Stop Claude Code turns whenever the serving model changes

[Tryanks]

Claude Code's model guard recognized only selected family transitions and inspected completed assistant messages. Make the enabled guard stop a turn whenever the serving model differs from the selected model, including Fable 5.1 → Opus 5 / Opus 4.8, other families, and version changes. Detect the change at streamed message start as well as in completed messages and explicit fallback notices.

Reuse the existing context-suffix normalizer: case and supported [1m] / [2m] suffix differences remain equivalent. Synthetic error messages and native subagent messages do not trigger the parent guard. Keep existing settings and event names compatible.

The Claude mapper owns the shared model observation; runtime shutdown now records and broadcasts an interrupted completion so clients stop showing a running turn. Update both locales and the design contract to describe general model changes without asserting a classifier cause, and offer an explicit retry on the reported model when no classifier category is available.

Regression coverage replaces the retired family whitelist test with production-mapper cases, preserves per-turn deduplication, and covers both Opus targets at stream start, subagent isolation, suffix filtering, and interrupted completion delivery to clients. The generalized mismatch, stream-start, suffix-notice, and missing-completion regressions were observed failing before their respective fixes.

Validation performed locally on macOS:

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo build --workspace --locked
• cargo test --workspace --locked — 1197 passed, 6 intentionally ignored across reported test groups
• cargo machete
• RUSTFLAGS='-D warnings' IPHONEOS_DEPLOYMENT_TARGET=26.0 cargo check -p tcode-ios --target aarch64-apple-ios-sim --locked
• RUSTFLAGS='-D warnings' cargo check -p tcode-web --target wasm32-unknown-unknown --locked
• RUSTFLAGS='-D warnings' CARGO_NDK_PLATFORM=26 cargo ndk -t arm64-v8a check -p tcode-android --locked with NDK 27.1.12297006
• Isolated GUI profile with a local mock Claude stream: inspected light/dark recovery cards and verified Fable 5.1 → Opus 5 stops the final build's running indicator.

Validation gaps: no live-provider reproduction of the original report; narrow-window visual verification was not completed. Linux and Windows execution is left to CI. The local build reports the existing large debug unwind-table linker warning and the dependency block future-compatibility notice.