fix: separate Glas actor from claim worker identity

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

workplans/REIN-A-0004-glas-profiled-ops-runs.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Profile-driven ops-run execution through Glas"
 domain: infotech
 repo: rein-aharness
-status: blocked
+status: active
 owner: codex
 topic_slug: rein-aharness
 priority: high
 created: "2026-08-22"
-updated: "2026-08-22"
+updated: "2026-08-23"
 related:
   - ACTIVITY-WP-0032
   - ACT-ADR-006
@@ -90,7 +90,7 @@ redaction-by-allowlist, bounding, and unusable bodies.
 
 ```task
 id: REIN-A-0004-T04
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "b19a4dab-d6d7-537a-8c8f-77217f0d9069"
 ```
@@ -124,3 +124,12 @@ backoff. Activity Core handoff `413a4041-cfb3-4d02-a41a-1d92b3de06af`
 contains the production traceback and requests migration application before a
 pilot is scheduled. T04 waits only on that upstream repair and the coordinated
 low-risk proof.
+
+**Resumed 2026-08-23:** Activity Core applied migration `0008` and the bounded
+pilot reached the Glas branch with its selector and refs intact. It refused at
+`sandbox_create` because `OpsRunConfig.worker_id` had been used as the Glas
+actor, conflating queue lease identity (`rein-aharness@railiance01`) with the
+governed actor type (`agt`). Activity Core handoff
+`c9a4ae44-f092-424f-9a4d-9b4cf58d65fd` confirms a direct `actor=agt`
+create/destroy preflight passed and requests the mapping correction plus real
+Glas/sand-boxer model validation before the final pilot.