10/4

SECURITY_DESIGN.txt

@@ -179,6 +179,14 @@ is being preserved exactly as-is — gstore stays permanently
 user-scope-only; the fix is removing -N, not touching the bounds
 check.
 
+LATER AMENDMENT: `gstore -n` does run as root — it creates
+/glacier/usr/<uid> inside a root-owned parent (PACKAGE_SCOPES.txt
+section 1). Still user scope only. Root runs it with an explicit UID; a
+user runs it for themselves through a doas rule pinned to exactly
+`-n`, which is what stops them naming another UID (same boundary as
+section 6). Being root-run, gstore follows syspkg's loading rules
+(pinned paths, -E, root-ownership checks).
+
 
 +--------------------------------------------+
 | 6. syspkg privilege model                  |