changelog.d/202.md

@@ -62,15 +62,3 @@
 - Probe results are written to an issue in the probe repo and carried to the
   ceremony issue by a human, so the probe holds no path that can write to the
   live board (#202).
-
-### Changed
-
-- `docs/RUNNER-PROBES.md` records the venue's first delivered drills — the
-  #192 asymmetry re-observed on demand under the workflow token, the dispatch
-  route's 204 under both identities, and #215's boundary finding — each with
-  the probe-issue URL it is recorded in (#202).
-
-- Two venue lessons join the runbook where the next probe author will look:
-  findings must be written to issues because the venue's log route 404s for
-  non-admin reads, and report content sent to the forge must never contain a
-  credential expression or value (#202).

docs/RUNNER-PROBES.md

@@ -333,55 +333,13 @@ No probe touches `heavy-duty/ceremony`'s board. No labels, no comments, no
 runs attributable to a probe. The venue exists so that the live board does not
 have to be the test fixture.
 
-## The probes this venue owes — and the records of those delivered
+## The probes this venue owes
 
-Delivered probes stay listed with their record: the venue's value is that a
+- **ceremony#192** — that the repaired sweep actually lifts a label under the
-claim like "the asymmetry reproduces" carries a URL a reader can open, not a
+  workflow token, which is the half its acceptance criteria cannot get from
-memory.
+  the hermetic contract tests.
-
+- **ceremony#205** — whether `POST /actions/workflows/{file}/dispatches`
-- **ceremony#192** — DELIVERED, first drill (2026-08-05). Under
+  works on this instance with a valid ref and inputs. Measured so far:
-  `${{ github.token }}` in the venue:
+  `GET /actions/workflows` 404s and the dispatch route answers 500 rather than
-  `DELETE /issues/{n}/labels/{id}` → **500**, the label still on the issue
+  a 4xx, which is not enough to port against.
-  afterward — the failure observable in the set, not merely a status — then
+- A 0.6.0 consumer exercise once ceremony#198 has merged.
-  `PUT` full-set clear → **200**, set actually empty. Record:
-  [probe issue #1](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/1)
-  (run 1) and
-  [probe issue #2](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/2)
-  (run 4 — the clean independent repeat after the redaction incident below).
-- **ceremony#205** — DELIVERED with a correction to the line above's
-  premise. The dispatch route answers **204** to a valid body carrying the
-  bare resolvable ref `main` — under the workflow token
-  ([ceremony#205 comment #6262](https://forgejo.heavyduty.builders/heavy-duty/ceremony/issues/205#issuecomment-6262),
-  run 504, and again as
-  [probe issue #4](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/4),
-  run 6) and under a PAT
-  ([probe issue #5](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/5),
-  run 7, and ceremony run 459). The earlier opaque `500` came from a bare
-  UNRESOLVABLE ref or an unknown/unparseable workflow — the diagnostic !213
-  ships now names this; a fully-qualified bad ref gets a clean 404 instead.
-  The `GET /actions/workflows` listing still 404s. Claims here are limited to
-  what those runs measured.
-- **ceremony#215** — the discriminator drill: REST-body `inputs` DO reach a
-  top-level dispatched workflow, both contexts
-  (`inputs.*` and `github.event.inputs.*`), both identities. What loses the
-  value is the `workflow_call` boundary — a called workflow does not see the
-  caller's `event.inputs` on this instance. Records:
-  [probe issues #4 and #5](https://forgejo.heavyduty.builders/heavy-duty/ceremony-runner-probe/issues/4)
-  (runs 6 and 7).
-- A 0.6.0 consumer exercise once ceremony#198 has merged. (#198 merged
-  2026-08-05; this probe remains open.)
-
-Two venue lessons from the first drills, kept where the next probe author will
-look:
-
-- **Rule 4 is load-bearing on this instance**: the probe repo's web log route
-  404s for non-admin reads, and a log-only observation (run 2) was lost where
-  issue-written ones were not.
-- **Report content sent to the forge must never contain a credential
-  expression OR a credential value** — moving a secret from `${{ … }}` syntax
-  into a shell variable does not make it safe to emit. Name identities in
-  literal prose ("the workflow token"), allowlist the fields a report emits,
-  and treat anything else as unsendable. The incident this teaches from: an
-  escaped `${{ github.token }}` in a comment template was expanded by the
-  runner into the recorded text (the run's ephemeral token); it was redacted
-  in place and the drill repeated clean (probe issue #2, run 4).