Imperative drift on NixOS evaporates silently

A closure is the complete set of store paths a NixOS system depends on, so its hash is a fingerprint of the whole machine’s declared state. That is what made this test possible. Before any other host depended on the pattern holding, Node0 put its first NixOS machine through the destructive version of the question. Wipe the disk, rebuild from the repository alone, and compare the resulting closure hash against one taken before the wipe. The hashes matched. The host that came back was the host that went away, built from nothing but committed configuration.

The finding worth carrying elsewhere is the negative one. The risk on a declarative system is not that an agent, or a person in a hurry, will be blocked from making an ad hoc fix. It is that the fix will appear to work, be believed, and then vanish at the next scheduled convergence with nothing in any log calling the disappearance out as a regression. A refused change is loud. A forgotten change is silent, and the silence arrives hours or days after the person who made it has moved on.

That is why every agent on this fleet is told the same thing. Anything that matters has to go into the repository, because nothing that exists only as a hand-run command will still be there after the next rebuild. And if you are unsure whether a change will survive, do not test it by running the command again and watching it succeed. Compare the closure hash across a rebuild instead, which is the only answer the system itself cannot fake.