CUST-WP-0071: record wave-1/wave-2 receiving work and apply blocker

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md

@@ -68,3 +68,13 @@ completion of T04.
   only. Wave 2 and anything outside the reviewed wave-1 diffs need a new approval.
 - ihp-railiance-probe: "Find owner first". Trace the owner from the repos; make no
   change until the owner is confirmed.
+
+## Wave-1 apply path and probe (same session)
+
+- Apply path: "Local kubectl allowed". The ssh-based installers can't read the k3s
+  kubeconfig on railiance01, so this session applies the reviewed wave-1 changes
+  with kubectl/helm from the workstation, using its kubeconfig, one owner at a time.
+- ihp-railiance-probe: "Approve uninstall" (CORE-WP-0012-T02). Run
+  `helm uninstall ihp-railiance-probe -n coulomb`; delete namespace `coulomb` only
+  if it is empty.
+- flex-auth: its receiving task goes to access-engine, next to `charts/flex-auth`.

workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md

@@ -568,3 +568,25 @@ CPU below 500m, or apps-pg above 600m. Gaps: no SSO, ingress or TLS; a standalon
 database instead of CNPG; a synthetic closed loop; a single quiet-hour run. These
 results are provisional. They do not prove human workflow acceptance, which stays
 with RAPPS-WP-0014-T03 / VERGABE-WP-0019.
+
+## Wave-1 and wave-2 receiving records — 2026-10-21
+
+Wave-1 receiving work is ready but not applied:
+- RAIL-KNATIVE-WP-0003 (rail-knative `76cb9c7`, pushed) and RCLUSTER-WP-0020
+  (railiance-cluster `3b18b84`, pushed): HPA caps 20/5/10 → 3/2/3, CPU requests 220m → 60m.
+- STATE-WP-0099 (state-hub `a6afb08`): API 250m → 390m, state-hub-db → 70m/416Mi,
+  preflight surge read from the values. This has to land after Knative and before
+  forge and telemetry.
+- FORGE-WP-0011 (railiance-forge `6d79567`): a patch for railiance-apps. gitea gets
+  200m/1104Mi with a 1536Mi limit; the runner pod gets 125m/496Mi with dind limited to 1500m/2Gi.
+- rapp-telemetry: worker still running.
+
+Wave-2 receiving workplans are committed in 21 repos: the 20 listed by the worker,
+plus access-engine FLEX-WP-0038 (`9f954a0`) for flex-auth. They include CORE-WP-0012-T02,
+the uninstall of the leftover ihp-railiance-probe Helm release, which the founder
+approved. Every wave-2 task waits on `needs_human`.
+
+Apply blocker: the founder allowed local kubectl for wave 1, but Claude Code's
+permission classifier refuses cluster writes from this session ("Protected-Scope
+IaC Apply"). The founder runs the applies, or adds a permission rule. No
+production allocation has changed.