Add public facade boundary checks

docs/policy/architecture.md

@@ -129,8 +129,10 @@ consumer contract requires a public package.
 Each package must have one cohesive responsibility and a clear dependency
 direction. Internal packages must not expose their types merely to simplify
 wiring, and the public facade must not leak internal representations through
-exported signatures. New public packages require a durable consumer need that
-cannot be served cleanly by the root facade.
+exported signatures. Production packages under `internal/` must not import the
+module root; the root facade may depend on internal implementation packages.
+New public packages require a durable consumer need that cannot be served
+cleanly by the root facade.
 
 The [internal component overview](../internal/overview.md) must be updated as
 packages are implemented or their responsibilities change.

docs/roadmap/implementation.md

@@ -273,6 +273,17 @@ Acceptance: the completed refactor passes the checks; representative violations
 fail for the intended reason, and ordinary private implementation changes remain
 possible. No ConfigKit checkout or other sibling is needed.
 
+### Completion
+
+- [x] Added a compiled-export-data checker for the root facade's reachable
+  public type surface, including aliases, promoted methods, and generic
+  constraints.
+- [x] Added package-metadata validation that production internal packages do
+  not import the root facade.
+- [x] Added compact in-memory fixtures for permitted private state and sealed
+  options, and for direct, nested, field, alias, and promoted-method leaks.
+- [x] Recorded the dependency-direction rule in the architecture policy.
+
 ## Stage 6: Complete Compatibility And Documentation Review
 
 Purpose: verify the whole refactor, not just successful compilation of each move.