@oneie/claude 0.6.0 → 0.7.0

package/scripts/typedb-cluster-status.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# typedb-cluster-status.sh — read the TypeDB Cloud CONTROL plane and answer the
+# one question the data plane cannot: is the instance running and the process
+# dying, or is the instance never coming up at all?
+#
+# This is step 1 of text/typedb-production-problem-solutions.md § Solutions.
+# Everything else about the cluster (resize vs rebuild vs escalate) is guessing
+# until this is read.
+#
+#   servers present but unhealthy  -> instance runs, TypeDB process fails
+#                                     => resource limits, resize (solution 2)
+#   servers empty / missing        -> instance is not being provisioned
+#                                     => platform issue, TypeDB support (solution 4)
+#   servers appear/disappear       -> crash loop, which is what the external
+#     between polls                  behaviour has looked like all along
+#
+# Usage:
+#   bash .claude/scripts/typedb-cluster-status.sh          # one read
+#   bash .claude/scripts/typedb-cluster-status.sh --watch  # poll 10x/5s — catches a crash loop
+#
+# Needs ONE secret this machine does not have. Mint it in the TypeDB Cloud
+# console (Settings -> API keys) and put it in .claude/typedb/prod.env
+# (gitignored, mode 600):
+#
+#   TYPEDB_CLOUD_TOKEN=<the key>
+#
+# The team / space / cluster IDs are DISCOVERED from the token — don't hunt for
+# them. Override only if discovery picks the wrong one:
+#   TYPEDB_CLOUD_TEAM_ID= / TYPEDB_CLOUD_SPACE_ID= / TYPEDB_CLOUD_CLUSTER_ID=
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PROD_ENV="$ROOT/.claude/typedb/prod.env"
+API="${TYPEDB_CLOUD_API:-https://cloud.typedb.com}"
+WATCH=0; [ "${1:-}" = "--watch" ] && WATCH=1
+
+[ -f "$PROD_ENV" ] && eval "$(python3 - "$PROD_ENV" <<'PY'
+import re,sys,shlex
+for line in open(sys.argv[1], errors="replace"):
+    m = re.match(r'^\s*(?:export\s+)?(TYPEDB_CLOUD_\w+)\s*=\s*(.*?)\s*$', line)
+    if m: print(f"{m.group(1)}={shlex.quote(m.group(2).strip(chr(34)+chr(39)))}")
+PY
+)"
+: "${TYPEDB_CLOUD_TOKEN:=}" "${TYPEDB_CLOUD_TEAM_ID:=}" "${TYPEDB_CLOUD_SPACE_ID:=}" "${TYPEDB_CLOUD_CLUSTER_ID:=}"
+
+if [ -z "$TYPEDB_CLOUD_TOKEN" ]; then
+  cat >&2 <<EOF
+CANNOT RUN: no TYPEDB_CLOUD_TOKEN.
+
+This is the control-plane credential, and it is NOT the same as the four
+TYPEDB_* keys already in prod.env — those log in to the cluster to run queries
+and carry no authority over the instance.
+
+  1. TypeDB Cloud console -> Settings -> API keys -> create
+  2. printf 'TYPEDB_CLOUD_TOKEN=%s\n' '<key>' >> $PROD_ENV
+     chmod 600 $PROD_ENV
+  3. re-run this script
+
+Verified reachable 2026-07-29: ${API}/api/v1/{team,teams,clusters,user} all
+answer 401 UNAUTHENTICATED_REQUEST, so the API is live and only wants the key.
+EOF
+  exit 3
+fi
+
+# The console has used more than one header scheme over time; try each and keep
+# whichever authenticates, rather than guessing one and reporting a false 401.
+AUTH=""
+for scheme in "Authorization: Bearer $TYPEDB_CLOUD_TOKEN" "X-API-Key: $TYPEDB_CLOUD_TOKEN" "Authorization: $TYPEDB_CLOUD_TOKEN"; do
+  code=$(curl -s -o /dev/null -m 20 -w '%{http_code}' -H "$scheme" "$API/api/v1/teams")
+  [ "$code" = "200" ] && { AUTH="$scheme"; break; }
+done
+if [ -z "$AUTH" ]; then
+  echo "CANNOT RUN: token rejected by every auth scheme tried (Bearer / X-API-Key / raw)." >&2
+  echo "  The key may be expired, scoped to another team, or the API may have moved." >&2
+  exit 3
+fi
+
+get() { curl -s -m 30 -H "$AUTH" "$API$1"; }
+
+# ── discover the IDs so nobody has to hunt for them ───────────────────────
+[ -z "$TYPEDB_CLOUD_TEAM_ID" ] && TYPEDB_CLOUD_TEAM_ID=$(get /api/v1/teams | python3 -c '
+import sys,json
+try:
+    d=json.load(sys.stdin)
+    ts=d.get("teams") or d.get("data") or (d if isinstance(d,list) else [])
+    print((ts[0].get("id") or ts[0].get("uuid") or ts[0].get("slug") or "") if ts else "")
+except Exception: print("")')
+[ -z "$TYPEDB_CLOUD_TEAM_ID" ] && { echo "CANNOT RUN: authenticated, but no team returned." >&2; exit 3; }
+
+[ -z "$TYPEDB_CLOUD_SPACE_ID" ] && TYPEDB_CLOUD_SPACE_ID=$(get "/api/v1/team/$TYPEDB_CLOUD_TEAM_ID/spaces" | python3 -c '
+import sys,json
+try:
+    d=json.load(sys.stdin)
+    ss=d.get("spaces") or d.get("data") or (d if isinstance(d,list) else [])
+    print((ss[0].get("id") or ss[0].get("uuid") or ss[0].get("slug") or "") if ss else "")
+except Exception: print("")')
+
+BASE="/api/v1/team/$TYPEDB_CLOUD_TEAM_ID/spaces/$TYPEDB_CLOUD_SPACE_ID/clusters"
+echo "team=$TYPEDB_CLOUD_TEAM_ID space=$TYPEDB_CLOUD_SPACE_ID"
+
+report() {
+  get "$BASE${TYPEDB_CLOUD_CLUSTER_ID:+/$TYPEDB_CLOUD_CLUSTER_ID}" | python3 - "$@" <<'PY'
+import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print("  (unparseable response)"); sys.exit(0)
+cs = d.get("clusters") or d.get("data") or (d if isinstance(d, list) else [d])
+for c in cs:
+    if not isinstance(c, dict): continue
+    name = c.get("id") or c.get("name") or c.get("slug") or "?"
+    servers = c.get("servers") or []
+    line = f"  cluster {name}  status={c.get('status','?')}  tier={c.get('machineType') or c.get('tier') or c.get('size','?')}  servers={len(servers)}"
+    for s in servers:
+        line += f"\n      server {s.get('id') or s.get('name','?')}  status={s.get('status','?')}"
+    print(line)
+    if not servers:
+        print("      NO SERVERS -> the instance is not being provisioned. Platform issue: raise with TypeDB support.")
+    elif any(str(s.get("status","")).lower() not in ("running","ready","healthy") for s in servers):
+        print("      UNHEALTHY SERVER -> the instance runs and the TypeDB process fails. Resource limits: resize.")
+PY
+}
+
+if [ $WATCH -eq 1 ]; then
+  echo "polling 10x every 5s — servers appearing and disappearing between polls IS the crash loop"
+  for i in $(seq 1 10); do printf '[%02d] ' "$i"; report; sleep 5; done
+else
+  report
+fi

package/scripts/typedb-env.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# typedb-env.sh — switch one.ie/web/.env between the local (dev) and cloud (prod)
+# TypeDB substrate. Rewrites only the four TYPEDB_* lines; everything else in
+# .env is untouched.
+#
+#   .claude/scripts/typedb-env.sh            # status
+#   .claude/scripts/typedb-env.sh dev        # point at local OrbStack container
+#   .claude/scripts/typedb-env.sh prod       # point back at TypeDB Cloud
+#   .claude/scripts/typedb-env.sh up         # start the local container
+#   .claude/scripts/typedb-env.sh down       # stop the local container
+#
+# Profiles live in .claude/typedb/{dev,prod}.env (gitignored — prod holds a
+# password). Re-snapshot prod at any time with:  cp-from-env prod
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENVF="$ROOT/one.ie/web/.env"
+PROFILES="$ROOT/.claude/typedb"
+KEYS='TYPEDB_URL TYPEDB_DATABASE TYPEDB_USERNAME TYPEDB_PASSWORD'
+CONTAINER=typedb
+# Pinned to the version TypeDB Cloud runs (checked via GET $TYPEDB_URL/v1/version).
+# Dev mirrors the substrate, it does not lead it — bump only when prod does.
+# Prod moved to 3.12.1 on 2026-07-29 and the local container was migrated in place
+# the same day; this pin was left at 3.8.3, so a container rebuild would have
+# silently DOWNGRADED local back under the two 3.8.3 server-killing bugs
+# (`\uXXXX` in a literal, and the same var in two roles → PANIC, not an error).
+IMAGE=typedb/typedb:3.12.1
+VOLUME=typedb-data
+# The path the SERVER actually writes to, not the one the tarball layout suggests.
+# `docker inspect typedb` -> `server --storage.data-directory=/var/lib/typedb/data`.
+# The old value mounted the named volume at /opt/... where nothing was ever written,
+# so every local database lived in an ANONYMOUS volume — one `docker rm` from being
+# orphaned, and no local backup would have contained anything.
+DATA_DIR=/var/lib/typedb/data
+
+die() { echo "typedb-env: $*" >&2; exit 1; }
+val() { grep -E "^$1=" "$ENVF" | tail -1 | cut -d= -f2-; }
+
+# Which profile does the live .env currently match? (compare URL only)
+current() {
+  local url; url=$(val TYPEDB_URL)
+  for p in dev prod; do
+    [ -f "$PROFILES/$p.env" ] || continue
+    if [ "$url" = "$(grep -E '^TYPEDB_URL=' "$PROFILES/$p.env" | cut -d= -f2-)" ]; then
+      echo "$p"; return
+    fi
+  done
+  echo "custom"
+}
+
+status() {
+  local cur; cur=$(current)
+  echo "profile : $cur"
+  echo "url     : $(val TYPEDB_URL)"
+  echo "database: $(val TYPEDB_DATABASE)"
+  local st; st=$(docker ps -a --filter "name=^${CONTAINER}$" --format '{{.Status}}' 2>/dev/null || true)
+  echo "local   : ${st:-not created}"
+  local url; url=$(val TYPEDB_URL)
+  if curl -sf -m 5 -X POST "$url/v1/signin" -H 'content-type: application/json' \
+       -d "{\"username\":\"$(val TYPEDB_USERNAME)\",\"password\":\"$(val TYPEDB_PASSWORD)\"}" \
+       >/dev/null 2>&1; then
+    echo "signin  : ok"
+  else
+    echo "signin  : FAILED"
+  fi
+  echo "scope   : one.ie/web/.env only — api/wrangler.toml stays pinned to cloud,"
+  echo "          as do tools that default to it when env is unset (pay/tools/"
+  echo "          simulate-market.ts, text/seed-tasks-typedb.ts, text/backfill-task-context.ts)"
+}
+
+use() {
+  local p="$1" src="$PROFILES/$1.env"
+  [ -f "$src" ] || die "no profile $p (expected $src)"
+  [ -f "$ENVF" ] || die "no env file at $ENVF"
+  # Snapshot named for the profile being LEFT, so a rollback target is never
+  # clobbered by the next switch (a single .bak slot ends up holding the very
+  # profile you were trying to get away from).
+  cp "$ENVF" "$ENVF.bak.$(current)"
+  for k in $KEYS; do
+    local line; line=$(grep -E "^$k=" "$src" | tail -1) || die "$p profile missing $k"
+    # in-place replace; portable sed needs the value escaped for & and /
+    local esc; esc=$(printf '%s' "$line" | sed -e 's/[\/&]/\\&/g')
+    if grep -qE "^$k=" "$ENVF"; then
+      sed -i '' -E "s/^$k=.*/$esc/" "$ENVF"
+    else
+      printf '%s\n' "$line" >> "$ENVF"
+    fi
+  done
+  echo "switched to $p"
+  status
+}
+
+up() {
+  docker info >/dev/null 2>&1 || { open -a OrbStack; echo "starting OrbStack..."; }
+  for _ in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
+  docker info >/dev/null 2>&1 || die "docker daemon did not come up"
+  if docker ps -a --format '{{.Names}}' | grep -qx "$CONTAINER"; then
+    docker start "$CONTAINER" >/dev/null
+  else
+    docker volume create "$VOLUME" >/dev/null
+    docker run -d --name "$CONTAINER" --restart unless-stopped \
+      -p 1729:1729 -p 8000:8000 -v "$VOLUME:$DATA_DIR" "$IMAGE" >/dev/null
+  fi
+  for _ in $(seq 1 30); do
+    curl -sf -m 3 -X POST http://127.0.0.1:8000/v1/signin -H 'content-type: application/json' \
+      -d '{"username":"admin","password":"password"}' >/dev/null 2>&1 && { echo "local TypeDB ready"; return; }
+    sleep 2
+  done
+  die "local TypeDB did not become ready — docker logs $CONTAINER"
+}
+
+down() { docker stop "$CONTAINER" >/dev/null 2>&1 && echo "local TypeDB stopped" || echo "not running"; }
+
+# Canonical load order — schema/CLAUDE.md § Files, narrowed to what production
+# actually carries (probed via GET $TYPEDB_URL/v1/databases/one/schema, 2026-07-28).
+# Deliberately excluded, because prod does NOT have them and dev must mirror the
+# substrate rather than lead it:
+#   factory-*.tql            — "DEFINES CLEAN, NOT DEPLOYED" per schema/CLAUDE.md
+#   marketing/contact/education-schema.tql
+#                            — documented "LOAD-SAFE against prod 2026-07-08", but
+#                              absent from the live schema AND they fail to commit
+#                              on a clean 3.8.3 db (INF11: `incremental_roas` and
+#                              `recommend_strategy` read attributes off variables
+#                              whose inferred types can't own them). Loading them
+#                              is a schema fix, not an env switch.
+SCHEMA_STACK='one.tql roles.tql do.tql reason.tql router.tql channels.tql'
+
+# seed — create the local `one` database and define the canonical stack.
+# LOCAL ONLY: refuses to run unless the active profile is dev, so a stray
+# invocation can never define schema against TypeDB Cloud.
+seed() {
+  [ "$(current)" = dev ] || die "refusing: active profile is '$(current)', not dev. Run 'typedb-env.sh dev' first."
+  local url; url=$(val TYPEDB_URL)
+  local db;  db=$(val TYPEDB_DATABASE)
+  local tok
+  tok=$(curl -s -m 15 -X POST "$url/v1/signin" -H 'Content-Type: application/json' \
+        -d "{\"username\":\"$(val TYPEDB_USERNAME)\",\"password\":\"$(val TYPEDB_PASSWORD)\"}" \
+        | python3 -c 'import sys,json;print(json.load(sys.stdin).get("token",""))' 2>/dev/null)
+  [ -n "$tok" ] || die "signin failed at $url"
+
+  if curl -s -m 10 "$url/v1/databases/$db" -H "Authorization: Bearer $tok" | grep -q '"name"'; then
+    echo "database '$db' exists"
+  else
+    curl -sf -m 30 -X POST "$url/v1/databases/$db" -H "Authorization: Bearer $tok" >/dev/null \
+      || die "could not create database '$db'"
+    echo "created database '$db'"
+  fi
+
+  for f in $SCHEMA_STACK; do
+    local path="$ROOT/schema/$f"
+    [ -f "$path" ] || die "missing $path"
+    python3 - "$path" "$db" > /tmp/typedb-seed.json <<'PY'
+import json, sys
+print(json.dumps({
+    "databaseName": sys.argv[2],
+    "transactionType": "schema",
+    "query": open(sys.argv[1]).read(),
+}))
+PY
+    local out
+    out=$(curl -s -m 120 -X POST "$url/v1/query" -H "Authorization: Bearer $tok" \
+          -H 'Content-Type: application/json' --data-binary @/tmp/typedb-seed.json)
+    if printf '%s' "$out" | grep -q '"code"'; then
+      echo "  FAIL $f"
+      printf '%s\n' "$out" | head -c 600; echo
+      die "schema load aborted at $f"
+    fi
+    echo "  ok   $f"
+  done
+  rm -f /tmp/typedb-seed.json
+  echo "local schema loaded ($(printf '%s' "$SCHEMA_STACK" | wc -w | tr -d ' ') files)"
+}
+
+case "${1:-status}" in
+  dev)    up; use dev ;;
+  prod)   use prod ;;
+  up)     up ;;
+  down)   down ;;
+  seed)   seed ;;
+  status) status ;;
+  *)      die "usage: typedb-env.sh [status|dev|prod|up|down|seed]" ;;
+esac

package/scripts/typedb-flap-recorder.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# typedb-flap-recorder.sh — record the NEXT production flap in full, so it does
+# not have to be reconstructed by hand the way 2026-07-28/29 was.
+#
+# The cluster is healthy between failures, which is exactly why this is hard:
+# by the time anyone looks, the transition is gone. This samples the three
+# layers that fail INDEPENDENTLY and timestamps every change of state:
+#
+#   /v1/health   204  — readiness. Cheapest, and the first to go.
+#   /v1/signin   200  — auth path. Can pass while queries fail.
+#   /v1/query    200  — the data plane actually doing work, with latency.
+#
+# The doc's open question is whether the backend dies under no load. This answers
+# it with a timeline instead of an inference: if health flips to 5xx while this
+# is the only client, that is measured, not argued.
+#
+# Usage:
+#   bash .claude/scripts/typedb-flap-recorder.sh              # foreground
+#   nohup bash .claude/scripts/typedb-flap-recorder.sh &      # leave it running
+#   INTERVAL=5 bash .claude/scripts/typedb-flap-recorder.sh   # tighter sampling
+#
+# Log: text/typedb-flap-log.tsv (append-only, gitignored-safe to commit if short)
+#   ts  health  signin  query  query_ms  note
+#
+# Writes a line on EVERY sample to the log, but prints to the terminal only when
+# the state CHANGES — so a week of green is quiet and the flap is loud.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LOG="${FLAP_LOG:-$ROOT/text/typedb-flap-log.tsv}"
+INTERVAL="${INTERVAL:-15}"
+
+eval "$(python3 - "$ROOT/.claude/typedb/prod.env" <<'PY'
+import re,sys,shlex
+try: f = open(sys.argv[1], errors="replace")
+except OSError: sys.exit(0)
+for line in f:
+    m = re.match(r'^\s*(?:export\s+)?(TYPEDB_(?:URL|DATABASE|USERNAME|PASSWORD))\s*=\s*(.*?)\s*$', line)
+    if m: print(f"{m.group(1)}={shlex.quote(m.group(2).strip(chr(34)+chr(39)))}")
+PY
+)"
+: "${TYPEDB_URL:=}" "${TYPEDB_DATABASE:=one}" "${TYPEDB_USERNAME:=admin}" "${TYPEDB_PASSWORD:=}"
+[ -z "$TYPEDB_URL" ] && { echo "CANNOT RUN: no TYPEDB_URL in .claude/typedb/prod.env" >&2; exit 3; }
+case "$TYPEDB_URL" in
+  *127.0.0.1*|*localhost*) echo "refusing: prod.env points at a LOCAL substrate — nothing to record" >&2; exit 2 ;;
+esac
+
+[ -f "$LOG" ] || printf 'ts\thealth\tsignin\tquery\tquery_ms\tnote\n' > "$LOG"
+echo "recording $TYPEDB_URL every ${INTERVAL}s -> $LOG   (ctrl-c to stop)"
+
+last=""
+while true; do
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  health=$(curl -s -o /dev/null -m 10 -w '%{http_code}' "$TYPEDB_URL/v1/health")
+  tok=$(curl -s -m 10 -X POST "$TYPEDB_URL/v1/signin" -H 'Content-Type: application/json' \
+        -d "{\"username\":\"$TYPEDB_USERNAME\",\"password\":\"$TYPEDB_PASSWORD\"}" \
+        | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("token",""))
+except Exception: print("")' 2>/dev/null)
+  if [ -n "$tok" ]; then
+    signin=200
+    t0=$(python3 -c 'import time;print(int(time.time()*1000))')
+    query=$(curl -s -o /dev/null -m 30 -w '%{http_code}' -X POST "$TYPEDB_URL/v1/query" \
+      -H "Authorization: Bearer $tok" -H 'Content-Type: application/json' \
+      -d "{\"databaseName\":\"$TYPEDB_DATABASE\",\"transactionType\":\"read\",\"query\":\"match \$x isa thing; reduce \$c = count;\"}")
+    t1=$(python3 -c 'import time;print(int(time.time()*1000))')
+    qms=$((t1 - t0))
+  else
+    # A signin that returns no token is NOT necessarily auth failure — on this
+    # cluster it is usually the backend being gone. Record the transport code.
+    signin=$(curl -s -o /dev/null -m 10 -w '%{http_code}' -X POST "$TYPEDB_URL/v1/signin" \
+             -H 'Content-Type: application/json' \
+             -d "{\"username\":\"$TYPEDB_USERNAME\",\"password\":\"$TYPEDB_PASSWORD\"}")
+    query="-"; qms="-"
+  fi
+
+  state="$health/$signin/$query"
+  note=""
+  [ "$state" != "$last" ] && [ -n "$last" ] && note="STATE CHANGE from $last"
+  printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$ts" "$health" "$signin" "$query" "$qms" "$note" >> "$LOG"
+  if [ "$state" != "$last" ]; then
+    printf '%s  health=%-4s signin=%-4s query=%-4s %sms  %s\n' "$ts" "$health" "$signin" "$query" "$qms" "$note"
+    last="$state"
+  fi
+  sleep "$INTERVAL"
+done

package/scripts/typedb-probes/containment-probe.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Settles the doc's UNCONFIRMED claim:
+
+    "Do NOT run `match (container: $x, contained: $x) isa containment;` — the
+     same variable in two roles. It appeared to kill the cluster outright
+     rather than return empty."
+
+Same oracle as the unicode panic probe: docker restart count before/after.
+Runs against a scratch db with a containment relation defined and a couple of
+real (non-self) edges, so an empty result is a meaningful empty.
+"""
+import json, subprocess, sys, time, urllib.request, urllib.error
+
+URL = "http://127.0.0.1:8000"
+DB = "selfrole"
+
+
+def restarts():
+    return subprocess.run(["docker", "inspect", "typedb", "--format", "{{.RestartCount}}"],
+                          capture_output=True, text=True).stdout.strip()
+
+
+def signin(tries=25):
+    for _ in range(tries):
+        try:
+            req = urllib.request.Request(URL + "/v1/signin", method="POST",
+                                         headers={"Content-Type": "application/json"})
+            with urllib.request.urlopen(req, json.dumps(
+                    {"username": "admin", "password": "password"}).encode(), timeout=5) as r:
+                return json.load(r)["token"]
+        except Exception:
+            time.sleep(1)
+    sys.exit("could not sign in")
+
+
+def send(tok, q, kind="read"):
+    req = urllib.request.Request(URL + "/v1/query", method="POST", headers={
+        "Content-Type": "application/json", "Authorization": "Bearer " + tok})
+    body = json.dumps({"databaseName": DB, "transactionType": kind, "query": q},
+                      ensure_ascii=False).encode("utf-8")
+    t0 = time.time()
+    try:
+        with urllib.request.urlopen(req, body, timeout=60) as r:
+            d = json.load(r)
+            n = len(d.get("answers") or [])
+            return f"200 ({n} answers)", time.time() - t0
+    except urllib.error.HTTPError as e:
+        return f"{e.code} {e.read()[:60].decode('utf-8','replace')}", time.time() - t0
+    except Exception as e:
+        return f"DROPPED({type(e).__name__})", time.time() - t0
+
+
+tok = signin()
+try:
+    urllib.request.urlopen(urllib.request.Request(
+        URL + f"/v1/databases/{DB}", method="POST",
+        headers={"Authorization": "Bearer " + tok}), b"", timeout=15).read()
+except Exception:
+    pass
+
+send(tok, """define
+  attribute nid, value string;
+  entity node, owns nid @key, plays containment:container, plays containment:contained;
+  relation containment, relates container, relates contained;""", "schema")
+send(tok, 'insert $a isa node, has nid "a"; $b isa node, has nid "b"; $c isa node, has nid "c";', "write")
+send(tok, 'match $a isa node, has nid "a"; $b isa node, has nid "b"; '
+          'insert $r links (container: $a, contained: $b), isa containment;', "write")
+send(tok, 'match $b isa node, has nid "b"; $c isa node, has nid "c"; '
+          'insert $r links (container: $b, contained: $c), isa containment;', "write")
+
+PROBES = [
+    ("sanity: normal containment read", 'match $r links (container: $x, contained: $y), isa containment; select $x, $y;'),
+    ("THE SUSPECT: same var in two roles", 'match $r links (container: $x, contained: $x), isa containment; select $x;'),
+    ("legacy paren syntax, same var",      'match ($x, $x) isa containment; select $x;'),
+    ("recovery: normal read again",        'match $r links (container: $x, contained: $y), isa containment; select $x, $y;'),
+]
+
+print(f"  {'probe':40} {'result':30} {'secs':>6}  restarts")
+prev = restarts()
+print(f"  {'(baseline)':40} {'-':30} {'-':>6}  {prev}")
+for name, q in PROBES:
+    res, secs = send(tok, q)
+    time.sleep(4)
+    r = restarts()
+    flag = "  <-- SERVER KILLED" if r != prev else ""
+    print(f"  {name:40} {res:30} {secs:6.2f}  {r}{flag}")
+    prev = r
+    tok = signin()

package/scripts/typedb-probes/panic-probe-version.py

@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+"""Run both confirmed server-killing query shapes against an arbitrary TypeDB.
+
+Usage: panic-probe-version.py <url> <container-name>
+Oracle is the container restart count, same as the 3.8.3 probes.
+"""
+import json, subprocess, sys, time, urllib.request, urllib.error
+
+URL, CONTAINER = sys.argv[1], sys.argv[2]
+DB = "panicver"
+
+
+def restarts():
+    return subprocess.run(["docker", "inspect", CONTAINER, "--format", "{{.RestartCount}}"],
+                          capture_output=True, text=True).stdout.strip()
+
+
+def alive():
+    try:
+        urllib.request.urlopen(urllib.request.Request(
+            URL + "/v1/signin", method="POST", headers={"Content-Type": "application/json"}),
+            json.dumps({"username": "admin", "password": "password"}).encode(), timeout=3)
+        return True
+    except urllib.error.HTTPError:
+        return True          # answered => process alive
+    except Exception:
+        return False
+
+
+def signin(tries=30):
+    for _ in range(tries):
+        try:
+            req = urllib.request.Request(URL + "/v1/signin", method="POST",
+                                         headers={"Content-Type": "application/json"})
+            with urllib.request.urlopen(req, json.dumps(
+                    {"username": "admin", "password": "password"}).encode(), timeout=5) as r:
+                return json.load(r)["token"]
+        except Exception:
+            time.sleep(1)
+    return None
+
+
+def send(tok, q, kind="write"):
+    req = urllib.request.Request(URL + "/v1/query", method="POST", headers={
+        "Content-Type": "application/json", "Authorization": "Bearer " + tok})
+    body = json.dumps({"databaseName": DB, "transactionType": kind, "query": q},
+                      ensure_ascii=False).encode("utf-8")
+    try:
+        with urllib.request.urlopen(req, body, timeout=30) as r:
+            d = json.load(r)
+            return f"200 ({len(d.get('answers') or [])} answers)"
+    except urllib.error.HTTPError as e:
+        return f"{e.code} {json.loads(e.read()).get('code','')}"
+    except Exception as e:
+        return f"DROPPED({type(e).__name__})"
+
+
+tok = signin()
+try:
+    urllib.request.urlopen(urllib.request.Request(
+        URL + f"/v1/databases/{DB}", method="POST",
+        headers={"Authorization": "Bearer " + tok}), b"", timeout=15).read()
+except Exception:
+    pass
+send(tok, """define
+  attribute note, value string; attribute nid, value string;
+  entity node, owns nid @key, owns note,
+    plays containment:container, plays containment:contained;
+  relation containment, relates container, relates contained;""", "schema")
+send(tok, 'insert $a isa node, has nid "a"; $b isa node, has nid "b";', "write")
+send(tok, 'match $a isa node, has nid "a"; $b isa node, has nid "b"; '
+          'insert $r links (container: $a, contained: $b), isa containment;', "write")
+
+PROBES = [
+    ("control: ASCII insert",             'insert $x isa node, has nid "ctl1", has note "plain";', "write"),
+    ("control: raw UTF-8 insert",         'insert $x isa node, has nid "ctl2", has note "café — ok";', "write"),
+    ("KILLER 1: \\uXXXX in literal",      'insert $x isa node, has nid "u1", has note "caf\\u00e9";', "write"),
+    ("KILLER 2: same var, two roles",     'match $r links (container: $x, contained: $x), isa containment; select $x;', "read"),
+    ("recovery: ASCII read",              'match $x isa node, has nid $n; select $n;', "read"),
+]
+
+print(f"  {'probe':36} {'result':30} restarts  alive")
+prev = restarts()
+print(f"  {'(baseline)':36} {'-':30} {prev:8}  {alive()}")
+for name, q, kind in PROBES:
+    res = send(tok, q, kind)
+    time.sleep(4)
+    r, a = restarts(), alive()
+    flag = "  <-- KILLED" if r != prev else ""
+    print(f"  {name:36} {res:30} {r:8}  {a}{flag}")
+    prev = r
+    tok = signin() or tok

package/scripts/typedb-probes/panic-probe.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Minimal reproducer: a \\uXXXX escape inside a TypeQL string literal PANICS
+TypeDB 3.8.3 and kills the server process.
+
+Each probe sends one write query and then reads the container's restart count.
+A rising restart count means that query killed the server, not that it errored.
+
+Usage: panic-probe.py [url]
+"""
+import json, subprocess, sys, time, urllib.request, urllib.error
+
+URL = sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:8000"
+DB = "paniclab"
+
+
+def restarts():
+    return subprocess.run(["docker", "inspect", "typedb", "--format", "{{.RestartCount}}"],
+                          capture_output=True, text=True).stdout.strip()
+
+
+def signin(tries=20):
+    for _ in range(tries):
+        try:
+            req = urllib.request.Request(URL + "/v1/signin", method="POST")
+            req.add_header("Content-Type", "application/json")
+            body = json.dumps({"username": "admin", "password": "password"}).encode()
+            with urllib.request.urlopen(req, body, timeout=5) as r:
+                return json.load(r)["token"]
+        except Exception:
+            time.sleep(1)
+    sys.exit("could not sign in")
+
+
+def send(tok, q, kind="write"):
+    req = urllib.request.Request(URL + "/v1/query", method="POST")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Authorization", "Bearer " + tok)
+    # ensure_ascii=False: the ESCAPE UNDER TEST must reach TypeQL as written,
+    # not be double-escaped by the JSON envelope.
+    body = json.dumps({"databaseName": DB, "transactionType": kind, "query": q},
+                      ensure_ascii=False).encode("utf-8")
+    try:
+        with urllib.request.urlopen(req, body, timeout=15) as r:
+            return str(r.status)
+    except urllib.error.HTTPError as e:
+        return str(e.code)
+    except Exception as e:
+        return f"DROPPED({type(e).__name__})"
+
+
+tok = signin()
+# fresh scratch db
+urllib.request.urlopen(urllib.request.Request(
+    URL + f"/v1/databases/{DB}", method="POST",
+    headers={"Authorization": "Bearer " + tok}), b"", timeout=15).read() if True else None
+send(tok, "define attribute note, value string; entity probe, owns note;", "schema")
+
+PROBES = [
+    ("ASCII literal",                  'insert $x isa probe, has note "plain ascii";'),
+    ("raw UTF-8 (e-acute, em-dash)",   'insert $x isa probe, has note "café — ok";'),
+    ("escaped quote",                  'insert $x isa probe, has note "she said \\"hi\\"";'),
+    ("\\uXXXX escape (e-acute)",       'insert $x isa probe, has note "caf\\u00e9";'),
+    ("\\uXXXX escape (control char)",  'insert $x isa probe, has note "bell\\u0007here";'),
+    ("ASCII again (did it recover?)",  'insert $x isa probe, has note "still alive";'),
+]
+
+print(f"  {'probe':38} {'http':16} restarts")
+before = restarts()
+print(f"  {'(baseline)':38} {'-':16} {before}")
+for name, q in PROBES:
+    code = send(tok, q)
+    time.sleep(4)          # let docker restart-policy settle before reading the count
+    r = restarts()
+    killed = " <-- SERVER KILLED" if r != before else ""
+    print(f"  {name:38} {code:16} {r}{killed}")
+    before = r
+    tok = signin()          # token dies with the process