docs: route vendored doctrine through the manifest

Emergency operator-authorized hotfix, sibling of crew 36c6745: engine and
sweep panel requests fail on the pre-rename -reviewer names. ceremony#232
records the debt and verifies. Authorized by @andres in-session.

.github/labels.conf

@@ -1,5 +1,5 @@
-panel=codex-reviewer-andresmgsl glm-reviewer-andresmgsl cluade-reviewer-andresmgsl kimi-reviewer-andresmgsl
-triage-actors=cluade-reviewer-andresmgsl
+panel=codex-bot-andresmgsl glm-bot-andresmgsl cluade-bot-andresmgsl kimi-bot-andresmgsl
+triage-actors=cluade-bot-andresmgsl
 scope:release-flow|C5DEF5|The reusable release workflow, decide, the doors
 scope:guards|C5DEF5|changelog-armed / changelog-monotonic / drill-recorded
 scope:labels|C5DEF5|The labels workflow, reconciler, the taxonomy

CONTRIBUTING.md

@@ -48,10 +48,10 @@ the box is the blast-radius boundary; roles are what a session is told, and
 
 | identity | box (rig tenant) | standing work |
 |---|---|---|
-| `cluade-reviewer-andresmgsl` | `triage` (claude-box) | **triage** — the only door issues come through; this identity mints issues and nothing else writes them (#18's `triage-actors`) — and review. It does not build. |
-| `codex-reviewer-andresmgsl` | codex-box | build + review |
-| `glm-reviewer-andresmgsl` | glm-box | review |
-| `kimi-reviewer-andresmgsl` | kimi-box | review |
+| `cluade-bot-andresmgsl` | `triage` (claude-box) | **triage** — the only door issues come through; this identity mints issues and nothing else writes them (#18's `triage-actors`) — and review. It does not build. |
+| `codex-bot-andresmgsl` | codex-box | build + review |
+| `glm-bot-andresmgsl` | glm-box | review |
+| `kimi-bot-andresmgsl` | kimi-box | review |
 
 **The review panel for any PR is every bench identity except its author** —
 recusal by construction, enforced by the reconciler (#10): the required
@@ -97,14 +97,13 @@ table repeats it (#104).
 
 ## Doctrine conventions
 
-The vendored role files — `AGENTS.md`, `TRIAGE.md`, `BUILDER.md`,
-`REVIEWER.md`, `LABELS.md`, and `RELEASES.md` — state each normative rule
-completely, keep at most one sentence of why, and cite its record only with a
-bare parenthetical such as `(#N)`, `(#N D3)`, or `(#N, #M)`. Incident
-narrative — timestamps, actors, quoted comments, measured counts, and links to
-specific comments — belongs in that record. If a rule cannot be followed
-without chasing its cite, the rule is under-stated: fix the statement, not the
-citation. (#280)
+The vendored role files — the set [`docs/VENDORED.txt`](docs/VENDORED.txt)
+declares — state each normative rule completely, keep at most one sentence of
+why, and cite its record only with a bare parenthetical such as `(#N)`,
+`(#N D3)`, or `(#N, #M)`. Incident narrative — timestamps, actors, quoted
+comments, measured counts, and links to specific comments — belongs in that
+record. If a rule cannot be followed without chasing its cite, the rule is
+under-stated: fix the statement, not the citation. (#280)
 
 Normative text in those files does not cite issues from other repositories.
 Consumers read the vendored bytes outside this organization's context, and a
@@ -119,21 +118,12 @@ every session. (#280)
 
 ## How the other repos use this
 
-Two consumption modes, split by what has a runtime:
-
-- **Machinery is consumed by reference.** Workflows and actions are fetched
-  by GitHub at run time from the ref the caller pins — no copy exists in the
-  consumer.
-- **Doctrine is consumed as a machine-verified mirror.** A document's only
-  "runtime" is an agent reading the working tree of the repo it stands in —
-  a doc that requires a cross-repo fetch before it governs is a doc that
-  sometimes goes unread. So the agent-facing set — **AGENTS.md, TRIAGE.md,
-  BUILDER.md, REVIEWER.md, LABELS.md, RELEASES.md** — is vendored into each governed
-  repo at **`.ceremony/`**, byte-identical to this repo at the pinned ref,
-  by the sync tool (issue #19). A CI guard diffs the mirror against the pin
-  on every PR: hand-editing a vendored file, or bumping the pin without
-  re-syncing, goes red. It is a copy that cannot drift — which is the only
-  kind of copy this org allows.
+Two consumption modes, split by what has a runtime: **machinery by
+reference**, fetched at run time from the ref a caller pins, and **doctrine
+as a mirror** — the set [`docs/VENDORED.txt`](docs/VENDORED.txt) declares,
+vendored at `.ceremony/` and held to the pin by a guard (issue #19). The
+[README](README.md) states both modes in full, and why they differ; what
+follows is only what they leave a governed repo to carry.
 
 A governed repo (box, rig, cast, incubator, …) therefore carries:
 

VERSION

@@ -1 +1 @@
-0.6.1
+0.6.2-dev

changelog.d/217.md

@@ -0,0 +1,3 @@
+### Changed
+
+- `docs/RUNNER-PROBES.md` records the delivered 0.6.1 consumer exercise in the standing Forgejo runner venue (#217).

changelog.d/229.md

@@ -0,0 +1 @@
+- Forge consumers now receive the upstream 0.6.1 and 0.6.2 doctrine for vendored-set routing, review-round signalling, operator-owned remainders, producer liveness, and post-merge release edges (#229).

docs/RUNNER-PROBES.md

@@ -368,8 +368,25 @@ memory.
   caller's `event.inputs` on this instance. Records:
   [probe issues #4 and #5](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/4)
   (runs 6 and 7).
-- A 0.6.0 consumer exercise once ceremony#198 has merged. (#198 merged
-  2026-08-05; this probe remains open.)
+- **ceremony#217** — DELIVERED (2026-08-09). The standing venue used the
+  published consumer callers without rewrites or bypasses:
+  `labels.yml@0.6.1` and `labels-sweep.yml@0.6.1`. Opening fixture issue #7
+  drove event caller
+  [run 23](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/actions/runs/23)
+  and its dispatched sweep
+  [run 24](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/actions/runs/24);
+  the sweep wrote `needs-triage` on that issue under the workflow token. A
+  separate manual sweep was green in
+  [run 25](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/actions/runs/25).
+  Observer
+  [run 30](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/actions/runs/30)
+  recorded the released tag SHA `338cf5f754f0e87feefe9231b47910fb236ab4d0`,
+  both caller runs and the resulting label set in
+  [probe issue #10](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/10).
+  The event caller loaded its reusable workflow at `@0.6.1`; both sweep runs
+  completed the reusable workflow's internal `CEREMONY_SELF_REF` checkout at
+  the real `0.6.1` tag. There was no candidate SHA rewrite and no dogfood
+  bypass.
 
 Two venue lessons from the first drills, kept where the next probe author will
 look:

drills/0.6.1.md

@@ -0,0 +1,116 @@
+# 0.6.1 — drill record
+
+Run 2026-08-09 by `codex-reviewer-andresmgsl` against release PR !226,
+candidate branch `release-0.6.1`, canonical candidate SHA
+`ba3b17af88e0fe1ccae9eefd4b37bf2666f6cdad`. All six probes ran on this
+Forgejo instance. Each result below was read from its own run and from the
+repository state after that run.
+
+## Scope ruling — a full rehearsal was owed
+
+The last rehearsed tag was `0.6.0`. The release path at this candidate is the
+exact output of `.github/scripts/release-path.sh`. Its measured diff from
+`0.6.0` is not pin-only: `.github/workflows/release.yml`, `lib/facts.sh`, and
+the new `lib/forge.sh` changed. These are release-door bytes, so the
+doors-unchanged record shape is refused and this release carries a full live
+rehearsal.
+
+## Where
+
+Disposable **private** repository `heavy-duty/ceremony-drill-0.6.1`, created
+by the operator on 2026-08-09 after the fleet identity's personal repository
+could not see the organization runner. It carries the `docs/CONSUMERS.md`
+release caller with `version-source: file`, a fragment-mode fixture armed at
+`0.6.1-dev`, and a non-blank `drills/0.6.1.md`. The `release` label existed
+before the first probe PR.
+
+**Disposal as observed when this record was written:** the repository is
+private and **not yet archived**. This builder's archive PATCH returned 403
+because it has push but not admin permission. The operator was asked to
+archive it; delete remains the operator's later step. No archive or delete is
+claimed, and cleanup gates neither review nor merge.
+
+## Candidate-ref deviation
+
+The candidate tree pins `CEREMONY_SELF_REF` to `0.6.1`, a tag that did not
+exist before this release. No branch named `0.6.1` was created on
+`heavy-duty/ceremony`.
+
+The scratch caller instead uses
+`codex-reviewer-andresmgsl/ceremony/.github/workflows/release.yml@drill/0.6.1`.
+That ref is commit `f766752090429241c20a0d86aba6f679d713fc2c`; its parent is the canonical
+candidate SHA above, and its only change rewrites all three
+`CEREMONY_SELF_REF` carriers to that canonical SHA. The release path is
+therefore byte-identical to the candidate except for the required candidate
+pin rewrite.
+
+## Probes
+
+| # | probe | run | result |
+|---|---|---|---|
+| 1 | merge-door ceremony | 5 | ✅ one `0.6.1` release; tag points to merge commit `438097fc75b1d294b448830a3a79c00b0ee7b83f`; main re-armed to `0.6.2-dev` |
+| 2 | release-labelled ordinary PR | 2 | ✅ green no-op; zero tags and zero releases |
+| 3 | bare-version PR without `release` | 3 | ✅ refused; zero tags and zero releases |
+| 4 | completed ceremony repeated | 7 | ✅ refused; release count stayed one and tag `0.6.1` stayed on the original merge commit |
+| 5 | manual matching tag | 8 | ✅ `0.6.2` published from its own changelog section; main was unchanged |
+| 6 | mismatched tag | 9 | ✅ refused before publication; no `9.9.9` release, and the operator-created probe tag was removed afterwards |
+
+### Probe 1 — merge door
+
+PR #4 transitioned `VERSION` from `0.6.1-dev` to `0.6.1`, assembled both
+fixture fragments, and carried the `release` label. Run 5 succeeded. The
+published body is exactly the assembled `0.6.1` section, tag `0.6.1` points
+to PR #4's merge commit, and the workflow pushed `0.6.2-dev` to main at
+`1c74d76f035da4a13f7af0d2a43d611092061204`.
+
+### Probe 2 — labelled ordinary work
+
+PR #1 carried the `release` label and added only `changelog.d/2.md`.
+`VERSION` stayed `0.6.1-dev`. Run 2 succeeded as a no-op; the tag and release
+lists were both empty afterwards.
+
+### Probe 3 — bare version without declared intent
+
+PR #2 assembled the two fragments and transitioned to bare `0.6.1`, but had
+no `release` label. Run 3 failed. Both tag and release lists remained empty.
+Setup PR #3 then reverted that probe and restored the armed fixture; run 4
+was green before the ceremony probe began.
+
+### Probe 4 — completed ceremony repeated
+
+Forgejo exposes no run-rerun API, so this probe reproduced the completed
+door's input. Setup PR #5 restored `0.6.1-dev` and run 6 was green. Release-
+labelled PR #6 transitioned to bare `0.6.1` again. Run 7 failed at the
+already-existing tag guard. The release count stayed one and tag `0.6.1`
+still pointed to the original ceremony merge commit, not PR #6.
+
+### Probe 5 — matching manual tag
+
+Side branch `probe5-tag` carried bare `VERSION 0.6.2` and a publishable
+`0.6.2` changelog section. Tag `0.6.2` was created at
+`a4ba62aa83fdd2e259ed3c3e906b13eaab1abcd0`. Run 8 succeeded and published
+only that section. Main stayed at the state left by probe 4; the tag door did
+not push a version change to it.
+
+### Probe 6 — mismatched tag
+
+Tag `9.9.9` was created at the same `0.6.2` tree. Run 9 failed before
+publication. The release list remained exactly `0.6.1` and `0.6.2`. The
+operator-created `9.9.9` ref was then deleted; the remaining tag list was
+exactly `0.6.1` and `0.6.2`.
+
+## Runs that are setup, not probes
+
+- Run 1: the initial `0.6.1-dev` fixture push; green no-op.
+- Run 4: PR #3 restored the armed fixture after probe 3; green.
+- Run 6: PR #5 restored `0.6.1-dev` to reproduce the completed ceremony
+  input for probe 4; green.
+
+## What this rehearsal establishes
+
+Both release doors ran against the 0.6.1 candidate's Forgejo implementation.
+The merge door published once, tagged the reviewed merge commit, and re-armed
+main. It stayed a green no-op for labelled ordinary work, refused a bare
+unlabelled transition, and refused a repeated ceremony. The tag door
+published a matching tag without changing main and refused a mismatched tag
+without publishing. Every refusal created no tag or release of its own.