Model ignores MANDATORY rules and memory about Bash command chaining

Claude Code repeatedly chains whitelisted Bash commands using semicolons, pipes, and redirects despite MANDATORY rules in CLAUDE.md and persistent memory explicitly documenting this correction from prior sessions.

Reproduction:

1. Add to CLAUDE.md (global): 'NEVER pipe, chain, or redirect whitelisted commands'
2. Add a memory file reinforcing this rule
3. Use Claude Code across multiple sessions
4. Observe that the model still appends 2>&1, ; echo ..., or | tail to whitelisted commands

Example (2026-03-16):

What Claude ran (triggered permission prompt):

.venv/bin/ruff check --target-version py314 /dev/null 2>&1; echo "exit: $?"

What it should have run (matches Bash(.venv/bin/*) allow pattern):

.venv/bin/ruff check --target-version py314 /dev/null

Why this matters:

• Claude Code matches the full command string against permission allow-list patterns
• Appending ; echo ... or 2>&1 breaks the pattern match, triggering an unnecessary permission prompt
• The Bash tool already reports exit codes, so the echo was redundant
• The user has corrected this behavior multiple times across sessions
• The model acknowledges the rule, stores it in memory, then violates it again in the same or next session

Impact: Every violation blocks the user with a permission prompt for a command that should be auto-allowed. This erodes trust and wastes time.

Expected behavior: The model should treat MANDATORY rules in CLAUDE.md and persistent memory feedback as hard constraints. Whitelisted commands should always run as standalone Bash calls with no pipes, redirects, semicolons, or chains.