Bind the metered owner route to worker leases and sandbox lifecycle

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

workplans/REINAH-WP-0003-governed-runtime-integrity.md

@@ -736,3 +736,32 @@ truth, and no residual exists only in prose.
    repo has an authoritative validated classification.
 6. Production deployment, recovery checks, CI, package versions, and docs all
    describe and exercise the same supported topology.
+
+### Local owner-route integration return — 2026-09-09
+
+`MessagesOwner` now starts an owner-only Unix Messages listener after the worker
+reserves its parent envelope. The initial accepted Activity Core heartbeat supplies
+its exact expiry, run, worker and attempt binding. Lease loss, timeout, signals,
+gateway exceptions and normal exit revoke the route. A timer also enforces the
+initial lease deadline; heartbeat renewal does not extend this first route.
+Only the opaque token and namespace-local base URL reach the child. Provider key,
+ledger and owner socket directory remain outside the workload's mounts and PID
+namespace. The sandbox refuses direct egress, alternate credential delivery,
+extra host mounts, consumer mismatches and additional sandboxes for this binding.
+
+Real local bwrap tests prove sole-route forwarding, direct host/public-IP denial,
+private-state absence, revocation with no second forward, and teardown. The actual
+worker/Glas/bwrap/ledger path also imports its permitted fixture commit and replays
+a lost terminal close without repeating the request or authoring. Queue, provider,
+credential and authoring remain deterministic fixtures; factory attempts remain 0.
+Worker suite: 377 passed, including installed CLI and real namespace tests.
+Sand-boxer required `make check`: lint clean, 199 tests passed. LLM suite: 264
+passed; changed transport adds no lint/type diagnostics, with existing full-repo
+177 Ruff/36 mypy diagnostics still requiring pre-release disposition.
+
+This closes local source route/lease/token/confinement wiring. Remaining return:
+admitted owner bootstrap that supplies the provider key to `MessagesOwner`, matched
+protected runtime/CLI artifact, Railiance host/profile/consumer/custody/recovery
+admission, live provider compatibility and accepted bounds/tariffs/FX, then G0 and
+natural model/queue evidence. No protected runtime was installed or promoted,
+no existing CCR changed, no secret read or paid execution took place.