docs: record wave 5 (G-diagnostics) in flight

Explicit pathspec only — a worker is writing to the tree right now
(hazard #7: `git add -A` mid-wave has swept half-finished source into
commits twice on this project).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/HANDOFF.md

@@ -334,3 +334,42 @@ rate-limited lookup reaches the user as "No match found." Recommended order is a
 free Google Books API key, then distinguishing "couldn't ask" from "not found",
 then retry/backoff, before adding any new source. **Awaiting the user's decision;
 do not implement unasked.**
+
+## Wave 5 — G-diagnostics: IN FLIGHT, launched 2026-09-09 10:42Z
+Prompt: `tasks/G-diagnostics.txt`. Session id in `logs/G-diagnostics.sid`.
+Lease `bookshelf-wave` held and VERIFIED by `tasks/wave-guard.sh`, sentinel
+`logs/WAVE5-DONE`. Launched from a console the user was about to disconnect, so
+the lease is the only thing keeping the sprite hot — check it first if anything
+looks stalled: `sprite-env curl /v1/tasks` and `tail logs/wave-guard.log`.
+
+**Scope:** make the app distinguish three outcomes it currently conflates —
+barcode-didn't-decode (silent today), lookup-request-failed (reported as "No
+match found"), and genuinely-not-found. SPEC's "Book metadata lookup" and
+"Barcode scanning" sections were rewritten to state the three-way contract
+(`Found` / `NotFound` / `Unavailable`) BEFORE launch, so the worker implements a
+spec rather than inventing one. This is the only wave-5 task; there is no
+parallel worker, so the disjoint-ownership device isn't needed, but the prompt
+still forbids build files and every package outside data.metadata + ui.scan.
+
+**Why this and not more sources:** the two books that failed on the phone
+(9781883937386, 9781883937676) are BOTH fully present in Open Library, with
+cover art, and the app's own parser handles their real responses — there are
+regression fixtures and a test proving it. The coverage hypothesis is dead.
+See `docs/METADATA-SOURCES.md` § "What actually failed". Do not let a future
+worker "fix" this by bolting on a third data source.
+
+**Verify before accepting** (workers self-report optimistically; two of five
+waves over-claimed):
+    cd ~/bookshelf && ./tasks/gw assembleDebug && ./tasks/gw testDebugUnitTest \
+      && ./tasks/gw recordPaparazziDebug && git status --porcelain
+107 tests pass today; the count must go UP and nothing may regress. Also grep the
+build log for `always 'false'` — that warning class silently blanked every book
+cover in this app for months and is now an explicit item in the worker's prompt.
+Then eyeball the two new Paparazzi PNGs (LookupFailed sheet, rejected-barcode
+overlay) — the user cares how this looks and no worker has ever been trusted on
+that.
+
+**Still open, unchanged:** the free Google Books API key (keyless returns 429;
+worth doing on its own merits but no longer the leading theory), R8 still off so
+the release APK is 41.8MB and too large to send over the file channel (30MB cap),
+where the server will live, and the two account emails for `create-user.sh`.