See
https://github.com/trofi/nixpkgs/blob/2777d222438a14e7a24a42637e3e07c0545020dd/pkgs/stdenv/generic/make-derivation.nix#L460-L477

and NixOS/nixpkgs#214044

The crux of the issue is:

• We don't these references settings to bloat the closure
• The "unsafe discard trick" is sketchy, and not sound in the presence of CA derivations (because the placeholders don't get rewritten without the context)

What should instead happen is this:

1. We compute the inputs closure of the derivation based on all the other deps (i.e. ignoring these fields)
2. We statically prove certain things cannot happen, and thus can purge things from the the lists (impossible disallowed, impossible allowed)
3. We just test the rest of them

It is tempting to think this can be done at eval time, but I am not sure whether that is the case. The crux of the issue is what until all dependencies are built, we don't actually know what the runtime closure of our inputs is --- we don't know what transtive build deps (inputs of inputs) will end up being transitively runtime-referenced by our final immediate inputs. This is especially bad in the case of CA derivations because all the actually concrete paths are unknowable, we need to track the deriving paths so we can substitute everything last minute.

The above pessimistically seems to mean we need to have some sort of notion of an optional dependency at the derivation level just for this things --- a "let's keep this around until we can maybe discharge it right before the build" dependency. That's really ugly though.

A better solution might be to instead make the output checks separate from the derivation itself: #11955.

I am not putting this ticket in the CA derivations stabilization milestone because I think that #11955 is the better solution, and it can take place post-stabilization. The NixOS/nixpkgs#214044 workaround is good enough for now.