NixOS has no /opt; tar's 'cannot open' is a fatal exit 2, which is exactly the failure every run has shown since 2026-08-07. ci.yml has always extracted into /tangled/workspace — the working example was one directory away the whole time. Also bootstraps the strict power-loss image, which admit run requires and CI has never had. Probes proved the engine, image, dependency list and virtualisation.docker are all fine, so this was the remaining difference. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>