10/4

PACKAGE_SCOPES.txt

@@ -15,20 +15,25 @@ up to and including destroying a live /usr.
 +------------------------------------+
 
 USR (GL_SCOPE_USR)
-    Per-uid packages. Index/store/links all live under a specific
-    uid's tree:
-        /glacier/usr/index/<uid>
-        /glacier/usr/store/<uid>
-        /glacier/usr/links/<uid>
-    Symlinks always land under /glacier/usr/links/<uid>/{bin,...}.
+    Per-uid packages. Everything a uid's transactions touch lives
+    under ONE directory that uid owns:
+        /glacier/usr/<uid>/{index,store,links,stage,old,lock}
+    /glacier/usr itself is root-owned (0755) and each /glacier/usr/<uid>
+    is owned by that uid (0700), so every create/rename/lock a
+    transaction does happens inside the user's own directory — no shared
+    writable parent, so no uid can create or squat another's. Root
+    creates each one: `gstore -n UID` directly, or a user for themselves
+    via a doas rule pinned to `gstore -n` (see gstore's header). The
+    library refuses a base that isn't a real directory owned by its uid
+    with no group/other bits, or whose /glacier/usr is loosened.
+    Symlinks always land under /glacier/usr/<uid>/links/{bin,...}.
     There is no base-repo exception for USR scope. Nothing installed
     under a per-user scope is ever considered part of the base system,
     so nothing here ever touches /usr.
 
 SYS (GL_SCOPE_SYS)
     System-wide packages, not owned by any particular uid:
-        /glacier/sys/index
-        /glacier/sys/store
+        /glacier/sys/{index,store,links,stage,old,lock}
     Symlink destination depends on the package's repo (see section 3).
     Requires root. gpkg enforces this via geteuid() before it will
     even attempt a system-scope operation.
@@ -69,9 +74,11 @@ decides where that package's activation symlinks physically land.
 | 3. Symlink placement rule          |
 +------------------------------------+
 
-    scope == USR                         -> /glacier/usr/links/<uid>
+    scope == USR                         -> /glacier/usr/<uid>/links
     scope == SYS && repo == "base"       -> /usr              (*)
     scope == SYS && repo != "base"       -> /glacier/sys/links
+    scope == SYS, package path etc/...   -> COPIED into /etc (any repo;
+                                            config, not linked — see below)
 
 (*) This is the base-system exception. Packages that are part of the
     minimal working system get their symlinks placed directly into
@@ -84,6 +91,14 @@ decides where that package's activation symlinks physically land.
     same as it always has. The base system is the exception to the
     norm, not the other way around.
 
+Config files are the exception to linking. Editing a symlink into the
+store would edit the store itself, so a system-scope package's etc/ is
+copied into /etc instead. glacier keeps a record of the last version
+each package offered (<store>/.etc-state/). A file the admin changed,
+deleted, or that glacier never installed is never overwritten; package
+changes to it arrive once as FILE.new. Unchanged files are updated in
+place and removed with their package (pacman-style).
+
 This decision is made per-package, at the point where a package's repo
 is actually known (inside gl_link_pkg / gl_unlink_pkg / the walk loop
 in gl_relink_store) — NOT baked into the context at creation time.