docs(plan): track Phase 9 layer-stack work (no-DRBD + LUKS layering)

The MVP scope hardcoded the layer chain to STORAGE→DRBD; the
project's stated goals include single-replica local mode (no DRBD)
and a LUKS encryption layer. Capture the gap explicitly so it
doesn't drift; phase outline includes the satellite-side stack
walker, the CSI shape, the test matrix, and an open question about
passphrase rotation interaction.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -473,6 +473,28 @@ The dev stand has been Talos+QEMU loopfile-backed. Production parity needs:
 
 ---
 
+## Phase 9 — Layer stack (no-DRBD + LUKS layering)
+
+The project's stated goal includes "ability to run without DRBD, as pure local storage (single-replica diskful or diskless)" and a LUKS encryption layer at the volume level. Today's satellite always renders a `.res` and shells out to `drbdadm`; LUKS exists in `pkg/luks` but isn't wired through `applyStorage`. To match upstream LINSTOR's `layer_list` semantics:
+
+- [ ] **`ResourceDefinition.Spec.LayerStack` (or per-RD prop)** — array of layers, default `["DRBD","STORAGE"]`. Valid values: `STORAGE`, `LUKS`, `DRBD`. Order matters: `[LUKS,STORAGE]` = LUKS-on-LV, no DRBD; `[DRBD,LUKS,STORAGE]` = DRBD-over-LUKS-over-LV (per-volume cipher with replication on top).
+- [ ] **Satellite-side stack execution** — in `applyResource`, walk the layer stack:
+  - `STORAGE` always runs — provider creates the backing block device
+  - `LUKS` (when present) — `pkg/luks.Format` (first activation), `Open` to /dev/mapper/<rd>-<volnum>, `Close` on teardown. Key material from a per-RD passphrase (KV-store under `Cryptokeys/<rd>`)
+  - `DRBD` (when present) — render `.res` against the highest-layer device path (storage device if just `[DRBD,STORAGE]`, mapper device if `[DRBD,LUKS,STORAGE]`); `drbdadm create-md/adjust`. Skip entirely when DRBD isn't in the stack.
+- [ ] **CSI shape** — linstor-csi reads `layer_list` on RD; pass it through unchanged so existing piraeus-operator flows keep working when they configure `LinstorSatelliteConfiguration.spec.storageClasses[*].layerList`.
+- [ ] **Tests**:
+  - unit: layer stack decoder rejects unknown layers, defaults to `[DRBD,STORAGE]` when empty
+  - satellite contract: `[STORAGE]` apply renders no `.res` and never invokes `drbdadm`
+  - satellite contract: `[LUKS,STORAGE]` apply runs `cryptsetup luksFormat` once, `cryptsetup open` on subsequent reconciles, never DRBD
+  - satellite contract: `[DRBD,LUKS,STORAGE]` apply layers all three; `.res` points at /dev/mapper/<rd>-0, not the raw LV
+  - e2e: `tests/e2e/no-drbd.sh` (single-replica ZFS-backed PVC, write/read), `tests/e2e/luks-layer.sh` (encrypted single-replica PVC + reboot remount), `tests/e2e/drbd-luks-stack.sh` (3-replica encrypted)
+- [ ] **Documentation** — `docs/layer-stack.md` with the upstream LINSTOR layer model, the supported subset, and how it maps to cozystack StorageClasses.
+
+Open question: cluster passphrase rotation (`POST /v1/encryption/passphrase`) already lands in Phase 7 — its interaction with the LUKS layer needs to be pinned (re-encrypt all volumes vs. just rotate the wrapping key).
+
+---
+
 ## Workflow
 
 ### Daily loop