diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 0000000..ae23d4d
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,58 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+    # The generated pages under docs/ are what a CLI change moves, and the
+    # `rust` job of CI fails until they are regenerated in the same commit, so
+    # a change that alters `--help` reaches this filter as a docs/ change.
+    paths:
+      - docs/**
+      - spec/**
+      - tools/gen_docs.py
+      - .github/workflows/docs.yml
+  # No path filter here: `docs` is a required status check, so it has to run on
+  # every pull request rather than only on the ones that touch the book.
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: actions/setup-python@v5
+      - run: cargo build --manifest-path rust/Cargo.toml --locked -p ocomment
+      # The site may not restate anything the binary or spec/ no longer says.
+      - run: python3 tools/gen_docs.py --check
+      - run: mdbook build docs
+      # `create-missing = false` in docs/book.toml makes the build above fail on
+      # a SUMMARY entry with no file behind it, so this only has to catch the
+      # opposite: a chapter that was written and never linked from SUMMARY.md.
+      - name: Every page under docs/ is in the book
+        run: |
+          set -euo pipefail
+          status=0
+          for page in docs/*.md; do
+            name=$(basename "$page")
+            if [ "$name" = "SUMMARY.md" ]; then continue; fi
+            if ! grep -q "($name)" docs/SUMMARY.md; then
+              echo "::error file=docs/SUMMARY.md::${name} is not listed in docs/SUMMARY.md"
+              status=1
+            fi
+          done
+          exit "$status"
diff --git a/.github/workflows/scratch.yml b/.github/workflows/scratch.yml
new file mode 100644
index 0000000..5d71918
--- /dev/null
+++ b/.github/workflows/scratch.yml
@@ -0,0 +1,18 @@
+name: Scratch
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d
+      - run: python3 --version