diff --git a/doc/manual/src/advanced-topics/distributed-builds.md b/doc/manual/src/advanced-topics/distributed-builds.md
index 52acd039c10..ddabaeb4df1 100644
--- a/doc/manual/src/advanced-topics/distributed-builds.md
+++ b/doc/manual/src/advanced-topics/distributed-builds.md
@@ -12,14 +12,14 @@ machine is accessible via SSH and that it has Nix installed. You can
 test whether connecting to the remote Nix instance works, e.g.
 
 ```console
-$ nix store info --store ssh://mac
+$ nix store ping --store ssh://mac
 ```
 
 will try to connect to the machine named `mac`. It is possible to
 specify an SSH identity file as part of the remote store URI, e.g.
 
 ```console
-$ nix store info --store ssh://mac?ssh-key=/home/alice/my-key
+$ nix store ping --store ssh://mac?ssh-key=/home/alice/my-key
 ```
 
 Since builds should be non-interactive, the key should not have a
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 8d609529959..c2e95739252 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -257,8 +257,8 @@
         ''^src/libstore/unix/pathlocks\.cc$''
         ''^src/libstore/unix/posix-fs-canonicalise\.cc$''
         ''^src/libstore/unix/posix-fs-canonicalise\.hh$''
-        ''^src/libstore/unix/uds-remote-store\.cc$''
-        ''^src/libstore/unix/uds-remote-store\.hh$''
+        ''^src/libstore/uds-remote-store\.cc$''
+        ''^src/libstore/uds-remote-store\.hh$''
         ''^src/libstore/windows/build\.cc$''
         ''^src/libstore/worker-protocol-impl\.hh$''
         ''^src/libstore/worker-protocol\.cc$''
@@ -355,7 +355,7 @@
         ''^src/libutil/unix/processes\.cc$''
         ''^src/libutil/unix/signals-impl\.hh$''
         ''^src/libutil/unix/signals\.cc$''
-        ''^src/libutil/unix/unix-domain-socket\.cc$''
+        ''^src/libutil/unix-domain-socket\.cc$''
         ''^src/libutil/unix/users\.cc$''
         ''^src/libutil/url-parts\.hh$''
         ''^src/libutil/url\.cc$''
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 2550e975ad7..0366e502008 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -20,7 +20,7 @@
 #  include "gc_cpp.h"
 #endif
 
-// Helper function to throw an exception if value is null
+// Internal helper functions to check [in] and [out] `Value *` parameters
 static const nix::Value & check_value_not_null(const Value * value)
 {
     if (!value) {
@@ -37,6 +37,33 @@ static nix::Value & check_value_not_null(Value * value)
     return *((nix::Value *) value);
 }
 
+static const nix::Value & check_value_in(const Value * value)
+{
+    auto & v = check_value_not_null(value);
+    if (!v.isValid()) {
+        throw std::runtime_error("Uninitialized Value");
+    }
+    return v;
+}
+
+static nix::Value & check_value_in(Value * value)
+{
+    auto & v = check_value_not_null(value);
+    if (!v.isValid()) {
+        throw std::runtime_error("Uninitialized Value");
+    }
+    return v;
+}
+
+static nix::Value & check_value_out(Value * value)
+{
+    auto & v = check_value_not_null(value);
+    if (v.isValid()) {
+        throw std::runtime_error("Value already initialized. Variables are immutable");
+    }
+    return v;
+}
+
 /**
  * Helper function to convert calls from nix into C API.
  *
@@ -111,7 +138,7 @@ ValueType nix_get_type(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         using namespace nix;
         switch (v.type()) {
         case nThunk:
@@ -147,7 +174,7 @@ const char * nix_get_typename(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         auto s = nix::showType(v);
         return strdup(s.c_str());
     }
@@ -159,7 +186,7 @@ bool nix_get_bool(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nBool);
         return v.boolean();
     }
@@ -171,7 +198,7 @@ nix_err nix_get_string(nix_c_context * context, const Value * value, nix_get_str
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nString);
         call_nix_get_string_callback(v.c_str(), callback, user_data);
     }
@@ -183,7 +210,7 @@ const char * nix_get_path_string(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nPath);
         // NOTE (from @yorickvP)
         // v._path.path should work but may not be how Eelco intended it.
@@ -202,7 +229,7 @@ unsigned int nix_get_list_size(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nList);
         return v.listSize();
     }
@@ -214,7 +241,7 @@ unsigned int nix_get_attrs_size(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nAttrs);
         return v.attrs()->size();
     }
@@ -226,7 +253,7 @@ double nix_get_float(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nFloat);
         return v.fpoint();
     }
@@ -238,7 +265,7 @@ int64_t nix_get_int(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nInt);
         return v.integer();
     }
@@ -250,7 +277,7 @@ ExternalValue * nix_get_external(nix_c_context * context, Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         assert(v.type() == nix::nExternal);
         return (ExternalValue *) v.external();
     }
@@ -262,7 +289,7 @@ Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalSta
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nList);
         auto * p = v.listElems()[ix];
         nix_gc_incref(nullptr, p);
@@ -278,7 +305,7 @@ Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalSt
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nAttrs);
         nix::Symbol s = state->state.symbols.create(name);
         auto attr = v.attrs()->get(s);
@@ -298,7 +325,7 @@ bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nAttrs);
         nix::Symbol s = state->state.symbols.create(name);
         auto attr = v.attrs()->get(s);
@@ -315,7 +342,7 @@ nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * sta
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         const nix::Attr & a = (*v.attrs())[i];
         *name = ((const std::string &) (state->state.symbols[a.name])).c_str();
         nix_gc_incref(nullptr, a.value);
@@ -330,7 +357,7 @@ const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * valu
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         const nix::Attr & a = (*v.attrs())[i];
         return ((const std::string &) (state->state.symbols[a.name])).c_str();
     }
@@ -342,7 +369,7 @@ nix_err nix_init_bool(nix_c_context * context, Value * value, bool b)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkBool(b);
     }
     NIXC_CATCH_ERRS
@@ -354,7 +381,7 @@ nix_err nix_init_string(nix_c_context * context, Value * value, const char * str
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkString(std::string_view(str));
     }
     NIXC_CATCH_ERRS
@@ -365,7 +392,7 @@ nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * val
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkPath(s->state.rootPath(nix::CanonPath(str)));
     }
     NIXC_CATCH_ERRS
@@ -376,7 +403,7 @@ nix_err nix_init_float(nix_c_context * context, Value * value, double d)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkFloat(d);
     }
     NIXC_CATCH_ERRS
@@ -387,7 +414,7 @@ nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkInt(i);
     }
     NIXC_CATCH_ERRS
@@ -398,7 +425,7 @@ nix_err nix_init_null(nix_c_context * context, Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkNull();
     }
     NIXC_CATCH_ERRS
@@ -422,7 +449,7 @@ nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         auto r = (nix::ExternalValueBase *) val;
         v.mkExternal(r);
     }
@@ -469,7 +496,7 @@ nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, Value
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkList(list_builder->builder);
     }
     NIXC_CATCH_ERRS
@@ -480,19 +507,19 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * p)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkPrimOp((nix::PrimOp *) p);
     }
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_copy_value(nix_c_context * context, Value * value, Value * source)
+nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * source)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        auto & s = check_value_not_null(source);
+        auto & v = check_value_out(value);
+        auto & s = check_value_in(source);
         v = s;
     }
     NIXC_CATCH_ERRS
@@ -503,7 +530,7 @@ nix_err nix_make_attrs(nix_c_context * context, Value * value, BindingsBuilder *
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_out(value);
         v.mkAttrs(b->builder);
     }
     NIXC_CATCH_ERRS
@@ -550,7 +577,7 @@ nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * st
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
+        auto & v = check_value_in(value);
         nix::NixStringContext stringContext;
         auto rawStr = state->state.coerceToString(nix::noPos, v, stringContext, "while realising a string").toOwned();
         nix::StorePathSet storePaths;
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index d8bd77c33c9..b2b3439ef3e 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -422,7 +422,7 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * op);
  * @param[in] source value to copy from
  * @return error code, NIX_OK on success.
  */
-nix_err nix_copy_value(nix_c_context * context, Value * value, Value * source);
+nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * source);
 /**@}*/
 
 /** @brief Create a bindings builder
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index ca61c33d438..1362e2ec681 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -50,6 +50,7 @@
 
 #include <gc/gc.h>
 #include <gc/gc_cpp.h>
+#include <gc/gc_allocator.h>
 
 #include <boost/coroutine2/coroutine.hpp>
 #include <boost/coroutine2/protected_fixedsize_stack.hpp>
@@ -347,6 +348,8 @@ void initGC()
     gcInitialised = true;
 }
 
+static constexpr size_t BASE_ENV_SIZE = 128;
+
 EvalState::EvalState(
     const LookupPath & _lookupPath,
     ref<Store> store,
@@ -429,10 +432,13 @@ EvalState::EvalState(
 #if HAVE_BOEHMGC
     , valueAllocCache(std::allocate_shared<void *>(traceable_allocator<void *>(), nullptr))
     , env1AllocCache(std::allocate_shared<void *>(traceable_allocator<void *>(), nullptr))
+    , baseEnvP(std::allocate_shared<Env *>(traceable_allocator<Env *>(), &allocEnv(BASE_ENV_SIZE)))
+    , baseEnv(**baseEnvP)
+#else
+    , baseEnv(allocEnv(BASE_ENV_SIZE))
 #endif
-    , virtualPathMarker(settings.nixStore + "/lazylazy0000000000000000")
-    , baseEnv(allocEnv(128))
     , staticBaseEnv{std::make_shared<StaticEnv>(nullptr, nullptr)}
+    , virtualPathMarker(settings.nixStore + "/lazylazy0000000000000000")
 {
     corepkgsFS->setPathDisplay("<nix", ">");
     internalFS->setPathDisplay("«nix-internal»", "");
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 7c11ffd79d9..3f80f0efcd0 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -368,8 +368,6 @@ public:
     /* Decode a path encoded by `encodePath()`. */
     SourcePath decodePath(std::string_view s, PosIdx pos = noPos);
 
-    const std::string virtualPathMarker;
-
     /* Decode all virtual paths in a string, i.e. all
        /nix/store/virtual000... substrings are replaced by the
        corresponding input accessor. */
@@ -570,6 +568,11 @@ public:
      */
     SingleDerivedPath coerceToSingleDerivedPath(const PosIdx pos, Value & v, std::string_view errorCtx);
 
+#if HAVE_BOEHMGC
+    /** A GC root for the baseEnv reference. */
+    std::shared_ptr<Env *> baseEnvP;
+#endif
+
 public:
 
     /**
@@ -591,6 +594,8 @@ public:
      */
     std::vector<std::pair<std::string, Constant>> constantInfos;
 
+    const std::string virtualPathMarker;
+
 private:
 
     unsigned int baseEnvDispl = 0;
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 7ed3fa5a9ff..5795f04cfba 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -23,6 +23,7 @@ class BindingsBuilder;
 
 
 typedef enum {
+    tUninitialized = 0,
     tInt = 1,
     tBool,
     tString,
@@ -166,7 +167,7 @@ public:
 struct Value
 {
 private:
-    InternalType internalType;
+    InternalType internalType = tUninitialized;
 
     friend std::string showType(const Value & v);
 
@@ -270,6 +271,7 @@ public:
     inline ValueType type(bool invalidIsThunk = false) const
     {
         switch (internalType) {
+            case tUninitialized: break;
             case tInt: return nInt;
             case tBool: return nBool;
             case tString: return nString;
@@ -294,6 +296,16 @@ public:
         internalType = newType;
     }
 
+    /**
+     * A value becomes valid when it is initialized. We don't use this
+     * in the evaluator; only in the bindings, where the slight extra
+     * cost is warranted because of inexperienced callers.
+     */
+    inline bool isValid() const
+    {
+        return internalType != tUninitialized;
+    }
+
     inline void mkInt(NixInt n)
     {
         finishValue(tInt, { .integer = n });
diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index d6fb58e4ab9..c1c9362489b 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -173,12 +173,13 @@ void initNix(bool loadConfig)
        everybody. */
     umask(0022);
 
-#ifndef _WIN32
     /* Initialise the PRNG. */
     struct timeval tv;
     gettimeofday(&tv, 0);
+#ifndef _WIN32
     srandom(tv.tv_usec);
 #endif
+    srand(tv.tv_usec);
 
 
 }
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 933fc2e5a33..0c71a751553 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -782,6 +782,7 @@ public:
 
           - the store object has been signed using a key in the trusted keys list
           - the [`require-sigs`](#conf-require-sigs) option has been set to `false`
+          - the store URL is configured with `trusted=true`
           - the store object is [content-addressed](@docroot@/glossary.md#gloss-content-addressed-store-object)
         )",
         {"binary-cache-public-keys"}};
diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
new file mode 100644
index 00000000000..9da05778db2
--- /dev/null
+++ b/src/libstore/indirect-root-store.cc
@@ -0,0 +1,44 @@
+#include "indirect-root-store.hh"
+
+namespace nix {
+
+void IndirectRootStore::makeSymlink(const Path & link, const Path & target)
+{
+    /* Create directories up to `gcRoot'. */
+    createDirs(dirOf(link));
+
+    /* Create the new symlink. */
+    Path tempLink = fmt("%1%.tmp-%2%-%3%", link, getpid(), rand());
+    createSymlink(target, tempLink);
+
+    /* Atomically replace the old one. */
+    renameFile(tempLink, link);
+}
+
+Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _gcRoot)
+{
+    Path gcRoot(canonPath(_gcRoot));
+
+    if (isInStore(gcRoot))
+        throw Error(
+            "creating a garbage collector root (%1%) in the Nix store is forbidden "
+            "(are you running nix-build inside the store?)",
+            gcRoot);
+
+    /* Register this root with the garbage collector, if it's
+       running. This should be superfluous since the caller should
+       have registered this root yet, but let's be on the safe
+       side. */
+    addTempRoot(storePath);
+
+    /* Don't clobber the link if it already exists and doesn't
+       point to the Nix store. */
+    if (pathExists(gcRoot) && (!isLink(gcRoot) || !isInStore(readLink(gcRoot))))
+        throw Error("cannot create symlink '%1%'; already exists", gcRoot);
+    makeSymlink(gcRoot, printStorePath(storePath));
+    addIndirectRoot(gcRoot);
+
+    return gcRoot;
+}
+
+}
diff --git a/src/libstore/indirect-root-store.hh b/src/libstore/indirect-root-store.hh
index c11679fe8b8..b74ebc1eed4 100644
--- a/src/libstore/indirect-root-store.hh
+++ b/src/libstore/indirect-root-store.hh
@@ -67,6 +67,9 @@ struct IndirectRootStore : public virtual LocalFSStore
      * The form this weak-reference takes is implementation-specific.
      */
     virtual void addIndirectRoot(const Path & path) = 0;
+
+protected:
+    void makeSymlink(const Path & link, const Path & target);
 };
 
 }
diff --git a/src/libstore/local.mk b/src/libstore/local.mk
index 2e118f6cb2c..590a230e577 100644
--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
@@ -21,6 +21,9 @@ libstore_LDFLAGS += $(SQLITE3_LIBS) $(LIBCURL_LIBS) $(THREAD_LDFLAGS)
 ifdef HOST_LINUX
   libstore_LDFLAGS += -ldl
 endif
+ifdef HOST_WINDOWS
+  libstore_LDFLAGS += -lws2_32
+endif
 
 $(foreach file,$(libstore_FILES),$(eval $(call install-data-in,$(d)/$(file),$(datadir)/nix/sandbox)))
 
diff --git a/src/libstore/unix/uds-remote-store.cc b/src/libstore/uds-remote-store.cc
similarity index 86%
rename from src/libstore/unix/uds-remote-store.cc
rename to src/libstore/uds-remote-store.cc
index 226cdf7175c..649644146bf 100644
--- a/src/libstore/unix/uds-remote-store.cc
+++ b/src/libstore/uds-remote-store.cc
@@ -2,16 +2,20 @@
 #include "unix-domain-socket.hh"
 #include "worker-protocol.hh"
 
+#include <cstring>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <sys/socket.h>
-#include <sys/un.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
 
-#include <cstring>
-
+#ifdef _WIN32
+# include <winsock2.h>
+# include <afunix.h>
+#else
+# include <sys/socket.h>
+# include <sys/un.h>
+#endif
 
 namespace nix {
 
@@ -57,7 +61,7 @@ std::string UDSRemoteStore::getUri()
 
 void UDSRemoteStore::Connection::closeWrite()
 {
-    shutdown(fd.get(), SHUT_WR);
+    shutdown(toSocket(fd.get()), SHUT_WR);
 }
 
 
@@ -68,7 +72,7 @@ ref<RemoteStore::Connection> UDSRemoteStore::openConnection()
     /* Connect to a daemon that does the privileged work for us. */
     conn->fd = createUnixDomainSocket();
 
-    nix::connect(conn->fd.get(), path ? *path : settings.nixDaemonSocketFile);
+    nix::connect(toSocket(conn->fd.get()), path ? *path : settings.nixDaemonSocketFile);
 
     conn->from.fd = conn->fd.get();
     conn->to.fd = conn->fd.get();
diff --git a/src/libstore/unix/uds-remote-store.hh b/src/libstore/uds-remote-store.hh
similarity index 100%
rename from src/libstore/unix/uds-remote-store.hh
rename to src/libstore/uds-remote-store.hh
diff --git a/src/libstore/unix/uds-remote-store.md b/src/libstore/uds-remote-store.md
similarity index 100%
rename from src/libstore/unix/uds-remote-store.md
rename to src/libstore/uds-remote-store.md
diff --git a/src/libstore/unix/gc.cc b/src/libstore/unix/gc.cc
index 9b2e6d525cd..be579439568 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/unix/gc.cc
@@ -35,20 +35,6 @@ static std::string gcSocketPath = "/gc-socket/socket";
 static std::string gcRootsDir = "gcroots";
 
 
-static void makeSymlink(const Path & link, const Path & target)
-{
-    /* Create directories up to `gcRoot'. */
-    createDirs(dirOf(link));
-
-    /* Create the new symlink. */
-    Path tempLink = fmt("%1%.tmp-%2%-%3%", link, getpid(), random());
-    createSymlink(target, tempLink);
-
-    /* Atomically replace the old one. */
-    renameFile(tempLink, link);
-}
-
-
 void LocalStore::addIndirectRoot(const Path & path)
 {
     std::string hash = hashString(HashAlgorithm::SHA1, path).to_string(HashFormat::Nix32, false);
@@ -57,32 +43,6 @@ void LocalStore::addIndirectRoot(const Path & path)
 }
 
 
-Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _gcRoot)
-{
-    Path gcRoot(canonPath(_gcRoot));
-
-    if (isInStore(gcRoot))
-        throw Error(
-                "creating a garbage collector root (%1%) in the Nix store is forbidden "
-                "(are you running nix-build inside the store?)", gcRoot);
-
-    /* Register this root with the garbage collector, if it's
-       running. This should be superfluous since the caller should
-       have registered this root yet, but let's be on the safe
-       side. */
-    addTempRoot(storePath);
-
-    /* Don't clobber the link if it already exists and doesn't
-       point to the Nix store. */
-    if (pathExists(gcRoot) && (!isLink(gcRoot) || !isInStore(readLink(gcRoot))))
-        throw Error("cannot create symlink '%1%'; already exists", gcRoot);
-    makeSymlink(gcRoot, printStorePath(storePath));
-    addIndirectRoot(gcRoot);
-
-    return gcRoot;
-}
-
-
 void LocalStore::createTempRootsFile()
 {
     auto fdTempRoots(_fdTempRoots.lock());
diff --git a/src/libutil/unix/unix-domain-socket.cc b/src/libutil/unix-domain-socket.cc
similarity index 84%
rename from src/libutil/unix/unix-domain-socket.cc
rename to src/libutil/unix-domain-socket.cc
index 0bcf9040d95..87914bb83e7 100644
--- a/src/libutil/unix/unix-domain-socket.cc
+++ b/src/libutil/unix-domain-socket.cc
@@ -1,24 +1,31 @@
 #include "file-system.hh"
-#include "processes.hh"
 #include "unix-domain-socket.hh"
 #include "util.hh"
 
-#include <sys/socket.h>
-#include <sys/un.h>
+#ifdef _WIN32
+# include <winsock2.h>
+# include <afunix.h>
+#else
+# include <sys/socket.h>
+# include <sys/un.h>
+# include "processes.hh"
+#endif
 #include <unistd.h>
 
 namespace nix {
 
 AutoCloseFD createUnixDomainSocket()
 {
-    AutoCloseFD fdSocket = socket(PF_UNIX, SOCK_STREAM
+    AutoCloseFD fdSocket = toDescriptor(socket(PF_UNIX, SOCK_STREAM
         #ifdef SOCK_CLOEXEC
         | SOCK_CLOEXEC
         #endif
-        , 0);
+        , 0));
     if (!fdSocket)
         throw SysError("cannot create Unix domain socket");
+#ifndef _WIN32
     closeOnExec(fdSocket.get());
+#endif
     return fdSocket;
 }
 
@@ -32,16 +39,15 @@ AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode)
     if (chmod(path.c_str(), mode) == -1)
         throw SysError("changing permissions on '%1%'", path);
 
-    if (listen(fdSocket.get(), 100) == -1)
+    if (listen(toSocket(fdSocket.get()), 100) == -1)
         throw SysError("cannot listen on socket '%1%'", path);
 
     return fdSocket;
 }
 
-
 static void bindConnectProcHelper(
     std::string_view operationName, auto && operation,
-    int fd, const std::string & path)
+    Socket fd, const std::string & path)
 {
     struct sockaddr_un addr;
     addr.sun_family = AF_UNIX;
@@ -54,6 +60,9 @@ static void bindConnectProcHelper(
     auto * psaddr = reinterpret_cast<struct sockaddr *>(&addr);
 
     if (path.size() + 1 >= sizeof(addr.sun_path)) {
+#ifdef _WIN32
+        throw Error("cannot %s to socket at '%s': path is too long", operationName, path);
+#else
         Pipe pipe;
         pipe.create();
         Pid pid = startProcess([&] {
@@ -83,6 +92,7 @@ static void bindConnectProcHelper(
             errno = *errNo;
             throw SysError("cannot %s to socket at '%s'", operationName, path);
         }
+#endif
     } else {
         memcpy(addr.sun_path, path.c_str(), path.size() + 1);
         if (operation(fd, psaddr, sizeof(addr)) == -1)
@@ -91,7 +101,7 @@ static void bindConnectProcHelper(
 }
 
 
-void bind(int fd, const std::string & path)
+void bind(Socket fd, const std::string & path)
 {
     unlink(path.c_str());
 
@@ -99,7 +109,7 @@ void bind(int fd, const std::string & path)
 }
 
 
-void connect(int fd, const std::string & path)
+void connect(Socket fd, const std::string & path)
 {
     bindConnectProcHelper("connect", ::connect, fd, path);
 }
diff --git a/src/libutil/unix-domain-socket.hh b/src/libutil/unix-domain-socket.hh
new file mode 100644
index 00000000000..a8bbc4b89d3
--- /dev/null
+++ b/src/libutil/unix-domain-socket.hh
@@ -0,0 +1,82 @@
+#pragma once
+///@file
+
+#include "types.hh"
+#include "file-descriptor.hh"
+
+#ifdef _WIN32
+#  include <winsock2.h>
+#endif
+#include <unistd.h>
+
+namespace nix {
+
+/**
+ * Create a Unix domain socket.
+ */
+AutoCloseFD createUnixDomainSocket();
+
+/**
+ * Create a Unix domain socket in listen mode.
+ */
+AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode);
+
+/**
+ * Often we want to use `Descriptor`, but Windows makes a slightly
+ * stronger file descriptor vs socket distinction, at least at the level
+ * of C types.
+ */
+using Socket =
+#ifdef _WIN32
+    SOCKET
+#else
+    int
+#endif
+    ;
+
+#ifdef _WIN32
+/**
+ * Windows gives this a different name
+ */
+#  define SHUT_WR SD_SEND
+#endif
+
+/**
+ * Convert a `Socket` to a `Descriptor`
+ *
+ * This is a no-op except on Windows.
+ */
+static inline Socket toSocket(Descriptor fd)
+{
+#ifdef _WIN32
+    return reinterpret_cast<Socket>(fd);
+#else
+    return fd;
+#endif
+}
+
+/**
+ * Convert a `Socket` to a `Descriptor`
+ *
+ * This is a no-op except on Windows.
+ */
+static inline Descriptor fromSocket(Socket fd)
+{
+#ifdef _WIN32
+    return reinterpret_cast<Descriptor>(fd);
+#else
+    return fd;
+#endif
+}
+
+/**
+ * Bind a Unix domain socket to a path.
+ */
+void bind(Socket fd, const std::string & path);
+
+/**
+ * Connect to a Unix domain socket.
+ */
+void connect(Socket fd, const std::string & path);
+
+}
diff --git a/src/libutil/unix/unix-domain-socket.hh b/src/libutil/unix/unix-domain-socket.hh
deleted file mode 100644
index b78feb454b1..00000000000
--- a/src/libutil/unix/unix-domain-socket.hh
+++ /dev/null
@@ -1,31 +0,0 @@
-#pragma once
-///@file
-
-#include "types.hh"
-#include "file-descriptor.hh"
-
-#include <unistd.h>
-
-namespace nix {
-
-/**
- * Create a Unix domain socket.
- */
-AutoCloseFD createUnixDomainSocket();
-
-/**
- * Create a Unix domain socket in listen mode.
- */
-AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode);
-
-/**
- * Bind a Unix domain socket to a path.
- */
-void bind(int fd, const std::string & path);
-
-/**
- * Connect to a Unix domain socket.
- */
-void connect(int fd, const std::string & path);
-
-}
diff --git a/tests/functional/flakes/common.sh b/tests/functional/flakes/common.sh
index e0776d5ed77..f83a02aba73 100644
--- a/tests/functional/flakes/common.sh
+++ b/tests/functional/flakes/common.sh
@@ -25,6 +25,8 @@ writeSimpleFlake() {
     parent = builtins.dirOf ./.;
 
     baseName = builtins.baseNameOf ./.;
+
+    root = ./.;
   };
 }
 EOF
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 1a9f70b5933..48239805e6b 100644
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -236,7 +236,12 @@ nix build -o "$TEST_ROOT/result" --expr "(builtins.getFlake \"git+file://$flake1
 [[ $(nix eval --json flake1#parent) = \""$NIX_STORE_DIR"\" ]]
 
 # Regression test for baseNameOf on the root of the flake.
-[[ $(nix eval --raw flake1#baseName) =~ ^[a-z0-9]*-source$ ]]
+[[ $(nix eval --raw flake1#baseName) =~ ^[a-z0-9]+-source$ ]]
+
+# Test that the root of a tree returns a path named /nix/store/<hash1>-<hash2>-source.
+# This behavior is *not* desired, but has existed for a while.
+# Issue #10627 what to do about it.
+[[ $(nix eval --raw flake1#root) =~ ^.*/[a-z0-9]+-[a-z0-9]+-source$ ]]
 
 # Building a flake with an unlocked dependency should fail in pure mode.
 (! nix build -o "$TEST_ROOT/result" flake2#bar --no-registries)
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index ac0cdb9c449..6e1131e10f8 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -14,11 +14,16 @@
 
 namespace nixC {
 
-TEST_F(nix_api_expr_test, nix_value_set_get_int)
+TEST_F(nix_api_expr_test, nix_value_get_int_invalid)
 {
     ASSERT_EQ(0, nix_get_int(ctx, nullptr));
-    ASSERT_DEATH(nix_get_int(ctx, value), "");
+    assert_ctx_err();
+    ASSERT_EQ(0, nix_get_int(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_int)
+{
     int myInt = 1;
     nix_init_int(ctx, value, myInt);
 
@@ -27,24 +32,34 @@ TEST_F(nix_api_expr_test, nix_value_set_get_int)
     ASSERT_EQ(NIX_TYPE_INT, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_float)
+TEST_F(nix_api_expr_test, nix_value_set_get_float_invalid)
 {
-    ASSERT_FLOAT_EQ(0.0, nix_get_float(ctx, nullptr));
-    ASSERT_DEATH(nix_get_float(ctx, value), "");
+    ASSERT_DOUBLE_EQ(0.0, nix_get_float(ctx, nullptr));
+    assert_ctx_err();
+    ASSERT_DOUBLE_EQ(0.0, nix_get_float(ctx, value));
+    assert_ctx_err();
+}
 
-    float myDouble = 1.0;
+TEST_F(nix_api_expr_test, nix_value_set_get_float)
+{
+    double myDouble = 1.0;
     nix_init_float(ctx, value, myDouble);
 
-    ASSERT_FLOAT_EQ(myDouble, nix_get_float(ctx, value));
+    ASSERT_DOUBLE_EQ(myDouble, nix_get_float(ctx, value));
     ASSERT_STREQ("a float", nix_get_typename(ctx, value));
     ASSERT_EQ(NIX_TYPE_FLOAT, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_bool)
+TEST_F(nix_api_expr_test, nix_value_set_get_bool_invalid)
 {
     ASSERT_EQ(false, nix_get_bool(ctx, nullptr));
-    ASSERT_DEATH(nix_get_bool(ctx, value), "");
+    assert_ctx_err();
+    ASSERT_EQ(false, nix_get_bool(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_bool)
+{
     bool myBool = true;
     nix_init_bool(ctx, value, myBool);
 
@@ -53,12 +68,18 @@ TEST_F(nix_api_expr_test, nix_value_set_get_bool)
     ASSERT_EQ(NIX_TYPE_BOOL, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_string)
+TEST_F(nix_api_expr_test, nix_value_set_get_string_invalid)
 {
     std::string string_value;
     ASSERT_EQ(NIX_ERR_UNKNOWN, nix_get_string(ctx, nullptr, OBSERVE_STRING(string_value)));
-    ASSERT_DEATH(nix_get_string(ctx, value, OBSERVE_STRING(string_value)), "");
+    assert_ctx_err();
+    ASSERT_EQ(NIX_ERR_UNKNOWN, nix_get_string(ctx, value, OBSERVE_STRING(string_value)));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_string)
+{
+    std::string string_value;
     const char * myString = "some string";
     nix_init_string(ctx, value, myString);
 
@@ -68,21 +89,29 @@ TEST_F(nix_api_expr_test, nix_value_set_get_string)
     ASSERT_EQ(NIX_TYPE_STRING, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_null)
+TEST_F(nix_api_expr_test, nix_value_set_get_null_invalid)
 {
-    ASSERT_DEATH(nix_get_typename(ctx, value), "");
+    ASSERT_EQ(NULL, nix_get_typename(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_null)
+{
     nix_init_null(ctx, value);
 
     ASSERT_STREQ("null", nix_get_typename(ctx, value));
     ASSERT_EQ(NIX_TYPE_NULL, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_path)
+TEST_F(nix_api_expr_test, nix_value_set_get_path_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_path_string(ctx, nullptr));
-    ASSERT_DEATH(nix_get_path_string(ctx, value), "");
-
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_path_string(ctx, value));
+    assert_ctx_err();
+}
+TEST_F(nix_api_expr_test, nix_value_set_get_path)
+{
     const char * p = "/nix/store/40s0qmrfb45vlh6610rk29ym318dswdr-myname";
     nix_init_path_string(ctx, state, value, p);
 
@@ -91,25 +120,39 @@ TEST_F(nix_api_expr_test, nix_value_set_get_path)
     ASSERT_EQ(NIX_TYPE_PATH, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_build_and_init_list)
+TEST_F(nix_api_expr_test, nix_build_and_init_list_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, nullptr, state, 0));
+    assert_ctx_err();
     ASSERT_EQ(0, nix_get_list_size(ctx, nullptr));
+    assert_ctx_err();
 
-    ASSERT_DEATH(nix_get_list_byidx(ctx, value, state, 0), "");
-    ASSERT_DEATH(nix_get_list_size(ctx, value), "");
+    ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, value, state, 0));
+    assert_ctx_err();
+    ASSERT_EQ(0, nix_get_list_size(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_build_and_init_list)
+{
     int size = 10;
     ListBuilder * builder = nix_make_list_builder(ctx, state, size);
 
     Value * intValue = nix_alloc_value(ctx, state);
+    Value * intValue2 = nix_alloc_value(ctx, state);
+
+    // `init` and `insert` can be called in any order
     nix_init_int(ctx, intValue, 42);
     nix_list_builder_insert(ctx, builder, 0, intValue);
+    nix_list_builder_insert(ctx, builder, 1, intValue2);
+    nix_init_int(ctx, intValue2, 43);
+
     nix_make_list(ctx, builder, value);
     nix_list_builder_free(builder);
 
     ASSERT_EQ(42, nix_get_int(ctx, nix_get_list_byidx(ctx, value, state, 0)));
-    ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, value, state, 1));
+    ASSERT_EQ(43, nix_get_int(ctx, nix_get_list_byidx(ctx, value, state, 1)));
+    ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, value, state, 2));
     ASSERT_EQ(10, nix_get_list_size(ctx, value));
 
     ASSERT_STREQ("a list", nix_get_typename(ctx, value));
@@ -119,20 +162,33 @@ TEST_F(nix_api_expr_test, nix_build_and_init_list)
     nix_gc_decref(ctx, intValue);
 }
 
-TEST_F(nix_api_expr_test, nix_build_and_init_attr)
+TEST_F(nix_api_expr_test, nix_build_and_init_attr_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_attr_byname(ctx, nullptr, state, 0));
+    assert_ctx_err();
     ASSERT_EQ(nullptr, nix_get_attr_byidx(ctx, nullptr, state, 0, nullptr));
+    assert_ctx_err();
     ASSERT_EQ(nullptr, nix_get_attr_name_byidx(ctx, nullptr, state, 0));
+    assert_ctx_err();
     ASSERT_EQ(0, nix_get_attrs_size(ctx, nullptr));
+    assert_ctx_err();
     ASSERT_EQ(false, nix_has_attr_byname(ctx, nullptr, state, "no-value"));
+    assert_ctx_err();
+
+    ASSERT_EQ(nullptr, nix_get_attr_byname(ctx, value, state, 0));
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_attr_byidx(ctx, value, state, 0, nullptr));
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_attr_name_byidx(ctx, value, state, 0));
+    assert_ctx_err();
+    ASSERT_EQ(0, nix_get_attrs_size(ctx, value));
+    assert_ctx_err();
+    ASSERT_EQ(false, nix_has_attr_byname(ctx, value, state, "no-value"));
+    assert_ctx_err();
+}
 
-    ASSERT_DEATH(nix_get_attr_byname(ctx, value, state, 0), "");
-    ASSERT_DEATH(nix_get_attr_byidx(ctx, value, state, 0, nullptr), "");
-    ASSERT_DEATH(nix_get_attr_name_byidx(ctx, value, state, 0), "");
-    ASSERT_DEATH(nix_get_attrs_size(ctx, value), "");
-    ASSERT_DEATH(nix_has_attr_byname(ctx, value, state, "no-value"), "");
-
+TEST_F(nix_api_expr_test, nix_build_and_init_attr)
+{
     int size = 10;
     const char ** out_name = (const char **) malloc(sizeof(char *));
 
@@ -311,4 +367,17 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
     nix_gc_decref(ctx, e);
 }
 
+TEST_F(nix_api_expr_test, nix_copy_value)
+{
+    Value * source = nix_alloc_value(ctx, state);
+
+    nix_init_int(ctx, source, 42);
+    nix_copy_value(ctx, value, source);
+
+    ASSERT_EQ(42, nix_get_int(ctx, value));
+
+    // Clean up
+    nix_gc_decref(ctx, source);
+}
+
 }
diff --git a/tests/unit/libexpr/value/value.cc b/tests/unit/libexpr/value/value.cc
new file mode 100644
index 00000000000..5762d5891f8
--- /dev/null
+++ b/tests/unit/libexpr/value/value.cc
@@ -0,0 +1,25 @@
+#include "value.hh"
+
+#include "tests/libstore.hh"
+
+namespace nix {
+
+class ValueTest : public LibStoreTest
+{};
+
+TEST_F(ValueTest, unsetValue)
+{
+    Value unsetValue;
+    ASSERT_EQ(false, unsetValue.isValid());
+    ASSERT_EQ(nThunk, unsetValue.type(true));
+    ASSERT_DEATH(unsetValue.type(), "");
+}
+
+TEST_F(ValueTest, vInt)
+{
+    Value vInt;
+    vInt.mkInt(42);
+    ASSERT_EQ(true, vInt.isValid());
+}
+
+} // namespace nix
diff --git a/tests/unit/libutil-support/tests/nix_api_util.hh b/tests/unit/libutil-support/tests/nix_api_util.hh
index 75d302bd6d8..efd2001167d 100644
--- a/tests/unit/libutil-support/tests/nix_api_util.hh
+++ b/tests/unit/libutil-support/tests/nix_api_util.hh
@@ -24,7 +24,9 @@ protected:
 
     nix_c_context * ctx;
 
-    inline void assert_ctx_ok() {
+    inline void assert_ctx_ok()
+    {
+
         if (nix_err_code(ctx) == NIX_OK) {
             return;
         }
@@ -33,5 +35,14 @@ protected:
         std::string msg(p, n);
         FAIL() << "nix_err_code(ctx) != NIX_OK, message: " << msg;
     }
+
+    inline void assert_ctx_err()
+    {
+        if (nix_err_code(ctx) != NIX_OK) {
+            return;
+        }
+        FAIL() << "Got NIX_OK, but expected an error!";
+    }
 };
+
 }