diff --git a/.gitea/workflows/cache-probe.yml b/.gitea/workflows/cache-probe.yml
new file mode 100644
index 0000000..036102c
--- /dev/null
+++ b/.gitea/workflows/cache-probe.yml
@@ -0,0 +1,91 @@
+name: Cache Service Probe
+
+# Temporary diagnostic for #178, to be deleted once it has answered its
+# question. actions/cache refuses to run here, printing its GHES warning, on
+# both v3 and v4. Two explanations remain and they need different fixes:
+#
+#   1. Cache is off in act_runner's config, so no ACTIONS_CACHE_URL is exported
+#      and the runner has nothing to point a patched bundle at. Fix is
+#      cache.enabled in config.yaml.
+#   2. Cache is served, but the runner's bundle patcher does not recognise
+#      these bundles and so leaves the GHES gate shut. That is a runner bug
+#      worth reporting upstream.
+#
+# An exported cache URL tells the two apart.
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  probe:
+    name: Cache Service Probe
+    runs-on: ubuntu-latest
+    steps:
+      # Values for the URLs, which are plain endpoints, and presence only for
+      # the tokens, which are credentials and must not reach the log.
+      - name: Report cache-related environment
+        run: |
+          echo "GITHUB_SERVER_URL        = ${GITHUB_SERVER_URL:-<unset>}"
+          echo "ACTIONS_CACHE_URL        = ${ACTIONS_CACHE_URL:-<unset>}"
+          echo "ACTIONS_RESULTS_URL      = ${ACTIONS_RESULTS_URL:-<unset>}"
+          echo "ACTIONS_CACHE_SERVICE_V2 = ${ACTIONS_CACHE_SERVICE_V2:-<unset>}"
+          for t in ACTIONS_RUNTIME_TOKEN ACTIONS_CACHE_TOKEN GITHUB_TOKEN; do
+            if [ -n "${!t:-}" ]; then echo "$t: set"; else echo "$t: unset"; fi
+          done
+
+      # Names only, never values — catches any endpoint variable the runner
+      # exports under a name this probe did not think to ask for.
+      - name: List ACTIONS_/GITHUB_ variable names
+        run: env | grep -E '^(ACTIONS_|GITHUB_)' | sed 's/=.*//' | sort
+
+      # Run the real thing alongside, so the warning and the environment that
+      # produced it sit in one log.
+      - name: Try actions/cache
+        uses: actions/cache@v4
+        with:
+          path: /tmp/cache-probe
+          key: cache-probe-${{ github.run_id }}
+
+      - name: Runner and version context
+        run: |
+          echo "runner.arch = ${{ runner.arch }}"
+          echo "runner.os   = ${{ runner.os }}"
+
+  # The first probe showed ACTIONS_CACHE_URL unset but ACTIONS_RESULTS_URL set,
+  # i.e. the runner serves the v2 cache service and not v1. actions/cache v4.3
+  # can speak v2, but only when ACTIONS_CACHE_SERVICE_V2 is set, and it is not.
+  # These three variants test the ways round that.
+  variant-v4-flag:
+    name: cache@v4 + ACTIONS_CACHE_SERVICE_V2
+    runs-on: ubuntu-latest
+    env:
+      ACTIONS_CACHE_SERVICE_V2: "true"
+    steps:
+      - run: mkdir -p /tmp/probe && head -c 1048576 /dev/urandom > /tmp/probe/blob
+      - uses: actions/cache@v4
+        with:
+          path: /tmp/probe
+          key: probe-v4flag-${{ github.run_id }}
+
+  variant-v6:
+    name: cache@v6
+    runs-on: ubuntu-latest
+    steps:
+      - run: mkdir -p /tmp/probe && head -c 1048576 /dev/urandom > /tmp/probe/blob
+      - uses: actions/cache@v6
+        with:
+          path: /tmp/probe
+          key: probe-v6-${{ github.run_id }}
+
+  variant-v6-flag:
+    name: cache@v6 + ACTIONS_CACHE_SERVICE_V2
+    runs-on: ubuntu-latest
+    env:
+      ACTIONS_CACHE_SERVICE_V2: "true"
+    steps:
+      - run: mkdir -p /tmp/probe && head -c 1048576 /dev/urandom > /tmp/probe/blob
+      - uses: actions/cache@v6
+        with:
+          path: /tmp/probe
+          key: probe-v6flag-${{ github.run_id }}