diff --git a/docs/intakes/residuals.md b/docs/intakes/residuals.md
index 7ce7c31..e417a32 100644
--- a/docs/intakes/residuals.md
+++ b/docs/intakes/residuals.md
@@ -109,6 +109,13 @@ description: |
   concrete lane, credential delivery, enforced egress, pinned Claude runtime,
   and deployment/Glas acceptance remain open in SAND-WP-0015-T04.
 
+  2026-09-21 review: sand-boxer bfe0e4c/be42de7/7a61383 add an owner-metered
+  Messages route (provider key outside bwrap, empty egress, owner socket) and
+  frozen-lock runtime builds. The Claude-route acceptance should use that
+  empty-egress profile. Blocked on SECRETS-WP-0009-T03 live delivery and the
+  approval-engine deployment; status requests sent 2026-09-21 (see
+  GLAS-WP-0015-T03).
+
   Done when a non-secret probe and one real rein command execute inside the
   namespace, the source checkout is not visible/mutable, required egress is
   explicit, and teardown removes the sandbox workspace.
diff --git a/workplans/GLAS-WP-0015-production-dependency-coordination.md b/workplans/GLAS-WP-0015-production-dependency-coordination.md
index 549cf25..326c508 100644
--- a/workplans/GLAS-WP-0015-production-dependency-coordination.md
+++ b/workplans/GLAS-WP-0015-production-dependency-coordination.md
@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: production-dependency-coordination
 created: "2026-09-06"
-updated: "2026-09-09"
+updated: "2026-09-21"
 state_hub_workstream_id: "94c02b1f-66ed-588d-bdd7-7158107b85fb"
 ---
 
@@ -78,6 +78,22 @@ The matching rein/Glas code must be rebuilt and admitted in the protected runtim
 this local proof does not close live G1/G2 or authorize a model request. See the
 2026-09-09 runtime-transfer evidence and the owning runtime documentation.
 
+2026-09-21 owner review: sand-boxer bfe0e4c, be42de7 and 7a61383 add a trusted,
+ephemeral owner Messages route. For metered runs the provider key stays in
+rein's MessagesOwner outside bwrap. The workload reaches it only through a mounted
+owner socket, with empty egress and no child credential routes. The commits also
+add frozen-lock owner runtime builds and refuse stale installed packages. Glas
+reran the focused sand-boxer tests (messages route, runtime builder): 20 passed.
+This changes the GLAS-IN-0002 acceptance shape. "Explicit required egress" for
+the metered profile is empty egress plus the owner socket; it is no longer a
+direct-CONNECT allowlist. The Glas candidate profile (GLAS-WP-0012-T03) must
+target the newly reviewed empty-egress owner profile. Owner T04 still waits on
+provider-to-owner bootstrap, protected install, Railiance placement and live
+compatibility. SECRETS-WP-0009-T03 remains wait, so no real run is possible.
+Status requests were sent on the existing threads: secrets-engine
+`6ea00e6d-c074-4564-a0d0-2137fea20ac0`, approval-engine
+`54ae49cc-ece8-4107-9b76-1477e11280eb`.
+
 ## Delivery receipts
 
 | Owner | Root message / reply thread |