False-positive session abort on benign ACA cryptogram/cipher-solving vocabulary

Description

Claude Code sessions working on a classical cryptogram/cipher-puzzle-solving
toolkit (American Cryptogram Association style puzzles — Aristocrat, Patristocrat,
Playfair, Bifid, Keyphrase, etc.) intermittently get hard-stopped mid-session:
the assistant states it can't continue and that a new chat should be started.
No actual policy-violating request was made — this is recreational/hobbyist
puzzle-solving software development, not an attack on any real system.

This matches the pattern already reported in #67132 ("benign crypto/backend
dev context with security-adjacent vocabulary") and the context-accumulation
mechanism described in #74734 and #63751 ("one hit contaminates entire
session," classifier scores accumulated conversation context rather than the
triggering message alone).

Suspected trigger

The project's own domain vocabulary is unavoidably "security-adjacent" even
though the work is unrelated to real-world security: words like attack,
crack, break, key, brute force, solver are the standard terms of
art for classical pen-and-paper cryptanalysis (ACA puzzle types), not
indicators of intent against a real system. A large project context file
(CLAUDE.md) and a persistent memory index, both containing this vocabulary
throughout, are loaded at every session start, which — if the context-
accumulation theory in #74734 is correct — may make this project's sessions
more likely to cross a threshold over time rather than any single message
doing it.

Impact

Sessions abort with no diagnostic detail and no way to inspect or contest
the decision. Because the abort can happen well into a long working session,
in-progress work is lost and has to be reconstructed from manually-written
handoff docs, which is a heavy workaround for something that should just work.

Request

• Tune the classifier (or scope it) to distinguish classical/recreational

cryptography and puzzle-solving vocabulary from real-world offensive
security content.

• Surface some diagnostic (even just "safety intervention" in the transcript,

per the request in #64287) rather than a silent full-session stop, so this
is reportable with evidence instead of "it happened again, no idea why."

Environment

• Claude Code, project: local Python toolkit (ACA-style cipher solvers), no

external dependencies, no network/security-testing tooling involved.