diff --git a/.gitea/workflows/probe.yml b/.gitea/workflows/probe.yml
new file mode 100644
index 0000000..9b91c18
--- /dev/null
+++ b/.gitea/workflows/probe.yml
@@ -0,0 +1,30 @@
+# TEMPORARY probe workflow (R-168, Part 0). DELETED before this session ends — if you are reading
+# this on main, teardown was missed. Measures P1 (a runner picks a job up at all), P2 in situ
+# (python3+git inside the job, not just inside the image), P3 (source without any JavaScript
+# action), and Scenario E's negative (docker must NOT be reachable).
+name: probe
+on: [push]
+jobs:
+  probe:
+    runs-on: felhom-gates
+    steps:
+      - name: P1 - the job runs at all
+        run: echo "P1-OK runner picked up the job"
+
+      - name: P2 in situ - tools visible to the JOB, not just the image
+        run: |
+          echo -n "P2 python3: "; python3 --version
+          echo -n "P2 git:     "; git --version
+
+      - name: P3 - obtain the source with no JavaScript action step
+        run: |
+          echo "P3 pushed sha = $GITHUB_SHA"
+          git clone -q http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git src
+          cd src && git checkout -q "$GITHUB_SHA"
+          echo "P3 checked-out sha = $(git rev-parse HEAD)"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA" && echo "P3-OK checkout equals pushed commit" || { echo "P3-FAIL"; exit 1; }
+
+      - name: Scenario E - docker MUST be unreachable
+        run: |
+          if docker ps 2>&1; then echo "E-FAIL docker reachable from the job"; exit 1; fi
+          echo "E-OK docker refused (output above is the refusal)"