ACP silently keeps the native default when a selected model is excluded by the session catalog #26621

Area

ACP provider adapter / account-restricted model selection

Problem

An ACP session can offer a smaller model set than a saved provider catalog or thread selection. This matters for corporate allowlists, plan restrictions, or permissions changed after a thread was saved.

On current main (9e09926d97824179d97311d1a810c6b5bb60d2d1), configureSession only applies an explicit selected model when it appears in the session's model config or legacy availableModels. If it is absent, the adapter skips the write and still opens the provider session using the requested selection. It does not reject the unavailable choice before starting the run, leaving the agent's native default in place.

Deterministic reproduction

1. Return a successful ACP session/new whose current model is Model A and whose available choices contain only Model A.
2. Open a T3 thread with the explicitly selected Model B, representing a previously saved catalog choice that the active account no longer permits.
3. Exercise both native configOptions model selection and legacy models.availableModels.

The new cases in the existing ACP model-write orchestrator replay test fail on main: the run becomes running instead of failing with a model-selection error. The existing cases where the agent explicitly rejects the model write already pass; this missing-catalog branch skips that protection entirely.

Expected behavior

For an explicit model excluded by a session's advertised catalog, fail before inference with the existing actionable model-selection error. Preserve default/auto behavior and existing validation of user-configured custom IDs. Do not broaden an account's ACP catalog by substituting devin models list output, and do not silently use another model.

Verification scope

The public-catalog/session-subset scenario is reproduced with controlled ACP protocol replays. A real Devin Free account separately exposes only SWE-1.6 Slow through stock T3 ACP even though the CLI catalog is broader. No corporate credentials or production corporate account were used; the corporate-policy case is covered by the restricted-session fixtures.

This is separate from #15177, which assigns one model's option descriptors to other models. It is also separate from #19699, which explains an explicit native model-write rejection; here no model write is attempted.