diff --git a/stacks/claude-memory/main.tf b/stacks/claude-memory/main.tf
index e0f0078e..d1a87d19 100644
--- a/stacks/claude-memory/main.tf
+++ b/stacks/claude-memory/main.tf
@@ -236,6 +236,7 @@ resource "kubernetes_deployment" "claude-memory" {
     }
   }
   lifecycle {
+    # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18.
     ignore_changes = [
       spec[0].template[0].spec[0].container[0].image
     ]
diff --git a/stacks/k8s-portal/modules/k8s-portal/main.tf b/stacks/k8s-portal/modules/k8s-portal/main.tf
index 7413d2bd..c44b06fc 100644
--- a/stacks/k8s-portal/modules/k8s-portal/main.tf
+++ b/stacks/k8s-portal/modules/k8s-portal/main.tf
@@ -113,6 +113,7 @@ resource "kubernetes_deployment" "k8s_portal" {
     }
   }
   lifecycle {
+    # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA); Kyverno mutates dns_config for ndots. Reviewed 2026-04-18.
     ignore_changes = [
       spec[0].template[0].spec[0].dns_config,
       spec[0].template[0].spec[0].container[0].image, # CI updates image tag
diff --git a/stacks/mailserver/modules/mailserver/main.tf b/stacks/mailserver/modules/mailserver/main.tf
index cf75d9ab..695c1a28 100644
--- a/stacks/mailserver/modules/mailserver/main.tf
+++ b/stacks/mailserver/modules/mailserver/main.tf
@@ -127,9 +127,10 @@ resource "kubernetes_config_map" "mailserver_config" {
     logtarget = SYSOUT
     EOF
   }
-  # Password hashes are different each time and avoid changing secret constantly. 
+  # Password hashes are different each time and avoid changing secret constantly.
   # Either 1.Create consistent hashes or 2.Find a way to ignore_changes on per password
   lifecycle {
+    # DRIFT_WORKAROUND: postfix-accounts.cf password hashes non-deterministic; would flap on every apply. Reviewed 2026-04-18.
     ignore_changes = [data["postfix-accounts.cf"]]
   }
 }
diff --git a/stacks/novelapp/main.tf b/stacks/novelapp/main.tf
index e5420752..f69e55d8 100644
--- a/stacks/novelapp/main.tf
+++ b/stacks/novelapp/main.tf
@@ -80,6 +80,7 @@ resource "kubernetes_deployment" "novelapp" {
     }
   }
   lifecycle {
+    # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18.
     ignore_changes = [
       spec[0].template[0].spec[0].container[0].image,
     ]
diff --git a/stacks/owntracks/main.tf b/stacks/owntracks/main.tf
index 78325eb6..a1b1e47b 100644
--- a/stacks/owntracks/main.tf
+++ b/stacks/owntracks/main.tf
@@ -77,6 +77,7 @@ resource "kubernetes_secret" "basic_auth" {
 
   type = "Opaque"
   lifecycle {
+    # DRIFT_WORKAROUND: htpasswd bcrypt hashes are non-deterministic per apply; would cause perpetual diff. Reviewed 2026-04-18.
     ignore_changes = [data]
   }
 }
diff --git a/stacks/plotting-book/main.tf b/stacks/plotting-book/main.tf
index f799badb..b89ed767 100644
--- a/stacks/plotting-book/main.tf
+++ b/stacks/plotting-book/main.tf
@@ -80,6 +80,7 @@ resource "kubernetes_deployment" "plotting-book" {
     }
   }
   lifecycle {
+    # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18.
     ignore_changes = [
       spec[0].template[0].spec[0].container[0].image,
     ]
diff --git a/stacks/trading-bot/main.tf b/stacks/trading-bot/main.tf
index a0942e7f..fea7bb02 100644
--- a/stacks/trading-bot/main.tf
+++ b/stacks/trading-bot/main.tf
@@ -314,6 +314,7 @@ resource "kubernetes_deployment" "trading-bot-frontend" {
     }
   }
   lifecycle {
+    # DRIFT_WORKAROUND: CI pipeline owns image tags for api + migrations containers. Reviewed 2026-04-18.
     ignore_changes = [
       spec[0].template[0].spec[0].container[0].image,
       spec[0].template[0].spec[0].container[1].image,
@@ -575,6 +576,7 @@ resource "kubernetes_deployment" "trading-bot-workers" {
     }
   }
   lifecycle {
+    # DRIFT_WORKAROUND: CI pipeline owns image tags for all 6 worker containers. Reviewed 2026-04-18.
     ignore_changes = [
       spec[0].template[0].spec[0].container[0].image,
       spec[0].template[0].spec[0].container[1].image,