docs(specify): adopt R-017..R-020, D-215..D-237, REQ-099..REQ-118 for v0.11

SPECIFY stage: adopt 5 research docs into authoritative ciagent files.
- PRD_v0.11.md: new file extending R-series 16->20 (R-017 ingress hybrid, R-018/R-019/R-020 drift detection)
- PROJECT.md: append D-215..D-237 (23 new decisions, no collisions with D-001..D-206)
- REQUIREMENTS.md: append REQ-099..REQ-118 (20 net-new; ingress 099-102, drift 103-113, CLI 114-118)
- ROADMAP.md: update v0.11 section (fold ingress into P15.5 per Q3=A, expand P09/P10, add CLI REQs to P05/P06/P14a/P14b per Q2=C)

---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---

.ciagent/ROADMAP.md

@@ -300,7 +300,13 @@ releases if the latest lacks the asset.
 **Scope**: ship a cluster that operators can run. Builds on the v0.9
 re-architecture foundation with the production-grade subsystems:
 secrets, transactions, ACL/SPIFFE, backup/restore, drain, recovery, and
-the v0.8→v1.0 migration.
+the v0.8→v1.0 migration. **Phase 0 adopts 4 new load-bearing rules
+(R-017…R-020) and 23 new decisions (D-215…D-237) from 5 research docs
+covering ingress hardening, drift detection, platform-engineer
+positioning, strategic framing, and the systemd Path unit
+implementation.** No new phases added; scope is folded into existing
+phases per operator decisions Q2=C (add 5 CLI commands), Q3=A (fold
+ingress into P15.5).
 
 **Milestone type**: feature (multiple `feat` phases).
 
@@ -311,20 +317,20 @@ the v0.8→v1.0 migration.
 - [ ] Phase P02: ACL (SPIFFE + token identities) — tag `v0.10.4`
 - [ ] Phase P03: Secrets subsystem (REQ-080; **gate C-19** threat model) — tag `v0.10.5`
 - [ ] Phase P04: Backup/restore (tar + signed) — tag `v0.10.6`
-- [ ] Phase P05: Drain + daemon drain-and-stop (REQ-061) — tag `v0.10.7`
-- [ ] Phase P06: Alloc history (CLI-side SQLite retention; REQ-071 cache DB) — tag `v0.10.8`
+- [ ] Phase P05: Drain + daemon drain-and-stop (REQ-061) + **`orca job migrate` (REQ-116)** — tag `v0.10.7`
+- [ ] Phase P06: Alloc history (CLI-side SQLite retention; REQ-071 cache DB) + **`orca logs --all-nodes --since` (REQ-117)** — tag `v0.10.8`
 - [ ] Phase P07: Recovery (`orca restore`) — tag `v0.10.9`
-- [ ] Phase P08: Integration tests — expand hermetic harness (REQ-087) — tag `v0.10.10`
-- [ ] Phase P09: Collector + aggregator (opt-in; **gates C-11, C-12, C-14**) — tag `v0.10.11`
-- [ ] Phase P10: Transactional plane (REQ-075, REQ-079; **gate C-09** orca-pull.sh failure contract) — tag `v0.10.12`
+- [ ] Phase P08: Integration tests — expand hermetic harness (REQ-087) + **drift-detection integration tests (auto-remediation, NFS fallback, cooldown, secret exclusion)** — tag `v0.10.10`
+- [ ] Phase P09: Collector + aggregator (opt-in; **gates C-11, C-12, C-14**) + **drift-event aggregation extension (REQ-107, D-237)** — tag `v0.10.11`
+- [ ] Phase P10: Transactional plane (REQ-075, REQ-079; **gate C-09**) + **drift detection (R-018/R-019/R-020, REQ-103..REQ-113; `orca drift` CLI, systemd Path unit emitter, `orca-drift-notify.sh`, `orca-remediate.sh`, cadence config, `--force`+per-ns gate, `orca` system user, NFS detection)** — tag `v0.10.12`
 - [ ] Phase P11: `orca job lint` (REQ-084) — tag `v0.10.13`
 - [ ] Phase P12: `orca job verify` (dry-run txn through lead) — tag `v0.10.14`
 - [ ] Phase P13: `orca ns` subcommands (full surface) + deprecation warnings (REQ-068) — tag `v0.10.15`
-- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07** CA migration spec) — tag `v0.10.16`
-- [ ] Phase P14b: Daemon cutover + running-allocation adoption — tag `v0.10.17`
+- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07**) + **`orca upgrade --to-vX` (REQ-115, thin wrapper, handles R-017 binding cutover)** — tag `v0.10.16`
+- [ ] Phase P14b: Daemon cutover + running-allocation adoption + **`orca cluster rotate-lead` (REQ-114)** — tag `v0.10.17`
 - [ ] Phase P14c: Mixed-version tolerance + no-orca-on-server enforcement (REQ-065, REQ-086; implements C-13) — tag `v0.10.18`
-- [ ] Phase P15: README quickstart (REQ-089) — tag `v0.10.19`
-- [ ] Phase P15.5: Threat model + security review (**gate C-19**) — tag `v0.10.20`
+- [ ] Phase P15: README quickstart (REQ-089; **Nomad-inspired framing per Q5=A, honest-trade-offs table from research doc 3**) — tag `v0.10.19`
+- [ ] Phase P15.5: Threat model + security review (**gate C-19**) + **ingress hybrid (R-017; nft emitter REQ-099, Traefik binding REQ-100, `orca doctor nft` REQ-101, `orca nft` CLI REQ-102) + `orca doctor mTLS` (REQ-118)** — tag `v0.10.20`
 - [ ] Phase P16: Final review + ship + audit — **v0.11.0 milestone release** — tag `v0.10.21` (v1.0.0 cut separately after UAT sign-off)
 
 **Milestone tag**: `v0.11.0` (the v0.11 milestone release tag; v1.0.0 is
@@ -338,24 +344,36 @@ tags: `v0.10.0`…`v0.10.21`.
 - **P00** — CLI cache (R-008)
 - **P01.5** — SPIFFE spike (REQ-076; C-08)
 - **P03** — Secrets (REQ-080; C-19)
-- **P05** — Drain + daemon stop (REQ-061)
-- **P06** — Alloc history (REQ-071 cache DB)
-- **P08** — Integration tests (REQ-087)
-- **P10** — Transactional plane (REQ-075, REQ-079; C-09)
+- **P05** — Drain + daemon stop (REQ-061) + `orca job migrate` (REQ-116)
+- **P06** — Alloc history (REQ-071 cache DB) + `orca logs --all-nodes --since` (REQ-117)
+- **P08** — Integration tests (REQ-087) + drift-detection integration tests
+- **P09** — Collector + aggregator (C-11, C-12, C-14) + drift-event aggregation (REQ-107, D-237)
+- **P10** — Transactional plane (REQ-075, REQ-079; C-09) + drift detection (R-018/R-019/R-020; REQ-103..REQ-113)
 - **P11** — Job lint (REQ-084)
 - **P13** — ns subcommands + deprecation warnings (REQ-068)
-- **P14a/b/c** — Migration (REQ-066, REQ-065, REQ-086; C-07, C-13)
-- **P15** — README (REQ-089)
-- **P15.5** — Threat model (C-19)
+- **P14a/b/c** — Migration (REQ-066, REQ-065, REQ-086; C-07, C-13) + `orca upgrade` (REQ-115) + `orca cluster rotate-lead` (REQ-114)
+- **P15** — README (REQ-089; Q5=A framing)
+- **P15.5** — Threat model (C-19) + ingress hybrid (R-017; REQ-099..REQ-102) + `orca doctor mTLS` (REQ-118)
 
-### Risk register (from grill, for ongoing monitoring)
+### New load-bearing rules adopted in Phase 0
+
+- **R-017** — Ingress hybrid: nft DNAT → Traefik on `127.0.0.1:8443`; opt-out via `--public-binding`; `service { ingress: native }` per-workload opt-in
+- **R-018** — Drift cadence: default 60s; critical 5s + systemd Path units; standard 30s
+- **R-019** — Drift detector is a BACKSTOP; primary = systemd/Traefik/step-ca/Syncthing
+- **R-020** — Hard gate: applier refuses txns on pre-flight drift; `--force` + per-ns scoping override
+
+### Risk register (from grill + research, for ongoing monitoring)
 
 - **step-ca single-instance SPOF** (mitigation: C-12 doc; v1.x HA via systemd failover)
 - **master.key passphrase-less 0600** (mitigation: C-19 threat model; consider OS keyring in v1.x)
 - **wasmtime CGO breaks cross-compile** (mitigation: C-01 spike; fallback to podman/process primary)
 - **bash control plane drift** (mitigation: C-15..C-18 render-format contract + bats gate)
 - **daemon cutover orphans running allocs** (mitigation: P14b split; test adoption)
-- **27→35+ phase scope** (mitigation: C-04 resolved — operator decision: keep 2 milestones v0.9 + v0.11, keep all phases, v1.0 is UAT-gated after v0.11; current count v0.9=18 + v0.11=22 = 40 phases, exceeds 35 soft limit but operator accepted)
+- **27→35+ phase scope** (mitigation: C-04 resolved — operator accepted 40 phases; v0.11 stays at 23 phases with scope folded in, no new phases)
+- **R-020 deadlock** (mitigation: `--force` flag + per-namespace scoping per Q4=A; drifted peer in ns-A doesn't block ns-B)
+- **P10 sizing** (mitigation: P10 is the largest phase — drift detection + txn plane; grill may split into P10a/P10b if vertical slice is too large)
+- **Ingress default migration** (mitigation: `orca upgrade` [REQ-115] handles Traefik binding cutover from `:443` to `127.0.0.1:8443` for existing v0.9/v0.10 clusters)
+- **`orca` system user on peers** (mitigation: net-new operational requirement; peer-setup emits `useradd -r orca` idempotently; documented in P10)
 
 ## Deferred to v1.x (out of scope for v0.11)