/model switch to a classifier-incompatible model bricks all non-trivial commands; error misreports it as a transient outage

Summary

Switching the session model with /model <id> to a model the permission classifier can't use silently bricks every command that needs classifier approval (all non-trivial Bash, plus Edit/Write), until you switch back. Two distinct defects compound it:

1. /model accepts the new model with no validation and no fallback for the classifier path.
2. The resulting error reports a permanent config problem as a transient outage, which drives users into a pointless retry loop.

Environment

• Claude Code 2.1.162
• Auto / default permission mode

Repro

1. Start a session on a normal GA model (e.g. claude-opus-4-8). Confirm bash/node/etc. commands work.
2. Run /model <some-other-model-id> (in my case an experimental id).
3. Run any non-trivial command, e.g. node -e "console.log(1)" or bun install ....

Actual

Every command routed through the LLM safety classifier fails with:

<model-id> is temporarily unavailable, so auto mode cannot determine the safety of Bash right now. Wait briefly and then try this action again.

• Statically-safe read-only commands (echo, ls, grep) still pass, because they bypass the classifier. This makes the failure look intermittent when it is actually deterministic: 100% of classifier-path commands fail, 0% of static-path commands fail.
• The main chat loop keeps working on the new model, so the model itself is reachable - only the classifier path is broken.
• The "temporarily unavailable / wait briefly and try again" wording reads as an Anthropic-side outage, so the natural response is to retry. Retrying never works; the only fix is /model <GA-model>.

Expected

One or more of:

• /model validates that the target model can serve the permission classifier before switching, and rejects/warns if not.
• The classifier falls back to a default model when the session model can't serve it, instead of hard-failing every command.
• The error distinguishes "this model can't run the safety classifier - switch models with /model" from a genuine transient outage, so users don't retry-loop.

Impact

A single /model switch can make a session appear broken in a way that's hard to attribute - the error blames an outage, the failure looks intermittent, and the actual cause (the model switch) is never surfaced.