The set_model and session-initialization code paths now verify model names against the allowlist before applying them. If a model is not allowed, the change is rejected and the user sees an actionable warning message instead of the session silently using an unexpected model.
Evidence
Updated onSetModel handler (search for "model-restricted-bridge-")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.