Imported from ashrujit/Heatmap (KahnRuntime.Tests/AGENTS.md). Install upstream with npx skills add ashrujit/Heatmap --skill KahnRuntime.Tests. Copyright stays with the author.

Kahn Runtime Offline Tests

• Link pure sources only, not the deploying KahnRuntime project. This executable has no Quantower reference, gateway, live file controls, or broker connection.

• Preserve existing RuntimeSelfTests as legacy regression coverage. Session tests exercise the pure coordinator used by the worker; they do not simulate a broker by treating accepted submissions as fills.

• Synthetic tests assert mechanisms, including failures and vetoes. Replay comparisons must retain failed roots and report changed permissions honestly.

• Captured sample identity comes from the local engine's export contract; never generalize timestamp grouping to arbitrary external JSONL evidence.

• Build output stays in this project. Replay output belongs under research/out in a new directory, never overwrite frozen prior-study output.

• Python writable profiles stay under .tmp/kahn-transport-tests: Windows Python private temporary-directory ACLs can prevent the sandbox from reading them.

• First-dispatch coverage must consume the actual C# checkpoint writer's disk output, not only hand-built Python checkpoints or in-memory C# defaults.

• Broker callback regression tests use the production event DTO, fill merger, session adapter and management-cycle orchestration. Include trade-first and order-first delivery, stale removals, duplicates and concurrent reductions. The September 8 incident log did not retain Trade.Id; label its test identity as synthetic, not recovered broker provenance. Offline tests are not connected broker validation or proof that Quantower has loaded the deployed DLL.

• Position regressions must include a broker average updating before quantity and before its trade callback. Correct fill deduplication alone does not prove correct weighted cost or BE eligibility. Test protection maintenance separately from new-risk admission, including recovery and invalid position identity.

• Root tests must distinguish trigger and owner identities, historical ownership hydration from fresh permission, and TEST from FAIL. Never repair a failing counter-claim fixture by inventing its live partner. The session replay must hydrate only from the actual earlier prefix and report inadmissible proxy seeds as rejected, not force them through live admission or erase them from results.

• Recovery coverage links the actual pure LL engine as well as the coordinator. Test both sides and Lean/Consumed owners through repeated gaps, missing-time timer resets and failure during warmup. Test-only reflection seeds an already owned rail; it is not evidence of live ownership formation or a production recovery/import API. Genuine identity loss needs a distinct infrastructure exit.

• Capture tests use the production bounded buffer, continuity gate and source clock, plus the real LL engine and session. Simulate worker delay separately from absent capture. Historical hydration must not grant entry/add authority; immediate versus buffered engine results must agree on original timestamps.