docs: regression fix deployed as 125b8a5 and verified on prod in both directions

TODO.md

@@ -130,16 +130,18 @@ the design doc's M0–M4 is the intent behind it — see that doc's §0).
       Numbers reflect the profiled-subset denominator fix. The whole path (orchestrator → this
       Space → machine-auth gate → curated artifact) is now proven in production.
 
-## Open — a chart regression is LIVE on prod; the fix is committed but not deployed
-
-- [ ] **DEPLOY `819da30`.** Prod (`23d37b6`) has a regression shipped 2026-08-05: a query that
-      NARROWS the gene set leaves the previous answer's bars under the new answer's caution for one
-      render. Self-corrects on a second click and never shows a wrong *number*, but it does show one
-      cohort's bars beneath another cohort's warning. `819da30` fixes it (handler now blanks the
-      chart before yielding the answer) and is verified in BOTH directions on a single click — the
-      check whose absence caused this. 234 tests pass. Not deployed: needs Annie's go-ahead.
+## Done — the chart regression, fixed and deployed
+
+- [x] **DEPLOYED `125b8a5` (2026-08-06)** — closes the regression `23d37b6` shipped. The handler now
+      blanks the chart before yielding the answer, so a narrowing query can never leave the previous
+      cohort's bars under the new cohort's caution. **Verified on the live prod Space in BOTH
+      directions, each on a single click** — CCLE wide → MSK+NRG1 narrow (correct NRG1 bar, not
+      CCLE's) → full panel wide (KRAS ~94%, all 33 genes). 234 tests, security scan clean.
       **Do not "clean up" `colors_in_legend` back in** — it looks cosmetic and is not; see `memory.md`
       2026-08-05 (latest) for the three-way measurement.
+- [ ] **Realign `dev` with prod.** `dev`/`hf-dev/main` is still at `23d37b6`, so the dev Space now
+      trails prod and carries the regression prod has shed. Fast-forward `dev` to `main` and push
+      `hf-dev` — a separate Space deploy, so it needs Annie's go-ahead.
 
 ## Open — the dev lane cannot be click-through verified while private
 

memory.md

@@ -36,6 +36,13 @@ EMPTY chart, which claims nothing, rather than a stale one, which claims somethi
 directions verified repainting on a single click. `test_ui_handler_gating` reads the final frame via
 `_final()`; the ADR-0004 assertions are untouched and a denied path still yields exactly one frame.
 
+**Deployed `125b8a5` 2026-08-06** (gates clean: 234 tests, pip-audit, gitleaks; hook mirrored to
+`github` first). **Verified on the live prod Space in both directions, each on a single click** —
+CCLE wide → MSK+NRG1 narrow (correct NRG1 bar immediately, not CCLE's) → full panel wide (KRAS ~94%
+across all 33 genes). The OAuth session drops when the Space rebuilds, so sign in again before
+verifying; an anonymous query renders nothing visible because the plot is None and the JSON
+accordion is collapsed.
+
 **Three process lessons, all of them mine:**
 1. **I explained away the symptom the first time.** I saw the stale chart locally, guessed "my click
    missed the button", and moved on. It had not missed. A surprising observation deserves one cheap