libexpr/static-analyzer: init

Change-Id: I606718fbe33db1f6c00ca34f45c6553ce468398c Signed-off-by: Raito Bezarius <raito@lix.systems>
libexpr: de-ptr-ize Value references
2025-11-21 17:36:35 +01:00 · 2025-09-28 00:02:21 +02:00 · 2025-09-28 00:02:21 +02:00 · 2025-09-28 00:02:21 +02:00 · 2025-09-28 00:02:21 +02:00 · 2025-09-28 00:02:21 +02:00
1586 changed files with 22750 additions and 46786 deletions
@@ -1,14 +0,0 @@
-[target.'cfg(true)']
-rustflags = [
-	# rustc will pass `-nodefaultlibs` without this, but we need the C++ standard library.
-	'-Cdefault-linker-libraries=yes',
-]
-
-[target.'cfg(target_env = "musl")']
-rustflags = [
-	'-Cdefault-linker-libraries=yes',
-	# musl, at least in Nixpkgs, is not compiled with -fPIE.
-	# XXX: nevermind? as of Nixpkgs 26.05??
-	# Oh gods do we need to gate this??
-	#'-Crelocation-model=static',
-]
@@ -4,10 +4,9 @@ AccessModifierOffset: -4
 AlignAfterOpenBracket: BlockIndent
 AlignEscapedNewlines: Left
 AlignOperands: DontAlign
-AlignTrailingComments: false
-AllowShortBlocksOnASingleLine: Empty
+AllowShortBlocksOnASingleLine: Always
 AllowShortFunctionsOnASingleLine: Empty
-AllowShortIfStatementsOnASingleLine: Never
+AllowShortIfStatementsOnASingleLine: WithoutElse
 AlwaysBreakBeforeMultilineStrings: true
 AlwaysBreakTemplateDeclarations: Yes
 BinPackArguments: false
@@ -36,7 +35,7 @@ BreakAfterAttributes: Always
 BreakBeforeBinaryOperators: NonAssignment
 BreakBeforeBraces: Custom
 BreakConstructorInitializers: BeforeComma
-ColumnLimit: 110
+ColumnLimit: 100
 EmptyLineAfterAccessModifier: Leave
 EmptyLineBeforeAccessModifier: Leave
 FixNamespaceComments: false
@@ -8,12 +8,16 @@ Checks:
  - -bugprone-narrowing-conversions
    # kind of nonsense
  - -bugprone-easily-swappable-parameters
+    # too many warnings for now
+  - -bugprone-implicit-widening-of-multiplication-result
    # Lix's exception handling is Questionable
  - -bugprone-empty-catch
    # many warnings
  - -bugprone-unchecked-optional-access
    # many warnings, seems like a questionable lint
  - -bugprone-branch-clone
+    # extremely noisy before clang 19: https://github.com/llvm/llvm-project/issues/93959
+  - -bugprone-multi-level-implicit-pointer-conversion
    # we don't compile out our asserts
  - -bugprone-assert-side-effect
    # FIXME(jade): figure out if this warning is any good
@@ -25,6 +29,9 @@ Checks:
    # crimes must be appropriately declared as crimes
  - cppcoreguidelines-pro-type-cstyle-cast
  - lix-*
+    # This can not yet be applied to Lix itself since we need to do source
+    # reorganization so that lix/ include paths work.
+  - -lix-fixincludes
    # This lint is included as an example, but the lib function it replaces is
    # already gone.
  - -lix-hasprefixsuffix
@@ -33,5 +40,3 @@ Checks:
 CheckOptions:
  bugprone-reserved-identifier.AllowedIdentifiers: '__asan_default_options'
  bugprone-unused-return-value.AllowCastToVoid: true
-
-ExtraArgs: ["-Werror=unnecessary-virtual-specifier"]
@@ -1,5 +1,4 @@
-/build
-/outputs
+outputs/

 # GNU Global
 GPATH
@@ -42,6 +41,3 @@ buildtime.bin
 *.pyc

 **/.idea
-
-# Yeah, I've got no clue.
-/subprojects/.wraplock
@@ -1,5 +1,2 @@
 Fiona Behrens <me@kloenk.dev>
 Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
-rootile <lix@rootile.de>
-rootile <lix@rootile.de> <commentator2.0@crystal-cavern.systems>
-rootile <lix@rootile.de> <lix@crystal-cavern.systems>
@@ -2,320 +2,18 @@
 # It is not intended for manual editing.
 version = 4

-[[package]]
-name = "aho-corasick"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "allocator-api2"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
-
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys",
-]
-
-[[package]]
-name = "ar_archive_writer"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4087686b4b0a3427190bae57a1d9a478dbb2d40c5dc1bd6e2b6d797913bdd348"
-dependencies = [
- "object",
-]
-
-[[package]]
-name = "ariadne"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72fe02fc62033df9ba41cba57ee19acf5e742511a140c7dbc3a873e19a19a1bd"
-dependencies = [
- "unicode-width 0.1.14",
- "yansi",
-]
-
-[[package]]
-name = "askama"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b79091df18a97caea757e28cd2d5fda49c6cd4bd01ddffd7ff01ace0c0ad2c28"
-dependencies = [
- "askama_derive",
- "askama_escape",
- "humansize",
- "num-traits",
- "percent-encoding",
-]
-
-[[package]]
-name = "askama_derive"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19fe8d6cb13c4714962c072ea496f3392015f0989b1a2847bb4b2d9effd71d83"
-dependencies = [
- "askama_parser",
- "basic-toml",
- "mime",
- "mime_guess",
- "proc-macro2",
- "quote",
- "serde",
- "syn",
-]
-
-[[package]]
-name = "askama_escape"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "619743e34b5ba4e9703bba34deac3427c72507c7159f5fd030aea8cac0cfe341"
-
-[[package]]
-name = "askama_parser"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acb1161c6b64d1c3d83108213c2a2533a342ac225aabd0bda218278c2ddb00c0"
-dependencies = [
- "nom",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "basic-toml"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba62675e8242a4c4e806d12f11d136e626e6c8361d6b829310732241652a178a"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bitflags"
-version = "2.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "cc"
-version = "1.2.65"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
-dependencies = [
- "find-msvc-tools",
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "chumsky"
-version = "1.0.0-alpha.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e82d74e6c83060ec269fe9e0d408d6de4a1645d525f9a0bbbb841ba4efd91ac"
-dependencies = [
- "hashbrown 0.15.5",
- "regex-automata 0.3.9",
- "serde",
- "stacker",
- "unicode-ident",
- "unicode-segmentation",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "clipboard-win"
-version = "5.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
-dependencies = [
- "error-code",
-]
-
-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
 [[package]]
 name = "countme"
 version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"

-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
 [[package]]
 name = "dissimilar"
 version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "59f8e79d1fbf76bdfbde321e902714bf6c49df88a7dda6fc682fc2979226962d"

-[[package]]
-name = "either"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
-
-[[package]]
-name = "endian-type"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "869b0adbda23651a9c5c0c3d270aac9fcb52e8622a8f2b17e57802d7791962f2"
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "error-code"
-version = "3.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
-
 [[package]]
 name = "expect-test"
 version = "1.5.0"
@@ -326,139 +24,12 @@ dependencies = [
 "once_cell",
 ]

-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"

-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "allocator-api2",
- "equivalent",
- "foldhash",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "home"
-version = "0.5.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "humansize"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb51c9a029ddc91b07a787f1d86b53ccfa49b0e86688c946ebe8d3555685dd7"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown 0.17.1",
-]
-
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
-[[package]]
-name = "itertools"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "licxxbridge"
-version = "0.0.0"
-dependencies = [
- "clap",
- "zngur",
-]
-
-[[package]]
-name = "lix"
-version = "0.0.0"
-dependencies = [
- "lix-doc",
- "pkg-config",
- "regex",
- "rootcause",
- "rustyline",
- "rustyline-derive",
- "zngur",
-]
-
 [[package]]
 name = "lix-doc"
 version = "0.0.1"
@@ -468,197 +39,12 @@ dependencies = [
 "rowan",
 ]

-[[package]]
-name = "log"
-version = "0.4.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
-
-[[package]]
-name = "memchr"
-version = "2.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
-
-[[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
-name = "mime_guess"
-version = "2.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
-dependencies = [
- "mime",
- "unicase",
-]
-
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "nibble_vec"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
-dependencies = [
- "smallvec",
-]
-
-[[package]]
-name = "nix"
-version = "0.31.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
-dependencies = [
- "bitflags",
- "cfg-if",
- "cfg_aliases",
- "libc",
-]
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "object"
-version = "0.37.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"

-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "psm"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645dbe486e346d9b5de3ef16ede18c26e6c70ad97418f4874b8b1889d6e761ea"
-dependencies = [
- "ar_archive_writer",
- "cc",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "radix_trie"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b4431027dcd37fc2a73ef740b5f233aa805897935b8bce0195e41bbf9a3289a"
-dependencies = [
- "endian-type",
- "nibble_vec",
-]
-
-[[package]]
-name = "regex"
-version = "1.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata 0.4.14",
- "regex-syntax 0.8.11",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59b23e92ee4318893fa3fe3e6fb365258efbfe6ac6ab30f090cdcbb7aa37efa9"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax 0.7.5",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax 0.8.11",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
-
 [[package]]
 name = "rnix"
 version = "0.12.0"
@@ -668,28 +54,6 @@ dependencies = [
 "rowan",
 ]

-[[package]]
-name = "rootcause"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b660d9968fae12f4e691f2b2be5d9a3a6de875300c682e8d2cb89a618dd60875"
-dependencies = [
- "hashbrown 0.17.1",
- "indexmap",
- "rootcause-internals",
- "rustc-hash 2.1.3",
- "triomphe",
-]
-
-[[package]]
-name = "rootcause-internals"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0184f6fcff3b58b7c963aee6e3cc915c04331aa6eef974f79d7d44d21e246c24"
-dependencies = [
- "triomphe",
-]
-
 [[package]]
 name = "rowan"
 version = "0.15.16"
@@ -697,8 +61,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0a542b0253fa46e632d27a1dc5cf7b930de4df8659dc6e720b647fc72147ae3d"
 dependencies = [
 "countme",
- "hashbrown 0.14.5",
- "rustc-hash 1.1.0",
+ "hashbrown",
+ "rustc-hash",
 "text-size",
 ]

@@ -708,250 +72,8 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"

-[[package]]
-name = "rustc-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
-
-[[package]]
-name = "rustyline"
-version = "18.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53f6a737db68eb1a8ccff86b584b2fc13eca6a7bb6f78ebc7c529547e3ab9684"
-dependencies = [
- "bitflags",
- "cfg-if",
- "clipboard-win",
- "home",
- "libc",
- "log",
- "memchr",
- "nix",
- "radix_trie",
- "unicode-segmentation",
- "unicode-width 0.2.2",
- "utf8parse",
- "windows-sys",
-]
-
-[[package]]
-name = "rustyline-derive"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64e5587417a3c4e16a4415e8d7d07f80998ed835ade621d19dfbe9fbe3205b0f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "smallvec"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
-
-[[package]]
-name = "stacker"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "640c8cdd92b6b12f5bcb1803ca3bbf5ab96e5e6b6b96b9ab77dabe9e880b3190"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "psm",
- "windows-sys",
-]
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "2.0.118"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
 [[package]]
 name = "text-size"
 version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
-
-[[package]]
-name = "triomphe"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b40688ea6389c8171614b25491f71d4a27946e0c7ce2da1c6de27e25abf1a0ae"
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "unicase"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "yansi"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
-
-[[package]]
-name = "zngur"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fc912d12934b4d04aabc52c14db6fc88ae8aa5a47902f27e8759c2de254723f"
-dependencies = [
- "zngur-generator",
-]
-
-[[package]]
-name = "zngur-def"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f27e49a62db537cea43a6c122ded7eda99c4ac0ca1d7cfd74f2bf6a6c88712d"
-dependencies = [
- "indexmap",
- "itertools",
-]
-
-[[package]]
-name = "zngur-generator"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ffad8c6994c477023aba7613bdf17c470003bbd191846d3096e84ffecf86d4c"
-dependencies = [
- "askama",
- "hex",
- "indexmap",
- "itertools",
- "sha2",
- "zngur-def",
- "zngur-parser",
-]
-
-[[package]]
-name = "zngur-parser"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d66c1b85ca6eab9576df5de31758cb1f9046b4ce47b25f45dabcb0fc7ef8789"
-dependencies = [
- "ariadne",
- "chumsky",
- "itertools",
- "zngur-def",
-]
@@ -1,28 +1,6 @@
 [workspace]
 resolver = "2"
-members = [
-	"lix/lix-doc",
-	"lix/lix-rs",
-	"tools/licxxbridge",
-]
+members = ["lix/lix-doc"]

 [workspace.package]
 edition = "2021"
-
-[workspace.dependencies]
-clap = "4"
-regex = "1.12.4"
-rootcause = "0.13.0"
-rustyline = "18"
-rustyline-derive = "0.12"
-syn = "2.0"
-zngur = "0.10"
-pkg-config = "0.3.33"
-
-[profile.dev]
-opt-level = 1
-
-[profile.release]
-debug = "full"
-debug-assertions = true
-overflow-checks = true
@@ -10,7 +10,6 @@ import platform
 import shlex
 import textwrap
 import dataclasses
-from pathlib import Path

 flake_args = ["--extra-experimental-features", "nix-command flakes"]
 cases = {
@@ -19,7 +18,7 @@ cases = {
        *flake_args,
        "search",
        "--no-eval-cache",
-        f"path:{Path('./bench/nixpkgs/').readlink()}",
+        "github:nixos/nixpkgs/e1fa12d4f6c6fe19ccb59cac54b5b3f25e160870",
        "hello",
    ],
    "rebuild": lambda build: [
@@ -1,13 +0,0 @@
-plugin_mtls_store = shared_module(
-  'plugin_mtls_store',
-  'plugin_mtls_store.cc',
-  # don't link liblix* into plugins (host process provides them at runtime).
-  # Explicitly link curl so it binds to Nix-store libcurl, not /usr/lib/libcurl.
-  dependencies : [
-    liblix.partial_dependency(includes : true, compile_args : true),
-    curl,
-  ],
-  install : false,
-  build_by_default : true,
-  link_args : plugin_link_args,
-)
@@ -1,14 +0,0 @@
-R"(
-
-**Store URL format**: `https+mtls://...`
-
-This store allows a binary cache to be accessed via HTTPS with mutual TLS (client certificate authentication).
-
-Both parameters are required:
-
- `tls-certificate`, a path to the TLS client certificate
- `tls-private-key`, a path to the TLS private key backing the client certificate
-
-If you don't need mTLS, use `https://` instead.
-
-)"
@@ -1,102 +0,0 @@
-#include "lix/libstore/store-api.hh"
-#include "lix/libutil/config.hh"
-#include "lix/libstore/http-binary-cache-store.hh"
-#include <stdlib.h>
-#include <curl/curl.h>
-
-namespace nix {
-struct mTLSBinaryCacheStoreConfig : HttpBinaryCacheStoreConfig
-{
-    using HttpBinaryCacheStoreConfig::HttpBinaryCacheStoreConfig;
-
-    const std::string name() override
-    {
-        return "mTLS HTTP Binary Cache Store";
-    }
-
-    std::string doc() override
-    {
-        return
-#include "mtls-http-binary-cache-store.md"
-            ;
-    }
-
-    PathsSetting<nix::Path> tlsCertificate{
-        this,
-        "",
-        "tls-certificate",
-        "Path of the TLS client certificate in PEM format as expected by CURLOPT_SSLCERT"
-    };
-
-    PathsSetting<nix::Path> tlsKey{
-        this,
-        "",
-        "tls-private-key",
-        "Path of the TLS client certificate private key in PEM format as expected by CURLOPT_SSLKEY"
-    };
-};
-
-struct mTLSBinaryCacheStoreImpl : public HttpBinaryCacheStore
-{
-    struct Keyring
-    {
-        nix::Path tlsCertificate;
-        nix::Path tlsKey;
-    };
-
-    mTLSBinaryCacheStoreConfig config_;
-    std::shared_ptr<Keyring> keyring;
-
-    mTLSBinaryCacheStoreConfig & config() override
-    {
-        return config_;
-    }
-    const mTLSBinaryCacheStoreConfig & config() const override
-    {
-        return config_;
-    }
-
-    mTLSBinaryCacheStoreImpl(
-        const std::string & uriScheme, const Path & _cacheUri, mTLSBinaryCacheStoreConfig config
-    )
-        : Store(config)
-        , HttpBinaryCacheStore("https", _cacheUri, config)
-        , config_(std::move(config))
-        , keyring(std::make_shared<Keyring>(config_.tlsCertificate.get(), config_.tlsKey.get()))
-    {
-    }
-
-    FileTransferOptions makeOptions(Headers && headers = {}) override
-    {
-        auto options = HttpBinaryCacheStore::makeOptions(std::move(headers));
-        auto baseExtraSetup = std::move(options.extraSetup);
-        auto keyring = this->keyring;
-
-        options.extraSetup = [keyring, baseExtraSetup{std::move(baseExtraSetup)}](CURL * req) {
-            if (baseExtraSetup) {
-                baseExtraSetup(req);
-            }
-
-            const bool haveCert = !keyring->tlsCertificate.empty();
-            const bool haveKey = !keyring->tlsKey.empty();
-            if (!(haveCert && haveKey)) {
-                throw Error("https+mtls requires both tls-certificate and tls-private-key");
-            }
-            curl_easy_setopt(req, CURLOPT_SSLCERT, keyring->tlsCertificate.c_str());
-            curl_easy_setopt(req, CURLOPT_SSLKEY, keyring->tlsKey.c_str());
-        };
-
-        return options;
-    }
-
-    static std::set<std::string> uriSchemes()
-    {
-        return {"https+mtls"};
-    }
-};
-}
-
-extern "C" void nix_plugin_entry()
-{
-    nix::StoreImplementations::add<nix::mTLSBinaryCacheStoreImpl, nix::mTLSBinaryCacheStoreConfig>();
-}
@@ -1,15 +1,9 @@
-let
-  lockFile = builtins.fromJSON (builtins.readFile ./flake.lock);
-  flake-compat-node = lockFile.nodes.${lockFile.nodes.root.inputs.flake-compat};
-  flake-compat = builtins.fetchTarball {
-    inherit (flake-compat-node.locked) url;
-    sha256 = flake-compat-node.locked.narHash;
-  };
-
-  flake = (
-    import flake-compat {
-      src = ./.;
-    }
-  );
-in
-flake.defaultNix
+(import (
+  let
+    lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  in
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+    sha256 = lock.nodes.flake-compat.locked.narHash;
+  }
+) { src = ./.; }).defaultNix
@@ -24,7 +24,8 @@ def map_contents_recursively(transformer):
 def process_command:
    .[0] as $context |
    .[1] as $body |
-	$body | .items |= map(map_contents_recursively(if $context.renderer == "html" then transform_anchors_html else transform_anchors_strip end))
-	;
+    $body + {
+        sections: $body.sections | map(map_contents_recursively(if $context.renderer == "html" then transform_anchors_html else transform_anchors_strip end)),
+    };

 process_command
@@ -22,16 +22,16 @@ fold.level = 30
 # not want to disable the links preprocessor entirely though because that requires
 # disabling *all* built-in preprocessors and selectively reenabling those we want.
 [preprocessor.substitute]
-command = "python3 substitute.py"
+command = "python3 doc/manual/substitute.py"
 before = ["anchors", "links"]

 [preprocessor.anchors]
 renderers = ["html"]
-command = "jq --from-file anchors.jq"
+command = "jq --from-file doc/manual/anchors.jq"

 [output.markdown]

-[output.linkcheck2]
+[output.linkcheck]
 # no Internet during the build (in the sandbox)
 follow-web-links = false

@@ -48,11 +48,6 @@ artemist:
  display_name: Artemis Tosini
  forgejo: artemist

-astreaprtcl:
-  display_name: Astreaprtcl
-  forgejo: astreaprtcl
-  github: astreaprtcl
-
 bb010g:
  display_name: Dusk Banks
  forgejo: bb010g
@@ -62,10 +57,6 @@ blitz:
  display_name: Julian Stecklina
  github: blitz

-blokyk:
-  display_name: blokyk
-  github: blokyk
-
 cole-h:
  display_name: Cole Helbling
  github: cole-h
@@ -82,9 +73,6 @@ detroyejr:
  display_name: Jonathan De Troye
  github: detroyejr

-edef:
-  github: edef1c
-
 edolstra:
  display_name: Eelco Dolstra
  github: edolstra
@@ -98,11 +86,6 @@ ericson:
  display_name: John Ericson
  github: ericson2314

-getchoo:
-  display_name: Seth Flynn
-  forgejo: getchoo
-  github: getchoo
-
 gilice:
  forgejo: gilice

@@ -111,9 +94,6 @@ goldstein:
  forgejo: goldstein
  github: GoldsteinE

-gustavderdrache:
-  github: gustavderdrache
-
 horrors:
  display_name: eldritch horrors
  forgejo: pennae
@@ -140,19 +120,11 @@ jade:
 just1602:
  forgejo: just1602

-k900:
-  display_name: K900
-  forgejo: K900
-  github: K900
-
 kasimeka:
  display_name: ورد
  forgejo: janw4ld
  github: kasimeka

-keysmashes:
-  github: keysmashes
-
 kfears:
  display_name: KFears
  forgejo: kfearsoff
@@ -199,11 +171,6 @@ midnightveil:
  forgejo: midnightveil
  github: midnightveil

-milibopp:
-  display_name: Emilia Bopp
-  forgejo: milibopp
-  github: milibopp
-
 nan-git:
  display_name: NaN-git
  github: NaN-git
@@ -211,9 +178,6 @@ nan-git:
 ncfavier:
  github: ncfavier

-nkk0:
-  github: nkk0
-
 not-my-profile:
  display_name: Martin Fischer
  github: not-my-profile
@@ -256,32 +220,13 @@ raito:
  forgejo: raito
  github: RaitoBezarius

-rkjnsn:
-  display_name: Erik Jensen
-  forgejo: rkjnsn
-  github: rkjnsn
-
 roberth:
  display_name: Robert Hensing
  github: roberth

-rootile:
-  display_name: rootile (Rutile)
-  forgejo: rootile
-
-sandydoo:
-  github: sandydoo
-
 seppel3210:
  github: Seppel3210

-sterni:
-  forgejo: sterni
-  github: sternenseemann
-
-stevalkr:
-  github: stevalkr
-
 teofilc:
  forgejo: teofilc
  github: TeofilC
@@ -308,9 +253,6 @@ vigress8:
  forgejo: vigress8
  github: vigress8

-vlaci:
-  github: vlaci
-
 vlinkz:
  display_name: Victor Fuentes
  forgejo: vlinkz
@@ -326,18 +268,11 @@ xanderio:
 xokdvium:
  github: xokdvium

-xyenon:
-  forgejo: xyenon
-  github: xyenon
-
 yorickvp:
  github: yorickvp

 yshui:
  github: yshui

-ysndr:
-  github: ysndr
-
 zimbatm:
  github: zimbatm
@@ -69,7 +69,7 @@ let
    let
      result = squash ''
        - ${
-          if inlineHTML then ''<span id="conf-${name}">[`${name}`](#conf-${name})</span>'' else "`${name}`"
+          if inlineHTML then ''<span id="conf-${name}">[`${name}`](#conf-${name})</span>'' else ''`${name}`''
        }

        ${indent "  " body}
@@ -41,13 +41,9 @@ manual = custom_target(
    '-euo', 'pipefail',
    '-c',
    '''
-        @0@ @INPUT0@ @3@ > @DEPFILE@
-
-        # Needs to be in lix/doc/manual for e.g. substitute.py
-        pushd @3@
-        @1@ build . -d @2@
-        popd
-
+        @0@ @INPUT0@ @CURRENT_SOURCE_DIR@ > @DEPFILE@
+        cd @SOURCE_ROOT@
+        @1@ build doc/manual -d @2@ | { grep -Fv "because fragment resolution isn't implemented" || :; }
        rm -rf @2@/manual
        mv @2@/html @2@/manual
        find @2@/manual -iname meson.build -delete
@@ -55,7 +51,6 @@ manual = custom_target(
      python.full_path(),
      mdbook.full_path(),
      meson.current_build_dir(),
-      meson.current_source_dir()
    ),
  ],
  input : [
@@ -86,7 +81,7 @@ manual = custom_target(
  depfile : 'manual.d',
  env : {
    'RUST_LOG': 'info',
-    'MANUAL_SUBSTITUTE_SEARCH': meson.current_build_dir() / 'src',
+    'MDBOOK_SUBSTITUTE_SEARCH': meson.current_build_dir() / 'src',
  },
 )
 manual_md = manual[1]
@@ -1,10 +0,0 @@
---
-synopsis: "allow setting nested attributes via `--arg`/`--argstr`"
-cls: [5338]
-category: "Features"
-credits: [ma27]
-issues: [fj#496]
---
-
-Passing `--arg config.allowUnfree true` to e.g. `nix-build` now results in `config` with value
-`{ allowUnfree = true; }` passed to the expression.
@@ -0,0 +1,16 @@
+---
+synopsis: First argument to `--arg`/`--argstr` must be a valid Nix identifier
+issues: [fj#496]
+category: "Breaking Changes"
+credits: [ma27]
+---
+
+The first argument to `--arg`/`--argstr` must be a valid Nix identifier, i.e.
+`nix-build --arg config.allowUnfree true` is now rejected.
+
+This is because that invocation is a false friend since it doesn't set
+`{ config = { allowUnfree = true; }; }`, but `{ "config.allowUnfree" = true; }`.
+
+The idea is to change the behavior to the latter in the long-term. For that,
+non-identifiers started giving a warning since 2.92 and are now rejected to give people
+who depend on that a chance to notice and potentially weigh in on the discussion.
@@ -0,0 +1,20 @@
+---
+synopsis: "Improved susbtituter query speed"
+issues: []
+cls: []
+category: Improvements
+credits: [horrors]
+---
+
+The code used to query substituters for derivations has been rewritten slightly
+to take advantage of our asynchronous runtime. Such queries run for every build
+that could download from substituters and processes every derivation that isn't
+yet present on the local system. Previously Lix would use `http-connections` to
+limit query concurrency, even for modern caches that support HTTP/2 and have no
+limit on how many queries can be run concurrently on one single connection. Lix
+no longer does this, resulting in approximately 60% reduction in query time for
+medium-sized closures (e.g. NixOS system closures) during testing, although the
+exact number depends greatly on local network latency and generally improves as
+latency increases. Unlike previously setting `http-connections` to `1` or other
+low values no longer brings a massive penalty in query performance if the cache
+in use by the querying system supports HTTP/2 (as e.g. `cache.nixos.org` does).
@@ -0,0 +1,12 @@
+---
+synopsis: "`build-dir` no longer defaults to `temp-dir`"
+cls: [3453]
+category: "Fixes"
+credits: [horrors]
+---
+
+The directory in which temporary build directories are created no longer defaults
+to the value of the `temp-dir` setting to avoid builders making their directories
+world-accessible. This behavior has been used to escape the build sandbox and can
+cause build impurities even when not used maliciously. We now default to `builds`
+in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration).
@@ -0,0 +1,60 @@
+---
+synopsis: "Global certificate authorities are copied inside the builder's environment"
+issues: [gh#12698, fj#885]
+cls: [3765]
+category: Fixes
+credits: [raito, emilazy]
+---
+
+Previously, CA certificates were only installed at
+`/etc/ssl/certs/ca-certificates.crt` for sandboxed builds on Linux.
+
+This setup was insufficient in light of recent changes in `nixpkgs`, which now
+enforce HTTPS usage for `fetchurl`, even for fixed-output derivations, to
+mitigate confidentiality risks such as `netrc` or credentials leakage.
+`nixpkgs` still make use of a special package called `cacerts` which contains a
+copy of the CA certificates maintained by Nixpkgs and added as a reference for
+TLS-enabled fetchers.
+
+As a result, having a consistent and trusted certificate authority in all
+builder environments is becoming more essential.
+
+On `nix-darwin`, the `NIX_SSL_CERT_FILE` environment variable is always
+explicitly defined, but it is ignored by the sandbox setup.
+
+Simultaneously, Nix evaluates and propagates impure environment variables via
+`lib.proxyImpureEnvVars`, meaning that if `NIX_SSL_CERT_FILE` is set (which
+influences the default value for `ssl-cert-file`), it will be forwarded
+unchanged into the builder environment.
+
+However, on Linux, Nix also *copies* the CA file into the sandbox, creating a
+discrepancy between the value of `NIX_SSL_CERT_FILE` and the actual trusted
+certificate path used during the build.
+
+This divergence caused confusion and was partially addressed by attempts to
+whitelist the CA path in the Darwin sandbox (see cl/2906), but that approach
+involved a non-trivial path canonicalization step and is not as general as this one.
+
+To address this properly, we now emit a warning and override
+`NIX_SSL_CERT_FILE` inside the builder, explicitly pointing it to the CA file
+copied into the sandbox.
+
+This eliminates ambiguity between `NIX_SSL_CERT_FILE`
+and `ssl-cert-file`, ensuring consistent trust anchors across platforms.
+
+This warning might become a hard error as we figure out what to do regarding
+`lib.proxyImpureEnvVars` in nixpkgs.
+
+The behavior has been verified across sandboxed and unsandboxed builds on both
+Linux and Darwin.
+
+As a consequence of this change, approximately 500 KB of CA certificate data is
+now unconditionally copied into the build directory for fixed-output
+derivations.
+
+While this ensures consistent trust verification without having to restart the
+daemon after system upgrades, it may introduce a slight overhead in build
+performance. At present, no optimizations have been implemented to avoid this
+copy, but if this overhead proves noticeable in your workflows, please open an
+issue so we can evaluate and possibly implement different strategies to render
+trust anchors visible.
@@ -0,0 +1,69 @@
+---
+synopsis: New cgroup delegation model
+issues: [fj#537, fj#77]
+cls: [3230]
+category: "Breaking Changes"
+credits: [raito, horrors, lheckemann]
+---
+
+Builds using cgroups (i.e. `use-cgroups = true` and the experimental feature
+`cgroups`) now always delegate a cgroup tree to the sandbox.
+
+Compared to the original C++ Nix project, our delegation includes the
+`subtree_control` file as well, which means that the sandbox can disable
+certain controllers in its own cgroup tree.
+
+This is a breaking change because this requires the Nix daemon to run with an
+already delegated cgroup tree by the service manager.
+
+## How to setup the cgroup tree with systemd?
+
+systemd offers knobs to perform the required setup using:
+
+```
+[Service]
+Delegate=yes
+DelegateSubtree=supervisor
+```
+
+These directives are now included in our systemd packaging.
+
+## What about using Nix as root without connecting to the daemon?
+
+Builds run as `root` without connecting to the daemon relying on the cgroup
+feature are now broken, i.e.
+
+```console
+# nix-build --use-cgroups --sandbox ... # will not work
+```
+
+Consider doing instead:
+
+```console
+# systemd-run --same-dir --wait -p Delegate=yes -p DelegateSubgroup=supervisor nix-build --use-cgroups ...
+```
+
+If you need to disable cgroups temporarily, remember that you can do
+`NIX_CONF='include /etc/nix/nix.conf\nuse-cgroups = false' nix-build ...` or
+`nix-build --no-use-cgroups ...`.
+
+## What about other service managers than systemd?
+
+systemd has a [documentation](https://systemd.io/CGROUP_DELEGATION/) on how to
+handle cgroup delegation from service management perspective.
+
+If your service manager adheres to systemd semantics, e.g. writing an extended
+attribute `user.delegate=1` on the delegated cgroup tree directory and moving
+the `nix-daemon` process inside a cgroup tree to respect the inner process
+rule, then, the feature will work as well.
+
+## Why is the cgroup feature still experimental?
+
+While the cgroup feature unlocks many use cases, its behavior and integration (e.g. user experience), especially at scale on build farms or in multi-tenant environments, are not yet fully matured. There’s also potential for deeper systemd integration (e.g. using slices and scopes) that has not been fully explored.
+
+To avoid locking in an unstable interface, we’re keeping the experimental flag until we have validated the feature across a broader range of scenarios, including but not limited to:
+
+* Nix as root
+* Hydra-style build farms
+* Forgejo CI runners
+* Shared remote builders
@@ -1,9 +0,0 @@
---
-synopsis: "check for missing ca-file or netrc-file if one is specified"
-cls: [5646]
-category: "Improvements"
-credits: [astreaprtcl]
-issues: [fj#1106]
---
-
-If the settings `ssl-cert-file` or `netrc-file` have been set by the user, check if those files actually exist and fail if they are missing.
@@ -0,0 +1,16 @@
+---
+synopsis: Deprecation of CA derivations, dynamic derivations, and impure derivations
+issues: [fj#815]
+cls: []
+significance: significant
+category: Miscellany
+credits: []
+---
+
+Content-addressed derivations are now deprecated and slated for removal in Lix 2.94.
+We're doing this because the CA derivation system has been a known cause of problems
+and inconsistencies, is unmaintained, habitually makes improving the store code very
+difficult (or blocks such improvements outright), and is beset by a number of design
+flaws that in our opinion cannot be fixed without a full reimplementation from zero.
+Dynamic derivations and impure derivations are built on the CA derivation framework,
+and owing to this they too are deprecated and slated for removal in another release.
@@ -0,0 +1,25 @@
+---
+synopsis: "Hitting Control-C twice always terminates Lix"
+cls: [3574]
+issues: []
+category: "Improvements"
+credits: [horrors]
+---
+
+Hitting Control-C or sending `SIGINT` to Lix now prints an informational message
+if it is still running after on second, the second Control-C/`SIGINT` terminates
+Lix immediately without waiting for any shutdown code to finish running. Lix did
+not treat the second such event differently from first in the past; this made it
+impossible to easily terminate running Lix processes that got stuck in e.g. very
+expensive Nixlang code that never interacted with the store. We now terminate as
+soon as the user hits Control-C again without waiting any more, to much the same
+effect as putting Lix into the background and killing it immediately afterwards.
+
+This means you can now more conveniently break out of stuck Nixlang evaluations:
+```
+❯ nix-instantiate --eval --expr 'let f = n: if n == 0 then 0 else f (n - 1) + f (n - 1); in f 32'
+^CStill shutting down. Press ^C again to abort all operations immediately.
+^C
+
+❌130 ❯
+```
@@ -1,10 +0,0 @@
---
-synopsis: "libexpr: allow empty attr-names in parseAttrPath if they are quoted"
-cls: [5375]
-category: "Miscellany"
-credits: [ma27]
---
-
-Empty strings are now allowed in attribute paths as consumed by e.g. `nix-build`.
-I.e. `nix-build -A 'foo."".bar'` works now.
-The quotes are necessary, i.e. `nix-build -A foo..bar` will throw an error.
@@ -0,0 +1,12 @@
+---
+synopsis: "libstore: exponential backoff for downloads"
+issues: [lix#932]
+cls: [3856]
+category: Fixes
+credits: [ma27]
+---
+
+The connection timeout when downloading from e.g. a binary cache is exponentially
+increased per failure. The option `connect-timeout` is now an alias to `max-connect-timeout`
+which is the maximum value for a timeout. The start value is controlled
+by `initial-connect-timeout` which is `5` by default.
@@ -1,10 +0,0 @@
---
-synopsis: "don't treat tarball fetches with empty or zero hash as locked"
-cls: []
-category: "Fixes"
-credits: [horrors]
-issues: [fj#1233]
---
-
-Lix no longer treats tarball fetches with empty or zero hashes as locked.
-All such fetches are now also affected by `tarball-ttl` as a consequence.
@@ -0,0 +1,9 @@
+---
+synopsis: Fix develop shells for derivations with escape codes
+issues: [fj#991]
+cls: [4154, 4155]
+category: Fixes
+credits: [Qyriad]
+---
+
+ASCII control characters (including `\e`, used for ANSI escape codes) in derivation variables are now correctly escaped for `nix develop` and `nix print-dev-env`, instead of erroring.
@@ -0,0 +1,13 @@
+---
+synopsis: "nix-store --delete: always remove obsolete hardlinks"
+issues: []
+cls: [3188]
+category: Fixes
+credits: [lheckemann]
+---
+
+Deleting specific paths using `nix-store --delete` or `nix store
+delete` previously did not delete hard links created by `nix-store
+--optimise` even if they became obsolete, unless _all_ of the given
+paths were deleted successfully. Now, hard links are always cleaned
+up, even if some of the given paths could not be deleted.
@@ -0,0 +1,24 @@
+---
+synopsis: "Report GC statistics correctly"
+issues: []
+cls: [3188]
+category: Fixes
+credits: [lheckemann]
+---
+
+Deleting specific paths using `nix-store --delete` or `nix store delete` previously did
+not report statistics correctly when some of the paths could not be deleted, even if
+others were deleted:
+
+```
+$ nix store delete /nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1 --delete-closure -v
+finding garbage collector roots...
+deleting '/nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1'
+0 store paths deleted, 0.00 MiB freed
+error: Cannot delete some of the given paths because they are still alive. Paths not deleted:
+         k9bxzr1l92r5y6mihrkbpbr3fmc8qszx-libidn2-2.3.8
+         mbx9ii53lzjlrsnlrfmzpwm33ynljwdn-libunistring-1.3
+         rf8hcy6bldxdqc0g6q1dcka1vh47x69s-xgcc-14.2.1.20250322-libgcc
+         vbrdc5wgzn0w1zdp10xd2favkjn5fk7y-glibc-2.40-66
+       To find out why, use nix-store --query --roots and nix-store --query --referrers.
+```
@@ -0,0 +1,16 @@
+---
+synopsis: Add `inputs.self.submodules` flake attribute
+issues: [fj#942]
+cls: [3839]
+category: Features
+credits: [edolstra, kasimeka]
+---
+
+A port of <https://github.com/NixOS/nix/pull/12421> to Lix, which:
+
+- adds a general `inputs.self` flake attribute that retroactively applies
+  configurations to a flake after it's been fetched, then triggers a refetch of
+  the flake with the new config.
+- implements `inputs.self.submodules` that allows a flake to declare its need
+  for submodules, which are then fetched automatically with no need to pass
+  `?submodules=1` anywhere.
@@ -1,13 +0,0 @@
---
-synopsis: builtins.floor/builtins.ceil handle out-of-range inputs correctly
-issues: [nix#12899]
-cls: [3923]
-prs: [nix#13013]
-category: "Breaking Changes"
-credits: [jade, nan-git, rootile]
---
-Previously, `builtins.floor` and `builtins.ceil` always cast the input into a floating point value before running the operation and casting the floating point result back into an integer.
-No checks were made for precision loss in either coercing integer inputs or converting the output to an integer (and in fact in the latter case, invoked undefined behaviour).
-
-Now, Lix checks for precision loss on integer input (to avoid a silent eval semantics change if we were to simply pass it through as-is) and on integer output.
-If your code fails to evaluate after this change, use `--extra-deprecated-features floor-ceil-corrupt-integers`.
@@ -0,0 +1,16 @@
+---
+synopsis: Add hyperlinks in attr set printing
+issues: []
+cls: [3790]
+category: Features
+credits: [jade]
+---
+
+The attribute set printer, such as is seen in `nix repl` or in type errors, now prints hyperlinks on each attribute name to its definition site if it is known.
+
+Example: all of the attributes shown here are hyperlinks to the exact definition site of the attribute in question:
+
+```
+$ nix eval -f '<nixpkgs>' lib.licenses.mit
+{ deprecated = false; free = true; fullName = "MIT License"; redistributable = true; shortName = "mit"; spdxId = "MIT"; url = "https://spdx.org/licenses/MIT.html"; }
+```
@@ -0,0 +1,24 @@
+---
+synopsis: Repl debugger uses `--ignore-try` by default
+issues: [lix#666]
+cls: [3488]
+category: Breaking Changes
+credits: [jade]
+---
+Previously, using the debugger meant that exceptions thrown in `builtins.tryEval` would trigger the debugger.
+
+However, this caught nixpkgs initialization code, which is unhelpful in the majority of cases, so we changed the default.
+
+To get the old behaviour, use `--no-ignore-try`.
+
+```
+$ nix repl --debugger --expr 'with import <nixpkgs> {}; pkgs.hello'
+Lix 2.94.0-dev-pre20250625-9a59106
+Type :? for help.
+error: file 'nixpkgs-overlays' was not found in the Nix search path (add it using $NIX_PATH or -I)
+
+This exception occurred in a 'tryEval' call. Use --ignore-try to skip these.
+
+Added 13 variables.
+nix-repl>
+```
@@ -0,0 +1,25 @@
+---
+synopsis: "Fallback to safe temp dir when build-dir is unwritable"
+issues: [fj#876]
+cls: [3501]
+category: "Fixes"
+credits: ["raito", "horrors"]
+---
+
+Non-daemon builds started failing with a permission error after introducing the `build-dir` option:
+
+```
+$ nix build --store ~/scratch nixpkgs#hello --rebuild
+error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied
+```
+
+This happens because:
+
+1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`.
+2. The user lacks permissions for that path.
+
+We considered making `build-dir` a store-level option and defaulting it to `<chroot-root>/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`.
+
+To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir.
+
+**Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads.
@@ -0,0 +1,47 @@
+---
+synopsis: Experimental integer coercion in interpolated strings
+issues: []
+cls: [3198]
+category: "Features"
+credits: [raito, delroth, horrors, winter]
+---
+
+Ever tried interpolating a port number in Lix and ended up with something like this?
+
+```nix
+"http://${config.network.host}:${builtins.toString config.network.port}/"
+```
+
+You're not alone. Thousands of Lix users suffer every day from excessive `builtins.toString` syndrome. It’s 2025, and we still have to cast integers to use them in strings.
+
+To address this, Lix introduces the **`coerce-integers`** experimental feature. When enabled, interpolated integers within `"${...}"` are automatically coerced to strings. This allows writing:
+
+```nix
+"http://${config.network.host}:${config.network.port}/"
+```
+
+without additional conversion.
+
+To enable the feature, you need to add `coerce-integers` to your set of experimental features.
+
+### Stabilization criteria
+
+The `coerce-integers` feature is experimental and limited strictly to string interpolation (`"${...}"`). Before stabilization, the following must hold:
+
+1. **Interpolation-only**
+   Coercion must not occur outside interpolation. Expressions like `"" + 42` must continue to fail.
+
+2. **Expectation that no explicit cast are being observed**
+   Cases observing explicit coercion (e.g., via `tryEval` gadget or similar) are expected not to be load-bearing in actual production code.
+
+### Timeline for stabilization
+
+If the feature proves safe and is widely adopted across typical usage (e.g., actual configurations in the wild turning on the flag, non-trivial out-of-tree projects using it), the experimental flag will be removed **after six months of active use or two Lix releases**, whichever is longer.
+
+This avoids locking the feature in experimental status indefinitely, as happened with Flakes, while allowing time for validation and ecosystem integration.
+
+### What about coercing floats or more?
+
+Coercion beyond integers -- such as for floats or other types -- is **not planned**, even under an experimental flag. Questions like "what is the canonical string representation of a float?" involve subtle and context-dependent trade-offs. Without a robust and principled mechanism to define and audit such behavior, introducing broader coercion risks setting unintended and hard-to-reverse precedents. The scope of `coerce-integers` is intentionally narrow and will remain so.
+
+In terms of outlook, a proposal like https://git.lix.systems/lix-project/lix/issues/835 could pave the way for a better solution.
@@ -0,0 +1,16 @@
+---
+synopsis: Parse overflowing JSON number literals as floating‐point
+issues: []
+cls: [3919]
+category: "Fixes"
+credits: [emilazy]
+---
+
+Previously, `builtins.fromJSON "-9223372036854775809"` would
+return a floating‐point number, while `builtins.fromJSON
+"9223372036854775808"` would cause an evaluation error. This was
+introduced with the banning of integer overflow in Lix 2.91; previously
+the latter would result in C++ undefined behaviour. These cases are
+now treated consistently with JSON’s model of a single numeric type,
+and JSON number literals that do not fit in a Nix‐language integer
+will be parsed as floating‐point numbers.
@@ -0,0 +1,13 @@
+---
+synopsis: "`--keep-failed` chowns the build directory to the user that request the build"
+issues: []
+cls: []
+category: Improvements
+credits: [horrors]
+---
+
+Running a build with `--keep-failed` now chowns the temporary directory from the
+builder user and group to the user that request the build if the build came from
+a local user connected to the daemon. This makes inspecting failed derivations a
+lot easier. On Linux the build directory made visible to the user will not be in
+the same path as it was in the sandbox and continuing builds will usually break.
@@ -1,14 +0,0 @@
---
-synopsis: "builtins.break doesn't break expression anymore"
-issues: [1165]
-cls: [5422]
-category: "Fixes"
-credits: [blokyk]
---
-
-Wrapping an expression in `builtins.break` used to break some builtins like
-`map` and the `is*` functions, which could modify the execution path of code
-inadvertently, made debugging nix harder than it already is, and in some cases
-even crashed the interpreter. Now, using `break` should be completely
-transparent to whatever function receives it as an input, preventing the
-above-mentioned issues.
@@ -1,9 +0,0 @@
---
-synopsis: "flake config warnings are now printed to stderr"
-issues: [1155]
-cls: [5379]
-category: "Fixes"
-credits: [lheckemann]
---
-
-The settings listed in a flake-config confirmation prompt are now printed to stderr rather than stdout, which allows `nix print-dev-env` to emit valid bash again even in the presence of untrusted settings.
@@ -1,21 +0,0 @@
---
-synopsis: "Use a lock when fetching inputs"
-issues: [1122]
-cls: [5438]
-category: "Fixes"
-credits: [lheckemann]
---
-
-Up to now, attempting to fetch the same git input from multiple processes
-concurrently when the input is not yet cached presented multiple issues:
-
- If the input was not already present, it would unnecessarily be fetched
-  multiple times;
-
- Access to the fetcher cache database was contentious, and could lead to
-  evaluation or flake locking failing unnecessary because the fetcher cache
-  was locked.
-
-We now acquire a lock on a path based on a hash of the input specification
-before accessing the fetcher db, reducing contention significantly, and
-preventing more than one process from fetching the same path at the same time.
@@ -0,0 +1,11 @@
+---
+synopsis: Fix handling of OSC codes in terminal output
+issues: [fj#160]
+cls: [3143]
+category: Fixes
+credits: [lilyball]
+---
+
+OSC codes in terminal output are now handled correctly, where OSC 8 (hyperlink) is preserved any
+time color codes are allowed and all other OSC codes are stripped out. This applies not only to
+output from build commands but also to rendered documentation in the REPL.
@@ -1,16 +0,0 @@
---
-synopsis: "Use mimalloc for faster evaluation"
-cls: [5645]
-category: Features
-credits: [getchoo, lovesegfault]
---
-
-Lix now links with [mimalloc](https://github.com/microsoft/mimalloc),
-replacing the system's default `malloc()` for all non-GC allocations.
-
-This yields a **5–12% wall-clock improvement** on evaluation workloads,
-ranging from `nix-instantiate hello` to `nix-env -qa` and full NixOS
-configurations.
-
-The allocator can be disabled at build time with `-Dmimalloc=disabled`,
-or by passing the `useMimalloc = false` override to the `lix` package.
@@ -1,10 +0,0 @@
---
-synopsis: "Lix now requires lowdown 1.4.0 or later"
-issues: []
-cls: [5374]
-category: Packaging
-credits: [sterni]
---
-
-Support for linking against `lowdown < 1.4.0` has been removed from Lix since
-all supported Nixpkgs channels distribute lowdown 2.0.4 or later.
@@ -0,0 +1,14 @@
+---
+synopsis: Better debuggability on fixed-output hash mismatches
+issues: []
+cls: []
+category: Improvements
+credits: [lheckemann]
+---
+
+Fixed-output derivation hash mismatch error messages will now include the path that was
+produced unexpectedly, and this path will be registered as valid even if `--check`
+(`nix-store`, `nix-build`) or `--rebuild` (`nix build`) was passed. This makes comparing
+the expected path with the obtained path easier, and is useful for debugging when
+upstreams modify previously-published releases or when changes in fixed-output
+derivations' dependencies affect their output unexpectedly.
@@ -1,12 +0,0 @@
---
-synopsis: "nix-eval-jobs support `--apply` flag"
-cls: [5748]
-category: "Features"
-credits: [isabelroses,mic92,ysndr]
-issues: [fj#1214]
---
-
-`nix-eval-jobs` now supports the `--apply` flag. With this you can apply the
-provided function to the each derivation, the result of this function will then
-be serialized as a JSON value and stored inside `"extraValue"` key of the json
-line output.
@@ -0,0 +1,10 @@
+---
+synopsis: "nix-eval-jobs: support `--no-instantiate` flag"
+issues: [fj#987]
+category: Features
+credits: [mic92,ma27]
+---
+
+`nix-eval-jobs` now supports a flag called `--no-instantiate`. With this enabled,
+no write operations on the eval store are performed. That means, only evaluation is
+performed, but derivations (and their gcroots) aren't created.
@@ -1,10 +0,0 @@
---
-synopsis: "Fix `nix-copy-closure --include-outputs`"
-issues: [gh#5105]
-cls: [5588]
-category: "Fixes"
-credits: [rkjnsn]
---
-
-The `--include-outputs` flag for `nix-copy-closure` now works as intended.
-Previously, the option was accepted but silently ignored.
@@ -0,0 +1,29 @@
+---
+synopsis: "Fix nix develop for derivations that rejects dependencies with structured attrs"
+issues: [fj#997]
+cls: [4182]
+category: Fixes
+credits: [raito]
+---
+
+For the sake of concision, we refer to `disallowedReferences` in what follows,
+but all output checks were equally fixed:
+`{dis,}allowed{References,Requisites}`.
+
+Derivations can define *output checks* to reject unwanted dependencies, such as
+interpreters like `bash` or compilers like `gcc`. This can be done in two ways:
+
+* **Legacy style**: `disallowedReferences = [ ... ]` in the environment.
+* **Structured attrs**: `outputChecks.<output>.disallowedReferences = [ ... ]`,
+  typically used in `__json`.
+
+Only the structured form supports derivations with multiple outputs.
+
+`nix develop` internally rewrites derivations to create development shells. It
+relied on the legacy `disallowedReferences`, and failed to honor the structured
+variant. This led to broken shells in cases where `bashInteractive` was
+explicitly disallowed using structured output checks, e.g. `nix develop
+nixpkgs#systemd` after the "bash-less NixOS" changes.
+
+This fix teaches `nix develop` to respect structured output checks, restoring
+support for such derivations.
@@ -1,14 +0,0 @@
---
-synopsis: "Improve nix doctor"
-cls: [5316, 5317, 5318, 5319, 5320, 5768, 5829]
-category: Features
-credits: [rootile, raito]
---
-The `nix doctor` diagnosics interface now provides a lot more useful information including, but not limited to:
- General system information (OS, Hardware etc)
- Nix Information like Sandbox, Version, Store, State and other directories
- Flake registry
- Search path Information
- Nixpkgs provenance
- Remote builder configuration (including remote connection)
- fix crash when having relative Paths in PATH
@@ -0,0 +1,12 @@
+---
+synopsis: "Add --raw flag to `nix-instantiate --eval` for unescaped output"
+issues: []
+prs: [gh#12119]
+cls: [2886]
+category: Improvements
+credits: [not-my-profile, infinisil, raito]
+---
+
+The `nix-instantiate --eval` command now supports a `--raw` flag. When used,
+the result must be coercible to a string (as with `${...}`) and is printed
+verbatim, without quotes or escaping.
@@ -1,11 +0,0 @@
---
-synopsis: "Shadowing internal files through the Nix search path is now an error"
-issues: [998]
-cls: [4632, 5370]
-category: "Breaking Changes"
-credits: [thubrecht, jade, horrors]
---
-
-As Lix uses the path `<nix/fetchurl.nix>` for bootstrapping purposes, the ability to shadow it by adding `nix=/some/path` (or `/other/path` that contains a `nix` directory) to the search path is not desirable.
-
-Lix 2.95 deprecated this behavior with a warning, Lix 2.96 now turns it into a hard error if the `nix-path-shadow` deprecated feature isn't enabled. This deprecated feature is slated to be removed in Lix 2.98.
@@ -0,0 +1,12 @@
+---
+synopsis: Allow `nix store ls` to read nar listings from binary cache stores.
+issues: []
+cls: [3225]
+category: Improvements
+credits: [vlinkz]
+---
+
+The `nix store ls` command now supports reading `.ls` nar listings from binary cache stores.
+If a listing is detected for the store path being queried, the nar is no longer downloaded.
+These nar listings are available in binary cache stores where the `write-nar-listing` option is
+enabled, such as cache.nixos.org.
@@ -0,0 +1,10 @@
+---
+synopsis: "nix-eval-jobs: retain NIX_PATH"
+issues: []
+cls: [3859]
+category: Fixes
+credits: [ma27,mic92]
+---
+
+`nix-eval-jobs` doesn't clear the `NIX_PATH` from the environment anymore. This matches the behavior
+of [upstream version `2.30`](https://github.com/nix-community/nix-eval-jobs/releases/tag/v2.30.0).
@@ -1,11 +0,0 @@
---
-synopsis: "Remove `max-connections` store parameters for `ssh://` and `ssh-ng://` stores"
-cls: []
-category: Miscellany
-credits: [horrors]
---
-
-The `max-connections` parameter was undocumented, untested, and (in the case of `ssh`) even ignored
-entirely for remote builds. During a survey of public nixos configurations we have found *two* uses
-of `max-connections` for `ssh-ng`, and none at all for `ssh`. Since it is so rarely used but brings
-significant internal complexity that hinders improvements we have decided to remove these features.
@@ -0,0 +1,25 @@
+---
+synopsis: "show tree with references that lead to an output cycle"
+issues: [fj#551]
+category: Improvements
+credits: [ma27]
+---
+
+When Lix determines a cyclic dependency between several outputs of a derivation,
+it now displays which files in which outputs lead to an output cycle:
+
+```
+error: cycle detected in build of '/nix/store/gc5h2whz3rylpf34n99nswvqgkjkigmy-demo.drv' in the references of output 'bar' from output 'foo'.
+
+       Shown below are the files inside the outputs leading to the cycle:
+       /nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar
+       └───lib/libfoo: …stuffbefore /nix/store/h680k7k53rjl9p15g6h7kpym33250w0y-demo-baz andafter.…
+           → /nix/store/h680k7k53rjl9p15g6h7kpym33250w0y-demo-baz
+           └───share/snenskek: …???? /nix/store/dm24c76p9y2mrvmwgpmi64rryw6x5qmm-demo-foo ....…
+               → /nix/store/dm24c76p9y2mrvmwgpmi64rryw6x5qmm-demo-foo
+               └───bin/alarm: …textexttext/nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar abcabcabc.…
+                   → /nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar
+```
+
+Please note that showing the files and its contents while displaying the cycles only works
+on Linux.
@@ -0,0 +1,20 @@
+---
+synopsis: "Fixed output derivations can be run using `pasta` network isolation"
+cls: [3452]
+issues: [fj#285]
+category: "Breaking Changes"
+credits: [horrors, puck]
+---
+
+Fixed output derivations traditionally run in the host network namespace.
+On Linux this allows such derivations to communicate with other sandboxes
+or the host using the abstract Unix domains socket namespace; this hasn't
+been unproblematic in the past and has been used in two distinct exploits
+to break out of the sandbox. For this reason fixed output derivations can
+now run in a network namespace (provided by [`pasta`]), restricted to TCP
+and UDP communication with the rest of the world. When enabled this could
+be a breaking change and we classify it as such, even though we don't yet
+enable or require such isolation by default. We may enforce this in later
+releases of Lix once we have sufficient confidence that breakage is rare.
+
+[`pasta`]: https://passt.top/
@@ -0,0 +1,21 @@
+---
+synopsis: Remove reliance on Bash for remote stores via SSH
+issues: [fj#830, fj#805, fj#304]
+cls: [3159]
+category: "Fixes"
+credits: [raito]
+---
+
+The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed.
+
+After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on:
+
+  * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`),
+  * BusyBox / initrd images with no Bash,
+  * hosts using non-POSIX shells such as Nushell.
+
+The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless.
+
+Real connection or protocol errors are now left to SSH/Nix to report directly.
+
+This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes.
@@ -0,0 +1,20 @@
+---
+synopsis: Remove support for daemon protocols before 2.18
+issues: [fj#510]
+cls: [3249]
+significance: significant
+category: "Breaking Changes"
+credits: [horrors]
+---
+
+Support for daemon wire protocols belonging to Nix 2.17 or older have been
+removed. This impacts clients connecting to the local daemon socket or any
+remote builder configured using the `ssh-ng` protocol. Builders configured
+with the `ssh` protocol are still accessible from clients such as Nix 2.3.
+Additionally Lix will not be able to connect to an old daemon locally, and
+remote build connections to old daemons is likewise limited to `ssh` urls.
+
+We have decided to take this step because the old protocols are very badly
+tested (if at all), maintenance overhead is high, and a number of problems
+with their design makes it infeasible to remain backwards compatible while
+we move Lix to a more modern RPC mechanism with better versioning support.
@@ -0,0 +1,14 @@
+---
+synopsis: "`nix eval --write-to` has been removed"
+cls: [4045]
+issues: [fj#974, fj#227]
+category: "Breaking Changes"
+credits: [horrors]
+---
+
+`nix eval --write-to` has been removed since it was underspecified, not widely
+useful, and prone to security-sensitive misbehaviors. The feature was added in
+Nix 2.4 purely for internal use in the build system. According to our research
+it hasn't found any use outside of some distribution packaging scripts. Please
+use structured outputs formats (such as JSON) instead as they have better type
+fidelity, don't conflate attributes with paths, and are useful to other tools.
@@ -0,0 +1,17 @@
+---
+synopsis: Remove impure derivations and dynamic derivations
+issues: [fj#815]
+cls: [3210]
+significance: significant
+category: "Breaking Changes"
+credits: [horrors]
+---
+
+The `impure-derivations` and `dynamic-derivations` experimental feature have
+been removed.
+
+New impure or dynamic derivations cannot be created from this point forward, and
+any such pre-existing store derivations canot be read or built any more.
+Derivation outputs created by building such a derivation are still valid
+until garbage collected; existing store derivations can only be garbage
+collected.
@@ -0,0 +1,17 @@
+---
+synopsis: Remove the `parse-toml-timestamps` experimental feature
+category: "Breaking Changes"
+credits: [emilazy]
+---
+
+The `parse-toml-timestamps` experimental feature has been removed.
+
+This feature used in‐band signalling to mark timestamps, making it
+impossible to unambiguously parse TOML documents. It also exposed
+implementation‐defined behaviour in the TOML specification that
+changed in the toml11 parser library.
+
+Any interface for parsing TOML timestamps suitable for future
+stabilization would necessarily involve breaking changes, and there
+is no evidence this experimental feature is being relied upon in the
+wild, so it has been removed.
@@ -0,0 +1,20 @@
+---
+synopsis: "repl-overlays now work in the debugger for flakes"
+issues: [fj#777]
+cls: [3398]
+category: Fixes
+credits: [jade]
+---
+Due to a bug, it was previously not possible to use the debugger on flakes with repl-overlays, or with pure evaluation in general:
+
+```
+$ nix repl --pure-eval
+Lix 2.94.0-dev-pre20250617-87d99da
+Type :? for help.
+Loading 'repl-overlays'...
+error: access to absolute path '/Users/jade/.config/nix/repl.nix' is forbidden in pure eval mode (use '--impure' to override)
+```
+
+This is now fixed.
+The contents of the repl-overlays file itself (i.e. most typically the top level lambda in it) will be evaluated in impure mode.
+It may be necessary to use `builtins.seq` to force the impure operations to happen first if one wants to do impure operations inside a repl-overlays file in pure evaluation mode.
@@ -1,18 +0,0 @@
---
-synopsis: "Allow moving between stack frames relative to current debugger frame"
-issues: [1156]
-cls: [5411]
-category: "Improvements"
-credits: [blokyk]
---
-
-Debugging functional programs often involve switching between a bunch of stack
-frames to get the full context of what's happening and who's calling who.
-Before this change, going up or down the stack in the nix debugger with `:st`
-meant remembering the absolute index of each stack frame, instead of their
-positions relative to one another; this got tiring *fast*.
-
-Now, you can prepend `:st`'s argument with a + or - sign to indicate you want to
-move relative to the current stack frame. For example, typing `:st +3` when you
-were on frame `10` will go frame `13`; vice-versa, typing `:st -4` on frame `6`
-will go to frame `2`.
@@ -1,17 +0,0 @@
---
-synopsis: "Print REPL backtraces in more convenient order"
-issues: []
-cls: [5491]
-category: "Improvements"
-credits: [blokyk]
---
-
-When using the debugger, stack traces printed with the `:bt` command were
-previously printed in reverse order compared to most other situations where they
-appeared: the current stack frame would be printed at the very top, with the
-most outer frame at the bottom, meaning that you'd have to scroll up to get a
-sense of where you are.
-
-With this change, the stack frames are printed such that the most relevant ones
-are immediatly visible at the bottom, just like other traces in lix (e.g.
-ones caused by errors).
@@ -1,14 +0,0 @@
---
-synopsis: "invalid arguments to :st now print an error"
-cls: [5386]
-category: "Improvements"
-credits: [blokyk]
---
-
-When using the debugger, the `:st` command used to traverse the call stack would
-silently fail and put the debugger in an invalid state if the argument given to
-it wasn't a valid stack frame index.
-
-This change adds an error message warning the user if the given index wasn't a
-valid frame (telling them the range of valid indices), as well as if it wasn't
-even a valid integer to begin with.
@@ -0,0 +1,19 @@
+---
+synopsis: "`disallowedRequisites` now reports chains of disallowed requisites"
+issues: [fj#334,fj#626,gh#10877]
+category: Improvements
+credits: [ma27,roberth]
+---
+
+When a build fails because of [`disallowedRequisites`](@docroot@/language/advanced-attributes.md#adv-attr-disallowedRequisites), the error message now includes the chain of references that led to the failure. This makes it easier to see in which derivations the chain can be broken, to resolve the problem.
+
+Example:
+
+```
+$ nix-build -A hello
+error: output '/nix/store/0b7k85gg5r28gb54px9nq7iv5986mns9-hello-2.12.2' is not allowed to refer to the following paths:
+       /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.40-66
+       Shown below are chains that lead to the forbidden path(s).
+       /nix/store/0b7k85gg5r28gb54px9nq7iv5986mns9-hello-2.12.2
+       └───/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.40-66
+```
@@ -1,12 +0,0 @@
---
-synopsis: "REPL now uses rustyline"
-cls: [5703]
-category: "Improvements"
-credits: [horrors]
-issues: []
---
-
-The REPL now uses [rustyline](https://github.com/kkawakam/rustyline) for input processing instead
-of editline. This comes with some improvements to REPL behavior: wrapping lines no longer confuse
-the line editor, unicode is fully supported, pasting multiline expressions is noew possible, even
-undo commands are now available! We plan to improve the REPL further using these newfound powers.
@@ -0,0 +1,17 @@
+---
+synopsis: "libstore/binary-cache-store: don't cache narinfo on nix copy, remove negative entry"
+issues: []
+cls: [3789]
+category: Fixes
+credits: [ma27]
+---
+
+When using e.g. [Snix's nar-bridge](https://snix.dev/docs/components/overview/#nar-bridge) via
+an `http`-store, Lix would create cache entries with a wrong URL to the NAR when uploading
+a store-path.
+
+This caused hard build failures for Hydra.
+
+Lix doesn't create these entries on upload anymore. Instead, it only removes negative cache entries.
+The cache entry for a narinfo is now created the first time, Lix queries the cache
+for the previously uploaded store-path again.
@@ -0,0 +1,10 @@
+---
+synopsis: "Lix libraries can now be linked statically"
+issues: [fj#789]
+cls: [3775, 3778]
+category: Fixes
+credits: [alois31]
+---
+Previously the pkg-config files distributed with Lix were only suitable for dynamic linkage, causing "undefined reference to…" linker errors when trying to link statically.
+Private dependency information has now been added to make static linkage work as expected without user intervention.
+In addition, relevant static libraries are now prelinked to avoid strange failures due to missing static initializers.
@@ -1,11 +0,0 @@
---
-synopsis: "Hash mismatch diagnostics now work with `structuredAttrs`"
-issues: [fj#1175]
-cls: [5441]
-category: Fixes
-credits: [keysmashes]
---
-
-Nixpkgs fetchers like `fetchurl` now use `structuredAttrs`, which broke the
-hash mismatch diagnostics added in Lix 2.91. This has been fixed and the likely
-URL is now shown again.
@@ -0,0 +1,34 @@
+---
+synopsis: Symbols reuses once-allocated Value to reduce garbage collected allocations
+issues: []
+cls: [3308, 3300, 3314, 3310, 3312, 3313]
+category: Improvements
+credits: [raito, horrors, thubrecht, xokdvium, nan-git]
+---
+
+In the Lix evaluator, **symbols** represent immutable strings, like those used
+for attribute names.
+
+In evaluator design, such strings are typically [**interned**](https://en.wikipedia.org/wiki/String_interning), stored uniquely
+to save memory, and Lix inherits this approach from the original C++ codebase.
+
+However, some builtins, like `builtins.attrNames`, must return a `Value` type
+that can represent any Nix value (strings, integers, lists, etc.).
+
+Before this change, these builtins would create lists of `Value` objects by
+allocating them through the garbage collector, copying the symbol’s string
+content each time.
+
+This allocation is unnecessary if the interned symbols themselves also hold a
+`Value` representation allocated outside the garbage collector, since these
+live for the full duration of evaluation.
+
+As a result, this reduces the number of allocations, leading to:
+
+* A significant drop in maximum [resident set memory](https://en.wikipedia.org/wiki/Resident_set_size) (RSS), with some large-scale
+  tests showing up to 11% (about 500 MiB) savings in large colmena deployments.
+* A slight decrease in CPU usage during Nix evaluations.
+
+This change is inspired by https://github.com/NixOS/nix/pull/13258 but the approach is different.
+
+**Note** : [`xokdvium`](https://github.com/xokdvium) is the rightful author of https://gerrit.lix.systems/c/lix/+/3300 and the credit was missed on our end during the development process. We are deeply sorry for this mistake.
@@ -0,0 +1,14 @@
+---
+synopsis: Reject overflowing TOML integer literals
+issues: []
+cls: [3916]
+category: "Breaking Changes"
+credits: [emilazy]
+---
+
+The toml11 library used by Lix was updated. The new
+version aligns with the [TOML v1.0.0 specification’s
+requirement](https://toml.io/en/v1.0.0#integer) to reject integer
+literals that cannot be losslessly parsed. This means that code like
+`builtins.fromTOML "v=0x8000000000000000"` will now produce an error
+rather than silently saturating the integer result.
@@ -1,18 +0,0 @@
---
-synopsis: "Changes to `flake.nix` validation"
-cls: [5523]
-category: "Breaking Changes"
-credits: [piegames, Qyriad, horrors]
-issues: [gh#4945]
---
-
-Flakes try to keep their inputs and metadata "simple", to make sure no unbounded computation may happen when calling e.g. `nix flake show`.
-Those checks were haphazard, a maintenance burden, and also easily circumventable.
-
-Lix has now replaced all the old checks by a simple rule: **No function calls outside of `outputs`.**
-This is easier to reason about than the previous set of inconsistent rules, and crucially now also allows syntax features that users felt like they *should* have worked in the past, like let bindings.
-However, some warts still remain for now: Some syntax constructs like `-1` internally desugar to `__sub 0 1`, which is a function call and thus remains forbidden.
-This will be rectified as soon as the deprecation period of the respective anti-features has been completed.
-
-This change is **breaking** in the sense that flakes which are written with the newly allowed language features will not evaluate with an older Lix version which still uses the old, more restrictive checks.
-Crucially, this also affects **all transitive dependants** of such Flakes.
@@ -0,0 +1,15 @@
+---
+synopsis: uid-range depends on cgroups
+issues: []
+cls: [3230]
+category: "Breaking Changes"
+credits: [raito, horrors]
+---
+
+`uid-range` builds now depends on `cgroups`, an experimental feature.
+
+`uid-range` builds already depended upon `auto-allocate-uids`, another experimental feature.
+
+The rationale for doing so is that `uid-range` provides a sandbox with many
+UIDs, this is useful for re-mapping them into a nested namespace, e.g. a
+container.
@@ -1,28 +0,0 @@
---
-synopsis: "Fix unsigned overflow leading to out-of-band write in the NAR parser"
-cls: [5554]
-category: "Fixes"
-credits: [horrors, raito, edef, sandydoo]
-issues: []
---
-
-The NAR parser contained an unsigned integer overflow that could be used by an
-attacker to write arbitrary data to an unknown memory location and possibly
-achieve code execution. A successful attack on the system-wide Lix daemon
-could lead to privilege escalation to root. Any process that involves NAR
-serialization could trigger this issue, including (but not limited to)
-
-  - local user interaction, whether the users are trusted or untrusted
-  - malicious substituters sending malformed NARs
-  - remote builders sending malformed build results
-  - remote daemons sending malformed inputs when requesting remote builds
-
-Successful attacks using this bug require ASLR weakening of some sort, whether
-by architecture constraints (e.g. on 32 bit systems, where little randomization
-is possible) or system configuration (e.g. low ASLR entropy when loading
-libraries), and millions of attempts. Local attacks can be mounted in less than
-an hour. Remote builds typically require a fresh SSH connection for each build
-and are thus less susceptible. Only one attempt can be made by substituters for
-every build using substituters, they are thus not a likely vector for attacks.
-
-At the time of writing, MITRE has not assigned this a CVE yet.
@@ -1,23 +0,0 @@
---
-synopsis: "Always print frames from `addErrorContext` in error traces"
-cls: [5847]
-category: "Improvements"
-credits: [blokyk]
-issues: []
---
-
-The [`builtins.addErrorContext`](@docroot@/language/builtins.md#builtins-addErrorContext)
-function allows an author to add artificial stack frames with custom messages to
-help end-users understand the context of an error and the path the code took to
-get there, without having to read and understand the original source code. A
-particularly notable user of this is the Nixpkgs module system, which adds
-custom frames detailing what option it's evaluating or which definition it's
-looking at.
-
-However, previously, these frames would end up treated just as any other,
-meaning they would most often not be visible without `--show-trace`; yet, using
-`--show-trace`, they would be drowned out in the noise of the hundreds of other
-frames, rendering them just as unusable.
-
-With this change, these frames are now unconditionally shown, even without
-`--show-trace`, which makes basic error traces much more informative.
@@ -0,0 +1,10 @@
+---
+synopsis: add description to zsh completions
+issues: [fj#910]
+cls: [3632]
+category: "Fixes"
+credits: [matthewbauer]
+---
+
+Emit descriptions when completing args in zsh completions. This uses the descriptions we already
+provided in NIX\_GET\_COMPLETIONS.
@@ -39,9 +39,6 @@
  - [Tuning Cores and Jobs](advanced-topics/cores-vs-jobs.md)
  - [Verifying Build Reproducibility](advanced-topics/diff-hook.md)
  - [Using the `post-build-hook`](advanced-topics/post-build-hook.md)
-  - [Pasta](advanced-topics/pasta.md)
- [Known Issues](known-issues/known-issues.md)
-  - [Limitations around non-isolated builds](known-issues/non-isolated-build-limits.md)
 - [Command Reference](command-ref/command-ref.md)
  - [Common Options](command-ref/opt-common.md)
  - [Common Environment Variables](command-ref/env-common.md)
@@ -200,8 +197,6 @@
 - [Release Notes](release-notes/release-notes.md)
  - [Upcoming release](release-notes/rl-next.md)
    <!-- RELENG-AUTO-INSERTION-MARKER (see releng/release_notes.py) -->
-  - [Lix 2.95 (2026-03-13)](release-notes/rl-2.95.md)
-  - [Lix 2.94 (2025-11-17)](release-notes/rl-2.94.md)
  - [Lix 2.93 (2025-05-09)](release-notes/rl-2.93.md)
  - [Lix 2.92 (2025-01-18)](release-notes/rl-2.92.md)
  - [Lix 2.91 (2024-08-12)](release-notes/rl-2.91.md)
@@ -41,17 +41,106 @@ contains Nix.
 > If you are building via the Lix daemon (default on Linux and macOS), it is the Lix daemon user account (that is, `root`) that should have SSH access to a user (not necessarily `root`) on the remote machine.
 >
 > Furthermore, `root` needs to have the public host keys for the remote system in its `.ssh/known_hosts`.
-> To add them to `known_hosts` for root, do `ssh-keyscan HOST | sudo tee -a ~root/.ssh/known_hosts`.
+> To add them to `known_hosts` for root, do `ssh-keyscan USER@HOST | sudo tee -a ~root/.ssh/known_hosts`.
 >
 > If you can’t or don’t want to configure `root` to be able to access the remote machine, you can use a private Nix store instead by passing e.g. `--store ~/my-nix` when running a Nix command from the local machine.

-
-## Configuration
-
 The list of remote machines can be specified on the command line or in
-the Lix configuration file. The former is convenient for testing.
-Additionally, there are two supported formats to configure remote builders:
-The legacy, "space"-separated format and starting with Lix 2.95.0, a TOML.
+the Lix configuration file. The former is convenient for testing. For
+example, the following command allows you to build a derivation for
+`x86_64-darwin` on a Linux machine:
+
+```console
+$ uname
+Linux
+
+$ nix build --impure \
+  --expr '(with import <nixpkgs> { system = "x86_64-darwin"; }; runCommand "foo" {} "uname > $out")' \
+  --builders 'ssh://mac x86_64-darwin'
+[1/0/1 built, 0.0 MiB DL] building foo on ssh://mac
+
+$ cat ./result
+Darwin
+```
+
+It is possible to specify multiple builders separated by a semicolon or
+a newline, e.g.
+
+```console
+  --builders 'ssh://mac x86_64-darwin ; ssh://beastie x86_64-freebsd'
+```
+
+Each machine specification consists of the following elements, separated
+by spaces. Only the first element is required. To leave a field at its
+default, set it to `-`.
+
+1.  The URI of the remote store in the format
+    `ssh://[username@]hostname[?port=<port>]`, e.g. `ssh://nix@mac` or `ssh://mac`.
+    If the ssh server is not listening on port 22 (e.g. port 1337 in this case)
+    the URI would be `ssh://nix@mac?port=1337`
+    For backward compatibility, `ssh://` may be omitted. The hostname
+    may be an alias defined in your `~/.ssh/config`.
+
+2.  A comma-separated list of Nix platform type identifiers, such as
+    `x86_64-darwin`. It is possible for a machine to support multiple
+    platform types, e.g., `i686-linux,x86_64-linux`. If omitted, this
+    defaults to the local platform type.
+
+3.  The SSH identity file to be used to log in to the remote machine. If
+    omitted, SSH will use its regular identities.
+
+4.  The maximum number of builds that Lix will execute in parallel on
+    the machine. Typically this should be equal to the number of CPU
+    cores. For instance, the machine `itchy` in the example will execute
+    up to 8 builds in parallel.
+
+5.  The “speed factor”, indicating the relative speed of the machine. If
+    there are multiple machines of the right type, Lix will prefer the
+    fastest, taking load into account.
+
+6.  A comma-separated list of *supported features*. If a derivation has
+    the `requiredSystemFeatures` attribute, then Lix will only perform
+    the derivation on a machine that has the specified features. For
+    instance, the attribute
+
+    ```nix
+    requiredSystemFeatures = [ "kvm" ];
+    ```
+
+    will cause the build to be performed on a machine that has the `kvm`
+    feature.
+
+7.  A comma-separated list of *mandatory features*. A machine will only
+    be used to build a derivation if all of the machine’s mandatory
+    features appear in the derivation’s `requiredSystemFeatures`
+    attribute.
+
+8.  The (base64-encoded) public host key of the remote machine. If omitted, SSH
+    will use its regular known-hosts file. Specifically, the field is calculated
+    via `base64 -w0 /etc/ssh/ssh_host_ed25519_key.pub`.
+
+For example, the machine specification
+
+    nix@scratchy.labs.cs.uu.nl  i686-linux      /home/nix/.ssh/id_scratchy_auto        8 1 kvm
+    nix@itchy.labs.cs.uu.nl     i686-linux      /home/nix/.ssh/id_scratchy_auto        8 2
+    nix@poochie.labs.cs.uu.nl   i686-linux      /home/nix/.ssh/id_scratchy_auto        1 2 kvm benchmark
+
+specifies several machines that can perform `i686-linux` builds.
+However, `poochie` will only do builds that have the attribute
+
+```nix
+requiredSystemFeatures = [ "benchmark" ];
+```
+
+or
+
+```nix
+requiredSystemFeatures = [ "benchmark" "kvm" ];
+```
+
+`itchy` cannot do builds that require `kvm`, but `scratchy` does support
+such builds. For regular builds, `itchy` will be preferred over
+`scratchy` because it has a higher speed factor.

 Remote builders can also be configured in `nix.conf`, e.g.

@@ -70,180 +159,3 @@ option `builders-use-substitutes` in your local `nix.conf`.

 To build only on remote builders and disable building on the local
 machine, you can use the option `--max-jobs 0`.
-
---
-
-Each machine specification consists of the following attributes.
-How those are combined within the configuration file differs for the formats, and will be explained further down.
-
-1.  `uri` (**required**)
-    The URI of the remote store in the format
-    `ssh[-ng]://[username@]hostname[?port=<port>]`, e.g. `ssh://nix@mac` or `ssh://mac`.
-    If the ssh server is not listening on port 22 (e.g. port 1337 in this case)
-    the URI would be `ssh[-ng]://nix@mac?port=1337`. The hostname
-    may be an alias defined in your `~/.ssh/config`.
-
-2.  `system-types` (**optional**)
-    A list of Nix platform type identifiers, such as
-    `x86_64-darwin`. It is possible for a machine to support multiple
-    platform types, e.g., `i686-linux` and `x86_64-linux`.
-
-    Defaults to the local platform type
-
-3.  `ssh-key` (**optional**)
-    The SSH identity file to be used to log in to the remote machine.
-
-    Defaults to SSHs regular identities.
-
-4.  `jobs` (**optional**)
-    The maximum number of builds that Lix will execute in parallel on
-    the machine. Typically, this should be equal to the number of CPU
-    cores divided by the cores within the target machines configuration, i.e. `jobs * cores ~= cpu cores`
-
-    Defaults to 1; must be a positive integer.
-
-5.  `speed-factor`
-    The “speed factor”, indicating the relative speed of the machine. If
-    there are multiple machines of the right type, Lix will prefer the
-    fastest, taking load into account.
-
-    Defaults to 1; must be a positive float.
-
-6.  `supported-features` (**optional**)
-    A list of *supported features*. If a derivation has
-    the `requiredSystemFeatures` attribute, then Lix will only schedule
-    the derivation on a machine that has the specified features. For
-    example, the attribute
-
-    ```nix
-    requiredSystemFeatures = [ "kvm" ];
-    ```
-
-    will cause the build to be performed on a machine that has the `kvm`
-    feature.
-
-    Defaults to an empty list.
-
-7.  `mandatory-features` (**optional**)
-    A list of *mandatory features*. A machine will only
-    be used to build a derivation if all the machine’s mandatory
-    features appear in the derivation’s `requiredSystemFeatures`
-    attribute.
-
-    Defaults to an empty list.
-
-8.  `ssh-public-host-key` (**optional**)
-    The public host key of the remote machine.
-
-    Defaults to basic ssh behavior (checking contents of the known-hosts file)
-
-
-### Using a TOML configuration
-
-Each machine is configured as an attribute within the map called `machines`.
-The attributes name is the machines name.
-Attributes can be in any order.
-
-For example:
-
-```toml
-version = 1
-
-[machines.andesite]
-uri = "ssh://lix@andesite.lix.systems" # toml also allows for comments
-system-types = ["i686-linux"]
-jobs = 8
-speed-factor = 1.0
-supported-features = ["kvm"]
-ssh-key = "/home/deepslate/.ssh/id_ed25519"
-
-[machines.diorite]
-uri = "ssh://lix@diorite.lix.systems"
-system-types = ["i686-linux"]
-jobs = 8
-speed-factor = 2.0
-ssh-key = "/home/deepslate/.ssh/id_ed25519"
-
-[machines.granite]
-uri = "ssh://lix@granite.lix.systems"
-system-types = ["i686-linux"]
-jobs = 1
-speed-factor = 2.0
-supported-features = ["kvm", "benchmark"]
-ssh-key = "/home/deepslate/.ssh/id_ed25519"
-
-[machines.legacy]
-uri = "ssh://nix@nix-15-11.nixos.org"
-enable = false
-
-```
-
-> **Note**
->
-> If the version tag is omitted (e.g. in the CLI), it defaults to the latest version.
-> It is strongly recommended to always provide a version tag for configuration within files to avoid breakage.
-
-For testing purposes, one can also define a builder ad hoc on the CLI as follows:
-`--builders 'machines.andesite = {uri = "ssh://lix@andesite.lix.systems", jobs = 8}'`
-
-
-#### Special handling of fields
- - `enable` (**optional**)
-    If set to false, the declared machine will not be loaded.
-    This allows one to statically disable machines.
-
-    Defaults to true
-
-### Using the legacy format
-> **Warning**
->
-> This format is frozen and new features / configuration options will not be backported to this format.
-
-It is possible to specify multiple builders separated by a semicolon or
-a newline, e.g.
-
-```console
-  --builders 'ssh://mac x86_64-darwin ; ssh://beastie x86_64-freebsd'
-```
-
-Every machine specification consists of the elements listed in the section above, seperated by any amount of spaces or tabs.
-The Attributes need to be provided **in order** and without names.
-To leave a field at its default, set it to `-`.
-Lists are colon seperated, without additional spaces.
-
-```
-lix@andesite.lix.systems    i686-linux      /home/deepslate/.ssh/id_ed25519        8 1 kvm
-lix@diorite.lix.systems     i686-linux      /home/deepslate/.ssh/id_ed25519        8 2
-lix@granite.lix.systems     i686-linux      /home/deepslate/.ssh/id_ed25519        1 2 kvm benchmark
-```
-
-#### Special handling of fields
- `uri`: Due to backward compatibility, the `ssh://` may be omitted for the store-uri.
- `ssh-public-host-key`: The key must be provided encoded in base64. Specifically calculated via `base64 -w0 /etc/ssh/ssh_host_ed25519_key.pub`
-
-
-### Format detection
-
-At first, the given configuration is being parsed syntactically as a toml.
-If parsing fails and the given configuration contains a `"` the error is presented to the user, as those characters are necessary for TOML, but disallowed for the legacy format.
-Otherwise, parsing is retried using the legacy format.
-If non-syntactic errors are detected within the toml, the exception will always be shown to the user directly.
-
-
-## Builder selection
-The configuration(s) above specify several machines that can perform `i686-linux` builds.
-However, `granite` will only do builds that have the attribute
-
-```nix
-requiredSystemFeatures = [ "benchmark" ];
-```
-
-or
-
-```nix
-requiredSystemFeatures = [ "benchmark" "kvm" ];
-```
-
-`diorite` cannot do builds that require `kvm`, but `andesite` does support
-such builds. For regular builds, `diorite` will be preferred over
-`andesite` because it has a higher speed factor.
@@ -1,19 +0,0 @@
-# [Pasta](https://passt.top/passt/about/): a network sandbox for fixed-output derivations
-
-## Introduction
-
-This section only applies to **Linux systems** as Pasta is a Linux-only measure.
-
-Since [CVE-2025-46416](https://lix.systems/blog/2025-06-24-lix-cves/), the Lix project decided to adopt [Pasta](https://passt.top/passt/about/) for all fixed-output derivations, protecting against various attack vectors such as UNIX abstract domain sockets or more manipulation at the network layer from a malicious fixed-output derivation code.
-
-Pasta acts as a translation layer between a layer-2 network interface and layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on the host. It requires no special privileges and can serve as a alternative to [SLiRP](https://en.wikipedia.org/wiki/Slirp) which was used [by Guix to mitigate the same problem](https://codeberg.org/guix/guix/commit/fb42611b8f27960304db5a1c0d33b8371dcde2a8).
-
-## How to disable Pasta?
-
-It's sufficient to pass `pasta-path = ""` in your `/etc/nix/nix.conf` or on the command line `--pasta-path ""` of a Lix invocation.
-
-## Known issues surrounding Pasta
-
- Only the first DNS server in `/etc/resolv.conf` is considered: failover is not possible.
- [Reduced feature set compared to the Linux kernel](https://passt.top/passt/about/#features)
- [Performance overhead in multi-gigabits contexts and IMIX MTUs](https://passt.top/passt/about/#performance_1)
@@ -58,7 +58,7 @@ $ nix-build flake:nixpkgs -A firefox
 $ nix-build flake:github:NixOS/nixpkgs/release-23.11 -A firefox
 ```

-Finally, for legacy reasons, if a path starts with `channel:`, the rest of the argument is interpreted as the name of a *nixpkgs* channel tarball to fetch from `https://channels.nixos.org/$CHANNEL_NAME/nixexprs.tar.xz`.
+Finally, for legacy reasons, if a path starts with `channel:`, the rest of the argument is interpreted as the name of a *nixpkgs* channel tarball to fetch from `https://nixos.org/channels/$CHANNEL_NAME/nixexprs.tar.xz`.
 This is a **hard coded URL** pattern and is *not* related to the subscribed channels managed by the [nix-channel](./nix-channel.md) command.

 > **Note**: any of the special syntaxes may always be disambiguated by prefixing the path.
@@ -11,7 +11,7 @@
 Channels are a mechanism for referencing remote Nix expressions and conveniently retrieving their latest version.

 The moving parts of channels are:
- The official channels listed at <https://channels.nixos.org>
+- The official channels listed at <https://nixos.org/channels>
 - The user-specific list of [subscribed channels](#subscribed-channels)
 - The [downloaded channel contents](#channels)
 - The [Nix expression search path](@docroot@/command-ref/conf-file.md#conf-nix-path), set with the [`-I` option](#opt-I) or the [`NIX_PATH` environment variable](#env-NIX_PATH)
@@ -77,9 +77,9 @@ This command has the following operations:
 Subscribe to the Nixpkgs channel and run `hello` from the GNU Hello package:

 ```console
-$ nix-channel --add https://channels.nixos.org/nixpkgs-unstable
+$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
 $ nix-channel --list
-nixpkgs https://channels.nixos.org/nixpkgs
+nixpkgs https://nixos.org/channels/nixpkgs
 $ nix-channel --update
 $ nix-shell -p hello --run hello
 hello
@@ -177,12 +177,6 @@ Most commands in Lix accept the following command-line options:
  You can override this using `--arg`, e.g., `nix-env --install --attr pkgname --arg system \"i686-freebsd\"`.
  (Note that since the argument is a Nix string literal, you have to escape the quotes.)

-  Additionally, dots are interpreted as attribute-path separators.
-  I.e. `nix-instantiate '<nixpkgs>' -A hello-unfree --arg config.allowUnfree true` will result in an argument `config` with value `{ allowUnfree = true; }` being passed to `<nixpkgs>`.
-
-  Please note that merging of different arguments is rejected.
-  I.e. `--arg config '{ cudaSupport = true; }' --arg config.allowUnfree true` will not work whereas `--arg config.cudaSupport true --arg config.allowUnfree true` is accepted.
-
 - <span id="opt-argstr">[`--argstr`](#opt-argstr)</span> *name* *value*

  This option is like `--arg`, only the value is not a Nix expression but a string.
@@ -19,7 +19,7 @@ This description is not normative, but a feature removal may roughly happen like
 1. Add a warning when the feature is being used.
 2. Disable the feature by default, putting it behind a deprecated feature flag.
  - If disabling the feature started out as an opt-in experimental feature, turn that experimental flag into a no-op or remove it entirely.
-    For example, `--extra-experimental-features no-url-literals` becomes `--extra-deprecated-features url-literals`.
+    For example, `--extra-experimental-features=no-url-literals` becomes `--extra-deprecated-features=url-literals`.
 3. Decide on a time frame for how long that feature will still be supported for backwards compatibility, and clearly communicate that in the error messages.
  - Sometimes, automatic migration to alternatives is possible, and such should be provided if possible
  - At least one NixOS release cycle should be the minimum
@@ -51,64 +51,28 @@ $ nix-shell -A native-clangStdenvPackages

 ### Building from the development shell

-We have a [justfile](https://just.systems/) for extra convenient building.
-It defaults to using `./build` as the build directory, and `$out` (`./outputs/out`) as the install directory.
-For most cases, you can clean-build, install, and run the tests with:
-
-```bash
-$ just setup --wipe && just test
-```
-
-> **Note**
->
-> The `--wipe` argument to `meson setup` conveniently works whether you have an existing build directory or not.
->
-> However, it is *mostly*, but not *exactly* equivalent to deleting the build directory first.
-> In particular, previously specified `-D` build options are **preserved** with `--wipe` (for some reason).
-> For example, if you fetch and checkout a new version of Lix, and that new version *removes* a Meson build option from `./meson.options`, *and* a previous invocation in that build directory explicitly set that option, then `meson setup --wipe build` will error, complaining about the unknown option.
-> For these cases, `just clean` will give you a well-and-truly-this-time-for-real clean build.
-
-Because the integration tests require installation to work, `just test` automatically also calls `just install`, and Meson helpfully will automatically build any targets that need building when trying to install them.
-
-You can override the build directory or install directory by setting the justfile [variables](https://just.systems/man/en/setting-variables-from-the-command-line.html) `outdir` and `builddir` on the command-line:
-
-```bash
-$ just builddir=build-before-bisect outdir=out-before-bisect setup
-$ just builddir=build-before-bisect test
-```
-
-You'll have to set `builddir` for every target, but `outdir` only needs to be set for `setup`.
+Run a clean build and test with `just clean setup build install test`.

 You can also run the unit tests and integration tests separately:

 ```bash
-$ just setup
-$ just test-unit
-$ just test-integration
+$ just setup build test-unit
+$ just install test-integration
 ```

-Most justfile targets forward all further arguments to the underlying Meson invocation.
+Many justfile aliases have a `-custom` variant which pass extra arguments to `meson`.
 For example, to work on both Lix and nix-eval-jobs you can run:

-```bash
-$ just setup -Dnix-eval-jobs=enabled
+```
+$ just setup-custom -Dnix-eval-jobs=enabled
+$ # or
+$ mesonFlags=-Dnix-eval-jobs=enabled just setup
 ```

-Note that only targets which *don't* accept extra arguments can have other targets following them.
-`just clean setup` is equivalent to `just clean && just setup`, but `just build test` runs the `build` target with the argument `test`.
-This means that if you want to, for example, build with lower parallelism, and then test, you will have to do something like this:
-
-```bash
-$ just build -j4
-$ just test
-```
-
-Finally, the rewrite of the integration test suite, functional2, also has its own justfile target which allows passing extra arguments to pytest.
-For example, to collect and list all functional2 tests without running them, you can pass pytest's `--collect-only` argument:
-
-```bash
-$ just test-functional2 --collect-only
-```
+Note that only targets which don't accept extra arguments can be used when
+running multiple targets at once; `just setup build` is fine, but `just
+setup-custom build` is an error. The `test` target is usually the last one to
+run, so it always accepts extra arguments.

 You can also build Lix manually:

@@ -177,21 +141,6 @@ To inspect the canonical source of truth on what the state of the buildsystem co
 $ meson introspect
 ```

-#### LLD
-
-The development shell on Linux uses LLD by default for faster link times.
-This is set using `mesonFlags`, so to override it, you can simplify re-specify the linker to Meson:
-
-```bash
-$ just setup -Dc_link_args=-fuse-ld=ld -Dcpp_link_args=-fuse-ld=ld
-```
-
-While using LLD, you may find it helpful to use ThinLTO for even further improvements to link times for incremental builds:
-
-```bash
-$ just setup -Db_lto=true -Db_lto_mode=thin -Db_thinlto_cache=true
-```
-
 ## Sending changes to Gerrit for review {#sending-to-gerrit}

 We use Gerrit for all our code review in Lix.
@@ -200,7 +149,7 @@ Our instance is at <https://gerrit.lix.systems>.
 There's much more information about how to use Gerrit in the [wiki section on Gerrit][wiki-gerrit] including how to use Jujutsu, how to use the UI and more.
 The Snix project also has some Gerrit information [in their contributing docs][snix-gerrit].

-[wiki-gerrit]: https://wiki.lix.systems/books/contributing/chapter/intro-to-gerrit
+[wiki-gerrit]: https://wiki.lix.systems/books/lix-contributors/chapter/gerrit
 [snix-gerrit]: https://snix.dev/docs/guides/contributing/

 The gist is that once you have your SSH key and git remote set up, you can send commits for review with:
@@ -221,14 +170,6 @@ Once you get a `Code-Review+2` vote on your change, it's rebased on `main` and C
 If the change appears as "Rebase Required", you need to rebase it on `main` locally or via the Gerrit UI and wait for `Verified+1` before the Submit button is made active
 The `Code-Review+2` from before will stick around through trivial rebases so no need to re-request review for a mere rebase.

-## Interacting with the CI, Buildkite
-
-We use Buildkite for our CI, usually you will not have to interact directly with it other than reviewing any errors it produces, which are linked from Gerrit.
-
-However in certain cases a CI run will fail due to transient issues not related to your code and you will need to rerun it by hand.
-You can log in to the CI via [SSO](https://buildkite.com/sso/afnix). On your job you can then hit the "Retry failed" button to rerun it, normally you will not have a repeat of the transient issue.
-If the build still fails on CI issues or all builds are failing this should be reported via [Zulip on #T-infra](https://zulip.lix.systems/#narrow/channel/7-T-infra) or [Matrix on #dev](https://matrix.to/#/%23dev%3Alix.systems?via=lix.systems).
-
 ## Building Lix with `nix`

 To build a release version of Lix for the current operating system and CPU architecture:
@@ -566,7 +507,7 @@ Then add the new file there, and don't forget to register it in the appropriate
 The following metadata properties are supported for builtin functions:
 * `name` (required): the language-facing name (as a member of the `builtins` attribute set) of the function.
 * `implementation` (optional): a C++ expression specifying the implementation of the builtin.
-  It must be a function of signature `Value(EvalState &, PosIdx, Value * *)`.
+  It must be a function of signature `void(EvalState &, PosIdx, Value * *, Value &)`.
  If not specified, defaults to `prim_${name}`.
 * `renameInGlobalScope` (optional): whether the definition should be "hidden" in the global scope by prefixing its name with two underscores.
  If not specified, defaults to `true`.
@@ -62,12 +62,6 @@ For `installcheck` specifically, first run `just install` before running the tes

 Finer-grained filtering within a test suite is also possible using the [--gtest_filter](https://google.github.io/googletest/advanced.html#running-a-subset-of-the-tests) command-line option to a test suite executable, or the `GTEST_FILTER` environment variable.

-### Inspecting failures
-
-The test suite emits logs in `build/meson-logs/`; the full textual failure logs are in `build/meson-logs/testlog.txt`.
-
-If you want a much nicer experience of viewing the logs in a structured manner, use `xunit-viewer --results build/meson-logs/testlog.junit.xml --server` to view them in a web browser.
-
 ### Unit test support libraries

 There are headers and code which are not just used to test the library in question, but also downstream libraries.
@@ -383,10 +377,7 @@ I grepped `lix/` for `get[eE]nv\("` to find the mentions in Lix code.
  Overrides compile-time configuration of various locations used by Lix. See `lix/libstore/globals.cc`.

  **Expected value**: a directory
- `LIX_DAEMON_SOCKET_DIR` (optional) - Overrides the daemon socket directory from `$NIX_STATE_DIR/daemon-socket`.
-
-  **Expected value**: a directory
- `NIX_DAEMON_SOCKET_PATH` (optional) - Overrides the daemon socket path from `$NIX_STATE_DIR/daemon-socket/socket`. Ignored if `LIX_DAEMON_SOCKET_DIR` is set.
+- `NIX_DAEMON_SOCKET_PATH` (optional) - Overrides the daemon socket path from `$NIX_STATE_DIR/daemon-socket/socket`.

  **Expected value**: path to a socket
 - `NIX_LOG_FD` (output) - An FD number for logs in `internal-json` format to be sent to.
@@ -404,6 +395,7 @@ I grepped `lix/` for `get[eE]nv\("` to find the mentions in Lix code.

  **Expected value**: the path to an executable shell
 - `PRINT_PATH` - Undocumented. Used by `nix-prefetch-url` as an alternative form of `--print-path`. Why???
+- `_NIX_IN_TEST` - If present with any value, makes `fetchClosure` accept file URLs in addition to HTTP ones. Why is this not `_NIX_FORCE_HTTP`??

  Not used anywhere else.
 - `NIX_ALLOW_EVAL` - Used by eval-cache tests to block evaluation if set to `0`.
@@ -89,7 +89,7 @@

  [store path]: #gloss-store-path

- [file system object]{#gloss-file-system-object}
+- [file system object]{#gloss-store-object}

  The Nix data model for representing simplified file system data.

@@ -60,10 +60,3 @@ Then:
 ```console
 $ docker run -ti lix
 ```
-
-# Known issues
-
-Lix in Docker is very sensitive to **functional** DNS resolution if you are running with [Pasta protections](../advanced-topics/pasta.md) which are enabled by default since Lix 2.93.0 on most distributions.
-If you notice failure to download things, double check whether your **first** DNS entry in `/etc/resolv.conf` is functional.
-
-Lix with [Pasta protections](../advanced-topics/pasta.md) does not support failing over the next entries.
@@ -50,6 +50,10 @@ The most current alternative to this section is to read `package.nix` and see wh
  - The `boost` library of version 1.66.0 or higher. It can be obtained
    from the official web site <https://www.boost.org/>.

+  - The `editline` library of version 1.14.0 or higher. It can be
+    obtained from the its repository
+    <https://github.com/troglobit/editline>.
+
  - Recent versions of Bison and Flex to build the parser. (This is
    because Nix needs GLR support in Bison and reentrancy support in
    Flex.) For Bison, you need version 2.6, which can be obtained from
@@ -1 +0,0 @@
-This section lists known issues around Lix.
@@ -1,21 +0,0 @@
-# Limitations of non-isolated builds
-
-## What are non-isolated builds?
-
-In Lix, only builds done on Linux with `sandbox = true` and a functioning
-`pasta-path` are isolated from the rest of the system, all other builds are
-considered non-isolated to some degree.
-
-For example, running Lix with [Pasta](@docroot@/advanced-topics/pasta.md)
-disabled makes the host network visible to fixed-output derivations, reducing
-isolation somewhat.
-
-## Clean termination of non-isolated builds
-
-Non-isolated builds may not terminate cleanly in all cases due to limitations in Lix's process management.
-
-This occurs when a build keeps the build log file descriptor open past the end of the actual build. A common cause of this are background tasks that aren't properly terminated before the main build process exits, for example: HTTP servers run as part of a test suite.
-
-See [issue #1018](https://git.lix.systems/lix-project/lix/issues/1018) for an example.
-
-The only solution is to manually terminate leftover processes in your derivation, including during failure scenarios.
@@ -17,12 +17,6 @@ the attributes of which specify the inputs of the build.
    string. This is used as a symbolic name for the package by
    `nix-env`, and it is appended to the output paths of the derivation.

-    > **Note**
-    >
-    > Names can only contain alphanumerical characters (0-9, a-z, A-Z)
-    > as well as `+`, `-`, `.`, `_`, `?` and `=`. Names must be neither
-    > `.` nor `..`, and must not start with `.-` or `..-`.
-
  - There must be an attribute named [`builder`]{#attr-builder} that identifies the
    program that is executed to perform the build. It can be either a
    derivation or a source (a local file reference, e.g.,
@@ -164,7 +164,7 @@ Note that lists are only lazy in values, and they are strict in length.

 An attribute set is a collection of name-value-pairs (called *attributes*) enclosed in curly brackets (`{ }`).

-An attribute name can be an identifier or a [double-quoted string](#type-string).
+An attribute name can be an identifier or a [string](#type-string).
 An identifier must start with a letter (`a-z`, `A-Z`) or underscore (`_`), and can otherwise contain letters (`a-z`, `A-Z`), numbers (`0-9`), underscores (`_`), apostrophes (`'`), or dashes (`-`).

 > *name* = *identifier* | *string* \
@@ -5,7 +5,7 @@
 FIXME(Lix): This section does not document the most common modern practices in terms of avoiding channels, pinning, declarative software installation (see flakey-profile or home-manager or NixOS), or using flakes, etc.
 It is, however, likely correct at a technical level.

-For more information on modern practices, see the [resources](https://wiki.lix.systems/books/lix-users/page/nix-resources) page on the Lix site.
+For more information on modern practices, see the [resources](https://lix.systems/resources) page on the Lix site.

 </div>

@@ -41,7 +41,7 @@ install Lix. If this is not the case for some reason, you can add it
 as follows:

 ```console
-$ nix-channel --add https://channels.nixos.org/nixpkgs-unstable
+$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
 $ nix-channel --update
 ```

@@ -49,7 +49,7 @@ $ nix-channel --update
 >
 > On NixOS, you’re automatically subscribed to a NixOS channel
 > corresponding to your NixOS major release (e.g.
-> <https://channels.nixos.org/nixos-21.11>). A NixOS channel is identical
+> <http://nixos.org/channels/nixos-21.11>). A NixOS channel is identical
 > to the Nixpkgs channel, except that it contains only Linux binaries
 > and is updated only if a set of regression tests succeed.

@@ -5,7 +5,7 @@
 FIXME(Lix): This chapter is quite outdated with respect to recommended practices in 2024 and needs updating.
 The commands in here will work, however, and the installation section is up to date.

-For more updated guidance, see the links on <https://wiki.lix.systems/books/lix-users/page/nix-resources>
+For more updated guidance, see the links on <https://lix.systems/resources/>

 </div>

@@ -1,955 +0,0 @@
-# Lix 2.94 "Açaí na tigela" (2025-11-17)
-
-
-# Lix 2.94.0 (2025-11-17)
-## Breaking Changes
-
- Remove support for daemon protocols before 2.18 [fj#510](https://git.lix.systems/lix-project/lix/issues/510) [cl/3249](https://gerrit.lix.systems/c/lix/+/3249)
-
-  Support for daemon wire protocols belonging to Nix 2.17 or older have been
-  removed. This impacts clients connecting to the local daemon socket or any
-  remote builder configured using the `ssh-ng` protocol. Builders configured
-  with the `ssh` protocol are still accessible from clients such as Nix 2.3.
-  Additionally Lix will not be able to connect to an old daemon locally, and
-  remote build connections to old daemons is likewise limited to `ssh` urls.
-
-  We have decided to take this step because the old protocols are very badly
-  tested (if at all), maintenance overhead is high, and a number of problems
-  with their design makes it infeasible to remain backwards compatible while
-  we move Lix to a more modern RPC mechanism with better versioning support.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Remove impure derivations and dynamic derivations [fj#815](https://git.lix.systems/lix-project/lix/issues/815) [cl/3210](https://gerrit.lix.systems/c/lix/+/3210)
-
-  The `impure-derivations` and `dynamic-derivations` experimental feature have
-  been removed.
-
-  New impure or dynamic derivations cannot be created from this point forward, and
-  any such pre-existing store derivations canot be read or built any more.
-  Derivation outputs created by building such a derivation are still valid
-  until garbage collected; existing store derivations can only be garbage
-  collected.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- First argument to `--arg`/`--argstr` must be a valid Nix identifier [fj#496](https://git.lix.systems/lix-project/lix/issues/496)
-
-  The first argument to `--arg`/`--argstr` must be a valid Nix identifier, i.e.
-  `nix-build --arg config.allowUnfree true` is now rejected.
-
-  This is because that invocation is a false friend since it doesn't set
-  `{ config = { allowUnfree = true; }; }`, but `{ "config.allowUnfree" = true; }`.
-
-  The idea is to change the behavior to the latter in the long-term. For that,
-  non-identifiers started giving a warning since 2.92 and are now rejected to give people
-  who depend on that a chance to notice and potentially weigh in on the discussion.
-
-  Many thanks to [ma27](https://git.lix.systems/ma27) for this.
-
- New cgroup delegation model [fj#537](https://git.lix.systems/lix-project/lix/issues/537) [fj#77](https://git.lix.systems/lix-project/lix/issues/77) [cl/3230](https://gerrit.lix.systems/c/lix/+/3230)
-
-  Builds using cgroups (i.e. `use-cgroups = true` and the experimental feature
-  `cgroups`) now always delegate a cgroup tree to the sandbox.
-
-  Compared to the original C++ Nix project, our delegation includes the
-  `subtree_control` file as well, which means that the sandbox can disable
-  certain controllers in its own cgroup tree.
-
-  This is a breaking change because this requires the Nix daemon to run with an
-  already delegated cgroup tree by the service manager.
-
-  ## How to setup the cgroup tree with systemd?
-
-  systemd offers knobs to perform the required setup using:
-
-  ```
-  [Service]
-  Delegate=yes
-  DelegateSubtree=supervisor
-  ```
-
-  These directives are now included in our systemd packaging.
-
-  ## What about using Nix as root without connecting to the daemon?
-
-  Builds run as `root` without connecting to the daemon relying on the cgroup
-  feature are now broken, i.e.
-
-  ```console
-  # nix-build --use-cgroups --sandbox ... # will not work
-  ```
-
-  Consider doing instead:
-
-  ```console
-  # systemd-run --same-dir --wait -p Delegate=yes -p DelegateSubgroup=supervisor nix-build --use-cgroups ...
-  ```
-
-  If you need to disable cgroups temporarily, remember that you can do
-  `NIX_CONF='include /etc/nix/nix.conf\nuse-cgroups = false' nix-build ...` or
-  `nix-build --no-use-cgroups ...`.
-
-  ## What about other service managers than systemd?
-
-  systemd has a [documentation](https://systemd.io/CGROUP_DELEGATION/) on how to
-  handle cgroup delegation from service management perspective.
-
-  If your service manager adheres to systemd semantics, e.g. writing an extended
-  attribute `user.delegate=1` on the delegated cgroup tree directory and moving
-  the `nix-daemon` process inside a cgroup tree to respect the inner process
-  rule, then, the feature will work as well.
-
-  ## Why is the cgroup feature still experimental?
-
-  While the cgroup feature unlocks many use cases, its behavior and integration (e.g. user experience), especially at scale on build farms or in multi-tenant environments, are not yet fully matured. There’s also potential for deeper systemd integration (e.g. using slices and scopes) that has not been fully explored.
-
-  To avoid locking in an unstable interface, we’re keeping the experimental flag until we have validated the feature across a broader range of scenarios, including but not limited to:
-
-  * Nix as root
-  * Hydra-style build farms
-  * Forgejo CI runners
-  * Shared remote builders
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito), [eldritch horrors](https://git.lix.systems/pennae), and [lheckemann](https://git.lix.systems/lheckemann) for this.
-
- Enable high compress ratio zstd compression by default for binary caches uploads [fj#945](https://git.lix.systems/lix-project/lix/issues/945) [cl/4503](https://gerrit.lix.systems/c/lix/+/4503)
-
-  The default compression method for binary cache uploads has been switched from
-  [`xz`](https://github.com/tukaani-project/xz) to
-  [`zstd`](https://github.com/facebook/zstd) to address performance and usability
-  issues related to modern hardware and high-speed connections.
-
-  ## Why?
-
-  `xz` offers compression ratios but is single-threaded in our implementation and
-  very slow (~10-20 Mbps in our test), preventing full utilization of 100Mbps+
-  connections and significantly slowing decompression for end users.
-
-  Lix is a "compress once, decompress many" application: build farms can afford
-  to spend more time compressing to achieve a faster download transfer for the
-  end user. More importantly, it matters that all end users spend the least
-  amount of time decompressing.
-
-  ## What about compression ratios?
-
-  `zstd` cannot achieve the same peaks as `xz`, nonetheless, `zstd` compression
-  level has been increased to level 12 by default to balance compression ratio
-  and performance.
-
-  ## Synthetic test case data
-
-  * **xz** (default compression level) on a 4.4GB file: ~632MB (77s)
-  * **zstd** (level 12) on the same file: ~775MB (18s), 18% larger but 50% faster
-  * **zstd** (level 14): ~773MB (37s)
-  * **zstd** (level 16): ~735MB (66s)
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) and [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Repl debugger uses `--ignore-try` by default [lix#666](https://git.lix.systems/lix-project/lix/issues/666) [cl/3488](https://gerrit.lix.systems/c/lix/+/3488)
-
-  Previously, using the debugger meant that exceptions thrown in `builtins.tryEval` would trigger the debugger.
-
-  However, this caught nixpkgs initialization code, which is unhelpful in the majority of cases, so we changed the default.
-
-  To get the old behaviour, use `--no-ignore-try`.
-
-  ```
-  $ nix repl --debugger --expr 'with import <nixpkgs> {}; pkgs.hello'
-  Lix 2.94.0-dev-pre20250625-9a59106
-  Type :? for help.
-  error: file 'nixpkgs-overlays' was not found in the Nix search path (add it using $NIX_PATH or -I)
-
-  This exception occurred in a 'tryEval' call. Use --ignore-try to skip these.
-
-  Added 13 variables.
-  nix-repl>
-  ```
-
-  Many thanks to [jade](https://git.lix.systems/jade) for this.
-
- Strings may now contain NUL bytes [cl/3968](https://gerrit.lix.systems/c/lix/+/3968)
-
-  Lix now allows strings to contain NUL bytes instead of silently truncating the
-  string before the first such byte. Notably NUL-bearing strings were allowed as
-  attribute names—even though the corresponding strings were not representable!—
-  leading to very surprising and incorrect behavior in corner cases, for example
-
-  ```
-  nix-repl> builtins.fromJSON ''{"a": 1, "a\u0000b": 2}''
-  {
-    a = 1;
-    "ab" = 2;
-  }
-
-  nix-repl> builtins.attrNames (builtins.fromJSON ''{"a": 1, "a\u0000b": 2}'')
-  [
-    "a"
-    "a"
-  ]
-  ```
-
-  rather than the more correct but still with the terminal eating NUL on display
-
-  ```
-  nix-repl> builtins.fromJSON ''{"a": 1, "a\u0000b": 2}''
-  {
-    a = 1;
-    "ab" = 2;
-  }
-
-  nix-repl> builtins.attrNames (builtins.fromJSON ''{"a": 1, "a\u0000b": 2}'')
-  [
-    "a"
-    "ab"
-  ]
-  ```
-
-  We consider this a breaking change since eval results *will* change if strings
-  with embedded NUL bytes were used, but we also consider the old behavior to be
-  not intentional (seeing how inconsistent it was) but merely fallout from a old
-  and misguided implementation decision to be worked around, not actually fixed.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Fixed output derivations can be run using `pasta` network isolation [fj#285](https://git.lix.systems/lix-project/lix/issues/285) [cl/3452](https://gerrit.lix.systems/c/lix/+/3452)
-
-  Fixed output derivations traditionally run in the host network namespace.
-  On Linux this allows such derivations to communicate with other sandboxes
-  or the host using the abstract Unix domains socket namespace; this hasn't
-  been unproblematic in the past and has been used in two distinct exploits
-  to break out of the sandbox. For this reason fixed output derivations can
-  now run in a network namespace (provided by [`pasta`]), restricted to TCP
-  and UDP communication with the rest of the world. When enabled this could
-  be a breaking change and we classify it as such, even though we don't yet
-  enable or require such isolation by default. We may enforce this in later
-  releases of Lix once we have sufficient confidence that breakage is rare.
-
-  [`pasta`]: https://passt.top/
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) and [puck](https://git.lix.systems/puck) for this.
-
- Function equality semantics are more consistent, but still bad [cl/4556](https://gerrit.lix.systems/c/lix/+/4556) [cl/4244](https://gerrit.lix.systems/c/lix/+/4244)
-
-  Lix has inherited a historic misfeature from CppNix in the form of pointer
-  equality checks built into the `==` operator. These checks were originally
-  meant to optimize comparison for large sets, but they have the unfortunate
-  side effect of producing unexpected results when sets containing functions
-  are compared. **Lix 2.93 and earlier** behave as shown in the repl session
-
-  ```
-  Lix 2.93.3
-  Type :? for help.
-  nix-repl> f = x: x
-  Added f.
-
-  nix-repl> f == f
-  false
-
-  nix-repl> let s.f = f; in s.f == s.f
-  false
-
-  nix-repl> # however!
-            { inherit f; } == { inherit f; }
-  true
-
-  nix-repl> [ f ] == [ f ]
-  true
-
-  nix-repl> # and, in another twist:
-            [ f ] == map f [ f ]
-  false
-  ```
-
-  Nixpkgs relies on sets containing functions being comparable, so we cannot
-  simply deprecate this behavior. Due to changes to the object model used by
-  Lix ***all* comparisons above now evaluate to `true`**. This is considered
-  a breaking change because eval results may differ, but we also consider it
-  minor because the optimization is unsound (c.f. `let l = [NaN]; in l == l`
-  evaluates to `true` even though floating point `NaN` is incomparable). Lix
-  intends to remove this optimization altogether in the future, but until we
-  can do that we instead make it slightly less broken to allow other, *real*
-  optimizations. Function equality comparison remains **undefined behavior**
-  and should not be relied upon in Nixlang code that intends to be portable.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- `nix eval --write-to` has been removed [fj#974](https://git.lix.systems/lix-project/lix/issues/974) [fj#227](https://git.lix.systems/lix-project/lix/issues/227) [cl/4045](https://gerrit.lix.systems/c/lix/+/4045)
-
-  `nix eval --write-to` has been removed since it was underspecified, not widely
-  useful, and prone to security-sensitive misbehaviors. The feature was added in
-  Nix 2.4 purely for internal use in the build system. According to our research
-  it hasn't found any use outside of some distribution packaging scripts. Please
-  use structured outputs formats (such as JSON) instead as they have better type
-  fidelity, don't conflate attributes with paths, and are useful to other tools.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Remove the `parse-toml-timestamps` experimental feature
-
-  The `parse-toml-timestamps` experimental feature has been removed.
-
-  This feature used in‐band signalling to mark timestamps, making it
-  impossible to unambiguously parse TOML documents. It also exposed
-  implementation‐defined behaviour in the TOML specification that
-  changed in the toml11 parser library.
-
-  Any interface for parsing TOML timestamps suitable for future
-  stabilization would necessarily involve breaking changes, and there
-  is no evidence this experimental feature is being relied upon in the
-  wild, so it has been removed.
-
-  Many thanks to [Emily](https://git.lix.systems/emilazy) for this.
-
- Reject overflowing TOML integer literals [cl/3916](https://gerrit.lix.systems/c/lix/+/3916)
-
-  The toml11 library used by Lix was updated. The new
-  version aligns with the [TOML v1.0.0 specification’s
-  requirement](https://toml.io/en/v1.0.0#integer) to reject integer
-  literals that cannot be losslessly parsed. This means that code like
-  `builtins.fromTOML "v=0x8000000000000000"` will now produce an error
-  rather than silently saturating the integer result.
-
-  Many thanks to [Emily](https://git.lix.systems/emilazy) for this.
-
- uid-range depends on cgroups [cl/3230](https://gerrit.lix.systems/c/lix/+/3230)
-
-  `uid-range` builds now depends on `cgroups`, an experimental feature.
-
-  `uid-range` builds already depended upon `auto-allocate-uids`, another experimental feature.
-
-  The rationale for doing so is that `uid-range` provides a sandbox with many
-  UIDs, this is useful for re-mapping them into a nested namespace, e.g. a
-  container.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
-
-## Features
-
- Add `inputs.self.submodules` flake attribute [fj#942](https://git.lix.systems/lix-project/lix/issues/942) [cl/3839](https://gerrit.lix.systems/c/lix/+/3839)
-
-  A port of <https://github.com/NixOS/nix/pull/12421> to Lix, which:
-
-  - adds a general `inputs.self` flake attribute that retroactively applies
-    configurations to a flake after it's been fetched, then triggers a refetch of
-    the flake with the new config.
-  - implements `inputs.self.submodules` that allows a flake to declare its need
-    for submodules, which are then fetched automatically with no need to pass
-    `?submodules=1` anywhere.
-
-  Many thanks to [Eelco Dolstra](https://github.com/edolstra) and [ورد](https://git.lix.systems/janw4ld) for this.
-
- Lix supports HTTP/3 behind `--http3` [fj#1033](https://git.lix.systems/lix-project/lix/issues/1033)
-
-  Lix now supports HTTP/3 for file transfers when the linked curl version
-  supports it.
-
-  By default, HTTP/3 is disabled notably due to performance issues reported in
-  mid-2024. [More details
-  here](https://daniel.haxx.se/blog/2024/06/10/http-3-in-curl-mid-2024/).
-
-  As of 2025-11-14, [NixOS official cache](https://cache.nixos.org) supports
-  HTTP/3 via Fastly. [More info
-  here](https://github.com/NixOS/infra/commit/157fa70e46afbd6338a32407be461fce05c57bf8).
-
-  To enable HTTP/3:
-
-  * Use `--http3` for individual transfers.
-  * Add `http3 = true` in your Nix configuration for permanent activation.
-
-  To disable it, use `--no-http3`.
-
-  **Note**:
-
-  * `--no-http2 --http3` will still enable both HTTP/2 and HTTP/3.
-  * `--http2 --http3` will prioritize HTTP/3 and fall back to HTTP/2 (and then
-    HTTP/1.1).
-
-  These are current CLI limitations. In the future, we plan to replace `--httpX`
-  options with `--max-http-version [1,2,3]` for easier version selection in Lix
-  transfers.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Add hyperlinks in attr set printing [cl/3790](https://gerrit.lix.systems/c/lix/+/3790)
-
-  The attribute set printer, such as is seen in `nix repl` or in type errors, now prints hyperlinks on each attribute name to its definition site if it is known.
-
-  Example: all of the attributes shown here are hyperlinks to the exact definition site of the attribute in question:
-
-  ```
-  $ nix eval -f '<nixpkgs>' lib.licenses.mit
-  { deprecated = false; free = true; fullName = "MIT License"; redistributable = true; shortName = "mit"; spdxId = "MIT"; url = "https://spdx.org/licenses/MIT.html"; }
-  ```
-
-  Many thanks to [jade](https://git.lix.systems/jade) for this.
-
- Experimental integer coercion in interpolated strings [cl/3198](https://gerrit.lix.systems/c/lix/+/3198)
-
-  Ever tried interpolating a port number in Lix and ended up with something like this?
-
-  ```nix
-  "http://${config.network.host}:${builtins.toString config.network.port}/"
-  ```
-
-  You're not alone. Thousands of Lix users suffer every day from excessive `builtins.toString` syndrome. It’s 2025, and we still have to cast integers to use them in strings.
-
-  To address this, Lix introduces the **`coerce-integers`** experimental feature. When enabled, interpolated integers within `"${...}"` are automatically coerced to strings. This allows writing:
-
-  ```nix
-  "http://${config.network.host}:${config.network.port}/"
-  ```
-
-  without additional conversion.
-
-  To enable the feature, you need to add `coerce-integers` to your set of experimental features.
-
-  ### Stabilization criteria
-
-  The `coerce-integers` feature is experimental and limited strictly to string interpolation (`"${...}"`). Before stabilization, the following must hold:
-
-  1. **Interpolation-only**
-     Coercion must not occur outside interpolation. Expressions like `"" + 42` must continue to fail.
-
-  2. **Expectation that no explicit cast are being observed**
-     Cases observing explicit coercion (e.g., via `tryEval` gadget or similar) are expected not to be load-bearing in actual production code.
-
-  ### Timeline for stabilization
-
-  If the feature proves safe and is widely adopted across typical usage (e.g., actual configurations in the wild turning on the flag, non-trivial out-of-tree projects using it), the experimental flag will be removed **after six months of active use or two Lix releases**, whichever is longer.
-
-  This avoids locking the feature in experimental status indefinitely, as happened with Flakes, while allowing time for validation and ecosystem integration.
-
-  ### What about coercing floats or more?
-
-  Coercion beyond integers -- such as for floats or other types -- is **not planned**, even under an experimental flag. Questions like "what is the canonical string representation of a float?" involve subtle and context-dependent trade-offs. Without a robust and principled mechanism to define and audit such behavior, introducing broader coercion risks setting unintended and hard-to-reverse precedents. The scope of `coerce-integers` is intentionally narrow and will remain so.
-
-  In terms of outlook, a proposal like https://git.lix.systems/lix-project/lix/issues/835 could pave the way for a better solution.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito), [delroth](https://github.com/delroth), [eldritch horrors](https://git.lix.systems/pennae), and [winter](https://git.lix.systems/winter) for this.
-
- nix-eval-jobs: support `--no-instantiate` flag [fj#987](https://git.lix.systems/lix-project/lix/issues/987)
-
-  `nix-eval-jobs` now supports a flag called `--no-instantiate`. With this enabled,
-  no write operations on the eval store are performed. That means, only evaluation is
-  performed, but derivations (and their gcroots) aren't created.
-
-  Many thanks to [mic92](https://github.com/mic92) and [ma27](https://git.lix.systems/ma27) for this.
-
-
-## Improvements
-
- Assess current profile generations pointers in `nix doctor` [cl/3108](https://gerrit.lix.systems/c/lix/+/3108)
-
-  Added a new check to `nix doctor` that verifies whether the current generation of
-  a Nix profile can be resolved. This helps users diagnose issues with broken or
-  misconfigured profile symlinks.
-
-  This helps determining if you have broken symlinks or misconfigured packaging.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Improved susbtituter query speed
-
-  The code used to query substituters for derivations has been rewritten slightly
-  to take advantage of our asynchronous runtime. Such queries run for every build
-  that could download from substituters and processes every derivation that isn't
-  yet present on the local system. Previously Lix would use `http-connections` to
-  limit query concurrency, even for modern caches that support HTTP/2 and have no
-  limit on how many queries can be run concurrently on one single connection. Lix
-  no longer does this, resulting in approximately 60% reduction in query time for
-  medium-sized closures (e.g. NixOS system closures) during testing, although the
-  exact number depends greatly on local network latency and generally improves as
-  latency increases. Unlike previously setting `http-connections` to `1` or other
-  low values no longer brings a massive penalty in query performance if the cache
-  in use by the querying system supports HTTP/2 (as e.g. `cache.nixos.org` does).
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Hitting Control-C twice always terminates Lix [cl/3574](https://gerrit.lix.systems/c/lix/+/3574)
-
-  Hitting Control-C or sending `SIGINT` to Lix now prints an informational message
-  if it is still running after on second, the second Control-C/`SIGINT` terminates
-  Lix immediately without waiting for any shutdown code to finish running. Lix did
-  not treat the second such event differently from first in the past; this made it
-  impossible to easily terminate running Lix processes that got stuck in e.g. very
-  expensive Nixlang code that never interacted with the store. We now terminate as
-  soon as the user hits Control-C again without waiting any more, to much the same
-  effect as putting Lix into the background and killing it immediately afterwards.
-
-  This means you can now more conveniently break out of stuck Nixlang evaluations:
-  ```
-  ❯ nix-instantiate --eval --expr 'let f = n: if n == 0 then 0 else f (n - 1) + f (n - 1); in f 32'
-  ^CStill shutting down. Press ^C again to abort all operations immediately.
-  ^C
-
-  ❌130 ❯
-  ```
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- `--keep-failed` chowns the build directory to the user that request the build
-
-  Running a build with `--keep-failed` now chowns the temporary directory from the
-  builder user and group to the user that request the build if the build came from
-  a local user connected to the daemon. This makes inspecting failed derivations a
-  lot easier. On Linux the build directory made visible to the user will not be in
-  the same path as it was in the sandbox and continuing builds will usually break.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Better debuggability on fixed-output hash mismatches
-
-  Fixed-output derivation hash mismatch error messages will now include the path that was
-  produced unexpectedly, and this path will be registered as valid even if `--check`
-  (`nix-store`, `nix-build`) or `--rebuild` (`nix build`) was passed. This makes comparing
-  the expected path with the obtained path easier, and is useful for debugging when
-  upstreams modify previously-published releases or when changes in fixed-output
-  derivations' dependencies affect their output unexpectedly.
-
-  Many thanks to [lheckemann](https://git.lix.systems/lheckemann) for this.
-
- Add --raw flag to `nix-instantiate --eval` for unescaped output [gh#12119](https://github.com/NixOS/nix/pull/12119) [cl/2886](https://gerrit.lix.systems/c/lix/+/2886)
-
-  The `nix-instantiate --eval` command now supports a `--raw` flag. When used,
-  the result must be coercible to a string (as with `${...}`) and is printed
-  verbatim, without quotes or escaping.
-
-  Many thanks to [Martin Fischer](https://github.com/not-my-profile), [infinisil](https://github.com/infinisil), and [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Allow `nix store ls` to read nar listings from binary cache stores. [cl/3225](https://gerrit.lix.systems/c/lix/+/3225)
-
-  The `nix store ls` command now supports reading `.ls` nar listings from binary cache stores.
-  If a listing is detected for the store path being queried, the nar is no longer downloaded.
-  These nar listings are available in binary cache stores where the `write-nar-listing` option is
-  enabled, such as cache.nixos.org.
-
-  Many thanks to [Victor Fuentes](https://git.lix.systems/vlinkz) for this.
-
- show tree with references that lead to an output cycle [fj#551](https://git.lix.systems/lix-project/lix/issues/551)
-
-  When Lix determines a cyclic dependency between several outputs of a derivation,
-  it now displays which files in which outputs lead to an output cycle:
-
-  ```
-  error: cycle detected in build of '/nix/store/gc5h2whz3rylpf34n99nswvqgkjkigmy-demo.drv' in the references of output 'bar' from output 'foo'.
-
-         Shown below are the files inside the outputs leading to the cycle:
-         /nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar
-         └───lib/libfoo: …stuffbefore /nix/store/h680k7k53rjl9p15g6h7kpym33250w0y-demo-baz andafter.…
-             → /nix/store/h680k7k53rjl9p15g6h7kpym33250w0y-demo-baz
-             └───share/snenskek: …???? /nix/store/dm24c76p9y2mrvmwgpmi64rryw6x5qmm-demo-foo ....…
-                 → /nix/store/dm24c76p9y2mrvmwgpmi64rryw6x5qmm-demo-foo
-                 └───bin/alarm: …textexttext/nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar abcabcabc.…
-                     → /nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar
-  ```
-
-  Please note that showing the files and its contents while displaying the cycles only works
-  on Linux.
-
-  Many thanks to [ma27](https://git.lix.systems/ma27) for this.
-
- Lix now enables parallel marking in boehm-gc [fj#983](https://git.lix.systems/lix-project/lix/issues/983) [cl/3880](https://gerrit.lix.systems/c/lix/+/3880)
-
-  This brings a fairly modest performance improvement (~38% for `nixpkgs search hello`) to evaluation, especially in scenarios that necessitate larger heap sizes.
-
-  Many thanks to [Eelco Dolstra](https://github.com/edolstra) and [Seth Flynn](https://git.lix.systems/getchoo) for this.
-
- `disallowedRequisites` now reports chains of disallowed requisites [fj#334](https://git.lix.systems/lix-project/lix/issues/334) [fj#626](https://git.lix.systems/lix-project/lix/issues/626) [gh#10877](https://github.com/NixOS/nix/issues/10877)
-
-  When a build fails because of [`disallowedRequisites`](@docroot@/language/advanced-attributes.md#adv-attr-disallowedRequisites), the error message now includes the chain of references that led to the failure. This makes it easier to see in which derivations the chain can be broken, to resolve the problem.
-
-  Example:
-
-  ```
-  $ nix-build -A hello
-  error: output '/nix/store/0b7k85gg5r28gb54px9nq7iv5986mns9-hello-2.12.2' is not allowed to refer to the following paths:
-         /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.40-66
-         Shown below are chains that lead to the forbidden path(s).
-         /nix/store/0b7k85gg5r28gb54px9nq7iv5986mns9-hello-2.12.2
-         └───/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.40-66
-  ```
-
-  Many thanks to [ma27](https://git.lix.systems/ma27) and [Robert Hensing](https://github.com/roberth) for this.
-
- Stack traces now summarize involved derivations at the bottom [cl/4493](https://gerrit.lix.systems/c/lix/+/4493)
-
-  When evaluation errors and a stack trace is printed,
-
-  For example, if I add Nheko to a NixOS `environment.systemPackages` without adding `olm-3.2.16` `nixpkgs.config.permittedInsecurePackages`, then without `--show-trace`, I previously got this:
-
-  ```
-  error:
-         … while calling the 'head' builtin
-           at /nix/store/9v6qa656sq3xc58vkxslqy646p0ajj61-source/lib/attrsets.nix:1701:13:
-           1700|           if length values == 1 || pred here (elemAt values 1) (head values) then
-           1701|             head values
-               |             ^
-           1702|           else
-
-         … while evaluating the attribute 'value'
-           at /nix/store/9v6qa656sq3xc58vkxslqy646p0ajj61-source/lib/modules.nix:1118:7:
-           1117|     // {
-           1118|       value = addErrorContext "while evaluating the option `${showOption loc}':" value;
-               |       ^
-           1119|       inherit (res.defsFinal') highestPrio;
-
-         (stack trace truncated; use '--show-trace' to show the full trace)
-
-         error: Package ‘olm-3.2.16’ in /nix/store/9v6qa656sq3xc58vkxslqy646p0ajj61-source/pkgs/by-name/ol/olm/package.nix:37 is marked as insecure, refusing to evaluate.
-
-         < -snip the whole explanation about olm's CVEs- >
-  ```
-
-  This doesn't tell me anything about where `olm-3.2.16` came from.
-  With `--show-trace`, there's 1 155 lines to sift through, but does contain lines like "while evaluating derivation 'nheko-0.12.1'".
-
-  With this change, those lines are summarized and collected at the bottom, regardless of `--show-trace`:
-
-  ```
-  error:
-         … while calling the 'head' builtin
-           at /nix/store/9v6qa656sq3xc58vkxslqy646p0ajj61-source/lib/attrsets.nix:1701:13:
-           1700|           if length values == 1 || pred here (elemAt values 1) (head values) then
-           1701|             head values
-               |             ^
-           1702|           else
-
-         … while evaluating the attribute 'value'
-           at /nix/store/9v6qa656sq3xc58vkxslqy646p0ajj61-source/lib/modules.nix:1118:7:
-           1117|     // {
-           1118|       value = addErrorContext "while evaluating the option `${showOption loc}':" value;
-               |       ^
-           1119|       inherit (res.defsFinal') highestPrio;
-
-         (stack trace truncated; use '--show-trace' to show the full trace)
-
-         error: Package ‘olm-3.2.16’ in /nix/store/9v6qa656sq3xc58vkxslqy646p0ajj61-source/pkgs/by-name/ol/olm/package.nix:37 is marked as insecure, refusing to evaluate.
-
-
-         < -snip the whole explanation about olm's CVEs- >
-
-
-         note: trace involved the following derivations:
-         derivation 'etc'
-         derivation 'dbus-1'
-         derivation 'system-path'
-         derivation 'nheko-0.12.1'
-         derivation 'mtxclient-0.10.1'
-  ```
-
-  Now we finally know that olm was evaluated because of Nheko, without sifting through *thousands* of lines of error message.
-
-  Many thanks to [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- Symbols reuses once-allocated Value to reduce garbage collected allocations [cl/3308](https://gerrit.lix.systems/c/lix/+/3308) [cl/3300](https://gerrit.lix.systems/c/lix/+/3300) [cl/3314](https://gerrit.lix.systems/c/lix/+/3314) [cl/3310](https://gerrit.lix.systems/c/lix/+/3310) [cl/3312](https://gerrit.lix.systems/c/lix/+/3312) [cl/3313](https://gerrit.lix.systems/c/lix/+/3313)
-
-  In the Lix evaluator, **symbols** represent immutable strings, like those used
-  for attribute names.
-
-  In evaluator design, such strings are typically [**interned**](https://en.wikipedia.org/wiki/String_interning), stored uniquely
-  to save memory, and Lix inherits this approach from the original C++ codebase.
-
-  However, some builtins, like `builtins.attrNames`, must return a `Value` type
-  that can represent any Nix value (strings, integers, lists, etc.).
-
-  Before this change, these builtins would create lists of `Value` objects by
-  allocating them through the garbage collector, copying the symbol’s string
-  content each time.
-
-  This allocation is unnecessary if the interned symbols themselves also hold a
-  `Value` representation allocated outside the garbage collector, since these
-  live for the full duration of evaluation.
-
-  As a result, this reduces the number of allocations, leading to:
-
-  * A significant drop in maximum [resident set memory](https://en.wikipedia.org/wiki/Resident_set_size) (RSS), with some large-scale
-    tests showing up to 11% (about 500 MiB) savings in large colmena deployments.
-  * A slight decrease in CPU usage during Nix evaluations.
-
-  This change is inspired by https://github.com/NixOS/nix/pull/13258 but the approach is different.
-
-  **Note** : [`xokdvium`](https://github.com/xokdvium) is the rightful author of https://gerrit.lix.systems/c/lix/+/3300 and the credit was missed on our end during the development process. We are deeply sorry for this mistake.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito), [eldritch horrors](https://git.lix.systems/pennae), [Tom Hubrecht](https://git.lix.systems/tom-hubrecht), [xokdvium](https://github.com/xokdvium), and [NaN-git](https://github.com/NaN-git) for this.
-
-
-## Fixes
-
- `build-dir` no longer defaults to `temp-dir` [cl/3453](https://gerrit.lix.systems/c/lix/+/3453)
-
-  The directory in which temporary build directories are created no longer defaults
-  to the value of the `temp-dir` setting to avoid builders making their directories
-  world-accessible. This behavior has been used to escape the build sandbox and can
-  cause build impurities even when not used maliciously. We now default to `builds`
-  in `NIX_STATE_DIR` (which is `/nix/var/nix/b` in the default configuration).
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Global certificate authorities are copied inside the builder's environment [gh#12698](https://github.com/NixOS/nix/issues/12698) [fj#885](https://git.lix.systems/lix-project/lix/issues/885) [cl/3765](https://gerrit.lix.systems/c/lix/+/3765)
-
-  Previously, CA certificates were only installed at
-  `/etc/ssl/certs/ca-certificates.crt` for sandboxed builds on Linux.
-
-  This setup was insufficient in light of recent changes in `nixpkgs`, which now
-  enforce HTTPS usage for `fetchurl`, even for fixed-output derivations, to
-  mitigate confidentiality risks such as `netrc` or credentials leakage.
-  `nixpkgs` still make use of a special package called `cacerts` which contains a
-  copy of the CA certificates maintained by Nixpkgs and added as a reference for
-  TLS-enabled fetchers.
-
-  As a result, having a consistent and trusted certificate authority in all
-  builder environments is becoming more essential.
-
-  On `nix-darwin`, the `NIX_SSL_CERT_FILE` environment variable is always
-  explicitly defined, but it is ignored by the sandbox setup.
-
-  Simultaneously, Nix evaluates and propagates impure environment variables via
-  `lib.proxyImpureEnvVars`, meaning that if `NIX_SSL_CERT_FILE` is set (which
-  influences the default value for `ssl-cert-file`), it will be forwarded
-  unchanged into the builder environment.
-
-  However, on Linux, Nix also *copies* the CA file into the sandbox, creating a
-  discrepancy between the value of `NIX_SSL_CERT_FILE` and the actual trusted
-  certificate path used during the build.
-
-  This divergence caused confusion and was partially addressed by attempts to
-  whitelist the CA path in the Darwin sandbox (see cl/2906), but that approach
-  involved a non-trivial path canonicalization step and is not as general as this one.
-
-  To address this properly, we now emit a warning and override
-  `NIX_SSL_CERT_FILE` inside the builder, explicitly pointing it to the CA file
-  copied into the sandbox.
-
-  This eliminates ambiguity between `NIX_SSL_CERT_FILE`
-  and `ssl-cert-file`, ensuring consistent trust anchors across platforms.
-
-  This warning might become a hard error as we figure out what to do regarding
-  `lib.proxyImpureEnvVars` in nixpkgs.
-
-  The behavior has been verified across sandboxed and unsandboxed builds on both
-  Linux and Darwin.
-
-  As a consequence of this change, approximately 500 KB of CA certificate data is
-  now unconditionally copied into the build directory for fixed-output
-  derivations.
-
-  While this ensures consistent trust verification without having to restart the
-  daemon after system upgrades, it may introduce a slight overhead in build
-  performance. At present, no optimizations have been implemented to avoid this
-  copy, but if this overhead proves noticeable in your workflows, please open an
-  issue so we can evaluate and possibly implement different strategies to render
-  trust anchors visible.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [Emily](https://git.lix.systems/emilazy) for this.
-
- libstore: exponential backoff for downloads [lix#932](https://git.lix.systems/lix-project/lix/issues/932) [cl/3856](https://gerrit.lix.systems/c/lix/+/3856)
-
-  The connection timeout when downloading from e.g. a binary cache is exponentially
-  increased per failure. The option `connect-timeout` is now an alias to `max-connect-timeout`
-  which is the maximum value for a timeout. The start value is controlled
-  by `initial-connect-timeout` which is `5` by default.
-
-  Many thanks to [ma27](https://git.lix.systems/ma27) for this.
-
- Fix develop shells for derivations with escape codes [fj#991](https://git.lix.systems/lix-project/lix/issues/991) [cl/4154](https://gerrit.lix.systems/c/lix/+/4154) [cl/4155](https://gerrit.lix.systems/c/lix/+/4155)
-
-  ASCII control characters (including `\e`, used for ANSI escape codes) in derivation variables are now correctly escaped for `nix develop` and `nix print-dev-env`, instead of erroring.
-
-  Many thanks to [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- nix-store --delete: always remove obsolete hardlinks [cl/3188](https://gerrit.lix.systems/c/lix/+/3188)
-
-  Deleting specific paths using `nix-store --delete` or `nix store
-  delete` previously did not delete hard links created by `nix-store
-  --optimise` even if they became obsolete, unless _all_ of the given
-  paths were deleted successfully. Now, hard links are always cleaned
-  up, even if some of the given paths could not be deleted.
-
-  Many thanks to [lheckemann](https://git.lix.systems/lheckemann) for this.
-
- Report GC statistics correctly [cl/3188](https://gerrit.lix.systems/c/lix/+/3188)
-
-  Deleting specific paths using `nix-store --delete` or `nix store delete` previously did
-  not report statistics correctly when some of the paths could not be deleted, even if
-  others were deleted:
-
-  ```
-  $ nix store delete /nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1 --delete-closure -v
-  finding garbage collector roots...
-  deleting '/nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1'
-  0 store paths deleted, 0.00 MiB freed
-  error: Cannot delete some of the given paths because they are still alive. Paths not deleted:
-           k9bxzr1l92r5y6mihrkbpbr3fmc8qszx-libidn2-2.3.8
-           mbx9ii53lzjlrsnlrfmzpwm33ynljwdn-libunistring-1.3
-           rf8hcy6bldxdqc0g6q1dcka1vh47x69s-xgcc-14.2.1.20250322-libgcc
-           vbrdc5wgzn0w1zdp10xd2favkjn5fk7y-glibc-2.40-66
-         To find out why, use nix-store --query --roots and nix-store --query --referrers.
-  ```
-
-  Many thanks to [lheckemann](https://git.lix.systems/lheckemann) for this.
-
- Fallback to safe temp dir when build-dir is unwritable [fj#876](https://git.lix.systems/lix-project/lix/issues/876) [cl/3501](https://gerrit.lix.systems/c/lix/+/3501)
-
-  Non-daemon builds started failing with a permission error after introducing the `build-dir` option:
-
-  ```
-  $ nix build --store ~/scratch nixpkgs#hello --rebuild
-  error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied
-  ```
-
-  This happens because:
-
-  1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`.
-  2. The user lacks permissions for that path.
-
-  We considered making `build-dir` a store-level option and defaulting it to `<chroot-root>/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`.
-
-  To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir.
-
-  **Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Parse overflowing JSON number literals as floating‐point [cl/3919](https://gerrit.lix.systems/c/lix/+/3919)
-
-  Previously, `builtins.fromJSON "-9223372036854775809"` would
-  return a floating‐point number, while `builtins.fromJSON
-  "9223372036854775808"` would cause an evaluation error. This was
-  introduced with the banning of integer overflow in Lix 2.91; previously
-  the latter would result in C++ undefined behaviour. These cases are
-  now treated consistently with JSON’s model of a single numeric type,
-  and JSON number literals that do not fit in a Nix‐language integer
-  will be parsed as floating‐point numbers.
-
-  Many thanks to [Emily](https://git.lix.systems/emilazy) for this.
-
- Fix handling of OSC codes in terminal output [fj#160](https://git.lix.systems/lix-project/lix/issues/160) [cl/3143](https://gerrit.lix.systems/c/lix/+/3143)
-
-  OSC codes in terminal output are now handled correctly, where OSC 8 (hyperlink) is preserved any
-  time color codes are allowed and all other OSC codes are stripped out. This applies not only to
-  output from build commands but also to rendered documentation in the REPL.
-
-  Many thanks to [lilyball](https://git.lix.systems/lilyball) for this.
-
- Fix nix develop for derivations that rejects dependencies with structured attrs [fj#997](https://git.lix.systems/lix-project/lix/issues/997) [cl/4182](https://gerrit.lix.systems/c/lix/+/4182)
-
-  For the sake of concision, we refer to `disallowedReferences` in what follows,
-  but all output checks were equally fixed:
-  `{dis,}allowed{References,Requisites}`.
-
-  Derivations can define *output checks* to reject unwanted dependencies, such as
-  interpreters like `bash` or compilers like `gcc`. This can be done in two ways:
-
-  * **Legacy style**: `disallowedReferences = [ ... ]` in the environment.
-  * **Structured attrs**: `outputChecks.<output>.disallowedReferences = [ ... ]`,
-    typically used in `__json`.
-
-  Only the structured form supports derivations with multiple outputs.
-
-  `nix develop` internally rewrites derivations to create development shells. It
-  relied on the legacy `disallowedReferences`, and failed to honor the structured
-  variant. This led to broken shells in cases where `bashInteractive` was
-  explicitly disallowed using structured output checks, e.g. `nix develop
-  nixpkgs#systemd` after the "bash-less NixOS" changes.
-
-  This fix teaches `nix develop` to respect structured output checks, restoring
-  support for such derivations.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- nix-eval-jobs: retain NIX_PATH [cl/3859](https://gerrit.lix.systems/c/lix/+/3859)
-
-  `nix-eval-jobs` doesn't clear the `NIX_PATH` from the environment anymore. This matches the behavior
-  of [upstream version `2.30`](https://github.com/nix-community/nix-eval-jobs/releases/tag/v2.30.0).
-
-  Many thanks to [ma27](https://git.lix.systems/ma27) and [mic92](https://github.com/mic92) for this.
-
- Remove reliance on Bash for remote stores via SSH [fj#830](https://git.lix.systems/lix-project/lix/issues/830) [fj#805](https://git.lix.systems/lix-project/lix/issues/805) [fj#304](https://git.lix.systems/lix-project/lix/issues/304) [cl/3159](https://gerrit.lix.systems/c/lix/+/3159)
-
-  The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed.
-
-  After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on:
-
-    * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`),
-    * BusyBox / initrd images with no Bash,
-    * hosts using non-POSIX shells such as Nushell.
-
-  The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless.
-
-  Real connection or protocol errors are now left to SSH/Nix to report directly.
-
-  This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- repl-overlays now work in the debugger for flakes [fj#777](https://git.lix.systems/lix-project/lix/issues/777) [cl/3398](https://gerrit.lix.systems/c/lix/+/3398)
-
-  Due to a bug, it was previously not possible to use the debugger on flakes with repl-overlays, or with pure evaluation in general:
-
-  ```
-  $ nix repl --pure-eval
-  Lix 2.94.0-dev-pre20250617-87d99da
-  Type :? for help.
-  Loading 'repl-overlays'...
-  error: access to absolute path '/Users/jade/.config/nix/repl.nix' is forbidden in pure eval mode (use '--impure' to override)
-  ```
-
-  This is now fixed.
-  The contents of the repl-overlays file itself (i.e. most typically the top level lambda in it) will be evaluated in impure mode.
-  It may be necessary to use `builtins.seq` to force the impure operations to happen first if one wants to do impure operations inside a repl-overlays file in pure evaluation mode.
-
-  Many thanks to [jade](https://git.lix.systems/jade) for this.
-
- `nix-shell` default shell directory is not `/tmp` anymore for `$NIX_BUILD_TOP` [fj#940](https://git.lix.systems/lix-project/lix/issues/940)
-
-  Previously, Lix `nix-shell`s could exit non-zero status when `stdenv`'s `dumpVars` phase failed to write to `$NIX_BUILD_TOP/env-vars`, despite `dumpVars` being intended as a debugging aid.
-
-  This happens when `TMPDIR` is not set and defaults therefore to `/tmp`, resulting in a `/tmp/env-vars` global file that every `nix-shell` wants to write.
-
-  We fix this issue by reusing a pre-created, unique, and writable location, as the build top directory, avoiding shell exiting from write failures silently.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- libstore/binary-cache-store: don't cache narinfo on nix copy, remove negative entry [cl/3789](https://gerrit.lix.systems/c/lix/+/3789)
-
-  When using e.g. [Snix's nar-bridge](https://snix.dev/docs/components/overview/#nar-bridge) via
-  an `http`-store, Lix would create cache entries with a wrong URL to the NAR when uploading
-  a store-path.
-
-  This caused hard build failures for Hydra.
-
-  Lix doesn't create these entries on upload anymore. Instead, it only removes negative cache entries.
-  The cache entry for a narinfo is now created the first time, Lix queries the cache
-  for the previously uploaded store-path again.
-
-  Many thanks to [ma27](https://git.lix.systems/ma27) for this.
-
- Lix libraries can now be linked statically [fj#789](https://git.lix.systems/lix-project/lix/issues/789) [cl/3775](https://gerrit.lix.systems/c/lix/+/3775) [cl/3778](https://gerrit.lix.systems/c/lix/+/3778)
-
-  Previously the pkg-config files distributed with Lix were only suitable for dynamic linkage, causing "undefined reference to…" linker errors when trying to link statically.
-  Private dependency information has now been added to make static linkage work as expected without user intervention.
-  In addition, relevant static libraries are now prelinked to avoid strange failures due to missing static initializers.
-
-  Many thanks to [alois31](https://git.lix.systems/alois31) for this.
-
- add description to zsh completions [fj#910](https://git.lix.systems/lix-project/lix/issues/910) [cl/3632](https://gerrit.lix.systems/c/lix/+/3632)
-
-  Emit descriptions when completing args in zsh completions. This uses the descriptions we already
-  provided in NIX\_GET\_COMPLETIONS.
-
-  Many thanks to [matthewbauer](https://github.com/matthewbauer) for this.
-
-
-## Miscellany
-
- Deprecation of CA derivations, dynamic derivations, and impure derivations [fj#815](https://git.lix.systems/lix-project/lix/issues/815)
-
-  Content-addressed derivations are now deprecated and slated for removal in Lix 2.94.
-  We're doing this because the CA derivation system has been a known cause of problems
-  and inconsistencies, is unmaintained, habitually makes improving the store code very
-  difficult (or blocks such improvements outright), and is beset by a number of design
-  flaws that in our opinion cannot be fixed without a full reimplementation from zero.
-  Dynamic derivations and impure derivations are built on the CA derivation framework,
-  and owing to this they too are deprecated and slated for removal in another release.
@@ -1,546 +0,0 @@
-# Lix 2.95 "Kakigōri" (2026-03-13)
-
-
-# Lix 2.95.0 (2026-03-13)
-## Breaking Changes
-
- Deprecate shadowing internal files through the Nix search path [lix#998](https://git.lix.systems/lix-project/lix/issues/998) [cl/4632](https://gerrit.lix.systems/c/lix/+/4632)
-
-  As Lix uses the path `<nix/fetchurl.nix>` for bootstrapping purposes, the ability to shadow it by adding `nix=/some/path` (or `/other/path` that contains a `nix` directory) to the search path is not desirable.
-
-  To alleviate potential issues, Lix now emits a warning when the Nix search path contains potential shadows for internal files, which will be changed to an error in a future release.
-
-  The warning can be disabled by enabling the deprecated feature `nix-path-shadow`.
-
-  Many thanks to [Tom Hubrecht](https://git.lix.systems/tom-hubrecht) for this.
-
- More deprecated features [cl/2092](https://gerrit.lix.systems/c/lix/+/2092) [cl/2310](https://gerrit.lix.systems/c/lix/+/2310) [cl/2311](https://gerrit.lix.systems/c/lix/+/2311) [cl/4638](https://gerrit.lix.systems/c/lix/+/4638) [cl/4652](https://gerrit.lix.systems/c/lix/+/4652) [cl/4764](https://gerrit.lix.systems/c/lix/+/4764)
-
-  This release cycle features a new batch of deprecated (anti-)features.
-  You can opt in into the old behavior with `--extra-deprecated-features` or any equivalent configuration option.
-
-  - `broken-string-indentation` indented strings (those starting with  `''`) might produce unintended results due to how the whitespace stripping is done. Those cases will now warn the user.
-  - `broken-string-escape` "escaped" characters without a properly defined escape sequence evaluate to "themselves". This is in most cases unintended behaviour, both for writing regexes, and using legacy or uncommon escape sequences like `\f`. The user will now be warned, if those are present.
-  - `floating-without-zero` so far, one was able to declare a float using something like `.123`. This can cause confusion about accessing attributes. Floating point numbers must now always include the leading zero, i.e. `0.123`
-  - `rec-set-merges` Attribute sets like `{ foo = {}; foo.bar = 42;}` implicitly merge at parse time, however if one of them is marked as recursive but not the others then the recursive attribute may get lost (order-dependent). Therefore, merging attrs with mixed-`rec` is now forbidden.
-  - `rec-set-dynamic-attrs` Dynamic attributes have weird semantics in the presence of recursive attrsets (they evaluate *after* the rest of the set). This is now forbidden.
-  - `or-as-identifier` `or` as an identifier has always been weird since the `or` (almost-)keyword has been introduced. We are deprecating the backcompat hacks from the early days of Nix in favor of making `or` a full and proper keyword.
-  - `tokens-no-whitespace` Function applications without space around the arguments like `0a`, `0.00.0` or `foo"1"2` are now forbidden. The same applies to list elements. The primary reason for this deprecation is to remove foot guns around surprising tokenization rules regarding number literals, but this will also free up some syntax for other purposes (e.g. `r""` strings) for reuse at some point in the future.
-  - `shadow-internal-symbols` has been expanded to also forbid shadowing `null`, `true` and `false`.
-  - `ancient-let` deprecation has been turned into a full parser error instead of a warning.
-  - `rec-set-overrides` deprecation has been turned into a full parser error instead of a warning.
-
-  Many thanks to [piegames](https://git.lix.systems/piegames), [rootile (Rutile)](https://git.lix.systems/rootile), and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Move `/root/.cache/nix` to `/var/cache/nix` by default [lix#634](https://git.lix.systems/lix-project/lix/issues/634) [cl/4671](https://gerrit.lix.systems/c/lix/+/4671)
-
-  By default, Lix attempts to locate a cache directory for its operations (such
-  as the narinfo cache) by checking the value of `$XDG_CACHE_DIR`.
-
-  However, since the Nix daemon is a system service, using `$XDG_CACHE_DIR` is
-  not typical in this context.
-
-  To address this, systemd provides a better solution. Specifically, when
-  `CacheDirectory=` is set in the `[Service]` section of a systemd unit, it
-  automatically sets the `$CACHE_DIRECTORY` environment variable and systemd will
-  manage that cache directory for us.
-
-  Now, our systemd unit includes `CacheDirectory=nix`, which sets the
-  `$CACHE_DIRECTORY` and takes precedence over `$XDG_CACHE_DIR`.
-
-  If the daemon is run under user units, systemd will automatically set
-  `$XDG_CACHE_DIR`.
-
-  If neither of these variables is set, Lix falls back to its default behavior.
-  By default, Lix will try to find a cache directory for its various operations
-  (e.g. narinfo cache) by looking into `$XDG_CACHE_DIR`.
-
-  In summary, what was stored in `/root/.cache/nix` is now moved to
-  `/var/cache/nix/nix`.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Remove `fetch-closure` experimental feature [lix#1010](https://git.lix.systems/lix-project/lix/issues/1010) [cl/4595](https://gerrit.lix.systems/c/lix/+/4595)
-
-  The `fetch-closure` experimental feature has been removed.
-
-  Outside of allowing the user to import closure from binary cache,
-  `fetchClosure` also allowed you to do the following:
-
-  * rewrite non-CA path to CA
-  * reject non-CA paths at fetching time
-  * reject CA paths at fetching time
-
-  Some people are using those mechanism to prevent users from having to build any
-  package and force going via the declared cache or as a way to use ancient/old
-  software without paying the evaluation cost of a second nixpkgs.
-
-  Both use cases are somewhat of an antipattern in Nix semantics. If the user
-  cannot fetch a program directly via the substituter mechanism and fall back to
-  local build, this is a feature *and* a misconfiguration. If the user cannot build
-  certain derivations because they are too expensive, the build directives should
-  pass `-j0` or similar.
-
-  As for the second usecase, there's a different way to do it that also allows to
-  have a way to reproduce the paths that are hardcoded in that file, perform
-  `import (fetchurl "https://my-cache/${hashparts storepath}.drv")` rather, i.e.
-  an IFD to a possibly well known name. The backend can generate them on the fly
-  or once, and possess stable names.
-
-  Finally, as for the non-CA → CA features, Lix removed ca-derivations.
-  fetchClosure offers ca-derivations-like features which suffers from similar
-  shortcomings albeit lessened. It only follows that we should deprecate
-  and remove these capabilities.
-
-  Many thanks to [just1602](https://git.lix.systems/just1602) for this.
-
-
-## Features
-
- `nix store add-path` now supports references [cl/5205](https://gerrit.lix.systems/c/lix/+/5205)
-
-  Lix supports two categories of hashes in store paths: input-addressed and output-addressed.
-
-  Currently, in Nix language, there is no way to produce output-addressed paths with references, as fixed-output derivations forbid references.
-  However, the Nix store actually *supports* references in output-addressed paths.
-  This is very useful for importing build products created outside of Lix that reference dependency store paths since such build products have no associated derivation so don't make any sense to input-address.
-  Previously, output-addressed paths with references could only be created by writing a custom client to the rather-baroque Nix daemon protocol; now it's available in the CLI.
-
-  Using `nix store add-path --references-list-json REFS_LIST_FILE SOME_PATH` with a JSON list of string store paths, you can now create such paths with the Lix CLI.
-  They may be consumed from Nix language using something like `builtins.storePath` or the following which also works in pure evaluation mode:
-
-  ```nix
-  # Hack from https://git.lix.systems/lix-project/lix/issues/402#issuecomment-5889
-  path:
-  builtins.appendContext path {
-    ${path} = {
-      path = true;
-    };
-  }
-  ```
-
-  Many thanks to [jade](https://git.lix.systems/jade) for this.
-
- Add `builtins.warn` for emitting warnings from Nix code [cl/2248](https://gerrit.lix.systems/c/lix/+/2248)
-
-  Lix now has a builtin function for emitting warnings.
-  Like `builtins.trace`, it takes two arguments: the message to emit, and the expression to return.
-  _Unlike_ `builtins.trace`, `builtins.warn` requires the first argument — the message — to be a string.
-  In the future we may extend `builtins.warn` to accept a more structured API.
-
-  To go along with this, we also have two new config settings:
-  - [`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn), which, when used with `--debugger`, makes `builtins.warn` also function like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
-  - [`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn), which aborts evaluation entirely after the warning is emitted.
-
-  Many thanks to [Emilia Bopp](https://git.lix.systems/milibopp) and [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- `keep-env-derivations` is now supported for nix3 CLI (`nix profile`) [lix#1095](https://git.lix.systems/lix-project/lix/issues/1095) [cl/5332](https://gerrit.lix.systems/c/lix/+/5332)
-
-  The `keep-env-derivations` feature is now available for `nix profile`. This allows users to prevent the garbage collection of derivations used to install a profile, even when `keep-derivations = false` (set to `true` by default).
-
-  Previously, `nix-env` supported this feature, but `nix profile` **never** did. This caused issues when garbage collection removed the associated `.drv` files, which are required, for example, by vulnerability management tools (e.g. [vulnix](https://github.com/nix-community/vulnix)) for proper operation.
-
-  This issue has now been resolved.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Make `log-format` a setting [cl/4686](https://gerrit.lix.systems/c/lix/+/4686)
-
-  The [`--log-format` CLI option](@docroot@/command-ref/opt-common.md#opt-log-format) can now be set in [`nix.conf`](@docroot@/command-ref/conf-file.md#conf-log-format)!
-  For example, you can now persistently enable the `multiline-with-logs` log format [added in Lix 2.91](@docroot@/release-notes/rl-2.91.md) by adding the following to your `nix.conf`:
-
-  ```conf
-  log-format = multiline-with-logs
-  ```
-
-  Or the equivalent in a NixOS configuration:
-  ```nix
-  {
-    nix.settings.log-format = "multiline-with-logs";
-  }
-  ```
-
-  Many thanks to [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- Allow remote builders to be configured using TOML [cl/4533](https://gerrit.lix.systems/c/lix/+/4533)
-
-  Lix now supports configuring remote builders using a TOML file instead of the old, very cursed and incomprehensible format.
-  This comes with not only a human-understandable file, but also with better messages and error reports on misconfiguration.
-
-  A more detailed Documentation can be found on the [distributed-builds](@docroot@/advanced-topics/distributed-builds.md) documentation page.
-
-  Many thanks to [rootile (Rutile)](https://git.lix.systems/rootile) and [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- Emit warnings when encountering IFD with `warn-import-from-derivation` [nix#13279](https://github.com/NixOS/nix/pull/13279) [cl/3879](https://gerrit.lix.systems/c/lix/+/3879)
-
-  Instead of only being able to toggle the use of [Import from
-  Derivation](https://nix.dev/manual/nix/stable/language/import-from-derivation) with
-  `allow-import-from-derivation`, Lix is now able to warn users whenever IFD is encountered with
-  `warn-import-from-derivation`.
-
-  Many thanks to [Seth Flynn](https://git.lix.systems/getchoo), [gustavderdrache](https://github.com/gustavderdrache), and [Eelco Dolstra](https://github.com/edolstra) for this.
-
-
-## Improvements
-
- Collect Flakes untrusted settings into one prompt [lix#682](https://git.lix.systems/lix-project/lix/issues/682) [cl/2921](https://gerrit.lix.systems/c/lix/+/2921)
-
-  When working with Flakes containing untrusted settings, a prompt is shown for each setting, asking whether to vet or approve it. This looks like:
-
-  ```
-  ❯ nix flake lock
-  warning: ignoring untrusted flake configuration setting 'allow-dirty', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  warning: ignoring untrusted flake configuration setting 'sandbox', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  The following settings require your decision:
-  - allow-dirty = false
-  - sandbox = false
-  Do you want to allow configuration settings to be applied?
-  This may allow the flake to gain root, see the nix.conf manual page (yes for now/Allow always/no/No to all)
-  ```
-
-  In Flakes with a large number of settings to approve or reject, this process can become tedious as each option must be handled individually.
-
-  To address this, all untrusted settings are now consolidated into a single prompt: allowing for bulk acceptance permanently or not, rejection, or detailed review. For example:
-
-  ### Scrutiny scenario
-
-  ```console
-  ❯ nix flake lock
-  warning: ignoring untrusted flake configuration setting 'allow-dirty', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  warning: ignoring untrusted flake configuration setting 'sandbox', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  The following settings require your decision:
-  - allow-dirty = false
-  - sandbox = false
-  Do you want to allow configuration settings to be applied?
-  This may allow the flake to gain root, see the nix.conf manual page (yes for now/Allow always/no/No to all) n
-  warning: you can set 'accept-flake-config' to 'false' to automatically reject configuration options supplied by flakes
-  Do you want to allow setting 'allow-dirty = false'? (yes for now/Allow always/no for now) y
-  Do you want to allow setting 'sandbox = false'? (yes for now/Allow always/no for now) n
-  ```
-
-  ### Reject everything scenario
-
-  ```console
-  ❯ nix flake lock
-  warning: ignoring untrusted flake configuration setting 'allow-dirty', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  warning: ignoring untrusted flake configuration setting 'sandbox', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  The following settings require your decision:
-  - allow-dirty = false
-  - sandbox = false
-  Do you want to allow configuration settings to be applied?
-  This may allow the flake to gain root, see the nix.conf manual page (yes for now/Allow always/no/No to all) N
-  Rejecting all untrusted nix.conf entries
-  warning: you can set 'accept-flake-config' to 'false' to automatically reject configuration options supplied by flakes
-  ```
-
-  ### Accept everything scenario
-
-  ```console
-  ❯ nix flake lock
-  warning: ignoring untrusted flake configuration setting 'allow-dirty', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  warning: ignoring untrusted flake configuration setting 'sandbox', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  The following settings require your decision:
-  - allow-dirty = false
-  - sandbox = false
-  Do you want to allow configuration settings to be applied?
-  This may allow the flake to gain root, see the nix.conf manual page (yes for now/Allow always/no/No to all) y
-  ```
-
-  ### Accept everything PERMANENTLY scenario
-
-  Note that accepting everything permanently will authorize these options for any
-  further operations.
-
-  The file containing this trust information is usually located in
-  `~/.local/share/nix/trusted-settings.json` and can be edited manually to revoke
-  this permission until Lix provides a first-class command for this manipulation.
-
-  ```console
-  ❯ nix flake lock
-  warning: ignoring untrusted flake configuration setting 'allow-dirty', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  warning: ignoring untrusted flake configuration setting 'sandbox', pass '--accept-flake-config' to trust it (may allow the flake to gain root, see the nix.conf manual page)
-  The following settings require your decision:
-  - allow-dirty = false
-  - sandbox = false
-  Do you want to allow configuration settings to be applied?
-  This may allow the flake to gain root, see the nix.conf manual page (yes for now/Allow always/no/No to all) A
-  ```
-
-  Many thanks to [isabelroses](https://git.lix.systems/isabelroses), [Raito Bezarius](https://git.lix.systems/raito), and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- `--check` or `--rebuild` is clearer about a missing path [lix#485](https://git.lix.systems/lix-project/lix/issues/485)
-
-  Previously, when running Lix with --check or --rebuild, failures often surfaced
-  as an unhelpful error:
-
-  > "some outputs of '...' are not valid, so checking is not possible"
-
-  This message could mean two different things:
-
-  - The requested output paths don't exist at all, or,
-  - Some outputs exist but are not known to Lix
-
-  Lix cannot reliably distinguish these cases, so it treated them the same.
-
-  We've updated the error messages to clarify what Lix can determine: whether any
-  valid outputs (> 0) are present or whether no outputs are available.
-
-  When no valid outputs can be found, Lix will now suggest building the derivation
-  normally (without --check or --rebuild) before trying again.
-
-  When some valid outputs are present, Lix now reports which ones are valid,
-  shows the full list of known outputs, and also suggests building the derivation
-  normally.
-
-  In the future, Lix may automate this recovery step when it knows how to rebuild
-  the paths, but implementing that safely requires more extensive changes to the
-  codebase.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- `nix develop` no longer ignores the env variable `SSL_CERT_FILE` [cl/5042](https://gerrit.lix.systems/c/lix/+/5042)
-
-  Running `nix develop` and `nix print-dev-env` on shells that define the environment variable `SSL_CERT_FILE` now works correctly by exporting that variable inside the built shell.
-
-  Many thanks to [Tom Hubrecht](https://git.lix.systems/tom-hubrecht) for this.
-
- Linux sandbox launch overhead greatly reduced [cl/5030](https://gerrit.lix.systems/c/lix/+/5030) [cl/5073](https://gerrit.lix.systems/c/lix/+/5073) [cl/5074](https://gerrit.lix.systems/c/lix/+/5074)
-
-  Sandboxed builds are now much cheaper to launch on Linux, with constant management
-  overhead. This will mostly be noticeable when building derivation trees containing
-  many small derivations like nixpkgs' `writeFile` or `runCommand` with scripts that
-  exit quickly. In synthetic tests we have seen build times of 3000 small runCommand
-  drop from 80 seconds to 14 seconds, which is the most optimistic case in practice.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- mTLS store connections via a plugin [cl/3754](https://gerrit.lix.systems/c/lix/+/3754) [cl/3696](https://gerrit.lix.systems/c/lix/+/3696) [cl/3697](https://gerrit.lix.systems/c/lix/+/3697) [cl/3698](https://gerrit.lix.systems/c/lix/+/3698)
-
-  To support use cases requiring mutual TLS (mTLS) authentication when connecting
-  to remote Nix stores, e.g. private stores, we have introduced a **contributed**
-  mTLS plugin extending the Lix store interface.
-
-  This design follows an extensibility model which was brought up [by a proposal
-  of making Kerberos authentication possible in Lix
-  directly](https://gerrit.lix.systems/c/lix/+/3637).
-
-  This mTLS plugin serves as a concrete example of how store connection
-  mechanisms can be modularized through external plugins, without extending Lix
-  core. This idea can be generalized to integrate automatic certificate renewal
-  or advanced integrations with secrets engine or posture checks.
-
-  It enables custom TLS client certificates to be used for authenticating against
-  a remote store that enforces mTLS.
-
-  To use the plugin, configure Lix manually by setting in your `nix.conf`:
-
-  ```
-  plugin-files = /a/path/to/libplugin_mtls_store.so
-  ```
-
-  Currently, this must be done explicitly. In the future, Nixpkgs will provide a
-  mechanism to reference an up-to-date and curated set of plugins automatically.
-
-  Making plugins easily consumable outside of Nixpkgs (e.g., from external plugin
-  registries or binary distributions) remains an open question and will require
-  further design.
-
-  Contributed plugins come with significantly reduced **stability** and
-  **maintenance** guarantees compared to the Lix core. We encourage users who
-  depend on a given plugin to take on maintenance responsibilities and apply for
-  ownership within the Lix mono-repository. These plugins are subject to removal
-  at any time.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito), [eldritch horrors](https://git.lix.systems/pennae), [mic92](https://github.com/mic92), [vlaci](https://github.com/vlaci), and [nkk0](https://github.com/nkk0) for this.
-
- Add an indication of nix-shell nesting depth [lix#826](https://git.lix.systems/lix-project/lix/issues/826) [cl/4657](https://gerrit.lix.systems/c/lix/+/4657)
-
-  When in a nix shell (either via a `nix-shell` or a `nix develop` invocation), a variable `NIX_SHELL_LEVEL` is exported to indicate the nesting depth of nix shells.
-
-  Many thanks to [Tom Hubrecht](https://git.lix.systems/tom-hubrecht) for this.
-
- `nix store delete` can now unlink a GC root before deleting its closure [cl/4660](https://gerrit.lix.systems/c/lix/+/4660)
-
-  Ever build something, and then you want to delete it and whatever dependencies it downloaded?
-  Before you had to resolve the `result` symlink and copy it, then delete it, *then* `nix store delete --delete-closure --skip-live` on the path you copied.
-  Now you can just pass `--unlink` and the `result` symlink itself.
-
-  Many thanks to [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- `nix path-info` no longer lies to the user about fetching paths [lix#323](https://git.lix.systems/lix-project/lix/issues/323) [cl/4866](https://gerrit.lix.systems/c/lix/+/4866)
-
-  When running `nix path-info` with an installable that is not present in the store, Lix no longer
-  tells the user which paths are missing and that they will be fetched, as the documentation clearly
-  states that this command does not fetch missing paths.
-
-  Many thanks to [Tom Hubrecht](https://git.lix.systems/tom-hubrecht) for this.
-
- Derivations can now be printed in detail in `nix repl` [cl/3842](https://gerrit.lix.systems/c/lix/+/3842)
-
-  Traditionally derivations printed in the REPL would only print a formatted object
-  representing the path of the derivation file it refers to. This makes inspecting
-  the enhanced derivation attribute sets encountered from `mkDerivation` or similar
-  wrappers more difficult. Even the `:p`/`:print` command would not elaborate attribute sets
-  tagged as a derivation.
-
-  With this change you can now use `:p`/`:print` to directly inspect a derivation
-  by providing one as the top-level object. Derivation attribute sets will only be
-  printed two levels deep and internal derivation attrsets will remain in unexpanded
-  path form as before. `drvAttrs` will also be elided as these attributes are already
-  present in the top-level attribute set of the derivation. These heuristics provide
-  a balance between readability and functionality. When the `:p`/`:print` is omitted,
-  a bare derivation is printed in the path format as before.
-
-  Many thanks to [Lunaphied](https://git.lix.systems/Lunaphied) for this.
-
- Reject `__json` in structured attributes derivations [lix#380](https://git.lix.systems/lix-project/lix/issues/380) [cl/5286](https://gerrit.lix.systems/c/lix/+/5286)
-
-  In structured attributes derivations, `__json` is used internally to store the
-  JSON representation of the `env` attribute field that users can set.
-
-  Unfortunately, a user can set `__json` *and* enable structured attributes,
-  resulting in a broken derivation from a semantic point of view.
-
-  As no user can benefit from setting `__json` *and* enable structured attributes,
-  we disallow that possibility and throw an error from now on.
-
-  This is not seen as a breaking change because there's no user code that can
-  benefit from this behavior, hence, it's an improvement to user experience.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Shells support `$NIX_LOG_FD` now [lix#336](https://git.lix.systems/lix-project/lix/issues/336) [cl/4694](https://gerrit.lix.systems/c/lix/+/4694) [cl/4695](https://gerrit.lix.systems/c/lix/+/4695)
-
-  Lix's "debugging" shells (`nix3-develop` and `nix-shell`) now set the
-  `$NIX_LOG_FD` environment variable.
-
-  This means that [hook logging in
-  stdenv](https://github.com/NixOS/nixpkgs/pull/310387) appears while debugging
-  derivations via `nix3-develop` or `nix-shell`.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Supplementary groups are now supported for daemon authentication [lix#968](https://git.lix.systems/lix-project/lix/issues/968) [cl/5021](https://gerrit.lix.systems/c/lix/+/5021)
-
-  macOS, FreeBSD and Linux now support receiving supplementary groups during UNIX domain authentication to a Lix daemon.
-
-  This change is particularly beneficial for systemd units with `DynamicUser=true` that need to connect to a Lix daemon, using a `SupplementaryGroups=` allocated by systemd in the context of the process. This is desirable if you wish to harden Lix clients.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito), [Tom Hubrecht](https://git.lix.systems/tom-hubrecht), [alois31](https://git.lix.systems/alois31), and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
-
-## Fixes
-
- Nix shells' `$NIX_BUILD_TOP` are shorter [lix#1044](https://git.lix.systems/lix-project/lix/issues/1044) [cl/4663](https://gerrit.lix.systems/c/lix/+/4663)
-
-  Following the changes in 2.94.0 to shorten build directory paths, aimed at [resolving UNIX domain socket length issues](https://gerrit.lix.systems/c/lix/+/4168/13) and [improving nix-shell](https://git.lix.systems/lix-project/lix/issues/940), we inadvertently introduced an excessively long path for the `$NIX_BUILD_TOP` environment variable used by Nix shells (their effective temporary `/build` directory).
-
-  To fix this, we replaced the `build-top-$HASH` directory name with simply `build-top`, reducing these paths by at least 30 characters.
-
-  We also added a test to ensure that Nix shells do not introduce more than 50 extra characters relative to their base directory (e.g., `/tmp` when `$TMPDIR` is not set).
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this.
-
- Fix resolving of symlinks in flake paths [lix#106](https://git.lix.systems/lix-project/lix/issues/106) [lix#12286](https://git.lix.systems/lix-project/lix/pulls/12286) [cl/4783](https://gerrit.lix.systems/c/lix/+/4783)
-
-  Flake paths are now canonicalized to resolve symlinks. This ensures that when a flake is accessed via a symlink, paths are resolved relative to the target directory, not the symlink's location.
-
-  Many thanks to [stevalkr](https://github.com/stevalkr) and [xyenon](https://git.lix.systems/xyenon) for this.
-
- The REPL no longer considers failed loads for `:reload` [lix#50](https://git.lix.systems/lix-project/lix/issues/50) [cl/4864](https://gerrit.lix.systems/c/lix/+/4864) [cl/4865](https://gerrit.lix.systems/c/lix/+/4865) [cl/4700](https://gerrit.lix.systems/c/lix/+/4700) [cl/4889](https://gerrit.lix.systems/c/lix/+/4889)
-
-  The [REPL](@docroot@/command-ref/new-cli/nix3-repl.md) allows "loading" files, flakes, and expressions into the environment, with the commands `:load`/`:l`, `:load-flake`/`:lf`, and `:add`/`:a` respectively.
-  The results of those stay in the environment as-is even if their sources change, until the `:reload` command is used.
-  However `:reload` would re-perform *all* instances of `:l`/`:lf`/`:a`, meaning you would get things like this:
-
-  ```nix
-  nix-repl> :l /tmp/texting.nix
-  error: getting status of '/tmp/texting.nix': No such file or directory
-  # oops, typo.
-  nix-repl> :l /tmp/testing.nix
-
-  # Do some stuff…
-
-  nix-repl> :reload
-  error: getting status of '/tmp/texting.nix': No such file or directory
-  ```
-
-  This is pretty silly, but also *incredibly* annoying, as it would stop there and *not* reload the correct files anymore.
-  This effectively meant typoing any of the load commands would make `:reload` useless for the rest of the entire `nix repl` session!
-
-  This has been fixed, so now only *successful* loads count towards `:reload`.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [Qyriad](https://git.lix.systems/Qyriad) for this.
-
- Consistently use commit hash as rev when locking git inputs [cl/4762](https://gerrit.lix.systems/c/lix/+/4762)
-
-  Lix will now use commit hashes instead of tag object hashes in the `rev` field
-  when fetching git inputs by tag in `flake.lock` and `builtins.fetchTree` output.
-  Note that this means that Lix may change some `flake.lock` files on re-locking. Old `flake.lock` files still remain valid.
-
-  Many thanks to [goldstein](https://git.lix.systems/goldstein) for this.
-
-
-## Development
-
- Functional lang migration [lix#856](https://git.lix.systems/lix-project/lix/issues/856) [cl/3213](https://gerrit.lix.systems/c/lix/+/3213)
-
-  We have done it! The functional/lang framework has now been fully migrated to functional2/lang.
-  This means: no more `just clean` and `just install` mess and whatever because one removed a test.
-  The lang test suite is also getting a face lift, with an improved folder structure and restructuring of many tests.
-
-  Only the first CL of the chain is provided but there's way more changes associated to this project.
-
-  Many thanks to [piegames](https://git.lix.systems/piegames) and [rootile (Rutile)](https://git.lix.systems/rootile) for this.
-
-
-## Miscellany
-
- Warn instead of erroring when the final destination of a transfer changes in-flight [lix#1004](https://git.lix.systems/lix-project/lix/issues/1004) [cl/4641](https://gerrit.lix.systems/c/lix/+/4641)
-
-  Lix will now emit a warning during downloads where the final destination changes suddently mid-transfer instead of throwing an error.
-  This transfer behavior has been known to happen very rarely while fetching from some CDNs.
-
-  Many thanks to [Tom Hubrecht](https://git.lix.systems/tom-hubrecht) for this.
-
- `impersonate-linux-26` setting removed [cl/5047](https://gerrit.lix.systems/c/lix/+/5047)
-
-  Linux 3.0 was released 15 years ago. The `impersonate-linux-26` setting was added
-  14 years ago with no mention of it being necessary to build anything, only saying
-  that it improves determinism—which isn't accurate since impersonating Linux 2.6.x
-  still allows the version string to change, and the final component of the version
-  does still change with each Linux release. Since this setting should be no longer
-  necessary in modern systems and workarounds for building old code exist (by using
-  e.g. `setarch --uname-2.6` to wrap builds) we are removing this setting from Lix.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Default to showing build logs in the new-style (nix3) CLI [cl/4674](https://gerrit.lix.systems/c/lix/+/4674)
-
-  Lix will now show logs by default, in addition to the progress bar, when invoked through the new-style "nix3" CLI (`nix build`, etc)
-
-  Many thanks to [K900](https://git.lix.systems/K900) for this.
-
- Lix daemons are now fully socket-activated on systemd setups [lix#1030](https://git.lix.systems/lix-project/lix/issues/1030)
-
-  When launched by systemd, Lix no longer uses a persistent daemon process and uses systemd socket
-  activation instead. This is necessary to support the `cgroups` and `auto-allocate-uids` features
-  and may improve observability of daemon behavior with common systemd-based monitoring solutions.
-
-  The old behavior with a single persistent daemon is still available, but disabled by default. It
-  is not possible to enable both a persistent daemon and socket activation, starting one stops the
-  other automatically. Existing installations should not require any changes when they're updated.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
- Plugin interfaces have changed (again) [lix#359](https://git.lix.systems/lix-project/lix/issues/359) [cl/4933](https://gerrit.lix.systems/c/lix/+/4933) [cl/4934](https://gerrit.lix.systems/c/lix/+/4934)
-
-  The `RegisterPrimOp` class used to register builtins has been removed. Plugins
-  must now call `PluginPrimOps::add` from their `nix_plugin_entry` with the same
-  parameters previously passed to `RegisterRrimOp` to register any new builtins.
-
-  The `GlobalConfig::Register` helper class has also been removed. Adding config
-  options to the system is now done with `GlobalConfig::registerGlobalConfig`; a
-  plugin can add config values by calling this function from `nix_plugin_entry`.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Raito Bezarius	a6f0e87fa8	libexpr/static-analyzer: init Change-Id: I606718fbe33db1f6c00ca34f45c6553ce468398c Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-11-21 17:36:35 +01:00
eldritch horrors	17879c9a83	libexpr: de-ptr-ize Value references thunk values are shareable, and we can represent invalid/uninitialized values with a special bit pattern that makes no sense otherwise. there is no need to keep allocating values on the heap, instead we can treat values like reference-counted smart pointers to heap objects, which in turn lets us save a lot of allocations and, ultimately, gc heap space. compared to our baseline (main of 2025-09-27) we save 15%+ memory on a system rebuild and 17% on nix search. eval time regresses by ~3% for a system rebuild, while nix search is 7% faster. further optimization is probably possible (but for now this will just have to be good enough). Change-Id: Ib6c47acdbe2fac4f76a83c2269f16f30ef66b2e1	2025-09-28 00:02:21 +02:00
eldritch horrors	9ba7a7eee7	libexpr: reformat stuff we'll change soon mainly to keep the next diff smaller. it'll be large enough as is. Change-Id: Ib8a34520f03539cbf6aa2f0e66cbed05fe1225eb	2025-09-28 00:02:21 +02:00
eldritch horrors	5f070b2297	libexpr: de-ptr-ize many Value uses with thunk state being shareable we no longer need to worry about value uniqueness, only about value lifetime. this means we can liberally drop indirections and allocations, passing references instead of pointers or using stack memory instead of gc-managed memory for some intermediates. Change-Id: I2d48a6fd57a376d544bd9bd2d05e5420611986d1	2025-09-28 00:02:21 +02:00
eldritch horrors	3b093988fb	libexpr: remove ValueVector{,Map} these typedefs were convenient in the past, but now they're not really. Change-Id: I7522f7582ead545148af8e6444295d620ee0872a	2025-09-28 00:02:21 +02:00
eldritch horrors	fe6dfa5ace	libexpr: remove unused return types Change-Id: Ief898b70f9781bd3dbe66734710f388daa2f2fed	2025-09-28 00:02:21 +02:00
eldritch horrors	acd85805ab	libexpr: remove type punning in primt_attrValues there's no measurable performance gain in real-world testing to abusing our list value storage like this. we haven't tested how much storage we actually need on the stack to offset most of the temporary storage cost and used 128 as a "good enough" value instead, reserving 1 kiB of stack space on 64 bit platforms in a leaf function. this should do for a bit. Change-Id: Ie98519b1da3e6fe685da88d1c44ffb4580fb592a	2025-09-28 00:02:21 +02:00
eldritch horrors	af86b74467	libexpr: tag Value::Acb Value is already tagged. Value::Acb blocks are allocated for lambdas (so we can fit the value tag into the three bits we have available), but the current layout is rather wasteful for this purpose. the type bits can be stored together with parts of pointers, which in the lambda case will be the scope the lambda captures. the expr could also be used, but Env is a gc-allocated item and thus guaranteed to be aligned properly for tagging Change-Id: Ia685875387c7795bc4a00d73d1ce3cfea84e7297	2025-09-28 00:02:21 +02:00
eldritch horrors	85ed12485e	libexpr: make thunk state shareable this is a strong prerequisite for making values themselves copyable without duplicating evaluation side effects. with this we can treat `Value` the way we treated `Value *` to date and drop indirections. Change-Id: I08f30d12697614a3ae7149615f6f1da83b13f52b	2025-09-28 00:02:21 +02:00
eldritch horrors	30b971f6e0	libexpr: reduce Value size to one pointer Change-Id: Id6e4a2f68eaa4afdd006379ebcf839c4a126b819	2025-09-28 00:02:21 +02:00
eldritch horrors	32440b5fae	libexpr: heap-allocate "large" integers Change-Id: Ic391f2f1bf87f044d7a688196ba9e0ad766d65aa	2025-09-28 00:02:21 +02:00
eldritch horrors	aa39e14fcf	libexpr: heap-allocate app nodes Change-Id: I9a39dcf0be7589cedf494757e21665c5d50e446b	2025-09-28 00:02:21 +02:00
eldritch horrors	b0d11f9da1	libexpr: heap-allocate thunk control state Change-Id: I20d8ab1d6f683c0a2f3b77edf9bdad147d62c8fa	2025-09-28 00:02:20 +02:00
eldritch horrors	002dfbb2e3	libexpr: move lambdas to auxiliary storage Change-Id: Ibe4885f17c0ba1634ed6dbca0a45f8bd4619d69b	2025-09-28 00:02:20 +02:00
eldritch horrors	6e242e8b9b	libexpr: move primops to auxiliary storage same as for null: we have few of them, they're statically allocated, and they're not the largest contributor to the value population. not storing them in Value itself frees up resources we will use later. Change-Id: I521f9f243f48f56a78f7bffdf1dc1f0bc40a5c2d	2025-09-28 00:02:20 +02:00
eldritch horrors	b1ffae3ccd	libexpr: move null to auxiliary storage we only need the one object for it. there's no need to waste precious bits of the value internal type enum for this simple singleton datum. Change-Id: Ie314b5bf429015e518798d9d65ad8ab2bb84a38e	2025-09-28 00:02:20 +02:00
eldritch horrors	5def7559a6	libexpr: move floats to auxiliary storage floats are used very rarely, and our float support is bad enough to strongly discourage using them on reproducibility grounds alone. we can thus move them to more expensive storage without hurting folks. Change-Id: I1086f612f85e294dd3fae4a2d334e09f52bbe4a8	2025-09-28 00:02:20 +02:00
eldritch horrors	ce70234904	libexpr: move external value refs to aux storage external values very rarely appear during eval "normal" eval, and creating them is pretty expensive. does anything even use them? Change-Id: Id50fa3f76b7e1f551d550d99996a1ed5880b2531	2025-09-28 00:02:20 +02:00
eldritch horrors	cbc378b277	libexpr: heap-alloc string control blocks despite not using allocation caches this does not have a statistically significant performance impact, with less than 1% extra memory needed. Change-Id: Ibe51a55ba986e471f217f3724977af17880fafff	2025-09-28 00:02:20 +02:00
eldritch horrors	5d6bb8c350	libexpr: remove tPrimOpApp using the same nodes as tApp is possible, and thanks to multi-arg app nodes it can even be a bit faster than the linked lists used to date. Change-Id: Idccb7c0b54c808e62da85d1c42ee09e6e92c4f7b	2025-09-28 00:02:20 +02:00
eldritch horrors	93bda92508	libexpr: add multi-arg app nodes these behave like the old chains of app nodes, but they can store more than one argument per node. for tApp values themselves this is not all that useful, but if we could share tApp and tPrimOpApp backing storage we could avoid creating and traversing the linked lists of values that are currently needed to represent partially applied builtin functions. Change-Id: I5a2a02d9733e1e0be5443459e2998d62fd3b9a5b	2025-09-28 00:02:20 +02:00
eldritch horrors	dbee9d15c5	libexpr: use std::span for callFunction Change-Id: I8c94bafabdb2416c85d9721d3d6424f52fbd45e0	2025-09-28 00:02:20 +02:00
eldritch horrors	7642b7227a	libexpr: unify strings and paths paths already are just strings with slightly magic semantics. the type can mirror that at no perf cost, letting us drop one internalType tag. Change-Id: I98acaa4fe3bedd28fc0841e1b81184d8dcddacc5	2025-09-28 00:02:20 +02:00
eldritch horrors	aa96b00182	libexpr: alloc list storage as a (length, vla) type memory overhead is minimal and performance impact not measurable. once we've done something like this for all value types that don't fit in a single machine word we can cut a word from Value, offsetting the cost. Change-Id: I9813bacd7e851957ad3426aed8f74033179a4212	2025-09-28 00:02:20 +02:00
eldritch horrors	d37a5d4000	libexpr: don't inline small lists into values this has no measurable performance impact thanks to the new caches. Change-Id: Ib403a9a567161675f78e8c5d314d6340183d181d	2025-09-28 00:02:20 +02:00
eldritch horrors	b36a19e50c	libexpr: cache more allocation sizes we now use a single cache set for a number of sizes from one to eight words. this also matches small attrsets, but perf impact seems small. Change-Id: Icf16b329b98a20fcc9fe75e6395e148f0852c798	2025-09-28 00:02:20 +02:00
eldritch horrors	f08b8532be	libexpr: "hide" Value union members on its own this is not very useful, but having accessors for every value kind is a prerequisite for doing smart things with Value than the union. the net effect for now is only to add a few parentheses across the tree. Change-Id: I88688ac09eb08495dad1eb221034ca540f094950	2025-09-28 00:02:20 +02:00
eldritch horrors	f3fcd7c02f	bench: add memory benchmark Change-Id: I4b2aa305b452a3a0c73e37953a5c332219d43d2c	2025-09-28 00:02:20 +02:00
eldritch horrors	1f0b25a92c	bench: allow benchmarking a single build Change-Id: Ie77247f9348eaeea740b0f894819ee2383d92312	2025-09-28 00:02:20 +02:00
eldritch horrors	82b771951c	testing: disable substitution in f2 mirrors f1. much faster. Change-Id: I38bbbd5b26220f480afe76ef9302e5c90f21507a	2025-09-28 00:02:20 +02:00
				`@@ -1 +0,0 @@`
				`This section lists known issues around Lix.`