Function is_read_only_path 

pub fn is_read_only_path(candidate: &Path) -> bool

True when candidate resolves to a location inside a configured read-only root. The candidate’s nearest existing ancestor is canonicalized (so a not-yet-existing file inherits the read-only status of the directory it would be created in — closing the “create a new file in a read-only repo” hole) and matched against the (symlink-resolved) read-only roots.

A false return is only authoritative when the roots list is empty or the path provably sits outside every root; an unresolvable candidate (no existing ancestor) is treated as not read-only here and is rejected later by the ordinary write/jail error, never silently written.