From 3c2eefe7f4ffc4260783f291f61dc9495b87418a Mon Sep 17 00:00:00 2001
From: Daniel Hammer <daniel@nexlink.cloud>
Date: Sat, 17 Oct 2026 10:53:36 +0200
Subject: [PATCH] refactor: move wallpaper.cache to 0:/state

---
 kernel/src/Api/BuildNo.hpp             |  2 +-
 kernel/src/Fs/ProtectedPaths.cpp       |  6 +++++-
 programs/src/login/login_wallpaper.cpp | 16 +++++++++++++---
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/kernel/src/Api/BuildNo.hpp b/kernel/src/Api/BuildNo.hpp
index 9aa0514..34ee96d 100644
--- a/kernel/src/Api/BuildNo.hpp
+++ b/kernel/src/Api/BuildNo.hpp
@@ -12,4 +12,4 @@
 
 #pragma once
 
-#define MONTAUK_BUILD_NUMBER 3
+#define MONTAUK_BUILD_NUMBER 4
diff --git a/kernel/src/Fs/ProtectedPaths.cpp b/kernel/src/Fs/ProtectedPaths.cpp
index 56949de..ba5be90 100644
--- a/kernel/src/Fs/ProtectedPaths.cpp
+++ b/kernel/src/Fs/ProtectedPaths.cpp
@@ -29,9 +29,13 @@ namespace Fs {
         {"/config/ssh.toml",         false, montauk::abi::CAP_USER_ADMIN},
         {"/config/capabilities.toml",false, montauk::abi::CAP_USER_ADMIN},
         {"/config/consent.toml",     false, montauk::abi::CAP_USER_ADMIN},
-        {"/config/wallpaper.cache",  false, montauk::abi::CAP_USER_ADMIN},
         // Read by the Bluetooth driver at controller bring-up.
         {"/config/bluetooth.toml",   false, montauk::abi::CAP_DEVICE_ADMIN},
+        // Login's wallpaper cache. The directory is listed for the same reason
+        // as /config: a rename only checks its own path, so an unlisted parent
+        // could be swapped for one holding a forged cache.
+        {"/state/cache",             false, montauk::abi::CAP_USER_ADMIN},
+        {"/state/cache/wallpaper.cache", false, montauk::abi::CAP_USER_ADMIN},
         {"/apps",                    true,  montauk::abi::CAP_SYSTEM_IMAGE},
         {"/os",                      true,  montauk::abi::CAP_SYSTEM_IMAGE},
     };
diff --git a/programs/src/login/login_wallpaper.cpp b/programs/src/login/login_wallpaper.cpp
index d1edc2a..8c2e64c 100644
--- a/programs/src/login/login_wallpaper.cpp
+++ b/programs/src/login/login_wallpaper.cpp
@@ -12,9 +12,15 @@ namespace {
 constexpr const char* kDefaultWallpaperPath = "0:/os/wallpapers/default.jpg";
 
 // Screen-sized, already tinted pixels, so a re-login skips the JPEG decode and
-// the rescale entirely. Kernel-protected (CAP_USER_ADMIN) because it is drawn
-// on a screen that is about to take a password.
-constexpr const char* kCachePath = "0:/config/wallpaper.cache";
+// the rescale entirely. Kernel-protected (CAP_USER_ADMIN), along with its
+// directory, because it is drawn on a screen that is about to take a password.
+constexpr const char* kStateDir  = "0:/state";
+constexpr const char* kCacheDir  = "0:/state/cache";
+constexpr const char* kCachePath = "0:/state/cache/wallpaper.cache";
+
+// Where the cache lived before it moved out of 0:/config. Deleted when the new
+// one is first written so an upgraded install does not keep the stale copy.
+constexpr const char* kLegacyCachePath = "0:/config/wallpaper.cache";
 
 constexpr uint32_t kCacheMagic   = 0x4350574DU;  // "MWPC"
 constexpr uint32_t kCacheVersion = 1;
@@ -137,6 +143,10 @@ void save_to_cache(const LoginState* ls, const char* srcPath,
     header->overlayAlpha = kLoginOverlayAlpha;
     montauk::strncpy(header->sourcePath, srcPath, sizeof(header->sourcePath));
 
+    montauk::fdelete(kLegacyCachePath);
+    montauk::fmkdir(kStateDir);
+    montauk::fmkdir(kCacheDir);
+
     int fd = montauk::fcreate(kCachePath);
     if (fd < 0) return;  // read-only volume or no authority: not fatal
     // One write, so the file is never briefly visible half-written and the