fix: update the Nix flake so rustc meets rust-version

CONTRIBUTING.md

@@ -15,7 +15,9 @@ module boundary.
 
 ## Workspace and toolchain
 
-The repository is one Cargo workspace using Rust 1.95 and edition 2024:
+The repository is one Cargo workspace using Rust 1.95 and edition 2024. The
+Nix flake compiles with `nixpkgs` rustc from `flake.lock`; after raising
+`rust-version`, run `nix flake update` so that lock is new enough.
 
 - the root `wayscriber` package owns the overlay, daemon, CLI, shared domain/config/session code,
   rendering, and integration tests;

flake.nix

@@ -7,12 +7,22 @@
   };
 
   outputs = { self, nixpkgs, flake-utils }:
-    flake-utils.lib.eachDefaultSystem (system:
+    # Linux only. eachDefaultSystem also evaluates x86_64-darwin, which
+    # nixpkgs 26.11 dropped.
+    flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
       let
         pkgs = import nixpkgs { inherit system; };
-        version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.version;
+        cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
+        version = cargoToml.package.version;
+        rustVersion = cargoToml.package.rust-version;
         servicePath = pkgs.lib.makeBinPath [ pkgs.grim pkgs.slurp pkgs.wl-clipboard ];
-      in {
+      in
+      # Instantiation (and CI `nix eval`) must fail before cargoBuildHook
+      # when flake.lock's nixpkgs rustc lags Cargo.toml's rust-version.
+      assert pkgs.lib.assertMsg
+        (pkgs.lib.versionAtLeast pkgs.rustc.version rustVersion)
+        "nixpkgs rustc ${pkgs.rustc.version} is older than Cargo.toml rust-version ${rustVersion}; run `nix flake update`.";
+      {
         packages = {
           wayscriber = pkgs.rustPlatform.buildRustPackage {
             pname = "wayscriber";

tools/README.md

@@ -64,7 +64,7 @@ Helper scripts for development, installation, packaging, and release workflows.
   - Usage: `./tools/bump-version.sh [--dry-run] [new_version]`
 
 - **check-version-consistency.sh** - Check release metadata alignment
-  - Verifies Cargo manifests, the workspace lockfile, packaging metadata, and flake version sourcing
+  - Verifies Cargo manifests, the workspace lockfile, packaging metadata, flake version sourcing, and that the flake compares nixpkgs rustc to Cargo.toml rust-version
   - Keeps the configurator's libadwaita 1.4 floor aligned across Cargo, deb, rpm, PKGBUILD, and `.SRCINFO`
   - With `--release-version X.Y.Z[.N]`, rejects tags that do not match Cargo or an explicit packaging hotfix of Cargo
   - Usage: `bash tools/check-version-consistency.sh [--release-version X.Y.Z[.N]]`

tools/check-version-consistency.sh

@@ -348,6 +348,13 @@ require_template_sha256sums(
 flake_text = read_text("flake.nix")
 if "builtins.fromTOML (builtins.readFile ./Cargo.toml)" not in flake_text:
     errors.append("flake.nix package version should be derived from Cargo.toml")
+if not all(
+    token in flake_text
+    for token in ("package.rust-version", "pkgs.rustc.version", "versionAtLeast")
+):
+    errors.append(
+        "flake.nix should compare nixpkgs rustc against Cargo.toml rust-version"
+    )
 
 # Install examples that pin a concrete tag are stale one release later.
 readme_pin_patterns = (