detailed information about the CR incident. Nothing to do with patient safety concerns. Apart from possibly a reference to "escalating behaviour"?
Throughout the whole tribunal, there's been obfuscation about whether the suspension etc was due to patient safety concerns or the CR confrontation.
But no one bothered to datix any patient safety concerns, or even mention them for months after the incident (the Snickers bar child at Halloween). When, if something actually bad happened it would preferably have been datixed before the end of the shift. And dealt with then, because it would have been a big deal.
So the investigation was started because of the CR incident. Anything else was added on later.