docs(memory): record the dev-lane setup and the pre-push mirror fix

TODO.md

@@ -449,3 +449,11 @@ the design doc's M0–M4 is the intent behind it — see that doc's §0).
   `data_level: called_variants`) and move cohort semantics there. That is a cross-repo change —
   a new manifest kind, a registry version bump, and a re-pin in every consuming repo — so it
   needs **ADR-0008** (claim from `main` first) and its own milestone, not a drive-by.
+
+- [ ] **Create the dev Space `anne-voigt/pdac-genomics-agent-dev`** (Annie — needs her HF account).
+  The local half is done (`32b56aa`): `hf-dev` remote, `dev` branch, tracking, mirror-hook
+  exclusion. Private, gradio `6.18.0`, py3.11, hardware matching prod. Then copy the Space
+  secrets/variables — `ACCESS_CONTROL`, `ADMIN_IDS`, `ALLOWED_IDS`, `LOG_SINK_HF_DATASET`
+  (**separate** dataset), `LOG_SINK_HF_TOKEN`, `CBIOPORTAL_CONTACT` — and stage with
+  `git push hf-dev dev:main`. Until the Space exists `hf-dev` resolves to nothing and
+  `git fetch --all` warns; that is expected, not breakage.

memory.md

@@ -1708,3 +1708,33 @@ gate applied to fusions, unknown modality falling back to mutation, fusion row f
 missense. None of them raised. All of them produced a well-formatted, citation-stamped answer to a
 question nobody asked. **When reviewing this codebase, grep for `else:` on a branch that picks a
 modality, a gene set, or a status — that is where they live.**
+
+---
+
+## 2026-08-05 — dev lane established (local half); mirror hook fixed
+
+`32b56aa` on the new `dev` branch. This was the **only showcase agent repo without a dev Space** —
+`main` IS the public prod Space, so every deploy shipped straight to production with no staging.
+
+What landed (all local, nothing on HuggingFace):
+
+- `hf-dev` remote → `anne-voigt/pdac-genomics-agent-dev`. **The Space does not exist yet** — that
+  is Annie's call. Until it does, `hf-dev` resolves to nothing and `git fetch --all` warns on it.
+- `dev` cut from `main`, tracking `hf-dev/main`; `main` tracking `origin/main`. Both branches
+  previously tracked *nothing*, which is why unpushed work here was invisible to `git status`
+  and the generated fleet table showed `(no upstream)` instead of an ahead-count.
+- **`scripts/hooks/pre-push` bug, found by adding the remote and fixed in the same commit.** The
+  hook selected deploy pushes with `origin*|*huggingface.co*` and then acted on anything headed
+  for `refs/heads/main`. `git push hf-dev dev:main` satisfies BOTH — so the first dev-Space push
+  would have mirrored unreleased dev code onto the GitHub mirror's `main`, where the ADR-0007
+  freshness job reads it as production. Exactly the wrong-CI failure the hook exists to prevent,
+  inverted. Now bails on `hf-dev` (and any `*-dev` URL) before the deploy test. All four paths
+  exercised by piping synthetic stdin at the hook: hf-dev by name, hf-dev by URL, github, origin.
+- `CLAUDE.md`: three-remote table, branch-lifecycle section, and a correction — the
+  memory-maintenance list still told agents to hand-edit `SHOWCASE_STATUS.md`, which is generated
+  from `status/` fragments now.
+
+**To activate**: create the Space (private, gradio `6.18.0`, py3.11, hardware matching prod), then
+copy `ACCESS_CONTROL` / `ADMIN_IDS` / `ALLOWED_IDS` / `LOG_SINK_HF_DATASET` (a **separate** dataset,
+so staging runs don't pollute `anne-voigt/pdac-genomics-results`) / `LOG_SINK_HF_TOKEN` /
+`CBIOPORTAL_CONTACT`. Repo is 588 KiB packed with no LFS payload, so the push is cheap.