Which step is most useful in an executable agent plan for an expired-session bug?

Which step is most useful in an executable agent plan for an expired-session bug?

1. Add a regression case in test/session.test.js and checkpoint the expected pre-fix status 200
2. Analyze the authentication system thoroughly
3. Make all necessary improvements and ensure quality
4. Keep editing until the agent believes the issue is solved