v19: audit and enforce root export boundary

[flyingrobots]

Part of #712.

Problem

The current root export surface exposes implementation vocabulary too early. v19 needs a mechanically enforced package boundary so graph-shaped, patch-shaped, worldline, strand, braid, optic, witness, and hologram symbols do not leak from root.

Scope

• Inventory all root and browser entrypoint exports.
• Classify each export as root, storage, advanced, diagnostics, legacy, or internal.
• Add an automated root export audit that rejects forbidden public names.
• Keep type-only public nouns separate from value exports.

Acceptance

• The audit fails if root exports graph-shaped substrate names.
• The audit covers Node and browser entrypoints.
• Allowed root value exports are limited to the v19 first-use API.
• Existing consumers can still reach compatibility symbols through planned subpaths, not root.

Suggested RED/GREEN

RED: add a boundary fixture that detects an existing forbidden root export.

GREEN: move or stop exporting that symbol from root and update the audit allowlist.

[coderabbitai]

🔗 Related PRs

#58 - release: v12.4.0 — standalone lane batch [merged]
#77 - Cycle 0008: Stream architecture + P5 codec dissolution [merged]
#82 - refactor: split StrandService into explicit collaborators [merged]
#654 - Clean up versioned runtime names [closed]
#660 - Replace static assertion batch 4 [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[flyingrobots]

Implemented the first boundary-ratchet slice in 41cf0f34.

What changed:

• Added test/unit/scripts/v19-public-api-boundary.test.ts.
• The test imports the package root and browser entrypoint and rejects any forbidden root/browser export that is not explicitly classified for migration.
• Current v18 leaks are deliberately recorded with planned destinations: storage, advanced, diagnostics, or legacy.
• This does not yet remove symbols from root. It prevents new unclassified graph/worldline/patch/optic/hologram-style leaks while v19: move storage and substrate compatibility to explicit subpaths #720 and the later facade slices move symbols out.

RED/GREEN:

• RED: the new test failed with 89 unclassified package-root leaks and 4 unclassified browser leaks when the migration ledger was empty.
• GREEN: populated the v19 migration ledger and the test passed.

Validation:

npx vitest run test/unit/scripts/v19-public-api-boundary.test.ts
npx eslint test/unit/scripts/v19-public-api-boundary.test.ts
npm run typecheck:test
npm run typecheck:policy
git diff --check -- test/unit/scripts/v19-public-api-boundary.test.ts

Next slice should be #720: add the explicit storage, advanced, diagnostics, and legacy subpaths so symbols have a real destination before root pruning.