diff --git a/docs/planning/SERENITY_CLEANUP_WAVE_1.md b/docs/planning/SERENITY_CLEANUP_WAVE_1.md
index 443de40..2c3c06a 100644
--- a/docs/planning/SERENITY_CLEANUP_WAVE_1.md
+++ b/docs/planning/SERENITY_CLEANUP_WAVE_1.md
@@ -323,6 +323,49 @@ Definition of done:
 - decision recorded to use PD shared-mariadb for RomM unless blocked
 - required PD mount paths for libraries/assets/resources identified
 
+Chosen target layout (2026-05-25):
+- place both services in the PD `media` stack so they follow the same steady-state placement already documented for PD media/library apps
+- attach both services to:
+  - `media-net` for local app adjacency
+  - `ix-databases_shared-databases` for shared DB access
+  - `pangolin` for internal ingress / public exposure
+- preserve the current host ports on PD because live checks showed them free there:
+  - GameVault: `8785:8080`
+  - RomM: `8457:8080`
+- preserve the public hostnames already in use during cutover:
+  - `gamevault.paccoco.com`
+  - `romm.paccoco.com`
+- use the PD internal ingress model (`Pangolin -> Traefik -> app`) when the public route is re-homed, rather than introducing another direct-to-container edge pattern
+
+Chosen storage layout:
+- GameVault appdata on SSD because it is small and write-active:
+  - `/mnt/docker-ssd/docker/appdata/gamevault/media` -> `/media`
+  - `/mnt/docker-ssd/docker/appdata/gamevault/logs` -> `/logs`
+- GameVault canonical content mounts should be re-used, not copied:
+  - `/mnt/unraid/data/media/Games-Apps Isos` -> `/files`
+  - `/mnt/unraid/data/media/Saved Games` -> `/savefiles`
+- RomM split layout:
+  - write-active cache on SSD:
+    - `/mnt/docker-ssd/docker/appdata/romm/redis-data` -> `/redis-data`
+  - config/assets/resources on tank appdata:
+    - `/mnt/tank/docker/appdata/romm/config` -> `/romm/config`
+    - `/mnt/tank/docker/appdata/romm/assets` -> `/romm/assets`
+    - `/mnt/tank/docker/appdata/romm/resources` -> `/romm/resources`
+- RomM canonical library mount should be re-used, not copied:
+  - `/mnt/unraid/data/media/RomM` -> `/romm/library`
+
+Chosen database layout:
+- GameVault -> PD `shared-postgres` on `ix-databases_shared-databases`
+  - target DB: `gamevault`
+  - target DB user: `gamevault`
+- RomM -> PD `shared-mariadb` on `ix-databases_shared-databases`
+  - target DB: `romm`
+  - target DB user: `romm`
+
+Routing/proxy notes to preserve during implementation:
+- RomM upstream docs call out reverse-proxy sensitivity; keep websocket support intact when the route is moved behind PD Traefik
+- existing Traefik file-provider patterns in `ingress/traefik/dynamic/routes.yml` should be extended rather than inventing a new routing mechanism for these two apps
+
 ### Card D2 — stage PD database targets for the wave
 Definition of done:
 - GameVault target DB/user created on PD shared-postgres or explicit exception documented