[jamie950315]

Problem

The experimental client model catalog can aggregate native Codex and third-party provider models. Native routing currently treats that shared catalog as evidence that a ChatGPT account with no account-specific catalog can serve every listed model.

In a mixed-account installation this allowed gemini-4-argon to select a ChatGPT credential instead of its API provider. The upstream rejected it with model_not_found. A subsequent continuation could then fail locally with continuation_history_incomplete / cipher_incompatible when the gateway tried to rebuild the provider history for the wrong route. Background GPT requests sharing the same logical thread made this observable during continuation.

Changes

• Separate cold ChatGPT model admission from the aggregate client catalog: retain built-in Codex defaults and explicitly listed GPT/Codex models, without admitting third-party model names from that catalog.
• Apply the check to automatic native ChatGPT routing and the cold official-authorization catalog path.
• Preserve provider-account catalogs, explicit mappings, and fetched official account catalogs.
• Add a regression covering Gemini rejection for cold ChatGPT credentials, Gemini acceptance for its provider, native GPT availability, and authoritative fetched account catalogs.

History, opaque reasoning carriers, and encrypted-history safety checks are unchanged. This is independent of the tool-name restoration fix in #2901.

Validation

The same Rust source changes were validated on the local v1.3.73 repair installation. Current main differs from that base only in documentation/Homebrew files, with no intervening src-tauri changes.

• New model-scope regression: 1 passed.
• Existing native_provider_routes_tests: 8 passed.
• Existing native_chatgpt_plan_tests: 13 passed.
• Production release build with tauri/custom-protocol: passed.
• Installed, signed macOS application: API health and rendered dashboard passed.
• Original affected Gemini conversation: resumed on its existing API provider with HTTP 200, and continued executing tools and agent work.

git diff --check passes. cargo fmt --manifest-path src-tauri/Cargo.toml --package cockpit-tools -- --check reports existing repository-wide formatting differences, including untouched src/commands/announcement.rs and src/commands/codex.rs; unrelated formatting is excluded from this PR.