diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 68da8af..122267b 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -205,7 +205,7 @@
 | task | FLEX-WP-0035-T02 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
 | task | FLEX-WP-0035-T03 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
 | task | FLEX-WP-0035-T04 | wait | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
-| task | FLEX-WP-0035-T05 | todo | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
+| task | FLEX-WP-0035-T05 | wait | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
 | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |
diff --git a/workplans/FLEX-WP-0035-per-identity-application-readback.md b/workplans/FLEX-WP-0035-per-identity-application-readback.md
index 3737673..7aa301e 100644
--- a/workplans/FLEX-WP-0035-per-identity-application-readback.md
+++ b/workplans/FLEX-WP-0035-per-identity-application-readback.md
@@ -169,5 +169,12 @@ Add `values/flex-auth-application-readback.yaml` (or a deploy manifest) for a
 dedicated `flex-auth-application-readback` pin, plus a test asserting that its
 package paths match each participant's own pin values (digest-equality, §4).
 Add the user-engine ingress rule, then get the founder's go for the rollout.
+
+Promised to user-engine (reply to `d7e02758`, 2026-10-10), so the values file
+must match: URL
+`http://flex-auth-application-readback.flex-auth.svc.cluster.local.:8080`
+(trailing dot, in-cluster only), caller token audience `flex-auth`
+(`serve-readback --caller-audience` default), readback caller
+`system:serviceaccount:user-engine:user-engine`.
 The pin ships with the image that contains `serve-readback`. Hand user-engine
 the evidence that unblocks `USER-WP-0026-T03`.