configs/nixos/AGENTS.md

@@ -52,8 +52,8 @@
   directories already exist inside the read-only source.
   For aggregate Copyparty volumes such as `/srv` with nested `/srv/inbox`, keep the guest bind mount
   writable and enforce read-only behavior through Copyparty access plus service `ReadWritePaths`.
-- `deploy-to` builds from the source checkout and activates an imported closure on the target.
-  Do not rely on a target-local monorepo checkout for remote deployment.
+- `deploy-to` builds from the source checkout, records the imported closure as the target system profile,
+  and activates it. Do not rely on a target-local monorepo checkout for remote deployment.
 - On Pikachu, `nix copy --to ssh://pikachu` accepted a small `nix store add-file` probe,
   but rejected locally built system paths that lacked trusted signatures.
   Use a sudo `nix-store --import` path for unsigned deploy closures.
@@ -64,3 +64,4 @@
 - Configure the Chaotic Nyx cache only on hosts that select `linuxPackages_cachyos` (currently Neogaia
   and Zeus), not in the generic host module.
 - Module-relative paths resolve from the module file. Update them when moving a module into a subdirectory.
+- On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.

configs/nixos/modules/shell/fish/functions/deploy-to.fish

@@ -80,6 +80,13 @@ else
     echo "deploy-to: $host already has the full closure for $system_path" >&2
 end
 
+echo "deploy-to: recording $system_path as the system profile on $host" >&2
+ssh -t $host sudo nix-env --profile /nix/var/nix/profiles/system --set $system_path
+or begin
+    echo "deploy-to: system profile update failed for $host" >&2
+    return $status
+end
+
 echo "deploy-to: activating $system_path on $host" >&2
 ssh -t $host sudo "$system_path/bin/switch-to-configuration" switch
 or begin