What nix flake update changes
1. Resolve inputs
Fetch the latest revision of nixpkgs and the other inputs.
→
2. Rewrite the lock
Pin every revision and content hash in flake.lock.
→
3. Rebuild
Re-evaluate the system closure against the new nixpkgs.
This updates more than explicit system packages: the kernel, desktop,
services and transitive libraries are re-evaluated too.
system.stateVersion is a compatibility marker, not a pin.
Why local.nix is impure
local.nix is git-ignored, so it never enters the flake
source tree. The flake reads it from
NIXOS_FLAKE_DIR, which is why rebuild commands pass
--impure. local.nix.example documents the
expected shape without exposing values.