Chameleon

Remediation of the qa28 real-user campaign: ~80 live claude -p sessions drove every tool, command, and hook from scratch on never-profiled GitHub clones (vercel/swr, thoughtbot/administrate), plus an A/B effectiveness battery and a v2.12.0 upgrade simulation. The campaign confirmed the upgrade path loses nothing for existing users, and found five P1s that no scripted test layer had caught; all ship fixed here, each regression-verified from its original repro. Full unit suite 3,544 passing.

Fixed

• Production-ref derivation silently died behind symlinked paths. Extractors emit symlink-resolved file paths while the prodtree scan root was used unresolved, so any symlinked data-dir component (macOS /tmp, relocated ~/.local/share) made every relative_to fail: archetype buckets became absolute-path garbage, per-edit advisories never fired, and bootstrap, doctor, and status all reported healthy. The prodtree root is now resolved before derivation, and a pinned test asserts no committed artifact may ever carry a prodtree path fragment.
• apply_archetype_renames deleted calls_index.json. The rename transaction re-emitted every artifact except the calls index, and the protocol-file posture drops whatever is not re-emitted - so /chameleon-init's auto-rename shipped fresh profiles without caller facts. The transaction now carries the artifact forward verbatim, like the partial-refresh path.
• The correctness judge was dead on OAuth/subscription installs. claude --bare no longer inherits OAuth credentials, so every reviewer spawn exited "Not logged in" with only the attestation file aware. The first bare spawn now doubles as a functional auth probe (cached 24h); on failure the judge retries without --bare, and because that spawn pays the session primer and cannot fit the 45s sync budget, known bare-auth failure auto-routes the spawn through the detached async path (new CORRECTNESS_JUDGE_FALLBACK_TIMEOUT_SECONDS, default 180) with findings delivered at the next prompt. CHAMELEON_JUDGE_ASYNC=0 still forces sync.
• A failing judge starved the duplication gate forever. Deferral now requires a spawn that actually produced a reviewable result; degraded spawns run the duplication review in the same turn.
• bootstrap_repo and refresh_repo bypassed the unsafe-root guard. Both now refuse temp/world-writable roots with the same policy as the hooks and name the CHAMELEON_ALLOW_TMP_REPO=1 opt-out; detect_repo carries the refusal reason instead of a bare no_repo.
• Doctor passed dead installs. Three new checks, each failing open: generated-artifact completeness for the profile's language, judge-spawn health from recent attestations, and advisory-emission sanity (trusted edits resolving no archetype). A failed reviewer spawn also surfaces as a one-line SessionStart banner instead of living only in the attestation ledger.
• Every edit wrote two drift rows (preflight and verify both recorded), doubling drift statistics and banner pressure; only the verify-side row remains.