command-code: catalog lists models the account gets MODEL_NOT_IN_PLAN (403) for #7684

OpenCodex can list a Command Code model the account's plan does not include. Codex and GOAT then select it, and every request fails.

Seen on 2026-10-24 (goat-si/goat#1205): a host's Codex model cache and opencodex-catalog.json (written by an older ocx, 2.83–2.86) still offered command-code/google-gemini-4-argon as a selectable model. Requests to it through POST /v1/responses returned:

Provider error 403: {"success":false,"error":{"code":"FORBIDDEN","status":403,"message":"MODEL_NOT_IN_PLAN: Gemini 4 Argon available in Pro and above plans or extra on demand usage"}}

Codex retried it 5/5 times per turn. A newer ocx (2.90.0) no longer lists the model, so this may be partly fixed already. The asks:

1. Do not list a Command Code model in the catalog when the account gets MODEL_NOT_IN_PLAN for it, or drop it after the first such 403.
2. Consider returning a 403 MODEL_NOT_IN_PLAN in a form Codex treats as non-retryable, so a turn does not spend five retries on a refusal that cannot change.

GOAT's side (classify the refusal as a permission error and let fallback chains move past it) is goat-si/goat#1205.