@oneie/claude 0.6.0 → 0.8.0

package/scripts/typedb-env.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# typedb-env.sh — switch one.ie/web/.env between the local (dev) and cloud (prod)
+# TypeDB substrate. Rewrites only the four TYPEDB_* lines; everything else in
+# .env is untouched.
+#
+#   .claude/scripts/typedb-env.sh            # status
+#   .claude/scripts/typedb-env.sh dev        # point at local OrbStack container
+#   .claude/scripts/typedb-env.sh prod       # point back at TypeDB Cloud
+#   .claude/scripts/typedb-env.sh up         # start the local container
+#   .claude/scripts/typedb-env.sh down       # stop the local container
+#
+# Profiles live in .claude/typedb/{dev,prod}.env (gitignored — prod holds a
+# password). Re-snapshot prod at any time with:  cp-from-env prod
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENVF="$ROOT/one.ie/web/.env"
+PROFILES="$ROOT/.claude/typedb"
+KEYS='TYPEDB_URL TYPEDB_DATABASE TYPEDB_USERNAME TYPEDB_PASSWORD'
+CONTAINER=typedb
+# Pinned to the version TypeDB Cloud runs (checked via GET $TYPEDB_URL/v1/version).
+# Dev mirrors the substrate, it does not lead it — bump only when prod does.
+# Prod moved to 3.12.1 on 2026-07-29 and the local container was migrated in place
+# the same day; this pin was left at 3.8.3, so a container rebuild would have
+# silently DOWNGRADED local back under the two 3.8.3 server-killing bugs
+# (`\uXXXX` in a literal, and the same var in two roles → PANIC, not an error).
+IMAGE=typedb/typedb:3.12.1
+VOLUME=typedb-data
+# The path the SERVER actually writes to, not the one the tarball layout suggests.
+# `docker inspect typedb` -> `server --storage.data-directory=/var/lib/typedb/data`.
+# The old value mounted the named volume at /opt/... where nothing was ever written,
+# so every local database lived in an ANONYMOUS volume — one `docker rm` from being
+# orphaned, and no local backup would have contained anything.
+DATA_DIR=/var/lib/typedb/data
+
+die() { echo "typedb-env: $*" >&2; exit 1; }
+val() { grep -E "^$1=" "$ENVF" | tail -1 | cut -d= -f2-; }
+
+# Which profile does the live .env currently match? (compare URL only)
+current() {
+  local url; url=$(val TYPEDB_URL)
+  for p in dev prod; do
+    [ -f "$PROFILES/$p.env" ] || continue
+    if [ "$url" = "$(grep -E '^TYPEDB_URL=' "$PROFILES/$p.env" | cut -d= -f2-)" ]; then
+      echo "$p"; return
+    fi
+  done
+  echo "custom"
+}
+
+status() {
+  local cur; cur=$(current)
+  echo "profile : $cur"
+  echo "url     : $(val TYPEDB_URL)"
+  echo "database: $(val TYPEDB_DATABASE)"
+  local st; st=$(docker ps -a --filter "name=^${CONTAINER}$" --format '{{.Status}}' 2>/dev/null || true)
+  echo "local   : ${st:-not created}"
+  local url; url=$(val TYPEDB_URL)
+  if curl -sf -m 5 -X POST "$url/v1/signin" -H 'content-type: application/json' \
+       -d "{\"username\":\"$(val TYPEDB_USERNAME)\",\"password\":\"$(val TYPEDB_PASSWORD)\"}" \
+       >/dev/null 2>&1; then
+    echo "signin  : ok"
+  else
+    echo "signin  : FAILED"
+  fi
+  echo "scope   : one.ie/web/.env only — api/wrangler.toml stays pinned to cloud,"
+  echo "          as do tools that default to it when env is unset (pay/tools/"
+  echo "          simulate-market.ts, text/seed-tasks-typedb.ts, text/backfill-task-context.ts)"
+}
+
+use() {
+  local p="$1" src="$PROFILES/$1.env"
+  [ -f "$src" ] || die "no profile $p (expected $src)"
+  [ -f "$ENVF" ] || die "no env file at $ENVF"
+  # Snapshot named for the profile being LEFT, so a rollback target is never
+  # clobbered by the next switch (a single .bak slot ends up holding the very
+  # profile you were trying to get away from).
+  cp "$ENVF" "$ENVF.bak.$(current)"
+  for k in $KEYS; do
+    local line; line=$(grep -E "^$k=" "$src" | tail -1) || die "$p profile missing $k"
+    # in-place replace; portable sed needs the value escaped for & and /
+    local esc; esc=$(printf '%s' "$line" | sed -e 's/[\/&]/\\&/g')
+    if grep -qE "^$k=" "$ENVF"; then
+      sed -i '' -E "s/^$k=.*/$esc/" "$ENVF"
+    else
+      printf '%s\n' "$line" >> "$ENVF"
+    fi
+  done
+  echo "switched to $p"
+  status
+}
+
+up() {
+  docker info >/dev/null 2>&1 || { open -a OrbStack; echo "starting OrbStack..."; }
+  for _ in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
+  docker info >/dev/null 2>&1 || die "docker daemon did not come up"
+  if docker ps -a --format '{{.Names}}' | grep -qx "$CONTAINER"; then
+    docker start "$CONTAINER" >/dev/null
+  else
+    docker volume create "$VOLUME" >/dev/null
+    docker run -d --name "$CONTAINER" --restart unless-stopped \
+      -p 1729:1729 -p 8000:8000 -v "$VOLUME:$DATA_DIR" "$IMAGE" >/dev/null
+  fi
+  for _ in $(seq 1 30); do
+    curl -sf -m 3 -X POST http://127.0.0.1:8000/v1/signin -H 'content-type: application/json' \
+      -d '{"username":"admin","password":"password"}' >/dev/null 2>&1 && { echo "local TypeDB ready"; return; }
+    sleep 2
+  done
+  die "local TypeDB did not become ready — docker logs $CONTAINER"
+}
+
+down() { docker stop "$CONTAINER" >/dev/null 2>&1 && echo "local TypeDB stopped" || echo "not running"; }
+
+# Canonical load order — schema/CLAUDE.md § Files, narrowed to what production
+# actually carries (probed via GET $TYPEDB_URL/v1/databases/one/schema, 2026-07-28).
+# Deliberately excluded, because prod does NOT have them and dev must mirror the
+# substrate rather than lead it:
+#   factory-*.tql            — "DEFINES CLEAN, NOT DEPLOYED" per schema/CLAUDE.md
+#   marketing/contact/education-schema.tql
+#                            — documented "LOAD-SAFE against prod 2026-07-08", but
+#                              absent from the live schema AND they fail to commit
+#                              on a clean 3.8.3 db (INF11: `incremental_roas` and
+#                              `recommend_strategy` read attributes off variables
+#                              whose inferred types can't own them). Loading them
+#                              is a schema fix, not an env switch.
+SCHEMA_STACK='one.tql roles.tql do.tql reason.tql router.tql channels.tql'
+
+# seed — create the local `one` database and define the canonical stack.
+# LOCAL ONLY: refuses to run unless the active profile is dev, so a stray
+# invocation can never define schema against TypeDB Cloud.
+seed() {
+  [ "$(current)" = dev ] || die "refusing: active profile is '$(current)', not dev. Run 'typedb-env.sh dev' first."
+  local url; url=$(val TYPEDB_URL)
+  local db;  db=$(val TYPEDB_DATABASE)
+  local tok
+  tok=$(curl -s -m 15 -X POST "$url/v1/signin" -H 'Content-Type: application/json' \
+        -d "{\"username\":\"$(val TYPEDB_USERNAME)\",\"password\":\"$(val TYPEDB_PASSWORD)\"}" \
+        | python3 -c 'import sys,json;print(json.load(sys.stdin).get("token",""))' 2>/dev/null)
+  [ -n "$tok" ] || die "signin failed at $url"
+
+  if curl -s -m 10 "$url/v1/databases/$db" -H "Authorization: Bearer $tok" | grep -q '"name"'; then
+    echo "database '$db' exists"
+  else
+    curl -sf -m 30 -X POST "$url/v1/databases/$db" -H "Authorization: Bearer $tok" >/dev/null \
+      || die "could not create database '$db'"
+    echo "created database '$db'"
+  fi
+
+  for f in $SCHEMA_STACK; do
+    local path="$ROOT/schema/$f"
+    [ -f "$path" ] || die "missing $path"
+    python3 - "$path" "$db" > /tmp/typedb-seed.json <<'PY'
+import json, sys
+print(json.dumps({
+    "databaseName": sys.argv[2],
+    "transactionType": "schema",
+    "query": open(sys.argv[1]).read(),
+}))
+PY
+    local out
+    out=$(curl -s -m 120 -X POST "$url/v1/query" -H "Authorization: Bearer $tok" \
+          -H 'Content-Type: application/json' --data-binary @/tmp/typedb-seed.json)
+    if printf '%s' "$out" | grep -q '"code"'; then
+      echo "  FAIL $f"
+      printf '%s\n' "$out" | head -c 600; echo
+      die "schema load aborted at $f"
+    fi
+    echo "  ok   $f"
+  done
+  rm -f /tmp/typedb-seed.json
+  echo "local schema loaded ($(printf '%s' "$SCHEMA_STACK" | wc -w | tr -d ' ') files)"
+}
+
+case "${1:-status}" in
+  dev)    up; use dev ;;
+  prod)   use prod ;;
+  up)     up ;;
+  down)   down ;;
+  seed)   seed ;;
+  status) status ;;
+  *)      die "usage: typedb-env.sh [status|dev|prod|up|down|seed]" ;;
+esac

package/scripts/typedb-flake-check.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+# typedb-flake-check.sh — decide whether a RED vitest log is ONLY the shared
+# TypeDB Cloud cluster being unavailable, and therefore safe to ship past.
+#
+# manifest: portable
+#
+# WHY THIS EXISTS. `one.ie/web`'s suite talks to a REAL shared TypeDB Cloud
+# cluster (CLAUDE.md: "Don't mock TypeDB in integration tests"). When that
+# cluster blips or a query exceeds its timeout, a handful of task/substrate
+# suites go red without anything in the diff being wrong. Before this script the
+# operator read the log by eye and decided — which is exactly the judgement call
+# that gets rubber-stamped at 2am on the fifth deploy attempt.
+#
+# WHAT IT IS NOT. It is not a failure allowlist by FILE. A file-based allowlist
+# waves through every future failure in that file, including real ones. This
+# keys on the failure SIGNATURE — the substrate was unreachable — so a genuine
+# assertion break in the very same test still blocks.
+#
+# THE HARD LINE. `not_found` from `tasks:claim` is the privilege boundary. Four
+# separate defects presented as exactly that string and were fixed 2026-08-02
+# (see deploy.md's Known-Flaky section). It is NEVER a flake, it is never
+# waived, and it is checked BEFORE the flake signatures so no combination of
+# other output can pass it.
+#
+# CONTRACT
+#   exit 0 — every failure carries a substrate-unavailable signature. Waivable.
+#   exit 1 — at least one failure is real, or the log could not be classified.
+# Silence is never a pass: a log with no parseable "Tests N failed" line exits 1.
+#
+#   bash .claude/scripts/typedb-flake-check.sh <vitest-log>
+#   bash .claude/scripts/typedb-flake-check.sh --self-test
+set -uo pipefail
+
+# ── signatures ───────────────────────────────────────────────────────────────
+# The substrate refused to answer. Nothing downstream of these proved anything.
+FLAKE_RE='upstream_50[234]|status=50[234]|fixture write failed|Test timed out in [0-9]+ ?ms|ETIMEDOUT|ECONNRESET|ECONNREFUSED|EAI_AGAIN|socket hang up|fetch failed|TypeDB.*(unavailable|timed out|connection)|Failed to connect'
+
+# Never waivable, whatever else the log says: the privilege boundary. Matched
+# against failure BODIES only, in the awk below -- see the comment there.
+NEVER_RE='not_found'
+
+classify() {
+  local log="$1" fails blocks matched
+  [ -f "$log" ] || { echo "typedb-flake: no such log: $log"; return 1; }
+
+  # A COLLECT CRASH — vitest's bracketed form, `FAIL  path/x.test.ts [ path/x.test.ts ]`
+  # followed by a parse/import error — ran ZERO tests. It is never a cluster blip
+  # and never waivable: on 2026-09-05 a truncated gitignored JSON crashed the
+  # collect of deploy-board.test.tsx and the waiver called it a TypeDB outage
+  # (vitest-collect-crash-reads-as-pass, through the waiver door).
+  if grep -qE '^ *FAIL +[^ ]+\.test\.[a-z]+ +\[ +[^ ]+\.test\.[a-z]+ +\]' "$log"; then
+    echo "typedb-flake: BLOCKED -- a test file failed to COLLECT ($(grep -oE '^ *FAIL +[^ ]+\.test\.[a-z]+ +\[' "$log" | head -1 | awk '{print $2}')). Zero tests ran there. Not a flake."
+    return 1
+  fi
+  # Unhandled errors ("Errors  45 errors") fail the run with ZERO failed tests.
+  # They are never a cluster blip and never waivable — refuse before anything
+  # else, or a red run reads GREEN here (measured 2026-09-05).
+  if grep -qE 'Errors +[1-9][0-9]* errors?' "$log"; then
+    echo "typedb-flake: BLOCKED -- the log carries unhandled errors ($(grep -Eo 'Errors +[0-9]+ errors?' "$log" | tail -1)). Not a flake."
+    return 1
+  fi
+  # How many tests vitest itself says failed. No line ⇒ we cannot classify ⇒ RED.
+  fails=$(grep -Eo 'Tests +[0-9]+ failed' "$log" | tail -1 | grep -Eo '[0-9]+' || true)
+  if [ -z "$fails" ]; then
+    # A green log has "Tests N passed" and no "failed" — that is not our business.
+    if grep -qE 'Tests +[0-9]+ passed' "$log" && ! grep -qE '[0-9]+ failed' "$log"; then
+      echo "typedb-flake: log is GREEN — nothing to classify"; return 1
+    fi
+    echo "typedb-flake: cannot find a 'Tests N failed' line — refusing to classify"; return 1
+  fi
+
+  # The hard line, checked first and independently of everything else.
+  #
+  # Scoped to failure BODIES, with the FAIL header line dropped. Two reasons,
+  # both real: (a) a whole-log grep sees `not_found` in the NAME of a perfectly
+  # healthy test -- tasks-do-roundtrip.test.ts really does contain
+  # `claim by an unknown slug is not_found, never a silent success`, so a
+  # log-wide grep let one passing test veto every deploy; (b) `not_found` is
+  # legitimate ASSERTED output in the tests that check the boundary holds. What
+  # is never acceptable is `not_found` as the RECEIVED value of a failure.
+  # `seen` bounds the FIRST block: before any FAIL header the accumulator holds
+  # the log PREAMBLE — gate banners plus the stderr of every PASSING test that
+  # ran first — and a passing test's NAME ("…is not_found") or asserted output
+  # ("workspace_not_found") tripped this on two deploys (2026-09-05), once with a
+  # confident wrong diagnosis pointing at tasks:claim for an un-regenerated
+  # roster. A body is only a failure body once a header has opened it.
+  if awk -v re="$NEVER_RE" '
+      /^ *(FAIL|Unhandled)/ { if (seen && body ~ re) { print "HIT"; exit } ; seen = 1; body = ""; next }
+      { body = body "\n" $0 }
+      END { if (seen && body ~ re) print "HIT" }
+    ' "$log" | grep -q HIT; then
+    echo "typedb-flake: BLOCKED -- a failure BODY contains 'not_found'."
+    echo "  That is the tasks:claim privilege boundary, not a cluster blip."
+    echo "  It is never waived. See deploy.md section Known-Flaky Test Allowlist."
+    return 1
+  fi
+
+  # Split the log into vitest's per-failure blocks (the ⎯[n/m]⎯ separators) and
+  # require EVERY one of them to carry a substrate signature. Counting matched
+  # blocks rather than grepping the whole file is the point: one flake signature
+  # anywhere must not vouch for an unrelated assertion failure beside it.
+  blocks=$(awk '/^ *(FAIL|Unhandled)/{n++} END{print n+0}' "$log")
+  matched=$(awk -v re="$FLAKE_RE" '
+    /^ *(FAIL|Unhandled)/ { if (cur != "" && cur ~ re) m++; cur = $0; next }
+    { cur = cur "\n" $0 }
+    END { if (cur != "" && cur ~ re) m++; print m+0 }
+  ' "$log")
+
+  if [ "$blocks" -eq 0 ]; then
+    echo "typedb-flake: $fails failed test(s) but no FAIL blocks parsed — refusing to classify"; return 1
+  fi
+  if [ "$matched" -lt "$blocks" ]; then
+    echo "typedb-flake: BLOCKED — $matched/$blocks failure blocks look like substrate outage."
+    echo "  $(( blocks - matched )) failure(s) are REAL. Diagnose them."
+    return 1
+  fi
+  echo "typedb-flake: WAIVABLE — all $blocks failure block(s) ($fails test(s)) are substrate-unavailable."
+  echo "  Signature matched: shared TypeDB Cloud did not answer. Nothing was disproven."
+  return 0
+}
+
+# ── --self-test: prove the checker can go RED ────────────────────────────────
+# A classifier that only ever says "waivable" is worse than no classifier. This
+# drives both halves, including the two ways it must refuse.
+if [ "${1:-}" = "--self-test" ]; then
+  d=$(mktemp -d); fails=0
+  t() { # name expected_rc file
+    local name="$1" want="$2" f="$3" got
+    classify "$f" >/dev/null 2>&1; got=$?
+    if [ "$got" -eq "$want" ]; then echo "  ok   $name (rc=$got)"
+    else echo "  FAIL $name — wanted rc=$want got rc=$got"; fails=$((fails+1)); fi
+  }
+
+  cat >"$d/flake.log" <<'EOF'
+ FAIL  tests/unit/tasks-humans.test.ts > seeds a task
+Error: fixture write failed (status=503 error=upstream_503)
+⎯⎯⎯[1/1]⎯
+ Test Files  1 failed | 900 passed (901)
+      Tests  1 failed | 9000 passed (9001)
+EOF
+  t "pure 503 outage is waivable" 0 "$d/flake.log"
+
+  cat >"$d/real.log" <<'EOF'
+ FAIL  tests/unit/billing.test.ts > charges the card once
+AssertionError: expected 2 to be 1
+⎯⎯⎯[1/1]⎯
+ Test Files  1 failed | 900 passed (901)
+      Tests  1 failed | 9000 passed (9001)
+EOF
+  t "a real assertion failure BLOCKS" 1 "$d/real.log"
+
+  cat >"$d/mixed.log" <<'EOF'
+ FAIL  tests/unit/tasks-humans.test.ts > seeds a task
+Error: fixture write failed (status=503 error=upstream_503)
+ FAIL  tests/unit/billing.test.ts > charges the card once
+AssertionError: expected 2 to be 1
+⎯⎯⎯[2/2]⎯
+ Test Files  2 failed | 900 passed (902)
+      Tests  2 failed | 9000 passed (9002)
+EOF
+  t "one flake must not vouch for its neighbour" 1 "$d/mixed.log"
+
+  cat >"$d/notfound.log" <<'EOF'
+ FAIL  tests/unit/tasks-containment.test.ts > a task is claimable
+AssertionError: expected 'not_found' to be undefined
+Error: fixture write failed (status=503 error=upstream_503)
+⎯⎯⎯[1/1]⎯
+ Test Files  1 failed | 900 passed (901)
+      Tests  1 failed | 9000 passed (9001)
+EOF
+  t "not_found BLOCKS even wrapped in a 503" 1 "$d/notfound.log"
+
+  cat >"$d/nameonly.log" <<'EOF'
+ FAIL  tests/tasks-do-roundtrip.test.ts > claim by an unknown slug is not_found, never a silent success
+Error: fixture write failed (status=503 error=upstream_503)
+ Test Files  1 failed | 900 passed (901)
+      Tests  1 failed | 9000 passed (9001)
+EOF
+  t "not_found in a test NAME does not block a real 503" 0 "$d/nameonly.log"
+
+  cat >"$d/green.log" <<'EOF'
+ Test Files  901 passed (901)
+      Tests  9001 passed (9001)
+EOF
+  t "a green log is not classifiable" 1 "$d/green.log"
+
+  : >"$d/empty.log"
+  t "an empty log is not a pass" 1 "$d/empty.log"
+
+  rm -rf "$d"
+  [ "$fails" -eq 0 ] && { echo "typedb-flake: self-test PASS"; exit 0; }
+  echo "typedb-flake: self-test FAILED ($fails)"; exit 1
+fi
+
+classify "${1:?usage: typedb-flake-check.sh <vitest-log> | --self-test}"

package/scripts/typedb-flap-recorder.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# typedb-flap-recorder.sh — record the NEXT production flap in full, so it does
+# not have to be reconstructed by hand the way 2026-07-28/29 was.
+#
+# The cluster is healthy between failures, which is exactly why this is hard:
+# by the time anyone looks, the transition is gone. This samples the three
+# layers that fail INDEPENDENTLY and timestamps every change of state:
+#
+#   /v1/health   204  — readiness. Cheapest, and the first to go.
+#   /v1/signin   200  — auth path. Can pass while queries fail.
+#   /v1/query    200  — the data plane actually doing work, with latency.
+#
+# The doc's open question is whether the backend dies under no load. This answers
+# it with a timeline instead of an inference: if health flips to 5xx while this
+# is the only client, that is measured, not argued.
+#
+# Usage:
+#   bash .claude/scripts/typedb-flap-recorder.sh              # foreground
+#   nohup bash .claude/scripts/typedb-flap-recorder.sh &      # leave it running
+#   INTERVAL=5 bash .claude/scripts/typedb-flap-recorder.sh   # tighter sampling
+#
+# Log: text/typedb-flap-log.tsv (append-only, gitignored-safe to commit if short)
+#   ts  health  signin  query  query_ms  note
+#
+# Writes a line on EVERY sample to the log, but prints to the terminal only when
+# the state CHANGES — so a week of green is quiet and the flap is loud.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LOG="${FLAP_LOG:-$ROOT/text/typedb-flap-log.tsv}"
+INTERVAL="${INTERVAL:-15}"
+
+eval "$(python3 - "$ROOT/.claude/typedb/prod.env" <<'PY'
+import re,sys,shlex
+try: f = open(sys.argv[1], errors="replace")
+except OSError: sys.exit(0)
+for line in f:
+    m = re.match(r'^\s*(?:export\s+)?(TYPEDB_(?:URL|DATABASE|USERNAME|PASSWORD))\s*=\s*(.*?)\s*$', line)
+    if m: print(f"{m.group(1)}={shlex.quote(m.group(2).strip(chr(34)+chr(39)))}")
+PY
+)"
+: "${TYPEDB_URL:=}" "${TYPEDB_DATABASE:=one}" "${TYPEDB_USERNAME:=admin}" "${TYPEDB_PASSWORD:=}"
+[ -z "$TYPEDB_URL" ] && { echo "CANNOT RUN: no TYPEDB_URL in .claude/typedb/prod.env" >&2; exit 3; }
+case "$TYPEDB_URL" in
+  *127.0.0.1*|*localhost*) echo "refusing: prod.env points at a LOCAL substrate — nothing to record" >&2; exit 2 ;;
+esac
+
+[ -f "$LOG" ] || printf 'ts\thealth\tsignin\tquery\tquery_ms\tnote\n' > "$LOG"
+echo "recording $TYPEDB_URL every ${INTERVAL}s -> $LOG   (ctrl-c to stop)"
+
+last=""
+while true; do
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  health=$(curl -s -o /dev/null -m 10 -w '%{http_code}' "$TYPEDB_URL/v1/health")
+  tok=$(curl -s -m 10 -X POST "$TYPEDB_URL/v1/signin" -H 'Content-Type: application/json' \
+        -d "{\"username\":\"$TYPEDB_USERNAME\",\"password\":\"$TYPEDB_PASSWORD\"}" \
+        | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("token",""))
+except Exception: print("")' 2>/dev/null)
+  if [ -n "$tok" ]; then
+    signin=200
+    t0=$(python3 -c 'import time;print(int(time.time()*1000))')
+    query=$(curl -s -o /dev/null -m 30 -w '%{http_code}' -X POST "$TYPEDB_URL/v1/query" \
+      -H "Authorization: Bearer $tok" -H 'Content-Type: application/json' \
+      -d "{\"databaseName\":\"$TYPEDB_DATABASE\",\"transactionType\":\"read\",\"query\":\"match \$x isa thing; reduce \$c = count;\"}")
+    t1=$(python3 -c 'import time;print(int(time.time()*1000))')
+    qms=$((t1 - t0))
+  else
+    # A signin that returns no token is NOT necessarily auth failure — on this
+    # cluster it is usually the backend being gone. Record the transport code.
+    signin=$(curl -s -o /dev/null -m 10 -w '%{http_code}' -X POST "$TYPEDB_URL/v1/signin" \
+             -H 'Content-Type: application/json' \
+             -d "{\"username\":\"$TYPEDB_USERNAME\",\"password\":\"$TYPEDB_PASSWORD\"}")
+    query="-"; qms="-"
+  fi
+
+  state="$health/$signin/$query"
+  note=""
+  [ "$state" != "$last" ] && [ -n "$last" ] && note="STATE CHANGE from $last"
+  printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$ts" "$health" "$signin" "$query" "$qms" "$note" >> "$LOG"
+  if [ "$state" != "$last" ]; then
+    printf '%s  health=%-4s signin=%-4s query=%-4s %sms  %s\n' "$ts" "$health" "$signin" "$query" "$qms" "$note"
+    last="$state"
+  fi
+  sleep "$INTERVAL"
+done

package/scripts/typedb-probes/containment-probe.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Settles the doc's UNCONFIRMED claim:
+
+    "Do NOT run `match (container: $x, contained: $x) isa containment;` — the
+     same variable in two roles. It appeared to kill the cluster outright
+     rather than return empty."
+
+Same oracle as the unicode panic probe: docker restart count before/after.
+Runs against a scratch db with a containment relation defined and a couple of
+real (non-self) edges, so an empty result is a meaningful empty.
+"""
+import json, subprocess, sys, time, urllib.request, urllib.error
+
+URL = "http://127.0.0.1:8000"
+DB = "selfrole"
+
+
+def restarts():
+    return subprocess.run(["docker", "inspect", "typedb", "--format", "{{.RestartCount}}"],
+                          capture_output=True, text=True).stdout.strip()
+
+
+def signin(tries=25):
+    for _ in range(tries):
+        try:
+            req = urllib.request.Request(URL + "/v1/signin", method="POST",
+                                         headers={"Content-Type": "application/json"})
+            with urllib.request.urlopen(req, json.dumps(
+                    {"username": "admin", "password": "password"}).encode(), timeout=5) as r:
+                return json.load(r)["token"]
+        except Exception:
+            time.sleep(1)
+    sys.exit("could not sign in")
+
+
+def send(tok, q, kind="read"):
+    req = urllib.request.Request(URL + "/v1/query", method="POST", headers={
+        "Content-Type": "application/json", "Authorization": "Bearer " + tok})
+    body = json.dumps({"databaseName": DB, "transactionType": kind, "query": q},
+                      ensure_ascii=False).encode("utf-8")
+    t0 = time.time()
+    try:
+        with urllib.request.urlopen(req, body, timeout=60) as r:
+            d = json.load(r)
+            n = len(d.get("answers") or [])
+            return f"200 ({n} answers)", time.time() - t0
+    except urllib.error.HTTPError as e:
+        return f"{e.code} {e.read()[:60].decode('utf-8','replace')}", time.time() - t0
+    except Exception as e:
+        return f"DROPPED({type(e).__name__})", time.time() - t0
+
+
+tok = signin()
+try:
+    urllib.request.urlopen(urllib.request.Request(
+        URL + f"/v1/databases/{DB}", method="POST",
+        headers={"Authorization": "Bearer " + tok}), b"", timeout=15).read()
+except Exception:
+    pass
+
+send(tok, """define
+  attribute nid, value string;
+  entity node, owns nid @key, plays containment:container, plays containment:contained;
+  relation containment, relates container, relates contained;""", "schema")
+send(tok, 'insert $a isa node, has nid "a"; $b isa node, has nid "b"; $c isa node, has nid "c";', "write")
+send(tok, 'match $a isa node, has nid "a"; $b isa node, has nid "b"; '
+          'insert $r links (container: $a, contained: $b), isa containment;', "write")
+send(tok, 'match $b isa node, has nid "b"; $c isa node, has nid "c"; '
+          'insert $r links (container: $b, contained: $c), isa containment;', "write")
+
+PROBES = [
+    ("sanity: normal containment read", 'match $r links (container: $x, contained: $y), isa containment; select $x, $y;'),
+    ("THE SUSPECT: same var in two roles", 'match $r links (container: $x, contained: $x), isa containment; select $x;'),
+    ("legacy paren syntax, same var",      'match ($x, $x) isa containment; select $x;'),
+    ("recovery: normal read again",        'match $r links (container: $x, contained: $y), isa containment; select $x, $y;'),
+]
+
+print(f"  {'probe':40} {'result':30} {'secs':>6}  restarts")
+prev = restarts()
+print(f"  {'(baseline)':40} {'-':30} {'-':>6}  {prev}")
+for name, q in PROBES:
+    res, secs = send(tok, q)
+    time.sleep(4)
+    r = restarts()
+    flag = "  <-- SERVER KILLED" if r != prev else ""
+    print(f"  {name:40} {res:30} {secs:6.2f}  {r}{flag}")
+    prev = r
+    tok = signin()

package/scripts/typedb-probes/panic-probe-version.py

@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+"""Run both confirmed server-killing query shapes against an arbitrary TypeDB.
+
+Usage: panic-probe-version.py <url> <container-name>
+Oracle is the container restart count, same as the 3.8.3 probes.
+"""
+import json, subprocess, sys, time, urllib.request, urllib.error
+
+URL, CONTAINER = sys.argv[1], sys.argv[2]
+DB = "panicver"
+
+
+def restarts():
+    return subprocess.run(["docker", "inspect", CONTAINER, "--format", "{{.RestartCount}}"],
+                          capture_output=True, text=True).stdout.strip()
+
+
+def alive():
+    try:
+        urllib.request.urlopen(urllib.request.Request(
+            URL + "/v1/signin", method="POST", headers={"Content-Type": "application/json"}),
+            json.dumps({"username": "admin", "password": "password"}).encode(), timeout=3)
+        return True
+    except urllib.error.HTTPError:
+        return True          # answered => process alive
+    except Exception:
+        return False
+
+
+def signin(tries=30):
+    for _ in range(tries):
+        try:
+            req = urllib.request.Request(URL + "/v1/signin", method="POST",
+                                         headers={"Content-Type": "application/json"})
+            with urllib.request.urlopen(req, json.dumps(
+                    {"username": "admin", "password": "password"}).encode(), timeout=5) as r:
+                return json.load(r)["token"]
+        except Exception:
+            time.sleep(1)
+    return None
+
+
+def send(tok, q, kind="write"):
+    req = urllib.request.Request(URL + "/v1/query", method="POST", headers={
+        "Content-Type": "application/json", "Authorization": "Bearer " + tok})
+    body = json.dumps({"databaseName": DB, "transactionType": kind, "query": q},
+                      ensure_ascii=False).encode("utf-8")
+    try:
+        with urllib.request.urlopen(req, body, timeout=30) as r:
+            d = json.load(r)
+            return f"200 ({len(d.get('answers') or [])} answers)"
+    except urllib.error.HTTPError as e:
+        return f"{e.code} {json.loads(e.read()).get('code','')}"
+    except Exception as e:
+        return f"DROPPED({type(e).__name__})"
+
+
+tok = signin()
+try:
+    urllib.request.urlopen(urllib.request.Request(
+        URL + f"/v1/databases/{DB}", method="POST",
+        headers={"Authorization": "Bearer " + tok}), b"", timeout=15).read()
+except Exception:
+    pass
+send(tok, """define
+  attribute note, value string; attribute nid, value string;
+  entity node, owns nid @key, owns note,
+    plays containment:container, plays containment:contained;
+  relation containment, relates container, relates contained;""", "schema")
+send(tok, 'insert $a isa node, has nid "a"; $b isa node, has nid "b";', "write")
+send(tok, 'match $a isa node, has nid "a"; $b isa node, has nid "b"; '
+          'insert $r links (container: $a, contained: $b), isa containment;', "write")
+
+PROBES = [
+    ("control: ASCII insert",             'insert $x isa node, has nid "ctl1", has note "plain";', "write"),
+    ("control: raw UTF-8 insert",         'insert $x isa node, has nid "ctl2", has note "café — ok";', "write"),
+    ("KILLER 1: \\uXXXX in literal",      'insert $x isa node, has nid "u1", has note "caf\\u00e9";', "write"),
+    ("KILLER 2: same var, two roles",     'match $r links (container: $x, contained: $x), isa containment; select $x;', "read"),
+    ("recovery: ASCII read",              'match $x isa node, has nid $n; select $n;', "read"),
+]
+
+print(f"  {'probe':36} {'result':30} restarts  alive")
+prev = restarts()
+print(f"  {'(baseline)':36} {'-':30} {prev:8}  {alive()}")
+for name, q, kind in PROBES:
+    res = send(tok, q, kind)
+    time.sleep(4)
+    r, a = restarts(), alive()
+    flag = "  <-- KILLED" if r != prev else ""
+    print(f"  {name:36} {res:30} {r:8}  {a}{flag}")
+    prev = r
+    tok = signin() or tok