We describe our system for the ArGuard 2026 shared task (Task B), harmful-prompt detection for Arabic, with subtasks B1 (binary safe versus unsafe) and B2 (seven-way harm-domain classification), both scored by macro-F1. Our system pairs a Unicode-normalization front-end with an ensemble of fine-tuned Arabic encoders, treats B2 as topic-domain classification over all prompts, and adds a retrieval-augmented resolver for the confusable interpersonal classes; it reaches development macro-F1 0.907 (B2) and 0.950 (B1), and on the blind test B1 0.9839 (1st, tied) and B2 0.7875 (2nd). Our main contribution explains the large B2 development-to-test gap. One fifth of the B2 test is a "novel" slice: AraSafe prompts re-annotated into the seven ArGuard domains under a fixed cross-taxonomy mapping that the organizers confirmed. Because that mapping does not preserve the training convention and is recorded in no data available during the task, no system can infer it, and the competitive B2 field compresses onto a blind 0.68-0.79 band, far below the ~0.90 reachable in-distribution. On the familiar slice we score macro-F1 0.908, matching development; we argue this is the honest measure of the system.