feat: %TYPE/%ROWTYPE 锚定建成 [T] 引用边（detail/impact 可见，lineage 不污染） (#158)

[c2j]

概要

把 PL/SQL %TYPE / 表级 %ROWTYPE 编译期 schema 锚定建成 AnchorsOn 引用边（EdgeCategory::Reference，CLI 标签 [T]）：detail / trace / impact 可见，lineage / conflicts / --summarize-tables / community 自动排除。

Closes #158。

实现要点

• Edge::AnchorsOn { kind, column, site, location }：追加在 Edge 枚举末尾（bincode 序号稳定）；kind: PercentType | PercentRowType、site: ReturnType | Param | Variable | NestedType。8 处穷尽 match 补臂（category / edge_type_tag / edge_weight / JSON / NDJSON / DOT / Mermaid / location_line）。
• AnchorExtractor visitor：结构化 AST（变量/嵌套 TYPE/record 全是 PlDataType）+ 扁平签名串兜底解析（容忍 par_sys_purchase. purchase_days% type 式 token 空格与大小写混乱）；守卫：cursor 名与局部声明名（变量/TYPE/RECORD）命中即跳过，防伪表锚。
• 建边：create_object_ref_edges / collect_package_object_ref_edges 走 table_index 既有解析路径（无 DDL → inferred table*）；包级变量锚到 Package 节点，包级 cursor 名注入成员例程；routine 内 (object, column, kind, site) 去重。
• edge_label_for 聚合：同对节点平行边标签合并为 [R,T]（修复原先只取首边的显示缺口；petgraph LIFO 迭代经 .rev() 还原创建顺序）。
• STORE_VERSION 8→9：新变体改变 bincode 布局；旧 store 拒载并提示重建，analyze fast-path 自愈（peek_version 门禁复用 fix(analyze): store 版本校验缺失导致升级二进制后 stale 缓存死循环 #157 机制）。
• dedup：anchors_on 专分支按 (kind, column小写, site) 保留不同锚定组合（同表多列 %TYPE 不被折叠）。

验收对照（issue §验收）

• ✅ detail CALLEES 同表 [R]+[T] 共存 → issue_158_dml_and_anchor_edges_coexist_on_read_table
• ✅ 无 DML 表以 [T] 可见（inferred table*）→ issue_158_type_only_reference_produces_inferred_table_with_anchor_only
• ✅ lineage 无多余 hop、conflicts 不计锁 → issue_158_lineage_ignores_anchor_edges / issue_158_conflicts_ignore_anchor_edges
• ✅ impact 从纯锚定表可达函数 → issue_158_impact_reaches_via_anchor_edge
• ✅ cursor%ROWTYPE 不误建表边 → issue_158_no_cursor_rowtype_anchor_edges_present 等
• ✅ 旧 store 拒载 → should_reject_store_with_stale_version

另含 33+ 单元测试（解析/抽取/建边/序列化），关键路径均做变异验证（注入实现错误 → 测试失败）。

披露

• 新 helper collect_routine_anchor_edges 沿用本文件既有惯例加了 #[allow(clippy::too_many_arguments)]（builder.rs/main.rs 已有 8 处同类）。
• 锚定边 line 暂取 routine 起始行（AST 无 span）。
• Follow-up（本期 Non-goals）：游标 RETURN t%ROWTYPE 锚定、CGEF 回导白名单扩展 anchors_on、ogsql-parser 将签名类型结构化为 PlDataType。

门禁（rebase 到 origin/main 后实测）

cargo build --features full                        → 0 errors
cargo clippy --features full -- -D warnings        → clean
cargo fmt --all -- --check                         → clean
cargo test --features full -- --skip test_path_mapping_applied --skip test_serve_
                                                   → 716 lib + 全部集成套件，0 failed

🤖 Generated with Claude Code

[c2j]

[bug] anchor_from_pl_data_type treats every PlDataType::PercentType as a table.column anchor, including the single-identifier form that ogsql-parser encodes as column: "". In v0.10.0 (parse_pl_data_type), v1%TYPE becomes PercentType { table: "v1", column: String::new() }. The flat parser already rejects that shape (PercentType requires ≥2 identifiers), but the AST path does not. Combined with a skip set that only knows previously declared local variables/cursors, this creates inferred table* nodes for common non-table anchors: v2 v1%TYPE at package level (builder only checks pkg_cursor_names), and v p_id%TYPE where p_id is a parameter (never inserted into var_names). Those fake tables then show up in detail/trace/impact as [T] edges.

Suggestion: Return None for PercentType when column is empty/whitespace, matching parse_anchor_from_type_string. Also seed the skip set with routine parameter names and package-level variable/type names (see Issue 2) so rec.field%TYPE against a record param/package var is still suppressed. Add tests for v p_id%TYPE and package-level v2 v1%TYPE.

[c2j]

已修复 1a53283：anchor_from_pl_data_type 对 column.trim().is_empty() 的 PercentType 返回 None（对齐扁平解析器的 ≥2 段语义）。测试：should_reject_empty_column_percent_type_from_ast（空串/空白/正常表列/PercentRowType 四形态）。

[c2j]

[bug] Member-routine (and top-level) AnchorExtractor walks are only seeded with package cursor names. Parameter names, package-level variables, and package-level type names are not registered, even though collect_package_call_edges already collects pkg_var_names and PackageItem::Type for call extraction. So v p_emp.empno%TYPE (parameter is p_emp employees%ROWTYPE) and v pkg_rec.col%TYPE (package-level record) still have a non-empty column and pass Issue 1’s empty-column filter, then become inferred tables. Package-level variables have the same hole: collect_package_object_ref_edges only skips pkg_cursor_names (line 2104), not earlier package vars/types.

Suggestion: Add register_var_name (or a generic register_local_name) next to register_cursor_name. Before walk_pl_block, register every parameters[].name, every PackageItem::Variable name, and every pl_type_decl_name from PackageItem::Type. At package-variable site, skip if the object matches any package var/type/cursor name collected from the same pkg_items list.

[c2j]

已修复 d1e249e：新增 AnchorExtractor::register_var_name；collect_routine_anchor_edges 内注册全部 parameters[].name，签名扩展 pkg_var_type_names: &[String]（包级 Variable 名 + pl_type_decl_name，收集于锚定循环前）；包级变量锚定点守卫扩为 pkg_cursor_names ∪ pkg_var_type_names；成员例程注入双集合。测试：should_skip_type_anchored_to_param_name（v p_emp.empno%TYPE）、should_skip_package_var_anchored_to_earlier_package_var、should_skip_type_anchored_to_package_level_record + e2e issue_158_param_name_anchor_suppressed_end_to_end。

[c2j]

[bug] PackageItem::Type(_) is continued, so package-level TYPE t IS TABLE OF x.col%TYPE / VARRAY OF / RECORD (f t.col%TYPE) never produce AnchorsOn edges. Issue #158 lists nested TYPE/record-field anchors in scope, and the routine-body visitor already handles the same PlTypeDecl variants. In real PL/SQL those nested types almost always live in the package spec/body, not in a routine DECLARE. Package-level variables in the same loop are already turned into package-node anchors, so this is an inconsistent hole in the same declare section, not a documented non-goal (D3 is cursor RETURN only).

Suggestion: Walk PackageItem::Type with the same PlTypeDecl match used in AnchorExtractor (TableOf/VarrayOf/Record fields), apply the package-level cursor/var/type skip set, and attach surviving edges to the package node with site=NestedType. Add a builder test for TYPE t_list IS TABLE OF some_table.col%TYPE inside PACKAGE BODY.

[c2j]

已修复 e165644：PackageItem::Type 不再 continue——提取共享入口 pub fn anchor_targets_in_pl_type_decl（复用 anchor_from_pl_data_type，TableOf{elem_type,index_by}/VarrayOf/Record fields 全覆盖），AnchorExtractor 的 Type 臂同步改用该入口（无重复 match）；包节点锚定 site=NestedType，守卫含本 TYPE 名（TYPE t_bad IS TABLE OF t_list.col%TYPE 被抑制）。测试：should_anchor_package_level_nested_type + e2e issue_158_package_nested_type_anchor_end_to_end。

[c2j]

[suggestion] The doc comment on collect_routine_anchor_edges narrates refactor history (“that previously duplicated this sequence”) rather than a current invariant. Same class of leakage as the long “Caveats” / “Task N” commentary elsewhere in the diff.

Suggestion: Keep one sentence on why pkg_cursor_names is injected; drop the “previously duplicated” / task-history wording.

[c2j]

已修复 c47fa7e：doc 改为陈述当前不变量（为何注入包级名集），移除 "previously duplicated" 历史叙事；另在 5eaf87f 补充遮蔽 caveat 明确覆盖 register_var_name 注入的参数名（参数与真表同名的保守跳过是文档化行为）。

[c2j]

[bug] Previous issue 2 (fake table anchors from non-table names) is only fixed for the body walk. collect_routine_anchor_edges still turns every signature %TYPE/%ROWTYPE string into an AnchorsOn edge with no cursor/var/TYPE/parameter skip. pkg_cursor_names / pkg_var_type_names are injected only after this loop (and only into AnchorExtractor), so they never apply here. Concrete false positives: PROCEDURE p(p_rec c%ROWTYPE) when c is a package cursor; FUNCTION f(p_id emp_rec.empno%TYPE) when emp_rec is a package RECORD type; PROCEDURE p(p_id v_emp.empno%TYPE) when v_emp is a package-level %ROWTYPE variable. Each creates an inferred table* named c / emp_rec / v_emp. The new tests (should_skip_type_anchored_to_param_name, issue_158_param_name_anchor_suppressed_end_to_end) only cover a body variable v p_emp.empno%TYPE, not a parameter/RETURN whose type string itself points at a local name.

Suggestion: Before add_anchor_edge, drop a parsed signature anchor whose lowercased object is in pkg_cursor_names, pkg_var_type_names, or the current routine's parameter names (excluding the parameter currently being declared, so employees employees%ROWTYPE as a param still anchors the table). Add a builder test whose parameter type is a package cursor/TYPE/variable name.

[c2j]

已修复 e70728a：collect_routine_anchor_edges 参数/RETURN 锚定在建边前检查 pkg_cursor_names ∪ pkg_var_type_names ∪ 参数名集（小写全串对比）；排除当前参数自身名——PROCEDURE p(employees employees%ROWTYPE) 惯用法仍锚表（should_still_anchor_param_named_after_table 锁定）；RETURN 无 self 排除（保守）。测试：should_skip_signature_anchor_to_package_cursor / should_skip_signature_anchor_to_package_type_and_variable。

[c2j]

[bug] The new skip sets (pkg_cursor_names, pkg_var_type_names) are built only from the current statement's pkg_items. create_sql_edges already knows spec and body are independent statements and therefore indexes SPEC items (spec_items_by_pkg) so a BODY can inherit public Variable/Type/Cursor names (see the comment at builder.rs:1624–1636 and the BODY call at 1652–1662). create_object_ref_edges / collect_package_object_ref_edges do not. A SPEC-only CURSOR c, TYPE rec_t IS RECORD (...), or package variable used from a BODY member (rec c%ROWTYPE, v rec_t.col%TYPE) is therefore unguarded and becomes an inferred table*. The new tests keep TYPE/cursor/var and the member routine in the same BODY, so they never exercise this split.

Suggestion: Mirror the call-edge path: index CreatePackage items by pkg_qualified_key, pass them as inherited_items when walking CreatePackageBody, and union them into pkg_cursor_names / pkg_var_type_names (and into any signature skip from Issue 1). Cover with a two-statement SPEC+BODY fixture.

[c2j]

已修复 0697f37 + 73b50c6：collect_package_object_ref_edges 新增 inherited_items 参数，create_object_ref_edges 预扫描构建 spec_items_by_pkg（镜像调用边 :1629 模式，后提取为 build_spec_items_index 共享 helper），BODY 调用传 SPEC items；pkg_cursor_names/pkg_var_type_names 收集 .chain(inherited)。测试：should_inherit_spec_names_for_body_anchor_guards（SPEC+BODY 双语句）+ e2e issue_158_spec_body_inherited_guards_end_to_end（伪表 c/rec_t/v_emp 缺席 + 对照组锚定）。

[c2j]

[bug] The skip set includes the identifier currently being declared, so the standard PL/SQL idiom emp emp%ROWTYPE / emp emp.empno%TYPE never produces an AnchorsOn edge. visit_pl_declaration inserts v.name (and the TYPE name at 1241) before reading the %TYPE/%ROWTYPE target; package-level code has the same hole because pkg_var_type_names is the full item list including self (builder.rs:2115–2131). Cursor %ROWTYPE does not need this: CURSOR c; rec c%ROWTYPE is already filtered by cursor_names. Empty-column v2 v1%TYPE is already rejected by anchor_from_pl_data_type. The extractor caveat that “shadowing means the name resolves to the local declaration” is wrong at the declaration site — Oracle’s own examples use employees employees%ROWTYPE, and %ROWTYPE looks up a table/view/cursor, not the variable whose type is being written. Same-name later siblings (v employees%ROWTYPE then a package var named employees) are also over-skipped by the full-set package guard; declare-before-use (previous names only, insert-after-visit) is enough for v_id v_emp.empno%TYPE.

Suggestion: Register the current variable/TYPE name after visiting its PlDataType / nested fields. For package-level items, skip only names declared earlier in pkg_items (plus inherited SPEC names from Issue 2), never the item’s own name. Add a builder test for emp emp%ROWTYPE asserting an AnchorsOn to table emp, and keep the existing v_emp → v_id v_emp.empno%TYPE guard test.

[c2j]

已修复 6b07c1d：extractor 改 insert-after-visit（Variable/Type 名在自身类型访问后注册）——emp emp%ROWTYPE 惯用法正向测试 should_anchor_variable_self_named_after_table；包级循环改增量 declared_earlier 集（种子 = SPEC 继承名，永不含 self）+ should_anchor_package_var_self_named_after_table；成员例程注入维持全集（包体整体可见）；cursor 名维持全集（如 review 所述不需要）。doc caveat 同步改写（声明点自名解析为表）。回归：v2 v1%TYPE/t_bad→t_list/v_id v_emp.empno%TYPE 守卫全部保持。

[c2j]

[bug] collect_routine_anchor_edges is invoked for every package member that already has a proc_idx, including SPEC signatures whose block is None. Node creation (create_package_nodes) skips body-less SPEC items, but create_sql_nodes finishes the whole file (SPEC then BODY) before create_object_ref_edges runs, so by the time SPEC is walked for anchors the BODY has already inserted the shared RoutineId node. SPEC then emits Param/ReturnType AnchorsOn edges; BODY emits the same edges again. anchor_seen is local to a single call, and neither GraphBuilder::build nor project::analyze runs store.dedup(), so JSON/detail consumers see two identical anchors_on edges on the standard Oracle pattern (CREATE PACKAGE … PROCEDURE p(t t%ROWTYPE); + matching BODY). Round-2 tests never declare the procedure in both SPEC and BODY, so they miss it.

Suggestion: Dedup signature anchors across SPEC and BODY for the same proc_idx (a pass-level (proc_idx, AnchorDedupKey) set, or collect signatures only from SPEC when a matching SPEC exists and let BODY contribute DECLARE-site anchors only). Add a SPEC+BODY fixture that asserts exactly one AnchorsOn from p to the table.

[c2j]

已修复 002366b：anchor_seen 上移为调用方持有 HashSet<(NodeIndex, AnchorDedupKey)>（proc 维度入键），collect_package_object_ref_edges 一个集贯穿 SPEC+BODY——签名相同折叠、不同保留（不偏向 SPEC）。测试：should_dedupe_signature_anchors_across_spec_and_body（SPEC+BODY 双声明恰好 1 条 Param 边 + BODY 独有 Variable 边保留）。

[c2j]

[suggestion] AnchorExtractor::visit_pl_declaration falls through NestedProcedure / NestedFunction to _ => {} and returns Continue. The default walker then recurses into the nested block on the same extractor: nested-routine parameters are never register_var_name’d (they are not PlDeclarations), so PROCEDURE inner(p_emp VARCHAR2) IS v p_emp.empno%TYPE; still mints inferred table* p_emp — the same hole round 1 closed for top-level params. Nested locals/cursors also leak into the outer skip sets. CallExtractor in this same file already save/restores scope and injects nested parameters via begin_routine_scope.

Suggestion: Mirror CallExtractor: on NestedProcedure/NestedFunction, save cursor_names/var_names, register_var_name each nested parameter, walk the nested block, then restore. Cover with should_skip_type_anchored_to_nested_proc_param.

[c2j]

已修复 6370485：镜像 CallExtractor——NestedProcedure/NestedFunction 臂 mem::take 保存 cursor/var 集 → 注册嵌套参数 → 手动 walk 嵌套块 → restore → SkipChildren 防默认递归双走。测试：should_skip_type_anchored_to_nested_proc_param（伪造 p_emp 被守卫）+ should_not_leak_nested_routine_locals_into_outer_scope（行为化：嵌套后用嵌套专属名锚定，正向断言泄漏未发生；变异自证 restore 移除即 Red）。

[c2j]

[suggestion] GraphStore::dedup() now keeps distinct AnchorsOn edges that share (src, dst) but differ in (kind, column, site). GraphStore::merge still keys seen_edges on (src_key, dst_key, edge_type_tag) only ("anchors_on"), so p1 emp.id%TYPE + p2 emp.name%TYPE in one input store collapse to a single edge when merged. That reintroduces the exact invariant should_keep_distinct_anchor_edges_through_dedup locked for dedup().

Suggestion: Apply the same (kind, lowercased column, site) key inside merge’s per-store edge loop (and when combining with edges already in the accumulator). A merge-path unit test parallel to the dedup one would lock it.

[c2j]

已修复 d667927 + e74f41f：anchors_on 边在 merge 用扩展键（kind/小写 column/site，贯穿全部 store 的 seen_anchor_keys，天然覆盖累加器已存在边），非锚定边维持 per-store 原语义。中途曾把全局 seen 泛化到全部边类型、破坏 TableAccess 跨 store 模式并集——review 捕获后回退并加回归锁：should_union_table_access_modes_across_stores_on_merge（Read+Write → Read|Write）+ should_keep_distinct_anchor_edges_through_merge / should_dedupe_identical_anchor_edge_across_stores。

[c2j]

[suggestion] Several new comments narrate review history rather than the current invariant: “PR #164 review round 2 issue 1” (here), “PR #164 review round 2” on the SPEC-inheritance skip sets, “PR #164 review round 2 issue 3” on declared_earlier. c47fa7e already stripped that style once; the follow-up commits put it back.

Suggestion: Keep the self-naming / SPEC-inheritance / earlier-only rules; drop the PR-round citations.

[c2j]

已修复 f4de1c9：全仓 grep 清理 "PR #164 review round N" 叙事（builder/extractor/store 23 处），保留规则语义；bc07b6d 顺带修正两处陈旧前瞻描述与 doc rewrap。

[c2j]

[bug] AnchorExtractor’s new NestedProcedure / NestedFunction arms save scope with std::mem::take, which clears cursor_names / var_names for the nested walk and only restores them afterward. That correctly stops nested locals from leaking outward (the previous finding, covered by should_not_leak_nested_routine_locals_into_outer_scope) and nested parameters are now registered (covered by should_skip_type_anchored_to_nested_proc_param). It also wipes names the nested routine is supposed to see. PL/SQL nested subprograms inherit the enclosing DECLARE / parameter list, and collect_routine_anchor_edges injects package-level cursor/var/TYPE names plus the outer routine’s parameters onto this same extractor before walk_pl_block. After take(), a nested body like rec c%ROWTYPE (outer/package cursor c) or v p_emp.empno%TYPE (outer param p_emp) is unguarded and still mints inferred table* c / table* p_emp attached to the outer node. CallExtractor uses the same take() because local_vars is a call-vs-identifier set that starts fresh per routine; copying that mechanic here is the wrong scope rule for %TYPE/%ROWTYPE guards. The struct comment only claims leak-out isolation; the implementation is stronger than that invariant.

Suggestion: Clone-and-restore instead of take-and-restore (saved = self.cursor_names.clone(); … self.cursor_names = saved;, same for var_names), then register nested parameters (so they can shadow). Add a test that an outer/package cursor or outer param visible in a nested body does not become a table anchor (CURSOR c IS …; PROCEDURE inner IS rec c%ROWTYPE;). Same change on the NestedFunction arm at line 1279.

[c2j]

Fixed in d0353f7: both NestedProcedure/NestedFunction arms now clone() (not take()) cursor_names/var_names before registering the nested routine's own parameters and walking — outer/package cursor and parameter names stay guarded inside the nested body (lexical inheritance), while the save/restore-to-snapshot afterward is unchanged, so nested-local declarations still don't leak outward. Added two RED\u2192GREEN regression tests: should_skip_nested_body_anchor_using_outer_cursor (outer CURSOR c + nested rec c%ROWTYPE) and should_skip_nested_function_body_anchor_using_outer_param (nested-within-nested: a nested routine's own parameter guarding a further-nested body's %TYPE reference \u2014 the literal top-level-signature-parameter variant doesn't exercise this code path since extract_anchors()'s test harness never registers a CREATE FUNCTION's own signature parameters, only graph::builder::collect_routine_anchor_edges does downstream). Verified both new tests fail against the old take() code (fabricated table* c / table* p_emp anchors) before the fix, and pass after. Existing guards (should_skip_type_anchored_to_nested_proc_param, should_not_leak_nested_routine_locals_into_outer_scope) and the full regress_issue_158_type_anchor_edges suite (10/10) remain green.

[c2j]

[suggestion] anchor_merge_key’s doc-comment still narrates the review/commit history (“regression fixed in commit following d667927: a global generic key silently dropped…”) rather than stating the current invariant. The useful part is already there: AnchorsOn uses a cross-store (src, dst, kind, column, site) set; every other edge type stays on the per-store (src, dst, tag) key so merge_duplicate_table_access_edges can union modes. The commit-hash sentence is the same class of history-narration the previous pass asked to drop from builder.rs (those sites are clean now). The test at should_union_table_access_modes_across_stores_on_merge also leads with “commit d667927”.

Suggestion: Keep the invariant (separate cross-store AnchorsOn key vs per-store generic key, because TableAccess union needs both stores’ edges present). Drop the commit hash and the “what we broke last time” recap from production comments; the regression test name/body is enough history.

[c2j]

Fixed in 90bde2a: both doc comments dropped the commit-hash / "what we broke last time" narration while keeping the invariant statement. anchor_merge_key's doc now states: AnchorsOn uses a merge-spanning (src, dst, kind, lowercased column, site) key so identical anchors collapse across stores while distinct columns survive, and every other edge type keeps the per-store (src, dst, tag) key so merge_duplicate_table_access_edges can still union TableAccess modes across stores. should_union_table_access_modes_across_stores_on_merge's doc now reads "Regression guard (#158): a whole-merge generic key would drop the second store's TableAccess edge before mode union; per-store keys + the dedicated AnchorsOn key above keep both behaviors" \u2014 no commit hash. grep -rn "d667927" src/ \u2192 0 hits.

[c2j]

[suggestion] After the take→clone fix, nested-routine scope is lexical inheritance (outer/package names remain visible; nested params shadow on top; restore only prevents leak-out). The struct-level caveat still says a nested routine "gets its own isolated scope". That was true of mem::take and is now false; it contradicts the arm comment and the new tests. A later change that "restores isolation" by switching back to take would reintroduce the round-4 bug.

Suggestion: Rewrite the bullet to the current invariant: nested bodies inherit the enclosing (and injected package) guard sets, nested parameters are registered on top, and the pre-nesting snapshot is restored so nested locals do not leak out.

[c2j]

[suggestion] The NestedProcedure/NestedFunction comment still narrates the review fix (*clone* (not take)) and claims the arms "Mirror CallExtractor", but CallExtractor still uses mem::take + begin_routine_scope (a fresh scope). The follow-up that de-historicized anchor_merge_key introduced the same class of history-narration here, and the CallExtractor parallel is now inaccurate.

Suggestion: State the current contract only: clone the guard sets, register nested params, walk, restore, return SkipChildren. Drop the take/clone post-mortem and the CallExtractor claim (or note that CallExtractor intentionally uses a fresh call-resolution scope).

[c2j]

[suggestion] should_skip_signature_anchor_to_package_cursor asserts that a package cursor does guard a signature %ROWTYPE (and collect_routine_anchor_edges now consults pkg_cursor_set / pkg_var_type_set / other param names). The test comment still speaks in the present tense as if the signature loop "bypasses the guard entirely" and "never consults" those sets — the old hole, not the current invariant.

Suggestion: Rephrase as the locked behavior (signature anchors must consult the same cursor/var/param guards as the body walk), not as a description of a bypass that the test then contradicts.