From c90b9992852bee344eb69acdebe9575bde43f0c1 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Tue, 1 Sep 2026 10:38:04 +0200
Subject: [PATCH] module-eval: say how to read the verdict without a build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The check's results are already embedded in its builder text — the comment
above `runCommand` says so — but nothing said that this makes the verdict
readable straight out of the derivation. So mutation-testing a case, which
is the documented way to prove a case can fail, has been costing a build on
the shared farm per arm when it costs none.

Command verified against both arms: on an unmutated tree it prints the
`N properties hold` line, and with a case deliberately broken it prints that
case's `FAILED:` line. The jq shape is envelope-agnostic, since `derivation
show` grew a `{"derivations": …}` wrapper.
---
 nix/module-eval.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 3cd84707..82585bcc 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -571,6 +571,13 @@ in
 # The results are embedded in the builder text on purpose: that is what
 # makes this derivation's hash depend on them, so a nix-only change that
 # flips a case cannot be answered from cache.
+#
+# It also means the verdict can be read without building anything, which is
+# what makes mutation-testing a case affordable — mutate, re-read, restore,
+# with nothing queued on the shared builder:
+#
+#     nix derivation show .#checks.<system>.module-eval \
+#       | jq -r '..|.buildCommand? // empty'
 pkgs.runCommand "hyperhive-module-eval" { } ''
   ${report}
   ${