I’m not talking about apt the CLI tool, but the actual package manager. The plain apt tool is only designed to be a convenience wrapper for common workflows implemented in other tools.

Sure, but the interface is probably just as important as the actual logic behind it, isn't it?

As you correctly pointed out, Apt has the distinction between packages installed as a dependency (“auto installed”) versus packages installed directly (“manually installed”). This is precisely one of the reasons why I consider Apt the best package manager.

Honestly I would consider that one of the fundamental things a package manager must do, I didn't think it was a special thing haha

If you want to install a package as manual, then later mark it as auto, you can do that with apt-mark.

Yeah, I know. But if you want to manually install a package like that, you have to remember the extra step after it's finished installing instead of before the install. It's just unergonomic, for something that could be a flag (e.g. in emerge -1) and that I at least use fairly often.

Another problem with it being a two-step thing is that if you do it unconditionally in a script, it doesn't retain the flag from before the previous installation command, you need a third step, i.e. checking if the package was installed before. My use case for this was installing dependencies for a package build which should be able to be removed again afterward, while not affecting the subset that were already installed explicitly.

Now that I think about it, it's probably a good idea to always check if a package needs to be installed before installing it if you script it, though, because otherwise it might be unnecessarily reinstalled. Fair enough.

Are you maintaining a PPA for others?

Yeah, I maintain some software/config/meta packages for the computers at the uni I study at. Before, I'm pretty sure the packages were manually packaged with every update and I wanted to automate it a bit and also make clear how to get from the source tarballs to the final build.

On the other hand, in Debian, they rehost the upstream package and add the debian directory. This means that building Debian packages is mostly hermetic: you don’t need access to the network.

Ahh, the way it's structured makes a lot more sense knowing that. Coming from packaging stuff for Arch, Gentoo and NixOS, where the packaging process is essentially the same for all three, with you usually supplying source download URLs, I had absolutely no idea how debian/rules would allow me to do anything and felt like I was missing a big thing. I guess it really is just a Makefile that you run directly, and that makes sense if you already have the sources in your tree?

• Pinning, and relatedly that packages can include version constraints in their dependencies.

This, at least version constraints, is another one I'd consider essential tbh. The rest are great though, I agree.