fix(reference): preserve source scope and loader authority

Share parser-owned package and runtime facts across dependency consumers.
Preserve uncertain loader requests and explicit wrapper bindings without
inventing unbound require authority in known modules. Cover selected source
grammar through the public MCP boundary and retain ambient/type dependencies.

Open each selected directory before loading its scoped policy, retaining
partial directory failures and cleanup ownership. Preserve explicit caller
negation precedence and source diagnostics across inventory projections.

Clarify how version comparison retains container provenance without claiming
semantic drift. Use independent unknown source inputs to keep candidate-limit
fixtures meaningful as conditional branch evaluation becomes more precise.

Fixes #6891
Fixes #6882
Fixes #6883
Fixes #6859

src/reference/ReferenceSourceReaderEntries.ts

@@ -76,11 +76,6 @@ export const traverseDirectory = async (
     );
     return { ok: true, value: undefined };
   }
-  const policy = await state.beforeDirectory?.(
-    pathFromRoot(state.root, current.path),
-  );
-  if (policy !== undefined && !policy.ok) return policy;
-  if (isAborted(state.signal)) return err(cancelled());
   const directories: PendingDirectory[] = [];
   let readFailure: FilesystemFailureDetail | undefined;
   let unrepresentableNameCount = 0;
@@ -101,7 +96,15 @@ export const traverseDirectory = async (
     let result: ReferenceSourceResult<undefined> = ok(undefined);
     let cleanup: ArtifactCleanupAttempt;
     try {
-      for (;;) {
+      // A directory that cannot be opened retains its ordinary partial-entry
+      // failure; only an opened directory needs policy before enumeration.
+      result = isAborted(state.signal)
+        ? err(cancelled())
+        : ((await state.beforeDirectory?.(
+            pathFromRoot(state.root, current.path),
+          )) ?? ok(undefined));
+      if (result.ok && isAborted(state.signal)) result = err(cancelled());
+      while (result.ok) {
         let child: Dirent | null;
         try {
           child = await handle.read();
@@ -123,7 +126,6 @@ export const traverseDirectory = async (
           continue;
         }
         result = await processEntry(state, current, decoded.name, directories);
-        if (!result.ok) break;
       }
     } finally {
       cleanup = await state.resources.release({