diff --git a/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md b/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md
index 47ce0a3..b636642 100644
--- a/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md
+++ b/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md
@@ -43,3 +43,12 @@ Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hour
 authorization decision latency is unchanged, and the next weekly allocation report
 shows no CPU throttling. Rollback: revert the values commit and redeploy through
 the existing path.
+
+## Prepared 2026-10-22 (wave-2 worker W1b)
+
+Status stays `wait` / `needs_human`. Local commit only: not pushed, not applied. Diff = full owner render vs live (`kubectl diff`, object names and changed key paths only, Secret objects skipped).
+
+- Live source: 9 Helm releases `flex-auth-*` from `charts/flex-auth` with `values/<release>.yaml`. The `values/access-engine/*` files render differently named objects and are not deployed.
+- Change: access-engine `36465de`: chart default request 25m/32Mi -> 5m/20Mi. Overrides: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (up, because p95 is 35Mi), informed-decision-t03 16Mi. CPU is 5m for every release. Total 45m/204Mi, compared with 176Mi proposed; the difference comes from per-pod rounding.
+- Diff: NOT resource-only. In 8 of 9 releases, the chart at HEAD adds `--caller-audience` to the container args (`flex-auth` or `access-engine`, depending on the release). informed-decision-sitting also changes image. Only `flex-auth-ops-warden` diffs resource-only. This drift goes to the founder before any helm upgrade.
+- Apply (per release, after founder OK): `helm upgrade --install flex-auth-<release> charts/flex-auth --namespace flex-auth -f values/<release>.yaml --wait --timeout 2m`.