fix: the broadcast diagnostic reported NO-BINDING from a parse that never ran

The run I asked for came back with three alarming lines:

  lifeCycle=? privacy=? recording=? bound=NONE boundMatches=NO-BINDING
  autoStart=unset autoStop=unset liveChatId=none | streamStatus=active

Every single broadcast field was empty, and the stream half was fine. That
combination is the tell: not a failed request, a wrong nesting level.

liveBroadcasts.list returns a LIST wrapper, so the broadcast is at items[0]. I
descended into items for the stream and read the response root for the
broadcast, so every lookup missed, and BoundMatches — handed a null it could
not distinguish from a real null — reported a confident NO-BINDING. The
diagnostic invented the bug it was written to find. Three lines of fabricated
alarm on the one run that was supposed to produce evidence.

Two fixes, and the second is the one that matters:

  FirstItem() descends into items[0] for both halves, and returns default when
  there is genuinely no item.

  The line now prints boundMatches=unread when the broadcast could not be
  read at all, so an absent parse degrades to "I don't know" instead of a
  verdict. A diagnostic that guesses is worse than no diagnostic: this one
  would have sent me off to rebuild a binding that may well be correct.

Test guards the regression: FirstItem_DescendsIntoTheListWrapper_AndReports-
AbsenceHonestly, including the empty-items and missing-items cases. Suite
390/390, 0 warnings.

Credit to the run for catching it. What it did establish, from the half that
worked: streamStatus goes ready -> active about 30s into the push. So the
ingest registers as active server-side, which combined with the 99MB muxed
yesterday means the stream half is verified healthy end to end. The broadcast
half needs one more run to say anything.

ai.md

@@ -1710,6 +1710,23 @@ These are the hard facts behind every decision. Full list in `TASKS.md`.
   the whole experiment.** Guarded by `BroadcastBindingTests.BoundMatches_ComparesTheBroadcastAgainstTheStreamWePush`,
   which pins `unknown` for a missing expectation so an absent stream id can never be misreported
   as a match.
+  - **⚠️ The first version of this diagnostic LIED, and the first real run caught it (2026-10-04).**
+    `liveBroadcasts.list` returns a **list wrapper**, so the broadcast lives at `items[0]`. The
+    original code descended into `items` for the *stream* but read the *broadcast's* response root,
+    so every broadcast field came back `?` — and `BoundMatches` then dutifully reported a confident
+    **`boundMatches=NO-BINDING`** from a parse that had never happened. Three lines of fabricated
+    alarm. Two fixes, both load-bearing: **`FirstItem()`** descends into `items[0]` for both halves
+    (and returns `default` when there is genuinely no item), and the line now prints
+    **`boundMatches=unread`** when the broadcast could not be read, so an absent parse can never be
+    reported as a verdict. Guarded by
+    `BroadcastBindingTests.FirstItem_DescendsIntoTheListWrapper_AndReportsAbsenceHonestly`.
+    **Generalisation: a diagnostic must degrade to "I don't know", never to a confident wrong
+    answer** — otherwise one level of JSON nesting manufactures a bug that isn't there.
+  - **What the one run that *did* work proved:** the stream half was correct, and it shows
+    `streamStatus=ready` → **`streamStatus=active`** about 30s into the push. So the ingest does
+    register as active server-side, which is a genuine step forward — combined with the 99MB muxed
+    in the earlier run, the stream half of the system is now verified healthy. The broadcast half is
+    still unobserved pending a re-run.
 - **Visibility picker (TASK 9 item 6) — DELIBERATE TEST-PHASE LOCK, not drift (2026-09-01).**
   The "always Private" enforcement in `YouTubeStreamService.CreateBroadcast` stays while the creator
   runs multi-month real-world testing: non-private test streams would clutter the channel with VODs