[Helweg]

Change

Replacement for #471, integrated onto current main (d6f26f69773f0fbfee4caa8595aa4977154508cb) rather than modifying the Dependabot branch.

• Upgrade Chokidar to 6.0.0 and readdirp to 5.1.1.
• Breaking: raise the published Node.js floor for both package identities from 22.13.0 to 22.22.0, matching Chokidar 6's engine requirement. Development range: ^22.22.0 || ^24.11.0 || >=26.0.0.
• Recover readable, traversable, policy-selected directory/project-root EPERM/EACCES registrations through the existing one-shot polling handoff; include empty directories that can later gain selected source files.
• Preserve ignored/excluded/restricted/protected-index/unreadable/external-config boundaries and native source-watch ownership.
• Exercise actual Chokidar 6 per-directory resources in watcher/Indexer behavioral regressions, including initial and post-ready faults, new files, successive indexed-definition replacement and stale-owner errors.
• Align CI's exact minimum runtime, identity staging checks, README/source prerequisites and runtime documentation. Preserve current-main security/history changes and package version 0.38.2; no release or version bump.

Verification

Private official checksum-verified Node v22.22.0, macOS ARM64; private dependency install, npm caches and Cargo target.

• Sequential npm run build && npm run typecheck && npm run lint && npm run test:run passed once on this current-main candidate.
• Full suite: 149 files passed / 1 skipped; 2961 tests passed / 6 skipped.
• Frozen built CLI smoke passed, including ESM/CJS help, MCP initialization/idle/resume and shutdown.
• Actual source FileWatcher + Indexer recovered a controlled project-root EPERM through real polling; both an existing-file update and newly added file became searchable.
• Both independently packed identities passed engine-strict installs, standalone ESM/CJS declarations and root exports, separate SDK type interoperability, all CLI aliases, MCP tools and indexing estimates.
• Scoped PATH and a narrowly scoped observer recorded 83 runtime observations across 82 Node PIDs, including 6 npm invocations, all using exact v22.22.0 with engine-strict. All 27 successful candidate-addon loads matched the pre-execution native hash; all recorded proof PIDs had exited afterward.
• Installs deliberately use --ignore-scripts: lifecycle-hook execution is not claimed. Controlled backend faults are not OS ACL/chmod denial, and local macOS ARM64 proof is not cross-platform CI.

The prior candidate and all old failed/r2/r3 proof receipts remain untouched. This is a new current-main acceptance, not a relabeling of those results. No source edits to sibling checkouts, assertion weakening, frozen-harness modification, bot-branch mutation, merge, tag or npm publication.