nix: flake.nix hand-types stale package versions (maxplayer 0.1.1 vs workspace 0.5.6, relay 0.1.0 vs buzz-relay 0.2.0) — derive them from the manifests

[maxy-player]

flake.nix hand-types package versions that no longer match the crates it builds. Measured at main = c1338504.

The mismatch

flake.nix	label	what it builds	real version
:43-44 pname = "maxplayer"; version = "0.1.1"	0.1.1	the maxplayer workspace crate (src = self)	0.5.6 — Cargo.toml:20 [workspace.package] version = "0.5.6", inherited by crates/maxplayer/Cargo.toml:8 (version.workspace = true). Latest tag v0.5.6.
:102-103 pname = "maxplayer-relay-write-policy"; version = "0.1.1"	0.1.1	a workspace crate (src = self)	0.5.6 if it is a workspace member — same inheritance
:135-136 pname = "maxplayer-relay"; version = "0.1.0"	0.1.0	the vendored buzz-relay crate (src = ./crates/buzz)	0.2.0 — crates/buzz/crates/buzz-relay/Cargo.toml:7

Why it matters

The label is what nix shows: store path names (maxplayer-0.1.1), nix flake show, nix profile list, and any deployed nixosConfigurations.relay closure. The binary inside says something else — maxplayer --version comes from Cargo and prints 0.5.6. One artifact, two versions, and the nix one is the stale one. After #818 lands (PR #955 stamps the build commit into --version), a nix user will hold a binary that names its exact commit while its store path claims a release four minors old.

Nothing today compares the two, so this cannot fail CI and will drift again the next time the workspace bumps.

Change

Derive, do not relabel. A hand-typed string went stale once; a second hand-typed string will too.

1. maxplayer and maxplayer-relay-write-policy: version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
2. maxplayer-relay: version = (builtins.fromTOML (builtins.readFile ./crates/buzz/crates/buzz-relay/Cargo.toml)).package.version;
3. No literal version string remains in flake.nix for any package.

Acceptance

• nix eval --raw .#packages.<system>.maxplayer.version prints exactly the [workspace.package] version from Cargo.toml; the relay package prints exactly buzz-relay's.
• grep -nE 'version = "[0-9]' flake.nix prints nothing.
• Optional and worth it: one line in scripts/verify-release-version.sh (already the release gate for the version string, per stamp the build commit into maxplayer --version #818) that fails a release when the flake-evaluated version differs from Cargo.toml. Only if nix is available on the release runner; otherwise leave it out and say so.

Bounds

• Scope is the three version = lines and nothing else in flake.nix. PR cli: stamp the build commit into maxplayer --version (closes #818) #955 (stamp the build commit into maxplayer --version #818) adds a MAXPLAYER_BUILD_COMMIT line at :47 in the same block and leaves :44 alone, so the two are disjoint but adjacent; whichever lands second rebases trivially.
• Whether maxplayer-relay-write-policy is a workspace member is not confirmed here — read its cargoBuildFlags at :106 and the crate's manifest before choosing rule 1 or 2 for it.
• nix is not installed on the box that measured this, so the acceptance commands were not run. Someone with nix should evaluate before and after.

Surfaced by the #818 worker (w-818-version-stamp) while stamping --version; parked as "818-siblings" and filed on Bob's word.

---

Filed by maxie (forge v2 domain lead) under the shared maxy-player credential, on Bob's order 2026-09-01 21:44 PDT.