chameleon 3.1.1

Hardens the delivery-faithful wiring detector behind the 3.1.0 memory-channel
features. Post-ship adversarial QA found markdown shapes where a QUOTED
@.chameleon/conventions.md line read as live wiring (false "delivered"), the
one direction the design must never err in: a false positive lets the Stop
review gist idioms the session never received and lets the SessionStart dedup
drop the conventions injection while the memory channel delivers nothing.

Fixed

• Nine false-"delivered" classes in the wiring scan (_blank_code_regions
  in hook_helper.py, rewritten CommonMark-faithful): (1) a content line
  carrying extra fence characters (" ") no longer closes an open fence
  (a closer is one run of the opener's character, at least its length,
  followed only by whitespace); (2) indented code blocks (>= 4 columns, tab =
  4-column stops) are blanked, while 0-3 column imports stay wired; (3) fences
  behind blockquote and list-item prefixes open real fences whose prefixed
  contents are blanked; (4) inline code spans pair backtick strings of equal
  length, so double-delimited spans blank; (5) spans crossing a soft line
  break blank; (6) indented code nested inside a blockquote or list item is
  blanked (the threshold applies to the container-stripped remainder); (7) a

  = 4-column lazy-continuation line stays in its paragraph so span pairing
  crosses it, with the line's own output blanked; (8) an ordered-list marker
  not starting at 1 cannot interrupt a paragraph, so a "2) ```" line after
  prose is lazy text, not a fence; (9) line splitting now honors only
  LF/CRLF/CR, so an embedded U+2028/form-feed byte cannot fabricate a closing
  fence. Over-blanking stays the safe direction throughout: ambiguous shapes
  read as unwired, which keeps the full push-based delivery. Also fixes a
  pre-existing over-blank (a list fence's indented closer was misread as a new
  opener, hiding a legitimate import after the list). 41 new unit tests pin
  the closer rule, the indent boundary, container chains, span pairing, and
  the line-ending model.

Quiet-powerful turn-end review: the taught rules move onto the high-authority
CLAUDE.md memory channel (10/10 adherence in the published migration A/B vs
4/10 as hook context), and the hook surfaces shrink to match — the Stop idiom
review drops from ~3.5KB of pushed text to gist lines on wired repos, and
SessionStart stops double-delivering the conventions block.

Added

• Taught idioms and principles ride the conventions.md mirror.
  render_conventions_md now emits a TEAM IDIOMS section (one
  - name: first-sentence directive line per active idiom, 30 idioms / 280
  chars per gist, deprecated excluded — render_idiom_gists in tools.py)
  and the principles sections, making the mirror the complete
  session-conventions content. Synced everywhere idioms.md or conventions.json
  change: bootstrap/refresh transactions, teach/unteach, the deprecate paths
  (previously never re-synced), the partial-refresh commit (previously served
  a stale mirror), and a noop refresh now self-heals a missing or older-format
  mirror from disk instead of forcing a full re-derive.
• Memory-channel-aware Stop idiom gists (CHAMELEON_STOP_IDIOM_GIST=0 to
  disable; --toggle stop_idiom_gist). When the repo imports
  .chameleon/conventions.md (CLAUDE.md / CLAUDE.local.md /
  .claude/rules/*.md) and the DELIVERED mirror carries an idiom's gist, the
  Stop self-review renders that idiom as a one-line gist plus one shared
  "Full text for any you have not applied: .chameleon/idioms.md" pointer
  instead of re-dumping the full block. Delivery is verified the way Claude
  Code resolves imports — code fences (indented/tilde/unclosed included) and
  inline code spans are ignored (a doc that quotes the import line is not
  wiring), the path resolves relative to its containing file, and the target
  must exist — so a linked worktree with an unmaterialized target reads as
  undelivered. Session-faithful: the delivered names are snapshotted at
  SessionStart and the Stop gate reads only the snapshot, so an idiom taught
  mid-session is never gisted before the model has actually seen it. Idioms
  with no delivery channel keep the v3.0.3 full-text escalation — an idiom
  the model never saw is still never reduced to a name; detection fails open
  to "no channel".
• SessionStart memory-channel dedup (CHAMELEON_MEMORY_CHANNEL_DEDUP=0 to
  disable; --toggle memory_channel_dedup). A wired repo's session no longer
  receives the conventions block twice: the hook injection collapses to a
  one-line pointer at the higher-authority import. Lossless-gated at line
  granularity — the swap happens only when every non-empty line the block
  would inject already appears in the text the import actually delivers, so
  pre-3.1.0 mirrors (no principles sections), content-stale mirrors, and
  unmaterialized worktree targets all keep the full injection; untrusted
  repos are unchanged.

Changed

• Stop idiom-review boilerplate halved. The enforce-mode directive,
  principles pointer, and confirm/skip/off-switch tail compress from ~570 to
  ~310 chars (the durable enforcement.idiom_review: false off-switch is
  still named); the shadow advisory is compressed the same way.
• Idiom gists survive long parentheticals. A summary that runs over its
  cap now elides long (...) enumerations first (_elide_long_parens), so a
  directive like the atomic-commit idiom's keeps its verbs instead of being
  cut mid-artifact-list; short call-syntax parens are kept verbatim.