Safeguard model switch (Fable 5 → Opus 4.8) persists for the whole session; selected model is never restored

### Environment

- Claude Code 2.1.241
- macOS (Darwin 25.5.0), zsh
- Model selected: Fable 5

### Summary

When a safeguard classifier flags a message and switches the session from Fable 5 to Opus 4.8, the
switch applies to the **entire remaining session**, not just the flagged turn. The explicitly
selected model is silently discarded for hours.

The notice shown is:

> Fable 5's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver
> more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology
> tasks. Switched to Opus 4.8. Send feedback with /feedback or learn more:
> https://support.claude.com/en/articles/15363606
>
> Details: `[cyber]`

### Steps to reproduce

1. `/model` → Fable 5 (confirmed with "Set model to Fable 5 and saved as your default for new sessions").
2. Work in a repository whose subject matter trips the `[cyber]` classifier (in my case an ordinary
private crypto-wallet backend — testnet only, see #3 in this series).
3. Observe the "Switched to Opus 4.8" system notice.
4. Keep working normally.

### Expected

The switch covers the flagged turn only and the next turn returns to the selected model — or the UI
states clearly that the session is now pinned to the fallback, and offers a way back.

### Actual

Every subsequent turn runs on `claude-opus-4-8`. Verified from the local session transcripts
(`~/.claude/projects//*.jsonl`), where each message carries a `message.model` field. Six
switches across five sessions, 2026-08-19 → 2026-08-24, all tagged `[cyber]`:

| Session | Switch at (UTC) | Model at session end | Time on the unselected model |
|---|---|---|---|
| A | 2026-08-19 12:10:37Z | `claude-opus-4-8` | ~2h18m, to session end |
| B | 2026-08-20 08:09:42Z | `claude-opus-4-8` | ~6h32m, to session end |
| C | 2026-08-20 17:39:03Z | `claude-fable-5` | ~14m, then reverted with no user action |
| D | 2026-08-20 20:21:30Z | `claude-opus-4-8` | ~1h23m, to session end |
| E | 2026-08-24 07:03:24Z | (see below) | ~4h29m, until manually re-selected |
| E | 2026-08-24 11:33:22Z | — | re-flagged 2m33s after re-selecting Fable |

Two things stand out:

**It is non-deterministic.** Session C reverted to `claude-fable-5` on its own after ~14 minutes.
Same day, same repository, same `[cyber]` tag, opposite behaviour from sessions A, B, D and E.

**Re-selecting does not help.** In session E I ran `/model` → Fable 5 at 11:30:49Z; the next
substantive prompt was flagged and switched back at 11:33:22Z. That is **2 minutes 33 seconds** of
the model I chose. In this repository Fable 5 is effectively unusable.

### Impact

The user selects — and pays for — one model and silently receives another, for hours, with no
persistent indicator anywhere in the UI that the session is running on a fallback.

### Related

See the companion issues in this series: the model also *denies* the switch when asked, and the
`[cyber]` classifier appears to be firing on ordinary development work.

Start with the `/model` entry point and inspect the local session transcripts at `~/.claude/projects//*.jsonl`, especially each message's `message.model` field around a safeguard switch. Reproduce the Fable 5 to Opus 4.8 transition and determine whether the selected model is restored after the flagged turn. Done means subsequent turns use the selected model, or the UI clearly indicates and permits recovery from a persistent fallback.

Written by the indexing model from the issue text.