From e4a22b41907cb9cd460044d98b3f5cd50a5bbd59 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 2 Sep 2026 00:54:09 +0200
Subject: [PATCH] module-eval: cut the header to the new comment budget, drop
 the verdict note
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mara set a 20-line comment maximum and scoped this file for the first pass.
Measured rather than eyeballed: this file had exactly one block over 20 — the
28-line header. Every other block in it is 8 lines or fewer, so the pass is
that header plus one removal.

The header keeps the four things a reader can act on — why this check exists,
assertion versus the absence class, name a case for the property it defends,
and evaluates-rather-than-executes with its stubbing rule — and loses the
connective prose around them.

The verdict-reading paragraph goes back out. It landed by a misclick on a PR
she meant to close, and the judgement is the one she gave its sibling: the
technique works, it just does not earn source space.

The lint still enforces 30. 208 blocks repo-wide exceed 20, so flipping MAX
belongs to the overhaul rather than to this file's pass.
---
 nix/module-eval.nix | 42 +++++++++++++-----------------------------
 1 file changed, 13 insertions(+), 29 deletions(-)

diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 82585bcc..3ca034d1 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -1,31 +1,22 @@
 # `checks.module-eval` — the flake check that covers **nix**.
 #
-# Why this exists: every other check in ./checks.nix is a Rust
-# derivation, so a `.nix`-only diff moves no hash, every check is a
-# cache hit, and `nix flake check` reports green **without evaluating
-# what changed**. This one's derivation hash is a function of the
-# evaluated *results* below, so a nix change that flips a property
-# rebuilds it and the builder fails naming that property.
+# Every other check in ./checks.nix is a Rust derivation, so a `.nix`-only
+# diff moves no hash and `nix flake check` goes green **without evaluating
+# what changed**. This derivation's hash is a function of the results
+# below, so a change that flips a property rebuilds it and fails naming it.
 #
-# ## What belongs here, and what does not
-#
-# Anything expressible as a module `assertion` **should be one instead**:
+# Anything expressible as a module `assertion` **should be one instead** —
 # an assertion fires at deploy time for a real operator, not only in CI.
-# What cannot be an assertion is the **absence class** — "a hive that
-# hasn't opted in renders exactly what it did before", "this unit does
-# not exist unless X". Those are claims about the *rendered config*
-# rather than about a config being invalid, so they need an evaluator.
+# What cannot is the **absence class**: "a hive that hasn't opted in
+# renders what it did before", "this unit does not exist unless X" — claims
+# about the rendered config rather than about a config being invalid.
 #
-# ⚠️ **Cases are named by the PROPERTY they defend, never by the ticket
-# that prompted them.** A case named after a ticket has the ticket's
-# lifetime; a case named after a property lives as long as the property.
+# ⚠️ **Name a case for the PROPERTY it defends, never the ticket that
+# prompted it**; a case named after a ticket has the ticket's lifetime.
 #
-# ⚠️ **This check evaluates. It does not execute.** Where the artifact is
-# a command line, an HTTP request or a certificate, a value assertion
-# cannot stand in — those need something that *runs* them. And a case
-# that needs a **rendered file** must stub the packages that file drags
-# in (`swarm.ui.package = pkgs.emptyDirectory`), or it costs a full
-# frontend build to answer a question about a listen directive.
+# ⚠️ **This evaluates, it does not execute** — a command line, a request or
+# a certificate needs something that *runs* it. A case needing a rendered
+# file must stub what it drags in (`swarm.ui.package = pkgs.emptyDirectory`).
 {
   pkgs,
   lib,
@@ -571,13 +562,6 @@ in
 # The results are embedded in the builder text on purpose: that is what
 # makes this derivation's hash depend on them, so a nix-only change that
 # flips a case cannot be answered from cache.
-#
-# It also means the verdict can be read without building anything, which is
-# what makes mutation-testing a case affordable — mutate, re-read, restore,
-# with nothing queued on the shared builder:
-#
-#     nix derivation show .#checks.<system>.module-eval \
-#       | jq -r '..|.buildCommand? // empty'
 pkgs.runCommand "hyperhive-module-eval" { } ''
   ${report}
   ${