Fair enough, NixOS doesn't completely solve this either (other than the aforementioned possibility to reference other parts of the system config and some integrity checks). I was just wondering if that's an area where more static checks are possible.

That sounds pretty good though, thanks! Maybe I'll try out Guix System some day.