CalendarStream 0.2.8-beta.36

F58: the Google code split into small modules in app/google/ (ten checkpoints), with review #9 findings 2 and 3 and review #8's test-runner follow-ups; rules R18–R20. Still open for the next build: GoogleSync becomes an injected client instead of a mixin, and main.py and the routes (an import cycle) are split.

Fixed

• F58 checkpoint 1 (I5): a Google module whose account has no sign-in was skipped by every sync without a word; History now says so once ("not signed in … so it isn't synced: open it and Connect me"). New suite 68.
• F58 checkpoint 9 (R19): build_rules/dependencies.md, made by tests/tools/deps.py, maps which app file imports which, leaves first, with import cycles marked (main.py and the routes are the cycle: that is the next thing to split). New suite 75 checks it is current and that every app/google/ file has its header. GoogleSync stays a mixin of Google for now; handing it an injected GoogleApi instead is the next step.
• F58 checkpoint 8: the calendar and event code moves to app/google/sync.py (GoogleSync, SyncResult, event_body…); gsync.py is now a small facade (Google(GoogleApi, GoogleSync) plus re-exports and the endpoints/limit the suites set). No behavior change. New suite 74.
• F58 checkpoint 7: app/google/health.py (GoogleHealth) remembers each Google account's health in the database (state, kind of failure, attempts, next retry); a failing sync is classified and recorded, an account waiting out a back-off is skipped quietly, a success or a new sign-in clears it. No setting, mapping or token is touched. New suite 73; suite 68 covers the wiring.
• F58 checkpoint 6: app/google/failure_classifier.py (what kind of failure a Google error is) and recovery_policy.py (retry or not, the account's new state, bounded backoff with jitter, Retry-After respected); GoogleError carries optional status, transient and retry_after. New suite 72 (no app or database). The Tests workflow no longer cancels a run when the next push arrives.
• F58 checkpoint 5 (review #9 finding 2): app/google/readiness.py tells apart the OAuth client, the sign-in, Google's answer and a sync; the Google Calendar API Sync's last step now says the client is "set up" (never "ready") and names each Google module that isn't signed in, has a Google error or hasn't synced. New suite 71; suite 68 covers the step.
• F58 checkpoint 4 (review #9 finding 3): a Google sign-in's PKCE verifier (encrypted) and an invite's sign-in state are saved in the database (google_signins, google_invite_states), expire after 15 minutes and are used once, so restarting between Continue with Google and Google's answer no longer loses them.
• F58 checkpoint 3: the Google sign-in, tokens and requests move to app/google/api.py (GoogleApi); gsync.Google builds on it with the same public behavior and the same module-level endpoints the suites set. New suite 70 (no app, database or network).
• F58 checkpoint 2: app/google/ begins: errors.py (the Google errors, moved out of gsync.py, which still offers them), health_state.py, failure_kind.py, recovery_decision.py, each with a Dart-ready header. New suite 69 (no app, database or network).

Added

• Checkpoints (2-build.md, R20): a build is a series of small checkpoint commits, pushed as made; VERSION is bumped only by the last; BUILD runs through as many as it can; the full suite runs on GitHub.
• Code structure rules (AGENTS.md, R18, R19): new code is a module; one class per file, laid out like a Flutter feature (data, domain, ui); every file's header says what it depends on, who uses it and its Dart note; a dependency map for the Dart port.
• Tests workflow (.github/workflows/tests.yml): runs tests/run.sh, pip-audit and bandit on GitHub for every push to main, so the Reviewer can read an independent result (4-review.md, step 0).
• Test-runner self-test (tests/tools/harness_selftest.sh, review #8): injects a database that can't be made or seeded, a silent nonzero exit, a time-out and a leftover process, and checks run.sh catches each (TEST_SUITE_TIMEOUT sets the suite time-out, default 600 s). Runs first in the Tests workflow.