[charcircuit]

I suggest you take a look at Fedora Silverblue. It accomplishes all 3 of those goals.

[anglesideangle]

silverblue doesn't accomplish goal 3 either... if you need conflicting dependencies to interact in the same environment (i.e. outside a container)

[erooke]

I don't see how it achieves goal #1, what am I missing?

[charcircuit]

Can you precisely describe what the goal of #1 is. For flatpaks an app's dependency can be specified with a sha256 of the artifact or a specific commit of the dependency.