autoUpgrade pins the upgrade to the revision the forward-only guard resolved and writes it to /var/lib/superconfig-revision after a successful upgrade, like deploy does. Vector reads that file every 30s and exports nixos_system_info{host,revision,revision_short}; the node dashboard shows host -> revision_short.

The flake's git revision (-dirty with uncommitted changes, unknown for non-git sources) is copied to the target with the source and written by deploy-switch once the switch succeeded. Read by the monitoring agent; it is in no derivation, so a commit doesn't change every machine's closure.