Ran two more web_search_exa passes on Google service-account/JWT auth patterns (JWT structure/claims, PHP client library patterns, token caching, and exponential-backoff/retry conventions for 429/5xx). Checked media.db first for existing coverage (M0004-M0006 from 08/08) before saving to avoid duplicates. Two genuinely new findings saved: M0009 (retry/backoff pattern -- Step 2 spec had zero retry logic in it, a real gap) and M0010 (token endpoint discrepancy -- M0005 cites the older www.googleapis.com/oauth2/v4/token, current Google docs use oauth2.googleapis.com/token). Folded both back into SOP-GDRIVE-SERVICE-ACCOUNT.md as v1.4 before Server 40 starts the actual build (T758 still not started) so they don't build against outdated/incomplete spec.