docs/superpowers/specs/2026-08-05-immich-nixos-module-design.md

@@ -16,7 +16,7 @@ links, metadata) and photo/video library.
 | Topic | Decision |
 |-------|----------|
 | Approach | Native `services.immich` (nixpkgs), not `oci-containers` |
-| Version target | Stable nixpkgs ships **2.7.5**, unstable **3.0.3**. Pin target ≥ running docker version (forward-migration only) |
+| Version target | **Resolved: docker runs 2.7.5 == stable nixpkgs 2.7.5.** Use the stable module as-is; no `package` override. Same-version restore, no forward schema migration |
 | Media location | Default local path `/var/lib/immich`. NAS deferred to a future read-only external library |
 | Database | Migrate via dump/restore — keep everything |
 | HW acceleration | Video transcoding only (VAAPI/QSV via existing Intel graphics stack). ML on CPU |
@@ -83,8 +83,9 @@ groups (above); (b) the hwaccel backend (QSV/VAAPI) is chosen in Immich's
 
 ### Pre-flight (hard blocker)
 1. Get running docker Immich version (`docker exec <server> immich --version` or web UI footer).
-2. Compare to target (stable 2.7.5 / unstable 3.0.3). Target **must be ≥ running**.
-   - running ≤ 2.7.5 → stable module as-is
+2. **Resolved 2026-08-05: running version is 2.7.5, equal to stable nixpkgs.**
+   Use the stable module as-is (no `package` override). Kept for reference:
+   - running ≤ 2.7.5 → stable module as-is ← **this case**
    - 2.7.6–3.0.3 → set `package = pkgs.unstable.immich`
    - `> 3.0.3` → bump nixpkgs first; **stop and re-plan**
 3. Record docker `UPLOAD_LOCATION` and DB container name/credentials.
@@ -111,9 +112,10 @@ Before deleting any docker data: `systemctl stop immich-*`, disable the profile,
 `nixos-rebuild switch`, `docker compose up -d`. Original docker DB + upload
 folder remain untouched until explicitly removed after a few days of confidence.
 
-## Known risk
+## Known risk — RESOLVED
 
-Step 9 crosses the **pgvecto.rs → VectorChord** vector-extension boundary if the
-docker version predates VectorChord. Follow Immich's official "migrate vector
-database" guidance during restore. The exact case is known only after the
-pre-flight version check.
+The main risk was step 9 crossing the **pgvecto.rs → VectorChord** vector-extension
+boundary. With source and target both at **2.7.5**, both use VectorChord — no
+boundary crossing and no forward schema migration. The restore is a same-version
+dump/load. Residual risk is limited to routine dump/restore mechanics
+(roles, extension availability in the NixOS Postgres, ownership on restore).