Function default_approval_store 

pub fn default_approval_store(cwd: &Path) -> PathBuf

BP-10: the DEFAULT per-project approval store for cwd — $SUPERCODE_HOME/approvals/<project_tag>.json. Transcribes crate::checkpoint’s own default_shadow_root method exactly (same $SUPERCODE_HOME resolver, same crate::checkpoint::project_tag), so a remembered approval sits beside the session’s other per-project records instead of inventing a third layout.

Per PROJECT, not per session: cc§4 records “don’t ask again” per project+command and cx saves prefix rules the same way — a grant a user gave once should not evaporate because they started a new session in the same repo. It is still scoped: another project never sees it.