diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b5fccf8..19dc9943 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
+        # `stable` installs a MINIMAL profile: rustc, cargo, rust-std and no
+        # more. Components have to be named. Without this line the Clippy step
+        # below dies on "'cargo-clippy' is not installed for the toolchain
+        # 'stable-aarch64-unknown-linux-gnu'" — which is not a lint result, it
+        # is the step never having run. The `fmt` job below always got this
+        # right; this one never did.
         uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
 
       - name: Cache Cargo registry and build
         uses: Swatinem/rust-cache@v2
@@ -69,6 +77,20 @@ jobs:
       - name: Run tests
         run: cargo test --workspace
 
+      # This step has never once executed on this codebase: the toolchain above
+      # shipped without the component, so every run died on "not installed"
+      # before clippy saw a line of source. Its result was never pass or fail,
+      # only unmeasured. With the component installed it becomes a real check,
+      # and the first honest thing it will report is that the workspace is not
+      # clean — the build already emits ~13 plain rustc warnings (unused
+      # imports, unused variables, needless `mut`, dead fields) that
+      # `-D warnings` promotes to errors, before clippy's own lints are counted.
+      #
+      # Left gating on purpose. A red check that measures something is worth
+      # more than a green one that measures nothing, and the alternative —
+      # `continue-on-error`, or dropping `-D warnings` — cannot tell "debt not
+      # yet paid" from "debt paid", which is the shape PROTOCOL.md forbids.
+      # The debt is scoped in #13, as the rustfmt debt is in #12.
       - name: Clippy
         run: cargo clippy --workspace -- -D warnings