anchor.diff:    imports = [
       (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
       (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
  -    (mkChangedOptionModule
  -      [ "security" "initialRootPassword" ]
  -      [ "users" "users" "root" "initialHashedPassword" ]
  -      (cfg: if cfg.security.initialRootPassword == "!"
  -            then null
  -            else cfg.security.initialRootPassword))
  +    (mkRenamedOptionModule ["security" "initialRootPassword"] ["users" "users" "root" "initialHashedPassword"])
     ];
   
     ###### interface
  -
     options = {
   
       users.mutableUsers = mkOption {
  
positive.code:         home = "/root";
          shell = mkDefault cfg.defaultUserShell;
          group = "root";
        };
        nobody = {
          uid = ids.uids.nobody;
  
negative.code:         # there is at least one "privileged" account that has a
          # password or an SSH authorized key. Privileged accounts are
          # root and users in the wheel group.
          # The check does not apply when users.disableLoginPossibilityAssertion
          # The check does not apply when users.mutableUsers
          assertion = !cfg.mutableUsers -> !cfg.allowNoPasswordLogin ->
            any id (mapAttrsToList (name: cfg:
              (name == "root"
               || cfg.group == "wheel"
               || elem "wheel" cfg.extraGroups)
              &&
  