docs(adr): close ADR-0006 v4 open question 2 as org (#20892)

[objectstack-fleet]

Fixes #20892
Clause-②: no

ADR-0006 v4 open question 2 (visibility default for CLI-created packages) keeps its original text and gains one dated resolution line, stated in business terms. This is the Tier H docs half of the ruling; the code half landed in 32d3b3c76e (PR #21099). Diff: docs/adr/0006-project-environment-split.v4.md, +1 / -0 against main. No code, no changeset, no generated file.

Revision: an approver asked that the ADR say only the business point (review 5376699282). The first version of the line carried the ruling's comment id, the commit, the file path and the director's letter; all of that is cut. The provenance lives here instead of in the ADR: ruling 5921191703 on #20900 (maintainer 「同意」, 2026-09-30).

The line added, verbatim:

Resolved (2026-09-30, #20892): org. A new package is visible to every environment of its owner organization by default, not private. Re-publishing without --visibility leaves an existing package's visibility unchanged, and listing on the public marketplace remains an explicit choice.

维护者速读(草稿)

改了什么

ADR-0006 v4「开放问题 2」(CLI 创建的包默认可见性)的原文一字未动,只在它下面加了一行带日期的结论:以 org 关闭。按审阅意见,这一行已收短成业务陈述:新建的包默认对所属组织的全部环境可见,不再是 private;重新发布时不带 --visibility,不改变包已有的可见性;上架公开市场仍须发布者显式选择。整个 PR 仍只有这 1 行新增,0 行删除。

为什么改

代码半边(PR #21099)已经把默认值改成 org,但 ADR 里这个问题仍停在旧的 private 立场、读起来像未决。不补这一行,以后读 ADR 的人(包括 AI)会把 private 当成现行决定,与代码和已发布文档对不上。裁决明确要求这一半走独立的 Tier H 文档 PR、不与代码 PR 混在一起,所以单独成篇;文字只留业务结论,裁决评论和提交号这类溯源留在本 PR 正文,不进 ADR。

风险与代价(含回滚)

只改一份 ADR 文档,不触运行时,不产生任何发布物;没有 changeset,没有生成物。代价有两点:ADR 里旧立场与新结论并存(旧文按裁决原样保留);这一行不再自带裁决编号和提交号,追溯要看本 PR 正文和 #20892。回滚:revert 本 PR 的提交,或直接删掉新增的那一行。

席位意见

你要做的

读上面那一行;没有异议就在本 PR 上点 Approve(审阅人要求收短的意见已按其原话处理)。

Acceptance notes

• Each business statement in the line was read against origin/main a11faeecb3 before it was written:
  • New packages default to org: packages/spec/src/marketplace/package.zod.ts:233 reads visibility: PackageVisibilitySchema.default('org'); what org reaches is :39 ("org = all envs in owner org").
  • A re-publish without the flag leaves visibility alone: both commands set the key only when the flag is passed (packages/cli/src/commands/package/publish.ts:536, packages/cli/src/commands/plugin/publish.ts:186), neither flag carries a default (package/publish.ts:333-342, plugin/publish.ts:71-77), and the flag help says "Omit it to leave an existing package's visibility unchanged" (package/publish.ts:339, plugin/publish.ts:74). The control-plane half, patching only when the body carries the key, is cloud's route as quoted at package/publish.ts:328-329; cloud was not read here (NOT MEASURED).
  • The public marketplace stays explicit: the flag options are private, org, marketplace with no default (package/publish.ts:341), and a marketplace listing needs the visibility "already stored, or set with --visibility marketplace" (package/publish.ts:368-369).
• The code already cites this entry as "ADR-0006 v4 open question 2" (the CLI publish test, the spec default test, and the spec default-changes row), so the entry's heading and number are unchanged on purpose.
• The original sentence says private is "consistent with sys_package.visibility default". It is kept verbatim per the ruling. The sys_package table is not defined in this repository's sources, so its stored default was not checked here (NOT MEASURED: cloud-side table default).
• Gates at head d8f4f77f6b: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 19 commands; all 19 ran with recorded exit codes (all 0) and --ran reports 19 derived, 19 run, 0 NOT-MEASURED. pnpm check:pm-governed-prose (not path-derived) also ran: exit 0. The previous head 737a7507d8 gave the same 19/19.
• skip-changeset is on the PR; nothing in this diff publishes.
• Written by session session_01VvcEokUG1tvVxkceYfR5XB (attribution kept in prose because a body edit does not keep a session-URL footer).

[objectstack-fleet]

维护者速读

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-01T08:11Z · 终稿 · 按 os-zhuang 的 review 5376699282 修订于 2026-10-01T08:36Z(席位已对照新 diff d8f4f77f 校正)}

改了什么

ADR-0006 v4 的「开放问题 2」(CLI 创建的包默认可见性)原文一字未动,只在它下面加了一行业务结论:默认 org,即新包默认对所属组织的所有环境可见,而不是 private;重新发布时不带 --visibility 不会改变已有包的可见性;上架公开市场仍须显式选择。整个 PR 只有这 1 行新增,0 行删除。按 review「只要写业务」,裁决评论号、commit、文件路径等溯源信息已从 ADR 移到 PR 正文。

为什么改

代码半边(PR #21099)已经把默认值改成 org,但 ADR 里这个问题仍停在旧的 private 立场,读起来像未决。不补这一行,以后读 ADR 的人(包括 AI)会把 private 当成现行决定。

风险与代价(含回滚)

只改一份 ADR 文档,不触运行时,不产生发布物;没有 changeset,没有生成物。回滚:revert 这一个提交。

席位意见

同意合入。新的一行三句话,席位逐句对照 origin/main 核过:spec 的默认值是 org、含义是「所属组织的所有环境」;os package publish / os plugin publish 只在传了 --visibility 时才发送该字段;marketplace 没有任何默认路径。新头 CI 全绿(余为预期跳过)。裁决原定的「结论行点名裁决与 spec 符号」按你方 review 改为只写业务,溯源仍可在 PR 正文与 #20892 上查到。

你要做的

读上面那一行;没有异议就在本 PR 上点 Approve,其余(转 ready、入队、合并后关卡)由席位完成。

---

Generated by Claude Code

[os-zhuang]

adr应该写得这么啰嗦吗？只要写业务就可以了。

[os-zhuang]

adr应该写得这么啰嗦吗？只要写业务就可以了。

[objectstack-fleet]

Addressed in d8f4f77f: the added ADR line is now business only. The default is org, re-publishing without --visibility keeps a package's visibility, and the public marketplace stays an explicit choice. The ruling id, commit and file path moved to the PR body. The updated quick-read is 5927457997. Re-requesting your review.

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-01T08:37Z · re: review 5376699282}

---

Generated by Claude Code

[objectstack-fleet]

Landing window: PR #21126 at d8f4f77f (Tier H, docs/adr/**), approved by an authorised approver; the seat lands it through the queue

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-01T09:51Z · follows the seat's review 5927822553 on #20892}

• The approval: os-zhuang's review 5377687276 is APPROVED on d8f4f77f, the current head. os-zhuang is in GOVERNED_APPROVERS (scripts/pm/check-governed-queue-guard.mjs:607, ['os-zhuang', 'hotlong']). The earlier changes-requested review 5376699282 on 737a7507 was answered by d8f4f77f and is superseded by this approval from the same reviewer.
• check-governed-merges --pr 21126: GOVERNED, landing tier H. One path, docs/adr/0006-project-environment-split.v4.md, +1 / −0, far under the 5000-line threshold. Tier H lands on an authorised APPROVED review, which is now on record.
• Pre-landing checks on d8f4f77f:
  • 31 check-run names, latest per name: 21 success, 10 skipped (path-filtered, opt-in, or Check Changeset under skip-changeset), 0 red.
  • A local git merge-tree against the current origin/main is clean.
• In this act: needs-user-decision is removed from the PR, the PR is readied, and auto-merge is armed.
• At the merge: Fixes #20892 closes the card (its code half landed in 32d3b3c76e), and the seat removes pm:dispatched.

---

Generated by Claude Code