### Added

- `docs/RUNNER-PROBES.md` documents the standing runner-probe venue,
  `heavy-duty/ceremony-runner-probe` — the place runner-only facts are measured
  on demand, ruled as option A by the operator (#202).

- `drills/README.md` cross-links it beside the disposal rule, so the exception
  is visible where the dangerous habit lives (#202).

- The runbook states that the drill disposal rule does **not** apply to it.
  Archiving it defeats its purpose, and that is exactly how the three existing
  drill repos each became unavailable (#202).

- It records that a probe must run as an Actions job under the workflow token:
  the same call answers 500 there and 204 under a PAT, so a probe run any other
  way produces a confident wrong answer (#202).

- Creating the repo is recorded as the operator's step, measured rather than
  assumed: a fleet identity gets 403 on org repo creation and 201 in its own
  namespace (#202).

- It carries an executable two-layer arming procedure: an immutable candidate
  code SHA and an armed workflow commit on top of it. A single layer is
  self-referential — rewriting a workflow makes a new commit, and a commit
  cannot contain its own object ID (#202).

- Callers are pinned by layer: composite actions to the candidate code SHA,
  reusable workflows to the armed SHA, which is the only revision whose inner
  checkout points at the fork (#202).

- The arming gate asserts what each carrier IS, not only that the old literal
  is gone: every `repository:` equals the fork, every `CEREMONY_SELF_REF` value
  equal the candidate code SHA, and callers match the layer they belong to
  (#202).

- It enumerates the carriers from the tree rather than encoding a count, and
  distinguishes ceremony's internal self-checkouts from the consumer checkouts
  that must stay `${{ github.repository }}` (#202).

- Both published snippets are ShellCheck-clean when extracted and linted
  directly, not merely as part of the repository sweep (#202).

- The checker validates the MANIFEST against the target it was given, so a
  manifest that describes a wrong arming consistently — wrong fork, or the
  armed SHA where the candidate belongs — refuses instead of matching a tree
  rewritten to the same wrong value (#202).

- The manifest is generated from the PRE-arming tree, which is the only order
  that enumerates the carriers that must change (#202).

- Both published snippets were driven against a constructed candidate/probe
  pair: deletion, both role swaps, wrong owner, wrong
  SHA, wrong path, a deleted caller class and an extra carrier all refuse, and
  the armed control passes (#202).

- The manifest records complete caller coordinates, so a path swapped under the
  right owner and SHA is caught (#202).

- Generator and checker share one domain — ceremony callers — so a third-party
  `actions/checkout` is neither manifested nor reported as unrecognised (#202).

- Probe results are written to an issue in the probe repo and carried to the
  ceremony issue by a human, so the probe holds no path that can write to the
  live board (#202).

### Changed

- `docs/RUNNER-PROBES.md` records the venue's first delivered drills — the
  #192 asymmetry re-observed on demand under the workflow token, the dispatch
  route's 204 under both identities, and #215's boundary finding — each with
  the probe-issue URL it is recorded in (#202).

- Two venue lessons join the runbook where the next probe author will look:
  findings must be written to issues because the venue's log route 404s for
  non-admin reads, and report content sent to the forge must never contain a
  credential expression or value (#202).