From e2484a8ad70774189bfc6ec585c56dbdb79fbac2 Mon Sep 17 00:00:00 2001
From: Wyatt Gill <wyattgill01@outlook.com>
Date: Thu, 27 Aug 2026 00:20:51 -0700
Subject: [PATCH] ci: repack eval matrix, cancel superseded runs, centralize
 nix setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The on-push pipeline took ~1.5h wall despite ~20min of real work. Job
timings from run 33041628057 show all linux work finishing 20 minutes
in; the remainder was 24 macOS nixpkgs-eval jobs (each ~3.5min of
runner setup for ~6min of eval) queuing on the ~5-slot macOS pool,
compounded by overlapping runs from rapid pushes starving each other.

Repack the 72-job eval matrix into 12 group jobs: each walks 3 of the
12 chunks, both gc-budget lanes, cold+warm each. Coverage is
byte-identical — the compiled-chunk cache (~/.cache/fix/chunks) is
wiped before each (chunk, lane) pair so cold runs stay genuinely cold.
Oracle caches move to per-group v2 keys.

Add a concurrency group with cancel-in-progress so a new push releases
the superseded run's runners immediately, and split build-darwin out of
build so a macOS runner drought can no longer block the linux evals,
gc detector, or daemon arms.

Fold the nix preamble every job repeated (install, snapshot restore +
self-heal, channel pin) into a setup-nix composite action replacing
nix-store-cache; jobs are now checkout + one setup step. Snapshot saves
stay explicit last steps so a broken job never publishes a poisoned
store. Also fix nixpkgs-gc-detector restoring a store key nothing ever
saved (it ran cold every run); it now shares the x86_64-linux eval key.
---
 .github/actions/nix-store-cache/action.yml |  60 -----
 .github/actions/setup-nix/action.yml       |  86 +++++++
 .github/workflows/ci.yml                   | 250 ++++++++++-----------
 .github/workflows/concurrency-nightly.yml  |  64 +-----
 4 files changed, 215 insertions(+), 245 deletions(-)
 delete mode 100644 .github/actions/nix-store-cache/action.yml
 create mode 100644 .github/actions/setup-nix/action.yml

diff --git a/.github/actions/nix-store-cache/action.yml b/.github/actions/nix-store-cache/action.yml
deleted file mode 100644
index c7100674..00000000
--- a/.github/actions/nix-store-cache/action.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: nix store cache
-description: >
-  Restore a /nix snapshot with self-healing as the DEFAULT: store
-  optimisation is disabled first (an optimised store is a hard-link farm
-  into /nix/store/.links; snapshots archive files AS those links and the
-  restore cannot resolve them against a fresh install — the deterministic
-  "corrupt cache" class), then the restored store is probed cheaply and
-  wiped ENTIRELY on any anomaly. A cache problem may cost a job minutes;
-  it must never fail one. The caller reinstalls its nix flavor when
-  `wiped` is true and re-applies the optimisation setting.
-inputs:
-  key:
-    description: cache-nix-action primary key
-    required: true
-outputs:
-  wiped:
-    description: "'true' when the restored store failed validation and /nix was removed"
-    value: ${{ steps.probe.outputs.wiped }}
-runs:
-  using: composite
-  steps:
-    - name: Disable store optimisation (snapshots need regular files)
-      shell: bash
-      run: |
-        echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-        sudo systemctl restart nix-daemon 2>/dev/null || true
-    - uses: nix-community/cache-nix-action/restore@v7
-      with:
-        primary-key: ${{ inputs.key }}
-    - name: Validate restored store (wipe on any anomaly)
-      id: probe
-      shell: bash
-      run: |
-        set +e
-        probe() {
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-          timeout 120 nix-store --verify >/dev/null 2>&1 || return 1
-          timeout 60 nix-instantiate --eval -E '1 + 1' >/dev/null 2>&1 || return 1
-          return 0
-        }
-        if probe; then
-          echo "restored store validated"
-          echo "wiped=false" >> "$GITHUB_OUTPUT"
-        elif [[ "$(uname)" == "Darwin" ]]; then
-          # macOS: /nix is a synthetic-firmlink volume that cannot be
-          # rm -rf'd. No self-heal there — proceed with the restored store
-          # (status quo; the corruption class has only ever hit Linux/lix).
-          echo "restored store failed validation on darwin — proceeding as-is (no wipe possible)"
-          echo "wiped=false" >> "$GITHUB_OUTPUT"
-        else
-          echo "restored store failed validation — discarding for a cold reinstall"
-          # Full installer footprint: /nix alone is not enough — installers
-          # refuse to merge onto a leftover /etc/nix/nix.conf, and stale
-          # daemon units point into the removed store.
-          sudo systemctl stop nix-daemon.socket nix-daemon 2>/dev/null || true
-          sudo rm -rf /nix /etc/nix
-          sudo rm -f /etc/systemd/system/nix-daemon.service /etc/systemd/system/nix-daemon.socket
-          sudo systemctl daemon-reload 2>/dev/null || true
-          echo "wiped=true" >> "$GITHUB_OUTPUT"
-        fi
diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
new file mode 100644
index 00000000..e6fa4c3c
--- /dev/null
+++ b/.github/actions/setup-nix/action.yml
@@ -0,0 +1,86 @@
+name: setup nix
+description: >
+  The whole per-job nix preamble: install a nix flavor, restore a /nix
+  snapshot, and install the pinned nixpkgs channel. Restoring self-heals
+  by DEFAULT: store optimisation is disabled first (an optimised store is
+  a hard-link farm into /nix/store/.links; snapshots archive files AS
+  those links and the restore cannot resolve them against a fresh install
+  — the deterministic "corrupt cache" class), then the restored store is
+  probed cheaply and wiped ENTIRELY on any anomaly, followed by a cold
+  reinstall. A cache problem may cost a job minutes; it must never fail
+  one. Saving a snapshot stays with the caller: the save must be the
+  job's LAST step so a broken job never publishes a poisoned snapshot,
+  and composite actions cannot schedule that.
+inputs:
+  key:
+    description: cache-nix-action primary key
+    required: true
+  installer:
+    description: "nix flavor to install: cppnix or lix"
+    required: false
+    default: cppnix
+runs:
+  using: composite
+  steps:
+    - name: Install CppNix
+      if: ${{ inputs.installer == 'cppnix' }}
+      uses: cachix/install-nix-action@v31
+    - name: Install Lix
+      if: ${{ inputs.installer == 'lix' }}
+      uses: samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d # v2026-06-15
+    - name: Disable store optimisation (snapshots need regular files)
+      shell: bash
+      run: |
+        echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
+        sudo systemctl restart nix-daemon 2>/dev/null || true
+    - uses: nix-community/cache-nix-action/restore@v7
+      with:
+        primary-key: ${{ inputs.key }}
+    - name: Validate restored store (wipe on any anomaly)
+      id: probe
+      shell: bash
+      run: |
+        set +e
+        probe() {
+          sudo systemctl restart nix-daemon 2>/dev/null || true
+          timeout 120 nix-store --verify >/dev/null 2>&1 || return 1
+          timeout 60 nix-instantiate --eval -E '1 + 1' >/dev/null 2>&1 || return 1
+          return 0
+        }
+        if probe; then
+          echo "restored store validated"
+          echo "wiped=false" >> "$GITHUB_OUTPUT"
+        elif [[ "$(uname)" == "Darwin" ]]; then
+          # macOS: /nix is a synthetic-firmlink volume that cannot be
+          # rm -rf'd. No self-heal there — proceed with the restored store
+          # (status quo; the corruption class has only ever hit Linux/lix).
+          echo "restored store failed validation on darwin — proceeding as-is (no wipe possible)"
+          echo "wiped=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "restored store failed validation — discarding for a cold reinstall"
+          # Full installer footprint: /nix alone is not enough — installers
+          # refuse to merge onto a leftover /etc/nix/nix.conf, and stale
+          # daemon units point into the removed store.
+          sudo systemctl stop nix-daemon.socket nix-daemon 2>/dev/null || true
+          sudo rm -rf /nix /etc/nix
+          sudo rm -f /etc/systemd/system/nix-daemon.service /etc/systemd/system/nix-daemon.socket
+          sudo systemctl daemon-reload 2>/dev/null || true
+          echo "wiped=true" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Reinstall CppNix (cold, after wipe)
+      if: ${{ steps.probe.outputs.wiped == 'true' && inputs.installer == 'cppnix' }}
+      uses: cachix/install-nix-action@v31
+    - name: Reinstall Lix (cold, after wipe)
+      if: ${{ steps.probe.outputs.wiped == 'true' && inputs.installer == 'lix' }}
+      uses: samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d # v2026-06-15
+    - name: Re-disable store optimisation (cold path)
+      if: ${{ steps.probe.outputs.wiped == 'true' }}
+      shell: bash
+      run: |
+        echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
+        sudo systemctl restart nix-daemon 2>/dev/null || true
+    - name: Install pinned nixpkgs channel
+      shell: bash
+      run: |
+        nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
+        nix-channel --update nixpkgs
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41df0d7f..2e653699 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,12 +6,21 @@ on:
 permissions:
   contents: read
 
+# Pushes often land minutes apart while a full run still holds macOS
+# runners (a ~5-slot pool that provisions slowly); superseded runs must
+# release them immediately or runs starve each other for half an hour.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  # One x86_64-linux build feeds every consumer that needs only the BINARY
-  # (12 nixpkgs chunks, the gc detector, both daemon arms) — previously each
-  # of those built fix from a cold zig cache. Consumers run inside the same
-  # pinned nix-shell, so the artifact's dynamic deps (curl/libgit2/glibc
-  # store paths) resolve identically.
+  # One build per (system, optimize) feeds every consumer that needs only
+  # the BINARY (the eval groups, the gc detector, both daemon arms) —
+  # previously each of those built fix from a cold zig cache. Consumers
+  # run inside the same pinned nix-shell, so the artifact's dynamic deps
+  # (curl/libgit2/glibc store paths) resolve identically. Darwin builds
+  # in its own job so a macOS runner drought never blocks the linux
+  # pipeline.
   build:
     name: build / ${{ matrix.system }} ${{ matrix.optimize }}
     runs-on: ${{ matrix.runner }}
@@ -31,29 +40,11 @@ jobs:
             runner: ubuntu-24.04-arm
             optimize: ReleaseFast
             artifact: fix-releasefast-aarch64-linux
-          - system: aarch64-darwin
-            runner: macos-15
-            optimize: ReleaseFast
-            artifact: fix-releasefast-aarch64-darwin
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-build-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
       # Zig caches persist across runs (keyed to HEAD, prefix-restored from
       # the newest prior run). Only the zig builds share these; the nix
       # package build is hermetic by design and must not see them.
@@ -87,6 +78,37 @@ jobs:
         with:
           primary-key: nix-v4-build-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
 
+  build-darwin:
+    name: build / aarch64-darwin ReleaseFast
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-nix
+        with:
+          key: nix-v4-build-aarch64-darwin-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
+      - name: Restore zig cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            .zig-cache
+            ~/.cache/zig
+          key: zig-build-aarch64-darwin-ReleaseFast-${{ github.sha }}
+          restore-keys: |
+            zig-build-aarch64-darwin-ReleaseFast-
+      - name: Build ReleaseFast
+        timeout-minutes: 20
+        run: |
+          nix-shell --run 'zig build -Doptimize=ReleaseFast -Dcpu=baseline --summary all'
+          cp zig-out/bin/fix fix-releasefast-aarch64-darwin
+      - uses: actions/upload-artifact@v7
+        with:
+          name: fix-releasefast-aarch64-darwin
+          path: fix-releasefast-aarch64-darwin
+          retention-days: 3
+      - uses: nix-community/cache-nix-action/save@v7
+        with:
+          primary-key: nix-v4-build-aarch64-darwin-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
+
   test:
     name: ${{ matrix.system }}
     runs-on: ${{ matrix.runner }}
@@ -103,24 +125,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
-
       # Shared across ALL zig builds in this job (suite test binaries are the
       # bulk of the compile time). The nix package build below is hermetic
       # (its own TMPDIR cache) and intentionally excluded.
@@ -226,81 +233,108 @@ jobs:
         with:
           primary-key: nix-v4-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
 
+  # Native runners on purpose: the aarch64 arms are the only place the
+  # weak-memory-ordering code paths (deque/future fences) run on real
+  # hardware — qemu inherits the x86 host's TSO and hides those bugs.
+  # Each platform evaluates its NATIVE universe (outpaths systems = null
+  # -> currentSystem), so oracles are per-system.
+  #
+  # Each group job walks 3 of the 12 universe chunks; per chunk it runs
+  # the default and tight gc-budget lanes, each COLD (compiled-chunk
+  # cache wiped first) and then WARM (the identical eval answered through
+  # the persistent cache's read path). Chunks are grouped because
+  # per-chunk jobs spent more wall time on runner setup than on eval —
+  # and 72 of them starved the runner pools.
   nixpkgs-eval:
-    # Native runners on purpose: the aarch64 arms are the only place the
-    # weak-memory-ordering code paths (deque/future fences) run on real
-    # hardware — qemu inherits the x86 host's TSO and hides those bugs.
-    # Each platform evaluates its NATIVE universe (outpaths systems = null
-    # -> currentSystem), so oracles are per-system.
-    name: nixpkgs / ${{ matrix.system }} chunk ${{ matrix.chunk }} (${{ matrix.lane }})
+    name: nixpkgs / ${{ matrix.system }} group ${{ matrix.group }}
     runs-on: ${{ matrix.runner }}
     needs: build
     strategy:
       fail-fast: false
       matrix:
-        chunk: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]
-        system: [x86_64-linux, aarch64-linux, aarch64-darwin]
-        lane: [default, tight]
+        group: [0, 1, 2, 3]
+        system: [x86_64-linux, aarch64-linux]
         include:
           - system: x86_64-linux
             runner: ubuntu-24.04
           - system: aarch64-linux
             runner: ubuntu-24.04-arm
-          - system: aarch64-darwin
-            runner: macos-15
-          - {system: x86_64-linux, lane: default, budget: 1024}
-          - {system: x86_64-linux, lane: tight, budget: 512}
-          - {system: aarch64-linux, lane: default, budget: 1024}
-          - {system: aarch64-linux, lane: tight, budget: 512}
-          # macos-15 runners have 7 GB RAM; a 1024-budget chunk peaks near
-          # 10 GB, so darwin's lanes sit one rung lower.
-          - {system: aarch64-darwin, lane: default, budget: 512}
-          - {system: aarch64-darwin, lane: tight, budget: 256}
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-eval-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
       - name: Restore oracle cache
         uses: actions/cache@v5
         with:
           path: ~/.cache/fix-nixpkgs-eval
-          key: nixpkgs-oracle-v1-${{ hashFiles('npins/sources.json') }}-${{ matrix.system }}-chunk-${{ matrix.chunk }}
+          key: nixpkgs-oracle-v2-${{ hashFiles('npins/sources.json') }}-${{ matrix.system }}-group-${{ matrix.group }}
       - uses: actions/download-artifact@v8
         with:
           name: fix-releasefast-${{ matrix.system }}
-      - name: Differential eval (cold compile cache)
-        timeout-minutes: 35
+      - name: Differential eval (3 chunks x 2 lanes, cold+warm)
+        timeout-minutes: 45
         run: |
           chmod +x fix-releasefast-${{ matrix.system }}
-          nix-shell --run 'test/nixpkgs/run.sh --chunk ${{ matrix.chunk }}/12 --gc-budget ${{ matrix.budget }} --fix ./fix-releasefast-${{ matrix.system }}'
-      # Identical eval again: the persistent compiled-chunk cache written by
-      # the first run now serves, so the second run answers the same oracle
-      # through the cache read path.
-      - name: Differential eval (warm compile cache)
-        timeout-minutes: 35
-        run: |
-          nix-shell --run 'test/nixpkgs/run.sh --chunk ${{ matrix.chunk }}/12 --gc-budget ${{ matrix.budget }} --fix ./fix-releasefast-${{ matrix.system }}'
+          nix-shell --run '
+            set -euo pipefail
+            for i in 0 1 2; do
+              chunk=$(( 3 * ${{ matrix.group }} + i ))
+              for budget in 1024 512; do
+                rm -rf "${XDG_CACHE_HOME:-$HOME/.cache}/fix/chunks"
+                test/nixpkgs/run.sh --chunk $chunk/12 --gc-budget $budget --fix ./fix-releasefast-${{ matrix.system }}
+                test/nixpkgs/run.sh --chunk $chunk/12 --gc-budget $budget --fix ./fix-releasefast-${{ matrix.system }}
+              done
+            done
+          '
       # Last step on purpose: it is skipped when anything above failed, so a
       # broken job can never publish a poisoned store snapshot.
       - uses: nix-community/cache-nix-action/save@v7
         with:
           primary-key: nix-v4-eval-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
 
+  # macos-15 runners have 7 GB RAM; a 1024-budget chunk peaks near 10 GB,
+  # so darwin's lanes sit one rung lower (512 default, 256 tight).
+  nixpkgs-eval-darwin:
+    name: nixpkgs / aarch64-darwin group ${{ matrix.group }}
+    runs-on: macos-15
+    needs: build-darwin
+    strategy:
+      fail-fast: false
+      matrix:
+        group: [0, 1, 2, 3]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-nix
+        with:
+          key: nix-v4-eval-aarch64-darwin-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
+      - name: Restore oracle cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/fix-nixpkgs-eval
+          key: nixpkgs-oracle-v2-${{ hashFiles('npins/sources.json') }}-aarch64-darwin-group-${{ matrix.group }}
+      - uses: actions/download-artifact@v8
+        with:
+          name: fix-releasefast-aarch64-darwin
+      - name: Differential eval (3 chunks x 2 lanes, cold+warm)
+        timeout-minutes: 45
+        run: |
+          chmod +x fix-releasefast-aarch64-darwin
+          nix-shell --run '
+            set -euo pipefail
+            for i in 0 1 2; do
+              chunk=$(( 3 * ${{ matrix.group }} + i ))
+              for budget in 512 256; do
+                rm -rf "${XDG_CACHE_HOME:-$HOME/.cache}/fix/chunks"
+                test/nixpkgs/run.sh --chunk $chunk/12 --gc-budget $budget --fix ./fix-releasefast-aarch64-darwin
+                test/nixpkgs/run.sh --chunk $chunk/12 --gc-budget $budget --fix ./fix-releasefast-aarch64-darwin
+              done
+            done
+          '
+      - uses: nix-community/cache-nix-action/save@v7
+        with:
+          primary-key: nix-v4-eval-aarch64-darwin-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
+
   # GC use-after-free tripwire: chunk 0 at a tight budget was the workload
   # that exposed the w>1 collection races (2026-08: native-handoff result
   # rooting; the swept force_thunk task root). ReleaseSafe is the detector
@@ -313,28 +347,15 @@ jobs:
     needs: build
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      # Restore-only: the x86_64-linux eval jobs own this snapshot key.
+      - uses: ./.github/actions/setup-nix
         with:
-          key: nix-v4-eval-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
+          key: nix-v4-eval-x86_64-linux-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
       - name: Restore oracle cache
         uses: actions/cache@v5
         with:
           path: ~/.cache/fix-nixpkgs-eval
-          key: nixpkgs-oracle-v1-${{ hashFiles('npins/sources.json') }}-x86_64-linux-chunk-0
+          key: nixpkgs-oracle-v2-${{ hashFiles('npins/sources.json') }}-x86_64-linux-group-0
       - uses: actions/download-artifact@v8
         with:
           name: fix-releasesafe-x86_64-linux
@@ -354,31 +375,10 @@ jobs:
         implementation: [cppnix, lix]
     steps:
       - uses: actions/checkout@v6
-      - name: Install CppNix
-        if: matrix.implementation == 'cppnix'
-        uses: cachix/install-nix-action@v31
-      - name: Install Lix
-        if: matrix.implementation == 'lix'
-        uses: samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d # v2026-06-15
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: daemon-v4-${{ matrix.implementation }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall CppNix (cold, after wipe)
-        if: matrix.implementation == 'cppnix' && steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Reinstall Lix (cold, after wipe)
-        if: matrix.implementation == 'lix' && steps.store.outputs.wiped == 'true'
-        uses: samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d # v2026-06-15
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
+          installer: ${{ matrix.implementation }}
       - name: Report daemon implementation
         run: nix --version
       - uses: actions/download-artifact@v8
diff --git a/.github/workflows/concurrency-nightly.yml b/.github/workflows/concurrency-nightly.yml
index 6c391788..674210af 100644
--- a/.github/workflows/concurrency-nightly.yml
+++ b/.github/workflows/concurrency-nightly.yml
@@ -33,23 +33,9 @@ jobs:
       STRESS_SEED: ${{ github.run_id }}
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-stress-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
       # Warm from the on-push test caches when the nightly one is stale.
       - name: Restore zig cache
         uses: actions/cache@v5
@@ -139,23 +125,9 @@ jobs:
         workers: [8, 16]
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-stress-x86_64-linux-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
       # One shared key: all eight jobs compile the same TSan binary; the
       # first to finish saves, the rest hit.
       - name: Restore zig cache
@@ -188,23 +160,9 @@ jobs:
             runner: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-build-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
       - name: Restore zig cache
         uses: actions/cache@v5
         with:
@@ -253,24 +211,10 @@ jobs:
           - {system: aarch64-linux, runner: ubuntu-24.04-arm, chunk: 0, strings: '0'}
     steps:
       - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
       # Restore-only: the on-push pipeline owns these snapshot keys.
-      - id: store
-        uses: ./.github/actions/nix-store-cache
+      - uses: ./.github/actions/setup-nix
         with:
           key: nix-v4-eval-${{ matrix.system }}-${{ hashFiles('**/*.nix', 'npins/sources.json') }}
-      - name: Reinstall nix (cold, after wipe)
-        if: steps.store.outputs.wiped == 'true'
-        uses: cachix/install-nix-action@v31
-      - name: Re-disable store optimisation (cold path)
-        if: steps.store.outputs.wiped == 'true'
-        run: |
-          echo "auto-optimise-store = false" | sudo tee -a /etc/nix/nix.conf
-          sudo systemctl restart nix-daemon 2>/dev/null || true
-      - name: Install pinned nixpkgs channel
-        run: |
-          nix-channel --add "$(jq -r '.pins.nixpkgs.url' npins/sources.json)" nixpkgs
-          nix-channel --update nixpkgs
       - name: Restore oracle cache
         uses: actions/cache@v5
         with: