[Bug] `opusplan` silently falls back to Sonnet during plan mode (no signal)

Environment

• Product: Claude Code (CLI)
• Model configuration: ~/.claude/settings.json → "model": "opusplan" (persistent global config, not a session-only /model override)
• Platform: macOS (Darwin 25.5.0)
• Observed across multiple sessions over several weeks

Symptom

opusplan is intended so that plan mode runs on Opus and execution mode automatically switches to Sonnet. In practice, plan-mode turns have been observed running on Sonnet even though settings.json was verified (by reading the file, not by assertion) to contain "opusplan" at the time. There is no error, warning, or status-line signal when this happens — the only tell is behavioral (an agent reasoning at Sonnet-level depth on a plan-mode turn), or session inspection after the fact.

Expected behavior

When settings.json .model is "opusplan":

• Every plan-mode turn executes on Opus.
• Every execution-mode turn (post plan-approval) executes on Sonnet.
• If the runtime cannot honor this (availability, rate limit, internal fallback), it should surface a visible signal — not silently downgrade a turn the user believes is running on Opus.

Actual behavior

• Plan-mode turns have executed on Sonnet despite a verified-correct "opusplan" setting, with no error or status-line indication of the fallback.
• In one session the settings.json .model value itself was found silently rewritten to "sonnet" outside of an explicit user action — cause unconfirmed, but noted as a related data point since it compounds the trust problem (a user can no longer assume "I set opusplan and it stayed set"). This may be a separate config-integrity bug.

Impact

• Silent model downgrade during plan mode undermines the entire reason opusplan exists (Opus-quality planning, cost-optimized Sonnet execution).
• Because there is no error signal, the only detection mechanism is behavioral suspicion + manual file re-verification. A local SessionStart hook can warn on config drift at session start, but cannot detect a silent per-turn fallback.

What we've ruled out

• Not a one-time typo: verified in multiple independent sessions.
• Not solely a stale /model override, since the underlying file was read and confirmed correct at the time of at least one occurrence.

Ask

1. Confirm whether opusplan is intended to guarantee Opus for every plan-mode turn, or whether silent fallback-to-Sonnet is expected under some condition (rate limiting, availability).
2. If fallback is by design, add a visible signal (status-line marker, transcript annotation) when a plan-mode turn executes on a model other than Opus.
3. Separately investigate whether settings.json .model can be silently overwritten by a /model session override — if confirmed, that is an independent config-integrity bug.