Instrument and improve incremental workspace checks

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

test/capability-assembly.test.ts

@@ -107,6 +107,35 @@ package Runtime id "package:runtime" revision "package:runtime@1" {
   assert.equal(resource.resource.kind, "package");
   assert.equal(resource.resources.length, 2);
   assert.equal(resource.directResources.size, 1);
+
+  const checked = new Map(result.resources.map((node) => [node.key, node.resource]));
+  let generated = 0;
+  const reused = await compileWorkspaceRepository({
+    rootDirectory: root,
+    resolveResource: async (source, kind) => ({
+      directory: directories.get(`${kind}\0${source.repository}\0${source.commit}`)!,
+    }),
+    checkedResource: async (kind, source) => {
+      const value = checked.get(`${kind}\0${source.repository}\0${source.commit}`);
+      return value?.kind === "build" ? undefined : value;
+    },
+    generateQueries: async () => {
+      generated++;
+      return { queries: [], documents: new Map() };
+    },
+  });
+  assert.deepEqual(reused, result, "Nix-composed resource checks preserve full assembly results");
+  assert.equal(generated, 0, "unchanged checked packages do not run their query frontend again");
+  await assert.rejects(
+    compileWorkspaceRepository({
+      rootDirectory: root,
+      resolveResource: async (source, kind) => ({
+        directory: directories.get(`${kind}\0${source.repository}\0${source.commit}`)!,
+      }),
+      checkedResource: async () => (resource.resource.kind === "build" ? undefined : resource.resource),
+    }),
+    /Checked resource identity mismatch/,
+  );
 });
 
 test("resource repositories cannot own workspace Quixos selection policy", async (context) => {
@@ -249,19 +278,48 @@ test("resource-owned fragment imports compile through the locked package closure
  }`,
   );
   await writeFile(path.join(dirs.screen!, "screen.graphql"), "query Screen {root {...Row}}");
-  const result = await compileCapabilityResourceRepository({
+  const options = {
     rootDirectory: dirs.screen!,
-    kind: "package",
-    source: { resolver: "git", repository: "https://example.test/screen.git", commit: packageCommit },
-    resolveResource: async (source) => {
+    kind: "package" as const,
+    source: { resolver: "git" as const, repository: "https://example.test/screen.git", commit: packageCommit },
+    resolveResource: async (source: { repository: string }) => {
       const name = new URL(source.repository).pathname.slice(1, -4);
       assert.ok(dirs[name], name);
       return { directory: dirs[name]! };
     },
-  });
+  };
+  const result = await compileCapabilityResourceRepository(options);
   assert.equal(result.resource.kind, "package");
   if (result.resource.kind !== "package") throw Error("expected package");
   const view = result.resource.revision.checkedQueries!.find((q) => q.declaration.id === "view")!;
   assert.equal(view.selection[0]!.selection[0]!.fragmentSpread?.package, "rows@1");
   assert.equal(result.resources.length, 3);
+  const checked = new Map(result.resources.map((node) => [node.key, node.resource]));
+  let generated = 0;
+  const reused = await compileCapabilityResourceRepository({
+    ...options,
+    checkedResource: async (kind, source) => {
+      if (source.repository === options.source.repository) return undefined;
+      const resource = checked.get(`${kind}\0${source.repository}\0${source.commit}`);
+      return resource?.kind === "build" ? undefined : resource;
+    },
+    generateQueries: async () => {
+      generated++;
+      return { queries: [], documents: new Map() };
+    },
+  });
+  assert.deepEqual(reused, result, "cached imported fragments and full checking produce identical contracts");
+  assert.equal(generated, 1, "only the uncached package checks its queries");
+  await writeFile(path.join(dirs.screen!, "screen.graphql"), "query Screen {root {unknownField}}");
+  await assert.rejects(
+    compileCapabilityResourceRepository({
+      ...options,
+      source: { ...options.source, commit: "5".repeat(40) },
+      checkedResource: async (kind, source) => {
+        const resource = checked.get(`${kind}\0${source.repository}\0${source.commit}`);
+        return resource?.kind === "build" ? undefined : resource;
+      },
+    }),
+    /unknownField/,
+  );
 });