feat(pipeline): simple routes collect from scope subtree

Simple routes (to-packages, to-apps, etc.) previously collected class
content only from their own scope. Parametric class keys like
`packages = { host }: { pkgs, ... }: ...` resolve at entity scopes
(host/user/home) which are descendants of the route's scope, so the
route never saw them.

Change applySimpleRoute to walk the scopeParent tree and collect from
the source scope's entire subtree. This works with any topology —
default (flake-system → host → user), fleet (fleet → environment →
host), or custom — because the collection follows the scope hierarchy
rather than hardcoding a specific path.

Adds test: parametric packages from user includes across two systems.

Author: sini

nix/lib/aspects/fx/resolve.nix

@@ -148,11 +148,12 @@ let
 
   # Phase 3: Apply routes.
   applyRoutes =
-    fxResolve: ctx: scopeContexts: rootScopeId: scopedRoutes: acc:
+    fxResolve: ctx: scopeContexts: rootScopeId: scopeParent: scopedRoutes: acc:
     route.applyRoutes {
       inherit
         scopedRoutes
         scopeContexts
+        scopeParent
         ctx
         rootScopeId
         fxResolve
@@ -325,7 +326,7 @@ let
                   subtreePhase1 = wrapPerScope ctx subtreeContexts subtreeClassImports;
                   subtreePhase2 = applyProvides ctx relevantContexts subtreeProvides subtreePhase1;
                   subtreePhase3 =
-                    applyRoutes fxResolveFn ctx relevantContexts hostScopeId subtreeRoutes
+                    applyRoutes fxResolveFn ctx relevantContexts hostScopeId scopeParent subtreeRoutes
                       subtreePhase2;
                 in
                 extractSubtreeModules subtreePhase3.perScope scopeParent hostScopeId hostClass
@@ -444,7 +445,7 @@ let
             subtreePhase1 = wrapPerScope ctx subtreeContexts subtreeClassImports;
             subtreePhase2 = applyProvides ctx relevantContexts subtreeProvides subtreePhase1;
             subtreePhase3 =
-              applyRoutes (fxResolve mkPipeline) ctx relevantContexts hostScopeId subtreeRoutes
+              applyRoutes (fxResolve mkPipeline) ctx relevantContexts hostScopeId scopeParent subtreeRoutes
                 subtreePhase2;
             preWalkedModules = extractSubtreeModules subtreePhase3.perScope scopeParent hostScopeId hostClass;
             modules = if preWalkedModules != null then preWalkedModules else [ spec.mainModule ];
@@ -569,7 +570,8 @@ let
       phase1 = wrapPerScope ctx augmentedScopeContexts drainedClassImportsRaw;
       phase2 = applyProvides ctx augmentedScopeContexts scopedProvides phase1;
       phase3 =
-        applyRoutes (fxResolve mkPipeline) ctx augmentedScopeContexts result.state.rootScopeId scopedRoutes
+        applyRoutes (fxResolve mkPipeline) ctx augmentedScopeContexts result.state.rootScopeId scopeParent
+          scopedRoutes
           phase2;
       phase4 = applyInstantiates {
         scopedInstantiates = result.state.scopedInstantiates null;
@@ -618,6 +620,7 @@ let
       phase2 = applyProvides ctx augmentedScopeContexts (result.state.scopedProvides null) phase1;
       phase3 =
         applyRoutes (fxResolveImports mkPipeline) ctx augmentedScopeContexts result.state.rootScopeId
+          (result.state.scopeParent null)
           (result.state.scopedRoutes null)
           phase2;
     in

nix/lib/aspects/fx/route/apply.nix

@@ -111,16 +111,33 @@ let
       };
     };
 
+  # Collect class modules from a scope and all its descendants.
+  collectFromSubtree =
+    wrappedPerScope: scopeParent: rootScopeId: fromClass:
+    let
+      allScopeIds = builtins.attrNames wrappedPerScope;
+      isInSubtree =
+        sid:
+        sid == rootScopeId
+        || (
+          let
+            parent = scopeParent.${sid} or null;
+          in
+          parent != null && parent != sid && isInSubtree parent
+        );
+      subtreeScopes = builtins.filter isInSubtree allScopeIds;
+    in
+    lib.concatMap (sid: wrappedPerScope.${sid}.${fromClass} or [ ]) subtreeScopes;
+
   applySimpleRoute =
     acc:
     {
       route,
       wrappedPerScope,
+      scopeParent,
     }:
     let
-      scopeExists = wrappedPerScope ? ${route.sourceScopeId};
-      sourceModules =
-        if !scopeExists then [ ] else wrappedPerScope.${route.sourceScopeId}.${route.fromClass} or [ ];
+      sourceModules = collectFromSubtree wrappedPerScope scopeParent route.sourceScopeId route.fromClass;
       adapterMod = route.adapterModule or null;
       modulesWithAdapter = if adapterMod == null then sourceModules else sourceModules ++ [ adapterMod ];
       isFlakeRoute = route.intoClass == "flake";
@@ -207,6 +224,7 @@ let
       scopedRoutes,
       wrappedPerScope,
       classImports,
+      scopeParent ? { },
       scopeContexts ? { },
       ctx ? { },
       fxResolve ? null,
@@ -232,7 +250,7 @@ let
               ;
           }
         else
-          applySimpleRoute acc { inherit route wrappedPerScope; }
+          applySimpleRoute acc { inherit route wrappedPerScope scopeParent; }
       )
       {
         inherit classImports;

templates/ci/modules/features/forward-flake-level.nix

@@ -160,6 +160,46 @@
       }
     );
 
+    # Parametric packages from user includes roll up to flake output.
+    # The { host }: wrapper resolves per-host at user scope; the
+    # to-packages route collects from the flake-system subtree.
+    test-parametric-packages-from-user-includes = denTest (
+      {
+        den,
+        lib,
+        config,
+        inputs,
+        ...
+      }:
+      {
+        imports = [ inputs.den.flakeOutputs.packages ];
+
+        den.hosts.x86_64-linux.alpha.users.a = { };
+        den.hosts.aarch64-linux.beta.users.b = { };
+
+        den.aspects.a.includes = [ den.aspects.nh-tool ];
+        den.aspects.b.includes = [ den.aspects.nh-tool ];
+
+        den.aspects.nh-tool = {
+          packages =
+            { host }:
+            { pkgs, ... }:
+            {
+              "sw-${host.name}" = pkgs.writeText "sw-${host.name}" host.name;
+            };
+        };
+
+        expr = {
+          alpha = config.flake.packages.x86_64-linux ? sw-alpha;
+          beta = config.flake.packages.aarch64-linux ? sw-beta;
+        };
+        expected = {
+          alpha = true;
+          beta = true;
+        };
+      }
+    );
+
     test-route-flake-outputs-from-hosts = denTest (
       {
         den,