The engine package published public, and two plan documents still specify private

[The-Running-Dev]

v0.4.0 published @the-running-dev/game-engine to GitHub Packages on 2026-08-02 with visibility: public, verified against the packages API. Two plan documents still specify otherwise, each carrying a pointer to the design/90-decisions.md entry this issue tracks: plans/39 Decision 4 ("a private GitHub Packages npm package") and plans/40's non-goals ("No public npm publication. Private GitHub Packages only").

Checking why turned up a larger stale premise: both SubZeroDev.GameEngine and SubZeroDev.SunTrap are public repositories, which TODO.md described as private until corrected alongside this entry.

Two coherent resolutions, differing in cost:

• Accept public and correct the documents — a private package fronting a public repository protects nothing and adds an authentication step to Sun Trap's CI for no benefit.
• Make it private through the package's own settings (no REST API for visibility) and grant Sun Trap read access — which reopens W41's ledger.

Done when

• The visibility question is decided — accept public and correct plans/39/plans/40, or make the package private and grant Sun Trap read access — and the decision is recorded in design/90-decisions.md.

---

Agent instructions

Not a /slice unit — this is a design-doc register item, a decision to make and record, not a numbered work unit.

• Authority: design/90-decisions.md §2, "The engine package published public, and the plans specify private" @ eabb620d
• Stop if: the resolution requires reopening W41's package-boundary work — that is /contract's call, not this issue's.