diff --git a/diagnose/SKILL.md b/diagnose/SKILL.md
index 5d1f8b2b5..9b81a5314 100644
--- a/diagnose/SKILL.md
+++ b/diagnose/SKILL.md
@@ -1633,6 +1633,10 @@ OPEN QUESTIONS
  is more useful than a false "complete" diagnosis.]
 
 STATUS: ROOT_CAUSE_ESTABLISHED | PROBABLE_CAUSE | INSUFFICIENT_EVIDENCE
+
+NEXT STEPS
+──────────
+[Suggest 1-3 gstack skills based on the diagnosis outcome. Pick from:]
 ════════════════════════════════════════════════════════════════════
 ```
 
@@ -1641,6 +1645,18 @@ STATUS: ROOT_CAUSE_ESTABLISHED | PROBABLE_CAUSE | INSUFFICIENT_EVIDENCE
 - **PROBABLE_CAUSE:** Confidence 6-8, strong evidence but gaps remain. Report clearly states what's uncertain.
 - **INSUFFICIENT_EVIDENCE:** Confidence <6, need more data. Report lists exactly what evidence is needed and how to obtain it.
 
+### Next step suggestions (pick based on outcome):
+
+After printing the report, suggest the most relevant next skill:
+
+- **ROOT_CAUSE_ESTABLISHED + fix is straightforward:** → `/investigate` to implement and test the fix
+- **ROOT_CAUSE_ESTABLISHED + fix is complex / risky / multi-system:** → Write a plan, then `/plan-eng-review` to lock in the architecture before implementing
+- **ROOT_CAUSE_ESTABLISHED + fix needs scope/strategy discussion:** → Write a plan, then `/plan-ceo-review` to decide scope (is this a quick patch or a redesign?)
+- **PROBABLE_CAUSE:** → Suggest what additional data/access would upgrade to ROOT_CAUSE. If browse is available and issue is UI-visible, suggest `/qa` to reproduce the exact flow.
+- **INSUFFICIENT_EVIDENCE:** → Suggest `/investigate` with specific instructions on what to look for, or suggest instrumenting the code (add logging) and waiting for recurrence.
+- **Security implications found:** → `/cso` for a security audit of the affected area
+- **Multiple systems affected:** → `/review` when the fix PR is ready, to catch cross-system issues
+
 ---
 
 ## Capture Learnings
diff --git a/diagnose/SKILL.md.tmpl b/diagnose/SKILL.md.tmpl
index c65d46b12..aa71595ea 100644
--- a/diagnose/SKILL.md.tmpl
+++ b/diagnose/SKILL.md.tmpl
@@ -1049,6 +1049,10 @@ OPEN QUESTIONS
  is more useful than a false "complete" diagnosis.]
 
 STATUS: ROOT_CAUSE_ESTABLISHED | PROBABLE_CAUSE | INSUFFICIENT_EVIDENCE
+
+NEXT STEPS
+──────────
+[Suggest 1-3 gstack skills based on the diagnosis outcome. Pick from:]
 ════════════════════════════════════════════════════════════════════
 ```
 
@@ -1057,6 +1061,18 @@ STATUS: ROOT_CAUSE_ESTABLISHED | PROBABLE_CAUSE | INSUFFICIENT_EVIDENCE
 - **PROBABLE_CAUSE:** Confidence 6-8, strong evidence but gaps remain. Report clearly states what's uncertain.
 - **INSUFFICIENT_EVIDENCE:** Confidence <6, need more data. Report lists exactly what evidence is needed and how to obtain it.
 
+### Next step suggestions (pick based on outcome):
+
+After printing the report, suggest the most relevant next skill:
+
+- **ROOT_CAUSE_ESTABLISHED + fix is straightforward:** → `/investigate` to implement and test the fix
+- **ROOT_CAUSE_ESTABLISHED + fix is complex / risky / multi-system:** → Write a plan, then `/plan-eng-review` to lock in the architecture before implementing
+- **ROOT_CAUSE_ESTABLISHED + fix needs scope/strategy discussion:** → Write a plan, then `/plan-ceo-review` to decide scope (is this a quick patch or a redesign?)
+- **PROBABLE_CAUSE:** → Suggest what additional data/access would upgrade to ROOT_CAUSE. If browse is available and issue is UI-visible, suggest `/qa` to reproduce the exact flow.
+- **INSUFFICIENT_EVIDENCE:** → Suggest `/investigate` with specific instructions on what to look for, or suggest instrumenting the code (add logging) and waiting for recurrence.
+- **Security implications found:** → `/cso` for a security audit of the affected area
+- **Multiple systems affected:** → `/review` when the fix PR is ready, to catch cross-system issues
+
 ---
 
 {{LEARNINGS_LOG}}