There's a quite a bunch of stuff now going on before we get to call `_endChange()`... and due to the asynchrony it can't all be safeguarded with a try/catch.  I wonder if we should consider having a longish (10sec? 30sec?) timeout after which we log an error and forcibly unblock watcher notifications.  (Not in this PR, but maybe as a follow-up bug).  Otherwise, an exception in e.g. `_handleDirectoryChange()` would leave watchers effectively hosed for the rest of the session -- _without_ the cache-clearing safeguards we do for impl-level watcher failure, no less.