diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d8a64e..f8d2244 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## v0.91.2 — a healthy credential probe is observable (2026-07-21)
+
+The probe logged only on failure, so a healthy one was silent — which makes "no `auth_failed`"
+indistinguishable from "never probed", and leaves the leg impossible to demonstrate as running. That
+is precisely how v0.91.0 shipped it inert without anyone noticing. Adds a Debug line on success
+naming the storage: free in normal operation, one log level away when it matters.
+
 ## v0.91.1 — wire the credential probe (v0.91.0 shipped the seam inert) (2026-07-21)
 
 **Supersedes v0.91.0; that artifact is materially incomplete — do not vouch it.**
diff --git a/internal/pbs/live_reporter.go b/internal/pbs/live_reporter.go
index a340eb8..8349058 100644
--- a/internal/pbs/live_reporter.go
+++ b/internal/pbs/live_reporter.go
@@ -100,6 +100,10 @@ func (r *LiveSnapshotReporter) probeAuthAndReport(ctx context.Context, t Target)
 	err := r.probeAuth(ctx, t)
 	switch {
 	case err == nil:
+		// Logged even on success: a safety mechanism that is silent when healthy cannot be shown to be
+		// RUNNING, and "no auth_failed" is indistinguishable from "never probed". Debug level, so it
+		// costs nothing in normal operation but is one log-level away when it matters.
+		r.log.Debug("pbs: credential probe OK", "storage", t.StorageID, "datastore", t.Datastore)
 		r.authSink.NoteAuthResult(t.StorageID, false, "")
 	case errors.Is(err, ErrUnauthorized):
 		// The one case that is TERMINAL and actionable: the credential is rejected, not the network.