docs: reconcile scope with verified capability

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

docs/intakes/residuals.md

@@ -139,3 +139,31 @@ description: |
   assigned and GLAS-WP-0006 is the authoritative record for that work.
 state_hub_intake_id: "01a02bde-7d1e-7af3-9eba-aecc8f50365c"
 ```
+
+## GLAS-IN-0005 — Make profile operational readiness explicit
+
+```yaml
+id: GLAS-IN-0005
+kind: intake
+title: "Separate profile selection enablement from runtime readiness"
+lane: red
+status: todo
+priority: high
+owner: glas-harness
+repo: glas-harness
+origin: residual
+origin_ref: GLAS-WP-0007
+description: |
+  The catalog currently labels all three committed profiles enabled when their
+  schemas and rein capabilities are selectable. That status does not prove the
+  selected host can execute the rein inside its sandbox transport. Both local
+  profiles currently fail closed at session_start on the sand-boxer owner-exec
+  boundary, while the remote profile lacks a positive post-hardening proof.
+
+  Define and implement an explicit operational-readiness contract. Decide
+  whether unavailable profiles must be disabled, carry a separate readiness
+  state, or be filtered through a bounded preflight. Catalog and CLI output
+  must not imply runtime executability from schema validation alone. Coordinate
+  with GLAS-IN-0002 for local owner-exec/runtime evidence; do not add a host
+  fallback or claim readiness from lifecycle-only proof.
+```