# Child request reservations in the worker envelope

`rein_aharness.request_admission.RequestLedger` implements llm-connect's
owner-hosted Messages meter in the existing private `SpendLedger` database.
It introduces no second daily/total allowance and does not install a service.

The trusted provisioning path calls `RequestLedger.initialize()` before any run
reservation. Missing tables or state refuse; initialization is additive and
cannot reset existing request tables. After the normal validated parent dispatch
reservation, the owner calls `bind_route(run_id, policy_sha256, lease_id=...,
expires_at=...)` with the real accepted lease expiry. This returns one random
token whose hash is stored with run, lease, exact request policy and expiry.
The owner supplies that token and the gateway URL to the workload; no provider
key or ledger path belongs in the sandbox. There is no replacement/renewal path
for a run; expiry or revocation requires owner handling, not workload replay.

Each forward first commits a child hold in micro-USD. Requests serialize with
SQLite `BEGIN IMMEDIATE`; a pending or unknown request blocks additional calls.
Sum of full child liabilities cannot exceed the parent's admitted USD maximum.
Trusted terminal usage charges the full child reservation without refunds.
Known overrun records the larger amount and freezes the whole envelope. Request
receipts contain only bounded IDs/digests, amounts, times and disposition.

Parent observation revokes the route, including unknown accounting results.
Even an apparent successful CLI result cannot settle a parent with pending child
requests. Existing operator reconciliation still requires attested provider
termination and final accounting; it settles child holds conservatively and
never reopens a route or grants another demand attempt. `revoke_route` is the
trusted callback for real lease loss; an expiry also denies new admissions.
In-flight cancellation retains liability until outcome is known.

The downstream protocol is documented in
`llm-connect/contracts/functional/messages-admission.md` (LLM-WP-0009).
The default worker/serve configurations do not yet host or inject this route.
REINAH-WP-0003-T05/T06 and LLM-WP-0009-T03 retain protected owner hosting, real
lease/token wiring, provider custody, enforced egress and bypass proof, accepted
tariffs/FX, runtime installation and admitted real-profile/queue execution.

The installed-CLI fake-provider proof uses synthetic bounds and dummy keys.
With a USD 0.01 parent the same native request is refused with zero upstream
calls; with adequate fixture capacity a two-request tool session succeeds.
That verifies request admission and accounting, not a live EUR ceiling or
owner/workload secret and network separation.

When `AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION` is set, preflight also refuses
before any claim unless the in-process owner carries positive integer
input and output micro-USD upper rates and an `activate` path that can bind
an accepted queue lease to a route token. Those rates are the fixture or
owner pin already on `MessagesPolicy`. They are not a live tariff or FX.
The 2026-10-08 fixture receipt is
`docs/evidence/2026-10-08-fixture-recovery-rate-queue.json`. It does not
deploy the admitted runtime or start a paid request. Activity Core still
owes a reply to message `27cd4c47-117c-46a8-a3cf-204f65caa540`: a heartbeat
409 stays claimed because this worker must not terminal-close a lost lease.

Owner lifecycle and sole-route integration are now documented in
[owner-messages-route.md](owner-messages-route.md). This is local source/fixture
evidence; live bootstrap and placement acceptance remain open.