diagnosing-bugs: support operational regression probes and distinguish workarounds from repairs

Problem

Phase 1 explicitly supports authenticated HTTP probes and browser workflows, but Phase 5 treats the absence of a source-code regression seam as an architectural finding in all cases. Configuration, deployment, and persisted-state defects can have a useful operational regression check without requiring a source-code fix.

A second completion ambiguity appears when changing a local dependency makes the original user workflow succeed: that verifies the local workaround, but does not establish that the original remote target was repaired.

Evidence

In a local-preview investigation, an authenticated HTTP replay isolated a failing service-to-service path. Reusing a correctly configured local dependency and reconciling approved local authorization state made the intended browser workflow usable. No application-source fix was needed. The original remote target remained unverified. The reproduction-first and ranked-hypothesis steps were useful; the proposed change preserves them.

Proposed wording

Scope the Phase 5 architectural-testability finding to application-code defects, and add:

For application-code defects, use the real failing seam as the regression test; document architectural testability gaps when they prevent that. For configuration, deployment or persisted-state defects, an authenticated operational probe may be the appropriate regression check: record its target, prerequisites and expected result without embedding credentials. Distinguish a repaired original target from a local workaround or changed dependency. Re-run the user's original workflow against the intended final topology and state which environments remain unverified.

In Phase 6, allow the applicable regression test or operational probe, and require precise repair/workaround reporting. A retained replay should explain how fresh authorized context is supplied; a script referencing a deleted credential capture is not a ready-to-run check.

Validation scenario

Given a valid browser token, a broken upstream caller credential and a working local replacement, the agent should report a verified local workaround, identify the original target as unverified, and retain a credential-free probe recipe. An actual application-code defect should still follow the existing failing-test-first path.

The proposal was checked against the current skills/engineering/diagnosing-bugs/SKILL.md (blob 1b929e29fb519c26b500d3eda744177986883ac8). If adopted, sync the human-facing docs per repository guidance. No downstream vendored fork is proposed.