Restrict launches to prepared runtime images

docs/native-hosts.md

@@ -35,7 +35,8 @@ Status replies still expire normally, and native timeout diagnostics are retaine
    game files, image, capacity and ports required for the launch.
 6. Launch a server or collection. The latest game files and default runtime
    are selected automatically. An advanced runtime override is
-   available. If the latest files change after previewing, refresh the preview
+   available for images an admin has already prepared on the destination host.
+   If the latest files change after previewing, refresh the preview
    before launching.
    Apply saves the requested lobby IDs. Provisioning selects a host and atomically
    reserves UDP/TCP ports when capacity is available.
@@ -153,8 +154,12 @@ memory measurements. Hosts with stale or missing measurements cannot accept new
 servers. Existing API clients may still explicitly constrain a launch to a host.
 
 Queued jobs retain their accepted game-file version. Automatic host preparation
-also downloads the files and runtime images needed by unplaced jobs; a newer
-upload does not remove files still needed by the queue.
+also downloads the game files needed by unplaced jobs; a newer upload does not
+remove files still needed by the queue. Only the configured default runtime is
+pulled automatically. Custom images must already be cached on the selected host,
+or on an active host for automatic placement, before a launch is accepted. Admins
+can prepare them from the host page. Queued launches and migrations never trigger
+custom image pulls, and container creation cannot implicitly pull a missing image.
 
 Only provisioning reserves a host and port. Agent **1.4.6** fixes container
 discovery for resource sampling (the