diff --git a/.tangled/workflows/probe-deps.yml b/.tangled/workflows/probe-deps.yml
new file mode 100644
index 0000000..15399a5
--- /dev/null
+++ b/.tangled/workflows/probe-deps.yml
@@ -0,0 +1,30 @@
+# Bisect probe B: microvm with admission.yml's full dependency list and no
+# virtualisation. If this fails while probe A passes, one of these package
+# names is the thing that has been killing admission.yml. Delete once known.
+
+when:
+  - event: ["push"]
+    branch: ["main"]
+  - event: ["manual"]
+
+engine: microvm
+image: nixos
+
+dependencies:
+  - just
+  - python3
+  - uv
+  - go
+  - git
+  - jq
+  - curl
+  - xz
+  - e2fsprogs
+
+steps:
+  - name: every dependency resolves
+    command: |
+      set -euo pipefail
+      for c in just python3 uv go git jq curl xz mkfs.ext4; do
+        command -v "$c" >/dev/null && echo "ok   $c" || echo "MISS $c"
+      done
diff --git a/.tangled/workflows/probe-microvm.yml b/.tangled/workflows/probe-microvm.yml
index a01da82..f308f69 100644
--- a/.tangled/workflows/probe-microvm.yml
+++ b/.tangled/workflows/probe-microvm.yml
@@ -1,8 +1,6 @@
-# Throwaway probe: does this spindle run the microvm engine at all?
-# admission.yml has failed in ~15s on every push since 2026-08-07 with no
-# step logs, which is consistent with the run dying before any step. This
-# isolates the engine from everything admission.yml also asks for (docker,
-# nbd, a zig toolchain, a cloned upstream). Delete once the answer is known.
+# Bisect probe A: microvm + virtualisation.docker (probe with jq alone and no
+# virtualisation already succeeded, so this isolates the docker guest config).
+# Delete both probes once admission.yml runs.
 
 when:
   - event: ["push"]
@@ -15,14 +13,11 @@ image: nixos
 dependencies:
   - jq
 
+virtualisation:
+  docker: true
+
 steps:
-  - name: hello
+  - name: docker present
     command: |
       set -euo pipefail
-      echo "microvm engine works"
-      uname -a
-      jq --version
-
-  - name: docker available?
-    command: |
-      command -v docker && docker info >/dev/null 2>&1 && echo "docker: yes" || echo "docker: no"
+      docker info >/dev/null 2>&1 && echo "docker: usable" || { echo "docker: NOT usable"; exit 1; }