Merge: record the click-through verification and the dev-lane visibility finding

TODO.md

@@ -130,6 +130,20 @@ the design doc's M0–M4 is the intent behind it — see that doc's §0).
       Numbers reflect the profiled-subset denominator fix. The whole path (orchestrator → this
       Space → machine-auth gate → curated artifact) is now proven in production.
 
+## Open — the dev lane cannot be click-through verified while private
+
+- [ ] **Decide: make `pdac-genomics-agent-dev` public, or accept that UI verification happens on prod
+      only.** Found 2026-08-05 trying to verify the display fixes on dev. The Space **builds and runs
+      fine** — it is *reaching* the UI that fails. Private ⇒ `anne-voigt-pdac-genomics-agent-dev.hf.space`
+      is a **404** (the session cookie is on `huggingface.co`, not the `hf.space` origin); through the
+      embed the app renders but sits in a cross-origin iframe that synthetic clicks do not reach; and
+      the iframe's signed `__sign=` URL, promoted to top level, serves a **username/password form**
+      ("Could not get API info. Connection errored out."). So the dev lane currently verifies *that it
+      boots*, not *that it answers*. That is most of what a staging Space is for.
+      The 2026-08-05 fixes were verified against the merged branch **running locally** on the pinned
+      gradio 6.18.0 — sound for client-side rendering bugs, and NOT sound for anything server-shaped
+      (auth, secrets, artifact loading in the Space image).
+
 ## Open — found in the 2026-08-05 signed-in click-through
 
 First click-through since 2026-07-27, against deployed `40ab3dd`. **Every payload was correct**;

memory.md

@@ -90,6 +90,29 @@ still wins where both make a claim — annotation is a fallback, not an override
 CCLE still reports `uncharacterized`, so its caveat is untouched; that was checked deliberately,
 since the caveat rests entirely on bare labels never being promoted.
 
+**All three fixes verified by clicking through the merged build** (`d956d91`), 2026-08-05:
+- `ccle_broad_2019` now renders the caveat in full — "…this cohort can never return
+  `fusion_in_frame`. Read an absence of in-frame fusions here as a fact about the annotation, NOT
+  about the biology" — **alongside** the Broad licence line, not instead of it.
+- The chart regression is gone: NRG1-alone (single red `sv` bar, y-axis 0–0.30, `sv`-only legend)
+  followed immediately by the full panel now draws KRAS ~94%, TP53 ~78%, CDKN2A ~40% across all 33
+  genes with the full mutation/cnv/sv legend. That is the exact sequence that used to draw empty.
+- `sv` renders **red** in both the narrow and wide charts — the colour no longer depends on how many
+  modalities happen to be present.
+- NRG1 on `pdac_msk_2024`: `assayed: false` + its note (the ADR-0008 gate is intact), 6/2336 =
+  0.257%, and all six now `fusion_in_frame` rather than bare `rearrangement`.
+
+⚠️ **The dev Space could NOT be used for this, and this is structural, not a one-off.** It is
+**private**, so `anne-voigt-pdac-genomics-agent-dev.hf.space` returns **404** — the session cookie
+lives on `huggingface.co`, not on the `hf.space` origin. Through the embed on the Space page the app
+renders but is a cross-origin iframe, and synthetic clicks do not reach it. Promoting the iframe's
+signed `__sign=` URL to top level lands on a **username/password form** with "Could not get API
+info. Connection errored out." So: **while the dev Space is private, it can be built and booted but
+not clicked through.** The verification above was done against the merged branch running locally on
+the pinned gradio 6.18.0 — legitimate here because both display bugs are purely client-side, but it
+is NOT a substitute for a real click-through of anything server-shaped. Make the dev Space public
+(or accept prod-only click-through) before relying on the dev lane for UI verification.
+
 **Two habits earned their keep and should be kept:** re-curating with `--check` first (all seven
 `up_to_date`, so this was a re-derivation and not a data refresh hiding behind a code change), and
 reading the re-curation diff **cell by cell** instead of trusting the summary line — which was