docs: the packaging trigger's intended shape at M6

ROADMAP.md

@@ -125,3 +125,4 @@ After 012, multiple branches are independent. If running more than one coding ag
 | 2026-09-20 | Four slices added under the accepted 2026-09-20 plan: 002 (supply chain, early: SBOM, provenance, TLS floor; counted in M9), 003 (FIPS build leg from source; counted in M2 because it runs 024's FIPS properties), 025 (encryption at rest and the key-custody seam) and 026 (store-and-forward receipts; blocked on the external plane's answer). Re-derived this date: `find slices -name SLICE.md | wc -l` → **40**. |
 | 2026-09-22 | Slice 062 amended under the owner's decision: the production profile is an OAuth client and resource server against an external authorization server, the embedded authorization server is the non-default personal profile refused under an external authority adapter, and Enterprise Managed Authorization (ID-JAG redemption at Trinity's own server) leaves the slice as a deferral with a lift condition (slice 062 NOTES, "Amendment"). AC3 and AC6 removed; the row's title follows. |
 | 2026-09-22 | The gate gained a release check (`scripts/prod_check.sh`: prod compile, headless release assemble, runtime config eval) and `package.yml` gained a `branches:` trigger beside its tags one. Both follow slice 062's F5: a plug's `init/1` is escaped at compile time under prod, so a closure there broke the release build while `mix gate`, which runs in `:test`, stayed green on every leg, and the tags-only packaging trigger meant the first packaging run of the slice was the one after approval. Measured before adopting: the release check costs 52 s cold and 2 s warm, and it is red on the original defect. |
+| 2026-09-22 | Recorded with the change above, so it is not rediscovered: the `branches:` trigger on `package.yml` is the right shape **now**, while packaging changes are rare and a slice's release correctness is proven by `scripts/prod_check.sh`. When **M6** makes signed release artifacts the deliverable (090 to 101), the intended replacement is a scheduled `package` run on `main` (a cron trigger) instead of a per-branch one: it keeps slice branches quiet, bounds a packaging regression to a day, and packages the tree that ships rather than the branch that proposed it. Owner: the product owner. Lift condition a stranger can check: the first slice of M6 that produces a signed artifact. Measured 2026-09-22 for the comparison: a three-OS `package` run is about 16 minutes wall clock, `scripts/prod_check.sh` 52 s cold and 2 s warm, and CI minutes are free because the repository is public. |