fix: harden release checks for grouped routes

backend/pyproject.toml

@@ -6,6 +6,7 @@ readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
     "fastapi>=0.112.0",
+    "starlette>=0.46.0,<1.0.0",
     "uvicorn[standard]>=0.30.6",
     "SQLAlchemy>=2.0.34",
     "psycopg[binary]>=3.2.1",

backend/tests/test_readiness_gate.py

@@ -1,6 +1,13 @@
 from pathlib import Path
 
 
+def test_backend_keeps_starlette_on_the_supported_pre_httpx2_line() -> None:
+    pyproject = Path(__file__).resolve().parents[1] / "pyproject.toml"
+    content = pyproject.read_text(encoding="utf-8")
+
+    assert '"starlette>=0.46.0,<1.0.0"' in content
+
+
 def test_readiness_gate_treats_deprecation_warnings_as_errors() -> None:
     script = Path(__file__).resolve().parents[2] / "scripts" / "run_readiness_check.sh"
     content = script.read_text(encoding="utf-8")

backend/tests/test_sprint48_api_contract_audit.py

@@ -18,6 +18,9 @@ def test_api_contract_audit_checks_openapi_against_docs() -> None:
     content = script.read_text(encoding="utf-8")
 
     assert "create_app" in content
+    assert ".openapi()" in content
+    assert 'schema.get("paths", {})' in content
+    assert "for route in app.routes" not in content
     assert "docs/API_CONTRACTS.md" in content
     assert "Missing documented API route" in content
     assert "Documented API route is not implemented" in content

backend/tests/test_sprint8c_detection_visualization_qa.py

@@ -8,6 +8,7 @@ from fastapi.testclient import TestClient
 from geoalchemy2.shape import from_shape
 from shapely.geometry import Polygon, box
 
+from app.core.errors import AppError
 from app.main import app
 from app.db.session import get_db
 from app.models import AnalysisRun, Dataset, Detection, Job, Metric, Project, QualityCheck, VectorFeature
@@ -276,6 +277,54 @@ def test_detection_qa_no_match_case_persists_zero_scores() -> None:
     assert result["f1_score"] == 0.0
 
 
+def test_configured_yolo_qa_requires_persisted_tile_manifest_provenance() -> None:
+    project_id = uuid4()
+    dataset_id = uuid4()
+    reference_dataset_id = uuid4()
+    analysis_run_id = uuid4()
+    detection = _detection(project_id, dataset_id, analysis_run_id)
+    reference_dataset = Dataset(
+        id=reference_dataset_id,
+        project_id=project_id,
+        name="reference.geojson",
+        dataset_type="vector",
+        source="manual",
+        dataset_role="reference",
+    )
+    reference_feature = VectorFeature(
+        id=uuid4(),
+        dataset_id=reference_dataset_id,
+        feature_class="building",
+        geometry=from_shape(box(4.0, 51.0, 4.1, 51.1), srid=4326),
+    )
+    db = FakeSession(
+        objects={
+            (AnalysisRun, analysis_run_id): AnalysisRun(
+                id=analysis_run_id,
+                project_id=project_id,
+                dataset_id=dataset_id,
+                analysis_type="detection",
+                status="success",
+                model_name="yolo-configured",
+                parameters_json={"model_id": "yolo-configured"},
+            ),
+            (Dataset, reference_dataset_id): reference_dataset,
+        },
+        query_rows={Detection: [detection], VectorFeature: [reference_feature]},
+    )
+
+    with pytest.raises(AppError) as exc_info:
+        DetectionService.compare_detections_with_reference(
+            db=db,
+            analysis_run_id=analysis_run_id,
+            reference_dataset_id=reference_dataset_id,
+            iou_threshold=0.5,
+        )
+
+    assert exc_info.value.code == "DETECTION_QA_COVERAGE_UNAVAILABLE"
+    assert db.added == []
+
+
 def _coverage_manifest(tmp_path, dataset_id, bounds=(-1.0, -1.0, 3.0, 3.0)):
     manifest_path = tmp_path / "manifest.json"
     manifest_path.write_text(