What changed

• Added a new read-only runner mode: --mode oauth-diagnostics.
• Purpose: quick proof that OAuth refresh token + login_customer_id routing works, without running full preflight.

Verification run

• Result: OAUTH_DIAGNOSTICS=OK
• Probe: customer 3681763507 (Sam Aguiar Injury Lawyers), manager=true
• Live changes made: NO
• Protected LSA IDs skipped/not touched: 1581498091, 3050138639

Artifacts (local)

• C:\Users\SAguiar\Documents\Codex\google-ads\2026-05-10_153648_272210-oauth-diagnostics\oauth_diagnostics.json
• C:\Users\SAguiar\Documents\Codex\google-ads\2026-05-10_153648_272210-oauth-diagnostics\closeout.md
• C:\Users\SAguiar\Documents\Codex\google-ads\oauth_diagnostics_console_2026-05-10_153648.log

How to run

$env:GADS_CREDENTIAL_PROFILE='gmail'
$env:PYTHONPATH='C:\\Users\\SAguiar\\Documents\\Projects\\google-ads-cloud-runner\\src'
python -m gads_runner.run --mode oauth-diagnostics