Reserve provider requests inside the durable worker envelope

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

workplans/REINAH-WP-0003-governed-runtime-integrity.md

@@ -672,6 +672,24 @@ Do not infer network/credential confinement from direct CLI tool rules: indirect
 Git helpers remain inside the sandbox owner's responsibility. No paid request,
 credential read or deployment was performed during the fixture proof.
 
+### Provider request admission return — 2026-09-09
+
+Implemented child request holds in the existing worker envelope and consumed
+llm-connect's opt-in Messages transport (LLM-WP-0009). Real HTTP/SQLite proofs
+cover exhaustion, simultaneous admission, unknown outcomes, replay, lease loss,
+cache accounting and full-charge recovery. Parent terminal observation now
+revokes the route and cannot settle unresolved children. The installed CLI
+counterexample makes zero upstream calls through the guard; a permitted two-call
+tool session creates its file. Worker full suite: 360 passed; llm-connect: 263
+passed. All provider responses, keys, bounds and FX are fixtures.
+
+See [request admission](../docs/request-admission.md). T05 remains progress for
+protected owner hosting, actual queue lease/token injection and revocation,
+provider custody and direct-route denial, accepted tariffs/FX and matching
+runtime installation. LLM-WP-0009-T03 retains the transport integration return;
+T06 remains wait for admitted real-model/natural-queue evidence. No production
+policy, listener, credential, deployment or paid attempt was created.
+
 ## Re-prove one governed profiled run and close residuals
 
 ```task