Trace native Linux GHC phases after CI build failure

scripts/nix/README.md

@@ -110,6 +110,16 @@ Darwin ARM64/x86_64, with a six-hour job limit. It uploads the existing library
 and CLIs under an artifact named for the source SHA. Each native CLI also runs
 the encrypted-store and profile-password smoke test, which can be repeated with
 `python3 scripts/nix/smoke-cli.py result-nix/BUILD_SYSTEM/exe:simplex-chat/bin/simplex-chat`.
+
+After a failed native x86_64 Linux library build, CI tries a separate derivation
+with `-v2 -ddump-timings` on compile calls and uploads
+`native-linux-ghc-phase-trace.log`, including when that trace fails. Compiler
+queries and the original source, plan, dependency units and GHC arguments stay
+unchanged. The canonical build remains failed. The trace has one job/core and a
+two-hour wall-clock/per-derivation bound; the job's six-hour limit stays in place.
+`trace-native-ghc.nix` accepts the original component via `--arg original` for the
+same diagnostic locally.
+
 Hydra continues to consume
 the same `hydraJobs` attributes. The older application release workflow still
 uses its existing GHCup/Docker compiler settings; migrating that packaging and

scripts/nix/trace-native-ghc.nix

@@ -0,0 +1,30 @@
+# Compile-phase diagnostics for an existing, already-planned native component.
+# This produces a different derivation; it does not change source, plan, compiler,
+# dependency units or the original GHC arguments. Query output stays unchanged.
+{ original }:
+let
+  needle = "    printf '#!/bin/sh\\nexec %s \"$@\"\\n' \"$g\" > \"$wrapBin/$gName\"";
+  replacement = "    printf '#!/bin/sh\\n"
+    + "ghcTraceCompile=\\n"
+    + "for arg do\\n"
+    + "  case \"$arg\" in\\n"
+    + "    --numeric-version|--version|-V|--info|--print-*|--show-*|--supported-*|--abi-hash|-M)\\n"
+    + "      exec \"%s\" \"$@\"\\n"
+    + "      ;;\\n"
+    + "    @*|--make|-c) ghcTraceCompile=1 ;;\\n"
+    + "  esac\\n"
+    + "done\\n"
+    + "if [ -n \"$ghcTraceCompile\" ]; then\\n"
+    + "  exec \"%s\" \"$@\" -v2 -ddump-timings\\n"
+    + "fi\\n"
+    + "exec \"%s\" \"$@\"\\n"
+    + "' \"$g\" \"$g\" \"$g\" > \"$wrapBin/$gName\"";
+  occurrences = phase: builtins.div
+    (builtins.stringLength phase - builtins.stringLength
+      (builtins.replaceStrings [ needle ] [ "" ] phase))
+    (builtins.stringLength needle);
+in original.overrideAttrs (old:
+  # Fail visibly if the pinned v2 builder changes its wrapper-generation seam.
+  assert occurrences old.buildPhase == 1; {
+    buildPhase = builtins.replaceStrings [ needle ] [ replacement ] old.buildPhase;
+  })