Document workbench-host default on pulled Ollama models

ARCHITECTURE.md

@@ -61,6 +61,13 @@ every read, never copied down at creation time. A sub-workbench or child
 tenant never gets a snapshot of its parent's catalog; it always sees the
 parent's current state.
 
+The workbench host's default inference model is chosen from that
+visible catalog: tenant-owned (direct) completion offerings beat
+inherited catalog seeds when any exist; an inherit-only catalog still
+picks the inherited completion default. Embedding models stay
+ineligible. This is a preference among what the ancestor walk already
+shows, not a snapshot and not a second catalog.
+
 See [docs/TENANCY.md](docs/TENANCY.md) for the full contract, including
 the workbench-owned discriminator that distinguishes a "real" bench from a
 workbench's own child tenancy (native tenants carry no `kind` field), and

IMPLEMENTATION.md

@@ -236,6 +236,29 @@ These are unit-tested control-flow facts. Live Canva OAuth against
 Canva's own servers is **not** verified; do not document a proven live
 handshake.
 
+## Workbench-host default inference
+
+`selectDefaultInferencePreferences`
+(`packages/chat/src/inference-preferences.ts`) builds the preference
+list a workbench host launches with (`workbenchHostInferencePreferences`
+on the chat adapter; also `tenantDefaultModel` on agent-definition
+routes). It keeps credentialed completion-capable offerings
+(`preferCompletionCapable` in `@workbench/hub-client/model-capability`
+— embedding names never win) and, when any survivor is
+`origin.direct`, picks from that direct set only. Inherit-only catalogs
+still sort among inherited completion rows.
+
+Ollama connect is the case that used to lose: discovery
+(`GET /api/tenants/:id/models`) includes inherited `CATALOG_SEEDS` rows,
+so the curated name (`CATALOG_SEEDS.ollama.models[0]`) could win a
+name-sort without living on the instance. `resolveOllamaModelSource`
+(`packages/onboarding/src/complete-credential.ts`) therefore also reads
+tenant-owned `GET /api/tenants/:id/catalog/models` (paginated
+`ModelResponse` envelope) when discovery contains that curated name. A
+non-empty owned list restricts candidates to those names; an empty owned
+list keeps inherited discovery. Other providers still pin
+`CATALOG_SEEDS[provider].models[0]`.
+
 ## Related docs
 
 - [README.md](README.md) — quickstart, local setup, repo layout, e2e detail

PRODUCT.md

@@ -69,6 +69,13 @@ lands in Myra's one DM rather than `/new` or an empty shell:
    (`openAgentDm` / find-or-reopen). There is no parallel Myra home
    route. `/new` stays the create door (sidebar `+`), not this hop.
 
+Connecting a local Ollama uses a completion model that instance has
+actually pulled, so Myra's first DM message is a real agent turn — even
+on a machine that only has models like llama3.2 or qwen3. An inherited
+catalog seed the instance never pulled is not the default when the
+tenant already owns a pulled completion model. Embedding models never
+become that default.
+
 Create stays on `/new` (`apps/web/src/pages/new-workbench-picker.tsx`):
 a prompt box is the primary act: typing a goal and submitting mints an
 empty channel and sends that text as the first message; blank plus