Status: BLOCKED-ENV. The Google Ads OAuth refresh token in google-ads.yaml returned invalid_grant: Token has been expired or revoked on 2026-04-26. Token has not been rotated since the 2026-04-25 failure. No GAQL queries executed. No data pulled. No mutations.

Source files:

• Run report: google-ads/outputs/fix-lists/neg-candidates-2026-04-26.md
• Handoff: handoffs/gads-search-term-review-2026-04-26.md
• QA queue mirror: google-ads/outputs/qa-queue-mirror/2026-04-26.md

What changed since 2026-04-25

Nothing in the credentials. google-ads.yaml mtime is still 2026-04-24 20:00. Same OAuth client 76590338058-..., same refresh token, same invalid_grant.

Severity escalates: Day 2 blocked. Backfill plan widens to LAST_14_DAYS one-shot.

Open MCs (4-way; A is recommended)

Q1. Refresh-token rotation (REPEAT)

• A) Rotate now using the existing OAuth client; resume on 2026-04-27 with LAST_14_DAYS backfill. (Recommended)
• B) Move OAuth client to "In production" publishing status first, then rotate.
• C) Build sail-automation service-style credential per the Provisioning Guide before unblocking.
• D) Other.

Q2. Backfill window

• A) Widen GAQL to LAST_14_DAYS one time on resume to cover the 2-day gap. (Recommended)
• B) Stick with LAST_7_DAYS, accept the gap.
• C) Custom range from 2026-04-24.
• D) Other.

Q3. Credential health monitor (PROMOTED)