[Bug] Fable 5 safeguards chain-flag entire sessions: children's song lyrics and routine Korean e-commerce instructions all flagged (6 request IDs)

## Environment

- Claude Code version: 2.1.220
- OS: macOS 15.7.5 (darwin)
- Model: claude-fable-5 (paid subscription)
- Locale: Korean (all work instructions are in Korean)
- `switchModelsOnFlag: false` is set

## Summary

Once a session's context gets classified as cybersecurity-adjacent, **every subsequent user message is flagged by Fable 5's safeguards, regardless of content** — including literal children's song lyrics, casual greetings, and routine e-commerce development instructions. The session becomes permanently unusable with Fable 5. This has been recurring since at least 2026-09-15 across multiple sessions and has cost several working days.

## Flagged messages (verbatim examples, all flagged)

- "뭐여 왜 고장났어" ("huh, why is it broken") — casual remark, flagged. Request ID: `req_011Cf4ep7JmShNCunQNcMTCA`
- "어이 모시모시" ("hey, hello") — greeting, flagged. Request ID: `req_011Cf4eqdhPw7qpWJgBevxfZ`
- "산토끼 토끼야 어디로 가느냐" — lyrics of a Korean children's song about a mountain rabbit, flagged. Request ID: `req_011Cf4esqMBZR3KifC7K94jX`
- "추가 사항은 언급하지 말고 정확하게 기획자가 물어본것에만 답하는것으로 다시 코멘트 구성해서 출력" ("rewrite the comment to answer only what the planner asked") — routine documentation instruction, flagged three times in a row with minor rewording. Request IDs: `req_011Cf4eHWzBnAdbDqBjmL7gM`, `req_011Cf4eKifDJUVfLKzxfdAWm`, `req_011Cf4eMsmx1xZZa31Y1x1Uh`
- "이제 네가 확인한 인수인계 문서와 설계서에서 공급사 지역별 배송비 페이지가 제대로 보이지 않아서 보류되었던 모든 항목을 확인해" ("verify all items that were on hold because the supplier regional shipping fee page wasn't displaying") — e-commerce admin work instruction, flagged (2026-09-19).

None of these messages contain security content. The flags chain: after the first flag in a session, essentially every message is flagged.

## Suspected mechanism

Per the support article (15363606), safeguard checks "review everything the model reads, not just your latest message — including memory, content from connectors, web search results, and files."

Our project is a large Korean e-commerce platform. The repository's project instructions (`.claude/rules/`) include a **defensive security review checklist** (OWASP-style: SQL injection detection patterns with example payloads such as `pg_sleep`, XSS filter-bypass examples, WAF regexes) that is auto-loaded into every session's context by design, for code-review purposes. Combined with legitimate admin-panel browser automation for QA (logging into our own test malls), the resident context appears to trip the cybersecurity classifier — after which no user message can pass, no matter how innocuous.

This matches #85041 (vocabulary matching over intent) and #83939 (trivial prompts flagged), but adds two data points not covered there:

1. **Chained flagging**: the unit of false positive is the *session context*, not the message. "Edit prompt and retry" is useless advice when a nursery rhyme gets flagged.
2. **Non-English users**: all flagged instructions are ordinary Korean business language.

## Impact

- Multiple working days lost between 2026-09-15 and 2026-09-19 on a paid plan.
- With `switchModelsOnFlag: false`: the session pauses on nearly every message.
- With the default (auto-switch): work silently degrades to Opus 4.8 mid-task.
- Repeatedly abandoning sessions and re-handing-over context to fresh sessions is the only workaround found, and it does not last.

## Requests

1. Evaluate flags against the *current message intent*, not only accumulated context; or decay/reset the classification instead of chain-flagging entire sessions.
2. Whitelist or down-weight defensive security *checklist/documentation* content in project instruction files — this is standard practice in enterprise repos (secure-coding rules are exactly the files teams load into review context).
3. Document what was flagged (category at minimum) so users can act, instead of guessing.
4. Review the attached Request IDs as false-positive samples.

Start by reviewing the reported Request IDs, support article 15363606, and the project instructions under .claude/rules/. Compare the chained flags against the listed Korean messages and defensive security checklist content. Done means the reported false-positive pattern is addressed or clearly characterized, including whether session context, intent, and flag categories behave as requested.

Written by the indexing model from the issue text.