v0.328.0 (unreleased): live finding on 9201 (rc.4) — roots resolved through their nearest existing ancestor; no symlink resolve for the placeholder check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/privpolicy/privpolicy.go

@@ -548,8 +548,9 @@ func (c *checker) underRoot(p string) bool {
 		return false
 	}
 	for _, r := range c.roots {
-		rr, rerr := c.p.Resolve(r)
-		if rerr == nil && within(rp, rr) {
+		// A root is resolved the same way (nearest existing ancestor): a drive folder not created yet must not make
+		// every bind under it "outside" (found live on 9201 with rc.4: every not-installed app refused).
+		if rr, ok := c.resolveExisting(r); ok && within(rp, rr) {
 			return true
 		}
 	}