[TheGreatAxios]

Summary

• disposeAll drops its unused reason parameter; interface and callers updated
• Collapses the dead forceRefresh branch in the worktree-roots cache refresh
• path-restriction.ts imports the exported realpathOr instead of duplicating it
• Removes the evaluateApprovals pass-through; tests call approvalCoversSubject directly
• assertShellCwdUsable collapses its redundant catch re-check into one message path
• Merges isRequestCoveredByApprovals into isRequestCoveredByGrant (single approval or the live approvals list)

Verification

Each item verified inert before changing:

1. disposeAll(reason) — body ended void reason;. Dropped the parameter and updated the interface plus all callers (subagent/run.ts ×3, agent/tools.ts, and the co-located tests).
2. worktree-roots.ts — forceRefresh alone did nothing (refresh only ran when due); collapsed to if (due). The parameter is retained (_forceRefresh) because callers still pass true; behavior is unchanged.
3. path-restriction.ts — local realpathOr was identical to the exported one in worktree-roots.ts; imported it and deleted the local copy. The third copy in session/project-key.ts is untouched (out of scope).
4. authz-grants.ts — evaluateApprovals was a one-line pass-through to approvalCoversSubject; production calls approvalCoversSubject directly and only tests used the wrapper. Dropped it and updated the test call sites.
5. persistent-shell-cwd.ts — the catch re-checked err.message.startsWith("Shell working directory"), which exactly matches the missingShellCwdMessage constant prefix; collapsed to one check that always throws the same message.
6. gate.ts — isRequestCoveredByGrant wrapped isRequestCoveredByApprovals(request, [approval], …); merged into one function accepting a single approval or the live approvals list (mintGrant's onGrant call site updated). Per-segment every(some(...)) coverage semantics preserved.

• Co-located suites (background-shell, worktree-roots, path-restriction, permission, grant-scope, persistent-shell-cwd, gate, tool-aliases, run-persist-close, shell-guard-plugin): 382 pass, 0 fail
• bun run typecheck passes
• oxlint and oxfmt pass on the changed files

Fixes CL-10521

[linear-code]

CL-10521

[corbits-triage]

No changes needed from you. A maintainer will review this pull request.