chameleon 2.38.5

Fixed

• Cross-file call graph on src-layout Python repos. Absolute imports
  (pkg.sub) are now resolved against a PyPA src/ package root, not only the
  repo root. A src-layout repo (package under src/, declared via pyproject)
  previously dropped every absolute-import edge, building an empty
  calls_index.json / reverse_index.json and silently zeroing get_callers,
  get_blast_radius, query_symbol_importers, contract-break detection, and
  cross-file duplication. The resolver probes the repo root first (flat-layout
  unchanged), then src/.
• Large valid calls index rejected by a too-small read cap. The builder caps
  on edge count (CALLS_INDEX_MAX_TOTAL_EDGES) while the reader rejected any file
  over a hardcoded 16MB, so a legitimately-built index on a large repo (~21MB on a
  big monorepo) was refused and get_callers / get_callees / get_blast_radius
  returned no-calls-index despite a correct committed index. The read ceiling now
  derives from the edge cap so the two can never drift. This loader is tool-time and
  the turn-end judge only, never the per-edit hot path.
• Merge driver silently rewrote an idiom-bearing profile.summary.md. The
  idioms-markdown detector matched any ### header, so a profile.summary.md that
  lists idioms under a ## Idioms subsection was misrouted to the idioms union merge
  on a conflict — rewriting the summary and exiting 0 (git staged a mangled file as
  resolved), violating the .gitattributes-template contract that the non-idioms
  companion files (profile.summary.md / principles.md / COMMITTED) must DECLINE
  and leave a conflict. The detector now treats a document whose top-level title is not
  an idioms title as non-idioms, so the summary declines cleanly (OURS preserved).

Fixed (skills + comprehension audit)

• bootstrap_repo MCP wrapper now forwards production_ref. The wrapper exposed
  only (path, paths_glob, force), so the init/refresh skills' explicit
  production-branch answer was silently dropped on the conflict and local-only paths.
• doctor walks to the repo root instead of reading cwd/.chameleon/config.json
  directly, which reported a configured repo as unconfigured from any subdirectory
  (misleading /chameleon-status).
• get_blast_radius reports honest truncation. The per-node fanout cap silently
  dropped direct callers while truncated stayed false (the shallow-but-wide case);
  truncated now also fires when the fanout cap clips a node.
• receiving-code-review security grounding no longer no-ops on a null archetype
  (pass a placeholder string so lint_file's pre-archetype secret/sink scans run).
• Deprecated-idiom writes strip the ## deprecated _(none)_ placeholder.
• search_codebase returns found: false on an empty/blank query (per its
  contract, so a caller can branch on found).
• Doc accuracy: the doctor skill lists hook_interpreter_deps (+ its error
  remediation); the statusline update badge shows the apply instruction in the no-jq
  fallback too; the get_crossfile_context docstring documents its Ruby
  constant-graph fallback.