diff --git a/.github/workflows/tmp-brew-macos-probe.yml b/.github/workflows/tmp-brew-macos-probe.yml
new file mode 100644
index 00000000..417fdf18
--- /dev/null
+++ b/.github/workflows/tmp-brew-macos-probe.yml
@@ -0,0 +1,118 @@
+name: tmp-brew-macos-probe
+
+# TEMPORARY. Delete before merging.
+#
+# Round 2 found it. Homebrew 6.0.x gates third-party taps behind explicit
+# trust:
+#
+#   Refusing to load formula mcpp-community/mcpp/mcpp-m from untrusted tap
+#   mcpp-community/mcpp.
+#   Run `brew trust --formula …` or `brew trust mcpp-community/mcpp`.
+#
+# macos-14 / 15 / 26 all hit it (Homebrew 6.0.5 / 6.0.12 / 6.0.13). The
+# documented one-liner still passes because `brew install <user>/<repo>/<f>`
+# on an UNTAPPED repo taps and installs in one go, and Homebrew reads that as
+# explicit intent. Everything after the tap exists is refused.
+#
+# Round 3 answers the two questions that decide the fix:
+#   1. WHICH user-facing paths are actually broken (short form, re-running the
+#      documented command, `brew upgrade`, the alias)
+#   2. Does `brew trust <tap>` actually repair all of them — i.e. is the fix
+#      "document one command", or something more
+#
+# Exit codes are captured before any pipe. Round 1 reported `cmd | tail` and
+# read tail's status, which turned a failure into a green line.
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  brew-trust:
+    name: "trust gate ${{ matrix.os }}"
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-14, macos-26]
+    steps:
+      - name: Environment
+        run: |
+          echo "runner: ${{ matrix.os }} | macOS $(sw_vers -productVersion) | $(uname -m)"
+          brew --version | head -1
+          echo "── does this brew even have \`trust\`? ──"
+          brew trust --help 2>&1 | head -25 || echo "(no brew trust subcommand)"
+
+      # ① the documented one-liner on a machine that has never tapped
+      - name: "1. documented one-liner (untapped machine)"
+        run: |
+          set +e
+          brew install mcpp-community/mcpp/mcpp-m > s1.log 2>&1
+          echo "STEP1_rc=$?"
+          tail -5 s1.log
+
+      # ② the SAME documented command again, now that the tap exists. This is
+      #    what a user hits on their second machine-state, and what CI would
+      #    hit on a warm image.
+      - name: "2. documented one-liner AGAIN (tap now present)"
+        run: |
+          set +e
+          brew uninstall --force mcpp-m > /dev/null 2>&1
+          brew install mcpp-community/mcpp/mcpp-m > s2.log 2>&1
+          echo "STEP2_rc=$?"
+          tail -5 s2.log
+
+      # ③ the short form the tap README advertises once tapped
+      - name: "3. short form: brew install mcpp-m"
+        run: |
+          set +e
+          brew uninstall --force mcpp-m > /dev/null 2>&1
+          brew install mcpp-m > s3.log 2>&1
+          echo "STEP3_rc=$?"
+          tail -5 s3.log
+
+      # ④ the alias spelling (tap README line 30)
+      - name: "4. alias: brew install …/mcpp"
+        run: |
+          set +e
+          brew uninstall --force mcpp-m > /dev/null 2>&1
+          brew install mcpp-community/mcpp/mcpp > s4.log 2>&1
+          echo "STEP4_rc=$?"
+          tail -5 s4.log
+
+      # ⑤ THE FIX, if it is one. Everything below must pass after this.
+      - name: "5. brew trust mcpp-community/mcpp"
+        run: |
+          set +e
+          brew trust mcpp-community/mcpp > s5.log 2>&1
+          echo "STEP5_rc=$?"
+          cat s5.log
+
+      - name: "6. after trust: short form"
+        run: |
+          set +e
+          brew uninstall --force mcpp-m > /dev/null 2>&1
+          brew install mcpp-m > s6.log 2>&1
+          echo "STEP6_rc=$?"
+          tail -5 s6.log
+
+      - name: "7. after trust: alias"
+        run: |
+          set +e
+          brew uninstall --force mcpp-m > /dev/null 2>&1
+          brew install mcpp-community/mcpp/mcpp > s7.log 2>&1
+          echo "STEP7_rc=$?"
+          tail -5 s7.log
+
+      - name: "8. after trust: upgrade path + the binary still works"
+        run: |
+          set +e
+          brew upgrade mcpp-m > s8.log 2>&1
+          echo "STEP8_rc=$?"
+          tail -5 s8.log
+          mcpp --version; echo "VERSION_rc=$?"
+          cd "$(mktemp -d)" && mcpp new t > /dev/null 2>&1; echo "NEW_rc=$?"
+          cd t && mcpp run > s8run.log 2>&1; echo "RUN_rc=$?"
+          tail -6 s8run.log