Safeguard model-switch is sticky — session never returns to the selected model after a flagged turn

To be clear up front: I'm not disputing the model _downgrade_ itself. If Anthropic has decided a flagged turn should be handled by a fallback model, I'll assume there's a reasoned judgement behind it and leave that alone. This issue is about one thing only: the switch is sticky, and it shouldn't be.

The defect. When a message trips Fable 5's safeguard, the session switches to Opus 4.8 — and then stays there for every subsequent turn, including turns that have nothing to do with the flagged content and would never have been flagged themselves. The docs confirm it: _"After a fallback, the session continues on the fallback model."_ There is no auto-restore; the only way back is to manually run /model.

Why this has no justification. The classifier flags a _message_, not a bounded "task." Fine — but that cuts the other way: if evaluation is per-message, the model choice should be per-message too. A later, unrelated, non-flagged turn is being run on the fallback model purely because an _earlier_ turn was flagged. There is no safety rationale for that turn to inherit the downgrade — it wasn't flagged. The "security task" is already over; the system just never looks again.

Impact. On a long or autonomous run, a single flagged turn early on silently degrades the _entire remainder_ of the work to Opus 4.8. The user selected and is paying for Fable 5, receives 4.8 for the rest of the session, and — because switchModelsOnFlag defaults to on — is never stopped to notice. This is worst precisely where it matters: unattended long-running tasks.

Requested fix (in order of preference):

1. Re-evaluate per turn. Apply the fallback only to flagged turns; on the next turn that isn't flagged, automatically return to the user's selected model. The non-flagged turn _is_ the task boundary.
2. Failing that, on completing a flagged turn, notify and offer a one-key restore ("Security task handled — return to Fable 5? [y]").
3. At minimum, surface the persistent-downgrade state on every subsequent turn so it can't silently ride along unnoticed.

Secondary note (not the main point): the fallback for a cybersecurity flag is Opus 4.8, while a biology flag falls back to Opus 5 — so current-generation fallback clearly exists and is used elsewhere. Worth reconsidering, but the stickiness above is the actual defect.

For reference, the banner that appears on a flag:

_"Fable 5's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 4.8. Send feedback with /feedback or learn more."_

Related: #67246.

Environment: Claude Code CLI, Windows 11, model set to Fable 5.