docs: accept wave 5; record HAZARD #8 (guard can die without its sentinel)

The wave-guard was killed after its 11:13 renewal and never wrote
logs/WAVE5-DONE, despite the worker succeeding at 11:21. That makes this
file's own first-command heuristic actively misleading — "no sentinel +
no processes -> workers were KILLED" would have thrown away a completed,
verified wave. Recorded the reliable signals instead: the size of
logs/<name>.json and the tail of logs/<name>.state.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/HANDOFF.md

@@ -373,3 +373,41 @@ that.
 worth doing on its own merits but no longer the leading theory), R8 still off so
 the release APK is 41.8MB and too large to send over the file channel (30MB cap),
 where the server will live, and the two account emails for `create-user.sh`.
+
+## Wave 5 — G-diagnostics: COMPLETE, verified by the orchestrator 2026-09-09
+Commit `93f972b`. The app now distinguishes barcode-didn't-decode from
+lookup-request-failed from genuinely-not-found; see the commit message and
+`docs/METADATA-SOURCES.md`.
+
+| Check | Result |
+|---|---|
+| `assembleDebug` | exit 0 |
+| `testDebugUnitTest` | exit 0 — **138 tests**, 1 skipped, 0 failures (was 107) |
+| `verifyPaparazziDebug` | exit 0 |
+| `assembleRelease` | exit 0 — 41,793,760 bytes, V2 signer `CN=Bookshelf` |
+| boundary check | clean — no build files, no forbidden packages |
+| `grep "always 'false'"` | 0 hits on touched files |
+
+The worker was honest this time: everything it claimed checked out. Cost $0.28,
+6 turns, one quota wait that `run-task.sh` resumed correctly.
+
+**The orchestrator added one thing the worker's brief didn't cover:** the
+manual-ISBN dialog silently discarded an unparseable entry — the same silent
+failure this wave existed to eliminate, sitting just outside the prompt's scope.
+It now marks the field in error and disables "Look up" until the checksum passes.
+Lesson for future prompts: scope a wave by *failure class*, not by file list, or
+the instances of the class that live outside the listed files survive.
+
+### HAZARD #8 — the wave-guard can die without writing its sentinel
+`logs/WAVE5-DONE` was written BY HAND. The guard renewed at 11:13, the worker
+succeeded at 11:21, and the guard neither wrote the sentinel nor logged its
+"guard exiting" trap line — it was killed outright. The lease expired on its own
+an hour later.
+
+**This breaks the first-command heuristic at the top of this file.** "no sentinel
++ pgrep count 0 -> workers were KILLED" was WRONG here: the worker had finished
+successfully. Use these instead, in this order:
+  1. `ls -l logs/<name>.json` — 0 bytes means killed; non-zero means it finished.
+  2. `tail logs/<name>.state` — says SUCCESS / GIVING UP / WALL CLOCK explicitly.
+  3. `git status --porcelain` — is there actually work in the tree?
+The sentinel is a convenience, not the record of truth. `logs/<name>.state` is.