This is not a complete fix, the whole thing is still full of races, but at least this gets it to explode a lot less often.
The nixpkgs-unstable channel's programs.sqlite was used to identify packages producing exactly one binary, and these automatically added to their package definitions wherever possible.
This is the thing you want to look at.
