docs(P00): grill v0.11 — 6 binding conditions (C-23..C-28), P10 split into P10a/P10b

GRILL stage: adversarial review across 6 forcing questions. Verdict: PROCEED-WITH-CONDITIONS.
- C-23: orca-pull.sh distinguishes cluster-wide vs ns-scoped txns (gate P10a)
- C-24: split P10 into P10a (txn plane) + P10b (drift detection); phase count 23->24; tags shift by 1
- C-25: orca upgrade post-cutover verification + rollback (gate P14a)
- C-26: per-phase LoC soft ceiling ~800 (no gate, recorded)
- C-27: orca upgrade creates orca system user on existing peers (gate P14a)
- C-28: P15.5 two sub-waves (ingress+doctor nft, then threat model+doctor mTLS) (gate P15.5)
ROADMAP updated: 24 phases, tags v0.10.0..v0.10.22.

---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---

.ciagent/ROADMAP.md

@@ -322,16 +322,17 @@ ingress into P15.5).
 - [ ] Phase P07: Recovery (`orca restore`) — tag `v0.10.9`
 - [ ] Phase P08: Integration tests — expand hermetic harness (REQ-087) + **drift-detection integration tests (auto-remediation, NFS fallback, cooldown, secret exclusion)** — tag `v0.10.10`
 - [ ] Phase P09: Collector + aggregator (opt-in; **gates C-11, C-12, C-14**) + **drift-event aggregation extension (REQ-107, D-237)** — tag `v0.10.11`
-- [ ] Phase P10: Transactional plane (REQ-075, REQ-079; **gate C-09**) + **drift detection (R-018/R-019/R-020, REQ-103..REQ-113; `orca drift` CLI, systemd Path unit emitter, `orca-drift-notify.sh`, `orca-remediate.sh`, cadence config, `--force`+per-ns gate, `orca` system user, NFS detection)** — tag `v0.10.12`
-- [ ] Phase P11: `orca job lint` (REQ-084) — tag `v0.10.13`
-- [ ] Phase P12: `orca job verify` (dry-run txn through lead) — tag `v0.10.14`
-- [ ] Phase P13: `orca ns` subcommands (full surface) + deprecation warnings (REQ-068) — tag `v0.10.15`
-- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07**) + **`orca upgrade --to-vX` (REQ-115, thin wrapper, handles R-017 binding cutover)** — tag `v0.10.16`
-- [ ] Phase P14b: Daemon cutover + running-allocation adoption + **`orca cluster rotate-lead` (REQ-114)** — tag `v0.10.17`
-- [ ] Phase P14c: Mixed-version tolerance + no-orca-on-server enforcement (REQ-065, REQ-086; implements C-13) — tag `v0.10.18`
-- [ ] Phase P15: README quickstart (REQ-089; **Nomad-inspired framing per Q5=A, honest-trade-offs table from research doc 3**) — tag `v0.10.19`
-- [ ] Phase P15.5: Threat model + security review (**gate C-19**) + **ingress hybrid (R-017; nft emitter REQ-099, Traefik binding REQ-100, `orca doctor nft` REQ-101, `orca nft` CLI REQ-102) + `orca doctor mTLS` (REQ-118)** — tag `v0.10.20`
-- [ ] Phase P16: Final review + ship + audit — **v0.11.0 milestone release** — tag `v0.10.21` (v1.0.0 cut separately after UAT sign-off)
+- [ ] Phase P10a: Transactional plane (REQ-075, REQ-079; **gate C-09**; **gate C-23** cluster-wide vs ns-scoped txn distinction) — tag `v0.10.12`
+- [ ] Phase P10b: Drift detection (R-018/R-019/R-020; REQ-103..REQ-113; `orca drift` CLI, systemd Path unit emitter, `orca-drift-notify.sh`, `orca-remediate.sh`, cadence config, `--force`+per-ns gate, `orca` system user, NFS detection) — depends on P10a — tag `v0.10.13`
+- [ ] Phase P11: `orca job lint` (REQ-084) — tag `v0.10.14`
+- [ ] Phase P12: `orca job verify` (dry-run txn through lead) — tag `v0.10.15`
+- [ ] Phase P13: `orca ns` subcommands (full surface) + deprecation warnings (REQ-068) — tag `v0.10.16`
+- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07**; **gate C-25** post-cutover verification + rollback; **gate C-27** orca user creation) + **`orca upgrade --to-vX` (REQ-115, thin wrapper, handles R-017 binding cutover)** — tag `v0.10.17`
+- [ ] Phase P14b: Daemon cutover + running-allocation adoption + **`orca cluster rotate-lead` (REQ-114)** — tag `v0.10.18`
+- [ ] Phase P14c: Mixed-version tolerance + no-orca-on-server enforcement (REQ-065, REQ-086; implements C-13) — tag `v0.10.19`
+- [ ] Phase P15: README quickstart (REQ-089; **Nomad-inspired framing per Q5=A, honest-trade-offs table from research doc 3**) — tag `v0.10.20`
+- [ ] Phase P15.5: Threat model + security review (**gate C-19**; **gate C-28** two sub-waves) + **ingress hybrid (R-017; nft emitter REQ-099, Traefik binding REQ-100, `orca doctor nft` REQ-101, `orca nft` CLI REQ-102) + `orca doctor mTLS` (REQ-118)** — tag `v0.10.21`
+- [ ] Phase P16: Final review + ship + audit — **v0.11.0 milestone release** — tag `v0.10.22` (v1.0.0 cut separately after UAT sign-off)
 
 **Milestone tag**: `v0.11.0` (the v0.11 milestone release tag; v1.0.0 is
 UAT-gated and cut separately after v0.11 completion per operator decision —
@@ -348,7 +349,8 @@ tags: `v0.10.0`…`v0.10.21`.
 - **P06** — Alloc history (REQ-071 cache DB) + `orca logs --all-nodes --since` (REQ-117)
 - **P08** — Integration tests (REQ-087) + drift-detection integration tests
 - **P09** — Collector + aggregator (C-11, C-12, C-14) + drift-event aggregation (REQ-107, D-237)
-- **P10** — Transactional plane (REQ-075, REQ-079; C-09) + drift detection (R-018/R-019/R-020; REQ-103..REQ-113)
+- **P10a** — Transactional plane (REQ-075, REQ-079; C-09; C-23)
+- **P10b** — Drift detection (R-018/R-019/R-020; REQ-103..REQ-113)
 - **P11** — Job lint (REQ-084)
 - **P13** — ns subcommands + deprecation warnings (REQ-068)
 - **P14a/b/c** — Migration (REQ-066, REQ-065, REQ-086; C-07, C-13) + `orca upgrade` (REQ-115) + `orca cluster rotate-lead` (REQ-114)
@@ -369,7 +371,7 @@ tags: `v0.10.0`…`v0.10.21`.
 - **wasmtime CGO breaks cross-compile** (mitigation: C-01 spike; fallback to podman/process primary)
 - **bash control plane drift** (mitigation: C-15..C-18 render-format contract + bats gate)
 - **daemon cutover orphans running allocs** (mitigation: P14b split; test adoption)
-- **27→35+ phase scope** (mitigation: C-04 resolved — operator accepted 40 phases; v0.11 stays at 23 phases with scope folded in, no new phases)
+- **27→35+ phase scope** (mitigation: C-04 resolved — operator accepted 40 phases; v0.11 grows to 24 phases per grill C-24 split of P10→P10a/P10b; scope folded in, no other new phases)
 - **R-020 deadlock** (mitigation: `--force` flag + per-namespace scoping per Q4=A; drifted peer in ns-A doesn't block ns-B)
 - **P10 sizing** (mitigation: P10 is the largest phase — drift detection + txn plane; grill may split into P10a/P10b if vertical slice is too large)
 - **Ingress default migration** (mitigation: `orca upgrade` [REQ-115] handles Traefik binding cutover from `:443` to `127.0.0.1:8443` for existing v0.9/v0.10 clusters)