[atyrode]

Problem

The workbench's main control had a separate Review step between a saved team and its launch, and it ran on its own: any observed input that moved (an account observation refresh, the model list's check status, OMP defaults, an account plugin restart) revoked the saved team's review and re-ran it after a short settle, so the control flipped between Launch, Review and Reviewing… without a press. An edited team whose projection was not grounded offered Save & review, which stopped at the review.

Agent Run launches could also fail on a busy agent plugin: Manifold validates the Agent's profile with a context-free request that needs OMP's isolate to serve nothing else, and otherwise answers unavailable with exclusive request requires a drained guest, which the panel showed raw. On the preview both observed launches failed that way while ordinary panel reads were in flight.

Change

• No review step. nextLaunchStep has verify | save | launch; the review step, the review intent, the auto-review (autoReviewDue, AUTO_REVIEW_SETTLE_MS), grounded and the Review, Save & review and Reviewing… labels are gone. Nothing reviews without a press.
• One press. launch() reviews the session immediately before starting it and goes on when the review shows what the panel showed (reviewMatches). One that differs is held (HeldReview) and the press stops with "What will run differs" and the differences; the next press launches the held review while it stands. A hold stands on the press's own inputs (team, options, machine, saved profile, authority) and explicit pins (OMP defaults and skill catalog revisions, successful reads, its launch still being the step), and is dropped for good the first time one fails. A press stands on the same inputs, so an observation that moves meanwhile no longer stops it; the launch already re-reads the accounts and OMP defaults itself (reviewedComposition).
• Save & launch chains straight to the launch once the saved revision is observed (only Save, with no chain, where no canvas can place a terminal).
• Busy validation is retried. createCodeWorkflowClient asks again core.access.registerAgentV2, updateAgentV2 and launchRun (the doors that validate the Agent's profile) when refused with exclusive request requires a drained guest or profile validation requires exclusive guest access, after 150/300/600/1200 ms; a refusal that outlasts that reads "OMP was busy for a moment. Try again." and the Run is cancelled as before. No other door is retried, so a model check's cancellation and currency checks are untouched. Launch-related refusals no longer tell the person to "Review again".
• Clean cutover: unused effectiveSkillMode/effectiveSkillCount removed; the scope only resume still uses is named for it.
• Docs: docs/configuration.md (the launch, one press, the workflow contract), README.md, docs/status.md (the busy-validation evidence boundary).

Evidence

• Unit tests: 452 pass. New: a busy launchRun and a busy registerAgentV2 are asked again and the launch goes on; a busy refusal that outlasts the retries is said in words and its Run cancelled; a non-validating door is never retried; reviewDifferences and the "What will run differs" line. Both busy tests fail without the retry.
• Browser verifier (verify-browser.ts, real Chromium, real pinned OMP bundles): the launch reads launch ready through ~6.6 s of re-reads with no reviewSession; one press dispatches reviewSession then the launch doors (Agent Run doors or prepareSession), reading launching… throughout; Save & launch reads save & launch → saving… → launching… in one press; a canvas-less Save never reads launching…; a press whose own review shows an account pool the panel did not show stops on "What will run differs", the line survives ~3.4 s of re-reads, and the next press launches it with no new reviewSession.
• Real surface (design lab, Chromium, omp-updated, authoring): the label stayed launch | ready for 15 s idle with no reviewSession; one press went launching… → review → session preparation (the lab refuses the session) → launch | ready with the refusal on the line; an edited team read save & launch, then saving… ("Saving the workspace profile") → launching… ("Opening a terminal on …") in the same press; no sideways scroll at 390 px.
• scripts/gate.sh at b71c261605: exit 0 (tsc, 452 unit tests, pack, consumer, hardened and packaged verification, browser PASS (485s), native). An earlier gate run at the same head failed once in the kept-checks scenario at "the machine list opens" (the machine dropdown on a freshly opened workspace, a step this change does not touch); the browser verifier alone then passed, and so did this full gate.
• Independent review (two rounds): every finding fixed or answered; final verdict pass.

Closes #275

[atyrode]

Independent review at b71c26160550bbf9367b59c78de1bedfbe6290cf: pass (three rounds; every blocker and major finding fixed). CI at this head: agent-policy, plugins / verify and test pass. Local scripts/gate.sh at this head: exit 0. Minor follow-ups from the last round are tracked in #277.