denful · sini · Sep 15, 2026 · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026
diff --git a/.claude/skills/den-debugging.md b/.claude/skills/den-debugging.md
@@ -152,7 +152,7 @@ When a bug involves content wrappers, check whether the forwarded (shallow-merge
 Look for structural markers that distinguish the working path from the broken path. In den's pipeline, common differentiators:
 
 - `__contentValues` — present on content wrappers from `aspectContentType`, absent on sub-aspects from `emitNestedAspect` and full aspects from `aspectSubmodule`
-- `__provider` — tracks the definition path through nested aspects
+- `__aspectChain` — tracks the definition path through nested aspects
 - `__providesForwarded` — keys forwarded from `provides` onto the aspect
 - `__fn` / `__args` — parametric wrappers
 - `__scopeHandlers` — context propagation

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -119,7 +119,7 @@ New test files must be `git add`'d before nix can evaluate them. Use `--override
 - Idiomatic Nix: use `lib.optional` `lib.optionals` `lib.optionalAttrs` for basic conditionals
 - Idiomatic Nix: avoid `with` — prefer `inherit` to bring names into scope. `with` obscures where bindings come from and breaks tooling.
 - Error messages: prefix with `den:` for traceability (e.g., `throw "den: multiple __functor definitions at ..."`)
-- Internal markers: double-underscore prefixed attrs (`__contentValues`, `__provider`, `__fn`) are pipeline internals. Don't add new ones without understanding the classification and structural key filtering in `key-classification.nix`.
+- Internal markers: double-underscore prefixed attrs (`__contentValues`, `__aspectChain`, `__fn`) are pipeline internals. Don't add new ones without understanding the classification and structural key filtering in `key-classification.nix`.
 - Commenting: comments should describe why not what, code should be self documenting as to what
 - Minimal changes: fix the bug, don't refactor surroundings
 - Diagnose before reverting: the fix is usually one targeted change

diff --git a/ci.bash b/ci.bash
@@ -1,7 +1,12 @@
 #!/usr/bin/env bash
 #
 # Uses nix-eval-jobs with $(nproc) workers
-# NOTE: Ignores tests with expectedError
+# NOTE: expectedError cells only verify that expr throws SOMETHING (via
+# tryEval, in the --select expression below). They do not verify
+# expectedError.type/.msg — nix-eval-jobs runs each job out-of-process, so
+# only tryEval's success/failure crosses that boundary, not the caught
+# exception's details. Use `nix-unit` directly (`just ci-deep`/`just test`)
+# for full type/msg verification.
 #
 # Redirect stdout to null IF you only want to see failures
 set -aeuo pipefail
@@ -48,13 +53,18 @@ if test -n "$testFilter"; then
 fi
 
 results=$(mktemp -t den-test-XXXXX.json)
+evalLog=$(mktemp -t den-test-XXXXX.err)
 
 # Cap workers and per-worker memory to prevent OOM from infinite recursion.
 # nproc can be very high (32+); limit workers so worst-case memory is bounded.
 max_workers=8
 mem_per_worker=2048  # MiB
 workers=$(( $(nproc) < max_workers ? $(nproc) : max_workers ))
 
+# set +e around the pipeline: under `set -e` a dying evaluator aborts the
+# script here, so the summary below never runs and the exit status arrives
+# with nothing said. Read PIPESTATUS instead and report it.
+set +e
 nix-eval-jobs \
   --flake ./templates/ci#tests${preSuite} \
   --override-input den . \
@@ -68,8 +78,16 @@ nix-eval-jobs \
         let
           hasExpected = v ? expected && !(v.expected ? undefined);
           hasExpectedError = v ? expectedError && !(v.expectedError ? undefined);
+          # nix-eval-jobs runs each job in a separate worker; only
+          # tryEval'\''s success/failure crosses that boundary, not the
+          # caught exception'\''s type/msg text. So this only proves expr
+          # throws SOMETHING — closing the class where a fix silently stops
+          # throwing and the cell still reads green. It does not verify
+          # expectedError.type/.msg; only `nix-unit` does that (it uses
+          # the evaluator'\''s C++ API directly to inspect the exception).
           pass = if hasExpected then v.expr == v.expected
-                 else if hasExpectedError then true # ignored
+                 else if hasExpectedError then
+                   !(builtins.tryEval (builtins.deepSeq v.expr null)).success
                  else true;
           name = builtins.replaceStrings ["." "'\''"] ["-" "_"] prefix;
         in derivation {
@@ -81,17 +99,34 @@ nix-eval-jobs \
         builtins.mapAttrs (k: go (if prefix == "" then k else "${prefix}.${k}")) v
       else derivation { name = "SKIP"; system = "${system}"; builder = "/bin/sh"; args = ["-c" "echo > $out"]; };
   in builtins.mapAttrs (k: go k) tests' \
-  "${args[@]}" 2>/dev/null \
+  "${args[@]}" 2>"$evalLog" \
   | tee "$results" \
   | jq -r 'if (.name != null and (.name | startswith("PASS-"))) then "✅ '"${postSuite}"'" + .attr else empty end'
+evalStatus=${PIPESTATUS[0]}
+set -e
+
+# A dead evaluator is not a test failure and must not be tallied as one:
+# `total` below is pass+fail over whatever reached the JSON stream, so a run
+# that stopped early still reads as a clean N/N with zero failures. The
+# evaluator's stderr is the only thing that says which file and line killed
+# it, so it is a file now rather than /dev/null.
+if [ "$evalStatus" -ne 0 ]; then
+  echo >&2
+  echo "💥 EVALUATOR FAILED (nix-eval-jobs exit ${evalStatus})" >&2
+  echo "The run stopped early — no tally covers what it did not reach." >&2
+  echo >&2
+  cat "$evalLog" >&2
+  rm -f "$evalLog" "$results"
+  exit "$evalStatus"
+fi
 
 pass=$(jq -r 'select(.name != null and (.name | startswith("PASS-"))) | "."' "$results" | wc -l)
 fail=$(jq -r 'select(.error != null or (.name != null and (.name | startswith("FAIL-")))) | "."' "$results" | wc -l)
 total=$(expr "$pass" + "$fail")
 
 if [ "$fail" -eq "0" ]; then
   echo "🎉 ${pass}/${total} successful" >&2
-  rm "$results" || true
+  rm -f "$results" "$evalLog" || true
 else
   echo >&2
   echo "💥 FAILURES (${fail}):" >&2
@@ -101,6 +136,14 @@ else
   jq -r 'select(.error != null or (.name != null and (.name | startswith("FAIL-")))) | "❌ '"${postSuite}"'" + .attr' "$results" >&2
   echo >&2
   echo "😢 ${pass}/${total} successful" >&2
-  rm "$results" || true
+  # Only when the evaluator actually said something. An ordinary assertion
+  # failure leaves nothing here but nix's lock-file warnings, and burying the
+  # list of failures under those is how a diagnostic stops being read.
+  if grep -q "^error:" "$evalLog"; then
+    echo >&2
+    echo "--- evaluator stderr ---" >&2
+    cat "$evalLog" >&2
+  fi
+  rm -f "$results" "$evalLog" || true
   exit 1
 fi
diff --git a/docs/src/content/docs/reference/aspects.mdx b/docs/src/content/docs/reference/aspects.mdx
@@ -65,10 +65,10 @@ registered class), *nested aspect keys*, or one of these structural keys:
 |-----|------|---------|
 | `<class>` | module / config | Config merged into entities of that class |
 | `includes` | `listOf provider` | Providers (aspects, sub-aspects, functions) pulled into this aspect |
-| `excludes` | `listOf unspecified` | Aspects or policies excluded from this subtree |
+| `excludes` | `listOf provider` | Aspects or policies excluded from this subtree |
 | `provides` / `_` | submodule | Sub-aspect namespace (`_` is an alias for `provides`) |
 | `policies` | policy registry | Named policy functions, activated by placing in `includes` |
-| `meta` | submodule | Attached metadata (`handleWith`, `provider`, `collisionPolicy`; `guard`/`aspects` for conditional aspects) |
+| `meta` | submodule | Attached metadata (`handleWith`, `aspect-chain`, `collisionPolicy`; `guard`/`aspects` for conditional aspects) |
 | `classes` | `lazyAttrsOf raw` | Class schemas declared by this aspect, merged into `den.classes` |
 | `name` / `description` | `str` | Aspect name and description |
 
@@ -114,17 +114,29 @@ for the full API and examples.
 longer exists.
 </Aside>
 
-### `meta.provider`
+### `meta.aspect-chain`
 
-Type: `listOf str` (internal, read-only). Default: the provider prefix.
+Type: `listOf str` or `null` (internal, read-only). No default -- a declared
+aspect sets its own chain.
 
-Tracks the structural origin of an aspect as a path. Top-level aspects have
-`meta.provider = []`. An aspect provided by `foo` (via `foo.provides.bar` or
-its alias `foo._.bar`) has `meta.provider = ["foo"]`. Deeply nested
-providers accumulate: `foo._.bar._.baz` has `meta.provider = ["foo" "bar"]`.
+Tracks the structural origin of an aspect as a path. A top-level aspect has
+`meta.aspect-chain = []`. An aspect provided by `foo` (via `foo.provides.bar`
+or its alias `foo._.bar`) has `meta.aspect-chain = ["foo"]`. Deeply nested
+providers accumulate: `foo._.bar._.baz` has
+`meta.aspect-chain = ["foo" "bar"]`.
 
-The `meta.provider` list distinguishes aspects by origin during pipeline
-resolution.
+`null` and `[]` are different values. `[]` means "root -- the chain is
+empty"; `null` means "no chain set", which is what an inline `includes`
+literal carries until something fills it in. Absence, not root.
+
+The chain distinguishes aspects by origin during pipeline resolution.
+
+<Aside type="caution">
+This field was called `meta.provider`. `meta` has a freeform type, so a
+`meta.provider = [ "foo" ]` written today is absorbed into freeform meta and
+silently ignored -- no error, no warning, and the chain stays whatever the
+pipeline derives.
+</Aside>
 
 ### `meta.guard` / `meta.aspects` -- conditional aspects
 

@@ -13,7 +13,7 @@
         type = lib.types.submodule {
           freeformType = lib.types.attrsOf (
             (config.den.lib.aspects.mkAspectsType {
-              providerPrefix = [
+              origin = [
                 "den"
                 "batteries"
               ];

@@ -76,7 +76,7 @@
     in
     {
       name = "import-tree(${baseNameOf rootStr})";
-      meta.provider = [
+      meta.aspect-chain = [
         "den"
         "batteries"
       ];

@@ -27,10 +27,14 @@ let
       };
     };
 
+  # Chain segments state each child's position under "insecure-predicate"
+  # explicitly rather than letting the name carry it — a name can never
+  # double-encode an ancestor that's already named as its own chain segment.
   osAspect =
     { host }:
     {
-      name = "insecure-predicate/os";
+      name = "os";
+      meta.aspect-chain = [ "insecure-predicate" ];
     }
     # A synthetic host identity (from a `user@host` home with no declared host)
     # has no class output, so there is nothing to import into. Guard like
@@ -42,7 +46,8 @@ let
   userAspect =
     { host, user }:
     {
-      name = "insecure-predicate/user";
+      name = "user";
+      meta.aspect-chain = [ "insecure-predicate" ];
     }
     // lib.optionalAttrs (lib.elem "homeManager" user.classes) {
       homeManager.imports = [ insecureModule ];
@@ -51,14 +56,19 @@ let
   homeAspect =
     { home }:
     {
-      name = "insecure-predicate/home";
+      name = "home";
+      meta.aspect-chain = [ "insecure-predicate" ];
     }
     // lib.optionalAttrs (home ? class) {
       ${home.class}.imports = [ insecureModule ];
     };
 
   aspect = {
     name = "insecure-predicate";
+    # Stated explicitly, not left to fill from the walk: this is included
+    # from den.default, and without its own chain it would inherit
+    # den.default's position instead of staying a root.
+    meta.aspect-chain = [ ];
     inherit description;
     includes = [
       osAspect

@@ -14,7 +14,7 @@ let
 
   __functor = _self: allowed-names: {
     name = "insecure(${builtins.concatStringsSep "," allowed-names})";
-    meta.provider = [
+    meta.aspect-chain = [
       "den"
       "provides"
     ];

@@ -23,7 +23,7 @@ let
 
   __functor = _self: username: {
     name = "tty-autologin(${username})";
-    meta.provider = [
+    meta.aspect-chain = [
       "den"
       "provides"
     ];

@@ -27,10 +27,14 @@ let
       };
     };
 
+  # Chain segments state each child's position under "unfree-predicate"
+  # explicitly rather than letting the name carry it — a name can never
+  # double-encode an ancestor that's already named as its own chain segment.
   osAspect =
     { host }:
     {
-      name = "unfree-predicate/os";
+      name = "os";
+      meta.aspect-chain = [ "unfree-predicate" ];
     }
     # A synthetic host identity (from a `user@host` home with no declared host)
     # has no class output, so there is nothing to import into. Guard like
@@ -42,7 +46,8 @@ let
   userAspect =
     { host, user }:
     {
-      name = "unfree-predicate/user";
+      name = "user";
+      meta.aspect-chain = [ "unfree-predicate" ];
     }
     // lib.optionalAttrs (lib.elem "homeManager" user.classes) {
       homeManager.imports = [ unfreeModule ];
@@ -51,14 +56,19 @@ let
   homeAspect =
     { home }:
     {
-      name = "unfree-predicate/home";
+      name = "home";
+      meta.aspect-chain = [ "unfree-predicate" ];
     }
     // lib.optionalAttrs (home ? class) {
       ${home.class}.imports = [ unfreeModule ];
     };
 
   aspect = {
     name = "unfree-predicate";
+    # Stated explicitly, not left to fill from the walk: this is included
+    # from den.default, and without its own chain it would inherit
+    # den.default's position instead of staying a root.
+    meta.aspect-chain = [ ];
     inherit description;
     includes = [
       osAspect

@@ -14,7 +14,7 @@ let
 
   __functor = _self: allowed-names: {
     name = "unfree(${builtins.concatStringsSep "," allowed-names})";
-    meta.provider = [
+    meta.aspect-chain = [
       "den"
       "provides"
     ];

@@ -23,7 +23,7 @@ let
 
   __functor = _self: username: {
     name = "vm-autologin(${username})";
-    meta.provider = [
+    meta.aspect-chain = [
       "den"
       "provides"
     ];

@@ -5,6 +5,16 @@
     type = den.lib.aspects.types.aspectType;
   };
 
+  # aspectType's meta-injecting merge only fires for options built through a
+  # container that calls the element type's merge directly (den.aspects is
+  # attrsOf aspectType). den.default is a bare top-level submodule option:
+  # nixpkgs expands its nested-path definitions (den.default.includes = ...)
+  # via the type's getSubOptions instead, which never calls the overridden
+  # merge, so aspectMeta's mkDefault chain never lands and this reads null.
+  # den.default is unambiguously a root — it is broadcast, never included by
+  # anyone — so it states its own chain rather than relying on injection.
+  config.den.default.meta.aspect-chain = lib.mkDefault [ ];
+
   # Inject den.default as a schema include for all entity kinds so
   # default aspects are resolved automatically. This replaces the old
   # *-to-default policies (host-to-default, user-to-default, home-to-default)

@@ -20,6 +20,38 @@ let
   # lazily at eval time, so they safely use den.lib.schema.
   schemaLib = import ./../nix/lib/schema.nix { inherit inputs lib; };
 
+  # Element check for BOTH schema-tier collections. gen-schema has no
+  # per-collection `type` to route a bad element through, so the check that the
+  # aspect tier gets from `providerType` has to live here — and it has to be
+  # ONE check: the two collections take the same references, so a shape that
+  # excludes at the aspect tier must not throw at the schema tier.
+  #
+  # A bare string was the original defect at both. Unchecked, it reached
+  # children.nix's aspect walk and crashed with a raw Nix `expected a set but
+  # found a string` from propagateScope's `//` on the includes side, and on the
+  # excludes side `identity.key` reduced it to "<anon>", which matches no
+  # policy and so excluded nothing in silence.
+  #
+  # Recurses into nested lists because `providerType` names a list of policy
+  # records as a valid element and children.nix walks nested lists the same way
+  # at both tiers (`processInclude`, and `lib.flatten` over excludes since
+  # 6127cbc). Admits a function because a parametric aspect reference is one.
+  checkCollectionElement =
+    collection:
+    let
+      check =
+        v:
+        if builtins.isList v then
+          map check v
+        else if builtins.isAttrs v || lib.isFunction v then
+          v
+        else
+          throw "den: den.schema.<kind>.${collection}: expected a policy or aspect reference, got ${
+            if builtins.isString v then ''"${v}"'' else builtins.typeOf v
+          }";
+    in
+    check;
+
   classSchemaType = lib.types.submodule (
     { ... }:
     {
@@ -74,9 +106,11 @@ in
     collections = {
       includes = {
         default = [ ];
+        merge = acc: val: acc ++ map (checkCollectionElement "includes") val;
       };
       excludes = {
         default = [ ];
+        merge = acc: val: acc ++ map (checkCollectionElement "excludes") val;
       };
       isEntity = {
         default = false;