fix(05): revise plans based on checker feedback

.planning/ROADMAP.md

@@ -184,7 +184,29 @@ Plans:
   4. The money cast round-trips the PHP ceiling and blank-string cases as a fixed 4-decimal JSON string (never `float64`), and an encrypted-at-rest credential column is AES-GCM encrypted at rest and hidden from serialization.
   5. Paginated responses use the exact `{data, meta{current_page,last_page,per_page,total}}` envelope with no `links` key; another plugin extends a model's lifecycle through the GORM callback registry and a companion migration without editing the owning plugin's file; soft-deletable + uniquely-keyed tables pass a delete-then-recreate test.
 
-**Plans**: TBD
+**Plans**: 6 plans
+
+Plans:
+**Wave 1**
+
+- [ ] 05-01-PLAN.md — Verify models-leaf rule, restructure plugins into Winter layout, ship lagoon write/read-path primitives
+
+**Wave 2** *(blocked on Wave 1 completion)*
+
+- [ ] 05-02-PLAN.md — Album/Collection slice: migrations, models, casts, validation engine, write services
+- [ ] 05-03-PLAN.md — Secrets slice: encrypted cast, key management, organisations, credentials/OAuth tables
+
+**Wave 3** *(blocked on Wave 2 completion)*
+
+- [ ] 05-04-PLAN.md — Attachments: system_files, blob storage, thumbnails, delete lifecycle
+
+**Wave 4** *(blocked on Wave 3 completion)*
+
+- [ ] 05-05-PLAN.md — Remaining models, D-02 schema-diff proof, test-only DATA-11 fixture plugin, CLI-03 verification
+
+**Wave 5** *(blocked on Wave 4 completion)*
+
+- [ ] 05-06-PLAN.md — Fuzz tests, hidden-marshal coverage, attachment smoke test, security review
 
 ### Phase 6: HTTP routing, auth groups and rate limiting
 
@@ -368,7 +390,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 2. API parity harness bootstrap | 5/5 | Complete   | 2026-09-17 |
 | 3. First vertical slice — genres end to end | 4/4 | Complete   | 2026-09-17 |
 | 4. CLI scaffolding, i18n and mail | 4/4 | Complete   | 2026-09-18 |
-| 5. Data layer full fidelity | 0/TBD | Not started | - |
+| 5. Data layer full fidelity | 0/6 | Planned | - |
 | 6. HTTP routing, auth groups and rate limiting | 0/TBD | Not started | - |
 | 7. User plugin and authentication | 0/TBD | Not started | - |
 | 8. OAuth2.1 authorization server | 0/TBD | Not started | - |