Function evaluate_path_safe_roots 

pub fn evaluate_path_safe_roots(
    rules: &RuleSet,
    kind: PathKind,
    roots: &[PathBuf],
    raw_path: &str,
    default: Decision,
) -> Decision

BP-10 (catalog row “Additional working directories”): evaluate_path_safe over EVERY granted root — cwd plus each core.additional_dirs/ --add-dir entry — folded to the strictest Decision any of them reaches.

Why a fold rather than “pick the containing root”: a root-relative protected-path floor (write(.git/**), from protected_path_deny_rules) is written relative to A workspace root, and once an extra root is granted there is more than one. Evaluating against only cwd — what this crate did before BP-10 — meant a write to <extra_root>/.git/config matched NO root-relative pattern at all and fell through to default, i.e. the grant silently also removed the floor inside the granted directory. Folding every root keeps the floor on all of them; and because evaluate_path_subject_safe already treats “resolves entirely outside this root” as a non-match (never an over-block), a root a path has nothing to do with contributes nothing.

roots empty is impossible in practice (callers pass crate::tools::ToolContext::write_roots-shaped lists that always start with cwd); an empty slice returns default unchanged.