diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5e43dd0..dad6ad5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,42 +1,84 @@
 name: CI
 
+# THE BUILD TOOL IS NAMED HERE AND NOWHERE ELSE.
+#
+# This workflow used to install it through `.xlings.json', a workspace pin that
+# `actions/checkout' places in the working directory before anything else runs.
+# Two consequences followed and neither was visible in a passing log:
+#
+#   * every `mcpp' invocation in this repository resolved to the pinned version
+#     rather than to the one the job had installed, because that pin is read
+#     from the current directory;
+#   * the pin named 0.0.13, from 2026-05. The index no longer serves the
+#     toolchain packages a build tool of that age asks for, so `mcpp build'
+#     ended at `package 'xim:glibc@>=2.39' not found' before compiling a line.
+#
+# The pin file is removed. The version is an environment variable, so the two
+# places that need it, the install and the cache, cannot drift apart again.
+
 on:
   push:
     branches: [master]
   pull_request:
+  # A CANARY, BECAUSE THIS ROTTED WHERE NOTHING WOULD LOOK.
+  #
+  # The breakage above occurred between 2026-07-11 and 2026-08-29 and nothing
+  # reported it: master received no pushes in that window, so the first run to
+  # meet it was a contributor's pull request, whose author had no way to
+  # distinguish a broken environment from a broken change.
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+env:
+  MCPP_VERSION: 2026.8.29.1
+  XLINGS_VERSION: v2026.8.17.2
+  XLINGS_NON_INTERACTIVE: '1'
 
 jobs:
   build:
     name: build + test (linux x86_64, mcpp)
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
 
       - name: Install xlings
-        env:
-          XLINGS_VERSION: 0.4.31
         run: |
-          tarball="xlings-${XLINGS_VERSION}-linux-x86_64.tar.gz"
-          curl -fsSL -o "/tmp/${tarball}" \
-            "https://github.com/d2learn/xlings/releases/download/v${XLINGS_VERSION}/${tarball}"
-          tar -xzf "/tmp/${tarball}" -C /tmp
-          "/tmp/xlings-${XLINGS_VERSION}-linux-x86_64/subos/default/bin/xlings" self install
+          # --retry-all-errors and not --retry alone: the first covers a
+          # transient HTTP status and a timeout, and what this step actually
+          # meets is a failure of the transport. Observed in this ecosystem as
+          # `curl: (35) Recv failure: Connection reset by peer', thirteen
+          # seconds into a job, before anything was built.
+          curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 \
+            https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh \
+            | bash -s "$XLINGS_VERSION"
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
-      - name: Refresh package index
-        run: xlings update
-
-      - name: Install workspace tools (.xlings.json → mcpp 0.0.13)
-        run: xlings install -y
+      - name: Install mcpp
+        run: |
+          xlings update
+          xlings install "mcpp@$MCPP_VERSION" -y -g
+          # The version this job runs is the version it prints. A pin that is
+          # not read is the failure this file exists to stop repeating.
+          mcpp --version
+          # A runner outside China reaches the mirrors this names. The CN set is
+          # for a developer's machine and is slower or unreachable from here.
+          mcpp self config --mirror GLOBAL
 
+      # The toolchain mcpp bootstraps is decided by the version pinned above, so
+      # that version is the whole of the key.
       - name: Cache mcpp sandbox
         uses: actions/cache@v4
         with:
-          path: ~/.xlings/data/xpkgs/xim-x-mcpp/0.0.13/registry
-          key: mcpp-sandbox-${{ runner.os }}-mcpp0.0.13
+          path: ~/.xlings/data/xpkgs/xim-x-mcpp/${{ env.MCPP_VERSION }}/registry
+          key: mcpp-sandbox-${{ runner.os }}-mcpp${{ env.MCPP_VERSION }}
 
       - name: Build with mcpp
         run: mcpp build
 
+      # Six of these reach httpbin.org. They were here before this change and
+      # are left as they were. A network failure among them is distinguishable
+      # in the log by the endpoint it names.
       - name: Run tests
         run: mcpp test
diff --git a/.gitignore b/.gitignore
index 1a3902c..c2668b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@ build/
 .xmake/
 # mcpp build artefacts
 target/
+# mcpp writes this beside the manifest on every build
+compile_commands.json
diff --git a/.xlings.json b/.xlings.json
deleted file mode 100644
index 81146db..0000000
--- a/.xlings.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "workspace": {
-    "mcpp": "0.0.87"
-  }
-}
diff --git a/mcpp.lock b/mcpp.lock
index 07de937..9cba824 100644
--- a/mcpp.lock
+++ b/mcpp.lock
@@ -1,4 +1,8 @@
 # Auto-generated by mcpp. Do not edit by hand.
+# Records what this build resolved. It does not yet pin future builds:
+# index dependencies are re-resolved from their constraints each time.
+# dev-dependencies are excluded: only `mcpp test` resolves them, and this
+# file must not change depending on which command ran last.
 version = 2
 
 [package."compat.mbedtls"]