Tests that protect behavior

Run uv run pytest -q for deterministic local checks. Tests use synthetic geometry, in-process HTTP transports, and temporary repositories. They do not download live GIS, call paid Jev inference, or require a GPU.

Risk	Test evidence
Wrong units or handedness	Python projection round trip in meters; separate UE coordinate tests
Partial GIS download	Missing object IDs reject the page; long-ID queries use POST
Corrupted generated geography	Shifted/missing roads, invalid bounds, and houses outside setbacks fail verification
Fabricated canopy accuracy	Missing/same-source reference blocks; equal coverage in a different location fails
LiDAR subset loses observations or invents ground	Additive EPT traversal includes ancestors; missing/cyclic hierarchies and excessive counts fail; vegetation needs nearby class-2 ground; vertical offsets preserve relative height
Canopy rendering uses stale geometry or loses map regions at LOD	Runtime frame/source hashes and return accounting are checked; every voxel belongs to exactly one spatial batch
Inference stalls or misbehaves	500-agent deadline/cancellation, concurrency cap, invalid actions, partial answers, and local collision override
Service changes schedules	Night and midday jogger pauses persist with the service connected
Unbounded service queue	Concurrent request returns 503 while the first is active
Resident identities lose continuity or become misleading	Separate sourced public-figure portrayals, independent per-scene encounter memory, distinct voice assignment, bounded role context reaching the mocked Jev transport
Speech continues after mute or exhausts resources	Cancellation fences late audio and pending retries; explicit busy responses recover within bounded retries; missing models fail immediately; playback rejection frees URLs; timeout keeps the one-worker gate; WAV validation and cache bounds use injected synthesis
Walking or a mission has no real effect	Source-footprint collision, frame-rate-independent movement, finite resources, delayed visit completion, and achievable/failing community outcomes
Rapid arrival talks to the previous resident	Browser arrival, close and E occur in one task, before the HUD can refresh; the current nearby resident must respond
Resident motion crosses geometry or stalls the render thread	Bounded routes avoid footprints/trunks; actual browser navigation runs in a worker; speed caps, passing pedestrians, pause and conversation holds preserve positions
Old routes or reactions override a new situation	Weather, scene generation, request tick/age and current action fence late work; expired shelter reactions release residents
A visit awards support without anyone arriving	District work requires the assigned helper within 1.5 m; real routes go around footprints; pause and storms hold visits; inaccessible paths return unused capacity once; reset discards late routes
Street furniture leaves the mapped streets or blocks a junction	Kerb strips sit at their own lane edge and clear joining lanes; lamps, planters and bins stay beside a lane, outside footprints and off inner bends; window rows fit under every mapped parapet
Time of day only rotates shadows	Dusk lowers sun, sky, environment and exposure together and warms the light; every hour and weather stays finite and continuous
Secret accidentally committed	Index scan catches a synthetic token despite a clean unstaged replacement; .env force-add is rejected; missing scanner fails closed; actual Git commit is blocked in a temporary repository

There is no arbitrary test-count or coverage-percentage target. Add a regression that reproduces a risk or failure before fixing it. Avoid snapshotting implementation details, mocking your own helpers, host-sensitive timing assertions, and tests that only assert source strings exist.

The 500-agent timing script records measurements without enforcing host-dependent pass thresholds. It measures local Python classification only. Full inference latency must include serialization, networking, provider time, batch deadlines, fallback rates, and all-agent update age. UE acceptance needs a frame-time trace recording resolution, upscaling, GPU/driver, scene, population, weather, and engine version.

Unreal Editor/Game builds and native automation have run on UE 5.8.2. See native resident validation and engine acceptance for measured results. Source-only hosts can run RiverOaks.Contracts; the full RiverOaks group additionally requires the imported resident assets. These checks do not establish packaging, complete collision integration or target performance.

With both development servers running, the browser CLI scripts preview/e2e/district.js, sidebar.js, personas-voice.js, resident-life.js, volunteer-visits.js, and visual-fidelity.js operate real controls and record UHD/mobile screenshots. The voice script additionally needs the optional model and tests actual local synthesis/playback, alongside the hermetic unit tests. It does not run in dependency-only CI. None of these browser checks establishes target-GPU 60 fps or photographic accuracy.

The installed secret hook runs on commits in this checkout. New clones must install it. CI scans the worktree and complete fetched history; require its checks in branch protection to enforce the merge gate. Scanners cannot detect every secret format, and local hooks can be bypassed. Tests verify the configured guard's behavior rather than claiming absolute prevention.