todo: Stage 2 needs a CI job that type-checks the packed artifact - #1757

Deleting private.d.ts at prepack is invisible to every existing check:
npx tsc reads the source private.ts, npm pack never type-checks its
output, and the global installs in CI take the published CLI rather than
the artifact just built. Record what makes such a job real rather than
theatre — skipLibCheck off in the consumer, a consumer that imports the
affected module surfaces, a directory outside the repository — plus a
falsifiability task, and point the work at the packed-consumer fixture
fjs/ci/todo/f-mjs-package-support.md already scopes instead of a second
validation path.

Also repairs the Related section: the blocked @internal todo it linked
was deleted in Stage 1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

Removing the prepack deletion step leaves private.d.ts in the tarball,
where every reference to it resolves — that reddens the contents
assertion and leaves the consumer green, so it cannot serve as the
consumer's negative control. The consumer's control is the reverse: a
packed declaration depending on a private module the tarball does not
carry, which resolves in-repo and dangles once packed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

Stage 2 is pointed at this fixture, and its scope still called for a
mixed module.f.ts / module.f.mjs pair — a source form the completed
migration retired, so following it literally would reintroduce .f.ts.
Retarget it to the current model and name the sibling private.ts the
private-declaration check needs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

Two simplifications measured rather than assumed.

A negation in package.json's files ("!**/private.d.ts") drops exactly the
16 emitted private.d.ts from the tarball -- 675 packed files become 659
under npm pack --dry-run -- so Stage 2 needs no prepack deletion step, no
script, and no proof for a path predicate. It also leaves the working
tree alone, where a deletion would take declarations a following npx tsc
expects.

The consumer check moves to a job with no repository checkout, fed the
tarball as a CI artifact. That is stronger than a directory outside the
repository: with no repository on the runner there is no tsconfig.json to
inherit, no node_modules to resolve into, and no source file that could
stand in for an omitted declaration. Records that skipLibCheck must stay
at its false default, that the job should be a required check, and the
measurements showing the exclusion is safe today and the check
falsifiable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

A consumer that imports the surfaces known to carry private types is only as
current as its import list. Measured on an installed tarball: with a dangling
`./private.js` import injected into `fjs/emergent_testing` — a module with no
`private.ts` today, standing in for a future one — a consumer importing all 16
of today's private-carrying surfaces exits 0, while type-checking all 377
packed declarations exits 2 with TS2307. The job would have shipped unable to
see the case it exists to catch.

So the second job now enumerates the packed `.d.ts` / `.d.mts` from the
installed artifact and passes them all to `tsc` as root files. Two further
details recorded from doing it: `skipLibCheck` must stay false even with
declarations as root files, and the tarball must be installed as a dependency
rather than unpacked into `node_modules` by hand, since a later `npm install`
prunes it and leaves an empty file list. The type-check's negative control now
goes in a module with no `private.ts`, so it proves exhaustiveness too.

Also retires the fixture task's last two `.f.ts` requirements. The `.ts` ->
`.mjs` runtime direction no longer exists to test: all 225 imports in authored
`.ts` are `import type`, and `types.js` is not emitted, so the form is doubly
excluded. The reject-runtime-import rule got wider rather than lapsing — the
authored `.ts` that remain are exactly the type-level companions — and is
restated that way, with the matching acceptance criterion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

With no checkout there is no lockfile, so a bare `npm install typescript`
resolves whatever the registry publishes that day — the required check could
redden, or quietly change module-resolution behaviour, with no change to this
repository. That is the same wrong-reason failure the `needs` edge avoids.

The version is readable without a checkout: `npm pack` keeps
`devDependencies` in the packed `package.json`, verified on the tarball built
here, which carries `"typescript": "=7.0.2"` — the repository's exact pin and
the version the measurements in this document were taken with. Records the
trade too: determinism over consumer-compiler coverage, with a second pinned
version as the way to widen it rather than letting the first float.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

todo/README.md says a higher-level todo/ must not duplicate tasks belonging in
a child todo/, and this had started to: fjs/ci/todo/ci-integration-tests.md
already owns "run npm pack, upload as a GitHub Actions artifact" and "download
artifact, install", and f-mjs-package-support.md already owns the clean
packed-package consumer. Two owners for one task is how contradictory
requirements appear when only one of them is updated.

Split along ownership rather than by deleting:

- ci-integration-tests.md takes the job-ordering edge and the jobSchema / Job /
  proof extension it needs. That issue's own two-stage split needs the same
  edge, so owning it there stops whichever consumer lands first from
  implementing another issue's task.
- f-mjs-package-support.md takes the checkout-less type-check job and the four
  details that decide whether it can fail — exhaustive file set, skipLibCheck
  false, install as a dependency, pinned compiler — each with its reasoning.
- separate-private-types.md keeps what is actually its own: the requirement, the
  conditions it needs that job to satisfy, and the measurements that justify
  them. Nothing was dropped; the conditions are stated as conditions instead of
  as generator tasks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

The review's closing note was right that the three measurements so far inject
the failure into an already-packed declaration: they show the check can fail,
not that this repository's workflow could produce the artifact that fails it.

It can. The organic control is a source-level violation of the
public-declaration-closure rule — exporting a binding whose signature names a
private type. Run end to end with `export const divide` in
fjs/types/bigfloat/module.f.mjs: ordinary prepack emits a real
`import type { _BigFloatWithRemainder } from './private.ts'` rather than the
inlined structural type; npm pack with the files negation ships 0 private.d.ts;
installing that tarball and type-checking all 377 declarations exits 2 with
TS2307 on that line.

Two consequences recorded. The check's real target is a closure-rule violation
reaching an exported signature — today none does, because every binding
annotated with a private type is module-private, which is why the tree measures
clean. And the fixture's control should be this source-level one: it exercises
emit, packing and consumption together, so it also fails if a future TypeScript
starts inlining the reference and the design's premise quietly stops holding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

f-mjs-package-support.md said "Deleting generated private.d.ts before packaging
is the second stage of separate-private-types.md" — the superseded design. Now
that the owning issue is where an implementer starts, that contradiction is the
exact failure the ownership split was meant to prevent, one commit later.

It now prescribes the files negation, says prepack is unchanged and the working
tree untouched, says explicitly not to reintroduce a deletion step, and notes
that once it lands private.d.ts leaves the package-private set entirely, so the
leak tolerance narrows to the _-prefixed names in types.d.ts.

Also corrects that file's Related entry for microsoft/TypeScript#46407, still
listed as an upstream blocker: Stage 1 removed every file-scope JSDoc typedef,
so there is nothing left for stripInternal to strip.

Swept the repository for other copies: fjs/fsc/README.md describes the outcome
("removing shipped private declaration artifacts from the package") rather than
a mechanism, so it needs no change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

The retargeted fixture named module.f.mjs with types.ts and private.ts but no
proof.f.mjs. fjs/AGENTS.md §1.2 requires 100% proof coverage for every authored
.f.mjs, so implementing it literally would fail npm run cov and put the
repository in violation of its own rule while demonstrating package support.

Adding the proof surfaced a second constraint the task did not state. The
fixture carries a private.ts for the packed-declaration check, so it is tempting
to have it export a private-typed binding — but that is exactly the failure the
check reports, and it would redden the check permanently. The fixture must be a
conforming module, private type out of every exported signature, like the rest
of the tree; the falsifiability control is a deliberate temporary violation
applied while verifying the check can fail, which is how it was measured end to
end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

f55f58f put the temporary violation in the package fixture. But the fixture is
precisely the module a hand-written import list would name, so a violation
there fails under a fixed list too — it proves the check reports a dangling
reference and says nothing about whether the file set was enumerated. That also
contradicted the parent's requirement to place the control in a module with no
private surface.

Both documents now keep the two questions apart:

- Can it fail? Any module with a private.ts; measured in fjs/types/bigfloat.
- Is it exhaustive? A module with no private.ts today — which means temporarily
  giving one to a module that has none — and specifically not the fixture.
  Measured in fjs/emergent_testing.

This matches how they were actually measured; the previous wording implied one
control could answer both, which is the mistake it would have taught an
implementer to make.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

Two points from review.

The organic control's most useful property was implicit: with the violation in
place, npx tsc exits 0 and npm pack succeeds. Verified here directly rather
than taken from the review. That is this section's opening claim — the
exclusion is invisible to every check the repository has — demonstrated instead
of argued: the artifact is already broken while nothing in the repository can
say so. It is the whole case for a consumer-side job, so it belongs in the
measurements.

a201e03 also narrowed the leak-tolerance contract to "the _-prefixed names in
types.d.ts". Coherent inside its own enumeration but narrower than
separate-private-types.md and fsc/README.md, which also cover exported _
constants emitted into module.d.mts. Now says both, and points at fsc/README.md
for the contract itself so the three cannot drift apart again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

The merge queue dequeued this for MERGE_CONFLICT. One conflict, in the Related
section: both sides were additive, so both survive — my two ownership links,
and main's note recording that jsdoc-typedef-strip-internal is retired rather
than merely unlinked.

Main's heading normalization and todo renames (#1756) auto-merged; all links in
the three touched files still resolve and tsc is clean.

Re-measured everything the documents assert, since main moved a lot. The
invariants hold exactly: 16 private.ts, fjs/emergent_testing still has none
(so it remains a valid stand-in for a future module), 0 runtime imports among
the 226 in authored .ts, and bigfloat's divide is still unexported with
_BigFloatWithRemainder still private.

The absolute counts drifted for the third time, though: 675/659 is now 677/661
and 377 declarations is 378. The numbers were never the claim — "exactly 16
disappear, and they are exactly the private.d.ts" is — so the prose now says
that, with the totals marked as a re-measured snapshot. Future drift makes the
snapshot old rather than making the document wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n