@@ -223,14 +223,17 @@ function build_response( $location, $location_args ) {
 	$events = array();
 	$error  = null;
 
+	// Define defaults if not set in the request.
+	$location_args += array( 'restrict_by_country' => false );
+
 	if ( 'temp-request-throttled' === $location ) {
 		$location = array();
 		$error    = 'temp-request-throttled';
 	}
 
 	if ( $location ) {
 		$event_args = array(
-			'is_client_core' => is_client_core( $_SERVER['HTTP_USER_AGENT'] ),
+			'is_client_core'      => is_client_core( $_SERVER['HTTP_USER_AGENT'] ),
 			'restrict_by_country' => $location_args['restrict_by_country'],
 		);
 
@@ -810,13 +813,19 @@ function get_country_from_name( $country_name ) {
 function get_events( $args = array() ) {
 	global $wpdb, $cache_life, $cache_group;
 
-	// Sort to ensure consistent cache keys.
-	ksort( $args );
+	// Define defaults if not set in the request.
+	$args += array(
+		'is_client_core'      => false,
+		'restrict_by_country' => false,
+		'number'              => 10,
+	);
 
 	// number should be between 0 and 100, with a default of 10.
-	$args['number'] = $args['number'] ?? 10;
 	$args['number'] = max( 0, min( $args['number'], 100 ) );
 
+	// Sort to ensure consistent cache keys.
+	ksort( $args );
+
 	// Distances in kilometers
 	$event_distances = array(
 		'meetup'   => 100,
 
@@ -17,10 +17,10 @@ class Test_Events extends TestCase {
 	 * Asserts that an HTTP response is valid and contains an event.
 	 */
 	public function assertResponseHasEvent( $response ) {
-		$body  = json_decode( $response->body );
-		$event = $body->events[0];
+		$this->assertSame( 200, $response->status_code, 'Non-200 response body: ' . substr( $response->body, 0, 200 ) );
 
-		$this->assertSame( 200, $response->status_code );
+		$body = json_decode( $response->body );
+		$this->assertIsObject( $body, 'Response body was not valid JSON: ' . substr( $response->body, 0, 200 ) );
 		$this->assertNull( $body->error );
 
 		$this->assertIsObject( $body->location );
@@ -29,6 +29,8 @@ public function assertResponseHasEvent( $response ) {
 			( isset( $body->location->latitude ) && is_numeric( $body->location->latitude ) )
 		);
 
+		$this->assertNotEmpty( $body->events, 'Response contained no events.' );
+		$event = $body->events[0];
 		$this->assertContains( $event->type, array( 'wordcamp', 'meetup' ) );
 		$this->assertIsString( $event->title );
 		$this->assertIsNumeric( $event->start_unix_timestamp );
@@ -471,20 +473,31 @@ public function test_get_location( array $input, $expected ) : void {
 			$actual_result['description'] = strtolower( $actual_result['description'] );
 		}
 
-		/*
-		 * Normalize coordinates to account for minor differences in the databases.
-		 *
-		 * Rounding to three decimal places means that we're still accurate within about 110 meters, which is
-		 * good enough for our purposes.
-		 *
-		 * @link https://gis.stackexchange.com/a/8674/49125.
-		 */
-		if ( isset( $actual_result['latitude'], $actual_result['longitude'] ) ) {
-			$actual_result['latitude']  = number_format( round( $actual_result['latitude'],  3 ), 3 );
-			$actual_result['longitude'] = number_format( round( $actual_result['longitude'], 3 ), 3 );
+		$this->assertSameWithLatLonDelta( $expected, $actual_result );
+	}
+
+	/**
+	 * Assert that two location arrays match, allowing small drift in latitude/longitude.
+	 *
+	 * Compares lat/lon with a tolerance to absorb routine drift in the geo databases, and
+	 * compares the remaining fields exactly. A delta of 0.01 degrees is roughly 1km at the
+	 * equator — tight enough to catch a wrong-city match, loose enough to survive geonames
+	 * updates.
+	 *
+	 * @link https://gis.stackexchange.com/a/8674/49125.
+	 */
+	public function assertSameWithLatLonDelta( $expected, $actual, float $delta = 0.01 ) : void {
+		if ( is_array( $expected ) && is_array( $actual )
+			&& isset( $expected['latitude'], $expected['longitude'], $actual['latitude'], $actual['longitude'] )
+		) {
+			$this->assertEqualsWithDelta( (float) $expected['latitude'],  (float) $actual['latitude'],  $delta, 'latitude drifted beyond tolerance' );
+			$this->assertEqualsWithDelta( (float) $expected['longitude'], (float) $actual['longitude'], $delta, 'longitude drifted beyond tolerance' );
+
+			// Strip the coordinates so the remaining fields can be compared exactly.
+			unset( $expected['latitude'], $expected['longitude'], $actual['latitude'], $actual['longitude'] );
 		}
 
-		$this->assertSame( $expected, $actual_result );
+		$this->assertSame( $expected, $actual );
 	}
 
 	public static function data_get_location() : array {
@@ -813,12 +826,12 @@ public static function data_get_location() : array {
 
 			'city-endonym-ideographic-asia3' => array(
 				'input' => array(
-					'location_name' => 'كراچى',
+					'location_name' => 'کراچی',
 					'locale'        => 'ur',
 					'timezone'      => 'Asia/Karachi',
 				),
 				'expected' => array(
-					'description' => 'كراچى',
+					'description' => 'کراچی',
 					'latitude'    => '24.861',
 					'longitude'   => '67.010',
 					'country'     => 'PK',
@@ -1464,7 +1477,8 @@ public static function data_build_response() : array {
 
 			'throttled' => array(
 				'input' => array(
-					'location' => 'temp-request-throttled',
+					'location'      => 'temp-request-throttled',
+					'location_args' => array(),
 				),
 				'expected' => array(
 					'location' => array(),
@@ -1475,7 +1489,8 @@ public static function data_build_response() : array {
 
 			'no-location' => array(
 				'input' => array(
-					'location' => array(),
+					'location'      => array(),
+					'location_args' => array(),
 				),
 				'expected' => array(
 					'location' => array(),
 
@@ -11,7 +11,7 @@
 }
 
 // Signal to index.php that we're running tests so it skips main() / bootstrap() / init.php.
-define( 'WPORG_RUNNING_TESTS', true );
+defined( 'WPORG_RUNNING_TESTS' ) || define( 'WPORG_RUNNING_TESTS', true );
 
 // Time constants normally defined inside main().
 defined( 'HOUR_IN_SECONDS' ) || define( 'HOUR_IN_SECONDS', 60 * 60 );
@@ -41,6 +41,13 @@
 // Load the API entry-point so its functions are defined. main() is gated by WPORG_RUNNING_TESTS.
 require_once dirname( __DIR__ ) . '/index.php';
 
+// Load deps (hyperdb, etc.) so $wpdb is available for needs-db tests. Skipped on
+// open-source checkouts that don't have the API config — the bootstrap() call
+// itself requires init.php internally, which is gated above.
+if ( file_exists( $api_init_file ) ) {
+	\Dotorg\API\Events\bootstrap();
+}
+
 // Provide cache-function stubs (normally registered by disable_caching() inside main()).
 \Dotorg\API\Events\disable_caching();
 
@@ -54,8 +61,9 @@
  * @throws \RuntimeException When the request fails at the transport layer.
  */
 function send_request( $path ) {
-	$sandboxed = defined( 'WPORG_SANDBOXED' ) ? WPORG_SANDBOXED : false;
-	$host      = $sandboxed ? $sandboxed . '.wordpress.org' : 'api.wordpress.org';
+	// On a sandbox, the request has to be made to localhost with the Host header overridden.
+	$sandboxed = defined( 'WPORG_SANDBOXED' ) && WPORG_SANDBOXED;
+	$host      = $sandboxed ? '127.0.0.1' : 'api.wordpress.org';
 	$url       = 'https://' . $host . $path;
 
 	$body = file_get_contents(
@@ -69,6 +77,7 @@ function send_request( $path ) {
 				'timeout'       => 15,
 			),
 			'ssl'  => array(
+				'verify_peer'      => ! $sandboxed,
 				'verify_peer_name' => ! $sandboxed,
 			),
 		) )