Use the rebuild binary from the reviewed closure and --no-reexec. The bootstrap nixos-rebuild otherwise evaluates its own package through the old channel before honoring --store-path. The failed attempt made no live changes.
Document successful empty-home file deployment, writable lock idempotence, and safe migration/backup tests. Require focused regular commits and record the source revision in each system generation.
Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile.
Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.