diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md
index 16f6bf4..02a0da2 100644
--- a/workplans/NK-WP-0055-security-platform-production-readiness.md
+++ b/workplans/NK-WP-0055-security-platform-production-readiness.md
@@ -314,6 +314,8 @@ Owner: access-engine. **Done when:** policy changes are imported without rebuild
 tenant packages split, one production explain receipt exists, and FLEX-WP-0031 (decision records) and FLEX-WP-0024 (signed
 envelope) are delivered or accepted as exceptions.
 
+
+2026-10-27 founder decision: import path **B**, a policy bundle mounted into access-engine and pinned by digest, so policy changes no longer need an image rebuild; move to C (signed bundle) once FLEX-WP-0024 signing custody exists. Delivery sits in access-engine FLEX-WP-0039-T03.
 ## Register rotation lanes with blast radius and verification
 
 ```task