diff --git a/docs/linuxcnc-source-policy.md b/docs/linuxcnc-source-policy.md
index e58bc15..14d1a53 100644
--- a/docs/linuxcnc-source-policy.md
+++ b/docs/linuxcnc-source-policy.md
@@ -18,8 +18,8 @@ Hard rules:
   add browser filesystem paths that bypass OPFS.
 - Browser app and wasm bridge code must not persist CNC programs, LinuxCNC
   parameter files, or mirrored workspace files through non-OPFS browser storage
-  APIs such as Local Storage, IndexedDB, File Picker writes, WebKit filesystem
-  APIs, or FileReader-backed import paths.
+  APIs such as Local Storage, IndexedDB, File Picker reads/writes, Directory
+  Picker access, WebKit filesystem APIs, or FileReader-backed import paths.
 
 Allowed project code:
 
diff --git a/test-all-native.sh b/test-all-native.sh
index 8aae54f..4a73e3c 100755
--- a/test-all-native.sh
+++ b/test-all-native.sh
@@ -734,7 +734,11 @@ grep -F 'signature must include the blocker wrapper script, analyzer script' doc
 grep -F 'sha256sum test-linuxcnc-wasm-blockers.sh' test-linuxcnc-wasm-blockers.sh >/dev/null
 grep -F 'browser app/wasm code must not add filesystem persistence outside OPFS' test-native.sh >/dev/null
 grep -F 'browser app/wasm code must not add filesystem persistence outside OPFS' test-linuxcnc-wasm-cmake-safe-probe.sh >/dev/null
+grep -F 'showDirectoryPicker' test-native.sh >/dev/null
+grep -F 'showDirectoryPicker' test-linuxcnc-wasm-cmake-safe-probe.sh >/dev/null
 grep -F 'reject browser app/wasm storage APIs that could bypass it' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'Directory' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'Picker access' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'Persistent native, source-link, source-syntax, and wasm-safe CMake probe' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'copies and byte-compares `cnc_sim.js` and `cnc_sim.wasm` under' docs/linuxcnc-source-policy.md >/dev/null
 grep -F '`CNC_SIM_BUILD_JOBS` must be a positive integer and defaults to `8`.' docs/linuxcnc-source-policy.md >/dev/null
diff --git a/test-linuxcnc-wasm-cmake-safe-probe.sh b/test-linuxcnc-wasm-cmake-safe-probe.sh
index 90e969e..a753c3b 100755
--- a/test-linuxcnc-wasm-cmake-safe-probe.sh
+++ b/test-linuxcnc-wasm-cmake-safe-probe.sh
@@ -763,7 +763,7 @@ grep -F -- './test-web-wasm-node-smoke.sh' build-wasm.sh >/dev/null
 grep -F -- './test-web-wasm-browser-smoke.sh' build-wasm.sh >/dev/null
 grep -F 'const opfsOptions = options.opfs ?? (isOpfsAvailable() ? {} : false)' web/src/wasm-core.js >/dev/null
 grep -F 'OPFS cannot be disabled in browser contexts with OPFS support' web/src/wasm-core.js >/dev/null
-if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|webkitRequestFileSystem|FileReader' web/src; then
+if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|showDirectoryPicker|webkitRequestFileSystem|FileReader' web/src; then
     echo "browser app/wasm code must not add filesystem persistence outside OPFS" >&2
     exit 1
 fi
diff --git a/test-native.sh b/test-native.sh
index 8f040a1..b159c34 100755
--- a/test-native.sh
+++ b/test-native.sh
@@ -389,7 +389,7 @@ grep -F '"parameters/rs274ngc.var"' web/test-browser-wasm-smoke-opfs-parameter-s
 grep -F '"parameters/rs274ngc.var.bak"' web/test-browser-wasm-smoke-opfs-parameter-sections.js >/dev/null
 grep -F 'const opfsOptions = options.opfs ?? (isOpfsAvailable() ? {} : false)' web/src/wasm-core.js >/dev/null
 grep -F 'OPFS cannot be disabled in browser contexts with OPFS support' web/src/wasm-core.js >/dev/null
-if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|webkitRequestFileSystem|FileReader' web/src; then
+if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|showDirectoryPicker|webkitRequestFileSystem|FileReader' web/src; then
     echo "browser app/wasm code must not add filesystem persistence outside OPFS" >&2
     exit 1
 fi