Launch runs the model check itself; checks belong to the person and renew on their own

AGENTS.md

@@ -151,6 +151,7 @@ comments, never another contributor's branch. Published tags are immutable.
 | `plugins/code/contract.ts` | Code action schemas and the policy-only typed client |
 | `plugins/code/context.ts` | Minimal guest context, named refusals and canonical digests |
 | `plugins/code/state.ts` | Container-scoped CAS state, explicit legacy adoption, the named schema-2-to-3 native migration and lazy schema-3-to-4 reads |
+| `plugins/code/checks.ts` | A person's kept model checks, by exact account pool, and their standing approval of what checks spend |
 | `plugins/code/server.ts` | Governed Code policy handlers; no OMP proxy |
 | `plugins/code/workflow.ts` | React-free ordinary Code/OMP/native-deployment workflow used by web and headless clients |
 | `plugins/code/service-{setup,policies}.ts` | Optional external suggestion classifier only |
@@ -168,7 +169,7 @@ comments, never another contributor's branch. Published tags are immutable.
 
 1. **Manifold is the application.** Identity, grants/consent, durable storage and migrations, native resources, jobs, locations, terminals and traces stay native. Code never adds another ACL, inventory, job store, terminal transport or lifecycle supervisor.
 2. **OMP owns all agent runtime behavior.** The OMP plugin alone owns broker/gateway placement, sign-in, credential storage/refresh, observations and controls, workspace operations, inventory/benchmark and session preparation. Code calls its public typed doors as the principal; it never proxies, aliases or copies them.
-3. **Code state is container-scoped policy.** Canonical schema version 4 has accounts, catalog draft/active documents with their verification provenance (`null` when unverified), and selection only. Machine id is an execution choice, not a storage key. Mutations use exact native CAS. Schema version 2 is transformed by the named guest migration; schema version 3 reads as schema 4 with unverified catalogs and is persisted as schema 4 by the next CAS write, because a bulk pass would exceed the host's migration staging bound; schema version 1 is adopted only when a caller explicitly names its legacy machine and no canonical record exists.
+3. **Workspace profiles are container-scoped; model checks belong to the person.** A workspace's canonical record, schema version 4, has accounts, catalog draft/active documents with their verification provenance (`null` when unverified), and selection only. A verified list a check stages is also kept as the checking person's check of its exact account pool and budget, beside that person's standing approval of what checks may spend. Both are keyed by the caller's principal, kept only for a person whose sign-in reaches the workspace root, and never read or written for anyone else. A workspace whose saved choices select a kept pool adopts the check into its own record instead of checking again, so `runSession` callers still read a workspace. Machine id is an execution choice, not a storage key. Mutations use exact native CAS. Schema version 2 is transformed by the named guest migration; schema version 3 reads as schema 4 with unverified catalogs and is persisted as schema 4 by the next CAS write, because a bulk pass would exceed the host's migration staging bound; schema version 1 is adopted only when a caller explicitly names its legacy machine and no canonical record exists.
 4. **No account broadening.** Saved choices identify concrete OMP service scope plus OAuth identity or positive credential slot. Missing/stale/changed observations refuse. An operational ownership transfer may rebind only after proving the same provider, credential id and concrete identity/slot; never alias the old scope or match ambiguous email.
 5. **Every effect is re-reviewed at its owner.** Code composition, OMP defaults/accounts/destination, native deployment and service policy revisions are independent. The headless workflow re-observes them immediately before effects. A checkbox, installation, retained job or terminal placement is not authority or provider success.
 6. **No source staging.** Pack from immutable in-memory generated metadata and worker bytes through Manifold's `compilePlugin`; never copy source into a replaceable temporary tree. The generic development/verification order comes from finished bundle manifests, not directory names or caller summaries.

README.md

@@ -40,9 +40,9 @@ quota preservation and Code-owned upstream fallback repair are not planned.
   or wheel, each model shown by its short alias per tier, with **Defaults** and
   **Revert** in its head and a readout line that says what a pointed word does,
   including to quota where it strands a role or leads on a strained pool. A lane for
-  a signed-in family the model list lacks is struck, and pressing it starts **Verify
-  models**. Cost and speed meters sit above a launch row that names the next step
-  (Verify models, Save & launch, Launch) beside a dropdown of the machines it can run
+  a signed-in family the model list lacks is struck, and pressing it checks the models,
+  which finds them. Cost and speed meters sit above a launch row that names the next step
+  (Launch, Save & launch, Review) beside a dropdown of the machines it can run
   on; a machine without OMP is refused like an offline one. When the step is refused it
   stays focusable and the launch line names what failed (the accounts, the workspace
   profile, OMP missing from the machine) with a fix. **Routing** beside it lists every
@@ -56,12 +56,22 @@ quota preservation and Code-owned upstream fallback repair are not planned.
   **Shortcuts**, with a short key line that a touch screen does not show. Launch is
   task-less: the task is typed in the session. Empty workspaces derive a render-only
   starter from OMP's passive bundled model metadata, so exploring needs no models,
-  credentials or runtime setup; saving starts with **Verify models**. Stored active
-  policy always wins. Models (the list as one ladder per provider, its verification
-  and charge, a staged list, import and export), Setup (one checklist of what the
-  machine needs, with the profile's facts and the classifier) and Options (profile
+  credentials or runtime setup. Stored active policy always wins. Models (the list as
+  one ladder per provider, its check and charge, a staged list, import and export),
+  Setup (one checklist of what the machine needs, with the profile's facts, the
+  standing approval of model checks and the classifier) and Options (profile
   switches, skills and automation for one launch) open as sheets. An unsaved profile
   survives a reload in the tab.
+- **Model checks:** a launch needs a model list checked against the account pool,
+  and Launch runs that check itself when the list in use cannot serve it (a first
+  launch, a model OMP no longer lists, or a lead the accounts no longer serve), then
+  goes on to the review and the launch. The first check asks the person to approve its
+  cost, once: later checks within twice that charge run without asking, and Setup can
+  withdraw the approval. A finished check is kept as that person's check of the exact
+  account pool, so another workspace whose choices select the same pool adopts it on its
+  first launch, without spending. When accounts change, a check renews a list that passed one on its
+  own while the panel is open, within the approval, and Launch keeps working with the last
+  list that passed meanwhile.
 - **Agent launch:** the launch is still one press. Where an Agent Run can carry it,
   Code registers one Manifold Agent per sponsor and workspace profile with OMP's TUI
   harness, updates it when the profile changes, and launches a Run whose terminal is