Instrument and improve incremental workspace checks

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

nix/checked-candidate.nix

@@ -9,7 +9,11 @@
   system ? builtins.currentSystem,
 }:
 let
-  pkgs = import (/. + "@nixpkgs@") { inherit system; };
+  pkgs = import (/. + "@nixpkgs@") {
+    inherit system;
+    config = { };
+    overlays = [ ];
+  };
   protocol = builtins.storePath generator;
   sourceKey = source: "${source.kind}:${source.repository}@${source.commit}";
   fetch =
@@ -26,8 +30,9 @@ let
     source:
     let
       directory = fetch source;
+      lockSource = import ./lock-source.nix { source = directory; };
       lockFile = pkgs.runCommand "qx-source-lock.json" { } ''
-        ${protocol}/bin/quixos-lock-check ${directory}/quixos.lock > "$out"
+        ${protocol}/bin/quixos-lock-check ${lockSource}/quixos.lock > "$out"
       '';
       lock = builtins.fromJSON (builtins.readFile lockFile);
     in
@@ -124,15 +129,40 @@ let
         }) (builtins.filter (entry: entry.kind != "workspace") (resourceClosure true node));
       }
     );
-  compile =
+  # Each resource is checked once per exact source/closure/frontend/toolchain.
+  # Composition imports these compiler outputs; authoring receipts are never
+  # build inputs. Missing entries in ordinary CLI use take the full check path.
+  compiledNodes = builtins.mapAttrs (_: node: compileNode node) nodeTable;
+  compile = node: compiledNodes.${sourceKey node};
+  checkedResources =
     node:
-    pkgs.runCommand "qx-${node.kind}-contract" { } ''
+    pkgs.writeText "qx-checked-resources.json" (
+      builtins.toJSON (
+        map
+          (dependency: {
+            inherit (dependency) kind repository commit;
+            artifact = compile dependency;
+          })
+          (
+            builtins.filter (
+              dependency:
+              dependency.kind != "workspace"
+              && dependency.kind != "build"
+              && sourceKey dependency != sourceKey node
+            ) (resourceClosure true node)
+          )
+      )
+    );
+  compileNode =
+    node:
+    pkgs.runCommand "qx-${node.kind}-contract" { QUIXOS_TRACE_PROFILE = "1"; } ''
       mkdir -p "$out"
       ${
         if node.kind == "workspace" then
           ''
             ${protocol}/bin/quixos-workspace-compile --root ${node.directory} \
-              ${queryGeneratorFlags node} \
+              ${queryGeneratorFlags root} \
+              --checked-resources ${checkedResources node} \
               --source-root-commit ${pkgs.lib.escapeShellArg node.commit} \
               --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} \
               --graph-out "$out/graph.json" --schemas-out "$out/package-schemas.json" \
@@ -144,7 +174,8 @@ let
         else
           ''
             ${protocol}/bin/quixos-resource-compile --root ${node.directory} \
-              ${queryGeneratorFlags node} \
+              ${queryGeneratorFlags root} \
+              --checked-resources ${checkedResources node} \
               --kind ${node.kind} --repository ${pkgs.lib.escapeShellArg node.repository} \
               --commit ${pkgs.lib.escapeShellArg node.commit} \
               --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} --snapshot-only true \
@@ -153,6 +184,18 @@ let
       }
     '';
   contract = compile root;
+  # Parse shared workspace outputs once. Repeating fromJSON in every package
+  # makes composition quadratic in package count and in the serialized world.
+  workspacePackages = builtins.listToAttrs (
+    map
+      (pkg: {
+        name = sourceKey (pkg.source // { kind = "package"; });
+        value = pkg;
+      })
+      (builtins.fromJSON (builtins.readFile "${contract}/execution-plan.json"))
+      .definition.bindingSchema.packages
+  );
+  workspaceContexts = builtins.fromJSON (builtins.readFile "${contract}/build-contexts.json");
   buildDependencies =
     node:
     builtins.listToAttrs (
@@ -218,17 +261,19 @@ let
         if execution && kind == "workspace" then
           {
             revision =
-              pkgs.lib.findFirst
-                (pkg: pkg.source.repository == node.repository && pkg.source.commit == node.commit)
-                (throw "Source package missing from workspace compilation: ${node.repository}")
-                (builtins.fromJSON (builtins.readFile "${contract}/execution-plan.json"))
-                .definition.bindingSchema.packages;
+              workspacePackages.${sourceKey node}
+              or (throw "Source package missing from workspace compilation: ${node.repository}");
           }
         else
           builtins.fromJSON (builtins.readFile "${compiled}/candidate.json");
       buildContext = import ./package-context.nix {
         inherit pkgs protocol;
         contexts = if kind == "workspace" then "${contract}/build-contexts.json" else null;
+        contextData =
+          if execution && kind == "workspace" then
+            workspaceContexts.${candidate.revision.revisionId}
+          else
+            null;
         plan = "${compiled}/bindings.json";
         packageRevisionId = candidate.revision.revisionId;
       };
@@ -254,6 +299,11 @@ let
             typescript = runtimePackages.camino-replica-core.dependencies;
             packageRevisionId = candidate.revision.revisionId;
             dependencies = buildDependencies node;
+            buildEnvironment = {
+              inherit pkgs system;
+              nixpkgsSource = toString pkgs.path;
+              narHash = "@nixpkgsNarHash@";
+            };
           }
           // pkgs.lib.optionalAttrs (componentEntries != [ ]) {
             react = {
@@ -310,7 +360,7 @@ in
 pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate") { } ''
   mkdir -p "$out"
   cp ${
-    pkgs.writeText "qx-candidate-source.json" (builtins.toJSON { inherit repository commit kind; })
+    builtins.toFile "qx-candidate-source.json" (builtins.toJSON { inherit repository commit kind; })
   } "$out/source.json"
   cp ${contract}/candidate.json "$out/candidate.json"
   cp ${contract}/graph.json "$out/graph.json"