diff --git a/tools/cdb/a6-probe-runner.ps1 b/tools/cdb/a6-probe-runner.ps1
new file mode 100644
index 0000000..160721a
--- /dev/null
+++ b/tools/cdb/a6-probe-runner.ps1
@@ -0,0 +1,56 @@
+# Phase A6.P1 cdb probe runner — 2026-05-21
+#
+# Attaches cdb to a live retail acclient.exe with the a6-probe.cdb script.
+# Per-scenario usage:
+#   .\tools\cdb\a6-probe-runner.ps1 -ScenarioTag "scen1_inn_doorway"
+#
+# Prerequisites (verify before invoking):
+#   1. Retail acclient.exe v11.4186 running and in-world (matches refs/acclient.pdb).
+#      Verify with: py tools\pdb-extract\check_exe_pdb.py "C:\Turbine\Asheron's Call\acclient.exe"
+#   2. ACE running locally on 127.0.0.1:9000.
+#   3. Retail character at the scenario start position.
+#
+# Output:
+#   docs\research\2026-05-21-a6-captures\<ScenarioTag>\retail.log
+
+param(
+    [Parameter(Mandatory=$true)]
+    [string]$ScenarioTag
+)
+
+$cdbExe = "C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe"
+if (-not (Test-Path $cdbExe)) {
+    Write-Error "cdb.exe not found at $cdbExe. Install Microsoft Store WinDbg (~50 MB)."
+    exit 1
+}
+
+$scriptPath = Join-Path $PSScriptRoot "a6-probe.cdb"
+if (-not (Test-Path $scriptPath)) {
+    Write-Error "a6-probe.cdb not found at $scriptPath."
+    exit 1
+}
+
+$captureDir = Join-Path $PSScriptRoot "..\..\docs\research\2026-05-21-a6-captures\$ScenarioTag"
+if (-not (Test-Path $captureDir)) {
+    New-Item -ItemType Directory -Path $captureDir | Out-Null
+}
+
+$logPath = Join-Path $captureDir "retail.log"
+
+# Patch the .cdb script with the scenario-tagged log path (in-place substitution).
+$scriptContent = Get-Content $scriptPath -Raw
+$patchedScript = $scriptContent -replace '\$\{ARG_LOG_TAG\}', $ScenarioTag
+
+$tempScript = Join-Path $env:TEMP "a6-probe-$ScenarioTag.cdb"
+Set-Content -Path $tempScript -Value $patchedScript -Encoding ASCII
+
+Write-Host "Attaching cdb to acclient.exe with scenario tag '$ScenarioTag'..."
+Write-Host "Log: $logPath"
+Write-Host "(cdb auto-detaches at 50K total hits; or press Ctrl-Break to interrupt.)"
+
+& $cdbExe -pn acclient.exe -cf $tempScript 2>&1 | Tee-Object -FilePath $logPath
+
+Remove-Item $tempScript -ErrorAction SilentlyContinue
+
+Write-Host ""
+Write-Host "Capture complete. Log saved to $logPath"