I have had this multiple times, with usbguard, opensnitch, now I suppose “no multithreading” kernel arguments…
I set something, it is broken, I comment it out, it seems to stay enabled.
What I did is change the config to manually disable it but this sucks and doesnt work for everything.
I am using flakes with regular nixos modules for my config.
Is there a way to force cleanup the system to only contain stuff actually defined?
This is how NixOS works, you’re doing something wrong if that’s not happening.
Sounds like you’re making changes to the kernel, are you rebooting? You can’t change the kernel on the fly (at least not without kexec, which is effectively the same as rebooting for your average desktop computer).
If that’s not it, are you accidentally switching to the wrong configuration? It’s pretty common for folks to still accidentally be deploying /etc/nixos even though they think they’ve moved the configuration. That, or editing a configuration in one directory while deploying one in another.
Share your configuration if it’s neither of those things, and the exact set of steps you’re following/commands you’re executing to deploy.
Depends what the default value is especially if some other option is setting it. Hard to say without specifics.