Default‑public vs opt‑in public: trade‑off for accidental exposure in Titanium SDK modules

The goal is to decide whether the Titanium SDK should change the default visibility of module methods from public to private, requiring an explicit public attribute to expose them.

This change would reduce accidental exposure of internal helpers, but it must preserve backward compatibility for existing modules, address the current lack of compile‑time linting for missing attributes, and consider the uncertain runtime enforcement of the private flag.

Should the SDK adopt a private‑by‑default model with an opt‑in public annotation?
What migration strategy would allow existing modules to continue working without modification?
How would the runtime enforcement of the private flag need to behave to make the new default effective?