diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index 87a6fa8..1d2fbc8 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -24,7 +24,7 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [x] **Phase 9: Backend admin authentication and schema pipeline** - Admin roles, fields.yaml/columns.yaml, relation manager (completed 2026-10-01)
 - [x] **Phase 10: Admin Vue SPA** - Login, navigation, lists, forms and relation manager for five controllers (completed 2026-09-27)
 - [ ] **Phase 11: Jobs, realtime and search infrastructure** - River, Centrifugo and Typesense sync brought up before the API phases that need them
-- [ ] **Phase 12: Płytarium API — Collections and Albums** - Core content endpoints ported with byte-level parity
+- [x] **Phase 12: Płytarium API — Collections and Albums** - Core content endpoints ported with byte-level parity (completed 2026-10-02)
 - [ ] **Phase 13: Płytarium API — wishlist, notifications, CSV, credentials, public routes** - Remaining core API surface
 - [ ] **Phase 14: Domain jobs and external integrations** - CSV/Discogs jobs, wishlist digest, reindex, Discogs client, AI recognition, feedback, sitemap
 - [ ] **Phase 15: Cutover** - Parity harness green on all 154 routes, both real clients run unchanged
@@ -630,7 +630,7 @@ Plans:
 - [x] 12-04-PLAN.md — Albums, search and lookups: full album write path, covers through fetchguard, uploads, bulk/stats/value/missing/sync, Scout-exact search recount, lookups, nuxt-albums flow, created/updated goldens
 
 **Wave 5** *(blocked on Wave 4 completion)*
-- [ ] 12-05-PLAN.md — Unit tests last: D-18 leak test with D-19 totals, route-table scope test, request-DTO fuzz, T-12 threat tests, coverage, check-phase12.sh, security review and validation sign-off
+- [x] 12-05-PLAN.md — Unit tests last: D-18 leak test with D-19 totals, route-table scope test, request-DTO fuzz, T-12 threat tests, coverage, check-phase12.sh, security review and validation sign-off
 
 ### Phase 12.1: User plugin admin screens (INSERTED)
 
@@ -766,7 +766,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 11. Jobs, realtime and search infrastructure | 8/8 | In Progress|  |
 | 11.1. SummerCMS documentation for humans and AI agents | 7/7 | In Progress|  |
 | 11.2. summercms.io Alpha 0.1 landing page on SummerCMS | 3/3 | In Progress|  |
-| 12. Płytarium API — Collections and Albums | 4/5 | In Progress|  |
+| 12. Płytarium API — Collections and Albums | 5/5 | Complete   | 2026-10-02 |
 | 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 0/TBD | Not started | - |
 | 14. Domain jobs and external integrations | 0/TBD | Not started | - |
 | 15. Cutover | 0/TBD | Not started | - |
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 96a3ded..1bbeb03 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -13,7 +13,7 @@ progress:
   total_phases: 21
   completed_phases: 10
   total_plans: 106
-  completed_plans: 100
+  completed_plans: 101
 milestone_name: milestone
 ---
 
@@ -155,6 +155,7 @@ Progress: [██████░░░░] 60%
 | Phase 12 P02 | 46 min | 3 tasks | 119 files |
 | Phase 12 P03 | 36 min | 3 tasks | 72 files |
 | Phase 12 P04 | 82 min | 3 tasks | 226 files |
+| Phase 12 P05 | 2h15m | 3 tasks | 85 files |
 
 ## Accumulated Context
 
@@ -452,6 +453,9 @@ Recent decisions affecting current work:
 - [Phase 12]: 12-04: sync versions compare at whole seconds so PHP's base64 cursor round-trips; albums/value prints exact sums like sprintf('%.2f')
 - [Phase 12]: 12-04: GORM callback handles are used through a NewDB session (cleanSession); WithContext keeps the write's bind variables
 - [Phase 12]: 12-04: parity album state uses fixed ids/timestamps on both sides; recorded query strings are restored from the spec
+- [Phase 12]: 12-05: attach Thumb stores WinterCMS's broken-image picture for an unusable original instead of erroring (T-12-16)
+- [Phase 12]: 12-05: check-phase12.sh --removal runs separately from --all because it edits tracked source; all 25 RC rows recorded in 12-SECURITY-REVIEW.md
+- [Phase 12]: 12-05 complete (5/5 plans): Phase 12 ready for /gsd-verify-work 12; sm-user-plugin master is 3 commits ahead of origin and needs a push
 
 ### Pending Todos