diff --git a/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md b/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
index 61f81dc..17d881b 100644
--- a/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
+++ b/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
@@ -341,9 +341,29 @@ forgejo — the same publish-before-repoint rule as `KAIZEN-WP-0010`.
 Routed to ops-warden (lane owner for the catalog entry; `railiance-platform`
 owns the credential itself).
 
-**Still not swept:** CI runners. `railiance-forge/tools/gitea-runner-status.sh`
-suggests gitea-registered Actions runners exist; whether any repo's pipelines
-depend on them was not established.
+### CI runner sweep, 2026-08-20 — clear, and the sweep is now closed
+
+86 repositories carry `.forgejo/workflows`, with jobs on `self-hosted` (83),
+`container-build` (11), `ubuntu-latest` (87) and `docker` (1). Those labels
+resolve to registered runners, so the question was where the runners live.
+
+**The only runner in the estate is on railiance01**: `forgejo/forgejo-runner`,
+a Deployment up 48 days, registering against `${FORGEJO_INSTANCE}` — forgejo,
+not gitea. No runner exists on CoulombCore.
+
+`railiance-forge/tools/gitea-runner-status.sh`, which prompted this check, is a
+**legacy artifact**: it defaults to `RUNNER_HOST=haskelseed` and probes
+`INTER_HUB_IMAGE`. Both are already retired — haskelseed's bridge on 2026-08-19,
+inter-hub in July. So the gitea-era runner lived on haskelseed and died with it a
+day ago, and nothing broke: evidence in itself that gitea-based CI is no longer
+in use.
+
+**CoulombCore's dependency surface is therefore fully enumerated** across four
+methods — tunnels, service DNS, workload image references, operational-file
+grep, credential-lane catalog, and CI runners. Each method found something the
+previous one structurally could not see, which is the finding `T06`'s `G-GEN`
+gate should encode: **an inventory is only as complete as the number of
+independent ways you looked.**
 
 `forgejo.coulomb.social` is already on railiance01, so the work is retag, push,
 update manifest. Routed to `railiance-platform`; ownership of the `reuse-surface`