diff --git a/.kiro/specs/plane-on-kubernetes/tasks.md b/.kiro/specs/plane-on-kubernetes/tasks.md
index 657238e..7013a6c 100644
--- a/.kiro/specs/plane-on-kubernetes/tasks.md
+++ b/.kiro/specs/plane-on-kubernetes/tasks.md
@@ -55,7 +55,7 @@ go-ahead** with a ceiling; steps that need a hand on a cluster that does not exi
     in `tests/test_plane_reconciler.py:803` moves to 550 in task 2.4 with the reason in the assertion message.
   - Evidence: the numbers in `record.json`.
   - _Requirements: 2.1_
-- [ ] 1.7 gvisor tarball reachability (open question 3) **manual**
+- [x] 1.7 gvisor tarball reachability (open question 3) **manual** -- documented as planned in `docs/deployment.md` B.1; the live check waits for k3s
   - `docs/deployment.md` (B.1, planned): the k3s node must fetch
     `gs://gvisor/releases/nightly/2026-09-02/<arch>/gvisor.tar.zstd` (`substrate/manifests/ate-install/sandboxconfig-gvisor.yaml`)
     or a mirrored copy named in a copied SandboxConfig; the check is `kubectl -n ate-system logs` of the worker
diff --git a/docs/deployment.md b/docs/deployment.md
index 7c8e0f2..a866be9 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -150,6 +150,14 @@ cluster. Everything else below is either a step you take or a code change that i
   receiver, TLS passthrough to the Workspaces' Git hosts and the Model's declared hosts.
 - Deploy ax (`make deploy AX_IMAGE_REPO=<your registry>` in the ax checkout) **after** B.2.
 - Apply a WorkerPool (B.6). Substrate installs none by itself ("no free workers").
+- **gVisor on the nodes (planned, checked by hand on the day k3s exists).** Substrate does not use a Kubernetes
+  `RuntimeClass`: the `ateom-gvisor` worker runs `runsc` itself, from the gVisor release tarball named in
+  `manifests/ate-install/sandboxconfig-gvisor.yaml` of the Substrate checkout
+  (`gs://gvisor/releases/nightly/2026-09-02/<arch>/gvisor.tar.zstd`, sha256-pinned per architecture), which
+  the atelet fetches on the worker node. The node must reach that URL, or a copied `SandboxConfig` must name a
+  mirrored copy with the same sha256 and the ActorTemplates must name that config. The check is the atelet's
+  fetch line in `kubectl -n ate-system logs` of the worker pod; it is labelled planned until that log has been
+  read on a k3s node (plane-on-kubernetes task 1.7, design open question 3).
 
 ### B.2 ax's snapshot bucket: `AX_SNAPSHOTS_BUCKET`