diff --git a/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md b/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md
index a72fb7f..abd97e6 100644
--- a/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md
+++ b/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md
@@ -59,10 +59,9 @@ refusals.
 
 ## Consequences
 
-- **The pinned executor image needs rebuilding.** The image pinned in the rapp by T18 (`c67cb044`, `b90951a`) has the
-  defect. It must be rebuilt from `625ad65` or later and re-pinned before T06.
-- **Open for the founder.** approval-engine accepts an aal1 human entry unless the approval declares
-  `required_assurance` (APPROVAL-WP-0007-T01). Today the executor is the only aal2 guard. The request phase could
-  declare `required_assurance: {"level": "aal2"}` so approval-engine also enforces the floor at approve and consume
-  time. That needs the deployed approval-engine to be at schema v7 or later, and a check that informed-decision's
-  present_existing accepts the field.
+- **Image re-pinned (2026-11-04).** The image built for `66dc397`, `sha256:3aa2bcce…500d8a`, is pinned in the rapp
+  (`3ddacfc`). Its 7 executed files are byte-identical to the repo, and the `provider` test job passed. It replaces
+  T21's `e0b9bf6c`, which had the defect.
+- **Founder decision (2026-11-04): no `required_assurance` at request.** approval-engine supports a level per
+  approval: no floor by default, with an optional `required_assurance` floor. This decision does not need
+  approval-engine to require aal2. The executor still enforces the admission's aal2 (BEA-C4).
diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index 2b23724..872a26c 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -828,11 +828,14 @@ approving, and an aal1 entry.
 would have refused every real founder approval. Fixed in `625ad65` (`entry_is_aal2`). The request-phase tests no
 longer expire with the example window.
 
-Follow-ups:
+Follow-ups, both settled 2026-11-04:
 
-- rebuild the executor image from `625ad65` and re-pin it in the rapp (T18's `c67cb044` has the defect);
-- founder decision: should the request phase also declare `required_assurance: aal2`, so approval-engine enforces
-  the floor?
+- **Image.** The image built for `66dc397` is `sha256:3aa2bcce…500d8a`. The `provider` job (executor tests) passed,
+  and the 7 executed files are byte-identical to the repo. It is pinned in the rapp (`3ddacfc`), replacing T21's
+  `e0b9bf6c`, which had the defect.
+- **Founder decision: no `required_assurance` at request.** approval-engine's rigidity is per approval: no floor by
+  default, with an optional `required_assurance` level. This decision does not need approval-engine to require aal2.
+  The admission's own aal2 (BEA-C4) is still enforced by the executor.
 
 ## Executor audit sender