iris-vector-graph 2.18.5__tar.gz → 2.18.7__tar.gz

{iris_vector_graph-2.18.5 → iris_vector_graph-2.18.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: iris-vector-graph
-Version: 2.18.5
+Version: 2.18.7
 Summary: Native graph database layer for InterSystems IRIS — openCypher, hybrid vector search, temporal property graph, RDF export, SHACL validation
 Project-URL: Homepage, https://github.com/intersystems-community/iris-vector-graph
 Project-URL: Documentation, https://github.com/intersystems-community/iris-vector-graph/tree/main/docs
@@ -207,7 +207,7 @@ and [docs/performance/GRAPH_ALGORITHMS.md](docs/performance/GRAPH_ALGORITHMS.md)
 
 ```text
 ┌─────────────────────────────────────────────────────────────────────┐
-│                    iris-vector-graph  v2.18.0                       │
+│                    iris-vector-graph  v2.18.5                       │
 ├─────────────────────────────────────────────────────────────────────┤
 │                                                                     │
 │   ┌───────────────┐   ┌───────────────┐   ┌───────────────────┐    │

{iris_vector_graph-2.18.5 → iris_vector_graph-2.18.7}/README.md

@@ -109,7 +109,7 @@ and [docs/performance/GRAPH_ALGORITHMS.md](docs/performance/GRAPH_ALGORITHMS.md)
 
 ```text
 ┌─────────────────────────────────────────────────────────────────────┐
-│                    iris-vector-graph  v2.18.0                       │
+│                    iris-vector-graph  v2.18.5                       │
 ├─────────────────────────────────────────────────────────────────────┤
 │                                                                     │
 │   ┌───────────────┐   ┌───────────────┐   ┌───────────────────┐    │

{iris_vector_graph-2.18.5 → iris_vector_graph-2.18.7}/iris_src/src/Graph/KG/TemporalIndex.cls

@@ -9,9 +9,46 @@ Parameter TSUNIT As %String = "";
 /// Bucket width in milliseconds when TSUNIT="ms". Derived: BUCKET * 1000.
 Parameter BUCKETMS As %Integer = 300000;
 
+/// Render a numeric value as valid JSON.
+/// ObjectScript renders 0.5 as ".5" and -0.5 as "-.5" — both are not JSON.
+/// Empty string is stored as null.
+ClassMethod jsonNum(pValue As %String) As %String [ Internal ]
+{
+	If pValue = "" { Return "null" }
+	If $Extract(pValue, 1, 2) = "-." { Return "-0" _ $Extract(pValue, 2, *) }
+	If $Extract(pValue, 1) = "." { Return "0" _ pValue }
+	Return pValue
+}
+
+/// Escape a string for embedding inside a JSON double-quoted value.
+/// Handles backslash, double-quote, and ASCII control characters.
+ClassMethod jsonEsc(pValue As %String) As %String [ Internal ]
+{
+	// RFC 8259 §7: U+0000–U+001F must be escaped. Named escapes for the 5
+	// common ones; \uXXXX for the rest (NUL, SOH … ETB, EM … US).
+	Set result = $Replace(pValue, "\", "\\")
+	Set result = $Replace(result, """", "\""")
+	Set result = $Replace(result, $Char(8),  "\b")
+	Set result = $Replace(result, $Char(9),  "\t")
+	Set result = $Replace(result, $Char(10), "\n")
+	Set result = $Replace(result, $Char(12), "\f")
+	Set result = $Replace(result, $Char(13), "\r")
+	// Remaining control chars U+0000–U+001F (NUL and 0x01–0x07, 0x0B, 0x0E–0x1F)
+	For i = 0:1:7,11,14:1:31 {
+		If result [ $Char(i) {
+			Set hex = $Select(i<16: "000"_$ZHex(i), 1: "00"_$ZHex(i))
+			Set result = $Replace(result, $Char(i), "\u"_hex)
+		}
+	}
+	Return result
+}
+
 ClassMethod InsertEdge(source As %String, predicate As %String, target As %String, timestamp As %Integer = "", weight As %Double = 1.0, attrsJSON As %String = "", upsert As %Boolean = 0, suppressReverseIndex As %Boolean = 0, mode As %String = "") As %Status
 {
 	If timestamp = "" Set timestamp = ##class(%SYSTEM.SQL).DATEDIFF("ss", "1970-01-01 00:00:00", $ZDateTime($ZTimeStamp, 3, 1))
+	// Coerce empty weight to 1 — same guard as the batch path (:70).
+	// Prevents {"w":} in QueryWindow JSON (defect #3).
+	If weight = "" Set weight = 1
 	// Resolve effective mode: explicit mode overrides legacy upsert boolean.
 	// mode="" falls back to upsert semantics for backward compat.
 	If mode = "" { Set mode = $Select(upsert: "skip", 1: "insert") }
@@ -200,7 +237,7 @@ ClassMethod QueryWindow(source As %String, predicate As %String, tsStart As %Int
 					If o = "" Quit
 					If 'first Set result = result _ ","
 					Set first = 0
-					Set result = result _ "{""s"":""" _ s _ """,""p"":""" _ p _ """,""o"":""" _ o _ """,""ts"":" _ ts _ ",""w"":" _ w _ "}"
+					Set result = result _ "{""s"":""" _ ..jsonEsc(s) _ """,""p"":""" _ ..jsonEsc(p) _ """,""o"":""" _ ..jsonEsc(o) _ """,""ts"":" _ ts _ ",""w"":" _ ..jsonNum(w) _ "}"
 				}
 			}
 		}
@@ -235,7 +272,7 @@ ClassMethod QueryWindowSources(predicate As %String, tsStart As %Integer, tsEnd
 		Quit:(src = "")
 		If 'first { Set result = result _ "," }
 		Set first = 0
-		Set result = result _ """" _ src _ """"
+		Set result = result _ """" _ ..jsonEsc(src) _ """"
 	}
 	Return result _ "]"
 }
@@ -283,7 +320,7 @@ ClassMethod FindBursts(predicate As %String, windowSec As %Integer, threshold As
 		If total >= threshold {
 			Set:'first result = result _ ","
 			Set first = 0
-			Set result = result _ "{""id"":""" _ node _ """,""velocity"":" _ total _ "}"
+			Set result = result _ "{""id"":""" _ ..jsonEsc(node) _ """,""velocity"":" _ ..jsonNum(total) _ "}"
 		}
 	}
 	Return result _ "]"
@@ -506,7 +543,7 @@ ClassMethod QueryWindowInbound(target As %String, predicate As %String, tsStart
 					If s = "" Quit
 					If 'first Set result = result _ ","
 					Set first = 0
-					Set result = result _ "{""s"":""" _ s _ """,""p"":""" _ p _ """,""o"":""" _ o _ """,""ts"":" _ ts _ ",""w"":" _ w _ "}"
+					Set result = result _ "{""s"":""" _ ..jsonEsc(s) _ """,""p"":""" _ ..jsonEsc(p) _ """,""o"":""" _ ..jsonEsc(o) _ """,""ts"":" _ ts _ ",""w"":" _ ..jsonNum(w) _ "}"
 				}
 			}
 		}
@@ -592,7 +629,7 @@ ClassMethod GetBucketGroups(predicate As %String, tsStart As %Integer, tsEnd As
 			Set avg = $Select(cnt=0:"null", 1:$FN(sm/cnt,"",6))
 			If 'first Set result = result _ ","
 			Set first = 0
-			Set result = result _ "{""source"":""" _ src _ """,""predicate"":""" _ p _ """,""count"":" _ cnt _ ",""sum"":" _ sm _ ",""avg"":" _ avg _ ",""min"":" _ mn _ ",""max"":" _ mx _ "}"
+			Set result = result _ "{""source"":""" _ ..jsonEsc(src) _ """,""predicate"":""" _ ..jsonEsc(p) _ """,""count"":" _ ..jsonNum(cnt) _ ",""sum"":" _ ..jsonNum(sm) _ ",""avg"":" _ ..jsonNum(avg) _ ",""min"":" _ ..jsonNum(mn) _ ",""max"":" _ ..jsonNum(mx) _ "}"
 		}
 	}
 	Return result _ "]"
@@ -629,7 +666,7 @@ ClassMethod GetBucketGroupTargets(source As %String, predicate As %String, tsSta
 		Quit:(tgt = "")
 		If 'first { Set result = result _ "," }
 		Set first = 0
-		Set result = result _ """" _ tgt _ """"
+		Set result = result _ """" _ ..jsonEsc(tgt) _ """"
 	}
 	Return result _ "]"
 }

{iris_vector_graph-2.18.5 → iris_vector_graph-2.18.7}/iris_src/src/Graph/KG/TraversalBFS.cls

@@ -1,6 +1,37 @@
 Class Graph.KG.TraversalBFS Extends %RegisteredObject
 {
 
+/// Render a numeric value as valid JSON (leading-zero normalization).
+/// ObjectScript renders 0.5 as ".5" — not valid JSON for external parsers.
+ClassMethod jsonNum(pValue As %String) As %String [ Internal ]
+{
+	If pValue = "" { Return "null" }
+	If $Extract(pValue, 1, 2) = "-." { Return "-0" _ $Extract(pValue, 2, *) }
+	If $Extract(pValue, 1) = "." { Return "0" _ pValue }
+	Return pValue
+}
+
+/// Escape a string for embedding inside a JSON double-quoted value.
+ClassMethod jsonEsc(pValue As %String) As %String [ Internal ]
+{
+	// RFC 8259 §7: U+0000–U+001F must be escaped. Named escapes for common ones;
+	// \uXXXX for the rest (NUL $Char(0), SOH–BEL, VT, SO–US).
+	Set result = $Replace(pValue, "\", "\\")
+	Set result = $Replace(result, """", "\""")
+	Set result = $Replace(result, $Char(8),  "\b")
+	Set result = $Replace(result, $Char(9),  "\t")
+	Set result = $Replace(result, $Char(10), "\n")
+	Set result = $Replace(result, $Char(12), "\f")
+	Set result = $Replace(result, $Char(13), "\r")
+	For i = 0:1:7,11,14:1:31 {
+		If result [ $Char(i) {
+			Set hex = $Select(i<16: "000"_$ZHex(i), 1: "00"_$ZHex(i))
+			Set result = $Replace(result, $Char(i), "\u"_hex)
+		}
+	}
+	Return result
+}
+
 ClassMethod BFS(srcId As %String, preds As %DynamicArray = "", maxHops As %Integer = 2, dstLabel As %String = "") As %DynamicArray
 {
     Set results = ##class(%DynamicArray).%New()
@@ -187,7 +218,7 @@ ClassMethod BFSFastJsonDirect(srcId As %String, predsJson As %String = "", maxHo
         If $Find(p, """") Set p = $Replace(p, """", "\""")
         If $Find(o, """") Set o = $Replace(o, """", "\""")
         Set result = result
-            _ "{""s"":""" _ s _ """,""p"":""" _ p _ """,""o"":""" _ o _ """,""w"":" _ +$ListGet(lb, 4) _ ",""step"":" _ +$ListGet(lb, 5) _ "}"
+            _ "{""s"":""" _ ..jsonEsc(s) _ """,""p"":""" _ ..jsonEsc(p) _ """,""o"":""" _ ..jsonEsc(o) _ """,""w"":" _ ..jsonNum($ListGet(lb, 4)) _ ",""step"":" _ +$ListGet(lb, 5) _ "}"
     }
     Return result _ "]"
 }
@@ -216,7 +247,7 @@ ClassMethod BFSFastJsonChunked(srcId As %String, predsJson As %String = "", maxH
     For i = 1:1:count {
         Set lb = $Get(^||BFS.Results(i))
         If lb = "" Continue
-        Set obj = "{""s"":"""_$Replace($ListGet(lb,1),"""","\""")_""",""p"":"""_$Replace($ListGet(lb,2),"""","\""")_""",""o"":"""_$Replace($ListGet(lb,3),"""","\""")_""",""w"":"_(+$ListGet(lb,4))_",""step"":"_(+$ListGet(lb,5))_"}"
+        Set obj = "{""s"":"""_..jsonEsc($ListGet(lb,1))_""",""p"":"""_..jsonEsc($ListGet(lb,2))_""",""o"":"""_..jsonEsc($ListGet(lb,3))_""",""w"":"_..jsonNum($ListGet(lb,4))_",""step"":"_(+$ListGet(lb,5))_"}"
         If 'first Set obj = "," _ obj
         Set first = 0
         Set chunk = chunk _ obj
@@ -311,7 +342,7 @@ ClassMethod ReadBFSResults(tag As %String) As %String
             Set s = $ListGet(lb, 1)
             Set p = $ListGet(lb, 2)
             Set w = +$ListGet(lb, 3)
-            Set result = result _ "{""s"":"""_$Replace(s,"""","\""")_""",""p"":"""_$Replace(p,"""","\""")_""",""o"":"""_$Replace(o,"""","\""")_""",""w"":"_w_",""step"":"_step_"}"
+            Set result = result _ "{""s"":"""_..jsonEsc(s)_""",""p"":"""_..jsonEsc(p)_""",""o"":"""_..jsonEsc(o)_""",""w"":"_..jsonNum(w)_",""step"":"_step_"}"
         }
     }
     Kill ^ArnoKG("bfs_r", tag)
@@ -348,7 +379,7 @@ ClassMethod ReadBFSPage(tag As %String, cursorStep As %String, cursorO As %Strin
         Set s = $ListGet(lb, 1)
         Set p = $ListGet(lb, 2)
         Set w = +$ListGet(lb, 3)
-        Set entry = "{""s"":"""_$Replace(s,"""","\""")_""",""p"":"""_$Replace(p,"""","\""")_""",""o"":"""_$Replace(o,"""","\""")_""",""w"":"_w_",""step"":"_step_"}"
+        Set entry = "{""s"":"""_..jsonEsc(s)_""",""p"":"""_..jsonEsc(p)_""",""o"":"""_..jsonEsc(o)_""",""w"":"_..jsonNum(w)_",""step"":"_step_"}"
         If result '= "" Set result = result _ ","
         Set result = result _ entry
         Set count = count + 1

{iris_vector_graph-2.18.5 → iris_vector_graph-2.18.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "iris-vector-graph"
-version = "2.18.5"
+version = "2.18.7"
 description = "Native graph database layer for InterSystems IRIS — openCypher, hybrid vector search, temporal property graph, RDF export, SHACL validation"
 readme = "README.md"
 license = "MIT"

iris_vector_graph-2.18.7/tests/integration/test_temporal_json_safety.py

@@ -0,0 +1,313 @@
+"""E2E tests for TemporalIndex JSON output safety.
+
+Root cause of the bug these tests catch:
+  ObjectScript string-concatenation JSON building emits `.nnn` for fractional
+  weights (e.g. 0.5 → ".5"), which Python json.loads (and JSON.parse) reject.
+  IRIS's own %FromJSON is lenient and accepts it, so ObjectScript-only tests
+  always pass — only external consumers break.
+
+  Three defects fixed in v2.18.6:
+    1. QueryWindow / QueryWindowInbound emit bare .nnn for fractional weights
+    2. s/p/o/source/predicate fields are not escape-safe (injection + parse failure)
+    3. InsertEdge stores empty weight verbatim → {"w":} even %FromJSON rejects
+
+  Critical rule: EVERY test here must parse with Python json.loads (strict),
+  NOT iterate an IRIS DynamicArray. ObjectScript-side parsing is lenient and
+  will NOT catch the failure mode.
+
+Requires ivg-iris-enterprise container (port 31972).
+"""
+
+import json
+import os
+import uuid
+
+import pytest
+
+SKIP_IRIS_TESTS = os.environ.get("SKIP_IRIS_TESTS", "false").lower() == "true"
+
+_PREFIX = f"tjson_{uuid.uuid4().hex[:8]}"
+
+
+def _insert(store, src, pred, tgt, ts, weight):
+    """Insert directly via ObjectScript, bypassing Python's pydantic weight≥0 guard."""
+    store._call_classmethod(
+        "Graph.KG.TemporalIndex", "InsertEdge",
+        src, pred, tgt, str(ts), str(weight),
+    )
+
+
+def _qw_strict(store, src, pred, ts_start, ts_end):
+    """Call QueryWindow and parse with strict Python json.loads — the gate that matters."""
+    raw = str(store._call_classmethod(
+        "Graph.KG.TemporalIndex", "QueryWindow",
+        src, pred, str(ts_start), str(ts_end),
+    ))
+    return json.loads(raw)   # raises on .nnn, bare :, unescaped chars
+
+
+def _qw_in_strict(store, tgt, pred, ts_start, ts_end):
+    raw = str(store._call_classmethod(
+        "Graph.KG.TemporalIndex", "QueryWindowInbound",
+        tgt, pred, str(ts_start), str(ts_end),
+    ))
+    return json.loads(raw)
+
+
+@pytest.fixture(scope="module")
+def tstore(iris_connection):
+    from iris_vector_graph.engine import IRISGraphEngine
+    e = IRISGraphEngine(iris_connection)
+    yield e._store
+    # Purge test data — use classMethodVoid (Purge returns no value)
+    try:
+        e._store._iris_obj().classMethodVoid("Graph.KG.TemporalIndex", "Purge")
+    except Exception:
+        pass
+
+
+@pytest.mark.skipif(SKIP_IRIS_TESTS, reason="SKIP_IRIS_TESTS=true")
+class TestQueryWindowJsonSafety:
+    """Defect #1 — fractional weights must be valid JSON numbers."""
+
+    def test_weight_half_parses_strictly(self, tstore):
+        """0.5 must not emit '.5' — Python json.loads is the gate."""
+        src = f"{_PREFIX}_w05"; tgt = f"{src}_t"
+        _insert(tstore, src, "W", tgt, 1000, "0.5")
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert len(rows) == 1
+        assert abs(rows[0]["w"] - 0.5) < 1e-9
+
+    def test_weight_point_818_parses_strictly(self, tstore):
+        """Exact value from the opsreview repro."""
+        src = f"{_PREFIX}_w818"; tgt = f"{src}_t"
+        _insert(tstore, src, "W", tgt, 1000, ".818")
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert len(rows) == 1
+        assert abs(rows[0]["w"] - 0.818) < 1e-9
+
+    def test_weight_zero_parses_strictly(self, tstore):
+        src = f"{_PREFIX}_w0"; tgt = f"{src}_t"
+        _insert(tstore, src, "W", tgt, 1000, "0")
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert rows[0]["w"] == 0
+
+    def test_weight_integer_parses_strictly(self, tstore):
+        src = f"{_PREFIX}_w1"; tgt = f"{src}_t"
+        _insert(tstore, src, "W", tgt, 1000, "1")
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert rows[0]["w"] == 1
+
+    def test_weight_greater_than_one_fraction_parses_strictly(self, tstore):
+        src = f"{_PREFIX}_w15"; tgt = f"{src}_t"
+        _insert(tstore, src, "W", tgt, 1000, "1.5")
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert abs(rows[0]["w"] - 1.5) < 1e-9
+
+    def test_mixed_weights_whole_window_parses(self, tstore):
+        """A single bad weight invalidates the whole array — test the full window."""
+        src = f"{_PREFIX}_mix"; tgt = f"{src}_t"
+        weights = ["0.1", "0.5", "0.818", "1", "1.5", "0"]
+        for i, w in enumerate(weights):
+            _insert(tstore, src, "W", tgt, 2000 + i, w)
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert len(rows) == len(weights)
+        parsed_weights = sorted(r["w"] for r in rows)
+        assert all(isinstance(w, (int, float)) for w in parsed_weights)
+
+    def test_querywindowinbound_weight_parses_strictly(self, tstore):
+        """QueryWindowInbound has the same concat site — verify symmetrically."""
+        src = f"{_PREFIX}_in_s"; tgt = f"{_PREFIX}_in_t"
+        _insert(tstore, src, "W", tgt, 3000, "0.453")
+        rows = _qw_in_strict(tstore, tgt, "W", 0, 9999999)
+        assert len(rows) == 1
+        assert abs(rows[0]["w"] - 0.453) < 1e-9
+
+
+@pytest.mark.skipif(SKIP_IRIS_TESTS, reason="SKIP_IRIS_TESTS=true")
+class TestQueryWindowStringEscaping:
+    """Defect #2 — node ids and predicates with special chars must not break JSON."""
+
+    def test_double_quote_in_node_id_does_not_break_json(self, tstore):
+        # A node id with a double quote would emit {"s":"a"b",...} — broken JSON
+        src = f'{_PREFIX}_dq_s'; tgt = f'{_PREFIX}_dq_t'
+        # Insert the edge with a quote embedded via direct global write
+        # (going through ObjectScript to bypass Python-side validation)
+        try:
+            tstore._iris_obj().classMethodVoid(
+                "Graph.KG.TemporalIndex", "InsertEdge",
+                src + '"quoted"', "PRED", tgt, "4000", "1",
+            )
+            raw = str(tstore._call_classmethod(
+                "Graph.KG.TemporalIndex", "QueryWindow",
+                src + '"quoted"', "PRED", "0", "9999999",
+            ))
+            result = json.loads(raw)
+            assert len(result) == 1
+            assert '"' in result[0]["s"]
+        except Exception:
+            pytest.skip("Container-specific: InsertEdge rejects quote in node id")
+
+    def test_backslash_in_predicate_does_not_break_json(self, tstore):
+        src = f"{_PREFIX}_bs_s"; tgt = f"{_PREFIX}_bs_t"
+        try:
+            tstore._iris_obj().classMethodVoid(
+                "Graph.KG.TemporalIndex", "InsertEdge",
+                src, "PRED\\TYPE", tgt, "5000", "1",
+            )
+            raw = str(tstore._call_classmethod(
+                "Graph.KG.TemporalIndex", "QueryWindow",
+                src, "PRED\\TYPE", "0", "9999999",
+            ))
+            result = json.loads(raw)
+            assert len(result) == 1
+            assert "\\" in result[0]["p"]
+        except Exception:
+            pytest.skip("Container-specific: InsertEdge rejects backslash in predicate")
+
+
+@pytest.mark.skipif(SKIP_IRIS_TESTS, reason="SKIP_IRIS_TESTS=true")
+class TestInsertEdgeEmptyWeight:
+    """Defect #3 — InsertEdge with empty weight must not store bare "" → {"w":}."""
+
+    def test_empty_weight_stored_as_1(self, tstore):
+        """InsertEdge(weight='') must default to 1, not store literal empty string."""
+        src = f"{_PREFIX}_ew"; tgt = f"{src}_t"
+        tstore._iris_obj().classMethodVoid(
+            "Graph.KG.TemporalIndex", "InsertEdge",
+            src, "PRED", tgt, "6000", "",
+        )
+        rows = _qw_strict(tstore, src, "PRED", 0, 9999999)
+        assert len(rows) == 1, "edge should be present"
+        assert rows[0]["w"] == 1, f"empty weight should default to 1, got {rows[0]['w']}"
+
+    def test_empty_weight_result_json_is_valid(self, tstore):
+        """Even if weight=1 after coercion, json.loads must not raise."""
+        src = f"{_PREFIX}_ewv"; tgt = f"{src}_t"
+        tstore._iris_obj().classMethodVoid(
+            "Graph.KG.TemporalIndex", "InsertEdge",
+            src, "PRED", tgt, "7000", "",
+        )
+        raw = str(tstore._call_classmethod(
+            "Graph.KG.TemporalIndex", "QueryWindow",
+            src, "PRED", "0", "9999999",
+        ))
+        # Must not raise ValueError
+        result = json.loads(raw)
+        assert isinstance(result, list)
+
+
+@pytest.mark.skipif(SKIP_IRIS_TESTS, reason="SKIP_IRIS_TESTS=true")
+class TestJsonNumHelper:
+    """Unit-style tests for the jsonNum helper, exercised through real QueryWindow calls."""
+
+    def _round_trip(self, tstore, weight_str):
+        src = f"{_PREFIX}_jn_{uuid.uuid4().hex[:4]}"; tgt = f"{src}_t"
+        _insert(tstore, src, "W", tgt, 8000, weight_str)
+        rows = _qw_strict(tstore, src, "W", 0, 9999999)
+        assert len(rows) == 1
+        return rows[0]["w"]
+
+    def test_point_five(self, tstore):
+        w = self._round_trip(tstore, "0.5")
+        assert abs(w - 0.5) < 1e-9
+
+    def test_point_zero_nine_nine(self, tstore):
+        w = self._round_trip(tstore, ".099")
+        assert abs(w - 0.099) < 1e-6
+
+    def test_one_point_zero(self, tstore):
+        w = self._round_trip(tstore, "1.0")
+        assert abs(w - 1.0) < 1e-9
+
+    def test_large_integer(self, tstore):
+        w = self._round_trip(tstore, "42")
+        assert w == 42
+
+    def test_zero(self, tstore):
+        w = self._round_trip(tstore, "0")
+        assert w == 0
+
+
+@pytest.mark.skipif(SKIP_IRIS_TESTS, reason="SKIP_IRIS_TESTS=true")
+class TestBFSJsonSafety:
+    """BFSFastJson / BFSFastJsonSorted emit the same {"s":..,"w":..} structure.
+
+    Same defect as TemporalIndex: fractional edge weights render as '.nnn'.
+    Caught by TraversalBFS.cls fix (jsonNum/jsonEsc added).
+    """
+
+    def test_bfs_fractional_weight_parses_strictly(self, tstore):
+        """BFS result with fractional ^KG weight must parse with Python json.loads."""
+        from iris_vector_graph.stores.iris_sql_store import IRISGraphStore
+        from iris_vector_graph.engine import _call_classmethod
+
+        src = f"{_PREFIX}_bfs_s"; dst = f"{_PREFIX}_bfs_d"
+        # Write fractional weight directly to ^KG adjacency
+        tstore._iris_obj().classMethodVoid(
+            "Graph.KG.EdgeScan", "WriteAdjacency", src, "REL", dst, "0.453", 0
+        )
+        raw = str(tstore._call_classmethod(
+            "Graph.KG.Traversal", "BFSFastJsonSorted",
+            src, "", "1", "", "out", "0",
+        ))
+        # BFSFastJsonSorted returns "SORTED:<tag>:<count>" — stream pages
+        if raw.startswith("SORTED:") and not raw.endswith(":0"):
+            from iris_vector_graph.engine import _bfs_stream_pages
+            pages = list(_bfs_stream_pages(tstore.conn, raw.split(":")[1]))
+            # Each page is a list of dicts already parsed by _bfs_stream_pages
+            # which calls json.loads internally — verify it didn't fail
+            assert isinstance(pages, list)
+            weights = [r["w"] for r in pages if r.get("s") == src]
+            assert any(abs(w - 0.453) < 1e-6 for w in weights), (
+                f"Expected w≈0.453 in BFS results, got weights: {weights}"
+            )
+
+
+@pytest.mark.skipif(SKIP_IRIS_TESTS, reason="SKIP_IRIS_TESTS=true")
+class TestControlCharEscaping:
+    """jsonEsc must cover all U+0000-U+001F, not just the 5 named escapes.
+
+    Root cause of the 2.18.6 field failure:
+      Kubernetes process names embed a NUL byte (chr(0)) as a C string terminator.
+      jsonEsc handled backslash/quote/LF/CR/TAB/BS/FF but not NUL or the other
+      26 control chars. json.loads raises ValueError on any unescaped U+0000-U+001F.
+
+    Rule: these tests MUST call json.loads() — not iterate the result object.
+    Python json.loads is strict; IRIS %FromJSON is lenient and will NOT catch this.
+    """
+
+    NUL_SRC = f"{_PREFIX}_nul_pod\x00suffix"
+
+    def test_nul_byte_in_source_parses_strictly(self, tstore):
+        """NUL in node id must emit \\u0000, not a raw NUL byte."""
+        tstore._iris_obj().classMethodVoid(
+            "Graph.KG.TemporalIndex", "InsertEdge",
+            self.NUL_SRC, "CALLS", f"{_PREFIX}_svc", "10000", "1",
+        )
+        raw = str(tstore._call_classmethod(
+            "Graph.KG.TemporalIndex", "QueryWindow",
+            self.NUL_SRC, "CALLS", "0", "99999999",
+        ))
+        result = json.loads(raw)   # raises if NUL is unescaped
+        assert len(result) == 1
+        assert result[0]["s"] == self.NUL_SRC  # chr(0) decoded back by json.loads
+
+    def test_other_control_chars_parse_strictly(self, tstore):
+        """U+0001-U+0007 SOH-BEL, U+000B VT, U+000E-U+001F SO-US all must escape."""
+        other_controls = "".join(
+            chr(i) for i in [1, 2, 3, 4, 5, 6, 7, 11, 14, 15, 27, 28, 31]
+        )
+        src = f"{_PREFIX}_ctrl_{uuid.uuid4().hex[:4]}"
+        tstore._iris_obj().classMethodVoid(
+            "Graph.KG.TemporalIndex", "InsertEdge",
+            src + other_controls, "CALLS", f"{_PREFIX}_svc2", "11000", "1",
+        )
+        raw = str(tstore._call_classmethod(
+            "Graph.KG.TemporalIndex", "QueryWindow",
+            src + other_controls, "CALLS", "0", "99999999",
+        ))
+        result = json.loads(raw)
+        assert len(result) == 1
+        # Verify the source round-trips correctly
+        assert result[0]["s"] == src + other_controls