docs: OAuth verification is PARKED, not the next step — the map was lying

The 2026-09-27 entry sat under a "NEXT STEP" heading and framed the Google
verification as the top priority. It was neither un-attempted nor un-blocked:
the attempt had already failed on a Google-side bug and the creator had
already ruled it unimportant for where we sit. A "next step" heading lends a
dead end borrowed authority, and the next session would have opened the
console instead of the editor.

Records the ruling in the terms that change behaviour: attempted, died on
Google's side, ruled unimportant, do not re-attempt. States the cost of
tabling it honestly — an accepted 7-day refresh-token expiry while the
consent screen sits in Testing, which is why the creator kept having to
re-consent. The sensitive-vs-restricted classification was never read and is
moot until a second real user or Store submission.

The mechanism of the Google-side bug was never recorded and is left
deliberately blank rather than reconstructed — a confident fiction in a
memory map is the one sentence the next session would trust. The project
number and console link stay in ai.md:233; they cost a hunt and are still true.

The two code scope cleanups survive the tabling (neither needs verification
to land): drop the redundant force-ssl scope, and move the uploads-playlist
fetch off the user's session token. The channels?mine=true call on the same
service legitimately needs the session — flagged so it is not "fixed" later.

No code touched. Test state unchanged.

MyMistakes.md

@@ -1234,3 +1234,35 @@ parallel load — **it is not a signal that your change broke notifications.** B
 re-run it alone (`vstest --Tests:Info_Auto_Dismisses_And_Error_Sticks`); only treat it as yours if it
 fails in isolation too. See also the two other suite-level timing traps already recorded above
 (the one-tick pipe read, and blocking waits on the shared `RealApp` STA thread).
+
+### Writing the *plan* into the handoff instead of the *outcome* — the OAuth verification trap
+
+On 2026-09-27 I wrote a HANDOFF entry titled "record the Google Cloud project owner + the OAuth
+verification blocker". What it actually contained was the two console questions I was about to go
+answer, filed under `⏭ NEXT STEP` — which made the top of the file say *the next thing we do is
+verify with Google*. The verification attempt had **already failed on a Google-side bug** and the
+creator had **already ruled it unimportant for where we sit**. I knew the ruling; the map still said
+the opposite, and the next session would have opened the console before opening the editor.
+
+**The failure is not that the fact is missing — it's that the file is optimistic by construction.**
+A "next step" heading is a promise that this is un-attempted and un-blocked, so parking a dead end
+under one is worse than omitting it: the heading lends the dead end borrowed authority it does not
+deserve. When an attempt dies on someone else's bug, the handoff must say **attempted → died on their
+side → ruled unimportant → do not re-attempt**, in those words, where the next session will read it.
+
+Two corollaries, both paid for here:
+
+- **Record the ruling, not just the discovery.** "Here is the project number" is cheap and I wrote
+  it. "Here is why we stopped, and what it cost us to stop" is the part that changes behaviour, and
+  it is the part I skipped. The real cost — an accepted 7-day refresh-token expiry while the consent
+  screen sits in Testing — was never written anywhere.
+- **Leave the unknown blank, loudly.** I cannot now say what the Google-side bug *was*. Writing a
+  plausible mechanism would be fabrication, and it would be the most trusted sentence in the file,
+  because it is the one that explains everything else. `HANDOFF.md` now carries an explicit
+  "deliberately left blank, do not reconstruct it" marker. An honest gap beats a confident fiction
+  in a memory map; in a memory map especially, since the whole point is that the next session skips
+  the search.
+
+**Generalisation: a memory map entry that makes the reader's *next action* wrong is a bug, not an
+omission.** When a fact is superseded by a ruling, the ruling wins the headline — the stale detail
+belongs underneath it, labelled as what it is.