What happens when the regulator pulls your frontier vendor? The 2026-06-12 Commerce Department directive that disabled Claude Fable 5 + Mythos 5 globally for any foreign national set a precedent every CISO needs to underwrite. This episode walks the three governance gaps the recall exposes, the xAI safety-incident stack, the open-weight-as-risk-hedge calculus with its Chinese-vendor counter-exposure, the five-axis identity-management framework the field needs but no vendor has shipped, and the federal-posture shift from "framework guidance" to "directive plus clearinghouse plus binding operational directive plus export-control" inside a single quarter.