Close local release-quality gaps and reconcile workplan status

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e332-3365-77c0-8491-084e9ea33ac1

contracts/functional/messages-admission.md

@@ -8,12 +8,14 @@ REINAH-WP-0003-T05/T06.
 ## Contract
 
 The owner constructs immutable `MessagesPolicy` with an exact model, tariff
-reference, maximum admitted context/output, integer micro-USD per-token upper
+reference, input liability context/output ceiling, integer micro-USD per-token upper
 rates, explicit beta allowlist, body limit and request timeout. There is no
 built-in live price, FX source, token estimate or default beta grant. Input rates
 must conservatively cover input, both cache-write lifetimes, cache reads and all
 accepted multipliers. Accepted provider limits and tariff validity remain an
-operator policy responsibility; a fixture policy cannot establish them.
+operator policy responsibility; a fixture policy cannot establish them. The input
+context is a reservation assumption, not an enforced token cap: it must cover
+the provider's maximum accepted context for the admitted model/features.
 
 `RequestMeter.reserve_request(token, policy_sha256, liability_microusd)` must
 atomically check authority and remaining parent capacity, persist the hold and
@@ -57,14 +59,18 @@ the parent already binds worker, definition, project, target, grant and runtime
 digests. Route tokens are random, stored only as hashes, cannot be rebound or
 renewed by the workload, and revoke on parent terminal observation.
 
-The next integration must host the listener in the trusted owner boundary, keep
-provider credentials and ledger inaccessible to the sandbox, deliver only its
-run token/base URL, bind actual lease loss to route revocation, and prove direct
-provider and alternate-route denial. This module does not install a listener,
-configure a sandbox, resolve credentials, or promote a profile. The installed
-CLI fixture demonstrates transport/ledger behavior in a fake-provider namespace;
-it does **not** prove secret or network separation between real owner/workload
-processes. LLM-WP-0009-T03 retains this owner integration return.
+Rein's `MessagesOwner` now hosts the private listener, binds the accepted queue
+lease, delivers only the run token/base URL, and revokes on lease loss or exit.
+Real local bwrap tests prove owner/workload state separation and direct-route
+denial using a fake provider. The factory's 2026-09-10 placement receipt also
+records synthetic checks of a pinned protected artifact on Railiance. The
+2026-09-27 return additionally records the approved corrected owner/Secrets Engine
+installation and a synthetic two-request tool/result proof on runtime `b6e4e8a4`,
+profile `harness.agent-dev-local@1.1.1`. The inactive EUR 10 proposal and remaining
+native approvals are recorded in LLM-WP-0009-T03; no paid proof is claimed.
+This module does not resolve credentials or promote a profile. Native credential
+delivery, service/profile admission and recovery, accepted live provider policy,
+and admitted model/queue evidence remain open under LLM-WP-0009-T03.
 
 ## Verification and primary protocol references
 
@@ -91,6 +97,6 @@ At most 16 request handlers are active; idle header reads time out. TCP host/por
 selection cannot coexist with Unix mode. The protocol and durable meter interface
 are unchanged. Rein's MessagesOwner supplies the private listener, accepted lease
 and cancellation hooks; sand-boxer mounts only the socket and enforces sole routing.
-The provider key and ledger remain outside the workload. This source/library path
-is tested with a fake provider; accepted custody, protected bootstrap/artifact and
-Railiance placement are still required by LLM-WP-0009-T03.
+The provider key and ledger remain outside the workload. The source/library path
+and installed bootstrap/artifact were tested with a fake provider; accepted
+native custody and service admission remain required by LLM-WP-0009-T03.