package: stop shipping generated private declarations - #1771

Stage 2 of the private-types design, and the last of it. A `!**/private.d.ts`
negation in `package.json`'s `files` excludes the generated declarations;
`prepack` is unchanged and the working tree is left alone, so a contributor who
runs `npm pack` does not silently lose declarations a following `npx tsc`
expects.

The invariant the design asked for, measured rather than assumed: 679 packed
files become 663, the 16 that disappear are all `private.d.ts`, and nothing
else moves in either direction.

The packed-declaration type-check merged in #1767 cannot guard this on its own.
With `private.d.ts` shipped, every reference to it resolves and that job is
green — so a dropped negation is invisible to it. The Node job therefore also
asserts what was packed, from `npm pack --json`, npm's own account of the
tarball. The two fail on opposite inputs:

- negation dropped, private dependency present → contents assertion red,
  type-check green;
- negation in place, private dependency present → type-check red (TS2307),
  contents assertion green.

Both measured end to end before this landed. The second used
`fjs/emergent_testing`, a module with no `private.ts` and not the package
fixture, because a violation anywhere a hand-written import list would already
look proves the check can fail but says nothing about whether the file set was
enumerated.

`node` for the assertion rather than a text search: the paths arrive as JSON and
are compared as whole filenames, so nothing can mistake a path containing the
name for one ending in it. AGENTS.md §6 asks for a tool that parses what it
checks; here that is the runtime this repository is written in, already running
in every job.

`fjs/fsc/README.md` no longer tolerates a shipped `private.d.ts`, since none
ships. The permanent half of the contract stays: `_` names still reach the
declarations that do ship and are still not API.

`fjs/todo/separate-private-types.md` is deleted, as it specified. Its thirteen
inbound references across seven documents are retargeted to where the rules now
live — root `AGENTS.md`, `fjs/AGENTS.md` §3.2, and `fjs/fsc/README.md` — rather
than left dangling, and the measurements two CI todos cited from it are written
into those todos.

3480/3480, coverage 100%, tsc clean, ci-update round-trips.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

One conflict, resolved by taking main's side: #1769 deleted
`fjs/todo/module-tag-restore.md`, which this branch had edited only to retarget
a link at the design document Stage 2 removes. With the file gone there is no
link left to dangle, so the edit had nothing left to do.

That PR also settled the paragraph in `fjs/AGENTS.md` this branch touches.
The two agree: `private.ts` keeps `@module` because its prose is for
contributors reading the sources, and its generated declarations are not
packaged — which this branch turns from a plan into a fact.

3480/3480, coverage 100%, tsc clean, ci-update round-trips.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

It guarded a dropped `files` negation, which the packed-declaration type-check
cannot see: with `private.d.ts` shipped, every reference to it resolves and that
job is green. But the consequence it prevented is declaration noise in the
tarball — the state shipped until this branch, and one the `_` contract already
tolerates — not a broken package. The check that catches breakage is the
type-check, and it stays.

Against that, the cost was real and kept arriving. It produced three defects in
three commits: it enforced an exclusion the branch had lost, so nothing could
pass; its predicate was a suffix test over the whole path, which also flags
`notprivate.d.ts` — a name the negation deliberately keeps, so the job would
have failed on a legal file and banned a filename nothing documents; and its own
doc comment could not contain `**/` without ending the block.

Root AGENTS.md §6: "Leaving the check undone is the better trade against that
complexity. A rule no available tool can express stays written down and
unenforced. That is honest, and cheaper than machinery whose failures are
silent." The negation is one line in `package.json` and losing it is a visible
diff in review.

`fjs/ci/**` and `.gitignore` are byte-identical to main again; what remains on
this branch is the negation, the documentation, and the retired design.
`fjs/ci/todo/f-mjs-package-support.md` records that a dropped negation is now
unguarded, and why that was accepted.

3479/3479, coverage 100%, tsc clean, ci-update round-trips. Package still packs
663 files with no `private.d.ts`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

`fjs/fsc/README.md` claimed CI asserts both halves of the exclusion — that the
tarball carries no `private.d.ts` and that what it does carry type-checks. The
first half stopped being true when the packed-listing assertion was removed one
commit earlier, and the sentence was left behind.

It now says what holds: the type-check covers the consequence, and losing the
negation is not caught, because the private declarations come back and every
reference to them resolves. The reasoning for accepting that gap is one link
away rather than restated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

`changelog/README.md` asks for about three wrapped lines, ~250 characters. The
entry was five lines and 370, and the excess was rationale — why the files were
private, and what CI checks about the package — which the same guidance sends to
the pull request description or the relevant README. Both are already there.

What is left is the user-visible change: the files are gone, and depending on
them was never supported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

`changelog/README.md` asks for the `Topic: short description` form, and every
other entry in `unreleased/` carries one — `rtti`, `effects`, `web`,
`emergent_testing`, `fjs/fsc`. This one started with the change itself, so a
reader scanning a release's notes had nothing to sort it by.

`package`, matching what the change is about: what the published npm package
contains. 214 characters over three lines, still inside the documented limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n

`todo/README.md`: "Issue headings should be short and direct — describe the
action or the thing, not the full context", and its template is a plain
`## Title`. This heading carried a repeat of the filename slug followed by the
whole symptom.

`Generated declarations shadow their sources` is the thing. The symptom it
replaced — a local `npx tsc` passing on an error CI reports — is the first
paragraph of `### Problem`, where the context belongs.

Sibling files under `fjs/*/todo/` do use a `slug. description` heading, which is
what this one was modelled on; the documented rule is the plain title, so the
habit is not evidence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqeS5t2ZKkSu3chRPMXR7n