Set the global nix-path from the declarative NIX_PATH list so a clean environment resolves the same locked Nixpkgs. Keep old root channel profiles for recovery rather than deleting them to silence the activation warning.
Use the rebuild binary from the reviewed closure and --no-reexec. The bootstrap nixos-rebuild otherwise evaluates its own package through the old channel before honoring --store-path. The failed attempt made no live changes.
Document successful empty-home file deployment, writable lock idempotence, and safe migration/backup tests. Require focused regular commits and record the source revision in each system generation.
Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile.
Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.
Coding Agent