[BUG] Fable 5 = "Self-caged" : the model's own output (`fork`/`kill`/`orphan`/`reap`) trips its own classifier midstream — input rewording can't fix it

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Self-caged — Fable 5 trips its own classifier on its own legitimate output.

On official Claude Code web, a correct answer to benign systems-programming work is semantically inseparable from standard, unavoidable technical identifiers. In practice, Fable 5 begins answering correctly, and then — after it has already generated part of that correct answer — the session switches to Opus 4.8. Because the switch happens after generation has visibly started, and not before the first token, the trigger is in the model's own emitted output, not in the user's prompt. That is exactly why rewording the request does not help: the flagged tokens are the ones Fable must produce in order to answer correctly at all.

Benign identifiers that get flagged — process supervision / syscall ABI:
fork · vfork · clone · kill · ForceKill · killpg · tgkill · waitpid · wait4 · SIGKILL · SIGTERM · SIGCHLD · PR_SET_PDEATHSIG · setsid · signalfd · orphan (orphan process) · zombie (zombie process) · reap / reaping · daemon

⚠️ Highest-frequency triggers in practice: force kill orphan and drop orphan (orphaned relationship entries / rels)

Same failure — file-format / metadata processing:
adversarial · payload · exploit · inject · escape / escaped / unescape · bypass · sanitize / scrub · exfiltrate · leak · tamper · spoof / forge · redact · privacy-surface · PII · miscased

Every term above is standard, benign software-engineering vocabulary. None describes offensive tooling. Yet merely reading a .md design doc containing them — or generating a correct answer that must use them — causes the session to fall back to Opus 4.8.

What Should Happen?

In a benign low-level-systems or file-format-processing context, the model's use of unavoidable standard identifiers (fork / kill / waitpid / orphan / reap / zombie, or payload / sanitize / adversarial) should not, by itself, constitute a trigger. These must be calibrated separately from genuine offensive-tooling signals such as exploit construction, malware behavior, or persistence and obfuscation techniques.

Additionally, when a user has explicitly selected Fable 5, that selection should persist for the remainder of the session, rather than the conversation silently staying on the fallback model after a single trigger.

Error Messages/Logs

Steps to Reproduce

1. Official Claude Code web, model Fable - MAX
2. Work in any codebase that legitimately involves low-level process/signal management, or standards-compliant file-format and metadata processing.
3. Phrase the request in fully neutral, non-adversarial language.
4. Observe: Fable 5 begins a correct answer, then — after it has already generated part of that answer — the session switches to Opus 4.8, at the point the answer necessarily reaches standard technical identifiers (e.g. fork / kill / waitpid / orphan / reap).
5. Input-side variant: merely having Fable read a .md document containing such standard terms is sufficient to cause the switch — on content the user never typed.
6. Note that rephrasing the request does not prevent case (4), because the trigger is in the generated output. Once switched, the session stays on Opus 4.8 for the remainder of the conversation, with no way to switch back to Fable 5.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

not obtainable in the web UI

Platform

Other

Operating System

Other

Terminal/Shell

Other

Additional Information

_No response_