Wave-2 right-sizing: record prepared change, diff verdict and apply command

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

workplans/FLEX-WP-0038-wave2-resource-right-sizing.md

@@ -43,3 +43,12 @@ Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hour
 authorization decision latency is unchanged, and the next weekly allocation report
 shows no CPU throttling. Rollback: revert the values commit and redeploy through
 the existing path.
+
+## Prepared 2026-10-22 (wave-2 worker W1b)
+
+Status stays `wait` / `needs_human`. Local commit only: not pushed, not applied. Diff = full owner render vs live (`kubectl diff`, object names and changed key paths only, Secret objects skipped).
+
+- Live source: 9 Helm releases `flex-auth-*` from `charts/flex-auth` with `values/<release>.yaml`. The `values/access-engine/*` files render differently named objects and are not deployed.
+- Change: access-engine `36465de`: chart default request 25m/32Mi -> 5m/20Mi. Overrides: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (up, because p95 is 35Mi), informed-decision-t03 16Mi. CPU is 5m for every release. Total 45m/204Mi, compared with 176Mi proposed; the difference comes from per-pod rounding.
+- Diff: NOT resource-only. In 8 of 9 releases, the chart at HEAD adds `--caller-audience` to the container args (`flex-auth` or `access-engine`, depending on the release). informed-decision-sitting also changes image. Only `flex-auth-ops-warden` diffs resource-only. This drift goes to the founder before any helm upgrade.
+- Apply (per release, after founder OK): `helm upgrade --install flex-auth-<release> charts/flex-auth --namespace flex-auth -f values/<release>.yaml --wait --timeout 2m`.