Typed runtime messages with trusted provenance and bounded payload/TTL.

Payload and status messages never start a model run. Only task requests can trigger admission, and that decision remains with the receiving policy.