docs: plan HTTPS peers and source install

docs/critical-check-cluster.md

@@ -33,7 +33,8 @@ witness. It is never a Raft voter.
 
 ## Topology
 
-- Production clusters have 3 or 5 voters, never an even count.
+- Initial production clusters require exactly 3 voters. A future measured
+  five-voter profile may be introduced separately; never use an even count.
 - Voters remain within a bounded-latency topology. Remote regions use observer
   nodes unless measured RTT supports the configured election timeout.
 - Nodes may be `voter`, `observer`, or `voter+observer`.
@@ -44,6 +45,12 @@ Single-voter bootstrap is temporary. The cluster must not execute customer
 critical checks until at least three voters are healthy and the signed
 observer set is committed.
 
+Membership and mTLS identity are assigned by the control plane as defined in
+[public-endpoint-and-identity.md](public-endpoint-and-identity.md). Production
+Raft traffic uses `/raft` on each worker's external HTTPS origin through an
+HTTP/1.1 upgrade-capable reverse proxy. Static peers and shared Basic auth are
+lab compatibility only.
+
 ## Raft State
 
 The FSM contains only:
@@ -167,14 +174,16 @@ but cannot commit or fabricate incidents.
 
 1. [x] Remove production exposure of debug config application.
 2. [ ] Complete versioned FSM types, command validation, and deterministic tests.
-3. [ ] Add mTLS identity and safe one-claim cluster bootstrap.
+3. [ ] Adapt the rbackup CA pattern into short-lived SAN-bound mTLS identity,
+   rotation/revocation, and safe one-claim cluster bootstrap.
 4. [ ] Add signed config and observer-set adoption.
 5. [ ] Add deterministic scheduler and checkexec bridge in shadow mode.
 6. [ ] Implement observation aggregation, incident policy, and idempotency.
 7. [ ] Implement encrypted snapshots and restore/migration tests.
 8. [ ] Add metadata outbox executor and failover-safe delivery.
 9. [ ] Add external witness, replay, metrics, and operational runbooks.
-10. [ ] Run synthetic 3/5-node fault campaigns before any customer check.
+10. [ ] Run synthetic three-node HTTPS-proxy fault campaigns before any
+    customer check; define a separate five-node profile before testing it.
 
 ## Release Gates