pub fn enforce_writable(candidate: &Path) -> Result<(), String>Expand description
Default-deny write guard for the read-only tier (#475): returns an error if
candidate is inside a configured read-only root, Ok(()) otherwise.
This is the single read-only-aware choke point. Every filesystem write that
can target a caller-supplied path routes through it (the atomic writers in
ctx_edit/edit_apply, the handoff/session export bundle writers, the
in-place memory-compaction writer, and the refactor IDE pre-write gate), so
a “read-only” root cannot be written through any tool. Reads are unaffected.