[exe-dev-github-integration]

Cause

Legacy probability rows were loaded from the raw download log but bypassed the pooled filter applied to current-instrument rows. The frontend rendered arbitrary condition IDs from preserved snapshots.

Fix

• Filter timeline rows before the current/legacy split using the published experiment pooled allowlist and row publication flags.
• Restrict generated condition cells and legend to public pooled conditions.
• Fail closed in the chart for unknown/shadow conditions, including retained snapshots.
• For contaminated retained snapshots, derive displayed model means and ensemble medians from public condition answers only. Leave immutable snapshot bytes and raw downloads intact.

Regression coverage

• Current and legacy rows, ai-banned with missing flags, private news shadow, unknown future shadows and explicit unpooled/private rows.
• Browser helper tests verify public-only dots, model means and medians; immutable source data.
• Tooltip tests: 3 passed; experiments/runlog/build tests: 42 passed, 2 expected skips; assembly/production tests: 32 passed.
• Local browser rendering with the production snapshot: all five public conditions, no ai-banned legend entry, no JS errors.

User requested deployment after checks; deploy frontend normally, preserving snapshot and downloads.