10/14

IMAGE_DESIGN.txt

@@ -116,8 +116,11 @@ string against the runtime store prefix. But every "does the target
 exist" check has to become "does T + target exist". The same goes for
 restore_displaced and for anything else that follows a link.
 
-Proposed shape:
+Shape (ACCEPTED 2026-10-05):
 
+  - The library refuses a sysroot other than "/" for GL_SCOPE_USR
+    contexts. Only system scope may target another root, for every
+    caller, not just the CLIs (section 4).
   - gl_context_t gains `char sysroot[PATH_MAX]` ("" == "/"; appended
     at the end, matched in lib/glacier_cdef.lua and
     tests/glacier_ffi.lua).
@@ -126,6 +129,12 @@ Proposed shape:
     wrappers passing "/", so every current caller is unchanged.
   - One helper, gl_at(ctx, runtime_path, out), used for EVERY
     filesystem operation. Runtime paths stay what's stored and compared.
+    AS BUILT (2026-10-05): the reverse, same effect. The context stores
+    INSTALL paths, used for every filesystem operation unchanged, and
+    gl_runtime_path() translates only where runtime meaning matters
+    (link targets, is_glacier_symlink, .displaced keys); gl_at() checks
+    a link's target during prune. A missed translation then lands in T,
+    never on the host.
   - GL_BASE_LINKS_DEST resolves to sysroot + "/usr". Never the host's
     /usr when a sysroot is set.
 
@@ -239,9 +248,13 @@ Consequences of /usr starting empty that the design has to own:
 | 8. Milestones                              |
 +--------------------------------------------+
 
-  1. sysroot in the library (section 3), plus the host-untouched test.
+  1. [DONE 2026-10-05] sysroot in the library (section 3), plus the
+     host-untouched test (glacier-ng/tests/sysroot_alpine.sh). Implemented
+     with INSTALL paths in the context and runtime translation where a
+     path's meaning matters; see CLAUDE.md "Install root / sysroot".
      No CLI changes, testable through FFI alone.
-  2. syspkg --root (section 4), with the root-owned-target check.
+  2. [DONE 2026-10-05] syspkg --root (section 4), with the root-owned-target
+     check, as -R/--root (implies --strict). glacier-ng/tests/root_alpine.sh.
   3. A `filesystem` base package (section 7).
   4. images/minimal.image + a driver script (gworld -> syspkg --root
      -> finalize). Milestone: `chroot T /bin/sh` works, and