From 81158342b66cd6dc997a8337fd1a405de38cfb57 Mon Sep 17 00:00:00 2001
From: Sunrisepeak <speakshen@163.com>
Date: Sat, 17 Oct 2026 10:11:31 +0900
Subject: [PATCH 1/3] probe: upgrade from 2026.10.11.1 to 2026.10.16.3
 (revision reinstall, orphan records)

Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com>
---
 .github/probe/upgrade.sh                      | 188 ++++
 .github/workflows/aur-publish.yml             | 163 ---
 .github/workflows/bootstrap-macos.yml         | 154 ---
 .github/workflows/build.yml                   | 126 ---
 .../workflows/ci-aarch64-fresh-install.yml    | 402 --------
 .github/workflows/ci-arm64-published-cn.yml   | 127 ---
 .github/workflows/ci-bootstrap.yml            | 143 ---
 .github/workflows/ci-fresh-install.yml        | 796 ---------------
 .github/workflows/ci-linux-e2e.yml            | 538 ----------
 .github/workflows/ci-linux.yml                | 425 --------
 .github/workflows/ci-macos-e2e.yml            | 132 ---
 .github/workflows/ci-macos-ios.yml            | 378 -------
 .github/workflows/ci-macos.yml                | 470 ---------
 .github/workflows/ci-target-matrix.yml        | 501 ---------
 .github/workflows/ci-windows-e2e.yml          | 136 ---
 .github/workflows/ci-windows-msvc-xlings.yml  |  94 --
 .github/workflows/ci-windows.yml              | 486 ---------
 .github/workflows/ci.yml                      | 277 -----
 .github/workflows/cross-build-test.yml        | 574 -----------
 .github/workflows/homebrew-publish.yml        |  83 --
 .../workflows/measure-windows-tool-crt.yml    | 247 -----
 .github/workflows/openkal-cross.yml           | 861 ----------------
 .github/workflows/probe-upgrade.yml           |  37 +
 .github/workflows/pypi-publish.yml            | 200 ----
 .github/workflows/release-canaries.yml        | 101 --
 .github/workflows/release.yml                 | 961 ------------------
 26 files changed, 225 insertions(+), 8375 deletions(-)
 create mode 100644 .github/probe/upgrade.sh
 delete mode 100644 .github/workflows/aur-publish.yml
 delete mode 100644 .github/workflows/bootstrap-macos.yml
 delete mode 100644 .github/workflows/build.yml
 delete mode 100644 .github/workflows/ci-aarch64-fresh-install.yml
 delete mode 100644 .github/workflows/ci-arm64-published-cn.yml
 delete mode 100644 .github/workflows/ci-bootstrap.yml
 delete mode 100644 .github/workflows/ci-fresh-install.yml
 delete mode 100644 .github/workflows/ci-linux-e2e.yml
 delete mode 100644 .github/workflows/ci-linux.yml
 delete mode 100644 .github/workflows/ci-macos-e2e.yml
 delete mode 100644 .github/workflows/ci-macos-ios.yml
 delete mode 100644 .github/workflows/ci-macos.yml
 delete mode 100644 .github/workflows/ci-target-matrix.yml
 delete mode 100644 .github/workflows/ci-windows-e2e.yml
 delete mode 100644 .github/workflows/ci-windows-msvc-xlings.yml
 delete mode 100644 .github/workflows/ci-windows.yml
 delete mode 100644 .github/workflows/ci.yml
 delete mode 100644 .github/workflows/cross-build-test.yml
 delete mode 100644 .github/workflows/homebrew-publish.yml
 delete mode 100644 .github/workflows/measure-windows-tool-crt.yml
 delete mode 100644 .github/workflows/openkal-cross.yml
 create mode 100644 .github/workflows/probe-upgrade.yml
 delete mode 100644 .github/workflows/pypi-publish.yml
 delete mode 100644 .github/workflows/release-canaries.yml
 delete mode 100644 .github/workflows/release.yml

diff --git a/.github/probe/upgrade.sh b/.github/probe/upgrade.sh
new file mode 100644
index 000000000..41e55042d
--- /dev/null
+++ b/.github/probe/upgrade.sh
@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+# TEMPORARY probe (do not merge). Prints, never asserts.
+#
+# Measures what a user sees when they upgrade from the previous release
+# (2026.10.11.1, bundled xlings 2026.10.10.2) to the current one
+# (2026.10.16.3, bundled xlings 2026.10.16.2) on a home the previous release
+# made, and then run `mcpp new && mcpp run`.
+#
+# variant:
+#   plain     the previous release installs from today's index; nothing altered
+#   snapshot  the previous release installs from the xim index as of
+#             2026-10-07 (xim-pkgindex ebf1fbb, before llvm revision 1 and
+#             gcc 16.1.0-r1): payloads genuinely of the old revision
+#   stamp     like plain, then every payload stamp records a revision other
+#             than its recipe's (the mechanism, on every platform)
+#   orphan    like stamp, then the version DB loses c++@<gcc version> while
+#             the workspace keeps it active (the shape of the reported home)
+set -u
+VARIANT="${1:-plain}"
+OLD_VER=2026.10.11.1
+NEW_VER=2026.10.16.3
+SNAPSHOT=ebf1fbb3417ec513b923279044433887b3af8850
+
+W="${RUNNER_TEMP:-/tmp}/upg"
+rm -rf "$W"; mkdir -p "$W"
+export MCPP_HOME="$W/home"
+REG="$MCPP_HOME/registry"
+PY=$(command -v python3 || command -v python)
+
+case "$(uname -s)-$(uname -m)" in
+  Linux-x86_64)  PLAT=linux-x86_64;  EXT=tar.gz; EXE= ;;
+  Linux-aarch64) PLAT=linux-aarch64; EXT=tar.gz; EXE= ;;
+  Darwin-arm64)  PLAT=macosx-arm64;  EXT=tar.gz; EXE= ;;
+  MINGW*|MSYS*)  PLAT=windows-x86_64; EXT=zip;   EXE=.exe ;;
+  *) echo "unknown platform $(uname -a)"; exit 0 ;;
+esac
+IS_LINUX=0; [[ $PLAT == linux-* ]] && IS_LINUX=1
+
+section() { echo; echo "================ [$(date -u +%H:%M:%S)] $* ================"; }
+
+fetch_release() {  # ver dest
+  local ver=$1 dest=$2 name="mcpp-$1-$PLAT.$EXT"
+  curl -fsSL -o "$W/$name" "https://github.com/mcpp-community/mcpp/releases/download/v$ver/$name" || { echo "download $name failed"; return 1; }
+  mkdir -p "$W/x-$ver"
+  if [[ $EXT == zip ]]; then
+    "$PY" -c "import zipfile,sys; zipfile.ZipFile(sys.argv[1]).extractall(sys.argv[2])" "$W/$name" "$W/x-$ver"
+  else
+    tar xzf "$W/$name" -C "$W/x-$ver"
+  fi
+  mv "$W/x-$ver"/mcpp-$ver-$PLAT "$dest"
+  chmod +x "$dest/bin/mcpp$EXE" "$dest/registry/bin/xlings$EXE" 2>/dev/null || true
+}
+
+# run <label> <dir> <mcpp> args...: time, exit code, and the lines that matter
+RUNS="$W/runs.tsv"; : > "$RUNS"
+run() {
+  local label=$1 dir=$2 bin=$3; shift 3
+  section "$label: (cd $dir && mcpp $*)"
+  local t0=$(date +%s) rc
+  (cd "$dir" && "$bin" "$@") > "$W/$label.log" 2>&1; rc=$?
+  local dt=$(( $(date +%s) - t0 ))
+  sed -e 's/\x1b\[[0-9;]*[A-Za-z]//g' "$W/$label.log" | tr '\r' '\n' | grep -v '^\s*Planning ' | tail -40
+  local refresh=$(grep -c "Refreshing package index" "$W/$label.log")
+  local reinstall=$(grep -o "reinstall[a-z]*: recipe revision [0-9]*, installed revision [0-9]*\|reinstalling [^:]*" "$W/$label.log" | sort -u | tr '\n' ';')
+  local dl=$(grep -o "Downloading [^ ]*\( done, [0-9.]* [KMG]B\)\?" "$W/$label.log" | tr '\n' ';')
+  echo "--> rc=$rc ${dt}s refresh=$refresh reinstall=[$reinstall] downloads=[$dl]"
+  printf '%s\t%s\t%ss\t%s\t%s\t%s\n' "$label" "$rc" "$dt" "$refresh" "$reinstall" "$dl" >> "$RUNS"
+}
+
+stamps() {
+  section "payload stamps ($1)"
+  for d in "$REG"/data/xpkgs/xim-x-llvm/* "$REG"/data/xpkgs/xim-x-gcc/* "$REG"/data/xpkgs/xim-x-glibc/* "$REG"/data/xpkgs/xim-x-gcc-runtime/*; do
+    [ -f "$d/.xpkg-install.json" ] && echo "$d: $(tr -d '\n ' < "$d/.xpkg-install.json")"
+  done
+  section "xlings ($1)"
+  "$REG/bin/xlings$EXE" --version 2>&1 | head -1
+  local targets='["xim:llvm@23.1.3"'; [ $IS_LINUX = 1 ] && targets+=',"xim:gcc@16.1.0","xim:glibc@2.44.3"'; targets+=']'
+  (cd "$REG" && XLINGS_HOME="$REG" "$REG/bin/xlings$EXE" interface payload_status --args "{\"targets\":$targets}" 2>&1 | grep -o '{"targets".*' | head -1) || echo "(payload_status not available)"
+  section "index layout ($1)"
+  ls "$REG/data" 2>&1 | tr '\n' ' '; echo
+  ls -d "$MCPP_HOME"/indices/* 2>/dev/null
+  for f in "$REG/data/xim-pkgindex/pkgs/l/llvm.lua" "$REG/data/xim-pkgindex/pkgs/g/gcc.lua"; do
+    if [ -f "$f" ]; then echo "$f revisions: $(grep -o 'revision = [0-9]*' "$f" | tr '\n' ' ')"; else echo "$f: MISSING"; fi
+  done
+  "$PY" - "$REG/.xlings.json" <<'PY' 2>&1
+import json, sys
+d = json.load(open(sys.argv[1]))
+print("home config keys:", sorted(d))
+for r in d.get("index_repos", []): print("  index_repo:", {k: r.get(k) for k in ("name", "dir", "store", "url")})
+PY
+}
+
+llvm_facts() {
+  section "llvm payload facts ($1)"
+  local root="$REG/data/xpkgs/xim-x-llvm/23.1.3"
+  for cfg in "$root"/bin/*.cfg; do [ -f "$cfg" ] && { echo "--- $cfg"; cat "$cfg"; }; done
+  [ -x "$root/bin/clang++$EXE" ] && echo | "$root/bin/clang++$EXE" -v -E -x c++ - 2>&1 | sed -n '/search starts here/,/End of search list/p'
+}
+
+section "probe variant=$VARIANT platform=$PLAT"
+fetch_release "$OLD_VER" "$W/old" || exit 0
+fetch_release "$NEW_VER" "$W/new" || exit 0
+OLD="$W/old/bin/mcpp$EXE"; NEW="$W/new/bin/mcpp$EXE"
+"$OLD" --version; "$NEW" --version
+
+new_project() {  # dir toolchain
+  (cd "$W" && "$OLD" new "$1" > /dev/null 2>&1) || mkdir -p "$W/$1"
+  printf '\n[toolchain]\ndefault = "%s"\n' "$2" >> "$W/$1/mcpp.toml"
+}
+
+# ---------------------------------------------------------------- old release
+run old-env "$W" "$OLD" self env
+if [ "$VARIANT" = snapshot ]; then
+  section "swap the xim index for xim-pkgindex@$SNAPSHOT"
+  git clone -q --filter=blob:none https://github.com/openxlings/xim-pkgindex "$W/xpi" && git -C "$W/xpi" checkout -q "$SNAPSHOT"
+  idx="$REG/data/xim-pkgindex"
+  find "$idx" -mindepth 1 -maxdepth 1 ! -name .xlings-index-version -exec rm -rf {} +
+  (cd "$W/xpi" && git archive HEAD) | tar x -C "$idx"
+  echo "llvm.lua now: $(grep -o 'revision = [0-9]*' "$idx/pkgs/l/llvm.lua" | tr '\n' ' ')"
+fi
+
+run old-tc-llvm "$W" "$OLD" toolchain install llvm@23.1.3
+[ $IS_LINUX = 1 ] && run old-tc-gcc "$W" "$OLD" toolchain install gcc@16.1.0
+new_project p-llvm llvm@23.1.3
+run old-run-llvm "$W/p-llvm" "$OLD" run
+if [ $IS_LINUX = 1 ]; then new_project p-gcc gcc@16.1.0; run old-run-gcc "$W/p-gcc" "$OLD" run; fi
+stamps after-old
+[ $IS_LINUX = 1 ] && llvm_facts after-old
+
+if [ "$VARIANT" = stamp ] || [ "$VARIANT" = orphan ]; then
+  section "rewrite stamps to a revision other than the recipe's"
+  "$PY" - "$REG/data/xpkgs" <<'PY'
+import json, os, sys, glob
+for f in glob.glob(os.path.join(sys.argv[1], "xim-x-*", "*", ".xpkg-install.json")):
+    d = json.load(open(f)); r = d.get("revision", 0)
+    d["revision"] = 1 if r == 0 else r - 1
+    json.dump(d, open(f, "w"), indent=2); print(f, r, "->", d["revision"])
+PY
+fi
+if [ "$VARIANT" = orphan ]; then
+  section "drop c++@<gcc version> from the version DB, keep the workspace"
+  "$PY" - "$REG" <<'PY'
+import json, os, sys
+reg = sys.argv[1]
+ws = json.load(open(os.path.join(reg, "subos/default/.xlings.json")))["workspace"]
+print("workspace c++:", ws.get("c++"))
+active = (ws.get("c++") or {}).get("active")
+for path, key in ((os.path.join(reg, "data/versions.json"), "versions"), (os.path.join(reg, ".xlings.json"), "versions")):
+    if not os.path.exists(path): continue
+    doc = json.load(open(path)); db = doc.get(key, {})
+    cxx = db.get("c++", {})
+    gone = cxx.get("versions", {}).pop(active, None) is not None
+    for edges in cxx.get("bindings", {}).values(): edges.pop(active, None)
+    json.dump(doc, open(path, "w")); print(path, "dropped c++@%s:" % active, gone)
+PY
+fi
+
+# ---------------------------------------------------------------- new release
+if [ "$VARIANT" = snapshot ]; then
+  # the old index is still in place: does the new release use the old-revision
+  # payload, and does it build with it?
+  run new-run-llvm-on-snapshot "$W/p-llvm" "$NEW" run
+  stamps after-new-on-snapshot
+  llvm_facts after-new-on-snapshot
+  run new-index-update "$W" "$NEW" index update
+fi
+new_project p-new llvm@23.1.3
+run new-run1-llvm "$W/p-new" "$NEW" run
+run new-run2-llvm "$W/p-new" "$NEW" run
+run new-run3-llvm-old-project "$W/p-llvm" "$NEW" run
+if [ $IS_LINUX = 1 ]; then
+  run new-run1-gcc "$W/p-gcc" "$NEW" run
+  run new-run2-gcc "$W/p-gcc" "$NEW" run
+fi
+stamps after-new
+[ $IS_LINUX = 1 ] && llvm_facts after-new
+run new-doctor "$W" "$NEW" self doctor
+
+section "SUMMARY variant=$VARIANT platform=$PLAT"
+{
+  echo "### upgrade probe: $PLAT / $VARIANT"
+  echo
+  echo "| run | rc | time | index refreshes | reinstall | downloads |"
+  echo "|---|---|---|---|---|---|"
+  while IFS=$'\t' read -r a b c d e f; do echo "| $a | $b | $c | $d | ${e:-} | ${f:-} |"; done < "$RUNS"
+} | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"
+mkdir -p "${GITHUB_WORKSPACE:-.}/probe-out"; cp -r "$W"/*.log "$W/runs.tsv" "${GITHUB_WORKSPACE:-.}/probe-out/" 2>/dev/null || true
+exit 0
diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml
deleted file mode 100644
index ce6eae4a4..000000000
--- a/.github/workflows/aur-publish.yml
+++ /dev/null
@@ -1,163 +0,0 @@
-name: aur-publish
-
-# Reconcile only mcpp-bin.  This workflow is downstream of `release`, so its
-# failure is visible without changing the already-terminal release conclusion.
-on:
-  workflow_run:
-    workflows: [release]
-    types: [completed]
-  schedule:
-    - cron: '17 */6 * * *'
-  workflow_dispatch:
-    inputs:
-      publish:
-        description: 'Publish the validated diff (false performs a dry-run only)'
-        type: boolean
-        required: true
-        default: false
-      tag:
-        description: 'Optional exact latest complete stable tag (no downgrade override)'
-        type: string
-        required: false
-
-concurrency:
-  group: aur-mcpp-bin-reconcile
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  reconcile:
-    name: reconcile mcpp-bin
-    if: >-
-      github.event_name != 'workflow_run' ||
-      github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    env:
-      GH_TOKEN: ${{ github.token }}
-      PYTHONDONTWRITEBYTECODE: '1'
-      REQUESTED_TAG: ${{ inputs.tag }}
-    steps:
-      - name: Checkout reconciler source
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
-
-      - name: Reconciler contract tests
-        run: python3 tests/scripts/test_aur_reconcile.py
-
-      # This phase has no SSH private key in its environment.  It downloads the
-      # immutable manifest and both Linux payload/sidecars, recomputes hashes,
-      # runs makepkg as non-root in Arch, inspects RPC + HTTPS git, and emits the
-      # exact diff before any publishing secret is loaded.
-      - name: Inspect and validate desired state
-        id: plan
-        env:
-          TRIGGER: ${{ github.event_name }}
-          MANUAL_PUBLISH: ${{ inputs.publish }}
-          # Repository variable, absent until a human has watched one publish
-          # succeed. See "Arming the automatic triggers" in tools/aur/README.md.
-          AUTOPUBLISH: ${{ vars.AUR_AUTOPUBLISH }}
-        run: |
-          args=(
-            --trigger "$TRIGGER"
-            --report-json "$RUNNER_TEMP/aur-plan.json"
-            --summary "$GITHUB_STEP_SUMMARY"
-          )
-          [[ -z "$REQUESTED_TAG" ]] || args+=(--tag "$REQUESTED_TAG")
-          python3 tools/aur/reconcile_mcpp_bin.py "${args[@]}"
-
-          # An unattended push to a third-party service must be ARMED, not
-          # inherited from a merge. `schedule` fires every six hours off the
-          # default branch, so merging this workflow used to be enough to make
-          # mcpp start writing to the AUR on its own — before anyone had seen
-          # the reconciler complete a real push even once. Both automatic
-          # triggers therefore plan-and-report until AUR_AUTOPUBLISH is set;
-          # `workflow_dispatch` keeps its explicit per-run switch, which is how
-          # that first push is meant to happen.
-          case "$TRIGGER" in
-              workflow_run | schedule)
-                  if [[ "${AUTOPUBLISH:-}" == "true" ]]; then
-                      publish=true
-                  else
-                      publish=false
-                      echo "::notice::AUR_AUTOPUBLISH is not set — reporting the desired state without publishing."
-                  fi
-                  ;;
-              *)
-                  publish=${MANUAL_PUBLISH:-false}
-                  ;;
-          esac
-          echo "needs_publish=$(jq -r '.needs_publish' "$RUNNER_TEMP/aur-plan.json")" >> "$GITHUB_OUTPUT"
-          echo "publish=$publish" >> "$GITHUB_OUTPUT"
-
-      - name: Configure pinned AUR SSH identity
-        if: steps.plan.outputs.needs_publish == 'true' && steps.plan.outputs.publish == 'true'
-        env:
-          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-        run: |
-          test -n "$AUR_SSH_PRIVATE_KEY" || { echo 'AUR_SSH_PRIVATE_KEY is empty'; exit 1; }
-          install -dm700 "$HOME/.ssh"
-          install -m600 /dev/null "$HOME/.ssh/aur"
-          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$HOME/.ssh/aur"
-          install -m600 tools/aur/aur.archlinux.org.known_hosts "$HOME/.ssh/known_hosts"
-          ssh-keygen -lf "$HOME/.ssh/known_hosts" -E sha256 \
-            | grep -F 'SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4'
-          install -m600 /dev/null "$HOME/.ssh/config"
-          printf '%s\n' \
-            'Host aur.archlinux.org' \
-            '  User aur' \
-            '  IdentityFile ~/.ssh/aur' \
-            '  IdentitiesOnly yes' \
-            '  StrictHostKeyChecking yes' \
-            '  UserKnownHostsFile ~/.ssh/known_hosts' \
-            > "$HOME/.ssh/config"
-
-      - name: Fast-forward publish and verify convergence
-        if: steps.plan.outputs.needs_publish == 'true' && steps.plan.outputs.publish == 'true'
-        env:
-          TRIGGER: ${{ github.event_name }}
-        run: |
-          args=(
-            --publish
-            --trigger "$TRIGGER"
-            --report-json "$RUNNER_TEMP/aur-final.json"
-            --summary "$GITHUB_STEP_SUMMARY"
-          )
-          [[ -z "$REQUESTED_TAG" ]] || args+=(--tag "$REQUESTED_TAG")
-
-          # EXIT 75 IS "THE PUSH LANDED, THE AUR'S INDEX HAS NOT CAUGHT UP",
-          # AND FAILING ON IT MAKES THIS REPOSITORY'S CI RED FOR SOMEBODY ELSE'S
-          # REFRESH SCHEDULE.
-          #
-          # The reconciler already classifies that case as TRANSIENT and exits
-          # 75 (the conventional EX_TEMPFAIL) rather than 2. It is reached only
-          # AFTER the git push has succeeded, so the AUR holds the new version
-          # at that point; what has not happened is the AUR's own RPC metadata
-          # refresh, which runs on a schedule measured in minutes.
-          #
-          # Measured twice (2026.8.21.2 and 2026.8.21.3): this step reported
-          # `AUR RPC did not converge to <ver>` and the AUR RPC answered with
-          # that exact version when asked afterwards.
-          #
-          # EVERY OTHER NON-ZERO CODE STILL FAILS. A refused downgrade (3) and
-          # a permanent error (2) are this repository's problem and stay red.
-          set +e
-          python3 tools/aur/reconcile_mcpp_bin.py "${args[@]}"
-          rc=$?
-          set -e
-          if [[ "$rc" == "75" ]]; then
-              echo "::warning::The push to the AUR succeeded; its RPC metadata had not refreshed within the poll window. Verify with: curl -s 'https://aur.archlinux.org/rpc/v5/info?arg[]=mcpp-bin'"
-          elif [[ "$rc" != "0" ]]; then
-              exit "$rc"
-          fi
-
-      - name: Preserve reconciliation reports
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: aur-mcpp-bin-reconciliation
-          path: ${{ runner.temp }}/aur-*.json
-          if-no-files-found: error
diff --git a/.github/workflows/bootstrap-macos.yml b/.github/workflows/bootstrap-macos.yml
deleted file mode 100644
index 0953ae26b..000000000
--- a/.github/workflows/bootstrap-macos.yml
+++ /dev/null
@@ -1,154 +0,0 @@
-name: bootstrap-macos
-
-# One-shot workflow to produce the first macOS mcpp binary.
-# Uses xmake + xlings LLVM to compile mcpp from source.
-# Once a macOS binary exists, mcpp can self-host for future releases.
-
-on:
-  workflow_dispatch:
-
-jobs:
-  bootstrap:
-    name: Bootstrap mcpp (macOS ARM64)
-    runs-on: macos-15
-    timeout-minutes: 30
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-      # Dormant (workflow_dispatch only), but kept in step with the rest —
-      # check_version_pins.sh holds it there. Floor: 0.4.69, below which the
-      # index cannot resolve two packages that share a short name.
-      XLINGS_VERSION: '2026.10.16.2'
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: System info
-        run: |
-          uname -a
-          sw_vers
-          xcrun --show-sdk-path
-
-      - name: Install xlings
-        run: |
-          WORK=$(mktemp -d)
-          tarball="xlings-${XLINGS_VERSION}-macosx-arm64.tar.gz"
-          bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-            "https://github.com/d2learn/xlings/releases/download/v${XLINGS_VERSION}/${tarball}" \
-            "${WORK}/${tarball}"
-          tar -xzf "${WORK}/${tarball}" -C "${WORK}"
-          "${WORK}/xlings-${XLINGS_VERSION}-macosx-arm64/subos/default/bin/xlings" self install
-          echo "$HOME/.xlings/subos/default/bin" >> "$GITHUB_PATH"
-          echo "$HOME/.xlings/bin" >> "$GITHUB_PATH"
-
-      - name: Install LLVM + xmake
-        run: |
-          xlings install llvm@23.1.3 -y || xlings install llvm -y
-          brew install xmake
-          LLVM_ROOT=$(find "$HOME/.xlings" -path "*/xpkgs/xim-x-llvm/*/bin/clang++" | head -1 | xargs dirname | xargs dirname)
-          echo "LLVM_ROOT=$LLVM_ROOT" >> "$GITHUB_ENV"
-          "$LLVM_ROOT/bin/clang++" --version
-          xmake --version
-
-      - name: Build mcpp with xmake
-        run: |
-          # Generate xmake.lua if not present
-          if [ ! -f xmake.lua ]; then
-            cat > xmake.lua << 'EOF'
-          add_rules("mode.release")
-          set_languages("c++23")
-
-          package("cmdline")
-              set_homepage("https://github.com/mcpplibs/cmdline")
-              set_description("Modern C++ command-line parsing library")
-              set_license("Apache-2.0")
-              add_urls("https://github.com/mcpplibs/cmdline/archive/refs/tags/$(version).tar.gz")
-              add_versions("0.0.1", "3fb2f5495c1a144485b3cbb2e43e27059151633460f702af0f3851cbff387ef0")
-              on_install(function (package)
-                  import("package.tools.xmake").install(package)
-              end)
-          package_end()
-
-          add_requires("cmdline 0.0.1")
-
-          target("mcpp")
-              set_kind("binary")
-              add_files("src/main.cpp")
-              add_files("src/**.cppm")
-              -- `modules/` holds packages mcpp links into itself. This
-              -- bootstrap has no package manager, so it compiles their sources
-              -- directly.
-              add_files("modules/*/src/**.cppm")
-              add_packages("cmdline")
-              add_includedirs("modules/libs/src/json")
-              set_policy("build.c++.modules", true)
-              -- Static link libc++ for minimal runtime dependencies
-              add_ldflags("-static-libstdc++", {force = true})
-              add_cxxflags("-stdlib=libc++", {force = true})
-              add_ldflags("-stdlib=libc++", {force = true})
-          EOF
-          fi
-
-          # Configure with xlings LLVM
-          xmake f -y -m release --toolchain=llvm --sdk="$LLVM_ROOT"
-          # Build
-          xmake build -y mcpp
-
-      - name: Verify built binary
-        run: |
-          MCPP=$(find build -name mcpp -type f -perm +111 | head -1)
-          test -x "$MCPP"
-          echo "=== file ==="
-          file "$MCPP"
-          echo "=== otool -L (dynamic deps) ==="
-          otool -L "$MCPP"
-          echo "=== version ==="
-          "$MCPP" --version
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-
-      - name: Package
-        id: package
-        run: |
-          VERSION=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-          TARBALL="mcpp-${VERSION}-macosx-arm64.tar.gz"
-          WRAPPER="mcpp-${VERSION}-macosx-arm64"
-
-          mkdir -p "dist/$WRAPPER/bin"
-          cp "$MCPP" "dist/$WRAPPER/bin/mcpp"
-          strip "dist/$WRAPPER/bin/mcpp" 2>/dev/null || true
-          cp LICENSE "dist/$WRAPPER/" 2>/dev/null || true
-          cp README.md "dist/$WRAPPER/" 2>/dev/null || true
-
-          cat > "dist/$WRAPPER/mcpp" << 'LAUNCHER'
-          #!/bin/sh
-          exec "$(dirname "$0")/bin/mcpp" "$@"
-          LAUNCHER
-          chmod +x "dist/$WRAPPER/mcpp"
-
-          # Bundle xlings
-          XLINGS_BIN="$HOME/.xlings/subos/default/bin/xlings"
-          if [ -x "$XLINGS_BIN" ]; then
-            mkdir -p "dist/$WRAPPER/registry/bin"
-            cp "$XLINGS_BIN" "dist/$WRAPPER/registry/bin/xlings"
-          fi
-
-          (cd dist && tar -czf "$TARBALL" "$WRAPPER")
-          (cd dist && shasum -a 256 "$TARBALL" > "$TARBALL.sha256")
-
-          echo "tarball=dist/$TARBALL" >> "$GITHUB_OUTPUT"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          ls -la dist/
-
-      - name: Smoke test
-        run: |
-          SMOKE=$(mktemp -d)
-          tar -xzf "${{ steps.package.outputs.tarball }}" -C "$SMOKE"
-          VERSION="${{ steps.package.outputs.version }}"
-          "$SMOKE/mcpp-${VERSION}-macosx-arm64/bin/mcpp" --version
-          "$SMOKE/mcpp-${VERSION}-macosx-arm64/mcpp" --version
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: mcpp-macosx-arm64
-          path: |
-            dist/mcpp-*-macosx-arm64.tar.gz
-            dist/mcpp-*-macosx-arm64.tar.gz.sha256
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index f7eddce0d..000000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,126 +0,0 @@
-name: build
-
-# ONE BUILD OF THIS COMMIT'S MCPP PER HOST (rule R1 of
-# .agents/docs/2026-10-02-pr-ci-acceleration-and-the-toolchain-specification-design.md).
-#
-# Called by ci.yml once per host. The binary is uploaded as the artifact
-# `mcpp-built-<host>`, and every job of the commit that needs this commit's mcpp
-# takes it with .github/actions/use-built-mcpp instead of building its own.
-# Measured before this workflow existed (2026-10-01): thirty to thirty-seven
-# jobs per commit built mcpp from source, which was 44 to 49 percent of the
-# commit's runner minutes, and none of those builds was incremental.
-#
-# This job is also the ONE WRITER of the host's sandbox and xlings caches (rule
-# R3), and it writes them only on a push to main. Before it saves, it installs
-# the toolchains its consumers need, so that the cache a pull request restores
-# already holds them.
-
-on:
-  workflow_call:
-    inputs:
-      host:
-        description: linux-x86_64, linux-aarch64, macos-arm64 or windows-x86_64
-        type: string
-        required: true
-      runs-on:
-        description: the runner label
-        type: string
-        required: true
-      prewarm:
-        description: >
-          Toolchains installed before the caches are saved on main, separated
-          by ';', each as `mcpp toolchain install` takes it (`gcc 16.1.0-musl`).
-        type: string
-        required: false
-        default: ''
-
-jobs:
-  build:
-    name: build mcpp (${{ inputs.host }})
-    runs-on: ${{ inputs.runs-on }}
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-
-      - id: boot
-        if: ${{ !startsWith(inputs.host, 'macos-') }}
-        uses: ./.github/actions/bootstrap-mcpp
-
-      - id: mac
-        if: ${{ startsWith(inputs.host, 'macos-') }}
-        uses: ./.github/actions/setup-macos-llvm
-        with:
-          image: ${{ inputs.runs-on }}
-
-      - name: Build mcpp from source (self-host)
-        shell: bash
-        run: |
-          set -euo pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$XLINGS_BIN" config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          # --strict: a key this bootstrap mcpp does not know is an error, not
-          # a warning. A bootstrap older than the manifest used to drop such a
-          # key and build something else, and still exit 0 (2026.9.24.1 and
-          # `[test] windows_code_page`): the moment `.xlings.json` must move is
-          # the moment this fails.
-          "$MCPP" build --strict
-          # target/ is not restored from a cache, so the tree holds exactly the
-          # binary this build linked.
-          case "${{ inputs.host }}" in windows-*) exe=mcpp.exe ;; *) exe=mcpp ;; esac
-          built=$(find target -type f -name "$exe" -path '*/bin/*' | grep -v '/dist/' || true)
-          [ "$(printf '%s\n' "$built" | grep -c .)" = 1 ] || {
-            echo "::error::expected one $exe under target/, found: ${built:-none}"; exit 1; }
-          mkdir -p dist
-          cp "$built" "dist/$exe"
-          "dist/$exe" --version
-
-      - name: Upload this commit's mcpp
-        timeout-minutes: 5
-        uses: actions/upload-artifact@v4
-        with:
-          name: mcpp-built-${{ inputs.host }}
-          path: dist/${{ startsWith(inputs.host, 'windows-') && 'mcpp.exe' || 'mcpp' }}
-          if-no-files-found: error
-          retention-days: 3
-
-      # Only on main, and only for the caches this job restored: a pull request
-      # reads the main lineage and adds nothing to the store.
-      - name: Install the toolchains the consumers use
-        if: ${{ github.event_name == 'push' && inputs.prewarm != '' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          IFS=';' read -ra specs <<< "${{ inputs.prewarm }}"
-          for spec in "${specs[@]}"; do
-            spec="$(echo "$spec" | xargs)"
-            [ -n "$spec" ] || continue
-            echo "::group::mcpp toolchain install $spec"
-            # shellcheck disable=SC2086 -- a spec is `<name> <version>`
-            "$MCPP" toolchain install $spec
-            echo "::endgroup::"
-          done
-
-      - name: Save the sandbox cache
-        if: ${{ github.event_name == 'push' && steps.boot.outcome == 'success' && steps.boot.outputs.sandbox-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.mcpp
-          key: ${{ steps.boot.outputs.sandbox-key }}
-
-      - name: Save the xlings cache
-        if: ${{ github.event_name == 'push' && steps.boot.outcome == 'success' && steps.boot.outputs.xlings-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.xlings
-          key: ${{ steps.boot.outputs.xlings-key }}
-
-      # macOS keeps no sandbox cache: setup-macos-llvm builds the sandbox from
-      # the freshly resolved LLVM on every run, which is what the macOS jobs
-      # exist to prove. Its xlings cache has this job as its writer.
-      - name: Save the xlings cache (macOS)
-        if: ${{ github.event_name == 'push' && steps.mac.outcome == 'success' && steps.mac.outputs.xlings-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.xlings
-          key: ${{ steps.mac.outputs.xlings-key }}
diff --git a/.github/workflows/ci-aarch64-fresh-install.yml b/.github/workflows/ci-aarch64-fresh-install.yml
deleted file mode 100644
index d72b44e27..000000000
--- a/.github/workflows/ci-aarch64-fresh-install.yml
+++ /dev/null
@@ -1,402 +0,0 @@
-name: ci-aarch64-fresh-install
-
-# End-to-end "fresh install" of the whole ecosystem on a NATIVE aarch64 host,
-# exactly as a new aarch64-Linux / Termux(-proot) user would:
-#
-#   curl quick_install.sh | bash     -> installs aarch64 xlings (static musl)
-#   xlings install mcpp              -> installs aarch64 mcpp (static musl)
-#   mcpp new / build / run           -> NATIVE aarch64 build (pulls the native
-#                                       musl-gcc toolchain from the ecosystem)
-#
-# Validates that every published aarch64 asset (xlings, mcpp, musl-gcc) lines
-# up and that mcpp can build & run a real `import std` program natively on
-# aarch64 — no cross, no qemu. Runs on GitHub's native ARM64 runner.
-
-on:
-  workflow_dispatch:
-    inputs:
-      xim_pkgindex_ref:
-        description: 'Candidate xim-pkgindex SHA or branch; empty runs ordinary released fresh-install'
-        type: string
-        required: false
-        default: ''
-      mcpp_run_id:
-        description: 'CI run with a successful native build of exactly this dispatched mcpp head'
-        type: string
-        required: false
-        default: ''
-  schedule:
-    - cron: '0 6 * * 1'   # weekly Mon 06:00 UTC
-  pull_request:
-    branches: [ main ]
-    paths:
-      - 'src/build/build_program.cppm'
-      - 'modules/platform/src/process.cppm'
-      - 'tests/e2e/168_build_mcpp_musl_host_static.sh'
-      - '.github/workflows/ci-aarch64-fresh-install.yml'
-  push:
-    branches: [ main ]
-    paths:
-      - '.github/workflows/ci-aarch64-fresh-install.yml'
-
-permissions:
-  contents: read
-  actions: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  fresh-install:
-    if: github.event_name != 'workflow_dispatch' || inputs.xim_pkgindex_ref == ''
-    name: fresh install + native build (aarch64 / glibc)
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 60
-    env:
-      # Verbose every mcpp invocation — cold bootstrap path (src/cli.cppm).
-      MCPP_VERBOSE: "1"
-    steps:
-      # NB: the checkout deliberately comes LAST, after every fresh-install
-      # step below — see the comment above it.
-      - name: System info
-        run: |
-          uname -a
-          echo "arch: $(uname -m)"   # aarch64 on this runner
-
-      - name: Fresh-install xlings (curl | bash)
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash
-          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
-          echo "$HOME/.xlings/bin" >> "$GITHUB_PATH"
-
-      - name: Verify xlings + GLOBAL mirror
-        run: |
-          xlings --version
-          xlings config --mirror GLOBAL 2>/dev/null || true
-          xlings update -y 2>/dev/null || xlings update 2>/dev/null || true
-
-      - name: Fresh-install mcpp via xlings
-        run: |
-          xlings install mcpp -y
-          mcpp --version
-          mcpp self config --mirror GLOBAL 2>/dev/null || true
-
-      - name: Refresh mcpp package index (force latest xim-pkgindex)
-        run: |
-          # mcpp seeds a baseline index with a freshness TTL marker, so a plain
-          # `index update` can no-op within the window. Force the latest index
-          # so this run validates the native build against current packages.
-          mcpp index update || true
-          idx="$HOME/.mcpp/registry/data/xim-pkgindex"
-          rm -rf "$idx"
-          # A bare `git clone` here fails the whole job on a runner DNS
-          # hiccup. The policy lives in .github/tools/git_clone_retry.sh —
-          # but this job checks the repository out LAST ON PURPOSE (a
-          # `.xlings.json` in the workspace re-points where `xlings install`
-          # writes, so an early checkout silently changes what the
-          # fresh-install steps above are testing). The helper therefore does
-          # not exist on disk yet, and the retry is spelled inline. Same
-          # policy: retry every failure, bounded, git's own message survives.
-          clone_retry() {
-            local rc dest="${@: -1}"
-            for i in 1 2 3 4; do
-              rc=0; git clone "$@" || rc=$?
-              [ "$rc" = 0 ] && return 0
-              [ "$i" = 4 ] && return "$rc"
-              [ -e "$dest" ] && rm -rf -- "$dest"
-              echo "clone_retry: attempt $i failed (exit $rc); retrying" >&2
-              sleep $((i * 5))
-            done
-          }
-          clone_retry --depth 1 https://github.com/openxlings/xim-pkgindex "$idx"
-          grep -n "skipping relocation\|os.isfile(path.join(bindir" "$idx/pkgs/m/musl-gcc.lua" | head -2 || true
-
-      - name: Native build + run an `import std` program
-        run: |
-          work=$(mktemp -d); cd "$work"
-          mcpp new hello
-          cd hello
-          # default src uses import std (C++23)
-          mcpp build
-          out=$(mcpp run 2>/dev/null || true)
-          echo "program output: $out"
-          bin=$(find target -type f -path '*/bin/hello' | head -1)
-          file "$bin"
-          file "$bin" | grep -q "ARM aarch64" || { echo "expected aarch64 ELF"; exit 1; }
-
-      - name: Self-host — build mcpp + xlings from source natively
-        run: |
-          # mcpp/xlings manifests pin a glibc default toolchain; on aarch64 the
-          # musl-static target is the published path, so build with --target.
-          #
-          # On a pull_request, self-host the code UNDER REVIEW rather than
-          # upstream main. Cloning main meant this gate never saw the PR at
-          # all: a change that breaks the from-source build passed here and
-          # only failed after merge, and — the way this surfaced — a fix to
-          # the repo's own bootstrap pin was untestable, because the fix was
-          # on the branch while the clone was of main. Outside a PR there is
-          # no head ref and main is exactly right.
-          ref='${{ github.event.pull_request.head.sha }}'
-          repo='${{ github.event.pull_request.head.repo.clone_url }}'
-          [ -n "$ref" ]  || ref='${{ github.sha }}'
-          [ -n "$repo" ] || repo='https://github.com/mcpp-community/mcpp'
-          # fetch-by-sha rather than `clone --depth 1`, which cannot take one.
-          git init -q /tmp/mcpp-src
-          cd /tmp/mcpp-src
-          git remote add origin "$repo"
-          git fetch -q --depth 1 origin "$ref"
-          git checkout -q FETCH_HEAD
-          echo "self-hosting $repo @ $ref"
-          # The clone's .xlings.json declares `workspace.mcpp` — the BOOTSTRAP
-          # pin, hand-maintained and deliberately lagging the newest release.
-          # It is scoped to the working directory and beats anything installed,
-          # so every `mcpp` below resolved the bootstrap version, which the
-          # fresh-install steps above never installed:
-          #
-          #     [error] xlings: version '2026.8.6.2' not found for 'mcpp'
-          #     [error]   available: 2026.8.8.2
-          #
-          # "newest release != bootstrap pin" is the NORMAL state, so this step
-          # failed on every run from the moment the two diverged — and it is
-          # weekly, so nothing pointed at it. This step tests the freshly
-          # installed RELEASED binary against a source tree; the bootstrap pin
-          # has no standing in that question. install_released_mcpp.sh removes
-          # it for exactly this reason on the x86_64 legs (its point 1); this
-          # leg was written separately and never got it.
-          rm -f .xlings.json
-          mcpp self config --mirror GLOBAL 2>/dev/null || true
-          mcpp build --target aarch64-linux-musl
-          # Absolute: it is used again after `cd /tmp/xlings-src` below.
-          m=$(find "$PWD/target/aarch64-linux-musl" -type f -path '*/bin/mcpp' | head -1)
-          file "$m" | grep -q "ARM aarch64" || { echo "expected aarch64 mcpp"; exit 1; }
-          "$m" --version
-          # MCPP_HOME must be carried over explicitly: mcpp derives it from the
-          # BINARY's location, so a binary sitting in /tmp/mcpp-src/target would
-          # otherwise adopt an empty home and re-bootstrap the whole ecosystem
-          # instead of reusing what the fresh-install steps above provisioned.
-          #
-          # Resolved HERE, before the cd below, and that placement is load-
-          # bearing: `mcpp` is the shim, so it obeys whatever workspace pin the
-          # CURRENT DIRECTORY carries — and the xlings checkout declares one too
-          # (`workspace.mcpp = 2026.8.6.1`, its own bootstrap). Run from there,
-          # this resolves a version nothing installed, MCPP_HOME comes back
-          # empty, and the step dies on the guard below instead of on the real
-          # cause. /tmp/mcpp-src has had its pin removed above, so ask from here.
-          export MCPP_HOME=$(mcpp self env | awk -F'= *' '/^MCPP_HOME/{print $2; exit}')
-          echo "reusing MCPP_HOME=$MCPP_HOME"
-          test -d "$MCPP_HOME" || { echo "could not determine MCPP_HOME"; exit 1; }
-          # Same inline retry as the index clone above, and for the same
-          # reason — the checkout that would provide the shared helper is
-          # deliberately the last step in this job.
-          clone_retry() {
-            local rc dest="${@: -1}"
-            for i in 1 2 3 4; do
-              rc=0; git clone "$@" || rc=$?
-              [ "$rc" = 0 ] && return 0
-              [ "$i" = 4 ] && return "$rc"
-              [ -e "$dest" ] && rm -rf -- "$dest"
-              echo "clone_retry: attempt $i failed (exit $rc); retrying" >&2
-              sleep $((i * 5))
-            done
-          }
-          clone_retry --depth 1 https://github.com/openxlings/xlings /tmp/xlings-src
-          cd /tmp/xlings-src
-          # "$m", not `mcpp`: the just-built binary is the code under review,
-          # and building xlings with the INSTALLED one meant this half of the
-          # gate never saw the PR — the same defect the clone-ref comment above
-          # records, one line further down. It surfaced the same way: a fix for
-          # an aarch64-only failure in exactly this build could not be
-          # validated here, because the binary running it predated the fix.
-          "$m" build --target aarch64-linux-musl
-          x=$(find target/aarch64-linux-musl -type f -path '*/bin/xlings' | head -1)
-          file "$x" | grep -q "ARM aarch64" || { echo "expected aarch64 xlings"; exit 1; }
-          "$x" --version
-
-      # ── PR regression gate ────────────────────────────────────────────────
-      # Everything above is the fresh-install charter: it must run exactly as a
-      # new user's machine does. Check out only NOW — this repo's .xlings.json
-      # declares an `mcpp` WORKSPACE pin, so with the checkout present in
-      # $GITHUB_WORKSPACE `xlings install mcpp` installs workspace-scoped
-      # instead of globally: the steps above would silently validate the pinned
-      # version rather than the freshly published one, and bare `mcpp` stops
-      # resolving anywhere outside the workspace.
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      # The PR's own source, then the musl host-helper regression against it.
-      # This is the only runner where a musl toolchain is the NATIVE one, so it
-      # is the only place #295 can actually be reproduced.
-      - name: Build current mcpp source for native regression tests
-        run: |
-          # Third site of the same pin, and the reason to remove it here too:
-          # this job installs `xlings install mcpp` (bare = latest) and NOTHING
-          # else, so the bootstrap version the checkout pins is never on this
-          # runner. Obeying the pin here does not select an older builder — it
-          # selects one that does not exist. Same removal as the self-host step
-          # above, same reason as install_released_mcpp.sh point 1.
-          rm -f .xlings.json
-          mcpp build --target aarch64-linux-musl
-          self=$(find target/aarch64-linux-musl -type f -path '*/bin/mcpp' | head -1)
-          test -x "$self"
-          self=$(realpath "$self")
-          "$self" --version
-          echo "MCPP_SELF=$self" >> "$GITHUB_ENV"
-
-      - name: "Regression: build.mcpp host helper is self-contained (#295)"
-        run: MCPP="$MCPP_SELF" bash tests/e2e/168_build_mcpp_musl_host_static.sh
-
-  candidate-admission:
-    name: candidate index + current mcpp native admission
-    if: github.event_name == 'workflow_dispatch' && inputs.xim_pkgindex_ref != ''
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 90
-    defaults:
-      run:
-        shell: bash
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-      MCPP_E2E_MIRROR: GLOBAL
-      MCPP_NATIVE_XIM_INDEX: ${{ github.workspace }}/_candidate-xim
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
-        with:
-          repository: openxlings/xim-pkgindex
-          ref: ${{ inputs.xim_pkgindex_ref }}
-          path: _candidate-xim
-      - name: Candidate admission contracts
-        run: |
-          echo "MCPP_NATIVE_REPORT_DIR=$RUNNER_TEMP/native-llvm-arm64" >> "$GITHUB_ENV"
-          python3 tests/scripts/test_native_candidate_admission.py
-      - name: Verify and download this head's successful native mcpp build
-        env:
-          GH_TOKEN: ${{ github.token }}
-          MCPP_SOURCE_RUN: ${{ inputs.mcpp_run_id }}
-        run: python3 .github/tools/download_native_admission_mcpp.py "$MCPP_SOURCE_RUN" "$RUNNER_TEMP/mcpp-built"
-      - uses: ./.github/actions/bootstrap-mcpp
-      - name: Seed the candidate index before installing the native runtime
-        run: |
-          set -euo pipefail
-          mkdir -p "$MCPP_NATIVE_REPORT_DIR"
-          git -C "$MCPP_NATIVE_XIM_INDEX" rev-parse HEAD | tee "$MCPP_NATIVE_REPORT_DIR/xim-commit.txt"
-          printf '%s\n' "$GITHUB_SHA" > "$MCPP_NATIVE_REPORT_DIR/mcpp-commit.txt"
-          python3 .github/tools/seed_native_xim_index.py "$HOME/.mcpp" "$MCPP_NATIVE_XIM_INDEX"
-          echo "MCPP_HOME=$HOME/.mcpp" >> "$GITHUB_ENV"
-          "$XLINGS_BIN" --version
-      - name: Use this head's mcpp against the candidate runtime
-        run: bash .github/actions/use-built-mcpp/use.sh linux-aarch64 GLOBAL
-      - name: Install, build, run and pack the native GNU default with candidate recipes
-        env:
-          MCPP: ${{ env.MCPP_FRESH }}
-        run: |
-          set -euo pipefail
-          bash .github/tools/check_aarch64_llvm_payload.sh 2>&1 | tee "$RUNNER_TEMP/native-llvm-arm64/admission.log"
-          grep -qF 'PASS: native ARM64 LLVM installs, builds and runs' "$RUNNER_TEMP/native-llvm-arm64/admission.log"
-      - name: GNU self-host with LLVM 23.1.3 on native ARM64
-        run: |
-          set -euo pipefail
-          python3 .github/tools/seed_native_xim_index.py --verify "$MCPP_HOME" "$MCPP_NATIVE_XIM_INDEX"
-          marker="$MCPP_NATIVE_REPORT_DIR/gnu-build-start"
-          touch "$marker"
-          "$MCPP_FRESH" build --toolchain llvm@23.1.3 --target aarch64-linux-gnu 2>&1 | tee "$MCPP_NATIVE_REPORT_DIR/gnu-selfhost.log"
-          mapfile -t binaries < <(find "$GITHUB_WORKSPACE/target/aarch64-linux-gnu" -type f -path '*/bin/mcpp' -newer "$marker")
-          [ "${#binaries[@]}" = 1 ] || { echo "expected one newly built GNU mcpp, found ${#binaries[@]}"; exit 1; }
-          gnu=$(realpath "${binaries[0]}")
-          readelf -hW "$gnu" | tee "$MCPP_NATIVE_REPORT_DIR/gnu-mcpp-header.txt"
-          grep -q 'Machine:.*AArch64' "$MCPP_NATIVE_REPORT_DIR/gnu-mcpp-header.txt"
-          readelf -lW "$gnu" | tee "$MCPP_NATIVE_REPORT_DIR/gnu-mcpp-program-headers.txt"
-          python3 - "$MCPP_HOME" "$MCPP_NATIVE_REPORT_DIR/gnu-mcpp-program-headers.txt" <<'PY'
-          import pathlib, re, sys
-          home = pathlib.Path(sys.argv[1]).resolve()
-          text = pathlib.Path(sys.argv[2]).read_text()
-          match = re.search(r'Requesting program interpreter: ([^\]]+)', text)
-          assert match, text
-          loader = pathlib.Path(match.group(1)).resolve()
-          loader.relative_to(home / 'registry/data/xpkgs/xim-x-glibc')
-          assert loader.name == 'ld-linux-aarch64.so.1', loader
-          PY
-          "$gnu" --version | tee "$MCPP_NATIVE_REPORT_DIR/gnu-mcpp-version.txt"
-          printf '%s\n' "$gnu" > "$MCPP_NATIVE_REPORT_DIR/gnu-mcpp-binary.txt"
-          echo "MCPP_NATIVE_GNU=$gnu" >> "$GITHUB_ENV"
-      - name: The GNU self-host runs the complete native unit and integration suite
-        run: |
-          set -euo pipefail
-          "$MCPP_NATIVE_GNU" test --toolchain llvm@23.1.3 --target aarch64-linux-gnu 2>&1 | tee "$MCPP_NATIVE_REPORT_DIR/gnu-tests.log"
-      - name: Preserve native ELF and link evidence when the suite fails
-        if: failure()
-        run: |
-          set -euo pipefail
-          evidence="$MCPP_NATIVE_REPORT_DIR/native-link-evidence"
-          mkdir -p "$evidence"
-          while IFS= read -r -d '' binary; do
-            relative="${binary#target/}"
-            mkdir -p "$evidence/$(dirname "$relative")"
-            cp "$binary" "$evidence/$relative"
-            readelf -aW "$binary" > "$evidence/$relative.readelf.txt"
-          done < <(find target/aarch64-linux-gnu -type f -path '*/bin/unit/test_elf_runtime' -print0)
-          while IFS= read -r -d '' plan; do
-            relative="${plan#target/}"
-            mkdir -p "$evidence/$(dirname "$relative")"
-            cp "$plan" "$evidence/$relative"
-          done < <(find target/aarch64-linux-gnu -type f -name build.ninja -print0)
-      - name: GNU mcpp builds the LLVM path host helper (804 LLVM case only)
-        env:
-          MCPP: ${{ env.MCPP_NATIVE_GNU }}
-          MCPP_E2E_804_LLVM_HOST_ONLY: '1'
-        run: |
-          set -euo pipefail
-          bash tests/e2e/804_a_path_host_tool_builds_with_its_chosen_toolchain.sh 2>&1 | tee "$MCPP_NATIVE_REPORT_DIR/gnu-llvm-host-helper.log"
-          grep -qF 'PASS: 804 native LLVM path host helper (LLVM case only)' "$MCPP_NATIVE_REPORT_DIR/gnu-llvm-host-helper.log"
-      - uses: actions/checkout@v4
-        with:
-          repository: mcpp-community/mcpp-index
-          ref: main
-          path: _native-mcpp-index
-      - name: Four real index members consume the native LLVM GNU ecosystem
-        run: |
-          set -euo pipefail
-          git -C _native-mcpp-index rev-parse HEAD | tee "$MCPP_NATIVE_REPORT_DIR/mcpp-index-commit.txt"
-          python3 .github/tools/seed_native_xim_index.py --verify "$MCPP_HOME" "$MCPP_NATIVE_XIM_INDEX"
-          adapter="$RUNNER_TEMP/mcpp-llvm-gnu-consumer"
-          cat > "$adapter" <<'SH'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          case "${1:-}" in
-            build|test|run) set -- "$@" --toolchain llvm@23.1.3 --target aarch64-linux-gnu ;;
-          esac
-          { printf 'GNU consumer argv:'; printf ' %q' "$@"; printf '\n'; } >> "$MCPP_NATIVE_REPORT_DIR/index-consumer-argv.log"
-          exec "$MCPP_NATIVE_GNU" "$@"
-          SH
-          chmod +x "$adapter"
-          cd _native-mcpp-index
-          MCPP="$adapter" MCPP_VERBOSE=1 MCPP_TIMINGS="$MCPP_NATIVE_REPORT_DIR/index-members.tsv" \
-            bash tests/run_members.sh cjson sqlite3 fmtlib.fmt nlohmann.json 2>&1 | tee "$MCPP_NATIVE_REPORT_DIR/index-members.log"
-          python3 - "$MCPP_NATIVE_REPORT_DIR/index-members.tsv" <<'PY'
-          import pathlib, sys
-          rows = [line.split('\t') for line in pathlib.Path(sys.argv[1]).read_text().splitlines()]
-          assert len(rows) == 4, rows
-          assert {row[1] for row in rows} == {'cjson', 'sqlite3', 'fmtlib.fmt', 'nlohmann.json'}, rows
-          assert all(row[2] == 'ok' for row in rows), rows
-          PY
-      - name: The real openkal stack runs as native ARM64 without skipping
-        env:
-          MCPP: ${{ env.MCPP_NATIVE_GNU }}
-          MCPP_E2E_EXPECT_ARCH: aarch64
-        run: |
-          set -euo pipefail
-          export MCPP_OPENKAL_INDEX="$GITHUB_WORKSPACE/_native-mcpp-index"
-          bash tests/e2e/286_the_openkal_stack_still_builds.sh 2>&1 | tee "$RUNNER_TEMP/native-llvm-arm64/openkal.log"
-          ! grep -q '^SKIP:' "$RUNNER_TEMP/native-llvm-arm64/openkal.log"
-          grep -qF 'OK: the openkal stack builds, links statically and runs' "$RUNNER_TEMP/native-llvm-arm64/openkal.log"
-          grep -qxF 'openkal hosted threads: isolation, destructors and concurrent unwind ok' "$RUNNER_TEMP/native-llvm-arm64/openkal.log"
-          grep -qxF 'openkal indexed JSON: dump, parse, literals and ordered_json ok' "$RUNNER_TEMP/native-llvm-arm64/openkal.log"
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: candidate-native-ecosystem-admission
-          path: ${{ runner.temp }}/native-llvm-arm64
-          if-no-files-found: warn
diff --git a/.github/workflows/ci-arm64-published-cn.yml b/.github/workflows/ci-arm64-published-cn.yml
deleted file mode 100644
index 59c036051..000000000
--- a/.github/workflows/ci-arm64-published-cn.yml
+++ /dev/null
@@ -1,127 +0,0 @@
-name: released ARM64 CN SubOS ecosystem
-on:
-  workflow_dispatch:
-    inputs:
-      release_version:
-        description: Exact published mcpp version (without v)
-        required: true
-        type: string
-      sandbox_backend:
-        description: Native distro backend used only as CI isolation infrastructure
-        required: true
-        type: choice
-        default: proot
-        options: [proot, bwrap]
-permissions:
-  contents: read
-concurrency:
-  group: released-arm64-cn-${{ inputs.release_version }}
-  cancel-in-progress: false
-jobs:
-  consume:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 90
-    env:
-      RELEASE_VERSION: ${{ inputs.release_version }}
-      SANDBOX_BACKEND: ${{ inputs.sandbox_backend }}
-      GH_TOKEN: ${{ github.token }}
-      XLINGS_NON_INTERACTIVE: '1'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Initialize the cold runtime home
-        run: echo "XLINGS_HOME=$RUNNER_TEMP/arm64-published-cn" >> "$GITHUB_ENV"
-      - name: Native distro sandbox infrastructure (not an ARM xim package)
-        run: |
-          set -euo pipefail
-          test "$(uname -m)" = aarch64
-          sudo apt-get update
-          backend_package="$SANDBOX_BACKEND"
-          [ "$SANDBOX_BACKEND" != bwrap ] || backend_package=bubblewrap
-          sudo apt-get install -y "$backend_package"
-          dpkg-query -W "$backend_package"
-      - name: Exact public CN release in a cold real SubOS
-        run: bash .github/tools/run_published_arm64_cn.sh "$RELEASE_VERSION" "$GITHUB_WORKSPACE" "$SANDBOX_BACKEND"
-      - uses: actions/upload-artifact@v4
-        with:
-          name: published-cn-arm64-openkal-targets
-          path: ${{ env.CN_CROSS_ARTIFACTS }}
-          if-no-files-found: error
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: published-cn-arm64-consumer-evidence
-          path: |
-            ${{ env.XLINGS_HOME }}/reports/*.json
-            ${{ env.XLINGS_HOME }}/reports/*.txt
-            ${{ env.XLINGS_HOME }}/reports/*.sha256
-            ${{ env.XLINGS_HOME }}/probes/runs/*/probe.log
-            ${{ env.XLINGS_HOME }}/probes/runs/*/*.txt
-            ${{ env.XLINGS_HOME }}/probes/runs/*/*.sha256
-            ${{ env.XLINGS_HOME }}/probes/runs/*/*.log
-            ${{ env.XLINGS_HOME }}/probes/runs/*/members.tsv
-          if-no-files-found: warn
-  target-run:
-    needs: consume
-    name: Run ARM-host CN artifacts on ${{ matrix.system }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - {system: linux, runner: ubuntu-24.04, file: linux}
-          - {system: macos, runner: macos-14, file: macos}
-          - {system: windows, runner: windows-2022, file: windows.exe}
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 10
-    defaults:
-      run:
-        shell: bash
-    steps:
-      # No checkout, compiler, mcpp or runtime install: run these exact bytes.
-      - uses: actions/download-artifact@v4
-        with:
-          name: published-cn-arm64-openkal-targets
-          path: art
-      - name: Validate artifact identity and real target execution
-        env:
-          TARGET_SYSTEM: ${{ matrix.system }}
-          TARGET_FILE: ${{ matrix.file }}
-        run: |
-          set -euo pipefail
-          cd art
-          sha256sum -c SHA256SUMS
-          grep -Eq '^[0-9a-f]{40}$' source-sha.txt
-          grep -Eq '^[0-9a-f]{40}$' engine-release-sha.txt
-          grep -Eq '^[0-9a-f]{40}$' index-source-sha.txt
-          grep -Eq '^[0-9a-f]{64}$' threads-source-sha256.txt
-          chmod +x "$TARGET_FILE"
-          if [ "$TARGET_SYSTEM" = macos ]; then
-            codesign -dv "$TARGET_FILE" 2>&1 | grep -q 'adhoc\|Signature'
-          fi
-          "./$TARGET_FILE" > output.log 2>&1
-          cat output.log
-          grep -q 'sorted: 2 4 7' output.log
-          grep -q 'caught: 42' output.log
-          grep -q 'unwound: true' output.log
-          grep -q 'import std over openkal: ok' output.log
-          case "$TARGET_SYSTEM" in
-            windows) threads_file=windows-threads.exe ;;
-            *) threads_file="$TARGET_SYSTEM-threads" ;;
-          esac
-          chmod +x "$threads_file"
-          if [ "$TARGET_SYSTEM" = macos ]; then
-            codesign -dv "$threads_file" 2>&1 | grep -q 'adhoc\|Signature'
-          fi
-          "./$threads_file" > threads.log 2>&1
-          cat threads.log
-          grep -qxF 'openkal hosted threads: isolation, destructors and concurrent unwind ok' threads.log
-          grep -qxF 'openkal indexed JSON: dump, parse, literals and ordered_json ok' threads.log
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: published-cn-arm64-target-run-${{ matrix.system }}
-          path: |
-            art/output.log
-            art/threads.log
-          if-no-files-found: warn
diff --git a/.github/workflows/ci-bootstrap.yml b/.github/workflows/ci-bootstrap.yml
deleted file mode 100644
index 811a52f4d..000000000
--- a/.github/workflows/ci-bootstrap.yml
+++ /dev/null
@@ -1,143 +0,0 @@
-name: ci-bootstrap
-
-# Which released mcpp builds this tree, measured the way a developer builds it.
-#
-# `.xlings.json` names the mcpp a clone of this repository builds with: inside
-# the checkout the `mcpp` shim refuses to run any other version
-# ("mcpp@<pin> is the version this project asks for ... set this project up:
-# xlings install"). The pin does not move with every release; it moves when the
-# tree starts to need something the pinned mcpp does not have. Two jobs answer
-# whether that moment has come:
-#
-#   developer  the pinned mcpp, installed by `xlings install` in the checkout
-#              (project scope, no -g) and run through the shim, builds the tree
-#              with --strict, on Linux, macOS and Windows. build.yml builds with
-#              the same version but installs it globally and runs it by path; a
-#              shim or project-scope defect, or a cold runner, is only seen here.
-#   latest     the newest release builds the tree with --strict. It runs only
-#              while the pin lags the newest release; when they are equal the
-#              developer job has already answered.
-#
-# --strict is the assertion. A mcpp older than the manifest warns about a key it
-# does not know, drops it and exits 0 (2026.9.24.1 against
-# `[test] windows_code_page`); under --strict that is an error.
-#
-# No cache, on purpose: the subject is a fresh clone.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  developer:
-    name: the pinned mcpp builds the tree (${{ matrix.os }}, xlings install + mcpp build --strict)
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-24.04, macos-15, windows-2025]
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-      XLINGS_VERSION: '2026.10.16.2'
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install xlings
-        if: runner.os != 'Windows'
-        shell: bash
-        run: |
-          set -euo pipefail
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.10.16.2
-          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
-          echo "$HOME/.xlings/bin" >> "$GITHUB_PATH"
-
-      - name: Install xlings
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          irm https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.ps1 | iex
-          "$env:USERPROFILE\.xlings\subos\current\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-
-      - name: Install the mcpp .xlings.json names, in this project
-        shell: bash
-        run: |
-          set -euo pipefail
-          xlings install -y
-          pin=$(grep -oE '"mcpp"[[:space:]]*:[[:space:]]*"[^"]+"' .xlings.json \
-                | grep -oE '[0-9]+(\.[0-9]+)+' | head -1)
-          got=$(mcpp --version | head -1 | awk '{print $2}' | tr -d '\r')
-          [ -n "$pin" ] && [ "$got" = "$pin" ] || {
-            echo "::error::.xlings.json names mcpp ${pin:-?}; the shim in this checkout runs ${got:-nothing}"; exit 1; }
-          echo "the shim runs mcpp $got, the version .xlings.json names"
-
-      - name: Build the tree with it (mcpp build --strict)
-        shell: bash
-        run: |
-          set -euo pipefail
-          mcpp self config --mirror GLOBAL
-          mcpp build --strict
-          case "$RUNNER_OS" in Windows) exe=mcpp.exe ;; *) exe=mcpp ;; esac
-          built=$(find target -type f -name "$exe" -path '*/bin/*' | grep -v '/dist/' || true)
-          [ "$(printf '%s\n' "$built" | grep -c .)" = 1 ] || {
-            echo "::error::expected one $exe under target/, found: ${built:-none}"; exit 1; }
-          want=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-          got=$("$built" --version | head -1 | tr -d '\r')
-          [ "$got" = "mcpp $want" ] || {
-            echo "::error::the built binary says '$got', mcpp.toml says $want"; exit 1; }
-          echo "built $got"
-
-  latest:
-    name: the newest release builds the tree (linux, when the pin lags it)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Compare the pin with the newest release
-        id: cmp
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          pin=$(grep -oE '"mcpp"[[:space:]]*:[[:space:]]*"[^"]+"' .xlings.json \
-                | grep -oE '[0-9]+(\.[0-9]+)+' | head -1)
-          latest=$(gh api "repos/${{ github.repository }}/releases/latest" --jq .tag_name | sed 's/^v//')
-          [ -n "$pin" ] && [ -n "$latest" ] || {
-            echo "::error::could not read the pin (${pin:-?}) or the newest release (${latest:-?})"; exit 1; }
-          echo "pin=$pin latest=$latest"
-          echo "latest=$latest" >> "$GITHUB_OUTPUT"
-          if [ "$pin" = "$latest" ]; then
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::.xlings.json names the newest release ($latest); the developer job covers it"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install xlings
-        if: steps.cmp.outputs.run == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.10.16.2
-          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
-
-      - name: Install the newest release and build the tree with it (mcpp build --strict)
-        if: steps.cmp.outputs.run == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          # Makes the released version the one the shim runs here, over the
-          # checkout's own pin, and asserts it.
-          bash .github/tools/install_released_mcpp.sh "${{ steps.cmp.outputs.latest }}" "$(pwd)"
-          mcpp self config --mirror GLOBAL
-          mcpp build --strict
-          built=$(find target -type f -name mcpp -path '*/bin/*' | grep -v '/dist/' || true)
-          [ "$(printf '%s\n' "$built" | grep -c .)" = 1 ] || {
-            echo "::error::expected one mcpp under target/, found: ${built:-none}"; exit 1; }
-          "$built" --version
diff --git a/.github/workflows/ci-fresh-install.yml b/.github/workflows/ci-fresh-install.yml
deleted file mode 100644
index e27940be7..000000000
--- a/.github/workflows/ci-fresh-install.yml
+++ /dev/null
@@ -1,796 +0,0 @@
-name: ci-fresh-install
-
-# Fresh install CI — validates the released mcpp binary via xlings.
-# Simulates a real first-time user on a clean machine (no caches).
-#
-# For each platform, tests every supported toolchain:
-#   1. mcpp new hello → mcpp run (basic project)
-#   2. mcpp build (build mcpp itself from source)
-#
-# This workflow tests released mcpp, not PR code.
-# It runs on release publish, manual trigger, and daily schedule.
-
-on:
-  # NOTE: `release: published` never fires from the release pipeline — the
-  # release is created by release.yml with GITHUB_TOKEN, and GitHub
-  # suppresses workflow triggers from GITHUB_TOKEN-generated events. Kept
-  # only for releases created manually outside the pipeline. The reliable
-  # post-release hook is `workflow_run` below: a platform-generated event,
-  # exempt from that suppression, and requiring no cross-repo PAT.
-  release:
-    types: [ published ]
-  workflow_run:
-    workflows: [ release ]
-    types: [ completed ]
-  workflow_dispatch:
-  schedule:
-    # Run daily at 06:00 UTC to catch issues from xlings/runner updates
-    - cron: '0 6 * * *'
-
-concurrency:
-  group: ci-fresh-install
-  cancel-in-progress: false # use false to test in PRs, true to only test released mcpp
-
-# The version under test is DERIVED, once, by the resolve-version job below,
-# and every install job consumes that one value.
-#
-# Two things had to hold, and a hardcoded pin only bought the first:
-#
-#  1. It must be an explicit version string. Bare `xlings install mcpp`
-#     resolves "newest in the runner's index copy", so a runner whose copy
-#     lags silently tests an OLDER binary and reports green. Naming the
-#     version makes a lagging index fail loudly with `version not found`.
-#
-#  2. The version the index guard waits for must be the version the jobs
-#     install. On 2026-07-21 they disagreed: the guard reported "index tracks
-#     0.0.102" and the jobs installed 0.0.100 ten seconds later, which then met
-#     an index whose floor was 0.0.101 (#265). The guard already derived the
-#     real answer from the releases API and threw it away.
-#
-# Deriving once and feeding both satisfies (1) and makes (2) structurally
-# impossible, instead of relying on a human to keep two hand-edited numbers in
-# step with a third that moves on its own. `xlings install mcpp@<derived>` is
-# every bit as explicit as `mcpp@<literal>`.
-#
-# NOT to be confused with the .xlings.json workspace pin, which this used to be
-# kept equal to. That one is the BOOTSTRAP compiler for the self-host builds and
-# has a different requirement — it must be a released mcpp that can build the
-# CURRENT source tree — so it stays hand-maintained. See docs/92-release.md.
-
-jobs:
-  # ──────────────────────────────────────────────────────────────────
-  # Linux: gcc@16.1.0, musl-gcc@16.1.0, llvm@23.1.3
-  # ──────────────────────────────────────────────────────────────────
-  # A4: post-release runs race the xim-pkgindex bump (a PR a maintainer
-  # merges asynchronously) — the 0.0.85 fresh-install failed with
-  # "version not found: available 0.0.84" 55s after the bump merged.
-  # Convert the race into a bounded wait: poll the index's mcpp.lua until
-  # it carries the released version (<=15 min), then let every job run.
-  # Non-workflow_run triggers (manual, cron, PR) skip the wait.
-  wait-index:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    timeout-minutes: 20
-    outputs:
-      version: ${{ steps.resolve.outputs.version }}
-    steps:
-      # Derive on EVERY trigger, not just post-release. "The newest published
-      # release" is the version under test whether we got here from the release
-      # pipeline, from cron, or by hand — only the WAIT below is specific to a
-      # post-release run, because only then can the index legitimately lag.
-      - name: Resolve the version under test (newest published release)
-        id: resolve
-        run: |
-          VER=$(curl -fsSL "https://api.github.com/repos/mcpp-community/mcpp/releases/latest" \
-                | python3 -c "import json,sys; print(json.load(sys.stdin)['tag_name'].lstrip('v'))")
-          # A blank version would silently degrade `mcpp@$VER` into bare `mcpp`,
-          # i.e. straight back to "newest in the runner's index copy" — the exact
-          # failure this job exists to prevent. Refuse instead.
-          case "$VER" in
-            ''|*[!0-9.]*) echo "::error::could not resolve a version from the releases API (got '$VER')"; exit 1 ;;
-          esac
-          echo "version=$VER" >> "$GITHUB_OUTPUT"
-          echo "version under test: $VER"
-      - name: Wait for the PUBLISHED index artifact to track the released mcpp
-        if: ${{ github.event_name == 'workflow_run' }}
-        env:
-          VER: ${{ steps.resolve.outputs.version }}
-        run: |
-          # Poll the ARTIFACT, not the git file.
-          #
-          # This used to curl raw.githubusercontent.com/openxlings/xim-pkgindex
-          # — the index's git source of truth, which updates the instant the
-          # bump PR merges. But the jobs install from the PUBLISHED ARTIFACT
-          # (xlings-res/xim-index → pointer → tarball), and that channel lags
-          # git by however long `Publish Index Artifact` plus release-CDN
-          # propagation takes. Measured on the 2026.8.3.5 release: this guard
-          # reported ready, and all 11 jobs then failed with
-          #     [error] package 'mcpp@2026.8.3.5' not found
-          # A guard that measures a channel nobody installs from is not a guard.
-          #
-          # This narrows the window; it cannot close it, because the CDN
-          # propagates per edge and the runner that polls is not the runner
-          # that installs. install_released_mcpp.sh retries from the consumer
-          # side for exactly that residue — this step exists so the retry is
-          # rarely needed, not so it can be removed.
-          echo "released: $VER — waiting for the published index artifact..."
-          for i in $(seq 1 40); do
-            ptr=$(curl -fsSL "https://github.com/xlings-res/xim-index/releases/download/latest/xim-index-latest.json" 2>/dev/null || true)
-            # One line on purpose: an indented heredoc inside a YAML block
-            # scalar is a trap — unindented content silently ends the block.
-            name=$(printf '%s' "$ptr" | python3 -c 'import json,sys; d=json.load(sys.stdin); n=d.get("indexes",{}).get("xim",d); print(n.get("artifact",{}).get("name",""))' 2>/dev/null || true)
-            if [ -n "$name" ] && curl -fsSL \
-                 "https://github.com/xlings-res/xim-index/releases/download/latest/$name" \
-                 | tar -xzO --wildcards '*pkgs/m/mcpp.lua' 2>/dev/null | grep -q "\"$VER\""; then
-              echo "published index artifact ($name) tracks $VER (after $((i*30))s)"; exit 0
-            fi
-            sleep 30
-          done
-          echo "::error::the published index artifact never tracked $VER within 20min — check that the xim-pkgindex bump PR merged AND that Publish Index Artifact ran"
-          exit 1
-      - name: No wait needed (manual/cron trigger)
-        if: ${{ github.event_name != 'workflow_run' }}
-        run: echo "not a post-release run; skipping index wait"
-
-  linux-fresh:
-    needs: [wait-index]
-    name: Linux fresh install
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    env:
-      # The one derived value (see the header comment): every install job names
-      # the SAME version the index guard waited for, so the two cannot disagree.
-      MCPP_PIN: ${{ needs.wait-index.outputs.version }}
-      # Verbose every mcpp invocation — fresh-install is the cold index/sandbox
-      # bootstrap path, exactly where extra diagnostics matter (src/cli.cppm).
-      MCPP_VERBOSE: "1"
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install xlings + mcpp
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.10.16.2
-          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
-
-      - name: Install mcpp and config mirror
-        shell: bash
-        run: |
-          # ONE implementation for "make the released mcpp@X be what `mcpp`
-          # runs, and prove it" — see .github/tools/install_released_mcpp.sh
-          # for the three defects the inline version had (workspace pin, no
-          # activation, and waiting on the wrong index channel).
-          bash .github/tools/install_released_mcpp.sh "${MCPP_PIN}" "$(pwd)"
-          mcpp self config --mirror GLOBAL
-
-          echo "mcpp debug info:"
-          which mcpp
-          cat $HOME/.xlings/.xlings.json
-
-      - name: "Default: mcpp new → run"
-        run: |
-          cd "$(mktemp -d)"
-          mcpp new hello_gcc
-          cd hello_gcc
-          mcpp run
-
-      # Template packages exercise the sha256-pinned mcpp-index fetch
-      # path (user report: `mcpp new ... --template imgui` failed with
-      # fetch 'imgui@0.0.6' exit 1 on hosts without a sha256sum binary).
-      - name: "Template: exact mcpplibs.imgui selector (fetch path)"
-        run: |
-          # The template fetch's own status is the first assertion; without
-          # pipefail `tee` would report success for it (WS7, #729).
-          set -o pipefail
-          cd "$(mktemp -d)"
-          mcpp new abc1 --template mcpplibs.imgui 2>&1 | tee template.log
-          test -f abc1/mcpp.toml
-          grep -F 'namespace=mcpplibs name=imgui' template.log
-
-      - name: "Default: build mcpp"
-        run: |
-          mcpp clean
-          mcpp run
-
-      - name: "musl-gcc: mcpp new → run"
-        run: |
-          mcpp toolchain install gcc 16.1.0-musl
-          mcpp toolchain default gcc@16.1.0-musl
-          cd "$(mktemp -d)"
-          mcpp new hello_musl
-          cd hello_musl
-          mcpp run
-
-      - name: "musl-gcc: build mcpp"
-        run: |
-          mcpp toolchain default gcc@16.1.0-musl
-          mcpp clean
-          mcpp run
-
-      - name: "gcc 16: mcpp new → run"
-        run: |
-          mcpp toolchain install gcc 16.1.0
-          mcpp toolchain default gcc@16.1.0
-          cd "$(mktemp -d)"
-          mcpp new hello_gcc16
-          cd hello_gcc16
-          mcpp run
-
-      - name: "gcc 16: build mcpp"
-        run: |
-          mcpp toolchain default gcc@16.1.0
-          mcpp clean
-          mcpp run
-
-      - name: "LLVM: mcpp new → run"
-        run: |
-          mcpp toolchain install llvm 23.1.3
-          mcpp toolchain default llvm@23.1.3
-          cd "$(mktemp -d)"
-          mcpp new hello_llvm
-          cd hello_llvm
-          mcpp run
-
-      - name: "LLVM: build mcpp"
-        run: |
-          mcpp toolchain default llvm@23.1.3
-          mcpp clean
-          mcpp run
-
-  # ──────────────────────────────────────────────────────────────────
-  # Newer/rolling-glibc distros — reproduction surface for the
-  # bundled-glibc-vs-host-libtinfo `sh:` crash (host glibc > bundled).
-  # Plus older-glibc legs (the safe reverse direction) proving the
-  # musl-static mcpp + self-contained toolchain run end-to-end on old
-  # hosts. Runs the released mcpp inside distro containers.
-  # ──────────────────────────────────────────────────────────────────
-  linux-distro-matrix:
-    needs: [wait-index]
-    name: Linux distro (${{ matrix.distro }})
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-24.04
-    container:
-      image: ${{ matrix.image }}
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        # findutils (find) is mandatory on every leg: quick_install.sh
-        # locates the extracted xlings dir with `find`, so a missing find
-        # fails the install with exit 127 *before* mcpp ever runs. Minimal
-        # images (opensuse/tumbleweed) ship without it; arch's base merely
-        # bundles it by luck. List it explicitly everywhere — don't rely on
-        # the base image.
-        include:
-          - distro: fedora-latest
-            image: fedora:latest
-            setup: dnf -y install curl bash tar gzip xz git findutils binutils file glibc-langpack-en
-          - distro: arch
-            image: archlinux:latest
-            setup: pacman -Sy --noconfirm curl bash tar gzip xz git findutils binutils file
-          - distro: tumbleweed
-            image: opensuse/tumbleweed:latest
-            setup: zypper -n install curl bash tar gzip xz git findutils binutils file
-          - distro: debian-testing
-            image: debian:testing
-            setup: apt-get update && apt-get -y install curl bash tar gzip xz-utils git ca-certificates binutils findutils file
-          - distro: ubuntu-2004
-            image: ubuntu:20.04
-            setup: apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y install curl bash tar gzip xz-utils git ca-certificates binutils findutils file
-          # debian-12 AND NOT debian-11, AND THE REASON IS NOT THE FAILURE.
-          #
-          # The debian-11 leg started failing on 2026-09-11 with
-          #
-          #   E: Release file for .../bullseye-security/InRelease is expired
-          #      (invalid since 3d 5h 32min 52s)
-          #
-          # and `apt-get update` exits 100. Bullseye is end-of-life and its
-          # security suite's metadata has expired, which is a property of the
-          # distribution and not of this workflow -- `-o
-          # Acquire::Check-Valid-Until=false` would silence it and keep a leg
-          # that tests against metadata nobody maintains.
-          #
-          # What was measured while replacing it: debian 11 and ubuntu 20.04
-          # both carry glibc 2.31, so the "older glibc" coverage this leg was
-          # here for was ALREADY DUPLICATED by the ubuntu-2004 leg above, and
-          # dropping bullseye loses nothing. Bookworm's 2.36 sits between that
-          # 2.31 and debian-testing's rolling version, so this leg now covers a
-          # point the matrix did not have.
-          - distro: debian-12
-            image: debian:12
-            setup: apt-get update && apt-get -y install curl bash tar gzip xz-utils git ca-certificates binutils findutils file
-    env:
-      # The one derived value (see the header comment): every install job names
-      # the SAME version the index guard waited for, so the two cannot disagree.
-      MCPP_PIN: ${{ needs.wait-index.outputs.version }}
-      XLINGS_NON_INTERACTIVE: '1'
-      HOME: /root
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install prerequisites (${{ matrix.distro }})
-        run: ${{ matrix.setup }}
-
-      - name: Install xlings + mcpp
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.10.16.2
-          # Deliberately NOT writing to $GITHUB_PATH here. On container
-          # images that declare no PATH in their config (opensuse/
-          # tumbleweed), appending a single dir to GITHUB_PATH makes the
-          # runner exec later steps' `sh` with only that dir on PATH —
-          # `sh` (in /usr/bin) vanishes and the next step dies with
-          # `exec: "sh": ... not found` / exit 127. Each step below already
-          # exports PATH itself, so the append is redundant anyway.
-
-      - name: Configure mcpp
-        shell: bash
-        run: |
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          # ONE implementation for "make the released mcpp@X be what `mcpp`
-          # runs, and prove it" — see .github/tools/install_released_mcpp.sh
-          # for the three defects the inline version had (workspace pin, no
-          # activation, and waiting on the wrong index channel).
-          bash .github/tools/install_released_mcpp.sh "${MCPP_PIN}" "$(pwd)"
-          mcpp self config --mirror GLOBAL
-
-      - name: "Regression: new → run (loader env must not crash /bin/sh)"
-        run: |
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          cd "$(mktemp -d)"
-          mcpp new hello_distro
-          cd hello_distro
-          mcpp run
-
-      - name: "Self-containment: produced binary uses bundled loader"
-        run: |
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          cd "$(mktemp -d)" && mcpp new hc && cd hc && mcpp build
-          bin="$(find target -type f -name hc | head -1)"
-          interp="$(file "$bin" | grep -o 'interpreter [^,]*' | awk '{print $2}')"
-          echo "interp=$interp"
-          case "$interp" in
-            */.mcpp/*|*/registry/*|*xpkgs*) echo "OK bundled loader" ;;
-            *) echo "FAIL host loader: $interp"; exit 1 ;;
-          esac
-
-  # ──────────────────────────────────────────────────────────────────
-  # macOS: llvm@23.1.3
-  # ──────────────────────────────────────────────────────────────────
-  # ──────────────────────────────────────────────────────────────────
-  # Termux (Android): the released tarball, `mcpp new` → `mcpp run` with the
-  # default toolchain (design 2026-10-10 §13, D27). Two halves, because no
-  # runner has a phone: termux-docker on a native arm64 runner is Termux's
-  # bionic userland and aarch64's default toolchain (llvm + the managed glibc);
-  # an Android 14 emulator (x86_64, KVM) is the app sandbox, where SELinux
-  # refuses link(2) and every install of a payload with hard links failed.
-  # The real aarch64 phone is a release check (O11), not a runner.
-  # ──────────────────────────────────────────────────────────────────
-  termux-docker:
-    needs: [wait-index]
-    name: Termux userland (termux-docker aarch64)
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v4
-      - name: "Default: mcpp new → run"
-        run: |
-          V="${{ needs.wait-index.outputs.version }}"
-          bash .github/tools/termux_fresh_install.sh docker \
-            "https://github.com/mcpp-community/mcpp/releases/download/v$V/mcpp-$V-linux-aarch64.tar.gz"
-
-  termux-emulator:
-    needs: [wait-index]
-    name: Termux app sandbox (Android 14 emulator, x86_64)
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v4
-      - name: Enable KVM
-        run: |
-          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-          sudo udevadm control --reload-rules
-          sudo udevadm trigger --name-match=kvm
-      - name: Download Termux and mcpp
-        run: |
-          V="${{ needs.wait-index.outputs.version }}"
-          bash .github/tools/termux_fresh_install.sh emulator-download \
-            "https://github.com/mcpp-community/mcpp/releases/download/v$V/mcpp-$V-linux-x86_64.tar.gz"
-      - name: "Default: mcpp new → run, in the app sandbox"
-        uses: reactivecircus/android-emulator-runner@v2
-        with:
-          api-level: 34
-          arch: x86_64
-          target: google_apis
-          disk-size: 14G
-          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
-          disable-animations: true
-          script: bash .github/tools/termux_fresh_install.sh emulator-run
-
-  macos-fresh:
-    needs: [wait-index]
-    name: macOS fresh install (${{ matrix.image }})
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    # Two images, the two ends of the supported range.
-    #
-    # macos-14: the support floor (mcpp ≥0.0.50 / xlings ≥0.4.50 ship
-    # minos=14.0 static-libc++ binaries). A fresh install passing here
-    # is the continuous proof of the macOS 14 floor — and of host-tool
-    # independence (this image has no sha256sum; macos-15 does).
-    #
-    # xcode-27: macOS 27, the newest release, served under the preview label
-    # `xcode-27` (actions/runner-images#14404; there is no `macos-27` label).
-    # The same released binaries, the same steps; a failure only here is a
-    # change in the newest system (SDK, loader, system libc++ headers) that the
-    # floor cannot show.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: macos-14
-          - image: xcode-27
-    runs-on: ${{ matrix.image }}
-    # While the line was on LLVM 22.1.8 the xcode-27 leg was known red (#669,
-    # the arm64e.x1 .tbd stubs, continue-on-error per the 2026-09-28 WS7
-    # design). The 23.1.3 line move removed the cause, so both images are
-    # plain required legs again.
-    timeout-minutes: 30
-    env:
-      # The one derived value (see the header comment): every install job names
-      # the SAME version the index guard waited for, so the two cannot disagree.
-      MCPP_PIN: ${{ needs.wait-index.outputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: The image is the macOS it names
-        run: |
-          echo "macOS $(sw_vers -productVersion) | $(uname -m)"
-          # See ci-macos.yml: `xcode-27` names an Xcode, not an OS.
-          if [ "${{ matrix.image }}" = xcode-27 ]; then
-            [ "$(sw_vers -productVersion | cut -d. -f1)" = 27 ] || { echo "::error::xcode-27 delivered macOS $(sw_vers -productVersion), not 27"; exit 1; }
-          fi
-
-      - name: Install xlings
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          # Pinned to kXlingsVersion like every other bootstrap (see
-          # .github/tools/check_version_pins.sh). Two floors this image needs,
-          # both long satisfied — do not pin below them:
-          #   v0.4.50+: first xlings whose macosx binary runs on macOS 14
-          #             (older ones carry minos=15 and refuse to start).
-          #   v0.4.51+: in-process sha256 — this image has no sha256sum
-          #             binary, so pinned fetches failed before it.
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.10.16.2
-          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
-
-      - name: Install mcpp and config mirror
-        shell: bash
-        run: |
-          # ONE implementation for "make the released mcpp@X be what `mcpp`
-          # runs, and prove it" — see .github/tools/install_released_mcpp.sh
-          # for the three defects the inline version had (workspace pin, no
-          # activation, and waiting on the wrong index channel).
-          bash .github/tools/install_released_mcpp.sh "${MCPP_PIN}" "$(pwd)"
-          mcpp self config --mirror GLOBAL
-
-          echo "mcpp debug info:"
-          which mcpp
-          cat $HOME/.xlings/.xlings.json
-
-      - name: "LLVM: mcpp new → run"
-        run: |
-          cd "$(mktemp -d)"
-          mcpp new hello_mac
-          cd hello_mac
-          mcpp run
-
-      # Template packages exercise the sha256-pinned mcpp-index fetch
-      # path — this is what broke on hosts without a sha256sum binary
-      # (stock macOS / bare Windows) before xlings 0.4.51 hashed
-      # in-process.
-      - name: "Template: exact mcpplibs.imgui selector (fetch path)"
-        run: |
-          # The template fetch's own status is the first assertion; without
-          # pipefail `tee` would report success for it (WS7, #729).
-          set -o pipefail
-          cd "$(mktemp -d)"
-          mcpp new abc1 --template mcpplibs.imgui 2>&1 | tee template.log
-          test -f abc1/mcpp.toml
-          grep -F 'namespace=mcpplibs name=imgui' template.log
-
-      - name: "LLVM: build mcpp"
-        run: |
-          mcpp clean
-          mcpp run
-
-  # ──────────────────────────────────────────────────────────────────
-  # macOS via HOMEBREW — the other fresh-install channel
-  #
-  # A SEPARATE JOB, not extra steps in macos-fresh: that job already has an
-  # mcpp on PATH from xlings, and a second one from brew would make every
-  # assertion below ambiguous about which binary it measured.
-  #
-  # It also does NOT need `wait-index`. Homebrew installs the GitHub release
-  # tarball directly, and the tap's own bump workflow lags the release by
-  # minutes — asserting the just-released version here would be racy for a
-  # reason that has nothing to do with mcpp. The version assertion is instead
-  # made SELF-CONSISTENT: whatever version the tapped formula declares is the
-  # version the installed binary must report.
-  #
-  # WHAT THIS EXISTS TO CATCH (measured on macOS 14.8.7 / 15.7.7 / 26.5.2,
-  # Homebrew 6.0.5 / 6.0.12 / 6.0.13):
-  #
-  #   Homebrew 6 refuses to load a formula from an untrusted third-party tap.
-  #   `brew install <user>/<repo>/<formula>` is exempt — it reads as explicit
-  #   intent — so the one-liner in README.md kept passing while EVERY other
-  #   spelling a user reaches for was broken:
-  #
-  #     brew install mcpp-m                      → exit 1, "untrusted tap"
-  #     brew install mcpp-community/mcpp/mcpp    → exit 1, "untrusted tap"
-  #
-  #   A CI job that only ran the documented one-liner would have reported this
-  #   channel healthy the entire time. So the trust gate itself is asserted
-  #   from BOTH sides: refused before `brew trust`, accepted after.
-  macos-brew-fresh:
-    name: macOS fresh install (Homebrew, ${{ matrix.image }})
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    # Same two images as macos-fresh: the formula declares `depends_on macos:
-    # :sonoma` + arm64, macos-14 is the oldest image satisfying it, and
-    # xcode-27 is macOS 27, the newest release.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: macos-14
-          - image: xcode-27
-    runs-on: ${{ matrix.image }}
-    # While the line was on LLVM 22.1.8 the xcode-27 leg was known red (#669,
-    # the arm64e.x1 .tbd stubs, continue-on-error per the 2026-09-28 WS7
-    # design). The 23.1.3 line move removed the cause, so both images are
-    # plain required legs again.
-    timeout-minutes: 30
-    steps:
-      - name: Environment
-        run: |
-          echo "macOS $(sw_vers -productVersion) | $(uname -m) | $(brew --version | head -1)"
-          if [ "${{ matrix.image }}" = xcode-27 ]; then
-            [ "$(sw_vers -productVersion | cut -d. -f1)" = 27 ] || { echo "::error::xcode-27 delivered macOS $(sw_vers -productVersion), not 27"; exit 1; }
-          fi
-
-      # ① The command README.md documents, on a machine that has never tapped.
-      #    Fully qualified, so Homebrew treats it as explicit intent.
-      - name: "Documented one-liner installs"
-        run: brew install mcpp-community/mcpp/mcpp-m
-
-      # ② The launcher is the whole point of the formula: mcpp WRITES at
-      #    runtime, so a bare symlink into the Cellar would make MCPP_HOME the
-      #    versioned Cellar dir and `brew upgrade` would drop every installed
-      #    toolchain. Assert the binary on PATH is brew's and reports the
-      #    version the FORMULA declares — not a hardcoded one, which would go
-      #    stale on every release.
-      - name: "Installed binary is brew's, and agrees with the formula"
-        run: |
-          set -euo pipefail
-          which mcpp
-          case "$(which mcpp)" in
-            "$(brew --prefix)"/bin/mcpp) ;;
-            *) echo "FAIL: mcpp on PATH is not the brew one"; exit 1 ;;
-          esac
-          formula_version="$(brew info --json=v2 mcpp-community/mcpp/mcpp-m \
-                             | python3 -c 'import json,sys; print(json.load(sys.stdin)["formulae"][0]["versions"]["stable"])')"
-          echo "formula declares: $formula_version"
-          mcpp --version
-          mcpp --version | grep -Fq "$formula_version"
-
-      # ③ THE TRUST GATE, from the failing side first.
-      #
-      #    Asserted before the fix is applied, because "short form works" alone
-      #    cannot distinguish "the gate is handled" from "this Homebrew has no
-      #    gate" — and a test that cannot fail is indistinguishable from one
-      #    that is not running. If a future Homebrew drops the gate, this step
-      #    turns red and says so, rather than silently protecting nothing.
-      - name: "Untrusted tap: short form is refused (states its own premise)"
-        run: |
-          set +e
-          brew uninstall --force mcpp-m > /dev/null 2>&1
-          out="$(brew install mcpp-m 2>&1)"; rc=$?
-          echo "$out" | tail -5
-          if [ $rc -eq 0 ]; then
-            echo "NOTE: this Homebrew did not gate the tap — the trust step below"
-            echo "      is now a no-op and README's warning can be revisited."
-            exit 0
-          fi
-          echo "$out" | grep -Fq 'untrusted tap' || {
-            echo "FAIL: short-form install failed for some OTHER reason than the"
-            echo "      trust gate — that is a new bug, not the known one."
-            exit 1
-          }
-
-      # ④ …and from the working side. `brew trust` is what README tells users
-      #    to run, so it is what CI runs.
-      - name: "brew trust unlocks the short form, the alias, and upgrade"
-        run: |
-          set -euo pipefail
-          brew trust mcpp-community/mcpp
-          brew uninstall --force mcpp-m
-          brew install mcpp-m                       # short form
-          brew uninstall --force mcpp-m
-          brew install mcpp-community/mcpp/mcpp     # the `mcpp` alias
-          brew upgrade mcpp-m || true               # no-op when current; must not be refused
-
-      # ⑤ The only assertion a user actually cares about: it builds and runs.
-      #    Exercises the launcher's MCPP_HOME/MCPP_VENDORED_XLINGS pinning,
-      #    the bundled xlings, and a real toolchain bootstrap.
-      - name: "Real use: mcpp new → run (toolchain bootstrap)"
-        run: |
-          set -euo pipefail
-          cd "$(mktemp -d)"
-          mcpp new brewhello
-          cd brewhello
-          mcpp run | tee run.log
-          grep -Fq 'Hello from brewhello' run.log
-
-      # ⑥ Per-user state must live outside the Cellar, or `brew upgrade` takes
-      #    the user's toolchains with it. §⑤ just created it — prove where.
-      - name: "State lives in ~/.mcpp, not the Cellar"
-        run: |
-          set -euo pipefail
-          test -d "$HOME/.mcpp"
-          if find "$(brew --prefix)/Cellar/mcpp-m" -name 'toolchain*' -o -name 'xpkgs' 2>/dev/null | grep -q .; then
-            echo "FAIL: toolchain state landed inside the Cellar"; exit 1
-          fi
-
-  # ──────────────────────────────────────────────────────────────────
-  # Windows WITH Visual Studio: llvm@23.1.3 + MSVC STL
-  #
-  # Two images, because the OS version is a real variable for a tool that
-  # touches the UCRT, the Windows SDK and long paths. GitHub publishes no
-  # Windows 10/11 CLIENT image, so these Server builds are the closest
-  # available stand-ins: windows-2022 is the Win10 21H2 kernel generation,
-  # windows-2025 the Win11 24H2 one. What they cannot cover is genuinely
-  # client-only behaviour — UAC prompts, Defender real-time scanning, the
-  # long-path policy default — which needs a self-hosted runner.
-  # ──────────────────────────────────────────────────────────────────
-  windows-fresh:
-    needs: [wait-index]
-    name: Windows fresh install (${{ matrix.image }})
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [windows-2022, windows-2025]
-    env:
-      # The one derived value (see the header comment): every install job names
-      # the SAME version the index guard waited for, so the two cannot disagree.
-      MCPP_PIN: ${{ needs.wait-index.outputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install xlings
-        shell: pwsh
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          irm https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.ps1 | iex
-
-          $xlingsbin = "$env:USERPROFILE\.xlings\subos\current\bin"
-          $env:PATH = "$xlingsbin;$env:PATH"
-          $xlingsbin | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-
-      - name: Install mcpp and config mirror
-        shell: bash
-        run: |
-          # ONE implementation for "make the released mcpp@X be what `mcpp`
-          # runs, and prove it" — see .github/tools/install_released_mcpp.sh
-          # for the three defects the inline version had (workspace pin, no
-          # activation, and waiting on the wrong index channel).
-          bash .github/tools/install_released_mcpp.sh "${MCPP_PIN}" "$(pwd)"
-          mcpp self config --mirror GLOBAL
-
-          cat "$USERPROFILE/.xlings/.xlings.json" || true
-
-      - name: "LLVM: mcpp new → run"
-        shell: pwsh
-        run: |
-          $tmp = New-TemporaryFile | ForEach-Object { Remove-Item $_; New-Item -ItemType Directory -Path $_ }
-          Set-Location $tmp
-          mcpp new hello_win
-          Set-Location hello_win
-          mcpp run
-
-      # Template packages exercise the sha256-pinned mcpp-index fetch
-      # path (user report: `mcpp new abc1 --template imgui` failed with
-      # fetch 'imgui@0.0.6' exit 1 on bare Windows — no sha256sum binary
-      # outside git-bash; fixed by xlings 0.4.51 in-process hashing).
-      - name: "Template: exact mcpplibs.imgui selector (fetch path)"
-        shell: pwsh
-        run: |
-          $tmp = New-TemporaryFile | ForEach-Object { Remove-Item $_; New-Item -ItemType Directory -Path $_ }
-          Set-Location $tmp
-          mcpp new abc1 --template mcpplibs.imgui 2>&1 | Tee-Object -Variable templateOutput
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          if (!(Test-Path abc1/mcpp.toml)) { exit 1 }
-          if (-not (($templateOutput -join "`n") -match 'namespace=mcpplibs name=imgui')) { exit 1 }
-
-      - name: "LLVM: build mcpp"
-        shell: pwsh
-        run: |
-          mcpp clean
-          mcpp run
-
-  # ──────────────────────────────────────────────────────────────────
-  # Windows WITHOUT Visual Studio — the shape of an ordinary user's machine
-  #
-  # A stock Windows install ships the UCRT runtime DLLs and nothing else: the
-  # MSVC STL and the Windows SDK arrive only with Visual Studio's "Desktop
-  # development with C++" workload. mcpp's Windows default targeted the MSVC
-  # ABI, so `mcpp new && mcpp build` failed on every such box — and no CI job
-  # could see it, because every GitHub Windows image ships Visual Studio.
-  #
-  # There is no VS-free runner, so the image is masked instead. The risk with
-  # masking is a false green: miss one of msvc.cppm's three discovery
-  # strategies (vswhere, environment, well-known paths) and mcpp still finds
-  # MSVC, takes the ordinary path, and the job passes while proving nothing.
-  # e2e 182 opens by asserting `mcpp toolchain default msvc` FAILS, which
-  # turns exactly that into a hard failure.
-  # ──────────────────────────────────────────────────────────────────
-  windows-nomsvc-fresh:
-    needs: [wait-index]
-    name: Windows fresh install (no Visual Studio)
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: windows-2025
-    timeout-minutes: 30
-    env:
-      MCPP_PIN: ${{ needs.wait-index.outputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-
-      # The mask retries a refused rename — "denied" is a state of the host,
-      # not of the image — and then masks VC\Tools, which is where all three
-      # of msvc.cppm's discovery strategies end. Its postcondition, no
-      # VC\Tools\MSVC left, is what keeps an incomplete mask from reading as a
-      # green no-Visual-Studio install.
-      - name: Mask Visual Studio
-        uses: ./.github/actions/mask-visual-studio
-
-      - name: Install xlings
-        shell: pwsh
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          irm https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.ps1 | iex
-
-          $xlingsbin = "$env:USERPROFILE\.xlings\subos\current\bin"
-          $env:PATH = "$xlingsbin;$env:PATH"
-          $xlingsbin | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-
-      - name: Install mcpp and config mirror
-        shell: bash
-        run: |
-          # ONE implementation for "make the released mcpp@X be what `mcpp`
-          # runs, and prove it" — see .github/tools/install_released_mcpp.sh
-          # for the three defects the inline version had (workspace pin, no
-          # activation, and waiting on the wrong index channel).
-          bash .github/tools/install_released_mcpp.sh "${MCPP_PIN}" "$(pwd)"
-          mcpp self config --mirror GLOBAL
-
-      # The self-check, the fallback, persistence, a self-contained exe, and
-      # the refusal to overrule an explicit [toolchain] — all in e2e 182, so
-      # the assertions live with the tests rather than in workflow YAML.
-      - name: "No Visual Studio: fallback to winlibs GCC (e2e 182)"
-        shell: bash
-        run: |
-          MCPP="$(command -v mcpp)" bash tests/e2e/182_windows_no_msvc_fallback.sh
-
-      - uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: bare-windows-fresh-install-diagnostics
-          path: ${{ runner.temp }}/bare-windows-diagnostics
-          if-no-files-found: warn
diff --git a/.github/workflows/ci-linux-e2e.yml b/.github/workflows/ci-linux-e2e.yml
deleted file mode 100644
index e4cf916a8..000000000
--- a/.github/workflows/ci-linux-e2e.yml
+++ /dev/null
@@ -1,538 +0,0 @@
-name: ci-linux-e2e
-
-# The e2e suite (tests/e2e/run_all.sh) on Linux, called by ci.yml beside
-# ci-linux.yml after the Linux build. Four shards, assigned by measured
-# duration (tests/e2e/timings/linux.tsv, rule R4 of the 2026-10-02 CI record),
-# each running the one binary build.yml produced (use-built-mcpp, rule R1).
-# Each shard writes a per-test report that the e2e-coverage job of ci.yml reads
-# (rule R5).
-#
-# Paired workflows: ci-linux.yml (unit + toolchain legs + integration),
-# ci-macos.yml / ci-macos-e2e.yml, ci-windows.yml / ci-windows-e2e.yml.
-
-on:
-  workflow_call:
-
-jobs:
-  e2e:
-    name: e2e ${{ matrix.shard }}/4 (linux x86_64, self-host)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
-    env:
-      E2E_SHARD: ${{ matrix.shard }}/4
-      E2E_TIMINGS: tests/e2e/timings/linux.tsv
-      E2E_REPORT: ${{ github.workspace }}/e2e-report-linux-${{ matrix.shard }}.tsv
-      MCPP_HOME: /home/runner/.mcpp
-      # NOTE: do NOT force MCPP_VERBOSE here. The e2e suite includes tests that
-      # assert mcpp's DEFAULT (quiet) output — e.g. 48_build_error_output and
-      # 53_namespaced_cache_label — which forced verbose would break. Verbose is
-      # set only in the fresh-install workflows (cold bootstrap, no such asserts).
-      # A specific test that needs verbose passes `--verbose` itself.
-    steps:
-      # `submodules: recursive` so tests/e2e/233_bench_matrix.sh can check that
-      # each `hub`/`body` in bench/matrix.json exists in the tree it names.
-      # Without the trees that check reads "submodule not initialised" and
-      # reports nothing (#599). Under 10 MB of source; every shard carries it,
-      # because which shard holds 233 follows from the timing table.
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      # Its own step and its own limit, so that downloads on a cold sandbox are
-      # not taken from the suite's budget.
-      - name: The toolchains the suite probes
-        timeout-minutes: 15
-        run: |
-          set -euo pipefail
-          # Pin the global default so test 28 (default-toolchain path) gets a
-          # deterministic GNU answer instead of an auto-install pick. Installed
-          # explicitly, not assumed: the restored sandbox is the build job's,
-          # and a toolchain that only happens to be in it is a dependency on a
-          # cache.
-          "$MCPP" toolchain install gcc 16.1.0
-          "$MCPP" toolchain default gcc@16.1.0
-          # The toolchains whose capabilities the suite probes (run_all.sh):
-          # musl, llvm (which also yields scan-deps and import-std-libcxx) and
-          # the Linux-hosted MinGW cross compiler. Without them their tests
-          # skip on every runner; measured 2026-10-01, seventeen such tests ran
-          # nowhere. Warm runs re-install nothing.
-          "$MCPP" toolchain install gcc 16.1.0-musl
-          "$MCPP" toolchain install llvm 23.1.3
-          "$MCPP" toolchain install mingw-cross 16.1.0
-          XLINGS_HOME="$MCPP_HOME/registry" "$MCPP_VENDORED_XLINGS" install xim:nasm -y
-          # The index payloads e2e 32, 33 and 40 link from this home into their
-          # own (_inherit_toolchain.sh). Installed in a test home instead, they
-          # are refused: the inherited subos projects assets that home's ledger
-          # does not register. A warm sandbox used to hold them by accident.
-          XLINGS_HOME="$MCPP_HOME/registry" "$MCPP_VENDORED_XLINGS" install \
-              mcpplibs:cmdline@0.0.1 mcpplibs:cmdline@0.0.2 -y
-
-      - name: E2E suite
-        # About twice the shard's budget of ten minutes (R4): reached only by a
-        # hang. The per-test 600 s limit in run_all.sh names the test that hung.
-        timeout-minutes: 22
-        run: |
-          set -euo pipefail
-          # MCPP is this commit's binary and MCPP_BOOT the released bootstrap
-          # (use-built-mcpp). e2e 252 needs the latter: the claim that an older
-          # client can build against a package this commit produces is only
-          # worth making against a real old binary.
-          export MCPP MCPP_BOOT
-          test -x "$MCPP_VENDORED_XLINGS"
-          # GitHub-hosted runners are outside CN; keep CI toolchain downloads on
-          # the global mirror while mcpp's default remains CN for fresh local
-          # sandboxes. E2E tests with their own MCPP_HOME read this variable.
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          "$MCPP" self config
-          bash tests/e2e/run_all.sh
-
-      # One file, no glob: the report the e2e-coverage job of ci.yml reads.
-      - name: Upload the shard's report
-        if: always()
-        timeout-minutes: 5
-        uses: actions/upload-artifact@v4
-        with:
-          name: e2e-report-linux-${{ matrix.shard }}
-          path: e2e-report-linux-${{ matrix.shard }}.tsv
-          if-no-files-found: warn
-          retention-days: 7
-
-  # An MCPP_HOME and a project on NFSv3 (docs/25 §6, #809): the filesystem
-  # whose rename refuses RENAME_NOREPLACE with EINVAL, where `mcpp new` once
-  # failed. mcpp measures what the filesystem does and publishes by it.
-  nfs:
-    name: e2e nfs (NFSv3 home and project)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: An NFSv3 export of this machine, mounted
-        run: |
-          set -euo pipefail
-          sudo apt-get update -q
-          sudo apt-get install -y --no-install-recommends nfs-kernel-server nfs-common
-          sudo mkdir -p /srv/nfs /mnt/nfs
-          sudo chown "$(id -u):$(id -g)" /srv/nfs
-          echo "/srv/nfs 127.0.0.1(rw,sync,no_subtree_check,no_root_squash)" | sudo tee /etc/exports
-          sudo exportfs -ra
-          sudo systemctl restart nfs-kernel-server
-          sudo mount -t nfs -o vers=3,nolock 127.0.0.1:/srv/nfs /mnt/nfs
-          test "$(stat -f -c %T /mnt/nfs)" = nfs
-
-      - name: A toolchain, a new project, its build and run, all on NFSv3
-        run: |
-          set -euo pipefail
-          export MCPP_HOME=/mnt/nfs/mcpp-home
-          "$MCPP" toolchain install gcc 16.1.0
-          cd /mnt/nfs
-          "$MCPP" new hello
-          cd hello
-          "$MCPP" build
-          "$MCPP" run > "$RUNNER_TEMP/run.log"
-          grep -q 'Hello from hello' "$RUNNER_TEMP/run.log"
-
-      - name: Doctor names the home's filesystem
-        run: |
-          set -euo pipefail
-          export MCPP_HOME=/mnt/nfs/mcpp-home
-          # doctor's exit status reports the machine's health, not this line.
-          "$MCPP" self doctor > "$RUNNER_TEMP/doctor.log" 2>&1 || true
-          grep -q '/mnt/nfs/mcpp-home on nfs' "$RUNNER_TEMP/doctor.log"
-
-  # ──────────────────────────────────────────────────────────────────
-  # Bare metal: the one chain the sharded suite above cannot be trusted
-  # to exercise.
-  #
-  # tests/e2e/130_freestanding_riscv_build_and_run.sh declares
-  # `# requires: qemu-riscv`, which is legitimately absent on the macOS and
-  # Windows runners — so it must be a SOFT token, and a soft token means the
-  # test skips in silence on a Linux runner that lost qemu too. That is the
-  # exact shape this repository has been burned by twice (65_* never ran at
-  # all; ten pack e2e skipped on two platforms), and no token can tell the two
-  # cases apart.
-  #
-  # So the guard lives here, where it can be exact: install qemu, run the one
-  # test, and assert its PASS line appeared. A skip fails this job.
-  # ──────────────────────────────────────────────────────────────────
-  baremetal:
-    name: bare-metal e2e (riscv64-none-elf + cortex-m, qemu)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 40
-    env:
-      MCPP_HOME: /home/runner/.mcpp
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: Install the emulator (xim:qemu-riscv)
-        run: |
-          # BOTH homes. The shim on PATH dispatches against whichever home
-          # owns it, and `mcpp run` runs the runner through that shim — so an
-          # emulator installed only in the ambient xlings home answers
-          # "xlings: 'qemu-system-riscv64' is not installed" when mcpp asks.
-          # Measured: the job installed it once, the shim resolved, and the
-          # run still failed.
-          "$XLINGS_BIN" install xim:qemu-riscv -y
-          XLINGS_HOME="${MCPP_HOME:-$HOME/.mcpp}/registry" \
-            "$XLINGS_BIN" install xim:qemu-riscv -y
-          # Assert it is reachable AND runnable BEFORE the tests. Without this
-          # the capability probe simply would not add `qemu-riscv` and the
-          # tests would skip — which is what this job exists to prevent.
-          command -v qemu-system-riscv64
-          qemu-system-riscv64 --version | head -1
-          # The target sysroot, into the home MCPP uses. Test 131's BSP
-          # declares it as an `[xlings] deps` entry and finds it through
-          # `xpkg_dir`; installed into the ambient xlings home instead, the
-          # test would SKIP and the seam would go unexercised.
-          XLINGS_HOME="${MCPP_HOME:-$HOME/.mcpp}/registry" \
-            "$XLINGS_BIN" install xim:picolibc-riscv -y
-          test -d "${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-picolibc-riscv"
-          # The M-profile emulator, in BOTH homes for the reason above.
-          # `xim:qemu-arm` carries `qemu-system-arm` as well as
-          # `qemu-system-aarch64`; test 332 addresses it by absolute path out of
-          # the payload, so what matters is that the payload EXISTS in the home
-          # mcpp uses rather than that a shim resolves.
-          "$XLINGS_BIN" install xim:qemu-arm -y
-          XLINGS_HOME="${MCPP_HOME:-$HOME/.mcpp}/registry" \
-            "$XLINGS_BIN" install xim:qemu-arm -y
-          # Reachable AND runnable before the tests, so that a missing emulator
-          # fails this step rather than silently skipping test 332.
-          ls "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-qemu-arm/*/bin/qemu-system-arm \
-            | sort -V | tail -1 | xargs -I{} {} --version | head -1
-
-      - name: Bare-metal e2e
-        timeout-minutes: 25
-        run: |
-          export MCPP MCPP_VENDORED_XLINGS
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          # llvm is the toolchain a freestanding target pins; install it
-          # explicitly rather than relying on whatever the sandbox cache holds.
-          "$MCPP" toolchain install llvm 23.1.3
-          # Run the two scripts DIRECTLY rather than through run_all.sh.
-          # They are standalone (they take $MCPP and nothing else), run_all.sh
-          # accepts no filter — it would run the whole 250-test suite here for
-          # two tests — and, more to the point, run_all.sh exits 0 on a skip.
-          # Invoked directly, a skip is visible: the script either prints its
-          # PASS line or it does not.
-          for t in tests/e2e/130_freestanding_riscv_build_and_run.sh \
-                   tests/e2e/131_freestanding_bsp_supplies_everything.sh \
-                   tests/e2e/132_freestanding_test_and_artifacts.sh \
-                   tests/e2e/133_freestanding_std_subset.sh \
-                   tests/e2e/332_cortex_m_builds_and_boots.sh \
-                   tests/e2e/336_armv7a_builds_and_boots.sh \
-                   tests/e2e/338_cortex_m_picolibc_sysroot.sh; do
-            echo "=== $t ==="
-            bash "$t" 2>&1 | tee "$(basename "$t").log"
-            rc=${PIPESTATUS[0]}
-            [ "$rc" = "0" ] || { echo "$t failed (exit $rc)"; exit 1; }
-          done
-          # The assertion this job exists for: both tests RAN. Each has an
-          # early `exit 0` for a missing capability, so a zero exit code alone
-          # does not distinguish "passed" from "skipped".
-          grep -q 'PASS: freestanding riscv64 build + run' \
-            130_freestanding_riscv_build_and_run.sh.log || {
-            echo "130 (engine chain) skipped on the runner that must run it"; exit 1; }
-          grep -q 'PASS: BSP supplies the sysroot' \
-            131_freestanding_bsp_supplies_everything.sh.log || {
-            echo "131 (ecosystem chain) skipped on the runner that must run it"; exit 1; }
-          grep -q 'PASS: bare-metal mcpp test names its failure' \
-            132_freestanding_test_and_artifacts.sh.log || {
-            echo "132 (test + artifacts) skipped on the runner that must run it"; exit 1; }
-          grep -q 'PASS: the freestanding std subset' \
-            133_freestanding_std_subset.sh.log || {
-            echo "133 (std subset) skipped on the runner that must run it"; exit 1; }
-          # 332 declares `# requires: qemu-arm`, which no sharded runner has
-          # — so on the shards it exits 0 without running. This job is the only
-          # place its PASS line can be demanded.
-          grep -q 'PASS: cortex-m rows build, boot' \
-            332_cortex_m_builds_and_boots.sh.log || {
-            echo "332 (cortex-m) skipped on the runner that must run it"; exit 1; }
-          # And a count, because four `grep -q` calls that each matched say
-          # nothing about how many rows the script actually booted: a fixture
-          # that stopped iterating would still print its PASS line.
-          booted=$(grep -c 'booted on ' 332_cortex_m_builds_and_boots.sh.log || true)
-          [ "$booted" = "4" ] || {
-            echo "332 booted $booted rows, expected 4"; exit 1; }
-          # 336 IS HERE FOR THE SAME REASON, AND ADDING IT TO THE LOOP ABOVE
-          # WITHOUT ADDING IT HERE WOULD HAVE BEEN THE SAME DEFECT: it declares
-          # `# requires: qemu-arm`, so on a shard it exits 0 having run nothing.
-          grep -q 'PASS: armv7-a rows build, boot' \
-            336_armv7a_builds_and_boots.sh.log || {
-            echo "336 (armv7-a) skipped on the runner that must run it"; exit 1; }
-          a32=$(grep -c 'booted on virt' 336_armv7a_builds_and_boots.sh.log || true)
-          [ "$a32" = "2" ] || {
-            echo "336 booted $a32 rows, expected 2"; exit 1; }
-          # 338 SKIPS UNTIL `xim:picolibc-arm` IS PUBLISHED, and a skip here
-          # is legitimate rather than a defect — the payload is a separate
-          # release. So its PASS line is NOT demanded; what IS demanded is that
-          # the script either passed or said why, which is what distinguishes a
-          # skip from a silent zero-exit.
-          grep -qE 'PASS: a Cortex-M project opts into picolibc|SKIP: picolibc-arm is not installed' \
-            338_cortex_m_picolibc_sysroot.sh.log || {
-            cat 338_cortex_m_picolibc_sysroot.sh.log
-            echo "338 neither passed nor reported why it did not run"; exit 1; }
-
-  # ──────────────────────────────────────────────────────────────────
-  # Android: the rows no sharded runner can reach.
-  #
-  # `run_all.sh` adds the `android-ndk` capability only when the NDK payload
-  # is already installed, and no other job installs it, so every
-  # `# requires: android-ndk` test skipped on every CI runner while reporting
-  # green. This job installs the payload, runs those tests directly and demands
-  # each PASS line, then runs `mcpp test` on an API 34 emulator through
-  # `adb-run` (the configuration measured on mcpp#635), which is the only
-  # place a test program's loading on the device is observed.
-  # ──────────────────────────────────────────────────────────────────
-  android:
-    name: android e2e (NDK rows + x86_64 emulator)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 90
-    env:
-      MCPP_HOME: /home/runner/.mcpp
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: Install the NDK (xim:android-ndk)
-        timeout-minutes: 20
-        run: |
-          XLINGS_HOME="$MCPP_HOME/registry" "$XLINGS_BIN" install xim:android-ndk@30.0.16248370 -y
-          # Present before the tests, so a missing payload fails this step
-          # rather than an assertion deep inside a test.
-          ls "$MCPP_HOME"/registry/data/xpkgs/xim-x-android-ndk/*/toolchains/llvm/prebuilt/*/bin/clang++
-
-      - name: Android e2e (no device)
-        timeout-minutes: 40
-        run: |
-          export MCPP MCPP_VENDORED_XLINGS
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          "$MCPP" toolchain install gcc 16.1.0
-          "$MCPP" toolchain default gcc@16.1.0
-          # Run directly, not through run_all.sh, so a skip cannot pass as a
-          # green: each script either prints its PASS line or this step fails.
-          declare -A pass=(
-            [652b_an_application_on_android_is_a_shared_library]='652b: kind = "app" on Android is a shared library OK'
-            [664_a_universal_apk_is_two_legs_in_one_tree]='664: the universal APK is the library route applied to an app OK'
-            [667_an_android_pack_stages_its_closure]='667: an Android pack stages its closure OK'
-            [675_android_test_programs_carry_their_cxx_runtime]='PASS: 675_android_test_programs_carry_their_cxx_runtime'
-            [680_a_dependency_floor_on_the_android_api_level]='PASS: 680_a_dependency_floor_on_the_android_api_level'
-          )
-          for t in "${!pass[@]}"; do
-            echo "=== $t ==="
-            bash "tests/e2e/$t.sh" 2>&1 | tee "$t.log"
-            rc=${PIPESTATUS[0]}
-            [ "$rc" = "0" ] || { echo "$t failed (exit $rc)"; exit 1; }
-            grep -qF "${pass[$t]}" "$t.log" || { echo "$t did not print its PASS line"; exit 1; }
-          done
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-
-      - name: Enable KVM
-        run: |
-          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-          sudo udevadm control --reload-rules
-          sudo udevadm trigger --name-match=kvm
-
-      - name: Compile the device tests before the emulator starts
-        timeout-minutes: 20
-        run: bash .github/tools/android_emulator_test.sh prebuild "$RUNNER_TEMP/droidtest"
-
-      - name: mcpp test on an API 34 emulator
-        timeout-minutes: 30
-        uses: reactivecircus/android-emulator-runner@v2
-        with:
-          api-level: 34
-          arch: x86_64
-          target: google_apis
-          force-avd-creation: false
-          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
-          disable-animations: true
-          script: bash .github/tools/android_emulator_test.sh run "$RUNNER_TEMP/droidtest"
-
-  # ──────────────────────────────────────────────────────────────────
-  # Hermetic (no host toolchain): the ONLY environment class that
-  # faithfully reproduces issue #195. Standard runners ship gcc +
-  # libc6-dev, so a sandbox toolchain that leaks to the host's CRT
-  # still links "green" there; this container has no compiler and no
-  # host Scrt1.o, so any leak fails loudly. Builds PR code with the
-  # bootstrap mcpp, then runs the llvm flow end-to-end.
-  # ──────────────────────────────────────────────────────────────────
-  hermetic:
-    name: hermetic e2e (no host toolchain, container)
-    runs-on: ubuntu-24.04
-    container: debian:stable-slim
-    timeout-minutes: 60
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-    steps:
-      - name: Install base utilities (NO compiler)
-        run: |
-          apt-get update -qq
-          apt-get install -y -qq curl ca-certificates git xz-utils unzip
-          # The whole point of this job: no host toolchain, no host CRT.
-          ! command -v gcc
-          ! command -v cc
-          test ! -e /usr/lib/x86_64-linux-gnu/Scrt1.o
-          test ! -e /usr/lib/gcc
-
-      - uses: actions/checkout@v4
-
-      # Payload cache (downloads only — the container still has no host
-      # toolchain, which is the property under test).
-      - name: Restore mcpp sandbox payloads
-        id: hermetic-cache
-        uses: actions/cache/restore@v4
-        with:
-          path: ~/.mcpp
-          key: mcpp-hermetic-${{ hashFiles('mcpp.toml', '.github/workflows/ci-linux-e2e.yml') }}
-          restore-keys: |
-            mcpp-hermetic-
-
-      - name: Bootstrap xlings + released mcpp
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v2026.10.16.2
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          xlings update
-          xlings install mcpp -y -g
-          MCPP_BOOT="$HOME/.xlings/subos/current/bin/mcpp"
-          "$MCPP_BOOT" --version
-          "$MCPP_BOOT" self config --mirror GLOBAL
-          echo "MCPP_BOOT=$MCPP_BOOT" >> "$GITHUB_ENV"
-
-      # This job builds its own mcpp on purpose: the build is part of what it
-      # tests, a compiler-free container in which only sandbox payloads exist.
-      - name: Build PR mcpp from source (sandbox gcc only)
-        run: |
-          "$MCPP_BOOT" build
-          MCPP=$(realpath "$(find target -type f -name mcpp -printf '%T@ %p\n' | sort -rn | head -1 | cut -d' ' -f2)")
-          test -x "$MCPP"
-          "$MCPP" --version
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-
-      - name: "issue #195 reproduction: manifest llvm toolchain, fresh"
-        run: |
-          cd "$(mktemp -d)"
-          "$MCPP" new hello195
-          cd hello195
-          printf '\n[toolchain]\nlinux = "llvm@23.1.3"\n' >> mcpp.toml
-          printf 'import std;\nint main() { std::println("hello {}", 195); return 0; }\n' > src/main.cpp
-          "$MCPP" run
-
-      - name: Hermetic llvm e2e subset
-        run: |
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          export MCPP
-          bash tests/e2e/86_llvm_hermetic_link.sh
-          bash tests/e2e/37_llvm_import_std.sh
-
-      # The scripts whose C++ runtime is a package (`llvm.libcxx`) declare
-      # `# requires: llvm`, which no shard has, and `run_all.sh` exits 0 when it
-      # skips. They run here, where llvm is installed, and each is held to the
-      # line it prints only when it ran to the end, and to the line of the step
-      # that runs a program (#641).
-      - name: "C++ runtime e2e that needs llvm (663, 690, 696, 700)"
-        run: |
-          set -o pipefail
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          export MCPP
-          run_and_assert() {   # $1 = script; the remaining arguments are lines it must print
-            local script="$1"; shift
-            local log="$RUNNER_TEMP/$(basename "$script").log"
-            bash "$script" 2>&1 | tee "$log"
-            for line in "$@"; do
-              grep -qxF "$line" "$log" || { echo "::error::$script did not print: $line"; exit 1; }
-            done
-          }
-          run_and_assert tests/e2e/663_a_graph_libcxx_over_the_payloads_c_library.sh \
-            "ok: llvm.libcxx supplies the C++ layer over the payload's C library, and the program runs"
-          run_and_assert tests/e2e/690_a_shared_library_over_a_graph_cxx_runtime.sh \
-            'ok: linkage = "static" builds and runs' \
-            'ok: cxx_runtime = { shared = "self-contained" } links a private copy and runs' \
-            "PASS: 690 a shared library over a graph C++ runtime is refused or carries a stated private copy"
-          run_and_assert tests/e2e/696_a_cxx_layer_provider_keeps_its_own_standard.sh \
-            "PASS: a C++-layer provider compiles its implementation units at its own standard"
-          # #646 F3a: the default llvm shape of a program over a C++ shared library
-          # aborted with std::bad_cast before its programs took the library's contract.
-          run_and_assert tests/e2e/700_a_program_over_a_cxx_shared_library_has_one_cxx_runtime.sh \
-            "ok: a program over a C++ shared library runs on one C++ runtime" \
-            "ok: a stated self-contained program over a coupled C++ shared library is refused" \
-            "PASS: 700 a program over a C++ shared library has one C++ runtime"
-
-      # The compile database (#699 report, design 2026-09-26 §3): the scripts
-      # whose rows need llvm declare `# requires: llvm`, which no shard has, so
-      # they run here and each is held to the lines it prints only when the
-      # property it names was checked.
-      - name: "Compile database e2e that needs llvm (783, 784, 785, 786)"
-        run: |
-          set -o pipefail
-          # The scripts read the database with python3, which this container
-          # lacks. It is not a toolchain: the job's property (no host compiler,
-          # no host C runtime) was asserted before the checkout and still holds.
-          if ! command -v python3 >/dev/null 2>&1; then
-            apt-get install -y -qq python3 >/dev/null
-            if command -v gcc >/dev/null 2>&1; then
-              echo "::error::installing python3 brought a host compiler"; exit 1
-            fi
-          fi
-          export PATH="$HOME/.xlings/subos/current/bin:$PATH"
-          export MCPP
-          run_and_assert() {   # $1 = script; the remaining arguments are lines it must print
-            local script="$1"; shift
-            local log="$RUNNER_TEMP/$(basename "$script").log"
-            bash "$script" 2>&1 | tee "$log"
-            for line in "$@"; do
-              grep -qxF "$line" "$log" || { echo "::error::$script did not print: $line"; exit 1; }
-            done
-          }
-          run_and_assert tests/e2e/783_cdb_switches_whole_with_the_configuration.sh \
-            "ok: mcpp test then mcpp build keep the test entry in one configuration" \
-            "ok: switching toolchain switches the whole root file" \
-            "ok: switching back restores that configuration's entries, test units included" \
-            "PASS: 783 one compile database per configuration"
-          run_and_assert tests/e2e/784_cdb_replays_from_its_directory.sh \
-            "ok: gcc row replays every entry from its directory, no gcm.cache/ in the project root" \
-            "ok: llvm row replays every entry from its directory" \
-            "PASS: 784 the compile database replays from its own directory"
-          run_and_assert tests/e2e/785_cdb_interface_flag_module_extensions.sh \
-            "ok: the interface entry carries -x c++-module immediately before -c, and replays" \
-            "ok: the non-module unit carries no language flag" \
-            "PASS: 785 the compile database states a module interface's language explicitly"
-          run_and_assert tests/e2e/786_std_unit_in_the_database_and_build_id.sh \
-            "ok: the std unit's directory is the shared std cache, not the project's output directory" \
-            "ok: emit --spec compile-commands renders the same std entry as the build's database" \
-            "ok: provides['std'] names the std-cache BMI" \
-            "ok: build-id is present and stable across two runs" \
-            "PASS: 786 the std unit in the database, emit/build agreement, provides and build-id"
-
-      # Last, so that the payloads the steps above installed are in it. This job
-      # is the one writer of its cache, on main only (R3).
-      - name: Save mcpp sandbox payloads
-        if: ${{ github.event_name == 'push' && steps.hermetic-cache.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.mcpp
-          key: ${{ steps.hermetic-cache.outputs.cache-primary-key }}
diff --git a/.github/workflows/ci-linux.yml b/.github/workflows/ci-linux.yml
deleted file mode 100644
index ac180b1c3..000000000
--- a/.github/workflows/ci-linux.yml
+++ /dev/null
@@ -1,425 +0,0 @@
-name: ci-linux
-
-# Self-host CI on Linux: mcpp builds mcpp. The bootstrap mcpp comes from
-# `xlings install mcpp` (xim:mcpp in the xlings package index), so this
-# workflow no longer depends on a previous-release tarball — the
-# chicken-and-egg now lives upstream in the xlings index.
-#
-# SHAPE: called by ci.yml after the Linux build (build.yml). No job here builds
-# mcpp to obtain the commit's binary: each takes the one binary that build
-# produced (.github/actions/use-built-mcpp, rule R1 of the 2026-10-02 CI
-# record). A job builds mcpp only when the build is what it tests: a cold
-# rebuild, another toolchain, a cross target.
-#
-# This replaced four independent jobs that each paid a "warm" rebuild, chosen
-# when that rebuild cost about 2.5 minutes. Measured on 2026-10-01 it cost 6.6
-# minutes, and on an exact hit of the restored target/ ninja still ran 830 of
-# 830 edges.
-#
-# The checks that need no binary run in the `docs` job of ci.yml.
-#
-# The e2e suite is ci-linux-e2e.yml, called beside this one.
-#
-# Paired workflows: ci-linux-e2e.yml, ci-macos.yml, ci-windows.yml.
-
-on:
-  workflow_call:
-
-env:
-  # MCPP_HOME pinned so the cache keys below restore into the same path
-  # mcpp resolves at runtime.
-  MCPP_HOME: /home/runner/.mcpp
-  # Verbose every mcpp invocation for richer CI diagnostics (src/cli.cppm).
-  # Safe here: this workflow no longer runs the e2e suite, which is what
-  # asserts mcpp's default quiet output (tests 48/53).
-  MCPP_VERBOSE: "1"
-
-jobs:
-  build-test:
-    name: unit tests (linux x86_64, self-host)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: Unit + integration tests via `mcpp test`
-        run: |
-          "$MCPP_FRESH" test
-
-      # Each package under `modules/` carries its own tests, and they are built
-      # as that package ALONE -- a configuration the root suite never produces,
-      # since there every module is linked together. A subsystem that has
-      # quietly come to depend on something it does not declare compiles in the
-      # root build and fails here, which is the whole reason to run both.
-      #
-      # Every member is run, and the loop is derived from the manifest rather
-      # than written out: a list maintained by hand is a list that stops
-      # matching, and `check_modules_wiring.sh` cannot see this file.
-      # WS8: docs/01 and docs/20 state, per host, the toolchain a first run
-      # installs; this host's row is checked against the one answer the
-      # resolver gives (`self env --format json` -> defaultToolchain). Each
-      # host's CI row checks its own row of the tables.
-      - name: The documented default toolchain is this host's answer
-        run: |
-          python3 tests/scripts/test_check_default_toolchain_docs.py
-          python3 .github/tools/check_default_toolchain_docs.py --mcpp "$MCPP_FRESH"
-
-      - name: Per-subsystem tests (`mcpp test -p <member>`)
-        run: |
-          set -euo pipefail
-          # `$MCPP_FRESH` is the binary of build.yml (use-built-mcpp), not one
-          # found under target/.
-          members=$(sed -n '/^\[workspace\]/,/^\[/p' mcpp.toml \
-                    | grep -oE '"modules/[a-z0-9-]+"' | tr -d '"' | sed 's|modules/||')
-          [ -n "$members" ] || { echo "no workspace members found in mcpp.toml"; exit 1; }
-          echo "members: $(echo $members | tr '\n' ' ')"
-          for m in $members; do
-            echo "::group::mcpp test -p $m"
-            "$MCPP_FRESH" test -p "$m"
-            echo "::endgroup::"
-          done
-
-  # A cold, from-scratch self-host build by this commit's binary with the
-  # manifest-pinned GCC: mcpp building itself, where build.yml has the
-  # bootstrap build it. `mcpp test` is deliberately NOT repeated here; it would
-  # be the same suite, toolchain and binary as `build-test`.
-  toolchain-gcc:
-    name: "toolchain: gcc (cold self-host)"
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: "Toolchain: GCC — cold rebuild with the PR binary"
-        run: |
-          # The build's exit status is the assertion; the grep names the
-          # toolchain that produced it (WS7, #729).
-          set -o pipefail
-          "$MCPP" clean
-          "$MCPP" build 2>&1 | tee build.log; grep -q "Resolved gcc@16.1.0" build.log
-
-  # The two rebuilds share one runner, each with this commit's binary as the
-  # builder: a runner apiece would cost more in setup than it saves.
-  toolchain-cross:
-    name: "toolchain: musl + llvm"
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      # Auto-installs gcc@16.1.0-musl on demand (cached across runs).
-      - name: "Toolchain: musl-gcc — build mcpp (--target)"
-        run: |
-          set -o pipefail
-          "$MCPP" clean
-          "$MCPP" build --target x86_64-linux-musl 2>&1 | tee build.log; grep -q "Resolved gcc@16.1.0 → x86_64-linux-musl" build.log
-
-      # #729. This step reported success for a year while the build failed:
-      # the build was piped into `tee` with no pipefail, and the only
-      # assertion was a grep for the resolution line. It now fails on the
-      # build's own status. It builds with llvm@23.1.3, the LLVM row mcpp
-      # develops with (`[toolchain] macos`) and that Windows CI resolves;
-      # libc++ 20's `std` module does not expose directory_iterator's
-      # comparison, so llvm@20.1.7 cannot build mcpp's own sources.
-      - name: "Toolchain: LLVM 23.1.3 — build mcpp"
-        run: |
-          set -o pipefail
-          "$MCPP" toolchain install llvm 23.1.3
-          "$MCPP" clean
-          "$MCPP" build --toolchain llvm@23.1.3 2>&1 | tee build.log
-          grep -q "Resolved llvm@23.1.3" build.log
-
-      # #722's function-size gate, which needs the compile database a
-      # successful clang build writes at the project root, and clang-tidy from
-      # xim:llvm-tools at the same version. It ran by hand until this job built
-      # mcpp with clang (#729).
-      - name: "Function sizes of the prepare decomposition (#722)"
-        run: |
-          "$XLINGS_BIN" install xim:llvm-tools@23.1.3 -y
-          bash .github/tools/check_function_sizes.sh
-
-  # Integration: the mcpp built from THIS PR's source builds & runs a real
-  # external C++ project — xlings (openxlings/xlings ships its own mcpp.toml).
-  # MCPP_VENDORED_XLINGS only supplies the xlings package backend that mcpp
-  # resolves deps through.
-  integration-xlings:
-    name: "integration: mcpp builds & runs xlings"
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: "Integration: mcpp builds & runs xlings (openxlings/xlings)"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh" \
-            --depth 1 --recurse-submodules \
-            https://github.com/openxlings/xlings /tmp/xlings-src
-          cd /tmp/xlings-src
-          "$MCPP" self config --mirror GLOBAL
-          "$MCPP" build
-          "$MCPP" run
-
-  # THE CURRICULUM WAS NEVER BUILT BY ANY JOB. e2e 616 checks that the examples
-  # and the table that documents them agree, and says so explicitly: it builds
-  # nothing. Every example in this repository could therefore stop compiling and
-  # the only signal would be a user reporting it.
-  #
-  # The list is DERIVED FROM THE TREE, not written here. An example that is in
-  # neither the build list nor the skip table fails this job, so adding one
-  # forces a decision about whether CI can build it rather than silently
-  # leaving it uncovered.
-  examples:
-    name: "examples: the curriculum builds"
-    runs-on: ubuntu-24.04
-    # Generous rather than tight: six cold example builds plus the Vulkan one,
-    # which provisions the shader compiler and a software driver as payloads.
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: Build every example the runner can build
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          bash .github/tools/build_examples.sh
-
-      # TWO CRITERIA A BUILD CANNOT SHOW, from the examples whose READMEs state
-      # them. Both are the shape this repository has paid for before: a green
-      # build over a result nobody compared.
-      - name: "examples: the feature criterion and the device language"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          set -eo pipefail
-
-          # 11-features. NOT "the default build works" -- that passes while the
-          # optional package is resolved and merely unused. The criterion is
-          # that the default build's RESOLUTION does not name it.
-          cd examples/11-features/greeter
-          "$MCPP" build 2>&1 | tee /tmp/f-default.log
-          "$MCPP" build --features metrics 2>&1 | tee /tmp/f-metrics.log
-          grep -qi counters /tmp/f-default.log && {
-            echo "FAIL: the default build resolved 'counters'"; exit 1; }
-          grep -qi counters /tmp/f-metrics.log || {
-            echo "FAIL: --features metrics did not resolve 'counters'"; exit 1; }
-          echo "ok: the optional package is absent without its feature"
-          cd - >/dev/null
-
-          # 12-a-new-device-language. Three criteria, and a probe run exits
-          # non-zero on purpose -- the program returns 1 when the answer is not
-          # 42 -- so those runs are guarded with `|| true` and judged by their
-          # output rather than their status.
-          cd examples/12-a-new-device-language/app
-          "$MCPP" run | tee /tmp/toy.log
-          grep -q 'answer()       = 42' /tmp/toy.log || {
-            echo "FAIL: the .toy did not reach the link"; exit 1; }
-          # THE LANGUAGE IS EXECUTED, NOT PATTERN-MATCHED: 21 is what the
-          # emitted `while` loop computes, and no constant in the tree holds it.
-          grep -q 'gcd(1071, 462) = 21' /tmp/toy.log || {
-            echo "FAIL: the emitted loop did not run"; exit 1; }
-
-          # Editing the .toy reaches the artifact.
-          sed -i 's/scale(gcd(1071, 462), 2)/scale(gcd(1071, 462), 3)/' src/kernels/answer.toy
-          "$MCPP" run > /tmp/toy2.log 2>&1 || true
-          sed -i 's/scale(gcd(1071, 462), 3)/scale(gcd(1071, 462), 2)/' src/kernels/answer.toy
-          grep -q 'answer()       = 63' /tmp/toy2.log || {
-            cat /tmp/toy2.log; echo "FAIL: editing the .toy did not reach the artifact"; exit 1; }
-
-          # THE COMPILER IS A DECLARED INPUT OF THE ACTION -- the half that
-          # fails silently, and the one criterion here that has to be built to
-          # isolate it. Bumping the tool's version is NOT that criterion: the
-          # tool's path is on the action's command line, so a new path re-runs
-          # the edge whether or not it is also declared as an input. Measured:
-          # with `a.input(compiler)` removed, a version bump still reached the
-          # artifact, and this step passed.
-          #
-          # The isolating change is different BYTES AT THE SAME PATH. Build a
-          # compiler that behaves differently, overwrite the cached binary in
-          # place, and the command line is byte-identical.
-          #
-          # BOTH DIRECTIONS ARE THE CRITERION, not either one. Falsified by
-          # removing `a.input(compiler)`: the artifact followed the first
-          # overwrite anyway and stopped following the restore, so a check that
-          # asserted only the first direction would have passed on a rule that
-          # tracks nothing.
-          #
-          # `n.value * 2` keeps `0` at `0`: a probe that changed every literal
-          # would turn `while (b != 0)` into a loop that divides by zero, and
-          # this step would report a crash rather than an answer.
-          # THE PROBE COMPILER IS BUILT FROM A COPY OF THE TREE. The store's
-          # key carries a stamp of the tool's tree (#630, item 6), so touching
-          # `../toyc` would move the key and the next run would rebuild the
-          # tool from the restored source -- the isolating change here is
-          # different bytes at the SAME path, which needs the tree untouched.
-          probe_tree=/tmp/toyc-probe
-          rm -rf "$probe_tree"; cp -r ../toyc "$probe_tree"; rm -rf "$probe_tree/target"
-          probe_on() { sed -i 's/return std::format("{}", n.value);/return std::format("{}", n.value * 2);/' "$1/src/compile.cppm"; }
-          probe_off() { sed -i 's/return std::format("{}", n.value \* 2);/return std::format("{}", n.value);/' "$1/src/compile.cppm"; }
-          install_toyc() {   # $1 = the tree to build, $2 = the store path to overwrite
-            ( cd "$1" && "$MCPP" build >/dev/null )
-            cp "$(find "$1/target" -name toyc -type f -perm -u+x | head -1)" "$2"
-          }
-
-          # `mcpp cache dir` prints a legacy-directory note on a second line.
-          # The newest entry, since a tree edited earlier in this job may have
-          # left another one.
-          store="$("$MCPP" cache dir | head -1)/tool"
-          cached="$(ls -t $(find "$store" -path '*toyc@0.1.0*/bin/toyc') 2>/dev/null | head -1)"
-          [ -n "$cached" ] || {
-            echo "FAIL: no toyc in the tool store under $store"; exit 1; }
-
-          probe_on "$probe_tree"; install_toyc "$probe_tree" "$cached"; probe_off "$probe_tree"
-          "$MCPP" run > /tmp/toy3.log 2>&1 || true
-          grep -q 'answer()       = 168' /tmp/toy3.log || {
-            cat /tmp/toy3.log
-            echo "FAIL: a changed compiler binary did not reach the artifact."
-            echo "      rules-toy must declare the compiler among the action's inputs."
-            exit 1; }
-          install_toyc "$probe_tree" "$cached"
-          "$MCPP" run > /tmp/toy4.log 2>&1 || true
-          grep -q 'answer()       = 42' /tmp/toy4.log || {
-            cat /tmp/toy4.log
-            echo "FAIL: restoring the compiler binary did not reach the artifact --"
-            echo "      the action is not tracking the compiler's bytes."
-            echo "      rules-toy must declare the compiler among the action's inputs."
-            exit 1; }
-
-          # THE STORE'S KEY HOLDS THE SOURCE (#630, item 6), which the
-          # example's README and docs/30 both state: editing the compiler's
-          # sources at the same version rebuilds the tool, and so does the
-          # reversal. Both directions, because a key that only ever grew
-          # would pass the first and fail the second.
-          sleep 1; probe_on ../toyc
-          "$MCPP" run > /tmp/toy5.log 2>&1 || true
-          grep -q 'answer()       = 168' /tmp/toy5.log || {
-            cat /tmp/toy5.log
-            echo "FAIL: editing the compiler's sources at the same version did not reach the artifact."
-            echo "      The tool store's key must carry the path package's tree stamp."
-            exit 1; }
-          sleep 1; probe_off ../toyc
-          "$MCPP" run > /tmp/toy5b.log 2>&1 || true
-          grep -q 'answer()       = 42' /tmp/toy5b.log || {
-            cat /tmp/toy5b.log
-            echo "FAIL: reverting the compiler's sources did not reach the artifact."
-            exit 1; }
-
-          # ... and a version bump still rebuilds it, as it always did.
-          sleep 1; probe_on ../toyc
-          sed -i 's/^version     = "0.1.0"/version     = "0.1.1"/' ../toyc/mcpp.toml
-          "$MCPP" run > /tmp/toy6.log 2>&1 || true
-          sed -i 's/^version     = "0.1.1"/version     = "0.1.0"/' ../toyc/mcpp.toml
-          probe_off ../toyc
-          grep -q 'answer()       = 168' /tmp/toy6.log || {
-            cat /tmp/toy6.log; echo "FAIL: bumping the tool version did not rebuild it"; exit 1; }
-          echo "ok: the compiler is a declared input, and the store is keyed on the tool's source"
-
-      - name: "Graphics example: render offscreen on lavapipe and assert the pixels"
-        run: |
-          set -o pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          cd examples/10-graphics/offscreen
-          "$MCPP" build
-          # THE SHADERS ARE THE FIRST ASSERTION, and both of them: a rule that
-          # compiled only the first source would leave the second header absent
-          # and everything after this would still pass.
-          d="$(sh "$GITHUB_WORKSPACE/.github/tools/out_dir.sh")/spirv"
-          for f in triangle_vert triangle_frag; do
-            test -f "$d/$f.h" || { echo "missing $d/$f.h"; exit 1; }
-            # Either file: which of the two carries the words is a property of
-            # the shader compiler the rule chose, not of the shader. See the
-            # cross-platform jobs, where that choice differs.
-            # ONE FILE AT A TIME, because `grep -qs a b` exits 2 when `b`
-            # does not exist -- even on a match in `a`, and even with `-s`,
-            # which suppresses the message and not the status. Written as one
-            # grep over both names, this criterion fails whenever the route
-            # that produces only a header is taken, which is a failure about
-            # the criterion and not about the shader.
-            found=""
-            for g in "$d/$f.h" "$d/$f.inc"; do
-              [ -f "$g" ] && grep -q '0x07230203' "$g" && found=1
-            done
-            [ -n "$found" ] \
-              || { echo "$f carries no SPIR-V magic in either $f.h or $f.inc"; exit 1; }
-          done
-          icd=$(find "${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-mesa-lavapipe" \
-                     "$HOME/.xlings/data/xpkgs/xim-x-mesa-lavapipe" \
-                     -name 'lvp_icd.x86_64.json' -print -quit 2>/dev/null || true)
-          [ -n "$icd" ] || { echo "no lavapipe ICD in either store"; exit 1; }
-          out=$(VK_DRIVER_FILES="$icd" "$MCPP" run 2>&1) || { echo "$out"; exit 1; }
-          echo "$out"
-          # The program asserts the corners and the centre itself and exits
-          # non-zero on either. What CI adds is that the run reached the DEVICE:
-          # the software rasteriser produces the same pixels by construction, so
-          # the image cannot distinguish them and the device name is what does.
-          echo "$out" | grep -q 'llvmpipe' \
-            || { echo "the run did not reach the lavapipe device"; exit 1; }
-          echo "$out" | grep -qE 'centre pixel: \([0-9]+, [0-9]+, [0-9]+, 255\)' \
-            || { echo "no centre pixel was reported"; exit 1; }
-          # THE REVERSE LEG, AND IT COMPARES THE PIXELS RATHER THAN JUST
-          # RUNNING. The claim this example makes is that the image is a
-          # contract two independent rasterisers satisfy, not a property of one
-          # device -- so the criterion is that the two legs report the SAME
-          # centre pixel while reporting different devices. Measured: both give
-          # (124, 70, 62, 255), byte for byte.
-          gpu_px=$(echo "$out" | grep -m1 '^centre pixel:')
-          "$MCPP" build --no-accel
-          "$MCPP" run --no-accel | tee cpu.log
-          grep -q 'cpu rasteriser' cpu.log || { echo "the CPU leg did not run"; exit 1; }
-          cpu_px=$(grep -m1 '^centre pixel:' cpu.log)
-          [ -n "$gpu_px" ] && [ "$gpu_px" = "$cpu_px" ] || {
-            echo "the two legs disagree about the image:"
-            echo "  device: $gpu_px"
-            echo "  cpu:    $cpu_px"
-            exit 1; }
-          echo "ok: both legs agree on $cpu_px"
-
-      - name: "Vulkan example: build the device half and run it on lavapipe"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          cd examples/09-heterogeneous/vulkan/app
-          "$MCPP" build
-          # BOTH STORES, because which one holds the payload is decided by how
-          # this mcpp resolved its home -- and a `find` over only one of them
-          # is the defect this repository has already paid for twice (e2e 614,
-          # llama.cpp-m's Vulkan job). Ask for the file, not for a layout.
-          icd=$(find "${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-mesa-lavapipe" \
-                     "$HOME/.xlings/data/xpkgs/xim-x-mesa-lavapipe" \
-                     -name 'lvp_icd.x86_64.json' -print -quit 2>/dev/null || true)
-          [ -n "$icd" ] || { echo "no lavapipe ICD in either store"; exit 1; }
-          echo "using ICD $icd"
-          out=$(VK_DRIVER_FILES="$icd" "$MCPP" run 2>&1) || { echo "$out"; exit 1; }
-          echo "$out"
-          # The device leg is the point: a run that silently fell back to the
-          # CPU variant would print the same numbers, so the assertion is that
-          # the program says which device answered AND that it is the payload's.
-          echo "$out" | grep -q 'llvmpipe' \
-            || { echo "the run did not reach the lavapipe device"; exit 1; }
-          echo "$out" | grep -q '12 24 36 48' \
-            || { echo "the device produced the wrong result"; exit 1; }
diff --git a/.github/workflows/ci-macos-e2e.yml b/.github/workflows/ci-macos-e2e.yml
deleted file mode 100644
index 5428ed881..000000000
--- a/.github/workflows/ci-macos-e2e.yml
+++ /dev/null
@@ -1,132 +0,0 @@
-name: ci-macos-e2e
-
-# The e2e suite on macOS ARM64, called by ci.yml beside ci-macos.yml after the
-# macOS build. Two shards, assigned by measured duration
-# (tests/e2e/timings/macos.tsv, rule R4 of the 2026-10-02 CI record), each
-# running the one binary build.yml produced (use-built-mcpp, rule R1), and
-# each writing the per-test report the e2e-coverage job of ci.yml reads.
-#
-# The suite took about 3.5 minutes when this workflow was split out of
-# ci-macos.yml, and it was not sharded for that reason. Measured on 2026-10-01
-# it took 17 to 21 minutes in one job, and reached the 25-minute limit once.
-#
-# Paired workflows: ci-macos.yml, ci-linux-e2e.yml, ci-windows-e2e.yml.
-
-on:
-  workflow_call:
-
-jobs:
-  e2e:
-    name: e2e suite ${{ matrix.shard }}/${{ matrix.shards }} (macOS ARM64, self-host, ${{ matrix.image }})
-    # The same two images as ci-macos.yml; `xcode-27` is macOS 27 (see there).
-    # While the line was on LLVM 22.1.8 the xcode-27 leg was known red
-    # (#669: the image's SDKs ship `arm64e.x1` .tbd stubs that ld64.lld 22.1.8
-    # cannot parse, llvm-project#222721) and ran as a single shard behind an
-    # input. The 23.1.3 line move removed the cause, so both images run the
-    # same two-shard suite on every pull request.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: macos-15
-            shard: 1
-            shards: 2
-          - image: macos-15
-            shard: 2
-            shards: 2
-          - image: xcode-27
-            shard: 1
-            shards: 2
-          - image: xcode-27
-            shard: 2
-            shards: 2
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 60
-    env:
-      E2E_SHARD: ${{ matrix.shard }}/${{ matrix.shards }}
-      E2E_TIMINGS: tests/e2e/timings/macos.tsv
-      E2E_REPORT: ${{ github.workspace }}/e2e-report-${{ matrix.image == 'macos-15' && 'macos' || matrix.image }}-${{ matrix.shard }}.tsv
-    # NOTE: no MCPP_VERBOSE — the e2e suite asserts mcpp's default quiet
-    # output (tests 48/53).
-    steps:
-      # `submodules: recursive` so tests/e2e/233_bench_matrix.sh can check that
-      # each `hub`/`body` in bench/matrix.json exists in the tree it names --
-      # the check reads "submodule not initialised" without them and reports
-      # nothing, which is how a stale hub path survived (#599). Under 10 MB of
-      # source across the three pins, and nothing here builds them.
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - uses: ./.github/actions/setup-macos-llvm
-        with:
-          image: ${{ matrix.image }}
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: macos-arm64
-
-      - name: E2E suite
-        # Twice a shard's budget of about nine minutes (R4); the per-test 600 s
-        # limit in run_all.sh names a test that hangs.
-        timeout-minutes: 20
-        run: |
-          # MCPP is this commit's binary and MCPP_BOOT the released bootstrap
-          # (use-built-mcpp); e2e 252 checks an older client against a package
-          # this commit produces, so it needs a real old binary.
-          export MCPP MCPP_BOOT MCPP_VENDORED_XLINGS
-          test -x "$MCPP_VENDORED_XLINGS"
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          "$MCPP" self config
-          # macOS default toolchain is LLVM
-          "$MCPP" toolchain default "llvm@${MCPP_LLVM_VER}"
-          # The index payloads e2e 32, 33 and 40 link from this home into their
-          # own (_inherit_toolchain.sh); see ci-linux-e2e.yml.
-          XLINGS_HOME="$HOME/.mcpp/registry" "$MCPP_VENDORED_XLINGS" install \
-              mcpplibs:cmdline@0.0.1 mcpplibs:cmdline@0.0.2 -y
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-          set -o pipefail
-          bash tests/e2e/run_all.sh 2>&1 | tee "$RUNNER_TEMP/e2e-suite.log"
-
-      # One file, no glob: the report the e2e-coverage job of ci.yml reads. A
-      # glob upload once hung a macOS job for ten minutes, and cancelling it lost
-      # the job's whole log.
-      - name: Upload the shard's report
-        if: always()
-        timeout-minutes: 5
-        uses: actions/upload-artifact@v4
-        with:
-          name: e2e-report-${{ matrix.image == 'macos-15' && 'macos' || matrix.image }}-${{ matrix.shard }}
-          path: e2e-report-${{ matrix.image == 'macos-15' && 'macos' || matrix.image }}-${{ matrix.shard }}.tsv
-          if-no-files-found: warn
-          retention-days: 7
-
-      # Measurement legs print READING lines and pass whatever they read; the
-      # readings are what a decision is taken from (#646 F2: whether a C++
-      # exception thrown in a dylib is caught by its class under the payload's
-      # default runtime), so they are collected where a reader finds them.
-      - name: Measurement readings
-        if: always()
-        shell: bash
-        run: |
-          {
-            echo "### Measurement readings (macOS)"
-            echo '```'
-            grep -h '^READING' "$RUNNER_TEMP/e2e-suite.log" 2>/dev/null || echo "(none)"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      # #647 E3: an Android row links on a macOS host. Its own step, because the
-      # NDK is a large download the suite's per-test bound does not allow for,
-      # and the shard does not carry it (the script declares android-ndk).
-      - name: "Android row on a macOS host (721)"
-        # Once per image, not once per shard: the step installs the NDK.
-        if: matrix.shard == 1  # ci-lint: allow-r1: one NDK install per image; the shards share it
-        timeout-minutes: 30
-        shell: bash
-        run: |
-          set -o pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          "$MCPP" toolchain install android-ndk@30.0.16248370
-          bash tests/e2e/721_*.sh 2>&1 | tee "$RUNNER_TEMP/721.log"
-          grep -q '^PASS: 721' "$RUNNER_TEMP/721.log"
diff --git a/.github/workflows/ci-macos-ios.yml b/.github/workflows/ci-macos-ios.yml
deleted file mode 100644
index 38863e54e..000000000
--- a/.github/workflows/ci-macos-ios.yml
+++ /dev/null
@@ -1,378 +0,0 @@
-name: ci-macos-ios
-
-# The iOS rows, measured on the only machine that can answer for them.
-#
-# iOS needs an ecosystem compiler and a LOCATED SDK: `xim:llvm` emits arm64
-# Mach-O for an iOS deployment target, and only the machine's Xcode can supply
-# the iPhoneOS / iPhoneSimulator headers and stub libraries, which are not
-# redistributable. The simulator runtime is the same category. So every claim
-# about these three rows is a claim about a macOS runner, and this job is where
-# they are made.
-#
-# Kept out of ci-macos.yml deliberately: that job asserts mcpp's default quiet
-# output shape and tacking a differently-shaped leg onto it has broken that
-# assertion before.
-
-on:
-  workflow_call:
-
-jobs:
-  # THE PREMISES, AS A PROBE THAT RUNS ON REQUEST.
-  #
-  # This job measured what the iOS rows were scheduled on: that a GitHub macOS
-  # runner ships both SDKs and a bootable simulator, that `simctl spawn` takes a
-  # bare Mach-O, that the payload's `clang++.cfg` names the macOS SDK, and
-  # which C++ runtime an iOS link can use. Every answer is now encoded -- in
-  # `simctl-run`, in `--no-default-config` on the Apple cross path, and in the
-  # MachO contract cell -- and asserted by `ios-engine` below.
-  #
-  # Every step continues on error, because a probe's value is the complete set
-  # of answers. That is also why it does not run on every change: a job that
-  # cannot fail shown as a green check beside the gate reads as a second gate.
-  # It stays available for the day a runner image changes one of the premises.
-  ios-host-surface:
-    name: iOS - what this runner actually provides
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: macos-15
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-macos-llvm
-
-      - name: "Host surface: the two located SDKs and the simulator runtime"
-        continue-on-error: true
-        run: |
-          set -x
-          xcode-select -p
-          xcrun --sdk iphoneos --show-sdk-path
-          xcrun --sdk iphoneos --show-sdk-version
-          xcrun --sdk iphonesimulator --show-sdk-path
-          xcrun --sdk iphonesimulator --show-sdk-version
-          set +x
-          echo "--- runtimes ---"
-          xcrun simctl list runtimes
-          echo "--- devices available ---"
-          xcrun simctl list devices available
-
-      # THE PAYLOAD'S CLANG READS A CONFIG FILE, AND THAT CONFIG NAMES A
-      # DIFFERENT SDK. Measured with `-isysroot <iPhoneSimulator18.5.sdk>` on
-      # the command line and the cfg not suppressed:
-      #
-      #   ld64.lld: error: /Library/Developer/CommandLineTools/SDKs/
-      #     MacOSX.sdk/usr/lib/libc++.tbd(/usr/lib/libc++.1.dylib) is
-      #     incompatible with arm64 (iOS Simulator18.0.0)
-      #
-      # which is why mcpp's Apple cross path carries `--no-default-config`.
-      - name: "The payload's default config, which is why --no-default-config"
-        continue-on-error: true
-        run: |
-          set -x
-          ls -la "$LLVM_ROOT/bin/"*.cfg || true
-          for f in "$LLVM_ROOT/bin/"*.cfg; do echo "=== $f"; cat "$f"; done || true
-
-      # WHETHER A BARE MACH-O CAN BE RUN AT ALL, which decided how much the
-      # runner program has to do: `simctl launch` needs an installed .app,
-      # `simctl spawn` takes an executable.
-      - name: "Device: is one bootable, and does spawn take a bare executable"
-        continue-on-error: true
-        run: |
-          set -uo pipefail
-          UDID=$(xcrun simctl list devices available \
-                 | grep -A50 -- '-- iOS' \
-                 | grep -m1 -oE '[0-9A-F]{8}-[0-9A-F-]{27}' || true)
-          echo "udid=[$UDID]"
-          if [ -z "$UDID" ]; then
-            echo "NO-IOS-SIMULATOR-DEVICE"
-            exit 0
-          fi
-          xcrun simctl boot "$UDID" || true
-          xcrun simctl bootstatus "$UDID" -b 2>&1 | tail -3 || true
-          cat > /tmp/hello.cpp << 'CPP'
-          #include <cstdio>
-          int main() { std::puts("1-2-3"); return 0; }
-          CPP
-          SDK=$(xcrun --sdk iphonesimulator --show-sdk-path)
-          if ! "$LLVM_ROOT/bin/clang++" -std=c++23 --no-default-config \
-                 -target arm64-apple-ios18.0-simulator \
-                 -isysroot "$SDK" -o /tmp/hello /tmp/hello.cpp; then
-            echo "SIM-COMPILE-FAILED"
-            exit 0
-          fi
-          file /tmp/hello
-          otool -l /tmp/hello | grep -A5 LC_BUILD_VERSION || true
-          echo "--- simctl spawn on a bare Mach-O ---"
-          if xcrun simctl spawn "$UDID" /tmp/hello; then
-            echo "SPAWN-OK"
-          else
-            echo "SPAWN-FAILED exit=$?"
-          fi
-
-      # THE C++ RUNTIME QUESTION. macOS links the PAYLOAD's static libc++ so
-      # that mcpp's deployment floor is real; that archive is built for macOS,
-      # and ld64 refuses an object built for one platform in a link for
-      # another. Both routes are tried because "which one works" is the fact
-      # the contract table needed.
-      - name: "C++ runtime: SDK libc++ versus the payload static archive"
-        continue-on-error: true
-        run: |
-          set -x
-          SDK=$(xcrun --sdk iphoneos --show-sdk-path)
-          cat > /tmp/cxx.cpp << 'CPP'
-          #include <string>
-          #include <cstdio>
-          int main() { std::string s = "1-2-3"; std::puts(s.c_str()); return 0; }
-          CPP
-          echo "--- (a) SDK libc++, dynamic ---"
-          if "$LLVM_ROOT/bin/clang++" -std=c++23 --no-default-config \
-               -target arm64-apple-ios18.0 \
-               -isysroot "$SDK" -o /tmp/cxx-sdk /tmp/cxx.cpp; then
-            otool -L /tmp/cxx-sdk
-            echo "SDK-LIBCXX-OK"
-          else
-            echo "SDK-LIBCXX-FAILED"
-          fi
-          echo "--- (b) payload static libc++ ---"
-          if "$LLVM_ROOT/bin/clang++" -std=c++23 --no-default-config \
-               -target arm64-apple-ios18.0 \
-               -isysroot "$SDK" -nostdlib++ \
-               "$LLVM_ROOT/lib/libc++.a" "$LLVM_ROOT/lib/libc++abi.a" \
-               -o /tmp/cxx-static /tmp/cxx.cpp; then
-            echo "PAYLOAD-STATIC-OK"
-          else
-            echo "PAYLOAD-STATIC-FAILED"
-          fi
-          set +x
-
-  # THE GATE. Every step here fails the job when its claim does not hold.
-  #
-  # The first version of this job was a probe too -- every step continued on
-  # error -- and it stayed that way after the rows it measured moved to
-  # `verified` and `preview`. That left a verified tier with no check that
-  # could turn red: a regression in the Apple cross path would have printed
-  # `RUN-THROUGH-RUNNER-FAILED` inside a green job.
-  ios-engine:
-    name: iOS - mcpp builds and the simulator runs it
-    runs-on: macos-15
-    timeout-minutes: 40
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - uses: ./.github/actions/setup-macos-llvm
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: macos-arm64
-
-      # NO TOOLCHAIN IS DECLARED, AND THAT IS WHAT MAKES THIS THE USER'S PATH.
-      #
-      # While the rows were `planned` the fixture had to write
-      # `[target.<row>] toolchain = "llvm@23.1.3"` to get past the tier gate,
-      # which meant it measured an override and never the row's own pin. The
-      # rows are now `verified` and `preview` and resolve `llvm@23.1.3` by
-      # themselves, so the fixture says nothing and the default is what is
-      # measured.
-      - name: "Fixture: a project that imports std and prints 1-2-3"
-        run: |
-          set -euo pipefail
-          mkdir -p /tmp/iostest/src
-          cat > /tmp/iostest/mcpp.toml << 'TOML'
-          [package]
-          name = "iostest"
-          version = "0.1.0"
-
-          [build]
-          ios_deployment_target = "18.0"
-
-          # THE C++ STANDARD LIBRARY AND THE COMPILER RUNTIME ARE PACKAGES ON
-          # THESE ROWS (#630). The payload's static libc++ is a macOS object
-          # and its resource directory carries no iOS builtins archive, so the
-          # engine used to link the SDK's libc++ under the payload's newer
-          # headers -- which fails at link on the first inline path the older
-          # dylib does not export. `llvm.libcxx` brings headers, module and
-          # objects as one release; `llvm.compiler-rt-builtins` brings
-          # `__isPlatformVersionAtLeast`. Declared by git until the index
-          # carries them.
-          [target.'cfg(os = "ios")'.dependencies]
-          llvm.libcxx               = { git = "https://github.com/mcpplibs/libcxx.git", tag = "22.1.8.1" }
-          llvm.compiler-rt-builtins = { git = "https://github.com/mcpplibs/compiler-rt-builtins.git", tag = "22.1.8.5" }
-
-          # THE RUNNER IS AN ARGV PREFIX AND THE SESSION BELONGS TO A
-          # PACKAGE. `simctl-run` comes from `xim:apple-simulator-tools`; it
-          # chooses a device, boots it if it is not booted, waits, spawns, and
-          # returns the program's own exit status. The device row keeps
-          # `runner` unset: an artefact cannot be run off an iOS device without
-          # a signature the developer owns.
-          [target.aarch64-ios-sim]
-          runner = ["simctl-run"]
-
-          # Declared on the row that runs it, as examples/13 does. A target
-          # section's `xlings.workspace` is installed only when that target is
-          # built, so the step below that runs the simulator artefact through
-          # `simctl-run` is also the measurement that this declaration works.
-          [target.aarch64-ios-sim.xlings.workspace]
-          "xim:apple-simulator-tools" = ""
-          TOML
-          cat > /tmp/iostest/src/main.cpp << 'CPP'
-          import std;
-          // The two inline paths that failed at link under the payload's
-          // headers over the SDK's libc++ (`__hash_memory`,
-          // `__atomic_notify_all_global_table`), and an availability check,
-          // which is `__isPlatformVersionAtLeast` from the builtins package.
-          int main() {
-            std::unordered_map<std::string, int> m;
-            m["three"] = 3;
-            std::atomic<int> a{1};
-            a.notify_all();
-            int two = 2;
-            if (__builtin_available(iOS 17, *)) two = 2;
-            std::vector<int> v{m["three"], a.load(), two};
-            std::ranges::sort(v);
-            std::print("{}-{}-{}\n", v[0], v[1], v[2]);
-          }
-          CPP
-          cat /tmp/iostest/mcpp.toml
-
-          # ONE ASSERTION FOR THE THREE ARTEFACTS. A build that succeeds cannot
-          # tell an iOS binary from a macOS one; LC_BUILD_VERSION can. Each
-          # value is read from the load command and compared whole, so an empty
-          # reading is a failure and not a pass.
-          cat > /tmp/assert-artefact.sh << 'SH'
-          #!/usr/bin/env bash
-          set -uo pipefail
-          target=$1 arch=$2 platform=$3 minos=$4
-          arts=(/tmp/iostest/target/"$target"/*/bin/iostest)
-          art=${arts[0]}
-          if [ ! -f "$art" ]; then
-            echo "FAIL: $target produced no artefact under /tmp/iostest/target/$target"
-            exit 1
-          fi
-          desc=$(file "$art")
-          lc=$(otool -l "$art")
-          echo "$desc"
-          grep -A5 LC_BUILD_VERSION <<<"$lc" || true
-          got_platform=$(awk '/cmd LC_BUILD_VERSION/{f=1} f && $1=="platform"{print $2; exit}' <<<"$lc")
-          got_minos=$(awk '/cmd LC_BUILD_VERSION/{f=1} f && $1=="minos"{print $2; exit}' <<<"$lc")
-          fail=0
-          if ! grep -qE "Mach-O 64-bit executable ${arch}\$" <<<"$desc"; then
-            echo "FAIL: $target is not a Mach-O $arch executable"; fail=1
-          fi
-          if [ "$got_platform" != "$platform" ]; then
-            echo "FAIL: $target LC_BUILD_VERSION platform is '$got_platform', expected $platform"; fail=1
-          fi
-          if [ "$got_minos" != "$minos" ]; then
-            echo "FAIL: $target minos is '$got_minos', expected $minos from ios_deployment_target"; fail=1
-          fi
-          [ "$fail" = 0 ] && echo "ok: $target is Mach-O $arch, platform $platform, minos $minos"
-          exit "$fail"
-          SH
-          chmod +x /tmp/assert-artefact.sh
-
-      # THE DEVICE ROW. Nothing runs it -- that needs a signature the developer
-      # owns -- so the claim is the artefact: `platform 2` is IOS. The refusal
-      # for a machine WITHOUT the SDK is asserted by tests/e2e/641 on every
-      # non-Apple host, which is the only place the SDK is genuinely absent:
-      # pointing `DEVELOPER_DIR` at nothing here measured nothing, because
-      # `xcrun` falls back to the recorded developer directory.
-      - name: "aarch64-ios: the artefact names the iOS platform"
-        run: |
-          set -euo pipefail
-          cd /tmp/iostest
-          "$MCPP_FRESH" build --target aarch64-ios
-          /tmp/assert-artefact.sh aarch64-ios arm64 2 18.0
-
-      # `platform 7` is IOSSIMULATOR. The number is what separates this row from
-      # the device row; the architecture does not.
-      - name: "aarch64-ios-sim: the artefact names the simulator platform"
-        run: |
-          set -euo pipefail
-          cd /tmp/iostest
-          "$MCPP_FRESH" build --target aarch64-ios-sim 2>&1 | tee build-sim.log
-          /tmp/assert-artefact.sh aarch64-ios-sim arm64 7 18.0
-
-      # THE TWO LAYERS THE PACKAGES SUPPLY, READ FROM THE REPORT AND FROM THE
-      # ARTEFACT. A build that succeeds cannot tell a self-contained libc++
-      # from the SDK's; the load commands can, and the report says which
-      # package answered for each layer.
-      - name: "aarch64-ios-sim: the C++ runtime and the builtins are the graph's"
-        run: |
-          set -euo pipefail
-          cd /tmp/iostest
-          grep -E 'c\+\+-abi +libc\+\+ +\(libcxx@22\.1\.8\.1, graph\)' build-sim.log \
-            || { echo "FAIL: the report does not name llvm.libcxx as the C++ layer"; exit 1; }
-          grep -E 'compiler-runtime +compiler-rt +\(compiler-rt-builtins@22\.1\.8\.5, graph\)' build-sim.log \
-            || { echo "FAIL: the report does not name llvm.compiler-rt-builtins as the compiler runtime"; exit 1; }
-          art=$(ls /tmp/iostest/target/aarch64-ios-sim/*/bin/iostest | head -1)
-          if otool -L "$art" | grep -q 'libc++'; then
-            echo "FAIL: the artefact links a libc++ dylib"; otool -L "$art"; exit 1
-          fi
-          echo "ok: no libc++ dylib in the load commands; both layers are the graph's"
-
-      # THE NEGATIVE DIRECTION: without the packages a program that imports
-      # std still builds, as it did before this release, and the degradation
-      # names the two lines; one that does not import std takes the SDK's
-      # headers under the SDK's libc++. Without this step the change could be
-      # read as "every iOS build now needs a package".
-      - name: "aarch64-ios-sim: without the packages, import std builds with the hazard named and plain C++ takes the SDK's headers"
-        run: |
-          set -euo pipefail
-          rm -rf /tmp/iosplain && mkdir -p /tmp/iosplain/src && cd /tmp/iosplain
-          # NO FLOOR STATED: the row takes the located SDK's version, read
-          # through xcrun, and the artefact's LC_BUILD_VERSION minos says so.
-          cat > mcpp.toml << 'TOML'
-          [package]
-          name = "iosplain"
-          version = "0.1.0"
-          TOML
-          printf 'import std;\nint main() { std::print("x\\n"); }\n' > src/main.cpp
-          "$MCPP_FRESH" build --target aarch64-ios-sim > mixed.log 2>&1 || { echo "FAIL: import std without llvm.libcxx no longer builds"; cat mixed.log; exit 1; }
-          # A degradation renders its `what` text, not its domain, so the
-          # sentence is what a log can be asked for.
-          grep -q "links the SDK's libc++ under the toolchain payload's libc++ headers" mixed.log || { echo "FAIL: no degradation named the mixed libc++"; cat mixed.log; exit 1; }
-          grep -q 'llvm.libcxx' mixed.log || { echo "FAIL: the degradation does not name llvm.libcxx"; cat mixed.log; exit 1; }
-          printf '#include <cstdio>\n#include <string>\nint main() { std::string s = "1-2-3"; std::puts(s.c_str()); }\n' > src/main.cpp
-          rm -rf target
-          "$MCPP_FRESH" build --target aarch64-ios-sim 2>&1 | tee plain.log
-          grep -q 'carries no compiler runtime for aarch64-ios-sim' plain.log || { echo "FAIL: no degradation named the missing compiler runtime"; exit 1; }
-          grep -q "links the SDK's libc++ under" plain.log && { echo "FAIL: a program without import std was reported as mixing libc++"; exit 1; }
-          ninja=$(ls target/aarch64-ios-sim/*/build.ninja | head -1)
-          grep -q -- '-isystem[^ ]*iPhoneSimulator[^ ]*/usr/include/c++/v1' "$ninja" || { echo "FAIL: the plain program does not take the SDK's C++ headers"; grep -o -- '-isystem[^ ]*c++/v1' "$ninja" | sort -u; exit 1; }
-          grep -q -- '-isystem[^ ]*xim-x-llvm[^ ]*/c++/v1' "$ninja" && { echo "FAIL: the plain program still takes the payload's C++ headers"; exit 1; }
-          art=$(ls target/aarch64-ios-sim/*/bin/iosplain | head -1)
-          otool -L "$art" | grep -q '/usr/lib/libc++.1.dylib' || { echo "FAIL: the plain program does not link the SDK's libc++"; otool -L "$art"; exit 1; }
-          sdkver=$(xcrun --sdk iphonesimulator --show-sdk-version)
-          minos=$(otool -l "$art" | awk '/cmd LC_BUILD_VERSION/{f=1} f && $1=="minos"{print $2; exit}')
-          [ "$minos" = "$sdkver" ] || { echo "FAIL: with no floor stated, minos is '$minos' and the located SDK is $sdkver"; exit 1; }
-          echo "ok: an unset floor is the located SDK's version ($sdkver)"
-          echo "ok: import std builds with the hazard named; plain C++ takes the SDK's headers and libc++; the builtins degradation is printed"
-
-      # THE SUPPORTED PATH, which is what the `verified` tier claims: a runner
-      # the manifest declares and a program a package provides. The program's
-      # own line is compared whole. An iOS-simulator Mach-O does not execute on
-      # the macOS host directly, so the line appearing at all means the
-      # simulator ran it.
-      - name: "aarch64-ios-sim: mcpp run prints 1-2-3 through the runner"
-        run: |
-          set -uo pipefail
-          cd /tmp/iostest
-          out=$("$MCPP_FRESH" run --target aarch64-ios-sim 2>&1) && rc=0 || rc=$?
-          printf '%s\n' "$out" | tail -20
-          if [ "$rc" -ne 0 ]; then
-            echo "FAIL: mcpp run --target aarch64-ios-sim exited $rc"
-            exit 1
-          fi
-          if ! grep -qx '1-2-3' <<<"$out"; then
-            echo "FAIL: the program's output line '1-2-3' is absent"
-            exit 1
-          fi
-          echo "ok: mcpp run --target aarch64-ios-sim printed 1-2-3 and exited 0"
-
-      # THE THIRD ROW, ON A HOST THAT CANNOT RUN IT. A simulator runs the host's
-      # architecture and this runner is Apple silicon, so the claim is the
-      # artefact alone -- which is exactly the `preview` tier the row carries.
-      - name: "x86_64-ios-sim: the artefact, on a host that cannot run it"
-        run: |
-          set -euo pipefail
-          cd /tmp/iostest
-          "$MCPP_FRESH" build --target x86_64-ios-sim
-          /tmp/assert-artefact.sh x86_64-ios-sim x86_64 7 18.0
diff --git a/.github/workflows/ci-macos.yml b/.github/workflows/ci-macos.yml
deleted file mode 100644
index 668c0d47c..000000000
--- a/.github/workflows/ci-macos.yml
+++ /dev/null
@@ -1,470 +0,0 @@
-name: ci-macos
-
-# macOS CI for mcpp — validates LLVM/Clang as the default macOS toolchain.
-# Tests the full xlings → LLVM → C++23 import std pipeline on macOS ARM64.
-#
-# Called by ci.yml after the macOS build (build.yml): the steps that need this
-# commit's mcpp take that build (use-built-mcpp, rule R1 of the 2026-10-02 CI
-# record) instead of building one. The e2e suite is ci-macos-e2e.yml, called
-# beside this one with the same setup (.github/actions/setup-macos-llvm).
-
-on:
-  workflow_call:
-
-jobs:
-  macos-xlings-llvm:
-    name: macOS ARM64 — xlings LLVM end-to-end (${{ matrix.image }})
-    # Two images: macos-15, the image every other macOS job uses, and macOS 27,
-    # the newest macOS release. The newest release is where a change of the SDK,
-    # the system libc++ headers or the loader first shows; the packaged binaries
-    # carry minos=14.0, and ci-fresh-install covers that floor.
-    #
-    # GitHub serves macOS 27 under the preview label `xcode-27` (macOS 27.0 with
-    # Xcode 27, actions/runner-images#14404); there is no `macos-27` label, and
-    # a job naming one waits for a runner that never comes. The "System info"
-    # step prints the OS the label delivered.
-    #
-    # Both images run on every pull request: while the line was on LLVM 22.1.8
-    # the xcode-27 leg was known red (#669, the arm64e.x1 .tbd stubs, gated
-    # behind an input so a PR that could not fix it held no green slot) — the
-    # 23.1.3 line move removed that cause, and a change can change the outcome
-    # here again.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: macos-15
-          - image: xcode-27
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 45
-    # NOTE: no MCPP_VERBOSE here — keep this job's output shape identical to
-    # ci-macos-e2e.yml, which asserts mcpp's default quiet output (48/53).
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: System info
-        run: |
-          uname -a
-          sw_vers
-          # `xcode-27` names an Xcode, not an OS, and the image changed its base
-          # OS once already; the leg exists for macOS 27, so it says so or fails.
-          if [ "${{ matrix.image }}" = xcode-27 ]; then
-            major=$(sw_vers -productVersion | cut -d. -f1)
-            [ "$major" = 27 ] || { echo "::error::xcode-27 delivered macOS $(sw_vers -productVersion), not 27"; exit 1; }
-          fi
-          xcrun --show-sdk-path
-          echo "SDK: $(xcrun --show-sdk-version)"
-
-      - uses: ./.github/actions/setup-macos-llvm
-        with:
-          image: ${{ matrix.image }}
-
-      - name: Inspect LLVM package structure
-        run: |
-          echo "=== bin/ ==="
-          ls "$LLVM_ROOT/bin/" | grep -E "^(clang|llvm|lld|ld)" | head -20
-          echo "=== lib/ ==="
-          ls "$LLVM_ROOT/lib/" 2>/dev/null | head -10
-          echo "=== share/libc++/ ==="
-          find "$LLVM_ROOT" -name "std.cppm" -o -name "std.compat.cppm" 2>/dev/null
-          echo "=== clang++.cfg ==="
-          cat "$LLVM_ROOT/bin/clang++.cfg" 2>/dev/null || echo "(no cfg file)"
-          echo "=== Target triple ==="
-          "$CXX" -dumpmachine
-          echo "=== Module manifest ==="
-          "$CXX" -print-library-module-manifest-path 2>/dev/null || echo "(not available)"
-
-      # THE TWO FLOATING MACROS mcpp STATES FOR AN APPLE TARGET
-      # (src/toolchain/hostflags.cppm, apple_float_macro_words). The macOS 27
-      # SDK leaves INFINITY and NAN to <float.h> once modules are on, and clang
-      # 22's header does not supply them in a -std=c++23 compile, so these raw
-      # compiles state them the way mcpp does. Unquoted words with no spaces, so
-      # plain word splitting of the variable is exact.
-      - name: The floating macros mcpp states for an Apple target
-        run: echo 'APPLE_FLOAT_MACROS=-DINFINITY=HUGE_VALF -DNAN=__builtin_nanf("0x7fc00000")' >> "$GITHUB_ENV"
-
-      # THE SDK mcpp'S OWN RESOLUTION NAMES: `xcrun --show-sdk-path`
-      # (modules/platform/src/macos/macos.cppm). These raw compiles state the
-      # SDK the same way, on purpose.
-      #
-      # On the 22.1.8 line this was the known-red spot (mcpp#669 has the
-      # evidence): both SDKs on the macOS 27 image ship `arm64e.x1` .tbd stubs
-      # that ld64.lld 22.1.8 cannot parse. LLVM 23.1.3 carries the fix.
-      - name: The SDK mcpp selects for an Apple target
-        run: echo "APPLE_SYSROOT=-isysroot $(xcrun --show-sdk-path)" >> "$GITHUB_ENV"
-
-      - name: Test — non-module C++23 compilation
-        run: |
-          WORK=$(mktemp -d)
-          cd "$WORK"
-          cat > main.cpp << 'EOF'
-          #include <iostream>
-          #include <format>
-          int main() {
-              std::cout << std::format("Hello from LLVM on macOS! clang {}", __clang_version__) << std::endl;
-              return 0;
-          }
-          EOF
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -o hello main.cpp
-          ./hello
-
-      - name: Test — import std (two-stage module compilation)
-        run: |
-          WORK=$(mktemp -d)
-          cd "$WORK"
-
-          # Find std.cppm
-          STD_CPPM=$(find "$LLVM_ROOT" -name "std.cppm" -path "*/libc++/*" | head -1)
-          if [ -z "$STD_CPPM" ]; then
-            echo "::error::std.cppm not found in LLVM package"
-            find "$LLVM_ROOT" -name "*.cppm" 2>/dev/null
-            exit 1
-          fi
-          echo "std.cppm at: $STD_CPPM"
-
-          echo "=== Step 1: Precompile std module ==="
-          mkdir -p pcm.cache
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            --precompile "$STD_CPPM" -o pcm.cache/std.pcm
-
-          echo "=== Step 2: Compile std.pcm → std.o ==="
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            pcm.cache/std.pcm -c -o std.o
-
-          echo "=== Step 3: Compile main.cpp with import std ==="
-          cat > main.cpp << 'EOF'
-          import std;
-          int main() {
-              std::println("C++23 import std works on macOS via xlings LLVM!");
-              return 0;
-          }
-          EOF
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -fmodule-file=std=pcm.cache/std.pcm -c main.cpp -o main.o
-
-          echo "=== Step 4: Link ==="
-          "$CXX" $APPLE_SYSROOT main.o std.o -o hello_modules
-          echo "=== Step 5: Run ==="
-          ./hello_modules
-
-      - name: Test — import std.compat
-        run: |
-          WORK=$(mktemp -d)
-          cd "$WORK"
-
-          STD_CPPM=$(find "$LLVM_ROOT" -name "std.cppm" -path "*/libc++/*" | head -1)
-          STD_COMPAT_CPPM=$(find "$LLVM_ROOT" -name "std.compat.cppm" -path "*/libc++/*" | head -1)
-
-          if [ -z "$STD_COMPAT_CPPM" ]; then
-            echo "::warning::std.compat.cppm not found, skipping"
-            exit 0
-          fi
-          echo "std.compat.cppm at: $STD_COMPAT_CPPM"
-
-          mkdir -p pcm.cache
-          # Build std first
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            --precompile "$STD_CPPM" -o pcm.cache/std.pcm
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            pcm.cache/std.pcm -c -o std.o
-
-          # Build std.compat (depends on std)
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            -fmodule-file=std=pcm.cache/std.pcm \
-            --precompile "$STD_COMPAT_CPPM" -o pcm.cache/std.compat.pcm
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            -fmodule-file=std=pcm.cache/std.pcm \
-            pcm.cache/std.compat.pcm -c -o std.compat.o
-
-          cat > main.cpp << 'EOF'
-          import std.compat;
-          #include <cstdio>
-          int main() {
-              printf("std.compat works on macOS! %s\n", "success");
-              return 0;
-          }
-          EOF
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS \
-            -fmodule-file=std=pcm.cache/std.pcm \
-            -fmodule-file=std.compat=pcm.cache/std.compat.pcm \
-            -c main.cpp -o main.o
-          "$CXX" $APPLE_SYSROOT main.o std.o std.compat.o -o compat_test
-          ./compat_test
-
-      - name: Test — multi-module project
-        run: |
-          WORK=$(mktemp -d)
-          cd "$WORK"
-
-          STD_CPPM=$(find "$LLVM_ROOT" -name "std.cppm" -path "*/libc++/*" | head -1)
-          mkdir -p pcm.cache
-
-          # Build std
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            --precompile "$STD_CPPM" -o pcm.cache/std.pcm
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -Wno-reserved-module-identifier \
-            pcm.cache/std.pcm -c -o std.o
-
-          # User module: greeter
-          cat > greeter.cppm << 'EOF'
-          export module greeter;
-          import std;
-          export namespace greeter {
-              std::string hello(std::string_view name) {
-                  return std::format("Hello, {}! (from macOS module)", name);
-              }
-          }
-          EOF
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -fmodule-file=std=pcm.cache/std.pcm \
-            --precompile greeter.cppm -o pcm.cache/greeter.pcm
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS -fmodule-file=std=pcm.cache/std.pcm \
-            pcm.cache/greeter.pcm -c -o greeter.o
-
-          # Main
-          cat > main.cpp << 'EOF'
-          import std;
-          import greeter;
-          int main() {
-              std::println("{}", greeter::hello("mcpp"));
-              return 0;
-          }
-          EOF
-          "$CXX" $APPLE_SYSROOT -std=c++23 $APPLE_FLOAT_MACROS \
-            -fmodule-file=std=pcm.cache/std.pcm \
-            -fmodule-file=greeter=pcm.cache/greeter.pcm \
-            -c main.cpp -o main.o
-          "$CXX" $APPLE_SYSROOT main.o greeter.o std.o -o multimod
-          ./multimod
-
-      - name: Validate mcpp probe logic expectations
-        run: |
-          echo "=== Verifying mcpp's assumptions ==="
-          echo "1. -print-sysroot returns empty (mcpp falls back to xcrun):"
-          result=$("$CXX" -print-sysroot 2>/dev/null || true)
-          if [ -z "$result" ]; then
-            echo "   PASS: empty (xcrun fallback needed)"
-          else
-            echo "   INFO: $result"
-          fi
-
-          echo "2. xcrun --show-sdk-path works:"
-          xcrun --show-sdk-path && echo "   PASS"
-
-          echo "3. -dumpmachine returns darwin triple:"
-          triple=$("$CXX" -dumpmachine)
-          echo "   $triple"
-          echo "$triple" | grep -q "darwin" && echo "   PASS: contains 'darwin'"
-
-          echo "4. libc++ module manifest discoverable:"
-          manifest=$("$CXX" -print-library-module-manifest-path 2>/dev/null || true)
-          if [ -n "$manifest" ] && [ -f "$manifest" ]; then
-            echo "   PASS: $manifest"
-            echo "   Content:"
-            cat "$manifest" | head -20
-          else
-            echo "   INFO: manifest not via flag, using fallback path"
-            find "$LLVM_ROOT/share/libc++" -name "*.cppm" 2>/dev/null && echo "   PASS: fallback exists"
-          fi
-
-          echo "5. llvm-ar available:"
-          ls "$LLVM_ROOT/bin/llvm-ar" && echo "   PASS"
-
-          echo "6. clang-scan-deps available:"
-          ls "$LLVM_ROOT/bin/clang-scan-deps" && echo "   PASS" || echo "   WARN: not found"
-
-      - name: Validate install.sh platform detection
-        run: |
-          uname_s=$(uname -s)
-          uname_m=$(uname -m)
-          echo "Platform: ${uname_s}-${uname_m}"
-          case "${uname_s}-${uname_m}" in
-            Darwin-arm64)   echo "PASS: would select darwin-arm64" ;;
-            Darwin-x86_64)  echo "PASS: would select darwin-x86_64" ;;
-            *)              echo "FAIL: unexpected platform"; exit 1 ;;
-          esac
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: macos-arm64
-
-      - name: Unit + integration tests via `mcpp test`
-        run: |
-          "$MCPP_FRESH" test
-
-      # WS8: this host's row of docs/01 and docs/20 is checked against the
-      # one answer the resolver gives (`self env --format json`).
-      - name: The documented default toolchain is this host's answer
-        run: |
-          python3 .github/tools/check_default_toolchain_docs.py --mcpp "$MCPP_FRESH"
-
-      - name: Forensics — test-binary link + load state (on failure)
-        if: failure()
-        run: |
-          BIN=$(find target -path "*/bin/test_manifest" | head -1)
-          echo "binary: $BIN"
-          [ -n "$BIN" ] || exit 0
-          echo "--- otool -L ---";  otool -L "$BIN" || true
-          echo "--- rpaths ---";    otool -l "$BIN" | grep -A2 LC_RPATH || true
-          echo "--- statically embedded libc++? ---"
-          # `nm ... 2>/dev/null | grep -c` USED TO PRINT "0 (good)" WHEN `nm`
-          # ITSELF FAILED. A count of zero and a tool that never ran produce the
-          # same number, and the word "good" is then a claim nothing supports.
-          # This is diagnostic output rather than a gate, which makes it worse
-          # rather than better: a human reads it and believes it.
-          if nm "$BIN" > /tmp/nm.out 2> /tmp/nm.err; then
-            echo "$(grep -cE 'T __ZNSt3__1' /tmp/nm.out) libc++ symbols (0 = none embedded)"
-          else
-            echo "nm failed, so this measurement says nothing: $(head -1 /tmp/nm.err)"
-          fi
-          echo "--- direct run ---"
-          set +e
-          "$BIN" > run.out 2>&1
-          echo "exit=$?"
-          head -20 run.out
-          sleep 5
-          echo "--- newest crash report (termination) ---"
-          CR=$(ls -t "$HOME/Library/Logs/DiagnosticReports"/*.ips 2>/dev/null | head -1)
-          if [ -n "$CR" ]; then
-            python3 - "$CR" <<'PY'
-          import json, sys
-          lines = open(sys.argv[1]).read().splitlines()
-          meta = json.loads(lines[0]); body = json.loads("\n".join(lines[1:]))
-          print("proc:", meta.get("app_name"), "| exc:", body.get("exception", {}))
-          print("termination:", body.get("termination", {}))
-          t = [th for th in body.get("threads", []) if th.get("triggered")]
-          for fr in (t[0].get("frames", [])[:12] if t else []):
-              print("  ", fr.get("imageIndex"), fr.get("symbol", fr.get("imageOffset")))
-          imgs = body.get("usedImages", [])
-          for i, im in enumerate(imgs[:12]):
-              print("img", i, im.get("path"))
-          PY
-          else
-            echo "none"
-          fi
-
-      - name: "Toolchain: LLVM — build mcpp (self-host)"
-        run: |
-          cp "$MCPP_FRESH" /tmp/mcpp-fresh
-          MCPP=/tmp/mcpp-fresh
-          "$MCPP" toolchain default "llvm@${MCPP_LLVM_VER}"
-          "$MCPP" clean
-          "$MCPP" build
-          "$MCPP" --version
-
-      # GRAPHICS ON THIS HOST, BUILD ONLY, AND THAT IS THE WHOLE CLAIM.
-      #
-      # This runner has no Vulkan device, so what is asserted is what this
-      # platform decides: that the shader compiler THIS platform uses -- the
-      # rule declares `xim:shaderc` here and `xim:glslang` on Linux -- produces
-      # both SPIR-V headers, and that the Vulkan half compiles and links
-      # against the loader package. Running it is the Linux job's criterion,
-      # where a software device (`xim:mesa-lavapipe`) is published and the two
-      # legs' pixels are compared.
-      #
-      # The example is otherwise built only on Linux (`build_examples.sh` runs
-      # there), which is exactly the shape this change exists to remove: the
-      # half of a lane written for a host is the half that host never
-      # exercises.
-      - name: "Graphics: the offscreen example builds on this host"
-        shell: bash
-        run: |
-          set -e
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          cd "$GITHUB_WORKSPACE/examples/10-graphics/offscreen"
-          # The toolchain is NAMED rather than inherited: leaving it to whatever
-          # a neighbouring step happened to select makes this step's subject
-          # depend on step order, which is not a property anybody reads.
-          "/tmp/mcpp-fresh" build --toolchain "llvm@${MCPP_LLVM_VER}"
-          d="$(sh "$GITHUB_WORKSPACE/.github/tools/out_dir.sh")/spirv"
-          for f in triangle_vert triangle_frag; do
-            test -f "$d/$f.h" || { echo "missing $d/$f.h"; exit 1; }
-            # THE MAGIC IS NOT ALWAYS IN THE HEADER, AND THAT IS THE POINT OF
-            # THIS JOB. The rule chooses the shader compiler this platform
-            # publishes -- glslang on Linux, glslc here -- and the two split
-            # the declaration differently: glslang writes a complete `const
-            # uint32_t ...[] = {...}`, glslc an initialiser list the rule
-            # declares around, so the words land in `<stem>.inc`. An assertion
-            # naming only the header is an assertion about ONE compiler, which
-            # is exactly the shape this step exists to catch.
-            # ONE FILE AT A TIME, because `grep -qs a b` exits 2 when `b`
-            # does not exist -- even on a match in `a`, and even with `-s`,
-            # which suppresses the message and not the status. Written as one
-            # grep over both names, this criterion fails whenever the route
-            # that produces only a header is taken, which is a failure about
-            # the criterion and not about the shader.
-            found=""
-            for g in "$d/$f.h" "$d/$f.inc"; do
-              [ -f "$g" ] && grep -q '0x07230203' "$g" && found=1
-            done
-            [ -n "$found" ] \
-              || { echo "$f carries no SPIR-V magic in either $f.h or $f.inc"; exit 1; }
-          done
-          echo "ok: both shader stages compiled and the Vulkan half linked"
-
-      # AND NOW IT RUNS, WHICH IS A DIFFERENT CLAIM FROM THE ONE ABOVE.
-      #
-      # A build asserts that the shader compiler this platform publishes works
-      # and that the Vulkan half links. It cannot assert that the loader hands
-      # this program a device, and on macOS that is the interesting half:
-      # MoltenVK is a PORTABILITY driver, which the loader does not give to
-      # `vkEnumeratePhysicalDevices` unless the instance asked for portability
-      # enumeration. A program written against native drivers therefore finds no
-      # device here and reports it as "this machine has no GPU".
-      #
-      # This step is what turns that into a red build rather than a plausible
-      # message. It depends on the portability enumeration in this PR: without
-      # it the run reaches zero devices even though everything installed
-      # correctly.
-      #
-      # `VK_DRIVER_FILES` rather than an ICD search directory: the package is in
-      # the xlings store, not in `/usr/local/share/vulkan/icd.d`, and naming the
-      # file is the one form that does not depend on where the loader looks.
-      - name: "Graphics: the offscreen example RUNS on MoltenVK"
-        shell: bash
-        run: |
-          set -e
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          # NOT installed from here. The example declares `xim:moltenvk` under
-          # `cfg(macos)`, so the build above already provisioned it, and looking
-          # for the ICD without installing anything is what asserts that the
-          # declaration works. An `xlings install` here would make this step
-          # pass whether the manifest named the driver or not.
-          icd=$(find "${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-moltenvk" \
-                     "$HOME/.xlings/data/xpkgs/xim-x-moltenvk" \
-                     -name 'MoltenVK_icd.json' -print -quit 2>/dev/null || true)
-          [ -n "$icd" ] || { echo "no MoltenVK ICD in either store"; exit 1; }
-          echo "ICD: $icd"
-          cd "$GITHUB_WORKSPACE/examples/10-graphics/offscreen"
-          out=$(VK_DRIVER_FILES="$icd" "/tmp/mcpp-fresh" run 2>&1) || { echo "$out"; exit 1; }
-          echo "$out"
-          # The program asserts the corners and the centre itself and exits
-          # non-zero on either. What CI adds is that the run reached a DEVICE:
-          # a portability driver that the loader declined to show would leave
-          # the program reporting no device, which is the failure this step
-          # exists for. The name is not compared to a fixed string because it is
-          # the host's GPU and differs by runner; that it is non-empty and the
-          # centre pixel is opaque is what distinguishes reaching a device from
-          # not.
-          echo "$out" | grep -qE 'centre pixel: \([0-9]+, [0-9]+, [0-9]+, 255\)' \
-            || { echo "no centre pixel was reported: the run reached no device"; exit 1; }
-          echo "ok: MoltenVK enumerated and the image was rendered on it"
-
-      # Integration: the mcpp built from THIS PR's source (the self-host binary,
-      # $MCPP = /tmp/mcpp-fresh) builds & runs a real external C++ project —
-      # xlings (openxlings/xlings ships its own mcpp.toml).
-      - name: "Integration: mcpp builds & runs xlings (openxlings/xlings)"
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          MCPP=/tmp/mcpp-fresh   # the freshly self-hosted binary built from this PR
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          # THIS IS THE STEP THE RETRY WAS MEASURED ON: a macOS runner
-          # answered `Could not resolve host: github.com` after 30s of
-          # resolver timeout, failing a PR check before a single line of
-          # mcpp had run. See .github/tools/git_clone_retry.sh.
-          "$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh" \
-            --depth 1 --recurse-submodules \
-            https://github.com/openxlings/xlings /tmp/xlings-src
-          cd /tmp/xlings-src
-          "$MCPP" self config --mirror GLOBAL
-          "$MCPP" build
-          "$MCPP" run
diff --git a/.github/workflows/ci-target-matrix.yml b/.github/workflows/ci-target-matrix.yml
deleted file mode 100644
index 3fd792256..000000000
--- a/.github/workflows/ci-target-matrix.yml
+++ /dev/null
@@ -1,501 +0,0 @@
-name: target matrix
-
-# 让支持矩阵成为一次测量的输出,而不是一份会悄悄过期的文档。
-#
-# 这套东西存在的理由,是本仓库反复付出的一类代价:一格因为「今天这台机器恰好
-# 装了某个载荷」而通过,或因为没装而跳过,而两者在退出码上与「全部正确」没有区别。
-# 三个宿主各扫一遍,把结果与仓库里的期望表比对,差异即失败。
-on:
-  workflow_call:
-
-env:
-  XLINGS_NON_INTERACTIVE: '1'
-
-jobs:
-  invariants:
-    # 第一层:四条恒等式,不需要期望表,也不依赖机器上装了什么。
-    #    它们是结构约束 —— 任何一格只要跑起来了就该满足。
-    name: invariants (${{ matrix.host }})
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # THE BUILD-HOST AXIS IS THE SET mcpp SHIPS FOR, NOT THE SET THAT
-          # WAS CONVENIENT. `release.yml` publishes four: linux-x86_64,
-          # linux-aarch64, macosx-arm64, windows-x86_64. A host mcpp is
-          # distributed for and never scanned is a host whose target table is
-          # a claim nobody checked.
-          #
-          # `host` IS (os, arch) AND NOT os. Two Linux hosts differ in which
-          # rows they serve — `x86_64-linux-gnu` needs the host-native glibc
-          # payload, so it is reachable on one and not the other — and a single
-          # `linux` key would have them overwrite each other in expected.tsv.
-          - { host: linux-x86_64,   runner: ubuntu-24.04     }
-          - { host: linux-aarch64,  runner: ubuntu-24.04-arm }
-          - { host: macos-arm64,    runner: macos-14         }
-          - { host: windows-x86_64, runner: windows-2022     }
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      # This commit's mcpp: the one build.yml produced (use-built-mcpp, rule R1
-      # of the 2026-10-02 CI record), except on the macOS leg. That leg runs on
-      # macos-14 and the macOS artifact is built on macos-15; whether it runs on
-      # macos-14 is not measured (the record's Part VII), so the leg builds its
-      # own until it is.
-      - if: matrix.host != 'macos-arm64'
-        uses: ./.github/actions/use-built-mcpp
-        with:
-          host: ${{ matrix.host }}
-
-      - name: Name this commit's mcpp MCPP_UNDER_TEST
-        if: matrix.host != 'macos-arm64'
-        run: echo "MCPP_UNDER_TEST=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: Build the mcpp in this pull request
-        if: matrix.host == 'macos-arm64'  # ci-lint: allow-r1: the macOS leg builds its own mcpp until the artifact is measured on macos-14
-        run: |
-          set -euo pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$XLINGS_BIN" config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" build --dev
-          # 两种拼写,且按 mtime 取最新 —— target/ 是缓存恢复的,`head -1`
-          # 会挑到上一次推送留下的二进制,版本号一样而代码是旧的。
-          BUILT=$(find target -type f \( -name 'mcpp' -o -name 'mcpp.exe' \) \
-                  -newer mcpp.toml | head -1)
-          [ -n "$BUILT" ] || { echo "::error::mcpp did not build"; exit 1; }
-          BUILT=$(cd "$(dirname "$BUILT")" && pwd)/$(basename "$BUILT")
-          echo "MCPP_UNDER_TEST=$BUILT" >> "$GITHUB_ENV"
-          "$BUILT" --version
-
-      - name: The invariants
-        run: |
-          set -euo pipefail
-          export MCPP="$MCPP_UNDER_TEST"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          # These four read mcpp's MACHINE interface, so jq is not optional
-          # here. Without it each one takes its own "nothing to compare" exit —
-          # four honest-looking skips, and the next step would then report that
-          # the invariants did not run. Failing on the cause beats failing on
-          # the symptom four steps later.
-          command -v jq >/dev/null || { echo "::error::jq is missing on ${{ matrix.host }}"; exit 1; }
-          fail=0
-          for t in tests/e2e/295_*.sh tests/e2e/296_*.sh \
-                   tests/e2e/297_*.sh tests/e2e/298_*.sh \
-                   tests/e2e/299_*.sh tests/e2e/300_*.sh \
-                   tests/e2e/301_*.sh tests/e2e/302_*.sh \
-                   tests/e2e/303_*.sh; do
-            echo "=== $t ==="
-            bash "$t" 2>&1 | tee "$(basename "$t").log" || true
-            rc=${PIPESTATUS[0]}
-            [ "$rc" = "0" ] || { echo "::error::$t failed (exit $rc)"; fail=1; }
-          done
-          [ "$fail" = 0 ] || exit 1
-
-      - name: Native ARM64 LLVM payload admission
-        if: matrix.host == 'linux-aarch64'
-        env:
-          MCPP: ${{ env.MCPP_UNDER_TEST }}
-          MCPP_VENDORED_XLINGS: ${{ env.XLINGS_BIN }}
-        run: bash .github/tools/check_aarch64_llvm_payload.sh
-
-      - uses: actions/upload-artifact@v4
-        if: ${{ always() && matrix.host == 'linux-aarch64' }}
-        with:
-          name: native-llvm-arm64-admission
-          path: ${{ runner.temp }}/native-llvm-arm64
-          if-no-files-found: warn
-
-      - name: Each invariant RAN
-        run: |
-          set -euo pipefail
-          # 这一步存在的全部理由:退出码分不清「通过」与「跳过」。两条 e2e 都
-          #    有为「这台机器没有可比的东西」准备的早退,而 CI 要的是它们真的比
-          #    过了。
-          check() {
-            grep -qF "$2" "$1".log || {
-              echo "::error::$1 did not reach its conclusion on ${{ matrix.host }}"
-              tail -6 "$1".log 2>/dev/null | sed 's/^/        /'
-              return 1
-            }
-            echo "  ok  $1"
-          }
-          # A SKIP IS ACCEPTED FOR ONE NAMED REASON, NOT ON ONE NAMED HOST.
-          #
-          # 297 declares a non-llvm compiler, so it needs one to exist. Every
-          # toolchain mcpp installs on macOS is llvm; on windows-2022 it depends
-          # on what the restored cache holds — measured, one run had
-          # `gcc@16.1.0` and the next had only `llvm@20.1.7`.
-          #
-          # THE FIRST VERSION EXEMPTED macOS BY NAME, and the very next
-          # Windows run skipped for the same reason and went red. Naming the
-          # host encodes where the fact happened to hold; naming the FACT holds
-          # wherever it does. A skip for any other reason is still a failure.
-          #
-          # AND THE DENOMINATOR IS ASSERTED SEPARATELY: linux always has a gcc
-          # payload (it backs the host row), so that job uses `check` and the
-          # test is guaranteed to be exercised somewhere on every run. Without
-          # that, a reason accepted everywhere is a test that runs nowhere.
-          check_or_declared_skip() {   # log  ok-line  acceptable-skip-substring
-            grep -qF "$2" "$1".log && { echo "  ok  $1"; return 0; }
-            if grep -q '^SKIP:' "$1".log && grep -qF "$3" "$1".log; then
-              echo "  ok  $1 (declared skip: $(grep -m1 '^SKIP:' "$1".log))"
-              return 0
-            fi
-            echo "::error::$1 neither concluded nor declared the expected skip on ${{ matrix.host }}"
-            echo "        expected skip to mention: $3"
-            tail -6 "$1".log 2>/dev/null | sed 's/^/        /'
-            return 1
-          }
-          fail=0
-          check 295_naming_the_host_target_changes_nothing.sh \
-            "OK: naming the host's own target changes nothing" || fail=1
-          check 296_what_the_report_names_is_what_the_link_line_uses.sh \
-            "OK: what the report names is what the link line uses" || fail=1
-          if [ "${{ matrix.host }}" = linux-x86_64 ]; then
-            # The denominator: gcc is always installed here, so this host must
-            # actually run the test.
-            check 297_a_capability_pin_is_not_a_preference.sh \
-              "OK: a capability pin is not a preference" || fail=1
-          else
-            check_or_declared_skip 297_a_capability_pin_is_not_a_preference.sh \
-              "OK: a capability pin is not a preference" \
-              "gcc is not installed here" || fail=1
-          fi
-          if [[ "${{ matrix.host }}" = linux-* ]]; then
-            check 298_overriding_a_convention_requires_replacing_it.sh \
-              "OK: a convention may be overridden, but not merely removed" || fail=1
-          else
-            # Non-Linux rows may restore a cache with no declared LLVM.
-            # Both Linux hosts require the assertion after native provisioning.
-            check_or_declared_skip 298_overriding_a_convention_requires_replacing_it.sh \
-              "OK: a convention may be overridden, but not merely removed" \
-              "llvm is not installed here" || fail=1
-          fi
-
-          # ── 2026.8.26.2: an answer mcpp already had, now used ─────────────
-          #
-          # Vocabulary completion is host-independent. The C-library query
-          # additionally checks graph layering on both GNU Linux hosts.
-          check 299_a_request_that_named_no_c_library_resolves_to_a_row_that_exists.sh \
-            "OK: a request that named no C library resolves to a row that exists" || fail=1
-          check 300_a_registered_family_is_not_reported_unknown.sh \
-            "OK: a registered family is not reported unknown" || fail=1
-          # 303's third half stacks a musl c-abi over this host's own target,
-          # and not every host stacks that — an MSVC-ABI host answers the
-          # layering question first, correctly, and there is then no
-          # two-answer document to check. Both GNU Linux hosts must run all
-          # three halves; a skip there is a failed assertion.
-          if [[ "${{ matrix.host }}" = linux-* ]]; then
-            check 303_the_query_gives_one_answer_for_the_c_library.sh \
-              "OK: the query gives one answer for the C library" || fail=1
-          else
-            check_or_declared_skip 303_the_query_gives_one_answer_for_the_c_library.sh \
-              "OK: the query gives one answer for the C library" \
-              "refuses a musl c-abi over its own target" || fail=1
-          fi
-
-          # 301/302 NEED TWO COMPILER FAMILIES, AND THAT IS A PROPERTY OF THE
-          # MACHINE RATHER THAN OF THE CLAIM. "A requirement that DIFFERS from
-          # mcpp's own answer is applied" cannot be stated where only one family
-          # exists — macOS ordinarily installs LLVM only. Both Linux hosts
-          # now have LLVM and GCC payloads.
-          #
-          # AND THE DENOMINATOR IS linux-x86_64, WHICH HAS BOTH. Without a
-          # host required to actually run these, a reason accepted everywhere is
-          # a test that runs nowhere.
-          if [ "${{ matrix.host }}" = linux-x86_64 ]; then
-            check 301_the_graphs_compiler_is_taken_and_nothing_is_written.sh \
-              "OK: the graph's compiler is taken and nothing is written" || fail=1
-            check 302_a_stated_compiler_outranks_the_graph_and_two_requirements_do_not_stack.sh \
-              "OK: a stated compiler outranks the graph and two requirements do not stack" || fail=1
-          else
-            check_or_declared_skip 301_the_graphs_compiler_is_taken_and_nothing_is_written.sh \
-              "OK: the graph's compiler is taken and nothing is written" \
-              "no other family is" || fail=1
-            # 302's half two needs no second family and always runs; only half
-            # one is skipped, so the file still reaches its conclusion.
-            check 302_a_stated_compiler_outranks_the_graph_and_two_requirements_do_not_stack.sh \
-              "OK: a stated compiler outranks the graph and two requirements do not stack" || fail=1
-          fi
-          [ "$fail" = 0 ] || exit 1
-
-  scan:
-    # 第二层:全表扫描,与仓库里的期望表比对。
-    name: scan (${{ matrix.host }})
-    needs: invariants
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # THE BUILD-HOST AXIS IS THE SET mcpp SHIPS FOR, NOT THE SET THAT
-          # WAS CONVENIENT. `release.yml` publishes four: linux-x86_64,
-          # linux-aarch64, macosx-arm64, windows-x86_64. A host mcpp is
-          # distributed for and never scanned is a host whose target table is
-          # a claim nobody checked.
-          #
-          # `host` IS (os, arch) AND NOT os. Two Linux hosts differ in which
-          # rows they serve — `x86_64-linux-gnu` needs the host-native glibc
-          # payload, so it is reachable on one and not the other — and a single
-          # `linux` key would have them overwrite each other in expected.tsv.
-          - { host: linux-x86_64,   runner: ubuntu-24.04     }
-          - { host: linux-aarch64,  runner: ubuntu-24.04-arm }
-          - { host: macos-arm64,    runner: macos-14         }
-          - { host: windows-x86_64, runner: windows-2022     }
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      # This commit's mcpp: the one build.yml produced (use-built-mcpp, rule R1
-      # of the 2026-10-02 CI record), except on the macOS leg. That leg runs on
-      # macos-14 and the macOS artifact is built on macos-15; whether it runs on
-      # macos-14 is not measured (the record's Part VII), so the leg builds its
-      # own until it is.
-      - if: matrix.host != 'macos-arm64'
-        uses: ./.github/actions/use-built-mcpp
-        with:
-          host: ${{ matrix.host }}
-
-      - name: Name this commit's mcpp MCPP_UNDER_TEST
-        if: matrix.host != 'macos-arm64'
-        run: echo "MCPP_UNDER_TEST=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: Build the mcpp in this pull request
-        if: matrix.host == 'macos-arm64'  # ci-lint: allow-r1: the macOS leg builds its own mcpp until the artifact is measured on macos-14
-        run: |
-          set -euo pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" build --dev
-          BUILT=$(find target -type f \( -name 'mcpp' -o -name 'mcpp.exe' \) \
-                  -newer mcpp.toml | head -1)
-          [ -n "$BUILT" ] || { echo "::error::mcpp did not build"; exit 1; }
-          echo "MCPP_UNDER_TEST=$(cd "$(dirname "$BUILT")" && pwd)/$(basename "$BUILT")" >> "$GITHUB_ENV"
-
-      # 格数不能是缓存状态的函数。
-      #
-      # 实测:同一台 ubuntu-24.04,一轮装了 gcc+llvm(扫 40 格),下一轮只有 gcc
-      # (扫 20 格)。`expected.tsv` 声明的是前者,于是后者会把所有 llvm 行报成
-      # 「期望表说有而扫描没跑到」—— 而那句报错是对的,问题在于覆盖面**漂移**了。
-      #
-      # 矩阵要声明它扫哪些工具链,并把它们装上。装不上就红在这里,而不是
-      # 变成一屏「没跑到」。
-      - name: Install the toolchains this matrix declares
-        run: |
-          set -uo pipefail
-          export MCPP="$MCPP_UNDER_TEST"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          want="$(awk -F'\t' -v h='${{ matrix.host }}' \
-                    'NF>=11 && $2==h {print $4}' tests/matrix/expected.tsv \
-                  | sort -u)"
-          if [ -z "$want" ]; then
-            echo "  ?   ${{ matrix.host }} 尚无期望行 —— 扫描它现有的工具链"
-            exit 0
-          fi
-          fail=0
-          for spec in $want; do
-            fam="${spec%@*}"; ver="${spec#*@}"
-            # `msvc@system` 是在机器上被找到的,不是装出来的。
-            [ "$ver" = system ] && { echo "  ok  $spec (system)"; continue; }
-            if "$MCPP" toolchain install "$fam" "$ver" >/dev/null 2>&1; then
-              echo "  ok  $spec"
-            else
-              echo "::error::$spec 装不上,而期望表声明了它"
-              fail=1
-            fi
-          done
-          [ "$fail" = 0 ] || exit 1
-
-      - name: Scan both systems
-        run: |
-          set -euo pipefail
-          export MCPP="$MCPP_UNDER_TEST"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          # 编译器轴跟着**声明**走,不跟着「这台机器上装了什么」走。
-          #
-          # 实测 2026-08-26,同一个提交:PR 上这个 job 绿,合入 main 后红 —— 那
-          # 次 windows-2022 恢复出来的缓存里多了一个 `gcc@16.1.0`,扫描产出 24
-          # 格而期望表声明 16 格,八格全部报成「表里没有这一格」。缓存里有什么
-          # 不是这个仓库声明了什么,而判据必须是后者。
-          #
-          # 与上一步取自同一列,所以「装它」和「扫它」不可能各说各话。
-          MATRIX_COMPILERS="$(awk -F'\t' -v h='${{ matrix.host }}' \
-                                'NF>=11 && $2==h {print $4}' tests/matrix/expected.tsv \
-                              | sort -u | tr '\n' ' ')"
-          export MATRIX_COMPILERS
-          echo "declared compiler axis: ${MATRIX_COMPILERS:-<none — scanning what is installed>}"
-          # 两种体系各自成表。scan 把 mode 写进第一列,而比对必须按 mode 分开
-          # 做 —— 拿一种体系的测量去比整张表,另一种的每一行都会被报成「没跑到」。
-          bash tests/matrix/scan.sh payload > measured-payload.tsv
-          bash tests/matrix/scan.sh graph   > measured-graph.tsv
-          cat measured-payload.tsv measured-graph.tsv > measured.tsv
-          echo "--- measured ---"; cat measured.tsv
-
-      # 上传排在比对之前,而这是刻意的次序。宿主的第一次运行本就没有期望行,
-      # 比对会红 —— 而回填要用的正是这份产物。`if: always()` 也保留:一步失败不
-      # 该把证据一起带走。
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: matrix-${{ matrix.host }}
-          path: measured.tsv
-
-      - name: Compare with the expected table
-        run: |
-          set -euo pipefail
-          fail=0
-          bash tests/matrix/compare.sh measured-payload.tsv \
-               tests/matrix/expected.tsv ${{ matrix.host }} payload || fail=1
-          bash tests/matrix/compare.sh measured-graph.tsv \
-               tests/matrix/expected.tsv ${{ matrix.host }} graph || fail=1
-          [ "$fail" = 0 ] || exit 1
-
-      # A WEB ARTEFACT RUNS THROUGH THE INTERPRETER ITS PAYLOAD NAMES, NOT
-      # THROUGH PATH. That is what `wasm32-emscripten`'s `verified` tier
-      # claims, and no step measured it until a sandbox with no `node` on PATH
-      # showed that the run depended on the host:
-      #
-      #   /usr/bin/env: 'node': No such file or directory
-      #
-      # A FRESH MCPP_HOME, BECAUSE THE CACHE IS NOT THE PUBLISHED FORM.
-      # `~/.mcpp` is restored by key prefix, so the emsdk payload in it may
-      # predate the recipe that writes `.mcpp-toolchain.json`, and that older
-      # payload would be the object measured. A fresh home installs what the
-      # index publishes today.
-      #
-      # AND A DECOY `node` FIRST ON PATH, rather than `node` removed from PATH.
-      # Removing it would also remove whatever else those directories hold,
-      # and an image that ships a real `node` would pass for the wrong reason.
-      # A decoy that exits 97 with a marker separates the two outcomes on any
-      # image: the payload's runner never reaches it.
-      - name: "wasm32-emscripten runs through its payload's runner, not PATH"
-        if: ${{ !cancelled() && matrix.host == 'linux-x86_64' }}
-        run: |
-          set -uo pipefail
-          home=$(mktemp -d); work=$(mktemp -d); decoy=$(mktemp -d)
-          printf '#!/bin/sh\necho "DECOY-NODE-WAS-RUN" >&2\nexit 97\n' > "$decoy/node"
-          chmod +x "$decoy/node"
-          export MCPP_HOME="$home" MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP_UNDER_TEST" self config --mirror GLOBAL >/dev/null 2>&1 || true
-          mkdir -p "$work/src"
-          printf '[package]\nname = "w"\nversion = "0.1.0"\n' > "$work/mcpp.toml"
-          cat > "$work/src/main.cpp" <<'CPP'
-          import std;
-          int main() {
-            std::vector<int> v{3, 1, 2};
-            std::ranges::sort(v);
-            std::print("{}-{}-{}\n", v[0], v[1], v[2]);
-          }
-          CPP
-          out=$(cd "$work" && PATH="$decoy:$PATH" "$MCPP_UNDER_TEST" run --target wasm32-emscripten 2>&1) && rc=0 || rc=$?
-          printf '%s\n' "$out" | tail -12
-          desc="$home/registry/data/xpkgs/xim-x-emsdk/6.0.9/.mcpp-toolchain.json"
-          if [ ! -f "$desc" ]; then
-            echo "::error::the freshly installed emsdk payload has no .mcpp-toolchain.json; the published recipe does not name its runner"
-            exit 1
-          fi
-          if grep -q 'DECOY-NODE-WAS-RUN' <<<"$out"; then
-            echo "::error::the artefact ran through the node on PATH, not through the payload's runner"
-            exit 1
-          fi
-          if [ "$rc" -ne 0 ]; then
-            echo "::error::mcpp run --target wasm32-emscripten exited $rc"
-            exit 1
-          fi
-          if ! grep -qx '1-2-3' <<<"$out"; then
-            echo "::error::the program's output line 1-2-3 is absent"
-            exit 1
-          fi
-          echo "ok: wasm32-emscripten ran through the payload's runner; the decoy node was never run"
-
-  coverage:
-    # THE DENOMINATOR. Every check above is per host, and no per-host check
-    # can notice a host that never ran.
-    #
-    # Each `scan` job compares the rows for ITS OWN host, so deleting a host
-    # from the matrix above silently retires every expectation the table holds
-    # for it: nothing measures those rows, nothing compares them, and the
-    # workflow is green. This job is the one place that reads the expected table
-    # as a whole and requires the run to have covered it.
-    #
-    # It runs even when a scan failed (`always()`), because "which hosts were
-    # covered" is a different question from "did they pass" — and a run where a
-    # host is missing entirely should say so in those words rather than leaving
-    # a reader to infer it from a job list.
-    name: coverage (every host the table names was scanned)
-    needs: scan
-    if: always()
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: matrix-*
-          path: measured
-      - name: Every host in expected.tsv produced rows
-        run: |
-          set -euo pipefail
-          want=$(awk -F'\t' 'NF>=11 {print $2}' tests/matrix/expected.tsv | sort -u)
-          [ -n "$want" ] || { echo "::error::expected.tsv names no host at all"; exit 1; }
-          got=$(cat measured/*/measured.tsv 2>/dev/null \
-                | awk -F'\t' 'NF>=11 {print $2}' | sort -u)
-          echo "expected hosts: $(echo $want)"
-          echo "scanned hosts:  $(echo ${got:-<none>})"
-          fail=0
-          for h in $want; do
-            printf '%s\n' "$got" | grep -qx "$h" || {
-              echo "::error::expected.tsv holds rows for '$h', and no scan produced any"
-              fail=1
-            }
-          done
-          # AND THE OTHER DIRECTION. A host that scanned but has no rows in the
-          # table is a new build host nobody declared expectations for — the
-          # per-host compare already reds on it, but saying it here names the
-          # cause rather than listing 40 unexplained cells.
-          for h in $got; do
-            printf '%s\n' "$want" | grep -qx "$h" || {
-              echo "::error::'$h' was scanned and the expected table does not mention it"
-              echo "        add its rows to tests/matrix/expected.tsv from this run's artifact"
-              fail=1
-            }
-          done
-          [ "$fail" = 0 ] || exit 1
-          echo "OK: every build host the table names was scanned, and no other"
-
-      - name: The build hosts mcpp ships for are the ones scanned
-        run: |
-          set -euo pipefail
-          # THE TABLE AND THE RELEASE MUST NAME THE SAME SET. A host that
-          # gets a published binary and no scan is a host whose target table is
-          # a claim nobody checked; a host that is scanned and never shipped is
-          # coverage spent on a machine no user has.
-          #
-          # Derived from release.yml's asset names rather than restated here, so
-          # adding a fifth host to the release fails this step until the matrix
-          # covers it.
-          ship=$(grep -oE 'mcpp-\$\{?[A-Za-z_{}. ]*\}?-(linux|macosx|windows)-(x86_64|aarch64|arm64)' \
-                   .github/workflows/release.yml \
-                 | sed -E 's/.*-(linux|macosx|windows)-/\1-/' \
-                 | sed 's/^macosx-/macos-/' | sort -u)
-          scanned=$(awk -F'\t' 'NF>=11 {print $2}' tests/matrix/expected.tsv | sort -u)
-          echo "release publishes: $(echo $ship)"
-          echo "matrix declares:   $(echo $scanned)"
-          if [ "$ship" != "$scanned" ]; then
-            echo "::error::the set of build hosts mcpp publishes and the set the target matrix declares differ"
-            diff <(printf '%s\n' "$ship") <(printf '%s\n' "$scanned") | sed 's/^/        /' || true
-            exit 1
-          fi
-          echo "OK: $(printf '%s\n' "$ship" | wc -l) build hosts, published and scanned"
diff --git a/.github/workflows/ci-windows-e2e.yml b/.github/workflows/ci-windows-e2e.yml
deleted file mode 100644
index de186f00f..000000000
--- a/.github/workflows/ci-windows-e2e.yml
+++ /dev/null
@@ -1,136 +0,0 @@
-name: ci-windows-e2e
-
-# The e2e suite on Windows x64, called by ci.yml beside ci-windows.yml after
-# the Windows build. Three shards, assigned by measured duration
-# (tests/e2e/timings/windows.tsv, rule R4 of the 2026-10-02 CI record): about
-# fifteen tests of over thirty seconds took 58 to 64 percent of a round-robin
-# shard, and the two shards differed by 3.6 minutes on average. Each shard runs
-# the one binary build.yml produced (use-built-mcpp, rule R1) and writes the
-# per-test report the e2e-coverage job of ci.yml reads.
-#
-# Paired workflows: ci-windows.yml, ci-linux-e2e.yml, ci-macos-e2e.yml.
-
-on:
-  workflow_call:
-
-jobs:
-  e2e:
-    name: e2e ${{ matrix.shard }}/3 (windows x64, self-host)
-    runs-on: windows-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3]
-    env:
-      MCPP_HOME: C:\Users\runneradmin\.mcpp
-      # Round-robin slice of tests/e2e (see run_all.sh).
-      E2E_SHARD: ${{ matrix.shard }}/3
-      E2E_TIMINGS: tests/e2e/timings/windows.tsv
-      E2E_REPORT: ${{ github.workspace }}/e2e-report-windows-${{ matrix.shard }}.tsv
-      # NOTE: do NOT force MCPP_VERBOSE here. The e2e suite includes tests that
-      # assert mcpp's DEFAULT (quiet) output — e.g. 48_build_error_output and
-      # 53_namespaced_cache_label — which forced verbose would break.
-    steps:
-      # `submodules: recursive` so tests/e2e/233_bench_matrix.sh can check that
-      # each `hub`/`body` in bench/matrix.json exists in the tree it names --
-      # the check reads "submodule not initialised" without them and reports
-      # nothing, which is how a stale hub path survived (#599). Under 10 MB of
-      # source across the three pins, and nothing here builds them.
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: windows-x86_64
-
-      - name: Name this commit's mcpp MCPP_SELF
-        shell: bash
-        run: |
-          "$MCPP_FRESH" --version
-          echo "MCPP_SELF=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      # MinGW-w64 GCC (xim:mingw-gcc). Installed here so the `mingw` capability
-      # is GRANTED rather than left to whatever the shared sandbox cache happens
-      # to carry: e2e 256 packs an MSVC leg and a MinGW leg into one package,
-      # which is the only place `lib/` keyed by triple is proven with two
-      # DIFFERENT artifact names (mathkit.lib beside libmathkit.a). Without this
-      # step that test skips, and a skipped test in a green suite reads exactly
-      # like a passing one.
-      #
-      # Not `|| true`: if the payload cannot be installed the capability quietly
-      # disappears and the coverage goes with it, which is the failure mode this
-      # step exists to prevent.
-      - name: "Toolchain: MinGW payload for the fat-package e2e"
-        shell: bash
-        run: |
-          # The build job's prewarm installs `mingw 16.1.0` on `main` and saves
-          # it into the sandbox cache, so every PR restores a sandbox that
-          # already holds it. The install call is then a no-op but still pays
-          # the mcpp-toolchain startup cost; measured 68 s on three shards per
-          # PR. Skip the call when the payload is already reachable, and keep
-          # the verification that names the missing-capability case (the whole
-          # reason this step exists is so a skipped shard does not read like a
-          # passing one).
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          found=""
-          for c in "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe \
-                   "$HOME"/.xlings/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe; do
-            [[ -x "$c" ]] && { found="$c"; break; }
-          done
-          if [ -z "$found" ]; then
-            "$MCPP_SELF" toolchain install mingw 16.1.0
-            for c in "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe \
-                     "$HOME"/.xlings/data/xpkgs/xim-x-mingw-gcc/*/bin/g++.exe; do
-              [[ -x "$c" ]] && { found="$c"; break; }
-            done
-          fi
-          # Verified through the SAME two locations run_all.sh probes — checking
-          # only one of them would let the step pass while the capability stays
-          # ungranted, which is the shape of a green run that tested nothing.
-          test -n "$found" || { echo "FAIL: mingw installed but not where run_all.sh looks"; exit 1; }
-          echo "mingw payload: $found"
-
-      - name: E2E suite
-        shell: bash
-        # About twice the shard's budget of fifteen minutes (R4): reached only by
-        # a hang. The per-test 600 s limit in run_all.sh names the test that hung.
-        timeout-minutes: 30
-        run: |
-          # MCPP_BOOT is the released bootstrap (use-built-mcpp). e2e 252 checks
-          # an older client against a package this commit produces, so it needs
-          # a real old binary.
-          export MCPP_BOOT
-          export MCPP="$MCPP_SELF"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          "$MCPP_SELF" self config --mirror GLOBAL
-          "$MCPP_SELF" toolchain default llvm@23.1.3
-          set -o pipefail
-          bash tests/e2e/run_all.sh 2>&1 | tee "$RUNNER_TEMP/e2e-suite.log"
-
-      # Measurement legs print READING lines (#646 F2 across PE images, #649 E10
-      # the llvm row's recorded CRT); collected where a reader finds them.
-      # One file, no glob: the report the e2e-coverage job of ci.yml reads.
-      - name: Upload the shard's report
-        if: always()
-        timeout-minutes: 5
-        uses: actions/upload-artifact@v4
-        with:
-          name: e2e-report-windows-${{ matrix.shard }}
-          path: e2e-report-windows-${{ matrix.shard }}.tsv
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Measurement readings
-        if: always()
-        shell: bash
-        run: |
-          {
-            echo "### Measurement readings (Windows, shard ${{ matrix.shard }})"
-            echo '```'
-            grep -h '^READING' "$RUNNER_TEMP/e2e-suite.log" 2>/dev/null || echo "(none)"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/ci-windows-msvc-xlings.yml b/.github/workflows/ci-windows-msvc-xlings.yml
deleted file mode 100644
index f8b50da45..000000000
--- a/.github/workflows/ci-windows-msvc-xlings.yml
+++ /dev/null
@@ -1,94 +0,0 @@
-name: ci-windows-msvc-xlings
-
-# mcpp driving the xlings-MANAGED MSVC toolset (`msvc@<toolset>`) — the whole
-# chain, end to end: index → payload → unpack → resolve → build → run →
-# remove.
-#
-# WHY THIS IS NOT IN ci-windows-e2e.yml, which also runs MSVC tests:
-#
-#   Different subject. Everything MSVC in the main suite (95_msvc_system,
-#   99_msvc_native_build, 177, 180, 182) tests mcpp against the machine's own
-#   Visual Studio. That is mcpp's code and nothing else's. This job tests
-#   mcpp against the xlings ECOSYSTEM — a package index, a mirror, a payload
-#   set, an unpack recipe — most of which lives in another repository and
-#   moves on its own schedule.
-#
-#   Different failure meaning. When this job goes red it usually means the
-#   index moved, not that the pull request broke something. Mixed into the
-#   main suite that reads as "your change broke Windows", and the honest
-#   signal (100+ fast tests, all about mcpp) gets buried under one slow test
-#   about somebody else's package. Keeping them apart keeps both readable.
-#
-#   Different cost. ~380 MB of downloads (xim:msvc + xim:windows-sdk) and a
-#   real toolchain install, against a suite whose other tests are seconds
-#   each.
-#
-# The split is enforced by a capability, not by a file list: the tests carry
-# `# requires: xlings-msvc`, granted only by MCPP_E2E_XLINGS_MSVC=1 below. So
-# the main suite skips them by construction, and a new test joins this job by
-# declaring the capability — there is no second list to keep in sync.
-#
-# Paired workflows: ci-windows.yml, ci-windows-e2e.yml.
-
-on:
-  workflow_call:
-
-jobs:
-  xlings-msvc:
-    name: xlings-managed msvc toolset (windows x64, self-host)
-    runs-on: windows-latest
-    timeout-minutes: 45
-    env:
-      MCPP_HOME: C:\Users\runneradmin\.mcpp
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: windows-x86_64
-
-      - name: Name this commit's mcpp MCPP_SELF
-        shell: bash
-        run: |
-          "$MCPP_FRESH" --version
-          echo "MCPP_SELF=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: xlings-managed msvc e2e
-        shell: bash
-        timeout-minutes: 30
-        env:
-          # Grants the `xlings-msvc` capability. Without it these tests skip
-          # everywhere, which is exactly what the main suite wants.
-          MCPP_E2E_XLINGS_MSVC: '1'
-          # Name what this job runs, so the job title and its contents cannot
-          # drift apart. Widen the glob when a second test joins.
-          E2E_ONLY: '239_*.sh'
-          # THE DEFAULT PER-TEST CAP IS TOO CLOSE TO WHAT THIS TEST COSTS.
-          # 239 fetches ~376 MB, and its measured durations on this runner are
-          # 244 / 292 / 313 / 335 / 515s against run_all.sh's 600s default — a
-          # download-bound test whose spread nearly reaches its own deadline,
-          # so a slow mirror reports a red build for a correct one.
-          #
-          # Raised only here, where the job runs that one test and the step's
-          # own `timeout-minutes: 30` is the real backstop — which is what
-          # run_all.sh's comment says the per-test value is meant to sit under.
-          E2E_TEST_TIMEOUT: '1500'
-        run: |
-          export MCPP="$MCPP_SELF"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          export MCPP_E2E_TOOLCHAIN_MIRROR=GLOBAL
-          "$MCPP_SELF" self config --mirror GLOBAL
-          bash tests/e2e/run_all.sh
-
-      # A run that matched nothing is a green tick for having done nothing,
-      # and it looks exactly like a run that passed. E2E_ONLY is a glob typed
-      # by hand; if it stops matching, say so here rather than in a report
-      # nobody reads.
-      - name: Fail if the filter selected no tests
-        if: always()
-        shell: bash
-        run: |
-          n=$(ls tests/e2e/239_*.sh 2>/dev/null | wc -l)
-          test "$n" -gt 0 || { echo "FAIL: E2E_ONLY matched no tests"; exit 1; }
-          echo "selected $n test(s)"
diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
deleted file mode 100644
index 84e71d950..000000000
--- a/.github/workflows/ci-windows.yml
+++ /dev/null
@@ -1,486 +0,0 @@
-name: ci-windows
-
-# Windows CI for mcpp — same flow as Linux (ci-linux.yml) and macOS (ci-macos.yml):
-#   xlings install mcpp → self-host build → smoke → package
-#
-# SHAPE: called by ci.yml after the Windows build (build.yml). No job here
-# builds mcpp to obtain the commit's binary: each takes the one binary that
-# build produced (use-built-mcpp, rule R1 of the 2026-10-02 CI record) and names
-# it MCPP_SELF. A job builds mcpp only when the build is what it tests (the LLVM
-# rebuild of `toolchains`). The e2e suite is ci-windows-e2e.yml, called beside
-# this one.
-
-on:
-  workflow_call:
-
-env:
-  MCPP_HOME: C:\Users\runneradmin\.mcpp
-
-jobs:
-  build-test:
-    name: test + package (windows x64, self-host)
-    runs-on: windows-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: windows-x86_64
-
-      - name: Name this commit's mcpp MCPP_SELF
-        shell: bash
-        run: |
-          "$MCPP_FRESH" --version
-          echo "MCPP_SELF=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: Unit + integration tests via mcpp test
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS=$(cygpath -w "$USERPROFILE/.xlings/subos/default/bin/xlings.exe")
-          "$MCPP_SELF" test
-
-      # WS8: this row has Visual Studio, so its answer is the "Windows with
-      # usable MSVC" row of docs/01 and docs/20.
-      - name: The documented default toolchain is this host's answer
-        shell: bash
-        run: python .github/tools/check_default_toolchain_docs.py --mcpp "$MCPP_SELF"
-
-      - name: Package Windows release zip
-        id: package
-        shell: bash
-        run: |
-          VERSION=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-          WRAPPER="mcpp-${VERSION}-windows-x86_64"
-          ZIPNAME="${WRAPPER}.zip"
-          # The binary of build.yml (use-built-mcpp), not one found under
-          # target/: nothing restores target/ any more, and this is the binary
-          # every other job of the commit tests.
-          MCPP_BIN="$MCPP_SELF"
-          test -f "$MCPP_BIN" || { echo "FAIL: no mcpp.exe at $MCPP_BIN"; exit 1; }
-
-          STAGING=$(mktemp -d)
-          mkdir -p "$STAGING/$WRAPPER/bin" "$STAGING/$WRAPPER/registry/bin"
-          cp "$MCPP_BIN" "$STAGING/$WRAPPER/bin/mcpp.exe"
-          printf '@echo off\r\n"%%~dp0bin\\mcpp.exe" %%*\r\n' > "$STAGING/$WRAPPER/mcpp.bat"
-          cp README.md "$STAGING/$WRAPPER/" 2>/dev/null || true
-          cp LICENSE "$STAGING/$WRAPPER/" 2>/dev/null || true
-          XLINGS_EXE="$USERPROFILE/.xlings/subos/default/bin/xlings.exe"
-          [ -f "$XLINGS_EXE" ] && cp "$XLINGS_EXE" "$STAGING/$WRAPPER/registry/bin/xlings.exe"
-
-          mkdir -p dist
-          (cd "$STAGING" && 7z a -tzip "$ZIPNAME" "$WRAPPER")
-          cp "$STAGING/$ZIPNAME" "dist/$ZIPNAME"
-          (cd dist && sha256sum "$ZIPNAME" > "$ZIPNAME.sha256")
-          echo "zipname=$ZIPNAME" >> "$GITHUB_OUTPUT"
-          ls -la dist/
-
-      - name: Smoke-test the packaged zip
-        shell: bash
-        run: |
-          ZIPNAME="${{ steps.package.outputs.zipname }}"
-          WRAPPER="${ZIPNAME%.zip}"
-          SMOKE=$(mktemp -d)
-          (cd "$SMOKE" && unzip -q "$GITHUB_WORKSPACE/dist/$ZIPNAME")
-          "$SMOKE/$WRAPPER/bin/mcpp.exe" --version
-          test -f "$SMOKE/$WRAPPER/registry/bin/xlings.exe"
-          test -f "$SMOKE/$WRAPPER/mcpp.bat"
-          echo "Smoke-test passed"
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: mcpp-windows-x86_64
-          path: |
-            dist/*.zip
-            dist/*.sha256
-
-  # Everything that needs a toolchain other than the default, plus the two
-  # Windows-specific behavioural regressions. Kept on one runner: each leg is
-  # seconds-to-2-minutes, so per-leg runners would cost more setup than they
-  # save.
-  # A Windows machine WITHOUT Visual Studio — the shape of an ordinary user's
-  # box, and the one shape no GitHub image provides. Every runner ships VS, so
-  # a bare-Windows regression was structurally invisible here; the fresh-install
-  # workflow now covers it too, but that one only runs post-release, which is
-  # far too late to learn that `mcpp new && mcpp build` no longer works on a
-  # stock machine.
-  #
-  # Order matters: mcpp is built while Visual Studio is still present (the
-  # self-host build uses llvm, which targets the MSVC ABI and needs it), and
-  # only then is VS masked. e2e 182 opens by asserting that MSVC detection
-  # FAILS, so an incomplete mask fails the job instead of quietly testing the
-  # ordinary path.
-  no-msvc-fallback:
-    name: "bare Windows: no Visual Studio (windows x64)"
-    # Takes the binary build-test already produced instead of building here.
-    # Building in this job means compiling with clang, which reads the MSVC
-    # STL — the open handles that leaves make the VS directories unrenamable,
-    # so the masking below silently did nothing.
-    needs: build-test
-    runs-on: windows-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Fetch the PR's mcpp.exe
-        uses: actions/download-artifact@v4
-        with:
-          name: mcpp-windows-x86_64
-          path: dist
-
-      - name: Unpack it
-        shell: bash
-        run: |
-          ZIP=$(ls dist/*.zip | head -1)
-          test -n "$ZIP" || { echo "FAIL: no zip artifact"; exit 1; }
-          unzip -q "$ZIP" -d unpacked
-          MCPP_SELF=$(find unpacked -name "mcpp.exe" | head -1)
-          test -n "$MCPP_SELF" || { echo "FAIL: no mcpp.exe in $ZIP"; exit 1; }
-          MCPP_SELF=$(cd "$(dirname "$MCPP_SELF")" && pwd)/$(basename "$MCPP_SELF")
-          "$MCPP_SELF" --version
-          echo "MCPP_SELF=$MCPP_SELF" >> "$GITHUB_ENV"
-
-      # Masked before anything else touches Visual Studio, so no process of
-      # ours is holding a handle into it. The mask retries a refused rename
-      # (a state of the host, not of the image) and then masks VC\Tools; its
-      # postcondition — no VC\Tools\MSVC left — is what keeps an incomplete
-      # mask from reading as a green "bare Windows" row.
-      - name: Mask Visual Studio
-        uses: ./.github/actions/mask-visual-studio
-
-      # After masking, so nothing this action does can be holding Visual
-      # Studio open. It installs xlings (which mcpp resolves the winlibs
-      # toolchain through) and a released mcpp; neither needs a C++ compiler,
-      # so a masked VS is irrelevant to it.
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      # WS8: with Visual Studio masked and no managed toolset installed yet,
-      # this row's answer is the "Windows without it" row of the tables.
-      - name: The documented default toolchain is this host's answer
-        shell: bash
-        run: python .github/tools/check_default_toolchain_docs.py --mcpp "$MCPP_SELF"
-
-      - name: "No Visual Studio: fallback to winlibs GCC (e2e 182)"
-        shell: bash
-        env:
-          MCPP_VENDORED_XLINGS: ${{ env.XLINGS_BIN }}
-        run: |
-          MCPP="$MCPP_SELF" bash tests/e2e/182_windows_no_msvc_fallback.sh
-
-      - uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: bare-windows-diagnostics
-          path: ${{ runner.temp }}/bare-windows-diagnostics
-          if-no-files-found: warn
-
-  toolchains:
-    name: "toolchains + regressions (windows x64)"
-    runs-on: windows-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: windows-x86_64
-
-      - name: Name this commit's mcpp MCPP_SELF
-        shell: bash
-        run: |
-          "$MCPP_FRESH" --version
-          echo "MCPP_SELF=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      # Integration: the mcpp built from THIS PR's source ($MCPP_SELF, the
-      # self-hosted binary) builds & runs a real external C++ project — xlings
-      # (openxlings/xlings ships its own mcpp.toml). MCPP_VENDORED_XLINGS only
-      # supplies the xlings package backend mcpp resolves deps through.
-      - name: "Integration: mcpp builds & runs xlings (openxlings/xlings)"
-        shell: bash
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-        run: |
-          export MCPP_VENDORED_XLINGS=$(cygpath -w "$USERPROFILE/.xlings/subos/default/bin/xlings.exe")
-          "$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh" \
-            --depth 1 --recurse-submodules \
-            https://github.com/openxlings/xlings /tmp/xlings-src
-          cd /tmp/xlings-src
-          "$MCPP_SELF" self config --mirror GLOBAL
-          "$MCPP_SELF" build
-          "$MCPP_SELF" run
-
-      # Regression test for the Windows first-run "press Enter to advance" hang.
-      # Launches mcpp with an OPEN, EMPTY, never-closing stdin pipe. Without
-      # seal_stdin's Windows fix, any grandchild that reads stdin would inherit
-      # our pipe and block forever — caught by the timeout below. With the fix,
-      # every subprocess stdin is redirected from NUL → no possibility of hang.
-      - name: "Regression: mcpp survives open-empty-stdin (Windows hang fix)"
-        shell: pwsh
-        timeout-minutes: 15
-        env:
-          MCPP_VENDORED_XLINGS: ${{ env.XLINGS_BIN }}
-        run: |
-          $ErrorActionPreference = 'Stop'
-
-          # MCPP_SELF was set in a bash step as an MSYS-style path
-          # (e.g. /d/a/mcpp/...). PowerShell can't exec that — convert it
-          # to a native Windows path via the git-bash cygpath that ships
-          # on the runner.
-          $mcppExe = (& 'C:\Program Files\Git\usr\bin\cygpath.exe' -w $env:MCPP_SELF).Trim()
-          Write-Host "Resolved MCPP_SELF (Windows form): $mcppExe"
-          if (-not (Test-Path $mcppExe)) {
-              throw "MCPP_SELF after cygpath not found: $mcppExe"
-          }
-
-          $tmp = Join-Path $env:RUNNER_TEMP ("stdin-hang-test-" + [guid]::NewGuid().ToString('N'))
-          New-Item -ItemType Directory -Path $tmp | Out-Null
-          Set-Location $tmp
-          & $mcppExe new hello_stdin
-          Set-Location hello_stdin
-
-          function Invoke-McppWithOpenStdin {
-              param([string]$McppPath, [string]$McppArgs, [int]$TimeoutSeconds = 300)
-
-              $psi = [System.Diagnostics.ProcessStartInfo]::new()
-              $psi.FileName               = $McppPath
-              $psi.Arguments              = $McppArgs
-              $psi.WorkingDirectory       = (Get-Location).Path
-              $psi.UseShellExecute        = $false
-              $psi.RedirectStandardInput  = $true   # parent holds child's stdin
-              $psi.RedirectStandardOutput = $true
-              $psi.RedirectStandardError  = $true
-              # By default the child inherits the parent's env (we did not
-              # touch $psi.Environment) so MCPP_VENDORED_XLINGS / PATH / etc.
-              # propagate.
-
-              $p = [System.Diagnostics.Process]::Start($psi)
-
-              # Async-drain stdout/stderr so a full output buffer doesn't
-              # itself deadlock the child (separate failure mode from the
-              # stdin hang we're testing).
-              $stdoutTask = $p.StandardOutput.ReadToEndAsync()
-              $stderrTask = $p.StandardError.ReadToEndAsync()
-
-              # NEVER write or close $p.StandardInput — the pipe stays open
-              # and empty for the lifetime of the child. Any grandchild that
-              # reads stdin will block on this pipe → caught by WaitForExit.
-
-              if (-not $p.WaitForExit($TimeoutSeconds * 1000)) {
-                  try { $p.Kill($true) } catch {}
-                  Write-Host "----- captured stdout -----"
-                  Write-Host $stdoutTask.Result
-                  Write-Host "----- captured stderr -----"
-                  Write-Host $stderrTask.Result
-                  throw "REGRESSION: 'mcpp $McppArgs' HUNG with open-empty stdin after ${TimeoutSeconds}s. The Windows seal_stdin fix is not effective."
-              }
-
-              Write-Host "----- stdout -----"
-              Write-Host $stdoutTask.Result
-              Write-Host "----- stderr -----"
-              Write-Host $stderrTask.Result
-
-              if ($p.ExitCode -ne 0) {
-                  throw "'mcpp $McppArgs' exited with code $($p.ExitCode) (no hang, but failed)."
-              }
-          }
-
-          Write-Host '=== T1: mcpp --version (sanity, fast path) ==='
-          Invoke-McppWithOpenStdin -McppPath $mcppExe -McppArgs '--version' -TimeoutSeconds 30
-
-          Write-Host '=== T2: mcpp build (full bootstrap + toolchain + dep resolve + compile) ==='
-          Invoke-McppWithOpenStdin -McppPath $mcppExe -McppArgs 'build' -TimeoutSeconds 600
-
-          Write-Host '=== T3: mcpp run (post-build run path) ==='
-          Invoke-McppWithOpenStdin -McppPath $mcppExe -McppArgs 'run' -TimeoutSeconds 120
-
-          Write-Host 'SUCCESS: mcpp completes with open-empty stdin → Windows seal_stdin fix verified.'
-
-      - name: "Toolchain: LLVM — mcpp new → run"
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          TMP=$(mktemp -d)
-          cd "$TMP"
-          "$MCPP_SELF" new hello_win
-          cd hello_win
-          "$MCPP_SELF" run
-
-      # MinGW-w64 GCC via the xlings ecosystem (xim:mingw-gcc → xlings-res
-      # winlibs mirror): install → default → modules build/run → standalone
-      # exe. Same flow as e2e 97 but as a visible CI step. Payload is cached
-      # via the mcpp sandbox cache after the first run.
-      - name: "Toolchain: MinGW — install → build → run (xim:mingw-gcc)"
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          MCPP="$MCPP_SELF" bash tests/e2e/97_mingw_toolchain.sh
-
-      # windows-latest ships VS 2022 Enterprise with the VC workload, so
-      # msvc@system detection MUST succeed here — a failure is a regression
-      # in the discovery/identification chain (vswhere → env → paths).
-      # Runs BEFORE the LLVM self-host rebuild: that step cleans + rebuilds
-      # target/, invalidating this job's $MCPP_SELF fingerprint path.
-      - name: "Toolchain: MSVC — detection & selection (msvc@system)"
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-
-          # Neutral cwd: the repo root's mcpp.toml [toolchain] would shadow
-          # the global default in `toolchain list` / doctor output.
-          TMP=$(mktemp -d); cd "$TMP"
-
-          # Both streams: `Detected` and `Default set to` are narration, on
-          # standard error since 2026.10.1.1.
-          out=$("$MCPP_SELF" toolchain default msvc 2>&1); echo "$out"
-          grep -q "Detected"     <<<"$out"
-          grep -q "msvc@system"  <<<"$out"
-
-          "$MCPP_SELF" toolchain list | tee tc-list.txt
-          grep -E '\*\s*msvc' tc-list.txt
-
-          "$MCPP_SELF" self doctor 2>&1 | tee doctor.txt || true
-          grep -qi "msvc" doctor.txt
-
-          # native cl.exe build: full e2e (modules, import std, incremental)
-          cd "$GITHUB_WORKSPACE"
-          MCPP="$MCPP_SELF" bash tests/e2e/99_msvc_native_build.sh
-
-          # build.mcpp under cl.exe. `MSVC x build.mcpp` was an empty cell in
-          # this matrix and the feature was correspondingly at zero — the ten
-          # build.mcpp e2e all run under clang, whose payload path has no
-          # spaces in it either. Both gaps closed here.
-          MCPP="$MCPP_SELF" bash tests/e2e/180_msvc_build_mcpp.sh
-
-          # restore the LLVM default for the remaining steps
-          "$MCPP_SELF" toolchain default llvm@23.1.3
-
-      # mcpp#693: a project in a directory whose name is not ASCII, inside the
-      # runner's code page 1252 and outside it, on the llvm, MSVC and MinGW rows,
-      # plus a path carried through build.mcpp. Each row reaches a different
-      # consumer of mcpp's text: Ninja's build file, the MSVC response files,
-      # and the MinGW driver.
-      - name: "Paths: non-ASCII project directories on every toolchain row (mcpp#693)"
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          MCPP="$MCPP_SELF" bash .github/tools/check_unicode_paths.sh
-
-      # GRAPHICS ON THIS HOST, BUILD ONLY, AND THAT IS THE WHOLE CLAIM.
-      #
-      # This runner has no Vulkan device, so what is asserted is what this
-      # platform decides: that the shader compiler THIS platform uses -- the
-      # rule declares `xim:shaderc` here and `xim:glslang` on Linux -- produces
-      # both SPIR-V headers, and that the Vulkan half compiles and links
-      # against the loader package. Running it is the Linux job's criterion,
-      # where a software device (`xim:mesa-lavapipe`) is published and the two
-      # legs' pixels are compared.
-      #
-      # The example is otherwise built only on Linux (`build_examples.sh` runs
-      # there), which is exactly the shape this change exists to remove: the
-      # half of a lane written for a host is the half that host never
-      # exercises.
-      - name: "Graphics: the offscreen example builds on this host"
-        shell: bash
-        run: |
-          set -e
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          cd "$GITHUB_WORKSPACE/examples/10-graphics/offscreen"
-          # The toolchain is NAMED rather than inherited: leaving it to whatever
-          # a neighbouring step happened to select makes this step's subject
-          # depend on step order, which is not a property anybody reads.
-          "$MCPP_SELF" build --toolchain "llvm@23.1.3"
-          d="$(sh "$GITHUB_WORKSPACE/.github/tools/out_dir.sh")/spirv"
-          for f in triangle_vert triangle_frag; do
-            test -f "$d/$f.h" || { echo "missing $d/$f.h"; exit 1; }
-            # THE MAGIC IS NOT ALWAYS IN THE HEADER, AND THAT IS THE POINT OF
-            # THIS JOB. The rule chooses the shader compiler this platform
-            # publishes -- glslang on Linux, glslc here -- and the two split
-            # the declaration differently: glslang writes a complete `const
-            # uint32_t ...[] = {...}`, glslc an initialiser list the rule
-            # declares around, so the words land in `<stem>.inc`. An assertion
-            # naming only the header is an assertion about ONE compiler, which
-            # is exactly the shape this step exists to catch.
-            # ONE FILE AT A TIME, because `grep -qs a b` exits 2 when `b`
-            # does not exist -- even on a match in `a`, and even with `-s`,
-            # which suppresses the message and not the status. Written as one
-            # grep over both names, this criterion fails whenever the route
-            # that produces only a header is taken, which is a failure about
-            # the criterion and not about the shader.
-            found=""
-            for g in "$d/$f.h" "$d/$f.inc"; do
-              [ -f "$g" ] && grep -q '0x07230203' "$g" && found=1
-            done
-            [ -n "$found" ] \
-              || { echo "$f carries no SPIR-V magic in either $f.h or $f.inc"; exit 1; }
-          done
-          echo "ok: both shader stages compiled and the Vulkan half linked"
-
-      # WINDOWS STAYS AT "BUILDS", AND FOUR MEASUREMENTS SAY WHY IT IS NOT
-      # WAITING ON ANY OF THE THINGS IT WAS THOUGHT TO BE.
-      #
-      # 1. Not a missing `vulkan-1.dll`. The program printed `render
-      #    unavailable`, which `src/main.cpp` writes after the render function
-      #    returns nothing. A process that could not resolve `vkCreateInstance`
-      #    from that DLL fails during image load and prints nothing at all.
-      #    mcpp-index's own `vulkan-tests` member calls
-      #    `vkEnumerateInstanceVersion` on the windows shards and passes.
-      #
-      # 2. Not an unparseable ICD manifest, though that WAS a real defect.
-      #    `xim:mesa-lavapipe` wrote its rewritten `library_path` into the
-      #    JSON string unescaped, so `C:\Users\...` carried `\U` and the
-      #    loader's cJSON parser rejected the file -- an ICD it skips with no
-      #    error. Fixed in openxlings/xim-pkgindex#781. With the fix the runner
-      #    reads
-      #      "library_path": "C:/Users/.../lib/vulkan_lvp.dll"
-      #    and the manifest parses. The program still prints `render
-      #    unavailable`.
-      #
-      # 3. Not a failed `LoadLibrary`. `vulkan_lvp.dll` imports only
-      #    ADVAPI32, GDI32, KERNEL32, ntdll, ole32, SHELL32 and USER32, all of
-      #    which any Windows has; the payload ships nothing else that could be
-      #    missing.
-      #
-      # 4. Not the environment variable's vintage. Both `VK_DRIVER_FILES` and
-      #    `VK_ICD_FILENAMES` were set, which covers loaders on either side of
-      #    1.3.234.
-      #
-      # What the loader itself said under `VK_LOADER_DEBUG=all`:
-      #
-      #   INFO: Loader is running with elevated permissions.
-      #         Environment variable VK_DRIVER_FILES will be ignored
-      #   INFO: Loader is running with elevated permissions.
-      #         Environment variable VK_ICD_FILENAMES will be ignored
-      #   DRIVER: Found no registry files in
-      #           HKEY_LOCAL_MACHINE\SOFTWARE\Khronos\Vulkan\Drivers
-      #   ERROR | DRIVER: windows_read_data_files_in_registry: Registry lookup
-      #           failed to get ICD manifest files.  Possibly missing Vulkan driver?
-      #
-      # THAT IS THE WHOLE ANSWER, AND NO PACKAGE CHANGE REACHES IT. A GitHub
-      # Windows runner runs elevated, and the loader discards every driver-path
-      # environment variable when it is -- it will not let a path a
-      # non-administrator could write inject a driver into an elevated process.
-      # It then falls back to the registry, which has no ICD. The mechanism this
-      # example uses on Linux and macOS is simply unavailable here.
-      #
-      # Reaching lavapipe on Windows therefore means registering the ICD under
-      # `HKEY_LOCAL_MACHINE\SOFTWARE\Khronos\Vulkan\Drivers`, or running the
-      # program unelevated. `xim:mesa-lavapipe`'s `config()` says outright that
-      # it places the payload and leaves naming the ICD to the consumer, so the
-      # registry entry is a decision for that package or for this repository,
-      # not a defect in either
-      #
-      # So the platform builds the Vulkan half and runs the CPU fallback, and
-      # the next attempt starts from here rather than from the top.
-
-      - name: "Toolchain: LLVM — build mcpp (self-host)"
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          cp "$MCPP_SELF" /tmp/mcpp-fresh.exe
-          MCPP=/tmp/mcpp-fresh.exe
-          "$MCPP" toolchain default llvm@23.1.3
-          "$MCPP" clean --bmi-cache
-          "$MCPP" build 2>&1 | tee build.log; grep -q "Resolved llvm@23.1.3" build.log
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 3722d4a9c..000000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,277 +0,0 @@
-name: ci
-
-# THE CI OF ONE COMMIT, IN STAGES. The design and its measurements are in
-# .agents/docs/2026-10-02-pr-ci-acceleration-and-the-toolchain-specification-design.md
-# (Part II); the rules it cites are R1-R7 there.
-#
-#   changes   what the commit changed decides what runs (R2). A change of
-#             documentation that nothing reads runs `docs` and nothing else.
-#   docs      the checks that need no binary, on every change.
-#   build-*   this commit's mcpp, built ONCE per host (R1) by build.yml and
-#             uploaded as `mcpp-built-<host>`.
-#   the rest  the per-area workflows, called as reusable workflows. Each waits
-#             for its own host's build only, takes the binary with
-#             .github/actions/use-built-mcpp, and keeps the job names it had as
-#             a workflow of its own.
-#   e2e-coverage  every e2e test ran somewhere or says why not (R5).
-#
-# Measured before this shape (2026-10-01, seven commits): 35 to 47 jobs started
-# at once against the organisation's 20 slots, 30 to 37 of them built mcpp
-# from source, and a commit waited 36 to 50 minutes, 9 to 13 of them in the
-# queue.
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-  workflow_dispatch:
-
-# A superseded pull-request run is cancelled. Every push to main runs to the
-# end, in a group of its own commit: its build jobs are the only writers of the
-# caches (R3), and a cancelled run saves nothing. A group shared by all pushes
-# to main would still lose runs, because GitHub keeps one pending run per group
-# and cancels the older pending one when a third arrives.
-concurrency:
-  group: ci-${{ github.event_name == 'push' && github.sha || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-permissions:
-  contents: read
-  # `changes` lists the files of the pull request.
-  pull-requests: read
-
-jobs:
-  changes:
-    name: what the change starts
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      code: ${{ steps.classify.outputs.code }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Classify the changed paths
-        id: classify
-        env:
-          GH_TOKEN: ${{ github.token }}
-          EVENT: ${{ github.event_name }}
-          REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-          BEFORE: ${{ github.event.before }}
-          SHA: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-          full() { echo "code=true" >> "$GITHUB_OUTPUT"; echo "code=true ($1)"; }
-          # Anything this step cannot list runs the whole CI: an API error, a
-          # force-push whose previous commit is gone, an event without a diff.
-          case "$EVENT" in
-            pull_request)
-              gh api --paginate "repos/$REPO/pulls/$PR/files" \
-                --jq '.[] | .filename, (.previous_filename // empty)' > changed.txt \
-                || { full "the files of the pull request could not be listed"; exit 0; } ;;
-            push)
-              if [ -z "$BEFORE" ] || [ "$BEFORE" = 0000000000000000000000000000000000000000 ]; then
-                full "a push with no previous commit"; exit 0
-              fi
-              gh api "repos/$REPO/compare/$BEFORE...$SHA" > compare.json \
-                || { full "the push could not be compared with its previous commit"; exit 0; }
-              # The compare API lists at most 300 files; a longer list is
-              # treated as a change of everything.
-              if [ "$(jq '.files | length' compare.json)" -ge 300 ]; then
-                full "300 or more changed files"; exit 0
-              fi
-              jq -r '.files[] | .filename, (.previous_filename // empty)' compare.json > changed.txt ;;
-            *)
-              full "event $EVENT"; exit 0 ;;
-          esac
-          python3 .github/tools/classify_changes.py --github-output "$GITHUB_OUTPUT" < changed.txt
-
-  docs:
-    name: documentation and repository checks
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check version / xlings pin consistency
-        run: bash .github/tools/check_version_pins.sh
-
-      - name: Check modules/ wiring
-        run: bash .github/tools/check_modules_wiring.sh
-
-      - name: Check src/build/prepare* file lengths
-        run: bash .github/tools/check_file_lengths.sh
-
-      - name: Check no walk-derived path is narrowed directly
-        run: bash .github/tools/check_narrow_conversions.sh
-
-      - name: Where the CI assertions live
-        run: bash tools/lint-ci-assertions.sh
-
-      - name: Steps assert what their names say
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 tests/scripts/test_check_workflow_assertions.py
-          python3 .github/tools/check_workflow_assertions.py --check-open
-
-      - name: The release canary runner runs each command under the named bash
-        run: python3 tests/scripts/test_release_canaries.py
-
-      - name: The protocol table of SPEC-007 names the engine's protocol
-        run: python3 tests/scripts/test_protocol_table.py
-
-      - name: The target matrix names every refusal
-        run: bash .github/tools/check_matrix_reasons.sh
-
-      - name: Check documentation style and bilingual parity
-        run: bash .github/tools/check_docs_style.sh
-
-      - name: Check documentation structure
-        run: bash .github/tools/check_docs_structure.sh
-
-      - name: The key registry and the field reference agree
-        run: python3 .github/tools/check_manifest_key_classes.py
-
-      - name: The deprecation registry, the code and docs/51 agree
-        run: python3 .github/tools/check_compat_registry.py
-
-      - name: Documented target tiers agree with the table
-        run: python3 .github/tools/check_target_tiers.py
-
-      - name: Reason tokens agree with the engine, and with the mirror
-        run: bash .github/tools/check_reason_tokens.sh
-
-      - name: Only the adapter and the composition root name the provider
-        run: python3 .github/tools/check_provider_boundary.py
-
-      - name: The tools of the CI stages pass their fixtures
-        run: |
-          python3 tests/scripts/test_classify_changes.py
-          python3 tests/scripts/test_check_e2e_coverage.py
-          python3 tests/scripts/test_check_default_toolchain_docs.py
-          python3 tests/scripts/test_check_provider_boundary.py
-          python3 tests/scripts/test_native_candidate_admission.py
-          python3 -m unittest discover -s tests/scripts -p test_toolchain_env.py
-
-  build-linux:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    uses: ./.github/workflows/build.yml
-    with:
-      host: linux-x86_64
-      runs-on: ubuntu-24.04
-      # What the Linux consumers install beyond the build's own toolchain: the
-      # e2e shards (musl, llvm, mingw-cross), the toolchain legs (musl, llvm).
-      prewarm: gcc 16.1.0-musl; llvm 23.1.3; mingw-cross 16.1.0
-
-  build-linux-arm:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    uses: ./.github/workflows/build.yml
-    with:
-      host: linux-aarch64
-      runs-on: ubuntu-24.04-arm
-      prewarm: llvm 23.1.3; gcc 16.1.0-musl
-
-  build-macos:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    uses: ./.github/workflows/build.yml
-    with:
-      host: macos-arm64
-      runs-on: macos-15
-
-  build-windows:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    uses: ./.github/workflows/build.yml
-    with:
-      host: windows-x86_64
-      runs-on: windows-latest
-      # The MinGW payload every Windows e2e shard installs.
-      prewarm: mingw 16.1.0
-
-  # The mcpp .xlings.json names builds the tree as a developer's clone does,
-  # and so does the newest release while the pin lags it (ci-bootstrap.yml).
-  bootstrap:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    uses: ./.github/workflows/ci-bootstrap.yml
-
-  linux:
-    needs: build-linux
-    uses: ./.github/workflows/ci-linux.yml
-
-  linux-e2e:
-    needs: build-linux
-    uses: ./.github/workflows/ci-linux-e2e.yml
-
-  macos:
-    needs: build-macos
-    uses: ./.github/workflows/ci-macos.yml
-
-  macos-e2e:
-    needs: build-macos
-    uses: ./.github/workflows/ci-macos-e2e.yml
-
-  macos-ios:
-    needs: build-macos
-    uses: ./.github/workflows/ci-macos-ios.yml
-
-  windows:
-    needs: build-windows
-    uses: ./.github/workflows/ci-windows.yml
-
-  windows-e2e:
-    needs: build-windows
-    uses: ./.github/workflows/ci-windows-e2e.yml
-
-  windows-msvc-xlings:
-    needs: build-windows
-    uses: ./.github/workflows/ci-windows-msvc-xlings.yml
-
-  cross:
-    needs: [build-linux, build-windows]
-    uses: ./.github/workflows/cross-build-test.yml
-
-  target-matrix:
-    needs: [build-linux, build-linux-arm, build-macos, build-windows]
-    uses: ./.github/workflows/ci-target-matrix.yml
-
-  # Pull requests and dispatch only, as when it was a workflow of its own.
-  openkal:
-    needs: [build-linux, build-linux-arm, build-macos, build-windows]
-    if: github.event_name != 'push'
-    uses: ./.github/workflows/openkal-cross.yml
-
-  e2e-coverage:
-    name: every e2e test runs somewhere
-    needs: [changes, linux-e2e, windows-e2e, macos-e2e]
-    if: ${{ always() && needs.changes.outputs.code == 'true' && !cancelled() }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Fetch the shards' reports
-        uses: actions/download-artifact@v4
-        with:
-          pattern: e2e-report-*
-          path: reports
-          merge-multiple: true
-
-      - name: Every test ran, is run by a dedicated job, or is excused
-        run: python3 .github/tools/check_e2e_coverage.py --reports reports --timings-out timings
-
-      # The measured durations, merged per host, in the format of
-      # tests/e2e/timings/; refreshing those tables is copying these files.
-      - name: Upload the measured durations
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: e2e-timings
-          path: timings/
-          if-no-files-found: ignore
-          retention-days: 14
diff --git a/.github/workflows/cross-build-test.yml b/.github/workflows/cross-build-test.yml
deleted file mode 100644
index fac33d54a..000000000
--- a/.github/workflows/cross-build-test.yml
+++ /dev/null
@@ -1,574 +0,0 @@
-name: cross-build-test
-
-# mcpp cross-build test — the single source of truth for "which CROSS-build
-# target combinations mcpp supports", verified end-to-end.
-#
-# Cross = host arch ≠ target arch. Verification targets are mcpp ITSELF and
-# xlings (real, self-hosting C++23 module projects), cross-built from source for
-# each target triple, arch-checked, and smoke-run under qemu-user.
-#
-# ── Supported cross matrix (built + verified below) ────────────────────────
-#   target                | toolchain                        | host→target   | run
-#   ----------------------|----------------------------------|---------------|-----
-#   aarch64-linux-musl    | aarch64-linux-musl-gcc@16.1.0    | x86_64→arm64  | qemu
-#   x86_64-w64-mingw32    | mingw-cross-gcc@16.1.0 (MSVCRT)  | linux→windows | wine
-#   x86_64-linux-musl     | x86_64-linux-musl-gcc@16.1.0     | windows→linux | linux job
-#
-# The mingw row is OS-cross (same arch, different OS/ABI: ELF→PE), so it lives
-# in its own job below with wine verification instead of the qemu arch matrix.
-# See .agents/docs/2026-07-15-mingw-linux-cross-windows-design.md.
-#
-# The windows→linux row is the MIRROR of that one, and its verification has no
-# wine-equivalent: a Windows runner cannot execute the ELF it just produced.
-# So it is split across TWO jobs — build on windows-latest, upload the artefact,
-# then download and really run it on ubuntu. Static assertions alone would not
-# do: "it linked" has never implied "it runs" (see the elfpatch incident in
-# .agents/docs/, and 2026-08-03-windows-host-linux-cross-design.md §6.1).
-# The artefact is a fully static musl ELF (no PT_INTERP), so the consumer job
-# needs neither qemu nor a matching loader.
-#
-# mcpp resolves a cross `--target <triple>-musl` build to the triple-named cross
-# gcc musl toolchain from the xlings ecosystem (xim:<triple>-gcc, see
-# src/build/prepare.cppm). Output is a fully static musl ELF (no PT_INTERP),
-# which also makes the aarch64 artefact runnable natively in Termux/Android —
-# qemu-aarch64 is the CI proxy for "does this cross artefact actually execute".
-#
-# ── NOT here ───────────────────────────────────────────────────────────────
-#   * The e2e scripts this job names explicitly (102, 198, 240, 248) are the
-#     ones the ordinary Linux shards SKIP for want of `mingw-cross`. They are
-#     listed in the job rather than left to run_all's cap gating precisely so
-#     they cannot end up skipping everywhere at once.
-#   * Same-arch builds (host arch == target arch) are NOT cross. The native musl
-#     static build `--target x86_64-linux-musl` (x86_64 host) is exercised by
-#     ci-linux.yml's "Toolchain: musl-gcc" step, and release.yml for the static
-#     release artefact. Keep them there; this file is cross-arch only.
-#
-# ── Planned cross rows (documented; NOT yet wired in mcpp — keep as comments) ─
-#   * llvm/clang cross  : clang is inherently a cross-compiler, but mcpp does not
-#                         yet inject `-target <triple>` + a cross sysroot for a
-#                         clang toolchain; cross `--target` resolves to gcc musl
-#                         only. Wire the clang cross path first, then add a row.
-#   * riscv64-linux-musl: add once xim:riscv64-linux-musl-gcc ships to
-#                         xlings-res + xim-pkgindex.
-
-on:
-  workflow_call:
-
-jobs:
-  cross-build:
-    name: cross-build ${{ matrix.target }} (mcpp + xlings)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - target: aarch64-linux-musl
-            file_arch: "ARM aarch64"
-            qemu_bin: qemu-aarch64-static
-    env:
-      MCPP_HOME: /home/runner/.mcpp
-      # Verbose every mcpp invocation for richer CI diagnostics (src/cli.cppm).
-      MCPP_VERBOSE: "1"
-    steps:
-      - uses: actions/checkout@v4
-
-      # Restored here and saved by this job alone, on main, after its last
-      # step (rule R3 of the 2026-10-02 CI record).
-      - name: Restore mcpp sandbox
-        id: sandbox
-        uses: actions/cache/restore@v4
-        with:
-          path: ~/.mcpp
-          key: mcpp-sandbox-${{ runner.os }}-cross-${{ matrix.target }}-${{ hashFiles('mcpp.toml', '.xlings.json', '.github/workflows/cross-build-test.yml') }}
-          restore-keys: |
-            mcpp-sandbox-${{ runner.os }}-cross-${{ matrix.target }}-
-
-      - name: Restore xlings
-        id: xlings
-        uses: actions/cache/restore@v4
-        with:
-          path: ~/.xlings
-          key: xlings-${{ runner.os }}-cross-v3-${{ hashFiles('.xlings.json') }}
-          restore-keys: |
-            xlings-${{ runner.os }}-cross-v3-
-
-      - name: Install qemu-user-static
-        run: |
-          # The runner image carries third-party apt lists (Google Chrome
-          # among them) that this job does not use, and a transient
-          # `Hash Sum mismatch` on one of them fails the whole update -- which
-          # killed two cross-build jobs in setup, before a single byte was
-          # compiled. Dropping the lists this job has no use for is what makes
-          # the step's failure mean something about this job.
-          #
-          # BY CONTENT, NOT BY FILENAME. The first attempt removed
-          # `google-chrome.list` and the update failed on the same URL: on
-          # ubuntu-24.04 the runner writes deb822 `.sources` files, so the
-          # name was a guess and the guess was wrong.
-          sudo grep -rlE 'dl[.]google[.]com|packages[.]microsoft[.]com' \
-               /etc/apt/sources.list.d/ 2>/dev/null | xargs -r sudo rm -f
-          sudo apt-get update -qq
-          sudo apt-get install -y qemu-user-static
-          ${{ matrix.qemu_bin }} --version | head -1
-
-      - name: Bootstrap mcpp via xlings
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-          # Must equal `pinned::kXlingsVersion` (src/provider/xlings/xlings.cppm) and the
-          # xlings the release bundles — enforced by
-          # .github/tools/check_version_pins.sh.
-          #
-          # Floors worth remembering. 0.4.67 carried the
-          # multi-index_repo install fix (openxlings/xlings#374); 0.4.68 adds
-          # per-repo index artifact sources (openxlings/xlings#377) so the
-          # mcpplibs index syncs via artifact with git as fallback (mcpp#269);
-          # 0.4.69 keys the index by (namespace, name) so two packages sharing
-          # a short name in ONE index are both addressable (openxlings/xlings#381)
-          # — the floor for SPEC-001 short-name descriptors.
-          # A past 0.4.61 "download 404
-          # for mcpp@<pin>" was NOT a version bug — the xlings-res/mcpp GitHub
-          # release assets were uploaded in a broken state (records present,
-          # blobs missing → 404 on GET); re-uploaded clean. The stale-INDEX
-          # half is handled by the marker-clear below.
-          XLINGS_VERSION: '2026.10.16.2'
-        run: |
-          tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
-          bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-            "https://github.com/d2learn/xlings/releases/download/v${XLINGS_VERSION}/${tarball}" \
-            "/tmp/${tarball}"
-          tar -xzf "/tmp/${tarball}" -C /tmp
-          "/tmp/xlings-${XLINGS_VERSION}-linux-x86_64/subos/default/bin/xlings" self install
-          export PATH="$HOME/.xlings/subos/default/bin:$PATH"
-          xlings --version
-          # Force a real index re-sync even on a warm cache: drop the TTL refresh
-          # markers so `xlings update` actually pulls the latest index (sees the
-          # current bootstrap pin) while the toolchain payloads stay cached.
-          find "$HOME/.xlings" -name '.xlings-index-cache.json' -delete 2>/dev/null || true
-          xlings config --mirror GLOBAL 2>/dev/null || true
-          xlings update -y 2>/dev/null || xlings update 2>/dev/null || true
-          # MCPP_BOOT is what actually runs the bootstrap build below, so it —
-          # not just MCPP — has to be the pinned binary. It used to be the shim
-          # in subos/default/bin, which resolves to whatever version xvm has
-          # selected; pinning only MCPP would have looked right and changed
-          # nothing.
-          MCPP_BOOT=$(bash "$GITHUB_WORKSPACE/.github/tools/install_pinned_mcpp.sh" "$GITHUB_WORKSPACE")
-          echo "MCPP=$MCPP_BOOT" >> "$GITHUB_ENV"
-          echo "XLINGS_BIN=$HOME/.xlings/subos/default/bin/xlings" >> "$GITHUB_ENV"
-          echo "MCPP_BOOT=$MCPP_BOOT" >> "$GITHUB_ENV"
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: "Cross-build mcpp -> ${{ matrix.target }}"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" build --target ${{ matrix.target }}
-          bin=$(find target/${{ matrix.target }} -type f -name mcpp | head -1)
-          [ -n "$bin" ] || { echo "no mcpp artefact for ${{ matrix.target }}"; exit 1; }
-          echo "== file =="; file "$bin"
-          file "$bin" | grep -q "${{ matrix.file_arch }}" || { echo "expected ${{ matrix.file_arch }}"; exit 1; }
-          file "$bin" | grep -q "statically linked" || { echo "expected static"; exit 1; }
-          echo "MCPP_XBIN=$bin" >> "$GITHUB_ENV"
-
-      - name: "Cross-build xlings -> ${{ matrix.target }}"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          # A hosted runner's DNS hiccup is not a red build — see
-          # .github/tools/git_clone_retry.sh for the measurement.
-          "$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh" \
-            --depth 1 https://github.com/openxlings/xlings /tmp/xlings-src
-          cd /tmp/xlings-src
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" build --target ${{ matrix.target }}
-          xbin=$(find target/${{ matrix.target }} -type f -name xlings | head -1)
-          [ -n "$xbin" ] || { echo "no xlings artefact for ${{ matrix.target }}"; exit 1; }
-          echo "== file =="; file "$xbin"
-          file "$xbin" | grep -q "${{ matrix.file_arch }}" || { echo "expected ${{ matrix.file_arch }}"; exit 1; }
-          file "$xbin" | grep -q "statically linked" || { echo "expected static"; exit 1; }
-          echo "XLINGS_XBIN=$xbin" >> "$GITHUB_ENV"
-
-      - name: "Smoke-run cross artefacts under qemu"
-        run: |
-          RUN="${{ matrix.qemu_bin }}"
-          # mcpp is self-contained, so --version runs cleanly under bare qemu —
-          # this is the hard execution proof for the cross artefact.
-          echo "== mcpp --version =="
-          mver=$($RUN "$MCPP_XBIN" --version)
-          echo "$mver"; echo "$mver" | grep -q "mcpp" || { echo "mcpp --version failed"; exit 1; }
-          # xlings expects a real runtime environment (sandbox/config) and may
-          # exit non-zero on a bare `--version` under qemu; its ELF arch + static
-          # linkage were already asserted in the build step, so treat execution
-          # here as best-effort rather than gating.
-          echo "== xlings --version (best-effort under qemu) =="
-          xver=$($RUN "$XLINGS_XBIN" --version 2>&1 || true)
-          echo "$xver"
-
-      - name: Save mcpp sandbox
-        if: ${{ github.event_name == 'push' && steps.sandbox.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.mcpp
-          key: ${{ steps.sandbox.outputs.cache-primary-key }}
-
-      - name: Save xlings
-        if: ${{ github.event_name == 'push' && steps.xlings.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.xlings
-          key: ${{ steps.xlings.outputs.cache-primary-key }}
-
-  # ── Linux → Windows MinGW cross (OS-cross, same arch: ELF→PE) ─────────────
-  # Builds a demo project for x86_64-w64-mingw32 with the from-source GCC-16
-  # MSVCRT cross toolchain, asserts the artefact is a fully-static PE, and runs
-  # it under wine. Delegated to the e2e harness (tests/e2e/102_mingw_cross_wine.sh,
-  # `# requires: mingw-cross wine`) so the run_all cap-gating stays the single
-  # source of truth. See 2026-07-15-mingw-linux-cross-windows-design.md Part C.
-  mingw-cross-wine:
-    name: mingw-cross linux→windows (build + wine run)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    env:
-      MCPP_HOME: /home/runner/.mcpp
-      MCPP_VERBOSE: "1"
-    steps:
-      - uses: actions/checkout@v4
-
-      # Restored here and saved by this job alone, on main, after its last
-      # step (rule R3). The Wine packages were evicted with everything else
-      # while the repository's caches exceeded their limit, and `apt` then
-      # took 26 to 50 minutes (2026-10-01); with one writer per key they stay.
-      - name: Restore mcpp sandbox
-        id: sandbox
-        uses: actions/cache/restore@v4
-        with:
-          path: ~/.mcpp
-          key: mcpp-sandbox-${{ runner.os }}-mingw-cross-${{ hashFiles('mcpp.toml', '.xlings.json', '.github/workflows/cross-build-test.yml') }}
-          restore-keys: |
-            mcpp-sandbox-${{ runner.os }}-mingw-cross-
-
-      - name: Restore xlings
-        id: xlings
-        uses: actions/cache/restore@v4
-        with:
-          path: ~/.xlings
-          key: xlings-${{ runner.os }}-mingw-cross-v3-${{ hashFiles('.xlings.json') }}
-          restore-keys: |
-            xlings-${{ runner.os }}-mingw-cross-v3-
-
-      # THE KEY NAMES THE RUNNER IMAGE, because the image is what the cached
-      # packages have to agree with. Wine's i386 closure is Multi-Arch: same
-      # with the amd64 libraries the image ships, and the two must be one
-      # version. Under the old fixed key (`-v1`) the cache was saved once and
-      # never again, the image moved on, and on 2026-10-15 (run 38695300904,
-      # a cache HIT) the cached libxml2:i386 3.9 met the image's
-      # libxml2:amd64 3.10: dpkg installed the stale i386 package, apt then
-      # upgraded it, and the upgrade's shared changelog was refused. A new
-      # image is a new key; until main has saved it, `restore-keys` hands back
-      # the previous image's packages, which the step below only uses where
-      # their version is still the one apt asks for.
-      - name: Runner image version
-        id: image
-        run: echo "version=${ImageVersion:-unknown}" >> "$GITHUB_OUTPUT"
-
-      - name: Restore wine debs
-        id: wine
-        uses: actions/cache/restore@v4
-        with:
-          path: ~/wine-debs
-          key: wine-debs-${{ runner.os }}-ubuntu24.04-${{ steps.image.outputs.version }}
-          restore-keys: |
-            wine-debs-${{ runner.os }}-ubuntu24.04-
-
-      # APT INSTALLS, ALWAYS; THE CACHE ONLY SPARES IT THE DOWNLOAD. The cached
-      # packages are put where apt keeps what it downloaded, and apt then
-      # resolves wine against the image as it is today: a cached package whose
-      # version is still current is used as is, anything newer is fetched.
-      # Nothing older than the image is ever installed, which is what
-      # `dpkg -i` of the cached set did whenever the image had moved on. Cold
-      # (no cache at all), this is the plain install it always was.
-      - name: Install wine
-        timeout-minutes: 20
-        run: |
-          sudo dpkg --add-architecture i386 || true
-          # The runner image carries third-party apt lists (Google Chrome
-          # among them) that this job does not use, and a transient
-          # `Hash Sum mismatch` on one of them fails the whole update -- which
-          # killed two cross-build jobs in setup, before a single byte was
-          # compiled. Dropping the lists this job has no use for is what makes
-          # the step's failure mean something about this job.
-          #
-          # BY CONTENT, NOT BY FILENAME. The first attempt removed
-          # `google-chrome.list` and the update failed on the same URL: on
-          # ubuntu-24.04 the runner writes deb822 `.sources` files, so the
-          # name was a guess and the guess was wrong.
-          sudo grep -rlE 'dl[.]google[.]com|packages[.]microsoft[.]com' \
-               /etc/apt/sources.list.d/ 2>/dev/null | xargs -r sudo rm -f
-          if ls ~/wine-debs/*.deb >/dev/null 2>&1; then
-            sudo cp ~/wine-debs/*.deb /var/cache/apt/archives/
-          fi
-          sudo apt-get update -qq
-          sudo apt-get install -y --download-only wine64 wine \
-            || sudo apt-get install -y --download-only wine
-          # What main saves is what this image installs: packages no longer
-          # in any index (the previous image's, carried in by restore-keys)
-          # are dropped first, so the cache does not grow with every image.
-          sudo apt-get autoclean -qq
-          rm -rf ~/wine-debs && mkdir -p ~/wine-debs
-          cp /var/cache/apt/archives/*.deb ~/wine-debs/ 2>/dev/null || true
-          sudo apt-get install -y wine64 wine || sudo apt-get install -y wine
-          wine --version
-
-      - name: Bootstrap mcpp via xlings
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.10.16.2'
-        run: |
-          tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
-          bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-            "https://github.com/d2learn/xlings/releases/download/v${XLINGS_VERSION}/${tarball}" \
-            "/tmp/${tarball}"
-          tar -xzf "/tmp/${tarball}" -C /tmp
-          "/tmp/xlings-${XLINGS_VERSION}-linux-x86_64/subos/default/bin/xlings" self install
-          export PATH="$HOME/.xlings/subos/default/bin:$PATH"
-          find "$HOME/.xlings" -name '.xlings-index-cache.json' -delete 2>/dev/null || true
-          xlings config --mirror GLOBAL 2>/dev/null || true
-          xlings update -y 2>/dev/null || xlings update 2>/dev/null || true
-          # MCPP_BOOT is what actually runs the bootstrap build below, so it —
-          # not just MCPP — has to be the pinned binary. It used to be the shim
-          # in subos/default/bin, which resolves to whatever version xvm has
-          # selected; pinning only MCPP would have looked right and changed
-          # nothing.
-          MCPP_BOOT=$(bash "$GITHUB_WORKSPACE/.github/tools/install_pinned_mcpp.sh" "$GITHUB_WORKSPACE")
-          echo "MCPP=$MCPP_BOOT" >> "$GITHUB_ENV"
-          echo "XLINGS_BIN=$HOME/.xlings/subos/default/bin/xlings" >> "$GITHUB_ENV"
-          echo "MCPP_BOOT=$MCPP_BOOT" >> "$GITHUB_ENV"
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: Install mingw-cross toolchain
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" toolchain install mingw-cross 16.1.0
-
-      - name: "e2e: cross-build + wine run"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          bash tests/e2e/102_mingw_cross_wine.sh
-
-      # mcpp#365. This is the only job with a MinGW cross toolchain, so it is
-      # the only place the GNU half of resource compilation (windres -O coff,
-      # because GNU ld cannot consume a .res) can run at all — the Linux e2e
-      # shards skip it for want of the `mingw-cross` capability. Named
-      # explicitly for the same reason 102 is.
-      - name: "e2e: windows resources (windres / COFF)"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          bash tests/e2e/198_windows_resources_cross.sh
-
-      # Packaging a Windows program FROM LINUX — and this job is the only
-      # place that can happen, for the same reason as the two above.
-      #
-      # Running it on a Windows runner would prove nothing: the point of
-      # reading the import table instead of executing the artifact
-      # (mcpp.pack.binfmt) is precisely that the packaging host need not be
-      # the target. A same-OS pack cannot tell the two implementations apart.
-      - name: "e2e: pack a PE from Linux (zip + DLL closure)"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          bash tests/e2e/240_pack_pe_zip_cross.sh
-
-      # A LIBRARY package whose legs cross an OS boundary, for the same reason
-      # as the three above: this is the only job with a MinGW cross toolchain.
-      #
-      # It is not redundant with 245 (which covers the fat-package mechanism
-      # with gnu + musl and therefore runs on every ordinary Linux shard). The
-      # leg added here changes BINARY FORMAT, and it is the case that proves
-      # `lib/` has to be keyed by triple rather than by OS: MinGW and MSVC are
-      # both "windows" and write `libfoo.a` and `foo.lib` respectively.
-      #
-      # Without this step the test would carry `# requires: mingw-cross` and
-      # skip in every job that exists — verified on a developer's machine and
-      # nowhere else, while the suite reported green.
-      - name: "e2e: pack a library across an OS boundary (PE leg)"
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          bash tests/e2e/248_pack_library_fat_pe_leg.sh
-
-      # SPEC-007 R4.3: the engine places a Windows program's runtime DLLs
-      # beside it after its link, so a program started by hand finds them.
-      # Named here for the reason the steps above are: the Linux shards skip
-      # `# requires: mingw-cross wine`. Each property is held to the line the
-      # script prints only when that property was checked.
-      # The runtime_search_dir directive on PE (#701): `mcpp run` finds a DLL
-      # through PATH and `mcpp pack` places it. The native leg is e2e 794 on
-      # the Windows shards; this is its Linux-hosted counterpart.
-      - name: "e2e: runtime_search_dir on PE under wine"
-        run: |
-          set -o pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          log="$RUNNER_TEMP/796.log"
-          bash tests/e2e/796_runtime_search_dir_on_pe_under_wine.sh 2>&1 | tee "$log"
-          grep -qxF "PASS: 796_runtime_search_dir_on_pe_under_wine" "$log" \
-            || { echo "::error::796 did not print its PASS line"; exit 1; }
-
-      - name: "e2e: a Windows program finds its runtime DLLs beside it"
-        run: |
-          set -o pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          log="$RUNNER_TEMP/797.log"
-          bash tests/e2e/797_a_windows_program_finds_its_dlls_beside_it.sh 2>&1 | tee "$log"
-          for line in \
-            "  ok: after the first build the program started by hand finds its DLL" \
-            "  ok: a build with nothing changed neither relinks nor places again" \
-            "  ok: a DLL replaced in its directory replaces the copy" \
-            "  ok: no system DLL is copied" \
-            "PASS: a Windows program finds its runtime DLLs beside it"; do
-            grep -qxF "$line" "$log" || { echo "::error::797 did not print: $line"; exit 1; }
-          done
-
-      # 257 needs a Linux-hosted MinGW compiler AND wine, which only this job
-      # has; on the shards it skipped, and it had run on no runner (finding F9
-      # of the 2026-10-02 CI record).
-      - name: "e2e: a shared library across the PE boundary (257)"
-        run: |
-          set -o pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          log="$RUNNER_TEMP/257.log"
-          bash tests/e2e/257_shared_library_pe.sh 2>&1 | tee "$log"
-          if grep -q '^SKIP' "$log"; then
-            echo "::error::257 skipped on the job that can run it"; exit 1
-          fi
-
-      - name: Save mcpp sandbox
-        if: ${{ github.event_name == 'push' && steps.sandbox.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.mcpp
-          key: ${{ steps.sandbox.outputs.cache-primary-key }}
-
-      - name: Save xlings
-        if: ${{ github.event_name == 'push' && steps.xlings.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/.xlings
-          key: ${{ steps.xlings.outputs.cache-primary-key }}
-
-      - name: Save wine debs
-        if: ${{ github.event_name == 'push' && steps.wine.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v4
-        with:
-          path: ~/wine-debs
-          key: ${{ steps.wine.outputs.cache-primary-key }}
-
-  # ── windows → linux ───────────────────────────────────────────────────────
-  # The mirror of mingw-cross-wine. Two jobs because a Windows runner cannot
-  # execute the ELF it produces; the artefact is handed to a Linux job and
-  # really run there.
-  windows-host-linux-cross:
-    name: windows→linux cross-build (windows host)
-    runs-on: windows-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@v4
-      # No job restores target/ any more. This one was the first to stop: a
-      # restored BMI tree beside a fresh one made GCC report
-      # `import 'std' has CRC mismatch` on the second of its two builds.
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: windows-x86_64
-
-      - name: Name this commit's mcpp MCPP_SELF
-        shell: bash
-        run: |
-          "$MCPP_FRESH" --version
-          echo "MCPP_SELF=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: Install the linux-musl cross toolchain (windows-hosted canadian)
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP_SELF" toolchain install gcc 16.1.0 --target x86_64-linux-musl
-          # The target row must now be visible on a Windows host — this is the
-          # host gate from design §1.2 having been lifted, asserted rather than
-          # eyeballed.
-          "$MCPP_SELF" toolchain list | tee /tmp/tclist.txt
-          grep -q "x86_64-linux-musl" /tmp/tclist.txt \
-            || { echo "FAIL: linux-musl target not listed on windows host"; exit 1; }
-
-      - name: "Cross-build mcpp -> x86_64-linux-musl"
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP_SELF" build --target x86_64-linux-musl
-          # Scope the search to the TARGET's output tree — target/ also holds the
-          # host build from the previous step, and both are named "mcpp*".
-          #
-          # The artefact carries a `.exe` suffix even though it is an ELF:
-          # plan.cppm's target_output() spells the suffix from
-          # mcpp::platform::exe_suffix, a HOST constant. That is the same
-          # host-decides-target confusion as B2, and it is symmetric — a
-          # Linux→Windows cross produces a PE with no `.exe` today. Renaming the
-          # output is a behaviour change that would touch the mingw e2e and any
-          # user script, so it is filed as follow-up rather than folded in here;
-          # match both spellings so this job is correct either way.
-          OUT=$(find target/x86_64-linux-musl -type f -path "*/bin/*" \
-                     \( -name "mcpp" -o -name "mcpp.exe" \) -printf "%T@ %p\n" \
-              | sort -rn | head -1 | cut -d" " -f2-)
-          if [ -z "$OUT" ]; then
-            echo "FAIL: no cross artefact produced; tree was:"
-            find target/x86_64-linux-musl -type f -path "*/bin/*" | head -20
-            exit 1
-          fi
-          cp "$OUT" mcpp-linux-musl
-          ls -la mcpp-linux-musl
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: mcpp-x86_64-linux-musl-from-windows
-          path: mcpp-linux-musl
-          retention-days: 1
-
-  windows-host-linux-cross-run:
-    name: windows→linux artefact really runs (linux)
-    needs: windows-host-linux-cross
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: mcpp-x86_64-linux-musl-from-windows
-
-      - name: Assert it is a static ELF, then run it
-        run: |
-          set -euo pipefail
-          chmod +x mcpp-linux-musl
-          file mcpp-linux-musl
-
-          # B2 regression gate (design §1.3): before the fix, `-static` was
-          # decided by a HOST constant (`supports_full_static = is_linux`), so
-          # a Windows host emitted a NON-static binary here. Written as a
-          # positive `grep -q` on purpose: `! cmd | grep` is exempt from
-          # errexit and can never fail (see build-mcpp-helper-self-containment).
-          file mcpp-linux-musl | grep -q "ELF 64-bit LSB"
-          file mcpp-linux-musl | grep -q "x86-64"
-          file mcpp-linux-musl | grep -q "statically linked"
-
-          # A static musl ELF has no PT_INTERP at all — the stronger form of
-          # the same claim, and independent of `file`'s wording.
-          readelf -l mcpp-linux-musl > hdrs.txt
-          if grep -q "INTERP" hdrs.txt; then
-            echo "FAIL: artefact has a PT_INTERP segment — not statically linked"
-            grep -A2 "INTERP" hdrs.txt
-            exit 1
-          fi
-
-          # Linked ≠ runs. This is the whole point of the second job.
-          ./mcpp-linux-musl --version
-          ./mcpp-linux-musl --help > /dev/null
-          echo "OK: windows-built linux artefact executes natively"
diff --git a/.github/workflows/homebrew-publish.yml b/.github/workflows/homebrew-publish.yml
deleted file mode 100644
index 858e6e494..000000000
--- a/.github/workflows/homebrew-publish.yml
+++ /dev/null
@@ -1,83 +0,0 @@
-name: homebrew-publish
-
-# Tell the Homebrew tap (mcpp-community/homebrew-mcpp) that a release is out.
-#
-# The tap owns the formula rewrite — it reads the .sha256 sidecars from the
-# release and commits the new url/version itself. All this workflow does is
-# fire the starting gun, so nothing here needs to know what a formula is.
-#
-# Triggers on COMPLETION of the `release` workflow rather than on
-# `release: published`, for the same reason aur-publish.yml does: release.yml
-# creates the GitHub Release in its first job but uploads the macOS / aarch64
-# assets in later jobs, and the tap needs every sidecar to exist.
-#
-# Requires one repository secret:
-#   HOMEBREW_TAP_TOKEN — fine-grained PAT scoped to mcpp-community/homebrew-mcpp
-#                        with "Contents: read and write" (repository_dispatch
-#                        is a write-level API).
-#
-# The secret is OPTIONAL. Without it this workflow logs a notice and exits 0;
-# the tap runs the same bump on a daily schedule, so a missing token costs
-# freshness (up to 24h), not correctness. That keeps a release from failing
-# over a credential the release itself doesn't need.
-
-on:
-  workflow_run:
-    workflows: [release]
-    types: [completed]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (default: [package].version in mcpp.toml)"
-        required: false
-
-concurrency:
-  group: homebrew-publish
-  cancel-in-progress: false
-
-jobs:
-  notify-tap:
-    runs-on: ubuntu-latest
-    # On the workflow_run trigger, only proceed if the release actually
-    # succeeded (skip failed/cancelled release runs).
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      github.event.workflow_run.conclusion == 'success'
-    steps:
-      - name: Checkout released commit
-        uses: actions/checkout@v4
-        with:
-          # workflow_run: the exact commit the release was built from.
-          # workflow_dispatch: default ref (HEAD of the branch).
-          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
-
-      - name: Resolve version
-        id: resolve
-        run: |
-          VER="${{ github.event.inputs.version }}"
-          if [ -z "$VER" ]; then
-            # mcpp.toml at the released commit carries the right version.
-            VER=$(grep -m1 -E '^\s*version\s*=' mcpp.toml | sed -E 's/.*"([^"]+)".*/\1/')
-          fi
-          [ -n "$VER" ] || { echo "cannot resolve version"; exit 1; }
-          echo "version=$VER" >> "$GITHUB_OUTPUT"
-          echo ":: version $VER"
-
-      - name: Ping the tap
-        env:
-          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          VER: ${{ steps.resolve.outputs.version }}
-        run: |
-          set -eu
-          if [ -z "${TAP_TOKEN}" ]; then
-            echo "::notice::HOMEBREW_TAP_TOKEN is not configured; skipping the ping. mcpp-community/homebrew-mcpp bumps itself on a daily schedule, so ${VER} reaches the tap within 24h."
-            exit 0
-          fi
-          curl -fsS -X POST \
-            -H "Authorization: Bearer ${TAP_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/mcpp-community/homebrew-mcpp/dispatches \
-            -d "{\"event_type\":\"mcpp-release\",\"client_payload\":{\"version\":\"${VER}\"}}"
-          echo ":: dispatched mcpp-release ${VER} to mcpp-community/homebrew-mcpp"
-          echo "Pinged the Homebrew tap for **${VER}**." >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/measure-windows-tool-crt.yml b/.github/workflows/measure-windows-tool-crt.yml
deleted file mode 100644
index 713c28a4b..000000000
--- a/.github/workflows/measure-windows-tool-crt.yml
+++ /dev/null
@@ -1,247 +0,0 @@
-name: measure windows tool crt
-
-# The measurement of the 2026-09-28 ecosystem design, §2.9 (task M2), which
-# gates the removal of the MSVC C++ runtime from xim:qt-base (task I2).
-#
-# Qt's host tools (moc.exe; lrelease.exe, which loads Qt6Core.dll) are built
-# with MSVC and need its C++ runtime to start. Once the payload carries no copy,
-# the only copy they can reach is the one the engine puts first on the PATH of
-# every action of a build for a Windows target: the toolset's. The system
-# directory precedes PATH in the loader's search order, and every GitHub
-# Windows image has the VC++ redistributable there, so the system's copy is
-# hidden while the legs run; without that the first leg could not fail.
-#
-# Two rows. On `visual-studio` the toolset's runtime is the Visual Studio
-# redistributable. On `bare` Visual Studio is masked and the project names the
-# managed toolset `msvc@14.44.35207`, whose payload carries its own.
-#
-#   M-a  each tool, started from the CRT-free payload with no runtime
-#        reachable, fails to start: the measurement can fail.
-#   M-b  each tool, started by the candidate's recorded action edge, starts.
-#   M-c  (a reading) the same edge recorded by the released mcpp; expected to
-#        fail, as the state before the change.
-#
-# The legs run the recorded edge with ninja directly, after the build that
-# recorded it, so that nothing else (the xlings the engine resolves through,
-# for instance) has to start while the system's runtime is hidden.
-
-on:
-  pull_request:
-    branches: [ main ]
-    paths:
-      - '.github/workflows/measure-windows-tool-crt.yml'
-      - 'src/build/ninja_backend.cppm'
-      - 'src/build/runtime_placement.cppm'
-      - 'src/cli.cppm'
-  workflow_dispatch:
-
-concurrency:
-  group: measure-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  candidate:
-    name: candidate mcpp (windows x64)
-    runs-on: windows-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-      - name: Build the candidate from this commit
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" build
-          exe=$(find target -name mcpp.exe -path '*/bin/*' -printf '%T@ %p\n' | sort -rn | head -1 | cut -d' ' -f2-)
-          test -n "$exe" || { echo "::error::no mcpp.exe under target/"; exit 1; }
-          mkdir -p candidate
-          # The program and what the build placed beside it (its own C++
-          # runtime among them), so it starts while the system's copy is hidden.
-          cp "$(dirname "$exe")"/*.exe "$(dirname "$exe")"/*.dll candidate/ 2>/dev/null || cp "$exe" candidate/
-          ls candidate
-          candidate/mcpp.exe --version
-      - uses: actions/upload-artifact@v4
-        with:
-          name: measure-candidate
-          path: candidate
-
-  measure:
-    name: measure (${{ matrix.row }})
-    needs: candidate
-    runs-on: windows-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        row: [visual-studio, bare]
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/download-artifact@v4
-        with:
-          name: measure-candidate
-          path: candidate
-
-      # The same mask as ci-windows.yml's bare-Windows row — one action, so
-      # the two rows cannot drift apart — applied before anything touches
-      # Visual Studio.
-      - name: Mask Visual Studio
-        if: matrix.row == 'bare'
-        uses: ./.github/actions/mask-visual-studio
-
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - name: Install xim:qt-base 6.11.1 and remove its copy of the runtime
-        shell: bash
-        run: |
-          "$XLINGS_BIN" install qt-base@6.11.1 -y
-          QT="$(cygpath -u "$USERPROFILE")/.xlings/data/xpkgs/xim-x-qt-base/6.11.1"
-          test -x "$QT/bin/moc.exe" || { echo "::error::no moc.exe in $QT/bin"; exit 1; }
-          # What revision 1 of the recipe removes (task I2). The published
-          # revision 1 no longer carries them, and `ls` of absent files exits 2,
-          # which `bash -e` would read as a failed install.
-          ( cd "$QT/bin" && { ls vcruntime140*.dll msvcp140*.dll concrt140.dll vccorlib140.dll 2>/dev/null || true; }; \
-            rm -f vcruntime140*.dll msvcp140*.dll concrt140.dll vccorlib140.dll )
-          echo "QT=$QT" >> "$GITHUB_ENV"
-
-      - name: Record the tool edges with the candidate and with the released mcpp
-        shell: bash
-        run: |
-          CAND="$PWD/candidate/mcpp.exe"
-          QTW=$(cygpath -m "$QT")
-          # The state before this change is the last release. `$MCPP` is the
-          # bootstrap's shim for this repository's own pin, which refuses to
-          # run outside the repository, so the release is installed and called
-          # by its store path. From a neutral directory, so the repository's
-          # .xlings.json does not select a project scope.
-          ( cd "$RUNNER_TEMP" && "$XLINGS_BIN" install mcpp@2026.9.28.1 -y ) > "$RUNNER_TEMP/released-install.log" 2>&1 || true
-          REL="$(cygpath -u "$USERPROFILE")/.xlings/data/xpkgs/xim-x-mcpp/2026.9.28.1/bin/mcpp.exe"
-          toolchain=""
-          [ "${{ matrix.row }}" = bare ] && toolchain='[toolchain]
-          windows = "msvc@14.44.35207"'
-          for who in candidate released; do
-            d="$RUNNER_TEMP/probe-$who"
-            mkdir -p "$d/src"
-            printf 'int main() { return 0; }\n' > "$d/src/main.cpp"
-            printf 'class Probe : public QObject {\n    Q_OBJECT\n};\n' > "$d/probe.h"
-            printf '[package]\nname    = "probe"\nversion = "0.1.0"\n\n%s\n' "$toolchain" > "$d/mcpp.toml"
-            cat > "$d/build.mcpp" <<EOF
-          import std;
-          import mcpp;
-          int main() {
-              const std::string root = mcpp::manifest_dir();
-              const std::string out  = mcpp::out_dir();
-              mcpp::action moc;
-              moc.id   = "tool-moc";
-              moc.role = mcpp::roles::check;
-              moc.arg("$QTW/bin/moc.exe").arg((root + "/probe.h").c_str())
-                 .arg("-o").arg((out + "/moc-probe.txt").c_str())
-                 .input((root + "/probe.h").c_str())
-                 .output((out + "/moc-probe.txt").c_str())
-                 .submit();
-              mcpp::action lr;
-              lr.id   = "tool-lrelease";
-              lr.role = mcpp::roles::check;
-              lr.arg("$QTW/bin/lrelease.exe").arg("-version")
-                 .output((out + "/lrelease-probe.stamp").c_str())
-                 .submit();
-              return 0;
-          }
-          EOF
-            m="$CAND"; [ "$who" = released ] && m="$REL"
-            if ! ( cd "$d" && "$m" build ); then
-              if [ "$who" = candidate ]; then
-                echo "::error::the candidate's build of the probe failed with the system's runtime present"; exit 1
-              fi
-              echo "READING M-c: the released mcpp could not record the edge ($(tail -1 "$RUNNER_TEMP/released-install.log"))"
-              : > "$d/ninja-file"
-              continue
-            fi
-            grep -rl "moc.exe" "$d/target" --include=build.ninja | head -1 > "$d/ninja-file"
-            test -s "$d/ninja-file" || { echo "::error::no build.ninja records the moc edge ($who)"; exit 1; }
-            echo "--- $who: the moc edge"
-            grep -m1 "moc.exe" "$(cat "$d/ninja-file")"
-          done
-          NINJA=$(ls "$(cygpath -u "$USERPROFILE")"/.mcpp/registry/data/xpkgs/xim-x-ninja/*/ninja.exe 2>/dev/null | head -1)
-          test -x "$NINJA" || NINJA=$(command -v ninja || true)
-          test -x "$NINJA" || { echo "::error::no ninja.exe"; exit 1; }
-          echo "NINJA=$NINJA" >> "$GITHUB_ENV"
-
-      - name: Hide the system's C++ runtime
-        shell: pwsh
-        run: |
-          $names = 'vcruntime140.dll','vcruntime140_1.dll','vcruntime140_threads.dll',
-                   'msvcp140.dll','msvcp140_1.dll','msvcp140_2.dll','msvcp140_atomic_wait.dll',
-                   'msvcp140_codecvt_ids.dll','concrt140.dll','vccorlib140.dll'
-          foreach ($n in $names) {
-            $p = Join-Path $env:SystemRoot "System32\$n"
-            if (Test-Path $p) {
-              takeown /f $p | Out-Null
-              icacls $p /grant "Administrators:F" | Out-Null
-              Rename-Item -LiteralPath $p -NewName "$n.measure-hidden"
-              if (Test-Path $p) { Write-Host "FAIL: $p is still present"; exit 1 }
-              Write-Host "hidden: $p"
-            }
-          }
-
-      - name: "M-a: a tool with no runtime reachable does not start"
-        shell: bash
-        run: |
-          for tool in moc lrelease; do
-            if out=$(cd /c && PATH="/c/Windows/System32:/c/Windows" "$QT/bin/$tool.exe" -v 2>&1); then
-              echo "::error::$tool.exe started with no C++ runtime reachable; this measurement cannot fail: $out"
-              exit 1
-            fi
-            echo "ok: M-a $tool.exe does not start without a runtime"
-          done
-
-      # The recorded edges are run again with ninja directly: their outputs
-      # (the edge targets, absolute paths under target/.build-mcpp/out) are
-      # removed, so ninja runs exactly those two edges and nothing else.
-      - name: "M-b: the candidate's action edge starts each tool"
-        shell: bash
-        run: |
-          nf=$(cat "$RUNNER_TEMP/probe-candidate/ninja-file")
-          bd=$(dirname "$nf")
-          abs() { case "$1" in [A-Za-z]:*|/*) cygpath -u "$1" ;; *) echo "$bd/$1" ;; esac; }
-          # `-t targets all` prints `<target>: <rule>`, and a Windows target
-          # begins with a drive letter and its colon: the rule is cut at the
-          # LAST `: `, never at the first colon.
-          "$NINJA" -C "$bd" -t targets all | grep -E 'moc-probe.txt|lrelease-probe.stamp' | sed 's/: [^:]*$//' > "$RUNNER_TEMP/edges"
-          [ "$(wc -l < "$RUNNER_TEMP/edges")" -eq 2 ] || { cat "$RUNNER_TEMP/edges"; echo "::error::the graph does not hold the two tool edges"; exit 1; }
-          while IFS= read -r t; do rm -f "$(abs "$t")"; done < "$RUNNER_TEMP/edges"
-          echo "edges: $(tr '\n' ' ' < "$RUNNER_TEMP/edges")"
-          PATH="/usr/bin:/c/Windows/System32:/c/Windows" "$NINJA" -C "$bd" $(cat "$RUNNER_TEMP/edges")
-          moc_out=$(abs "$(grep 'moc-probe.txt' "$RUNNER_TEMP/edges")")
-          grep -q "Probe" "$moc_out" || { echo "::error::moc.exe ran but wrote no code for Probe ($moc_out)"; exit 1; }
-          lr_out=$(abs "$(grep 'lrelease-probe.stamp' "$RUNNER_TEMP/edges")")
-          test -f "$lr_out" || { echo "::error::the lrelease edge left no stamp ($lr_out)"; exit 1; }
-          echo "ok: M-b moc.exe and lrelease.exe start from the action's PATH (${{ matrix.row }})"
-
-      - name: "M-c (reading): the released mcpp's action edge"
-        shell: bash
-        run: |
-          nf=$(cat "$RUNNER_TEMP/probe-released/ninja-file")
-          [ -n "$nf" ] || { echo "READING M-c: not recorded (see the step above)"; exit 0; }
-          bd=$(dirname "$nf")
-          abs() { case "$1" in [A-Za-z]:*|/*) cygpath -u "$1" ;; *) echo "$bd/$1" ;; esac; }
-          "$NINJA" -C "$bd" -t targets all | grep -E 'moc-probe.txt|lrelease-probe.stamp' | sed 's/: [^:]*$//' > "$RUNNER_TEMP/edges-released"
-          while IFS= read -r t; do rm -f "$(abs "$t")"; done < "$RUNNER_TEMP/edges-released"
-          if PATH="/usr/bin:/c/Windows/System32:/c/Windows" "$NINJA" -C "$bd" $(cat "$RUNNER_TEMP/edges-released") > "$RUNNER_TEMP/released.log" 2>&1; then
-            echo "READING M-c: the released mcpp's edge started the tools (${{ matrix.row }})"
-          else
-            echo "READING M-c: the released mcpp's edge did not start the tools (${{ matrix.row }}):"
-            tail -5 "$RUNNER_TEMP/released.log"
-          fi
-
-      # In bash: Git Bash does not use the MSVC runtime, and pwsh may.
-      - name: Restore the system's C++ runtime
-        if: always()
-        shell: bash
-        run: |
-          for f in /c/Windows/System32/*.measure-hidden; do
-            [ -e "$f" ] && mv "$f" "${f%.measure-hidden}" && echo "restored: ${f%.measure-hidden}"
-          done
-          true
diff --git a/.github/workflows/openkal-cross.yml b/.github/workflows/openkal-cross.yml
deleted file mode 100644
index 827fb43c8..000000000
--- a/.github/workflows/openkal-cross.yml
+++ /dev/null
@@ -1,861 +0,0 @@
-name: openkal cross-build (4 hosts × 3 targets)
-
-# WHAT THIS WORKFLOW ASSERTS, AND WHY IT IS A MATRIX RATHER THAN A ROW.
-#
-# `cross-build-test.yml` verifies the crosses served by a PAYLOAD: a toolchain
-# whose driver has exactly one target. There the host and the target are joined
-# — `x86_64-w64-mingw32-g++` is the Windows cross and nothing else — so one row
-# per supported combination is the honest shape.
-#
-# openkal changes the shape of the question. The target side — the C library,
-# the C++ runtime, the platform's own implementation — is a set of PACKAGES in
-# the dependency graph, and the compiler is an ordinary retargetable clang. The
-# claim that follows is that N hosts × N targets collapses to N implementations
-# plus one tool: **the machine doing the building stops being a variable.**
-#
-# THAT IS A CLAIM, AND CLAIMS OF THIS SHAPE HAVE BEEN WRONG IN THIS
-# REPOSITORY. Reaching PE from a Linux host needed four separate repairs, and
-# adding the other two hosts found seven more — every one of them a decision
-# that had been keyed on which machine was building rather than on which machine
-# the output was for:
-#
-#   the link line's three host-shaped branches, only one of which carried
-#   `--target=`; the `std` module command's Windows branch, which dropped the
-#   package's own include paths; `cd X && …` not changing the drive in cmd.exe;
-#   the artefact-format test matching LLVM's `apple` rather than mcpp's `macos`;
-#   the C++ runtime contract naming a library to link when one was already in
-#   the objects; `-nostdinc` missing so a host SDK header could be found; and
-#   `-lgcc` naming GCC's runtime on a link whose compiler is clang.
-#
-# None of those was visible from one host. So the matrix is the test.
-#
-# ── The shape ──────────────────────────────────────────────────────────────
-#
-# FOUR build jobs, one per host, each producing two applications for THREE
-# targets — twenty-four binaries across twelve host/target cells.
-# THREE run jobs, one per system, each executing the artefact FOR that system
-# produced by ALL FOUR hosts, including native Linux ARM64.
-#
-#              Linux x86_64   Linux aarch64   macOS ARM64   Windows x86_64
-#   run Linux
-#   run macOS
-#   run Windows
-#
-# Three cells are native. The nine crosses include every output built on Linux
-# ARM64, and are what a single-host workflow cannot reach.
-#
-# A `revisions` JOB RUNS FIRST, before any of them, and resolves the index and
-# the runtime branches to one commit each. The four build jobs materialise
-# those commits, because "the four hosts built the same sources" — the claim
-# the run jobs assert — needs one revision to be about. Four independent
-# clones of a moving `main` are not that, and on 2026-10-13 they were not one
-# revision (run 38399400601). See the job.
-#
-# THE RUN JOBS INSTALL NOTHING — not mcpp, not a compiler, not a C runtime.
-# A program above openkal carries its C library, its C++ runtime and its
-# unwinder; what remains is the operating system it was built for. If a
-# toolchain step is ever added to one of them because "the program needs it",
-# that is the finding rather than the fix.
-#
-# AND THE ASSERTION IS ON THE OUTPUT, NOT THE EXIT STATUS. The original program
-# prints four lines, and `unwound: true` is the one a link cannot fake: it says a
-# destructor ran while an exception was being carried out of a frame, which
-# means the unwinder found this image's own frame descriptions.
-# The companion also requires its JSON and TLS/thread/concurrent unwind
-# success lines on each target system.
-
-on:
-  workflow_call:
-
-env:
-  # No mcpp or xlings version here. `bootstrap-mcpp` owns both, and a second
-  # statement of them is a second thing to keep in step — the pin check
-  # (.github/tools/check_version_pins.sh) enforces the ones that exist and would
-  # not know about a copy in this file.
-  XLINGS_NON_INTERACTIVE: '1'
-  # The branch of the openkal packages this change is verified against.
-  #
-  # IT WAS `feat/openkal-closure` UNTIL 2026-08-25, LONG AFTER THAT BRANCH
-  # MERGED. A fixed name here is a pin nobody is reminded to move: the comment
-  # said "when they are on `main` this becomes `main`" and the moment for that
-  # passed without anyone reading it again. Every run since was verifying this
-  # engine against a tree the ecosystem had left behind — and the two
-  # regressions found today both hid behind exactly this shape, a pin that
-  # keeps a check green by keeping it out of date.
-  #
-  # IT IS OVERRIDABLE FOR ONE RUN, AND THAT IS THE OTHER HALF OF A PROTOCOL
-  # THIS REPOSITORY ALREADY HAS ONE HALF OF. The ecosystem repositories build
-  # against an mcpp PR branch through `MCPP_SOURCE_REF`, so an engine change
-  # is measured against them before it merges. The reverse was hard-coded to
-  # `main`, which makes a change that REQUIRES a coordinated ecosystem commit
-  # unverifiable until after that commit lands --- and unmergeable until then,
-  # since this job is the one that fails.
-  #
-  # `__CYGWIN__`'s withdrawal is the case that showed it: this job builds
-  # `openkal-llvm-runtime@main`, whose installed header read only the borrowed
-  # name, so the engine's own CI reproduced the ordering constraint as a red
-  # cell. The constraint is real and the cell is correct --- the packages must
-  # publish first --- but verifying the engine BEFORE that publish needs this
-  # input. Left empty, nothing changes.
-  OPENKAL_BRANCH: ${{ github.event.inputs.openkal_ref || 'main' }}
-
-jobs:
-  # ── THE TWO REVISIONS EVERY HOST BUILDS AGAINST, RESOLVED ONCE ───────────
-  #
-  # FOUR JOBS CLONING ONE BRANCH ARE NOT FOUR COPIES OF ONE REVISION. The build
-  # matrix cloned `main` of the index and of the runtime of its own accord, on
-  # runners that become available at different moments — the macOS leg waits in
-  # a queue the others do not — and the `run` job below then asserted that all
-  # four had built the same sources.
-  #
-  # THAT ASSERTION WAS RIGHT AND IT WENT RED FOR A REASON NO HOST CAUSED. On
-  # 2026-10-13, run 38399400601, all three `run` jobs failed with
-  #
-  #     index sources differ
-  #
-  # — so the four hosts did record different revisions. The run started at
-  # 12:43 UTC and its build jobs at 12:52:08, 12:53:44, 12:58:20 and 13:01:33
-  # UTC, and they do not clone at the same point in their own step sequence —
-  # the macOS leg builds this commit's mcpp first — while mcpp-index@main took
-  # four commits inside that window: 21b9a77a at 12:56:12, d3a328c8 at 13:04:42,
-  # cfb808bc at 13:10:06, 0340de61 at 13:17:58. Two clones straddling one push
-  # is all it takes, and the reading arrives 40 minutes later, in a job that
-  # built nothing.
-  #
-  # THE ALTERNATIVE — pinning a SHA into this file — is the failure
-  # `OPENKAL_BRANCH` above is annotated with: a pin nobody is reminded to move,
-  # which keeps a check green by keeping it out of date. So the refs are
-  # resolved here, once, and every host materialises the commit named below.
-  # `OPENKAL_BRANCH` keeps its meaning: a run that overrides it still verifies
-  # exactly what it named, now as one commit rather than as whatever the branch
-  # had become when each runner woke up.
-  #
-  # The `run` job keeps its comparison. It is no longer a race against a moving
-  # branch; it is what proves each host used the pin rather than re-resolving
-  # for itself.
-  revisions:
-    name: the index and runtime revisions this run builds
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    outputs:
-      index: ${{ steps.resolve.outputs.index }}
-      runtime: ${{ steps.resolve.outputs.runtime }}
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Resolve both refs, once
-        id: resolve
-        run: |
-          set -euo pipefail
-          RETRY="$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh"
-          index=$("$RETRY" --rev main https://github.com/mcpp-community/mcpp-index)
-          runtime=$("$RETRY" --rev "$OPENKAL_BRANCH" \
-            https://github.com/mcpplibs/openkal-llvm-runtime)
-          # The `run` job's comparison already refuses a SHA that is not 40 hex;
-          # this refuses to PIN one, so a mis-resolution fails here, in 10
-          # seconds, rather than as four builds of four different trees.
-          for commit in "$index" "$runtime"; do
-            [[ "$commit" =~ ^[0-9a-f]{40}$ ]] \
-              || { echo "::error::not a commit: '$commit'"; exit 1; }
-          done
-          echo "mcpp-index@main is $index"
-          echo "openkal-llvm-runtime@$OPENKAL_BRANCH is $runtime"
-          echo "index=$index" >> "$GITHUB_OUTPUT"
-          echo "runtime=$runtime" >> "$GITHUB_OUTPUT"
-
-  build:
-    name: build 3 targets on ${{ matrix.host }}
-    needs: revisions
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { host: linux,         runner: ubuntu-24.04,     artifact: linux-x86_64   }
-          - { host: linux-aarch64, runner: ubuntu-24.04-arm, artifact: linux-aarch64  }
-          - { host: macos,         runner: macos-14,         artifact: macos-aarch64  }
-          - { host: windows,       runner: windows-2022,     artifact: windows-x86_64 }
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-
-      # THE REPOSITORY'S OWN BOOTSTRAP, NOT A SECOND ONE.
-      #
-      # This job first wrote its own: fetch xlings, then
-      # `xlings install mcpp@<version>`. It failed on the very first run:
-      #
-      #     xlings: version '2026.8.17.1' not found for 'mcpp'
-      #       available: 2026.8.19.4
-      #
-      # `.xlings.json` at this repository's root pins the mcpp that BUILDS mcpp,
-      # and that pin does not move when mcpp is released — so it names a version
-      # the index no longer carries, and a bare install inside the checkout
-      # obeys the pin rather than the argument. `bootstrap-mcpp` already knows
-      # this (it runs `install_pinned_mcpp.sh`), works on all four hosts, and
-      # shares the cache lineage every other job lands on.
-      #
-      # ⇒ Two bootstraps would be two things to keep correct, and the second one
-      # was wrong within a day of being written.
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      # THE mcpp UNDER TEST. Everything after this uses the binary this step
-      # produces; the bootstrapped one above is only what compiles it.
-      # This commit's mcpp: the one build.yml produced (use-built-mcpp, rule R1
-      # of the 2026-10-02 CI record), except on the macOS leg. That leg runs on
-      # macos-14 and the macOS artifact is built on macos-15; whether it runs on
-      # macos-14 is not measured (the record's Part VII), so the leg builds its
-      # own until it is.
-      - if: matrix.host != 'macos'
-        uses: ./.github/actions/use-built-mcpp
-        with:
-          host: ${{ matrix.artifact }}
-
-      - name: Name this commit's mcpp MCPP_UNDER_TEST
-        if: matrix.host != 'macos'
-        run: echo "MCPP_UNDER_TEST=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: Build the mcpp in this pull request
-        if: matrix.host == 'macos'  # ci-lint: allow-r1: the macOS leg builds its own mcpp until the artifact is measured on macos-14
-        run: |
-          set -euo pipefail
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$XLINGS_BIN" config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          # `--dev` and not `--release`. What is under test is a set of
-          # decisions about compile and link flags; an optimisation level
-          # changes none of them and a release self-build is most of the budget
-          # of a job on a two-core runner.
-          # REMOVE ANY mcpp ALREADY UNDER `target/` FIRST, so that after the
-          # build there is exactly ONE and it is the one this step produced.
-          #
-          # `target/` is a RESTORED CACHE whose key hashes `src/**`. A source
-          # change misses the key, `restore-keys` hands back the nearest older
-          # tree anyway — that is the point of the layered restore — and the
-          # build then writes its output into a NEW `<triple>/<fingerprint>/`
-          # directory beside the ones already there. `find … | head -1` returns
-          # whichever directory the walk reaches first, which is not the newest
-          # and is not this build's.
-          #
-          # MEASURED, LOCALLY AND ON CI. On this developer's own tree the
-          # command picks `007bc0f2b78f7fa5` while the build just wrote
-          # `148448dec6c4a7a7`. On CI it picked a stale binary whose ELF
-          # interpreter names a glibc payload the runner no longer has:
-          #
-          #     …/bin/mcpp: cannot execute: required file not found     (exit 127)
-          #
-          # — which reads as a broken build of THIS commit and is nothing of the
-          # kind. Two runs, same stale fingerprint, after seven green ones: the
-          # trigger is simply a source change large enough to leave two
-          # directories in the restored tree.
-          #
-          # mtime CANNOT BE THE CRITERION HERE. A cache restore writes every
-          # file at extraction time, so "newest" is meaningless on exactly the
-          # tree where this goes wrong — `ls -t | head -1` has picked a stale
-          # fingerprint in this repository before. Absence can't be faked:
-          # delete them, and whatever exists afterwards was linked just now.
-          #
-          # The objects and BMIs stay cached — this costs one link.
-          find target -type f \( -name 'mcpp' -o -name 'mcpp.exe' \) -delete 2>/dev/null || true
-          "$MCPP" build --dev
-          # EXACTLY ONE, not "at least one". Two would mean the delete above
-          # missed a tree and the ambiguity this step exists to remove is back.
-          #
-          # NO `mapfile`. This job also runs on macos, whose `/bin/bash` is
-          # 3.2 and has no such builtin — a bashism here would fail on one row
-          # of the matrix for a reason unrelated to what the row tests.
-          find target -type f \( -name 'mcpp' -o -name 'mcpp.exe' \) > /tmp/mcpp-built.txt
-          COUNT=$(wc -l < /tmp/mcpp-built.txt | tr -d ' ')
-          if [ "$COUNT" -ne 1 ]; then
-            echo "::error::expected exactly one built mcpp, found $COUNT"
-            sed 's/^/        /' /tmp/mcpp-built.txt
-            exit 1
-          fi
-          BUILT=$(cat /tmp/mcpp-built.txt)
-          BUILT=$(cd "$(dirname "$BUILT")" && pwd)/$(basename "$BUILT")
-          echo "MCPP_UNDER_TEST=$BUILT" >> "$GITHUB_ENV"
-          "$BUILT" --version
-
-      - name: Select the toolchain the openkal packages ask for
-        run: |
-          set -euo pipefail
-          # Install, then select. `toolchain default` names one and does not
-          # fetch it.
-          "$MCPP_UNDER_TEST" self config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP_UNDER_TEST" toolchain install llvm 23.1.3
-          "$MCPP_UNDER_TEST" toolchain default 'llvm@23.1.3'
-
-      # WHAT THIS RUNNER ACTUALLY PROVIDES FOR THE mingw TARGET. On a Windows
-      # host `openkal-windows`'s build program generates no import libraries
-      # ("the system's own are present"), so `-lntdll` and its neighbours are
-      # found by lld only where the host, the sandbox or the payload puts
-      # them. This job was green with one sandbox lineage and red with the
-      # next (2026-09-13, PR #629, same sources, same image), which is the
-      # signature of a dependency on cached state nobody declared. The lines
-      # below say where the libraries come from, so the next such reading is
-      # diagnosed from the log rather than from a bisect over caches.
-      - name: What this host provides for x86_64-w64-windows-gnu
-        if: matrix.host == 'windows'
-        run: |
-          echo "PATH=$PATH" | tr ':' '\n' | head -40
-          ls "${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs" 2>/dev/null || echo "(no xpkgs dir)"
-          CLANG=$(ls "${MCPP_HOME:-$HOME/.mcpp}"/registry/data/xpkgs/xim-x-llvm/23.1.3/bin/clang++.exe 2>/dev/null | head -1)
-          echo "clang=$CLANG"
-          [ -n "$CLANG" ] && "$CLANG" --target=x86_64-w64-windows-gnu -print-search-dirs
-          [ -n "$CLANG" ] && "$CLANG" --target=x86_64-w64-windows-gnu -print-file-name=libntdll.a
-          [ -n "$CLANG" ] && "$CLANG" --target=x86_64-w64-windows-gnu -print-file-name=libkernel32.a
-          command -v x86_64-w64-mingw32-gcc gcc 2>/dev/null || true
-
-      - name: The program — one source, three targets
-        env:
-          INDEX_SHA: ${{ needs.revisions.outputs.index }}
-          RUNTIME_SHA: ${{ needs.revisions.outputs.runtime }}
-        run: |
-          set -euo pipefail
-          # THE SEVENTH CALL SITE. `git_clone_retry.sh` was written because a
-          # runner's DNS hiccup is not a red build, and its own note counts
-          # "six call sites, one failure mode" — this workflow was not among
-          # them, and the mode duly arrived here. Measured on this job,
-          # 2026-08-25:
-          #
-          #     fatal: unable to access '…/openkal-llvm-runtime/':
-          #            Could not resolve host: github.com
-          #
-          # One name that did not resolve ended a 120-minute job in its first
-          # minute, beside a real failure it had nothing to do with.
-          #
-          # BOTH CLONES NOW NAME A COMMIT. `--depth 1 -b main` was four jobs
-          # describing a moving branch as one revision; see the `revisions` job
-          # for the run that paid for it.
-          "$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh" \
-            --commit "$RUNTIME_SHA" \
-            https://github.com/mcpplibs/openkal-llvm-runtime "$RUNNER_TEMP/okl"
-          "$GITHUB_WORKSPACE/.github/tools/git_clone_retry.sh" \
-            --commit "$INDEX_SHA" \
-            https://github.com/mcpp-community/mcpp-index "$RUNNER_TEMP/openkal-index"
-          export MCPP_OPENKAL_INDEX="$RUNNER_TEMP/openkal-index"
-          cd "$RUNNER_TEMP/okl/examples/same-source"
-          mkdir -p "$RUNNER_TEMP/out"
-          git -C "$RUNNER_TEMP/okl" rev-parse HEAD > "$RUNNER_TEMP/out/source-sha.txt"
-          git -C "$MCPP_OPENKAL_INDEX" rev-parse HEAD > "$RUNNER_TEMP/out/index-source-sha.txt"
-          echo "openkal-llvm-runtime source SHA: $(cat "$RUNNER_TEMP/out/source-sha.txt")"
-          python3 - "$GITHUB_WORKSPACE/tests/fixtures/openkal-hosted-threads/src/main.cpp.in" "$RUNNER_TEMP/out/threads-source-sha256.txt" <<'PYHASH'
-          import hashlib, pathlib, sys
-          pathlib.Path(sys.argv[2]).write_text(hashlib.sha256(pathlib.Path(sys.argv[1]).read_bytes()).hexdigest() + "\n")
-          PYHASH
-          BIN="${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-llvm/23.1.3/bin"
-          READOBJ="$BIN/llvm-readobj"
-          [ -x "$READOBJ" ] || READOBJ="$BIN/llvm-readobj.exe"
-          [ -x "$READOBJ" ] || { echo "::error::no llvm-readobj under $BIN"; exit 1; }
-          # The three HOSTED targets. Bare metal is verified by
-          # `openkal-llvm-runtime`'s own CI under qemu; it has no runner here to
-          # execute on, and a build-only cell in a workflow whose point is
-          # running would be the weaker claim.
-          for t in x86_64-linux-gnu aarch64-macos x86_64-windows-gnu; do
-            rm -rf target
-            # The upstream manifest may pin an older LLVM line. The invocation
-            # selects this candidate explicitly, including on the ARM64 host.
-            "$MCPP_UNDER_TEST" build --target "$t" --toolchain llvm@23.1.3
-            a=$(find target -type f \( -name 'openkal-same-source' -o -name 'openkal-same-source.exe' \) | head -1)
-            [ -n "$a" ] || { echo "::error::$t produced no artefact on ${{ matrix.host }}"; exit 1; }
-            case "$t" in
-              x86_64-windows-gnu) cp "$a" "$RUNNER_TEMP/out/windows.exe" ;;
-              aarch64-macos)      cp "$a" "$RUNNER_TEMP/out/macos"       ;;
-              *)                  cp "$a" "$RUNNER_TEMP/out/linux"       ;;
-            esac
-            "$READOBJ" --file-headers "$a" > "$RUNNER_TEMP/out/$t.headers.txt"
-            case "$t" in
-              aarch64-macos) arch=aarch64 ;;
-              *) arch=x86_64 ;;
-            esac
-            grep -q "Arch: $arch" "$RUNNER_TEMP/out/$t.headers.txt" \
-              || { echo "::error::$t emitted the wrong architecture"; cat "$RUNNER_TEMP/out/$t.headers.txt"; exit 1; }
-            echo "${{ matrix.host }} → $t : $(ls -l "$a" | awk '{print $5}') bytes"
-            cat "$RUNNER_TEMP/out/$t.headers.txt"
-            MCPP="$MCPP_UNDER_TEST" LLVM_TOOLCHAIN=llvm@23.1.3 \
-              bash "$GITHUB_WORKSPACE/.github/tools/check_openkal_hosted_threads.sh" \
-                "$RUNNER_TEMP/okl" "$t" "$RUNNER_TEMP/threads-binary.txt"
-            thread_bin=$(cat "$RUNNER_TEMP/threads-binary.txt")
-            case "$t" in
-              x86_64-windows-gnu) thread_output=windows-threads.exe ;;
-              aarch64-macos) thread_output=macos-threads ;;
-              *) thread_output=linux-threads ;;
-            esac
-            cp "$thread_bin" "$RUNNER_TEMP/out/$thread_output"
-            "$READOBJ" --file-headers "$thread_bin" > "$RUNNER_TEMP/out/$t.threads.headers.txt"
-            grep -q "Arch: $arch" "$RUNNER_TEMP/out/$t.threads.headers.txt"
-          done
-
-      # THE ONLY CRITERION THE `builtins` TOKEN HAS, AND WHY IT IS HERE.
-      #
-      # `[c-abi] builtins = "iso"` states that the C library supplies the ISO
-      # functions and no vendor extensions. On Darwin targets clang's loop
-      # idiom recogniser rewrites a constant-pattern fill into a call to
-      # `memset_pattern16`, an Apple libc extension no such library carries.
-      # That call is produced by the code generator, so it appears in no `-D`
-      # and in no preprocessor dump --- and `mcpp.toolchain.cenv` verifies its
-      # tokens by comparing a `-dM` dump. The token this mechanism emitted was
-      # therefore a silent no-op for the whole of its first life, and this
-      # step exists because no other kind of check could have reported it.
-      #
-      # LEG 1 IS THE DENOMINATOR, AND IT IS NOT DECORATION. At `-O0` the pass
-      # does not run, and `-ffreestanding` implies `-fno-builtin`; an
-      # assertion that only reads "the symbol is absent" therefore passes in
-      # several worlds where nothing was measured. Leg 1 compiles with no flag
-      # at all and fails if the symbol does NOT appear.
-      #
-      # LEG 2 PINS THE DEFECT ITSELF. `-fno-builtin-memset_pattern16` is
-      # accepted in silence and changes nothing: `-fno-builtin-<fn>` is matched
-      # against clang's builtin table, and `memset_pattern16` is an LLVM
-      # TargetLibraryInfo libfunc rather than a clang builtin. The toolchain is
-      # pinned in this job, so the reading is stable. Should a later pin make
-      # leg 2 fail, clang has gained the narrower behaviour, and `cenv` can
-      # emit the narrower flag and recover the 1.8 per cent `-fno-builtin`
-      # costs.
-      #
-      # LEG 3 IS THE ENGINE: the same idiom, over the openkal stack, for
-      # `aarch64-macos`, built by the mcpp under test. Measured on the token
-      # this step was written for, the two readings are
-      #
-      #     -fno-builtin-memset_pattern16   1 reference, and the link fails
-      #     -fno-builtin                    0 references, and it links
-      #
-      # so a regression here reports itself at the link before the assertion
-      # is reached. The assertion covers the remaining case, in which some
-      # layer happens to supply the symbol and the link succeeds anyway.
-      #
-      # `-O2` IS PER PACKAGE RATHER THAN `--release`. The idiom pass does not
-      # run at the dev profile's `-O0`, and a release build would compile the
-      # runtime a second time in a second profile for no reading.
-      - name: builtins = "iso" withdraws the Apple pattern fill
-        run: |
-          set -euo pipefail
-          BIN="${MCPP_HOME:-$HOME/.mcpp}/registry/data/xpkgs/xim-x-llvm/23.1.3/bin"
-          # Not `ls ... | head -1`: with `pipefail` the absent candidate's
-          # exit status ends the step before the guard below is reached.
-          pick() {  # $1..$n = candidate paths; prints the first executable one
-            for c in "$@"; do
-              if [ -x "$c" ]; then printf '%s' "$c"; return 0; fi
-            done
-            return 1
-          }
-          CLANG="$(pick "$BIN/clang" "$BIN/clang.exe")" \
-            || { echo "::error::no clang under $BIN"; exit 1; }
-          NM="$(pick "$BIN/llvm-nm" "$BIN/llvm-nm.exe")" \
-            || { echo "::error::no llvm-nm under $BIN"; exit 1; }
-
-          # Inside the clone, so the dependency is named by a relative path.
-          # `$RUNNER_TEMP` is a backslash path on the Windows host and a TOML
-          # string would read its separators as escapes.
-          W="$RUNNER_TEMP/okl/examples/builtins-probe"
-          rm -rf "$W"; mkdir -p "$W/src"
-
-          # The one shape the idiom recogniser rewrites. The element type is
-          # `int` and not `char` because a byte-repeating value becomes
-          # `memset`, which every C library has.
-          cat > "$W/src/main.cpp" <<'PROBE'
-          extern "C" void fill(int* a, long n) {
-              for (long i = 0; i < n; ++i) a[i] = 0x01020304;
-          }
-
-          int main() {
-              static int buf[64];
-              fill(buf, 64);
-              return buf[0] == 0x01020304 ? 0 : 1;
-          }
-          PROBE
-
-          cat > "$W/mcpp.toml" <<'PROJECT'
-          [package]
-          name    = "openkal-builtins-probe"
-          version = "0.1.0"
-
-          [build]
-          cxxflags = ["-O2"]
-
-          [dependencies]
-          openkal-llvm-runtime = { path = "../.." }
-
-          [toolchain]
-          default = "llvm@23.1.3"
-          PROJECT
-
-          # THE READER ASKS FOR UNDEFINED SYMBOLS, NOT FOR BYTES.
-          #
-          # This was `grep -ac memset_pattern16`, on the reasoning that the name
-          # is in the object's string table and a byte match needs no tool. It
-          # reads 1/0 correctly with GNU grep and read 0 for all three legs on
-          # the macOS host, where grep is BSD: the object is binary, and what
-          # `-a` promises about that differs between the two. Leg 1 is what
-          # reported it. `llvm-nm` is in the payload beside the clang already
-          # being used, and answers the question this step is actually asking.
-          refs() { "$NM" -u "$1" 2>/dev/null | grep -c memset_pattern16 || true; }
-          T=--target=arm64-apple-macos14.0
-
-          "$CLANG" $T -O2                                -c "$W/src/main.cpp" -o "$W/bare.o"
-          "$CLANG" $T -O2 -fno-builtin-memset_pattern16  -c "$W/src/main.cpp" -o "$W/narrow.o"
-          "$CLANG" $T -O2 -fno-builtin                   -c "$W/src/main.cpp" -o "$W/blunt.o"
-          echo "no flag                       : $(refs "$W/bare.o")"
-          echo "-fno-builtin-memset_pattern16 : $(refs "$W/narrow.o")"
-          echo "-fno-builtin                  : $(refs "$W/blunt.o")"
-
-          [ "$(refs "$W/bare.o")" = 1 ] || { echo "::error::leg 1: the probe no longer triggers the idiom, so legs 2 and 3 measure nothing"; exit 1; }
-          [ "$(refs "$W/narrow.o")" = 1 ] || { echo "::error::leg 2: clang now honours -fno-builtin-memset_pattern16, and mcpp.toolchain.cenv can emit the narrower token"; exit 1; }
-          [ "$(refs "$W/blunt.o")" = 0 ] || { echo "::error::leg 2: -fno-builtin no longer withdraws the pattern fill"; exit 1; }
-
-          (cd "$W" && "$MCPP_UNDER_TEST" build --target aarch64-macos)
-          obj=$(find "$W/target" -name 'main.o' | head -1)
-          [ -n "$obj" ] || { echo "::error::leg 3 produced no object to read"; exit 1; }
-          echo "engine, aarch64-macos over openkal: $(refs "$obj")"
-          [ "$(refs "$obj")" = 0 ] || { echo "::error::leg 3: builtins = \"iso\" did not withdraw memset_pattern16"; exit 1; }
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: openkal-built-on-${{ matrix.host }}
-          path: ${{ runner.temp }}/out/
-          if-no-files-found: error
-
-  run:
-    name: run 4 builds on ${{ matrix.system }}
-    needs: build
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { system: linux,   runner: ubuntu-24.04, file: linux       }
-          - { system: macos,   runner: macos-14,     file: macos       }
-          - { system: windows, runner: windows-2022, file: windows.exe }
-    defaults:
-      run:
-        shell: bash
-    steps:
-      # NO checkout AND NO toolchain. This job is the claim: a program built
-      # above openkal needs the operating system it was built for and nothing
-      # else. Anything installed here would weaken what a pass means.
-      - uses: actions/download-artifact@v4
-        with: { pattern: openkal-built-on-*, path: art }
-
-      - name: The same program, from all four build hosts
-        run: |
-          set -euo pipefail
-          fail=0
-          source_sha=""
-          threads_sha=""
-          index_sha=""
-          mkdir -p run-evidence
-          for host in linux linux-aarch64 macos windows; do
-            sha_file="art/openkal-built-on-$host/source-sha.txt"
-            if [ ! -f "$sha_file" ]; then
-              echo "::error::source SHA missing for $host"; fail=1; continue
-            fi
-            sha=$(tr -d '\r\n' < "$sha_file")
-            if ! [[ "$sha" =~ ^[0-9a-f]{40}$ ]]; then
-              echo "::error::invalid source SHA for $host: $sha"; fail=1; continue
-            fi
-            if [ -z "$source_sha" ]; then source_sha="$sha"; fi
-            if [ "$sha" != "$source_sha" ]; then
-              echo "::error::$host built source $sha, expected $source_sha"; fail=1; continue
-            fi
-            echo "openkal-llvm-runtime source SHA: $sha"
-            index_commit=$(tr -d '\r\n' < "art/openkal-built-on-$host/index-source-sha.txt")
-            [[ "$index_commit" =~ ^[0-9a-f]{40}$ ]] || { echo '::error::invalid index source SHA'; exit 1; }
-            if [ -z "$index_sha" ]; then index_sha="$index_commit"; fi
-            [ "$index_commit" = "$index_sha" ] || { echo '::error::index sources differ'; exit 1; }
-            probe_sha=$(tr -d '\r\n' < "art/openkal-built-on-$host/threads-source-sha256.txt")
-            [[ "$probe_sha" =~ ^[0-9a-f]{64}$ ]] || { echo '::error::invalid hosted probe digest'; exit 1; }
-            if [ -z "$threads_sha" ]; then threads_sha="$probe_sha"; fi
-            [ "$probe_sha" = "$threads_sha" ] || { echo '::error::hosted probe sources differ'; exit 1; }
-            bin="art/openkal-built-on-$host/${{ matrix.file }}"
-            echo "──────── built on $host, running on ${{ matrix.system }} ────────"
-            if [ ! -f "$bin" ]; then
-              echo "::error::$bin is missing"; fail=1; continue
-            fi
-            # The executable bit does not survive an artefact upload.
-            chmod +x "$bin" || true
-            # arm64 macOS refuses an unsigned image, so the signature is
-            # asserted before the run: a failure here is "the linker did not
-            # ad-hoc sign it", which is a different repair from "it crashed".
-            if [ "${{ matrix.system }}" = "macos" ]; then
-              codesign -dv "$bin" 2>&1 | grep -q 'adhoc\|Signature' \
-                || { echo "::error::built on $host: no code signature"; fail=1; continue; }
-            fi
-            if ! "./$bin" > out.log 2>&1; then
-              echo "::error::built on $host: it did not run"; cat out.log; fail=1; continue
-            fi
-            cat out.log
-            cp out.log "run-evidence/$host.same-source.log"
-            ok=1
-            grep -q 'sorted: 2 4 7' out.log || ok=0
-            grep -q 'caught: 42'    out.log || ok=0
-            # The line a link cannot fake.
-            grep -q 'unwound: true' out.log || ok=0
-            grep -q 'import std over openkal: ok' out.log || ok=0
-            [ "$ok" = 1 ] || { echo "::error::built on $host: wrong output"; fail=1; }
-            case "${{ matrix.system }}" in
-              windows) threads_file=windows-threads.exe ;;
-              *) threads_file="${{ matrix.system }}-threads" ;;
-            esac
-            threads_bin="art/openkal-built-on-$host/$threads_file"
-            chmod +x "$threads_bin"
-            if [ "${{ matrix.system }}" = macos ]; then
-              codesign -dv "$threads_bin" 2>&1 | grep -q 'adhoc\|Signature'
-            fi
-            "./$threads_bin" > "run-evidence/$host.threads.log" 2>&1
-            cat "run-evidence/$host.threads.log"
-            grep -qxF 'openkal hosted threads: isolation, destructors and concurrent unwind ok' "run-evidence/$host.threads.log"
-            grep -qxF 'openkal indexed JSON: dump, parse, literals and ordered_json ok' "run-evidence/$host.threads.log"
-          done
-          [ "$fail" = 0 ] || exit 1
-          echo "four builds, one system, identical sources, exceptions and hosted TLS/threads"
-
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: openkal-target-execution-${{ matrix.system }}
-          path: run-evidence/*.log
-          if-no-files-found: warn
-
-  # ──────────────────────────────────────────────────────────────────
-  # The e2e scripts that BUILD the openkal ecosystem, on a runner that
-  # has what they ask for.
-  #
-  # THEY WERE WRITTEN AND THEY WERE NEVER RUN. `285`–`289` declare
-  # `# requires: llvm`, and the linux e2e shards report
-  #
-  #     Detected capabilities: elf unix-shell fresh-sandbox gcc
-  #                            patchelf pack symlink python3 …
-  #
-  # — no `llvm`, on either shard, because the shard workflow never
-  # installs one. `run_all.sh` exits 0 on a skip, so the suite stayed
-  # green while the five tests measuring this ecosystem did not run.
-  #
-  # run_all.sh's own note says why no token can fix this: a hard-requires
-  # cannot tell "this runner is misconfigured" from "this platform
-  # legitimately lacks the capability". The guard has to know which
-  # runner it is, so it lives in the job — install the capability, then
-  # assert each script's PASS line actually appeared. Same shape as
-  # ci-linux-e2e.yml's `baremetal` job, for the same reason.
-  # ──────────────────────────────────────────────────────────────────
-  ecosystem-e2e:
-    name: openkal e2e (the scripts, on a runner that has llvm)
-    runs-on: ubuntu-24.04
-    timeout-minutes: 90
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-x86_64
-
-      - name: Name this commit's mcpp MCPP_UNDER_TEST
-        run: echo "MCPP_UNDER_TEST=$MCPP_FRESH" >> "$GITHUB_ENV"
-
-      - name: Install what the scripts declare
-        run: |
-          set -euo pipefail
-          "$MCPP_UNDER_TEST" self config --mirror GLOBAL 2>/dev/null || true
-          # Both, and both are load-bearing: 285 and 291's first half build
-          # with gcc (a backend running ON a platform, keeping the payload's
-          # C library), 286-289 and 291's second half with llvm (the whole
-          # stack from the graph, where openkal-llvm-runtime IS libc++).
-          "$MCPP_UNDER_TEST" toolchain install gcc 16.1.0
-          "$MCPP_UNDER_TEST" toolchain install llvm 23.1.3
-
-      # THE EMULATORS, OR TWO OF THE SIX MEASURE HALF OF WHAT THEY SAY.
-      #
-      # 287 and 288 both end by RUNNING what they built — an aarch64 binary and
-      # a riscv64 machine image — and both degrade to a SKIP when no emulator
-      # is here. Measured on this job's first run: 288 printed
-      #
-      #     SKIP  no riscv64 machine emulator here — linking is not booting
-      #
-      # and still reached its OK line, so the PASS-line assertion below would
-      # have called that covered. Linking is not booting, as the script itself
-      # says.
-      #
-      # BOTH homes, for the reason ci-linux-e2e.yml's baremetal job records:
-      # the shim on PATH dispatches against whichever home owns it, so an
-      # emulator installed only in the ambient one answers "not installed" when
-      # mcpp asks.
-      - name: Install the AArch64 user emulator with xlings
-        run: |
-          set -euo pipefail
-          "$XLINGS_BIN" install xim:qemu-user-aarch64@7.2.0 -g -y -u
-          XLINGS_HOME="${MCPP_HOME:-$HOME/.mcpp}/registry" \
-            "$XLINGS_BIN" install xim:qemu-user-aarch64@7.2.0 -g -y -u
-          qemu-aarch64-static --version
-
-      - name: Install the RISC-V system emulator with xlings
-        run: |
-          set -euo pipefail
-          "$XLINGS_BIN" install xim:qemu-riscv@9.2.4-1 -g -y -u
-          XLINGS_HOME="${MCPP_HOME:-$HOME/.mcpp}/registry" \
-            "$XLINGS_BIN" install xim:qemu-riscv@9.2.4-1 -g -y -u
-          qemu-system-riscv64 --version
-
-      - name: Install the separate host MinGW header fixture with xlings
-        run: |
-          set -euo pipefail
-          source tests/e2e/_toolchain_env.sh
-          # This store stays outside MCPP_HOME. Test 738 first proves that
-          # unrestricted Clang finds its headers through PATH, then proves
-          # that the graph-supplied C library closes that host search.
-          export XLINGS_HOME="$RUNNER_TEMP/openkal-host-mingw"
-          mkdir -p "$XLINGS_HOME"
-          cd "$XLINGS_HOME"
-          "$XLINGS_BIN" config --mirror GLOBAL
-          "$XLINGS_BIN" install "xim:mingw-cross-gcc@$MINGW_CROSS_VERSION" -g -y
-          host_root="$XLINGS_HOME/data/xpkgs/xim-x-mingw-cross-gcc/$MINGW_CROSS_VERSION"
-          test -f "$host_root/x86_64-w64-mingw32/include/io.h"
-          test -x "$host_root/bin/x86_64-w64-mingw32-gcc"
-          echo "MCPP_E2E_HOST_MINGW_ROOT=$host_root" >> "$GITHUB_ENV"
-
-      - name: The scripts
-        run: |
-          set -euo pipefail
-          export MCPP="$MCPP_UNDER_TEST"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          # Directly rather than through run_all.sh: it accepts no filter, and
-          # it exits 0 on a skip — which is the condition this job exists to
-          # detect.
-          fail=0
-          for t in tests/e2e/285_*.sh tests/e2e/286_*.sh tests/e2e/287_*.sh \
-                   tests/e2e/288_*.sh tests/e2e/289_*.sh tests/e2e/291_*.sh \
-                   tests/e2e/292_*.sh tests/e2e/293_*.sh tests/e2e/294_*.sh \
-                   tests/e2e/738_*.sh tests/e2e/778_*.sh tests/e2e/891_*.sh; do
-            echo "=== $t ==="
-            bash "$t" 2>&1 | tee "$(basename "$t").log" || true
-            rc=${PIPESTATUS[0]}
-            [ "$rc" = "0" ] || { echo "::error::$t failed (exit $rc)"; fail=1; }
-          done
-          [ "$fail" = 0 ] || exit 1
-
-      - name: Each one RAN
-        run: |
-          set -euo pipefail
-          # THE ASSERTION THIS JOB EXISTS FOR. A zero exit code cannot
-          # distinguish "passed" from "skipped" — every one of these scripts
-          # has an early `exit 0` for a capability or an arrangement it did
-          # not find. The PASS line can.
-          check() {
-            grep -qF "$2" "$1".log || {
-              echo "::error::$1 did not run to its conclusion on the runner that must run it"
-              tail -5 "$1".log 2>/dev/null | sed 's/^/        /'
-              return 1
-            }
-            echo "  ok  $1"
-          }
-          fail=0
-          check 285_kernel_abi_from_graph_keeps_the_payload_c_library.sh \
-            "OK: a graph-supplied kernel interface leaves the payload's C library reachable" || fail=1
-          check 286_the_openkal_stack_still_builds.sh \
-            "OK: the openkal stack builds, links statically and runs" || fail=1
-          check 287_the_openkal_stack_crosses_to_aarch64.sh \
-            "OK: the openkal stack crosses to aarch64, supplies its atomics helpers and runs" || fail=1
-          # AND IT REACHED THE PARTS THAT NEED A TOOL. Both of 287's last two
-          # assertions degrade to a SKIP, and the OK line prints either way.
-          check 287_the_openkal_stack_crosses_to_aarch64.sh \
-            "LSE instructions out of" || fail=1
-          check 287_the_openkal_stack_crosses_to_aarch64.sh \
-            "it runs under qemu-aarch64" || fail=1
-          check 288_the_openkal_stack_on_a_machine_with_no_os.sh \
-            "OK: openkal runs on a machine with no operating system and no C library" || fail=1
-          # 288's name says "runs"; without this it can print that line
-          # having only linked.
-          check 288_the_openkal_stack_on_a_machine_with_no_os.sh \
-            "it boots" || fail=1
-          check 289_one_host_reaches_every_openkal_target.sh \
-            "OK: one host reached" || fail=1
-          check 291_dynamic_linkage_is_refused_only_when_the_c_library_is_the_graphs.sh \
-            "OK: the C library decides whether 'dynamic' can be honoured" || fail=1
-          check 292_a_package_that_names_a_layer_does_not_lose_the_targets_compiler.sh \
-            "OK: naming a layer changes the system, not the compiler that emits the target" || fail=1
-          check 293_the_requested_target_and_the_resolved_one_name_one_os.sh \
-            "OK: the requested target and the resolved one name one operating system" || fail=1
-          check 294_the_list_answers_what_can_be_built_not_what_has_a_payload.sh \
-            "OK: the list answers what can be built, not what has a payload" || fail=1
-          check 738_a_graph_supplied_target_closes_the_hosts_own_search.sh \
-            "PASS: 738 a graph-supplied target closes the host's own search" || fail=1
-          check 738_a_graph_supplied_target_closes_the_hosts_own_search.sh \
-            "ok: unprotected clang finds the separate host MinGW headers" || fail=1
-          # mcpp#696, the link-side twin of 738: both legs, because the one
-          # that separates the engines is the refusal, and a skip of either
-          # prints the final line all the same.
-          check 778_a_graph_link_searches_no_host_directory.sh \
-            "ok: -lm is answered by openkal-musl's own archive, and the program runs" || fail=1
-          check 778_a_graph_link_searches_no_host_directory.sh \
-            "ok: an unanswered -lm fails, and the note names openkal-musl 0.19.2" || fail=1
-          check 778_a_graph_link_searches_no_host_directory.sh \
-            "ok: aarch64-linux-musl links -lm from the graph and runs under qemu-aarch64" || fail=1
-          check 778_a_graph_link_searches_no_host_directory.sh \
-            "ok: a host directory in ldflags is refused, by name" || fail=1
-          # LLVM 23.1.3 Part 3 (D2/D3): the payload's C library closes the
-          # host's /usr/include, a written -idirafter reopens it, and the
-          # graph note stays away from a payload C library on both paths.
-          check 891_a_host_header_is_written_not_searched.sh \
-            "PASS: 891 a host header is written down, not searched" || fail=1
-          [ "$fail" = 0 ] || exit 1
-
-
-  ecosystem-native-arm64:
-    name: openkal native stack (Linux ARM64, LLVM 23.1.3)
-    # The same index revision the build jobs pinned, not whatever `main` had
-    # become when this runner woke up; see the `revisions` job.
-    needs: revisions
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 45
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/bootstrap-mcpp
-      - uses: ./.github/actions/use-built-mcpp
-        with:
-          host: linux-aarch64
-
-      - uses: actions/checkout@v4
-        with:
-          repository: mcpp-community/mcpp-index
-          ref: ${{ needs.revisions.outputs.index }}
-          path: _openkal-native-index
-
-      - name: Native platform and graph stack
-        env:
-          MCPP_VENDORED_XLINGS: ${{ env.XLINGS_BIN }}
-          MCPP_E2E_EXPECT_ARCH: aarch64
-          MCPP_E2E_LLVM_VERSION: 23.1.3
-        run: |
-          set -euo pipefail
-          test "$(uname -m)" = aarch64
-          export MCPP="$MCPP_FRESH"
-          export MCPP_OPENKAL_INDEX="$GITHUB_WORKSPACE/_openkal-native-index"
-          git -C "$MCPP_OPENKAL_INDEX" rev-parse HEAD | tee native-openkal-index-sha.txt
-          "$MCPP" toolchain install llvm 23.1.3
-          # The existing test builds real openkal-musl and LLVM runtime packages,
-          # verifies every graph layer, checks static ELF closure and runs it.
-          bash tests/e2e/286_the_openkal_stack_still_builds.sh 2>&1 | tee native-openkal.log
-          grep -qF "ok  native aarch64 ELF" native-openkal.log
-          grep -qF "OK: the openkal stack builds, links statically and runs" native-openkal.log
-          grep -qxF 'openkal hosted threads: isolation, destructors and concurrent unwind ok' native-openkal.log
-          grep -qxF 'openkal indexed JSON: dump, parse, literals and ordered_json ok' native-openkal.log
-
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: openkal-native-arm64
-          path: |
-            native-openkal.log
-            native-openkal-index-sha.txt
-          if-no-files-found: warn
diff --git a/.github/workflows/probe-upgrade.yml b/.github/workflows/probe-upgrade.yml
new file mode 100644
index 000000000..14692f7bb
--- /dev/null
+++ b/.github/workflows/probe-upgrade.yml
@@ -0,0 +1,37 @@
+name: probe-upgrade-revision (temporary, do not merge)
+# TEMPORARY. Upgrades a home made by mcpp 2026.10.11.1 (xlings 2026.10.10.2)
+# to mcpp 2026.10.16.3 (xlings 2026.10.16.2) and records what `mcpp new &&
+# mcpp run` does. Every other workflow is removed on this branch.
+on:
+  pull_request:
+jobs:
+  upgrade:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { runner: ubuntu-24.04,     variant: plain }
+          - { runner: ubuntu-24.04,     variant: snapshot }
+          - { runner: ubuntu-24.04,     variant: stamp }
+          - { runner: ubuntu-24.04,     variant: orphan }
+          - { runner: ubuntu-24.04-arm, variant: plain }
+          - { runner: ubuntu-24.04-arm, variant: stamp }
+          - { runner: ubuntu-24.04-arm, variant: orphan }
+          - { runner: macos-15,         variant: plain }
+          - { runner: macos-15,         variant: stamp }
+          - { runner: windows-2025,     variant: plain }
+          - { runner: windows-2025,     variant: stamp }
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v4
+      - name: upgrade (${{ matrix.variant }})
+        shell: bash
+        run: bash .github/probe/upgrade.sh "${{ matrix.variant }}" 2>&1 | tee probe.log
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: upgrade-${{ matrix.runner }}-${{ matrix.variant }}
+          path: |
+            probe.log
+            probe-out/
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
deleted file mode 100644
index fd7d18ad3..000000000
--- a/.github/workflows/pypi-publish.yml
+++ /dev/null
@@ -1,200 +0,0 @@
-name: pypi-publish
-
-# Publish the `mcpp-bin` wheels to PyPI (`pip install mcpp-bin`).
-#
-# Downstream of `release`, like aur-publish.yml and homebrew-publish.yml: the
-# wheels are built from the release's own mcpp-release.json and payloads, so
-# this runs only once the release workflow has completed.
-#
-# CREDENTIALS: none stored. Publishing uses PyPI Trusted Publishing (OIDC):
-# PyPI trusts this repository + workflow file + the `pypi` environment, and
-# the job exchanges its GitHub OIDC token for a short-lived upload token.
-# One-time setup is in tools/pypi/README.md.
-#
-# ARMING: the automatic trigger builds, verifies and reports, and publishes
-# only when the repository variable PYPI_AUTOPUBLISH is `true`, for the reason
-# aur-publish.yml gives: an unattended push to a third-party service must be
-# armed by a human who has watched one publish succeed, not inherited from a
-# merge. `workflow_dispatch` carries its own explicit `publish` switch.
-
-on:
-  workflow_run:
-    workflows: [release]
-    types: [completed]
-  # Changes to the packaging itself build and pip-install the wheels of the
-  # latest release on every platform. A pull request never publishes.
-  pull_request:
-    paths:
-      - tools/pypi/**
-      - tests/scripts/test_pypi_wheels.py
-      - .github/workflows/pypi-publish.yml
-  workflow_dispatch:
-    inputs:
-      publish:
-        description: 'Upload to PyPI (false builds and verifies only)'
-        type: boolean
-        required: true
-        default: false
-      tag:
-        description: 'Release tag, e.g. v2026.9.21.3 (default: the latest release)'
-        type: string
-        required: false
-
-concurrency:
-  group: pypi-mcpp-bin
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: build wheels
-    if: >-
-      github.event_name != 'workflow_run' ||
-      github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    outputs:
-      version: ${{ steps.resolve.outputs.version }}
-      publish: ${{ steps.resolve.outputs.publish }}
-    env:
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Builder contract tests
-        run: python3 tests/scripts/test_pypi_wheels.py
-
-      - name: Resolve the release and whether to publish
-        id: resolve
-        env:
-          TRIGGER: ${{ github.event_name }}
-          INPUT_TAG: ${{ inputs.tag }}
-          MANUAL_PUBLISH: ${{ inputs.publish }}
-          AUTOPUBLISH: ${{ vars.PYPI_AUTOPUBLISH }}
-        run: |
-          set -euo pipefail
-          if [[ -n "${INPUT_TAG:-}" ]]; then
-            tag="$INPUT_TAG"
-          elif [[ "$TRIGGER" == "workflow_run" ]]; then
-            # The released commit's mcpp.toml carries the released version.
-            tag="v$(grep -m1 -E '^\s*version\s*=' mcpp.toml | sed -E 's/.*"([^"]+)".*/\1/')"
-          else
-            tag="$(gh release view -R "$GITHUB_REPOSITORY" --json tagName --jq .tagName)"
-          fi
-          version="${tag#v}"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-          # PyPI never accepts the same file twice, so an existing version is
-          # a finished job rather than something to retry.
-          code=$(curl -s -o /dev/null -w '%{http_code}' --retry 3 --retry-all-errors \
-                   "https://pypi.org/pypi/mcpp-bin/$version/json")
-          if [[ "$code" == "200" ]]; then
-            echo "::notice::mcpp-bin $version is already on PyPI; nothing to publish."
-            publish=false
-          elif [[ "$TRIGGER" == "workflow_run" ]]; then
-            if [[ "${AUTOPUBLISH:-}" == "true" ]]; then
-              publish=true
-            else
-              publish=false
-              echo "::notice::PYPI_AUTOPUBLISH is not set — building and verifying $tag without publishing."
-            fi
-          elif [[ "$TRIGGER" == "workflow_dispatch" ]]; then
-            publish="${MANUAL_PUBLISH:-false}"
-          else
-            publish=false
-          fi
-          echo "publish=$publish" >> "$GITHUB_OUTPUT"
-          echo "mcpp-bin $version from $tag; publish=$publish" >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Build wheels from the release manifest
-        run: python3 tools/pypi/build_wheels.py --tag "${{ steps.resolve.outputs.tag }}" --out dist
-
-      - name: Check metadata
-        run: |
-          python3 -m pip install --quiet twine
-          python3 -m twine check --strict dist/*.whl
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: mcpp-bin-wheels
-          path: dist/*.whl
-          if-no-files-found: error
-
-  # pip, not this workflow, picks the wheel: each runner installs from the
-  # directory of all four, so a wrong platform tag fails here rather than on a
-  # user's machine. The run then checks the two properties the launcher exists
-  # for: the per-user home is outside the Python environment, and the bundled
-  # xlings is the one seeded into it.
-  smoke:
-    name: pip install (${{ matrix.os }})
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-14, windows-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
-    steps:
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      - uses: actions/download-artifact@v4
-        with:
-          name: mcpp-bin-wheels
-          path: dist
-      - name: Install and run
-        shell: bash
-        env:
-          VERSION: ${{ needs.build.outputs.version }}
-        run: |
-          set -euo pipefail
-          python -m venv venv
-          if [[ -x venv/Scripts/python.exe ]]; then py=venv/Scripts/python.exe; bin=venv/Scripts; else py=venv/bin/python; bin=venv/bin; fi
-          "$py" -m pip install --quiet --no-index --find-links dist mcpp-bin
-          home="$RUNNER_TEMP/home"; mkdir -p "$home"
-          export HOME="$home" USERPROFILE="$home"
-          unset MCPP_HOME MCPP_VENDORED_XLINGS
-          out="$("$bin/mcpp" --version)"
-          echo "$out"
-          [[ "$out" == *"$VERSION"* ]] || { echo "::error::expected $VERSION, got: $out"; exit 1; }
-          "$bin/mcpp" self env | tee env.txt
-          grep -F "MCPP_HOME" env.txt | grep -F ".mcpp" \
-            || { echo "::error::MCPP_HOME is not the per-user home"; exit 1; }
-          if grep -F "MCPP_HOME" env.txt | grep -qF "site-packages"; then
-            echo "::error::MCPP_HOME resolved into the Python environment"; exit 1
-          fi
-          # On Windows mcpp runs the vendored xlings in place (src/config.cppm,
-          # make_xlings_env), so the seeded copy is checked on POSIX only.
-          if [[ "$RUNNER_OS" != "Windows" ]]; then
-            ls "$home/.mcpp/registry/bin/" | grep -q '^xlings' \
-              || { echo "::error::the bundled xlings was not seeded into the home"; exit 1; }
-          fi
-
-  publish:
-    name: publish to PyPI
-    needs: [build, smoke]
-    if: needs.build.outputs.publish == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    environment:
-      name: pypi
-      url: https://pypi.org/project/mcpp-bin/${{ needs.build.outputs.version }}/
-    permissions:
-      id-token: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: mcpp-bin-wheels
-          path: dist
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: dist/
diff --git a/.github/workflows/release-canaries.yml b/.github/workflows/release-canaries.yml
deleted file mode 100644
index 8593394ce..000000000
--- a/.github/workflows/release-canaries.yml
+++ /dev/null
@@ -1,101 +0,0 @@
-name: release canaries
-
-# Real projects built with the candidate mcpp before a release is tagged (the
-# 2026-09-28 ecosystem design, WS10). release.yml calls this workflow first and
-# its tag job needs it, so a canary that fails blocks the tag. It can also be
-# dispatched by hand against any branch, to read a candidate early.
-#
-# The list is .github/release-canaries.toml. Each canary job builds the
-# candidate from this commit, checks the project out, removes the project's own
-# mcpp pin in that checkout (nothing is committed to the project), and runs the
-# project's commands with `$MCPP` naming the candidate.
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-jobs:
-  list:
-    name: canaries (list)
-    runs-on: ubuntu-24.04
-    outputs:
-      matrix: ${{ steps.read.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: read
-        run: python3 .github/tools/release_canaries.py matrix >> "$GITHUB_OUTPUT"
-
-  canary:
-    name: canary ${{ matrix.name }} (${{ matrix.os }})
-    needs: list
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.list.outputs.matrix) }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: ${{ matrix.timeout }}
-    defaults:
-      run:
-        shell: bash
-    env:
-      XLINGS_NON_INTERACTIVE: '1'
-      PYTHONUTF8: '1'
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: ./.github/actions/bootstrap-mcpp
-
-      - name: Build the candidate mcpp from this commit
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$XLINGS_BIN" config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          "$MCPP" build
-          exe=mcpp
-          [ "$RUNNER_OS" = Windows ] && exe=mcpp.exe
-          candidate=$(find target -type f -name "$exe" -path '*/bin/*' | head -1)
-          test -n "$candidate" || { echo "::error::no candidate $exe under target/"; exit 1; }
-          candidate=$(cd "$(dirname "$candidate")" && pwd)/$(basename "$candidate")
-          cp "$candidate" "$RUNNER_TEMP/$exe"
-          echo "CANDIDATE=$RUNNER_TEMP/$exe" >> "$GITHUB_ENV"
-          "$RUNNER_TEMP/$exe" --version
-
-      - name: Check out ${{ matrix.repo }}@${{ matrix.ref }}
-        run: |
-          sub=""
-          [ "${{ matrix.submodules }}" = true ] && sub="--recurse-submodules --shallow-submodules"
-          git clone --depth 1 --branch "${{ matrix.ref }}" $sub \
-            "https://github.com/${{ matrix.repo }}" "$RUNNER_TEMP/canary"
-          # A Windows runner has `python`, not `python3`.
-          py=python3; command -v python3 >/dev/null 2>&1 || py=python
-          "$py" .github/tools/release_canaries.py unpin "$RUNNER_TEMP/canary"
-
-      - name: Restore the canary's caches
-        if: matrix.cache != ''
-        uses: actions/cache@v4
-        with:
-          path: ${{ matrix.cache }}
-          key: canary-${{ matrix.name }}-${{ runner.os }}-${{ github.run_id }}
-          restore-keys: canary-${{ matrix.name }}-${{ runner.os }}-
-
-      - name: Build ${{ matrix.name }} with the candidate
-        run: |
-          export MCPP="$CANDIDATE"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          # The project's commands do not see the name: mcpp has its xlings
-          # above, and a project may give XLINGS_BIN its own meaning. xlings'
-          # test kit reads it as the binary under test, so its tests drove the
-          # released xlings instead of the one they had just built (2026.10.11.1:
-          # test_subos_new_template read an instance.json the released xlings
-          # does not write).
-          unset XLINGS_BIN
-          # The bash running this step, by path (release_canaries.py says why).
-          if [ "$RUNNER_OS" = Windows ]; then
-            export CANARY_BASH="$(cygpath -w "$BASH")"
-          else
-            export CANARY_BASH="$BASH"
-          fi
-          "$MCPP" self config --mirror GLOBAL
-          tool="$GITHUB_WORKSPACE/.github/tools/release_canaries.py"
-          py=python3; command -v python3 >/dev/null 2>&1 || py=python
-          cd "$RUNNER_TEMP/canary"
-          "$py" "$tool" run "${{ matrix.name }}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index a723324dc..000000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,961 +0,0 @@
-name: release
-
-# Self-host release: bootstrap mcpp from xlings (xim:mcpp), build the
-# musl-static artefact via `mcpp pack --target x86_64-linux-musl -o ...`,
-# inject xlings into the produced tarball for install.sh consumers,
-# smoke-test, upload.
-
-on:
-  push:
-    tags: [ 'v*' ]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'tag to (re)build — leave blank to derive `v<version>` from mcpp.toml and create the tag automatically'
-        required: false
-
-jobs:
-  # A RELEASE IS GATED BY THE ECOSYSTEM'S OWN PROJECTS (the 2026-09-28 design,
-  # WS10): they are built with the candidate first
-  # (.github/release-canaries.toml), and the job that creates the tag needs
-  # them. A downstream project validates the release in its own pull request.
-  canaries:
-    uses: ./.github/workflows/release-canaries.yml
-
-  build-release:
-    name: build + upload (linux / x86_64)
-    needs: canaries
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write   # required to create releases + push tags
-    timeout-minutes: 60
-    env:
-      # mcpp resolves MCPP_HOME from the binary's location by default,
-      # but here we want to share toolchains with the bootstrap sandbox,
-      # so we pin to a known path.
-      MCPP_HOME: /home/runner/.mcpp
-    steps:
-      # fetch-depth: 0 instead of fetch-tags: true — actions/checkout@v4
-      # fails on push-tag triggers when both the ref'd tag and
-      # `fetch-tags: true` are set:
-      #   "Cannot fetch both <sha> and refs/tags/vX.Y.Z to refs/tags/vX.Y.Z"
-      # Full-history fetch covers the resolve-tag step's needs without
-      # that contention.
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Resolve target tag + commit
-        id: resolve
-        # Three trigger shapes converge here:
-        #   1. push: refs/tags/vX.Y.Z   → use that tag, build at its commit
-        #   2. workflow_dispatch with `tag` input set:
-        #        - tag exists on remote → check it out (rebuild scenario)
-        #        - tag doesn't exist    → use current HEAD; gh-release
-        #          creates the tag at that commit on upload
-        #   3. workflow_dispatch with no input → derive `v<version>` from
-        #      mcpp.toml's [package].version, build at current HEAD;
-        #      gh-release creates the tag.
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            TAG="${{ github.ref_name }}"
-          elif [ -n "${{ github.event.inputs.tag }}" ]; then
-            TAG="${{ github.event.inputs.tag }}"
-          else
-            VER=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-            test -n "$VER" || { echo 'failed to read [package].version from mcpp.toml'; exit 1; }
-            TAG="v$VER"
-          fi
-          echo "tag=$TAG"           >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}"   >> "$GITHUB_OUTPUT"
-          # If the tag exists on remote AND we're on workflow_dispatch,
-          # check it out so we rebuild that exact commit. push-tag runs
-          # already start at the tag commit.
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] \
-             && git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
-            git checkout --detach "refs/tags/$TAG"
-          fi
-          echo "Resolved tag: $TAG (commit $(git rev-parse --short HEAD))"
-
-      # Cache mcpp's sandbox: musl-gcc 15.1 + binutils + glibc + linux-headers
-      # + patchelf + ninja is ~800 MB on disk; without this every release
-      # rebuilds from cold install. Key on the workspace manifest so a
-      # toolchain change in mcpp.toml refreshes the cache.
-      - name: Cache mcpp sandbox
-        uses: actions/cache@v4
-        with:
-          path: ~/.mcpp
-          key: mcpp-sandbox-${{ runner.os }}-release-${{ hashFiles('mcpp.toml', '.xlings.json') }}
-          restore-keys: |
-            mcpp-sandbox-${{ runner.os }}-release-
-
-      # Cache xlings + xim:mcpp install.
-      - name: Cache xlings
-        uses: actions/cache@v4
-        with:
-          path: ~/.xlings
-          key: xlings-${{ runner.os }}-release-xl0462-${{ hashFiles('.xlings.json') }}
-          restore-keys: |
-            xlings-${{ runner.os }}-release-xl0462-
-
-      - name: Bootstrap mcpp via xlings
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-          # Pin xlings to a known-good version. The upstream install
-          # script always grabs `latest` (no version override), so we
-          # download + self-install manually to avoid broken releases.
-          XLINGS_VERSION: '2026.10.16.2'
-        run: |
-          # BY VERSION, NOT BY PRESENCE. A restored ~/.xlings holds the
-          # xlings of an earlier release, and this binary is the one the
-          # tarball bundles: 2026.10.10.1 shipped xlings 2026.10.8.1 on
-          # linux-x86_64 because one was present.
-          have=$("$HOME/.xlings/subos/default/bin/xlings" --version 2>/dev/null | awk '{print $2}')
-          if [ "$have" != "$XLINGS_VERSION" ]; then
-            tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
-            bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-              "https://github.com/openxlings/xlings/releases/download/v${XLINGS_VERSION}/${tarball}" \
-              "/tmp/${tarball}"
-            tar -xzf "/tmp/${tarball}" -C /tmp
-            "/tmp/xlings-${XLINGS_VERSION}-linux-x86_64/subos/default/bin/xlings" self install
-          fi
-          export PATH="$HOME/.xlings/subos/default/bin:$PATH"
-          xlings --version
-          test "$(xlings --version | awk '{print $2}')" = "$XLINGS_VERSION" || {
-            echo "::error::the xlings this release bundles is $(xlings --version), not $XLINGS_VERSION"; exit 1; }
-          # Pinned to .xlings.json — a bare `xlings install mcpp` resolves
-          # "newest in this runner's index copy" and put 0.0.105 (below the
-          # index floor) into this job. See .github/tools/install_pinned_mcpp.sh.
-          MCPP=$(bash "$GITHUB_WORKSPACE/.github/tools/install_pinned_mcpp.sh" "$GITHUB_WORKSPACE")
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-          echo "XLINGS_BIN=$HOME/.xlings/subos/default/bin/xlings" >> "$GITHUB_ENV"
-
-      - name: Build + pack release artefact (musl static)
-        id: stage
-        # Build for the musl-static target, strip the produced ELF, then
-        # let `mcpp pack` assemble the tarball (binary + top-level wrapper
-        # + README + LICENSE, contents at archive root). Inject xlings
-        # afterwards so install.sh consumers get a single self-contained
-        # bundle.
-        run: |
-          TAG="${{ steps.resolve.outputs.tag }}"
-          VERSION="${{ steps.resolve.outputs.version }}"
-          TARBALL_NAME="mcpp-${VERSION}-linux-x86_64.tar.gz"
-
-          # Build first so we can strip the ELF before pack copies it.
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          "$MCPP" build --target x86_64-linux-musl
-          ARTIFACT=$(find target/x86_64-linux-musl -type f -name mcpp | head -1)
-          test -n "$ARTIFACT"
-          file "$ARTIFACT" | grep -q 'statically linked'
-          # NB: stripping here is pointless — `mcpp pack` below rebuilds the
-          # binary and overwrites it, which is why every release up to and
-          # including 2026.7.28.2 shipped an UNSTRIPPED bin/mcpp despite the
-          # strip that used to live on this line. The payload is slimmed after
-          # packing instead, in the inject step below.
-
-          # Pack with the freshly-built mcpp (not the bootstrap) so any
-          # fixes to the pack code path are exercised in the same release
-          # they ship in. MCPP_HOME is forced so the new binary uses the
-          # pinned sandbox instead of resolving relative to its own
-          # location under target/.
-          MCPP_HOME="$MCPP_HOME" "$ARTIFACT" pack \
-              --target x86_64-linux-musl \
-              --mode static \
-              -o "${TARBALL_NAME}"
-
-          # Inject xlings: extract → add registry/bin/xlings to the wrapper
-          # dir → re-tar preserving the wrapper. Since 0.0.4 the bundled
-          # xlings lives at <ROOT>/registry/bin/xlings (= <XLINGS_HOME>/bin/xlings).
-          TARBALL="target/dist/${TARBALL_NAME}"
-          WRAPPER="${TARBALL_NAME%.tar.gz}"
-          test -f "$TARBALL"
-          INJECT=$(mktemp -d)
-          tar -xzf "$TARBALL" -C "$INJECT"
-          mkdir -p "$INJECT/$WRAPPER/registry/bin"
-          cp "$XLINGS_BIN" "$INJECT/$WRAPPER/registry/bin/xlings"
-          chmod +x "$INJECT/$WRAPPER/registry/bin/xlings"
-          # Slim AFTER pack (pack rebuilds bin/mcpp) and BEFORE tar. Asserts
-          # the result, so a strip that silently stops working fails the
-          # release instead of quietly shipping a 34.8MB tarball again.
-          bash .github/tools/slim_linux_payload.sh "$INJECT/$WRAPPER"
-          (cd "$INJECT" && tar -czf "$GITHUB_WORKSPACE/${TARBALL}" "$WRAPPER")
-          rm -rf "$INJECT"
-
-          # Stage final dist/ (tarball + sidecars) for upload.
-          mkdir -p dist
-          cp "$TARBALL" "dist/${TARBALL_NAME}"
-          (cd dist && cp "${TARBALL_NAME}" "mcpp-linux-x86_64.tar.gz")
-          (cd dist && sha256sum "${TARBALL_NAME}" "mcpp-linux-x86_64.tar.gz" > SHA256SUMS)
-          (cd dist && sha256sum "${TARBALL_NAME}" > "${TARBALL_NAME}.sha256")
-          (cd dist && sha256sum "mcpp-linux-x86_64.tar.gz" > "mcpp-linux-x86_64.tar.gz.sha256")
-
-          # Top-level install.sh — fetched by `curl | bash`.
-          cp install.sh dist/install.sh
-          chmod +x dist/install.sh
-
-          echo "tag=$TAG"           >> $GITHUB_OUTPUT
-          echo "version=$VERSION"   >> $GITHUB_OUTPUT
-          echo "tarball=${TARBALL_NAME}" >> $GITHUB_OUTPUT
-          ls -la dist/
-
-      - name: Smoke-test the bundled tarball
-        # Extract to a scratch dir and run mcpp from there with MCPP_HOME
-        # unset — proves the release artefact is genuinely self-contained.
-        run: |
-          VERSION="${{ steps.stage.outputs.version }}"
-          TARBALL_NAME="${{ steps.stage.outputs.tarball }}"
-          # Wrapper dir inside the tarball matches its stem (mcpp pack
-          # ties the two together).
-          WRAPPER="${TARBALL_NAME%.tar.gz}"
-          SMOKE=$(mktemp -d)
-          tar -xzf "dist/${TARBALL_NAME}" -C "$SMOKE"
-          ROOT="$SMOKE/$WRAPPER"
-          test -x "$ROOT/bin/mcpp"
-          test -x "$ROOT/registry/bin/xlings"
-          test -x "$ROOT/mcpp"
-          file "$ROOT/bin/mcpp" | grep -q 'statically linked'
-          env -u MCPP_HOME "$ROOT/bin/mcpp" --version
-          env -u MCPP_HOME "$ROOT/bin/mcpp" --help | head -10
-          # Top-level wrapper reports the same version we're shipping.
-          env -u MCPP_HOME "$ROOT/mcpp" --version | grep -q "$VERSION"
-          # MCPP_HOME should auto-resolve to the extracted root.
-          out=$(env -u MCPP_HOME "$ROOT/bin/mcpp" self env)
-          echo "$out" | grep -q "MCPP_HOME *= *$ROOT"
-
-      - name: Generate source tarball + xpkg.lua via mcpp publish
-        # Use the freshly-built mcpp to produce the source tarball + xpkg
-        # descriptor for mcpp-index. The release tarball wraps its
-        # contents in a `<tarball-stem>/` directory so the extract path
-        # is $PUB/$WRAPPER/bin/mcpp.
-        run: |
-          VERSION="${{ steps.stage.outputs.version }}"
-          TARBALL_NAME="${{ steps.stage.outputs.tarball }}"
-          WRAPPER="${TARBALL_NAME%.tar.gz}"
-          PUB=$(mktemp -d)
-          tar -xzf "dist/${TARBALL_NAME}" -C "$PUB"
-          MCPP_BIN="$PUB/$WRAPPER/bin/mcpp"
-          env -u MCPP_HOME "$MCPP_BIN" publish --dry-run --allow-dirty
-          test -f "target/dist/mcpp-${VERSION}.tar.gz"
-          test -f "target/dist/mcpp.lua"
-          cp "target/dist/mcpp-${VERSION}.tar.gz" dist/
-          cp "target/dist/mcpp.lua" dist/
-          ls -la dist/
-
-      - name: Extract release notes from CHANGELOG
-        id: notes
-        run: |
-          TAG="${{ steps.stage.outputs.tag }}"
-          VERSION="${{ steps.stage.outputs.version }}"
-          awk -v v="$VERSION" '
-            /^## \[/ {
-              if (in_section) exit
-              if ($0 ~ "\\[" v "\\]") { in_section=1; next }
-            }
-            in_section { print }
-          ' CHANGELOG.md > dist/RELEASE_NOTES.md || true
-          # A RELEASE IS OUTWARD-FACING AND PERMANENT: publishing one whose
-          # notes silently came out empty is not a lesser failure than any
-          # other defect this workflow guards against, and until now it
-          # produced none — v2026.9.18.1 went out with its notes body reading
-          # literally "(no CHANGELOG entry found for 2026.9.18.1)", because
-          # CHANGELOG.md had no matching `## [<version>]` heading and this
-          # step wrote a placeholder and moved on rather than stopping. Stop
-          # instead: no matching section is an authoring mistake (the
-          # section is missing, or its version string does not match what is
-          # being tagged), and the fix belongs in CHANGELOG.md before the
-          # release is retried, not in a release whose notes nobody reads.
-          if [ ! -s dist/RELEASE_NOTES.md ]; then
-            echo "::error::CHANGELOG.md has no '## [$VERSION]' section — refusing to publish a release with empty notes. Add that section (docs/92-release.md) and re-run, rather than let this placeholder ship: (no CHANGELOG entry found for $VERSION)"
-            exit 1
-          fi
-          echo "--- RELEASE_NOTES.md ---"
-          cat dist/RELEASE_NOTES.md
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.stage.outputs.tag }}
-          name: ${{ steps.stage.outputs.tag }}
-          body_path: dist/RELEASE_NOTES.md
-          draft: false
-          prerelease: false
-          files: |
-            dist/mcpp-${{ steps.stage.outputs.version }}-linux-x86_64.tar.gz
-            dist/mcpp-${{ steps.stage.outputs.version }}-linux-x86_64.tar.gz.sha256
-            dist/mcpp-linux-x86_64.tar.gz
-            dist/mcpp-linux-x86_64.tar.gz.sha256
-            dist/install.sh
-            dist/SHA256SUMS
-            dist/mcpp-${{ steps.stage.outputs.version }}.tar.gz
-            dist/mcpp.lua
-
-  build-linux-aarch64:
-    name: build (linux / aarch64, cross)
-    runs-on: ubuntu-24.04
-    needs: build-release
-    permissions:
-      contents: write
-    timeout-minutes: 70
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install system deps + qemu
-        run: |
-          # The runner image carries third-party apt lists (Google Chrome
-          # among them) that this job does not use, and a transient
-          # `Hash Sum mismatch` on one of them fails the whole update -- which
-          # killed two cross-build jobs in setup, before a single byte was
-          # compiled. Dropping the lists this job has no use for is what makes
-          # the step's failure mean something about this job.
-          #
-          # BY CONTENT, NOT BY FILENAME. The first attempt removed
-          # `google-chrome.list` and the update failed on the same URL: on
-          # ubuntu-24.04 the runner writes deb822 `.sources` files, so the
-          # name was a guess and the guess was wrong.
-          sudo grep -rlE 'dl[.]google[.]com|packages[.]microsoft[.]com' \
-               /etc/apt/sources.list.d/ 2>/dev/null | xargs -r sudo rm -f
-          sudo apt-get update -qq
-          sudo apt-get install -y curl git build-essential qemu-user-static
-          qemu-aarch64-static --version | head -1
-
-      - name: Resolve tag + version
-        id: resolve
-        run: |
-          VERSION=$(grep -E '^version' mcpp.toml | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "tag=v$VERSION"    >> "$GITHUB_OUTPUT"
-
-      - name: Bootstrap mcpp via xlings
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.10.16.2'
-        run: |
-          tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
-          bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-            "https://github.com/openxlings/xlings/releases/download/v${XLINGS_VERSION}/${tarball}" \
-            "/tmp/${tarball}"
-          tar -xzf "/tmp/${tarball}" -C /tmp
-          "/tmp/xlings-${XLINGS_VERSION}-linux-x86_64/subos/default/bin/xlings" self install
-          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
-          echo "$HOME/.xlings/bin"               >> "$GITHUB_PATH"
-          echo "XLINGS_BIN=$HOME/.xlings/subos/default/bin/xlings" >> "$GITHUB_ENV"
-
-      - name: Bootstrap mcpp + refresh index (latest, GLOBAL)
-        run: |
-          xlings config --mirror GLOBAL 2>/dev/null || true
-          xlings update -y 2>/dev/null || xlings update 2>/dev/null || true
-          MCPP=$(bash "$GITHUB_WORKSPACE/.github/tools/install_pinned_mcpp.sh" "$GITHUB_WORKSPACE")
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-          "$MCPP" --version
-
-      - name: Cross-build mcpp -> aarch64-linux-musl (this release's source)
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-          # "$MCPP", not a bare `mcpp`: the bare form runs the PATH shim, which
-          # resolves to whatever version xvm has selected — so pinning the
-          # bootstrap would have looked correct and changed nothing here.
-          "$MCPP" self config --mirror GLOBAL 2>/dev/null || true
-          # The published bootstrap mcpp predates aarch64 cross-build support
-          # (the feature landed after the last release), so it resolves the
-          # x86_64 host musl-gcc for an aarch64 target. Two-stage instead: build
-          # THIS release's x86_64 mcpp first, then cross-build aarch64 with it.
-          "$MCPP" build --target x86_64-linux-musl
-          FRESH=$(find target/x86_64-linux-musl -type f -name mcpp | head -1)
-          test -n "$FRESH"
-          "$FRESH" build --target aarch64-linux-musl
-          BIN=$(find target/aarch64-linux-musl -type f -name mcpp | head -1)
-          test -n "$BIN"
-          file "$BIN" | grep -q 'ARM aarch64'
-          file "$BIN" | grep -q 'statically linked'
-          echo "MCPP_AARCH64=$GITHUB_WORKSPACE/$BIN" >> "$GITHUB_ENV"
-
-      - name: Package aarch64 release (+ bundle aarch64 xlings)
-        id: stage
-        run: |
-          VERSION="${{ steps.resolve.outputs.version }}"
-          TARBALL_NAME="mcpp-${VERSION}-linux-aarch64.tar.gz"
-          WRAPPER="mcpp-${VERSION}-linux-aarch64"
-          STAGING=$(mktemp -d)
-          mkdir -p "$STAGING/$WRAPPER/bin"
-          cp "$MCPP_AARCH64" "$STAGING/$WRAPPER/bin/mcpp"
-          # The binary is aarch64, so the host x86_64 `strip` cannot touch it —
-          # resolve a cross-capable one. Required, not best-effort: the old
-          # `|| true` here meant a missing tool silently shipped a fat tarball.
-          # (slim_linux_payload.sh runs after xlings is staged, below.)
-          STRIP=$(find "$HOME/.mcpp" -name 'aarch64-linux-musl-strip' -type f 2>/dev/null | head -1)
-          [ -n "$STRIP" ] || STRIP=$(command -v llvm-strip 2>/dev/null || true)
-          [ -n "$STRIP" ] || STRIP=$(command -v aarch64-linux-gnu-strip 2>/dev/null || true)
-          [ -n "$STRIP" ] || { echo "no aarch64-capable strip found"; exit 1; }
-          echo "aarch64 strip: $STRIP"
-          cp LICENSE "$STAGING/$WRAPPER/" 2>/dev/null || true
-          cp README.md "$STAGING/$WRAPPER/" 2>/dev/null || true
-          cat > "$STAGING/$WRAPPER/mcpp" << 'LAUNCHER'
-          #!/bin/sh
-          exec "$(dirname "$0")/bin/mcpp" "$@"
-          LAUNCHER
-          chmod +x "$STAGING/$WRAPPER/mcpp"
-          # Bundle the aarch64 xlings so install.sh consumers on aarch64 get an
-          # aarch64 xlings, not the x86_64 bootstrap one. The three literals
-          # below are pinned to the same version as XLINGS_VERSION; they are
-          # NOT interpolated from it, so check_version_pins.sh scans for them
-          # explicitly (they were absent from the old lock-step comment).
-          XLA="xlings-2026.10.16.2-linux-aarch64.tar.gz"
-          # NOT fetch_release.sh: this asset is OPTIONAL and the `if` is the
-          # point — an arch with no prebuilt xlings must fall through quietly,
-          # while the helper retries a 404 five times before giving up. The one
-          # flag that matters here is --retry-all-errors: `curl: (52) Empty
-          # reply from server` is a transport error, so plain --retry does not
-          # cover it.
-          if curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors \
-               --connect-timeout 20 --max-time 600 -o "/tmp/$XLA" \
-               "https://github.com/openxlings/xlings/releases/download/v2026.10.16.2/$XLA"; then
-            tar -xzf "/tmp/$XLA" -C /tmp
-            XLBIN=$(find /tmp/xlings-2026.10.16.2-linux-aarch64 -path '*/bin/xlings' -type f | head -1)
-            if [ -n "$XLBIN" ]; then
-              mkdir -p "$STAGING/$WRAPPER/registry/bin"
-              cp "$XLBIN" "$STAGING/$WRAPPER/registry/bin/xlings"
-              chmod +x "$STAGING/$WRAPPER/registry/bin/xlings"
-            fi
-          fi
-          # Slim both shipped ELFs with the cross strip resolved above, and
-          # assert the result (the vendored xlings was 86.9MB unstripped here).
-          bash .github/tools/slim_linux_payload.sh "$STAGING/$WRAPPER" "$STRIP"
-          mkdir -p dist
-          (cd "$STAGING" && tar -czf "$GITHUB_WORKSPACE/dist/${TARBALL_NAME}" "$WRAPPER")
-          cp "dist/${TARBALL_NAME}" "dist/mcpp-linux-aarch64.tar.gz"
-          (cd dist && sha256sum "${TARBALL_NAME}"      > "${TARBALL_NAME}.sha256")
-          (cd dist && sha256sum "mcpp-linux-aarch64.tar.gz" > "mcpp-linux-aarch64.tar.gz.sha256")
-          echo "tarball=${TARBALL_NAME}" >> "$GITHUB_OUTPUT"
-          ls -la dist/
-
-      - name: Smoke-test the aarch64 tarball (qemu)
-        run: |
-          TARBALL_NAME="${{ steps.stage.outputs.tarball }}"
-          WRAPPER="${TARBALL_NAME%.tar.gz}"
-          SMOKE=$(mktemp -d)
-          tar -xzf "dist/${TARBALL_NAME}" -C "$SMOKE"
-          ver=$(qemu-aarch64-static "$SMOKE/$WRAPPER/bin/mcpp" --version)
-          echo "$ver"; echo "$ver" | grep -q 'mcpp'
-
-      - name: Upload aarch64 artifacts to release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.resolve.outputs.tag }}
-          files: |
-            dist/mcpp-${{ steps.resolve.outputs.version }}-linux-aarch64.tar.gz
-            dist/mcpp-${{ steps.resolve.outputs.version }}-linux-aarch64.tar.gz.sha256
-            dist/mcpp-linux-aarch64.tar.gz
-            dist/mcpp-linux-aarch64.tar.gz.sha256
-
-  build-macos:
-    name: build (macOS / ARM64)
-    runs-on: macos-15
-    needs: build-release
-    permissions:
-      contents: write
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Resolve tag
-        id: resolve
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            TAG="${{ github.ref_name }}"
-          elif [ -n "${{ github.event.inputs.tag }}" ]; then
-            TAG="${{ github.event.inputs.tag }}"
-          else
-            VER=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-            TAG="v$VER"
-          fi
-          echo "tag=$TAG"         >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] \
-             && git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
-            git checkout --detach "refs/tags/$TAG"
-          fi
-
-      - name: Cache xlings
-        uses: actions/cache@v4
-        with:
-          path: ~/.xlings
-          key: xlings-macos15-release-xl0462-${{ hashFiles('.xlings.json') }}
-          restore-keys: |
-            xlings-macos15-release-xl0462-
-
-      - name: Bootstrap mcpp via xlings
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.10.16.2'
-        run: |
-          # By version, not by presence (see the Linux job).
-          have=$("$HOME/.xlings/subos/default/bin/xlings" --version 2>/dev/null | awk '{print $2}')
-          if [ "$have" != "$XLINGS_VERSION" ]; then
-            WORK=$(mktemp -d)
-            tarball="xlings-${XLINGS_VERSION}-macosx-arm64.tar.gz"
-            bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-              "https://github.com/openxlings/xlings/releases/download/v${XLINGS_VERSION}/${tarball}" \
-              "${WORK}/${tarball}"
-            tar -xzf "${WORK}/${tarball}" -C "${WORK}"
-            "${WORK}/xlings-${XLINGS_VERSION}-macosx-arm64/subos/default/bin/xlings" self install
-          fi
-          export PATH="$HOME/.xlings/subos/default/bin:$PATH"
-          xlings --version
-          test "$(xlings --version | awk '{print $2}')" = "$XLINGS_VERSION" || {
-            echo "::error::the xlings this release bundles is $(xlings --version), not $XLINGS_VERSION"; exit 1; }
-          # Pinned to .xlings.json — a bare `xlings install mcpp` resolves
-          # "newest in this runner's index copy" and put 0.0.105 (below the
-          # index floor) into this job. See .github/tools/install_pinned_mcpp.sh.
-          MCPP=$(bash "$GITHUB_WORKSPACE/.github/tools/install_pinned_mcpp.sh" "$GITHUB_WORKSPACE")
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-          echo "XLINGS_BIN=$HOME/.xlings/subos/default/bin/xlings" >> "$GITHUB_ENV"
-
-      - name: Build mcpp from source (two-stage self-host)
-        env:
-          # macOS min-version support: target macOS 14 so the release runs
-          # on 14.0+ instead of only the runner's OS (the official LLVM
-          # static libc++ archives are built for macOS 14 — going lower
-          # needs a custom libc++ build, tracked as follow-up). Needs
-          # static LLVM libc++ — the system libc++ on older macOS lacks
-          # LLVM-20-era C++23 symbols (std::print's __is_posix_terminal
-          # etc.; minos-14 + dynamic libc++ dies at launch on macos-14 CI).
-          # See xlings .agents/docs/2026-06-05-macos-min-version-support.md.
-          MACOSX_DEPLOYMENT_TARGET: '14.0'
-        run: |
-          export PATH="$HOME/.xlings/subos/default/bin:$PATH"
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-
-          # Stage 1: the bootstrap mcpp builds this release's source. The
-          # bootstrap's macOS link path predates the staticStdlib
-          # implementation (hardcoded -lc++), so stage 1 links the system
-          # libc++ — fine, it only needs to RUN on this runner.
-          "$MCPP" build
-          STAGE1=$(find target -path "*/bin/mcpp" | head -1)
-          STAGE1=$(cd "$(dirname "$STAGE1")" && pwd)/$(basename "$STAGE1")
-          "$STAGE1" --version
-
-          # Stage 2: this release's mcpp rebuilds itself — flags.cppm's
-          # native staticStdlib link produces the static minos-14 binary.
-          # NOTE: stage 2 lands in a NEW fingerprint directory (its
-          # fingerprint includes the deployment target; the bootstrap's
-          # did not) — pick the most recently modified binary, not the
-          # first find hit.
-          "$STAGE1" build --no-cache
-          MCPP_BIN=$(ls -t $(find target -path "*/bin/mcpp" -type f) | head -1)
-          MCPP_BIN=$(cd "$(dirname "$MCPP_BIN")" && pwd)/$(basename "$MCPP_BIN")
-          test -x "$MCPP_BIN"
-          file "$MCPP_BIN"
-          otool -L "$MCPP_BIN"
-          echo "=== LC_BUILD_VERSION (must be minos 14.0) ==="
-          otool -l "$MCPP_BIN" | grep -A4 LC_BUILD_VERSION | head -6
-          otool -l "$MCPP_BIN" | grep -A4 LC_BUILD_VERSION | grep -q "minos 14.0" \
-            || { echo "FAIL: expected minos 14.0"; exit 1; }
-          if otool -L "$MCPP_BIN" | grep -q "libc++"; then
-            echo "FAIL: still linked against system libc++"; exit 1
-          fi
-          "$MCPP_BIN" --version
-          echo "MCPP_BIN=$MCPP_BIN" >> "$GITHUB_ENV"
-
-      - name: Package macOS release
-        id: stage
-        run: |
-          VERSION="${{ steps.resolve.outputs.version }}"
-          TARBALL_NAME="mcpp-${VERSION}-macosx-arm64.tar.gz"
-          WRAPPER="mcpp-${VERSION}-macosx-arm64"
-
-          # Create release layout
-          STAGING=$(mktemp -d)
-          mkdir -p "$STAGING/$WRAPPER/bin"
-          cp "$MCPP_BIN" "$STAGING/$WRAPPER/bin/mcpp"
-          # Strip (Mach-O)
-          strip "$STAGING/$WRAPPER/bin/mcpp" 2>/dev/null || true
-          # Copy metadata
-          cp LICENSE "$STAGING/$WRAPPER/" 2>/dev/null || true
-          cp README.md "$STAGING/$WRAPPER/" 2>/dev/null || true
-
-          # Shell launcher (same as Linux)
-          cat > "$STAGING/$WRAPPER/mcpp" << 'LAUNCHER'
-          #!/bin/sh
-          exec "$(dirname "$0")/bin/mcpp" "$@"
-          LAUNCHER
-          chmod +x "$STAGING/$WRAPPER/mcpp"
-
-          # Bundle xlings for install.sh consumers
-          XLINGS_BIN="$HOME/.xlings/subos/default/bin/xlings"
-          if [ -x "$XLINGS_BIN" ]; then
-            mkdir -p "$STAGING/$WRAPPER/registry/bin"
-            cp "$XLINGS_BIN" "$STAGING/$WRAPPER/registry/bin/xlings"
-            chmod +x "$STAGING/$WRAPPER/registry/bin/xlings"
-          fi
-
-          # Create tarball
-          mkdir -p dist
-          (cd "$STAGING" && tar -czf "$GITHUB_WORKSPACE/dist/${TARBALL_NAME}" "$WRAPPER")
-          # Versionless alias
-          cp "dist/${TARBALL_NAME}" "dist/mcpp-macosx-arm64.tar.gz"
-          # SHA256
-          (cd dist && shasum -a 256 "${TARBALL_NAME}" > "${TARBALL_NAME}.sha256")
-          (cd dist && shasum -a 256 "mcpp-macosx-arm64.tar.gz" > "mcpp-macosx-arm64.tar.gz.sha256")
-
-          echo "tarball=${TARBALL_NAME}" >> "$GITHUB_OUTPUT"
-          ls -la dist/
-
-      - name: Smoke-test the tarball
-        run: |
-          VERSION="${{ steps.resolve.outputs.version }}"
-          TARBALL_NAME="${{ steps.stage.outputs.tarball }}"
-          WRAPPER="${TARBALL_NAME%.tar.gz}"
-          SMOKE=$(mktemp -d)
-          tar -xzf "dist/${TARBALL_NAME}" -C "$SMOKE"
-          "$SMOKE/$WRAPPER/bin/mcpp" --version
-          "$SMOKE/$WRAPPER/mcpp" --version | grep -q "$VERSION"
-
-      - name: Upload macOS artifacts to release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.resolve.outputs.tag }}
-          files: |
-            dist/mcpp-${{ steps.resolve.outputs.version }}-macosx-arm64.tar.gz
-            dist/mcpp-${{ steps.resolve.outputs.version }}-macosx-arm64.tar.gz.sha256
-            dist/mcpp-macosx-arm64.tar.gz
-            dist/mcpp-macosx-arm64.tar.gz.sha256
-
-  build-windows:
-    name: build (Windows / x86_64)
-    runs-on: windows-latest
-    needs: build-release
-    permissions:
-      contents: write
-    timeout-minutes: 45
-    env:
-      MCPP_HOME: C:\Users\runneradmin\.mcpp
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Resolve tag
-        id: resolve
-        shell: bash
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            TAG="${{ github.ref_name }}"
-          elif [ -n "${{ github.event.inputs.tag }}" ]; then
-            TAG="${{ github.event.inputs.tag }}"
-          else
-            VER=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-            TAG="v$VER"
-          fi
-          echo "tag=$TAG"         >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] \
-             && git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
-            git checkout --detach "refs/tags/$TAG"
-          fi
-
-      - name: Cache mcpp sandbox
-        uses: actions/cache@v4
-        with:
-          path: ~\.mcpp
-          key: mcpp-sandbox-${{ runner.os }}-release-${{ hashFiles('mcpp.toml', '.xlings.json') }}
-          restore-keys: |
-            mcpp-sandbox-${{ runner.os }}-release-
-
-      - name: Cache xlings
-        uses: actions/cache@v4
-        with:
-          path: ~\.xlings
-          key: xlings-${{ runner.os }}-release-xl0462-${{ hashFiles('.xlings.json') }}
-          restore-keys: |
-            xlings-${{ runner.os }}-release-xl0462-
-
-      - name: Bootstrap mcpp via xlings
-        shell: bash
-        env:
-          XLINGS_NON_INTERACTIVE: '1'
-          XLINGS_VERSION: '2026.10.16.2'
-        run: |
-          # Captured before the `cd` below, in POSIX form: this step never
-          # returns to the workspace, and GITHUB_WORKSPACE is a backslash
-          # Windows path that git-bash tools mangle.
-          REPO_DIR="$(pwd)"
-          WORK=$(mktemp -d)
-          zipfile="xlings-${XLINGS_VERSION}-windows-x86_64.zip"
-          bash "$GITHUB_WORKSPACE/.github/tools/fetch_release.sh" \
-            "https://github.com/openxlings/xlings/releases/download/v${XLINGS_VERSION}/${zipfile}" \
-            "${WORK}/${zipfile}"
-          cd "${WORK}"
-          unzip -q "${zipfile}"
-          "$WORK/xlings-${XLINGS_VERSION}-windows-x86_64/subos/default/bin/xlings.exe" self install
-          export PATH="$USERPROFILE/.xlings/subos/default/bin:$PATH"
-          echo "$USERPROFILE/.xlings/subos/default/bin" >> "$GITHUB_PATH"
-          xlings.exe --version
-          test "$(xlings.exe --version | awk '{print $2}' | tr -d '\r')" = "$XLINGS_VERSION" || {
-            echo "::error::the xlings this release bundles is not $XLINGS_VERSION"; exit 1; }
-          # Pinned + version-scoped lookup. The old `find | head -1` returned
-          # whichever version the directory walk reached first.
-          MCPP=$(bash "$REPO_DIR/.github/tools/install_pinned_mcpp.sh" "$REPO_DIR")
-          echo "MCPP=$MCPP" >> "$GITHUB_ENV"
-          XLINGS_BIN=$(cygpath -w "$USERPROFILE/.xlings/subos/default/bin/xlings.exe")
-          echo "XLINGS_BIN=$XLINGS_BIN" >> "$GITHUB_ENV"
-          echo "XLINGS_BIN_UNIX=$USERPROFILE/.xlings/subos/default/bin/xlings.exe" >> "$GITHUB_ENV"
-          echo "XLINGS_XPKGS=$USERPROFILE/.xlings/data/xpkgs" >> "$GITHUB_ENV"
-
-      - name: Build mcpp from source (self-host)
-        shell: bash
-        run: |
-          export MCPP_VENDORED_XLINGS="$XLINGS_BIN"
-
-          "$MCPP" build
-          # Pick the NEWEST mcpp.exe, not an arbitrary one: `target/` is
-          # restored from cache and keeps a directory per build fingerprint,
-          # so after a version bump the freshly built binary sits alongside
-          # the previous release's. `find | head -1` returned whichever the
-          # directory walk hit first — which is how a 0.0.106 build ran the
-          # 0.0.105 binary and failed 01_help_and_version.
-          MCPP_BIN=$(find target -name "mcpp.exe" -path "*/bin/*" -printf "%T@ %p\n" \
-              | sort -rn | head -1 | cut -d" " -f2-)
-          test -n "$MCPP_BIN" || { echo "FAIL: no mcpp.exe in target/"; exit 1; }
-          MCPP_BIN=$(cd "$(dirname "$MCPP_BIN")" && pwd)/$(basename "$MCPP_BIN")
-          echo "Self-hosted binary: $MCPP_BIN"
-          "$MCPP_BIN" --version
-          echo "MCPP_BIN=$MCPP_BIN" >> "$GITHUB_ENV"
-
-      - name: Package Windows release zip
-        id: stage
-        shell: bash
-        run: |
-          VERSION="${{ steps.resolve.outputs.version }}"
-          WRAPPER="mcpp-${VERSION}-windows-x86_64"
-          ZIPNAME="${WRAPPER}.zip"
-
-          STAGING=$(mktemp -d)
-          mkdir -p "$STAGING/$WRAPPER/bin" "$STAGING/$WRAPPER/registry/bin"
-          cp "$MCPP_BIN" "$STAGING/$WRAPPER/bin/mcpp.exe"
-
-          # Windows batch launcher
-          printf '@echo off\r\n"%%~dp0bin\\mcpp.exe" %%*\r\n' > "$STAGING/$WRAPPER/mcpp.bat"
-          cp README.md "$STAGING/$WRAPPER/" 2>/dev/null || true
-          cp LICENSE   "$STAGING/$WRAPPER/" 2>/dev/null || true
-
-          # Bundle xlings.exe for install consumers
-          if [ -f "$XLINGS_BIN_UNIX" ]; then
-            cp "$XLINGS_BIN_UNIX" "$STAGING/$WRAPPER/registry/bin/xlings.exe"
-          fi
-
-          # Pack with 7z (available on windows-latest)
-          mkdir -p dist
-          (cd "$STAGING" && 7z a -tzip "$ZIPNAME" "$WRAPPER")
-          cp "$STAGING/$ZIPNAME" "dist/$ZIPNAME"
-          # Versionless alias
-          cp "dist/$ZIPNAME" "dist/mcpp-windows-x86_64.zip"
-          # SHA256
-          (cd dist && sha256sum "$ZIPNAME" > "$ZIPNAME.sha256")
-          (cd dist && sha256sum "mcpp-windows-x86_64.zip" > "mcpp-windows-x86_64.zip.sha256")
-
-          echo "zipname=$ZIPNAME" >> "$GITHUB_OUTPUT"
-          ls -la dist/
-
-      - name: Smoke-test the packaged zip
-        shell: bash
-        run: |
-          ZIPNAME="${{ steps.stage.outputs.zipname }}"
-          WRAPPER="${ZIPNAME%.zip}"
-          SMOKE=$(mktemp -d)
-          (cd "$SMOKE" && unzip -q "$GITHUB_WORKSPACE/dist/$ZIPNAME")
-          "$SMOKE/$WRAPPER/bin/mcpp.exe" --version
-          "$SMOKE/$WRAPPER/bin/mcpp.exe" --help | head -5
-          test -f "$SMOKE/$WRAPPER/registry/bin/xlings.exe"
-          test -f "$SMOKE/$WRAPPER/mcpp.bat"
-          echo "Smoke-test passed"
-
-      - name: Upload Windows artifacts to release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.resolve.outputs.tag }}
-          files: |
-            dist/mcpp-${{ steps.resolve.outputs.version }}-windows-x86_64.zip
-            dist/mcpp-${{ steps.resolve.outputs.version }}-windows-x86_64.zip.sha256
-            dist/mcpp-windows-x86_64.zip
-            dist/mcpp-windows-x86_64.zip.sha256
-
-  # Seal the complete, non-draft release inventory only after every platform
-  # uploader has finished.  The manifest is desired state for downstream
-  # reconcilers: a rerun may reproduce it byte-for-byte, but may never replace
-  # it with different bytes for the same tag.
-  release-manifest:
-    name: validate + seal release manifest
-    needs: [build-release, build-linux-aarch64, build-macos, build-windows]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-    timeout-minutes: 20
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Resolve immutable release identity
-        id: resolve
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            TAG="${{ github.ref_name }}"
-          elif [ -n "${{ github.event.inputs.tag }}" ]; then
-            TAG="${{ github.event.inputs.tag }}"
-          else
-            VERSION=$(awk -F '"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)
-            test -n "$VERSION" || { echo 'failed to read [package].version from mcpp.toml'; exit 1; }
-            TAG="v$VERSION"
-          fi
-          git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"
-          COMMIT=$(git rev-list -n 1 "refs/tags/$TAG")
-          test -n "$COMMIT"
-          echo "tag=$TAG"         >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-          echo "commit=$COMMIT"   >> "$GITHUB_OUTPUT"
-
-      - name: Generate, upload once, and refetch manifest
-        run: |
-          TAG="${{ steps.resolve.outputs.tag }}"
-          VERSION="${{ steps.resolve.outputs.version }}"
-          COMMIT="${{ steps.resolve.outputs.commit }}"
-          AUDIT_ROOT=$(mktemp -d)
-          mkdir -p "$AUDIT_ROOT/assets" "$AUDIT_ROOT/publish"
-
-          gh api "repos/${GITHUB_REPOSITORY}/releases/tags/$TAG" \
-            > "$AUDIT_ROOT/release.json"
-          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
-            --dir "$AUDIT_ROOT/assets"
-          python3 tools/release/generate_manifest.py \
-            --release-json "$AUDIT_ROOT/release.json" \
-            --assets-dir "$AUDIT_ROOT/assets" \
-            --version "$VERSION" \
-            --tag "$TAG" \
-            --commit "$COMMIT" \
-            --output "$AUDIT_ROOT/publish/mcpp-release.json"
-
-          if [ -f "$AUDIT_ROOT/assets/mcpp-release.json" ]; then
-            cmp "$AUDIT_ROOT/assets/mcpp-release.json" \
-                "$AUDIT_ROOT/publish/mcpp-release.json"
-            echo "Existing manifest is byte-identical; leaving it untouched."
-          else
-            gh release upload "$TAG" \
-              "$AUDIT_ROOT/publish/mcpp-release.json" \
-              --repo "$GITHUB_REPOSITORY"
-          fi
-
-          # Do not trust the upload command alone. Fetch the final public
-          # inventory into a clean directory, recompute every payload digest,
-          # regenerate desired state, and compare the published bytes.
-          MANIFEST_VISIBLE=false
-          for attempt in {1..12}; do
-            if gh api "repos/${GITHUB_REPOSITORY}/releases/tags/$TAG" \
-                 --jq '.assets[].name' | grep -Fxq mcpp-release.json; then
-              MANIFEST_VISIBLE=true
-              break
-            fi
-            echo "Waiting for mcpp-release.json API visibility ($attempt/12)"
-            sleep 5
-          done
-          test "$MANIFEST_VISIBLE" = true
-          mkdir -p "$AUDIT_ROOT/final-assets"
-          gh api "repos/${GITHUB_REPOSITORY}/releases/tags/$TAG" \
-            > "$AUDIT_ROOT/final-release.json"
-          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
-            --dir "$AUDIT_ROOT/final-assets"
-          test -f "$AUDIT_ROOT/final-assets/mcpp-release.json"
-          python3 tools/release/generate_manifest.py \
-            --release-json "$AUDIT_ROOT/final-release.json" \
-            --assets-dir "$AUDIT_ROOT/final-assets" \
-            --version "$VERSION" \
-            --tag "$TAG" \
-            --commit "$COMMIT" \
-            --output "$AUDIT_ROOT/final-expected.json"
-          cmp "$AUDIT_ROOT/final-assets/mcpp-release.json" \
-              "$AUDIT_ROOT/final-expected.json"
-          cat "$AUDIT_ROOT/final-assets/mcpp-release.json"
-
-  # Publish this release into the xlings ecosystem, after ALL platform builds
-  # have uploaded their assets and the immutable manifest gate has passed:
-  #   ① mirror binaries → xlings-res/mcpp (GitHub + GitCode) so XLINGS_RES
-  #      downloads resolve on every platform (incl. the CN/GitCode path);
-  #   ② open a PR against openxlings/xim-pkgindex bumping mcpp to this version
-  #      (a maintainer merges it — index git source is not on the critical path).
-  # These publication steps are required for ecosystem completeness: their
-  # failure leaves the GitHub Release object available but keeps this workflow
-  # red, so post-release verification cannot report a complete release.
-  # Shared vendored scripts live in .github/tools/ (kept in sync with xlings).
-  publish-ecosystem:
-    needs: release-manifest
-    runs-on: ubuntu-latest
-    # A4 hardening: a single stuck upload once held this job >1h (6h default
-    # ceiling). The mirror script has per-file timeouts and (post-0.0.89)
-    # batch-upload + ranged-GET verification — normal runs are minutes; 30
-    # is the generous backstop (20 was hit by the old per-asset verify loop).
-    timeout-minutes: 30
-    env:
-      XLINGS_RES_TOKEN: ${{ secrets.XLINGS_RES_TOKEN }}
-      GITCODE_TOKEN: ${{ secrets.GITCODE_TOKEN }}
-      XIM_PKGINDEX_TOKEN: ${{ secrets.XIM_PKGINDEX_TOKEN }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Determine version
-        id: version
-        run: echo "version=$(awk -F '\"' '/^version[[:space:]]*=/{print $2; exit}' mcpp.toml)" >> "$GITHUB_OUTPUT"
-
-      - name: Mirror binaries to xlings-res/mcpp (gh + gtc)
-        if: ${{ env.XLINGS_RES_TOKEN != '' }}
-        # THIS MUST BE LONGER THAN THE SCRIPT'S OWN LEG DEADLINE, AND FOR
-        # A LONG TIME IT WAS SHORTER.
-        #
-        # `mirror_res.sh` gives GitCode `MIRROR_LEG_DEADLINE_GTC=2400s` because
-        # that host shapes inbound traffic; this step killed it at 600s, so the
-        # script's budget could never be spent and the shorter of two
-        # disagreeing limits always won. Every release since has ended the same
-        # way — `The action … has timed out after 10 minutes`, GitHub's eight
-        # assets uploaded in seconds and GitCode's three large ones cut off,
-        # with only the small `.sha256` files through. v2026.8.25.1 and
-        # v2026.8.25.2 both, measured.
-        #
-        # The paragraph this replaces described a design that no longer
-        # exists: a per-asset `MIRROR_UPLOAD_TIMEOUT` of 180s. The script's own
-        # comment records why it went ("the old per-asset cap failed four
-        # releases in a row") — but this value, calibrated to it, stayed.
-        #
-        # 45 > 40 leaves the script room to reach its own deadline and report
-        # what it abandoned by name, which is the visibility the value exists
-        # for; the job's `timeout-minutes: 30` above is the outer backstop.
-        timeout-minutes: 45
-        env:
-          GH_TOKEN: ${{ secrets.XLINGS_RES_TOKEN }}
-        run: |
-          chmod +x .github/tools/gtc .github/tools/mirror_res.sh
-          export PATH="$PWD/.github/tools:$PATH"
-          # A4: BLOCKING. Both mirror hosts serve users (GLOBAL + CN install
-          # paths); an incomplete mirror must fail here, visibly, instead of
-          # surfacing as a 404 in the first user's install (or fresh-install CI).
-          bash .github/tools/mirror_res.sh mcpp "${{ steps.version.outputs.version }}"
-
-      - name: Open index bump PR (xim-pkgindex)
-        if: ${{ env.XIM_PKGINDEX_TOKEN != '' }}
-        env:
-          PKGINDEX_TOKEN: ${{ secrets.XIM_PKGINDEX_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          chmod +x .github/tools/bump_index.sh
-          # A4: BLOCKING — a missing bump PR means the index never learns the
-          # release exists and every post-release install of the new version 404s.
-          bash .github/tools/bump_index.sh mcpp "${{ steps.version.outputs.version }}"
-
-      # Post-release verification (ci-fresh-install) is triggered via its
-      # `workflow_run: [release]` hook — a platform-generated event that is
-      # exempt from GITHUB_TOKEN trigger suppression and needs no cross-repo
-      # PAT. (A PAT-based dispatch step lived here briefly; it never worked —
-      # XIM_PKGINDEX_TOKEN's resource owner is the index org and cannot cover
-      # this repository.)

From 8571449c0e0ac7877549f348a4412a2f5d26ef60 Mon Sep 17 00:00:00 2001
From: Sunrisepeak <speakshen@163.com>
Date: Sat, 17 Oct 2026 10:12:26 +0900
Subject: [PATCH 2/3] probe: record xlings self doctor before and after the
 upgrade

Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com>
---
 .github/probe/upgrade.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/probe/upgrade.sh b/.github/probe/upgrade.sh
index 41e55042d..820cca608 100644
--- a/.github/probe/upgrade.sh
+++ b/.github/probe/upgrade.sh
@@ -155,6 +155,9 @@ for path, key in ((os.path.join(reg, "data/versions.json"), "versions"), (os.pat
 PY
 fi
 
+section "xlings self doctor on the home before the upgrade (read-only)"
+(cd "$REG" && XLINGS_HOME="$REG" "$REG/bin/xlings$EXE" self doctor 2>&1 | grep -v '^\s*ok' | head -60) || true
+
 # ---------------------------------------------------------------- new release
 if [ "$VARIANT" = snapshot ]; then
   # the old index is still in place: does the new release use the old-revision
@@ -175,6 +178,8 @@ fi
 stamps after-new
 [ $IS_LINUX = 1 ] && llvm_facts after-new
 run new-doctor "$W" "$NEW" self doctor
+section "xlings self doctor after the upgrade (read-only)"
+(cd "$REG" && XLINGS_HOME="$REG" "$REG/bin/xlings$EXE" self doctor 2>&1 | grep -v '^\s*ok' | head -60) || true
 
 section "SUMMARY variant=$VARIANT platform=$PLAT"
 {

From c92346d17b4c6d9e8f7fedc4d9ad22174b7d51dc Mon Sep 17 00:00:00 2001
From: Sunrisepeak <speakshen@163.com>
Date: Sat, 17 Oct 2026 10:16:17 +0900
Subject: [PATCH 3/3] probe: the orphan is another package's active c++; doctor
 --fix, doctor in a project

Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com>
---
 .github/probe/upgrade.sh            | 37 +++++++++++++++++++++--------
 .github/workflows/probe-upgrade.yml | 10 +-------
 2 files changed, 28 insertions(+), 19 deletions(-)

diff --git a/.github/probe/upgrade.sh b/.github/probe/upgrade.sh
index 820cca608..57e9fb0ba 100644
--- a/.github/probe/upgrade.sh
+++ b/.github/probe/upgrade.sh
@@ -138,20 +138,31 @@ for f in glob.glob(os.path.join(sys.argv[1], "xim-x-*", "*", ".xpkg-install.json
 PY
 fi
 if [ "$VARIANT" = orphan ]; then
-  section "drop c++@<gcc version> from the version DB, keep the workspace"
+  section "make gcc's c++ the active one, then drop it from the version DB (the reported home)"
   "$PY" - "$REG" <<'PY'
 import json, os, sys
 reg = sys.argv[1]
-ws = json.load(open(os.path.join(reg, "subos/default/.xlings.json")))["workspace"]
-print("workspace c++:", ws.get("c++"))
-active = (ws.get("c++") or {}).get("active")
-for path, key in ((os.path.join(reg, "data/versions.json"), "versions"), (os.path.join(reg, ".xlings.json"), "versions")):
+wsf = os.path.join(reg, "subos/default/.xlings.json")
+wsdoc = json.load(open(wsf)); ws = wsdoc["workspace"]
+print("workspace c++ before:", ws.get("c++"))
+dbf = os.path.join(reg, "data/versions.json")
+src = json.load(open(dbf))["versions"] if os.path.exists(dbf) else json.load(open(os.path.join(reg, ".xlings.json")))["versions"]
+cxx = src.get("c++", {})
+owner = {k: (v.get("bindingGroup") or {}).get("provider") for k, v in cxx.get("versions", {}).items()}
+print("c++ versions and owners:", owner)
+gcc_keys = [k for k, p in owner.items() if p and "gcc" in p]
+if not gcc_keys:
+    print("no gcc-owned c++ version; nothing to do"); sys.exit(0)
+key = gcc_keys[0]
+ws["c++"]["active"] = key
+json.dump(wsdoc, open(wsf, "w"))
+for path in (dbf, os.path.join(reg, ".xlings.json")):
     if not os.path.exists(path): continue
-    doc = json.load(open(path)); db = doc.get(key, {})
-    cxx = db.get("c++", {})
-    gone = cxx.get("versions", {}).pop(active, None) is not None
-    for edges in cxx.get("bindings", {}).values(): edges.pop(active, None)
-    json.dump(doc, open(path, "w")); print(path, "dropped c++@%s:" % active, gone)
+    doc = json.load(open(path)); db = doc.get("versions", {}); c = db.get("c++", {})
+    gone = c.get("versions", {}).pop(key, None) is not None
+    for edges in c.get("bindings", {}).values(): edges.pop(key, None)
+    json.dump(doc, open(path, "w")); print(path, "dropped c++@%s:" % key, gone)
+print("workspace c++ after:", ws.get("c++"))
 PY
 fi
 
@@ -175,6 +186,12 @@ if [ $IS_LINUX = 1 ]; then
   run new-run1-gcc "$W/p-gcc" "$NEW" run
   run new-run2-gcc "$W/p-gcc" "$NEW" run
 fi
+run new-doctor-in-project "$W/p-new" "$NEW" self doctor
+if [ "$VARIANT" = orphan ]; then
+  section "xlings self doctor --fix (the existing repair)"
+  (cd "$REG" && XLINGS_HOME="$REG" "$REG/bin/xlings$EXE" self doctor --fix 2>&1 | tail -30) || true
+  run new-run-after-fix "$W/p-new" "$NEW" run
+fi
 stamps after-new
 [ $IS_LINUX = 1 ] && llvm_facts after-new
 run new-doctor "$W" "$NEW" self doctor
diff --git a/.github/workflows/probe-upgrade.yml b/.github/workflows/probe-upgrade.yml
index 14692f7bb..ec958e418 100644
--- a/.github/workflows/probe-upgrade.yml
+++ b/.github/workflows/probe-upgrade.yml
@@ -10,17 +10,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { runner: ubuntu-24.04,     variant: plain }
-          - { runner: ubuntu-24.04,     variant: snapshot }
-          - { runner: ubuntu-24.04,     variant: stamp }
           - { runner: ubuntu-24.04,     variant: orphan }
-          - { runner: ubuntu-24.04-arm, variant: plain }
-          - { runner: ubuntu-24.04-arm, variant: stamp }
           - { runner: ubuntu-24.04-arm, variant: orphan }
-          - { runner: macos-15,         variant: plain }
-          - { runner: macos-15,         variant: stamp }
-          - { runner: windows-2025,     variant: plain }
-          - { runner: windows-2025,     variant: stamp }
+          - { runner: ubuntu-24.04,     variant: snapshot }
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 75
     steps: