docs: record production namespace boundary proof

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

workplans/GLAS-WP-0005-sandbox-boundary-runtime-hardening.md

@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: sandbox-boundary-runtime-hardening
 created: "2026-08-21"
-updated: "2026-08-22"
+updated: "2026-08-23"
 state_hub_workstream_id: "c8049700-73ca-549a-b250-1020de1cddc5"
 ---
 
@@ -160,6 +160,17 @@ the registered residual was re-sent to sand-boxer in message
 `2e203700-6a2c-4d86-8eed-5dea72e69994`. T05 remains `wait`; no unsafe host
 fallback was introduced.
 
+**2026-08-23 production evidence:** rein-aharness deployed the corrected
+`worker_id`/`actor` mapping and ran ops run
+`ededc939-266f-473c-8386-ffd3f027f5f0` with governed actor `agt`. Glas resolved
+the local profile, created sandbox `d750cd5c`, and failed closed at
+`session_start` before dispatch or commit because consumer `nsenter` could not
+join the bwrap namespaces. The sandbox reached `destroyed` and its workspace is
+absent. Loading Ubuntu's bwrap user-namespace AppArmor profile kept bwrap alive
+with child `CapEff=0`, but did not make direct namespace entry permissible.
+This confirms that T05 needs sand-boxer-owned execution rather than another
+consumer-side namespace workaround.
+
 ## Overall acceptance
 
 1. No governed rein invocation operates on the caller's original checkout.