package gudusoft.gsqlparser.ir.semantic.builder;

import gudusoft.gsqlparser.EBoundaryType;
import gudusoft.gsqlparser.EDbObjectType;
import gudusoft.gsqlparser.EDbVendor;
import gudusoft.gsqlparser.sqlenv.ESQLDataObjectType;
import gudusoft.gsqlparser.util.SQLUtil;
import gudusoft.gsqlparser.EExpressionType;
import gudusoft.gsqlparser.EGroupingSetType;
import gudusoft.gsqlparser.EJoinType;
import gudusoft.gsqlparser.ELimitRowType;
import gudusoft.gsqlparser.EPseudoTableType;
import gudusoft.gsqlparser.EQuantifierType;
import gudusoft.gsqlparser.ESetOperatorType;
import gudusoft.gsqlparser.ETableSource;
import gudusoft.gsqlparser.EUniqueRowFilterType;
import gudusoft.gsqlparser.TSourceToken;
import gudusoft.gsqlparser.ir.semantic.ColumnRef;
import gudusoft.gsqlparser.ir.semantic.Diagnostic;
import gudusoft.gsqlparser.ir.semantic.DiagnosticCode;
import gudusoft.gsqlparser.ir.semantic.DiagnosticDescriptorCatalog;
import gudusoft.gsqlparser.ir.semantic.Severity;
import gudusoft.gsqlparser.ir.semantic.SourceSpan;
import gudusoft.gsqlparser.ir.semantic.FrameBound;
import gudusoft.gsqlparser.ir.semantic.GroupingElement;
import gudusoft.gsqlparser.nodes.TParseTreeNode;
import gudusoft.gsqlparser.ir.semantic.LineageEdge;
import gudusoft.gsqlparser.ir.semantic.LineageRef;
import gudusoft.gsqlparser.ir.semantic.OutputColumn;
import gudusoft.gsqlparser.ir.semantic.RelationKind;
import gudusoft.gsqlparser.ir.semantic.RelationSource;
import gudusoft.gsqlparser.ir.semantic.RecoveryMetadata;
import gudusoft.gsqlparser.ir.semantic.RelatedLocation;
import gudusoft.gsqlparser.ir.semantic.RowLimit;
import gudusoft.gsqlparser.ir.semantic.RowLimitKind;
import gudusoft.gsqlparser.ir.semantic.SemanticBuildResult;
import gudusoft.gsqlparser.ir.semantic.SemanticProgram;
import gudusoft.gsqlparser.ir.semantic.SqlSemanticAnalyzer;
import gudusoft.gsqlparser.ir.semantic.SetOperator;
import gudusoft.gsqlparser.ir.semantic.StatementGraph;
import gudusoft.gsqlparser.ir.semantic.TargetRelation;
import gudusoft.gsqlparser.ir.semantic.WindowFrame;
import gudusoft.gsqlparser.ir.semantic.WindowSpec;
import gudusoft.gsqlparser.ir.semantic.binding.ColumnBinding;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.ColumnResolution;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.JoinAnalysisFacts;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.JoinEndpoint;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.JoinEndpointKind;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.JoinEntity;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.JoinGraph;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.JoinSourceSyntax;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.Predicate;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.PredicateKind;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.PredicateOperand;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.QueryBlockScope;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.ScopeKind;
import gudusoft.gsqlparser.ir.semantic.joinanalysis.SemanticJoinType;
import gudusoft.gsqlparser.ir.semantic.validation.oracle.OracleLegacyOuterJoinValidationResult;
import gudusoft.gsqlparser.ir.semantic.validation.oracle.OracleLegacyOuterJoinValidator;
import gudusoft.gsqlparser.ir.semantic.validation.oracle.PredicateJoinIntent;
import gudusoft.gsqlparser.ir.semantic.binding.FromSubqueryNaming;
import gudusoft.gsqlparser.ir.semantic.binding.NameBindingProvider;
import gudusoft.gsqlparser.ir.semantic.binding.RelationBinding;
import gudusoft.gsqlparser.ir.semantic.binding.UsingScope;
import gudusoft.gsqlparser.nodes.TCTE;
import gudusoft.gsqlparser.nodes.TCTEList;
import gudusoft.gsqlparser.nodes.TExpression;
import gudusoft.gsqlparser.nodes.TExpressionList;
import gudusoft.gsqlparser.nodes.TFetchFirstClause;
import gudusoft.gsqlparser.nodes.TFunctionCall;
import gudusoft.gsqlparser.nodes.TLimitClause;
import gudusoft.gsqlparser.nodes.TOffsetClause;
import gudusoft.gsqlparser.nodes.TTopClause;
import gudusoft.gsqlparser.nodes.TGroupBy;
import gudusoft.gsqlparser.nodes.TGroupByItem;
import gudusoft.gsqlparser.nodes.TGroupByItemList;
import gudusoft.gsqlparser.nodes.TGroupingExpressionItem;
import gudusoft.gsqlparser.nodes.TGroupingSet;
import gudusoft.gsqlparser.nodes.TGroupingSetItem;
import gudusoft.gsqlparser.nodes.TGroupingSetItemList;
import gudusoft.gsqlparser.nodes.TRollupCube;
import gudusoft.gsqlparser.nodes.TJoin;
import gudusoft.gsqlparser.nodes.TJoinItem;
import gudusoft.gsqlparser.nodes.TJoinItemList;
import gudusoft.gsqlparser.nodes.TJoinList;
import gudusoft.gsqlparser.nodes.TObjectName;
import gudusoft.gsqlparser.nodes.TObjectNameList;
import gudusoft.gsqlparser.nodes.TOrderBy;
import gudusoft.gsqlparser.nodes.TOutputClause;
import gudusoft.gsqlparser.nodes.TReturningClause;
import gudusoft.gsqlparser.nodes.TOrderByItem;
import gudusoft.gsqlparser.nodes.TOrderByItemList;
import gudusoft.gsqlparser.nodes.TParseTreeVisitor;
import gudusoft.gsqlparser.nodes.TPartitionClause;
import gudusoft.gsqlparser.nodes.TPivotClause;
import gudusoft.gsqlparser.nodes.TPivotInClause;
import gudusoft.gsqlparser.nodes.TPivotedTable;
import gudusoft.gsqlparser.nodes.TUnpivotInClause;
import gudusoft.gsqlparser.nodes.TUnpivotInClauseItem;
import gudusoft.gsqlparser.nodes.TResultColumn;
import gudusoft.gsqlparser.nodes.TResultColumnList;
import gudusoft.gsqlparser.nodes.TSelectDistinct;
import gudusoft.gsqlparser.nodes.TTable;
import gudusoft.gsqlparser.nodes.TWhereClause;
import gudusoft.gsqlparser.nodes.TWindowDef;
import gudusoft.gsqlparser.nodes.TWithinGroup;
import gudusoft.gsqlparser.nodes.TWindowFrame;
import gudusoft.gsqlparser.nodes.TWindowFrameBoundary;
import gudusoft.gsqlparser.resolver2.ResolutionStatus;
import gudusoft.gsqlparser.EInsertSource;
import gudusoft.gsqlparser.nodes.TColumnDefinition;
import gudusoft.gsqlparser.nodes.TColumnDefinitionList;
import gudusoft.gsqlparser.nodes.TViewAliasClause;
import gudusoft.gsqlparser.nodes.TViewAliasItem;
import gudusoft.gsqlparser.nodes.TViewAliasItemList;
import gudusoft.gsqlparser.stmt.TCreateTableSqlStatement;
import gudusoft.gsqlparser.stmt.TCreateViewSqlStatement;
import gudusoft.gsqlparser.stmt.TDeleteSqlStatement;
import gudusoft.gsqlparser.stmt.TInsertSqlStatement;
import gudusoft.gsqlparser.stmt.TMergeSqlStatement;
import gudusoft.gsqlparser.stmt.TSelectSqlStatement;
import gudusoft.gsqlparser.stmt.TUpdateSqlStatement;
import gudusoft.gsqlparser.nodes.TMergeWhenClause;
import gudusoft.gsqlparser.nodes.TMergeUpdateClause;
import gudusoft.gsqlparser.nodes.TMergeInsertClause;

import java.util.ArrayDeque;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Deque;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.HashSet;
import java.util.IdentityHashMap;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Set;

/**
 * Builds a {@link SemanticProgram} from a parsed and resolved
 * {@link TSelectSqlStatement}.
 *
 * <p>Current scope (after slice 9): SELECT with one or more base-table or
 * CTE sources, optional WHERE, optional JOIN of base tables with ON
 * conditions, optional GROUP BY (slice 6), optional WITH clause including
 * chained CTEs (each CTE sees the ones declared strictly before it),
 * optional FROM-clause subquery (slice 5), optional row-deduplication via
 * {@code SELECT DISTINCT} or Oracle's {@code SELECT UNIQUE} synonym
 * (slice 8 — see {@link StatementGraph#isDistinct()}), optional ORDER BY
 * over physical column references or column-bearing expressions
 * (slice 9 — see {@link StatementGraph#getOrderByColumnRefs()}).
 * Expression projections like {@code salary * 2 AS doubled} or
 * {@code a.x + a.y} are accepted and marked
 * {@link OutputColumn#isDerived()}; aggregate function calls (slice 6)
 * are flagged via {@link OutputColumn#isAggregate()}.
 *
 * <p>Slice 9 lifts {@code ORDER BY} for sort keys that are physical
 * column references or expressions over them. The collected references
 * surface as {@link StatementGraph#getOrderByColumnRefs()}. Sort
 * direction ({@code ASC}/{@code DESC}) and null placement
 * ({@code NULLS FIRST}/{@code NULLS LAST}) are presentation metadata
 * and are not modelled. Ordinal forms ({@code ORDER BY 1}) and
 * projection-alias forms ({@code SELECT id AS x ... ORDER BY x}) are
 * rejected so the dependency information is never silently lost; a
 * later slice can model output-position references explicitly. The
 * canonical lineage model (slice 7) deliberately ignores ORDER BY —
 * sort order changes presentation, not column dependency or row-set
 * membership.
 *
 * <p>Row-limit clauses ({@code LIMIT}, {@code TOP}, {@code OFFSET},
 * {@code FETCH FIRST}) are rejected statement-wide, including the
 * SQL Server-style {@code ORDER BY ... OFFSET ... FETCH NEXT}. With
 * a row-limit present, {@code ORDER BY} ceases to be presentation-only
 * and starts deciding which rows survive — the canonical-model
 * exclusion would no longer be sound, so the entire statement is out
 * of scope until a future slice models row-limit semantics.
 *
 * <p>Slice 10 lifts {@code HAVING}: the predicate's column references
 * are collected into {@link StatementGraph#getHavingColumnRefs()} via
 * {@link #buildHavingColumnRefs}. The same visitor pattern as projection
 * and ORDER BY rejects subqueries (scalar, EXISTS, IN-SELECT, ANY/ALL/
 * SOME) and window functions before {@link #collectColumnRefs} runs, so
 * inner-scope refs never leak. HAVING without GROUP BY is supported (the
 * parser still attaches a {@link TGroupBy} node with empty items).
 * HAVING is row-influence semantically but does not contribute to the
 * canonical lineage model — see
 * {@link StatementGraph#getHavingColumnRefs()} for why.
 *
 * <p>Slice 11 lifted uncorrelated scalar subqueries in projection;
 * scalar bodies are extracted as their own statements via
 * {@link #extractScalarSubqueriesAsStatements} with the synthetic-name
 * convention {@code <scalar_subquery_<index>>}.
 *
 * <p>Slice 12 lifts set operations (UNION / UNION ALL / INTERSECT /
 * INTERSECT ALL / MINUS / MINUS ALL / EXCEPT / EXCEPT ALL) at the top
 * level and as CTE bodies. Each branch becomes its own
 * {@link StatementGraph} with synthetic name
 * {@code <set_op_branch_<index>>}; the outer set-op statement carries
 * empty {@code relations} and lineage edges fan out per-position to
 * each branch. The flatten descends the left-leaning AST iteratively
 * (per CLAUDE.md — no recursion on {@code leftStmt}/{@code rightStmt}).
 * See {@link #buildSetOpProgram}.
 *
 * <p>Slice 22 lifts window-function frame clauses
 * ({@code ROWS}/{@code RANGE}/{@code GROUPS BETWEEN ...}); the frame
 * unit, start bound, and optional end bound are captured in
 * {@link WindowFrame} hung off
 * {@link WindowSpec#getFrame()}. Frame info is presentation-only
 * (dlineage XML harvests no frame information) and does NOT contribute
 * to the canonical lineage model — same status as slice-13's
 * PARTITION BY / OVER ORDER BY refs. Per-bound EXCLUDE clauses
 * (Netezza-reachable) and non-constant offsets (PG
 * {@code simple_object_name_t}, ANSI {@code parenthesis_t}) are still
 * rejected.
 *
 * <p>Still rejected: {@code WITH RECURSIVE}, {@code DISTINCT ON (...)}
 * and other non-{@code DISTINCT}/{@code UNIQUE} row-filters,
 * scalar-body constant-only projections (zero column refs),
 * correlated scalar subqueries, scalar bodies with
 * subqueries in WHERE/JOIN ON/GROUP BY, multi-column scalar inner,
 * scalar subqueries embedded in larger projection expressions including
 * EXISTS-in-projection, embedded window functions in larger projection
 * expressions, window functions in scalar-subquery bodies, window
 * functions in WHERE/JOIN ON/GROUP BY/HAVING/ORDER BY, empty
 * {@code OVER ()}, frame clauses with non-constant offsets (PG
 * {@code simple_object_name_t}, ANSI {@code parenthesis_t}), frame
 * {@code EXCLUDE} clauses (Netezza-reachable), named windows,
 * vendor-specific window extensions ({@code FILTER (WHERE ...)},
 * {@code WITHIN GROUP},
 * {@code KEEP DENSE_RANK}, Hive {@code DISTRIBUTE BY}/{@code CLUSTER BY}/
 * {@code SORT BY}/{@code PARTITION BY ... SORT (...)}), non-physical
 * {@code PARTITION BY} / OVER {@code ORDER BY} refs (literals,
 * subqueries, function calls, expressions, expression-alias references),
 * window function names outside the slice-13 allowlist,
 * (slice 63 lifts explicit {@code CROSS JOIN}, slice 64 lifts
 * {@code JOIN ... USING (...)}, and slice 66 lifts {@code NATURAL JOIN}
 * at outer / CTE-body / FROM-subquery-body call sites; all three stay
 * rejected inside scalar / set-op-branch / set-op-CTE / predicate bodies;
 * NATURAL additionally requires resolvable catalog metadata on both
 * sides, with a side-specific reject otherwise), duplicate aliases,
 * Oracle
 * {@code ORDER SIBLINGS BY}, Teradata {@code ORDER BY ... RESET WHEN},
 * row-limit clauses, ORDER BY ordinals/aliases, Teradata {@code QUALIFY}
 * clause, set operations nested in FROM-subquery / scalar bodies,
 * mixed-operator and mixed-{@code _ALL} set-op chains, set-op outer
 * ORDER BY / row-limit clauses, set-op internal-node modifiers, branch
 * column-count mismatch, set-op branches with FROM-subquery / scalar
 * projection / their own CTE list, nested WITH on set-op CTE body. The
 * builder fails fast outside this scope so callers see the unsupported
 * case immediately rather than receiving a half-built IR.
 *
 * <p><b>API status: advanced/preview.</b> This low-level builder requires the
 * caller to own parsing, Resolver2 configuration, statement dispatch,
 * catalog/provider consistency, diagnostics, and recovery. New production
 * integrations should use
 * {@link gudusoft.gsqlparser.ir.semantic.SqlSemanticAnalyzer}; advanced
 * integrations should use the atomic {@code buildResult} methods rather than
 * deprecated {@code build} compatibility adapters.
 */
public final class SemanticIRBuilder {

    /**
     * Reserved name prefix for synthetic scalar-subquery body
     * statements (slice 11). Names take the form
     * {@code "<scalar_subquery_<index>>"}; the angle brackets ensure
     * no collision with real CTE names or FROM-clause aliases.
     * {@link #isScalarSyntheticName(String)} is the only authorised
     * detector — both this builder and
     * {@code SemanticIRProjector.BodyIndexes} use it so the convention
     * lives in one place.
     */
    public static final String SCALAR_BODY_PREFIX = "<scalar_subquery_";

    /**
     * Strict regex for synthetic scalar-subquery-body names. Format is
     * exactly {@code <scalar_subquery_<digits>>} — pinning the digits
     * suffix and the closing angle bracket prevents a real (quoted)
     * CTE alias that happens to begin with the prefix from being
     * misclassified as a synthetic name and silently skipped by
     * {@code BodyIndexes}.
     */
    private static final java.util.regex.Pattern SCALAR_NAME_PATTERN =
            java.util.regex.Pattern.compile("<scalar_subquery_\\d+>");

    /**
     * True iff {@code name} is a synthetic scalar-subquery-body name
     * created by this builder (slice 11). Used by
     * {@code SemanticIRProjector.BodyIndexes} to skip such bodies when
     * building the CTE/FROM-subquery name lookup tables — scalar
     * bodies are reached only via lineage edges, never via relations.
     *
     * <p>The match is strict: the name must be the full reserved
     * pattern {@code <scalar_subquery_<digits>>}. A real CTE alias
     * that happens to start with {@code <scalar_subquery_} but
     * doesn't match the digits-and-closing-bracket suffix is NOT
     * skipped (codex impl-review round-1 SHOULD 2).
     */
    public static boolean isScalarSyntheticName(String name) {
        return name != null && SCALAR_NAME_PATTERN.matcher(name).matches();
    }

    /**
     * Reserved name prefix for synthetic set-op-branch body statements
     * (slice 12). Names take the form {@code "<set_op_branch_<index>>"};
     * the angle brackets ensure no collision with real CTE names or
     * FROM-clause aliases. {@link #isSetOpBranchSyntheticName(String)} is
     * the only authorised detector — both this builder and
     * {@code SemanticIRProjector.BodyIndexes} use it so the convention
     * lives in one place (slice-11 process lesson #10 generalised).
     */
    public static final String SET_OP_BRANCH_PREFIX = "<set_op_branch_";

    /**
     * Strict regex for synthetic set-op-branch-body names. Format is
     * exactly {@code <set_op_branch_<digits>>} — pinning the digits
     * suffix and the closing angle bracket prevents a real (quoted) CTE
     * alias that happens to begin with the prefix from being
     * misclassified as a synthetic name and silently skipped by
     * {@code BodyIndexes}.
     */
    private static final java.util.regex.Pattern SET_OP_BRANCH_NAME_PATTERN =
            java.util.regex.Pattern.compile("^<set_op_branch_\\d+>$");

    /**
     * True iff {@code name} is a synthetic set-op-branch-body name
     * created by this builder (slice 12). Used by
     * {@code SemanticIRProjector.BodyIndexes} to skip such bodies when
     * building the CTE/FROM-subquery name lookup tables — set-op
     * branches are reached only via lineage edges, never via relations.
     *
     * <p>The match is strict: the name must be the full reserved
     * pattern {@code <set_op_branch_<digits>>}.
     */
    public static boolean isSetOpBranchSyntheticName(String name) {
        return name != null && SET_OP_BRANCH_NAME_PATTERN.matcher(name).matches();
    }

    /**
     * Reserved name prefix for synthetic predicate-subquery body statements
     * (slice 23 — uncorrelated EXISTS extracted from outer-SELECT JOIN ON).
     * Names take the form {@code "<predicate_subquery_<index>>"}; the angle
     * brackets ensure no collision with real CTE names or FROM-clause aliases.
     * {@link #isPredicateSubquerySyntheticName(String)} is the only authorised
     * detector — both this builder and {@code SemanticIRProjector.BodyIndexes}
     * use it so the convention lives in one place.
     */
    public static final String PREDICATE_BODY_PREFIX = "<predicate_subquery_";

    /**
     * Strict regex for synthetic predicate-subquery-body names. Format is
     * exactly {@code <predicate_subquery_<digits>>}; pinning the digit suffix
     * and the closing angle bracket prevents a real (quoted) CTE alias that
     * happens to begin with the prefix from being misclassified as a synthetic
     * name and silently skipped by {@code BodyIndexes}.
     */
    private static final java.util.regex.Pattern PREDICATE_BODY_NAME_PATTERN =
            java.util.regex.Pattern.compile("<predicate_subquery_\\d+>");

    /**
     * True iff {@code name} is a synthetic predicate-subquery-body name
     * created by this builder (slice 23). Used by
     * {@code SemanticIRProjector.BodyIndexes} to skip such bodies when
     * building the CTE/FROM-subquery name lookup tables — predicate-subquery
     * bodies are unreachable from outer (no relation edge, no lineage edge).
     */
    public static boolean isPredicateSubquerySyntheticName(String name) {
        return name != null && PREDICATE_BODY_NAME_PATTERN.matcher(name).matches();
    }

    /**
     * Aggregate function names recognized by the builder's per-output
     * aggregate flag detection (slice 6 originated; slice 29 / slice 30
     * extended). Treated as case-insensitive. Callers should go through
     * {@link #isAggregateFunction(TExpression)} rather than reading this
     * set directly.
     *
     * <p>Slice-29 extensions: dialect aggregates {@code listagg},
     * {@code string_agg}, {@code group_concat}, {@code array_agg}.
     * Slice-30 extension: {@code mode} (PostgreSQL ordered-set aggregate;
     * admitted via the slice-29 WITHIN GROUP path under
     * {@code findUnsupportedWithinGroupFunctionName}). Slice 30 also
     * removes {@code mode} from {@link #WINDOW_FUNCTION_NAMES} via an
     * explicit {@code s.remove("mode")} so the slice-13 window allowlist
     * isn't widened — see {@link #WINDOW_FUNCTION_NAMES} JavaDoc and
     * {@code DlineageXmlProjector.ORDER_BY_WITHIN_GROUP_AGGREGATE_NAMES} for
     * the matching window-vs-aggregate discriminator override.
     */
    private static final Set<String> AGGREGATE_FUNCTION_NAMES;
    static {
        Set<String> s = new HashSet<>();
        s.add("count");
        s.add("sum");
        s.add("avg");
        s.add("min");
        s.add("max");
        s.add("stddev");
        s.add("variance");
        s.add("var_samp");
        s.add("var_pop");
        s.add("stddev_samp");
        s.add("stddev_pop");
        // Common dialect-specific aggregates so the flag has fewer false negatives.
        s.add("listagg");      // Oracle, PostgreSQL 16+
        s.add("string_agg");   // PostgreSQL, SQL Server
        s.add("group_concat"); // MySQL
        s.add("array_agg");    // PostgreSQL, Snowflake, BigQuery
        // Slice 30: PostgreSQL ordered-set aggregate. Unlike percentile_cont /
        // percentile_disc / rank-family, mode() has no documented window form
        // in any GSP-supported vendor; admitting it lets the WITHIN GROUP path
        // accept it in JOIN ON predicate subqueries (slice 29 lift extension)
        // AND lets DlineageXmlProjector mark its output aggregate=true.
        // Defensive: WINDOW_FUNCTION_NAMES below subtracts mode after
        // s.addAll(AGGREGATE_FUNCTION_NAMES) so mode() OVER (...) stays
        // rejected by the slice-13 window allowlist.
        s.add("mode");         // PostgreSQL ordered-set aggregate (slice 30)
        AGGREGATE_FUNCTION_NAMES = Collections.unmodifiableSet(s);
    }

    /**
     * Slice 42: hypothetical-set ordered-set aggregate function names that
     * are ALSO valid window functions. Unlike {@link #AGGREGATE_FUNCTION_NAMES}
     * these names are admitted as aggregates ONLY when the call carries a
     * {@link #isWithinGroupOnlyWindowDef WITHIN-GROUP-only}
     * {@link TWindowDef} attachment (Oracle / SQL Server parser style —
     * {@code RANK(100) WITHIN GROUP (ORDER BY x.id)} produces
     * {@code fn.getWindowDef()!=null}, {@code wd.isIncludingOverClause()==
     * false}, {@code wd.getWithinGroup()!=null}). Any other shape — direct
     * {@code fn.getWithinGroup()} (PG / Snowflake style),
     * {@code fn.getWindowDef()} with {@code OVER (...)}, or no attachment
     * at all — keeps the existing window-function classification.
     *
     * <p>The set is intentionally NOT merged into
     * {@link #AGGREGATE_FUNCTION_NAMES} because that would also lift the PG
     * direct-attachment hypothetical-set form ({@code rank(0.5) WITHIN GROUP
     * (ORDER BY x.salary)}). Pre-plan probe ({@code /tmp/probe42/Probe42.java})
     * confirmed PG dlineage XML for hypothetical-set is structurally
     * indistinguishable from {@code rank() OVER (ORDER BY x)} (both emit
     * {@code clauseType="orderby"} fdr) — admitting PG hypothetical-set
     * would manufacture an {@code AGGREGATION_MISMATCH} divergence on the
     * windowed form because the projector's
     * {@code DlineageXmlProjector.isWindowFunctionResultset} cannot tell
     * the two forms apart on PG.
     *
     * <p>The Oracle / MSSQL hypothetical-set form, by contrast, emits
     * neither a {@code clauseType="orderby"} fdr nor a
     * {@code clauseType="selectList"} fdr (probe-confirmed) — so the
     * projector's slice-13 windowed-vs-aggregate discriminator returns
     * {@code false} and the matching projector-side
     * {@code AGGREGATE_FUNCTION_NAMES} entry marks the output aggregate.
     * Their OVER form ({@code RANK() OVER (ORDER BY x.id)}) emits
     * {@code clauseType="orderby"} as expected and stays correctly
     * classified as windowed.
     *
     * <p>Vendor-gated to Oracle / MSSQL inside
     * {@link #isAdmittedTopLevelWithinGroupAggregate} and
     * {@link #findUnsupportedWithinGroupFunctionName}; the PG
     * direct-attachment shape never satisfies the
     * {@link #isWithinGroupOnlyWindowDef} predicate (because PG sets
     * {@code fn.getWindowDef()==null}) so the carve-out cannot accidentally
     * fire on PG.
     */
    private static final Set<String> HYPOTHETICAL_SET_AGGREGATE_NAMES;
    static {
        Set<String> s = new HashSet<>();
        s.add("rank");
        s.add("dense_rank");
        s.add("percent_rank");
        s.add("cume_dist");
        HYPOTHETICAL_SET_AGGREGATE_NAMES = Collections.unmodifiableSet(s);
    }

    /**
     * Slice 42: true iff {@code fn} is an Oracle / MSSQL hypothetical-set
     * ordered-set aggregate call shape — {@code RANK} / {@code DENSE_RANK} /
     * {@code PERCENT_RANK} / {@code CUME_DIST} with
     * {@link #isWithinGroupOnlyWindowDef WITHIN-GROUP-only}
     * {@link TWindowDef} attachment. Used both as a name-whitelist
     * discriminator (so PG direct {@code fn.getWithinGroup()} cannot
     * accidentally pass through, since PG sets {@code fn.getWindowDef()==
     * null}) and as the {@link #isAggregateFunction} carve-out trigger.
     */
    private static boolean isHypotheticalSetWithinGroupCall(TFunctionCall fn) {
        if (fn == null) return false;
        if (!isWithinGroupOnlyWindowDef(fn.getWindowDef())) return false;
        if (fn.getFunctionName() == null) return false;
        String name = fn.getFunctionName().toString();
        if (name == null || name.isEmpty()) return false;
        return HYPOTHETICAL_SET_AGGREGATE_NAMES.contains(
                name.toLowerCase(Locale.ROOT));
    }

    /**
     * Predicate-bearing join types accepted by the current builder.
     * Slice 64: each must carry either an ON condition or a USING
     * clause; the per-key {@code joinColumnRefs} emission happens in
     * {@link #buildRelations} for USING and via
     * {@link #collectColumnRefs} for ON. NATURAL, semi/anti,
     * vendor-specific joins, and nested-join sources stay rejected so
     * the IR cannot quietly drop a row-set predicate. The unqualified
     * output-naming case for USING merged keys is deferred to S65.
     */
    private static final EnumSet<EJoinType> ALLOWED_PREDICATE_JOIN_TYPES = EnumSet.of(
            EJoinType.inner,
            EJoinType.left,
            EJoinType.right,
            EJoinType.full,
            EJoinType.fullouter,
            EJoinType.leftouter,
            EJoinType.rightouter,
            EJoinType.join,
            // MySQL STRAIGHT_JOIN is an optimizer join-order hint with no
            // effect on result semantics; it carries a normal ON/USING
            // clause and mapSemanticJoinType() degrades it to INNER. Admit
            // it on the predicate path so it emits a standard INNER join
            // entity instead of aborting analysis with UNSUPPORTED_JOIN_TYPE.
            EJoinType.straight
    );

    /**
     * Slice 63 — join types admitted by the builder but that must NOT
     * carry an ON or USING clause. Currently just {@code CROSS}; the
     * tier exists so that future ON-less shapes can join the same path
     * with the same shape contract. Slice 66 added a separate
     * {@link #NATURAL_JOIN_TYPES} tier because NATURAL has its own
     * catalog-required reject path that CROSS does not.
     */
    private static final EnumSet<EJoinType> ALLOWED_ON_LESS_JOIN_TYPES = EnumSet.of(
            EJoinType.cross
    );

    /**
     * Slice 66 — NATURAL join types. Each MUST NOT carry an ON or USING
     * clause. Each MUST have resolvable catalog metadata on BOTH sides;
     * a missing-catalog reject fires inside {@link #buildRelations}
     * with a side-specific diagnostic. The shared-column list is
     * inferred from the running {@link LeftOutputState} ∩ right's
     * catalog and feeds into {@link #emitMergedJoinRefs} the same way
     * a syntactically-declared USING list does.
     */
    private static final EnumSet<EJoinType> NATURAL_JOIN_TYPES = EnumSet.of(
            EJoinType.natural,
            EJoinType.natural_inner,
            EJoinType.natural_left,
            EJoinType.natural_right,
            EJoinType.natural_leftouter,
            EJoinType.natural_rightouter,
            EJoinType.natural_full,
            EJoinType.natural_fullouter
    );

    private static boolean isNaturalJoinType(EJoinType jt) {
        return jt != null && NATURAL_JOIN_TYPES.contains(jt);
    }

    /**
     * SQL Server lateral joins: {@code CROSS APPLY} / {@code OUTER APPLY}.
     * The right operand is a correlated derived table (subquery or
     * table-valued function) whose correlation lives <em>inside</em> the
     * right operand (its WHERE clause for the subquery form, its function
     * arguments for the TVF form) rather than on an ON/USING clause. So
     * APPLY is admitted on the ON-less tier (like {@code CROSS}); it MUST
     * NOT carry ON/USING. {@code mapSemanticJoinType} degrades
     * {@code crossapply -> INNER} and {@code outerapply -> LEFT}; the
     * lateral nature is carried by {@link JoinEntity#isLateral()} (mirrors
     * how NATURAL is carried by {@code isNatural()} rather than its own
     * join type). The correlation is preserved by the normal child
     * StatementGraph the right derived table already produces, so it is
     * NOT lifted onto the join edge (the predicate references the inner
     * relation and the outer scope, not the right endpoint).
     */
    private static final EnumSet<EJoinType> LATERAL_JOIN_TYPES = EnumSet.of(
            EJoinType.crossapply,
            EJoinType.outerapply
    );

    private static boolean isLateralJoinType(EJoinType jt) {
        return jt != null && LATERAL_JOIN_TYPES.contains(jt);
    }

    /**
     * True when a join operand is an ANSI / PostgreSQL {@code LATERAL} derived
     * table or table-valued function. Unlike the SQL Server APPLY forms (which
     * are encoded in the join <em>type</em> and matched by
     * {@link #isLateralJoinType}), the {@code LATERAL} keyword sits on the right
     * operand itself: the parser captures it as that {@link TTable}'s start
     * token (covers {@code , LATERAL (...)}, {@code CROSS JOIN LATERAL (...)},
     * {@code JOIN LATERAL (...) ON ...}, and {@code LATERAL func(...)}). A plain
     * derived table starts with {@code (} and a base relation with its name, so
     * this never false-matches a non-lateral operand.
     */
    private static boolean isLateralTable(TTable t) {
        if (t == null) {
            return false;
        }
        // LATERAL always precedes a derived table / table-valued function /
        // xmltable, never a base relation. So a plain object-name table that
        // happens to be named `lateral` (legal where LATERAL is unreserved, or
        // when quoted) is NOT a lateral join even though its start token reads
        // `lateral` — exclude the base-relation shape before the token check.
        if (t.getTableType() == ETableSource.objectname) {
            return false;
        }
        TSourceToken st = t.getStartToken();
        return st != null && "LATERAL".equalsIgnoreCase(st.toString());
    }

    private SemanticIRBuilder() {}

    /**
     * Session owned by one atomic {@code build*Result} invocation. Deep static
     * builder helpers route diagnostics to the active session, but the facts
     * leave the builder only through {@link SemanticBuildResult}; consumers do
     * not coordinate a second drain operation.
     */
    private static final ThreadLocal<BuildSession> ACTIVE_BUILD_SESSION =
            new ThreadLocal<>();

    /**
     * Compatibility snapshot for legacy {@code build* + drain} callers. It is
     * populated only after an atomic result is complete and is never consumed
     * by {@link SqlSemanticAnalyzer} or another core pipeline stage.
     */
    private static final ThreadLocal<List<Diagnostic>> LEGACY_BUILD_DIAGNOSTICS =
            new ThreadLocal<>();

    private static void recordBuildDiagnostic(Diagnostic diagnostic) {
        BuildSession session = ACTIVE_BUILD_SESSION.get();
        if (session == null) {
            throw new IllegalStateException(
                    "build diagnostic emitted outside an active build session");
        }
        session.report(diagnostic);
    }

    private static void recordBuildWarning(Diagnostic warning) {
        if (warning.getSeverity() != Severity.WARN) {
            throw new IllegalArgumentException(
                    "recordBuildWarning requires WARN severity");
        }
        recordBuildDiagnostic(warning);
    }

    /** Record a recovered subject after its root diagnostic was reported. */
    private static void recordBuildRecovery(RecoveryMetadata.Entry entry) {
        BuildSession session = ACTIVE_BUILD_SESSION.get();
        if (session == null) {
            throw new IllegalStateException(
                    "build recovery emitted outside an active build session");
        }
        session.recover(entry);
    }

    /**
     * Clear the current thread's legacy compatibility snapshot. New callers
     * should use a {@code build*Result} method and need no clear/drain calls.
     */
    public static void clearBuildDiagnostics() {
        LEGACY_BUILD_DIAGNOSTICS.remove();
    }

    /**
     * Return the current thread's legacy compatibility snapshot without
     * clearing it. Each legacy top-level build replaces the snapshot, so an
     * undrained prior invocation cannot contaminate the next one.
     */
    public static List<Diagnostic> pendingBuildDiagnostics() {
        List<Diagnostic> snapshot = LEGACY_BUILD_DIAGNOSTICS.get();
        if (snapshot == null || snapshot.isEmpty()) {
            return Collections.emptyList();
        }
        return new ArrayList<>(snapshot);
    }

    /**
     * Read and clear the current thread's legacy compatibility snapshot.
     * Production analysis consumes {@link SemanticBuildResult} directly.
     */
    public static List<Diagnostic> drainBuildDiagnostics() {
        List<Diagnostic> pending = pendingBuildDiagnostics();
        LEGACY_BUILD_DIAGNOSTICS.remove();
        return pending;
    }

    /**
     * Catalog-less {@code NATURAL JOIN} degrade — record the
     * {@link DiagnosticCode#NATURAL_CATALOG_REQUIRED} reject as a non-fatal
     * {@link Severity#WARN} instead of throwing. The join still appears in
     * the join graph as a bare NATURAL entity (empty conditions / USING
     * columns, both endpoints populated); only the shared-column predicates
     * are absent. Shared between the SELECT-side {@link #buildRelations} and
     * the joined-UPDATE FROM path so the wording stays identical to the
     * former fatal diagnostic.
     */
    private static void recordNaturalDegradeWarning(NaturalKeyResult r, TJoinItem item) {
        recordBuildWarning(Diagnostic.warn(
                DiagnosticCode.NATURAL_CATALOG_REQUIRED,
                formatNaturalCatalogReject(r), item));
    }

    /**
     * Terminate a clause column-collection pass that accumulated non-exact
     * (unresolvable) column bindings. Normally fatal
     * ({@link DiagnosticCode#COLUMN_BINDING_NON_EXACT}); but two structural
     * anchors degrade it to a non-fatal warning (GSP R6) — record the warning
     * and let the build continue (the unresolved refs are simply omitted,
     * never fabricated) instead of discarding the whole statement graph:
     *
     * <ol>
     *   <li><b>USING join anchor</b> — the FROM clause carries a
     *       {@code JOIN ... USING} (the scope has merged keys). The join
     *       structure is fully known and only the unqualified non-key SELECT/
     *       WHERE columns are unplaceable without a catalog.</li>
     *   <li><b>Join-graph anchor</b> — the FROM clause resolved a fully-built
     *       join graph (two or more endpoints from explicit ON / CROSS / comma
     *       predicates; {@link NameBindingProvider#hasJoinStructureAnchor()}).
     *       An explicit ON / CROSS join graph is just as fully determined as a
     *       USING join — the only thing missing without a catalog is
     *       <em>which side</em> an unqualified column belongs to, which is
     *       exactly the non-fatal case the USING branch already tolerates.</li>
     * </ol>
     *
     * <p>BOTH anchors fire ONLY when every reject is an <em>unqualified</em>
     * column miss ({@code allRejectsUnqualified}). A qualified reference that
     * fails to bind (e.g. {@code b.id} pointing at the wrong side, or an
     * unregistered catalog column under {@code JOIN ... USING}) is a genuine
     * error, not a which-side ambiguity, and stays fatal under either anchor.
     *
     * <p>Catalog-less NATURAL joins are handled earlier by the
     * {@code hasNaturalDegrade()} fallback. The fatal path remains for the
     * genuinely structureless case (no resolvable join graph) and for any
     * qualified-reference miss.
     */
    private static void rejectNonExactBindings(List<String> rejects,
                                               NameBindingProvider provider,
                                               boolean allRejectsUnqualified) {
        if (provider != null && allRejectsUnqualified
                && provider.getUsingScope().hasMergedKeys()) {
            recordBuildWarning(Diagnostic.warn(DiagnosticCode.COLUMN_BINDING_NON_EXACT,
                    "non-exact column bindings (USING join, no aliases): " + rejects, null));
            return;
        }
        if (provider != null && provider.hasJoinStructureAnchor()
                && allRejectsUnqualified) {
            recordBuildWarning(Diagnostic.warn(DiagnosticCode.COLUMN_BINDING_NON_EXACT,
                    "non-exact column bindings (join graph resolved, no aliases/catalog): "
                            + rejects, null));
            return;
        }
        throw new SemanticIRBuildException(Diagnostic.error(
                DiagnosticCode.COLUMN_BINDING_NON_EXACT,
                "non-exact column bindings: " + rejects, null));
    }

    /**
     * Options in force for the {@code build*} call currently running on this
     * thread. Set by the three-argument {@code build*} overloads for exactly
     * the duration of their delegate call and restored (not merely cleared)
     * afterwards, so a nested build cannot leak its options to the caller and
     * a two-argument call always sees {@link SemanticIRBuildOptions#defaults()}.
     *
     * <p>Thread-local rather than a threaded parameter because the deep
     * recursion between the {@code build*} entry points and the nested-body
     * extractors is many frames wide. It is restored at the same atomic build
     * boundary as {@link #ACTIVE_BUILD_SESSION}.
     */
    private static final ThreadLocal<SemanticIRBuildOptions> ACTIVE_OPTIONS =
            new ThreadLocal<>();

    /** @return the options for the in-flight build; never null. */
    private static SemanticIRBuildOptions activeOptions() {
        SemanticIRBuildOptions o = ACTIVE_OPTIONS.get();
        return o == null ? SemanticIRBuildOptions.defaults() : o;
    }

    /**
     * Run {@code body} with {@code options} in force, restoring whatever was
     * previously in force on this thread (including "nothing") on the way out,
     * on both the normal and the exceptional path.
     */
    private static SemanticProgram withOptions(
            SemanticIRBuildOptions options,
            java.util.function.Supplier<SemanticProgram> body) {
        if (options == null) {
            throw new IllegalArgumentException("options must not be null");
        }
        SemanticIRBuildOptions previous = ACTIVE_OPTIONS.get();
        ACTIVE_OPTIONS.set(options);
        try {
            return body.get();
        } finally {
            if (previous == null) {
                ACTIVE_OPTIONS.remove();
            } else {
                ACTIVE_OPTIONS.set(previous);
            }
        }
    }

    /** Execute one build and publish its program and diagnostics atomically. */
    private static SemanticBuildResult executeBuild(
            SemanticIRBuildOptions options,
            java.util.function.Supplier<SemanticProgram> body) {
        if (options == null) {
            throw new IllegalArgumentException("options must not be null");
        }
        BuildSession previous = ACTIVE_BUILD_SESSION.get();
        BuildSession session = new BuildSession();
        ACTIVE_BUILD_SESSION.set(session);
        try {
            SemanticProgram program = withOptions(options, body);
            return session.completed(program);
        } catch (SemanticIRBuildException ex) {
            session.reportMissing(ex.getDiagnostics());
            return session.rejected();
        } finally {
            if (previous == null) {
                ACTIVE_BUILD_SESSION.remove();
            } else {
                ACTIVE_BUILD_SESSION.set(previous);
            }
        }
    }

    /** Adapt an atomic result to the legacy build-and-drain protocol. */
    private static SemanticProgram publishLegacyResult(SemanticBuildResult result) {
        List<Diagnostic> diagnostics = result.getDiagnostics();
        // A legacy build can be invoked re-entrantly from a provider callback.
        // Its caller receives only a SemanticProgram, so merge the completed
        // atomic facts into the restored parent session; otherwise the inner
        // diagnostics would survive only in the legacy snapshot that the
        // outer atomic/analyzer pipeline deliberately never drains.
        BuildSession parent = ACTIVE_BUILD_SESSION.get();
        // A rejected nested invocation has no semantic payload belonging to
        // the parent. If its exception escapes, executeBuild records it on the
        // normal exceptional path; if the callback handles it, it must remain
        // isolated from the otherwise-successful parent result.
        if (parent != null && result.getRecoveredProgram() != null) {
            parent.absorb(result);
        }
        if (diagnostics.isEmpty()) {
            LEGACY_BUILD_DIAGNOSTICS.remove();
        } else {
            LEGACY_BUILD_DIAGNOSTICS.set(Collections.unmodifiableList(
                    new ArrayList<>(diagnostics)));
        }

        SemanticProgram program = result.getRecoveredProgram();
        if (program != null) {
            return program;
        }
        throw SemanticIRBuildException.withDiagnostics(diagnostics);
    }

    private static final class BuildSession {
        private final List<Diagnostic> diagnostics = new ArrayList<>();
        private final List<RecoveryMetadata.Entry> recoveryEntries =
                new ArrayList<>();

        private void report(Diagnostic diagnostic) {
            diagnostics.add(java.util.Objects.requireNonNull(
                    diagnostic, "diagnostic"));
        }

        private void reportMissing(List<Diagnostic> additional) {
            for (Diagnostic diagnostic : additional) {
                if (!containsIdentity(diagnostics, diagnostic)) {
                    report(diagnostic);
                }
            }
        }

        private void absorb(SemanticBuildResult nested) {
            reportMissing(nested.getDiagnostics());
            for (RecoveryMetadata.Entry entry
                    : nested.getRecoveryMetadata().getEntries()) {
                if (!recoveryEntries.contains(entry)) {
                    recover(entry);
                }
            }
        }

        private static boolean containsIdentity(List<Diagnostic> values,
                                                Diagnostic candidate) {
            for (Diagnostic value : values) {
                if (value == candidate) {
                    return true;
                }
            }
            return false;
        }

        private void recover(RecoveryMetadata.Entry entry) {
            RecoveryMetadata.Entry nonNull = java.util.Objects.requireNonNull(
                    entry, "entry");
            if (!diagnostics.contains(nonNull.getRootDiagnostic())) {
                throw new IllegalArgumentException(
                        "recovery root diagnostic must be reported first");
            }
            recoveryEntries.add(nonNull);
        }

        private SemanticBuildResult completed(SemanticProgram program) {
            if (recoveryEntries.isEmpty()) {
                return SemanticBuildResult.completed(program, diagnostics);
            }
            return SemanticBuildResult.recovered(program, diagnostics,
                    RecoveryMetadata.of(recoveryEntries));
        }

        private SemanticBuildResult rejected() {
            return SemanticBuildResult.rejected(diagnostics);
        }
    }

    /**
     * Build a SELECT under caller-supplied {@code options}.
     *
     * <p>Identical to {@link #build(TSelectSqlStatement, NameBindingProvider)}
     * except for the knobs in {@code options}; pass
     * {@link SemanticIRBuildOptions#defaults()} for the historical behaviour.
     * With
     * {@link SemanticIRBuildOptions#withDegradeUnsupportedNestedBlocks(boolean)
     * degrade mode} on, an unsupported predicate-subquery body no longer
     * aborts the call: it becomes an
     * {@link StatementGraph#KIND_UNANALYZED} placeholder plus a
     * {@link DiagnosticCode#NESTED_BLOCK_UNANALYZED} warning, and the host
     * block's join graph is returned intact.
     */
    public static SemanticBuildResult buildResult(
            TSelectSqlStatement select, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildImpl(select, provider));
    }

    /** Build a SELECT and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildResult(
            TSelectSqlStatement select, NameBindingProvider provider) {
        return buildResult(select, provider, SemanticIRBuildOptions.defaults());
    }

    /**
     * Legacy compatibility API. Prefer {@link #buildResult}; this method
     * publishes the same diagnostics through {@link #drainBuildDiagnostics()}.
     */
    @Deprecated
    public static SemanticProgram build(TSelectSqlStatement select,
                                        NameBindingProvider provider,
                                        SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildResult(select, provider, options));
    }

    @Deprecated
    public static SemanticProgram build(TSelectSqlStatement select,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildResult(select, provider));
    }

    private static SemanticProgram buildImpl(TSelectSqlStatement select,
                                             NameBindingProvider provider) {
        if (select == null) {
            throw new IllegalArgumentException("select must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }
        List<StatementGraph> stmts = new ArrayList<>();
        List<LineageEdge> lineage = new ArrayList<>();
        Map<String, Integer> cteNameToStatementIndex = new HashMap<>();
        Map<String, List<String>> ctePublishedColumns = new HashMap<>();
        int outerIndex = buildSelectProgramInto(select, provider, stmts, lineage,
                cteNameToStatementIndex, ctePublishedColumns);
        // Slice 170 (S9): attach query-block scope metadata (GAP 4).
        attachQueryBlockScopes(stmts, outerIndex, cteNameToStatementIndex);
        return new SemanticProgram(stmts, lineage);
    }

    /**
     * Slice 170 (S9) — populate {@link QueryBlockScope} on each emitted
     * SELECT-program block (GAP 4): a stable {@code statementIndex}, the
     * {@link ScopeKind}, the CTE/derived name when present, and a
     * {@code parentStatementIndex} pointing at the <em>lexical owner</em>.
     *
     * <p>The flat list order is preserved (mutates entries in place via the
     * immutable {@code withJoinAnalysisFacts} copier). The outer statement
     * ({@code outerIndex}) is the {@link ScopeKind#MAIN} block with a null
     * parent. CTE bodies (known via {@code cteNameToStatementIndex}) and
     * other bodies emitted before the outer take the outer as their
     * top-level lexical owner.
     *
     * <p><strong>V1 scope (plan Q-CTE):</strong> {@code parentStatementIndex}
     * is the top-level owning statement. Precise multi-level nested-body
     * parent edges (e.g. a subquery inside a CTE body) are a documented
     * follow-up; for the common single-level case (CTEs / FROM-subqueries
     * directly under one SELECT) this is exact.
     */
    private static void attachQueryBlockScopes(List<StatementGraph> stmts,
                                               int outerIndex,
                                               Map<String, Integer> cteNameToStatementIndex) {
        if (stmts.isEmpty()) return;
        java.util.Set<Integer> cteIndices = new java.util.HashSet<Integer>(
                cteNameToStatementIndex.values());
        for (int i = 0; i < stmts.size(); i++) {
            StatementGraph sg = stmts.get(i);
            ScopeKind kind;
            Integer parent;
            if (i == outerIndex) {
                kind = ScopeKind.MAIN;
                parent = null;
            } else if (cteIndices.contains(Integer.valueOf(i))) {
                kind = ScopeKind.CTE;
                parent = Integer.valueOf(outerIndex);
            } else {
                // A FROM/scalar/predicate body emitted before the outer.
                kind = ScopeKind.DERIVED_TABLE;
                parent = Integer.valueOf(outerIndex);
            }
            // Slice 179 (R5): the block's own source span, set at the SELECT
            // construction site, follows the existing 1-based/end-exclusive
            // SourceSpan convention. Null when not threaded (e.g. DML).
            QueryBlockScope scope = new QueryBlockScope(
                    i, parent, kind, sg.getName(), sg.getSourceSpan());
            stmts.set(i, sg.withJoinAnalysisFacts(
                    sg.getJoinAnalysisFacts().withQueryBlockScope(scope)));
        }
    }

    /**
     * Slice 122 — build a SELECT program into a CALLER-OWNED
     * {@code stmts}/{@code lineage} pair, seeded with a caller-supplied
     * outer CTE context. {@link #build} delegates here with fresh empty
     * maps (behaviour-preserving extraction of its former inline body).
     *
     * <p>The MERGE USING-subquery branch in {@link #buildMerge} delegates
     * here with a COPY of the outer MERGE's {@code cteNameToStatementIndex}
     * (and {@code ctePublishedColumns}) so a USING body that references an
     * outer MERGE CTE
     * ({@code WITH cte AS (...) MERGE INTO t USING (SELECT ... FROM cte) s})
     * resolves the reference as CTE-kind and emits the cross-statement
     * {@code STATEMENT_OUTPUT(usingIdx, col) -> STATEMENT_OUTPUT(cteIdx, col)}
     * edge into the already-built CTE body. Building directly into the
     * shared lists means the inner statements land at their final absolute
     * indices with NO rebase — so edges to the pre-seeded outer CTE
     * reference the correct index (the pre-slice-122
     * {@code build()+rebaseLineageEdge} path could not, because the rebase
     * offset would wrongly shift an outer-CTE index too). This closes the
     * slice-110 documented parity gap.
     *
     * <p>{@code hasOuterCteListAlreadyProcessed} is derived from THIS
     * select's own CTE list only — the seeded outer CTEs are not declared
     * by {@code select.getCteList()}, so they must not trigger the
     * nested-WITH reject in {@code buildSelectStatementImpl}.
     *
     * <p>Slice 108 Phase 0 — the two helper calls (CTE walker +
     * outer-SELECT body) were extracted from {@link #build} into
     * {@link #buildSelectCteList} / {@link #buildSelectBodyAfterCteWalk};
     * calling them with {@code allowShadowOverride=false} /
     * {@code additionalAllCteNames=null} reproduces the prior inline walker.
     *
     * @return the index, into the supplied {@code stmts} list, of the
     *         program's final (outer / merged-set-op) statement — i.e. the
     *         statement a consumer should treat as this SELECT's result.
     */
    private static int buildSelectProgramInto(
            TSelectSqlStatement select,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        TCTEList cteList = select.getCteList();
        boolean hasOuterCteList = cteList != null && cteList.size() > 0;
        buildSelectCteList(cteList, provider, stmts, lineage,
                cteNameToStatementIndex, ctePublishedColumns,
                /*allowShadowOverride=*/ false,
                /*additionalAllCteNames=*/ null);
        buildSelectBodyAfterCteWalk(select, provider, stmts, lineage,
                cteNameToStatementIndex, ctePublishedColumns,
                /*hasOuterCteListAlreadyProcessed=*/ hasOuterCteList);
        return stmts.size() - 1;
    }

    /**
     * Slice 108 — walk a SELECT-side WITH clause and append each CTE body
     * to {@code stmts} as a preceding statement. Extracted from the inline
     * walker that previously lived in {@link #build} (lines ~516–663 pre-
     * slice-108). Mirrors the slice-101 {@link #buildMergeCteList},
     * slice-105 {@link #buildUpdateCteList}, and slice-106
     * {@link #buildDeleteCteList} helpers.
     *
     * <p>Phase 0 (behaviour-preserving refactor): {@code allowShadowOverride
     * = false} and {@code additionalAllCteNames = null} reproduce the
     * pre-slice-108 inline walker byte-for-byte.
     *
     * <p>Phase 1 (shadow admit): {@code allowShadowOverride = true} enables
     * the mixed outer+inner WITH on INSERT shadow case (slice 108). When
     * called from {@link #buildInsert}, the OUTER pass runs with
     * {@code allowShadowOverride=false}, populating
     * {@code cteNameToStatementIndex} and {@code ctePublishedColumns} with
     * outer CTE bindings. The INNER pass then runs with
     * {@code allowShadowOverride=true} and
     * {@code additionalAllCteNames=outerAllNames}. The inner pass:
     * <ul>
     *   <li>uses a fresh local {@code localVisibleSoFar} for intra-list
     *       duplicate detection (so {@code DUPLICATE_CTE_NAME} still
     *       fires for inner {@code x, x} even when outer also declares
     *       {@code x});</li>
     *   <li>snapshots {@code cteNameToStatementIndex.keySet()} at entry
     *       into {@code outerKeysSnapshot}; the union
     *       {@code outerKeysSnapshot ∪ localVisibleSoFar} drives BOTH
     *       {@link #rejectForwardCteReferences} AND
     *       {@link NameBindingProvider#withCteContext} (round-2 codex
     *       BLOCKER 3 fix — keeps inner-y references to outer-x from
     *       being falsely flagged as forward references);</li>
     *   <li>on collision with an outer entry (after a successful body
     *       build), {@link Map#put} overrides the
     *       {@code cteNameToStatementIndex} and {@code ctePublishedColumns}
     *       entries so the source SELECT sees the INNER body. The OUTER
     *       body stays in {@code stmts[]} at its earlier position; its
     *       cteMap entry is just no longer referenced by name (PG nested-
     *       WITH inner-shadows-outer semantics).</li>
     * </ul>
     *
     * <p>{@code additionalAllCteNames} is unioned into the per-call
     * {@code allCteNames} that {@link #rejectForwardCteReferences} consults
     * (round-1 codex BLOCKER 2 fix — keeps each scope's forward-ref check
     * narrow so an outer CTE body referencing a base-table whose name
     * happens to coincide with an inner CTE name does NOT falsely flag).
     */
    private static void buildSelectCteList(
            TCTEList cteList,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns,
            boolean allowShadowOverride,
            Set<String> additionalAllCteNames) {
        if (cteList == null || cteList.size() == 0) {
            return;
        }
        rejectRecursiveCtes(cteList);

        // Per-call allCteNames for rejectForwardCteReferences. The optional
        // additionalAllCteNames extends this scope (Phase 1: outer names
        // visible to inner CTE body forward-ref checks). Phase 0 path passes
        // null, so this is just collectCteNames(cteList).
        Set<String> allCteNames;
        if (additionalAllCteNames != null && !additionalAllCteNames.isEmpty()) {
            allCteNames = new HashSet<>(collectCteNames(cteList));
            allCteNames.addAll(additionalAllCteNames);
        } else {
            allCteNames = collectCteNames(cteList);
        }

        // Phase 1: snapshot outer-scope CTE names at entry so subsequent
        // iterations of this list always see the FULL outer scope for
        // forward-ref classification and withCteContext, even if a shadow
        // override later overwrites a name's cteMap entry.
        Set<String> outerKeysSnapshot = allowShadowOverride
                ? new HashSet<>(cteNameToStatementIndex.keySet())
                : null;

        // Build each CTE body left-to-right. Each CTE sees CTEs declared
        // strictly before it (standard SQL chain semantics, slice 4).
        // Slice 18: CTE bodies accept FROM-subqueries (mirroring the
        // outer-SELECT extraction path) AND scalar-subquery projections
        // (slice 11): for each CTE body, FROM-subqueries are extracted
        // first, then scalar bodies, then the CTE body is built/appended.
        // The per-CTE-body subqueryAliasToIndex is local to the iteration
        // so different CTE bodies cannot collide on FROM-subquery aliases.
        // Slice 60: running map of "CTE name → published column names"
        // for star expansion. Each CTE's published columns are added
        // AFTER its body is built so a CTE cannot self-reference and
        // forward references (rejected earlier) cannot leak through.
        // Set-op CTE bodies use the merged StatementGraph.outputColumns.
        // For non-set-op CTE bodies the column names also come from
        // StatementGraph.outputColumns. Explicit CTE column lists are
        // rejected at the star expander, not at populate time.
        Set<String> localVisibleSoFar = new HashSet<>();
        for (int i = 0; i < cteList.size(); i++) {
            TCTE cte = cteList.getCTE(i);
            String cteName = cte.getTableName().toString();
            String cteNameLower = cteName.toLowerCase(Locale.ROOT);
            // Slice 15 MUST 9 / round-4 MUST 1: reject duplicate CTE
            // names BEFORE rejectForwardCteReferences so duplicate-name
            // diagnostics are not preempted by forward-reference
            // diagnostics. cteNameToStatementIndex is keyed lower-case;
            // a duplicate entry would silently overwrite the earlier
            // body and leave OUTER_REFERENCE-of-CTE pointing at the
            // wrong statement.
            //
            // Slice 108: intra-list duplicate check uses localVisibleSoFar
            // (NOT outerKeysSnapshot) so an inner CTE shadowing an outer
            // CTE is admitted while inner-x, inner-x stays rejected (round-1
            // codex BLOCKER 1 fix).
            if (localVisibleSoFar.contains(cteNameLower)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DUPLICATE_CTE_NAME,
                        "duplicate CTE name '" + cteName
                                + "' in WITH clause; CTE names must be unique", cte));
            }
            // Slice 108: effectiveVisible = outerKeysSnapshot ∪ localVisibleSoFar.
            // Drives BOTH rejectForwardCteReferences AND
            // bodyProvider.withCteContext so inner-y body referencing outer-x
            // is admitted (round-2 codex BLOCKER 3 fix).
            Set<String> effectiveVisible;
            if (outerKeysSnapshot != null) {
                if (outerKeysSnapshot.isEmpty()) {
                    effectiveVisible = localVisibleSoFar;
                } else if (localVisibleSoFar.isEmpty()) {
                    effectiveVisible = outerKeysSnapshot;
                } else {
                    effectiveVisible = new HashSet<>(outerKeysSnapshot);
                    effectiveVisible.addAll(localVisibleSoFar);
                }
            } else {
                effectiveVisible = localVisibleSoFar;
            }
            rejectForwardCteReferences(cte, allCteNames, effectiveVisible);
            // Slice 60: bodyProvider gets the CTE-context narrowing
            // first; the effective-alias-keyed in-scope map is
            // applied LATER, after the body's own FROM-subqueries
            // are extracted (so we can walk the body's FROM clause
            // and resolve each relation to its effective alias).
            // This deferred narrowing replaces the slice-60 v1 path
            // that put the running ctePublishedColumns map (CTE-name
            // keyed) directly on the provider — that keying class
            // could collide when a subquery alias matched a CTE
            // name (codex diff-review).
            NameBindingProvider bodyProvider = provider.withCteContext(effectiveVisible);
            TSelectSqlStatement cteBody = cte.getSubquery();
            // Slice 103 — snapshot lineage size BEFORE the body branch so
            // the slice-102 rename helper can rewrite outgoing
            // STATEMENT_OUTPUT refs in [lineageSize0, lineage.size())
            // without touching prior CTE bodies' edges. Covers BOTH the
            // set-op and non-set-op branches (mirrors slice-102
            // buildMergeCteList at line ~5820).
            int lineageSize0 = lineage.size();
            int bodyIdx;
            if (cteBody != null
                    && cteBody.getSetOperatorType() != null
                    && cteBody.getSetOperatorType() != ESetOperatorType.none) {
                // Slice 12: set-op CTE body. The outer set-op statement
                // carries the CTE name so BodyIndexes.cteByConsumerAndName
                // resolves it (slice-18 consumer-keyed projector lookup).
                // The CTE body's CTE list (if any) is rejected as a
                // nested-WITH inside buildSetOpProgram.
                bodyIdx = buildSetOpProgram(cteBody, bodyProvider, stmts, lineage,
                        cteNameToStatementIndex, cteName,
                        /*hasOuterCteListAlreadyProcessed=*/ false);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
            } else {
                // Slice 18: snapshot/rollback around recursive
                // FROM-subquery extraction inside this CTE body.
                // Mirrors the outer-SELECT wrapper below and the
                // slice-16 set-op wrapper. Currently defensive: a
                // thrown exception in a deeper level would otherwise
                // leak siblings/ancestors at this CTE's level into
                // stmts/lineage. The wrapper truncates back to the
                // pre-extraction boundary and rethrows. Per-CTE
                // granularity: earlier CTE bodies in the same WITH
                // list are NOT rolled back (they're already complete).
                int cteStmtsSize0 = stmts.size();
                int cteLineageSize0 = lineage.size();
                Map<String, Integer> cteSubqueryAliasToIndex;
                try {
                    // Slice 60: pass the running ctePublishedColumns
                    // so the body's own FROM-subqueries see earlier
                    // CTEs at every recursion level.
                    cteSubqueryAliasToIndex =
                            extractFromSubqueriesAsStatements(cteBody, bodyProvider,
                                    stmts, lineage, cteNameToStatementIndex,
                                    ctePublishedColumns);
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteStmtsSize0) stmts.remove(stmts.size() - 1);
                    while (lineage.size() > cteLineageSize0) lineage.remove(lineage.size() - 1);
                    throw ex;
                }
                EnclosingScope cteEnclosing = buildEnclosingScope(cteBody,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        /*parent=*/ null);
                Map<Integer, ScalarInfo> cteScalarMap =
                        extractScalarSubqueriesAsStatements(cteBody,
                                bodyProvider, stmts, lineage,
                                cteNameToStatementIndex, cteEnclosing,
                                /*allowRecursiveScalarSubqueryExtraction=*/ true);
                // Slice 60 (codex diff-review): build the per-CTE
                // effective-alias-keyed in-scope map by walking the
                // CTE body's FROM list. CTE references and
                // FROM-subquery aliases live in the same FROM
                // namespace (preflight rejects duplicates), so
                // effective-alias keying makes a name collision
                // physically impossible.
                Map<String, List<String>> cteBodyInScope =
                        buildEffectiveAliasInScopeMap(cteBody, bodyProvider,
                                ctePublishedColumns, cteSubqueryAliasToIndex,
                                stmts);
                NameBindingProvider cteBodyProviderWithStar = bodyProvider
                        .withInScopeRelationColumns(cteBodyInScope);
                // Slice 114 — switch from the 7-arg buildSelectStatement
                // to the 14-arg buildSelectStatementImpl so the CTE
                // body's WHERE clause can extract uncorrelated predicate
                // subqueries (IN-SELECT / EXISTS / NOT EXISTS / scalar
                // comparison / ANY-ALL-SOME) as their own statements.
                // The wrapper mirrors the outer-SELECT entry pattern in
                // {@link #build}: if the build appends predicate bodies
                // and then a later post-extraction reject fires, the
                // try/catch truncates stmts/lineage back to the
                // pre-call boundary so a partial extraction doesn't
                // leak into the program. The slice-113 set-op branch
                // call site is itself enclosed by the slice-16
                // SET-OP-WIDE rollback at {@link #buildSetOpProgram};
                // the CTE-body call sites do NOT inherit a similar
                // enclosing wrapper, which is why slice 114 adds one
                // here. The from-subquery / scalar-subquery
                // extractions above this point have their own
                // slice-17/18 wrappers, so the pre-CALL snapshot
                // bounds the truncate exactly to whatever
                // buildSelectStatementImpl appended.
                int cteBodyStmtsSnapshot = stmts.size();
                int cteBodyLineageSnapshot = lineage.size();
                StatementGraph body;
                try {
                    if (isPivotSelect(cteBody)) {
                        // Slice 139 — a nested PIVOT/UNPIVOT as a CTE body.
                        // The slice-129 pivot router in
                        // buildSelectStatementImpl is gated to the OUTER
                        // SELECT (name == null && !isPredicateBody), so a
                        // pivot built here (name == cteName) would otherwise
                        // fall to the normal path and reject with the
                        // misleading TABLE_BINDING_UNRESOLVED
                        // ("null(piviot_table)"). Route it to buildPivotSelect
                        // with the CTE name as the statement name — mirroring
                        // the slice-138 processDirectSubqueryTable branch for a
                        // FROM-subquery body. The CTE becomes a proper pivot
                        // StatementGraph; the outer query references the CTE
                        // name (CTE-kind) so the standard cross-stmt CTE path
                        // emits STATEMENT_OUTPUT(outer) → STATEMENT_OUTPUT(cte),
                        // and the emitLineageForStatement(body, ...) call below
                        // wires the pivot's own output → source edges
                        // (base-table TABLE_COLUMN, or — when the pivot's source
                        // is itself a subquery, slice 136 — STATEMENT_OUTPUT via
                        // cteSubqueryAliasToIndex). All pivot deferrals are
                        // preserved by buildPivotSelect's own guards
                        // (PIVOT_WITH_QUERY_CLAUSE / MULTIPLE_CLAUSES /
                        // UNPIVOT / STAR_CATALOG_REQUIRED).
                        body = buildPivotSelect(cteBody,
                                cteBodyProviderWithStar, cteName);
                    } else {
                        body = buildSelectStatementImpl(cteBody,
                            cteBodyProviderWithStar, cteName,
                            /*hasOuterCteListAlreadyProcessed=*/ false,
                            /*allowFromSubqueries=*/ true,
                            /*allowScalarProjectionSubqueries=*/ true,
                            /*allowWindowProjection=*/ true,
                            // Slice 114 — keep JOIN-ON predicate
                            // subqueries rejected inside CTE bodies
                            // (preserve slice 23/26 contract; the lift
                            // is WHERE-only; the two flags are
                            // independent per slice 113 split).
                            /*allowJoinOnPredicateSubqueries=*/ false,
                            /*stmtsForExtraction=*/ stmts,
                            /*lineageForExtraction=*/ lineage,
                            /*cteMapForExtraction=*/ cteNameToStatementIndex,
                            /*isPredicateBody=*/ false,
                            /*whereClauseContext=*/ PredicateClauseContext.CTE_BODY_WHERE,
                            /*allowWherePredicateSubqueries=*/ true);
                    }
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteBodyStmtsSnapshot) stmts.remove(stmts.size() - 1);
                    while (lineage.size() > cteBodyLineageSnapshot) lineage.remove(lineage.size() - 1);
                    throw ex;
                }
                bodyIdx = stmts.size();
                stmts.add(body);
                // Slice 108 — emit lineage BEFORE the cteMap.put so that
                // in the shadow case (allowShadowOverride=true with
                // cteNameLower already in cteMap from outer pass), the
                // body's column refs to <cteNameLower> still resolve to
                // the OUTER body (PG inner-x body sees outer-x via the
                // closer-enclosing-not-yet-shadowed fallback). Non-shadow
                // cases are unaffected because cteMap does not yet contain
                // cteNameLower at this point and the body cannot reference
                // its own name without going through the recursive-CTE
                // path (already rejected upstream).
                emitLineageForStatement(body, bodyIdx, lineage,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        cteScalarMap);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
            }
            // Slice 103 — apply the slice-102 rename helper if the CTE
            // declares an explicit column list (no-op otherwise). The
            // helper returns the published column list (renamed if
            // explicit, else body's inner names). Slice-60's
            // `ctePublishedColumns.put` is collapsed into this single
            // call site (covers both branches above).
            List<String> publishedCols = applyExplicitCteColumnListRename(
                    cte, stmts, lineage, bodyIdx, lineageSize0, "SELECT");
            ctePublishedColumns.put(cteNameLower, publishedCols);
            localVisibleSoFar.add(cteNameLower);
        }
    }

    /**
     * Slice 108 — outer-SELECT processing extracted from the previous inline
     * body of {@link #build} (lines ~665–763 pre-slice-108).
     *
     * <p>{@code hasOuterCteListAlreadyProcessed} is an EXPLICIT boolean
     * parameter (round-2 codex BLOCKER 4 fix). Previously this was inferred
     * from {@code select.getCteList() != null && size > 0}; after the
     * slice-108 buildInsert shadow path nulls {@code source.getCteList()}
     * before calling, that inference would be wrong. The caller passes the
     * truth.
     *
     * <p>The post-walk {@code cteNameToStatementIndex.keySet()} replaces the
     * pre-walk {@code allCteNames} because the walker has populated every
     * declared CTE name by lowercase key — they are equal sets.
     */
    private static void buildSelectBodyAfterCteWalk(
            TSelectSqlStatement select,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns,
            boolean hasOuterCteListAlreadyProcessed) {
        Set<String> allCteNames = cteNameToStatementIndex.isEmpty()
                ? Collections.<String>emptySet()
                : new HashSet<>(cteNameToStatementIndex.keySet());

        // Slice 12: top-level set-op dispatch. CTE list (if any) was
        // already processed above; pass hasOuterCteListAlreadyProcessed=true
        // so buildSetOpProgram doesn't re-flag it as a nested WITH.
        if (select.getSetOperatorType() != null
                && select.getSetOperatorType() != ESetOperatorType.none) {
            NameBindingProvider outerProvider = provider.withCteContext(allCteNames);
            buildSetOpProgram(select, outerProvider, stmts, lineage,
                    cteNameToStatementIndex, /*setOpName=*/ null,
                    /*hasOuterCteListAlreadyProcessed=*/ hasOuterCteListAlreadyProcessed);
            return;
        }

        // Outer statement: pre-extract any FROM-clause subqueries as their
        // own statements, then any scalar-subquery projections, then build
        // the outer body, then emit lineage with the global CTE map, the
        // outer-local subquery alias map, AND the scalar-projection map.
        // Slice 60: outerProvider gets the CTE-context narrowing here;
        // the effective-alias-keyed in-scope map is applied LATER, after
        // outer FROM-subqueries are extracted. The same deferred
        // narrowing pattern as the CTE-body branch — see the codex
        // diff-review note on alias/CTE-name collision.
        NameBindingProvider outerProvider = provider.withCteContext(allCteNames);
        // Slice 17: snapshot/rollback around recursive FROM-subquery
        // extraction. The recursive extractor mutates stmts/lineage as
        // each level's bodies land; if a deeper-level rejection fires
        // after sibling/ancestor mutations, this wrapper truncates the
        // lists back to the pre-call boundary and rethrows. Mirrors the
        // slice-16 buildSetOpProgram wrapper (§14.18 process lesson #21:
        // when a class of mutation-free checks can fire after partial
        // mutation, close it transactionally instead of point-fixing).
        //
        // The rollback is currently defensive: build() allocates fresh
        // stmts/lineage per invocation, so a thrown exception's caller
        // cannot directly observe leaked state. The wrapper is kept
        // because (a) the slice-17 preflight closes the most direct
        // partial-mutation classes BEFORE the recursive extraction
        // runs, but recursive levels can still fail at deeper rejection
        // points (e.g. a nested set-op-in-FROM-subquery body inside a
        // sibling that succeeds at the preflight); (b) consistency with
        // slice 16's pattern means a future refactor that lifts the
        // build() per-call list allocation does not silently re-open
        // the partial-mutation class.
        int stmtsSize0 = stmts.size();
        int lineageSize0 = lineage.size();
        Map<String, Integer> outerSubqueryAliasToIndex;
        try {
            outerSubqueryAliasToIndex =
                    extractFromSubqueriesAsStatements(select, outerProvider,
                            stmts, lineage, cteNameToStatementIndex,
                            ctePublishedColumns);
        } catch (RuntimeException ex) {
            while (stmts.size() > stmtsSize0) stmts.remove(stmts.size() - 1);
            while (lineage.size() > lineageSize0) lineage.remove(lineage.size() - 1);
            throw ex;
        }
        EnclosingScope outerEnclosing = buildEnclosingScope(select,
                cteNameToStatementIndex, outerSubqueryAliasToIndex,
                /*parent=*/ null);
        Map<Integer, ScalarInfo> outerScalarMap =
                extractScalarSubqueriesAsStatements(select, outerProvider,
                        stmts, lineage, cteNameToStatementIndex, outerEnclosing,
                        /*allowRecursiveScalarSubqueryExtraction=*/ true);
        // Slice 60 (codex diff-review): build the outer's
        // effective-alias-keyed in-scope map by walking the outer
        // SELECT's FROM list. Effective-alias keying eliminates the
        // CTE-name vs subquery-alias collision class.
        Map<String, List<String>> outerInScope = buildEffectiveAliasInScopeMap(
                select, outerProvider, ctePublishedColumns,
                outerSubqueryAliasToIndex, stmts);
        NameBindingProvider outerProviderWithStar = outerProvider
                .withInScopeRelationColumns(outerInScope);
        // Slice 23: outer-SELECT path uses buildSelectStatementImpl directly so
        // the slice-23 EXISTS-extraction can append predicate-body statements
        // to `stmts`/`lineage`. Snapshot/rollback wrapper around the call
        // matches the slice-16/17/20 pattern: a partial extraction (e.g. third
        // EXISTS rejected after first two extracted) truncates the lists.
        int outerStmtsSnapshot = stmts.size();
        int outerLineageSnapshot = lineage.size();
        StatementGraph outer;
        try {
            outer = buildSelectStatementImpl(select, outerProviderWithStar, null,
                    /*hasOuterCteListAlreadyProcessed=*/ hasOuterCteListAlreadyProcessed,
                    /*allowFromSubqueries=*/ true,
                    /*allowScalarProjectionSubqueries=*/ true,
                    /*allowWindowProjection=*/ true,
                    /*allowJoinOnPredicateSubqueries=*/ true,
                    stmts, lineage,
                    /*cteMapForExtraction=*/ cteNameToStatementIndex,
                    /*isPredicateBody=*/ false,
                    /*whereClauseContext=*/ PredicateClauseContext.SELECT_WHERE,
                    /*allowWherePredicateSubqueries=*/ true);
        } catch (RuntimeException e) {
            while (stmts.size() > outerStmtsSnapshot) stmts.remove(stmts.size() - 1);
            while (lineage.size() > outerLineageSnapshot) lineage.remove(lineage.size() - 1);
            throw e;
        }
        int outerIndex = stmts.size();
        stmts.add(outer);
        emitLineageForStatement(outer, outerIndex, lineage,
                cteNameToStatementIndex, outerSubqueryAliasToIndex, outerScalarMap);
    }

    /**
     * Slice 78 — admit a single {@code INSERT INTO target SELECT ...}
     * statement. Builds the source SELECT via {@link #build} (reusing
     * the existing pipeline unchanged), then appends an {@code "INSERT"}-
     * kind {@link StatementGraph} carrying the target relation and
     * cross-statement lineage edges.
     *
     * <p>Admitted shape: {@code INSERT INTO <target> [(c1, c2, ...)]
     * <subquery-SELECT>}. Rejections:
     * <ul>
     *   <li>{@link EInsertSource#values}, {@code values_empty},
     *       {@code default_values}, {@code execute},
     *       {@code values_function}, {@code values_multi_table},
     *       {@code hive_query}, {@code values_oracle_record},
     *       {@code set_column_value}, {@code value_table} →
     *       {@link DiagnosticCode#INSERT_SOURCE_NOT_SUPPORTED}.</li>
     *   <li>Oracle {@code INSERT ALL} / {@code INSERT FIRST} →
     *       {@link DiagnosticCode#INSERT_MULTI_TABLE_NOT_SUPPORTED}.
     *       Hive multi-insert ({@code multiInsertStatements} non-empty) is
     *       routed to {@link #buildHiveMultiInsert} instead of rejected.</li>
     *   <li>Missing target table (defensive — the parser usually rejects
     *       first) → {@link DiagnosticCode#INSERT_TARGET_MISSING}.</li>
     *   <li>Explicit column list arity ≠ source SELECT output count →
     *       {@link DiagnosticCode#INSERT_COLUMN_COUNT_MISMATCH}.</li>
     * </ul>
     *
     * <p>The source SELECT is built first via {@code build()} and its
     * full {@link SemanticProgram} (CTE bodies + scalar bodies +
     * FROM-subquery bodies + outer SELECT + cross-stmt lineage) is
     * appended verbatim to the returned program. The INSERT
     * {@link StatementGraph} is appended LAST; its
     * {@link StatementGraph#getRelations() relations} lists the source
     * SELECT as a single {@link RelationKind#SUBQUERY} entry whose
     * {@code qualifiedName} is the source SELECT's outer-statement name
     * (synthesised when needed). All other column-ref lists stay empty
     * on the INSERT — an INSERT has no projection of its own.
     *
     * <p>Cross-statement {@link LineageEdge}s for the INSERT are
     * {@code from = TABLE_COLUMN(target_qname, target_col_i_name)}
     * and {@code to = STATEMENT_OUTPUT(selectIdx, source_output_i_name)}.
     * Target column names are the explicit INSERT column-list spellings
     * when supplied, else the source SELECT's positional output names.
     */
    /**
     * Build under caller-supplied {@code options}; see
     * {@link #build(TSelectSqlStatement, NameBindingProvider, SemanticIRBuildOptions)}.
     */
    public static SemanticBuildResult buildInsertResult(
            TInsertSqlStatement insert, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildInsertImpl(insert, provider));
    }

    /** Build an INSERT and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildInsertResult(
            TInsertSqlStatement insert, NameBindingProvider provider) {
        return buildInsertResult(insert, provider,
                SemanticIRBuildOptions.defaults());
    }

    @Deprecated
    public static SemanticProgram buildInsert(TInsertSqlStatement insert,
                                     NameBindingProvider provider,
                                     SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildInsertResult(insert, provider, options));
    }

    @Deprecated
    public static SemanticProgram buildInsert(TInsertSqlStatement insert,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildInsertResult(insert, provider));
    }

    private static SemanticProgram buildInsertImpl(TInsertSqlStatement insert,
                                                   NameBindingProvider provider) {
        if (insert == null) {
            throw new IllegalArgumentException("insert must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }

        // Oracle INSERT ALL / FIRST rejects: their multi-value AST shape
        // is fundamentally different from the Hive multi-insert path.
        // Slice 78 scopes single-target INSERT SELECT; slice 93 lifts
        // the Hive multi-insert case via buildHiveMultiInsert.
        if (insert.isInsertAll() || insert.isInsertFirst()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_MULTI_TABLE_NOT_SUPPORTED,
                    "multi-table INSERT (INSERT ALL / INSERT FIRST) is not "
                            + "supported by SemanticIRBuilder.buildInsert; "
                            + "slice 78 admits single-target INSERT INTO <target> SELECT ...",
                    insert));
        }
        // Slice 109 — outer-WITH on Hive multi-insert
        // (`WITH x AS (...) FROM x INSERT INTO t1 SELECT ... INSERT INTO t2
        // SELECT ...`) is now admitted via buildHiveMultiInsert's CTE-aware
        // path. The slice-104 early reject for this shape is removed; the
        // helper builds the outer CTE bodies ONCE upfront and reuses the
        // shared cteMap/publishedMap across every sub-SELECT.
        // INSERT_OUTER_WITH_ON_HIVE_MULTI_INSERT_NOT_SUPPORTED stays declared-
        // but-unreached for API stability (slice 71/72/82/86/95/96/97/98/108
        // retain-for-documentation precedent).
        //
        // Hive multi-insert: FROM src INSERT INTO t1 SELECT ... INSERT INTO t2 SELECT ...
        // Each sub-SELECT already carries the shared FROM source in its fromClause.
        if (!insert.getMultiInsertStatements().isEmpty()) {
            return buildHiveMultiInsert(insert, provider);
        }

        EInsertSource src = insert.getInsertSource();
        if (src != EInsertSource.subquery) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_SOURCE_NOT_SUPPORTED,
                    "INSERT source '" + src + "' is not supported by "
                            + "SemanticIRBuilder.buildInsert; slice 78 admits "
                            + "subquery-source INSERT only (INSERT INTO <target> SELECT ...)",
                    insert));
        }

        // Slice 85 — cheap statement-level OUTPUT_INTO reject runs
        // BEFORE the source SELECT is built so a multi-violation
        // shape (e.g. `INSERT INTO t OUTPUT INSERTED.x INTO #log
        // SELECT ... FROM bad_join`) routes to the cheaper structural
        // code first.
        if (insert.getOutputClause() != null
                && insert.getOutputClause().getIntoTable() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.OUTPUT_INTO_NOT_SUPPORTED,
                    "INSERT OUTPUT ... INTO <target> writes a second target; "
                            + "slice 85 admits projection-only OUTPUT",
                    insert));
        }

        TTable targetTable = insert.getTargetTable();
        if (targetTable == null || targetTable.getTableName() == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_TARGET_MISSING,
                    "INSERT statement has no resolvable target table",
                    insert));
        }
        String targetQName = targetTable.getTableName().toString();
        if (targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_TARGET_MISSING,
                    "INSERT target table name is empty",
                    insert));
        }

        TSelectSqlStatement source = insert.getSubQuery();
        if (source == null) {
            // Defensive: getInsertSource() == subquery but subQuery is
            // null. Surface as INSERT_TARGET_MISSING's source half.
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_SOURCE_NOT_SUPPORTED,
                    "INSERT source is declared as subquery but no SELECT "
                            + "statement was attached",
                    insert));
        }

        // Slice 104 — outer-WITH on INSERT. The parser attaches the outer
        // WITH clause to insert.getCteList(), NOT to source.getCteList().
        // Before slice 104 buildInsert ignored insert.getCteList(), which
        // silently mis-bound CTE references in the source SELECT as
        // TABLE-kind relations with phantom columns. The slice-104 fix is
        // an AST handoff: move insert.getCteList() onto source.getCteList()
        // for the duration of the inner build(source) call so the
        // slice-103 SELECT-side CTE walker handles construction, rename,
        // and rejects (recursive / duplicate / forward-reference / arity
        // mismatch). Restore in finally so the AST is observably
        // unchanged to the caller (Java field references — token-chain
        // state is perturbed by setCteList(null)'s removeTokens() but
        // observably benign for downstream Semantic IR).
        //
        // Slice 107 / 108 — mixed outer-WITH + inner-WITH on INSERT. PG /
        // Oracle / Snowflake admit at parse. Three sub-cases:
        //   (a) Only outer WITH populated. AST handoff (slice 104): move
        //       insert.cteList onto source.cteList and call build(source).
        //   (b) Only inner WITH populated. Pass through unchanged (the
        //       walker handles it on its own).
        //   (c) Both outer and inner WITH populated. Slice 107 admitted
        //       this for disjoint names via a flat-merge; slice 108 admits
        //       it for the SHADOWING case too (`WITH x ... INSERT ... WITH
        //       x ... SELECT ... FROM x` — inner shadows outer per
        //       PG/Oracle/Snowflake nested-WITH semantics). The slice-108
        //       implementation uses a TWO-PASS walker invocation in this
        //       method: outer pass first (allowShadowOverride=false), then
        //       inner pass (allowShadowOverride=true,
        //       additionalAllCteNames=outer-names). The walker's two-set
        //       visibility model (outerKeysSnapshot ∪ localVisibleSoFar)
        //       keeps PG semantics correct: inner-x's body sees outer-x via
        //       the cteMap (override is post-build), and inner CTEs declared
        //       after inner-x see inner-x. The OUTER body stays in stmts[]
        //       at its position; its cteMap entry is just no longer
        //       referenced by name (shadowed). Source SELECT's `FROM x`
        //       resolves to inner-x.
        //
        // INSERT_MIXED_OUTER_AND_INNER_WITH_NOT_SUPPORTED stays declared but
        // is no longer reached by slice 108. Slice107Test §F/§Q (cross-
        // boundary duplicate rejects) are deleted; positive coverage moves
        // to Slice108Test.
        TCTEList outerCtes = insert.getCteList();
        TCTEList savedSourceCtes = source.getCteList();
        boolean handoffApplied = false;
        SemanticProgram inner;
        boolean haveOuterCtes = outerCtes != null && outerCtes.size() > 0;
        boolean haveInnerCtes = savedSourceCtes != null && savedSourceCtes.size() > 0;
        if (haveOuterCtes && haveInnerCtes) {
            // Slice 108 — two-pass walker. Null both AST CTE lists before
            // calling buildSelectBodyAfterCteWalk so the helper does not
            // re-process source.getCteList(). hasOuterCteListAlreadyProcessed
            // is passed true (round-2 codex BLOCKER 4 fix).
            source.setCteList(null);
            insert.setCteList(null);
            handoffApplied = true;
            try {
                List<StatementGraph> innerStmts = new ArrayList<>();
                List<LineageEdge> innerLineage = new ArrayList<>();
                Map<String, Integer> cteMap = new HashMap<>();
                Map<String, List<String>> publishedMap = new HashMap<>();
                // Outer pass: outerAllNames as its own scope.
                buildSelectCteList(outerCtes, provider, innerStmts, innerLineage,
                        cteMap, publishedMap,
                        /*allowShadowOverride=*/ false,
                        /*additionalAllCteNames=*/ null);
                // Inner pass: outerAllNames also visible for forward-ref
                // classification (round-1 codex BLOCKER 2 fix); shadow
                // override admits cross-boundary duplicate names.
                Set<String> outerAllNames = collectCteNames(outerCtes);
                buildSelectCteList(savedSourceCtes, provider, innerStmts, innerLineage,
                        cteMap, publishedMap,
                        /*allowShadowOverride=*/ true,
                        /*additionalAllCteNames=*/ outerAllNames);
                // Source SELECT body sees the post-pass cteMap (inner wins
                // for shadowed names).
                buildSelectBodyAfterCteWalk(source, provider, innerStmts, innerLineage,
                        cteMap, publishedMap,
                        /*hasOuterCteListAlreadyProcessed=*/ true);
                inner = new SemanticProgram(innerStmts, innerLineage);
            } finally {
                source.setCteList(savedSourceCtes);
                insert.setCteList(outerCtes);
            }
        } else {
            // Single-sided cases. Slice 104 AST handoff for outer-only;
            // pass-through for inner-only or no CTEs.
            if (haveOuterCtes) {
                source.setCteList(outerCtes);
                insert.setCteList(null);
                handoffApplied = true;
            }
            try {
                // buildImpl, NOT the public two-argument build: this is an
                // INTERNAL recursion into the DML's own source SELECT and must
                // inherit the ambient options, or the three-argument
                // buildInsert/buildCreateTable/buildCreateView degrade
                // overloads would silently still throw. The public two-argument
                // overload deliberately pins defaults and is for EXTERNAL
                // callers only.
                inner = buildImpl(source, provider);
            } finally {
                if (handoffApplied) {
                    source.setCteList(savedSourceCtes);
                    insert.setCteList(outerCtes);
                }
            }
        }

        // Slice 93 — delegate INSERT-graph assembly to the shared helper
        // used by both single-target (slice 78) and Hive multi-insert
        // (slice 93). out is freshly empty so the helper's rebase offset
        // is 0 (no-op for inner lineage). RETURNING/OUTPUT clauses are
        // passed directly (slice 85 still owns the projection build).
        List<StatementGraph> out = new ArrayList<>(inner.getStatements().size() + 1);
        List<LineageEdge> outLineage = new ArrayList<>();
        assembleInsertGraphAndLineage(
                insert, targetTable, targetQName, inner,
                "INSERT",
                insert.getReturningClause(),
                insert.getOutputClause(),
                out, outLineage, provider);
        return new SemanticProgram(out, outLineage);
    }

    /**
     * Slice 93 — admit a Hive multi-insert block of the form
     * {@code FROM src INSERT INTO t1 SELECT col1 INSERT INTO t2 SELECT col2}.
     *
     * <p>The parser represents the whole block as one {@link TInsertSqlStatement}
     * whose first INSERT-SELECT pair is the primary statement and whose
     * additional pairs are in {@link TInsertSqlStatement#getMultiInsertStatements()}.
     * Crucially, each sub-SELECT already carries the shared FROM source in its own
     * {@code fromClause} / {@code fromSourceTable} — no post-processing is needed.
     *
     * <p>Produces a flat {@link SemanticProgram} containing per-pair blocks of
     * statements concatenated in INSERT order: each block contributes its source
     * SELECT's inner statements (CTE bodies / FROM-subquery bodies extracted by
     * {@link #build}) followed by its outer SELECT followed by an INSERT graph.
     * The minimum is {@code 2N} statements (one SELECT + one INSERT per target);
     * sub-SELECTs with extracted inner programs produce more. Each INSERT carries
     * cross-statement lineage edges pointing at its preceding SELECT via
     * {@link LineageRef#statementOutput}; per-pair inner lineage edges are
     * rebased by the current {@code out.size()} so absolute statement indices
     * remain valid across the concatenated program.
     *
     * <p>Safety note on the source-table fallback: this method enables
     * {@code provider.withSourceTableFallback(true)} so secondary sub-SELECTs
     * (which Resolver2 does not traverse) can still bind their column refs.
     * The fallback is constrained at the provider level to fire only when
     * Phase 2 did not run AND any explicit qualifier matches Phase 1's source —
     * see {@link Resolver2NameBindingProvider#bindColumn}. Current Hive
     * multi-insert parses always present a single FROM source, so Phase 1's
     * unqualified-column resolution is unambiguous in practice.
     */
    private static SemanticProgram buildHiveMultiInsert(TInsertSqlStatement insert,
                                                        NameBindingProvider provider) {
        // Slice 93 — source-table fallback strategy for Hive multi-insert.
        //
        // TSQLResolver2 does NOT process the secondary inserts in
        // getMultiInsertStatements(): their column refs have
        // resolution == null (Phase 2 did not run) even though Phase 1's
        // linkColumnToTable sets sourceTable. To let collectColumnRefs
        // accept these bindings, we enable a narrow source-table fallback
        // in the provider — but ONLY when every sub-SELECT has a SINGLE
        // FROM source (the common Hive multi-insert shape that current
        // parser support admits). In single-source contexts, Phase 1's
        // unqualified-column resolution is unambiguous; the fallback is
        // safe (round-2 codex Q1 BLOCKING).
        //
        // If any sub-SELECT has multiple FROM sources, Phase 1 may have
        // heuristically picked one source for an unqualified column —
        // promoting that to EXACT_MATCH could silently mis-bind. In that
        // case the fallback stays disabled; users must qualify column
        // references in the secondary branch (the qualifier-matches-source
        // safety in bindColumn still allows qualified refs through).
        boolean singleSource = isSingleSourceMultiInsert(insert);
        NameBindingProvider effectiveProvider = singleSource
                ? provider.withSourceTableFallback(true)
                : provider;

        List<StatementGraph> out = new ArrayList<>();
        List<LineageEdge> outLineage = new ArrayList<>();

        // Slice 109 — outer WITH on multi-insert: build the CTE bodies ONCE
        // upfront so each sub-SELECT's `FROM x` resolves against the shared
        // cteMap/publishedMap. The parser attaches the outer WITH to the
        // primary insert's getCteList(); sub-INSERTs in
        // getMultiInsertStatements() carry null cteLists. The AST handoff
        // mirrors the slice-104 single-target pattern but only nulls
        // insert.getCteList() — there is no source SELECT to move it onto
        // because each sub-INSERT has its own.
        TCTEList outerCtes = insert.getCteList();
        Map<String, Integer> cteMap = new HashMap<>();
        Map<String, List<String>> publishedMap = new HashMap<>();
        boolean handoffApplied = false;
        if (outerCtes != null && outerCtes.size() > 0) {
            insert.setCteList(null);
            handoffApplied = true;
            try {
                buildSelectCteList(outerCtes, effectiveProvider, out, outLineage,
                        cteMap, publishedMap,
                        /*allowShadowOverride=*/ false,
                        /*additionalAllCteNames=*/ null);
            } catch (RuntimeException ex) {
                // Restore eagerly on CTE-build failure so a downstream caller
                // observing the AST sees the original cteList.
                insert.setCteList(outerCtes);
                throw ex;
            }
        }

        try {
            // Primary INSERT (first target)
            appendOneHiveInsert(insert, effectiveProvider, out, outLineage,
                    cteMap, publishedMap);

            // Additional INSERTs from getMultiInsertStatements()
            for (Object miObj : insert.getMultiInsertStatements()) {
                appendOneHiveInsert((TInsertSqlStatement) miObj, effectiveProvider,
                        out, outLineage, cteMap, publishedMap);
            }
        } finally {
            if (handoffApplied) {
                insert.setCteList(outerCtes);
            }
        }

        return new SemanticProgram(out, outLineage);
    }

    /**
     * Slice 93 — true when every INSERT-SELECT pair in a Hive multi-insert
     * block has a single FROM source (i.e., one entry in
     * {@code subQuery.getTables()}). Guards the source-table fallback so
     * Phase 1's heuristic source assignment is only trusted in contexts
     * where it is provably unambiguous (round-2 codex Q1 BLOCKING).
     */
    private static boolean isSingleSourceMultiInsert(TInsertSqlStatement insert) {
        if (!isSingleSourceSubQuery(insert.getSubQuery())) {
            return false;
        }
        for (Object miObj : insert.getMultiInsertStatements()) {
            TInsertSqlStatement mi = (TInsertSqlStatement) miObj;
            if (!isSingleSourceSubQuery(mi.getSubQuery())) {
                return false;
            }
        }
        return true;
    }

    private static boolean isSingleSourceSubQuery(TSelectSqlStatement sel) {
        return sel != null && sel.getTables() != null && sel.getTables().size() == 1;
    }

    /**
     * Build one INSERT-SELECT pair into {@code out} / {@code outLineage}.
     * Called by {@link #buildHiveMultiInsert} for the primary and each
     * additional INSERT in a Hive multi-insert block. Each call validates
     * the target/source, builds the source SELECT via {@link #build}, and
     * delegates the post-build INSERT-graph assembly to
     * {@link #assembleInsertGraphAndLineage} so the layout exactly mirrors
     * the single-target slice-78 INSERT path (the helper also handles
     * inner-lineage rebasing when {@code out} is non-empty).
     */
    private static void appendOneHiveInsert(TInsertSqlStatement insert,
                                            NameBindingProvider provider,
                                            List<StatementGraph> out,
                                            List<LineageEdge> outLineage,
                                            Map<String, Integer> cteMap,
                                            Map<String, List<String>> publishedMap) {
        TTable targetTable = insert.getTargetTable();
        if (targetTable == null || targetTable.getTableName() == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_TARGET_MISSING,
                    "Hive multi-insert: INSERT has no resolvable target table",
                    insert));
        }
        String targetQName = targetTable.getTableName().toString();
        if (targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_TARGET_MISSING,
                    "Hive multi-insert: INSERT target table name is empty",
                    insert));
        }
        TSelectSqlStatement source = insert.getSubQuery();
        if (source == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_SOURCE_NOT_SUPPORTED,
                    "Hive multi-insert: INSERT has no source SELECT",
                    insert));
        }

        // Slice 109 — when outer CTEs are present (cteMap non-empty), build
        // the source SELECT via buildSelectBodyAfterCteWalk directly into
        // out/outLineage so it sees the shared cteMap/publishedMap. The
        // slice-93 path (no outer CTEs) keeps the build(source, provider) +
        // assembleInsertGraphAndLineage flow unchanged.
        if (cteMap.isEmpty()) {
            // Internal recursion — inherit ambient options (see buildInsertImpl).
            SemanticProgram inner = buildImpl(source, provider);
            // Hive has no RETURNING/OUTPUT — pass null clauses directly.
            assembleInsertGraphAndLineage(
                    insert, targetTable, targetQName, inner,
                    "Hive multi-insert: INSERT",
                    /*returningClause=*/ null,
                    /*outputClause=*/ null,
                    out, outLineage, provider);
            return;
        }

        // Slice 109 — defensive: parser probe shows sub-SELECTs in Hive
        // multi-insert do NOT carry their own cteList. If a future parser
        // change ever attached one, mixed outer+inner WITH semantics would
        // need slice-107/108-style two-pass walker support; until then the
        // shape rejects with the existing mixed-WITH code.
        if (source.getCteList() != null && source.getCteList().size() > 0) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_MIXED_OUTER_AND_INNER_WITH_NOT_SUPPORTED,
                    "Hive multi-insert: mixed outer + inner WITH on a "
                            + "sub-SELECT is not supported by "
                            + "SemanticIRBuilder.buildHiveMultiInsert; "
                            + "slice 109 admits outer-only WITH on multi-insert",
                    insert));
        }

        // Snapshot out.size() so the source SELECT and its inner extractions
        // are pinned to known positions. The slice-23 EXISTS-extraction and
        // FROM-subquery extraction paths inside buildSelectBodyAfterCteWalk
        // append directly to out/outLineage; the source SELECT lands LAST.
        int beforeSelectIdx = out.size();
        buildSelectBodyAfterCteWalk(source, provider, out, outLineage,
                cteMap, publishedMap,
                /*hasOuterCteListAlreadyProcessed=*/ true);
        if (out.size() <= beforeSelectIdx) {
            // Defensive: buildSelectBodyAfterCteWalk always appends at least
            // the source SELECT; this branch is unreachable in practice.
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_SOURCE_NOT_SUPPORTED,
                    "Hive multi-insert: INSERT source built no statements",
                    insert));
        }
        int selectIdx = out.size() - 1;
        assembleInsertTargetGraphFromAppended(
                insert, targetTable, targetQName, selectIdx,
                "Hive multi-insert: INSERT",
                /*returningClause=*/ null,
                /*outputClause=*/ null,
                out, outLineage, provider);
    }

    /**
     * Slice 93 — shared INSERT-graph assembly used by both the slice-78
     * single-target {@link #buildInsert} and the slice-93 Hive multi-insert
     * {@link #appendOneHiveInsert}. Appends {@code inner.getStatements()}
     * to {@code out} (rebasing {@code inner.getLineage()}'s STATEMENT_OUTPUT
     * indices when {@code out} is non-empty), then appends an INSERT-kind
     * {@link StatementGraph} and per-source-output cross-statement
     * {@link LineageEdge}s.
     *
     * <p>Discriminators between the two callers:
     * <ul>
     *   <li>{@code diagnosticPrefix} is woven into column-count-mismatch
     *       and empty-inner-source error messages so the originating call
     *       site is identifiable.</li>
     *   <li>{@code returningClause} / {@code outputClause} are passed
     *       directly to {@link #buildReturningColumns} (slice 78 supplies
     *       the INSERT's RETURNING/OUTPUT clauses; slice 93's Hive path
     *       passes {@code null}/{@code null} since Hive has no
     *       RETURNING/OUTPUT). Passing the clauses directly keeps the
     *       discriminator visible at every call site rather than hidden
     *       behind a boolean (round-2 codex Q3 suggestion).</li>
     * </ul>
     *
     * <p>Mutates both {@code out} and {@code outLineage}.
     */
    private static void assembleInsertGraphAndLineage(
            TInsertSqlStatement insert,
            TTable targetTable,
            String targetQName,
            SemanticProgram inner,
            String diagnosticPrefix,
            TReturningClause returningClause,
            TOutputClause outputClause,
            List<StatementGraph> out,
            List<LineageEdge> outLineage,
            NameBindingProvider provider) {
        List<StatementGraph> innerStmts = inner.getStatements();
        if (innerStmts.isEmpty()) {
            // Defensive: build() always returns at least one statement when
            // it doesn't throw. This branch is unreachable in practice but
            // surfaces a structured diagnostic instead of an
            // IndexOutOfBoundsException on the sourceOuter access below.
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.INSERT_SOURCE_NOT_SUPPORTED,
                    diagnosticPrefix + " source built no statements",
                    insert));
        }

        // Rebase inner lineage edges by the current out.size() offset
        // (round-2 codex Q4 BLOCKING). For the slice-78 single-target
        // path out is empty (offset=0) so rebase is a no-op; for the
        // slice-93 Hive path each subsequent INSERT-SELECT pair adds
        // an offset matching the absolute position of its inner block.
        int offset = out.size();
        int selectIdx = offset + innerStmts.size() - 1;
        out.addAll(innerStmts);
        for (LineageEdge e : inner.getLineage()) {
            outLineage.add(rebaseLineageEdge(e, offset));
        }

        StatementGraph sourceOuter = innerStmts.get(innerStmts.size() - 1);
        List<OutputColumn> sourceOutputs = sourceOuter.getOutputColumns();
        int sourceOutCount = sourceOutputs.size();

        // Optional explicit INSERT column list. Verbatim bare-name
        // spelling per slice-78 contract; arity mismatch rejects.
        TObjectNameList colList = insert.getColumnList();
        List<String> targetColumnNames = new ArrayList<>();
        if (colList != null && colList.size() > 0) {
            for (int i = 0; i < colList.size(); i++) {
                TObjectName n = colList.getObjectName(i);
                targetColumnNames.add(n == null ? "" : n.toString());
            }
            if (targetColumnNames.size() != sourceOutCount) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.INSERT_COLUMN_COUNT_MISMATCH,
                        diagnosticPrefix + " column list has "
                                + targetColumnNames.size()
                                + " column(s) but source SELECT produced "
                                + sourceOutCount + " output(s)",
                        insert));
            }
        }

        // INSERT StatementGraph — slice-78 single-target shape with the
        // source SELECT as a SUBQUERY-kind relation entry.
        String sourceName = sourceOuter.getName();
        String sourceRelAlias = (sourceName != null && !sourceName.isEmpty())
                ? sourceName : "__insert_source__";
        RelationBinding sourceBinding = new RelationBinding(
                RelationKind.SUBQUERY, sourceRelAlias);
        List<RelationSource> insertRelations = new ArrayList<>();
        insertRelations.add(new RelationSource(sourceRelAlias, sourceBinding));

        RelationBinding targetBinding = new RelationBinding(
                RelationKind.TABLE, targetQName);
        TargetRelation target = new TargetRelation(targetBinding, targetColumnNames);

        int insertIdx = out.size();
        String insertTargetAlias = effectiveAliasOf(targetTable);
        if (insertTargetAlias == null || insertTargetAlias.isEmpty()) {
            insertTargetAlias = targetQName;
        }
        // Slice 85: RETURNING/OUTPUT projections. Clauses are passed
        // through directly from the call site (slice-78 single-target
        // forwards the INSERT's own clauses; slice-93 Hive multi-insert
        // forwards null/null since Hive has no RETURNING/OUTPUT).
        List<OutputColumn> returningCols = buildReturningColumns(
                returningClause,
                outputClause,
                "INSERT",
                targetQName,
                insertTargetAlias,
                targetTable,
                /*fromSideRelations=*/ Collections.<RelationSource>emptyList(),
                /*fromSideAliasToStmtIndex=*/ Collections.<String, Integer>emptyMap(),
                provider,
                insertIdx,
                outLineage,
                insert);

        StatementGraph insertOuter = new StatementGraph(
                /*name=*/ null,
                "INSERT",
                insertRelations,
                /*outputColumns=*/ Collections.<OutputColumn>emptyList(),
                returningCols,
                /*filterColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*joinColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*groupByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinctOnColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ null,
                /*rowLimit=*/ null,
                target);
        out.add(insertOuter);

        // Cross-statement lineage: target.col_i ← STATEMENT_OUTPUT(selectIdx, srcName_i)
        for (int i = 0; i < sourceOutCount; i++) {
            String srcName = sourceOutputs.get(i).getName();
            String tgtName = (i < targetColumnNames.size())
                    ? targetColumnNames.get(i) : srcName;
            if (tgtName == null || tgtName.isEmpty()) {
                continue;
            }
            outLineage.add(new LineageEdge(
                    LineageRef.tableColumn(targetQName, tgtName),
                    LineageRef.statementOutput(selectIdx, srcName)));
        }
    }

    /**
     * Slice 109 — assemble the INSERT-target half (TargetRelation, INSERT
     * StatementGraph, RETURNING/OUTPUT projections, and cross-statement
     * lineage edges) when the source SELECT and its inner extractions have
     * ALREADY been appended directly to {@code out}/{@code outLineage} by
     * {@link #buildSelectBodyAfterCteWalk}. The slice-93
     * {@link #assembleInsertGraphAndLineage} helper, by contrast, takes a
     * pre-built {@link SemanticProgram} and rebases STATEMENT_OUTPUT
     * indices on the way in — that path is unused here because the source
     * SELECT was already built into absolute positions in {@code out}.
     *
     * <p>{@code selectIdx} must be the position of the source SELECT in
     * {@code out} (last statement appended by the caller before this helper
     * runs). RETURNING/OUTPUT clauses are passed directly (Hive multi-
     * insert callers pass {@code null}/{@code null}); other DMLs that
     * adopt this helper later can forward their own.
     */
    private static void assembleInsertTargetGraphFromAppended(
            TInsertSqlStatement insert,
            TTable targetTable,
            String targetQName,
            int selectIdx,
            String diagnosticPrefix,
            TReturningClause returningClause,
            TOutputClause outputClause,
            List<StatementGraph> out,
            List<LineageEdge> outLineage,
            NameBindingProvider provider) {
        StatementGraph sourceOuter = out.get(selectIdx);
        List<OutputColumn> sourceOutputs = sourceOuter.getOutputColumns();
        int sourceOutCount = sourceOutputs.size();

        TObjectNameList colList = insert.getColumnList();
        List<String> targetColumnNames = new ArrayList<>();
        if (colList != null && colList.size() > 0) {
            for (int i = 0; i < colList.size(); i++) {
                TObjectName n = colList.getObjectName(i);
                targetColumnNames.add(n == null ? "" : n.toString());
            }
            if (targetColumnNames.size() != sourceOutCount) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.INSERT_COLUMN_COUNT_MISMATCH,
                        diagnosticPrefix + " column list has "
                                + targetColumnNames.size()
                                + " column(s) but source SELECT produced "
                                + sourceOutCount + " output(s)",
                        insert));
            }
        }

        String sourceName = sourceOuter.getName();
        String sourceRelAlias = (sourceName != null && !sourceName.isEmpty())
                ? sourceName : "__insert_source__";
        RelationBinding sourceBinding = new RelationBinding(
                RelationKind.SUBQUERY, sourceRelAlias);
        List<RelationSource> insertRelations = new ArrayList<>();
        insertRelations.add(new RelationSource(sourceRelAlias, sourceBinding));

        RelationBinding targetBinding = new RelationBinding(
                RelationKind.TABLE, targetQName);
        TargetRelation target = new TargetRelation(targetBinding, targetColumnNames);

        int insertIdx = out.size();
        String insertTargetAlias = effectiveAliasOf(targetTable);
        if (insertTargetAlias == null || insertTargetAlias.isEmpty()) {
            insertTargetAlias = targetQName;
        }
        List<OutputColumn> returningCols = buildReturningColumns(
                returningClause,
                outputClause,
                "INSERT",
                targetQName,
                insertTargetAlias,
                targetTable,
                /*fromSideRelations=*/ Collections.<RelationSource>emptyList(),
                /*fromSideAliasToStmtIndex=*/ Collections.<String, Integer>emptyMap(),
                provider,
                insertIdx,
                outLineage,
                insert);

        StatementGraph insertOuter = new StatementGraph(
                /*name=*/ null,
                "INSERT",
                insertRelations,
                /*outputColumns=*/ Collections.<OutputColumn>emptyList(),
                returningCols,
                /*filterColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*joinColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*groupByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinctOnColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ null,
                /*rowLimit=*/ null,
                target);
        out.add(insertOuter);

        for (int i = 0; i < sourceOutCount; i++) {
            String srcName = sourceOutputs.get(i).getName();
            String tgtName = (i < targetColumnNames.size())
                    ? targetColumnNames.get(i) : srcName;
            if (tgtName == null || tgtName.isEmpty()) {
                continue;
            }
            outLineage.add(new LineageEdge(
                    LineageRef.tableColumn(targetQName, tgtName),
                    LineageRef.statementOutput(selectIdx, srcName)));
        }
    }

    /**
     * Slice 93 — rebase a {@link LineageEdge}'s {@code STATEMENT_OUTPUT}
     * statement indices by {@code offset}. {@code TABLE_COLUMN} refs are
     * returned unchanged. Used to concatenate inner {@link SemanticProgram}s
     * into a larger one (Hive multi-insert: each INSERT-SELECT pair's inner
     * program contributes its own block of statements).
     */
    private static LineageEdge rebaseLineageEdge(LineageEdge e, int offset) {
        if (offset == 0) {
            return e;
        }
        LineageRef from = rebaseLineageRef(e.getFrom(), offset);
        LineageRef to = rebaseLineageRef(e.getTo(), offset);
        if (from == e.getFrom() && to == e.getTo()) {
            return e;
        }
        return new LineageEdge(from, to);
    }

    private static LineageRef rebaseLineageRef(LineageRef ref, int offset) {
        if (ref == null) {
            return null;
        }
        if (ref.getKind() != LineageRef.Kind.STATEMENT_OUTPUT) {
            return ref;
        }
        return LineageRef.statementOutput(
                ref.getStatementIndex() + offset, ref.getOutputName());
    }

    /**
     * Slice 79 — admit a single {@code CREATE TABLE target [(c1, ...)] AS
     * SELECT ...} (CTAS) statement. Builds the source SELECT via
     * {@link #build} unchanged, then appends a {@code "CREATE_TABLE"}-
     * kind {@link StatementGraph} carrying the target relation and
     * cross-statement lineage edges (mirrors slice-78 INSERT).
     *
     * <p>Admitted shape: {@code CREATE [OR REPLACE] TABLE target
     * [(c1, c2, ...)] AS <subquery-SELECT>}. Plain
     * {@code CREATE TABLE target (a INT, b VARCHAR)} (column DDL with
     * no AS SELECT) is rejected via
     * {@link DiagnosticCode#CREATE_AS_NO_SOURCE_SELECT}. Explicit
     * column-list arity mismatch surfaces as
     * {@link DiagnosticCode#CREATE_AS_COLUMN_COUNT_MISMATCH}; a
     * missing / empty target name surfaces (defensively) as
     * {@link DiagnosticCode#CREATE_AS_TARGET_MISSING}.
     *
     * <p>For CTAS the explicit column-list spellings come from
     * {@link TCreateTableSqlStatement#getColumnList()} — only the bare
     * column name from each {@link TColumnDefinition} is consumed;
     * data-type tokens are ignored by slice 79.
     */
    /**
     * Build under caller-supplied {@code options}; see
     * {@link #build(TSelectSqlStatement, NameBindingProvider, SemanticIRBuildOptions)}.
     */
    public static SemanticBuildResult buildCreateTableResult(
            TCreateTableSqlStatement create, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildCreateTableImpl(create, provider));
    }

    /** Build a CTAS and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildCreateTableResult(
            TCreateTableSqlStatement create, NameBindingProvider provider) {
        return buildCreateTableResult(create, provider,
                SemanticIRBuildOptions.defaults());
    }

    @Deprecated
    public static SemanticProgram buildCreateTable(TCreateTableSqlStatement create,
                                     NameBindingProvider provider,
                                     SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(
                buildCreateTableResult(create, provider, options));
    }

    @Deprecated
    public static SemanticProgram buildCreateTable(TCreateTableSqlStatement create,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildCreateTableResult(create, provider));
    }

    private static SemanticProgram buildCreateTableImpl(TCreateTableSqlStatement create,
                                                        NameBindingProvider provider) {
        if (create == null) {
            throw new IllegalArgumentException("create must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }

        // Target name extraction. CTAS exposes the target via the
        // TCustomSqlStatement-inherited getTargetTable(); the explicit
        // getTableName() is a thin wrapper around tables[0].getTableName()
        // and also works. Use getTableName() for symmetry with the
        // slice-78 INSERT path.
        TObjectName targetName = create.getTableName();
        if (targetName == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_TARGET_MISSING,
                    "CREATE TABLE has no resolvable target table name",
                    create));
        }
        String targetQName = targetName.toString();
        if (targetQName == null || targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_TARGET_MISSING,
                    "CREATE TABLE target table name is empty",
                    create));
        }

        TSelectSqlStatement source = create.getSubQuery();
        if (source == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_NO_SOURCE_SELECT,
                    "CREATE TABLE has no AS SELECT subquery; slice 79 admits "
                            + "CTAS (CREATE TABLE <target> [(c1, ...)] AS SELECT ...) only",
                    create));
        }

        // Pull explicit column-list spellings BEFORE building the inner
        // — keeps the error path cheap for the structural-invalid case
        // (CTAS with column count mismatch is detected after the inner
        // build because we don't know the source output count yet).
        List<String> targetColumnNames = new ArrayList<>();
        TColumnDefinitionList colList = create.getColumnList();
        if (colList != null && colList.size() > 0) {
            for (int i = 0; i < colList.size(); i++) {
                TColumnDefinition cd = colList.getColumn(i);
                TObjectName n = (cd == null) ? null : cd.getColumnName();
                String spelling = (n == null) ? "" : n.toString();
                targetColumnNames.add(spelling);
            }
        }

        return assembleCreateLikeProgram(create, source, provider,
                "CREATE_TABLE", targetQName, targetColumnNames);
    }

    /**
     * Slice 79 — admit a single
     * {@code CREATE [OR REPLACE] VIEW v [(c1, ...)] AS SELECT ...}
     * statement. Mirrors {@link #buildCreateTable} except the source
     * SELECT is fetched via {@link TCreateViewSqlStatement#getSubquery()}
     * (lowercase 'q'), the target name from
     * {@link TCreateViewSqlStatement#getViewName()}, and the explicit
     * column-list spellings from {@link TViewAliasClause} on the AST.
     */
    /**
     * Build under caller-supplied {@code options}; see
     * {@link #build(TSelectSqlStatement, NameBindingProvider, SemanticIRBuildOptions)}.
     */
    public static SemanticBuildResult buildCreateViewResult(
            TCreateViewSqlStatement create, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildCreateViewImpl(create, provider));
    }

    /** Build a CREATE VIEW and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildCreateViewResult(
            TCreateViewSqlStatement create, NameBindingProvider provider) {
        return buildCreateViewResult(create, provider,
                SemanticIRBuildOptions.defaults());
    }

    @Deprecated
    public static SemanticProgram buildCreateView(TCreateViewSqlStatement create,
                                     NameBindingProvider provider,
                                     SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(
                buildCreateViewResult(create, provider, options));
    }

    @Deprecated
    public static SemanticProgram buildCreateView(TCreateViewSqlStatement create,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildCreateViewResult(create, provider));
    }

    private static SemanticProgram buildCreateViewImpl(TCreateViewSqlStatement create,
                                                       NameBindingProvider provider) {
        if (create == null) {
            throw new IllegalArgumentException("create must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }

        TObjectName viewName = create.getViewName();
        if (viewName == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_TARGET_MISSING,
                    "CREATE VIEW has no resolvable view name",
                    create));
        }
        String targetQName = viewName.toString();
        if (targetQName == null || targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_TARGET_MISSING,
                    "CREATE VIEW target view name is empty",
                    create));
        }

        TSelectSqlStatement source = create.getSubquery();
        if (source == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_NO_SOURCE_SELECT,
                    "CREATE VIEW has no AS SELECT subquery; slice 79 admits "
                            + "CREATE VIEW <target> [(c1, ...)] AS SELECT ... only",
                    create));
        }

        // View-side explicit column aliases via viewAliasClause. Items
        // whose alias is null are preserved as empty-string entries so
        // a parser-quirk gap doesn't silently collapse the list and
        // shift later aliases onto wrong source-output positions —
        // count-mismatch detection downstream stays accurate
        // (codex diff-review round 1 P2 catch).
        List<String> targetColumnNames = new ArrayList<>();
        TViewAliasClause aliasClause = create.getViewAliasClause();
        if (aliasClause != null) {
            TViewAliasItemList items = aliasClause.getViewAliasItemList();
            if (items != null) {
                for (int i = 0; i < items.size(); i++) {
                    TViewAliasItem item = items.getViewAliasItem(i);
                    TObjectName alias = (item == null) ? null : item.getAlias();
                    String spelling = (alias == null) ? "" : alias.toString();
                    targetColumnNames.add(spelling);
                }
            }
        }

        return assembleCreateLikeProgram(create, source, provider,
                "CREATE_VIEW", targetQName, targetColumnNames);
    }

    /**
     * Shared assembly path for slice-79 CTAS / CREATE VIEW. Given a
     * pre-validated target name and the (possibly empty) list of
     * explicit column-list spellings, builds the source SELECT,
     * validates column-list arity, and emits the outer
     * StatementGraph + cross-stmt lineage edges. Mirrors the
     * post-source half of slice-78 {@link #buildInsert}.
     */
    private static SemanticProgram assembleCreateLikeProgram(
            TParseTreeNode anchor, TSelectSqlStatement source,
            NameBindingProvider provider, String outerKind,
            String targetQName, List<String> targetColumnNames) {
        // Internal recursion — inherit ambient options (see buildInsertImpl).
        SemanticProgram inner = buildImpl(source, provider);
        List<StatementGraph> innerStmts = inner.getStatements();
        if (innerStmts.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_NO_SOURCE_SELECT,
                    "CREATE source built no statements",
                    anchor));
        }
        int selectIdx = innerStmts.size() - 1;
        StatementGraph sourceOuter = innerStmts.get(selectIdx);
        List<OutputColumn> sourceOutputs = sourceOuter.getOutputColumns();
        int sourceOutCount = sourceOutputs.size();

        if (!targetColumnNames.isEmpty()
                && targetColumnNames.size() != sourceOutCount) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.CREATE_AS_COLUMN_COUNT_MISMATCH,
                    outerKind.equals("CREATE_TABLE")
                            ? ("CREATE TABLE column list has " + targetColumnNames.size()
                                    + " column(s) but source SELECT produced "
                                    + sourceOutCount + " output(s)")
                            : ("CREATE VIEW alias list has " + targetColumnNames.size()
                                    + " column(s) but source SELECT produced "
                                    + sourceOutCount + " output(s)"),
                    anchor));
        }

        String sourceName = sourceOuter.getName();
        String sourceRelAlias = (sourceName != null && !sourceName.isEmpty())
                ? sourceName : "__create_source__";
        RelationBinding sourceBinding = new RelationBinding(
                RelationKind.SUBQUERY, sourceRelAlias);
        List<RelationSource> createRelations = new ArrayList<>();
        createRelations.add(new RelationSource(sourceRelAlias, sourceBinding));

        RelationBinding targetBinding = new RelationBinding(
                RelationKind.TABLE, targetQName);
        TargetRelation target = new TargetRelation(targetBinding, targetColumnNames);

        List<StatementGraph> out = new ArrayList<>(innerStmts.size() + 1);
        out.addAll(innerStmts);
        List<LineageEdge> outLineage = new ArrayList<>(inner.getLineage());

        StatementGraph createOuter = new StatementGraph(
                /*name=*/ null,
                outerKind,
                createRelations,
                /*outputColumns=*/ Collections.<OutputColumn>emptyList(),
                /*filterColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*joinColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*groupByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinctOnColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ null,
                /*rowLimit=*/ null,
                target);
        out.add(createOuter);

        for (int i = 0; i < sourceOutCount; i++) {
            String srcName = sourceOutputs.get(i).getName();
            String tgtName = (i < targetColumnNames.size())
                    ? targetColumnNames.get(i) : srcName;
            if (tgtName == null || tgtName.isEmpty()) {
                continue;
            }
            outLineage.add(new LineageEdge(
                    LineageRef.tableColumn(targetQName, tgtName),
                    LineageRef.statementOutput(selectIdx, srcName)));
        }

        return new SemanticProgram(out, outLineage);
    }

    /**
     * Slice 80 / 82 — admit {@code UPDATE target SET c1 = expr1,
     * c2 = expr2, ... [FROM source_list] [WHERE pred]} statements.
     * Emits one {@code "UPDATE"}-kind {@link StatementGraph} carrying
     * the target relation plus synthetic {@link OutputColumn} entries
     * per SET assignment (output name = SET LHS verbatim spelling;
     * sources = column refs collected from the RHS expression).
     * Optional WHERE refs surface on
     * {@link StatementGraph#getFilterColumnRefs()}.
     *
     * <p>Slice 82 lifts the slice-80 {@code UPDATE_JOINED_NOT_SUPPORTED}
     * reject for the common PG / MSSQL / BigQuery / Snowflake / Redshift
     * FROM-side joined UPDATE shapes. The IR shape gains two slots:
     * {@code relations[]} now carries TABLE-kind RelationSources for
     * FROM-side sources (slice 80 left empty), and
     * {@code joinColumnRefs[]} now carries ON-clause column refs from
     * FROM-side JOINs. The target stays on
     * {@link StatementGraph#getTarget()}; a reference-identity filter
     * excludes the target's own TTable instance from {@code relations[]}.
     *
     * <p>Admitted shape:
     * <ul>
     *   <li>Single-target UPDATE without FROM (slice 80) —
     *       {@code relations[]} stays empty.</li>
     *   <li>PG / BQ / SF / RS {@code UPDATE t SET ... FROM source}
     *       (single FROM source).</li>
     *   <li>PG / BQ {@code UPDATE t SET ... FROM s1, s2, ...}
     *       (comma-FROM list).</li>
     *   <li>PG / MSSQL {@code UPDATE t SET ... FROM s1 [INNER|LEFT|RIGHT|FULL OUTER] JOIN s2 ON ...}
     *       — ON refs populate {@code joinColumnRefs[]}.</li>
     *   <li>MSSQL {@code UPDATE t SET ... FROM t INNER JOIN s ON ...}
     *       — target may appear in FROM; reference-identity filter
     *       excludes the target's own TTable instance from
     *       {@code relations[]}.</li>
     *   <li>Explicit {@code CROSS JOIN} (no ON; semantically equivalent
     *       to comma-FROM).</li>
     *   <li>SET LHS is a {@link EExpressionType#simple_object_name_t}
     *       column reference (qualified {@code t.x} or bare {@code x}).
     *       Oracle tuple {@code SET (a, b) = (...)} (LHS = list_t)
     *       rejects via
     *       {@link DiagnosticCode#UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED}.</li>
     *   <li>SET RHS may be any expression NOT containing a scalar
     *       subquery and NOT containing a window function. Subqueries
     *       reject via
     *       {@link DiagnosticCode#UPDATE_SET_HAS_SUBQUERY_NOT_SUPPORTED};
     *       window functions reuse the existing
     *       {@link DiagnosticCode#CLAUSE_WINDOW_FUNCTION_LEAK}
     *       routed through {@link #rejectWindowFunctionInScope}.</li>
     *   <li>Optional WHERE clause — existing WHERE-side rejects
     *       (subqueries, window functions) continue to apply via the
     *       shared {@link #containsAnySubquery} +
     *       {@code rejectWindowFunctionInScope} helpers used by SELECT
     *       WHERE.</li>
     * </ul>
     *
     * <p>Slice 82 reject scope, with slice 83 admitting subquery FROM
     * sources (the slice-82 {@code UPDATE_FROM_SUBQUERY_NOT_SUPPORTED}
     * code stays declared but unreached — slice-71/72
     * retain-for-documentation precedent):
     * <ul>
     *   <li>Subquery as a FROM source — slice 83 admits via the
     *       SELECT-side {@code processDirectSubqueryTable} extractor,
     *       publishing a SUBQUERY-kind {@link RelationSource} and a
     *       cross-statement {@link LineageEdge} per subquery-bound
     *       output source.</li>
     *   <li>USING in any FROM-side join item —
     *       {@link DiagnosticCode#UPDATE_FROM_JOIN_USING_NOT_SUPPORTED}.</li>
     *   <li>NATURAL JOIN in any FROM-side join item —
     *       {@link DiagnosticCode#UPDATE_FROM_JOIN_NATURAL_NOT_SUPPORTED}.</li>
     *   <li>Subquery in any ON condition —
     *       {@link DiagnosticCode#UPDATE_JOIN_ON_HAS_SUBQUERY_NOT_SUPPORTED}.</li>
     *   <li>Window function in any ON condition — reuses
     *       {@link DiagnosticCode#CLAUSE_WINDOW_FUNCTION_LEAK} via
     *       {@link #rejectWindowFunctionInScope}.</li>
     * </ul>
     *
     * <p>Deferred (rejected at the outer level before any SET
     * processing):
     * <ul>
     *   <li>Top-level WITH on UPDATE →
     *       {@link DiagnosticCode#UPDATE_CTE_NOT_SUPPORTED}.</li>
     *   <li>RETURNING projection (PG / Oracle) →
     *       {@link DiagnosticCode#UPDATE_RETURNING_CLAUSE_NOT_SUPPORTED}.</li>
     *   <li>OUTPUT projection (SQL Server) →
     *       {@link DiagnosticCode#UPDATE_OUTPUT_CLAUSE_NOT_SUPPORTED}.</li>
     *   <li>ORDER BY / LIMIT on UPDATE (MySQL / Couchbase) →
     *       {@link DiagnosticCode#UPDATE_ORDER_BY_OR_LIMIT_NOT_SUPPORTED}.</li>
     *   <li>Empty / missing SET clause, Couchbase UNSET-only updates →
     *       {@link DiagnosticCode#UPDATE_NO_SET_CLAUSE}.</li>
     *   <li>Missing target table (defensive) →
     *       {@link DiagnosticCode#UPDATE_TARGET_MISSING}.</li>
     * </ul>
     *
     * <p>Cross-statement {@link LineageEdge}s, one per SET assignment:
     * <pre>
     *   from = LineageRef.tableColumn(targetQName, target_col_i)
     *   to   = LineageRef.statementOutput(0, output_name_i)
     * </pre>
     * Statement index 0 is the UPDATE statement itself — the synthetic
     * output IS the per-assignment "projection" that flows into the
     * target column. This is the slice-78 INSERT contract
     * (TABLE_COLUMN → STATEMENT_OUTPUT) with the source SELECT replaced
     * by the UPDATE's own per-assignment outputs; consumers read
     * {@code outputs[i].sources} to enumerate the RHS column refs that
     * feed the target column.
     */
    /**
     * Build under caller-supplied {@code options}; see
     * {@link #build(TSelectSqlStatement, NameBindingProvider, SemanticIRBuildOptions)}.
     */
    public static SemanticBuildResult buildUpdateResult(
            TUpdateSqlStatement update, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildUpdateImpl(update, provider));
    }

    /** Build an UPDATE and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildUpdateResult(
            TUpdateSqlStatement update, NameBindingProvider provider) {
        return buildUpdateResult(update, provider,
                SemanticIRBuildOptions.defaults());
    }

    @Deprecated
    public static SemanticProgram buildUpdate(TUpdateSqlStatement update,
                                     NameBindingProvider provider,
                                     SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildUpdateResult(update, provider, options));
    }

    @Deprecated
    public static SemanticProgram buildUpdate(TUpdateSqlStatement update,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildUpdateResult(update, provider));
    }

    private static SemanticProgram buildUpdateImpl(TUpdateSqlStatement update,
                                                   NameBindingProvider provider) {
        if (update == null) {
            throw new IllegalArgumentException("update must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }

        // Slice 86 — defensive UsingScope reset at entry so a parent
        // scope cannot leak into UPDATE's binding decisions. Mirrors
        // SELECT-side buildSelectStatementImpl (slice 65). The UPDATE's
        // own UsingScope is installed after the FROM-join walker (step
        // 5.8 below).
        provider = provider.withUsingScope(UsingScope.EMPTY);

        // 1) Slice 105 — admit top-level WITH on UPDATE. Walks the CTE
        // list left-to-right, building each body as a preceding
        // StatementGraph and producing cteNameToStatementIndex +
        // ctePublishedColumns for the FROM-as-CTE branch in
        // buildUpdateRelation below. Mirrors the slice-101 MERGE walker.
        // `stmts` / `lineage` allocated here (hoisted from the prior
        // slice-83 location) so the CTE walker can append.
        // UPDATE_CTE_NOT_SUPPORTED stays declared-but-unreached
        // (slice 71/72/82/86/95/96/97/98/99/100/101/102/103/104 precedent).
        List<StatementGraph> stmts = new ArrayList<>();
        List<LineageEdge> lineage = new ArrayList<>();
        Map<String, List<String>> ctePublishedColumns = new LinkedHashMap<>();
        Map<String, Integer> cteNameToStatementIndex = buildUpdateCteList(
                update, provider, stmts, lineage, ctePublishedColumns);

        // 2) Target table — defensive (parser usually rejects first).
        TTable targetTable = update.getTargetTable();
        if (targetTable == null || targetTable.getTableName() == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.UPDATE_TARGET_MISSING,
                    "UPDATE statement has no resolvable target table",
                    update));
        }
        String targetQName = targetTable.getTableName().toString();
        if (targetQName == null || targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.UPDATE_TARGET_MISSING,
                    "UPDATE target table name is empty",
                    update));
        }

        // 3) Slice 82 — FROM-side joined UPDATE is now admitted. The
        // slice-80 UPDATE_JOINED_NOT_SUPPORTED rejects (which fired on
        // update.tables.size() > 1 and update.getFromSourceJoin() != null)
        // are removed. The shape-specific rejects below (subquery in
        // FROM, USING, NATURAL, subquery in ON, window in ON) replace
        // them. UPDATE_JOINED_NOT_SUPPORTED remains declared but
        // unreached for API stability (the residual join-form-target
        // shape `UPDATE (a JOIN b) SET ...` does not parse in any
        // supported dialect — verified by AST probe).
        //
        // Reject ordering within buildUpdate: WITH / target-missing /
        // RETURNING / OUTPUT / ORDER BY / LIMIT / SET-empty all run
        // before the per-source FROM walk so a single rejection wins
        // on multi-violation shapes (e.g. `UPDATE t ... FROM s
        // RETURNING ...` rejects RETURNING before the FROM walk).

        // 4) Slice 85 lifts the RETURNING / OUTPUT rejects — projections
        // are now admitted via {@link #buildReturningColumns} called after
        // SET / WHERE / FROM walks complete (the projection expressions
        // need the providerWithStar binding constructed in step 5.5).
        // The cheap statement-level OUTPUT_INTO reject fires here so a
        // multi-violation shape (OUTPUT … INTO target with RETURNING
        // content errors) routes to the cheaper structural code first.
        // {@code UPDATE_RETURNING_CLAUSE_NOT_SUPPORTED} and
        // {@code UPDATE_OUTPUT_CLAUSE_NOT_SUPPORTED} stay declared but
        // unreached (slice 71/72 retain-for-documentation precedent).
        if (update.getOutputClause() != null
                && update.getOutputClause().getIntoTable() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.OUTPUT_INTO_NOT_SUPPORTED,
                    "UPDATE OUTPUT ... INTO <target> writes a second target; "
                            + "slice 85 admits projection-only OUTPUT",
                    update));
        }
        if (update.getOrderByClause() != null
                || update.getLimitClause() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.UPDATE_ORDER_BY_OR_LIMIT_NOT_SUPPORTED,
                    "UPDATE with ORDER BY / LIMIT (MySQL / Couchbase) is "
                            + "not supported by SemanticIRBuilder.buildUpdate; "
                            + "slice 80 admits no row-pruning on UPDATE",
                    update));
        }

        // 5) SET / UNSET — slice 80 requires a non-empty SET clause; a
        // Couchbase UNSET-only update (UnSetTerms populated, SET empty)
        // routes through the same code with discriminating message text.
        TResultColumnList sets = update.getResultColumnList();
        boolean hasUnSet = update.getUnSetTerms() != null
                && update.getUnSetTerms().size() > 0;
        if (sets == null || sets.size() == 0) {
            String reason = hasUnSet
                    ? "UPDATE has only an UNSET clause (Couchbase); slice 80 "
                            + "requires a non-empty SET clause"
                    : "UPDATE has no SET clause";
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.UPDATE_NO_SET_CLAUSE,
                    reason,
                    update));
        }

        // 5.5) Slice 83 — extract FROM subqueries as their own
        // StatementGraphs (after slice 105's CTE walker so the CTE
        // bodies precede any extracted FROM-subquery in the program).
        //
        // The extractor reuses the SELECT-side
        // {@link #processDirectSubqueryTable} verbatim — passing the
        // slice-105 cteNameToStatementIndex + ctePublishedColumns so a
        // nested SELECT inside a FROM-subquery can still resolve outer
        // CTE references through CTEScope (Resolver2 already binds CTE
        // refs in UPDATE correctly; the maps are passed for parity with
        // the SELECT/MERGE call sites). Inner predicate subqueries in
        // WHERE / JOIN ON / GROUP BY are caught by the slice-17 leak
        // guard ({@link #rejectSubqueriesInFromSubqueryBodyClauses}).
        //
        // No snapshot/rollback wrapper here (codex round-1 Q5 NICE):
        // buildUpdate owns fresh local stmts/lineage lists and
        // propagates exceptions to the caller — no observer can see
        // partial mutation.
        //
        // Slice 110 — decorate `provider` with `withCteContext` BEFORE
        // passing it to `extractUpdateFromSubqueries` so a nested SELECT
        // inside an extracted FROM-subquery body (e.g.
        // `UPDATE t SET col = sub.x FROM (SELECT id, x FROM cte) sub`)
        // routes CTE refs through `RelationKind.CTE`. Mirrors the
        // slice-106 DELETE-side `providerWithCte` pattern at line ~3205
        // (codex round-2 Q2 BLOCKING fix in slice 106). The slice-105
        // UPDATE site missed this decoration; slice 110 closes the gap
        // here since it also adds the same decoration on the WHERE-side
        // predicate-subquery extraction (line ~2370 below).
        NameBindingProvider providerWithCte = cteNameToStatementIndex.isEmpty()
                ? provider
                : provider.withCteContext(cteNameToStatementIndex.keySet());
        Map<String, Integer> subqueryAliasToIndex =
                extractUpdateFromSubqueries(update, providerWithCte, stmts, lineage,
                        cteNameToStatementIndex, ctePublishedColumns);
        // Build the in-scope map (subquery-alias → published column
        // names, plus CTE-bound alias → CTE published columns) so
        // `provider.withInScopeRelationColumns(map)` recognises
        // `sub.x` AND `cte.x` for the consuming UPDATE. Base-table
        // FROM-side relations don't need an entry; their column
        // resolution stays on the Resolver2 catalog path.
        Map<String, List<String>> updateInScope = buildUpdateInScopeMap(
                update, subqueryAliasToIndex, stmts,
                cteNameToStatementIndex, ctePublishedColumns);
        // Slice 110 — base `providerWithStar` on `providerWithCte`
        // (instead of raw `provider`) so SET RHS / WHERE / RETURNING
        // collectors and the slice-86 USING/NATURAL walker all see the
        // outer CTE context. Without this, a CTE-bound reference inside
        // a JOIN ON expression or a SET RHS scalar would bind as TABLE-
        // kind even when the CTE is declared at the UPDATE level.
        NameBindingProvider providerWithStar = updateInScope.isEmpty()
                ? providerWithCte
                : providerWithCte.withInScopeRelationColumns(updateInScope);

        // 5.7) Slice 86 — relocated from slice-82 step 8. The FROM-side
        // join walker now runs BEFORE SET RHS / WHERE collection so the
        // slice-86 UsingScope (step 5.8 below) can be applied to those
        // collectors. Slice 65 SELECT-side ordering: buildRelations →
        // buildUsingScope → buildOutputColumns / buildFilter / etc.
        // The join walker uses `providerWithStar` (inScope only — no
        // UsingScope yet) because USING/NATURAL emit joinColumnRefs[]
        // directly via emitMergedJoinRefs without consulting UsingScope.
        //
        // The walker treats `update.getJoins()` as the authoritative
        // FROM-list representation:
        //  - PG plain `FROM s` →   joins=[{table=s, items=[]}]
        //  - PG comma-FROM   →     joins=[{s1, items=[]}, {s2, items=[]}, ...]
        //  - PG / MSSQL explicit JOIN → joins=[{driver, items=[item1,...]}]
        //  - MSSQL target-in-FROM → joins=[{target_alias, items=[other,...]}]
        //
        // For each TJoin: the driver table goes through buildUpdateRelation
        // (which applies the slice-82 FROM-source rejects + identity
        // filter); each JoinItem is walked through buildUpdateJoinItem
        // which (slice 86) admits USING / NATURAL via slice-64/65/66
        // shared helpers in addition to ON / CROSS.
        List<RelationSource> relations = new ArrayList<>();
        // Slice 82 codex round-1 Q2 BLOCKING — LinkedHashSet dedup spans
        // the whole FROM so a column appearing in two ON clauses
        // produces one entry. Slice 86 USING/NATURAL emit refs also flow
        // through this dedup.
        java.util.LinkedHashSet<ColumnRef> joinRefsSet =
                new java.util.LinkedHashSet<>();
        for (TJoin join : update.getJoins()) {
            TTable leftTable = join.getTable();
            buildUpdateRelation(leftTable, targetTable, relations, update,
                    cteNameToStatementIndex);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            // Slice 86 — per top-level TJoin LeftOutputState seeded
            // with providerWithStar (codex round-1 B2 BLOCKING: inScope
            // installed so extracted FROM-subquery drivers' published
            // columns are visible to lookupRelationColumnNames for
            // NATURAL inference). Reset between top-level TJoins so
            // comma-FROM groups stay independent (matches SELECT-side
            // buildRelations slice-66 behavior).
            LeftOutputState leftState = new LeftOutputState();
            seedLeftOutput(leftState, leftTable, providerWithStar);
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                // Slice 86 — extended buildUpdateJoinItem signature
                // threads the join context (topJoin / items / itemIndex)
                // and LeftOutputState to the USING/NATURAL admit paths
                // so they can call the SELECT-side slice-64/65/66
                // shared helpers verbatim.
                // Slice 105 — threads cteNameToStatementIndex so the
                // join walker's per-item buildUpdateRelation call can
                // route objectname-typed CTE references to a SUBQUERY-
                // kind RelationSource pointing at the CTE statement.
                buildUpdateJoinItem(join, items, i, targetTable,
                        providerWithStar, relations, joinRefsSet, leftState,
                        update, cteNameToStatementIndex);
            }
        }
        List<ColumnRef> joinRefs = new ArrayList<>(joinRefsSet);

        // 5.8) Slice 86 — install the UPDATE's own UsingScope on
        // providerWithStar AFTER the join walker so SET RHS / WHERE /
        // RETURNING refs see merged-key resolution (mirrors SELECT-side
        // buildSelectStatementImpl slice 65 ordering). The join walker
        // itself emits joinColumnRefs via direct emit-refs helpers, so
        // UsingScope is irrelevant to ON refs (matches SELECT-side
        // contract).
        UsingScope updateUsingScope = buildUpdateUsingScope(update, providerWithStar);
        if (!updateUsingScope.isEmpty()) {
            providerWithStar = providerWithStar.withUsingScope(updateUsingScope);
        }

        // 5.9) Slice 115 — extract uncorrelated scalar subqueries on SET
        // RHS as their own <scalar_subquery_<idx>> StatementGraphs
        // appended to `stmts` BEFORE the UPDATE statement. Mirrors slice
        // 11 SELECT-side scalar projection extraction. A SET assignment
        // whose RHS is exactly a top-level subquery_t admits as a scalar
        // SET RHS: the body is built via buildSelectStatement (with the
        // slice-11 scalar-body invariants: allowFromSubqueries=false,
        // allowScalarProjectionSubqueries=false, allowWindowProjection=
        // false), inner predicate-leak guards run, and the resulting
        // ScalarInfo (extracted body index + inner output name) is stored
        // for the per-assignment loop and lineage emission below.
        //
        // Correlated scalar subqueries (whose inner refs would resolve to
        // an outer alias such as the UPDATE target or a FROM-side
        // relation) STILL reject via the slice-11 promoter called with
        // EnclosingScope.empty() — the inner ref's alias does not match
        // any local relation and no enclosing scope is provided, so
        // promoteCorrelatedRefsToOuterReference throws
        // SCALAR_SUBQUERY_UNKNOWN_RELATION_ALIAS. Lifting UPDATE-side
        // correlation is a follow-up slice (slice 14 SELECT analogue
        // extended to UPDATE).
        Map<Integer, List<ScalarInfo>> setRhsScalarInfo =
                extractScalarSubqueriesFromUpdateSetRhs(update, providerWithStar,
                        stmts, lineage, cteNameToStatementIndex,
                        subqueryAliasToIndex);

        // 6) Per-assignment processing. Each TResultColumn carries an
        // assignment_t TExpression whose leftOperand is the SET LHS
        // (target column reference) and whose rightOperand is the value
        // expression. We collect:
        //   - target column spelling   → TargetRelation.columns[i]
        //   - synthetic output name    → outputs[i].name (verbatim LHS
        //                                   spelling, mirrors slice-78
        //                                   INSERT column-list contract)
        //   - RHS source column refs   → outputs[i].sources
        List<OutputColumn> outputs = new ArrayList<>();
        List<String> targetColumnNames = new ArrayList<>();
        for (int i = 0; i < sets.size(); i++) {
            TResultColumn rc = sets.getResultColumn(i);
            TExpression assignment = (rc == null) ? null : rc.getExpr();
            // Defensive: per TUpdateSqlStatement's javadoc each SET term
            // is an assignment_t. If the parser produced something else
            // (no AST shape observed in the tested corpora) we still
            // route through TUPLE_ASSIGNMENT_NOT_SUPPORTED so an
            // unexpected shape surfaces a stable diagnostic.
            if (assignment == null
                    || assignment.getExpressionType() != EExpressionType.assignment_t) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "UPDATE SET assignment #" + (i + 1) + " is not a "
                                + "simple column-value assignment_t; slice 80 "
                                + "admits target_col = expr assignments only",
                        update));
            }
            TExpression lhs = assignment.getLeftOperand();
            TExpression rhs = assignment.getRightOperand();
            if (lhs == null || rhs == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "UPDATE SET assignment #" + (i + 1)
                                + " is missing an operand",
                        update));
            }
            // Tuple LHS (Oracle) - SET (a, b) = (SELECT c1, c2 FROM ...)
            // surfaces as list_t. Reject before any subquery-on-RHS
            // walk so the diagnostic clearly identifies the tuple shape.
            if (lhs.getExpressionType() == EExpressionType.list_t) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "UPDATE SET tuple assignment '(a, b) = ...' is not "
                                + "supported by SemanticIRBuilder.buildUpdate; "
                                + "slice 80 admits target_col = expr only",
                        update));
            }
            if (lhs.getExpressionType() != EExpressionType.simple_object_name_t) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "UPDATE SET assignment #" + (i + 1) + " LHS is "
                                + "expressionType=" + lhs.getExpressionType()
                                + "; slice 80 admits simple column references only",
                        update));
            }
            TObjectName targetCol = lhs.getObjectOperand();
            if (targetCol == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "UPDATE SET assignment #" + (i + 1) + " LHS has no "
                                + "TObjectName operand",
                        update));
            }
            String colSpelling = targetCol.toString();

            // Slice 115 — top-level subquery_t SET RHS already extracted
            // in step 5.9 as a <scalar_subquery_<idx>> StatementGraph.
            // OutputColumn carries empty sources; slice-115/119 cross-stmt
            // edge below wires the consumer to the extracted body.
            if (rhs.getExpressionType() == EExpressionType.subquery_t) {
                targetColumnNames.add(colSpelling);
                outputs.add(new OutputColumn(colSpelling,
                        /*derived=*/ true, /*aggregate=*/ false,
                        Collections.<ColumnRef>emptyList()));
                continue;
            }
            // Slice 119 — mixed-expression scalar subquery path: subquery
            // nested inside a compound RHS (e.g. `SET col = (SELECT...) + 1`).
            // The scalar(s) were already extracted in step 5.9; collect only
            // the non-subquery column refs by skipping extracted subq nodes.
            if (containsAnySubqueryExpression(rhs)) {
                List<TExpression> subqRootsList =
                        collectNestedSubqueryExpressions(rhs);
                if (subqRootsList.isEmpty()) {
                    // P2-1 codex-review: containsAnySubqueryExpression
                    // returned true (via getSubQuery() != null) but no
                    // subquery_t nodes were found by acceptChildren
                    // traversal (e.g. EXISTS or non-scalar predicate
                    // subquery). Preserve the original reject so lineage
                    // is not silently dropped.
                    throw new SemanticIRBuildException(Diagnostic.error(
                            DiagnosticCode.UPDATE_SET_HAS_SUBQUERY_NOT_SUPPORTED,
                            "UPDATE SET assignment #" + (i + 1) + " right-hand "
                                    + "side contains a non-scalar subquery "
                                    + "(slice 119 admits only scalar subquery_t "
                                    + "inside compound expressions)",
                            update));
                }
                Set<TExpression> subqRoots = Collections.newSetFromMap(
                        new IdentityHashMap<TExpression, Boolean>());
                subqRoots.addAll(subqRootsList);
                // P2-2 codex-review: window functions in the non-subquery
                // part of a compound RHS are still illegal. Use the
                // skipping variant so scalar body contents are not scanned
                // (window functions inside a scalar SELECT are legitimate).
                rejectWindowFunctionInScopeSkipping(rhs, "UPDATE SET RHS",
                        subqRoots);
                List<ColumnRef> sources = collectColumnRefsSkipping(
                        rhs, providerWithStar, subqRoots);
                targetColumnNames.add(colSpelling);
                outputs.add(new OutputColumn(colSpelling,
                        /*derived=*/ true, /*aggregate=*/ false, sources));
                continue;
            }
            // Window function on RHS — reuse the existing scope reject.
            rejectWindowFunctionInScope(rhs, "UPDATE SET RHS");

            // Collect physical column refs from the RHS expression.
            List<ColumnRef> sources = collectColumnRefs(rhs, providerWithStar);
            boolean derived =
                    rhs.getExpressionType() != EExpressionType.simple_object_name_t;
            targetColumnNames.add(colSpelling);
            outputs.add(new OutputColumn(colSpelling,
                    derived, /*aggregate=*/ false, sources));
        }

        // 7) WHERE refs — slice 110 lifts the slice-80 blanket subquery
        // reject by routing uncorrelated predicate-subquery wrappers
        // (IN-SELECT / EXISTS / NOT EXISTS / scalar comparison /
        // ANY-ALL-SOME) through the slice-23+ JOIN-ON extraction pipeline
        // refactored to take a PredicateClauseContext. Each extracted
        // wrapper lands as its own <predicate_subquery_<i>> StatementGraph
        // BEFORE the UPDATE statement (so updateIdx already accounts for
        // them via stmts.size() below). Remaining non-subquery refs flow
        // into filterColumnRefs via collectColumnRefsSkipping. SET-RHS
        // subqueries still reject (slice-110 scope excludes SET RHS).
        // Window functions in non-subquery subtrees still reject via
        // the existing rejectWindowFunctionInScopeSkipping helper.
        List<ColumnRef> filterRefs;
        TWhereClause where = update.getWhereClause();
        if (where == null || where.getCondition() == null) {
            filterRefs = Collections.<ColumnRef>emptyList();
        } else {
            Set<TExpression> extractedWhereRoots =
                    Collections.<TExpression>emptySet();
            if (containsAnySubquery(where)) {
                // Slice 110 — `providerWithStar` already carries
                // `withCteContext(cteNameToStatementIndex.keySet())`
                // (applied at the providerWithCte → providerWithStar
                // chain above) so the predicate body's inner SELECT's
                // `FROM cte` refs route through `RelationKind.CTE`.
                // Without that, emitLineageForStatement would lose the
                // STATEMENT_OUTPUT → STATEMENT_OUTPUT edge to the CTE
                // body.
                extractedWhereRoots =
                        extractUncorrelatedPredicateSubqueriesFromClause(
                                where.getCondition(), providerWithStar,
                                stmts, lineage, cteNameToStatementIndex,
                                PredicateClauseContext.UPDATE_WHERE);
                rejectAnyRemainingSubqueriesFromClause(
                        where.getCondition(), extractedWhereRoots,
                        PredicateClauseContext.UPDATE_WHERE);
            }
            rejectWindowFunctionInScopeSkipping(where, "WHERE clause",
                    extractedWhereRoots);
            // Slice 83 — providerWithStar so WHERE refs against
            // extracted subquery aliases bind correctly. Slice 110 —
            // skip extracted predicate-subquery subtrees so inner refs
            // do not leak into outer filterColumnRefs (mirrors the
            // slice-23 JOIN-ON ref collector).
            filterRefs = collectColumnRefsSkipping(where, providerWithStar,
                    extractedWhereRoots);
        }

        // (Step 8 of slice 82 was relocated to step 5.7 by slice 86 so
        // the slice-86 UsingScope built at step 5.8 can apply to the
        // SET RHS / WHERE collectors above. The walker logic itself is
        // unchanged from slice 82's contract — only its position moved.)

        RelationBinding targetBinding = new RelationBinding(
                RelationKind.TABLE, targetQName);
        TargetRelation target = new TargetRelation(targetBinding, targetColumnNames);

        // Slice 85 — build RETURNING / OUTPUT projection columns BEFORE
        // the StatementGraph so the new returningColumns slot can be
        // populated. updateIdx is computed first (deterministic — the
        // DML's position is stmts.size() at the moment of the
        // upcoming stmts.add(updateStmt)). LineageEdges are emitted
        // here via the shared helper (consumer ← producer).
        int updateIdx = stmts.size();
        // UPDATE target alias = effective alias from the target's
        // TTable (slice-82 / slice-83 use the same convention for
        // FROM-side reference identity). FROM-side relations is the
        // walked `relations[]` list already built above.
        String updateTargetAlias = effectiveAliasOf(targetTable);
        if (updateTargetAlias == null || updateTargetAlias.isEmpty()) {
            updateTargetAlias = targetQName;
        }
        // Slice 123 — hoist the slice-105 combined map (slice-83
        // subqueryAliasToIndex + slice-105 CTE-as-relation alias→cteIdx)
        // ABOVE buildReturningColumns so the slice-85 walker can promote a
        // RETURNING/OUTPUT ref to a SUBQUERY-kind FROM-side relation column
        // to a cross-stmt STATEMENT_OUTPUT → STATEMENT_OUTPUT edge. The same
        // map instance is reused below for emitUpdateSubquerySourceEdges
        // (slice 105), so the hoist is behaviour-preserving for that call.
        Map<String, Integer> combinedAliasToSubIdx =
                buildUpdateCombinedAliasToSubIdx(update,
                        subqueryAliasToIndex, cteNameToStatementIndex);
        List<OutputColumn> returningColumns = buildReturningColumns(
                update.getReturningClause(),
                update.getOutputClause(),
                "UPDATE",
                targetQName,
                updateTargetAlias,
                /*targetTable=*/ targetTable,
                relations,
                combinedAliasToSubIdx,
                providerWithStar,
                updateIdx,
                lineage,
                update);

        StatementGraph updateStmt = new StatementGraph(
                /*name=*/ null,
                "UPDATE",
                relations,
                outputs,
                returningColumns,
                filterRefs,
                /*joinColumnRefs=*/ joinRefs,
                /*groupByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinctOnColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ null,
                /*rowLimit=*/ null,
                target);

        // Slice 83 — updateIdx is dynamic: stmts already contains any
        // extracted FROM-subquery statements from step 5.5. The
        // slice-78/80 contract `target.col_i ← STATEMENT_OUTPUT(idx,
        // out_i)` is preserved by indexing the UPDATE's own statement
        // position rather than the slice-80 hardcoded 0.
        stmts.add(updateStmt);

        // Slice 78/80 cross-stmt edges — one per SET assignment:
        //   target.col_i ← STATEMENT_OUTPUT(updateIdx, out_i)
        for (int i = 0; i < outputs.size(); i++) {
            String tgtName = targetColumnNames.get(i);
            String outName = outputs.get(i).getName();
            if (tgtName == null || tgtName.isEmpty()
                    || outName == null || outName.isEmpty()) {
                // Defensive — both should be the same verbatim spelling.
                continue;
            }
            lineage.add(new LineageEdge(
                    LineageRef.tableColumn(targetQName, tgtName),
                    LineageRef.statementOutput(updateIdx, outName)));
        }

        // Slice 115 — for each SET assignment whose RHS was extracted as
        // a top-level scalar subquery in step 5.9, emit the cross-stmt
        // wire edge:
        //   STATEMENT_OUTPUT(updateIdx, outName) →
        //       STATEMENT_OUTPUT(scalarIdx, innerOutputName)
        // mirrors the SELECT-side slice-11 emission in
        // emitLineageForStatement (line ~7440). Runs AFTER the slice-78/
        // 80 target edge loop so the target edge is always emitted
        // first; the scalar-bound assignment's OutputColumn.sources is
        // empty by construction so the slice-83
        // emitUpdateSubquerySourceEdges call below is a no-op for these
        // outputs.
        // Slice 115/119 — one edge per extracted scalar per SET assignment:
        //   STATEMENT_OUTPUT(updateIdx, outName) → STATEMENT_OUTPUT(scalarIdx, innerOutputName)
        if (!setRhsScalarInfo.isEmpty()) {
            for (Map.Entry<Integer, List<ScalarInfo>> e : setRhsScalarInfo.entrySet()) {
                int ord = e.getKey();
                if (ord < 0 || ord >= outputs.size()) continue;
                String outName = outputs.get(ord).getName();
                if (outName == null || outName.isEmpty()) continue;
                for (ScalarInfo info : e.getValue()) {
                    lineage.add(new LineageEdge(
                            LineageRef.statementOutput(updateIdx, outName),
                            LineageRef.statementOutput(info.statementIndex,
                                    info.innerOutputName)));
                }
            }
        }

        // Slice 83 — emit STATEMENT_OUTPUT(updateIdx, out_i) →
        // STATEMENT_OUTPUT(subIdx, col) edges for output sources that
        // bind to a SUBQUERY-kind relation in this UPDATE's
        // relations[]. Base-table FROM-side sources stay as
        // outputs[i].sources only — preserves the slice-82 contract
        // that joined UPDATE without subqueries emits exactly ONE
        // cross-stmt edge per SET assignment (the target edge above).
        // Slice 105 — combine the slice-83 subqueryAliasToIndex with
        // the slice-105 CTE-as-relation alias→cteIdx entries so a SET
        // RHS reference to a CTE column (which lives on a SUBQUERY-
        // kind relation per slice 105) still produces a cross-stmt
        // STATEMENT_OUTPUT edge to the CTE body. Without the merge the
        // visible OutputColumn.sources stays correct but lineage[]
        // silently drops the canonical edge (codex round-2 Q5).
        // Slice 123 — combinedAliasToSubIdx is now built above (hoisted
        // for buildReturningColumns); reuse it here.
        if (!combinedAliasToSubIdx.isEmpty()) {
            emitUpdateSubquerySourceEdges(updateStmt, updateIdx,
                    combinedAliasToSubIdx, lineage);
        }

        return new SemanticProgram(stmts, lineage);
    }

    /**
     * Slice 83 — emit STATEMENT_OUTPUT → STATEMENT_OUTPUT edges from
     * each UPDATE output to its subquery-bound source column. Walks
     * {@code outputs[i].sources} and, for any source whose
     * {@code relationAlias} matches a SUBQUERY-kind entry in the
     * statement's {@link RelationSource} list, emits an edge to the
     * corresponding extracted subquery's STATEMENT_OUTPUT position.
     *
     * <p>Why not call {@link #emitLineageForStatement}? The SELECT-path
     * helper emits edges for ALL output sources (TABLE-kind →
     * TABLE_COLUMN; CTE/SUBQUERY-kind → STATEMENT_OUTPUT). For UPDATE
     * the slice-78/80 contract is intentionally narrower: the only
     * cross-stmt edge per SET assignment is the target edge. Adding
     * STATEMENT_OUTPUT → TABLE_COLUMN edges for base-table FROM-side
     * sources would change the cross-stmt edge count contract that
     * slice-82 tests assert ({@code edges.size() == numAssignments}).
     * The slice-83 emitter therefore is SUBQUERY-only — base-table
     * FROM-side refs continue to surface via {@code outputs[i].sources}
     * but emit no extra LineageEdge.
     */
    private static void emitUpdateSubquerySourceEdges(
            StatementGraph updateStmt,
            int updateIdx,
            Map<String, Integer> subqueryAliasToIndex,
            List<LineageEdge> lineage) {
        // Codex slice-83 diff-review Q1 BLOCKING — both the map and
        // the lookup must use the same casing policy so SQL like
        // `... FROM (SELECT ...) sub WHERE ... SUB.x = …` (resolver-2
        // may surface either case in `src.getRelationAlias()` depending
        // on dialect and quoting) still finds the SUBQUERY-kind entry.
        // The slice-83 inScope map and `subqueryAliasToIndex` are both
        // keyed lowercase; do the same here. (SELECT-side
        // `emitLineageForStatement` uses case-sensitive equality —
        // pre-existing limitation; a separate refactor.)
        Map<String, RelationSource> aliasToRelation = new HashMap<>();
        for (RelationSource rs : updateStmt.getRelations()) {
            String key = rs.getAlias();
            // Skip null / empty aliases — empty-string would produce a
            // vacuous "" key and could spuriously match other empty-alias
            // relations (codex round-2 Q2 advisory).
            if (key == null || key.isEmpty()) continue;
            aliasToRelation.put(key.toLowerCase(Locale.ROOT), rs);
        }
        for (OutputColumn out : updateStmt.getOutputColumns()) {
            String outName = out.getName();
            if (outName == null || outName.isEmpty()) continue;
            for (ColumnRef src : out.getSources()) {
                String srcAlias = src.getRelationAlias();
                if (srcAlias == null || srcAlias.isEmpty()) continue;
                RelationSource rel = aliasToRelation.get(
                        srcAlias.toLowerCase(Locale.ROOT));
                if (rel == null) continue;
                if (rel.getBinding() == null
                        || rel.getBinding().getKind() != RelationKind.SUBQUERY) {
                    continue;
                }
                Integer subIdx = subqueryAliasToIndex.get(
                        rel.getAlias().toLowerCase(Locale.ROOT));
                if (subIdx == null) continue;
                lineage.add(new LineageEdge(
                        LineageRef.statementOutput(updateIdx, outName),
                        LineageRef.statementOutput(subIdx, src.getColumnName())));
            }
        }
    }

    /**
     * Slice 115 — walk the UPDATE's SET clause and extract each
     * assignment whose RHS is exactly a top-level
     * {@link EExpressionType#subquery_t} as its own
     * {@code <scalar_subquery_<idx>>} {@link StatementGraph} appended to
     * {@code stmts} BEFORE the UPDATE. Mirrors the SELECT-side
     * {@link #extractScalarSubqueriesAsStatementsInternal} slice-11
     * pipeline but iterates SET assignments instead of result columns.
     * Returns {@code assignmentOrdinal → ScalarInfo} so {@link #buildUpdate}
     * can wire the cross-stmt edge for each extracted body.
     *
     * <p>Scope rejects (mirroring slice 11):
     * <ul>
     *   <li>Multi-column inner SELECT —
     *       {@link DiagnosticCode#SCALAR_SUBQUERY_COLUMN_COUNT}.</li>
     *   <li>Inner projection has no alias and no column name —
     *       {@link DiagnosticCode#SCALAR_SUBQUERY_INNER_PROJECTION_UNNAMED}.</li>
     *   <li>Subqueries in scalar body's WHERE / JOIN ON / GROUP BY —
     *       slice-11 {@link #rejectSubqueriesInScalarBodyClauses}.</li>
     *   <li>FROM-subqueries inside scalar body —
     *       {@code allowFromSubqueries=false} (slice-15 invariant).</li>
     *   <li>Nested scalar projections inside scalar body —
     *       {@code allowScalarProjectionSubqueries=false} (set-op-branch
     *       precedent; slice 115 initial scope).</li>
     *   <li>Window functions in scalar body —
     *       {@code allowWindowProjection=false} (slice-11 precedent).</li>
     *   <li>Correlated scalar subqueries (inner refs to outer aliases) —
     *       {@link #promoteCorrelatedRefsToOuterReference} called with
     *       {@link EnclosingScope#empty()} throws
     *       {@link DiagnosticCode#SCALAR_SUBQUERY_UNKNOWN_RELATION_ALIAS}.
     *       Lifting UPDATE-side correlation is a follow-up slice
     *       (slice 14 SELECT analogue extended to UPDATE).</li>
     * </ul>
     *
     * <p>Snapshot/rollback wrapper around the loop body mirrors
     * {@link #extractScalarSubqueriesAsStatements} so a partial
     * extraction (e.g. second of two scalar SET RHS fails on shape
     * validation) truncates {@code stmts}/{@code lineage} back to the
     * pre-call boundary.
     *
     * <p>Assignments whose RHS is not a top-level {@code subquery_t} are
     * silently skipped here; they fall through to the per-assignment
     * loop's existing slice-80 / slice-115 mixed-expression reject path.
     */
    private static Map<Integer, List<ScalarInfo>> extractScalarSubqueriesFromUpdateSetRhs(
            TUpdateSqlStatement update,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, Integer> subqueryAliasToIndex) {
        TResultColumnList sets = update.getResultColumnList();
        if (sets == null || sets.size() == 0) {
            return Collections.<Integer, List<ScalarInfo>>emptyMap();
        }
        // Fast pre-scan: any SET RHS that contains a subquery (top-level
        // subquery_t or nested inside a compound expression)? Avoids the
        // snapshot/rollback wrapper overhead when none are present.
        // Slice 115 handled top-level subquery_t only; slice 119 extends
        // to mixed-expression RHS (e.g. `SET col = (SELECT...) + 1`).
        // Tuple-LHS assignments (Oracle SET (a, b) = ...) are
        // intentionally skipped so the per-assignment loop's
        // UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED reject (slice 80
        // contract) wins.
        boolean anySubquery = false;
        for (int i = 0; i < sets.size(); i++) {
            TResultColumn rc = sets.getResultColumn(i);
            if (rc == null || rc.getExpr() == null) continue;
            TExpression assignment = rc.getExpr();
            if (assignment.getExpressionType() != EExpressionType.assignment_t) {
                continue;
            }
            TExpression lhs = assignment.getLeftOperand();
            if (lhs == null
                    || lhs.getExpressionType() == EExpressionType.list_t) {
                continue;
            }
            TExpression rhs = assignment.getRightOperand();
            if (rhs != null && containsAnySubqueryExpression(rhs)) {
                anySubquery = true;
                break;
            }
        }
        if (!anySubquery) {
            return Collections.<Integer, List<ScalarInfo>>emptyMap();
        }
        int stmtsSnapshot = stmts.size();
        int lineageSnapshot = lineage.size();
        try {
            return extractScalarSubqueriesFromUpdateSetRhsInternal(
                    update, provider, stmts, lineage,
                    cteNameToStatementIndex, subqueryAliasToIndex, sets);
        } catch (RuntimeException ex) {
            while (stmts.size() > stmtsSnapshot) stmts.remove(stmts.size() - 1);
            while (lineage.size() > lineageSnapshot) lineage.remove(lineage.size() - 1);
            throw ex;
        }
    }

    /**
     * Internal body of {@link #extractScalarSubqueriesFromUpdateSetRhs};
     * wrapped with snapshot/rollback by the public entry point. Do not
     * call directly from non-wrapper sites.
     */
    private static Map<Integer, List<ScalarInfo>> extractScalarSubqueriesFromUpdateSetRhsInternal(
            TUpdateSqlStatement update,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, Integer> subqueryAliasToIndex,
            TResultColumnList sets) {
        Map<Integer, List<ScalarInfo>> ordinalToInfo = new HashMap<>();
        for (int i = 0; i < sets.size(); i++) {
            TResultColumn rc = sets.getResultColumn(i);
            if (rc == null || rc.getExpr() == null) continue;
            TExpression assignment = rc.getExpr();
            if (assignment.getExpressionType() != EExpressionType.assignment_t) {
                continue;
            }
            TExpression lhs = assignment.getLeftOperand();
            // Skip tuple-LHS assignments — the per-assignment loop's
            // slice-80 UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED reject
            // should win for these (e.g. Oracle `SET (a, b) = (SELECT
            // c1, c2 FROM ...)`). Without this skip, the inner SELECT's
            // multi-column projection would surface as
            // SCALAR_SUBQUERY_COLUMN_COUNT here instead.
            if (lhs == null
                    || lhs.getExpressionType() == EExpressionType.list_t) {
                continue;
            }
            TExpression rhs = assignment.getRightOperand();
            if (rhs == null || !containsAnySubqueryExpression(rhs)) {
                continue; // no subquery in this RHS — handled by per-assignment loop
            }
            // "outer alias" used in diagnostic messages — the SET LHS
            // column spelling. Mirrors the slice-11 `outerAlias` role.
            String outerAlias = (lhs.getExpressionType() == EExpressionType.simple_object_name_t
                    && lhs.getObjectOperand() != null)
                    ? lhs.getObjectOperand().toString()
                    : ("SET assignment #" + (i + 1));

            // Determine which subquery TExpression nodes to extract.
            // Slice 115 path: RHS is exactly a top-level subquery_t →
            //   single-element list.
            // Slice 119 path: RHS is a compound expression (arithmetic,
            //   CASE, function) containing one or more subquery_t nodes
            //   at any depth → list in traversal order.
            List<TExpression> subqExprs;
            if (rhs.getExpressionType() == EExpressionType.subquery_t) {
                subqExprs = Collections.singletonList(rhs);
            } else {
                subqExprs = collectNestedSubqueryExpressions(rhs);
            }
            if (subqExprs.isEmpty()) continue; // defensive (containsAnySubqueryExpression true but none found)

            // Build the UPDATE-side enclosing scope once per assignment
            // (used by each per-scalar correlation promotion below).
            EnclosingScope innerEnclosing = buildUpdateEnclosingScope(update,
                    cteNameToStatementIndex, subqueryAliasToIndex,
                    /*parent=*/ null);

            List<ScalarInfo> infos = new ArrayList<>();
            for (TExpression subqExpr : subqExprs) {
                TSelectSqlStatement inner = subqExpr.getSubQuery();
                if (inner == null) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_NO_INNER_SELECT,
                            "scalar subquery on UPDATE SET RHS for '" + outerAlias
                                    + "' has no inner SELECT", rc));
                }
                // Pre-recursion validation (matches slice 11 ordering):
                // inspect inner column count and naming before recursive
                // build so the diagnostic is scalar-specific.
                TResultColumnList innerRcl = inner.getResultColumnList();
                if (innerRcl == null || innerRcl.size() == 0) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_COLUMN_COUNT,
                            "scalar subquery on UPDATE SET RHS for '" + outerAlias
                                    + "' must project exactly one column, got 0", rc));
                }
                if (innerRcl.size() != 1) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_COLUMN_COUNT,
                            "scalar subquery on UPDATE SET RHS for '" + outerAlias
                                    + "' must project exactly one column, got "
                                    + innerRcl.size(), rc));
                }
                TResultColumn innerCol = innerRcl.getResultColumn(0);
                String innerAlias = innerCol.getColumnAlias();
                String innerColName = innerCol.getColumnNameOnly();
                boolean innerHasName =
                        (innerAlias != null && !innerAlias.isEmpty())
                                || (innerColName != null && !innerColName.isEmpty());
                if (!innerHasName && !isConstantExpression(innerCol.getExpr())) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_INNER_PROJECTION_UNNAMED,
                            "scalar subquery on UPDATE SET RHS for '" + outerAlias
                                    + "' inner projection has no alias and no column "
                                    + "name; add an explicit alias inside the subquery",
                            rc));
                }
                // Predicate-leak guard: scalar body's WHERE / JOIN ON /
                // GROUP BY must not contain subqueries. Slice 121: the
                // UPDATE SET-RHS scalar path keeps the WHERE reject
                // (allowWherePredicateSubqueries=false) — only the
                // projection scalar path lifts WHERE predicate subqueries.
                rejectSubqueriesInScalarBodyClauses(inner, outerAlias,
                        /*allowWherePredicateSubqueries=*/ false);

                // Slice 117 / 119 — decorate provider with the inner
                // SELECT's local FROM aliases for tolerant outer-binding.
                Set<String> innerLocalAliases = precomputeInnerLocalAliases(inner);
                NameBindingProvider tolerantProvider = innerLocalAliases.isEmpty()
                        ? provider
                        : provider.withTolerantOuterBinding(innerLocalAliases);

                String scalarName = SCALAR_BODY_PREFIX + stmts.size() + ">";
                StatementGraph innerStmt = buildSelectStatement(inner, tolerantProvider,
                        scalarName,
                        /*hasOuterCteListAlreadyProcessed=*/ false,
                        /*allowFromSubqueries=*/ false,
                        /*allowScalarProjectionSubqueries=*/ false,
                        /*allowWindowProjection=*/ false);
                innerStmt = promoteCorrelatedRefsToOuterReference(
                        innerStmt, outerAlias, innerEnclosing);
                int idx = stmts.size();
                stmts.add(innerStmt);
                String innerOutName = effectiveOutputName(innerCol);
                infos.add(new ScalarInfo(idx, innerOutName));
                emitLineageForStatement(innerStmt, idx, lineage,
                        cteNameToStatementIndex,
                        innerEnclosing.flattenSubqueryAliasToIndex(),
                        Collections.<Integer, ScalarInfo>emptyMap());
            }
            ordinalToInfo.put(i, infos);
        }
        return ordinalToInfo;
    }

    /**
     * Slice 82 — process one FROM-side source table for joined
     * {@link #buildUpdate}. Applies the slice-82 reject contract for
     * non-table FROM sources, then appends a TABLE-kind
     * {@link RelationSource} unless the table is the target
     * (reference-identity filter — clean IR semantics: relations[]
     * models read-side sources only).
     */
    private static void buildUpdateRelation(TTable t, TTable targetTable,
                                            List<RelationSource> relations,
                                            TUpdateSqlStatement update,
                                            Map<String, Integer> cteNameToStatementIndex) {
        if (t == null) {
            return; // defensive — parser should never produce a null table
        }
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
            // Slice 83 — admit FROM-side subqueries. The inner SELECT
            // has already been extracted as its own StatementGraph by
            // {@link #extractUpdateFromSubqueries} (step 5.5 of
            // buildUpdate). Here we publish the SUBQUERY-kind
            // {@link RelationSource} so {@code outputs[i].sources}
            // resolved via the inScope-enhanced provider can route to
            // it. Alias and qualifiedName both use
            // {@code effectiveAliasOf(t)} — matching slice-14 / slice-58
            // SUBQUERY-kind convention used by SELECT.
            //
            // {@code UPDATE_FROM_SUBQUERY_NOT_SUPPORTED} stays declared
            // but unreached (slice-71/72 retain-for-documentation
            // precedent — keeps the public DiagnosticCode enum stable
            // for consumers that route by code).
            String subAlias = effectiveAliasOf(t);
            if (subAlias != null && !subAlias.isEmpty()) {
                relations.add(new RelationSource(subAlias,
                        new RelationBinding(RelationKind.SUBQUERY, subAlias)));
            }
            return;
        }
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.join) {
            // Defensive: TTable wrapping a TJoin. Not reached by any
            // observed parser path on the supported dialects (slice-82
            // probe set), but gets its own DiagnosticCode so consumers
            // can route this distinct shape without parsing message
            // text — per slice-80's message-text-discrimination
            // contract (codex round-1 Q4 BLOCKING).
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.UPDATE_FROM_NESTED_JOIN_NOT_SUPPORTED,
                    "UPDATE FROM source is a nested join wrapper; "
                            + "slice 82 admits simple table FROM sources only",
                    update));
        }
        // Reference-identity filter: target's own TTable instance is
        // excluded from relations[]. In MSSQL `UPDATE T2 ... FROM Table2 T2 …`,
        // tables[0] / joins[0].getTable() IS the same instance as
        // update.getTargetTable(); excluding it keeps the IR clean
        // (relations[] models reads, target models writes). The
        // catalog-miss WARN walker's target-first ordering handles the
        // cross-instance-same-name MSSQL self-join edge case where two
        // distinct TTable instances share the same qualified name.
        if (t == targetTable) {
            return;
        }
        TObjectName tName = t.getTableName();
        if (tName == null) {
            return; // defensive
        }
        // Slice 105 — FROM-side CTE detection. When the FROM-side table
        // is an objectname-typed reference whose bare name matches a
        // declared CTE in this UPDATE's outer WITH clause, emit a
        // SUBQUERY-kind RelationSource pointing at the CTE statement
        // (mirrors MERGE USING-as-CTE in slice 101). The slice-77
        // catalog-miss WARN walker filters to RelationKind.TABLE so
        // CTE-bound relations are naturally skipped, even when the
        // catalog also declares the same name (codex round-2 Q4
        // confirmed YES). The cross-stmt lineage edge from
        // STATEMENT_OUTPUT(updateIdx,col) → STATEMENT_OUTPUT(cteIdx,col)
        // is emitted by emitUpdateSubquerySourceEdges using the
        // combined alias→subIdx map.
        if (cteNameToStatementIndex != null
                && !cteNameToStatementIndex.isEmpty()) {
            String bareName = tName.toString();
            if (bareName != null && !bareName.isEmpty()) {
                String bareNameLower = bareName.toLowerCase(Locale.ROOT);
                if (cteNameToStatementIndex.containsKey(bareNameLower)) {
                    String cteAlias = effectiveAliasOf(t);
                    if (cteAlias == null || cteAlias.isEmpty()) {
                        cteAlias = bareName;
                    }
                    relations.add(new RelationSource(cteAlias,
                            new RelationBinding(RelationKind.SUBQUERY, cteAlias)));
                    return;
                }
            }
        }
        // effectiveAliasOf returns the SQL-written alias if present,
        // else the table name. RelationSource requires a non-empty
        // alias; this matches the slice-58/59 buildRelation contract.
        relations.add(new RelationSource(effectiveAliasOf(t),
                new RelationBinding(RelationKind.TABLE, tName.toString())));
    }

    /**
     * Slice 82 (extended by slice 86) — process one {@link TJoinItem}
     * for joined {@link #buildUpdate}. Routes USING / NATURAL JoinItems
     * through the SELECT-side slice-64/65/66 shared helpers
     * ({@link #populateUsingJoinRefs} / {@link #emitMergedJoinRefs} /
     * {@link #naturalSharedKeys}) so the UPDATE join walker emits the
     * same {@code joinColumnRefs[]} shape as a SELECT body. ON / CROSS
     * JoinItems retain the slice-82 reject contract (subquery in ON,
     * window in ON) and ref-collection path.
     *
     * <p>Slice 86 signature extension: the join context
     * ({@code topJoin}, {@code items}, {@code itemIndex}) and the
     * per-top-level-TJoin {@link LeftOutputState} are required by the
     * shared helpers — the prior-relations chain for emit-refs and the
     * accumulated left row type for NATURAL inference.
     *
     * <p>USING / NATURAL shape conflicts (USING+ON, NATURAL+USING,
     * NATURAL+ON) reuse the existing slice-64/66 codes
     * ({@link DiagnosticCode#JOIN_WITH_BOTH_ON_AND_USING},
     * {@link DiagnosticCode#NATURAL_WITH_USING},
     * {@link DiagnosticCode#NATURAL_WITH_ON}) rather than introducing
     * UPDATE-specific codes — matching slice 86's "reuse SELECT-side
     * machinery verbatim" architecture.
     *
     * <p>Slice 82's lifted reject codes
     * ({@link DiagnosticCode#UPDATE_FROM_JOIN_USING_NOT_SUPPORTED} and
     * {@link DiagnosticCode#UPDATE_FROM_JOIN_NATURAL_NOT_SUPPORTED})
     * stay declared-but-unreached for API stability — slice 71/72/82
     * retain-for-documentation precedent.
     */
    private static void buildUpdateJoinItem(TJoin topJoin,
                                            TJoinItemList items,
                                            int itemIndex,
                                            TTable targetTable,
                                            NameBindingProvider provider,
                                            List<RelationSource> relations,
                                            java.util.LinkedHashSet<ColumnRef> joinRefs,
                                            LeftOutputState leftState,
                                            TUpdateSqlStatement update,
                                            Map<String, Integer> cteNameToStatementIndex) {
        if (items == null) return;
        TJoinItem item = items.getJoinItem(itemIndex);
        if (item == null) return;

        TObjectNameList usingCols = item.getUsingColumns();
        boolean hasUsing = usingCols != null && usingCols.size() > 0;
        boolean isNatural = isNaturalJoinType(item.getJoinType());
        boolean hasOn = item.getOnCondition() != null;

        // Slice 86 — USING/NATURAL admit paths. Shape conflicts use the
        // slice-64/66 SELECT-side codes verbatim; the UPDATE-specific
        // lifted codes (UPDATE_FROM_JOIN_USING_NOT_SUPPORTED /
        // UPDATE_FROM_JOIN_NATURAL_NOT_SUPPORTED) are no longer thrown
        // (declared-but-unreached for API stability).
        if (isNatural && hasUsing) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.NATURAL_WITH_USING,
                    "NATURAL JOIN must not carry a USING clause; choose "
                            + "either NATURAL or USING, not both", item));
        }
        if (isNatural && hasOn) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.NATURAL_WITH_ON,
                    "NATURAL JOIN must not carry an ON condition; rewrite "
                            + "as JOIN ... ON, or drop the NATURAL keyword", item));
        }
        if (hasUsing && hasOn) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.JOIN_WITH_BOTH_ON_AND_USING,
                    "JOIN cannot carry both ON and USING; choose one", item));
        }

        if (hasUsing) {
            // Right-side table first: applies slice-82 source-shape
            // rejects + identity filter exactly as the ON path.
            buildUpdateRelation(item.getTable(), targetTable, relations, update,
                    cteNameToStatementIndex);
            // Slice 64 emit-refs: left-then-right per key, walking
            // priorRelations = topJoin.getTable() + items[0..itemIndex-1].
            List<ColumnRef> usingRefs = new ArrayList<>();
            populateUsingJoinRefs(topJoin, items, itemIndex, item.getTable(),
                    usingCols, provider, usingRefs);
            joinRefs.addAll(usingRefs);
            // Slice 66 LeftOutputState update: merge right's columns
            // into accumulated state so a subsequent NATURAL JoinItem
            // sees the row type (matches SELECT-side
            // {@code buildRelations}).
            List<String> usingKeyNames = new ArrayList<>(usingCols.size());
            for (int k = 0; k < usingCols.size(); k++) {
                TObjectName key = usingCols.getObjectName(k);
                if (key == null) continue;
                String keyName = key.getColumnNameOnly();
                if (keyName != null && !keyName.isEmpty()) {
                    usingKeyNames.add(keyName);
                }
            }
            mergeRightIntoLeftOutput(leftState, item.getTable(), provider,
                    usingKeyNames);
            return;
        }

        if (isNatural) {
            // Right-side table first; identity filter excludes target.
            buildUpdateRelation(item.getTable(), targetTable, relations, update,
                    cteNameToStatementIndex);
            // Slice 66 catalog-required NATURAL inference. When either
            // side lacks resolvable column metadata the shared-column list
            // cannot be computed; DEGRADE (mirrors the SELECT-side
            // buildRelations path) — skip the merged join refs, record a
            // non-fatal NATURAL_CATALOG_REQUIRED warning, and append the
            // right's columns to the running state for consistency.
            NaturalKeyResult r = naturalSharedKeys(leftState, item.getTable(), provider);
            if (r.kind != NaturalKeyResult.Kind.SUCCESS) {
                recordNaturalDegradeWarning(r, item);
                appendRightToLeftOutput(leftState, item.getTable(), provider);
                return;
            }
            List<ColumnRef> naturalRefs = new ArrayList<>();
            emitMergedJoinRefs(JoinKind.NATURAL, r.keys, topJoin, items,
                    itemIndex, item.getTable(), provider, naturalRefs);
            joinRefs.addAll(naturalRefs);
            // Update LeftOutputState with the right's columns (merging
            // shared keys into existing slots, appending non-shared
            // columns as new entries).
            mergeRightIntoLeftOutput(leftState, item.getTable(), provider, r.keys);
            return;
        }

        // ON / CROSS branch — slice-82 contract preserved.
        buildUpdateRelation(item.getTable(), targetTable, relations, update,
                    cteNameToStatementIndex);
        // Slice 86 — append right to LeftOutputState so subsequent
        // NATURAL JoinItems in the same top-level TJoin observe the
        // accumulated row type. CROSS / ON contribute non-merged
        // columns to state (matches SELECT-side appendRightToLeftOutput).
        appendRightToLeftOutput(leftState, item.getTable(), provider);
        TExpression onCond = item.getOnCondition();
        if (onCond == null) return; // CROSS JOIN: no ON.
        if (containsAnySubqueryExpression(onCond)) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.UPDATE_JOIN_ON_HAS_SUBQUERY_NOT_SUPPORTED,
                    "UPDATE FROM JOIN ON condition contains a subquery; "
                            + "slice 82 admits scalar predicates only",
                    item));
        }
        rejectWindowFunctionInScope(onCond, "UPDATE FROM JOIN ON");
        joinRefs.addAll(collectColumnRefs(onCond, provider));
    }

    /**
     * Slice 83 — extract every FROM-side subquery in
     * {@code update.getJoins()} as its own {@link StatementGraph}
     * appended to {@code stmts} before the UPDATE itself. Walks both
     * the driver TTable of each TJoin AND each JoinItem's right table.
     * Returns an alias → stmts-index map so the consuming UPDATE can
     * (a) build its in-scope column map via
     * {@link #buildUpdateInScopeMap}, and (b) emit
     * STATEMENT_OUTPUT → STATEMENT_OUTPUT edges via
     * {@link #emitUpdateSubquerySourceEdges}.
     *
     * <p>Reuses the SELECT-side {@link #processDirectSubqueryTable}
     * verbatim, passing empty CTE maps because slice 80 already
     * rejects top-level WITH on UPDATE
     * ({@link DiagnosticCode#UPDATE_CTE_NOT_SUPPORTED}). The inner
     * SELECT's own FROM-subqueries are handled recursively by the
     * helper. Inner predicate subqueries in WHERE / JOIN ON /
     * GROUP BY are caught by the slice-17 leak guard
     * ({@link #rejectSubqueriesInFromSubqueryBodyClauses}). Inner
     * top-level WITH is rejected by
     * {@code buildSelectStatement(hasOuterCteListAlreadyProcessed=false)}.
     * Inner scalar projection subqueries are rejected by
     * {@code buildSelectStatement(allowScalarProjectionSubqueries=false)}.
     *
     * <p>No mutation-guard wrapper here: buildUpdate owns fresh local
     * lists and exceptions propagate to the caller (codex round-1 Q5
     * NICE).
     */
    private static Map<String, Integer> extractUpdateFromSubqueries(
            TUpdateSqlStatement update,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        Map<String, Integer> aliasToIndex = new HashMap<>();
        TJoinList joins = update.getJoins();
        if (joins == null) return aliasToIndex;
        // Slice 105 — forward the outer-WITH CTE maps so a nested SELECT
        // inside an extracted FROM-subquery body can resolve outer-WITH
        // CTE references. Resolver2 wires CTEScope already; the maps are
        // forwarded for parity with the SELECT / MERGE call sites.
        Map<String, Integer> cteMap = cteNameToStatementIndex == null
                ? Collections.<String, Integer>emptyMap()
                : cteNameToStatementIndex;
        Map<String, List<String>> ctePublished = ctePublishedColumns == null
                ? Collections.<String, List<String>>emptyMap()
                : ctePublishedColumns;
        for (TJoin join : joins) {
            // Driver table — may be a subquery (PG / Snowflake / BQ /
            // Redshift `UPDATE t SET … FROM (SELECT …) sub` shape).
            processDirectSubqueryTable(join.getTable(), provider,
                    stmts, lineage, cteMap, ctePublished, aliasToIndex);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                // Right-side table of a JoinItem — may be a subquery
                // (MSSQL / PG `UPDATE t SET … FROM x JOIN (SELECT …)
                // sub ON …` shape).
                processDirectSubqueryTable(item.getTable(), provider,
                        stmts, lineage, cteMap, ctePublished, aliasToIndex);
            }
        }
        return aliasToIndex;
    }

    /**
     * Slice 83 — build an effective-alias-keyed in-scope map publishing
     * each extracted FROM-subquery's output column names. The consuming
     * UPDATE wraps its provider via
     * {@code provider.withInScopeRelationColumns(map)} so {@code sub.x}
     * resolves to the subquery's published column rather than failing
     * resolution against the catalog.
     *
     * <p>Base-table FROM-side relations do not need an entry: their
     * column resolution stays on the Resolver2 catalog path. Slice 60's
     * SELECT-side {@link #buildEffectiveAliasInScopeMap} also skips
     * base-table relations.
     *
     * <p>Slice 105 — when an outer WITH clause declares a CTE and a
     * FROM-side relation references that CTE by its bare name, publish
     * the CTE's column names against the FROM-side effective alias so
     * SET RHS / WHERE / ON refs against the CTE alias bind correctly.
     */
    private static Map<String, List<String>> buildUpdateInScopeMap(
            TUpdateSqlStatement update,
            Map<String, Integer> subqueryAliasToIndex,
            List<StatementGraph> stmts,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        Map<String, List<String>> result = new HashMap<>();
        boolean haveSubq = subqueryAliasToIndex != null
                && !subqueryAliasToIndex.isEmpty();
        boolean haveCte = cteNameToStatementIndex != null
                && !cteNameToStatementIndex.isEmpty();
        if (!haveSubq && !haveCte) {
            return result;
        }
        TJoinList joins = update.getJoins();
        if (joins == null) return result;
        for (TJoin join : joins) {
            addUpdateRelationToInScopeMap(join.getTable(),
                    subqueryAliasToIndex, stmts, result,
                    cteNameToStatementIndex, ctePublishedColumns);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                addUpdateRelationToInScopeMap(item.getTable(),
                        subqueryAliasToIndex, stmts, result,
                        cteNameToStatementIndex, ctePublishedColumns);
            }
        }
        return result;
    }

    private static void addUpdateRelationToInScopeMap(TTable t,
            Map<String, Integer> subqueryAliasToIndex,
            List<StatementGraph> stmts,
            Map<String, List<String>> result,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        if (t == null) return;
        // Slice 105 — CTE-as-FROM-relation in-scope publication. When
        // the FROM-side table is an objectname-typed reference whose
        // bare name matches a declared outer CTE, publish the CTE's
        // own column names against the FROM-side effective alias so
        // SET RHS / WHERE refs against the CTE alias bind correctly.
        if (cteNameToStatementIndex != null
                && !cteNameToStatementIndex.isEmpty()
                && ctePublishedColumns != null
                && t.getTableType()
                        == gudusoft.gsqlparser.ETableSource.objectname) {
            TObjectName tName = t.getTableName();
            if (tName != null) {
                String bare = tName.toString();
                if (bare != null && !bare.isEmpty()) {
                    String bareLower = bare.toLowerCase(Locale.ROOT);
                    if (cteNameToStatementIndex.containsKey(bareLower)) {
                        String aliasKey = effectiveAliasLowerCaseOrNull(t);
                        if (aliasKey == null) aliasKey = bareLower;
                        List<String> cols = ctePublishedColumns.get(bareLower);
                        if (cols != null) {
                            result.put(aliasKey, cols);
                        }
                        return;
                    }
                }
            }
        }
        if (t.getTableType() != gudusoft.gsqlparser.ETableSource.subquery) {
            return;
        }
        if (subqueryAliasToIndex == null) {
            return;
        }
        String key = effectiveAliasLowerCaseOrNull(t);
        if (key == null) return;
        Integer idx = subqueryAliasToIndex.get(key);
        if (idx == null) return;
        result.put(key, outputColumnNames(stmts.get(idx)));
    }

    /**
     * Slice 81 / slice 84 — admit single-target and joined
     * {@code DELETE} statements and produce a {@code "DELETE"}-kind
     * {@link StatementGraph} (§8.1.4 row D11 follow-up via slice 84's
     * joined-DELETE candidate (a)).
     *
     * <p>Structurally mirrors slice-80 + slice-82 + slice-83
     * {@link #buildUpdate} but with no SET clause and an empty
     * {@code outputColumns} list — DELETE has no projection of its
     * own (RETURNING / OUTPUT projections are deferred to a later
     * slice). The target relation is exposed via the slice-78
     * {@link TargetRelation} slot; its {@code columns} list is
     * intentionally empty because DELETE removes whole rows rather
     * than writing specific columns.
     *
     * <p>WHERE-side reads still surface on
     * {@link StatementGraph#getFilterColumnRefs()} so downstream
     * governance can audit "what predicates does this DELETE depend
     * on". Cross-statement {@link LineageEdge}s are NOT emitted (the
     * slice-78 / slice-80 {@code target.col_i ← STATEMENT_OUTPUT(…)}
     * contract has no DELETE analogue: there is no source
     * projection).
     *
     * <p>Slice 84 admit scope (lifts slice-81's blanket joined-DELETE
     * reject for the common PG / MSSQL FROM-side shapes; mirrors
     * slice 82 + slice 83 onto DELETE):
     * <ul>
     *   <li>PG / Snowflake / BQ / Redshift {@code DELETE FROM t USING
     *       source_list [WHERE]} — {@code source_list} = simple table,
     *       comma-separated tables, or chain of explicit JOIN ... ON
     *       (driver is taken from {@code referenceJoins}).</li>
     *   <li>MSSQL {@code DELETE FROM t FROM driver_table [JOIN other
     *       ON ...] [WHERE]} — the target may itself appear in the
     *       FROM-FROM clause as a different TTable instance.</li>
     *   <li>MSSQL {@code DELETE alias FROM t alias INNER JOIN ... ON …}
     *       — the alias-form DELETE where target is matched by alias.</li>
     *   <li>CROSS JOIN inside USING — no ON; semantically equivalent
     *       to comma-FROM.</li>
     *   <li>{@code DELETE FROM t USING (SELECT …) s [WHERE]} —
     *       FROM-subquery as a USING source; mirrors slice-83 UPDATE
     *       FROM-subquery extraction.</li>
     * </ul>
     *
     * <p>Slice 84 reject scope (preserves slice-81 reject coverage
     * for shapes that still need a refinement slice):
     * <ul>
     *   <li>{@link DiagnosticCode#DELETE_JOINED_NOT_SUPPORTED} — any
     *       shape with {@code delete.getJoins().size() &gt; 0}: MySQL
     *       multi-target {@code DELETE T1, T2 FROM …}, MySQL
     *       self-reference {@code DELETE T1 FROM T1}, MySQL
     *       multi-USING {@code DELETE FROM T1 USING T1, T2}.
     *       Candidates (c) and (d) in §8.1.4 lift these later.</li>
     *   <li>{@link DiagnosticCode#DELETE_FROM_JOIN_USING_NOT_SUPPORTED}
     *       — {@code USING(col1, col2)} on a FROM-side join item;
     *       mirror of slice-82 {@code UPDATE_FROM_JOIN_USING_*}.</li>
     *   <li>{@link DiagnosticCode#DELETE_FROM_JOIN_NATURAL_NOT_SUPPORTED}
     *       — {@code NATURAL JOIN} on a FROM-side join item.</li>
     *   <li>{@link DiagnosticCode#DELETE_FROM_NESTED_JOIN_NOT_SUPPORTED}
     *       — defensive: TTable wrapping a TJoin in the FROM source
     *       (not reached by any observed parser path on supported
     *       dialects, but kept distinct from the subquery code per
     *       slice-80 message-text-discrimination contract).</li>
     *   <li>{@link DiagnosticCode#DELETE_JOIN_ON_HAS_SUBQUERY_NOT_SUPPORTED}
     *       — subquery in a JOIN ON predicate.</li>
     * </ul>
     *
     * <p>Other rejected shapes (slice-81 baseline preserved):
     * {@link DiagnosticCode#DELETE_CTE_NOT_SUPPORTED},
     * {@link DiagnosticCode#DELETE_TARGET_MISSING},
     * {@link DiagnosticCode#DELETE_RETURNING_CLAUSE_NOT_SUPPORTED},
     * {@link DiagnosticCode#DELETE_OUTPUT_CLAUSE_NOT_SUPPORTED},
     * {@link DiagnosticCode#DELETE_ORDER_BY_OR_LIMIT_NOT_SUPPORTED}.
     *
     * <p>WHERE-side subqueries reuse the existing
     * {@link DiagnosticCode#WHERE_HAS_SUBQUERY_NOT_SUPPORTED} (no
     * new DELETE-side code) — consistent with slice-80 UPDATE WHERE
     * handling. Window functions in WHERE / ON reuse
     * {@link DiagnosticCode#CLAUSE_WINDOW_FUNCTION_LEAK}.
     *
     * <p>IR shape (slice 84 changes from slice 81):
     * <ul>
     *   <li>{@code relations[]} — now carries TABLE-kind
     *       {@link RelationSource}s for joined-DELETE FROM-side
     *       sources, plus SUBQUERY-kind sources for {@code USING
     *       (SELECT …)} extractions. Slice 81 left it empty.
     *       Reference-identity filter excludes the target's own
     *       TTable instance; the slice-82 walker-order swap (target
     *       before relations[] in
     *       {@link gudusoft.gsqlparser.ir.semantic.SqlSemanticAnalyzer#collectCatalogMissWarnings})
     *       handles same-qualified-name target+driver collisions
     *       (e.g. MSSQL {@code DELETE FROM t FROM t spqh JOIN sp}).</li>
     *   <li>{@code joinColumnRefs[]} — now carries ON-clause refs
     *       collected from each JoinItem under a per-DELETE
     *       {@link java.util.LinkedHashSet} for cross-JoinItem dedup
     *       (slice-82 codex round-1 Q2 BLOCKING precedent).</li>
     *   <li>The DELETE itself emits NO new cross-stmt
     *       {@link LineageEdge}s — empty {@code outputColumns[]}
     *       means there is no STATEMENT_OUTPUT(deleteIdx, …) anchor
     *       for slice-83's SUBQUERY-kind emitter. Extracted
     *       FROM-subqueries DO emit their own internal lineage edges
     *       via {@code emitLineageForStatement} inside
     *       {@link #processDirectSubqueryTable}.</li>
     * </ul>
     */
    /**
     * Build under caller-supplied {@code options}; see
     * {@link #build(TSelectSqlStatement, NameBindingProvider, SemanticIRBuildOptions)}.
     */
    public static SemanticBuildResult buildDeleteResult(
            TDeleteSqlStatement delete, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildDeleteImpl(delete, provider));
    }

    /** Build a DELETE and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildDeleteResult(
            TDeleteSqlStatement delete, NameBindingProvider provider) {
        return buildDeleteResult(delete, provider,
                SemanticIRBuildOptions.defaults());
    }

    @Deprecated
    public static SemanticProgram buildDelete(TDeleteSqlStatement delete,
                                     NameBindingProvider provider,
                                     SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildDeleteResult(delete, provider, options));
    }

    @Deprecated
    public static SemanticProgram buildDelete(TDeleteSqlStatement delete,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildDeleteResult(delete, provider));
    }

    private static SemanticProgram buildDeleteImpl(TDeleteSqlStatement delete,
                                                   NameBindingProvider provider) {
        if (delete == null) {
            throw new IllegalArgumentException("delete must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }

        // 1) Slice 106 — admit top-level WITH on DELETE. Walks the CTE
        // list left-to-right, building each body as a preceding
        // StatementGraph and producing cteNameToStatementIndex +
        // ctePublishedColumns for the FROM-as-CTE branch in
        // buildDeleteRelation below. Mirrors the slice-105 UPDATE
        // walker. `stmts` / `lineage` allocated here (hoisted from the
        // prior slice-84 location) so the CTE walker can append.
        // DELETE_CTE_NOT_SUPPORTED stays declared-but-unreached
        // (slice 71/72/82/86/95/96/97/98/99/100/101/102/103/104/105
        // precedent).
        List<StatementGraph> stmts = new ArrayList<>();
        List<LineageEdge> lineage = new ArrayList<>();
        Map<String, List<String>> ctePublishedColumns = new LinkedHashMap<>();
        Map<String, Integer> cteNameToStatementIndex = buildDeleteCteList(
                delete, provider, stmts, lineage, ctePublishedColumns);

        // 2) Target table — defensive (parser usually rejects first).
        TTable targetTable = delete.getTargetTable();
        if (targetTable == null || targetTable.getTableName() == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_TARGET_MISSING,
                    "DELETE statement has no resolvable target table",
                    delete));
        }
        String targetQName = targetTable.getTableName().toString();
        if (targetQName == null || targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_TARGET_MISSING,
                    "DELETE target table name is empty",
                    delete));
        }

        // 3) Slice 84 / Slice 92 — joined-DELETE discriminator.
        // Parser-probe-verified shapes:
        //   - Admit (slice 84): PG `DELETE FROM t USING j` / MSSQL
        //     `DELETE FROM t FROM t spqh JOIN sp` / MSSQL `DELETE spqh
        //     FROM t spqh JOIN sp` / Snowflake DELETE-USING — all have
        //     joins.size=0 and referenceJoins.size > 0.
        //   - Admit (slice 92): MySQL `DELETE T1 FROM T1 [WHERE pred]`
        //     self-reference — joins.size=1, refJoins.size=1, and all
        //     three names (joins[0].table, refJoins[0].table, target)
        //     agree case-insensitively. Semantically identical to
        //     `DELETE FROM T1 [WHERE pred]`; produces the same IR shape.
        //   - Reject (slice-81 code preserved for non-self-ref):
        //     MySQL `DELETE T1, T2 FROM …` (joins.size=2) and
        //     MySQL `DELETE FROM T1 USING T1, T2` (refJoins.size=2).
        //
        // Slice 84 drops the slice-81 `tables.size > 1` and
        // `fromSourceJoin != null` blanket rejects (both fire for
        // admit shapes; probe confirms no parser-reachable shape
        // needs them when joins.size == 0). Candidate (d) in §8.1.4
        // (Hive multi-insert) remains open for a future slice.
        boolean mysqlSelfRef = false;
        if (delete.joins != null && delete.joins.size() > 0) {
            // Slice 92 — admit MySQL self-reference form:
            //   DELETE T1 FROM T1 [WHERE …]
            // The check requires all three names to match (codex
            // plan-review rounds Q1+Q5 BLOCKING fix: checking only
            // joins[0] is insufficient — DELETE T1 FROM T2 would
            // incorrectly admit because joins[0]=T1=target but
            // refJoins[0]=T2≠target).
            mysqlSelfRef = isMysqlSelfReferenceDelete(delete, targetQName);
            if (!mysqlSelfRef) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.DELETE_JOINED_NOT_SUPPORTED,
                        "DELETE with multi-target / multi-USING clause is "
                                + "not supported by SemanticIRBuilder.buildDelete; "
                                + "slice 84 admits PG `DELETE FROM t USING j` and "
                                + "MSSQL `DELETE FROM t FROM t JOIN s` shapes; "
                                + "slice 92 admits MySQL "
                                + "`DELETE T1 FROM T1 [WHERE …]` self-reference",
                        delete));
            }
        }

        // 4) Slice 85 lifts the RETURNING / OUTPUT rejects on DELETE.
        // The cheap statement-level OUTPUT_INTO reject fires here so a
        // multi-violation shape routes to the cheaper structural code
        // first. {@code DELETE_RETURNING_CLAUSE_NOT_SUPPORTED} and
        // {@code DELETE_OUTPUT_CLAUSE_NOT_SUPPORTED} stay declared but
        // unreached (slice 71/72 retain-for-documentation precedent).
        if (delete.getOutputClause() != null
                && delete.getOutputClause().getIntoTable() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.OUTPUT_INTO_NOT_SUPPORTED,
                    "DELETE OUTPUT ... INTO <target> writes a second target; "
                            + "slice 85 admits projection-only OUTPUT",
                    delete));
        }
        if (delete.getOrderByClause() != null
                || delete.getLimitClause() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_ORDER_BY_OR_LIMIT_NOT_SUPPORTED,
                    "DELETE with ORDER BY / LIMIT (MySQL) is not "
                            + "supported by SemanticIRBuilder.buildDelete; "
                            + "slice 81 admits no row-pruning on DELETE",
                    delete));
        }

        // 4.7) Slice 84 — extract FROM-subqueries from referenceJoins
        // (after slice 106's CTE walker so the CTE bodies precede any
        // extracted FROM-subquery in the program). Mirrors slice-83
        // UPDATE FROM-subquery extraction (which uses
        // update.getJoins()); here we use delete.getReferenceJoins().
        // buildDelete owns fresh local stmts/lineage lists (allocated
        // in step 1 above) so exceptions propagate cleanly to the
        // caller — no snapshot/rollback wrapper.
        //
        // Slice 106 — forward cteNameToStatementIndex +
        // ctePublishedColumns so a nested SELECT inside an extracted
        // FROM-subquery body can resolve outer-WITH CTE references
        // (Resolver2 wires CTEScope; the maps are forwarded for parity
        // with the SELECT / MERGE / UPDATE call sites and so the
        // §N test for `USING (SELECT … FROM cte) sub` produces the
        // expected cross-stmt edge to the CTE body).
        //
        // Decorate the provider with the outer-WITH CTE name set so
        // the SELECT-side {@link #buildRelation} routes references to
        // those names through {@link RelationKind#CTE} (rather than
        // TABLE), which in turn makes
        // {@link #emitLineageForStatement} emit the cross-stmt
        // {@code STATEMENT_OUTPUT(subIdx,col) →
        // STATEMENT_OUTPUT(cteIdx,col)} edge required by §N. This
        // mirrors the SELECT-side outer-WITH walker
        // (see {@link #build}'s {@code outerProvider}).
        NameBindingProvider providerWithCte = cteNameToStatementIndex.isEmpty()
                ? provider
                : provider.withCteContext(cteNameToStatementIndex.keySet());
        Map<String, Integer> subqueryAliasToIndex =
                extractDeleteFromSubqueries(delete, providerWithCte, stmts, lineage,
                        cteNameToStatementIndex, ctePublishedColumns);
        Map<String, List<String>> deleteInScope = buildDeleteInScopeMap(
                delete, subqueryAliasToIndex, stmts,
                cteNameToStatementIndex, ctePublishedColumns);
        NameBindingProvider providerWithStar = deleteInScope.isEmpty()
                ? providerWithCte
                : providerWithCte.withInScopeRelationColumns(deleteInScope);

        // 5) WHERE refs — slice 111 lifts the slice-81 blanket subquery
        // reject by routing uncorrelated predicate-subquery wrappers
        // (IN-SELECT / EXISTS / NOT EXISTS / scalar comparison /
        // ANY-ALL-SOME) through the slice-23+ JOIN-ON extraction pipeline
        // refactored by slice 110 to take a PredicateClauseContext. The
        // new DELETE_WHERE constant carries clause-specific
        // DiagnosticCode IDs (8 new DELETE_WHERE_* codes) and a
        // "DELETE WHERE clause" label. Each extracted wrapper lands as
        // its own <predicate_subquery_<i>> StatementGraph BEFORE the
        // DELETE (deleteIdx below = stmts.size() naturally accounts for
        // them — slice-83 dynamic-index pattern, slice 110 UPDATE
        // precedent). Remaining non-subquery refs flow into
        // filterColumnRefs via collectColumnRefsSkipping (or
        // collectColumnRefsTolerant on the slice-92 MySQL self-ref
        // path). Window functions in non-subquery subtrees still reject
        // via rejectWindowFunctionInScopeSkipping. Slice 84 —
        // providerWithStar so WHERE refs against extracted subquery
        // aliases bind correctly (slice-83 precedent).
        //
        // Slice 106 — providerWithCte (then providerWithStar on top of
        // it) already decorates the provider with the outer-WITH CTE
        // name set so the predicate body's inner SELECT routes
        // `FROM cte` refs through RelationKind.CTE and
        // emitLineageForStatement emits the
        // STATEMENT_OUTPUT(subIdx,col) → STATEMENT_OUTPUT(cteIdx,col)
        // cross-stmt edge (slice 110 UPDATE precedent).
        List<ColumnRef> filterRefs;
        TWhereClause where = delete.getWhereClause();
        if (where == null || where.getCondition() == null) {
            filterRefs = Collections.<ColumnRef>emptyList();
        } else {
            Set<TExpression> extractedWhereRoots =
                    Collections.<TExpression>emptySet();
            if (containsAnySubquery(where)) {
                extractedWhereRoots =
                        extractUncorrelatedPredicateSubqueriesFromClause(
                                where.getCondition(), providerWithStar,
                                stmts, lineage, cteNameToStatementIndex,
                                PredicateClauseContext.DELETE_WHERE);
                rejectAnyRemainingSubqueriesFromClause(
                        where.getCondition(), extractedWhereRoots,
                        PredicateClauseContext.DELETE_WHERE);
            }
            rejectWindowFunctionInScopeSkipping(where, "WHERE clause",
                    extractedWhereRoots);
            // Codex diff-review P1 fix: for MySQL self-reference DELETE the
            // MySQL parser puts 3 T1 instances in stmt.tables (target +
            // joins[0] + refJoins[0]), making Resolver2's inferredCandidates
            // see 3 candidates for any unqualified column → NOT_FOUND →
            // COLUMN_BINDING_NON_EXACT. Use a tolerant collector for the
            // self-ref path: EXACT_MATCH bindings (qualified refs) are
            // preserved verbatim; non-exact bindings emit the column ref with
            // the SQL-written qualifier (null for unqualified refs) instead of
            // throwing. Qualified refs like WHERE T1.id = 1 still get full
            // EXACT_MATCH treatment; only WHERE id = 1 (no qualifier) falls
            // back to the tolerant path. Slice 111 — both helpers now skip
            // extracted predicate-subquery subtrees so inner refs do not
            // leak into outer filterColumnRefs.
            filterRefs = mysqlSelfRef
                    ? collectColumnRefsTolerant(where, providerWithStar,
                            targetQName, extractedWhereRoots)
                    : collectColumnRefsSkipping(where, providerWithStar,
                            extractedWhereRoots);
        }

        // 5.5) Slice 84 — walk delete.getReferenceJoins() to populate
        // relations[] (TABLE-kind FROM-side sources, target excluded
        // by reference identity; SUBQUERY-kind for USING (SELECT …))
        // and joinColumnRefs[] (ON-clause refs across all JoinItems).
        // Mirrors slice-82 buildUpdate's FROM walk, with the
        // `update.getJoins()` source replaced by
        // `delete.getReferenceJoins()`.
        //
        // Slice 92 — for MySQL self-reference DELETE T1 FROM T1,
        // refJoins[0] is the same table as the target; skip the loop
        // so relations[] stays empty (mirrors the slice-81 single-target
        // contract). Resolver2's ScopeBuilder has already registered
        // the FROM-clause table (including any alias) via the
        // `referenceJoins` walk in preVisit(TDeleteSqlStatement), so
        // WHERE refs resolve correctly even without a relations[] entry.
        List<RelationSource> relations = new ArrayList<>();
        // Slice-82 codex round-1 Q2 BLOCKING precedent — joinRefs
        // accumulates across multiple JoinItems in chained-JOIN
        // shapes. LinkedHashSet ensures cross-JoinItem dedup.
        java.util.LinkedHashSet<ColumnRef> joinRefsSet =
                new java.util.LinkedHashSet<>();
        TJoinList refJoins = delete.getReferenceJoins();
        if (!mysqlSelfRef && refJoins != null) {
            for (int ji = 0; ji < refJoins.size(); ji++) {
                TJoin join = refJoins.getJoin(ji);
                TTable leftTable = join.getTable();
                // Slice 106 — threads cteNameToStatementIndex so the
                // FROM-driver buildDeleteRelation call can route
                // objectname-typed CTE references to a SUBQUERY-kind
                // RelationSource pointing at the CTE statement.
                buildDeleteRelation(leftTable, targetTable, relations, delete,
                        cteNameToStatementIndex);
                TJoinItemList items = join.getJoinItems();
                if (items == null) continue;
                for (int i = 0; i < items.size(); i++) {
                    TJoinItem item = items.getJoinItem(i);
                    // Slice 106 — threads cteNameToStatementIndex through
                    // the JoinItem walker so JOIN-side CTE refs (MSSQL
                    // `FROM target t JOIN cte ON …`) get SUBQUERY-kind
                    // RelationSource emission.
                    buildDeleteJoinItem(item, targetTable, providerWithStar,
                            relations, joinRefsSet, delete,
                            cteNameToStatementIndex);
                }
            }
        }
        List<ColumnRef> joinRefs = new ArrayList<>(joinRefsSet);

        // 6) Build the DELETE outer.
        // - relations[] may be non-empty for joined DELETE (slice 84);
        //   empty for single-target DELETE (slice 81 contract).
        // - target.columns empty by design — DELETE removes whole rows.
        RelationBinding targetBinding = new RelationBinding(
                RelationKind.TABLE, targetQName);
        TargetRelation target = new TargetRelation(
                targetBinding, Collections.<String>emptyList());

        // Slice 85 — build RETURNING / OUTPUT projection columns BEFORE
        // the StatementGraph so the new returningColumns slot can be
        // populated. deleteIdx mirrors the slice-84 stmts.size() pattern.
        int deleteIdx = stmts.size();
        // DELETE target alias = effective alias from the target's
        // TTable (slice-84 convention).
        String deleteTargetAlias = effectiveAliasOf(targetTable);
        if (deleteTargetAlias == null || deleteTargetAlias.isEmpty()) {
            deleteTargetAlias = targetQName;
        }
        // Slice 123 — combine slice-84 FROM-subquery aliases with slice-106
        // CTE-as-relation aliases so a RETURNING/OUTPUT ref to a SUBQUERY-
        // kind FROM-side relation column emits the cross-stmt
        // STATEMENT_OUTPUT → STATEMENT_OUTPUT edge into the producer.
        Map<String, Integer> returningAliasToSubIdx =
                buildDeleteCombinedAliasToSubIdx(delete,
                        subqueryAliasToIndex, cteNameToStatementIndex);
        List<OutputColumn> returningColumns = buildReturningColumns(
                delete.getReturningClause(),
                delete.getOutputClause(),
                "DELETE",
                targetQName,
                deleteTargetAlias,
                /*targetTable=*/ targetTable,
                relations,
                returningAliasToSubIdx,
                providerWithStar,
                deleteIdx,
                lineage,
                delete);

        StatementGraph deleteStmt = new StatementGraph(
                /*name=*/ null,
                "DELETE",
                relations,
                /*outputColumns=*/ Collections.<OutputColumn>emptyList(),
                returningColumns,
                filterRefs,
                joinRefs,
                /*groupByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinctOnColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ null,
                /*rowLimit=*/ null,
                target);

        stmts.add(deleteStmt);
        // Slice 85 — extracted FROM-subqueries have already emitted
        // their own internal lineage edges into `lineage` via
        // processDirectSubqueryTable; buildReturningColumns also
        // already appended STATEMENT_OUTPUT(deleteIdx, retName) →
        // TABLE_COLUMN(targetQName, baseCol) edges above. No further
        // edges are needed.
        return new SemanticProgram(stmts, lineage);
    }

    /**
     * Slice 94 — admit the single-target MERGE skeleton:
     * <pre>
     *     MERGE INTO target [AS] tgt
     *     USING (source_table | (SELECT ...) ) [AS] src
     *     ON  &lt;join condition&gt;
     *     WHEN MATCHED      [AND &lt;cond&gt;] THEN UPDATE SET c1 = expr1 [, ...]
     *     WHEN NOT MATCHED  [AND &lt;cond&gt;] THEN INSERT [(c1, ...)] VALUES (expr1, ...)
     *     WHEN MATCHED      [AND &lt;cond&gt;] THEN DELETE
     * </pre>
     *
     * <p>Emits one {@code "MERGE"}-kind {@link StatementGraph} carrying:
     * <ul>
     *   <li>{@link TargetRelation} on {@code getTarget()} only — slice
     *       78/80 contract: target lives on the dedicated target slot,
     *       NOT in {@code relations[]}. The slice-77/79 catalog walker
     *       fires the kind-discriminated "MERGE target relation 'X'"
     *       message via {@code targetWarnMessage("MERGE")}.</li>
     *   <li>{@code relations[]} = one entry for the USING source
     *       (TABLE-kind base table or SUBQUERY-kind aliased subquery).
     *       The slice-77 FROM walker fires "FROM relation 'X'" for
     *       missing source.</li>
     *   <li>{@code outputColumns[]} = empty (MERGE has no projection).</li>
     *   <li>{@code joinColumnRefs[]} = ON condition refs + per-WHEN AND
     *       condition refs, LinkedHashSet-deduplicated (slice 82
     *       pattern).</li>
     *   <li>{@code filterColumnRefs[]} = per-WHEN action WHERE refs
     *       (UPDATE WHERE, UPDATE...DELETE WHERE, INSERT WHERE; slice
     *       95). Empty when no action WHERE is present.</li>
     * </ul>
     *
     * <p>Per-WHEN action lineage:
     * <ul>
     *   <li>{@code WHEN MATCHED THEN UPDATE SET col_i = expr_i}: emit
     *       one {@link LineageEdge} per (target col, RHS source ref)
     *       pair as {@code TABLE_COLUMN(target,col) ← <ref>} — direct,
     *       no STATEMENT_OUTPUT intermediate (MERGE has no SELECT
     *       projection). Codex round-2 Q4 confirmed YES.</li>
     *   <li>{@code WHEN NOT MATCHED THEN INSERT (c1, ...) VALUES (e1, ...)}:
     *       same pattern — one edge per (insert col, source ref).</li>
     *   <li>{@code WHEN MATCHED THEN DELETE}: no per-column lineage
     *       (slice 81 DELETE contract).</li>
     *   <li>{@code WHEN MATCHED [AND <cond>] THEN DO NOTHING} (PG 15+,
     *       slice 96): admitted as a no-op action. No per-column
     *       lineage (slice 81 DELETE precedent). Per-WHEN AND
     *       condition refs still feed {@code joinColumnRefs[]} via
     *       the pre-dispatch block.</li>
     *   <li>{@code WHEN NOT MATCHED BY SOURCE [AND <cond>] THEN
     *       UPDATE SET ... | DELETE} (SQL Server, slice 97):
     *       admitted with the SQL Server semantic invariant that
     *       SET RHS and per-WHEN AND cond may not reference USING
     *       source columns (no source row exists when the action
     *       fires). Source-side refs reject with
     *       {@link DiagnosticCode#MERGE_NOT_MATCHED_BY_SOURCE_REFERENCES_SOURCE}.
     *       INSERT on BY SOURCE is parser-admitted but semantically
     *       invalid; rejects with
     *       {@link DiagnosticCode#MERGE_NOT_MATCHED_BY_SOURCE_INSERT_NOT_VALID}.
     *       UPDATE target self-refs ({@code t.a = t.b}) emit no
     *       lineage edges (slice-94 alias-filter convention; codex
     *       round-1 Q2 confirmed). PG 17+ BY SOURCE syntax still
     *       parses as type 2 plain NOT MATCHED in parser 4.1.5.0
     *       — that parser gap is not addressed in slice 97.</li>
     * </ul>
     *
     * <p>For USING-subquery, the inner SELECT is built via {@link #build}
     * and appended as a preceding {@link StatementGraph}; its inner
     * lineage edges are rebased by the current statement-list offset so
     * STATEMENT_OUTPUT indices stay valid (slice 78 INSERT pattern).
     *
     * <p>Resolver2 already handles MERGE via {@link gudusoft.gsqlparser.resolver2.scope.MergeScope}
     * — both USING base tables and USING subqueries surface as
     * {@code sourceTable + EXACT_MATCH} bindings on RHS / VALUES /
     * ON / WHEN-AND refs. Codex round-2 Q5 BLOCKING fix: we install
     * an explicit slice-83-style published-column map only for
     * USING subqueries (deterministic; cheap; matches the SELECT-
     * side FROM-subquery pattern even when redundant).
     */
    /**
     * Build under caller-supplied {@code options}; see
     * {@link #build(TSelectSqlStatement, NameBindingProvider, SemanticIRBuildOptions)}.
     */
    public static SemanticBuildResult buildMergeResult(
            TMergeSqlStatement merge, NameBindingProvider provider,
            SemanticIRBuildOptions options) {
        return executeBuild(options, () -> buildMergeImpl(merge, provider));
    }

    /** Build a MERGE and atomically return its program and diagnostics. */
    public static SemanticBuildResult buildMergeResult(
            TMergeSqlStatement merge, NameBindingProvider provider) {
        return buildMergeResult(merge, provider,
                SemanticIRBuildOptions.defaults());
    }

    @Deprecated
    public static SemanticProgram buildMerge(TMergeSqlStatement merge,
                                     NameBindingProvider provider,
                                     SemanticIRBuildOptions options) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildMergeResult(merge, provider, options));
    }

    @Deprecated
    public static SemanticProgram buildMerge(TMergeSqlStatement merge,
                                        NameBindingProvider provider) {
        clearBuildDiagnostics();
        return publishLegacyResult(buildMergeResult(merge, provider));
    }

    private static SemanticProgram buildMergeImpl(TMergeSqlStatement merge,
                                                  NameBindingProvider provider) {
        if (merge == null) {
            throw new IllegalArgumentException("merge must not be null");
        }
        if (provider == null) {
            throw new IllegalArgumentException("provider must not be null");
        }
        // Slice 94 — defensive UsingScope reset at entry. MERGE does
        // not produce its own UsingScope but a parent context might
        // (e.g. nested-statement contexts); mirrors slice 80 / 86
        // buildUpdate hygiene.
        provider = provider.withUsingScope(UsingScope.EMPTY);

        // Slice 101 — hoist allocations earlier so buildMergeCteList can
        // append CTE bodies as preceding statements. The slice-94 reject
        // at this location is replaced by the CTE walker below.
        List<StatementGraph> stmts = new ArrayList<>();
        List<LineageEdge> lineage = new ArrayList<>();

        // 1) Slice 101 — admit top-level WITH on MERGE. Walks CTE list
        // left-to-right, building each body as a preceding statement.
        // Produces cteNameToStatementIndex + ctePublishedColumns for the
        // USING-as-CTE branch below. Mirrors SELECT-side build() at
        // lines 516-653. `MERGE_CTE_NOT_SUPPORTED` stays declared-but-
        // unreached for API stability (slice 71/72/82/86/95/96/97/98/99/100
        // precedent).
        Map<String, List<String>> ctePublishedColumns = new LinkedHashMap<>();
        Map<String, Integer> cteNameToStatementIndex = buildMergeCteList(
                merge, provider, stmts, lineage, ctePublishedColumns);

        // 2) Target table — defensive.
        TTable targetTable = merge.getTargetTable();
        if (targetTable == null || targetTable.getTableName() == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_TARGET_MISSING,
                    "MERGE statement has no resolvable target table",
                    merge));
        }
        String targetQName = targetTable.getTableName().toString();
        if (targetQName == null || targetQName.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_TARGET_MISSING,
                    "MERGE target table name is empty",
                    merge));
        }

        // 3) USING source — defensive.
        TTable usingTable = merge.getUsingTable();
        if (usingTable == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_USING_SOURCE_MISSING,
                    "MERGE statement has no USING source",
                    merge));
        }

        // 4) ON condition — defensive (parser usually rejects first).
        TExpression onCondition = merge.getCondition();
        if (onCondition == null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_ON_CONDITION_MISSING,
                    "MERGE statement has no ON condition",
                    merge));
        }

        // 5) OUTPUT INTO / RETURNING / LIMIT / error logging rejects.
        // Slice 98 lifts MSSQL MERGE OUTPUT projection (non-INTO) via
        // the slice-85 buildReturningColumns walker; the actual call
        // is deferred until after step 8 because the walker needs the
        // populated relations[] (USING source). OUTPUT INTO continues
        // to reject (writes a second target). The RETURNING-clause
        // branch stays declared-but-unreached: PG parser drops
        // MERGE RETURNING silently, Oracle PARSE_FAILED, Couchbase
        // has no test reach (slice 71/72/82/86/95/96/97 precedent).
        if (merge.getOutputClause() != null
                && merge.getOutputClause().getIntoTable() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.OUTPUT_INTO_NOT_SUPPORTED,
                    "MERGE OUTPUT ... INTO <target> writes a second "
                            + "target; slice 98 admits OUTPUT projection only",
                    merge));
        }
        if (merge.getReturningClause() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_RETURNING_CLAUSE_NOT_SUPPORTED,
                    "MERGE RETURNING projection (Oracle / Couchbase) is "
                            + "not supported by SemanticIRBuilder.buildMerge",
                    merge));
        }
        if (merge.getLimitClause() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_LIMIT_NOT_SUPPORTED,
                    "MERGE with LIMIT (Couchbase) is not supported by "
                            + "SemanticIRBuilder.buildMerge",
                    merge));
        }
        if (merge.getErrorLoggingClause() != null) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_ERROR_LOGGING_NOT_SUPPORTED,
                    "MERGE LOG ERRORS INTO (Oracle) is not supported by "
                            + "SemanticIRBuilder.buildMerge",
                    merge));
        }

        // 6) Build USING source RelationSource. If USING is a subquery,
        // extract it as a preceding StatementGraph and emit a SUBQUERY-
        // kind RelationSource that points at it; slice-83 pattern.
        // Otherwise emit a TABLE-kind RelationSource.
        // Slice 101 — `stmts` / `lineage` were hoisted to the top of
        // buildMerge so the CTE walker can append its preceding CTE
        // body statements first. Do NOT re-declare them here.
        String usingAlias = effectiveAliasOf(usingTable);
        if (usingAlias == null || usingAlias.isEmpty()) {
            usingAlias = (usingTable.getName() == null
                    || usingTable.getName().toString().isEmpty())
                    ? "__merge_using__"
                    : usingTable.getName().toString();
        }
        boolean usingIsSubquery = usingTable.getTableType()
                == gudusoft.gsqlparser.ETableSource.subquery;
        List<RelationSource> relations = new ArrayList<>();
        Map<String, List<String>> mergeInScope = new LinkedHashMap<>();
        NameBindingProvider providerWithStar = provider;
        // Slice 94 — alias resolution maps for the per-WHEN action
        // lineage emitter. TABLE-kind sources map alias → qualifiedName;
        // SUBQUERY-kind sources map alias → statement index of the
        // extracted inner SELECT. A SEPARATE `targetAliases` set
        // identifies refs whose relationAlias is the target alias
        // (codex round-1 diff Q1 BLOCKING — without this separation,
        // a self-merge where USING happens to share the target's name
        // would mis-classify the source alias as the target alias).
        Map<String, String> aliasToTableQName = new HashMap<>();
        Map<String, Integer> aliasToSubIdx = new HashMap<>();
        Set<String> targetAliases = new HashSet<>();
        String targetAlias = effectiveAliasOf(targetTable);
        if (targetAlias != null && !targetAlias.isEmpty()) {
            targetAliases.add(targetAlias.toLowerCase(Locale.ROOT));
        }
        targetAliases.add(targetQName.toLowerCase(Locale.ROOT));
        if (usingIsSubquery) {
            TSelectSqlStatement usingSelect = usingTable.getSubquery();
            if (usingSelect == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.MERGE_SOURCE_NOT_SUPPORTED,
                        "MERGE USING declared as subquery but no inner "
                                + "SELECT statement was attached",
                        merge));
            }
            // Slice 122 — close the slice-110 documented parity gap so a
            // USING body that references an outer MERGE CTE
            // (`WITH cte AS (...) MERGE INTO t USING (SELECT ... FROM cte) s`)
            // binds CTE-kind and emits the cross-stmt edge into the CTE body.
            // Build the USING body directly into the SHARED stmts/lineage via
            // buildSelectProgramInto (no rebase — see its javadoc for the full
            // rationale), seeded with a COPY of the outer MERGE's CTE maps.
            // The COPY (not the live map) keeps a USING-body-own CTE from
            // leaking into the outer cteNameToStatementIndex consulted later
            // by the slice-116 action-WHERE extractor and the USING-as-CTE
            // `else` branch — matching pre-slice-122, where own-WITH CTEs were
            // never registered in the outer map.
            Map<String, Integer> usingCteMap =
                    new HashMap<>(cteNameToStatementIndex);
            Map<String, List<String>> usingCtePublished =
                    new LinkedHashMap<>(ctePublishedColumns);
            int subIdx = buildSelectProgramInto(usingSelect, provider,
                    stmts, lineage, usingCteMap, usingCtePublished);
            // Codex round-2 Q5 BLOCKING fix: install slice-83-style
            // in-scope map for USING subquery columns, scoped only to
            // the USING alias (codex round-3 Q2: ensure scoped to
            // USING alias only, no override of target / base-table).
            StatementGraph usingOuter = stmts.get(subIdx);
            List<String> publishedCols = new ArrayList<>();
            for (OutputColumn oc : usingOuter.getOutputColumns()) {
                if (oc.getName() != null && !oc.getName().isEmpty()) {
                    publishedCols.add(oc.getName());
                }
            }
            mergeInScope.put(
                    usingAlias.toLowerCase(Locale.ROOT), publishedCols);
            providerWithStar = provider.withInScopeRelationColumns(
                    mergeInScope);
            relations.add(new RelationSource(usingAlias,
                    new RelationBinding(RelationKind.SUBQUERY, usingAlias)));
            aliasToSubIdx.put(
                    usingAlias.toLowerCase(Locale.ROOT), subIdx);
        } else {
            // Slice 101 — USING-as-CTE detection. When MERGE has a WITH
            // clause and the USING bare name matches a CTE declared in
            // that WITH clause, route to a SUBQUERY-kind RelationSource
            // pointing at the CTE's already-built statement index. This
            // ensures:
            //   (a) lineage edges flow to STATEMENT_OUTPUT(cteIdx, col),
            //       not the fictitious TABLE_COLUMN(cteName, col);
            //   (b) the slice-77 catalog-miss WARN walker (which walks
            //       only TABLE-kind RelationSources) skips the CTE name;
            //   (c) Resolver2-bound CTE refs (probe 2026-05-17: status
            //       EXACT_MATCH with sourceTable=<cteName>) flow through
            //       the same emitMergeLineageEdge dispatch.
            // Case-insensitive lookup matches SQL identifier semantics.
            String usingBareName = (usingTable.getName() == null)
                    ? ""
                    : usingTable.getName().toString();
            String usingBareNameLower =
                    usingBareName.toLowerCase(Locale.ROOT);
            Integer cteIdx = usingBareNameLower.isEmpty()
                    ? null
                    : cteNameToStatementIndex.get(usingBareNameLower);
            if (cteIdx != null) {
                // USING references a declared CTE.
                List<String> publishedCols = ctePublishedColumns.get(
                        usingBareNameLower);
                if (publishedCols == null) {
                    publishedCols = new ArrayList<>();
                }
                mergeInScope.put(
                        usingAlias.toLowerCase(Locale.ROOT),
                        publishedCols);
                providerWithStar = provider.withInScopeRelationColumns(
                        mergeInScope);
                relations.add(new RelationSource(usingAlias,
                        new RelationBinding(
                                RelationKind.SUBQUERY, usingAlias)));
                aliasToSubIdx.put(
                        usingAlias.toLowerCase(Locale.ROOT), cteIdx);
                // Also register the bare CTE name in case the SQL
                // omits the alias (e.g. `USING src ON ...` with no
                // trailing alias). Mirrors the TABLE-kind branch
                // (line below) which also registers the bare name.
                aliasToSubIdx.put(usingBareNameLower, cteIdx);
            } else {
                // TABLE-kind USING — use the source table's qualified name
                // as the binding's qualifiedName so the slice-77 catalog
                // walker can find it.
                String usingQName = (usingTable.getTableName() == null)
                        ? usingAlias
                        : usingTable.getTableName().toString();
                relations.add(new RelationSource(usingAlias,
                        new RelationBinding(RelationKind.TABLE, usingQName)));
                aliasToTableQName.put(
                        usingAlias.toLowerCase(Locale.ROOT), usingQName);
                // Also register the bare name in case the SQL omits the
                // alias (e.g. `USING managers ON ...` without `s`).
                aliasToTableQName.put(
                        usingQName.toLowerCase(Locale.ROOT), usingQName);
            }
        }

        // 7) Walk ON condition + per-WHEN AND conditions to build
        // joinColumnRefs[] with LinkedHashSet dedup (slice 82 pattern).
        // Reject ON-side subqueries: not supported in this slice; users
        // can still use a USING subquery for complex source logic.
        if (containsAnySubqueryExpression(onCondition)) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_WHEN_CONDITION_HAS_SUBQUERY_NOT_SUPPORTED,
                    "MERGE ON condition contains a subquery; slice 94 "
                            + "admits scalar-only ON conditions",
                    merge));
        }
        rejectWindowFunctionInScope(onCondition, "MERGE ON condition");
        LinkedHashSet<ColumnRef> joinRefsSet = new LinkedHashSet<>();
        joinRefsSet.addAll(collectColumnRefs(onCondition, providerWithStar));
        // Slice 95 — per-WHEN action WHERE refs (UPDATE WHERE,
        // UPDATE...DELETE WHERE, INSERT WHERE) accumulate here.
        // Slice 94 left these refs silently dropped; slice 95 routes
        // them through filterColumnRefs[] (slice-80 UPDATE WHERE
        // precedent) — distinct from joinColumnRefs[] which holds
        // ON + WHEN-AND match conditions.
        LinkedHashSet<ColumnRef> filterRefsSet = new LinkedHashSet<>();

        // 8) Per-WHEN clause loop. Validate type, dispatch to action
        // builder, accumulate joinColumnRefs and lineage edges.
        TargetRelation targetRel = null;
        List<String> targetColumnNames = new ArrayList<>();
        // Stable-order map: target col spelling (lower-cased) →
        // verbatim spelling encountered first. Iterating WHEN clauses
        // in order naturally produces SET-LHS first, then INSERT
        // column-list, matching the plan v3 column ordering rule.
        Map<String, String> seenTargetCols = new LinkedHashMap<>();
        // LineageEdge dedup spans the whole MERGE on
        // (target column lower-case, source ref lower-case key).
        Set<String> emittedEdgeKeys = new HashSet<>();

        if (merge.getWhenClauses() == null
                || merge.getWhenClauses().size() == 0) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_WHEN_NO_ACTION,
                    "MERGE statement has no WHEN clauses",
                    merge));
        }
        // Slice 116 — providerWithCteForActionWhere decorates
        // providerWithStar with withCteContext so the predicate body's
        // inner SELECT's `FROM cte` refs route through
        // RelationKind.CTE (slice 110 documented this is required for
        // emitLineageForStatement to emit STATEMENT_OUTPUT →
        // STATEMENT_OUTPUT edges into the CTE body). Hoisted here once
        // (cteNameToStatementIndex is finalized by line 3856 well
        // before the per-WHEN loop; recomputing per-WHEN would be
        // wasteful — codex diff-review Q1 advisory). The decoration
        // is scoped to collectMergeActionWhere only; providerWithStar
        // elsewhere stays unchanged so the WHEN AND condition (line
        // ~4153) and per-action SET/INSERT walkers see the original
        // provider — they already have their own slice-94 subquery
        // rejects so no asymmetric resolution surfaces.
        final NameBindingProvider providerWithCteForActionWhere =
                cteNameToStatementIndex.isEmpty()
                        ? providerWithStar
                        : providerWithStar.withCteContext(
                                cteNameToStatementIndex.keySet());
        // Slice 118 — build the MERGE correlation scope once (target +
        // USING source + outer CTEs) and thread through every per-WHEN
        // action WHERE call so correlated predicate subqueries promote
        // outer-aliased refs into OUTER_REFERENCE relations instead of
        // rejecting them. Mirrors the slice-117 pattern (UPDATE
        // SET-RHS correlated scalars). The scope is null-safe — every
        // value type inside flows from already-computed buildMerge
        // state (targetTable / usingTable / aliasToSubIdx /
        // cteNameToStatementIndex).
        final EnclosingScope mergeCorrelationScope =
                buildMergeEnclosingScope(merge, cteNameToStatementIndex,
                        aliasToSubIdx);
        for (int wi = 0; wi < merge.getWhenClauses().size(); wi++) {
            TMergeWhenClause when = merge.getWhenClauses().getElement(wi);
            // Slice 97 — BY SOURCE variants (SQL Server admits parser
            // types 7 / 8) are now admitted. PG 17+ syntax still parses
            // as type 2 (parser gap; slice 97 does not address). The
            // legacy MERGE_WHEN_NOT_MATCHED_BY_SOURCE_NOT_SUPPORTED
            // code stays declared-but-unreached (slice 71/72/82/86/95/96
            // precedent).
            boolean isNotMatchedBySource =
                    when.getType() == TMergeWhenClause.not_matched_by_source
                    || when.getType()
                        == TMergeWhenClause.not_matched_by_source_with_condition;
            // Per-WHEN AND condition (matched_with_condition,
            // not_matched_with_condition, not_matched_by_target_with_condition,
            // not_matched_by_source_with_condition).
            TExpression whenCond = when.getCondition();
            if (whenCond != null) {
                if (containsAnySubqueryExpression(whenCond)) {
                    throw new SemanticIRBuildException(Diagnostic.error(
                            DiagnosticCode.MERGE_WHEN_CONDITION_HAS_SUBQUERY_NOT_SUPPORTED,
                            "MERGE WHEN AND condition contains a subquery; "
                                    + "slice 94 admits scalar-only WHEN "
                                    + "conditions",
                            merge));
                }
                rejectWindowFunctionInScope(whenCond, "MERGE WHEN AND condition");
                List<ColumnRef> condRefs =
                        collectColumnRefs(whenCond, providerWithStar);
                // Slice 97 — BY SOURCE branches forbid source-side
                // refs in the AND condition (no source row exists).
                if (isNotMatchedBySource) {
                    rejectSourceRefsForBySource(condRefs, aliasToTableQName,
                            aliasToSubIdx, "MERGE WHEN NOT MATCHED BY SOURCE "
                                    + "AND condition", merge);
                }
                joinRefsSet.addAll(condRefs);
            }
            // Dispatch to action. Slice 96 — DO NOTHING is a no-op
            // action (PG 15+): no SET/INSERT VALUES, no per-column
            // lineage (slice-81 DELETE precedent). Per-WHEN AND
            // condition refs were already collected into joinRefsSet
            // above. MERGE_DO_NOTHING_NOT_SUPPORTED stays declared-
            // but-unreached for API stability (slice 71/72/82/86/95
            // precedent).
            boolean isDoNothingAction = when.getDoNothingClause() != null;
            TMergeUpdateClause upd = when.getUpdateClause();
            TMergeInsertClause ins = when.getInsertClause();
            boolean isDeleteAction = when.getDeleteClause() != null;
            if (upd == null && ins == null && !isDeleteAction
                    && !isDoNothingAction) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.MERGE_WHEN_NO_ACTION,
                        "MERGE WHEN clause #" + (wi + 1)
                                + " has no UPDATE / INSERT / DELETE / "
                                + "DO NOTHING action",
                        merge));
            }
            // Slice 95 — collect per-WHEN action WHERE refs into
            // filterRefsSet. Slice 116 — uncorrelated predicate-subquery
            // wrappers in those WHEREs now extract through the slice-23+
            // pipeline via PredicateClauseContext.MERGE_WHEN_WHERE
            // (mirrors slice 110-114 lifts on UPDATE / DELETE / SELECT /
            // set-op branch / CTE-body WHEREs). Window functions still
            // reject via rejectWindowFunctionInScopeSkipping (slice 95
            // contract preserved). MERGE_UPDATE_DELETE_WHERE_NOT_SUPPORTED
            // remains declared-but-unreached (slice 71/72/82/86
            // precedent). The providerWithCteForActionWhere decoration
            // is hoisted ABOVE the per-WHEN loop (codex diff-review Q1
            // advisory) since cteNameToStatementIndex is finalized
            // before the loop.
            if (upd != null) {
                collectMergeActionWhere(upd.getUpdateWhereClause(),
                        "MERGE WHEN action UPDATE WHERE",
                        providerWithCteForActionWhere, filterRefsSet,
                        stmts, lineage, cteNameToStatementIndex, merge,
                        mergeCorrelationScope);
                collectMergeActionWhere(upd.getDeleteWhereClause(),
                        "MERGE WHEN action DELETE WHERE",
                        providerWithCteForActionWhere, filterRefsSet,
                        stmts, lineage, cteNameToStatementIndex, merge,
                        mergeCorrelationScope);
            }
            if (ins != null) {
                collectMergeActionWhere(ins.getInsertWhereClause(),
                        "MERGE WHEN action INSERT WHERE",
                        providerWithCteForActionWhere, filterRefsSet,
                        stmts, lineage, cteNameToStatementIndex, merge,
                        mergeCorrelationScope);
            }
            // Slice 97 — BY SOURCE forbids INSERT semantically. MSSQL
            // parser admits the shape, so Semantic IR rejects.
            if (isNotMatchedBySource && ins != null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.MERGE_NOT_MATCHED_BY_SOURCE_INSERT_NOT_VALID,
                        "MERGE WHEN NOT MATCHED BY SOURCE THEN INSERT is "
                                + "not a valid SQL Server action; INSERT only "
                                + "applies when the source row has no target "
                                + "match. Slice 97 admits UPDATE / DELETE on "
                                + "BY SOURCE branches.",
                        merge));
            }
            if (upd != null) {
                // Slice 97 — pre-walk SET RHS refs for BY SOURCE
                // branches to reject source-side refs before lineage
                // emission (Q1 in plan-review: keep helper branch-
                // agnostic; double-collect cost is bounded since
                // BY SOURCE UPDATEs are small).
                if (isNotMatchedBySource) {
                    rejectBySourceSetRhsRefs(upd, providerWithStar,
                            aliasToTableQName, aliasToSubIdx, merge);
                }
                buildMergeUpdateAction(upd, targetQName, targetTable,
                        providerWithStar, seenTargetCols, lineage,
                        emittedEdgeKeys, aliasToTableQName,
                        aliasToSubIdx, targetAliases, merge);
            }
            if (ins != null) {
                buildMergeInsertAction(ins, targetQName, targetTable,
                        providerWithStar, seenTargetCols, lineage,
                        emittedEdgeKeys, aliasToTableQName,
                        aliasToSubIdx, targetAliases, merge);
            }
            // DELETE action: no per-column lineage (slice 81 contract).
        }

        // 9) Build TargetRelation from accumulated target column spellings.
        for (String spelling : seenTargetCols.values()) {
            targetColumnNames.add(spelling);
        }
        targetRel = new TargetRelation(
                new RelationBinding(RelationKind.TABLE, targetQName),
                targetColumnNames);

        // 9.5) Slice 98 — MSSQL MERGE OUTPUT projection. Reuses the
        // slice-85 buildReturningColumns walker with dmlKind="MERGE":
        // Pass 1.5's INSERT/DELETE pseudo-table mismatch check naturally
        // skips (MERGE is action-polymorphic — INSERTED and DELETED
        // may both legitimately appear). The walker handles $action via
        // a slice-98-specific short-circuit (derived OutputColumn, no
        // sources, no edges). mergeIdx = stmts.size() because the MERGE
        // StatementGraph is appended below; for USING-subquery shapes,
        // step 6 has already appended the extracted SELECT so the index
        // points at the upcoming MERGE position (slice-83 dynamic-index
        // pattern). Pass relations[] as fromSideRelations so unique
        // USING-alias matches resolve to the source qname (codex Q4).
        int mergeIdx = stmts.size();
        String mergeTargetAlias = effectiveAliasOf(targetTable);
        if (mergeTargetAlias == null || mergeTargetAlias.isEmpty()) {
            mergeTargetAlias = targetQName;
        }
        List<OutputColumn> returningCols = buildReturningColumns(
                /*ret=*/ null,
                /*out=*/ merge.getOutputClause(),
                "MERGE",
                targetQName,
                mergeTargetAlias,
                targetTable,
                /*fromSideRelations=*/ relations,
                // Slice 124 — MERGE OUTPUT USING-source lineage unification
                // (symmetric follow-up to slice 123, which lifted DELETE +
                // UPDATE). aliasToSubIdx is already the MERGE combined
                // alias→stmt-index map: it holds the USING alias for both the
                // USING-(SELECT) subquery branch (alias→subIdx) and the
                // USING-as-CTE branch (alias→cteIdx); both add a SUBQUERY-kind
                // relation to relations[], so returningSubquerySourceIndex
                // promotes a MERGE OUTPUT ref bound to the USING source to the
                // canonical STATEMENT_OUTPUT(mergeIdx, ret) →
                // STATEMENT_OUTPUT(subOrCteIdx, col) edge instead of the
                // fictitious TABLE_COLUMN(<usingAlias>, col). TABLE-kind USING
                // adds nothing to aliasToSubIdx, and INSERTED/DELETED/target
                // refs are excluded by the gate, so those paths keep their
                // slice-85/98 TABLE_COLUMN edge.
                /*fromSideAliasToStmtIndex=*/ aliasToSubIdx,
                providerWithStar,
                mergeIdx,
                lineage,
                merge);

        // 10) Emit StatementGraph. joinColumnRefs[] = ON + WHEN-AND refs.
        // Slice 95: filterColumnRefs[] = per-WHEN action WHERE refs
        // (UPDATE WHERE, UPDATE...DELETE WHERE, INSERT WHERE).
        // Slice 98: returningColumns[] = MERGE OUTPUT projection.
        List<ColumnRef> joinRefs = new ArrayList<>(joinRefsSet);
        List<ColumnRef> filterRefs = new ArrayList<>(filterRefsSet);
        StatementGraph mergeStmt = new StatementGraph(
                /*name=*/ null,
                "MERGE",
                relations,
                /*outputColumns=*/ Collections.<OutputColumn>emptyList(),
                returningCols,
                filterRefs,
                joinRefs,
                /*groupByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinctOnColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ null,
                /*rowLimit=*/ null,
                targetRel);
        stmts.add(mergeStmt);

        return new SemanticProgram(stmts, lineage);
    }

    /**
     * Slice 95 — collect column refs from a per-WHEN action WHERE
     * predicate ({@code TMergeUpdateClause.updateWhereClause},
     * {@code TMergeUpdateClause.deleteWhereClause}, or
     * {@code TMergeInsertClause.insertWhereClause}) into the supplied
     * {@code filterRefsSet}.
     *
     * <p>Slice 116 — lifts the slice-95 blanket subquery reject by
     * routing uncorrelated predicate-subquery wrappers (IN-SELECT /
     * EXISTS / NOT EXISTS / scalar comparison / ANY-ALL-SOME) through
     * the slice-23+ JOIN-ON extraction pipeline refactored by slice
     * 110 to take a {@link PredicateClauseContext}. The
     * {@link PredicateClauseContext#MERGE_WHEN_WHERE} constant reuses
     * the {@code SELECT_WHERE_*} DiagnosticCode family (slice 113/114
     * precedent — a MERGE-action WHERE IS a SELECT WHERE in shape) so
     * the enum count stays at 279; only the {@code clauseLabel}
     * differs so diagnostic messages can identify the MERGE-action
     * host context.
     *
     * <p>Each extracted wrapper lands as its own
     * {@code <predicate_subquery_<i>>} StatementGraph BEFORE the
     * MERGE statement (so {@code mergeIdx = stmts.size()} below in
     * {@code buildMerge} already accounts for them — slice-83
     * dynamic-index pattern, slice 110/111 precedent). Remaining
     * non-subquery refs flow into {@code filterRefsSet} via
     * {@link #collectColumnRefsSkipping}. Window functions in
     * non-subquery subtrees still reject via
     * {@link #rejectWindowFunctionInScopeSkipping} (slice 95
     * window-function contract preserved).
     *
     * <p>The supplied {@code provider} must carry
     * {@code withCteContext(cteMap.keySet())} so the predicate body's
     * inner SELECT's {@code FROM cte} refs route through
     * {@link RelationKind#CTE} — without that decoration,
     * {@code emitLineageForStatement} would lose the
     * STATEMENT_OUTPUT &rarr; STATEMENT_OUTPUT edge to the CTE body
     * (slice 110 documented gap for UPDATE WHERE — same applies here).
     * {@code buildMerge} composes the decoration once before the
     * per-WHEN loop.
     *
     * <p>Null-safe: returns immediately when the WHERE expression is
     * absent (slice-94 default; most WHEN clauses have no action
     * WHERE).
     */
    private static void collectMergeActionWhere(TExpression expr,
                                                String label,
                                                NameBindingProvider provider,
                                                LinkedHashSet<ColumnRef> filterRefsSet,
                                                List<StatementGraph> stmts,
                                                List<LineageEdge> lineage,
                                                Map<String, Integer> cteMap,
                                                TMergeSqlStatement merge,
                                                EnclosingScope correlationScope) {
        if (expr == null) {
            return;
        }
        Set<TExpression> extractedRoots = Collections.<TExpression>emptySet();
        if (containsAnySubqueryExpression(expr)) {
            extractedRoots =
                    extractUncorrelatedPredicateSubqueriesFromClause(
                            expr, provider, stmts, lineage, cteMap,
                            PredicateClauseContext.MERGE_WHEN_WHERE,
                            correlationScope);
            rejectAnyRemainingSubqueriesFromClause(expr, extractedRoots,
                    PredicateClauseContext.MERGE_WHEN_WHERE);
        }
        rejectWindowFunctionInScopeSkipping(expr, label, extractedRoots);
        filterRefsSet.addAll(collectColumnRefsSkipping(expr, provider,
                extractedRoots));
    }

    /**
     * Slice 97 — reject any source-aliased column ref in a
     * WHEN NOT MATCHED BY SOURCE branch. SQL Server forbids
     * source-side references in this branch because there is no
     * matching source row when the action fires.
     *
     * <p>A ref is "source-aliased" iff its
     * {@code relationAlias.toLowerCase(Locale.ROOT)} appears in
     * either alias map (TABLE-kind or SUBQUERY-kind USING source).
     * Refs whose alias is unknown to both maps are assumed to be
     * target-bound (slice-94 alias-filter convention) and are
     * left alone.
     *
     * <p>Walks all refs so a source ref nested inside an arbitrary
     * function call (e.g. {@code COALESCE(s.code, t.code)}) is
     * caught — {@code collectColumnRefs} descends through arbitrary
     * scalar expressions (codex round-1 Q3 confirmed YES).
     */
    private static void rejectSourceRefsForBySource(List<ColumnRef> refs,
                                                    Map<String, String> aliasToTableQName,
                                                    Map<String, Integer> aliasToSubIdx,
                                                    String label,
                                                    TMergeSqlStatement merge) {
        if (refs == null || refs.isEmpty()) {
            return;
        }
        for (ColumnRef r : refs) {
            String alias = r.getRelationAlias();
            if (alias == null || alias.isEmpty()) {
                continue;
            }
            String key = alias.toLowerCase(Locale.ROOT);
            if (aliasToTableQName.containsKey(key)
                    || aliasToSubIdx.containsKey(key)) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.MERGE_NOT_MATCHED_BY_SOURCE_REFERENCES_SOURCE,
                        label + " references USING source column '"
                                + r + "'; WHEN NOT MATCHED BY SOURCE "
                                + "branches must only reference target "
                                + "columns or constants.",
                        merge));
            }
        }
    }

    /**
     * Slice 97 — pre-walk the SET RHS of every assignment in a BY SOURCE
     * UPDATE action and reject any source-side ref. Called before
     * {@link #buildMergeUpdateAction} so the existing slice-94 helper
     * remains BY-SOURCE-agnostic.
     *
     * <p>Skips assignments that aren't shaped as a simple
     * {@code assignment_t} expression; those defects are caught by
     * {@link #buildMergeUpdateAction} with
     * {@link DiagnosticCode#UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED}.
     */
    private static void rejectBySourceSetRhsRefs(TMergeUpdateClause upd,
                                                 NameBindingProvider provider,
                                                 Map<String, String> aliasToTableQName,
                                                 Map<String, Integer> aliasToSubIdx,
                                                 TMergeSqlStatement merge) {
        TResultColumnList sets = upd.getUpdateColumnList();
        if (sets == null || sets.size() == 0) {
            return;
        }
        for (int i = 0; i < sets.size(); i++) {
            TResultColumn rc = sets.getResultColumn(i);
            TExpression assignment = (rc == null) ? null : rc.getExpr();
            if (assignment == null
                    || assignment.getExpressionType() != EExpressionType.assignment_t) {
                continue;
            }
            TExpression rhs = assignment.getRightOperand();
            if (rhs == null) {
                continue;
            }
            // Subquery RHS would short-circuit later with
            // UPDATE_SET_HAS_SUBQUERY_NOT_SUPPORTED; ignore here.
            if (containsAnySubqueryExpression(rhs)) {
                continue;
            }
            List<ColumnRef> rhsRefs = collectColumnRefs(rhs, provider);
            rejectSourceRefsForBySource(rhsRefs, aliasToTableQName,
                    aliasToSubIdx,
                    "MERGE WHEN NOT MATCHED BY SOURCE UPDATE SET "
                            + "assignment #" + (i + 1) + " RHS",
                    merge);
        }
    }

    /**
     * Slice 94 — process one WHEN MATCHED THEN UPDATE SET action.
     * Each {@code TResultColumn} carries an assignment_t TExpression
     * whose leftOperand is the SET LHS (target column reference) and
     * whose rightOperand is the value expression. We emit one
     * {@link LineageEdge} per (target col, RHS source ref) pair.
     */
    private static void buildMergeUpdateAction(TMergeUpdateClause upd,
                                               String targetQName,
                                               TTable targetTable,
                                               NameBindingProvider provider,
                                               Map<String, String> seenTargetCols,
                                               List<LineageEdge> lineage,
                                               Set<String> emittedEdgeKeys,
                                               Map<String, String> aliasToTableQName,
                                               Map<String, Integer> aliasToSubIdx,
                                               Set<String> targetAliases,
                                               TMergeSqlStatement merge) {
        TResultColumnList sets = upd.getUpdateColumnList();
        if (sets == null || sets.size() == 0) {
            return;
        }
        for (int i = 0; i < sets.size(); i++) {
            TResultColumn rc = sets.getResultColumn(i);
            TExpression assignment = (rc == null) ? null : rc.getExpr();
            if (assignment == null
                    || assignment.getExpressionType() != EExpressionType.assignment_t) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "MERGE WHEN MATCHED UPDATE SET assignment #" + (i + 1)
                                + " is not a simple column-value assignment_t",
                        merge));
            }
            TExpression lhs = assignment.getLeftOperand();
            TExpression rhs = assignment.getRightOperand();
            if (lhs == null || rhs == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "MERGE WHEN MATCHED UPDATE SET assignment #" + (i + 1)
                                + " is missing an operand",
                        merge));
            }
            if (lhs.getExpressionType() == EExpressionType.list_t) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "MERGE WHEN MATCHED UPDATE SET tuple assignment "
                                + "'(a, b) = ...' is not supported",
                        merge));
            }
            if (lhs.getExpressionType() != EExpressionType.simple_object_name_t) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "MERGE WHEN MATCHED UPDATE SET assignment #" + (i + 1)
                                + " LHS is expressionType=" + lhs.getExpressionType()
                                + "; slice 94 admits simple column references only",
                        merge));
            }
            TObjectName targetCol = lhs.getObjectOperand();
            if (targetCol == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                        "MERGE WHEN MATCHED UPDATE SET assignment #" + (i + 1)
                                + " LHS has no TObjectName operand",
                        merge));
            }
            // Codex round-1 diff Q3 NO fix: SET LHS qualifier must be
            // either the target alias or the target qualified name.
            // A foreign qualifier (e.g. `s.name` on a SET LHS pointing
            // at source `s`) silently treated as a target column would
            // produce a wrong target column spelling.
            String rawSpelling = targetCol.toString();
            String colSpelling = validateAndStripSetLhsQualifier(
                    rawSpelling, targetTable, targetQName, merge);
            // Subquery / window on RHS — reuse existing codes per
            // plan v3 §B (codex round-1 Q2 NO fix).
            if (containsAnySubqueryExpression(rhs)) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.UPDATE_SET_HAS_SUBQUERY_NOT_SUPPORTED,
                        "MERGE WHEN MATCHED UPDATE SET assignment #" + (i + 1)
                                + " right-hand side contains a subquery; "
                                + "slice 94 admits scalar-only RHS expressions",
                        merge));
            }
            rejectWindowFunctionInScope(rhs, "MERGE WHEN MATCHED UPDATE SET RHS");

            String lowerKey = colSpelling.toLowerCase(Locale.ROOT);
            if (!seenTargetCols.containsKey(lowerKey)) {
                seenTargetCols.put(lowerKey, colSpelling);
            }
            // Per-WHEN action lineage: TABLE_COLUMN(target,col) ← <RHS ref>
            List<ColumnRef> rhsRefs = collectColumnRefs(rhs, provider);
            for (ColumnRef src : rhsRefs) {
                emitMergeLineageEdge(targetQName, colSpelling, src,
                        lineage, emittedEdgeKeys, aliasToTableQName,
                        aliasToSubIdx, targetAliases);
            }
        }
    }

    /**
     * Slice 94 — process one WHEN NOT MATCHED THEN INSERT (cols) VALUES (exprs)
     * action. Emits one {@link LineageEdge} per (insert col, source ref)
     * pair, plus arity validation between the explicit column list and
     * VALUES list. If the column list is omitted, we cannot derive
     * target column names — the slice rejects defensively.
     */
    private static void buildMergeInsertAction(TMergeInsertClause ins,
                                               String targetQName,
                                               TTable targetTable,
                                               NameBindingProvider provider,
                                               Map<String, String> seenTargetCols,
                                               List<LineageEdge> lineage,
                                               Set<String> emittedEdgeKeys,
                                               Map<String, String> aliasToTableQName,
                                               Map<String, Integer> aliasToSubIdx,
                                               Set<String> targetAliases,
                                               TMergeSqlStatement merge) {
        TResultColumnList values = ins.getValuelist();
        gudusoft.gsqlparser.nodes.TObjectNameList colList = ins.getColumnList();
        if (values == null || values.size() == 0) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.MERGE_INSERT_DEFAULT_VALUES_NOT_SUPPORTED,
                    "MERGE WHEN NOT MATCHED INSERT has no VALUES list "
                            + "(DEFAULT VALUES / row-type forms not supported)",
                    merge));
        }
        // If an explicit column list is present, validate arity.
        if (colList != null && colList.size() > 0) {
            if (colList.size() != values.size()) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.INSERT_COLUMN_COUNT_MISMATCH,
                        "MERGE WHEN NOT MATCHED INSERT column list has "
                                + colList.size() + " column(s) but VALUES "
                                + "list has " + values.size(),
                        merge));
            }
        }
        for (int i = 0; i < values.size(); i++) {
            TResultColumn rc = values.getResultColumn(i);
            TExpression rhs = (rc == null) ? null : rc.getExpr();
            if (rhs == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.MERGE_INSERT_DEFAULT_VALUES_NOT_SUPPORTED,
                        "MERGE WHEN NOT MATCHED INSERT VALUES item #"
                                + (i + 1) + " has no expression",
                        merge));
            }
            if (containsAnySubqueryExpression(rhs)) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.MERGE_INSERT_VALUES_HAS_SUBQUERY_NOT_SUPPORTED,
                        "MERGE WHEN NOT MATCHED INSERT VALUES item #"
                                + (i + 1) + " contains a subquery; slice 94 "
                                + "admits scalar-only VALUES expressions",
                        merge));
            }
            rejectWindowFunctionInScope(rhs, "MERGE INSERT VALUES");

            // Target column name. If the explicit column list is
            // omitted, slice 94 does not synthesize positional target
            // column names (the catalog is required to map by
            // position; the current builder does not consume catalog
            // ordering). We still emit lineage edges from a synth
            // "__merge_insert_pos_<i>__" target column so source refs
            // are observable; users with an explicit column list get
            // the verbatim spelling.
            String colSpelling;
            if (colList != null && colList.size() > 0) {
                TObjectName col = colList.getObjectName(i);
                // INSERT column list is conventionally bare (no
                // qualifier), but Oracle / SQL Server allow
                // target-qualified spellings; strip them and reject
                // foreign qualifiers (codex round-1 diff Q3 NO fix).
                colSpelling = (col == null) ? ("__merge_insert_pos_" + i + "__")
                        : validateAndStripSetLhsQualifier(col.toString(),
                                targetTable, targetQName, merge);
            } else {
                colSpelling = "__merge_insert_pos_" + i + "__";
            }
            String lowerKey = colSpelling.toLowerCase(Locale.ROOT);
            if (!seenTargetCols.containsKey(lowerKey)) {
                seenTargetCols.put(lowerKey, colSpelling);
            }
            List<ColumnRef> rhsRefs = collectColumnRefs(rhs, provider);
            for (ColumnRef src : rhsRefs) {
                emitMergeLineageEdge(targetQName, colSpelling, src,
                        lineage, emittedEdgeKeys, aliasToTableQName,
                        aliasToSubIdx, targetAliases);
            }
        }
    }

    /**
     * Slice 94 — emit a single MERGE per-WHEN action lineage edge:
     * {@code TABLE_COLUMN(targetQName, colSpelling) ← <src ref>}.
     * Deduplicates on a lower-case key so the same (target column,
     * source ref) pair appearing in multiple WHEN clauses produces
     * one edge (codex round-2 Q4 confirmed YES on this dedup
     * strategy).
     */
    private static void emitMergeLineageEdge(String targetQName,
                                             String colSpelling,
                                             ColumnRef src,
                                             List<LineageEdge> lineage,
                                             Set<String> emittedEdgeKeys,
                                             Map<String, String> aliasToTableQName,
                                             Map<String, Integer> aliasToSubIdx,
                                             Set<String> targetAliases) {
        if (src == null || colSpelling == null || colSpelling.isEmpty()) {
            return;
        }
        String srcAlias = src.getRelationAlias();
        String srcCol = src.getColumnName();
        if (srcCol == null || srcCol.isEmpty()) {
            return;
        }
        if (srcAlias == null) srcAlias = "";
        String aliasKey = srcAlias.toLowerCase(Locale.ROOT);
        // Codex round-1 diff Q1 BLOCKING fix: skip only if the alias
        // is a target alias, NOT if the alias resolves to a same-named
        // table. Self-merge (USING with same name as target) must
        // distinguish target from USING by alias identity, not by
        // resolved table name.
        if (targetAliases.contains(aliasKey)) {
            return;
        }
        // Map alias → LineageRef (TABLE_COLUMN or STATEMENT_OUTPUT).
        LineageRef toRef;
        if (aliasToSubIdx.containsKey(aliasKey)) {
            toRef = LineageRef.statementOutput(
                    aliasToSubIdx.get(aliasKey), srcCol);
        } else if (aliasToTableQName.containsKey(aliasKey)) {
            toRef = LineageRef.tableColumn(
                    aliasToTableQName.get(aliasKey), srcCol);
        } else {
            // Unknown alias — skip to avoid emitting a bogus edge.
            // The ref still surfaces on joinColumnRefs[] (ON / WHEN-AND).
            return;
        }
        // Codex round-1 diff Q2 NO fix: dedup on resolved LineageRef
        // identity (not raw alias), so `s.name` (alias) and
        // `managers.name` (qualified name) coming from the SAME
        // resolved source produce ONE edge. The key embeds the toRef's
        // canonical form: STATEMENT_OUTPUT(idx,col) or
        // TABLE_COLUMN(qname,col) — both are lower-cased.
        String resolvedKey;
        if (toRef.getKind() == LineageRef.Kind.STATEMENT_OUTPUT) {
            resolvedKey = "STMT_OUT::" + toRef.getStatementIndex() + "::"
                    + (toRef.getOutputName() == null ? "" : toRef.getOutputName());
        } else {
            resolvedKey = "TBL_COL::"
                    + (toRef.getQualifiedName() == null ? "" : toRef.getQualifiedName())
                    + "::"
                    + (toRef.getColumnName() == null ? "" : toRef.getColumnName());
        }
        String key = (targetQName + "::" + colSpelling + "::"
                + resolvedKey).toLowerCase(Locale.ROOT);
        if (emittedEdgeKeys.add(key)) {
            lineage.add(new LineageEdge(
                    LineageRef.tableColumn(targetQName, colSpelling),
                    toRef));
        }
    }

    /**
     * Slice 94 — validate the SET LHS / INSERT column-list spelling
     * and strip a leading target qualifier. Codex round-1 diff Q3 NO
     * fix: previously the helper returned a foreign-qualified spelling
     * unchanged, which silently produced a wrong target column (e.g.
     * {@code "s.name"} would land in the target columns list verbatim
     * instead of being rejected).
     *
     * <p>Admit rules:
     * <ul>
     *   <li>Unqualified bare name: return unchanged.</li>
     *   <li>Qualified by target alias or qualified name: strip.</li>
     *   <li>Qualified by anything else: reject as
     *       {@link DiagnosticCode#UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED}
     *       (the same code used for slice-80 UPDATE-LHS shape rejects,
     *       message text discriminates by mentioning the foreign
     *       qualifier).</li>
     * </ul>
     */
    private static String validateAndStripSetLhsQualifier(String spelling,
                                                          TTable targetTable,
                                                          String targetQName,
                                                          TMergeSqlStatement merge) {
        if (spelling == null) return spelling;
        int dot = spelling.indexOf('.');
        if (dot <= 0) return spelling;
        String qualifier = spelling.substring(0, dot);
        String bare = spelling.substring(dot + 1);
        String targetAlias = effectiveAliasOf(targetTable);
        if (targetAlias != null
                && qualifier.equalsIgnoreCase(targetAlias)) {
            return bare;
        }
        if (qualifier.equalsIgnoreCase(targetQName)) {
            return bare;
        }
        throw new SemanticIRBuildException(Diagnostic.error(
                DiagnosticCode.UPDATE_TUPLE_ASSIGNMENT_NOT_SUPPORTED,
                "MERGE SET LHS / INSERT column qualifier '" + qualifier
                        + "' does not match the target table; slice 94 "
                        + "admits target-qualified or unqualified target "
                        + "column references only",
                merge));
    }

    /**
     * Slice 84 — process one FROM-side source table for joined
     * {@link #buildDelete}. Mirrors slice-82 {@link #buildUpdateRelation}.
     * Applies the slice-84 reject contract for nested-join wrappers,
     * then appends a TABLE-kind {@link RelationSource} unless the
     * table is the target (reference-identity filter — clean IR
     * semantics: relations[] models read-side sources only). For
     * subquery sources (already extracted in step 4.7), publishes a
     * SUBQUERY-kind {@link RelationSource} so the inScope-enhanced
     * provider can route {@code sub.col} references.
     *
     * <p>Null-driver guard: probed PG
     * {@code DELETE FROM e USING (t1 JOIN t2 ON …)} returns
     * {@code refJoin[0].getTable() == null}. Silent skip mirrors
     * slice-82's null guard for the analogous UPDATE case;
     * documented as a known limitation (parenthesized JOIN-in-USING
     * is opaque to {@code relations[]} though WHERE refs still bind
     * via Resolver2).
     */
    private static void buildDeleteRelation(TTable t, TTable targetTable,
                                            List<RelationSource> relations,
                                            TDeleteSqlStatement delete,
                                            Map<String, Integer> cteNameToStatementIndex) {
        if (t == null) {
            return; // defensive — parenthesized JOIN-in-USING surfaces null
        }
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
            // Slice 84 — admit FROM-side subqueries. The inner SELECT
            // has already been extracted as its own StatementGraph by
            // extractDeleteFromSubqueries. Publish a SUBQUERY-kind
            // RelationSource so the inScope-enhanced provider routes
            // `sub.col` references correctly. Mirrors slice-83
            // buildUpdateRelation's subquery branch.
            String subAlias = effectiveAliasOf(t);
            if (subAlias != null && !subAlias.isEmpty()) {
                relations.add(new RelationSource(subAlias,
                        new RelationBinding(RelationKind.SUBQUERY, subAlias)));
            }
            return;
        }
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.join) {
            // Defensive: TTable wrapping a TJoin. Not reached by any
            // observed parser path on supported dialects (slice-82
            // precedent — parenthesized JOIN-in-USING surfaces a null
            // driver, not a join-typed TTable). Distinct DiagnosticCode
            // per slice-80's message-text-discrimination contract.
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_FROM_NESTED_JOIN_NOT_SUPPORTED,
                    "DELETE FROM source is a nested join wrapper; "
                            + "slice 84 admits simple table / subquery "
                            + "FROM sources only",
                    delete));
        }
        // Reference-identity filter: target's own TTable instance is
        // excluded from relations[]. Different TTable instances with
        // the same qualified name (e.g. MSSQL `DELETE FROM t FROM t
        // spqh JOIN sp` where target identity A and FROM-driver
        // identity B share name "t") both stay — the catalog-miss
        // WARN walker's pass-1-target-then-pass-2-relations ordering
        // (slice 83) deduplicates by qualified name.
        if (t == targetTable) {
            return;
        }
        TObjectName tName = t.getTableName();
        if (tName == null) {
            return; // defensive
        }
        // Slice 106 — FROM-side CTE detection. When the FROM-side table
        // is an objectname-typed reference whose bare name matches a
        // declared CTE in this DELETE's outer WITH clause, emit a
        // SUBQUERY-kind RelationSource pointing at the CTE statement
        // (mirrors slice-105 buildUpdateRelation). The slice-77 catalog-
        // miss WARN walker filters to RelationKind.TABLE so CTE-bound
        // relations are naturally skipped, even when the catalog also
        // declares the same name (slice-105 §G / §X precedent).
        //
        // Explicit objectname guard (codex round-1 NICE Q3): subquery /
        // join table types are handled by the early returns above; this
        // guard documents the contract and makes the branch resilient
        // if a future TTable type is added.
        if (cteNameToStatementIndex != null
                && !cteNameToStatementIndex.isEmpty()
                && t.getTableType()
                        == gudusoft.gsqlparser.ETableSource.objectname) {
            String bareName = tName.toString();
            if (bareName != null && !bareName.isEmpty()) {
                String bareNameLower = bareName.toLowerCase(Locale.ROOT);
                if (cteNameToStatementIndex.containsKey(bareNameLower)) {
                    String cteAlias = effectiveAliasOf(t);
                    if (cteAlias == null || cteAlias.isEmpty()) {
                        cteAlias = bareName;
                    }
                    relations.add(new RelationSource(cteAlias,
                            new RelationBinding(RelationKind.SUBQUERY, cteAlias)));
                    return;
                }
            }
        }
        relations.add(new RelationSource(effectiveAliasOf(t),
                new RelationBinding(RelationKind.TABLE, tName.toString())));
    }

    /**
     * Slice 84 — process one {@link TJoinItem} for joined
     * {@link #buildDelete}. Mirrors slice-82 {@link #buildUpdateJoinItem}.
     * Applies the slice-84 reject contract for USING / NATURAL /
     * subquery-in-ON, processes the right-side table via
     * {@link #buildDeleteRelation}, and collects ON-clause column
     * refs into {@code joinRefs} via the shared
     * {@link #collectColumnRefs} helper.
     */
    private static void buildDeleteJoinItem(TJoinItem item, TTable targetTable,
                                            NameBindingProvider provider,
                                            List<RelationSource> relations,
                                            java.util.LinkedHashSet<ColumnRef> joinRefs,
                                            TDeleteSqlStatement delete,
                                            Map<String, Integer> cteNameToStatementIndex) {
        if (item == null) return;
        if (item.getUsingColumns() != null && item.getUsingColumns().size() > 0) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_FROM_JOIN_USING_NOT_SUPPORTED,
                    "DELETE FROM join uses USING(...); slice 84 admits "
                            + "JOIN ON / CROSS JOIN / comma-FROM only",
                    item));
        }
        if (isNaturalJoinType(item.getJoinType())) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_FROM_JOIN_NATURAL_NOT_SUPPORTED,
                    "DELETE FROM uses NATURAL JOIN; slice 84 admits "
                            + "JOIN ON / CROSS JOIN / comma-FROM only",
                    item));
        }
        // Right-side table: apply the same source-shape rejects +
        // identity filter as the driver table. Slice 106 — threads
        // cteNameToStatementIndex so right-side CTE refs (MSSQL
        // `FROM target t JOIN cte ON …`) get SUBQUERY-kind emission.
        buildDeleteRelation(item.getTable(), targetTable, relations, delete,
                cteNameToStatementIndex);
        // ON-clause refs: subquery rejects with slice-84 code;
        // window function reuses CLAUSE_WINDOW_FUNCTION_LEAK via the
        // shared helper. CROSS JOIN has no ON; skip the walk entirely.
        TExpression onCond = item.getOnCondition();
        if (onCond == null) return;
        if (containsAnySubqueryExpression(onCond)) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.DELETE_JOIN_ON_HAS_SUBQUERY_NOT_SUPPORTED,
                    "DELETE FROM JOIN ON condition contains a subquery; "
                            + "slice 84 admits scalar predicates only",
                    item));
        }
        rejectWindowFunctionInScope(onCond, "DELETE FROM JOIN ON");
        joinRefs.addAll(collectColumnRefs(onCond, provider));
    }

    /**
     * Slice 84 — extract every FROM-side subquery in
     * {@code delete.getReferenceJoins()} as its own
     * {@link StatementGraph} appended to {@code stmts} before the
     * DELETE itself. Walks both the driver TTable of each TJoin AND
     * each JoinItem's right table. Returns an alias → stmts-index
     * map so the consuming DELETE can (a) build its in-scope column
     * map via {@link #buildDeleteInScopeMap}, and (b) bind
     * {@code sub.col} references in WHERE / ON via the
     * inScope-enhanced provider.
     *
     * <p>Mirrors slice-83 {@link #extractUpdateFromSubqueries} but
     * walks {@code delete.getReferenceJoins()} instead of
     * {@code update.getJoins()}. Reuses the SELECT-side
     * {@link #processDirectSubqueryTable} verbatim, forwarding the
     * outer-WITH {@code cteNameToStatementIndex} +
     * {@code ctePublishedColumns} (slice 106) so a nested SELECT in
     * an extracted FROM-subquery body can resolve outer-CTE refs.
     * Pre-slice-106 the maps were always empty because slice 81
     * rejected top-level WITH on DELETE
     * ({@link DiagnosticCode#DELETE_CTE_NOT_SUPPORTED}).
     *
     * <p>No mutation-guard wrapper: buildDelete owns fresh local
     * lists and exceptions propagate cleanly to the caller.
     */
    private static Map<String, Integer> extractDeleteFromSubqueries(
            TDeleteSqlStatement delete,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        Map<String, Integer> aliasToIndex = new HashMap<>();
        TJoinList refJoins = delete.getReferenceJoins();
        if (refJoins == null) return aliasToIndex;
        // Slice 106 — forward the outer-WITH CTE maps so a nested SELECT
        // inside an extracted FROM-subquery body can resolve outer-WITH
        // CTE references. Resolver2 wires CTEScope; the maps are
        // forwarded for parity with the SELECT / MERGE / UPDATE call
        // sites and so the §N test for
        // `USING (SELECT … FROM cte) sub` produces the expected
        // cross-stmt lineage edge to the CTE body.
        Map<String, Integer> cteMap = cteNameToStatementIndex == null
                ? Collections.<String, Integer>emptyMap()
                : cteNameToStatementIndex;
        Map<String, List<String>> ctePublished = ctePublishedColumns == null
                ? Collections.<String, List<String>>emptyMap()
                : ctePublishedColumns;
        for (int ji = 0; ji < refJoins.size(); ji++) {
            TJoin join = refJoins.getJoin(ji);
            // Driver table — may be a subquery (PG / SF / BQ / RS
            // `DELETE FROM t USING (SELECT …) sub` shape).
            processDirectSubqueryTable(join.getTable(), provider,
                    stmts, lineage, cteMap, ctePublished, aliasToIndex);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                // Right-side table of a JoinItem — may be a subquery
                // (MSSQL / PG `DELETE FROM t FROM x JOIN (SELECT …)
                // sub ON …` shape).
                processDirectSubqueryTable(item.getTable(), provider,
                        stmts, lineage, cteMap, ctePublished, aliasToIndex);
            }
        }
        return aliasToIndex;
    }

    /**
     * Slice 84 — build an effective-alias-keyed in-scope map publishing
     * each extracted DELETE FROM-subquery's output column names.
     * Mirrors slice-83 {@link #buildUpdateInScopeMap} but walks
     * {@code delete.getReferenceJoins()}.
     *
     * <p>Base-table FROM-side relations do not need an entry: their
     * column resolution stays on the Resolver2 catalog path
     * (probed correct for PG / MSSQL DELETE — see slice-84 plan
     * §Codex Q4 + Q11).
     */
    private static Map<String, List<String>> buildDeleteInScopeMap(
            TDeleteSqlStatement delete,
            Map<String, Integer> subqueryAliasToIndex,
            List<StatementGraph> stmts,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        Map<String, List<String>> result = new HashMap<>();
        boolean haveSubq = subqueryAliasToIndex != null
                && !subqueryAliasToIndex.isEmpty();
        boolean haveCte = cteNameToStatementIndex != null
                && !cteNameToStatementIndex.isEmpty();
        if (!haveSubq && !haveCte) {
            return result;
        }
        TJoinList refJoins = delete.getReferenceJoins();
        if (refJoins == null) return result;
        for (int ji = 0; ji < refJoins.size(); ji++) {
            TJoin join = refJoins.getJoin(ji);
            addDeleteRelationToInScopeMap(join.getTable(),
                    subqueryAliasToIndex, stmts, result,
                    cteNameToStatementIndex, ctePublishedColumns);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                addDeleteRelationToInScopeMap(item.getTable(),
                        subqueryAliasToIndex, stmts, result,
                        cteNameToStatementIndex, ctePublishedColumns);
            }
        }
        return result;
    }

    private static void addDeleteRelationToInScopeMap(TTable t,
            Map<String, Integer> subqueryAliasToIndex,
            List<StatementGraph> stmts,
            Map<String, List<String>> result,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        if (t == null) return;
        // Slice 106 — CTE-as-FROM-relation in-scope publication. When
        // the FROM-side table is an objectname-typed reference whose
        // bare name matches a declared outer CTE, publish the CTE's
        // own column names against the FROM-side effective alias so
        // WHERE / ON / RETURNING refs against the CTE alias bind
        // correctly. Mirrors slice-105 addUpdateRelationToInScopeMap.
        if (cteNameToStatementIndex != null
                && !cteNameToStatementIndex.isEmpty()
                && ctePublishedColumns != null
                && t.getTableType()
                        == gudusoft.gsqlparser.ETableSource.objectname) {
            TObjectName tName = t.getTableName();
            if (tName != null) {
                String bare = tName.toString();
                if (bare != null && !bare.isEmpty()) {
                    String bareLower = bare.toLowerCase(Locale.ROOT);
                    if (cteNameToStatementIndex.containsKey(bareLower)) {
                        String aliasKey = effectiveAliasLowerCaseOrNull(t);
                        if (aliasKey == null) aliasKey = bareLower;
                        List<String> cols = ctePublishedColumns.get(bareLower);
                        if (cols != null) {
                            result.put(aliasKey, cols);
                        }
                        return;
                    }
                }
            }
        }
        if (t.getTableType() != gudusoft.gsqlparser.ETableSource.subquery) {
            return;
        }
        if (subqueryAliasToIndex == null) {
            return;
        }
        String key = effectiveAliasLowerCaseOrNull(t);
        if (key == null) return;
        Integer idx = subqueryAliasToIndex.get(key);
        if (idx == null) return;
        result.put(key, outputColumnNames(stmts.get(idx)));
    }

    /**
     * Slice 92 — returns {@code true} when the MySQL DELETE statement is a
     * self-reference single-target form ({@code DELETE T1 FROM T1 [WHERE …]})
     * that is semantically equivalent to {@code DELETE FROM T1 [WHERE …]}.
     *
     * <p>The check requires ALL of the following (codex plan-review Q1+Q5
     * BLOCKING fix — checking only {@code joins[0]} is insufficient because
     * {@code DELETE T1 FROM T2} also has {@code joins.size==1} and
     * {@code joins[0].table=="T1"==targetQName}, yet the FROM clause points
     * to a different table):
     * <ol>
     *   <li>{@code joins.size == 1} — exactly one MySQL target list entry.</li>
     *   <li>{@code getReferenceJoins().size() == 1} — exactly one FROM clause
     *       table.</li>
     *   <li>{@code joins[0]} has no JoinItems — must be a plain table, not a
     *       JOIN chain.</li>
     *   <li>{@code refJoins[0]} has no JoinItems — same constraint.</li>
     *   <li>{@code joins[0].table.name.toLowerCase() == targetQName.toLowerCase()}.
     *   </li>
     *   <li>{@code refJoins[0].table.name.toLowerCase() == targetQName.toLowerCase()}.
     *   </li>
     * </ol>
     */
    private static boolean isMysqlSelfReferenceDelete(
            TDeleteSqlStatement delete, String targetQName) {
        if (delete.joins == null || delete.joins.size() != 1) return false;
        TJoinList ref = delete.getReferenceJoins();
        if (ref == null || ref.size() != 1) return false;
        TJoin join0 = delete.joins.getJoin(0);
        if (join0.getJoinItems() != null && join0.getJoinItems().size() > 0) {
            return false;
        }
        TJoin ref0 = ref.getJoin(0);
        if (ref0.getJoinItems() != null && ref0.getJoinItems().size() > 0) {
            return false;
        }
        TTable joinTable = join0.getTable();
        if (joinTable == null || joinTable.getTableName() == null) return false;
        TTable refTable = ref0.getTable();
        if (refTable == null || refTable.getTableName() == null) return false;
        String lowerTarget = targetQName.toLowerCase(java.util.Locale.ROOT);
        String joinName = joinTable.getTableName().toString()
                .toLowerCase(java.util.Locale.ROOT);
        String refName = refTable.getTableName().toString()
                .toLowerCase(java.util.Locale.ROOT);

        // Codex diff-review P1 fix: MySQL allows the alias in the DELETE
        // target list instead of the table name:
        //   DELETE t FROM T1 AS t WHERE t.id = 1
        // In this form joins[0].table.name = "t" (the alias used in the
        // delete-list) while targetQName = "T1" (from getTargetTable()
        // which the parser resolves to the real table). Accept the target
        // table's alias as a valid joins[0] match alongside the table name.
        String targetAlias = null;
        if (delete.getTargetTable() != null
                && delete.getTargetTable().getAliasClause() != null
                && delete.getTargetTable().getAliasClause().getAliasName() != null) {
            String a = delete.getTargetTable().getAliasClause()
                    .getAliasName().toString();
            if (a != null && !a.isEmpty()) {
                targetAlias = a.toLowerCase(java.util.Locale.ROOT);
            }
        }
        boolean joinMatchesTarget = joinName.equals(lowerTarget)
                || (targetAlias != null && joinName.equals(targetAlias));
        // refJoins[0].table must always be the real table name (= targetQName).
        return joinMatchesTarget && refName.equals(lowerTarget);
    }

    /**
     * Per-result-column metadata about an extracted scalar-subquery
     * projection (slice 11). {@link #statementIndex} points to the
     * inner body statement; {@link #innerOutputName} is the inner
     * SELECT's single projected output name (used to wire the
     * STATEMENT_OUTPUT → STATEMENT_OUTPUT lineage edge).
     */
    private static final class ScalarInfo {
        final int statementIndex;
        final String innerOutputName;
        ScalarInfo(int statementIndex, String innerOutputName) {
            this.statementIndex = statementIndex;
            this.innerOutputName = innerOutputName;
        }
    }

    /**
     * Walk the consuming SELECT's FROM list. For every {@link TTable} of
     * type {@link gudusoft.gsqlparser.ETableSource#subquery}, recursively
     * build the inner statement, append it to {@code stmts}, emit its own
     * lineage edges, and record alias→statementIndex. The returned map is
     * scoped to this single consuming statement so duplicate aliases
     * across different scopes do not collide.
     *
     * <p>Slice 17: extraction now walks BOTH sides of every JOIN
     * ({@code TJoin.getTable()} for the left, {@code joinItems[i].getTable()}
     * for each right) and recurses into nested FROM-subquery bodies. Each
     * recursive level pre-extracts its own children before calling
     * {@code buildSelectStatement}, preserving the
     * {@code BodyIndexes}-required ordering (innermost body before
     * its consumer). FROM-subquery bodies still recurse with
     * {@code allowScalarProjectionSubqueries=false} (slice-15 invariant
     * pinned by {@code Slice15Test.scalarProjectionInsideFromSubqueryBodyStillRejected}).
     *
     * <p>Slice 18 lifts CTE bodies (the non-set-op CTE-body branch in
     * {@link #build} now invokes this extractor with
     * {@code allowFromSubqueries=true}). Still rejected: subqueries with
     * no alias, FROM-subqueries inside a scalar body / set-op branch /
     * set-op CTE body (each enforced by the caller's
     * {@code allowFromSubqueries=false}), and predicate subqueries inside
     * the FROM-subquery body's WHERE / JOIN ON / GROUP BY (slice-17
     * helper {@link #rejectSubqueriesInFromSubqueryBodyClauses}).
     */
    private static Map<String, Integer> extractFromSubqueriesAsStatements(
            TSelectSqlStatement consumer,
            NameBindingProvider consumerProvider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns) {
        Map<String, Integer> aliasToIndex = new HashMap<>();
        if (consumer.joins == null) return aliasToIndex;
        // Slice 17 mutation-free preflight: walk the entire direct
        // FROM/JOIN list once and reject before any mutation of
        // stmts/lineage. Catches comma-FROM, anonymous subqueries,
        // unsupported join shapes, and ALL same-level alias collisions
        // (base AND subquery, since rejectDuplicateAliases inside
        // buildRelations only catches them later, after this level's
        // subquery body has already landed in stmts).
        preflightDirectFromList(consumer);

        // Slice 17: walk both sides of every join and process each
        // direct subquery via the same helper so left/right can't drift.
        for (TJoin join : consumer.joins) {
            processDirectSubqueryTable(join.getTable(),
                    consumerProvider, stmts, lineage,
                    cteNameToStatementIndex, ctePublishedColumns, aliasToIndex);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                processDirectSubqueryTable(item.getTable(),
                        consumerProvider, stmts, lineage,
                        cteNameToStatementIndex, ctePublishedColumns, aliasToIndex);
            }
        }
        return aliasToIndex;
    }

    /**
     * Slice 17 mutation-free preflight for the consumer's direct
     * FROM/JOIN list. Validates structural invariants BEFORE any
     * subquery body is appended to {@code stmts} so a deferred
     * failure (e.g. on the second of two siblings) doesn't strand
     * earlier-sibling output in the program.
     *
     * <p>Slice 62 (codex plan-review round 1): the comma-FROM
     * reject was removed here. The preflight runs only for
     * {@code allowFromSubqueries=true} paths (outer SELECT, CTE
     * body, FROM-subquery body recursion) — exactly the paths
     * that admit comma-FROM under slice 62. Synthetic body
     * contexts (scalar / set-op-branch / set-op-CTE / predicate)
     * do not run this preflight; they reach the gated reject in
     * {@link #buildRelations} (and predicate bodies hit the
     * earlier slice-62 reject inside
     * {@link #preflightPredicateSubqueryShape}).
     */
    private static void preflightDirectFromList(TSelectSqlStatement consumer) {
        if (consumer.joins == null) return;
        Set<String> seenSubqueryAliases = new HashSet<>();
        Set<String> seenAllAliases = new HashSet<>();
        for (TJoin join : consumer.joins) {
            preflightOneTable(join.getTable(), seenSubqueryAliases, seenAllAliases);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                rejectUnsupportedJoinShape(item);
                preflightOneTable(item.getTable(), seenSubqueryAliases, seenAllAliases);
            }
        }
    }

    /**
     * Slice 17: validate one direct FROM/JOIN-list TTable in the
     * mutation-free preflight. Effective alias is the SQL-written alias
     * if present, else the slice-74 synthetic alias for unaliased
     * FROM-subqueries (position-keyed), else the table name (matches
     * {@link #buildRelation}).
     *
     * <p>Slice 74: removed the {@code FROM_SUBQUERY_ALIAS_REQUIRED} reject
     * for anonymous subqueries; the slot is now filled by
     * {@link FromSubqueryNaming#synthAliasFor}. Two unaliased subqueries
     * at the same source location are theoretically impossible (the
     * parser would have to emit the same start token for both), but if
     * it ever happens the {@code DUPLICATE_FROM_SUBQUERY_ALIAS} branch
     * below catches it the same way as a literal user-written duplicate.
     *
     * <p>Still rejects: duplicate subquery aliases (whether user-written
     * or synthetic by collision), and any cross-kind alias collision
     * (base alias colliding with a subquery alias).
     */
    private static void preflightOneTable(TTable t,
                                          Set<String> seenSubqueryAliases,
                                          Set<String> seenAllAliases) {
        if (t == null) return;
        boolean isSub = t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery;
        String effective = effectiveAliasOf(t);
        if (effective == null || effective.isEmpty()) return;
        String lower = effective.toLowerCase(Locale.ROOT);
        if (isSub && !seenSubqueryAliases.add(lower)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.DUPLICATE_FROM_SUBQUERY_ALIAS,
                    "duplicate FROM-clause subquery alias '" + effective + "'", (TParseTreeNode) null));
        }
        if (!seenAllAliases.add(lower)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.DUPLICATE_RELATION_ALIAS,
                    "duplicate relation alias '" + effective
                            + "' is not supported (would make ColumnRef ambiguous)", (TParseTreeNode) null));
        }
    }

    /**
     * Slice 17: extract one direct subquery TTable as its own
     * StatementGraph. Recurses into the inner SELECT first
     * (innermost body lands in {@code stmts} BEFORE its consumer, as
     * {@code BodyIndexes} requires). Skips non-subquery tables (base
     * relations are bound later by {@code buildRelations}).
     */
    private static void processDirectSubqueryTable(
            TTable t,
            NameBindingProvider consumerProvider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, List<String>> ctePublishedColumns,
            Map<String, Integer> aliasToIndex) {
        if (t == null) return;
        // Slice 136: a PIVOT / UNPIVOT source can itself be a FROM-subquery
        // (`FROM (SELECT ...) [alias] PIVOT(...)`). Unwrap the pivoted_table to
        // its underlying source relation so the inner SELECT is extracted and
        // registered HERE — that lands the source-subquery alias in the
        // pre-pass's aliasToIndex (== build()'s outerSubqueryAliasToIndex)
        // BEFORE emitLineageForStatement runs, so the pivot→subquery cross-stmt
        // edges resolve. A base-table pivot source falls through the
        // non-subquery early-return below unchanged.
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.pivoted_table
                && t.getPivotedTable() != null
                && !t.getPivotedTable().getRelations().isEmpty()) {
            t = t.getPivotedTable().getRelations().get(0);
            if (t == null) return;
        }
        if (t.getTableType() != gudusoft.gsqlparser.ETableSource.subquery) return;
        // Alias presence/uniqueness already validated by the preflight.
        // Slice 74: anonymous (unaliased) subqueries get a synth name
        // from FromSubqueryNaming via effectiveAliasOf so the alias used
        // for the aliasToIndex map and inner-stmt name is non-null.
        String alias = effectiveAliasOf(t);
        String aliasLower = alias.toLowerCase(Locale.ROOT);
        TSelectSqlStatement inner = t.getSubquery();
        if (inner == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_NO_INNER_SELECT,
                    "FROM-clause subquery '" + alias + "' has no inner SELECT", (TParseTreeNode) null));
        }
        // Slice 17 leak guard: predicate subqueries inside the
        // FROM-subquery body's WHERE / JOIN ON / GROUP BY would
        // otherwise slip past `allowScalarProjectionSubqueries=false`
        // (which only guards buildOutputColumns) and leak inner refs
        // into the body's filter/join/group ref lists.
        rejectSubqueriesInFromSubqueryBodyClauses(inner, alias);
        // Recurse into the inner's own FROM-subqueries first so each
        // deeper body lands in stmts BEFORE the body that consumes it.
        // The recursive call uses `consumerProvider` because the inner
        // sees the same CTE-name set as the outer (CTEs are visible
        // through FROM-subquery bodies — pinned by
        // Slice5Test.cteVisibleInsideFromSubquery).
        // Slice 60: thread ctePublishedColumns down unchanged. The
        // inner's siblings get registered into innerSubAliasToIndex
        // here; below we build the per-level innerInScope BEFORE
        // calling buildSelectStatement.
        Map<String, Integer> innerSubAliasToIndex =
                extractFromSubqueriesAsStatements(inner, consumerProvider,
                        stmts, lineage, cteNameToStatementIndex,
                        ctePublishedColumns);
        // Slice 60 (codex diff-review): build the inner FROM-subquery
        // body's effective-alias-keyed in-scope map by walking the
        // inner SELECT's FROM list. Sibling isolation is preserved
        // because `innerSubAliasToIndex` contains ONLY this body's
        // own children — ancestor siblings are never visited by the
        // walk because they're not in the inner's FROM list.
        Map<String, List<String>> innerInScope = buildEffectiveAliasInScopeMap(
                inner, consumerProvider, ctePublishedColumns,
                innerSubAliasToIndex, stmts);
        NameBindingProvider innerProviderWithStar = consumerProvider
                .withInScopeRelationColumns(innerInScope);
        // Slice 120 — switch from the 7-arg buildSelectStatement to the
        // 14-arg buildSelectStatementImpl so the FROM-subquery body's
        // WHERE clause can extract uncorrelated predicate subqueries
        // (IN-SELECT / EXISTS / NOT EXISTS / scalar comparison /
        // ANY-ALL-SOME) as their own statements (mirrors the slice-114
        // CTE-body lift). JOIN-ON predicate subqueries stay rejected (the
        // two flags are independent per the slice-113 split) — the
        // slice-17 leak guard rejectSubqueriesInFromSubqueryBodyClauses
        // above still fires for the body's JOIN-ON / GROUP-BY clauses.
        // allowFromSubqueries=true so its buildRelations accepts
        // already-extracted subquery aliases; allowScalarProjectionSubqueries
        // =false (slice-15 invariant). The snapshot/rollback wrapper
        // mirrors the slice-114 CTE-body call site: if the build appends
        // predicate bodies and then a later reject fires, stmts/lineage
        // truncate back to the pre-call boundary so a partial extraction
        // does not leak into the program. processDirectSubqueryTable is
        // shared by the SELECT / UPDATE (slice 83) / DELETE (slice 84)
        // FROM-subquery extractors, so this single site lifts all three.
        int fromBodyStmtsSnapshot = stmts.size();
        int fromBodyLineageSnapshot = lineage.size();
        StatementGraph innerStmt;
        try {
            if (isPivotSelect(inner)) {
                // Slice 138: a nested PIVOT / UNPIVOT in a FROM-subquery body
                // (`FROM (SELECT ... FROM base PIVOT(...)) t`). The outer-SELECT
                // pivot router in buildSelectStatementImpl is gated to
                // `name == null`, so a pivot body extracted here (name == alias)
                // would otherwise fall to the normal path and reject with
                // TABLE_BINDING_UNRESOLVED ("null(piviot_table)"). Route it to
                // buildPivotSelect with the subquery alias as the statement name
                // so the extracted statement becomes a proper pivot StatementGraph;
                // the outer query then references it as a SUBQUERY-kind relation
                // and the slice-136 emitLineageForStatement call below wires the
                // pivot output → source edges (base-table TABLE_COLUMN, or — when
                // the pivot's own source is a subquery — STATEMENT_OUTPUT via the
                // innerSubAliasToIndex already populated by the recursion above).
                // PIVOT extra-clause / chained / set-op-branch nesting stay
                // deferred via buildPivotSelect's existing rejects.
                innerStmt = buildPivotSelect(inner, innerProviderWithStar, alias);
            } else {
                innerStmt = buildSelectStatementImpl(inner, innerProviderWithStar, alias,
                    /*hasOuterCteListAlreadyProcessed=*/ false,
                    /*allowFromSubqueries=*/ true,
                    /*allowScalarProjectionSubqueries=*/ false,
                    /*allowWindowProjection=*/ true,
                    /*allowJoinOnPredicateSubqueries=*/ false,
                    /*stmtsForExtraction=*/ stmts,
                    /*lineageForExtraction=*/ lineage,
                    /*cteMapForExtraction=*/ cteNameToStatementIndex,
                    /*isPredicateBody=*/ false,
                    /*whereClauseContext=*/ PredicateClauseContext.FROM_SUBQUERY_BODY_WHERE,
                    /*allowWherePredicateSubqueries=*/ true);
            }
        } catch (RuntimeException ex) {
            while (stmts.size() > fromBodyStmtsSnapshot) stmts.remove(stmts.size() - 1);
            while (lineage.size() > fromBodyLineageSnapshot) lineage.remove(lineage.size() - 1);
            throw ex;
        }
        int idx = stmts.size();
        stmts.add(innerStmt);
        aliasToIndex.put(aliasLower, idx);
        // Emit lineage with the inner's own subquery alias map (so
        // STATEMENT_OUTPUT → STATEMENT_OUTPUT edges target the inner's
        // children, not the outer's). Scalar map stays empty because
        // FROM-subquery bodies still reject scalar projections
        // (slice-15 invariant).
        emitLineageForStatement(innerStmt, idx, lineage,
                cteNameToStatementIndex,
                innerSubAliasToIndex,
                Collections.<Integer, ScalarInfo>emptyMap());
    }

    /**
     * Slice 17 leak guard: reject subqueries inside a FROM-subquery
     * body's JOIN ON / GROUP BY clauses. Mirrors
     * {@link #rejectSubqueriesInScalarBodyClauses} (slice 11) — the
     * {@code allowScalarProjectionSubqueries=false} flag only guards
     * {@code buildOutputColumns}, so without this helper a SQL like
     * {@code SELECT id FROM (SELECT id FROM e JOIN d ON e.x = d.x
     * AND EXISTS (...)) sub} would leak the EXISTS subquery's refs into
     * the body's join column refs via {@code collectColumnRefs}.
     * HAVING / ORDER BY subqueries are caught by the slice-9 / 10
     * deep-scan rejecters inside {@code buildSelectStatementImpl}.
     *
     * <p>Slice 120 — the WHERE branch was removed: uncorrelated WHERE-side
     * predicate subqueries in a FROM-subquery body are now extracted as
     * their own statements by {@code buildSelectStatementImpl} via
     * {@link PredicateClauseContext#FROM_SUBQUERY_BODY_WHERE} (see
     * {@link #processDirectSubqueryTable}). {@code FROM_SUBQUERY_INNER_SUBQUERY_IN_WHERE}
     * stays declared-but-unreached for public-API stability (slice
     * 71/72/82/86/95/101/.../114 retain-for-documentation precedent).
     */
    private static void rejectSubqueriesInFromSubqueryBodyClauses(
            TSelectSqlStatement inner, String fromAlias) {
        if (inner.joins != null) {
            for (TJoin join : inner.joins) {
                TJoinItemList items = join.getJoinItems();
                if (items == null) continue;
                for (int i = 0; i < items.size(); i++) {
                    TJoinItem item = items.getJoinItem(i);
                    TExpression onCond = item == null ? null : item.getOnCondition();
                    if (onCond != null && containsAnySubqueryExpression(onCond)) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_INNER_SUBQUERY_IN_JOIN_ON,
                                "FROM-clause subquery '" + fromAlias
                                        + "' has a subquery in a JOIN ON clause; not supported yet "
                                        + "(would leak inner refs)", (TParseTreeNode) null));
                    }
                }
            }
        }
        TGroupBy groupBy = inner.getGroupByClause();
        if (groupBy != null) {
            TGroupByItemList items = groupBy.getItems();
            if (items != null && containsAnySubquery(items)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_INNER_SUBQUERY_IN_GROUP_BY,
                        "FROM-clause subquery '" + fromAlias
                                + "' has a subquery in a GROUP BY clause; not supported yet "
                                + "(would leak inner refs)", (TParseTreeNode) null));
            }
        }
    }

    /**
     * Walk the consuming SELECT's result-column list. For every
     * top-level {@link EExpressionType#subquery_t} projection, build
     * the inner SELECT as its own {@link StatementGraph} (mirroring
     * slice 5 FROM-subquery extraction), append it to {@code stmts},
     * emit its own lineage edges, and record
     * {@code resultColumnOrdinal → ScalarInfo} so the consumer's
     * {@code emitLineageForStatement} can wire the
     * STATEMENT_OUTPUT → STATEMENT_OUTPUT edge.
     *
     * <p>Slice 11 disallows: scalar subqueries with no outer alias,
     * inner SELECTs that project more than one column, inner columns
     * with no alias and no direct column name, scalar subqueries
     * whose inner WHERE/JOIN/GROUP BY contains a subquery (predicate
     * leak guard), correlated scalar subqueries (inner refs that
     * resolve to outer aliases), and nested scalar subqueries.
     *
     * <p>Slice 14 lifted correlated TABLE-bound; slice 15 lifted CTE-
     * and SUBQUERY-bound. Slice 20 lifts <i>nested</i> scalar
     * projections inside a scalar body when the
     * {@code allowRecursiveScalarSubqueryExtraction} flag is true (passed
     * by the outer-build and CTE-body call sites). Set-op-branch call
     * sites pass false to keep the slice-12 / slice-16 boundary that
     * branch scalar bodies must not host another scalar projection.
     *
     * <p>Slice 20 wraps the body in a snapshot/rollback so a deeper
     * level's failure does not leak appended scalar-body statements at
     * shallower levels into {@code stmts}/{@code lineage}. The wrapper
     * mirrors slice-16's {@code buildSetOpProgram} and slice-17/18's
     * extract wrappers (§14.18 process lesson #21).
     */
    private static Map<Integer, ScalarInfo> extractScalarSubqueriesAsStatements(
            TSelectSqlStatement consumer,
            NameBindingProvider consumerProvider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            EnclosingScope enclosingScope,
            boolean allowRecursiveScalarSubqueryExtraction) {
        // Slice 20: SET-OP-WIDE-style transactional rollback. A failure
        // anywhere inside the loop (or inside a recursive call) truncates
        // both lists back to the pre-extraction size. The wrapper closes
        // the class of "mutation-free check fires after partial mutation"
        // (codex round-3..5 finding on slice 16); the recursive scalar
        // extraction surfaced it here.
        int stmtsSnapshot = stmts.size();
        int lineageSnapshot = lineage.size();
        try {
            return extractScalarSubqueriesAsStatementsInternal(consumer,
                    consumerProvider, stmts, lineage,
                    cteNameToStatementIndex, enclosingScope,
                    allowRecursiveScalarSubqueryExtraction);
        } catch (RuntimeException ex) {
            while (stmts.size() > stmtsSnapshot) stmts.remove(stmts.size() - 1);
            while (lineage.size() > lineageSnapshot) lineage.remove(lineage.size() - 1);
            throw ex;
        }
    }

    /**
     * Internal body of {@link #extractScalarSubqueriesAsStatements}.
     * Wrapped with snapshot/rollback by the public entry point; do not
     * call directly from non-wrapper sites.
     */
    private static Map<Integer, ScalarInfo> extractScalarSubqueriesAsStatementsInternal(
            TSelectSqlStatement consumer,
            NameBindingProvider consumerProvider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, Integer> cteNameToStatementIndex,
            EnclosingScope enclosingScope,
            boolean allowRecursiveScalarSubqueryExtraction) {
        Map<Integer, ScalarInfo> ordinalToInfo = new HashMap<>();
        TResultColumnList rcl = consumer.getResultColumnList();
        if (rcl == null || rcl.size() == 0) return ordinalToInfo;

        // Reject duplicate output aliases when a scalar projection is
        // present (codex impl-review round-1 SHOULD 1). Lineage refs are
        // keyed by (statementIndex, outputName); two outputs sharing
        // the same name would collapse their lineage chains and
        // silently merge the scalar dependency with another column's
        // dependency. The slice-11 boundary is the cleanest place to
        // enforce this since the issue is most acute when a scalar
        // body's STATEMENT_OUTPUT → STATEMENT_OUTPUT edge is in play.
        boolean hasScalar = false;
        for (int i = 0; i < rcl.size(); i++) {
            TResultColumn rc = rcl.getResultColumn(i);
            if (rc != null && rc.getExpr() != null
                    && rc.getExpr().getExpressionType() == EExpressionType.subquery_t) {
                hasScalar = true;
                break;
            }
        }
        if (hasScalar) {
            Set<String> seenOutputNames = new HashSet<>();
            for (int i = 0; i < rcl.size(); i++) {
                TResultColumn rc = rcl.getResultColumn(i);
                if (rc == null) continue;
                String alias = rc.getColumnAlias();
                String colName = rc.getColumnNameOnly();
                String name = (alias != null && !alias.isEmpty())
                        ? alias
                        : colName;
                if (name == null || name.isEmpty()) continue;
                String lower = name.toLowerCase(Locale.ROOT);
                if (!seenOutputNames.add(lower)) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.DUPLICATE_OUTPUT_NAME,
                            "duplicate output name '" + name
                                    + "' in a SELECT containing a scalar subquery projection; "
                                    + "lineage refs are keyed by output name and would collide", rc));
                }
            }
        }

        for (int i = 0; i < rcl.size(); i++) {
            TResultColumn rc = rcl.getResultColumn(i);
            if (rc == null || rc.getExpr() == null) continue;
            if (rc.getExpr().getExpressionType() != EExpressionType.subquery_t) {
                continue;
            }
            String outerAlias = rc.getColumnAlias();
            if (outerAlias == null || outerAlias.isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_ALIAS_REQUIRED,
                        "scalar subquery projection must have an alias", rc));
            }
            TSelectSqlStatement inner = rc.getExpr().getSubQuery();
            if (inner == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_NO_INNER_SELECT,
                        "scalar subquery projection '" + outerAlias
                                + "' has no inner SELECT", rc));
            }
            // Pre-recursion validation (codex round-2 MUST 2): inspect
            // the inner SELECT's projected column count and naming
            // BEFORE recursive build so the rejection message is
            // scalar-specific instead of bubbling up from
            // effectiveOutputName.
            TResultColumnList innerRcl = inner.getResultColumnList();
            if (innerRcl == null || innerRcl.size() == 0) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_COLUMN_COUNT,
                        "scalar subquery '" + outerAlias
                                + "' must project exactly one column, got 0", rc));
            }
            if (innerRcl.size() != 1) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_COLUMN_COUNT,
                        "scalar subquery '" + outerAlias
                                + "' must project exactly one column, got "
                                + innerRcl.size(), rc));
            }
            TResultColumn innerCol = innerRcl.getResultColumn(0);
            String innerAlias = innerCol.getColumnAlias();
            String innerColName = innerCol.getColumnNameOnly();
            boolean innerHasName =
                    (innerAlias != null && !innerAlias.isEmpty())
                            || (innerColName != null && !innerColName.isEmpty());
            if (!innerHasName && !isConstantExpression(innerCol.getExpr())) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_INNER_PROJECTION_UNNAMED,
                        "scalar subquery '" + outerAlias
                                + "' inner projection has no alias and no column name; "
                                + "add an explicit alias inside the subquery", rc));
            }
            // Pre-recursion deep-scan (codex round-3 MUST 5, round-4
            // MUST 1): reject nested predicate subqueries in the
            // scalar body's JOIN ON / GROUP BY before collectColumnRefs
            // can descend. Slice 121: the WHERE branch is no longer
            // rejected here (allowWherePredicateSubqueries=true) — the
            // scalar body's WHERE-side uncorrelated predicate subqueries
            // are extracted as their own statements by the
            // buildSelectStatementImpl call below via
            // PredicateClauseContext.SCALAR_BODY_WHERE.
            rejectSubqueriesInScalarBodyClauses(inner, outerAlias,
                    /*allowWherePredicateSubqueries=*/ true);

            // Slice 20: branch on allowRecursiveScalarSubqueryExtraction.
            // - true (outer / CTE-body call sites): build the inner's
            //   own enclosing scope chained to this caller's; recursively
            //   extract the inner's scalar projections; then build the
            //   inner with allowScalarProjectionSubqueries=true;
            //   compute scalarName AFTER the recursive extraction so
            //   the digit suffix matches the post-extraction stmts.size()
            //   (slice-16 codex round-1 MUST 2 lesson).
            // - false (set-op-branch call site): keep the slice-12 /
            //   slice-16 boundary — no recursive extraction; the inner
            //   scalar map stays empty; the inner builds with
            //   allowScalarProjectionSubqueries=false; promotion still
            //   uses the caller's enclosing scope so OUTER_REFERENCE-of-*
            //   correlation works at the branch level.
            EnclosingScope innerEnclosing;
            Map<Integer, ScalarInfo> innerScalarMap;
            String scalarName;
            if (allowRecursiveScalarSubqueryExtraction) {
                innerEnclosing = buildEnclosingScope(inner,
                        cteNameToStatementIndex,
                        Collections.<String, Integer>emptyMap(),
                        enclosingScope);
                innerScalarMap = extractScalarSubqueriesAsStatements(inner,
                        consumerProvider, stmts, lineage,
                        cteNameToStatementIndex, innerEnclosing,
                        /*allowRecursiveScalarSubqueryExtraction=*/ true);
                scalarName = SCALAR_BODY_PREFIX + stmts.size() + ">";
            } else {
                innerEnclosing = enclosingScope;
                innerScalarMap = Collections.<Integer, ScalarInfo>emptyMap();
                scalarName = SCALAR_BODY_PREFIX + stmts.size() + ">";
            }
            // Slice 121 — switch from the 7-arg buildSelectStatement to
            // the 14-arg buildSelectStatementImpl so the scalar body's
            // WHERE clause can extract uncorrelated predicate subqueries
            // (IN-SELECT / EXISTS / NOT EXISTS / scalar comparison /
            // ANY-ALL-SOME) as their own <predicate_subquery_<i>>
            // statements (mirrors the slice-113 set-op branch / slice-120
            // FROM-subquery body lift). allowJoinOnPredicateSubqueries=false
            // keeps JOIN-ON predicate subqueries rejected (the two flags
            // are independent per the slice-113 split; the slice-11 leak
            // guard above still fires for the body's JOIN-ON / GROUP-BY).
            // allowScalarProjectionSubqueries stays gated on
            // allowRecursiveScalarSubqueryExtraction (slice-15/16 invariant).
            // stmts/lineage/cteMap are threaded for extraction; the
            // enclosing extractScalarSubqueriesAsStatements wrapper is the
            // snapshot/rollback boundary (no per-site try/catch needed —
            // slice-113 enclosed-by-buildSetOpProgram precedent).
            // preBuildScalarSize == the digit baked into scalarName above
            // (nothing mutates stmts between the scalarName assignment and
            // here), so `idx != preBuildScalarSize` below is exactly "the
            // build appended predicate bodies" without re-parsing the name.
            int preBuildScalarSize = stmts.size();
            StatementGraph innerStmt = buildSelectStatementImpl(inner, consumerProvider,
                    scalarName,
                    /*hasOuterCteListAlreadyProcessed=*/ false,
                    /*allowFromSubqueries=*/ false,
                    /*allowScalarProjectionSubqueries=*/ allowRecursiveScalarSubqueryExtraction,
                    /*allowWindowProjection=*/ false,
                    /*allowJoinOnPredicateSubqueries=*/ false,
                    /*stmtsForExtraction=*/ stmts,
                    /*lineageForExtraction=*/ lineage,
                    /*cteMapForExtraction=*/ cteNameToStatementIndex,
                    /*isPredicateBody=*/ false,
                    /*whereClauseContext=*/ PredicateClauseContext.SCALAR_BODY_WHERE,
                    /*allowWherePredicateSubqueries=*/ true);
            // Slice 14: instead of rejecting correlated scalar
            // subqueries, promote outer-scope refs into synthesised
            // OUTER_REFERENCE relations on the inner statement.
            // Non-TABLE-bound outer refs (CTE / SUBQUERY) and
            // unknown aliases still throw. (This projection path uses the
            // innerEnclosing scope for promotion; the UPDATE SET-RHS scalar
            // path in extractScalarSubqueriesFromUpdateSetRhs instead uses
            // withTolerantOuterBinding because UPDATE has no enclosing-scope
            // promotion — slices 117/119. The two are equivalent for
            // uncorrelated bodies; do not cross-port one onto the other.)
            // promoteCorrelatedRefsToOuterReference returns a new
            // StatementGraph and does NOT append to stmts, so reading
            // idx after it is equivalent to reading it right after the
            // build (it only reflects predicate bodies the build appended).
            innerStmt = promoteCorrelatedRefsToOuterReference(
                    innerStmt, outerAlias, innerEnclosing);
            int idx = stmts.size();
            // Slice 121 — if the WHERE predicate-body extraction appended
            // statements during the build, the scalar body's final index
            // exceeds the value baked into scalarName (computed before the
            // build). Rebuild with the corrected <scalar_subquery_<idx>>
            // name so the slice-12/16 name↔index invariant survives
            // (slice-113 set-op-branch withRenamedTo precedent). LineageRefs
            // are idx-based, not name-based, so the rename is cosmetic.
            if (idx != preBuildScalarSize) {
                innerStmt = withRenamedTo(innerStmt, SCALAR_BODY_PREFIX + idx + ">");
            }
            stmts.add(innerStmt);
            String innerOutName = effectiveOutputName(innerCol);
            ordinalToInfo.put(i, new ScalarInfo(idx, innerOutName));
            // Slice 20: pass the chained subquery alias map so
            // OUTER_REFERENCE-of-SUBQUERY refs in deeply nested scalar
            // bodies resolve through ancestor FROM-subquery aliases.
            // Pass innerScalarMap (non-empty when recursive extraction
            // is allowed) so the inner's own STATEMENT_OUTPUT →
            // STATEMENT_OUTPUT edges land.
            emitLineageForStatement(innerStmt, idx, lineage,
                    cteNameToStatementIndex,
                    innerEnclosing.flattenSubqueryAliasToIndex(),
                    innerScalarMap);
        }
        return ordinalToInfo;
    }

    /**
     * Reject nested predicate subqueries inside a scalar body's
     * WHERE / JOIN ON / GROUP BY clauses. Scalar bodies are slice-11
     * scope; the pre-existing builder leaks predicate-subquery refs
     * into {@code filterColumnRefs}/etc. elsewhere, but the scalar-body
     * recursion path is guarded so slice-11 outputs stay clean.
     */
    private static void rejectSubqueriesInScalarBodyClauses(
            TSelectSqlStatement inner, String outerAlias,
            boolean allowWherePredicateSubqueries) {
        // Slice 121 — the WHERE branch is gated. The projection scalar
        // path passes {@code allowWherePredicateSubqueries=true} so its
        // WHERE-side uncorrelated predicate subqueries are instead
        // extracted as their own {@code <predicate_subquery_<i>>}
        // statements by {@code buildSelectStatementImpl} via
        // {@link PredicateClauseContext#SCALAR_BODY_WHERE} (see
        // {@link #extractScalarSubqueriesAsStatementsInternal}). The
        // UPDATE SET-RHS scalar path
        // ({@link #extractScalarSubqueriesFromUpdateSetRhs}) keeps passing
        // {@code false} so its WHERE subqueries still reject with
        // {@code SCALAR_SUBQUERY_INNER_SUBQUERY_IN_WHERE} (the code stays
        // reached). JOIN-ON and GROUP-BY always reject (slice 11/23/26).
        TWhereClause where = inner.getWhereClause();
        if (!allowWherePredicateSubqueries
                && where != null && containsAnySubquery(where)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_INNER_SUBQUERY_IN_WHERE,
                    "scalar subquery '" + outerAlias
                            + "' has a subquery in its WHERE clause; not supported yet "
                            + "(would leak inner refs)", (TParseTreeNode) null));
        }
        if (inner.joins != null) {
            for (TJoin join : inner.joins) {
                TJoinItemList items = join.getJoinItems();
                if (items == null) continue;
                for (int i = 0; i < items.size(); i++) {
                    TJoinItem item = items.getJoinItem(i);
                    TExpression onCond = item == null ? null : item.getOnCondition();
                    if (onCond != null && containsAnySubqueryExpression(onCond)) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_INNER_SUBQUERY_IN_JOIN_ON,
                                "scalar subquery '" + outerAlias
                                        + "' has a subquery in a JOIN ON clause; not supported yet "
                                        + "(would leak inner refs)", (TParseTreeNode) null));
                    }
                }
            }
        }
        TGroupBy groupBy = inner.getGroupByClause();
        if (groupBy != null) {
            TGroupByItemList items = groupBy.getItems();
            if (items != null && containsAnySubquery(items)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_INNER_SUBQUERY_IN_GROUP_BY,
                        "scalar subquery '" + outerAlias
                                + "' has a subquery in a GROUP BY clause; not supported yet "
                                + "(would leak inner refs)", (TParseTreeNode) null));
            }
        }
        // HAVING / ORDER BY subqueries are caught by the slice-9 / 10
        // deep-scan rejecters that fire during buildSelectStatement.
    }

    /**
     * True iff any descendant of {@code root} is a {@link TExpression}
     * with {@code subquery_t} type or a non-null
     * {@link TExpression#getSubQuery()}. Mirrors the slice 9/10 pattern.
     */
    private static boolean containsAnySubquery(gudusoft.gsqlparser.nodes.TParseTreeNode root) {
        final boolean[] found = {false};
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TExpression e) {
                if (found[0]) return;
                if (e.getExpressionType() == EExpressionType.subquery_t
                        || e.getSubQuery() != null) {
                    found[0] = true;
                }
            }
        });
        return found[0];
    }

    /** Same as {@link #containsAnySubquery} but also checks the root expression itself. */
    private static boolean containsAnySubqueryExpression(TExpression root) {
        if (root.getExpressionType() == EExpressionType.subquery_t
                || root.getSubQuery() != null) {
            return true;
        }
        return containsAnySubquery(root);
    }

    /**
     * Slice 119 — collect every {@code subquery_t} TExpression node that
     * is a direct (top-level) subquery in the compound expression {@code
     * root}, without descending into any found subquery's own body.
     *
     * <p>Uses {@link TExpression#acceptChildren} with a depth counter to
     * handle all expression subtypes (arithmetic, CASE, function args)
     * without manual branch enumeration. The depth counter increments on
     * every {@code subquery_t} preVisit and decrements on every postVisit,
     * so nested subqueries inside a found body (e.g. an EXISTS inside a
     * scalar's WHERE) are tracked but NOT added to the result set.
     *
     * <p>Result list is in traversal (preVisit) order for deterministic
     * statement-graph numbering across identical SQL texts.
     */
    private static List<TExpression> collectNestedSubqueryExpressions(TExpression root) {
        if (root == null) return Collections.<TExpression>emptyList();
        // Defensive: root itself is a subquery_t — callers of the
        // mixed-expression path should have already taken the slice-115
        // top-level branch, but guard anyway.
        if (root.getExpressionType() == EExpressionType.subquery_t) {
            return Collections.singletonList(root);
        }
        final List<TExpression> ordered = new ArrayList<>();
        final int[] depth = {0};
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TExpression e) {
                if (e.getExpressionType() == EExpressionType.subquery_t) {
                    if (depth[0] == 0) ordered.add(e); // top-level only
                    depth[0]++;
                }
            }
            @Override
            public void postVisit(TExpression e) {
                if (e.getExpressionType() == EExpressionType.subquery_t) {
                    depth[0]--;
                }
            }
        });
        return ordered;
    }

    /**
     * Slice-14 enclosing-scope map for correlation promotion. Holds the
     * full outer {@link RelationSource} per alias visible from the
     * enclosing scope so {@link #promoteCorrelatedRefsToOuterReference}
     * can read the outer's binding kind and qualifiedName.
     *
     * <p>The map is keyed by lower-cased alias for case-insensitive
     * lookup. The synthesised OUTER_REFERENCE RelationSource's alias is
     * NOT taken from this map's value — it is taken from the inner
     * ref's spelling (see §4.3 of the slice-14 plan), because
     * {@link gudusoft.gsqlparser.ir.semantic.binding.Resolver2NameBindingProvider}
     * records the inner ref's alias verbatim and case-sensitive
     * alias-equality elsewhere relies on that spelling.
     *
     * <p>Slice-15 adds {@link #subqueryAliasToIndex}: when a SUBQUERY-bound
     * outer alias is referenced from an inner correlated scalar, the
     * inner statement's lineage emission needs to look up the outer's
     * FROM-subquery body by alias to wire a STATEMENT_OUTPUT →
     * STATEMENT_OUTPUT edge. The map mirrors the outer's alias→index
     * map but is filtered to alias keys also present in
     * {@link #aliasLowerToOuter} as SUBQUERY entries so the two maps
     * cannot drift apart.
     *
     * <p>Slice-20 generalises slice-14/15's flat map into a chain of
     * ancestor scopes (the {@link #parent} field). Lookups walk innermost
     * → outermost via {@link #lookupAlias(String)}. The
     * {@link #flattenSubqueryAliasToIndex()} helper produces an innermost-
     * wins flattened map for {@code emitLineageForStatement} consumers
     * that resolve OUTER_REFERENCE-of-SUBQUERY through ancestor
     * FROM-subquery aliases. Worst-case asymptotic per build for a
     * scalar chain of depth D with K siblings per level is
     * {@code O(K · D²)}; in practice D ≤ 4-5 for human-written SQL so the
     * constant factor is negligible. If a real-world benchmark surfaces
     * the flatten as a hot path, the obvious fix is a memo keyed on
     * {@code EnclosingScope} identity — deferred until measured.
     */
    private static final class EnclosingScope {
        final Map<String, RelationSource> aliasLowerToOuter;
        final Map<String, Integer> subqueryAliasToIndex;
        /** Slice-20 chain: parent enclosing scope; null at the root. */
        final EnclosingScope parent;

        EnclosingScope(Map<String, RelationSource> aliasLowerToOuter,
                       Map<String, Integer> subqueryAliasToIndex,
                       EnclosingScope parent) {
            this.aliasLowerToOuter = aliasLowerToOuter;
            this.subqueryAliasToIndex = subqueryAliasToIndex;
            this.parent = parent;
        }

        static EnclosingScope empty() {
            return new EnclosingScope(
                    Collections.<String, RelationSource>emptyMap(),
                    Collections.<String, Integer>emptyMap(),
                    /*parent=*/ null);
        }

        /**
         * Walk the chain innermost → outermost; first match wins
         * (shadowing). Defensive cycle guard via identity-keyed visited
         * set: the chain is a DAG by construction (parent links never
         * loop back), but the guard makes the invariant explicit.
         */
        RelationSource lookupAlias(String aliasLower) {
            EnclosingScope cur = this;
            Set<EnclosingScope> visited = Collections.newSetFromMap(
                    new IdentityHashMap<EnclosingScope, Boolean>());
            while (cur != null && visited.add(cur)) {
                RelationSource r = cur.aliasLowerToOuter.get(aliasLower);
                if (r != null) return r;
                cur = cur.parent;
            }
            return null;
        }

        /**
         * Innermost-wins flatten of the SUBQUERY alias → body-index chain.
         * Ancestors contribute their own FROM-subquery alias maps; if both
         * a parent and a child define the same alias, the child wins
         * (innermost shadows outermost). Cycle guard mirrors
         * {@link #lookupAlias(String)}.
         */
        Map<String, Integer> flattenSubqueryAliasToIndex() {
            if (parent == null) return subqueryAliasToIndex;
            Deque<EnclosingScope> stack = new ArrayDeque<>();
            Set<EnclosingScope> visited = Collections.newSetFromMap(
                    new IdentityHashMap<EnclosingScope, Boolean>());
            EnclosingScope cur = this;
            while (cur != null && visited.add(cur)) {
                stack.push(cur);
                cur = cur.parent;
            }
            // Stack top = outermost. Pop outermost first, emit, then
            // innermost overwrites via put(). Result: innermost wins.
            Map<String, Integer> out = new LinkedHashMap<>();
            while (!stack.isEmpty()) {
                EnclosingScope s = stack.pop();
                out.putAll(s.subqueryAliasToIndex);
            }
            return out;
        }
    }

    /**
     * Build an {@link EnclosingScope} for the consuming SELECT by walking
     * its {@link TSelectSqlStatement#tables} list (FROM relations) and
     * classifying each entry. Mirrors how
     * {@link Resolver2NameBindingProvider#bindRelation} would classify
     * the same TTable but produces a full RelationSource per alias so
     * the slice-14 promotion can read both kind and qualifiedName.
     *
     * <p>Slice 20: the {@code parent} parameter chains the new scope to an
     * enclosing one so a doubly-nested scalar body can resolve grandparent
     * aliases. Top-level callers pass {@code null}; recursive scalar
     * extraction passes the caller's enclosing scope.
     *
     * <p>Classification (precedence on collision: CTE name beats
     * base-table name):
     * <ul>
     *   <li>{@code TTable.getTableType() == subquery} AND alias matches
     *       a key in {@code subqueryAliasToIndex} → SUBQUERY-bound.</li>
     *   <li>{@code TTable.getName().toLowerCase()} matches a key in
     *       {@code cteNameToStatementIndex} → CTE-bound.</li>
     *   <li>Otherwise → TABLE-bound.</li>
     * </ul>
     */
    private static EnclosingScope buildEnclosingScope(TSelectSqlStatement consumer,
                                                      Map<String, Integer> cteNameToStatementIndex,
                                                      Map<String, Integer> subqueryAliasToIndex,
                                                      EnclosingScope parent) {
        if (consumer == null || consumer.tables == null || consumer.tables.size() == 0) {
            // Even an empty FROM contributes an empty scope so the chain's
            // shape reflects nesting depth uniformly.
            return new EnclosingScope(
                    Collections.<String, RelationSource>emptyMap(),
                    Collections.<String, Integer>emptyMap(),
                    parent);
        }
        Map<String, RelationSource> map = new LinkedHashMap<>();
        Map<String, Integer> filteredSubqueryAliasToIndex = new LinkedHashMap<>();
        for (int i = 0; i < consumer.tables.size(); i++) {
            TTable t = consumer.tables.getTable(i);
            if (t == null) continue;
            // Slice 74: route anonymous FROM-subqueries through
            // effectiveAliasOf so the synth name (instead of the
            // literal "subquery" returned by t.getName()) flows into the
            // OUTER_REFERENCE scope chain.
            String aliasOrName = effectiveAliasOf(t);
            if (aliasOrName == null || aliasOrName.isEmpty()) continue;
            String lower = aliasOrName.toLowerCase(Locale.ROOT);
            if (map.containsKey(lower)) continue; // first-occurrence wins (defensive)

            if (t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
                if (subqueryAliasToIndex != null && subqueryAliasToIndex.containsKey(lower)) {
                    map.put(lower, new RelationSource(aliasOrName,
                            new RelationBinding(RelationKind.SUBQUERY, aliasOrName)));
                    // Slice 15: keep a parallel filtered map of alias→index
                    // so OUTER_REFERENCE-of-SUBQUERY emit-side dispatch can
                    // resolve the outer body's statement index.
                    filteredSubqueryAliasToIndex.put(lower, subqueryAliasToIndex.get(lower));
                }
                continue;
            }
            if (t.getTableType() != gudusoft.gsqlparser.ETableSource.objectname) {
                continue; // function / rowList / etc. — not modelled
            }
            String name = t.getName();
            if (name == null || name.isEmpty()) continue;
            String nameLower = name.toLowerCase(Locale.ROOT);
            if (cteNameToStatementIndex != null
                    && cteNameToStatementIndex.containsKey(nameLower)) {
                map.put(lower, new RelationSource(aliasOrName,
                        new RelationBinding(RelationKind.CTE, name)));
            } else {
                map.put(lower, new RelationSource(aliasOrName,
                        new RelationBinding(RelationKind.TABLE, name)));
            }
        }
        return new EnclosingScope(map, filteredSubqueryAliasToIndex, parent);
    }

    /**
     * Slice 117 — sibling to {@link #buildEnclosingScope} for UPDATE
     * SET-RHS scalar-subquery bodies. The UPDATE outer scope is the
     * target table (TABLE-bound) plus any FROM-side relations walked
     * via {@code update.getJoins()} (TABLE / CTE / SUBQUERY-classified).
     *
     * <p>The target is added FIRST so on alias collisions with a
     * FROM-side relation (e.g. {@code UPDATE t ... FROM other t}) the
     * target wins. The {@code first-occurrence wins} rule mirrors
     * {@link #buildEnclosingScope}.
     *
     * <p>Used only by
     * {@link #extractScalarSubqueriesFromUpdateSetRhsInternal}.
     */
    private static EnclosingScope buildUpdateEnclosingScope(
            TUpdateSqlStatement update,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, Integer> subqueryAliasToIndex,
            EnclosingScope parent) {
        Map<String, RelationSource> map = new LinkedHashMap<>();
        Map<String, Integer> filteredSubqueryAliasToIndex = new LinkedHashMap<>();
        if (update == null) {
            return new EnclosingScope(map, filteredSubqueryAliasToIndex, parent);
        }
        // 1) Target — always TABLE-bound. effectiveAliasOf falls back to
        //    the table's own name when no alias is present.
        TTable target = update.getTargetTable();
        if (target != null
                && target.getTableType() == gudusoft.gsqlparser.ETableSource.objectname) {
            String targetAlias = effectiveAliasOf(target);
            String targetName = target.getName();
            if (targetAlias != null && !targetAlias.isEmpty()
                    && targetName != null && !targetName.isEmpty()) {
                String aliasLower = targetAlias.toLowerCase(Locale.ROOT);
                map.put(aliasLower, new RelationSource(targetAlias,
                        new RelationBinding(RelationKind.TABLE, targetName)));
            }
        }
        // 2) FROM-side joins.
        TJoinList joins = update.getJoins();
        if (joins != null) {
            for (TJoin join : joins) {
                addUpdateRelationToEnclosingScope(join.getTable(), map,
                        filteredSubqueryAliasToIndex,
                        cteNameToStatementIndex, subqueryAliasToIndex);
                TJoinItemList items = join.getJoinItems();
                if (items == null) continue;
                for (int i = 0; i < items.size(); i++) {
                    TJoinItem item = items.getJoinItem(i);
                    if (item == null) continue;
                    addUpdateRelationToEnclosingScope(item.getTable(), map,
                            filteredSubqueryAliasToIndex,
                            cteNameToStatementIndex, subqueryAliasToIndex);
                }
            }
        }
        return new EnclosingScope(map, filteredSubqueryAliasToIndex, parent);
    }

    /**
     * Slice 117 — classify one FROM-side TTable for
     * {@link #buildUpdateEnclosingScope}. SUBQUERY-typed tables go to
     * {@link RelationKind#SUBQUERY} if their alias was registered in
     * {@code subqueryAliasToIndex} (slice-83 extraction map); objectname
     * tables go to {@link RelationKind#CTE} if their bare name is a
     * declared CTE, otherwise {@link RelationKind#TABLE}. First-
     * occurrence wins. Function / rowList sources are silently skipped
     * (not modelled).
     */
    private static void addUpdateRelationToEnclosingScope(TTable t,
            Map<String, RelationSource> map,
            Map<String, Integer> filteredSubqueryAliasToIndex,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, Integer> subqueryAliasToIndex) {
        if (t == null) return;
        String aliasOrName = effectiveAliasOf(t);
        if (aliasOrName == null || aliasOrName.isEmpty()) return;
        String lower = aliasOrName.toLowerCase(Locale.ROOT);
        if (map.containsKey(lower)) return; // first-occurrence wins
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
            if (subqueryAliasToIndex != null
                    && subqueryAliasToIndex.containsKey(lower)) {
                map.put(lower, new RelationSource(aliasOrName,
                        new RelationBinding(RelationKind.SUBQUERY, aliasOrName)));
                filteredSubqueryAliasToIndex.put(lower,
                        subqueryAliasToIndex.get(lower));
            }
            return;
        }
        if (t.getTableType() != gudusoft.gsqlparser.ETableSource.objectname) {
            return; // function / rowList / etc. — not modelled
        }
        String name = t.getName();
        if (name == null || name.isEmpty()) return;
        String nameLower = name.toLowerCase(Locale.ROOT);
        if (cteNameToStatementIndex != null
                && cteNameToStatementIndex.containsKey(nameLower)) {
            map.put(lower, new RelationSource(aliasOrName,
                    new RelationBinding(RelationKind.CTE, name)));
        } else {
            map.put(lower, new RelationSource(aliasOrName,
                    new RelationBinding(RelationKind.TABLE, name)));
        }
    }

    /**
     * Slice 118 — sibling to {@link #buildUpdateEnclosingScope} for MERGE
     * per-WHEN action WHERE correlated predicate subqueries. Builds the
     * enclosing scope's relation map covering MERGE's target table, USING
     * source, and any outer CTEs declared on the MERGE itself. Used only
     * by {@link #collectMergeActionWhere}; produced once per MERGE in
     * {@link #buildMerge} and threaded through the predicate-subquery
     * extractor.
     *
     * <p>Classification mirrors {@code buildMerge} step 6:
     * <ul>
     *   <li>{@code merge.getTargetTable()} — TABLE-bound (qualifiedName =
     *       target's table name). First-occurrence wins.</li>
     *   <li>{@code merge.getUsingTable()}:
     *       <ul>
     *         <li>SUBQUERY-typed → SUBQUERY-bound with index pulled from
     *             {@code aliasToSubIdx}.</li>
     *         <li>objectname-typed AND name in
     *             {@code cteNameToStatementIndex} → CTE-bound (slice-101
     *             USING-as-CTE).</li>
     *         <li>Else objectname → TABLE-bound.</li>
     *       </ul></li>
     * </ul>
     */
    private static EnclosingScope buildMergeEnclosingScope(
            TMergeSqlStatement merge,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, Integer> aliasToSubIdx) {
        Map<String, RelationSource> map = new LinkedHashMap<>();
        Map<String, Integer> filteredSubqueryAliasToIndex = new LinkedHashMap<>();
        if (merge == null) {
            return new EnclosingScope(map, filteredSubqueryAliasToIndex,
                    /*parent=*/ null);
        }
        // 1) Target — always TABLE-bound. effectiveAliasOf falls back to
        //    the table's own name when no alias is present.
        TTable target = merge.getTargetTable();
        if (target != null
                && target.getTableType() == gudusoft.gsqlparser.ETableSource.objectname) {
            String targetAlias = effectiveAliasOf(target);
            String targetName = target.getName();
            if (targetAlias != null && !targetAlias.isEmpty()
                    && targetName != null && !targetName.isEmpty()) {
                String aliasLower = targetAlias.toLowerCase(Locale.ROOT);
                map.put(aliasLower, new RelationSource(targetAlias,
                        new RelationBinding(RelationKind.TABLE, targetName)));
            }
        }
        // 2) USING source.
        TTable using = merge.getUsingTable();
        if (using != null) {
            String usingAlias = effectiveAliasOf(using);
            // Fall back to the USING source's bare name when no alias is
            // present — matches buildMerge's `usingAlias` initialisation.
            if (usingAlias == null || usingAlias.isEmpty()) {
                usingAlias = (using.getName() == null
                        || using.getName().toString().isEmpty())
                        ? "__merge_using__"
                        : using.getName().toString();
            }
            String usingAliasLower = usingAlias.toLowerCase(Locale.ROOT);
            // First-occurrence wins (defensive — target's alias could
            // theoretically shadow if user named USING source identically;
            // matches buildUpdateEnclosingScope behaviour).
            if (!map.containsKey(usingAliasLower)) {
                if (using.getTableType()
                        == gudusoft.gsqlparser.ETableSource.subquery) {
                    if (aliasToSubIdx != null
                            && aliasToSubIdx.containsKey(usingAliasLower)) {
                        map.put(usingAliasLower, new RelationSource(usingAlias,
                                new RelationBinding(RelationKind.SUBQUERY,
                                        usingAlias)));
                        filteredSubqueryAliasToIndex.put(usingAliasLower,
                                aliasToSubIdx.get(usingAliasLower));
                    }
                } else if (using.getTableType()
                        == gudusoft.gsqlparser.ETableSource.objectname) {
                    String usingName = using.getName();
                    if (usingName != null && !usingName.isEmpty()) {
                        String usingNameLower =
                                usingName.toLowerCase(Locale.ROOT);
                        Integer cteIdx = (cteNameToStatementIndex == null)
                                ? null
                                : cteNameToStatementIndex.get(usingNameLower);
                        if (cteIdx != null) {
                            // Slice 101 USING-as-CTE branch — model as
                            // SUBQUERY-bound so the promoter classifies
                            // outerKind=SUBQUERY (mirrors the slice-117
                            // SUBQUERY classifier for UPDATE FROM-CTE
                            // sources, also via aliasToSubIdx).
                            map.put(usingAliasLower, new RelationSource(usingAlias,
                                    new RelationBinding(RelationKind.SUBQUERY,
                                            usingAlias)));
                            // The MERGE caller pre-populates aliasToSubIdx
                            // with the CTE's statement index for both
                            // usingAlias AND bare CTE name. Use whichever
                            // exists (aliasToSubIdx is keyed on lower-cased
                            // aliases — matches buildMerge step 6).
                            if (aliasToSubIdx != null
                                    && aliasToSubIdx.containsKey(usingAliasLower)) {
                                filteredSubqueryAliasToIndex.put(usingAliasLower,
                                        aliasToSubIdx.get(usingAliasLower));
                            }
                        } else {
                            map.put(usingAliasLower, new RelationSource(usingAlias,
                                    new RelationBinding(RelationKind.TABLE, usingName)));
                        }
                    }
                }
                // function / rowList sources are silently skipped (not
                // modelled — same convention as buildUpdateEnclosingScope).
            }
        }
        return new EnclosingScope(map, filteredSubqueryAliasToIndex,
                /*parent=*/ null);
    }

    /**
     * Slice 117 — precompute the lowercased set of inner local FROM
     * aliases for a SELECT statement, used by the tolerant-outer-
     * binding fallback in
     * {@link gudusoft.gsqlparser.ir.semantic.binding.Resolver2NameBindingProvider#bindColumn}.
     * Walks {@code select.tables} (which includes both the FROM driver
     * and any JOIN sides) and collects each table's effective alias.
     *
     * <p>Computed BEFORE the inner build's {@code buildRelations} JOIN-
     * ON collector runs so the tolerant provider is already scope-aware
     * when the collector first calls {@code bindColumn} (codex round-5
     * ordering fix).
     */
    private static Set<String> precomputeInnerLocalAliases(
            TSelectSqlStatement select) {
        Set<String> aliases = new HashSet<>();
        if (select == null || select.tables == null) return aliases;
        for (int i = 0; i < select.tables.size(); i++) {
            TTable t = select.tables.getTable(i);
            if (t == null) continue;
            String alias = effectiveAliasOf(t);
            if (alias != null && !alias.isEmpty()) {
                aliases.add(alias.toLowerCase(Locale.ROOT));
            }
        }
        return aliases;
    }

    /**
     * Slice-14 correlation promotion (slice-15 extended). Walk every
     * column ref in the already-built inner statement; any ref whose
     * alias is NOT in the inner's local relations is "correlated."
     * Look it up in the enclosing scope:
     *
     * <ul>
     *   <li>Found AND TABLE / CTE / SUBQUERY-bound → synthesise an
     *       OUTER_REFERENCE RelationSource with {@code outerKind}
     *       set to the resolved outer kind, and add to
     *       {@code inner.relations}.</li>
     *   <li>Found AND UNION / UNKNOWN-bound → throw defensively
     *       (no current builder path produces these from a FROM
     *       relation).</li>
     *   <li>Not found anywhere → throw (Resolver2 should not give us
     *       such a ref; defensive).</li>
     * </ul>
     *
     * <p>The synthesised RelationSource's alias is the inner ref's
     * spelling (case-sensitive equality is preserved). The
     * qualifiedName comes from the outer's existing binding:
     * - TABLE: outer's table name.
     * - CTE: outer's CTE name (NOT alias — see
     *   {@code correlatedToCteBoundOuterWithCteAlias}).
     * - SUBQUERY: outer's alias (matching slice-14 SUBQUERY
     *   convention, where {@code buildEnclosingScope} sets
     *   {@code qualifiedName=aliasOrName}).
     * No lower-casing happens here — that happens at projector
     * emit-time per slice-1 convention. Multiple inner refs with
     * case-variant spellings inherit the same pre-existing slice-1
     * limitation.
     */
    private static StatementGraph promoteCorrelatedRefsToOuterReference(
            StatementGraph innerStmt, String outerAlias,
            EnclosingScope enclosingScope) {
        Set<String> innerAliasesLower = new HashSet<>();
        for (RelationSource r : innerStmt.getRelations()) {
            innerAliasesLower.add(r.getAlias().toLowerCase(Locale.ROOT));
        }
        // Per alias-lower: outer's RelationSource (for binding) and the
        // inner ref's exact alias spelling (for the synthesised alias).
        LinkedHashMap<String, RelationSource> outerByLower = new LinkedHashMap<>();
        LinkedHashMap<String, String> firstRefSpellingByLower = new LinkedHashMap<>();

        for (ColumnRef ref : collectAllInnerRefs(innerStmt)) {
            String aliasLower = ref.getRelationAlias().toLowerCase(Locale.ROOT);
            if (innerAliasesLower.contains(aliasLower)) continue; // local — not correlated
            if (outerByLower.containsKey(aliasLower)) continue;   // already promoted

            // Slice 20: chain-walking lookup. Walks the EnclosingScope
            // chain innermost → outermost; first match wins (shadowing
            // semantics). slice 14/15 used a single-level get(); slice
            // 20 generalises so inner-inner scalars can resolve
            // grandparent (and deeper) aliases.
            RelationSource outerRel = enclosingScope.lookupAlias(aliasLower);
            if (outerRel == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_UNKNOWN_RELATION_ALIAS,
                        "scalar subquery '" + outerAlias
                                + "' references unknown alias '" + ref.getRelationAlias()
                                + "' (column '" + ref.getRelationAlias() + "."
                                + ref.getColumnName()
                                + "'); not in inner relations or any enclosing scope", (TParseTreeNode) null));
            }
            RelationKind outerKind = outerRel.getBinding().getKind();
            if (outerKind != RelationKind.TABLE
                    && outerKind != RelationKind.CTE
                    && outerKind != RelationKind.SUBQUERY) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.CORRELATED_SCALAR_SUBQUERY_UNKNOWN_OUTER_BINDING,
                        "correlated scalar subquery '" + outerAlias
                                + "' references outer alias '" + ref.getRelationAlias()
                                + "' bound to a " + outerKind
                                + "; only TABLE / CTE / SUBQUERY-bound outer correlations supported", (TParseTreeNode) null));
            }
            outerByLower.put(aliasLower, outerRel);
            firstRefSpellingByLower.put(aliasLower, ref.getRelationAlias());
        }

        if (outerByLower.isEmpty()) return innerStmt;

        List<RelationSource> augmented = new ArrayList<>(innerStmt.getRelations());
        for (String key : outerByLower.keySet()) {
            RelationSource outerRel = outerByLower.get(key);
            augmented.add(new RelationSource(
                    firstRefSpellingByLower.get(key),
                    new RelationBinding(RelationKind.OUTER_REFERENCE,
                            outerRel.getBinding().getQualifiedName(),
                            outerRel.getBinding().getKind())));
        }
        return rebuildStatementGraphWithRelations(innerStmt, augmented);
    }

    /**
     * Collect every {@link ColumnRef} reachable from {@code innerStmt}'s
     * seven clause-bearing fields. Used by
     * {@link #promoteCorrelatedRefsToOuterReference} (slice-11 scalar
     * bodies) and the JOIN-ON EXISTS predicate-body correlation walker
     * (slice 23+); mirrors the old rejecter's clause coverage exactly
     * (output sources, filter, join, groupBy, having, orderBy, and
     * slice-73 distinctOn).
     */
    private static List<ColumnRef> collectAllInnerRefs(StatementGraph innerStmt) {
        List<ColumnRef> all = new ArrayList<>();
        for (OutputColumn out : innerStmt.getOutputColumns()) {
            all.addAll(out.getSources());
        }
        all.addAll(innerStmt.getFilterColumnRefs());
        all.addAll(innerStmt.getJoinColumnRefs());
        all.addAll(innerStmt.getGroupByColumnRefs());
        all.addAll(innerStmt.getHavingColumnRefs());
        all.addAll(innerStmt.getOrderByColumnRefs());
        all.addAll(innerStmt.getDistinctOnColumnRefs());
        return all;
    }

    /**
     * Copy a {@link StatementGraph} replacing only its relations list.
     * StatementGraph is otherwise immutable.
     */
    private static StatementGraph rebuildStatementGraphWithRelations(
            StatementGraph stmt, List<RelationSource> relations) {
        return new StatementGraph(
                stmt.getName(),
                stmt.getKind(),
                relations,
                stmt.getOutputColumns(),
                stmt.getFilterColumnRefs(),
                stmt.getJoinColumnRefs(),
                stmt.getGroupByColumnRefs(),
                stmt.getHavingColumnRefs(),
                stmt.getOrderByColumnRefs(),
                stmt.getDistinctOnColumnRefs(),
                stmt.isDistinct(),
                stmt.getSetOperator(),
                stmt.getRowLimit())
                // Slice 180 (R5): preserve the block span the legacy ctor
                // would otherwise drop (this copy only swaps relations).
                .withSourceSpan(stmt.getSourceSpan());
    }

    /**
     * Slice 16 preflight: reject any FROM-clause subquery directly on a
     * set-op branch's FROM/JOIN list, BEFORE
     * {@link #extractScalarSubqueriesAsStatements} can append scalar-body
     * statements to {@code stmts}/{@code lineage}. Without this preflight,
     * a branch with both a FROM-subquery and a scalar projection would
     * extract the scalar (mutating shared state) and then fail later in
     * {@code buildSelectStatement}, producing a confusing scalar-correlation
     * error message instead of the slice-12 FROM-subquery boundary.
     *
     * <p>Inspects only the branch's DIRECT FROM/JOIN entries — does NOT
     * recurse into result-column expressions or scalar-body inner SELECTs
     * (those are handled by the recursive scalar-body build's own
     * {@code allowFromSubqueries=false} guard). The error message contains
     * both {@code set-op branch} and {@code FROM-clause subquery} keywords
     * so the slice-12 boundary is surfaced explicitly.
     */
    private static void rejectFromSubqueriesInSetOpBranch(TSelectSqlStatement br) {
        if (br.joins == null) return;
        for (TJoin join : br.joins) {
            TTable left = join.getTable();
            if (left != null
                    && left.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_IN_SET_OP_BRANCH_FROM,
                        "FROM-clause subquery directly in a set-op branch FROM is not "
                                + "supported yet (set-op branch with FROM-clause subquery)", (TParseTreeNode) null));
            }
            // Slice 140: a PIVOT/UNPIVOT branch whose SOURCE is a FROM-subquery
            // (`SELECT ... FROM (SELECT ...) PIVOT(...) UNION ALL ...`) is
            // deferred. The slice-138 `processDirectSubqueryTable` pre-extraction
            // is NOT called from the set-op branch path (set-op branches set
            // `allowFromSubqueries=false`), so routing such a shape to
            // `buildPivotSelect` would land in `buildRelation` on the inner
            // subquery TTable with empty `subqueryAliasToIndex` and emit a
            // less-informative second-step `TABLE_BINDING_UNRESOLVED` against
            // the inner subquery. Reuse the existing
            // `FROM_SUBQUERY_IN_SET_OP_BRANCH_FROM` code with a discriminated
            // message; no new DiagnosticCode.
            if (left != null
                    && left.getTableType() == gudusoft.gsqlparser.ETableSource.pivoted_table
                    && left.getPivotedTable() != null
                    && !left.getPivotedTable().getRelations().isEmpty()
                    && left.getPivotedTable().getRelations().get(0) != null
                    && left.getPivotedTable().getRelations().get(0).getTableType()
                            == gudusoft.gsqlparser.ETableSource.subquery) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_IN_SET_OP_BRANCH_FROM,
                        "FROM-clause subquery as a PIVOT source in a set-op branch is "
                                + "not supported yet (set-op branch with FROM-clause subquery)", (TParseTreeNode) null));
            }
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TTable r = items.getJoinItem(i).getTable();
                if (r != null
                        && r.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_ON_JOIN_SIDE_IN_SET_OP_BRANCH,
                            "FROM-clause subquery on a JOIN side in a set-op branch is "
                                    + "not supported yet (set-op branch with FROM-clause subquery)", (TParseTreeNode) null));
                }
            }
        }
    }

    // ====================================================================
    // Slice 12: Set operations (UNION / INTERSECT / MINUS / EXCEPT).
    //
    // Algorithm: each branch of the set-op tree is built as its own
    // synthetically-named StatementGraph; the outer set-op statement has
    // empty relations and per-output `STATEMENT_OUTPUT → STATEMENT_OUTPUT`
    // lineage edges to each branch's corresponding output. The flatten
    // walks the left-leaning AST iteratively (CLAUDE.md mandates no
    // recursion on leftStmt/rightStmt; would StackOverflow on 2000+ UNIONs).
    //
    // Internal-node modifiers (ORDER BY / row-limits) are rejected on every
    // set-op node visited (root + internal), not just the root, because
    // parenthesized inner combined nodes can carry those modifiers (per
    // /tmp/SetOpInnerModifierProbe: `(A UNION B ORDER BY id) UNION C`
    // attaches ORDER BY to the inner node in Oracle / PostgreSQL / MSSQL;
    // PostgreSQL maps inner FETCH FIRST → LIMIT).
    // ====================================================================

    /**
     * Build a set-op program: flatten branches, build each as its own
     * StatementGraph, construct the outer set-op statement, emit lineage.
     * Returns the outer set-op statement's index in {@code stmts}.
     *
     * @param setOp the {@link TSelectSqlStatement} carrying
     *     {@code setOperatorType != none}.
     * @param setOpName non-null when the set-op is a CTE body (the outer
     *     statement is named with the CTE name); null when the set-op is
     *     the program's top-level outer.
     * @param hasOuterCteListAlreadyProcessed true when the caller already
     *     processed the set-op root's CTE list (top-level dispatch);
     *     false when this is a recursive context (set-op CTE body) where
     *     a non-empty CTE list on the set-op root is rejected as a
     *     nested WITH.
     */
    private static int buildSetOpProgram(TSelectSqlStatement setOp,
                                         NameBindingProvider provider,
                                         List<StatementGraph> stmts,
                                         List<LineageEdge> lineage,
                                         Map<String, Integer> cteNameToStatementIndex,
                                         String setOpName,
                                         boolean hasOuterCteListAlreadyProcessed) {
        // Nested-WITH guard (rd-5 MUST 1): when called from a CTE body
        // context, the set-op root must not carry its own CTE list.
        if (!hasOuterCteListAlreadyProcessed
                && setOp.getCteList() != null
                && setOp.getCteList().size() > 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.NESTED_WITH_NOT_SUPPORTED,
                    "nested WITH/CTE inside a CTE body or subquery is not supported yet "
                            + "(set-op CTE body has its own CTE list)", (TParseTreeNode) null));
        }
        // Slice 21: ORDER BY is now collected from the outer set-op
        // (see buildSetOpOuterOrderByColumnRefs).
        // Slice 72: outer row-limit lifted via buildSetOpRowLimit.
        // The internal-node reject (parenthesized inner set-ops with
        // row-limit) fires inside flattenSetOpTreeIteratively. Compute
        // BEFORE the snapshot block so a defensive throw (Hive/Vertica/
        // ANSI-DB2 guards, MSSQL null-valued TOrderBy slots) propagates
        // without leaving stmts/lineage partially populated.
        RowLimit setOpRowLimit = buildSetOpRowLimit(setOp);

        // Slice 16: SET-OP-WIDE TRANSACTIONAL ROLLBACK (codex rounds 3-5
        // adversarial findings). Snapshot `stmts.size()` and
        // `lineage.size()` BEFORE any branch mutation. On any
        // SemanticIRBuildException thrown by the per-branch loop or
        // post-build validation, truncate both lists back to the snapshot
        // and rethrow. This addresses the full class of "mutation-free
        // branch validation that fires after earlier-branch mutations":
        // FROM-subquery preflight (round 3), column-count check (round 4),
        // multi-scalar-projection per-branch validation (round 5), branch
        // duplicate-output-names check (round 5), and any future check
        // that may join the same class. The pre-loop preflight below
        // remains for fast-fail with better error messages on common
        // shapes, but the rollback is the safety net.
        int stmtsSnapshot = stmts.size();
        int lineageSnapshot = lineage.size();
        try {
            return buildSetOpProgramInternal(setOp, provider, stmts, lineage,
                    cteNameToStatementIndex, setOpName,
                    hasOuterCteListAlreadyProcessed, setOpRowLimit);
        } catch (RuntimeException e) {
            while (stmts.size() > stmtsSnapshot) stmts.remove(stmts.size() - 1);
            while (lineage.size() > lineageSnapshot) lineage.remove(lineage.size() - 1);
            throw e;
        }
    }

    /**
     * Internal body of {@link #buildSetOpProgram}. Wrapped with
     * snapshot/rollback by the public entry point; do not call directly.
     */
    private static int buildSetOpProgramInternal(TSelectSqlStatement setOp,
                                                  NameBindingProvider provider,
                                                  List<StatementGraph> stmts,
                                                  List<LineageEdge> lineage,
                                                  Map<String, Integer> cteNameToStatementIndex,
                                                  String setOpName,
                                                  boolean hasOuterCteListAlreadyProcessed,
                                                  RowLimit setOpRowLimit) {

        SetOperator setOpKind = resolveSetOperator(setOp);
        List<TSelectSqlStatement> branches = flattenSetOpTreeIteratively(setOp, setOpKind);
        if (branches.size() < 2) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_BRANCH_COUNT_TOO_FEW,
                    "set-op flatten produced " + branches.size()
                            + " branches; expected at least 2", (TParseTreeNode) null));
        }

        // Slice 16: PRE-LOOP PREFLIGHT (codex round-3 + round-4 adversarial
        // findings — medium). Run all mutation-free branch validation across
        // EVERY branch BEFORE the main build loop runs. Without this, a
        // scalar-bearing earlier branch can append scalar-body statements to
        // `stmts`/`lineage` BEFORE a later branch's rejection fires, leaving
        // partial state on the rejection path. The slice-16 safety claim is
        // "no half-built scalar bodies leak when a branch is rejected"; that
        // claim only holds when ALL mutation-free branch checks are
        // set-op-wide.
        //
        // Checks bundled here (each is AST-only and side-effect-free):
        //   - Defensive nested-set-op leaf check (slice 12).
        //   - Direct branch FROM-subquery rejection (slice 16 round 3).
        //   - Result-column-count compatibility across branches (slice 12,
        //     moved here in slice 16 round 4 — uses AST
        //     getResultColumnList().size() since BUILT outputColumns.size()
        //     is unavailable pre-build; the post-loop check on BUILT
        //     outputs stays as a defensive backup if AST-vs-built ever
        //     diverges for a future shape).
        int expectedAstCols = -1;
        for (int i = 0; i < branches.size(); i++) {
            TSelectSqlStatement br = branches.get(i);
            if (br.getSetOperatorType() != null
                    && br.getSetOperatorType() != ESetOperatorType.none) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_BRANCH_IS_SET_OP,
                        "set-op branch is itself a set operation; nested set "
                                + "operations in branches are not supported yet", (TParseTreeNode) null));
            }
            rejectFromSubqueriesInSetOpBranch(br);
            int astCols = br.getResultColumnList() == null
                    ? 0
                    : br.getResultColumnList().size();
            if (i == 0) {
                expectedAstCols = astCols;
            } else if (astCols != expectedAstCols) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_BRANCH_COLUMN_COUNT_MISMATCH,
                        "set-op branch column-count mismatch: branch[0] has "
                                + expectedAstCols + " columns, branch[" + i + "] has "
                                + astCols, (TParseTreeNode) null));
            }
        }

        int[] branchIdxs = new int[branches.size()];
        for (int i = 0; i < branches.size(); i++) {
            TSelectSqlStatement br = branches.get(i);

            // Slice 16: per-branch enclosing scope. allowFromSubqueries
            // stays false at the branch level so subqueryAliasToIndex
            // is empty (no OUTER_REFERENCE-of-SUBQUERY in branches).
            // CTE-aware so a branch's scalar can correlate to a CTE
            // visible in scope (top-level set-ops have all outer CTEs
            // indexed; CTE-body set-ops have only prior visible CTEs
            // indexed — the current CTE is registered AFTER this method
            // returns, by design, mirroring the non-set-op CTE body path).
            EnclosingScope branchEnclosing = buildEnclosingScope(br,
                    cteNameToStatementIndex,
                    Collections.<String, Integer>emptyMap(),
                    /*parent=*/ null);
            // Slice 20: pass `false` so the slice-12 / slice-16 boundary
            // holds — branch scalar bodies must NOT host another scalar
            // projection. The branch's TOP-LEVEL scalar projection is
            // still allowed (slice 16); deeper recursion is not.
            Map<Integer, ScalarInfo> branchScalarMap =
                    extractScalarSubqueriesAsStatements(br, provider,
                            stmts, lineage, cteNameToStatementIndex, branchEnclosing,
                            /*allowRecursiveScalarSubqueryExtraction=*/ false);

            // Slice 16: compute branchName AFTER scalar extraction so the
            // digit suffix in `<set_op_branch_<idx>>` matches the branch's
            // final position in `stmts`. Scalar bodies appended by
            // extractScalarSubqueriesAsStatements come BEFORE the branch
            // in `stmts`, so pre-extraction `stmts.size()` would be wrong
            // by (number of scalar bodies in this branch) — breaking the
            // slice-12 invariant that branch synthetic names round-trip
            // to their statement index.
            //
            // Slice 113 — predicate bodies extracted from the branch's
            // WHERE clause via {@link PredicateClauseContext#SET_OP_BRANCH_WHERE}
            // also land in {@code stmts} BEFORE the branch, INSIDE the
            // {@code buildSelectStatementImpl} call below. So the
            // pre-build {@code stmts.size()} can still understate the
            // branch's final position. The slice-12/16 invariant is
            // preserved by computing a tentative name pre-build (best
            // guess used by inner consumers that need a non-null name),
            // then rebuilding the StatementGraph with the corrected
            // name AFTER the build via {@link #withRenamedTo} if any
            // predicate body was extracted.
            int preBuildStmtsSize = stmts.size();
            String tentativeBranchName = SET_OP_BRANCH_PREFIX + preBuildStmtsSize + ">";
            StatementGraph branchStmt;
            if (isPivotSelect(br)) {
                // Slice 140: a nested PIVOT / UNPIVOT in a set-op branch
                // (`SELECT ... FROM base PIVOT(...) UNION ALL ...`). The
                // slice-129 pivot router in {@link #buildSelectStatementImpl}
                // is gated to `name == null && !isPredicateBody`; a set-op
                // branch carries the synthetic `<set_op_branch_N>` name, so
                // the gate misses and the branch would otherwise fall to the
                // normal path which can't bind a `pivoted_table` (rejects
                // with the misleading TABLE_BINDING_UNRESOLVED
                // "null(piviot_table)"). Route it to `buildPivotSelect` with
                // the synthetic branch name so the branch becomes a proper
                // pivot StatementGraph. PIVOT extra-clause / chained /
                // malformed-UNPIVOT / bare-`*`-without-catalog rejects stay
                // deferred via `buildPivotSelect`'s own guards. The
                // FROM-subquery-source case is pre-flight-rejected by the
                // extended {@link #rejectFromSubqueriesInSetOpBranch} above,
                // so `buildPivotSelect.buildRelation` never lands on an
                // unresolvable subquery TTable here. No
                // `withRenamedTo` rebuild block is needed below because
                // `buildPivotSelect` does not extract predicate bodies during
                // its build (its `rejectPivotExtraClauses` fires on WHERE /
                // GROUP BY / HAVING / ORDER BY / QUALIFY / DISTINCT /
                // row-limit / set-op).
                //
                // Direct analogue of slice 138 (FROM-subquery body via
                // `processDirectSubqueryTable`) and slice 139 (CTE body
                // via the four CTE walkers). This is the FIFTH and final
                // SemanticIRBuilder routing site that previously missed
                // the pivot router.
                branchStmt = buildPivotSelect(br, provider, tentativeBranchName);
            } else {
                branchStmt = buildSelectStatementImpl(br, provider, tentativeBranchName,
                        /*hasOuterCteListAlreadyProcessed=*/ false,
                        /*allowFromSubqueries=*/ false,
                        /*allowScalarProjectionSubqueries=*/ true,   // ← slice-16 lift
                        /*allowWindowProjection=*/ true,
                        // Slice 113 keeps JOIN-ON predicate subqueries rejected
                        // in set-op branches (slice 23 / 26 contract pinned by
                        // existsInSetOpBranchJoinOnStillRejected /
                        // lhsSubqueryInSetOpBranchRejected) — the lift is
                        // WHERE-only. The two flags are now independent.
                        /*allowJoinOnPredicateSubqueries=*/ false,
                        /*stmtsForExtraction=*/ stmts,               // ← slice-113
                        /*lineageForExtraction=*/ lineage,           // ← slice-113
                        /*cteMapForExtraction=*/ cteNameToStatementIndex, // ← slice-113
                        /*isPredicateBody=*/ false,
                        /*whereClauseContext=*/ PredicateClauseContext.SET_OP_BRANCH_WHERE,
                        /*allowWherePredicateSubqueries=*/ true);    // ← slice-113 lift
            }
            int idx = stmts.size();
            if (idx != preBuildStmtsSize) {
                // Slice 113 — predicate bodies were appended during
                // the branch build. Rebuild the StatementGraph with
                // the corrected name so the slice-12/16 invariant
                // (digit suffix == final position) survives. The
                // rebuild copies all 15 fields; no LineageRef is
                // affected because they are idx-based, not name-based
                // (codex round-1 Q4 resolution).
                String finalBranchName = SET_OP_BRANCH_PREFIX + idx + ">";
                branchStmt = withRenamedTo(branchStmt, finalBranchName);
            }
            rejectDuplicateOutputNames(branchStmt, branchStmt.getName());
            branchIdxs[i] = idx;
            stmts.add(branchStmt);
            // Branch's own per-output, filter, and join lineage. Pass
            // the branch's scalar map so STATEMENT_OUTPUT →
            // STATEMENT_OUTPUT edges to scalar bodies are emitted.
            // subqueryAliasToIndex stays empty (allowFromSubqueries=false
            // for branches, so no FROM-subquery aliases exist at this scope).
            emitLineageForStatement(branchStmt, idx, lineage,
                    cteNameToStatementIndex,
                    Collections.<String, Integer>emptyMap(),
                    branchScalarMap);
        }

        // Validate column-count alignment via BUILT statements.
        int expectedCols = stmts.get(branchIdxs[0]).getOutputColumns().size();
        for (int i = 1; i < branches.size(); i++) {
            int n = stmts.get(branchIdxs[i]).getOutputColumns().size();
            if (n != expectedCols) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_BRANCH_COLUMN_COUNT_MISMATCH,
                        "set-op branch column-count mismatch: branch[0] has "
                                + expectedCols + " columns, branch[" + i + "] has " + n, (TParseTreeNode) null));
            }
        }

        // Build outer outputs from branch[0]'s built outputs.
        StatementGraph branch0 = stmts.get(branchIdxs[0]);
        List<OutputColumn> outerOutputs = new ArrayList<>(expectedCols);
        Set<String> seenOuter = new HashSet<>();
        for (int i = 0; i < expectedCols; i++) {
            OutputColumn b0 = branch0.getOutputColumns().get(i);
            String name = b0.getName();
            if (name == null || name.isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_BRANCH_OUTPUT_NAME_UNUSABLE,
                        "set-op output position " + i + " has no usable name in branch[0]; "
                                + "add an alias to the SELECT-list expression", (TParseTreeNode) null));
            }
            if (!seenOuter.add(name.toLowerCase(Locale.ROOT))) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_DUPLICATE_OUTER_OUTPUT_NAME,
                        "set-op outer output name '" + name + "' is duplicated "
                                + "(branch[0] has duplicate output names)", null));
            }
            outerOutputs.add(new OutputColumn(name,
                    /*derived=*/ true,
                    /*aggregate=*/ false,
                    /*sources=*/ Collections.<ColumnRef>emptyList(),
                    /*windowSpec=*/ null));
        }

        // Slice 21: collect outer ORDER BY refs from branches' base sources.
        // A throw here unwinds via the slice-16 snapshot/rollback wrapper
        // in buildSetOpProgram(), so partially-built branches/scalar-bodies
        // do not leak into stmts/lineage on rejection.
        List<ColumnRef> outerOrderByRefs = buildSetOpOuterOrderByColumnRefs(
                setOp, outerOutputs, stmts, branchIdxs);

        StatementGraph outer = new StatementGraph(setOpName, "SELECT",
                /*relations=*/ Collections.<RelationSource>emptyList(),
                outerOutputs,
                /*filterColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*joinColumnRefs=*/  Collections.<ColumnRef>emptyList(),
                /*groupByColumnRefs=*/Collections.<ColumnRef>emptyList(),
                /*havingColumnRefs=*/ Collections.<ColumnRef>emptyList(),
                /*orderByColumnRefs=*/outerOrderByRefs,
                /*distinctOnColumnRefs=*/Collections.<ColumnRef>emptyList(),
                /*distinct=*/ false,
                /*setOperator=*/ setOpKind,
                /*rowLimit=*/ setOpRowLimit);
        // Slice 180 (R5): the set-op outer block's span covers the whole
        // set-op statement.
        outer = outer.withSourceSpan(SourceSpan.of(setOp));
        int outerIdx = stmts.size();
        stmts.add(outer);

        // Lineage: outer.outputs[i] → each branch.outputs[i] (in branch order).
        for (int i = 0; i < expectedCols; i++) {
            OutputColumn out = outer.getOutputColumns().get(i);
            for (int b = 0; b < branches.size(); b++) {
                StatementGraph branchStmt = stmts.get(branchIdxs[b]);
                String branchOutName = branchStmt.getOutputColumns().get(i).getName();
                lineage.add(new LineageEdge(
                        LineageRef.statementOutput(outerIdx, out.getName()),
                        LineageRef.statementOutput(branchIdxs[b], branchOutName)));
            }
        }
        return outerIdx;
    }

    /**
     * Reject row-limit clauses on an INTERNAL (non-root) set-op node.
     * Slice 9 / 12 rationale: with ORDER BY they decide which rows
     * survive, so the canonical-model exclusion of ORDER BY is only
     * sound when no row-limit is present.
     *
     * <p>Slice 21 split this from {@code rejectSetOpInternalOrderBy}
     * because the OUTER set-op node lifts its ORDER BY (collected via
     * {@link #buildSetOpOuterOrderByColumnRefs}). Slice 72 narrows the
     * row-limit guard the same way: the OUTER set-op node now lifts
     * row-limit metadata (collected via {@link #buildSetOpRowLimit}),
     * while parenthesized inner combined operations carrying a
     * row-limit (e.g. {@code (A UNION B LIMIT 3) UNION C}) remain
     * rejected because the intermediate limit is destroyed by the
     * outer set operation.
     */
    private static void rejectSetOpRowLimit(TSelectSqlStatement node) {
        if (node.getLimitClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_ROW_LIMIT_NOT_SUPPORTED,
                    "row-limit clause LIMIT on a non-root set-op node is not supported yet", (TParseTreeNode) null));
        }
        if (node.getTopClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_ROW_LIMIT_NOT_SUPPORTED,
                    "row-limit clause TOP on a non-root set-op node is not supported yet", (TParseTreeNode) null));
        }
        if (node.getFetchFirstClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_ROW_LIMIT_NOT_SUPPORTED,
                    "row-limit clause FETCH FIRST on a non-root set-op node is not supported yet", (TParseTreeNode) null));
        }
        if (node.getOffsetClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_ROW_LIMIT_NOT_SUPPORTED,
                    "row-limit clause OFFSET on a non-root set-op node is not supported yet", (TParseTreeNode) null));
        }
    }

    /**
     * Reject ORDER BY on an INTERNAL (non-root) set-op node. Slice 21
     * lifted ORDER BY on the OUTER (root) set-op, but parenthesized
     * inner combined nodes like
     * {@code (A UNION B ORDER BY id) UNION C} remain rejected: the
     * intermediate sort is destroyed by the outer set operation
     * (UNION does not preserve order), so the inner ORDER BY has no
     * observable effect. Lifting requires modelling intermediate sort
     * semantics — a future slice.
     */
    private static void rejectSetOpInternalOrderBy(TSelectSqlStatement node) {
        if (node.getOrderbyClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_NON_ROOT_ORDER_BY_NOT_SUPPORTED,
                    "ORDER BY on a non-root set-op node is not supported yet "
                            + "(intermediate sort would be discarded by the outer set operation)", (TParseTreeNode) null));
        }
    }

    /**
     * Collect physical column refs for the outer set-op's ORDER BY
     * clause. Slice 21 lifts the slice-12 rejection on set-op outer
     * ORDER BY using the slice-9 single-SELECT pattern, generalised:
     *
     * <ul>
     *   <li>Each sort-key item passes the same shape rejections as
     *       {@link #buildOrderByColumnRefs} (ordinals, constants,
     *       scalar / predicate subqueries, window functions, ORDER
     *       SIBLINGS BY, RESET WHEN, in-clause OFFSET/FETCH).
     *   <li>Each {@link TObjectName} reference dispatches via a
     *       four-case fail-closed taxonomy: {@code column_alias} →
     *       lookup via {@code toString()}; unqualified {@code column}
     *       → lookup via {@code getColumnNameOnly()}; qualified
     *       {@code column} → reject (set-op outer scope is the
     *       unioned outputs, not branches' tables); other
     *       {@code dbObjectType} → reject as unsupported.
     *   <li>The lookup is positional against {@code outerOutputs} (=
     *       branch[0].outputs by slice-12 design) — NOT per-branch
     *       name search. Per-branch name search would mis-bind
     *       swapped-name branches and silently accept names present
     *       only in non-branch[0]. Slice-21 codex rounds 1-2 MUSTs.
     *   <li>Each branch contributes its
     *       {@code outputColumns[pos].sources} for the matched
     *       position. Branches with empty sources at the matched
     *       position (scalar / fully-derived projection) reject the
     *       sort key with a tuned message — silent omission would
     *       lose dependency information (slice-21 codex round 1
     *       MUST 5).
     *   <li>Each branch-local {@link ColumnRef} is normalised to its
     *       catalog name via {@link RelationSource#getBinding()}'s
     *       {@code qualifiedName}. The set-op outer's relations list
     *       is empty, so branch-local aliases are not resolvable in
     *       the owning statement; normalisation yields self-contained
     *       refs (slice-21 codex round 1 MUST 4 + round 2 MUST 1).
     *   <li>A per-item empty-refs guard rejects sort keys that
     *       contributed zero physical refs (e.g. {@code ORDER BY
     *       1+0}, {@code ORDER BY UPPER('x')}). Mirrors slice-9
     *       single-SELECT invariant. Operates on a per-item local
     *       set, so duplicate cross-item refs ({@code ORDER BY id,
     *       id}) survive global LinkedHashSet de-duplication
     *       (slice-21 codex round 4 MUST 1).
     * </ul>
     *
     * <p>Like slice-9 ORDER BY for single-SELECT, this list does NOT
     * contribute to the canonical model — it is presentation metadata
     * only. The dlineage XML probe ({@code /tmp/SetOpOrderByLimitProbe})
     * confirmed dlineage emits no parity edges for set-op outer
     * ORDER BY.
     */
    private static List<ColumnRef> buildSetOpOuterOrderByColumnRefs(
            TSelectSqlStatement setOp,
            List<OutputColumn> outerOutputs,
            List<StatementGraph> stmts,
            int[] branchIdxs) {
        TOrderBy orderBy = setOp.getOrderbyClause();
        if (orderBy == null) {
            return new ArrayList<>();
        }
        if (orderBy.isSiblings()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_SIBLINGS_BY_NOT_SUPPORTED,
                    "ORDER SIBLINGS BY is not supported yet "
                            + "(Oracle hierarchical ordering)", orderBy));
        }
        if (orderBy.getResetWhenCondition() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_RESET_WHEN_NOT_SUPPORTED,
                    "ORDER BY ... RESET WHEN is not supported yet "
                            + "(Teradata window-style restart)", orderBy));
        }
        // Slice 72: TOrderBy in-clause OFFSET/FETCH slots are admitted
        // for MSSQL set-op outer via buildSetOpRowLimit's TOrderBy
        // fallback (the MSSQL parser routes set-op outer OFFSET/FETCH
        // EXCLUSIVELY onto TOrderBy, not duplicated onto the SELECT
        // node as in single-SELECT). Removing the previous defensive
        // throws here so the slice-72 admit shapes aren't false-
        // rejected. The unused codes
        // ORDER_BY_FETCH_FIRST_NOT_SUPPORTED and
        // ORDER_BY_OFFSET_NOT_SUPPORTED stay as documentation of a
        // known reject taxonomy.
        TOrderByItemList items = orderBy.getItems();
        if (items == null || items.size() == 0) {
            return new ArrayList<>();
        }
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        for (int i = 0; i < items.size(); i++) {
            TOrderByItem item = items.getOrderByItem(i);
            if (item == null) continue;
            TExpression sortKey = item.getSortKey();
            if (sortKey == null) continue;
            // Same shape rejections as slice-9 single-SELECT.
            rejectOrderByOrdinalOrConstant(sortKey);
            rejectOrderByScalarSubquery(sortKey);
            rejectOrderByWindowFunction(sortKey);
            // (NOT rejectOrderByAliasReference — alias refs are valid
            // at set-op outer scope; they ARE the branch-output names,
            // looked up positionally below.)

            // Per-item local set so the empty-refs guard counts refs
            // FOUND for this sort key, not refs ADDED to the global
            // set after de-dup. Otherwise `ORDER BY id, id` would
            // false-reject the second item (slice-21 codex round 4 MUST 1).
            LinkedHashSet<ColumnRef> itemRefs = new LinkedHashSet<>();
            collectSetOpOuterRefsForSortKey(sortKey, outerOutputs,
                    stmts, branchIdxs, itemRefs);
            if (itemRefs.isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_OUTER_ORDER_BY_NO_PHYSICAL_COLUMN_REFS,
                        "ORDER BY sort key '" + sortKey
                                + "' has no physical column references at set-op "
                                + "outer (constant or non-column expressions are "
                                + "not supported yet)", sortKey));
            }
            refs.addAll(itemRefs);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Collect refs for one set-op outer ORDER BY sort key. Walks the
     * sort-key expression for {@link TObjectName} nodes and dispatches
     * each through {@link #processSetOpOrderByObjectName}. Includes a
     * top-level fast path for the common {@code ORDER BY x} case where
     * the entire sort key IS the {@link TObjectName}.
     *
     * <p>The visitor filters its dispatch to {@code column},
     * {@code column_alias}, and {@code unknown} dbObjectTypes — these
     * are the shapes that represent sort-key column references. Other
     * TObjectName nodes (function names, schema qualifications) are
     * part of the surrounding expression structure and skipped
     * silently. The {@code unknown} case is included so the four-case
     * fail-closed taxonomy in {@link #processSetOpOrderByObjectName}
     * rejects vendor-typed unknown qualified refs (e.g.
     * {@code foo.id + id}, slice-21 codex round 2 MUST 2).
     */
    private static void collectSetOpOuterRefsForSortKey(
            TExpression sortKey,
            final List<OutputColumn> outerOutputs,
            final List<StatementGraph> stmts,
            final int[] branchIdxs,
            final LinkedHashSet<ColumnRef> outRefs) {
        // Top-level fast path: the visitor's `acceptChildren` may not
        // visit the root TObjectName when the sort key is itself a
        // bare TObjectName. Mirrors slice-9 rejectOrderByAliasReference.
        if (sortKey.getExpressionType() == EExpressionType.simple_object_name_t) {
            TObjectName op = sortKey.getObjectOperand();
            if (op != null) {
                processSetOpOrderByObjectName(op, outerOutputs, stmts,
                        branchIdxs, outRefs);
                return;
            }
        }
        sortKey.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TObjectName node) {
                EDbObjectType ot = node.getDbObjectType();
                // Skip non-column-like TObjectNames (function names,
                // schema/server qualifications). The four-case
                // fail-closed taxonomy still runs for column /
                // column_alias / unknown to handle the slice-21 codex
                // round 2 MUST 2 partial-accept case (e.g.
                // `foo.id + id` rejects via `foo.id`'s `unknown`
                // dbObjectType).
                if (ot != EDbObjectType.column
                        && ot != EDbObjectType.column_alias
                        && ot != EDbObjectType.unknown) {
                    return;
                }
                processSetOpOrderByObjectName(node, outerOutputs, stmts,
                        branchIdxs, outRefs);
            }
        });
    }

    /**
     * Resolve one {@link TObjectName} sort-key reference at set-op
     * outer scope. Four-case fail-closed taxonomy (slice-21 codex
     * round 2 MUST 2): column_alias / unqualified column / qualified
     * column / other.
     */
    private static void processSetOpOrderByObjectName(
            TObjectName node,
            List<OutputColumn> outerOutputs,
            List<StatementGraph> stmts,
            int[] branchIdxs,
            LinkedHashSet<ColumnRef> outRefs) {
        EDbObjectType ot = node.getDbObjectType();
        String name;
        if (ot == EDbObjectType.column_alias) {
            // Aliases at set-op outer carry tableToken=alias-name (the
            // /tmp/SetOpQualifiedRefProbe finding); accept regardless.
            name = node.toString();
        } else if (ot == EDbObjectType.column) {
            if (node.getTableToken() != null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ORDER_BY_QUALIFIED_REFERENCE_NOT_SUPPORTED,
                        "qualified column reference '" + node
                                + "' in set-op outer ORDER BY not supported "
                                + "(scope is the unioned outputs, not branches' tables)", node));
            }
            name = node.getColumnNameOnly();
        } else {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_OBJECT_REFERENCE_UNSUPPORTED,
                    "unsupported ORDER BY object reference '" + node
                            + "' (dbObjectType=" + ot + ") in set-op outer", node));
        }
        if (name == null || name.isEmpty() || "*".equals(name)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_OBJECT_REFERENCE_NO_USABLE_NAME,
                    "ORDER BY object reference '" + node + "' has no usable name", node));
        }
        String key = name.toLowerCase(Locale.ROOT);
        int pos = -1;
        for (int i = 0; i < outerOutputs.size(); i++) {
            String outName = outerOutputs.get(i).getName();
            if (outName != null && outName.toLowerCase(Locale.ROOT).equals(key)) {
                pos = i;
                break;
            }
        }
        if (pos < 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_NAME_NOT_MATCHED_IN_SET_OP_OUTPUT,
                    "ORDER BY '" + name + "' does not match any set-op output "
                            + "column (set-op outer column names come from branch[0])", node));
        }
        for (int b = 0; b < branchIdxs.length; b++) {
            StatementGraph br = stmts.get(branchIdxs[b]);
            OutputColumn oc = br.getOutputColumns().get(pos);
            if (oc.getSources().isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_ORDER_BY_BRANCH_OUTPUT_NO_SOURCES,
                        "ORDER BY '" + name + "' references branch[" + b
                                + "] output '" + oc.getName()
                                + "' which has no physical sources "
                                + "(derived/scalar projection); cannot "
                                + "capture this dependency yet", node));
            }
            for (ColumnRef cr : oc.getSources()) {
                outRefs.add(normaliseSetOpBranchRef(cr, br));
            }
        }
    }

    /**
     * Normalise a branch-local {@link ColumnRef} to a self-contained
     * ref using the underlying {@link RelationBinding#getQualifiedName()}.
     *
     * <p>Slice-21 invariant (codex round 2 MUST 1): the set-op outer's
     * {@code relations} list is empty. Branch-local aliases (like
     * {@code e} for {@code FROM employees e}) are not resolvable in
     * the outer statement, so {@code orderByColumnRefs} normalises to
     * the catalog name. Fail-closed if no matching RelationSource —
     * this would indicate corrupt branch lineage state.
     */
    private static ColumnRef normaliseSetOpBranchRef(ColumnRef cr,
                                                     StatementGraph branch) {
        String alias = cr.getRelationAlias();
        String aliasKey = alias.toLowerCase(Locale.ROOT);
        for (RelationSource rs : branch.getRelations()) {
            if (rs.getAlias().toLowerCase(Locale.ROOT).equals(aliasKey)) {
                return new ColumnRef(rs.getBinding().getQualifiedName(),
                        cr.getColumnName());
            }
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.BRANCH_COLUMN_REF_UNKNOWN_RELATION,
                "internal: branch ColumnRef relationAlias '" + alias
                        + "' does not match any RelationSource in the "
                        + "branch's relations list", null));
    }

    /**
     * Reject duplicate output names within a single statement.
     * Lineage refs are keyed by {@code (statementIndex, outputName)}; two
     * outputs sharing a name silently merge their lineage chains.
     */
    private static void rejectDuplicateOutputNames(StatementGraph stmt, String label) {
        Set<String> seen = new HashSet<>();
        for (OutputColumn c : stmt.getOutputColumns()) {
            String name = c.getName();
            if (name == null || name.isEmpty()) continue;
            if (!seen.add(name.toLowerCase(Locale.ROOT))) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_BRANCH_DUPLICATE_OUTPUT_NAME,
                        "set-op branch '" + label + "' has duplicate output name '"
                                + name + "'; lineage refs are keyed by output name "
                                + "and would collide", null));
            }
        }
    }

    /**
     * Map ({@link ESetOperatorType}, {@code isAll()}) to the IR
     * {@link SetOperator} enum. The exhaustive switch makes a future
     * {@code ESetOperatorType} value fail loudly at build time
     * (mirrors slice-8 {@code resolveDistinctFlag} pattern).
     */
    private static SetOperator resolveSetOperator(TSelectSqlStatement setOp) {
        ESetOperatorType type = setOp.getSetOperatorType();
        if (type == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SET_OP_ROOT_TYPE_NULL,
                    "expected non-null set-op type on the set-op root", (TParseTreeNode) null));
        }
        boolean all = setOp.isAll();
        switch (type) {
            case union:     return all ? SetOperator.UNION_ALL     : SetOperator.UNION;
            case intersect: return all ? SetOperator.INTERSECT_ALL : SetOperator.INTERSECT;
            case minus:     return all ? SetOperator.MINUS_ALL     : SetOperator.MINUS;
            case except:    return all ? SetOperator.EXCEPT_ALL    : SetOperator.EXCEPT;
            case none:
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_ROOT_TYPE_NONE,
                        "expected non-none set operator type on the set-op root", (TParseTreeNode) null));
            default:
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SET_OP_UNKNOWN_OPERATOR_TYPE,
                        "unknown set operator type: " + type, (TParseTreeNode) null));
        }
    }

    /**
     * Iteratively flatten the left-leaning set-op tree into a list of
     * leaf SELECT statements (CLAUDE.md mandates no recursion on
     * {@code leftStmt}/{@code rightStmt}; would StackOverflow on 2000+
     * UNIONs).
     *
     * <p>On every internal set-op node visited:
     * <ol>
     *   <li>Reject row-limit modifiers ({@link #rejectSetOpRowLimit})
     *       on every node (root + internal). Slice 12 +
     *       {@code /tmp/SetOpInnerModifierProbe}: parenthesized inner
     *       combined nodes can carry row-limits in Oracle / PostgreSQL /
     *       MSSQL.</li>
     *   <li>Reject ORDER BY ({@link #rejectSetOpInternalOrderBy}) only
     *       on INTERNAL (non-root) nodes. Slice 21 lifted ORDER BY on
     *       the root via {@link #buildSetOpOuterOrderByColumnRefs}; an
     *       internal {@code (A UNION B ORDER BY id) UNION C} sort is
     *       still discarded by the outer set operation, so it has no
     *       observable effect and remains rejected.</li>
     *   <li>Reject mixed-operator and mixed-{@code ALL} chains by checking
     *       the resolved kind matches the root's kind.</li>
     *   <li>Hard-reject malformed AST (null left/right child).</li>
     * </ol>
     *
     * <p>Push order is right-then-left so leaves emerge in left-to-right
     * declaration order.
     */
    private static List<TSelectSqlStatement> flattenSetOpTreeIteratively(
            TSelectSqlStatement root, SetOperator expected) {
        List<TSelectSqlStatement> leaves = new ArrayList<>();
        Deque<TSelectSqlStatement> stack = new ArrayDeque<>();
        stack.push(root);
        while (!stack.isEmpty()) {
            TSelectSqlStatement cur = stack.pop();
            ESetOperatorType t = cur.getSetOperatorType();
            if (t != null && t != ESetOperatorType.none) {
                // Slice 21: ORDER BY guard fires only on INTERNAL nodes.
                // The root (`cur == root`) lifts ORDER BY; the collection
                // happens in buildSetOpOuterOrderByColumnRefs.
                // Slice 72: row-limit guard ALSO fires only on INTERNAL
                // nodes. The root lifts via buildSetOpRowLimit (called
                // by buildSetOpProgram before this method).
                if (cur != root) {
                    rejectSetOpRowLimit(cur);
                    rejectSetOpInternalOrderBy(cur);
                }
                SetOperator curKind = resolveSetOperator(cur);
                if (curKind != expected) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.MIXED_SET_OPERATORS_NOT_SUPPORTED,
                            "mixed set operators in a single chain are not supported yet "
                                    + "(root=" + expected + ", inner=" + curKind + ")", (TParseTreeNode) null));
                }
                if (cur.getLeftStmt() == null || cur.getRightStmt() == null) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.MALFORMED_SET_OP_AST,
                            "malformed set-op AST: null left/right child", (TParseTreeNode) null));
                }
                stack.push(cur.getRightStmt());
                stack.push(cur.getLeftStmt());
            } else {
                leaves.add(cur);
            }
        }
        return leaves;
    }

    private static Set<String> collectCteNames(TCTEList cteList) {
        if (cteList == null || cteList.size() == 0) return Collections.emptySet();
        Set<String> names = new HashSet<>();
        for (int i = 0; i < cteList.size(); i++) {
            String name = cteList.getCTE(i).getTableName().toString();
            if (name != null && !name.isEmpty()) {
                names.add(name.toLowerCase(Locale.ROOT));
            }
        }
        return names;
    }

    /**
     * Slice 107 — return the first CTE name shared between the outer-WITH
     * and inner-WITH CTE lists on an INSERT (case-insensitive, lowercase
     * via {@code toLowerCase(Locale.ROOT)} matching the slice-15/103
     * duplicate-name walker convention), or {@code null} if the name sets
     * are disjoint. Used by {@code buildInsert} to keep the
     * shared-name case rejecting (PG/Oracle/Snowflake nested-WITH
     * inner-shadows-outer semantics not yet supported) while admitting
     * the disjoint case via flat-merge.
     *
     * <p>Pathological edge case (codex round-2 diff-review Q3): if one of
     * the two lists also contains an INTRA-list duplicate AND that
     * duplicated name happens to also appear in the other list, this
     * helper short-circuits with
     * INSERT_MIXED_OUTER_AND_INNER_WITH_NOT_SUPPORTED and masks the
     * more precise same-scope DUPLICATE_CTE_NAME the slice-103 walker
     * would have emitted. Accepted limitation — the diagnostic still
     * tells the user the shape is unsupported, and both codes point at
     * the same offending name. A future slice can pre-walk each list
     * for intra-list duplicates before the boundary check if a
     * customer reports confusion.
     */
    private static String findFirstSharedCteName(TCTEList outer, TCTEList inner) {
        Set<String> outerNames = new HashSet<>();
        for (int i = 0; i < outer.size(); i++) {
            outerNames.add(outer.getCTE(i).getTableName().toString().toLowerCase(Locale.ROOT));
        }
        for (int i = 0; i < inner.size(); i++) {
            String name = inner.getCTE(i).getTableName().toString();
            if (outerNames.contains(name.toLowerCase(Locale.ROOT))) {
                return name;
            }
        }
        return null;
    }

    /**
     * Reject the case where a CTE body references a sibling CTE declared
     * <i>after</i> it. SQL chain semantics only allow left-to-right
     * references, but the bind-by-name provider would happily classify a
     * forward-declared CTE name as a base {@code TABLE} (because it's not
     * yet in {@code visibleSoFar}). Catching it here turns the silent
     * mislabeling into a clear error.
     */
    private static void rejectForwardCteReferences(final TCTE cte,
                                                   final Set<String> allCteNames,
                                                   final Set<String> visibleSoFar) {
        TSelectSqlStatement body = cte.getSubquery();
        if (body == null) return;
        final String selfName = cte.getTableName().toString().toLowerCase(Locale.ROOT);
        final List<String> forwards = new ArrayList<>();
        body.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TTable t) {
                String tname = bareName(t);
                if (tname == null) return;
                String lower = tname.toLowerCase(Locale.ROOT);
                if (allCteNames.contains(lower)
                        && !visibleSoFar.contains(lower)
                        && !lower.equals(selfName)) {
                    forwards.add(tname);
                }
            }
        });
        if (!forwards.isEmpty()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.CTE_FORWARD_REFERENCE,
                    "CTE '" + cte.getTableName() + "' forward-references later CTE(s) "
                            + forwards + "; only left-to-right CTE chains are supported", cte));
        }
    }

    private static String bareName(TTable t) {
        if (t == null) return null;
        if (t.getTableType() != gudusoft.gsqlparser.ETableSource.objectname) return null;
        return t.getName();
    }

    /**
     * Reject {@code WITH RECURSIVE}. Slice 4 supports chained
     * (forward-referencing) CTEs; recursion is left for a later slice that
     * can model the fixpoint semantics.
     */
    private static void rejectRecursiveCtes(TCTEList cteList) {
        if (cteList == null) return;
        for (int i = 0; i < cteList.size(); i++) {
            TCTE cte = cteList.getCTE(i);
            if (cte.isRecursive()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.CTE_WITH_RECURSIVE_NOT_SUPPORTED,
                        "WITH RECURSIVE is not supported yet (CTE: " + cte.getTableName() + ")", cte));
            }
        }
    }

    /**
     * Slice 101 — walk the WITH clause on a MERGE statement and append
     * each CTE body to {@code stmts} as a preceding statement. Mirrors
     * the SELECT-side build() at lines ~516-653.
     *
     * <p>Returns a {@code cteNameToStatementIndex} map keyed by
     * lower-cased CTE name. {@code ctePublishedColumnsOut} is populated
     * with each CTE's output column names so the {@code buildMerge}
     * USING-as-CTE branch can install them via
     * {@link NameBindingProvider#withInScopeRelationColumns}.
     *
     * <p>Rejects (chronological):
     * <ol>
     *   <li>WITH RECURSIVE — reuses {@link DiagnosticCode#CTE_WITH_RECURSIVE_NOT_SUPPORTED}.
     *       Currently no admitting vendor (PG parser PARSE_FAILED, probe
     *       2026-05-17); defensive reject for forward compatibility.</li>
     *   <li>CTE with explicit column list — rejects with new
     *       {@link DiagnosticCode#MERGE_CTE_EXPLICIT_COLUMN_LIST_NOT_SUPPORTED}.
     *       PG and MSSQL parsers admit this shape; slice 101 defers
     *       because the inner CTE body output names ≠ user-visible CTE
     *       column names.</li>
     *   <li>Duplicate CTE name — reuses {@link DiagnosticCode#DUPLICATE_CTE_NAME}.</li>
     *   <li>Forward CTE reference — reuses {@link DiagnosticCode#CTE_FORWARD_REFERENCE}.</li>
     * </ol>
     *
     * <p>Set-op CTE bodies route through {@link #buildSetOpProgram};
     * non-set-op CTE bodies route through {@link #buildSelectStatement}.
     * Each CTE's published columns are added to {@code ctePublishedColumnsOut}
     * after its body is built so a CTE cannot self-reference (mirrors
     * SELECT-side slice 60).
     */
    private static Map<String, Integer> buildMergeCteList(
            TMergeSqlStatement merge,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, List<String>> ctePublishedColumnsOut) {
        TCTEList cteList = merge.getCteList();
        Map<String, Integer> cteNameToStatementIndex = new HashMap<>();
        if (cteList == null || cteList.size() == 0) {
            return cteNameToStatementIndex;
        }
        rejectRecursiveCtes(cteList);
        // Slice 102 — explicit-column-list shapes (PG/MSSQL `WITH cte(a, b) AS
        // (...) MERGE ...`) are admitted by rebuilding the body's
        // StatementGraph with the explicit-list names and rewriting outgoing
        // STATEMENT_OUTPUT lineage refs. The slice-101 upfront reject is
        // replaced by per-CTE rename application below. The slice-101 code
        // (MERGE_CTE_EXPLICIT_COLUMN_LIST_NOT_SUPPORTED) stays declared for
        // API stability.
        Set<String> allCteNames = collectCteNames(cteList);
        Set<String> visibleSoFar = new HashSet<>();
        for (int i = 0; i < cteList.size(); i++) {
            TCTE cte = cteList.getCTE(i);
            String cteName = cte.getTableName().toString();
            String cteNameLower = cteName.toLowerCase(Locale.ROOT);
            if (visibleSoFar.contains(cteNameLower)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DUPLICATE_CTE_NAME,
                        "duplicate CTE name '" + cteName
                                + "' in WITH clause; CTE names must be unique",
                        cte));
            }
            rejectForwardCteReferences(cte, allCteNames, visibleSoFar);
            NameBindingProvider bodyProvider =
                    provider.withCteContext(visibleSoFar);
            // Slice 102 — snapshot the lineage size BEFORE either branch so
            // the rename helper can rewrite outgoing STATEMENT_OUTPUT refs
            // in [lineageSize0, lineage.size()) without touching prior CTE
            // bodies' edges. Covers BOTH set-op and non-set-op branches
            // (codex round-1 plan-review BLOCKING).
            int lineageSize0 = lineage.size();
            int bodyIdx;
            TSelectSqlStatement cteBody = cte.getSubquery();
            if (cteBody != null
                    && cteBody.getSetOperatorType() != null
                    && cteBody.getSetOperatorType() != ESetOperatorType.none) {
                bodyIdx = buildSetOpProgram(cteBody, bodyProvider, stmts,
                        lineage, cteNameToStatementIndex, cteName,
                        /*hasOuterCteListAlreadyProcessed=*/ false);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
            } else {
                int cteStmtsSize0 = stmts.size();
                int cteLineageSize0 = lineage.size();
                Map<String, Integer> cteSubqueryAliasToIndex;
                try {
                    cteSubqueryAliasToIndex =
                            extractFromSubqueriesAsStatements(cteBody,
                                    bodyProvider, stmts, lineage,
                                    cteNameToStatementIndex,
                                    ctePublishedColumnsOut);
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteStmtsSize0) {
                        stmts.remove(stmts.size() - 1);
                    }
                    while (lineage.size() > cteLineageSize0) {
                        lineage.remove(lineage.size() - 1);
                    }
                    throw ex;
                }
                EnclosingScope cteEnclosing = buildEnclosingScope(cteBody,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        /*parent=*/ null);
                Map<Integer, ScalarInfo> cteScalarMap =
                        extractScalarSubqueriesAsStatements(cteBody,
                                bodyProvider, stmts, lineage,
                                cteNameToStatementIndex, cteEnclosing,
                                /*allowRecursiveScalarSubqueryExtraction=*/ true);
                Map<String, List<String>> cteBodyInScope =
                        buildEffectiveAliasInScopeMap(cteBody, bodyProvider,
                                ctePublishedColumnsOut,
                                cteSubqueryAliasToIndex, stmts);
                NameBindingProvider cteBodyProviderWithStar = bodyProvider
                        .withInScopeRelationColumns(cteBodyInScope);
                // Slice 114 — switch to buildSelectStatementImpl with
                // snapshot/rollback (see the matching SELECT-side
                // CTE site for full rationale).
                int cteBodyStmtsSnapshot = stmts.size();
                int cteBodyLineageSnapshot = lineage.size();
                StatementGraph body;
                try {
                    if (isPivotSelect(cteBody)) {
                        // Slice 139 — a nested PIVOT/UNPIVOT as a DML CTE body
                        // (mirrors the SELECT-side buildSelectCteList branch).
                        // The slice-129 pivot router in buildSelectStatementImpl
                        // is gated to the OUTER SELECT (name == null), so a pivot
                        // built here (name == cteName) would otherwise fall to the
                        // normal path and reject with TABLE_BINDING_UNRESOLVED
                        // ("null(piviot_table)"). The pivot CTE becomes its own
                        // StatementGraph; the DML's CTE-as-relation path (fed from
                        // ctePublishedColumns ← body.getOutputColumns()) carries
                        // the cross-stmt lineage. All pivot deferrals preserved by
                        // buildPivotSelect's own guards.
                        body = buildPivotSelect(cteBody,
                                cteBodyProviderWithStar, cteName);
                    } else {
                        body = buildSelectStatementImpl(cteBody,
                            cteBodyProviderWithStar, cteName,
                            /*hasOuterCteListAlreadyProcessed=*/ false,
                            /*allowFromSubqueries=*/ true,
                            /*allowScalarProjectionSubqueries=*/ true,
                            /*allowWindowProjection=*/ true,
                            /*allowJoinOnPredicateSubqueries=*/ false,
                            /*stmtsForExtraction=*/ stmts,
                            /*lineageForExtraction=*/ lineage,
                            /*cteMapForExtraction=*/ cteNameToStatementIndex,
                            /*isPredicateBody=*/ false,
                            /*whereClauseContext=*/ PredicateClauseContext.CTE_BODY_WHERE,
                            /*allowWherePredicateSubqueries=*/ true);
                    }
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteBodyStmtsSnapshot) stmts.remove(stmts.size() - 1);
                    while (lineage.size() > cteBodyLineageSnapshot) lineage.remove(lineage.size() - 1);
                    throw ex;
                }
                bodyIdx = stmts.size();
                stmts.add(body);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
                emitLineageForStatement(body, bodyIdx, lineage,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        cteScalarMap);
            }
            // Slice 102 — apply explicit-column-list rename if present.
            // Rebuilds stmts[bodyIdx] with renamed OutputColumns and
            // rewrites STATEMENT_OUTPUT(bodyIdx, oldName) refs in
            // lineage[lineageSize0..) to use the renamed name. Returns the
            // published column list (renamed if explicit list applied,
            // else inner names from the body).
            List<String> publishedCols = applyExplicitCteColumnListRename(
                    cte, stmts, lineage, bodyIdx, lineageSize0, "MERGE");
            ctePublishedColumnsOut.put(cteNameLower, publishedCols);
            visibleSoFar.add(cteNameLower);
        }
        return cteNameToStatementIndex;
    }

    /**
     * Slice 105 — walk the WITH clause on an UPDATE statement and append
     * each CTE body to {@code stmts} as a preceding statement. Mirrors
     * the slice-101 MERGE walker {@link #buildMergeCteList} verbatim
     * except for the source of the CTE list and the
     * {@link #applyExplicitCteColumnListRename} {@code dmlKind} argument.
     *
     * <p>Returns a {@code cteNameToStatementIndex} map keyed by
     * lower-cased CTE name. {@code ctePublishedColumnsOut} is populated
     * with each CTE's output column names so {@link #buildUpdateRelation}
     * + {@link #buildUpdateInScopeMap} can route FROM-side references to
     * the matching CTE as SUBQUERY-kind relations with the CTE's columns
     * published into the in-scope map.
     *
     * <p>The slice-103 SELECT-side CTE walker contract is reused via the
     * {@link #applyExplicitCteColumnListRename} helper with
     * {@code dmlKind="SELECT"} so the SELECT-side
     * {@link DiagnosticCode#CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH} code
     * fires on arity mismatch (codex round-1 Q2 confirmed YES — UPDATE is
     * closer to ordinary SELECT than to MERGE for CTE rename semantics).
     *
     * <p>Rejects (chronological):
     * <ol>
     *   <li>{@code WITH RECURSIVE} — {@link DiagnosticCode#CTE_WITH_RECURSIVE_NOT_SUPPORTED}.
     *       Currently no admitting vendor (Oracle PARSE_FAILED on outer-WITH-UPDATE).</li>
     *   <li>Duplicate CTE name — {@link DiagnosticCode#DUPLICATE_CTE_NAME}.</li>
     *   <li>Forward CTE reference — {@link DiagnosticCode#CTE_FORWARD_REFERENCE}.</li>
     *   <li>Explicit-column-list arity mismatch — handled by
     *       {@link #applyExplicitCteColumnListRename} via
     *       {@link DiagnosticCode#CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH}.</li>
     * </ol>
     */
    private static Map<String, Integer> buildUpdateCteList(
            TUpdateSqlStatement update,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, List<String>> ctePublishedColumnsOut) {
        TCTEList cteList = update.getCteList();
        Map<String, Integer> cteNameToStatementIndex = new HashMap<>();
        if (cteList == null || cteList.size() == 0) {
            return cteNameToStatementIndex;
        }
        rejectRecursiveCtes(cteList);
        Set<String> allCteNames = collectCteNames(cteList);
        Set<String> visibleSoFar = new HashSet<>();
        for (int i = 0; i < cteList.size(); i++) {
            TCTE cte = cteList.getCTE(i);
            String cteName = cte.getTableName().toString();
            String cteNameLower = cteName.toLowerCase(Locale.ROOT);
            if (visibleSoFar.contains(cteNameLower)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DUPLICATE_CTE_NAME,
                        "duplicate CTE name '" + cteName
                                + "' in WITH clause; CTE names must be unique",
                        cte));
            }
            rejectForwardCteReferences(cte, allCteNames, visibleSoFar);
            NameBindingProvider bodyProvider =
                    provider.withCteContext(visibleSoFar);
            int lineageSize0 = lineage.size();
            int bodyIdx;
            TSelectSqlStatement cteBody = cte.getSubquery();
            if (cteBody != null
                    && cteBody.getSetOperatorType() != null
                    && cteBody.getSetOperatorType() != ESetOperatorType.none) {
                bodyIdx = buildSetOpProgram(cteBody, bodyProvider, stmts,
                        lineage, cteNameToStatementIndex, cteName,
                        /*hasOuterCteListAlreadyProcessed=*/ false);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
            } else {
                int cteStmtsSize0 = stmts.size();
                int cteLineageSize0 = lineage.size();
                Map<String, Integer> cteSubqueryAliasToIndex;
                try {
                    cteSubqueryAliasToIndex =
                            extractFromSubqueriesAsStatements(cteBody,
                                    bodyProvider, stmts, lineage,
                                    cteNameToStatementIndex,
                                    ctePublishedColumnsOut);
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteStmtsSize0) {
                        stmts.remove(stmts.size() - 1);
                    }
                    while (lineage.size() > cteLineageSize0) {
                        lineage.remove(lineage.size() - 1);
                    }
                    throw ex;
                }
                EnclosingScope cteEnclosing = buildEnclosingScope(cteBody,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        /*parent=*/ null);
                Map<Integer, ScalarInfo> cteScalarMap =
                        extractScalarSubqueriesAsStatements(cteBody,
                                bodyProvider, stmts, lineage,
                                cteNameToStatementIndex, cteEnclosing,
                                /*allowRecursiveScalarSubqueryExtraction=*/ true);
                Map<String, List<String>> cteBodyInScope =
                        buildEffectiveAliasInScopeMap(cteBody, bodyProvider,
                                ctePublishedColumnsOut,
                                cteSubqueryAliasToIndex, stmts);
                NameBindingProvider cteBodyProviderWithStar = bodyProvider
                        .withInScopeRelationColumns(cteBodyInScope);
                // Slice 114 — switch to buildSelectStatementImpl with
                // snapshot/rollback (see the matching SELECT-side
                // CTE site for full rationale).
                int cteBodyStmtsSnapshot = stmts.size();
                int cteBodyLineageSnapshot = lineage.size();
                StatementGraph body;
                try {
                    if (isPivotSelect(cteBody)) {
                        // Slice 139 — a nested PIVOT/UNPIVOT as a DML CTE body
                        // (mirrors the SELECT-side buildSelectCteList branch).
                        // The slice-129 pivot router in buildSelectStatementImpl
                        // is gated to the OUTER SELECT (name == null), so a pivot
                        // built here (name == cteName) would otherwise fall to the
                        // normal path and reject with TABLE_BINDING_UNRESOLVED
                        // ("null(piviot_table)"). The pivot CTE becomes its own
                        // StatementGraph; the DML's CTE-as-relation path (fed from
                        // ctePublishedColumns ← body.getOutputColumns()) carries
                        // the cross-stmt lineage. All pivot deferrals preserved by
                        // buildPivotSelect's own guards.
                        body = buildPivotSelect(cteBody,
                                cteBodyProviderWithStar, cteName);
                    } else {
                        body = buildSelectStatementImpl(cteBody,
                            cteBodyProviderWithStar, cteName,
                            /*hasOuterCteListAlreadyProcessed=*/ false,
                            /*allowFromSubqueries=*/ true,
                            /*allowScalarProjectionSubqueries=*/ true,
                            /*allowWindowProjection=*/ true,
                            /*allowJoinOnPredicateSubqueries=*/ false,
                            /*stmtsForExtraction=*/ stmts,
                            /*lineageForExtraction=*/ lineage,
                            /*cteMapForExtraction=*/ cteNameToStatementIndex,
                            /*isPredicateBody=*/ false,
                            /*whereClauseContext=*/ PredicateClauseContext.CTE_BODY_WHERE,
                            /*allowWherePredicateSubqueries=*/ true);
                    }
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteBodyStmtsSnapshot) stmts.remove(stmts.size() - 1);
                    while (lineage.size() > cteBodyLineageSnapshot) lineage.remove(lineage.size() - 1);
                    throw ex;
                }
                bodyIdx = stmts.size();
                stmts.add(body);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
                emitLineageForStatement(body, bodyIdx, lineage,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        cteScalarMap);
            }
            // Slice 105 — explicit column-list rename uses dmlKind="SELECT"
            // so the SELECT-side CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH
            // code fires (codex Q2 confirmed YES — UPDATE is closer to
            // ordinary SELECT than MERGE for CTE rename semantics).
            List<String> publishedCols = applyExplicitCteColumnListRename(
                    cte, stmts, lineage, bodyIdx, lineageSize0, "SELECT");
            ctePublishedColumnsOut.put(cteNameLower, publishedCols);
            visibleSoFar.add(cteNameLower);
        }
        return cteNameToStatementIndex;
    }

    /**
     * Slice 106 — walk the WITH clause on a DELETE statement and append
     * each CTE body to {@code stmts} as a preceding statement. Mirrors
     * the slice-105 UPDATE walker {@link #buildUpdateCteList} verbatim
     * except for the source of the CTE list ({@code delete.getCteList()}).
     *
     * <p>Returns a {@code cteNameToStatementIndex} map keyed by
     * lower-cased CTE name. {@code ctePublishedColumnsOut} is populated
     * with each CTE's output column names so {@link #buildDeleteRelation}
     * + {@link #buildDeleteInScopeMap} can route FROM-side references to
     * the matching CTE as SUBQUERY-kind relations with the CTE's columns
     * published into the in-scope map.
     *
     * <p>The slice-103 SELECT-side CTE walker contract is reused via the
     * {@link #applyExplicitCteColumnListRename} helper with
     * {@code dmlKind="SELECT"} so the SELECT-side
     * {@link DiagnosticCode#CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH} code
     * fires on arity mismatch (slice-105 precedent: UPDATE/DELETE are
     * closer to ordinary SELECT than to MERGE for CTE rename semantics).
     *
     * <p>Rejects (chronological):
     * <ol>
     *   <li>{@code WITH RECURSIVE} —
     *       {@link DiagnosticCode#CTE_WITH_RECURSIVE_NOT_SUPPORTED}.
     *       PG / MySQL admit the parse shape but slice 106 rejects at the
     *       semantic layer (mirrors slice-105 boundary).</li>
     *   <li>Duplicate CTE name — {@link DiagnosticCode#DUPLICATE_CTE_NAME}.</li>
     *   <li>Forward CTE reference — {@link DiagnosticCode#CTE_FORWARD_REFERENCE}.</li>
     *   <li>Explicit-column-list arity mismatch — handled by
     *       {@link #applyExplicitCteColumnListRename} via
     *       {@link DiagnosticCode#CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH}.</li>
     * </ol>
     */
    private static Map<String, Integer> buildDeleteCteList(
            TDeleteSqlStatement delete,
            NameBindingProvider provider,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            Map<String, List<String>> ctePublishedColumnsOut) {
        TCTEList cteList = delete.getCteList();
        Map<String, Integer> cteNameToStatementIndex = new HashMap<>();
        if (cteList == null || cteList.size() == 0) {
            return cteNameToStatementIndex;
        }
        rejectRecursiveCtes(cteList);
        Set<String> allCteNames = collectCteNames(cteList);
        Set<String> visibleSoFar = new HashSet<>();
        for (int i = 0; i < cteList.size(); i++) {
            TCTE cte = cteList.getCTE(i);
            String cteName = cte.getTableName().toString();
            String cteNameLower = cteName.toLowerCase(Locale.ROOT);
            if (visibleSoFar.contains(cteNameLower)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DUPLICATE_CTE_NAME,
                        "duplicate CTE name '" + cteName
                                + "' in WITH clause; CTE names must be unique",
                        cte));
            }
            rejectForwardCteReferences(cte, allCteNames, visibleSoFar);
            NameBindingProvider bodyProvider =
                    provider.withCteContext(visibleSoFar);
            int lineageSize0 = lineage.size();
            int bodyIdx;
            TSelectSqlStatement cteBody = cte.getSubquery();
            if (cteBody != null
                    && cteBody.getSetOperatorType() != null
                    && cteBody.getSetOperatorType() != ESetOperatorType.none) {
                bodyIdx = buildSetOpProgram(cteBody, bodyProvider, stmts,
                        lineage, cteNameToStatementIndex, cteName,
                        /*hasOuterCteListAlreadyProcessed=*/ false);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
            } else {
                int cteStmtsSize0 = stmts.size();
                int cteLineageSize0 = lineage.size();
                Map<String, Integer> cteSubqueryAliasToIndex;
                try {
                    cteSubqueryAliasToIndex =
                            extractFromSubqueriesAsStatements(cteBody,
                                    bodyProvider, stmts, lineage,
                                    cteNameToStatementIndex,
                                    ctePublishedColumnsOut);
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteStmtsSize0) {
                        stmts.remove(stmts.size() - 1);
                    }
                    while (lineage.size() > cteLineageSize0) {
                        lineage.remove(lineage.size() - 1);
                    }
                    throw ex;
                }
                EnclosingScope cteEnclosing = buildEnclosingScope(cteBody,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        /*parent=*/ null);
                Map<Integer, ScalarInfo> cteScalarMap =
                        extractScalarSubqueriesAsStatements(cteBody,
                                bodyProvider, stmts, lineage,
                                cteNameToStatementIndex, cteEnclosing,
                                /*allowRecursiveScalarSubqueryExtraction=*/ true);
                Map<String, List<String>> cteBodyInScope =
                        buildEffectiveAliasInScopeMap(cteBody, bodyProvider,
                                ctePublishedColumnsOut,
                                cteSubqueryAliasToIndex, stmts);
                NameBindingProvider cteBodyProviderWithStar = bodyProvider
                        .withInScopeRelationColumns(cteBodyInScope);
                // Slice 114 — switch to buildSelectStatementImpl with
                // snapshot/rollback (see the matching SELECT-side
                // CTE site for full rationale).
                int cteBodyStmtsSnapshot = stmts.size();
                int cteBodyLineageSnapshot = lineage.size();
                StatementGraph body;
                try {
                    if (isPivotSelect(cteBody)) {
                        // Slice 139 — a nested PIVOT/UNPIVOT as a DML CTE body
                        // (mirrors the SELECT-side buildSelectCteList branch).
                        // The slice-129 pivot router in buildSelectStatementImpl
                        // is gated to the OUTER SELECT (name == null), so a pivot
                        // built here (name == cteName) would otherwise fall to the
                        // normal path and reject with TABLE_BINDING_UNRESOLVED
                        // ("null(piviot_table)"). The pivot CTE becomes its own
                        // StatementGraph; the DML's CTE-as-relation path (fed from
                        // ctePublishedColumns ← body.getOutputColumns()) carries
                        // the cross-stmt lineage. All pivot deferrals preserved by
                        // buildPivotSelect's own guards.
                        body = buildPivotSelect(cteBody,
                                cteBodyProviderWithStar, cteName);
                    } else {
                        body = buildSelectStatementImpl(cteBody,
                            cteBodyProviderWithStar, cteName,
                            /*hasOuterCteListAlreadyProcessed=*/ false,
                            /*allowFromSubqueries=*/ true,
                            /*allowScalarProjectionSubqueries=*/ true,
                            /*allowWindowProjection=*/ true,
                            /*allowJoinOnPredicateSubqueries=*/ false,
                            /*stmtsForExtraction=*/ stmts,
                            /*lineageForExtraction=*/ lineage,
                            /*cteMapForExtraction=*/ cteNameToStatementIndex,
                            /*isPredicateBody=*/ false,
                            /*whereClauseContext=*/ PredicateClauseContext.CTE_BODY_WHERE,
                            /*allowWherePredicateSubqueries=*/ true);
                    }
                } catch (RuntimeException ex) {
                    while (stmts.size() > cteBodyStmtsSnapshot) stmts.remove(stmts.size() - 1);
                    while (lineage.size() > cteBodyLineageSnapshot) lineage.remove(lineage.size() - 1);
                    throw ex;
                }
                bodyIdx = stmts.size();
                stmts.add(body);
                cteNameToStatementIndex.put(cteNameLower, bodyIdx);
                emitLineageForStatement(body, bodyIdx, lineage,
                        cteNameToStatementIndex, cteSubqueryAliasToIndex,
                        cteScalarMap);
            }
            // Slice 106 — explicit column-list rename uses dmlKind="SELECT"
            // so the SELECT-side CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH
            // code fires (slice-105 precedent: UPDATE/DELETE are closer
            // to ordinary SELECT than MERGE for CTE rename semantics).
            List<String> publishedCols = applyExplicitCteColumnListRename(
                    cte, stmts, lineage, bodyIdx, lineageSize0, "SELECT");
            ctePublishedColumnsOut.put(cteNameLower, publishedCols);
            visibleSoFar.add(cteNameLower);
        }
        return cteNameToStatementIndex;
    }

    /**
     * Slice 105 — combine the slice-83 subqueryAliasToIndex with the
     * slice-105 CTE-as-FROM-relation alias→cteIdx entries so
     * {@link #emitUpdateSubquerySourceEdges} produces cross-stmt
     * lineage edges for SET RHS references resolving to a CTE column.
     *
     * <p>Without this merge the visible {@link OutputColumn#getSources}
     * stays correct (CTE refs surface as {@link ColumnRef}s) but
     * {@code lineage[]} silently loses the canonical
     * {@code STATEMENT_OUTPUT(update,col) → STATEMENT_OUTPUT(cte,col)}
     * edge (codex round-2 Q5 silent-correctness bug).
     *
     * <p>Walks {@code update.getJoins()} the same way
     * {@link #buildUpdateRelation} does to keep the alias resolution
     * identical: CTE-bound FROM-side relations are detected by their
     * bare name (case-insensitive) and registered under their effective
     * alias. Subquery aliases stay keyed lowercase to match the
     * slice-83 contract.
     */
    private static Map<String, Integer> buildUpdateCombinedAliasToSubIdx(
            TUpdateSqlStatement update,
            Map<String, Integer> subqueryAliasToIndex,
            Map<String, Integer> cteNameToStatementIndex) {
        Map<String, Integer> combined = new HashMap<>();
        if (subqueryAliasToIndex != null) {
            combined.putAll(subqueryAliasToIndex);
        }
        if (cteNameToStatementIndex == null
                || cteNameToStatementIndex.isEmpty()) {
            return combined;
        }
        TJoinList joins = update.getJoins();
        if (joins == null) return combined;
        for (TJoin join : joins) {
            addCteAliasToCombinedMap(join.getTable(),
                    cteNameToStatementIndex, combined);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                addCteAliasToCombinedMap(item.getTable(),
                        cteNameToStatementIndex, combined);
            }
        }
        return combined;
    }

    private static void addCteAliasToCombinedMap(TTable t,
            Map<String, Integer> cteNameToStatementIndex,
            Map<String, Integer> combined) {
        if (t == null) return;
        if (t.getTableType() != gudusoft.gsqlparser.ETableSource.objectname) {
            return;
        }
        TObjectName tName = t.getTableName();
        if (tName == null) return;
        String bare = tName.toString();
        if (bare == null || bare.isEmpty()) return;
        String bareLower = bare.toLowerCase(Locale.ROOT);
        Integer cteIdx = cteNameToStatementIndex.get(bareLower);
        if (cteIdx == null) return;
        String aliasKey = effectiveAliasLowerCaseOrNull(t);
        if (aliasKey == null) aliasKey = bareLower;
        combined.put(aliasKey, cteIdx);
    }

    /**
     * Slice 123 — DELETE analogue of
     * {@link #buildUpdateCombinedAliasToSubIdx}: combine the slice-84
     * {@code subqueryAliasToIndex} (USING-(SELECT) FROM-subqueries) with the
     * slice-106 CTE-as-FROM-relation alias&rarr;cteIdx entries so the
     * slice-85 {@link #buildReturningColumns} walker can promote a
     * RETURNING/OUTPUT source ref that resolves to a SUBQUERY-kind FROM-side
     * relation to a cross-stmt {@code STATEMENT_OUTPUT → STATEMENT_OUTPUT}
     * edge.
     *
     * <p>Walks {@code delete.getReferenceJoins()} (NOT {@code getJoins()},
     * which catches MySQL self-ref / multi-target shapes that still reject)
     * the same way {@link #buildDeleteRelation} does so alias resolution is
     * identical. Subquery aliases stay keyed lowercase (slice-84 contract);
     * CTE-as-relation entries are keyed by their effective alias via the
     * shared {@link #addCteAliasToCombinedMap} helper.
     *
     * <p>The {@code putAll} then {@code put} order is collision-free: the two
     * entry sources are disjoint in valid SQL. {@code subqueryAliasToIndex}
     * keys are aliases of {@code (SELECT …) sub} FROM-subqueries (non-{@code
     * objectname} table sources), while {@code addCteAliasToCombinedMap} only
     * adds {@code objectname}-typed tables whose bare name matches a declared
     * CTE — a single alias cannot be both, and two FROM relations sharing one
     * alias is a SQL error the parser/resolver rejects. Mirrors the slice-105
     * {@link #buildUpdateCombinedAliasToSubIdx} contract.
     */
    private static Map<String, Integer> buildDeleteCombinedAliasToSubIdx(
            TDeleteSqlStatement delete,
            Map<String, Integer> subqueryAliasToIndex,
            Map<String, Integer> cteNameToStatementIndex) {
        Map<String, Integer> combined = new HashMap<>();
        if (subqueryAliasToIndex != null) {
            combined.putAll(subqueryAliasToIndex);
        }
        if (cteNameToStatementIndex == null
                || cteNameToStatementIndex.isEmpty()) {
            return combined;
        }
        TJoinList refJoins = delete.getReferenceJoins();
        if (refJoins == null) return combined;
        for (int ji = 0; ji < refJoins.size(); ji++) {
            TJoin join = refJoins.getJoin(ji);
            addCteAliasToCombinedMap(join.getTable(),
                    cteNameToStatementIndex, combined);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                addCteAliasToCombinedMap(item.getTable(),
                        cteNameToStatementIndex, combined);
            }
        }
        return combined;
    }

    /**
     * Slice 102 / Slice 103 — when a WITH-clause CTE declares an explicit
     * column list ({@code WITH cte(a, b) AS (SELECT x, y FROM t)}), rebuild
     * {@code stmts[bodyIdx]} so its {@link OutputColumn} names match the
     * explicit list at each ordinal and rewrite outgoing
     * {@link LineageRef.Kind#STATEMENT_OUTPUT} refs in
     * {@code lineage[lineageSize0..lineage.size())} so the inner-projection
     * names are replaced by the explicit-list names.
     *
     * <p>Returns the published column list for the caller's
     * {@code ctePublishedColumns} map: the renamed list when an explicit list
     * is present; otherwise the body's inner names (matching pre-slice-102
     * behavior). Slice 103 reuses this helper from the outer SELECT CTE
     * walker via {@code dmlKind="SELECT"} (slice-100 cross-DML reuse
     * precedent).
     *
     * <p>Rejects:
     * <ul>
     *   <li>Arity mismatch — explicit-list size != body output count →
     *       {@link DiagnosticCode#MERGE_CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH}
     *       when {@code dmlKind="MERGE"}, otherwise
     *       {@link DiagnosticCode#CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH}.
     *       Slice 103 cannot rename the MERGE-side code (it is pinned by
     *       {@code Slice102Test.valueOfPinsResolveBothCodes} and adopting
     *       it on the SELECT side would also miswire the message text);
     *       the SELECT-side gets its own parallel code (codex round-1
     *       plan-review BLOCKING).</li>
     *   <li>Duplicate explicit name ({@code WITH cte(a, a) AS ...}) →
     *       {@link DiagnosticCode#DUPLICATE_OUTPUT_NAME}. STATEMENT_OUTPUT
     *       refs are keyed by output name; duplicates would collide
     *       (codex round-2 plan-review advisory).</li>
     * </ul>
     *
     * <p>{@link OutputColumn} and {@link StatementGraph} are immutable; the
     * rebuild uses the slice-85 15-arg primary constructor copying every
     * field unchanged except {@code outputColumns}. {@link LineageEdge} and
     * {@link LineageRef} are immutable; the rewrite walker constructs new
     * instances and replaces them in the mutable {@code lineage} list via
     * {@link List#set}.
     */
    private static List<String> applyExplicitCteColumnListRename(
            TCTE cte,
            List<StatementGraph> stmts,
            List<LineageEdge> lineage,
            int bodyIdx,
            int lineageSize0,
            String dmlKind) {
        StatementGraph body = stmts.get(bodyIdx);
        if (cte.getColumnList() == null || cte.getColumnList().size() == 0) {
            return outputColumnNames(body);
        }
        // Materialize the explicit list of renamed names (in declaration order).
        boolean isMerge = "MERGE".equals(dmlKind);
        String dmlLabel = isMerge ? "MERGE CTE" : "CTE";
        String withClauseLabel = isMerge ? "MERGE WITH clause CTE" : "WITH clause CTE";
        List<String> renamed = new ArrayList<>(cte.getColumnList().size());
        Set<String> seenLower = new HashSet<>();
        for (int k = 0; k < cte.getColumnList().size(); k++) {
            TObjectName col = cte.getColumnList().getObjectName(k);
            String name = (col == null) ? null : col.getColumnNameOnly();
            if (name == null || name.isEmpty()) {
                // Defensive — parser normally fills these; if not, fall
                // back to a synthetic name so the constructor invariant
                // (non-empty name) holds, and the arity check still works.
                name = "col" + (k + 1);
            }
            String lower = name.toLowerCase(Locale.ROOT);
            if (!seenLower.add(lower)) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.DUPLICATE_OUTPUT_NAME,
                        "duplicate column name '" + name + "' in " + dmlLabel + " '"
                                + cte.getTableName()
                                + "' explicit column list; output names must "
                                + "be unique within a CTE published column list",
                        cte));
            }
            renamed.add(name);
        }
        List<OutputColumn> bodyOutputs = body.getOutputColumns();
        if (bodyOutputs.size() != renamed.size()) {
            DiagnosticCode arityCode = isMerge
                    ? DiagnosticCode.MERGE_CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH
                    : DiagnosticCode.CTE_EXPLICIT_COLUMN_LIST_ARITY_MISMATCH;
            throw new SemanticIRBuildException(Diagnostic.error(
                    arityCode,
                    withClauseLabel + " '" + cte.getTableName()
                            + "' declares " + renamed.size()
                            + " explicit column(s) but the body's SELECT "
                            + "publishes " + bodyOutputs.size() + " column(s); "
                            + "the explicit list must have exactly one entry "
                            + "per body output column",
                    cte));
        }
        // Capture the old → new name mapping by ordinal BEFORE building the
        // new OutputColumns, so the lineage rewrite can look up the
        // substitution by old (inner) name. Codex round-1 diff-review
        // (non-blocking → upgraded to defensive guard): if the body has
        // duplicate inner output names (e.g. `SELECT id, id`), name-keyed
        // rewrite collapses both old refs to the last mapping and
        // produces wrong lineage. The IR contract already states output
        // names must be unique (see DUPLICATE_OUTPUT_NAME javadoc and the
        // line-4378 scalar-subquery guard) but is not enforced
        // generically. Reject here so explicit-rename paths cannot
        // silently break lineage.
        Set<String> seenInnerLower = new HashSet<>();
        for (OutputColumn oc : bodyOutputs) {
            String n = oc.getName();
            if (n == null || n.isEmpty()) continue;
            String lower = n.toLowerCase(Locale.ROOT);
            if (!seenInnerLower.add(lower)) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.DUPLICATE_OUTPUT_NAME,
                        dmlLabel + " '" + cte.getTableName()
                                + "' body publishes duplicate inner column "
                                + "name '" + n + "'; the explicit column "
                                + "list rename requires unique inner names "
                                + "because lineage refs are keyed by output "
                                + "name and would collide",
                        cte));
            }
        }
        Map<String, String> oldToNewLower = new HashMap<>();
        List<OutputColumn> newOutputs = new ArrayList<>(bodyOutputs.size());
        for (int k = 0; k < bodyOutputs.size(); k++) {
            OutputColumn oc = bodyOutputs.get(k);
            String oldName = oc.getName();
            String newName = renamed.get(k);
            if (oldName != null && !oldName.isEmpty()) {
                oldToNewLower.put(oldName.toLowerCase(Locale.ROOT), newName);
            }
            newOutputs.add(new OutputColumn(newName, oc.isDerived(),
                    oc.isAggregate(), oc.getSources(), oc.getWindowSpec()));
        }
        // Rebuild the body's StatementGraph using the slice-85 15-arg primary
        // constructor — copies every field (including the slice-85
        // returningColumns slot per codex round-1 plan-review BLOCKING)
        // except outputColumns.
        StatementGraph renamedBody = new StatementGraph(
                body.getName(), body.getKind(), body.getRelations(),
                newOutputs, body.getReturningColumns(),
                body.getFilterColumnRefs(), body.getJoinColumnRefs(),
                body.getGroupByColumnRefs(), body.getHavingColumnRefs(),
                body.getOrderByColumnRefs(), body.getDistinctOnColumnRefs(),
                body.isDistinct(), body.getSetOperator(), body.getRowLimit(),
                body.getTarget())
                // Slice 180 (R5): the rebuild via the legacy ctor would strip
                // the block span the original carried; preserve it so the
                // renamed body keeps its scope span. (The legacy ctor also
                // resets joinAnalysisFacts; that pre-existing facts-strip is
                // left as-is here — out of R5 scope — to avoid changing the
                // emitted JSON for these renamed bodies.)
                .withSourceSpan(body.getSourceSpan());
        stmts.set(bodyIdx, renamedBody);
        // Rewrite outgoing STATEMENT_OUTPUT refs in the window. Both `from`
        // and `to` are checked because edges can place the body-output ref
        // on either side (producer-side: from=TABLE_COLUMN, to=STATEMENT_OUTPUT;
        // consumer-side from a deeper inner stmt: from=STATEMENT_OUTPUT,
        // to=STATEMENT_OUTPUT — neither shape today places bodyIdx on
        // `from` for THIS body, but the symmetric check is cheap and
        // future-proof). LineageRef and LineageEdge are immutable, so new
        // instances are constructed and `lineage.set` replaces in place.
        for (int idx = lineageSize0; idx < lineage.size(); idx++) {
            LineageEdge edge = lineage.get(idx);
            LineageRef from = edge.getFrom();
            LineageRef to = edge.getTo();
            LineageRef newFrom = maybeRewriteStatementOutputRef(
                    from, bodyIdx, oldToNewLower);
            LineageRef newTo = maybeRewriteStatementOutputRef(
                    to, bodyIdx, oldToNewLower);
            if (newFrom != from || newTo != to) {
                lineage.set(idx, new LineageEdge(newFrom, newTo));
            }
        }
        return Collections.unmodifiableList(renamed);
    }

    /**
     * Slice 113 — copy a {@link StatementGraph} with a new {@code name}
     * field. Every other field is preserved verbatim. Used by the
     * set-op branch loop to assign the synthetic
     * {@code <set_op_branch_<idx>>} name AFTER the branch build, in case
     * the branch's WHERE-side predicate-subquery extraction
     * (slice 113 via {@link PredicateClauseContext#SET_OP_BRANCH_WHERE})
     * appended predicate-body statements to {@code stmts}, which would
     * otherwise leave the pre-computed digit suffix lagging behind the
     * branch's final position.
     *
     * <p>The rebuild is purely cosmetic on the {@link StatementGraph#getName()}
     * field. No {@link LineageRef} is affected because all lineage refs
     * are idx-based (see {@link LineageRef#statementOutput(int, String)}),
     * not name-based. {@code outputColumns}, {@code relations},
     * {@code filterColumnRefs}, {@code joinColumnRefs} and every other
     * field are reused unchanged.
     */
    private static StatementGraph withRenamedTo(StatementGraph s, String newName) {
        return new StatementGraph(newName, s.getKind(),
                s.getRelations(), s.getOutputColumns(), s.getReturningColumns(),
                s.getFilterColumnRefs(), s.getJoinColumnRefs(),
                s.getGroupByColumnRefs(), s.getHavingColumnRefs(),
                s.getOrderByColumnRefs(), s.getDistinctOnColumnRefs(),
                s.isDistinct(), s.getSetOperator(), s.getRowLimit(),
                s.getTarget())
                // Slice 180 (R5): preserve the block span the legacy ctor
                // would otherwise drop, so this rename keeps the scope span.
                .withSourceSpan(s.getSourceSpan());
    }

    /**
     * Slice 102 — return a new STATEMENT_OUTPUT {@link LineageRef} with the
     * output name substituted when {@code ref} targets {@code bodyIdx} and
     * its current output name is a key in {@code oldToNewLower}. Otherwise
     * return {@code ref} unchanged (identity-comparable so the caller can
     * skip the {@code lineage.set} for no-op rewrites).
     */
    private static LineageRef maybeRewriteStatementOutputRef(
            LineageRef ref, int bodyIdx,
            Map<String, String> oldToNewLower) {
        if (ref == null) return null;
        if (ref.getKind() != LineageRef.Kind.STATEMENT_OUTPUT) return ref;
        if (ref.getStatementIndex() != bodyIdx) return ref;
        String oldName = ref.getOutputName();
        if (oldName == null || oldName.isEmpty()) return ref;
        String newName = oldToNewLower.get(oldName.toLowerCase(Locale.ROOT));
        if (newName == null) return ref;
        return LineageRef.statementOutput(bodyIdx, newName);
    }

    /**
     * Emit one lineage edge per (output, source) pair. Edges target a
     * {@link LineageRef.Kind#STATEMENT_OUTPUT} when the source's relation
     * is a CTE or a FROM-clause subquery, or a
     * {@link LineageRef.Kind#TABLE_COLUMN} when it's a base table.
     * Multi-source derived columns produce one edge per source.
     *
     * <p>{@code subqueryAliasToStatementIndex} is statement-local; the
     * caller supplies the alias map for this statement's own FROM list.
     * That avoids cross-scope alias collisions.
     */
    private static void emitLineageForStatement(StatementGraph stmt,
                                                int statementIndex,
                                                List<LineageEdge> lineage,
                                                Map<String, Integer> cteNameToStatementIndex,
                                                Map<String, Integer> subqueryAliasToStatementIndex,
                                                Map<Integer, ScalarInfo> ordinalToScalarInfo) {
        // Slice 87: lowercase alias keys so SQL identifiers written with
        // different casing in the FROM clause vs. SELECT qualifier resolve
        // correctly (e.g. `SELECT t.name FROM employees T`). Mirrors the
        // same fix in emitUpdateSubquerySourceEdges (slice 83). When two
        // relations collide after lowercasing (unusual, but not guaranteed
        // caught by the duplicate-alias preflight in all call paths per
        // codex Q1 advisory), last-write-wins — the same policy as slice 83.
        Map<String, RelationSource> aliasToRelation = new HashMap<>();
        for (RelationSource r : stmt.getRelations()) {
            String key = r.getAlias();
            if (key == null || key.isEmpty()) continue;
            aliasToRelation.put(key.toLowerCase(Locale.ROOT), r);
        }
        List<OutputColumn> outputs = stmt.getOutputColumns();
        for (int outOrdinal = 0; outOrdinal < outputs.size(); outOrdinal++) {
            OutputColumn out = outputs.get(outOrdinal);
            // Slice 11: scalar-subquery projections have empty sources
            // by construction; their lineage edge is a single
            // STATEMENT_OUTPUT → STATEMENT_OUTPUT pointing at the
            // extracted scalar body's only output. Emit it once and
            // skip the per-source loop (which would be a no-op anyway).
            ScalarInfo scalar = ordinalToScalarInfo.get(outOrdinal);
            if (scalar != null) {
                lineage.add(new LineageEdge(
                        LineageRef.statementOutput(statementIndex, out.getName()),
                        LineageRef.statementOutput(scalar.statementIndex,
                                scalar.innerOutputName)));
                continue;
            }
            for (ColumnRef src : out.getSources()) {
                String srcAlias = src.getRelationAlias();
                RelationSource rel = aliasToRelation.get(
                        srcAlias == null ? null : srcAlias.toLowerCase(Locale.ROOT));
                if (rel == null) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.OUTPUT_REFERENCES_UNKNOWN_RELATION,
                            "output '" + out.getName() + "' references unknown relation '"
                                    + src.getRelationAlias() + "'", null));
                }
                LineageRef from = LineageRef.statementOutput(statementIndex, out.getName());
                LineageRef to;
                // Slice 15: resolved-kind dispatch. For OUTER_REFERENCE
                // bindings the underlying outerKind decides which
                // table-column or statement-output edge we emit.
                // Codex round-1 MUST 2 / round-2 MUST 1: exhaustive
                // dispatch instead of catch-all.
                RelationKind kind = rel.getBinding().getKind();
                RelationKind resolvedKind = (kind == RelationKind.OUTER_REFERENCE)
                        ? rel.getBinding().getOuterKind()
                        : kind;
                if (resolvedKind == RelationKind.CTE) {
                    Integer cteIndex = cteNameToStatementIndex.get(
                            rel.getBinding().getQualifiedName().toLowerCase(Locale.ROOT));
                    if (cteIndex == null) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.CTE_BODY_MISSING,
                                "CTE '" + rel.getBinding().getQualifiedName() + "' has no body statement", null));
                    }
                    to = LineageRef.statementOutput(cteIndex, src.getColumnName());
                } else if (resolvedKind == RelationKind.SUBQUERY) {
                    Integer subIndex = subqueryAliasToStatementIndex.get(
                            rel.getAlias().toLowerCase(Locale.ROOT));
                    if (subIndex == null) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_BINDING_UNRESOLVED,
                                "FROM-clause subquery '" + rel.getAlias()
                                        + "' has no body statement registered", null));
                    }
                    to = LineageRef.statementOutput(subIndex, src.getColumnName());
                } else if (resolvedKind == RelationKind.TABLE
                        || resolvedKind == RelationKind.FUNCTION) {
                    // FUNCTION (table-valued function) is an opaque source:
                    // lineage terminates at the function's qualified name,
                    // same shape as a base table column.
                    to = LineageRef.tableColumn(
                            rel.getBinding().getQualifiedName(),
                            src.getColumnName());
                } else {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.OUTPUT_REFERENCES_UNSUPPORTED_BINDING_KIND,
                            "output '" + out.getName()
                                    + "' references relation '" + rel.getAlias()
                                    + "' with unsupported binding kind " + kind
                                    + (kind == RelationKind.OUTER_REFERENCE
                                        ? " (outerKind=" + rel.getBinding().getOuterKind() + ")"
                                        : ""), null));
                }
                lineage.add(new LineageEdge(from, to));
            }
        }
    }

    /**
     * Build one SELECT statement (CTE body or outer). The {@code name}
     * argument is non-null for a CTE body, null otherwise. When
     * {@code hasOuterCteListAlreadyProcessed} is true, the SELECT's own
     * {@code getCteList()} is not rejected because the caller has already
     * extracted those CTEs into separate statements; in all other cases a
     * non-empty CTE list on this node is rejected (so nested WITH inside
     * a CTE body does not silently slip through).
     */
    private static StatementGraph buildSelectStatement(TSelectSqlStatement select,
                                                       NameBindingProvider provider,
                                                       String name,
                                                       boolean hasOuterCteListAlreadyProcessed,
                                                       boolean allowFromSubqueries,
                                                       boolean allowScalarProjectionSubqueries,
                                                       boolean allowWindowProjection) {
        // Slice 23: legacy 7-arg call site. Predicate-subquery extraction is
        // disabled (allowJoinOnPredicateSubqueries=false) and this is not a
        // predicate body itself (isPredicateBody=false). All non-outer call
        // sites use this overload — the slice-17 `rejectSubqueriesInJoinOn`
        // continues to fire at every non-outer JOIN-ON site.
        return buildSelectStatementImpl(select, provider, name,
                hasOuterCteListAlreadyProcessed,
                allowFromSubqueries,
                allowScalarProjectionSubqueries,
                allowWindowProjection,
                /*allowJoinOnPredicateSubqueries=*/ false,
                /*stmtsForExtraction=*/ null,
                /*lineageForExtraction=*/ null,
                /*cteMapForExtraction=*/ null,
                /*isPredicateBody=*/ false,
                /*whereClauseContext=*/ PredicateClauseContext.SELECT_WHERE,
                /*allowWherePredicateSubqueries=*/ false);
    }

    /**
     * Internal body shared between the legacy 7-arg overload and the
     * outer-SELECT entry point used by {@link #build}. Slice 23 added two new
     * concepts; slice 24 added one more.
     * <ul>
     *   <li>{@code allowJoinOnPredicateSubqueries} + {@code stmts}/{@code lineage}
     *       — when {@code allow...} is {@code true}, JOIN-ON uncorrelated
     *       EXISTS subqueries are extracted as their own
     *       {@code <predicate_subquery_<i>>} statements appended to
     *       {@code stmts} (slice-11/12 synthetic-name pattern). Outer-SELECT
     *       entry only.</li>
     *   <li>{@code isPredicateBody} — when {@code true}, this statement IS
     *       the inner SELECT of an extracted EXISTS body. The constant-only
     *       projection rejection in {@link #buildOutputColumns} is bypassed
     *       and a single synthetic OutputColumn is emitted in its place.</li>
     *   <li>{@code cteMapForExtraction} (slice 24) — outer's CTE
     *       name-to-statement-index map, plumbed in only when
     *       {@code allowJoinOnPredicateSubqueries=true}. Required so the
     *       slice-24 column-bearing inner projection can emit
     *       STATEMENT_OUTPUT → STATEMENT_OUTPUT lineage edges into outer-
     *       visible CTE bodies. Non-outer call sites pass {@code null}.</li>
     * </ul>
     */
    private static StatementGraph buildSelectStatementImpl(
            TSelectSqlStatement select,
            NameBindingProvider provider,
            String name,
            boolean hasOuterCteListAlreadyProcessed,
            boolean allowFromSubqueries,
            boolean allowScalarProjectionSubqueries,
            boolean allowWindowProjection,
            boolean allowJoinOnPredicateSubqueries,
            List<StatementGraph> stmtsForExtraction,
            List<LineageEdge> lineageForExtraction,
            Map<String, Integer> cteMapForExtraction,
            boolean isPredicateBody,
            PredicateClauseContext whereClauseContext,
            boolean allowWherePredicateSubqueries) {
        rejectUnsupportedShape(select, hasOuterCteListAlreadyProcessed);
        // Slice 129: PIVOT sub-slice (a). A SELECT whose single FROM source
        // is a PIVOT routes to the dedicated pivot builder, which binds the
        // underlying source relation and captures the consumed FOR /
        // aggregation-arg columns into StatementGraph.pivotColumnRefs. Scoped
        // to the outer SELECT context (name == null, not a predicate body);
        // nested / non-outer PIVOTs are deferred to a later sub-slice and
        // fall through to the normal path (which rejects with the existing
        // TABLE_BINDING_UNRESOLVED as before).
        if (name == null && !isPredicateBody && isPivotSelect(select)) {
            return buildPivotSelect(select, provider, name);
        }
        // Slice 143: a PIVOT/UNPIVOT driver that ALSO has a JOIN partner
        // (e.g. FROM sales PIVOT(...) AS p JOIN dim d ON ...) trips
        // isPivotSelect's "no trailing JOIN" guard and would otherwise fall to
        // the normal path and reject with the GENERIC TABLE_BINDING_UNRESOLVED.
        // Emit a PRECISE deferral reusing the existing
        // PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED code (no new lineage admitted),
        // mirroring the precise chained-PIVOT reject.
        //
        // Slice 145: this precise routing no longer carries the slice-143/144
        // `name == null && !isPredicateBody` guard, so it also fires in NESTED
        // contexts (CTE body / FROM-subquery body / set-op branch /
        // predicate-subquery body) where a pivot-with-join reaches
        // buildSelectStatementImpl under a non-null name (or isPredicateBody).
        // The slice-129 ADMISSION router above keeps its outer-only guard —
        // nested ADMITTED pivots (isPivotSelect) are routed to buildPivotSelect
        // at their own call sites and never reach here; only NON-admitted
        // pivot-with-join shapes do, which were previously rejected with the
        // generic TABLE_BINDING_UNRESOLVED. The helpers only match when a
        // pivoted_table is genuinely present, so a plain JOIN is untouched.
        if (isPivotWithJoinPartner(select)) {
            TTable pivotTable = select.joins.getJoin(0).getTable();
            // Slice 146: name the ACTUAL operator (PIVOT vs UNPIVOT) so an
            // UNPIVOT-then-JOIN does not mis-report "PIVOT".
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                    pivotOperatorKeyword(pivotTable) + " combined with a JOIN is not supported yet",
                    pivotTable));
        }
        // Slice 144: the symmetric positions — a PIVOT/UNPIVOT appearing as a
        // JOIN PARTNER rather than the FROM driver: the right-hand side of an
        // explicit JOIN (FROM dim JOIN sales PIVOT(...) ON ...) or a comma-join
        // sibling (FROM sales PIVOT(...), dim). Slice 143 closed the
        // pivot-as-driver case; these shapes previously fell to the normal path
        // and rejected with the GENERIC TABLE_BINDING_UNRESOLVED. Emit the same
        // PRECISE deferral reusing PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED (no new
        // lineage admitted). Slice 145 (see above) lifts the outer-only guard so
        // this also fires for a pivot join partner in any nesting context.
        TTable pivotPartner = findPivotJoinPartner(select);
        if (pivotPartner != null) {
            // Slice 146: name the ACTUAL operator (PIVOT vs UNPIVOT).
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                    pivotOperatorKeyword(pivotPartner) + " combined with a JOIN is not supported yet",
                    pivotPartner));
        }
        boolean distinct = resolveDistinctFlag(select);
        // Slice 65 — reset using scope at entry so a parent SELECT's
        // scope cannot leak into recursive nested builds. The using
        // scope for THIS SELECT is installed only AFTER buildRelations
        // completes (see below) so the predicate-subquery extraction
        // walk inside buildRelations does not inherit the outer scope
        // (codex slice-65 diff-review round-1 P2 #1: an inner
        // {@code EXISTS (SELECT SUM(x.v) FILTER (WHERE k > 0) FROM x)}
        // would have its bare `k` expand to outer's merged sources,
        // causing a valid uncorrelated body to be rejected as
        // correlated). The slice-64 → 65 JOIN-ON merged-key reject
        // also runs BEFORE buildRelations so ON-clause refs aren't
        // collected with a stale or future scope.
        provider = provider.withUsingScope(UsingScope.EMPTY);
        // Reset the join-graph structural anchor at entry (mirrors the
        // UsingScope reset above) so a parent SELECT's anchor cannot leak into
        // this recursive nested build. It is re-installed below for THIS
        // SELECT's own FROM clause once relations are bound.
        provider = provider.withJoinStructureAnchor(false);
        rejectUnqualifiedMergedKeyInJoinOn(select, provider);
        List<ColumnRef> joinRefs = new ArrayList<>();
        List<RelationSource> relations;
        if (isSetOpBranchSyntheticName(name)
                && hasNoFromSource(select)
                && allResultColumnsAreConstantExpressions(select)) {
            // Slice 61: allow FROM-less constant-only set-op branches
            // such as SELECT 1 UNION ALL SELECT 2. The general SELECT
            // boundary remains unchanged: non-branch SELECT 1 still
            // fails in buildRelations with "must have at least one
            // FROM source".
            relations = Collections.emptyList();
        } else {
            relations = buildRelations(select, provider, joinRefs,
                    allowFromSubqueries,
                    allowJoinOnPredicateSubqueries,
                    stmtsForExtraction, lineageForExtraction, cteMapForExtraction);
        }
        // Slice 65 — install this SELECT's own using scope AFTER
        // buildRelations / predicate-subquery extraction. From here
        // forward the clause collectors (output / filter / groupBy /
        // having / orderBy) see the merged-key scope for THIS SELECT.
        UsingScope ownScope = buildUsingScope(select, provider);
        if (!ownScope.isEmpty()) {
            provider = provider.withUsingScope(ownScope);
        }
        // Install the join-graph structural anchor for THIS SELECT: two or more
        // bound FROM endpoints mean the join graph is fully determined (an
        // unqualified column can only be NON_EXACT when ≥2 candidate relations
        // exist, and reaching here means every relation bound — buildRelations
        // throws TABLE_BINDING_UNRESOLVED otherwise). The anchor lets
        // rejectNonExactBindings degrade an unqualified, catalog-less column
        // miss over an explicit ON / CROSS / comma join to a warning instead of
        // discarding the whole statement graph — the same treatment the USING
        // merged-key anchor already gives.
        //
        // CATALOG-LESS GATE: the degrade exists only because, WITHOUT a catalog,
        // we cannot know which side an unqualified column belongs to. When every
        // FROM relation has a known column list (catalog or in-scope derived
        // columns), the catalog CAN adjudicate — an unqualified column matching
        // no side is a genuine error and must stay fatal (a multi-relation
        // resolver returns a null binding either way, so the reject result alone
        // cannot distinguish the two). So anchor only when at least one endpoint's
        // columns are unknown.
        if (relations.size() >= 2 && !fromRelationColumnsFullyKnown(select, provider)) {
            provider = provider.withJoinStructureAnchor(true);
        }
        List<OutputColumn> outputColumns = buildOutputColumns(select, provider,
                allowScalarProjectionSubqueries, allowWindowProjection,
                isPredicateBody, name);
        // Slice 112 — thread the SELECT path's outer extraction context
        // through buildFilterColumnRefs so top-level SELECT WHERE can
        // lift uncorrelated predicate-subquery wrappers via the
        // slice-23+ extraction pipeline (PredicateClauseContext.SELECT_WHERE).
        // Slice 113 — the same threading extends to set-op branch WHERE
        // via PredicateClauseContext.SET_OP_BRANCH_WHERE, distinguished
        // only by clauseLabel for diagnostic messages (codes are shared).
        //
        // {@code allowWherePredicateSubqueries} is INDEPENDENT of
        // {@code allowJoinOnPredicateSubqueries} (slice 113 split):
        // set-op branches admit WHERE-side predicate subqueries while
        // KEEPING JOIN-ON predicate subqueries rejected (slice 23 / 26
        // contract — pinned by Slice23Test#existsInSetOpBranchJoinOnStillRejected
        // and Slice26Test#lhsSubqueryInSetOpBranchRejected). Nested
        // SELECTs without extraction context
        // (allowWherePredicateSubqueries=false) keep the slice-80
        // blanket reject inside buildFilterColumnRefs.
        // R8 — collector for predicate-derived semi-joins (EXISTS / IN /
        // NOT EXISTS / NOT IN in WHERE). Populated by buildFilterColumnRefs'
        // extraction; converted to SEMI / ANTI_SEMI JoinEntities at
        // JoinGraph assembly below (which has `relations` to resolve the
        // outer left endpoint).
        List<SemiJoinFact> semiFacts = new ArrayList<>();
        // R8 — the outer FROM relation aliases (lower-cased) gate the
        // correlated-EXISTS degrade: only a correlation to a genuine outer
        // relation degrades; an unknown alias still rejects.
        Set<String> outerRelationAliases = new HashSet<>();
        for (RelationSource rs : relations) {
            if (rs.getAlias() != null && !rs.getAlias().isEmpty()) {
                outerRelationAliases.add(rs.getAlias().toLowerCase(Locale.ROOT));
            }
        }
        List<ColumnRef> filterRefs = buildFilterColumnRefs(select, provider,
                allowWherePredicateSubqueries,
                stmtsForExtraction, lineageForExtraction, cteMapForExtraction,
                whereClauseContext, semiFacts, outerRelationAliases);
        List<ColumnRef> groupByRefs = buildGroupByColumnRefs(select, provider);
        List<ColumnRef> havingRefs = buildHavingColumnRefs(select, provider);
        List<ColumnRef> orderByRefs = buildOrderByColumnRefs(select, provider, outputColumns);
        // Slice 73: DISTINCT ON refs collected here so they observe the
        // same {@code provider} (with UsingScope already installed) used
        // by buildGroupByColumnRefs / buildHavingColumnRefs /
        // buildOrderByColumnRefs. This keeps `DISTINCT ON (k)` over
        // `JOIN ... USING (k)` consistent with slice-65 merged-key
        // semantics and prevents parent-scope leakage into nested
        // builds.
        List<ColumnRef> distinctOnRefs = buildDistinctOnColumnRefs(select, provider);
        // Slice 125: QUALIFY filter refs. Needs outputColumns for the
        // projection-alias form (QUALIFY rn = 1); observes the same
        // provider (with UsingScope already installed) as the other
        // clause-ref builders so QUALIFY over JOIN ... USING (k) stays
        // consistent with slice-65 merged-key semantics.
        List<ColumnRef> qualifyRefs = buildQualifyColumnRefs(select, provider, outputColumns);
        // Slice 128: structured GROUP BY view. Built after
        // buildGroupByColumnRefs so its slice-61/slice-13 guards have
        // already fired; observes the same provider as the other clause-ref
        // builders. Empty unless the statement has a GROUP BY.
        List<GroupingElement> groupingElements = buildGroupingElements(select, provider);
        RowLimit rowLimit = buildRowLimit(select);
        StatementGraph sg = new StatementGraph(name, "SELECT", relations, outputColumns,
                filterRefs, joinRefs, groupByRefs, havingRefs, orderByRefs,
                distinctOnRefs,
                qualifyRefs,
                groupingElements,
                distinct,
                /*setOperator=*/ null,
                rowLimit);
        // Slice 179 (R5): carry this block's own source span (covers the
        // full select [... where ...]). All SELECT blocks — main, CTE bodies,
        // FROM-subquery bodies — funnel through this site, so each gets its
        // span from its own parse node. Read by attachQueryBlockScopes.
        sg = sg.withSourceSpan(SourceSpan.of(select));
        // Slice 167 (S6): attach the ordered structured JoinGraph (GAP 1).
        // Slice 169 (S8): attach the WHERE filter predicate tree (GAP 2/3).
        // Both additive — the flat joinColumnRefs / filterColumnRefs above
        // are untouched.
        JoinGraph joinGraph = buildJoinGraph(select, provider);
        // Source-dialect Sema runs after relation binding and before join
        // promotion. It is unconditional for every SELECT/query block, so an
        // Oracle (+) marker cannot disappear merely because no comma-join
        // boundary was promotable. Compatibility lowering continues below,
        // while the atomic build result retains every ERROR and recovery link.
        OracleLegacyOuterJoinValidationResult oraclePlusValidation =
                OracleLegacyOuterJoinValidator.validate(
                        select, relations, provider);
        for (Diagnostic diagnostic : oraclePlusValidation.getDiagnostics()) {
            recordBuildDiagnostic(diagnostic);
        }
        for (RecoveryMetadata.Entry recovery
                : oraclePlusValidation.getRecoveryEntries()) {
            recordBuildRecovery(recovery);
        }
        // R8 — append predicate-derived semi-join entities (EXISTS / IN /
        // NOT EXISTS / NOT IN) after the FROM-clause joins, continuing the
        // order numbering. The left endpoint is the outer relation owning
        // the correlated outer column (falling back to the first FROM
        // relation); the right endpoint is the lifted subquery block.
        joinGraph = appendSemiJoins(joinGraph, semiFacts, relations);
        // Oracle-style implicit-join predicate promotion: when a WHERE conjunct
        // links both sides of a comma-join (IMPLICIT_CROSS) entity, move it from
        // the filter list into that join's conditions and upgrade the join to
        // INNER. A two-sided predicate — equi, non-equi, or a BETWEEN/band range
        // across both relations — is a join condition, not a cartesian filter.
        // The entity keeps sourceSyntax=COMMA so its implicit origin stays
        // distinguishable from an explicit ON join. Single-sided predicates
        // remain filters; an IMPLICIT_CROSS with no linking predicate stays a
        // true cross product.
        TExpression implicitWhere = (select.getWhereClause() != null)
                ? select.getWhereClause().getCondition() : null;
        List<Predicate> filterPredicates;
        if (implicitWhere != null && hasImplicitCrossJoin(joinGraph)) {
            ImplicitJoinPromotion promo = promoteImplicitJoinConditions(
                    joinGraph, implicitWhere, provider,
                    oraclePlusValidation);
            joinGraph = promo.graph;
            filterPredicates = promo.filterPredicates;
        } else {
            filterPredicates = buildFilterPredicates(select, provider);
        }
        JoinAnalysisFacts facts = sg.getJoinAnalysisFacts();
        if (!joinGraph.isEmpty()) {
            facts = facts.withJoinGraph(joinGraph);
        }
        if (!filterPredicates.isEmpty()) {
            facts = facts.withFilterPredicates(filterPredicates);
        }
        if (!facts.isEmpty()) {
            sg = sg.withJoinAnalysisFacts(facts);
        }
        return sg;
    }

    /**
     * Slice 169 (S8) — decompose the WHERE clause into a resolved filter
     * predicate list (GAP 2/3), reusing the slice-166 PredicateTreeBuilder.
     * Tolerant by construction: unknown shapes (including predicate
     * subqueries) fold into COMPLEX without leaking inner columns or
     * throwing. The flat {@code filterColumnRefs} are unaffected.
     */
    private static List<Predicate> buildFilterPredicates(TSelectSqlStatement select,
                                                         NameBindingProvider provider) {
        if (select == null || select.getWhereClause() == null
                || select.getWhereClause().getCondition() == null) {
            return Collections.emptyList();
        }
        return PredicateTreeBuilder.build(select.getWhereClause().getCondition(), provider);
    }

    /** True iff {@code graph} contains a comma-join {@link SemanticJoinType#IMPLICIT_CROSS} entity. */
    private static boolean hasImplicitCrossJoin(JoinGraph graph) {
        for (JoinEntity e : graph.getJoins()) {
            if (e.getJoinType() == SemanticJoinType.IMPLICIT_CROSS) {
                return true;
            }
        }
        return false;
    }

    /** Result of {@link #promoteImplicitJoinConditions}: the rewritten graph and residual WHERE filters. */
    private static final class ImplicitJoinPromotion {
        final JoinGraph graph;
        final List<Predicate> filterPredicates;

        ImplicitJoinPromotion(JoinGraph graph, List<Predicate> filterPredicates) {
            this.graph = graph;
            this.filterPredicates = filterPredicates;
        }
    }

    /**
     * Oracle implicit-join predicate promotion. For each top-level WHERE
     * conjunct that references aliases from BOTH sides of an
     * {@link SemanticJoinType#IMPLICIT_CROSS} comma-join entity, move its
     * {@link Predicate} into that entity's conditions and upgrade the entity's
     * join type. Aliases are read from the conjunct's AST (not the decomposed
     * predicate) so a {@code BETWEEN}'s range bounds — which collapse into a
     * single COMPLEX operand — are still seen as the right side.
     *
     * <p>The upgraded type depends on Oracle's {@code (+)} outer-join marker:
     * <ul>
     *   <li>no {@code (+)} → {@link SemanticJoinType#INNER};</li>
     *   <li>{@code (+)} on the column of the entity's RIGHT endpoint (the
     *       right side is null-producing) → {@link SemanticJoinType#LEFT};</li>
     *   <li>{@code (+)} on a column of the entity's LEFT endpoint (the left
     *       side is null-producing) → {@link SemanticJoinType#RIGHT}.</li>
     * </ul>
     * Direction is relative to the entity's endpoints, not operand position;
     * for GSP's left-deep comma model the LEFT endpoint is the accumulated
     * comma-join result and the RIGHT endpoint is the newly-added relation.
     * Multiple {@code (+)} conjuncts naming the same outer side all attach to
     * the one entity. A conjunct with {@code (+)} on both operands (illegal
     * Oracle) or conjuncts implying conflicting directions degrade the entity
     * back to {@link SemanticJoinType#IMPLICIT_CROSS} (its predicates stay
     * filters) rather than failing.
     *
     * <p>Each conjunct is assigned to the FIRST IMPLICIT_CROSS entity (in
     * FROM/graph order) whose right relation it references together with at
     * least one left-side relation, and all of whose referenced relations are
     * available at that boundary. A conjunct touching only one side, or no
     * comma-join boundary, stays a filter; an IMPLICIT_CROSS with no linking
     * conjunct stays a true cross product. The entity's {@code sourceSyntax}
     * stays {@link JoinSourceSyntax#COMMA}.
     */
    private static ImplicitJoinPromotion promoteImplicitJoinConditions(
            JoinGraph graph, TExpression whereCond, NameBindingProvider provider,
            OracleLegacyOuterJoinValidationResult oraclePlusValidation) {
        List<PredicateTreeBuilder.ConjunctPredicate> conjuncts =
                PredicateTreeBuilder.classifyConjuncts(whereCond, provider);
        List<JoinEntity> joins = graph.getJoins();
        JoinEndpointInstanceIndex endpointIndex =
                new JoinEndpointInstanceIndex(joins);
        int n = conjuncts.size();
        // Pass 1: assign each conjunct to the comma-join boundary it links,
        // and accumulate the Oracle (+) outer-join direction signal per entity.
        int[] assigned = new int[n];
        java.util.Arrays.fill(assigned, -1);
        boolean[] plusPresent = new boolean[n];
        java.util.Map<Integer, java.util.Set<SemanticJoinType>> dirByEntity =
                new java.util.HashMap<>();
        // Marked constant/function filters carry only the null-generated
        // relation. Resolve them to the earliest entity established by another
        // validated pair predicate in this same query block; in Oracle 12c+
        // one null-generated relation may have multiple preserved partners.
        java.util.Map<Integer, Integer> entityByNullGeneratedInstance =
                new java.util.HashMap<>();
        for (PredicateTreeBuilder.ConjunctPredicate cp : conjuncts) {
            PredicateJoinIntent intent =
                    oraclePlusValidation.intentForConjunct(cp.conjunct);
            if (intent == null
                    || intent.getValidity() != PredicateJoinIntent.Validity.VALID
                    || intent.isNullGeneratedFilter()
                    || intent.getNullGeneratedRelationInstanceId() == null) {
                continue;
            }
            int entityIndex = findImplicitJoinEntity(
                    joins, endpointIndex,
                    intent.getReferencedRelationInstanceIds());
            if (entityIndex < 0) continue;
            Integer nullId = intent.getNullGeneratedRelationInstanceId();
            Integer prior = entityByNullGeneratedInstance.get(nullId);
            if (prior == null || entityIndex < prior.intValue()) {
                entityByNullGeneratedInstance.put(
                        nullId, Integer.valueOf(entityIndex));
            }
        }
        // Entities to degrade: a (+) that is on both sides (illegal Oracle), or
        // a (+) we can detect but cannot classify to exactly one endpoint.
        java.util.Set<Integer> degradePlusEntities = new java.util.HashSet<>();
        for (int i = 0; i < n; i++) {
            PredicateTreeBuilder.ConjunctPredicate cp = conjuncts.get(i);
            PredicateJoinIntent validatedIntent =
                    oraclePlusValidation.intentForConjunct(cp.conjunct);
            if (validatedIntent != null
                    && validatedIntent.isNullGeneratedFilter()) {
                Integer target = entityByNullGeneratedInstance.get(
                        validatedIntent.getNullGeneratedRelationInstanceId());
                if (target != null && target.intValue() >= 0) {
                    assigned[i] = target.intValue();
                }
            } else {
                for (int ix = 0; ix < joins.size(); ix++) {
                    JoinEntity e = joins.get(ix);
                    if (e.getJoinType() != SemanticJoinType.IMPLICIT_CROSS) continue;
                    boolean links = validatedIntent != null
                            && validatedIntent.hasMarker()
                            ? conjunctInstanceIdsLinkImplicitJoin(
                                    endpointIndex, e,
                                    validatedIntent.getReferencedRelationInstanceIds())
                            : conjunctLinksImplicitJoin(e,
                                    collectConjunctRelationAliases(
                                            cp.conjunct, provider));
                    if (links) {
                        assigned[i] = ix;
                        break;
                    }
                }
            }
            int target = assigned[i];
            if (target < 0) continue;
            // Oracle (+) outer-join direction for this conjunct on its entity.
            // Deep-scan so a (+) anywhere in the conjunct is noticed even when
            // we cannot classify it (then we degrade rather than silently
            // treating it as an inner join).
            plusPresent[i] = validatedIntent != null
                    && validatedIntent.hasMarker();
            LegacyPlusAliasSignal compatibilitySignal = null;
            if (!plusPresent[i]) {
                compatibilitySignal = legacyPlusAliasSignal(
                        cp.conjunct, provider);
                plusPresent[i] = compatibilitySignal.markerPresent;
            }
            if (!plusPresent[i]) continue;
            if (validatedIntent != null) {
                if (validatedIntent.getValidity()
                        != PredicateJoinIntent.Validity.VALID) {
                    degradePlusEntities.add(target);
                    continue;
                }
                SemanticJoinType dir = oraclePlusJoinDirection(
                        endpointIndex, joins.get(target), validatedIntent);
                if (dir != null) {
                    dirByEntity.computeIfAbsent(target,
                            k -> new java.util.HashSet<SemanticJoinType>()).add(dir);
                } else {
                    degradePlusEntities.add(target);
                }
            } else if (compatibilitySignal.invalid) {
                degradePlusEntities.add(target);
            } else {
                SemanticJoinType dir = compatibilitySignal.outerAlias == null
                        ? null : oraclePlusJoinDirection(
                                joins.get(target), compatibilitySignal.outerAlias);
                if (dir != null) {
                    dirByEntity.computeIfAbsent(target,
                            k -> new java.util.HashSet<SemanticJoinType>()).add(dir);
                } else {
                    // (+) is present but unclassifiable (not a simple
                    // comparison, ambiguous operand, or outer column not an
                    // endpoint of this boundary) — degrade rather than guess.
                    degradePlusEntities.add(target);
                }
            }
        }
        // Pass 2: decide each linked entity's final join type. INNER when no
        // (+) is present; LEFT/RIGHT when all (+) conjuncts agree on direction;
        // DEGRADE (entity stays IMPLICIT_CROSS, its conjuncts fall back to
        // filters) when a (+) is invalid/unclassifiable or different conjuncts
        // imply conflicting directions.
        java.util.Map<Integer, SemanticJoinType> finalType = new java.util.HashMap<>();
        java.util.Set<Integer> degraded = new java.util.HashSet<>();
        for (int ix = 0; ix < joins.size(); ix++) {
            if (joins.get(ix).getJoinType() != SemanticJoinType.IMPLICIT_CROSS) continue;
            if (degradePlusEntities.contains(ix)) {
                degraded.add(ix);
                continue;
            }
            java.util.Set<SemanticJoinType> dirs = dirByEntity.get(ix);
            if (dirs == null || dirs.isEmpty()) {
                finalType.put(ix, SemanticJoinType.INNER);
            } else if (dirs.size() == 1) {
                finalType.put(ix, dirs.iterator().next());
            } else {
                degraded.add(ix);
            }
        }
        // Pass 3: in conjunct order, route each predicate to its entity's
        // condition list or to the residual filter list. For an OUTER (LEFT/
        // RIGHT) join only the (+)-marked conjuncts are join conditions: an
        // unmarked two-sided predicate is a post-join WHERE filter in Oracle
        // (it eliminates null-extended rows), so it must stay residual.
        java.util.Map<Integer, List<Predicate>> condsByEntity =
                new java.util.LinkedHashMap<>();
        List<Predicate> residualFilters = new ArrayList<>();
        for (int i = 0; i < n; i++) {
            int t = assigned[i];
            boolean asCondition = t >= 0 && !degraded.contains(t);
            if (asCondition) {
                SemanticJoinType ft = finalType.get(t);
                if (ft != SemanticJoinType.INNER && !plusPresent[i]) {
                    asCondition = false;
                }
            }
            if (asCondition) {
                condsByEntity.computeIfAbsent(t, k -> new ArrayList<Predicate>())
                        .add(conjuncts.get(i).predicate);
            } else {
                residualFilters.add(conjuncts.get(i).predicate);
            }
        }
        if (condsByEntity.isEmpty()) {
            return new ImplicitJoinPromotion(graph, residualFilters);
        }
        List<JoinEntity> upgraded = new ArrayList<>(joins.size());
        for (int ix = 0; ix < joins.size(); ix++) {
            JoinEntity e = joins.get(ix);
            List<Predicate> conds = condsByEntity.get(ix);
            if (conds == null || conds.isEmpty()) {
                upgraded.add(e);
            } else {
                upgraded.add(new JoinEntity(finalType.get(ix),
                        e.getLeftEndpoint(), e.getRightEndpoint(), e.getOrder(),
                        e.getSourceSyntax(), e.isNatural(), e.getUsingColumns(),
                        conds, e.getSourceSpan(), e.getConditionText(), e.isLateral()));
            }
        }
        return new ImplicitJoinPromotion(new JoinGraph(upgraded), residualFilters);
    }

    /**
     * Compatibility-only typed signal for non-Oracle dialects whose parser
     * reuses the Oracle marker flag. Oracle builds consume validated instance
     * identities and never reach this alias-based fallback.
     *
     * <p>Returns {@code null} when there is no {@code (+)} (or it is not on a
     * simple comparison — the only shape Oracle's {@code (+)} attaches to), or
     * when the marked column's relation cannot be resolved (caller degrades
     * when a marker was nonetheless detected). Returns
     * <p>Operand subtrees are deep-scanned for the marker so a parenthesised
     * column ({@code (b.y(+))}) is recognised as well as a bare one.
     */
    private static LegacyPlusAliasSignal legacyPlusAliasSignal(
            TExpression conjunct, NameBindingProvider provider) {
        boolean markerPresent = expressionHasOraclePlus(conjunct);
        TExpression e = unwrapParenExpression(conjunct);
        if (e == null || e.getExpressionType() != EExpressionType.simple_comparison_t) {
            return new LegacyPlusAliasSignal(markerPresent, false, null);
        }
        TExpression lo = e.getLeftOperand();
        TExpression ro = e.getRightOperand();
        boolean leftPlus = expressionHasOraclePlus(lo);
        boolean rightPlus = expressionHasOraclePlus(ro);
        if (leftPlus && rightPlus) {
            return new LegacyPlusAliasSignal(true, true, null);
        }
        String alias = leftPlus
                ? soleOperandRelationAlias(lo, provider)
                : rightPlus ? soleOperandRelationAlias(ro, provider) : null;
        return new LegacyPlusAliasSignal(markerPresent, false, alias);
    }

    private static final class LegacyPlusAliasSignal {
        private final boolean markerPresent;
        private final boolean invalid;
        private final String outerAlias;

        private LegacyPlusAliasSignal(boolean markerPresent, boolean invalid,
                                      String outerAlias) {
            this.markerPresent = markerPresent;
            this.invalid = invalid;
            this.outerAlias = outerAlias;
        }
    }

    /**
     * True iff {@code e} or any descendant (outside a nested subquery) carries
     * the Oracle {@code (+)} outer-join marker. Used both to notice a marker we
     * cannot otherwise classify and to find it under a {@code parenthesis_t}
     * operand wrapper.
     */
    private static boolean expressionHasOraclePlus(TExpression e) {
        if (e == null) return false;
        java.util.Set<TExpression> seen = java.util.Collections.newSetFromMap(
                new java.util.IdentityHashMap<TExpression, Boolean>());
        java.util.Deque<TExpression> work = new java.util.ArrayDeque<>();
        work.push(e);
        while (!work.isEmpty()) {
            TExpression current = work.pop();
            if (!seen.add(current)) continue;
            if (current.isOracleOuterJoin()) return true;
            if (current.getSubQuery() != null) continue;
            if (current.getExprList() != null) {
                for (int i = current.getExprList().size() - 1; i >= 0; i--) {
                    TExpression child = current.getExprList().getExpression(i);
                    if (child != null) work.push(child);
                }
            }
            if (current.getBetweenOperand() != null) {
                work.push(current.getBetweenOperand());
            }
            if (current.getRightOperand() != null) {
                work.push(current.getRightOperand());
            }
            if (current.getLeftOperand() != null) {
                work.push(current.getLeftOperand());
            }
        }
        return false;
    }

    /**
     * The single relation alias an operand expression references, lower-cased,
     * or {@code null} when it references zero or more than one relation (an
     * Oracle {@code (+)} marks exactly one column).
     */
    private static String soleOperandRelationAlias(TExpression operand,
                                                   NameBindingProvider provider) {
        java.util.Set<String> aliases = collectConjunctRelationAliases(operand, provider);
        return aliases.size() == 1 ? aliases.iterator().next() : null;
    }

    /**
     * Map an Oracle {@code (+)} outer (null-producing) relation alias to the
     * {@link SemanticJoinType} for {@code entity}, relative to its endpoints:
     * a null-producing RIGHT endpoint yields {@link SemanticJoinType#LEFT}
     * (the left side is preserved); a null-producing LEFT endpoint yields
     * {@link SemanticJoinType#RIGHT} (the right side is preserved). Returns
     * {@code null} when the outer alias is not one of this entity's endpoints.
     */
    private static SemanticJoinType oraclePlusJoinDirection(JoinEntity entity,
                                                            String outerAliasLc) {
        String right = entity.getRightEndpoint().getAlias();
        if (right != null && right.toLowerCase(Locale.ROOT).equals(outerAliasLc)) {
            return SemanticJoinType.LEFT;
        }
        for (String left : endpointAliasesLowerCase(entity.getLeftEndpoint())) {
            if (left.equals(outerAliasLc)) {
                return SemanticJoinType.RIGHT;
            }
        }
        return null;
    }

    /** Map a validated relation-instance intent to this join boundary. */
    private static SemanticJoinType oraclePlusJoinDirection(
            JoinEndpointInstanceIndex endpointIndex, JoinEntity entity,
            PredicateJoinIntent intent) {
        if (entity == null || entity.getRightEndpoint() == null
                || intent == null) {
            return null;
        }
        java.util.Set<Integer> rightIds = endpointIndex.resolve(
                entity.getRightEndpoint());
        java.util.Set<Integer> leftIds = endpointIndex.resolve(
                entity.getLeftEndpoint());
        Integer nullId = intent.getNullGeneratedRelationInstanceId();
        if (nullId != null && rightIds.contains(nullId)) {
            return SemanticJoinType.LEFT;
        }
        Integer preservedId = intent.getPreservedRelationInstanceId();
        if (nullId != null && leftIds.contains(nullId)
                && (preservedId == null || rightIds.contains(preservedId))) {
            return SemanticJoinType.RIGHT;
        }
        return null;
    }

    /** Unwrap nested parenthesis expressions iteratively; returns the inner non-paren expression. */
    private static TExpression unwrapParenExpression(TExpression e) {
        while (e != null && e.getExpressionType() == EExpressionType.parenthesis_t
                && e.getLeftOperand() != null) {
            e = e.getLeftOperand();
        }
        return e;
    }

    /**
     * True iff the comma-join {@code entity} is the boundary at which a WHERE
     * conjunct referencing {@code aliases} should be evaluated. Three
     * conditions must hold:
     *
     * <ul>
     *   <li>the conjunct references the entity's right relation (so the
     *       newly-added relation actually participates — otherwise the
     *       predicate belongs to an earlier boundary);</li>
     *   <li>it references at least one left-side relation (so it is genuinely
     *       two-sided, not a single-table filter);</li>
     *   <li>EVERY relation it references is available at this boundary — i.e.
     *       contained in the left aliases plus the right alias. This prevents
     *       a predicate that also touches a not-yet-joined relation (e.g.
     *       {@code a.x + c.z = b.y} at the {@code a×b} boundary) from being
     *       promoted too early; it is instead picked up at the later boundary
     *       where its last relation is added.</li>
     * </ul>
     */
    private static boolean conjunctLinksImplicitJoin(JoinEntity entity,
                                                     java.util.Set<String> aliases) {
        String right = entity.getRightEndpoint().getAlias();
        if (right == null || right.isEmpty()) return false;
        String rightLc = right.toLowerCase(Locale.ROOT);
        if (!aliases.contains(rightLc)) return false;
        java.util.Set<String> available = new java.util.HashSet<>();
        available.add(rightLc);
        boolean linksLeft = false;
        for (String left : endpointAliasesLowerCase(entity.getLeftEndpoint())) {
            available.add(left);
            if (!left.equals(rightLc) && aliases.contains(left)) {
                linksLeft = true;
            }
        }
        if (!linksLeft) return false;
        // All referenced relations must be available at this boundary.
        return available.containsAll(aliases);
    }

    /** Instance-identity counterpart used for validated Oracle (+) facts. */
    private static boolean conjunctInstanceIdsLinkImplicitJoin(
            JoinEndpointInstanceIndex endpointIndex, JoinEntity entity,
            java.util.Set<Integer> relationInstanceIds) {
        if (entity == null || entity.getRightEndpoint() == null
                || relationInstanceIds == null
                || relationInstanceIds.size() < 2) {
            return false;
        }
        java.util.Set<Integer> left = endpointIndex.resolve(
                entity.getLeftEndpoint());
        java.util.Set<Integer> right = endpointIndex.resolve(
                entity.getRightEndpoint());
        java.util.Set<Integer> covered = new java.util.HashSet<>(left);
        covered.addAll(right);
        return !java.util.Collections.disjoint(relationInstanceIds, left)
                && !java.util.Collections.disjoint(relationInstanceIds, right)
                && covered.containsAll(relationInstanceIds);
    }

    private static int findImplicitJoinEntity(
            List<JoinEntity> joins,
            JoinEndpointInstanceIndex endpointIndex,
            java.util.Set<Integer> relationInstanceIds) {
        for (int i = 0; i < joins.size(); i++) {
            JoinEntity entity = joins.get(i);
            if (entity.getJoinType() == SemanticJoinType.IMPLICIT_CROSS
                    && conjunctInstanceIdsLinkImplicitJoin(
                            endpointIndex, entity, relationInstanceIds)) {
                return i;
            }
        }
        return -1;
    }

    /**
     * Query-block index resolving RELATION/JOIN_RESULT endpoints to exact
     * relation instance ids. The producing-join map and endpoint results are
     * built once per promotion pass; traversal stays iterative for deep join
     * chains.
     */
    private static final class JoinEndpointInstanceIndex {
        private final java.util.Map<Integer, JoinEntity> byOrder =
                new java.util.HashMap<>();
        private final java.util.Map<JoinEndpoint, java.util.Set<Integer>> cache =
                new java.util.IdentityHashMap<>();

        private JoinEndpointInstanceIndex(List<JoinEntity> joins) {
            for (JoinEntity entity : joins) {
                byOrder.put(Integer.valueOf(entity.getOrder()), entity);
            }
        }

        private java.util.Set<Integer> resolve(JoinEndpoint endpoint) {
            if (endpoint == null) return java.util.Collections.emptySet();
            java.util.Set<Integer> cached = cache.get(endpoint);
            if (cached != null) return cached;

            java.util.Set<Integer> ids = new java.util.LinkedHashSet<>();
            java.util.Deque<JoinEndpoint> work = new java.util.ArrayDeque<>();
            work.push(endpoint);
            java.util.Set<JoinEndpoint> seen =
                    java.util.Collections.newSetFromMap(
                            new java.util.IdentityHashMap<JoinEndpoint, Boolean>());
            while (!work.isEmpty()) {
                JoinEndpoint current = work.pop();
                if (!seen.add(current)) continue;
                if (current.getKind() == JoinEndpointKind.RELATION) {
                    if (current.getInstanceId() != JoinEndpoint.NO_INSTANCE_ID) {
                        ids.add(Integer.valueOf(current.getInstanceId()));
                    }
                    continue;
                }
                if (current.getKind() == JoinEndpointKind.JOIN_RESULT) {
                    JoinEntity producer = byOrder.get(
                            Integer.valueOf(current.getProducingJoinOrder()));
                    if (producer != null) {
                        work.push(producer.getRightEndpoint());
                        work.push(producer.getLeftEndpoint());
                    }
                }
            }
            java.util.Set<Integer> result =
                    java.util.Collections.unmodifiableSet(ids);
            cache.put(endpoint, result);
            return result;
        }
    }

    /** Lower-cased relation aliases an endpoint represents (RELATION → one; JOIN_RESULT → all contributors). */
    private static java.util.List<String> endpointAliasesLowerCase(JoinEndpoint ep) {
        java.util.List<String> out = new ArrayList<>();
        if (ep == null) return out;
        if (ep.getKind() == JoinEndpointKind.RELATION) {
            if (ep.getAlias() != null && !ep.getAlias().isEmpty()) {
                out.add(ep.getAlias().toLowerCase(Locale.ROOT));
            }
        } else if (ep.getKind() == JoinEndpointKind.JOIN_RESULT) {
            for (String a : ep.getContributingAliases()) {
                if (a != null && !a.isEmpty()) {
                    out.add(a.toLowerCase(Locale.ROOT));
                }
            }
        }
        return out;
    }

    /**
     * Collect the lower-cased relation aliases a WHERE conjunct references, by
     * walking its column {@link TObjectName}s. Each column contributes exactly
     * ONE canonical alias: the resolver-bound relation alias (which matches the
     * join endpoints' {@code effectiveAliasOf}, even when the column is written
     * with the table name rather than the alias); when the column does not
     * bind, the SQL-written qualifier is the fallback. A column that neither
     * binds nor carries a qualifier (a bare unqualified name that the resolver
     * cannot place) contributes nothing — it cannot pick a side deterministically.
     *
     * <p>One canonical alias per column keeps the set comparable to the
     * endpoint alias sets, which the containment check in
     * {@link #conjunctLinksImplicitJoin} relies on. Nested subqueries are not
     * descended into.
     */
    private static java.util.Set<String> collectConjunctRelationAliases(
            TExpression conjunct, final NameBindingProvider provider) {
        final java.util.Set<String> aliases = new java.util.HashSet<>();
        conjunct.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TObjectName node) {
                if (nestedSelectDepth > 0) return;
                if (node.getDbObjectType() != EDbObjectType.column) return;
                ColumnBinding binding = provider.bindColumn(node);
                if (binding != null && binding.getRelationAlias() != null
                        && !binding.getRelationAlias().isEmpty()) {
                    aliases.add(binding.getRelationAlias().toLowerCase(Locale.ROOT));
                    return;
                }
                String qualifier = node.getTableString();
                if (qualifier != null && !qualifier.isEmpty()) {
                    aliases.add(qualifier.toLowerCase(Locale.ROOT));
                }
            }
        });
        return aliases;
    }

    // -----------------------------------------------------------------
    // Slice 129 — PIVOT sub-slice (a): source binding + consumed-refs slot.
    //
    // A PIVOT FROM source is a TTable of type pivoted_table carrying a
    // TPivotedTable: getRelations().get(0) is the underlying source relation
    // and getPivotClause() carries the aggregation function(s), the FOR /
    // pivot column(s), and the IN-list. Before slice 129 this rejected with
    // a misleading generic TABLE_BINDING_UNRESOLVED ("could not bind table
    // null(...)") because bindRelation returns null for a pivoted_table.
    //
    // Sub-slice (a) admits only the narrow base-table-source / explicit-
    // projection / no-other-clauses shape; it binds the source relation and
    // captures the consumed FOR + aggregation-arg columns into the new
    // StatementGraph.pivotColumnRefs slot. Output-column lineage and
    // SELECT * expansion are sub-slice (b); UNPIVOT is (c); subquery source,
    // chained PIVOT, extra clauses and nested PIVOT are later sub-slices and
    // reject here with structured PIVOT_* diagnostics.
    // -----------------------------------------------------------------

    /**
     * True when {@code select}'s sole FROM source is a PIVOT/UNPIVOT operator
     * with no trailing JOINs. A trailing JOIN on the pivot result
     * (e.g. {@code FROM t PIVOT(...) p JOIN x ON ...}) is out of scope for
     * slice 129 and stays on the normal path.
     */
    private static boolean isPivotSelect(TSelectSqlStatement select) {
        if (select.joins == null || select.joins.size() != 1) {
            return false;
        }
        TJoin join = select.joins.getJoin(0);
        if (join == null) {
            return false;
        }
        TJoinItemList items = join.getJoinItems();
        if (items != null && items.size() > 0) {
            return false;
        }
        TTable t = join.getTable();
        return t != null
                && t.getTableType() == gudusoft.gsqlparser.ETableSource.pivoted_table
                && t.getPivotedTable() != null;
    }

    /**
     * Slice 143 — mirror of {@link #isPivotSelect} but for the PIVOT-then-JOIN
     * shape: a single explicit JOIN ({@code joinItems} PRESENT) whose driver
     * table is a {@code pivoted_table}. Routes to a precise deferral reject
     * (reusing {@code PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED}) instead of the
     * generic {@code TABLE_BINDING_UNRESOLVED} the normal path would emit.
     */
    private static boolean isPivotWithJoinPartner(TSelectSqlStatement select) {
        if (select.joins == null || select.joins.size() != 1) {
            return false;
        }
        TJoin join = select.joins.getJoin(0);
        if (join == null) {
            return false;
        }
        TJoinItemList items = join.getJoinItems();
        if (items == null || items.size() == 0) {
            return false;
        }
        TTable t = join.getTable();
        return t != null
                && t.getTableType() == gudusoft.gsqlparser.ETableSource.pivoted_table
                && t.getPivotedTable() != null;
    }

    /**
     * Slice 144 — find a PIVOT/UNPIVOT operator that appears as a JOIN
     * PARTNER rather than the sole FROM driver. Two positions are covered:
     * <ul>
     *   <li>the right-hand side of an explicit JOIN
     *       ({@code FROM dim d JOIN sales PIVOT(...) AS p ON ...}), and</li>
     *   <li>a comma-join sibling ({@code FROM sales PIVOT(...) AS p, dim d}),
     *       which the parser represents as {@code select.joins.size() > 1}.</li>
     * </ul>
     *
     * <p>The admitted single-PIVOT shape ({@link #isPivotSelect}) and the
     * slice-143 pivot-as-driver-with-a-join shape
     * ({@link #isPivotWithJoinPartner}) are both routed earlier and never reach
     * here, so this helper only upgrades shapes that would otherwise fall to the
     * generic {@code TABLE_BINDING_UNRESOLVED}. The driver of the SOLE
     * {@code TJoin} is the slice-129/-143 driver and is skipped; for comma-join
     * siblings ({@code size > 1}) every {@code TJoin} is an independent FROM
     * item whose driver may itself be the pivot.
     *
     * @return the pivoted {@link TTable} to anchor the diagnostic on, or null.
     */
    private static TTable findPivotJoinPartner(TSelectSqlStatement select) {
        if (select.joins == null) {
            return null;
        }
        boolean singleJoin = select.joins.size() == 1;
        for (int j = 0; j < select.joins.size(); j++) {
            TJoin join = select.joins.getJoin(j);
            if (join == null) {
                continue;
            }
            if (!singleJoin && isPivotedTable(join.getTable())) {
                return join.getTable();
            }
            TJoinItemList items = join.getJoinItems();
            if (items != null) {
                for (int i = 0; i < items.size(); i++) {
                    if (items.getJoinItem(i) != null
                            && isPivotedTable(items.getJoinItem(i).getTable())) {
                        return items.getJoinItem(i).getTable();
                    }
                }
            }
        }
        return null;
    }

    /**
     * Slice 146 — the SQL keyword ("PIVOT" or "UNPIVOT") naming the row-shaping
     * operator carried by {@code pivotedTable}, used to make the JOIN-deferral
     * message name the actual operator instead of always saying "PIVOT".
     * Defaults to "PIVOT" when the clause is absent (e.g. a chained-clause-list
     * shape where {@link TPivotClause#getType()} is not reachable via
     * {@code getPivotClause()}), which is harmless for the deferral message.
     */
    private static String pivotOperatorKeyword(TTable pivotedTable) {
        if (pivotedTable != null && pivotedTable.getPivotedTable() != null) {
            TPivotedTable pivoted = pivotedTable.getPivotedTable();
            // Slice 149 — a CHAINED pivoted_table (clause list > 1) has no single
            // getPivotClause(): that accessor surfaces only ONE of the chained
            // clauses, so a MIXED chain (PIVOT(...) UNPIVOT(...)) as the JOIN
            // driver/partner would name just that one operator. Delegate to the
            // slice-148 list-walking helper so a mixed chain names the generic
            // "PIVOT / UNPIVOT" (an all-PIVOT chain still names "PIVOT", an
            // all-UNPIVOT chain still names "UNPIVOT" — byte-identical to before).
            if (pivoted.getPivotClauseList() != null
                    && pivoted.getPivotClauseList().size() > 1) {
                return chainedPivotOperatorKeyword(pivoted);
            }
            TPivotClause pc = pivoted.getPivotClause();
            if (pc != null && pc.getType() != TPivotClause.pivot) {
                return "UNPIVOT";
            }
        }
        return "PIVOT";
    }

    /**
     * Slice 148 — the SQL keyword(s) naming the operator(s) carried by a
     * CHAINED {@code pivoted_table} ({@code pivotClauseList.size() > 1}), used to
     * make the {@code PIVOT_MULTIPLE_CLAUSES_NOT_SUPPORTED} deferral message name
     * the actual operator(s) instead of always saying "PIVOT / UNPIVOT".
     * Inspects every clause's {@link TPivotClause#getType()}: all PIVOT &rarr;
     * "PIVOT"; all UNPIVOT &rarr; "UNPIVOT"; a genuine mix (or an empty/unknown
     * list) &rarr; the generic "PIVOT / UNPIVOT". Unlike
     * {@link #pivotOperatorKeyword}, this reads the whole clause LIST because the
     * single {@code getPivotClause()} accessor is null for a chained shape.
     */
    private static String chainedPivotOperatorKeyword(TPivotedTable pivoted) {
        boolean sawPivot = false;
        boolean sawUnpivot = false;
        if (pivoted != null && pivoted.getPivotClauseList() != null) {
            for (int i = 0; i < pivoted.getPivotClauseList().size(); i++) {
                TPivotClause pc = pivoted.getPivotClauseList().getElement(i);
                if (pc == null) {
                    continue;
                }
                if (pc.getType() == TPivotClause.pivot) {
                    sawPivot = true;
                } else {
                    sawUnpivot = true;
                }
            }
        }
        if (sawPivot && !sawUnpivot) {
            return "PIVOT";
        }
        if (sawUnpivot && !sawPivot) {
            return "UNPIVOT";
        }
        return "PIVOT / UNPIVOT";
    }

    /**
     * Slice 150 — true when {@code pc} is Oracle's PIVOT XML variant
     * ({@code PIVOT XML (...)}). PIVOT XML aggregates all pivoted values into a
     * SINGLE XMLType output column rather than producing one column per IN-list
     * value, so its output-column lineage differs from a regular PIVOT and
     * {@link #buildPivotSelect} defers it.
     *
     * <p>The parser exposes no XML flag on {@link TPivotClause}; the only signal
     * is the clause's start token, which is the {@code XML} keyword when the XML
     * modifier is present (it is the opening {@code (} otherwise). UNPIVOT has no
     * XML variant, so this only matches a {@code pivot}-type clause.
     */
    private static boolean isPivotXml(TPivotClause pc) {
        if (pc == null || pc.getType() != TPivotClause.pivot) {
            return false;
        }
        TSourceToken start = pc.getStartToken();
        return start != null && "XML".equalsIgnoreCase(start.astext);
    }

    /**
     * Slice 144 — true when {@code t} is a PIVOT/UNPIVOT operator
     * ({@code pivoted_table} carrying a {@code TPivotedTable}).
     */
    private static boolean isPivotedTable(TTable t) {
        return t != null
                && t.getTableType() == gudusoft.gsqlparser.ETableSource.pivoted_table
                && t.getPivotedTable() != null;
    }

    /**
     * Slice 129 — build the StatementGraph for a PIVOT-source SELECT
     * (see {@link #isPivotSelect}). Applies the admit-set rejects in a fixed
     * order, binds the underlying source relation, captures the consumed
     * FOR + aggregation-arg columns, and emits output-column NAMES with empty
     * sources (lineage deferred to a later sub-slice).
     */
    private static StatementGraph buildPivotSelect(TSelectSqlStatement select,
                                                   NameBindingProvider provider,
                                                   String name) {
        TTable pivotTable = select.joins.getJoin(0).getTable();
        TPivotedTable pivoted = pivotTable.getPivotedTable();

        // 1. single pivot clause only (chained PIVOTs deferred).
        if (pivoted.getPivotClauseList() != null
                && pivoted.getPivotClauseList().size() > 1) {
            // Slice 148 — name the ACTUAL chained operator(s) (all PIVOT,
            // all UNPIVOT, or a genuine mix), completing the message-operator
            // consistency begun on the JOIN-deferral (slice 146) and
            // extra-clause-deferral (slice 147) paths.
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_MULTIPLE_CLAUSES_NOT_SUPPORTED,
                    "chained " + chainedPivotOperatorKeyword(pivoted)
                            + " clauses are not supported yet", pivotTable));
        }
        TPivotClause pc = pivoted.getPivotClause();
        if (pc == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.TABLE_BINDING_UNRESOLVED,
                    "could not bind PIVOT source (no pivot clause)", pivotTable));
        }
        // 1b. Slice 150 — Oracle PIVOT XML is a fundamentally different shape:
        //     it produces a SINGLE XMLType output column (an XML aggregate of
        //     all pivoted values), NOT one column per IN-list value. Treating
        //     it as a regular PIVOT (the only path below) would emit incorrect
        //     output-column lineage, so defer it with the generic
        //     PIVOT/UNPIVOT-unsupported code. Checked here — before the
        //     UNPIVOT-shape, extra-clause, and bare-* handling — so the XML
        //     limitation is the reason reported regardless of the other clauses.
        if (isPivotXml(pc)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_UNPIVOT_NOT_SUPPORTED,
                    "PIVOT XML is not supported yet (the single XMLType output "
                            + "column has different lineage than a regular PIVOT)",
                    pivotTable));
        }
        // 2. UNPIVOT sub-slice (c): the deterministic single-value-column /
        //    simple-IN-list shape is now supported (see buildUnpivotOutputColumns).
        //    A multi-value-column or column-group ((a,b) ...) UNPIVOT stays
        //    deferred — checked here so PIVOT_UNPIVOT_NOT_SUPPORTED stays reached
        //    and the harder positional mapping is not mis-attributed.
        boolean isUnpivot = pc.getType() != TPivotClause.pivot;
        if (isUnpivot) {
            rejectUnsupportedUnpivotShape(pc, pivotTable);
        }
        // 3. extra query clauses deferred (WHERE / GROUP BY / HAVING /
        //    ORDER BY / QUALIFY / DISTINCT / row-limit / set-op). Processing
        //    them would hit the same resolver NOT_FOUND quirk that forces the
        //    direct consumed-ref construction below.
        rejectPivotExtraClauses(select, pivotTable);
        // 4. source must be a base table (subquery source deferred).
        if (pivoted.getRelations().isEmpty() || pivoted.getRelations().get(0) == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.TABLE_BINDING_UNRESOLVED,
                    "could not bind PIVOT source (no source relation)", pivotTable));
        }
        TTable sourceTable = pivoted.getRelations().get(0);
        // Slice 136: a FROM-subquery source is admitted for EXPLICIT projections.
        // The inner SELECT was already extracted as its own statement by the
        // processDirectSubqueryTable pre-pass (which unwraps the pivoted_table);
        // binding here with allowFromSubqueries=true yields a SUBQUERY-kind
        // relation whose alias matches the registered subquery-statement alias, so
        // emitLineageForStatement wires the pivot output → subquery output edges.
        // Slice 137: a bare SELECT * over a subquery source is now ALSO admitted —
        // the slice-137 addRelationToInScopeMap unwrap registers the subquery's
        // published columns under the source alias, so expandPivot/UnpivotBareStar
        // can synthesise the passthrough schema without an external catalog.
        RelationSource sourceRel = buildRelation(sourceTable, provider, /*allowFromSubqueries=*/ true);

        // 4b. Slice 156 (PIVOT) / slice 157 (UNPIVOT) — a WHERE clause over a
        //     PIVOT or UNPIVOT is now admitted when every ref is a PROVABLE
        //     passthrough source column (resolved directly to the underlying
        //     source column); anything else (a pivot-output / UNPIVOT value or
        //     FOR-name / consumed / non-provable ref, or a subquery predicate)
        //     keeps the slice-129 deferral. Resolved BEFORE output building so the
        //     WHERE deferral wins over a (deferred) output shape, mirroring the
        //     previous rejectPivotExtraClauses precedence.
        List<ColumnRef> filterRefs = buildPivotWhereColumnRefs(select, pc, isUnpivot,
                sourceRel.getAlias(), sourceTable, provider, pivotTable);

        // 4c. Slice 158 — a GROUP BY clause over a PIVOT or UNPIVOT is now
        //     admitted (into groupByColumnRefs) when every grouped column is a
        //     PROVABLE passthrough source column, the sibling of the slice-156/157
        //     WHERE admission. Resolved AFTER the WHERE so a WHERE deferral wins
        //     over a GROUP BY deferral (preserving the previous
        //     rejectPivotExtraClauses precedence, which checked WHERE before
        //     GROUP BY). A GROUP BY paired with a HAVING already deferred earlier
        //     in rejectPivotExtraClauses (HAVING branch), so it never reaches here.
        List<ColumnRef> groupByRefs = buildPivotGroupByColumnRefs(select, pc, isUnpivot,
                sourceRel.getAlias(), sourceTable, provider, pivotTable);

        // 4d. Slice 160 — a HAVING clause over a PIVOT or UNPIVOT is now admitted
        //     (into havingColumnRefs) when every column the HAVING touches is a
        //     PROVABLE passthrough source column, the sibling of the slice-156/157
        //     WHERE, slice-158 GROUP BY, and slice-159 QUALIFY admissions. Resolved
        //     AFTER the WHERE and GROUP BY and BEFORE the QUALIFY — the natural SQL
        //     clause order (WHERE, GROUP BY, HAVING, QUALIFY) — so a deferred WHERE
        //     / GROUP BY wins over a deferred HAVING, and a deferred HAVING wins
        //     over a deferred QUALIFY.
        List<ColumnRef> havingRefs = buildPivotHavingColumnRefs(select, pc, isUnpivot,
                sourceRel.getAlias(), sourceTable, provider, pivotTable);

        // 4e. Slice 159 — a QUALIFY clause over a PIVOT or UNPIVOT is now admitted
        //     (into qualifyColumnRefs) when every column the QUALIFY touches is a
        //     PROVABLE passthrough source column, the sibling of the slice-156/157
        //     WHERE, slice-158 GROUP BY, and slice-160 HAVING admissions. Resolved
        //     AFTER the WHERE, GROUP BY, and HAVING so any earlier-clause deferral
        //     wins — the natural SQL clause order (WHERE, GROUP BY, HAVING,
        //     QUALIFY).
        List<ColumnRef> qualifyRefs = buildPivotQualifyColumnRefs(select, pc, isUnpivot,
                sourceRel.getAlias(), sourceTable, provider, pivotTable);

        // 4f. Slice 161 - an ORDER BY clause over a PIVOT or UNPIVOT is already
        //     admitted (slice 142, lineage-neutral); this records its
        //     orderByColumnRefs when every sort-key column is a PROVABLE passthrough
        //     source column, the sibling of the slice-156/157 WHERE, slice-158 GROUP
        //     BY, slice-159 QUALIFY, and slice-160 HAVING admissions. UNLIKE those,
        //     it NEVER defers: a non-passthrough / unprovable / subquery sort key
        //     simply leaves the slot empty (the lineage-neutral slice-142 behaviour).
        List<ColumnRef> orderByRefs = buildPivotOrderByColumnRefs(select, pc, isUnpivot,
                sourceRel.getAlias(), sourceTable, provider);

        // 5. + 6. consumed refs and output-column lineage, branched on PIVOT
        //    vs UNPIVOT. PIVOT consumes the FOR + aggregation-arg columns and
        //    its outputs are the passthrough + pivot-output columns; UNPIVOT
        //    consumes the IN-list source columns and its outputs are the
        //    passthrough + value + FOR columns (slice 131 sub-slice (c)).
        List<ColumnRef> consumedRefs;
        List<OutputColumn> outputs;
        if (isUnpivot) {
            consumedRefs = collectUnpivotInListRefs(pc, sourceRel.getAlias());
            outputs = buildUnpivotOutputColumns(select, pivotTable, pc,
                    sourceRel.getAlias(), sourceTable, provider);
        } else {
            consumedRefs = collectPivotConsumedRefs(pc, sourceRel.getAlias());
            outputs = buildPivotOutputColumns(select, pivotTable, pc,
                    sourceRel.getAlias(), sourceTable, provider);
        }

        // Slice 180 (R5): PIVOT/UNPIVOT SELECT blocks are built here, not at
        // the main SELECT site, so set their block span too.
        return new StatementGraph(name, "SELECT",
                Collections.singletonList(sourceRel), outputs, filterRefs, groupByRefs,
                havingRefs, qualifyRefs, orderByRefs, consumedRefs)
                .withSourceSpan(SourceSpan.of(select));
    }

    /**
     * Slice 129 — reject a PIVOT SELECT that carries a COLUMN-TOUCHING query
     * clause beyond the projection and the FROM-PIVOT source. One
     * {@code DiagnosticCode} with clause-discriminated message text (the
     * deferral is the same semantic boundary: "PIVOT combined with an
     * additional query clause is not supported yet"). Deferred because
     * resolving a {@code WHERE} / {@code GROUP BY} / {@code HAVING} /
     * {@code QUALIFY} column reference needs to disambiguate a passthrough
     * SOURCE column from a PIVOT-OUTPUT column.
     *
     * <p>Slice 142 — the ROW-SHAPING clauses ({@code ORDER BY}, {@code DISTINCT},
     * and the row-limit clauses {@code TOP} / {@code LIMIT} / {@code OFFSET} /
     * {@code FETCH FIRST}) are NO LONGER rejected: they only re-shape the row
     * SET (order / dedup / truncate) and do not change the output COLUMN set or
     * the column lineage, which {@link #buildPivotSelect} reads only from the
     * pivot clause, the projection, and the source. Admitting them is therefore
     * lineage-neutral — the resulting {@code StatementGraph} is byte-identical
     * to the same query without the clause. The (defensive) set-operator branch
     * stays: a pivot SELECT node never carries a set operator in practice
     * ({@link #isPivotSelect} requires a FROM-PIVOT, which a union node has not),
     * but the guard is kept for robustness.
     */
    private static void rejectPivotExtraClauses(TSelectSqlStatement select, TTable pivotTable) {
        String clause = null;
        // Slice 156 — the WHERE clause is no longer rejected here; it is handled
        // by buildPivotWhereColumnRefs (called after the source is bound), which
        // ADMITS a WHERE whose every ref is a provable passthrough source column
        // and otherwise throws the same PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED
        // deferral. Slice 158 — likewise the GROUP BY clause is now handled by
        // buildPivotGroupByColumnRefs (passthrough-only admission). Slice 159 —
        // likewise the QUALIFY clause is now handled by buildPivotQualifyColumnRefs
        // (passthrough-only admission). Slice 160 — likewise the HAVING clause is
        // now handled by buildPivotHavingColumnRefs (passthrough-only admission).
        // The only remaining column-touching clause that still defers
        // unconditionally here is a set operator (a pivot SELECT node never carries
        // one in practice, but the guard is kept defensively). The WHERE / GROUP BY
        // / HAVING / QUALIFY admission helpers run after this guard, in natural SQL
        // clause order, so a deferred earlier clause wins over a deferred later one.
        if (select.getSetOperatorType() != ESetOperatorType.none) {
            clause = "a set operator";
        }
        if (clause != null) {
            // Slice 147 — name the ACTUAL operator (PIVOT vs UNPIVOT) via the
            // shared slice-146 helper, completing the message-operator
            // consistency begun on the JOIN-deferral path.
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                    pivotOperatorKeyword(pivotTable) + " combined with " + clause
                            + " is not supported yet", pivotTable));
        }
    }

    /**
     * Slice 156 (PIVOT) / slice 157 (UNPIVOT) — resolve the column refs of a
     * {@code WHERE} clause over a PIVOT or UNPIVOT, admitting the clause only when
     * EVERY referenced column is a PROVABLE passthrough source column. Returns the
     * resolved refs (document order, deduped) for the {@code StatementGraph}
     * filterColumnRefs slot, or an empty list when there is no WHERE.
     *
     * <p>Throws {@link DiagnosticCode#PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED} (the
     * slice-129 deferral, code kept reached) when the WHERE cannot be admitted:
     * the WHERE contains a subquery predicate; or any ref is NOT a provable
     * passthrough column. For a PIVOT, a non-passthrough ref is a pivot-output
     * column, a consumed FOR / aggregation-arg column, or a column whose source
     * membership cannot be proven without a catalog. For an UNPIVOT (slice 157),
     * it is the synthesised VALUE or FOR/name output column, a consumed IN-list
     * source column (narrowed into rows), or — again — a column with no provable
     * source membership. A passthrough column passes through the operator
     * unchanged, so its WHERE ref resolves directly to the underlying source
     * column ({@code sourceAlias.col}) regardless of the aggregation count or
     * IN-list shape — the same provable-membership doctrine as slice 153's
     * passthrough output columns. The {@code dbObjectType == column} filter
     * excludes function names and other non-column tokens.
     */
    private static List<ColumnRef> buildPivotWhereColumnRefs(TSelectSqlStatement select,
                                                             TPivotClause pc,
                                                             boolean isUnpivot,
                                                             String sourceAlias,
                                                             TTable sourceTable,
                                                             NameBindingProvider provider,
                                                             TTable pivotTable) {
        TWhereClause where = select.getWhereClause();
        if (where == null || where.getCondition() == null) {
            return Collections.emptyList();
        }
        // Slice 156 (PIVOT) / slice 157 (UNPIVOT) — the PROVABLE passthrough source
        // columns of the operator. A passthrough column survives the PIVOT/UNPIVOT
        // unchanged, so a WHERE touching ONLY those columns resolves directly to
        // the underlying source column. The set is empty when membership cannot be
        // proven (a base table with no catalog) — keeping the WHERE deferred.
        Set<String> passthroughLC = isUnpivot
                ? provableUnpivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider)
                : provablePivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider);
        if (!passthroughLC.isEmpty()) {
            final List<TObjectName> whereCols = new ArrayList<>();
            final boolean[] hasSubquery = {false};
            TParseTreeVisitor v = new TParseTreeVisitor() {
                @Override
                public void preVisit(TObjectName n) {
                    whereCols.add(n);
                }

                @Override
                public void preVisit(TSelectSqlStatement s) {
                    hasSubquery[0] = true;
                }
            };
            where.getCondition().acceptChildren(v);
            if (!hasSubquery[0]) {
                LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
                boolean allPassthrough = true;
                for (TObjectName n : whereCols) {
                    if (n == null || n.getDbObjectType() != EDbObjectType.column) {
                        continue;
                    }
                    String col = n.getColumnNameOnly();
                    if (col == null || col.isEmpty() || "*".equals(col)) {
                        continue;
                    }
                    if (!passthroughLC.contains(col.toLowerCase(Locale.ROOT))) {
                        allPassthrough = false;
                        break;
                    }
                    refs.add(new ColumnRef(sourceAlias, col));
                }
                if (allPassthrough) {
                    return new ArrayList<>(refs);
                }
            }
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                pivotOperatorKeyword(pivotTable) + " combined with a WHERE clause "
                        + "is not supported yet", pivotTable));
    }

    /**
     * Slice 158 — resolve the column refs of a {@code GROUP BY} clause over a
     * PIVOT or UNPIVOT, admitting the clause only when EVERY grouped column is a
     * PROVABLE passthrough source column. Returns the resolved refs (document
     * order, deduped) for the {@code StatementGraph} groupByColumnRefs slot, or an
     * empty list when there is no GROUP BY. This is the GROUP BY sibling of the
     * slice-156/157 WHERE admission ({@link #buildPivotWhereColumnRefs}) and uses
     * the same provable-passthrough doctrine: a passthrough column survives the
     * PIVOT/UNPIVOT unchanged, so grouping on it resolves directly to the
     * underlying source column ({@code sourceAlias.col}).
     *
     * <p>Throws {@link DiagnosticCode#PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED} (the
     * slice-129 deferral, code kept reached) when the GROUP BY cannot be admitted:
     * it contains a subquery; or any grouped ref is NOT a provable passthrough
     * column (a pivot-output column, a consumed FOR / aggregation-arg or IN-list
     * column, or a column whose source membership cannot be proven without a
     * catalog). A GROUP BY paired with a HAVING already deferred earlier in
     * {@link #rejectPivotExtraClauses}, so it never reaches here. The
     * {@code dbObjectType == column} filter excludes function names and other
     * non-column tokens.
     */
    private static List<ColumnRef> buildPivotGroupByColumnRefs(TSelectSqlStatement select,
                                                               TPivotClause pc,
                                                               boolean isUnpivot,
                                                               String sourceAlias,
                                                               TTable sourceTable,
                                                               NameBindingProvider provider,
                                                               TTable pivotTable) {
        TGroupBy groupBy = select.getGroupByClause();
        if (groupBy == null || groupBy.getItems() == null
                || groupBy.getItems().size() == 0) {
            return Collections.emptyList();
        }
        // The PROVABLE passthrough source columns of the operator — the same set
        // the WHERE admission uses. Empty when membership cannot be proven (a base
        // table with no catalog), keeping the GROUP BY deferred.
        Set<String> passthroughLC = isUnpivot
                ? provableUnpivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider)
                : provablePivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider);
        if (!passthroughLC.isEmpty()) {
            final List<TObjectName> groupCols = new ArrayList<>();
            final boolean[] hasSubquery = {false};
            TParseTreeVisitor v = new TParseTreeVisitor() {
                @Override
                public void preVisit(TObjectName n) {
                    groupCols.add(n);
                }

                @Override
                public void preVisit(TSelectSqlStatement s) {
                    hasSubquery[0] = true;
                }
            };
            TGroupByItemList items = groupBy.getItems();
            for (int i = 0; i < items.size(); i++) {
                TGroupByItem item = items.getGroupByItem(i);
                if (item != null && item.getExpr() != null) {
                    item.getExpr().acceptChildren(v);
                }
            }
            if (!hasSubquery[0]) {
                LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
                boolean allPassthrough = true;
                for (TObjectName n : groupCols) {
                    if (n == null || n.getDbObjectType() != EDbObjectType.column) {
                        continue;
                    }
                    String col = n.getColumnNameOnly();
                    if (col == null || col.isEmpty() || "*".equals(col)) {
                        continue;
                    }
                    if (!passthroughLC.contains(col.toLowerCase(Locale.ROOT))) {
                        allPassthrough = false;
                        break;
                    }
                    refs.add(new ColumnRef(sourceAlias, col));
                }
                if (allPassthrough) {
                    return new ArrayList<>(refs);
                }
            }
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                pivotOperatorKeyword(pivotTable) + " combined with a GROUP BY clause "
                        + "is not supported yet", pivotTable));
    }

    /**
     * Slice 159 — resolve the column refs of a {@code QUALIFY} clause over a PIVOT
     * or UNPIVOT, admitting the clause only when EVERY column the QUALIFY touches
     * (its window-function partition / order columns and any other column refs) is
     * a PROVABLE passthrough source column. Returns the resolved refs (document
     * order, deduped) for the {@code StatementGraph} qualifyColumnRefs slot, or an
     * empty list when there is no QUALIFY. This is the QUALIFY sibling of the
     * slice-156/157 WHERE admission ({@link #buildPivotWhereColumnRefs}) and the
     * slice-158 GROUP BY admission ({@link #buildPivotGroupByColumnRefs}), using
     * the same provable-passthrough doctrine: a passthrough column survives the
     * PIVOT/UNPIVOT unchanged, so a QUALIFY touching only those columns resolves
     * directly to the underlying source column ({@code sourceAlias.col}).
     *
     * <p>Throws {@link DiagnosticCode#PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED} (the
     * slice-129 deferral, code kept reached) when the QUALIFY cannot be admitted:
     * it contains a subquery; or any ref is NOT a provable passthrough column (a
     * pivot-output column, an UNPIVOT VALUE / FOR column, a consumed FOR / agg-arg
     * or IN-list column, or a column whose source membership cannot be proven
     * without a catalog). A QUALIFY paired with a HAVING already deferred earlier
     * in {@link #rejectPivotExtraClauses}, so it never reaches here. The
     * {@code dbObjectType == column} filter excludes the window-function name and
     * other non-column tokens.
     */
    private static List<ColumnRef> buildPivotQualifyColumnRefs(TSelectSqlStatement select,
                                                               TPivotClause pc,
                                                               boolean isUnpivot,
                                                               String sourceAlias,
                                                               TTable sourceTable,
                                                               NameBindingProvider provider,
                                                               TTable pivotTable) {
        if (select.getQualifyClause() == null
                || select.getQualifyClause().getSearchConditoin() == null) {
            return Collections.emptyList();
        }
        TExpression qualify = select.getQualifyClause().getSearchConditoin();
        // The PROVABLE passthrough source columns of the operator — the same set
        // the WHERE and GROUP BY admissions use. Empty when membership cannot be
        // proven (a base table with no catalog), keeping the QUALIFY deferred.
        Set<String> passthroughLC = isUnpivot
                ? provableUnpivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider)
                : provablePivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider);
        if (!passthroughLC.isEmpty()) {
            final List<TObjectName> qualifyCols = new ArrayList<>();
            final boolean[] hasSubquery = {false};
            TParseTreeVisitor v = new TParseTreeVisitor() {
                @Override
                public void preVisit(TObjectName n) {
                    qualifyCols.add(n);
                }

                @Override
                public void preVisit(TSelectSqlStatement s) {
                    hasSubquery[0] = true;
                }
            };
            qualify.acceptChildren(v);
            if (!hasSubquery[0]) {
                LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
                boolean allPassthrough = true;
                for (TObjectName n : qualifyCols) {
                    if (n == null || n.getDbObjectType() != EDbObjectType.column) {
                        continue;
                    }
                    String col = n.getColumnNameOnly();
                    if (col == null || col.isEmpty() || "*".equals(col)) {
                        continue;
                    }
                    if (!passthroughLC.contains(col.toLowerCase(Locale.ROOT))) {
                        allPassthrough = false;
                        break;
                    }
                    refs.add(new ColumnRef(sourceAlias, col));
                }
                if (allPassthrough) {
                    return new ArrayList<>(refs);
                }
            }
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                pivotOperatorKeyword(pivotTable) + " combined with a QUALIFY clause "
                        + "is not supported yet", pivotTable));
    }

    /**
     * Slice 161 — resolve the column refs of an {@code ORDER BY} clause over a
     * PIVOT or UNPIVOT, recording them in the {@code orderByColumnRefs} slot only
     * when EVERY sort-key column is a PROVABLE passthrough source column. Returns
     * the resolved refs (document order, deduped) or an empty list.
     *
     * <p>UNLIKE the slice-156/157 WHERE, slice-158 GROUP BY, slice-159 QUALIFY, and
     * slice-160 HAVING admissions (which THROW
     * {@link DiagnosticCode#PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED} when the clause
     * cannot be admitted), an ORDER BY over a pivot is ALREADY admitted (slice 142,
     * lineage-neutral — it only re-shapes the row order, not the output column set).
     * This helper therefore NEVER throws: it merely refines the lineage by recording
     * the passthrough refs when they can be proven, and otherwise returns an empty
     * list — exactly the lineage-neutral slice-142 behaviour. The slot stays empty
     * when: there is no ORDER BY; the source has no provable schema (a base table
     * with no catalog); any sort key contains a subquery; or any sort-key column is
     * NOT a provable passthrough column (a pivot-output / UNPIVOT-value / FOR /
     * consumed column, an ordinal, or a projection-alias reference). The
     * all-or-nothing gate mirrors the WHERE doctrine: a mixed ORDER BY (one
     * passthrough + one non-passthrough key) records nothing rather than partial
     * lineage. The {@code dbObjectType == column} filter excludes function names and
     * other non-column tokens; ordinals/aliases that are not source columns fail the
     * passthrough membership test and keep the slot empty.
     */
    private static List<ColumnRef> buildPivotOrderByColumnRefs(TSelectSqlStatement select,
                                                               TPivotClause pc,
                                                               boolean isUnpivot,
                                                               String sourceAlias,
                                                               TTable sourceTable,
                                                               NameBindingProvider provider) {
        TOrderBy orderBy = select.getOrderbyClause();
        if (orderBy == null || orderBy.getItems() == null) {
            return Collections.emptyList();
        }
        // The PROVABLE passthrough source columns of the operator — the same set the
        // WHERE, GROUP BY, HAVING, and QUALIFY admissions use. Empty when membership
        // cannot be proven (a base table with no catalog), keeping ORDER BY
        // lineage-neutral.
        Set<String> passthroughLC = isUnpivot
                ? provableUnpivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider)
                : provablePivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider);
        if (passthroughLC.isEmpty()) {
            return Collections.emptyList();
        }
        final List<TObjectName> orderByCols = new ArrayList<>();
        final boolean[] hasSubquery = {false};
        TParseTreeVisitor v = new TParseTreeVisitor() {
            @Override
            public void preVisit(TObjectName n) {
                orderByCols.add(n);
            }

            @Override
            public void preVisit(TSelectSqlStatement s) {
                hasSubquery[0] = true;
            }
        };
        TOrderByItemList items = orderBy.getItems();
        for (int i = 0; i < items.size(); i++) {
            TOrderByItem item = items.getOrderByItem(i);
            if (item == null || item.getSortKey() == null) {
                continue;
            }
            item.getSortKey().acceptChildren(v);
        }
        if (hasSubquery[0]) {
            return Collections.emptyList();
        }
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        for (TObjectName n : orderByCols) {
            if (n == null || n.getDbObjectType() != EDbObjectType.column) {
                continue;
            }
            String col = n.getColumnNameOnly();
            if (col == null || col.isEmpty() || "*".equals(col)) {
                continue;
            }
            if (!passthroughLC.contains(col.toLowerCase(Locale.ROOT))) {
                // Not all passthrough (a pivot-output / consumed column, or an
                // alias) — stay lineage-neutral (slice 142), do NOT defer.
                return Collections.emptyList();
            }
            refs.add(new ColumnRef(sourceAlias, col));
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 160 — resolve the column refs of a {@code HAVING} clause over a PIVOT
     * or UNPIVOT, admitting the clause only when EVERY column the HAVING touches
     * (its aggregate-function arguments and any other column refs) is a PROVABLE
     * passthrough source column. Returns the resolved refs (document order,
     * deduped) for the {@code StatementGraph} havingColumnRefs slot, or an empty
     * list when there is no HAVING. This is the HAVING sibling of the slice-156/157
     * WHERE admission ({@link #buildPivotWhereColumnRefs}), the slice-158 GROUP BY
     * admission ({@link #buildPivotGroupByColumnRefs}), and the slice-159 QUALIFY
     * admission ({@link #buildPivotQualifyColumnRefs}), using the same
     * provable-passthrough doctrine: a passthrough column survives the
     * PIVOT/UNPIVOT unchanged, so a HAVING touching only those columns resolves
     * directly to the underlying source column ({@code sourceAlias.col}). A
     * {@code HAVING COUNT(*)} touches no column at all, so it admits over a provable
     * source (empty refs) but still defers over a base table with no catalog (the
     * provable-passthrough set is empty, so membership cannot be proven).
     *
     * <p>Throws {@link DiagnosticCode#PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED} (the
     * slice-129 deferral, code kept reached) when the HAVING cannot be admitted: it
     * contains a subquery; or any ref is NOT a provable passthrough column (a
     * pivot-output column, an UNPIVOT VALUE / FOR column, a consumed FOR / agg-arg
     * or IN-list column, or a column whose source membership cannot be proven
     * without a catalog). The {@code dbObjectType == column} filter excludes the
     * aggregate-function names and other non-column tokens.
     */
    private static List<ColumnRef> buildPivotHavingColumnRefs(TSelectSqlStatement select,
                                                              TPivotClause pc,
                                                              boolean isUnpivot,
                                                              String sourceAlias,
                                                              TTable sourceTable,
                                                              NameBindingProvider provider,
                                                              TTable pivotTable) {
        TGroupBy groupBy = select.getGroupByClause();
        TExpression having = (groupBy == null) ? null : groupBy.getHavingClause();
        if (having == null) {
            return Collections.emptyList();
        }
        // The PROVABLE passthrough source columns of the operator — the same set
        // the WHERE, GROUP BY, and QUALIFY admissions use. Empty when membership
        // cannot be proven (a base table with no catalog), keeping the HAVING
        // deferred.
        Set<String> passthroughLC = isUnpivot
                ? provableUnpivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider)
                : provablePivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider);
        if (!passthroughLC.isEmpty()) {
            final List<TObjectName> havingCols = new ArrayList<>();
            final boolean[] hasSubquery = {false};
            TParseTreeVisitor v = new TParseTreeVisitor() {
                @Override
                public void preVisit(TObjectName n) {
                    havingCols.add(n);
                }

                @Override
                public void preVisit(TSelectSqlStatement s) {
                    hasSubquery[0] = true;
                }
            };
            having.acceptChildren(v);
            if (!hasSubquery[0]) {
                LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
                boolean allPassthrough = true;
                for (TObjectName n : havingCols) {
                    if (n == null || n.getDbObjectType() != EDbObjectType.column) {
                        continue;
                    }
                    String col = n.getColumnNameOnly();
                    if (col == null || col.isEmpty() || "*".equals(col)) {
                        continue;
                    }
                    if (!passthroughLC.contains(col.toLowerCase(Locale.ROOT))) {
                        allPassthrough = false;
                        break;
                    }
                    refs.add(new ColumnRef(sourceAlias, col));
                }
                if (allPassthrough) {
                    return new ArrayList<>(refs);
                }
            }
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.PIVOT_WITH_QUERY_CLAUSE_NOT_SUPPORTED,
                pivotOperatorKeyword(pivotTable) + " combined with a HAVING clause "
                        + "is not supported yet", pivotTable));
    }

    /**
     * Slice 156 — the lower-cased PROVABLE passthrough (group) source column
     * names of a PIVOT: the source's published columns (the catalog or a
     * FROM-subquery's published schema) MINUS the columns consumed by the PIVOT
     * (the FOR / pivot column(s) and the aggregation argument(s)). Empty when the
     * source has no provable schema (a base table with no catalog). This is the
     * slice-153 passthrough rule, factored out so the WHERE-clause admission
     * (slice 156) and {@link #buildPivotOutputColumns}' passthrough column
     * resolution share one source of truth.
     */
    private static Set<String> provablePivotPassthroughColsLC(TPivotClause pc,
                                                              String sourceAlias,
                                                              TTable sourceTable,
                                                              NameBindingProvider provider) {
        List<String> srcCols = lookupRelationColumnNames(sourceTable, provider);
        if (srcCols == null || srcCols.isEmpty()) {
            return Collections.emptySet();
        }
        Set<String> consumedLC = new HashSet<>();
        List<ColumnRef> consumed = new ArrayList<>(collectPivotForRefs(pc, sourceAlias));
        consumed.addAll(collectPivotAggArgRefs(pc, sourceAlias));
        for (ColumnRef r : consumed) {
            String cn = (r == null) ? null : r.getColumnName();
            if (cn != null && !cn.isEmpty()) {
                consumedLC.add(cn.toLowerCase(Locale.ROOT));
            }
        }
        Set<String> passthrough = new HashSet<>();
        for (String c : srcCols) {
            if (c == null || c.isEmpty()) {
                continue;
            }
            String lc = c.toLowerCase(Locale.ROOT);
            if (!consumedLC.contains(lc)) {
                passthrough.add(lc);
            }
        }
        return passthrough;
    }

    /**
     * Slice 157 — the lower-cased PROVABLE passthrough source column names of an
     * UNPIVOT: the source's published columns (the catalog or a FROM-subquery's
     * published schema) MINUS the IN-list SOURCE columns the UNPIVOT narrows into
     * rows ({@link #collectUnpivotInListRefs}). Empty when the source has no
     * provable schema (a base table with no catalog). These are exactly the
     * passthrough OUTPUT columns {@link #expandUnpivotBareStar} keeps unchanged;
     * the synthesised VALUE / FOR-name output columns are NOT source columns (by
     * UNPIVOT semantics they cannot name an existing input column), so they are
     * absent from the published set and a WHERE touching them stays deferred. This
     * is the UNPIVOT mirror of {@link #provablePivotPassthroughColsLC}, shared by
     * the WHERE-clause admission ({@link #buildPivotWhereColumnRefs}).
     */
    private static Set<String> provableUnpivotPassthroughColsLC(TPivotClause pc,
                                                                String sourceAlias,
                                                                TTable sourceTable,
                                                                NameBindingProvider provider) {
        List<String> srcCols = lookupRelationColumnNames(sourceTable, provider);
        if (srcCols == null || srcCols.isEmpty()) {
            return Collections.emptySet();
        }
        Set<String> consumedLC = new HashSet<>();
        for (ColumnRef r : collectUnpivotInListRefs(pc, sourceAlias)) {
            String cn = (r == null) ? null : r.getColumnName();
            if (cn != null && !cn.isEmpty()) {
                consumedLC.add(cn.toLowerCase(Locale.ROOT));
            }
        }
        Set<String> passthrough = new HashSet<>();
        for (String c : srcCols) {
            if (c == null || c.isEmpty()) {
                continue;
            }
            String lc = c.toLowerCase(Locale.ROOT);
            if (!consumedLC.contains(lc)) {
                passthrough.add(lc);
            }
        }
        return passthrough;
    }

    /**
     * Slice 129 — capture the columns CONSUMED by a PIVOT: the FOR / pivot
     * column(s) first, then the aggregation-function argument column(s), in
     * document order, deduplicated by (alias, columnName). Each is built
     * DIRECTLY as a {@link ColumnRef} against the bound source relation —
     * resolver2 marks these refs NOT_FOUND in PIVOT context even though
     * Phase-1 {@code linkColumnToTable} sets their {@code sourceTable}, so the
     * strict {@code collectColumnRefs} path would reject them.
     */
    private static List<ColumnRef> collectPivotConsumedRefs(TPivotClause pc,
                                                            String sourceAlias) {
        // Consumed = FOR / pivot column(s) FIRST, then aggregation-arg
        // column(s), document order, deduped (LinkedHashSet). Slice 130 split
        // the two halves into reusable helpers: the agg-arg refs are also the
        // sources of a pivot-output column (see buildPivotOutputColumns).
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        refs.addAll(collectPivotForRefs(pc, sourceAlias));
        refs.addAll(collectPivotAggArgRefs(pc, sourceAlias));
        return new ArrayList<>(refs);
    }

    /**
     * Slice 130 — the FOR / pivot column ref(s) consumed by a PIVOT, built
     * directly against {@code sourceAlias} (deduped, document order). Split out
     * of {@link #collectPivotConsumedRefs} so the consumed-refs slot and the
     * output-column lineage share one source of truth.
     */
    private static List<ColumnRef> collectPivotForRefs(TPivotClause pc, String sourceAlias) {
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        TObjectNameList forCols = pc.getPivotColumnList();
        if (forCols != null) {
            for (int i = 0; i < forCols.size(); i++) {
                addPivotConsumedRef(refs, forCols.getObjectName(i), sourceAlias);
            }
        } else if (pc.getPivotColumn() != null) {
            addPivotConsumedRef(refs, pc.getPivotColumn(), sourceAlias);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 130 — the aggregation-function argument column ref(s) (the value
     * being aggregated), built directly against {@code sourceAlias} (deduped,
     * document order). SQL Server / Snowflake carry a single
     * {@code TFunctionCall}; Oracle a {@code TResultColumnList}. These are the
     * sources of a pivot-output column. Function names and column-alias nodes
     * are skipped by the {@code dbObjectType} filter in addPivotConsumedRef.
     */
    private static List<ColumnRef> collectPivotAggArgRefs(TPivotClause pc, String sourceAlias) {
        final List<TObjectName> argCols = new ArrayList<>();
        TParseTreeVisitor argVisitor = new TParseTreeVisitor() {
            @Override
            public void preVisit(TObjectName n) {
                argCols.add(n);
            }
        };
        if (pc.getAggregation_function() != null
                && pc.getAggregation_function().getArgs() != null) {
            pc.getAggregation_function().getArgs().acceptChildren(argVisitor);
        }
        if (pc.getAggregation_function_list() != null) {
            pc.getAggregation_function_list().acceptChildren(argVisitor);
        }
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        for (TObjectName n : argCols) {
            addPivotConsumedRef(refs, n, sourceAlias);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 154 — the aggregation-argument column ref(s) for a SINGLE aggregation
     * in a multi-aggregation PIVOT's {@code aggregation_function_list} (the value
     * being aggregated by THIS one function), built directly against
     * {@code sourceAlias} (deduped, document order). This is the per-aggregation
     * counterpart of {@link #collectPivotAggArgRefs} (which unions ALL
     * aggregations' args): a multi-agg cross-product output column
     * {@code <in_value>_<agg_alias>} draws from ONLY the named aggregation's
     * argument, not every aggregation's. Function names / alias nodes are excluded
     * by the {@code dbObjectType == column} filter in {@link #addPivotConsumedRef}.
     */
    private static List<ColumnRef> collectSingleAggArgRefs(TResultColumn aggRc,
                                                           String sourceAlias) {
        final List<TObjectName> argCols = new ArrayList<>();
        TParseTreeVisitor argVisitor = new TParseTreeVisitor() {
            @Override
            public void preVisit(TObjectName n) {
                argCols.add(n);
            }
        };
        if (aggRc != null && aggRc.getExpr() != null
                && aggRc.getExpr().getFunctionCall() != null
                && aggRc.getExpr().getFunctionCall().getArgs() != null) {
            aggRc.getExpr().getFunctionCall().getArgs().acceptChildren(argVisitor);
        }
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        for (TObjectName n : argCols) {
            addPivotConsumedRef(refs, n, sourceAlias);
        }
        return new ArrayList<>(refs);
    }

    /** Slice 130 — number of aggregation functions in the PIVOT clause. */
    private static int pivotAggregationCount(TPivotClause pc) {
        if (pc.getAggregation_function() != null) {
            return 1;
        }
        if (pc.getAggregation_function_list() != null) {
            return pc.getAggregation_function_list().size();
        }
        return 0;
    }

    /**
     * Slice 130 — true when the PIVOT IN-list is a STATIC value list, so the
     * pivot-output column names are known at build time. False for a subquery
     * or {@code ANY} dynamic IN-list (the parser leaves {@code getItems()}
     * null or empty), where output lineage stays deferred.
     */
    private static boolean hasStaticInList(TPivotClause pc) {
        return pc.getPivotInClause() != null
                && pc.getPivotInClause().getItems() != null
                && pc.getPivotInClause().getItems().size() > 0;
    }

    /**
     * Slice 130 — the set of pivot-output column names: the IN-list items'
     * display names ({@code [2006]} for SQL Server bracket values, the IN-list
     * alias such as {@code pa} / {@code jan} for Oracle / Snowflake). A
     * projected column whose underlying column name
     * ({@link TResultColumn#getColumnNameOnly()}) is in this set is a pivot
     * output (sourced from the aggregation argument); any other simple-column
     * projection is a passthrough (group) column. Caller must have confirmed a
     * static IN-list via {@link #hasStaticInList}.
     *
     * <p>Returns a {@link LinkedHashSet} so the names are in IN-list DOCUMENT
     * ORDER. Slice 130 only used this for {@code contains()} membership, but
     * slice 133's {@code SELECT *} expansion ({@link #expandPivotBareStar})
     * relies on the ordered iteration to emit pivot-output columns in IN-list
     * order — so the ordered return type is part of the contract.
     */
    private static LinkedHashSet<String> collectPivotOutputNames(TPivotClause pc) {
        LinkedHashSet<String> names = new LinkedHashSet<>();
        TPivotInClause in = pc.getPivotInClause();
        if (in != null && in.getItems() != null) {
            for (int i = 0; i < in.getItems().size(); i++) {
                TResultColumn item = in.getItems().getResultColumn(i);
                if (item == null) {
                    continue;
                }
                String dn = item.getDisplayName();
                if (dn != null && !dn.isEmpty()) {
                    names.add(dn);
                }
            }
        }
        return names;
    }

    /**
     * Slice 129 helper — add one consumed column ref to {@code refs} iff it is
     * an actual column (not a function name, column alias, or {@code *}). The
     * ref is attributed DIRECTLY to {@code sourceAlias}.
     *
     * <p>No source-table match guard: sub-slice (a) admits only a single
     * base-table PIVOT source, so every column consumed by the FOR clause or
     * an aggregation argument necessarily belongs to that one source relation
     * — there is no other relation to mis-attribute to, and resolver2 leaves
     * these refs NOT_FOUND in PIVOT context anyway. Guarding on
     * {@code sourceTable} identity / name would SILENTLY DROP a valid consumed
     * column when Phase-1 left {@code sourceTable} null or shaped its name
     * differently (alias-normalized / schema-qualified) — codex diff-review
     * round 1 BLOCKING. The {@code dbObjectType == column} filter already
     * excludes function names and column-alias nodes.
     */
    private static void addPivotConsumedRef(LinkedHashSet<ColumnRef> refs,
                                            TObjectName ref,
                                            String sourceAlias) {
        if (ref == null || ref.getDbObjectType() != EDbObjectType.column) {
            return;
        }
        String col = ref.getColumnNameOnly();
        if (col == null || col.isEmpty() || "*".equals(col)) {
            return;
        }
        refs.add(new ColumnRef(sourceAlias, col));
    }

    /**
     * Slice 129 / 130 — build output columns for a PIVOT SELECT. Each projected
     * result column yields one OutputColumn whose name is the projection's
     * effective name. A {@code SELECT *} / {@code t.*} over a PIVOT is deferred
     * (it needs the full synthesised output schema / a catalog).
     *
     * <p>Slice 130 sub-slice (b1) attaches output-column LINEAGE when the
     * output schema maps deterministically to source columns — i.e. a SINGLE
     * aggregation over a STATIC IN-list ({@code lineageEnabled}):
     * <ul>
     *   <li><b>pivot-output column</b> — the projected column's underlying name
     *       ({@link TResultColumn#getColumnNameOnly()}) is one of the IN-list
     *       display names. It is the aggregate sliced by the FOR value, so
     *       {@code derived=true}, {@code aggregate=true}, and sources are the
     *       aggregation-argument column(s).</li>
     *   <li><b>passthrough (group) column</b> — any other simple-column
     *       projection. It is a direct reference to the source column, so
     *       {@code derived=false}, {@code aggregate=false}, and the single
     *       source is {@code sourceAlias.getColumnNameOnly()}. The output NAME
     *       may be aliased ({@code vendorid AS v}) but the SOURCE column is the
     *       underlying name.</li>
     * </ul>
     * Multi-aggregation (vendor-specific cross-product output names like
     * {@code pa_s}), a dynamic / subquery IN-list, and expression projections
     * keep the slice-129 NAME-only skeleton ({@code derived=true},
     * {@code aggregate=false}, EMPTY sources) — no false lineage.
     *
     * <p>All refs are built DIRECTLY against {@code sourceAlias}: sub-slice (a)
     * admits only a single base-table source, so every passthrough / agg-arg
     * column belongs to that one relation, and resolver2 marks them NOT_FOUND
     * in PIVOT context anyway (slice 129).
     */
    private static List<OutputColumn> buildPivotOutputColumns(TSelectSqlStatement select,
                                                              TTable pivotTable,
                                                              TPivotClause pc,
                                                              String sourceAlias,
                                                              TTable sourceTable,
                                                              NameBindingProvider provider) {
        TResultColumnList rcl = select.getResultColumnList();
        if (rcl == null || rcl.size() == 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SELECT_NO_PROJECTED_COLUMNS,
                    "SELECT has no projected columns", select));
        }
        boolean lineageEnabled = pivotAggregationCount(pc) == 1 && hasStaticInList(pc);
        Set<String> pivotOutputNames = lineageEnabled
                ? collectPivotOutputNames(pc) : Collections.<String>emptySet();
        List<ColumnRef> aggArgRefs = lineageEnabled
                ? collectPivotAggArgRefs(pc, sourceAlias) : Collections.<ColumnRef>emptyList();

        // Slice 153 — a NON-lineage-enabled PIVOT (a multi-aggregation PIVOT or a
        // dynamic / subquery IN-list) still has determinable PASSTHROUGH (group)
        // column lineage: a passthrough column passes through UNCHANGED from the
        // source regardless of the aggregation count or IN-list shape. Slice 130
        // emitted every projected column of such a PIVOT as a NAME-only skeleton
        // (empty sources); this attaches the source lineage to the passthrough
        // columns only. The set below is the lower-cased SOURCE column names that
        // are NOT consumed by the PIVOT (the FOR / pivot column(s) and the
        // aggregation-argument column(s)); a projected simple-column whose name is
        // in it is a passthrough. This is keyed off PROVABLE source membership
        // (the source catalog or a FROM-subquery's published columns) so it never
        // invents a false source for a vendor-specific cross-product output column
        // (e.g. `y6_s`) — those names are not source columns. Without a source
        // catalog (a base table and no Catalog) the set is empty, so the behaviour
        // is unchanged. (The lineage-enabled single-agg path below keys off the
        // KNOWN IN-list output-name set instead — for multi-agg those names are
        // vendor-specific cross-products we do not enumerate, hence the
        // catalog-confirmation rule here.)
        // Slice 156 — factored into provablePivotPassthroughColsLC (shared with
        // the WHERE-clause admission). Computed only for a non-lineage-enabled
        // PIVOT: the lineage-enabled single-agg path below keys off the KNOWN
        // IN-list output-name set instead.
        Set<String> passthroughSourceColsLC = lineageEnabled
                ? Collections.<String>emptySet()
                : provablePivotPassthroughColsLC(pc, sourceAlias, sourceTable, provider);

        // Slice 154 — a MULTI-aggregation PIVOT over a STATIC IN-list produces one
        // CROSS-PRODUCT output column per (IN-value × aggregation), named
        // `<in_value_display_name>_<agg_alias>` (`y6_s`, `y6_a`). Slice 130 / 153
        // left these as NAME-only skeletons because the names are vendor-specific
        // and were not enumerated. Build the map `<in_value>_<agg> -> that one
        // aggregation's argument column ref(s)` so a projected cross-product column
        // carries the SPECIFIC aggregation's lineage (NOT the union of all agg
        // args). Unlike the slice-153 passthrough rule, this needs NO source
        // catalog: the IN-value names and each aggregation's argument are fully
        // determined by the PIVOT clause itself (so a base table without a catalog
        // resolves the same as a subquery source — mirroring the lineage-enabled
        // single-agg path, which also reads the agg arg straight from the clause).
        // Keys are lower-cased (Locale.ROOT) to match the project's identifier
        // folding. A key produced by two (IN-value, agg) pairs with DIFFERENT
        // sources is AMBIGUOUS (e.g. degenerate names whose `_` concatenation
        // collides) and is dropped so it never attaches a wrong source.
        Map<String, List<ColumnRef>> crossProductSourcesLC = Collections.emptyMap();
        Set<String> ambiguousCrossProductLC = Collections.emptySet();
        if (!lineageEnabled && hasStaticInList(pc)
                && pc.getAggregation_function_list() != null
                && pc.getAggregation_function_list().size() > 1) {
            Map<String, List<ColumnRef>> xpMap = new HashMap<>();
            Set<String> xpAmbiguous = new HashSet<>();
            TResultColumnList aggList = pc.getAggregation_function_list();
            for (String inVal : collectPivotOutputNames(pc)) {
                if (inVal == null || inVal.isEmpty()) {
                    continue;
                }
                for (int ai = 0; ai < aggList.size(); ai++) {
                    TResultColumn aggRc = aggList.getResultColumn(ai);
                    if (aggRc == null) {
                        continue;
                    }
                    String aggAlias = aggRc.getDisplayName();
                    if (aggAlias == null || aggAlias.isEmpty()) {
                        continue;
                    }
                    String key = (inVal + "_" + aggAlias).toLowerCase(Locale.ROOT);
                    List<ColumnRef> argRefs = collectSingleAggArgRefs(aggRc, sourceAlias);
                    if (xpMap.containsKey(key)) {
                        if (!xpMap.get(key).equals(argRefs)) {
                            xpAmbiguous.add(key);
                        }
                    } else {
                        xpMap.put(key, argRefs);
                    }
                }
            }
            crossProductSourcesLC = xpMap;
            ambiguousCrossProductLC = xpAmbiguous;
        }

        // Slice 133 (sub-slice (b2-pivot)) — a SOLE `SELECT *` over a
        // lineage-enabled PIVOT is expanded from the source table's catalog
        // column list into the synthesised output schema (group / passthrough
        // columns then pivot-output columns). A `*` mixed with explicit columns
        // and the non-lineage-enabled (multi-agg / dynamic-IN) `*` stay deferred
        // via the per-column reject below.
        //
        // Slice 151 — the SOLE star is now admitted whether it is BARE (`*`) or
        // QUALIFIED (`p.*` / `src.*`). An admitted PIVOT SELECT has exactly ONE
        // relation in scope — the pivot output (isPivotSelect requires a
        // FROM-PIVOT with no JOIN) — so a qualified star can only mean that one
        // relation and is therefore equivalent to a bare `*`; expandPivotBareStar
        // synthesises the identical schema (it never reads the star's qualifier,
        // only the source columns and the pivot clause). Slice 152 dropped the
        // mirror gate on the UNPIVOT bare-star path below.
        if (lineageEnabled && rcl.size() == 1) {
            TResultColumn only = rcl.getResultColumn(0);
            if ("*".equals(only.getColumnNameOnly())) {
                // Slice 137 lifted the slice-136 subquery-source deferral. A bare
                // SELECT * over a FROM-subquery PIVOT now expands the same way as a
                // base-table PIVOT: expandPivotBareStar reads the source's published
                // columns via lookupRelationColumnNames, which the slice-137
                // addRelationToInScopeMap unwrap registers under the subquery alias.
                // No catalog is required for a subquery source — the subquery's
                // explicit projection IS the published schema.
                return expandPivotBareStar(pc, sourceTable, sourceAlias, provider,
                        aggArgRefs, only);
            }
        }

        // Slice 155 — admit a SOLE bare/qualified `*` over a MULTI-aggregation
        // static-IN PIVOT. Slice 130 / 133 deferred this (PIVOT_STAR_NOT_SUPPORTED)
        // because the cross-product output names were not enumerated; slice 154
        // enumerated them (`<in_value>_<agg_alias>` from the IN-list display names
        // and each aggregation's alias), so the full output schema is now
        // synthesisable: the passthrough (group) columns followed by the
        // cross-product output columns. (A dynamic / subquery IN-list multi-agg
        // bare `*` keeps the deferral via the per-column reject below — its
        // cross-product names are unknown. A single-agg static-IN bare `*` is
        // handled by the lineage-enabled block above.)
        if (!lineageEnabled && hasStaticInList(pc)
                && pc.getAggregation_function_list() != null
                && pc.getAggregation_function_list().size() > 1
                && rcl.size() == 1) {
            TResultColumn only = rcl.getResultColumn(0);
            if ("*".equals(only.getColumnNameOnly())) {
                return expandPivotMultiAggBareStar(pc, sourceTable, sourceAlias,
                        provider, only);
            }
        }

        List<OutputColumn> outs = new ArrayList<>();
        for (int i = 0; i < rcl.size(); i++) {
            TResultColumn rc = rcl.getResultColumn(i);
            if ("*".equals(rc.getColumnNameOnly())) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.PIVOT_STAR_NOT_SUPPORTED,
                        "SELECT * over a PIVOT is not supported yet "
                                + "(the synthesised output schema is deferred); "
                                + "project explicit columns", rc));
            }
            // effectiveOutputName throws RESULT_COLUMN_NO_NAME for an
            // unaliased non-name expression — acceptable deferral.
            String outName = effectiveOutputName(rc);
            if (!lineageEnabled) {
                // A non-lineage-enabled PIVOT (multi-agg, or dynamic / subquery
                // IN-list). A simple-column projection can be one of two resolvable
                // shapes; everything else (expressions) keeps the skeleton.
                String colName = rc.getColumnNameOnly();
                boolean simpleCol = colName != null && !colName.isEmpty()
                        && rc.getExpr() != null
                        && rc.getExpr().getExpressionType()
                                == EExpressionType.simple_object_name_t;
                String colNameLC = simpleCol ? colName.toLowerCase(Locale.ROOT) : null;
                if (simpleCol && passthroughSourceColsLC.contains(colNameLC)) {
                    // Slice 153 — passthrough (group) column: a simple source
                    // column proven NOT consumed by the PIVOT, passes through
                    // unchanged. (Disjoint from a cross-product name: PIVOT
                    // semantics forbid an IN-value naming an existing source
                    // column, so `<in>_<agg>` is never a source column.)
                    outs.add(new OutputColumn(outName, /*derived=*/ false,
                            /*aggregate=*/ false,
                            Collections.singletonList(new ColumnRef(sourceAlias, colName)),
                            /*windowSpec=*/ null));
                } else if (simpleCol && crossProductSourcesLC.containsKey(colNameLC)
                        && !ambiguousCrossProductLC.contains(colNameLC)) {
                    // Slice 154 — multi-agg cross-product pivot-output column:
                    // the aggregate of its SPECIFIC aggregation sliced by the FOR
                    // value (derived + aggregate, sourced from that one
                    // aggregation's argument column(s)).
                    outs.add(new OutputColumn(outName, /*derived=*/ true,
                            /*aggregate=*/ true,
                            crossProductSourcesLC.get(colNameLC),
                            /*windowSpec=*/ null));
                } else {
                    outs.add(pivotSkeletonOutput(outName));
                }
                continue;
            }
            String colOnly = rc.getColumnNameOnly();
            // Name-collision is a non-issue here: PIVOT semantics forbid an
            // IN-list value from naming a column that already exists in the
            // input source (see TPivotClause), so an IN-list display name can
            // never coincide with a real passthrough source column.
            if (colOnly != null && !colOnly.isEmpty() && pivotOutputNames.contains(colOnly)) {
                // Pivot-output column: aggregate over the value column, sliced
                // by the FOR value. Sources = aggregation-arg column(s).
                outs.add(new OutputColumn(outName, /*derived=*/ true, /*aggregate=*/ true,
                        aggArgRefs, /*windowSpec=*/ null));
            } else if (colOnly != null && !colOnly.isEmpty()
                    && rc.getExpr() != null
                    && rc.getExpr().getExpressionType() == EExpressionType.simple_object_name_t) {
                // Passthrough (group) column: direct reference to the source
                // column (the underlying name, not the output alias).
                outs.add(new OutputColumn(outName, /*derived=*/ false, /*aggregate=*/ false,
                        Collections.singletonList(new ColumnRef(sourceAlias, colOnly)),
                        /*windowSpec=*/ null));
            } else {
                // Expression projection (or no underlying column) — keep skeleton.
                outs.add(pivotSkeletonOutput(outName));
            }
        }
        return outs;
    }

    /**
     * Slice 133 (sub-slice (b2-pivot)) — synthesise the full output schema for a
     * bare {@code SELECT *} over a lineage-enabled (single-agg / static-IN)
     * PIVOT, using the source table's catalog column list:
     * <ol>
     *   <li><b>group / passthrough columns</b> — every catalog column that is
     *       NOT consumed by the PIVOT (i.e. not the FOR / pivot column(s) and not
     *       an aggregation-argument column), in CATALOG declaration order. Each is
     *       a direct source reference ({@code derived=false},
     *       {@code aggregate=false}, single source {@code sourceAlias.col}).</li>
     *   <li><b>pivot-output columns</b> — one per IN-list value
     *       ({@link #collectPivotOutputNames}, IN-list order). Each is the
     *       aggregate sliced by the FOR value ({@code derived=true},
     *       {@code aggregate=true}, sources = the aggregation-argument column(s)).</li>
     * </ol>
     * This is the SQL-standard {@code SELECT *} PIVOT shape (SQL Server / Oracle /
     * Snowflake): the implicit GROUP BY columns first, then the generated pivot
     * columns. (There is no dlineage {@code SELECT *} golden to match: dlineage
     * cannot expand {@code *} without a catalog either.)
     *
     * <p>The consumed-column subtraction folds names with
     * {@code toLowerCase(Locale.ROOT)} — the SAME identifier canonicalisation the
     * other semantic-IR catalog matchers use ({@link #expandBareStarOverUsing},
     * {@link #lookupRelationColumnNames}); so it is aligned with the project's
     * catalog name folding. (A degenerate catalog holding two columns that differ
     * only by case would have both excluded by a single consumed name — an
     * inherently ambiguous catalog, not a realistic PIVOT source.)
     *
     * <p>Throws {@link DiagnosticCode#PIVOT_STAR_CATALOG_REQUIRED} when no catalog
     * column list is available (mirrors slice-90
     * {@link DiagnosticCode#RETURNING_STAR_CATALOG_REQUIRED}).
     */
    private static List<OutputColumn> expandPivotBareStar(TPivotClause pc,
                                                          TTable sourceTable,
                                                          String sourceAlias,
                                                          NameBindingProvider provider,
                                                          List<ColumnRef> aggArgRefs,
                                                          TResultColumn star) {
        List<String> cols = lookupRelationColumnNames(sourceTable, provider);
        if (cols == null || cols.isEmpty()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_STAR_CATALOG_REQUIRED,
                    "SELECT * over a PIVOT requires catalog metadata for source '"
                            + sourceAlias + "' to expand the implicit group columns; "
                            + "supply a Catalog via "
                            + "SqlSemanticAnalyzer.analyze(sql, vendor, catalog)", star));
        }
        // Columns consumed by the PIVOT (FOR / pivot column(s) + aggregation-arg
        // column(s)); these are NOT passthrough group columns. Folded to lower
        // case (Locale.ROOT) to match the catalog identifier canonicalisation
        // used by the other semantic-IR catalog matchers (expandBareStarOverUsing,
        // lookupRelationColumnNames). addPivotConsumedRef already filters out
        // null / empty column names, so getColumnName() is non-null here; the
        // guard below is defensive.
        Set<String> consumedLC = new HashSet<>();
        List<ColumnRef> consumed = new ArrayList<>(collectPivotForRefs(pc, sourceAlias));
        consumed.addAll(aggArgRefs);
        for (ColumnRef r : consumed) {
            String cn = (r == null) ? null : r.getColumnName();
            if (cn != null && !cn.isEmpty()) {
                consumedLC.add(cn.toLowerCase(Locale.ROOT));
            }
        }
        List<OutputColumn> outs = new ArrayList<>();
        // 1. group / passthrough columns (catalog order, minus consumed).
        for (String c : cols) {
            if (c == null || c.isEmpty()) {
                continue;
            }
            if (consumedLC.contains(c.toLowerCase(Locale.ROOT))) {
                continue;
            }
            outs.add(new OutputColumn(c, /*derived=*/ false, /*aggregate=*/ false,
                    Collections.singletonList(new ColumnRef(sourceAlias, c)),
                    /*windowSpec=*/ null));
        }
        // 2. pivot-output columns (IN-list document order — collectPivotOutputNames
        //    returns a LinkedHashSet whose order is the IN-list order).
        for (String name : collectPivotOutputNames(pc)) {
            outs.add(new OutputColumn(name, /*derived=*/ true, /*aggregate=*/ true,
                    aggArgRefs, /*windowSpec=*/ null));
        }
        return outs;
    }

    /**
     * Slice 155 — synthesise the full output schema for a bare {@code SELECT *}
     * over a MULTI-aggregation static-IN PIVOT:
     * <ol>
     *   <li><b>passthrough / group columns</b> — every published source column
     *       NOT consumed by the PIVOT (the FOR / pivot column(s) and EVERY
     *       aggregation-argument column), in catalog / published declaration
     *       order. Each is a direct source reference ({@code derived=false},
     *       {@code aggregate=false}).</li>
     *   <li><b>cross-product output columns</b> — one per (IN-value × aggregation)
     *       named {@code <in_value_display_name>_<agg_alias>}, in
     *       IN-value-outer / aggregation-inner order (the SQL-standard / Oracle
     *       column order). Each is {@code derived=true}, {@code aggregate=true},
     *       sourced from that ONE aggregation's argument column(s).</li>
     * </ol>
     * Like {@link #expandPivotBareStar}, the passthrough expansion needs a source
     * catalog (or a FROM-subquery's published columns) — otherwise
     * {@link DiagnosticCode#PIVOT_STAR_CATALOG_REQUIRED}. The cross-product part,
     * by contrast, is fully clause-determined (mirroring slice 154's explicit
     * cross-product lineage), so it needs no catalog. Caller has confirmed a
     * static IN-list and a multi-aggregation PIVOT.
     */
    private static List<OutputColumn> expandPivotMultiAggBareStar(TPivotClause pc,
                                                                  TTable sourceTable,
                                                                  String sourceAlias,
                                                                  NameBindingProvider provider,
                                                                  TResultColumn star) {
        List<String> cols = lookupRelationColumnNames(sourceTable, provider);
        if (cols == null || cols.isEmpty()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_STAR_CATALOG_REQUIRED,
                    "SELECT * over a PIVOT requires catalog metadata for source '"
                            + sourceAlias + "' to expand the implicit group columns; "
                            + "supply a Catalog via "
                            + "SqlSemanticAnalyzer.analyze(sql, vendor, catalog)", star));
        }
        // Columns consumed by the PIVOT (FOR / pivot column(s) + EVERY
        // aggregation-argument column); these are NOT passthrough group columns.
        // Folded to lower case (Locale.ROOT) to match the catalog identifier
        // canonicalisation used by the other semantic-IR catalog matchers.
        Set<String> consumedLC = new HashSet<>();
        List<ColumnRef> consumed = new ArrayList<>(collectPivotForRefs(pc, sourceAlias));
        consumed.addAll(collectPivotAggArgRefs(pc, sourceAlias));
        for (ColumnRef r : consumed) {
            String cn = (r == null) ? null : r.getColumnName();
            if (cn != null && !cn.isEmpty()) {
                consumedLC.add(cn.toLowerCase(Locale.ROOT));
            }
        }
        List<OutputColumn> outs = new ArrayList<>();
        // 1. passthrough / group columns (published order, minus consumed).
        for (String c : cols) {
            if (c == null || c.isEmpty()) {
                continue;
            }
            if (consumedLC.contains(c.toLowerCase(Locale.ROOT))) {
                continue;
            }
            outs.add(new OutputColumn(c, /*derived=*/ false, /*aggregate=*/ false,
                    Collections.singletonList(new ColumnRef(sourceAlias, c)),
                    /*windowSpec=*/ null));
        }
        // 2. cross-product output columns — IN-value outer (IN-list document
        //    order), aggregation inner (declaration order). Each traces to its
        //    OWN aggregation's argument column(s), not the union of all aggs.
        TResultColumnList aggList = pc.getAggregation_function_list();
        for (String inVal : collectPivotOutputNames(pc)) {
            if (inVal == null || inVal.isEmpty()) {
                continue;
            }
            for (int ai = 0; ai < aggList.size(); ai++) {
                TResultColumn aggRc = aggList.getResultColumn(ai);
                if (aggRc == null) {
                    continue;
                }
                String aggAlias = aggRc.getDisplayName();
                if (aggAlias == null || aggAlias.isEmpty()) {
                    continue;
                }
                outs.add(new OutputColumn(inVal + "_" + aggAlias,
                        /*derived=*/ true, /*aggregate=*/ true,
                        collectSingleAggArgRefs(aggRc, sourceAlias),
                        /*windowSpec=*/ null));
            }
        }
        return outs;
    }

    /**
     * Slice 129 / 130 — a NAME-only deferred PIVOT output column ({@code
     * derived=true}, {@code aggregate=false}, EMPTY sources). Used for the
     * multi-aggregation / dynamic-IN / expression cases where output lineage
     * cannot be attributed without risking a false source.
     */
    private static OutputColumn pivotSkeletonOutput(String name) {
        return new OutputColumn(name, /*derived=*/ true, /*aggregate=*/ false,
                Collections.<ColumnRef>emptyList(), /*windowSpec=*/ null);
    }

    // -----------------------------------------------------------------
    // Slice 131 — PIVOT sub-slice (c): UNPIVOT output-column lineage.
    //
    // UNPIVOT narrows several source columns into rows. The clause carries:
    //   getValueColumnList() — the NEW value column(s) holding the unpivoted
    //                          values (e.g. `orders`);
    //   getPivotColumnList() — the NEW FOR/name column holding the literal
    //                          NAMES of the unpivoted columns (e.g. `employee`);
    //   getUnpivotInClause().getItems() — the narrowed SOURCE columns
    //                          (`emp1`, `emp2`, ...), each `getColumn()` a
    //                          base-table column with a Phase-1 sourceTable.
    // The value and FOR column names cannot name an existing input column
    // (PIVOT semantics, TPivotClause javadoc) — so they never collide with a
    // real passthrough source column.
    //
    // Sub-slice (c) admits the deterministic shape: a SINGLE value column over a
    // simple (non-column-group) IN-list. Output-column lineage mirrors the
    // authoritative dlineage UNPIVOT handler — each IN-list source column feeds
    // BOTH the value column and the FOR column. A multi-value-column or
    // column-group UNPIVOT stays deferred (PIVOT_UNPIVOT_NOT_SUPPORTED).
    // -----------------------------------------------------------------

    /**
     * Slice 131 / 132 — validate the UNPIVOT shape, deferring (reject with
     * {@code PIVOT_UNPIVOT_NOT_SUPPORTED}, code kept reached) the shapes whose
     * value↔source mapping is not deterministic.
     *
     * <p>Slice 131 admitted ONLY the single-value-column / simple-IN shape.
     * Slice 132 (sub-slice (c2)) generalises this to the well-formed
     * multi-value-column / column-group shape (Oracle / Redshift) — e.g.
     * {@code UNPIVOT ((s1, s2) FOR yr IN ((a1, a2) AS 'Y1', (b1, b2) AS 'Y2'))}.
     * The admit rule is a single width invariant: every IN-list item must have
     * EXACTLY one source column per value column ({@code itemWidth == valueCount}),
     * so each value column maps positionally to one group position.
     *
     * <p>The malformed / mixed shapes that stay deferred (and keep the code
     * reached): no value column; a group whose width differs from the value
     * count (e.g. {@code ((s1, s2) FOR yr IN ((a1, a2, a3) ...))}); a single
     * column item under a multi-value UNPIVOT; or a column-group item under a
     * single-value UNPIVOT. The harder positional mapping for those is left for
     * a later sub-slice.
     */
    private static void rejectUnsupportedUnpivotShape(TPivotClause pc, TTable pivotTable) {
        TObjectNameList valueCols = pc.getValueColumnList();
        if (valueCols == null || valueCols.size() < 1) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_UNPIVOT_NOT_SUPPORTED,
                    "UNPIVOT without a value column is not supported yet", pivotTable));
        }
        int valueCount = valueCols.size();
        TUnpivotInClause in = pc.getUnpivotInClause();
        if (in != null && in.getItems() != null) {
            for (int i = 0; i < in.getItems().size(); i++) {
                TUnpivotInClauseItem item = in.getItems().getElement(i);
                if (item == null) {
                    continue;
                }
                int itemWidth;
                if (item.getColumn() != null) {
                    itemWidth = 1;
                } else if (item.getColumnList() != null) {
                    itemWidth = item.getColumnList().size();
                } else {
                    itemWidth = 0;
                }
                if (itemWidth != valueCount) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.PIVOT_UNPIVOT_NOT_SUPPORTED,
                            "UNPIVOT IN-list item width does not match the value-column "
                                    + "count (each IN-list group must have exactly "
                                    + valueCount + " column(s) for the positional value "
                                    + "mapping); this shape is not supported yet", pivotTable));
                }
            }
        }
    }

    /**
     * Slice 131 / 132 — ALL columns CONSUMED by an UNPIVOT: the IN-list SOURCE
     * columns being narrowed (NOT the new value / FOR columns), in document
     * order, deduped. Built DIRECTLY against {@code sourceAlias} via the shared
     * {@link #addPivotConsumedRef} filter (resolver2 NOT_FOUND-in-pivot quirk,
     * slice 129). This is also the source list for the FOR output column (the
     * FOR values are the literal labels of the narrowed columns, attributed to
     * every source column for slice-131 / dlineage parity).
     *
     * <p>Slice 132 extends slice 131 to walk column-group items: a multi-value
     * UNPIVOT IN-list item is a column GROUP ({@code getColumn() == null},
     * {@code getColumnList()} populated), so the group columns are flattened
     * into this list in document order.
     *
     * <p>Note: this does NOT reuse {@link #collectPivotConsumedRefs}, which reads
     * {@code getPivotColumnList()} — for an UNPIVOT that is the NEW FOR column,
     * not a source column, and would be wrongly captured as a consumed ref.
     */
    private static List<ColumnRef> collectUnpivotInListRefs(TPivotClause pc,
                                                            String sourceAlias) {
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        TUnpivotInClause in = pc.getUnpivotInClause();
        if (in != null && in.getItems() != null) {
            for (int i = 0; i < in.getItems().size(); i++) {
                TUnpivotInClauseItem item = in.getItems().getElement(i);
                if (item == null) {
                    continue;
                }
                if (item.getColumn() != null) {
                    addPivotConsumedRef(refs, item.getColumn(), sourceAlias);
                } else if (item.getColumnList() != null) {
                    TObjectNameList group = item.getColumnList();
                    for (int k = 0; k < group.size(); k++) {
                        addPivotConsumedRef(refs, group.getObjectName(k), sourceAlias);
                    }
                }
            }
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 132 — the source column ref(s) for the value column at
     * {@code position} (positional mapping per roadmap §13): for each IN-list
     * item, the group column at {@code position} (or {@code getColumn()} for a
     * single-column item when {@code position == 0}). Document order, deduped,
     * built directly against {@code sourceAlias}.
     *
     * <p>This unifies the single-value and multi-value cases: for a single-value
     * UNPIVOT each item is a single column and {@code position} is always 0, so
     * this returns ALL IN-list source columns — byte-identical to the slice-131
     * value-column lineage. For a multi-value UNPIVOT, value column {@code s_k}
     * at position {@code k} draws only from group position {@code k}
     * ({@code s1 <- a1, b1}; {@code s2 <- a2, b2}), which is more precise than
     * the authoritative dlineage handler (it feeds every source column into
     * every output column). The shape gate
     * ({@link #rejectUnsupportedUnpivotShape}) guarantees every item width
     * equals the value count, so {@code position} is always in range; the bounds
     * check is defensive.
     */
    private static List<ColumnRef> collectUnpivotValueColumnRefs(TPivotClause pc,
                                                                 String sourceAlias,
                                                                 int position) {
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        TUnpivotInClause in = pc.getUnpivotInClause();
        if (in != null && in.getItems() != null) {
            for (int i = 0; i < in.getItems().size(); i++) {
                TUnpivotInClauseItem item = in.getItems().getElement(i);
                if (item == null) {
                    continue;
                }
                TObjectName col = null;
                if (item.getColumn() != null) {
                    if (position == 0) {
                        col = item.getColumn();
                    }
                } else if (item.getColumnList() != null
                        && position < item.getColumnList().size()) {
                    col = item.getColumnList().getObjectName(position);
                }
                addPivotConsumedRef(refs, col, sourceAlias);
            }
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 132 — map each UNPIVOT value-column NAME to its position in the
     * value-column list, so a projected column can be matched to its positional
     * source group. First occurrence wins on a (degenerate) duplicate name.
     */
    private static Map<String, Integer> unpivotValueColumnPositions(TPivotClause pc) {
        Map<String, Integer> positions = new HashMap<>();
        TObjectNameList vcl = pc.getValueColumnList();
        if (vcl != null) {
            for (int i = 0; i < vcl.size(); i++) {
                TObjectName n = vcl.getObjectName(i);
                if (n == null) {
                    continue;
                }
                String name = n.getColumnNameOnly();
                if (name != null && !name.isEmpty() && !positions.containsKey(name)) {
                    positions.put(name, i);
                }
            }
        }
        return positions;
    }

    /** Slice 131 — the UNPIVOT FOR/name-column name, or null. */
    private static String unpivotForColumnName(TPivotClause pc) {
        TObjectNameList pcl = pc.getPivotColumnList();
        if (pcl != null && pcl.size() >= 1 && pcl.getObjectName(0) != null) {
            return pcl.getObjectName(0).getColumnNameOnly();
        }
        if (pc.getPivotColumn() != null) {
            return pc.getPivotColumn().getColumnNameOnly();
        }
        return null;
    }

    /**
     * Slice 131 — build output columns for an UNPIVOT SELECT (the deterministic
     * single-value / simple-IN shape; multi-value / column-group already
     * deferred by {@link #rejectUnsupportedUnpivotShape}). Each projected result
     * column is matched by its underlying name ({@link TResultColumn#getColumnNameOnly()},
     * NOT the output alias — mirrors slice 130):
     * <ul>
     *   <li><b>value column</b> — underlying name == a value-column name. Holds
     *       the unpivoted values, so {@code derived=true}, {@code aggregate=false}.
     *       Sources are POSITIONAL (slice 132): value column at position {@code k}
     *       draws from group position {@code k} across all IN-list items
     *       ({@code s1 <- a1, b1}; {@code s2 <- a2, b2}). For a single-value
     *       UNPIVOT this collapses to ALL IN-list source columns (slice 131).</li>
     *   <li><b>FOR/name column</b> — underlying name == the FOR-column name. Holds
     *       the literal NAMES / labels of the unpivoted columns; attributed to ALL
     *       IN-list source columns (slice-131 / dlineage parity — both halves of a
     *       single-value UNPIVOT trace to every narrowed source column).
     *       {@code derived=true}, {@code aggregate=false}.</li>
     *   <li><b>passthrough column</b> — any other {@code simple_object_name_t}
     *       projection. Direct reference to the source column:
     *       {@code derived=false}, {@code aggregate=false}, single source
     *       {@code sourceAlias.colName} (underlying name, alias respected in the
     *       output NAME).</li>
     *   <li><b>expression projection</b> — kept as a NAME-only skeleton
     *       ({@link #pivotSkeletonOutput}); no single source column.</li>
     * </ul>
     * Value / FOR matching is exact (mirrors slice 130). No name-collision risk:
     * PIVOT/UNPIVOT semantics forbid the value / FOR column from naming an
     * existing input column, so a passthrough source column can never coincide
     * with the value / FOR name. All refs are built DIRECTLY against
     * {@code sourceAlias} (single base-table source; resolver2 NOT_FOUND quirk).
     */
    private static List<OutputColumn> buildUnpivotOutputColumns(TSelectSqlStatement select,
                                                                TTable pivotTable,
                                                                TPivotClause pc,
                                                                String sourceAlias,
                                                                TTable sourceTable,
                                                                NameBindingProvider provider) {
        TResultColumnList rcl = select.getResultColumnList();
        if (rcl == null || rcl.size() == 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SELECT_NO_PROJECTED_COLUMNS,
                    "SELECT has no projected columns", select));
        }

        // Slice 134 / 135 (sub-slice (b2-unpivot)) — a SOLE bare `SELECT *` over a
        // well-formed UNPIVOT (single-value, slice 131; or multi-value-column /
        // column-group, slice 132 — both already validated by the
        // rejectUnsupportedUnpivotShape width invariant run earlier in
        // buildPivotSelect) is expanded from the source table's catalog column list
        // into the synthesised output schema (passthrough columns then the FOR/name
        // column then the value column(s)). Slice 135 lifted the slice-134
        // valueCount==1 gate to valueCount>=1 so the multi-value-column case is
        // admitted too.
        //
        // Slice 152 — the SOLE star is now admitted whether it is BARE (`*`) or
        // QUALIFIED (`u.*` / `src.*`), mirroring slice 151 on the PIVOT path. An
        // admitted UNPIVOT SELECT has exactly ONE relation in scope — the unpivot
        // output (isPivotSelect requires a FROM-UNPIVOT with no JOIN) — so a
        // qualified star can only mean that one relation and is therefore
        // equivalent to a bare `*`; expandUnpivotBareStar synthesises the identical
        // schema (it never reads the star's qualifier, only the source columns and
        // the unpivot clause). The isBareStar gate is dropped here. A `*` mixed
        // with explicit columns (rcl.size() > 1) still defers via the per-column
        // reject below (PIVOT_STAR_NOT_SUPPORTED kept reached).
        TObjectNameList valueCols = pc.getValueColumnList();
        if (rcl.size() == 1 && valueCols != null && valueCols.size() >= 1) {
            TResultColumn only = rcl.getResultColumn(0);
            if ("*".equals(only.getColumnNameOnly())) {
                // Slice 137 lifted the slice-136 subquery-source deferral. A bare
                // SELECT * over a FROM-subquery UNPIVOT now expands the same way as
                // a base-table UNPIVOT: expandUnpivotBareStar reads the source's
                // published columns via lookupRelationColumnNames, which the
                // slice-137 addRelationToInScopeMap unwrap registers under the
                // subquery alias. No catalog is required for a subquery source —
                // the subquery's explicit projection IS the published schema.
                return expandUnpivotBareStar(pc, sourceTable, sourceAlias, provider, only);
            }
        }

        Map<String, Integer> valuePositions = unpivotValueColumnPositions(pc);
        String forName = unpivotForColumnName(pc);
        List<ColumnRef> inListRefs = collectUnpivotInListRefs(pc, sourceAlias);

        List<OutputColumn> outs = new ArrayList<>();
        for (int i = 0; i < rcl.size(); i++) {
            TResultColumn rc = rcl.getResultColumn(i);
            if ("*".equals(rc.getColumnNameOnly())) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.PIVOT_STAR_NOT_SUPPORTED,
                        "SELECT * over an UNPIVOT is not supported yet "
                                + "(the synthesised output schema is deferred); "
                                + "project explicit columns", rc));
            }
            String outName = effectiveOutputName(rc);
            String colOnly = rc.getColumnNameOnly();
            Integer valuePos = (colOnly == null || colOnly.isEmpty())
                    ? null : valuePositions.get(colOnly);
            if (valuePos != null) {
                // Value column (the unpivoted values): POSITIONAL sources — the
                // group column at this value column's position across every
                // IN-list item.
                outs.add(new OutputColumn(outName, /*derived=*/ true, /*aggregate=*/ false,
                        collectUnpivotValueColumnRefs(pc, sourceAlias, valuePos),
                        /*windowSpec=*/ null));
            } else if (colOnly != null && !colOnly.isEmpty()
                    && colOnly.equals(forName)) {
                // FOR/name column (the source column NAMES / labels): traces to
                // every narrowed IN-list source column (dlineage parity).
                outs.add(new OutputColumn(outName, /*derived=*/ true, /*aggregate=*/ false,
                        inListRefs, /*windowSpec=*/ null));
            } else if (colOnly != null && !colOnly.isEmpty()
                    && rc.getExpr() != null
                    && rc.getExpr().getExpressionType() == EExpressionType.simple_object_name_t) {
                // Passthrough column: direct reference to the source column.
                outs.add(new OutputColumn(outName, /*derived=*/ false, /*aggregate=*/ false,
                        Collections.singletonList(new ColumnRef(sourceAlias, colOnly)),
                        /*windowSpec=*/ null));
            } else {
                // Expression projection (or no underlying column) — keep skeleton.
                outs.add(pivotSkeletonOutput(outName));
            }
        }
        return outs;
    }

    /**
     * Slice 134 / 135 (sub-slice (b2-unpivot)) — synthesise the full output schema
     * for a bare {@code SELECT *} over a well-formed UNPIVOT (single-value, slice
     * 131; or multi-value-column / column-group, slice 132 — slice 135 lifted the
     * value-count gate), using the source table's catalog column list:
     * <ol>
     *   <li><b>passthrough columns</b> — every catalog column that is NOT a
     *       narrowed IN-list SOURCE column ({@link #collectUnpivotInListRefs}), in
     *       CATALOG declaration order. Each is a direct source reference
     *       ({@code derived=false}, {@code aggregate=false}, single source
     *       {@code sourceAlias.col}).</li>
     *   <li><b>FOR/name column</b> — {@link #unpivotForColumnName}. Holds the
     *       literal NAMES of the unpivoted columns; traces to ALL IN-list source
     *       columns ({@code derived=true}, {@code aggregate=false}).</li>
     *   <li><b>value column(s)</b> — every {@code getValueColumnList()} entry, in
     *       declaration order. Holds the unpivoted values; the value column at
     *       position {@code k} draws POSITIONALLY from group position {@code k}
     *       across every IN-list item ({@link #collectUnpivotValueColumnRefs}, the
     *       slice-132 mechanism): {@code s1 <- a1, b1}; {@code s2 <- a2, b2}. For a
     *       single-value UNPIVOT (slice 134) the sole position 0 collapses to ALL
     *       IN-list source columns ({@code derived=true}, {@code aggregate=false}).</li>
     * </ol>
     * This is the Oracle / Redshift {@code SELECT *} UNPIVOT order: the passthrough
     * columns first, then the FOR/name column, then the value column(s). The
     * per-column lineage is byte-identical to the slice-131 / 132 explicit-projection
     * path ({@link #buildUnpivotOutputColumns}); only the names and order are
     * synthesised here from the catalog + clause.
     *
     * <p>The passthrough subtraction folds names with {@code toLowerCase(Locale.ROOT)}
     * — the same identifier canonicalisation the other semantic-IR catalog matchers
     * use ({@link #expandPivotBareStar}, {@link #lookupRelationColumnNames}). The
     * FOR/value column names are NEW (UNPIVOT semantics forbid them from colliding
     * with a source column), so they are never in the catalog and need no subtraction.
     *
     * <p>Throws {@link DiagnosticCode#PIVOT_STAR_CATALOG_REQUIRED} (reused from
     * slice 133) when no catalog column list is available, with an
     * UNPIVOT-discriminated message (slice-80 message-text-discrimination contract).
     */
    private static List<OutputColumn> expandUnpivotBareStar(TPivotClause pc,
                                                            TTable sourceTable,
                                                            String sourceAlias,
                                                            NameBindingProvider provider,
                                                            TResultColumn star) {
        List<String> cols = lookupRelationColumnNames(sourceTable, provider);
        if (cols == null || cols.isEmpty()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.PIVOT_STAR_CATALOG_REQUIRED,
                    "SELECT * over an UNPIVOT requires catalog metadata for source '"
                            + sourceAlias + "' to expand the implicit passthrough columns; "
                            + "supply a Catalog via "
                            + "SqlSemanticAnalyzer.analyze(sql, vendor, catalog)", star));
        }
        // Columns NARROWED by the UNPIVOT (the IN-list SOURCE columns); these are
        // removed from the passthrough set. Folded to lower case (Locale.ROOT) to
        // match the catalog identifier canonicalisation used by the other
        // semantic-IR catalog matchers. addPivotConsumedRef already filters out
        // null / empty names, so getColumnName() is non-null; the guard is defensive.
        List<ColumnRef> inListRefs = collectUnpivotInListRefs(pc, sourceAlias);
        Set<String> consumedLC = new HashSet<>();
        for (ColumnRef r : inListRefs) {
            String cn = (r == null) ? null : r.getColumnName();
            if (cn != null && !cn.isEmpty()) {
                consumedLC.add(cn.toLowerCase(Locale.ROOT));
            }
        }
        List<OutputColumn> outs = new ArrayList<>();
        // 1. passthrough columns (catalog order, minus the narrowed IN-list sources).
        for (String c : cols) {
            if (c == null || c.isEmpty()) {
                continue;
            }
            if (consumedLC.contains(c.toLowerCase(Locale.ROOT))) {
                continue;
            }
            outs.add(new OutputColumn(c, /*derived=*/ false, /*aggregate=*/ false,
                    Collections.singletonList(new ColumnRef(sourceAlias, c)),
                    /*windowSpec=*/ null));
        }
        // 2. FOR/name column — the literal labels of the narrowed columns; traces
        //    to every IN-list source column (slice-131 / dlineage parity).
        String forName = unpivotForColumnName(pc);
        if (forName != null && !forName.isEmpty()) {
            outs.add(new OutputColumn(forName, /*derived=*/ true, /*aggregate=*/ false,
                    inListRefs, /*windowSpec=*/ null));
        }
        // 3. value column(s) — the unpivoted values, in getValueColumnList()
        //    declaration order. Slice 135: value column at position k draws from
        //    group position k across every IN-list item (collectUnpivotValueColumnRefs,
        //    the slice-132 positional mechanism): s1 <- a1, b1; s2 <- a2, b2. For a
        //    single-value UNPIVOT (slice 134) the sole position 0 collapses to all
        //    IN-list source columns, byte-identical to the prior behaviour.
        TObjectNameList valueCols = pc.getValueColumnList();
        if (valueCols != null) {
            for (int k = 0; k < valueCols.size(); k++) {
                TObjectName valueCol = valueCols.getObjectName(k);
                String valueName = (valueCol != null) ? valueCol.getColumnNameOnly() : null;
                if (valueName != null && !valueName.isEmpty()) {
                    outs.add(new OutputColumn(valueName, /*derived=*/ true, /*aggregate=*/ false,
                            collectUnpivotValueColumnRefs(pc, sourceAlias, k), /*windowSpec=*/ null));
                }
            }
        }
        return outs;
    }

    /**
     * Slices 70 and 71: build per-statement row-limit metadata from
     * {@code TLimitClause}, {@code TTopClause}, {@code TOffsetClause},
     * or {@code TFetchFirstClause}. Returns {@code null} when no
     * row-limit clause is present. All admit / reject decisions for
     * single-SELECT row-limit clauses live here; the set-op outer
     * row-limit path is rejected separately by
     * {@link #rejectSetOpRowLimit} (slice 72 lifts).
     *
     * <h4>Admitted shapes</h4>
     * <ul>
     *   <li>{@link RowLimitKind#LIMIT} — {@code TLimitClause} with
     *       non-null {@code getRow_count()}. Offset is populated when
     *       {@code TLimitClause.getOffset() != null} (PG / MySQL /
     *       SQLite / BigQuery / Snowflake / Redshift inline
     *       {@code LIMIT N OFFSET M}, MySQL old-style {@code LIMIT M, N},
     *       Informix {@code SKIP m LIMIT n}).</li>
     *   <li>{@link RowLimitKind#FETCH_FIRST} — {@code TLimitClause} with
     *       non-null {@code getSelectFetchFirstValue()} (PG
     *       {@code FETCH FIRST}, Informix {@code FIRST n}). Offset is
     *       populated when present (PG
     *       {@code OFFSET m FETCH FIRST n}, Informix
     *       {@code SKIP m FIRST n}). Also fires for
     *       {@code TFetchFirstClause} with non-null
     *       {@code getFetchValue()} (Oracle / SQL Server
     *       {@code FETCH FIRST/NEXT N ROWS ONLY}) when no
     *       {@code TOffsetClause} is present.</li>
     *   <li>{@link RowLimitKind#TOP} — {@code TTopClause} with non-null
     *       {@code getExpr()} and neither {@code isPercent()} nor
     *       {@code isWithties()} set. SQL Server {@code SELECT TOP N}.</li>
     *   <li>{@link RowLimitKind#OFFSET_FETCH} — Oracle / SQL Server
     *       {@code OFFSET m ROWS [FETCH NEXT n ROWS ONLY]} routed via
     *       the dedicated {@code TOffsetClause} + {@code TFetchFirstClause}
     *       pair, and PG offset-only {@code OFFSET m} routed via
     *       {@code TLimitClause.getOffset()} when {@code row_count} and
     *       {@code selectFetchFirstValue} are both null.
     *       {@link RowLimit#getCount()} may be {@code null} for
     *       offset-only forms.</li>
     * </ul>
     *
     * <h4>Rejects</h4>
     * <ul>
     *   <li>{@link DiagnosticCode#ROW_LIMIT_TOP_PERCENT_NOT_SUPPORTED}
     *       — {@code TOP N PERCENT}. The sampling semantics differ from
     *       fixed-row {@code LIMIT} enough to warrant a dedicated slice.</li>
     *   <li>{@link DiagnosticCode#ROW_LIMIT_TOP_WITH_TIES_NOT_SUPPORTED}
     *       — {@code TOP N WITH TIES}. Requires modeling the ORDER BY
     *       tie-handling interaction; deferred.</li>
     *   <li>{@link DiagnosticCode#ROW_LIMIT_HIVE_LIMIT_GRAMMAR_QUIRK} —
     *       Hive single-argument {@code LIMIT N} parser routes the
     *       count through {@code TLimitClause.getOffset()} with
     *       {@code row_count == null}, which is indistinguishable at
     *       the AST level from PG offset-only {@code OFFSET m}. Pinning
     *       this with a vendor-specific guard prevents emitting
     *       semantically-wrong {@code OFFSET_FETCH} metadata for what
     *       the SQL author wrote as a LIMIT. A future grammar fix
     *       should route the count through {@code getRow_count()}; this
     *       guard can be removed then.</li>
     *   <li>{@link DiagnosticCode#ROW_LIMIT_LIMIT_NOT_SUPPORTED} —
     *       Vertica TIMESERIES windowing on {@code TLimitClause}
     *       ({@code getWindowDef() != null}). Defensive; not modeled.</li>
     *   <li>{@link DiagnosticCode#ROW_LIMIT_COUNT_UNRESOLVED} — the
     *       parser constructed a row-limit clause node but did not
     *       populate any count slot:
     *       <ul>
     *         <li>{@code TLimitClause} with {@code row_count},
     *             {@code selectFetchFirstValue}, and {@code offset} all
     *             null (defensive; not observed in probe runs).</li>
     *         <li>{@code TFetchFirstClause} with null fetchValue —
     *             ANSI / DB2 grammar incompleteness (the parser
     *             constructs the clause node but does not populate the
     *             count). Future grammar fix can lift this.</li>
     *         <li>{@code TTopClause} with null expression (defensive).</li>
     *       </ul></li>
     * </ul>
     */
    private static RowLimit buildRowLimit(TSelectSqlStatement select) {
        TLimitClause limit = select.getLimitClause();
        if (limit != null) {
            // Vertica TIMESERIES window on TLimitClause — defensive; rare.
            // Pre-empts the row_count / fff branches because the windowed
            // form is its own semantic surface.
            if (limit.getWindowDef() != null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_LIMIT_NOT_SUPPORTED,
                        "row-limit clause LIMIT with Vertica TIMESERIES window "
                                + "is not supported yet", limit));
            }

            TExpression rc = limit.getRow_count();
            TExpression off = limit.getOffset();
            TExpression fff = limit.getSelectFetchFirstValue();

            // Hive single-argument LIMIT parser quirk: the count ends
            // up on offset with row_count=null. Vendor-conditional
            // because the same AST shape is legitimate PG offset-only.
            if (select.dbvendor == EDbVendor.dbvhive
                    && rc == null && off != null && fff == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_HIVE_LIMIT_GRAMMAR_QUIRK,
                        "Hive single-argument LIMIT N is currently mis-routed "
                                + "by the parser (count appears on TLimitClause.getOffset() "
                                + "with row_count=null); fix the Hive grammar to route "
                                + "the count through getRow_count() to lift this guard", limit));
            }

            if (rc != null) {
                // LIMIT N with optional OFFSET M (PG/MySQL/SQLite/
                // BigQuery/Snowflake/Redshift inline LIMIT-OFFSET,
                // MySQL old-style LIMIT M,N, Informix SKIP m LIMIT n).
                return new RowLimit(RowLimitKind.LIMIT,
                        rc.toString(),
                        off != null ? off.toString() : null);
            }
            if (fff != null) {
                // FETCH FIRST via the PG/Informix routing through
                // TLimitClause, with optional OFFSET (PG
                // OFFSET m FETCH FIRST n; Informix SKIP m FIRST n).
                return new RowLimit(RowLimitKind.FETCH_FIRST,
                        fff.toString(),
                        off != null ? off.toString() : null);
            }
            if (off != null) {
                // Offset-only via TLimitClause (PG OFFSET m [ROWS]).
                return new RowLimit(RowLimitKind.OFFSET_FETCH,
                        /*count=*/ null,
                        off.toString());
            }
            // Defensive: TLimitClause present with all four slots null.
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                    "row-limit clause LIMIT is present but no count, offset, "
                            + "or FETCH FIRST value is populated on the parser AST", limit));
        }

        TTopClause top = select.getTopClause();
        if (top != null) {
            if (top.isPercent()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_TOP_PERCENT_NOT_SUPPORTED,
                        "row-limit clause TOP N PERCENT is not supported yet; "
                                + "sampling semantics warrant a dedicated slice", top));
            }
            if (top.isWithties()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_TOP_WITH_TIES_NOT_SUPPORTED,
                        "row-limit clause TOP N WITH TIES is not supported yet; "
                                + "tie-handling semantics warrant a dedicated slice", top));
            }
            TExpression e = top.getExpr();
            if (e == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                        "row-limit clause TOP is present but the count expression "
                                + "is not populated on the parser AST", top));
            }
            return new RowLimit(RowLimitKind.TOP, e.toString(), /*offset=*/ null);
        }

        TOffsetClause offClause = select.getOffsetClause();
        TFetchFirstClause fetch = select.getFetchFirstClause();
        if (offClause != null) {
            // Oracle / SQL Server OFFSET m ROWS [FETCH NEXT n ROWS ONLY].
            // The optional FETCH NEXT counterpart populates
            // TFetchFirstClause when present.
            String offsetText = offClause.getSelectOffsetValue() != null
                    ? offClause.getSelectOffsetValue().toString()
                    : null;
            if (offsetText == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                        "row-limit clause OFFSET is present but the offset value "
                                + "is not populated on the parser AST", offClause));
            }
            String countText = null;
            if (fetch != null && fetch.getFetchValue() != null) {
                countText = fetch.getFetchValue().toString();
            }
            return new RowLimit(RowLimitKind.OFFSET_FETCH, countText, offsetText);
        }
        if (fetch != null) {
            if (fetch.getFetchValue() != null) {
                // Oracle / SQL Server FETCH FIRST/NEXT N ROWS ONLY
                // without OFFSET (TOffsetClause was null above).
                return new RowLimit(RowLimitKind.FETCH_FIRST,
                        fetch.getFetchValue().toString(), /*offset=*/ null);
            }
            // ANSI / DB2: TFetchFirstClause is non-null but fetchValue
            // is null because the grammar does not pass the count into
            // the node initializer. Reject so the gap is visible.
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                    "row-limit clause FETCH FIRST is present but the count "
                            + "expression is not populated on the parser AST "
                            + "(ANSI / DB2 grammar gap)", fetch));
        }
        return null;
    }

    /**
     * Slice 72: build the OUTER set-op statement's row-limit. Same
     * decision tree as {@link #buildRowLimit} for SELECT-level routing
     * (PG/MySQL/SQLite/BigQuery/Snowflake/Redshift via
     * {@code TLimitClause}, plus Hive/Vertica/ANSI-DB2 defensives),
     * with an additional MSSQL-only fallback that reads the OFFSET /
     * FETCH FIRST clauses off the outer {@code TOrderBy} node.
     *
     * <p>Empirical AST shapes (probed against the current parser):
     * <ul>
     *   <li>PG / MySQL / SQLite / BigQuery / Snowflake / Redshift route
     *       set-op outer LIMIT / OFFSET / FETCH FIRST onto
     *       {@code setOp.getLimitClause()} — handled by the primary
     *       {@code buildRowLimit} path.</li>
     *   <li>MSSQL routes set-op outer {@code OFFSET m ROWS [FETCH NEXT
     *       n ROWS ONLY]} EXCLUSIVELY onto
     *       {@code setOp.getOrderbyClause().getOffsetClause()} /
     *       {@code .getFetchFirstClause()} — NOT duplicated onto the
     *       SELECT node (opposite of single-SELECT MSSQL where slice 71
     *       saw duplication onto both). The TOrderBy fallback below
     *       handles this.</li>
     *   <li>Oracle drops set-op outer OFFSET / FETCH from both SELECT
     *       and TOrderBy slots silently; nothing for slice 72 to
     *       emit. A future Oracle grammar fix can lift this.</li>
     * </ul>
     *
     * <p>The TOrderBy fallback is vendor-gated to MSSQL to avoid
     * over-admitting on unprobed dialects (per codex round-1 B1).
     * Kind mapping mirrors {@link #buildRowLimit}'s single-SELECT
     * decision tree:
     * <ul>
     *   <li>{@code TOffsetClause} + {@code TFetchFirstClause} both
     *       populated → {@code OFFSET_FETCH/count/offset}</li>
     *   <li>{@code TOffsetClause} only → {@code OFFSET_FETCH/null/offset}</li>
     *   <li>{@code TFetchFirstClause} only → {@code FETCH_FIRST/count/null}
     *       (unreachable via current MSSQL grammar which requires
     *       OFFSET before FETCH; retained as defensive routing-shape
     *       parity with single-SELECT)</li>
     *   <li>Defensive null-value rejects mirror single-SELECT
     *       {@link #buildRowLimit}: a present {@code TOffsetClause}
     *       with a null offset value throws
     *       {@code ROW_LIMIT_COUNT_UNRESOLVED}; a present bare
     *       {@code TFetchFirstClause} (no companion OFFSET) with a
     *       null fetch value throws the same code. When both clauses
     *       are present, only the offset slot must be populated; a
     *       null fetch value is silently treated as offset-only
     *       (matches the single-SELECT
     *       {@code TOffsetClause + TFetchFirstClause} branch in
     *       {@code buildRowLimit}).</li>
     * </ul>
     */
    private static RowLimit buildSetOpRowLimit(TSelectSqlStatement setOp) {
        // Primary path: SELECT-level routing. Covers PG/MySQL/SQLite/
        // BigQuery/Snowflake/Redshift via TLimitClause, plus inherited
        // Hive / Vertica / ANSI-DB2 defensives from buildRowLimit.
        RowLimit fromSelect = buildRowLimit(setOp);
        if (fromSelect != null) {
            return fromSelect;
        }
        // MSSQL-only TOrderBy fallback (codex B1 vendor gate).
        if (setOp.dbvendor != EDbVendor.dbvmssql) {
            return null;
        }
        TOrderBy orderBy = setOp.getOrderbyClause();
        if (orderBy == null) return null;
        TOffsetClause oc = orderBy.getOffsetClause();
        TFetchFirstClause fc = orderBy.getFetchFirstClause();
        if (oc == null && fc == null) return null;

        String offsetText = (oc != null && oc.getSelectOffsetValue() != null)
                ? oc.getSelectOffsetValue().toString() : null;
        String countText = (fc != null && fc.getFetchValue() != null)
                ? fc.getFetchValue().toString() : null;

        if (oc != null && fc != null) {
            if (offsetText == null) {
                // Mirrors single-SELECT buildRowLimit TOffsetClause path:
                // a present OFFSET clause must populate its value (the
                // FETCH NEXT counterpart is optional; null countText is
                // silently treated as offset-only).
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                        "MSSQL set-op outer OFFSET clause present on TOrderBy "
                                + "but offset value is not populated on the parser AST", orderBy));
            }
            return new RowLimit(RowLimitKind.OFFSET_FETCH, countText, offsetText);
        }
        if (oc != null) {
            if (offsetText == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                        "MSSQL set-op outer OFFSET clause present on TOrderBy "
                                + "but offset value is not populated on the parser AST", orderBy));
            }
            return new RowLimit(RowLimitKind.OFFSET_FETCH, /*count=*/ null, offsetText);
        }
        // fc only (oc == null). Defensive: not reachable via current
        // MSSQL grammar which requires OFFSET before FETCH NEXT.
        if (countText == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ROW_LIMIT_COUNT_UNRESOLVED,
                    "MSSQL set-op outer FETCH FIRST clause present on TOrderBy "
                            + "but fetch value is not populated on the parser AST", orderBy));
        }
        return new RowLimit(RowLimitKind.FETCH_FIRST, countText, /*offset=*/ null);
    }

    /**
     * Resolve a {@link TSelectSqlStatement}'s row-filter clause to the IR's
     * {@code distinct} flag. Mapping:
     *
     * <ul>
     *   <li>no clause / {@code urfNone} / {@code urfAll}: {@code false}</li>
     *   <li>{@code urfDistinct}: {@code true}</li>
     *   <li>{@code urfUnique}: {@code true} — Oracle treats
     *       {@code SELECT UNIQUE} as a deprecated synonym for
     *       {@code SELECT DISTINCT}; both produce the same row-set.</li>
     *   <li>{@code urfDistinctOn}: admits (slice 73). Returns
     *       {@code true} for the boolean flag; the
     *       {@code DISTINCT ON (cols)} partition keys are collected
     *       separately by
     *       {@link #buildDistinctOnColumnRefs(TSelectSqlStatement,
     *       NameBindingProvider)} so the column-ref collection runs
     *       AFTER {@code UsingScope} is installed (matching the timing
     *       of {@link #buildGroupByColumnRefs} and friends).</li>
     *   <li>{@code urfDistinctRow}, {@code urfNormalize}: rejected
     *       (vendor-specific; not yet a documented IR shape).</li>
     *   <li>null filter on a non-null {@code TSelectDistinct}, or a
     *       new enum value the switch hasn't seen yet: rejected, so a
     *       future {@code EUniqueRowFilterType} addition fails loudly
     *       rather than silently classifying as {@code distinct=false}.</li>
     * </ul>
     */
    private static boolean resolveDistinctFlag(TSelectSqlStatement select) {
        TSelectDistinct sd = select.getSelectDistinct();
        if (sd == null) return false;
        EUniqueRowFilterType urf = sd.getUniqueRowFilter();
        if (urf == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.SELECT_ROW_FILTER_NULL,
                    "SELECT row-filter is null; expected one of "
                            + "{none, all, distinct, unique}", select));
        }
        switch (urf) {
            case urfNone:
            case urfAll:
                return false;
            case urfDistinct:
            case urfUnique:        // Oracle deprecated synonym for DISTINCT
            case urfDistinctOn:    // slice 73: refs collected separately
                return true;
            case urfDistinctRow:
            case urfNormalize:
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SELECT_ROW_FILTER_NOT_SUPPORTED,
                        "SELECT row-filter " + urf + " is not supported yet", select));
            default:
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.SELECT_ROW_FILTER_UNKNOWN,
                        "unknown SELECT row-filter " + urf, select));
        }
    }

    /**
     * Slice 73: collect physical column references from a
     * {@code SELECT DISTINCT ON (cols)} expression list. Returns the
     * empty list for plain {@code DISTINCT}, {@code UNIQUE},
     * {@code ALL}, and the no-filter case. Only PostgreSQL and
     * Greenplum expose {@code urfDistinctOn} with a populated
     * {@link TSelectDistinct#getExpressionList()}; Oracle, MySQL, and
     * Redshift silently drop the {@code ON (...)} clause and parse the
     * SELECT as plain {@code DISTINCT}, so this helper returns
     * {@code []} for those vendors regardless of the surface SQL.
     *
     * <p>Mirrors {@link #buildGroupByColumnRefs}: subqueries and window
     * functions in the expression list are rejected BEFORE
     * {@link #collectColumnRefs} descends, so inner-scope refs cannot
     * leak into {@code distinctOnColumnRefs}. Compound expressions
     * ({@code a + b}, {@code CASE WHEN ...}) and aggregate arguments
     * ({@code COUNT(x)}) are descended into so the underlying column
     * refs are captured.
     */
    private static List<ColumnRef> buildDistinctOnColumnRefs(
            TSelectSqlStatement select, NameBindingProvider provider) {
        TSelectDistinct sd = select.getSelectDistinct();
        if (sd == null
                || sd.getUniqueRowFilter() != EUniqueRowFilterType.urfDistinctOn) {
            return new ArrayList<>();
        }
        TExpressionList el = sd.getExpressionList();
        if (el == null || el.size() == 0) {
            // PG grammar requires at least one expression after
            // DISTINCT ON (; this branch is defensive — surface a
            // clear diagnostic rather than silently emit [].
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.DISTINCT_ON_EMPTY_COLUMN_LIST,
                    "DISTINCT ON requires at least one expression but the "
                            + "AST exposes an empty list", sd));
        }
        // Iterate items explicitly so each per-expression reject
        // diagnostic points at the offending expression. Equivalent
        // to running containsAnySubquery / rejectWindowFunctionInScope
        // / collectColumnRefs on the whole list (TExpressionList
        // inherits TParseTreeNodeList.acceptChildren which already
        // iterates element children), but the loop body gives
        // clearer rejection sites and lets us dedup refs across
        // expressions in declaration order.
        List<ColumnRef> refs = new ArrayList<>();
        for (int i = 0; i < el.size(); i++) {
            TExpression expr = el.getExpression(i);
            if (containsAnySubqueryExpression(expr)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DISTINCT_ON_HAS_SUBQUERY_NOT_SUPPORTED,
                        "DISTINCT ON expression list contains a subquery; "
                                + "subqueries in DISTINCT ON are not supported yet", sd));
            }
            rejectWindowFunctionInScope(expr, "DISTINCT ON expression list");
            for (ColumnRef ref : collectColumnRefs(expr, provider)) {
                if (!refs.contains(ref)) refs.add(ref);
            }
        }
        return refs;
    }

    private static boolean hasNoFromSource(TSelectSqlStatement select) {
        return select.joins == null || select.joins.size() == 0;
    }

    private static boolean allResultColumnsAreConstantExpressions(TSelectSqlStatement select) {
        TResultColumnList rcl = select.getResultColumnList();
        if (rcl == null || rcl.size() == 0) return false;
        for (int i = 0; i < rcl.size(); i++) {
            TResultColumn rc = rcl.getResultColumn(i);
            if (rc == null || rc.getExpr() == null || !isConstantExpression(rc.getExpr())) {
                return false;
            }
        }
        return true;
    }

    private static List<ColumnRef> buildGroupByColumnRefs(TSelectSqlStatement select, NameBindingProvider provider) {
        TGroupBy groupBy = select.getGroupByClause();
        if (groupBy == null || groupBy.getItems() == null || groupBy.getItems().size() == 0) {
            return new ArrayList<>();
        }
        TGroupByItemList items = groupBy.getItems();
        // Slice 127: flatten plain, ROLLUP, CUBE, and GROUPING SETS items
        // into the set of grouping expressions before guarding/collecting.
        // A plain visitor over {@code items} silently drops every column
        // inside a compound grouping element, because the AST visitor links
        // are broken there: {@link TGroupByItem#acceptChildren} descends
        // ONLY into its plain {@code expr} (not {@code rollupCube},
        // {@code groupingSet}, or {@code exprList}), and
        // {@link TRollupCube#acceptChildren} /
        // {@link TGroupingExpressionItem#acceptChildren} do not descend at
        // all. Pre-slice-127, `GROUP BY ROLLUP(a, c)` produced empty
        // groupByColumnRefs and a subquery/window function buried inside a
        // compound element bypassed the slice-61/slice-13 guards. We do NOT
        // patch the shared AST {@code acceptChildren} methods (that would
        // ripple into dlineage / resolver); the fix is localized here.
        List<TExpression> groupingExprs = flattenGroupByExpressions(items);
        // Slice 61: reject subqueries in GROUP BY before column collection
        // descends into them. Pre-slice-61, queries such as `SELECT 1
        // FROM employees GROUP BY (SELECT id FROM departments)` reached
        // the constant-only projection guard and failed there; with the
        // slice-61 lift the projection now builds and the GROUP BY
        // collection would leak `departments.id` into groupByColumnRefs
        // even though `departments` is not in {@code relations}, breaking
        // the IR invariant that column refs reference an in-scope
        // relation. Mirrors the WHERE / HAVING / ORDER BY subquery guards.
        // Slice 127 runs the guard over the flattened expressions so a
        // subquery inside ROLLUP/CUBE/GROUPING SETS is also rejected; the
        // anchor stays the {@code groupBy} node for contract stability.
        for (TExpression e : groupingExprs) {
            if (containsAnySubquery(e)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.GROUP_BY_HAS_SUBQUERY_NOT_SUPPORTED,
                        "GROUP BY clause contains a subquery; subqueries in "
                                + "GROUP BY are not supported yet", groupBy));
            }
        }
        // Slice 13: reject window functions in GROUP BY before collection
        // (slice 127 runs the guard over the flattened expressions).
        for (TExpression e : groupingExprs) {
            rejectWindowFunctionInScope(e, "GROUP BY clause");
        }
        // Visitor-based collection ensures column refs in any nested
        // expression (e.g. GROUP BY date_trunc('day', t)) are captured.
        //
        // Slice 127: collect with the Phase-1 source-table fallback enabled.
        // Resolver2's Phase-2 GROUP BY scope builder (processGroupBy) only
        // resolves columns inside a plain {@code item.getExpr()}; columns
        // inside ROLLUP / CUBE never reach processColumnReferences, so they
        // carry {@code resolution == null}. The slice-93 fallback promotes
        // such refs to EXACT_MATCH when Phase 1's linkColumnToTable has set
        // a source table and the SQL-written qualifier (if any) is
        // consistent with it — exactly the Hive multi-insert situation the
        // facet was built for. Plain grouping columns ARE resolved by
        // Resolver2 ({@code resolution != null}), so the fallback is inert
        // for them and the plain-GROUP-BY contract is unchanged.
        return collectColumnRefsFromExpressions(
                groupingExprs, provider.withSourceTableFallback(true));
    }

    /**
     * Flatten a {@link TGroupByItemList} into the ordered list of leaf
     * grouping {@link TExpression}s, descending into ROLLUP / CUBE /
     * GROUPING SETS compound elements that the AST visitor does not reach
     * (slice 127). Leaves are emitted in left-to-right document order.
     *
     * <p>Each {@link TGroupByItem} carries exactly one (mutually exclusive
     * per its {@code init}) of: a plain {@code expr}, an {@code exprList}
     * (parenthesized {@code GROUP BY (a, b)}), a {@link TRollupCube}
     * (ROLLUP / CUBE), or a {@link TGroupingSet} (GROUPING SETS). Per-item
     * descent into the compound forms uses an explicit stack (no recursion,
     * per the repo iterative-traversal rule) with reverse-push so leaves
     * pop in document order.
     */
    private static List<TExpression> flattenGroupByExpressions(TGroupByItemList items) {
        List<TExpression> out = new ArrayList<>();
        for (int i = 0; i < items.size(); i++) {
            TGroupByItem item = items.getGroupByItem(i);
            if (item == null) {
                continue;
            }
            flattenGroupByItem(item, out);
        }
        return out;
    }

    /**
     * Flatten a single {@link TGroupByItem} into the ordered list of leaf
     * grouping {@link TExpression}s, appending to {@code out}. Extracted
     * from {@link #flattenGroupByExpressions} (slice 127) so slice 128's
     * {@link #buildGroupingElements} can collect the member columns of one
     * top-level grouping element independently. Descent into ROLLUP / CUBE
     * / GROUPING SETS uses an explicit stack (no recursion, per the repo
     * iterative-traversal rule) with reverse-push so leaves pop in
     * document order.
     */
    private static void flattenGroupByItem(TGroupByItem item, List<TExpression> out) {
        if (item == null) {
            return;
        }
        if (item.getExpr() != null) {
            out.add(item.getExpr());
        }
        addExpressionListItems(item.getExprList(), out);
        Deque<TParseTreeNode> stack = new ArrayDeque<>();
        if (item.getRollupCube() != null) {
            stack.push(item.getRollupCube());
        }
        if (item.getGroupingSet() != null) {
            stack.push(item.getGroupingSet());
        }
        while (!stack.isEmpty()) {
            TParseTreeNode node = stack.pop();
            if (node instanceof TRollupCube) {
                addExpressionListItems(((TRollupCube) node).getItems(), out);
            } else if (node instanceof TGroupingSet) {
                TGroupingSetItemList gsItems = ((TGroupingSet) node).getItems();
                if (gsItems != null) {
                    // reverse-push so set items pop in document order
                    for (int j = gsItems.size() - 1; j >= 0; j--) {
                        TGroupingSetItem gsi = gsItems.getGroupingSetItem(j);
                        if (gsi != null) {
                            stack.push(gsi);
                        }
                    }
                }
            } else if (node instanceof TGroupingSetItem) {
                TGroupingSetItem gsi = (TGroupingSetItem) node;
                // exactly one payload per item; add direct exprs, push
                // the compound child so its leaves emerge in order.
                if (gsi.getGrouping_expression() != null) {
                    out.add(gsi.getGrouping_expression());
                }
                if (gsi.getExpressionItem() != null) {
                    stack.push(gsi.getExpressionItem());
                }
                if (gsi.getRollupCubeClause() != null) {
                    stack.push(gsi.getRollupCubeClause());
                }
            } else if (node instanceof TGroupingExpressionItem) {
                TGroupingExpressionItem gei = (TGroupingExpressionItem) node;
                if (gei.getExpr() != null) {
                    out.add(gei.getExpr());
                }
                addExpressionListItems(gei.getExprList(), out);
            }
        }
    }

    /**
     * Slice 128 — build the structured per-top-level-element view of the
     * {@code GROUP BY}: one {@link GroupingElement} per top-level
     * {@link TGroupByItem} in document order, tagged
     * {@code SIMPLE} / {@code ROLLUP} / {@code CUBE} / {@code GROUPING_SETS}
     * (via {@link #groupingElementKind}) and carrying that element's
     * flattened leaf member columns.
     *
     * <p>Returns an empty list when there is no {@code GROUP BY}. Runs
     * <i>after</i> {@link #buildGroupByColumnRefs} in the SELECT builder, so
     * the slice-61 subquery and slice-13 window-function guards have already
     * rejected illegal grouping expressions and the per-element member
     * collection (which reuses {@link #collectColumnRefsFromExpressions}
     * with the slice-93 source-table fallback, exactly as the flat path
     * does) cannot newly throw. Per-element collection means a column
     * appearing in two top-level elements (e.g.
     * {@code GROUP BY a, ROLLUP(a)}) is faithfully present in both — the
     * flat {@link #buildGroupByColumnRefs} dedups it to a single ref, which
     * is the intended difference between the two slots.
     */
    private static List<GroupingElement> buildGroupingElements(
            TSelectSqlStatement select, NameBindingProvider provider) {
        TGroupBy groupBy = select.getGroupByClause();
        if (groupBy == null || groupBy.getItems() == null || groupBy.getItems().size() == 0) {
            return new ArrayList<>();
        }
        TGroupByItemList items = groupBy.getItems();
        NameBindingProvider fallbackProvider = provider.withSourceTableFallback(true);
        List<GroupingElement> out = new ArrayList<>();
        for (int i = 0; i < items.size(); i++) {
            TGroupByItem item = items.getGroupByItem(i);
            if (item == null) {
                continue;
            }
            List<TExpression> exprs = new ArrayList<>();
            flattenGroupByItem(item, exprs);
            List<ColumnRef> members = collectColumnRefsFromExpressions(exprs, fallbackProvider);
            out.add(new GroupingElement(groupingElementKind(item), members));
        }
        return out;
    }

    /**
     * Classify the grouping operation of a single top-level
     * {@link TGroupByItem} (slice 128). The authoritative signals are the
     * AST node-presence checks: a non-null {@code groupingSet} is
     * {@code GROUPING SETS}; a non-null {@code rollupCube} carries its own
     * {@code rollup} / {@code cube} / {@code grouping_sets} operation
     * (BigQuery spells {@code GROUPING SETS} as a {@link TRollupCube} with
     * the {@code grouping_sets} operation). The
     * {@link EGroupingSetType} flag is a defensive fallback for any form
     * that sets the flag without populating the node; {@code gsExpr} /
     * {@code gsList} / {@code gsEmpty} and anything unrecognized fall
     * through to {@code SIMPLE} (the plain {@code expr} / {@code exprList}
     * grouping path).
     */
    private static GroupingElement.Kind groupingElementKind(TGroupByItem item) {
        if (item.getGroupingSet() != null) {
            return GroupingElement.Kind.GROUPING_SETS;
        }
        TRollupCube rc = item.getRollupCube();
        if (rc != null) {
            switch (rc.getOperation()) {
                case TRollupCube.cube:
                    return GroupingElement.Kind.CUBE;
                case TRollupCube.grouping_sets:
                    return GroupingElement.Kind.GROUPING_SETS;
                case TRollupCube.rollup:
                default:
                    return GroupingElement.Kind.ROLLUP;
            }
        }
        EGroupingSetType gst = item.getGroupingSetType();
        if (gst != null) {
            switch (gst) {
                case gsRollup:
                    return GroupingElement.Kind.ROLLUP;
                case gsCube:
                    return GroupingElement.Kind.CUBE;
                case gsSets:
                    return GroupingElement.Kind.GROUPING_SETS;
                default:
                    break;
            }
        }
        return GroupingElement.Kind.SIMPLE;
    }

    /** Append every {@link TExpression} of {@code list} (if any) to {@code out}. */
    private static void addExpressionListItems(TExpressionList list, List<TExpression> out) {
        if (list == null) {
            return;
        }
        for (int j = 0; j < list.size(); j++) {
            TExpression e = list.getExpression(j);
            if (e != null) {
                out.add(e);
            }
        }
    }

    /**
     * Multi-root variant of {@link #collectColumnRefs}: collect EXACT_MATCH
     * physical {@link ColumnRef}s from each expression root in order, with
     * the same {@code nestedSelectDepth} guard, USING merged-key handling
     * via {@link #appendMergedOrBoundColumnRef}, {@link LinkedHashSet}
     * dedup, and {@code COLUMN_BINDING_NON_EXACT} rejection. Used by
     * {@link #buildGroupByColumnRefs} over the slice-127 flattened
     * ROLLUP / CUBE / GROUPING SETS grouping expressions.
     */
    private static List<ColumnRef> collectColumnRefsFromExpressions(
            List<TExpression> exprs, final NameBindingProvider provider) {
        final LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        final List<String> rejects = new ArrayList<>();
        // True if any reject is a QUALIFIED column miss (e.g. b.id pointing at
        // the wrong side). Such a miss is a genuine error and must stay fatal;
        // only all-unqualified rejects are eligible for the join-graph degrade.
        final boolean[] sawQualifiedReject = {false};
        TParseTreeVisitor visitor = new TParseTreeVisitor() {
            int nestedSelectDepth = 0;

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TObjectName node) {
                if (nestedSelectDepth > 0) return;
                appendMergedOrBoundColumnRef(node, provider, refs, rejects,
                        sawQualifiedReject);
            }
        };
        for (TExpression e : exprs) {
            e.acceptChildren(visitor);
        }
        if (!rejects.isEmpty()) {
            rejectNonExactBindings(rejects, provider, !sawQualifiedReject[0]);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Collect physical column references from the {@code HAVING} clause.
     *
     * <p>HAVING is supported regardless of whether {@code GROUP BY} is
     * present: standard SQL allows {@code HAVING} without {@code GROUP BY}
     * (the whole result set is treated as a single group), and the parser
     * still attaches a {@link TGroupBy} node with empty
     * {@code getItems()} in that case. Both shapes flow through the same
     * collection path.
     *
     * <p>Per-shape rejections fire <i>before</i> {@link #collectColumnRefs}
     * so subquery / OVER children never enter the visitor and can't leak
     * inner-scope refs into {@code havingColumnRefs} (mirrors slice-9
     * ORDER BY guards):
     *
     * <ul>
     *   <li>Scalar subqueries ({@link EExpressionType#subquery_t}) and
     *       predicate subqueries ({@code EXISTS}, {@code IN (SELECT ...)},
     *       {@code ANY/ALL/SOME}) — checked via both expression-type and
     *       {@link TExpression#getSubQuery()}, deep-scanned through the
     *       whole HAVING expression subtree.</li>
     *   <li>Window functions ({@code OVER (...)}) — standard SQL forbids
     *       window functions in HAVING, but defense in depth: the
     *       deep-scan rejecter ensures PARTITION BY / OVER ORDER BY refs
     *       can't leak.</li>
     * </ul>
     *
     * <p>Aggregate functions in HAVING are <i>not</i> rejected — they're
     * the most common HAVING shape ({@code HAVING SUM(salary) > 1000}).
     * The visitor walks into the aggregate's argument list and captures
     * the underlying column ref ({@code salary}) the same way slice 6
     * does for projection-side aggregate args.
     */
    private static List<ColumnRef> buildHavingColumnRefs(TSelectSqlStatement select,
                                                        NameBindingProvider provider) {
        TGroupBy groupBy = select.getGroupByClause();
        if (groupBy == null) return new ArrayList<>();
        TExpression having = groupBy.getHavingClause();
        if (having == null) return new ArrayList<>();
        rejectHavingScalarSubquery(having);
        rejectHavingWindowFunction(having);
        return collectColumnRefs(having, provider);
    }

    /**
     * Reject HAVING expressions that contain a subquery anywhere in the
     * subtree. Catches both:
     *
     * <ul>
     *   <li>Scalar subqueries ({@link EExpressionType#subquery_t}) —
     *       e.g. {@code HAVING (SELECT MAX(salary) FROM employees) > 0}.</li>
     *   <li>Predicate subqueries ({@code EXISTS}, {@code IN (SELECT ...)},
     *       {@code ANY/ALL/SOME (SELECT ...)}) — these don't appear as
     *       {@code subquery_t} expression nodes but carry a non-null
     *       {@link TExpression#getSubQuery()}, e.g.
     *       {@code HAVING EXISTS (SELECT 1 FROM ...)} or
     *       {@code HAVING d.id IN (SELECT id FROM ...)}.</li>
     * </ul>
     *
     * <p>Mirrors {@link #rejectOrderByScalarSubquery}: top-level fast
     * path + visitor deep-scan over {@link TExpression#acceptChildren}.
     * The deep scan is required for nested cases like
     * {@code HAVING flag = 1 AND EXISTS (SELECT ...)} or
     * {@code HAVING CASE WHEN d.id IN (SELECT ...) THEN 1 ELSE 0 END > 0}.
     */
    private static void rejectHavingScalarSubquery(TExpression having) {
        if (having.getExpressionType() == EExpressionType.subquery_t
                || having.getSubQuery() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.HAVING_SUBQUERY_NOT_SUPPORTED,
                    "HAVING subquery '" + having + "' is not supported yet "
                            + "(subqueries in HAVING would leak inner column refs)", having));
        }
        final boolean[] found = {false};
        having.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TExpression e) {
                if (found[0]) return;
                if (e.getExpressionType() == EExpressionType.subquery_t
                        || e.getSubQuery() != null) {
                    found[0] = true;
                }
            }
        });
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.HAVING_HAS_SUBQUERY_NOT_SUPPORTED,
                    "HAVING expression '" + having + "' contains a subquery "
                            + "(scalar, EXISTS, IN, or ANY/ALL/SOME); not supported yet", having));
        }
    }

    /**
     * Reject HAVING expressions that contain a window function. Standard
     * SQL forbids window functions in HAVING (analytic functions are
     * computed after HAVING), but defense in depth: the visitor would
     * descend into {@code OVER (PARTITION BY ... ORDER BY ...)} and the
     * inner-scope refs would otherwise leak into {@code havingColumnRefs}.
     * Mirrors the projection-side {@link #rejectWindowFunctions} and the
     * ORDER BY-side {@link #rejectOrderByWindowFunction}.
     */
    private static void rejectHavingWindowFunction(TExpression having) {
        final boolean[] found = {false};
        having.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (fn.getWindowDef() != null) found[0] = true;
            }
        });
        if (!found[0] && having.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = having.getFunctionCall();
            if (fn != null && fn.getWindowDef() != null) found[0] = true;
        }
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.HAVING_WINDOW_FUNCTION_NOT_SUPPORTED,
                    "HAVING window function '" + having + "' is not supported yet "
                            + "(window OVER (...) refs would leak into havingColumnRefs)", having));
        }
    }

    /**
     * Slice 125: collect physical column references from a {@code QUALIFY}
     * clause's predicate (Snowflake / BigQuery / Teradata). QUALIFY filters
     * rows on window-function results; like {@code WHERE} / {@code HAVING}
     * it is row-influence, so its refs are captured into
     * {@link StatementGraph#getQualifyColumnRefs()}.
     *
     * <p>Two surface forms are admitted and reduce to the SAME influencing
     * base columns:
     * <ul>
     *   <li>Inline window form
     *       ({@code QUALIFY ROW_NUMBER() OVER (PARTITION BY a ORDER BY b) = 1})
     *       — the window's PARTITION BY / ORDER BY / argument refs bind as
     *       base columns and are collected directly; the function-name
     *       node and {@code *} are skipped.</li>
     *   <li>Projection-alias form ({@code QUALIFY rn = 1}) — the parser
     *       leaves {@code rn} as a bare {@code column}-typed
     *       {@link TObjectName} (it is NOT retyped to {@code column_alias}
     *       the way ORDER BY operands are), so it does not bind to a base
     *       column; it resolves to the matching {@link OutputColumn} and
     *       contributes that output's {@code getSources()} unioned with its
     *       window spec's partition/order refs.</li>
     * </ul>
     *
     * <p>Window functions are admitted (the whole point of QUALIFY) and are
     * NOT validated against the slice-13 projection window-function
     * allowlist — QUALIFY collects only the refs that influence the row
     * set; it does not build a {@link WindowSpec}. Subqueries (scalar,
     * EXISTS, IN-SELECT, ANY/ALL/SOME) are rejected before ref collection
     * (they would leak inner-scope refs), reusing the repurposed
     * {@link DiagnosticCode#QUALIFY_NOT_SUPPORTED} code.
     */
    private static List<ColumnRef> buildQualifyColumnRefs(TSelectSqlStatement select,
                                                          NameBindingProvider provider,
                                                          List<OutputColumn> outputColumns) {
        if (select.getQualifyClause() == null) {
            return new ArrayList<>();
        }
        TExpression qualify = select.getQualifyClause().getSearchConditoin();
        if (qualify == null) {
            return new ArrayList<>();
        }
        rejectQualifySubquery(qualify);
        rejectUnsupportedQualifyWindowFunction(qualify);
        return collectQualifyColumnRefs(qualify, provider, outputColumns);
    }

    /**
     * Slice 126: validate the function NAME of any INLINE window function
     * inside a {@code QUALIFY} predicate against the slice-13
     * {@link #WINDOW_FUNCTION_NAMES} allowlist. Slice 125 admitted any
     * function in QUALIFY (collecting only its influencing refs); this guard
     * applies the same name check {@link #buildWindowOutputColumn} uses for
     * projection windows so an unfamiliar windowed function whose semantics
     * the engine does not model — {@code QUALIFY FOO(a) OVER (ORDER BY b) = 1}
     * — rejects with {@link DiagnosticCode#WINDOW_FUNCTION_UNSUPPORTED}
     * instead of silently admitting.
     *
     * <p>An INLINE window function is a {@link TFunctionCall} carrying
     * {@code OVER (...)} ({@code getWindowDef() != null}). This is the SAME
     * signal {@code buildWindowOutputColumn} keys on. Non-window functions
     * are deliberately left alone:
     * <ul>
     *   <li>a plain UDF / scalar call with no {@code OVER}
     *       ({@code QUALIFY my_udf(a) = 1}), and</li>
     *   <li>a non-windowed aggregate ({@code QUALIFY SUM(a) = 1})</li>
     * </ul>
     * both have {@code getWindowDef() == null} and stay admitted — slice 126
     * validates window-function NAMES, it does not require QUALIFY to contain
     * a window function (that would be a broader semantic rule outside this
     * slice). The projection-alias form ({@code QUALIFY rn = 1}) carries no
     * {@link TFunctionCall} in the QUALIFY expression (the window function
     * lives in the projection, already slice-13 validated), so the guard is a
     * no-op there.
     *
     * <p>Nested SELECTs are skipped (a window function in an inner scope is
     * not this statement's QUALIFY window). In practice none survive —
     * {@link #rejectQualifySubquery} runs first and rejects any subquery — but
     * the {@code nestedSelectDepth} guard mirrors
     * {@link #collectQualifyColumnRefs} for defense-in-depth and parity.
     *
     * <p>Reuses the existing {@link DiagnosticCode#WINDOW_FUNCTION_UNSUPPORTED}
     * code (already reached by {@link #buildWindowOutputColumn}) so the
     * DiagnosticCode count stays unchanged.
     */
    private static void rejectUnsupportedQualifyWindowFunction(TExpression qualify) {
        qualify.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TFunctionCall fn) {
                if (nestedSelectDepth > 0) return;
                if (fn.getWindowDef() == null) return;
                String fnName = fn.getFunctionName() == null
                        ? null : fn.getFunctionName().toString();
                if (fnName == null
                        || !WINDOW_FUNCTION_NAMES.contains(fnName.toLowerCase(Locale.ROOT))) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_UNSUPPORTED,
                            "QUALIFY uses unsupported window function '" + fnName
                                    + "'; supported names are " + WINDOW_FUNCTION_NAMES, fn));
                }
            }
        });
    }

    /**
     * Reject {@code QUALIFY} expressions that contain a subquery anywhere
     * in the subtree — scalar ({@link EExpressionType#subquery_t}) or
     * predicate ({@code EXISTS}, {@code IN (SELECT ...)},
     * {@code ANY/ALL/SOME}, carried via {@link TExpression#getSubQuery()}).
     * Mirrors {@link #rejectHavingScalarSubquery}: top-level fast path plus
     * a visitor deep-scan. Reuses the (slice-125-repurposed)
     * {@link DiagnosticCode#QUALIFY_NOT_SUPPORTED} code so the
     * DiagnosticCode count stays unchanged and the code stays reached.
     */
    private static void rejectQualifySubquery(TExpression qualify) {
        boolean topLevelSubquery = qualify.getExpressionType() == EExpressionType.subquery_t
                || qualify.getSubQuery() != null;
        final boolean[] found = {topLevelSubquery};
        if (!found[0]) {
            qualify.acceptChildren(new TParseTreeVisitor() {
                @Override
                public void preVisit(TExpression e) {
                    if (found[0]) return;
                    if (e.getExpressionType() == EExpressionType.subquery_t
                            || e.getSubQuery() != null) {
                        found[0] = true;
                    }
                }
            });
        }
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.QUALIFY_NOT_SUPPORTED,
                    "QUALIFY subquery '" + qualify + "' is not supported yet "
                            + "(subqueries in QUALIFY would leak inner column refs)", qualify));
        }
    }

    /**
     * Slice 125: QUALIFY-specific column-ref collector. Mirrors
     * {@link #collectColumnRefs} / {@link #appendMergedOrBoundColumnRef}
     * (nested-SELECT skip, UsingScope merged-key expansion, EXACT_MATCH
     * binding) but adds a projection-alias fallback: an unqualified
     * {@code column}-typed {@link TObjectName} that does not bind to a base
     * column but matches an {@link OutputColumn} name resolves to that
     * output's influencing base columns ({@code getSources()} unioned with
     * its window spec's partition/order refs). This captures the canonical
     * {@code QUALIFY rn = 1} form, where {@code rn} aliases a window
     * projection whose own {@code getSources()} is empty.
     */
    private static List<ColumnRef> collectQualifyColumnRefs(TExpression qualify,
                                                            final NameBindingProvider provider,
                                                            final List<OutputColumn> outputColumns) {
        final LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        final List<String> rejects = new ArrayList<>();
        // True if any reject is a QUALIFIED column miss (e.g. b.id pointing at
        // the wrong side). Such a miss is a genuine error and must stay fatal;
        // only all-unqualified rejects are eligible for the join-graph degrade.
        final boolean[] sawQualifiedReject = {false};
        qualify.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TObjectName node) {
                if (nestedSelectDepth > 0) return;
                if (node.getDbObjectType() != EDbObjectType.column) return;
                String name = node.getColumnNameOnly();
                if (name == null || "*".equals(name)) return;
                UsingScope scope = provider.getUsingScope();
                String qualifier = node.getTableString();
                boolean unqualified = qualifier == null || qualifier.isEmpty();
                if (unqualified && scope.has(name)) {
                    if (scope.isAmbiguous(name)) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.UNQUALIFIED_COLUMN_AMBIGUOUS,
                                "unqualified reference to '" + name + "' is ambiguous: "
                                        + scope.ambiguityReason(name)
                                        + "; qualify with a table alias", null));
                    }
                    refs.addAll(scope.mergedSourcesFor(name));
                    return;
                }
                ColumnBinding binding = provider.bindColumn(node);
                if (binding != null && binding.getStatus() == ResolutionStatus.EXACT_MATCH) {
                    refs.add(new ColumnRef(binding.getRelationAlias(), binding.getColumnName()));
                    return;
                }
                // Base-column binding failed. Projection-alias fallback:
                // an unqualified name that matches an output column's name
                // (case-insensitive) resolves to that output's influencing
                // base columns. QUALIFY (post-window) can reference SELECT
                // aliases in Snowflake / BigQuery.
                if (unqualified) {
                    List<ColumnRef> aliasSources = resolveQualifyProjectionAlias(name, outputColumns);
                    if (aliasSources != null) {
                        refs.addAll(aliasSources);
                        return;
                    }
                    // Catalog-less NATURAL JOIN degrade (GSP R6): unqualified
                    // merged NATURAL key resolves to the left-side relation.
                    if (scope.hasNaturalDegrade()) {
                        refs.add(new ColumnRef(scope.naturalDegradeFallbackAlias(), name));
                        return;
                    }
                }
                rejects.add(node + (binding == null ? "[no binding]"
                        : "[" + binding.getStatus() + "]"));
                if (!unqualified) {
                    sawQualifiedReject[0] = true;
                }
            }
        });
        if (!rejects.isEmpty()) {
            rejectNonExactBindings(rejects, provider, !sawQualifiedReject[0]);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 125: resolve an unqualified QUALIFY reference name to the
     * influencing base columns of the matching projection output column.
     * The influencing columns are the output's
     * {@link OutputColumn#getSources()} unioned with its window spec's
     * {@link WindowSpec#getPartitionRefs()} and
     * {@link WindowSpec#getOrderRefs()} — a window output's own
     * {@code getSources()} is empty, so the partition/order refs are where
     * the row-influencing base columns live.
     *
     * <p>Return contract (the caller distinguishes the two non-throwing
     * cases by {@code null} vs empty):
     * <ul>
     *   <li>{@code null} — no output column matches by name; the caller
     *       records a {@code COLUMN_BINDING_NON_EXACT} reject.</li>
     *   <li>non-empty list — the matched output's influencing base
     *       columns.</li>
     *   <li><b>empty list</b> — an output matched but it has no influencing
     *       base columns (a constant projection such as {@code SELECT 1 AS x}
     *       referenced by {@code QUALIFY x = 1}, or any sourceless /
     *       window-less projection). This is an admitted, deliberate
     *       boundary: a QUALIFY predicate over a column-free output has no
     *       column dependency, exactly like a constant {@code WHERE 1 = 1}
     *       contributes no filter refs. It is NOT treated as a reject — the
     *       ref resolves successfully and simply contributes no base-column
     *       dependency.</li>
     * </ul>
     *
     * <p>Match strategy: case-insensitive ({@link Locale#ROOT}), FIRST
     * (leftmost) match — identical to {@link #tryResolveOrderByProjectionAlias}.
     * Duplicate projection aliases ({@code SELECT a AS rn, b AS rn ...
     * QUALIFY rn = 1}) therefore resolve to the leftmost projection rather
     * than rejecting as ambiguous; this is the documented slice-69 ORDER BY
     * boundary applied to QUALIFY for cross-clause consistency.
     *
     * <p>Resolution order in the caller is base-column-first: a name that
     * binds {@code EXACT_MATCH} to a base column is emitted directly and
     * never reaches this fallback, which fires only for an UNQUALIFIED ref
     * whose base binding failed. A qualified ref ({@code QUALIFY e.rn}) is
     * never alias-resolved here (qualifying a projection alias is invalid
     * SQL); it binds through the provider like any other qualified ref.
     */
    private static List<ColumnRef> resolveQualifyProjectionAlias(String name,
                                                                 List<OutputColumn> outputColumns) {
        String key = name.toLowerCase(Locale.ROOT);
        for (OutputColumn oc : outputColumns) {
            String outName = oc.getName();
            if (outName != null && outName.toLowerCase(Locale.ROOT).equals(key)) {
                LinkedHashSet<ColumnRef> influencing = new LinkedHashSet<>(oc.getSources());
                WindowSpec ws = oc.getWindowSpec();
                if (ws != null) {
                    influencing.addAll(ws.getPartitionRefs());
                    influencing.addAll(ws.getOrderRefs());
                }
                return new ArrayList<>(influencing);
            }
        }
        return null;
    }

    /**
     * Collect physical column references from {@code ORDER BY} sort keys.
     *
     * <p>Per-item validation rejects shapes that would otherwise vanish
     * silently into an empty ref list, leak inner-scope refs, or
     * misrepresent presentation as a dependency:
     *
     * <ul>
     *   <li>Ordinal references ({@code ORDER BY 1}) — the sort key is a
     *       {@link EExpressionType#simple_constant_t}; its meaning is
     *       "first projected column" which depends on the SELECT list,
     *       not on a base column. A future slice can model output-position
     *       references explicitly.</li>
     *   <li>Constant sort keys other than ordinals ({@code ORDER BY 'x'},
     *       and the compound {@code ORDER BY (1)} / {@code ORDER BY 1+0}
     *       caught by the generic no-physical-column-refs check).</li>
     *   <li>Projection-alias references ({@code ORDER BY x} where
     *       {@code x} is a SELECT alias) — {@link TOrderByItem#doParse}
     *       retypes the operand to {@link TObjectName#ttobjColumnAlias},
     *       which lowers {@link TObjectName#getDbObjectType()} to
     *       {@link EDbObjectType#column_alias}. Without explicit
     *       rejection the visitor would skip it and the IR would lose
     *       the dependency entirely. The deep-scan version of this
     *       check catches alias nodes nested inside expressions.</li>
     *   <li>Subqueries in sort keys — scalar
     *       ({@link EExpressionType#subquery_t}) and predicate
     *       ({@code EXISTS}, {@code IN (SELECT ...)}, {@code ANY/ALL/SOME})
     *       — would otherwise leak inner-scope column refs into the
     *       outer statement's {@code orderByColumnRefs}.</li>
     *   <li>Window functions in sort keys ({@code ORDER BY ROW_NUMBER()
     *       OVER (...)}) — the OVER clause descends through the visitor
     *       and would leak its PARTITION BY / ORDER BY refs.</li>
     * </ul>
     *
     * <p>Sub-clauses that change row-set semantics are also rejected
     * here: Oracle {@code ORDER SIBLINGS BY} (hierarchical, not yet
     * modelled), Teradata {@code RESET WHEN} (window-style restart),
     * and the {@link TOrderBy}-level {@code FETCH FIRST}/{@code OFFSET}
     * defensive guards (in fresh parses the SELECT-level row-limit
     * guards in {@link #rejectUnsupportedShape} fire first because
     * {@code TSelectSqlNode.setOrderbyClause()} copies in-clause OFFSET/
     * FETCH onto the SELECT node).
     *
     * <p>For everything else (qualified column refs, expressions like
     * {@code UPPER(name)}), {@link #collectColumnRefs} runs over each
     * sort key and aggregates the physical column refs. A per-item
     * empty-refs check catches anything that slipped past the explicit
     * shape rejections (e.g. {@code ORDER BY (1)},
     * {@code ORDER BY 1 + 0}). Sort direction ({@code ASC}/{@code DESC})
     * and null placement ({@code NULLS FIRST}/{@code NULLS LAST}) are
     * presentation metadata and are not modelled.
     */
    private static List<ColumnRef> buildOrderByColumnRefs(TSelectSqlStatement select,
                                                          NameBindingProvider provider,
                                                          List<OutputColumn> outputColumns) {
        TOrderBy orderBy = select.getOrderbyClause();
        if (orderBy == null) {
            return new ArrayList<>();
        }
        if (orderBy.isSiblings()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_SIBLINGS_BY_NOT_SUPPORTED,
                    "ORDER SIBLINGS BY is not supported yet "
                            + "(Oracle hierarchical ordering)", orderBy));
        }
        if (orderBy.getResetWhenCondition() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_RESET_WHEN_NOT_SUPPORTED,
                    "ORDER BY ... RESET WHEN is not supported yet "
                            + "(Teradata window-style restart)", orderBy));
        }
        // Slice 71: the in-clause OFFSET/FETCH on TOrderBy is no longer
        // rejected. MSSQL parsers duplicate OFFSET/FETCH onto BOTH the
        // SELECT node AND the TOrderBy node; slice 71 admits at the
        // SELECT level via buildRowLimit, so the TOrderBy duplicates
        // are simply ignored here. Oracle parsers populate only the
        // SELECT-level fields, so the TOrderBy fields are typically
        // null there.
        TOrderByItemList items = orderBy.getItems();
        if (items == null || items.size() == 0) {
            return new ArrayList<>();
        }
        // Validate + collect per item so a sort key contributing zero
        // column refs (e.g. constant arithmetic, parenthesised constant)
        // is rejected with an item-specific message instead of silently
        // disappearing.
        LinkedHashSet<ColumnRef> all = new LinkedHashSet<>();
        for (int i = 0; i < items.size(); i++) {
            TOrderByItem item = items.getOrderByItem(i);
            if (item == null) continue;
            TExpression sortKey = item.getSortKey();
            if (sortKey == null) continue;
            // Slice 68: positive-integer ordinals admit. The helper:
            //   - returns null when sortKey is not a positive-integer
            //     literal (caller falls through to the existing
            //     constant / alias / subquery / window rejecters and the
            //     standard ref collection);
            //   - returns the matching output column's sources list when
            //     sortKey IS a positive-integer literal in range;
            //   - throws ORDER_BY_ORDINAL_OUT_OF_RANGE when the ordinal
            //     is 0 or exceeds the output column count.
            // The sourceless-output case (e.g. SELECT 1 FROM t ORDER BY 1
            // or SELECT COUNT(*) FROM t ORDER BY 1) returns an empty
            // list and falls through to the per-item empty-refs guard
            // below, mirroring the existing ORDER BY COUNT(*) /
            // ORDER BY 1 + 0 rejection.
            List<ColumnRef> ordinalSources = tryResolveOrderByOrdinal(sortKey, outputColumns);
            if (ordinalSources != null) {
                if (ordinalSources.isEmpty()) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.ORDER_BY_NO_PHYSICAL_COLUMN_REFS,
                            "ORDER BY ordinal '" + sortKey
                                    + "' resolves to output column with no physical column references "
                                    + "(constant or sourceless aggregate output)", sortKey));
                }
                all.addAll(ordinalSources);
                continue;
            }
            // Slice 69: top-level projection-alias references admit. The
            // helper returns null for non-alias shapes; an empty list
            // (alias of a constant / sourceless aggregate) falls through
            // to ORDER_BY_NO_PHYSICAL_COLUMN_REFS, mirroring the slice-68
            // sourceless-ordinal handling. Deep-scan alias references
            // (e.g. ORDER BY UPPER(<alias>)) are still caught by
            // rejectOrderByAliasReference below.
            List<ColumnRef> aliasSources = tryResolveOrderByProjectionAlias(sortKey, outputColumns);
            if (aliasSources != null) {
                if (aliasSources.isEmpty()) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.ORDER_BY_NO_PHYSICAL_COLUMN_REFS,
                            "ORDER BY projection alias '" + sortKey
                                    + "' resolves to output column with no physical column references "
                                    + "(constant or sourceless aggregate output)", sortKey));
                }
                all.addAll(aliasSources);
                continue;
            }
            // Slice 68: non-ordinal constants stay rejected. The original
            // helper is preserved for the set-op outer path (which keeps
            // its ordinal/constant rejection until slice 72).
            rejectOrderByNonOrdinalConstant(sortKey);
            // Slice 69: top-level bare alias references are consumed by
            // tryResolveOrderByProjectionAlias above; this helper now only
            // catches DEEP alias references nested inside compound
            // expressions (e.g. ORDER BY UPPER(<alias>)).
            rejectOrderByAliasReference(sortKey);
            // Reject scalar subqueries and window functions BEFORE
            // collecting refs. The visitor descends into both, so without
            // these guards `ORDER BY (SELECT MAX(salary) FROM employees)`
            // and `ORDER BY ROW_NUMBER() OVER (ORDER BY salary)` would
            // leak inner refs into orderByColumnRefs as if the outer
            // statement physically depended on them.
            rejectOrderByScalarSubquery(sortKey);
            rejectOrderByWindowFunction(sortKey);
            List<ColumnRef> itemRefs = collectColumnRefs(item, provider);
            if (itemRefs.isEmpty()) {
                // Anything else that produces no physical column refs:
                // ORDER BY (1), ORDER BY 1+0, ORDER BY NULL, ORDER BY
                // CASE WHEN 1=1 THEN 'a' END, etc. Reject so the IR
                // doesn't silently emit empty refs.
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.ORDER_BY_NO_PHYSICAL_COLUMN_REFS,
                        "ORDER BY sort key '" + sortKey + "' has no physical column references "
                                + "(constant or non-column expressions are not supported yet)", sortKey));
            }
            all.addAll(itemRefs);
        }
        return new ArrayList<>(all);
    }

    /**
     * Slice 68: resolve a positive-integer ORDER BY ordinal to the matching
     * output column's sources. Returns:
     *
     * <ul>
     *   <li>{@code null} if {@code sortKey} is not a positive-integer
     *       literal (caller continues with the constant / alias / subquery
     *       / window rejecters and the standard ref collection);</li>
     *   <li>a {@link List} of {@link ColumnRef}s — the source list of the
     *       output column at position {@code v - 1} (1-based ordinals);</li>
     *   <li>throws {@link SemanticIRBuildException} with
     *       {@code ORDER_BY_ORDINAL_OUT_OF_RANGE} when {@code v} is 0 or
     *       exceeds the output column count.</li>
     * </ul>
     *
     * <p>{@code sortKey.getExpressionType() == simple_constant_t} for bare
     * positive integers; negative integers parse as a {@code unary_minus_t}
     * over a {@code simple_constant_t} and are not handled here. Compound
     * constant expressions ({@code ORDER BY 1 + 0}, {@code ORDER BY (1)})
     * are {@code arithmetic_*_t} / {@code parenthesis_t} respectively and
     * fall through to the per-item empty-refs guard.
     *
     * <p>The empty-list case (output column resolved with
     * {@link OutputColumn#getSources()} empty — constant projections,
     * {@code COUNT(*)}, sourceless aggregates) is returned to the caller
     * which fires {@code ORDER_BY_NO_PHYSICAL_COLUMN_REFS}. Slice 68
     * boundary.
     *
     * <p>Sort direction (ASC/DESC) and null placement (NULLS FIRST/LAST)
     * are presentation metadata on {@link TOrderByItem}, not on the sort
     * key expression; this helper doesn't inspect them (slice 9 decision).
     */
    private static List<ColumnRef> tryResolveOrderByOrdinal(TExpression sortKey,
                                                             List<OutputColumn> outputs) {
        if (sortKey.getExpressionType() != EExpressionType.simple_constant_t) {
            return null;
        }
        String txt = sortKey.toString();
        if (txt == null || !txt.matches("\\d+")) {
            return null;
        }
        long v;
        try {
            v = Long.parseLong(txt);
        } catch (NumberFormatException e) {
            // Very-long-digit text overflows long; definitely out of range.
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_ORDINAL_OUT_OF_RANGE,
                    "ORDER BY ordinal '" + sortKey + "' is out of range "
                            + "(must be between 1 and " + outputs.size() + ")", sortKey));
        }
        if (v < 1 || v > outputs.size()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_ORDINAL_OUT_OF_RANGE,
                    "ORDER BY ordinal '" + sortKey + "' is out of range "
                            + "(must be between 1 and " + outputs.size() + ")", sortKey));
        }
        return outputs.get((int) v - 1).getSources();
    }

    /**
     * Slice 69: resolve a top-level bare projection-alias ORDER BY sort
     * key to the matching output column's sources. Returns:
     *
     * <ul>
     *   <li>{@code null} if {@code sortKey} is not a top-level bare
     *       {@code simple_object_name_t} whose object operand has
     *       {@code dbObjectType == EDbObjectType.column_alias} (caller
     *       continues with {@link #rejectOrderByAliasReference} for the
     *       deep-scan case and the standard column-ref collection);</li>
     *   <li>a {@link List} of {@link ColumnRef}s — the matching output's
     *       source list (which may be empty when the aliased projection
     *       is a constant or sourceless aggregate; the caller fires
     *       {@code ORDER_BY_NO_PHYSICAL_COLUMN_REFS} in that case);</li>
     *   <li>throws {@link SemanticIRBuildException} with
     *       {@code ORDER_BY_PROJECTION_ALIAS_NOT_SUPPORTED} when the
     *       parser retyped the operand to {@code column_alias} but no
     *       matching output exists by case-insensitive name (defensive;
     *       theoretically unreachable for parsable SQL).</li>
     * </ul>
     *
     * <p>Match strategy: case-insensitive ({@link Locale#ROOT}) on
     * {@link OutputColumn#getName()}, returning the FIRST match. This
     * mirrors the set-op outer alias matcher in
     * {@link #processSetOpOrderByObjectName} (which uses the identical
     * {@code toLowerCase(Locale.ROOT)} pattern and {@code break}s on
     * first match) and follows MySQL / PostgreSQL ORDER BY alias
     * resolution semantics. Duplicate aliases (e.g. {@code SELECT a AS x,
     * b AS x FROM t ORDER BY x}) resolve to the leftmost matching
     * projection; this is the documented slice-69 boundary.
     *
     * <p>The set-op outer alias path
     * ({@link #buildSetOpOuterOrderByColumnRefs} →
     * {@link #processSetOpOrderByObjectName}) was already admitted by
     * slice 21 and is independent of this helper.
     *
     * <p>Deep-scan alias references inside compound expressions
     * ({@code ORDER BY UPPER(<alias>)}) are NOT handled here — the
     * parser only retypes the top-level operand to {@code column_alias};
     * inside nested expressions the alias may or may not be retyped by
     * resolver2 depending on schema heuristics. The slice-9
     * {@code orderByNestedAliasReferenceIsHandledSafely} contract is
     * preserved: deep alias refs are caught by
     * {@link #rejectOrderByAliasReference} with
     * {@code ORDER_BY_UNSUPPORTED_SORT_KEY_SHAPE} or by a binding
     * failure.
     */
    private static List<ColumnRef> tryResolveOrderByProjectionAlias(
            TExpression sortKey, List<OutputColumn> outputs) {
        if (sortKey.getExpressionType() != EExpressionType.simple_object_name_t) {
            return null;
        }
        TObjectName op = sortKey.getObjectOperand();
        if (op == null || op.getDbObjectType() != EDbObjectType.column_alias) {
            return null;
        }
        String name = op.toString();
        if (name == null || name.isEmpty()) {
            return null;
        }
        String key = name.toLowerCase(Locale.ROOT);
        for (OutputColumn oc : outputs) {
            String outName = oc.getName();
            if (outName != null && outName.toLowerCase(Locale.ROOT).equals(key)) {
                return oc.getSources();
            }
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.ORDER_BY_PROJECTION_ALIAS_NOT_SUPPORTED,
                "ORDER BY projection alias '" + sortKey
                        + "' does not match any output column "
                        + "(defensive — parser retyped to column_alias "
                        + "but no output by that name)", sortKey));
    }

    /**
     * Slice 68: reject ORDER BY sort keys that are constants but NOT
     * positive-integer ordinals. The positive-integer ordinal case is
     * admitted separately by {@link #tryResolveOrderByOrdinal} which maps
     * the ordinal to the matching output column's sources. This helper
     * handles the remaining constant shapes ({@code ORDER BY 'x'},
     * {@code ORDER BY 3.14}) — none of which reference an output position
     * and so contribute no column dependency.
     *
     * <p>The set-op outer ORDER BY path
     * ({@link #buildSetOpOuterOrderByColumnRefs}) keeps the original
     * {@link #rejectOrderByOrdinalOrConstant} helper so ordinals at that
     * scope stay rejected (slice 68 lifts only the single-SELECT case;
     * slice 72 will lift set-op outer).
     */
    private static void rejectOrderByNonOrdinalConstant(TExpression sortKey) {
        if (sortKey.getExpressionType() != EExpressionType.simple_constant_t) {
            return;
        }
        String txt = sortKey.toString();
        boolean looksOrdinal = txt != null && txt.matches("\\d+");
        if (looksOrdinal) {
            // Admitted by tryResolveOrderByOrdinal; this helper is a no-op
            // for positive-integer ordinals.
            return;
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.ORDER_BY_CONSTANT_NOT_SUPPORTED,
                "ORDER BY constant '" + sortKey + "' is not supported yet "
                        + "(constant sort keys add no column dependency)", sortKey));
    }

    /**
     * Reject ORDER BY sort keys that contain a subquery anywhere in the
     * subtree. Catches both:
     *
     * <ul>
     *   <li>Scalar subqueries ({@link EExpressionType#subquery_t}) —
     *       e.g. {@code ORDER BY (SELECT MAX(salary) FROM employees)}.</li>
     *   <li>Predicate subqueries ({@code EXISTS}, {@code IN (SELECT ...)},
     *       {@code ANY/ALL/SOME (SELECT ...)}) — these don't appear as a
     *       {@code subquery_t} expression but carry a non-null
     *       {@link TExpression#getSubQuery()}, e.g.
     *       {@code ORDER BY CASE WHEN EXISTS (SELECT 1 FROM t WHERE ...)
     *       THEN 0 ELSE 1 END}.</li>
     * </ul>
     *
     * <p>The visitor descends into the subquery body, so without an
     * explicit reject the inner-scope refs would leak into the outer
     * statement's {@code orderByColumnRefs}. The same restriction is
     * applied to scalar subqueries in projection (see
     * {@link #buildOutputColumns}).
     */
    private static void rejectOrderByScalarSubquery(TExpression sortKey) {
        // Top-level fast path: scalar-subquery message for the common case.
        if (sortKey.getExpressionType() == EExpressionType.subquery_t
                || sortKey.getSubQuery() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_SUBQUERY_NOT_SUPPORTED,
                    "ORDER BY subquery '" + sortKey + "' is not supported yet "
                            + "(subqueries in sort keys would leak inner column refs)", sortKey));
        }
        // Deep scan: any nested expression that owns a subquery (scalar,
        // EXISTS, IN (SELECT ...), ANY/ALL/SOME) makes the sort key
        // out of scope.
        final boolean[] found = {false};
        sortKey.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TExpression e) {
                if (found[0]) return;
                if (e.getExpressionType() == EExpressionType.subquery_t
                        || e.getSubQuery() != null) {
                    found[0] = true;
                }
            }
        });
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_HAS_SUBQUERY_NOT_SUPPORTED,
                    "ORDER BY sort key '" + sortKey + "' contains a subquery "
                            + "(scalar, EXISTS, IN, or ANY/ALL/SOME); not supported yet", sortKey));
        }
    }

    /**
     * Reject ORDER BY sort keys that contain a window function. Window
     * functions descend through {@link TFunctionCall#acceptChildren()} so
     * their PARTITION BY / ORDER BY column refs would otherwise leak into
     * the outer statement's {@code orderByColumnRefs}. Mirrors the
     * projection-side {@link #rejectWindowFunctions}, but wired through
     * the ORDER BY item-walk instead of the result-column list.
     */
    private static void rejectOrderByWindowFunction(TExpression sortKey) {
        final boolean[] found = {false};
        sortKey.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (fn.getWindowDef() != null) found[0] = true;
            }
        });
        if (!found[0] && sortKey.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = sortKey.getFunctionCall();
            if (fn != null && fn.getWindowDef() != null) found[0] = true;
        }
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_WINDOW_FUNCTION_NOT_SUPPORTED,
                    "ORDER BY window function '" + sortKey + "' is not supported yet "
                            + "(window OVER (...) refs would leak into orderByColumnRefs)", sortKey));
        }
    }

    /**
     * Reject ORDER BY sort keys that are bare constants. Splits the
     * message between integer ordinals (which reference the SELECT
     * position) and other constants (which add no column dependency). The
     * generic no-physical-column-refs check in
     * {@link #buildOrderByColumnRefs} catches compound cases like
     * {@code ORDER BY (1)} or {@code ORDER BY 1 + 0}.
     *
     * <p><b>Slice 68:</b> the single-SELECT call site no longer uses this
     * helper because positive-integer ordinals now resolve to the matching
     * output column's sources (see {@link #tryResolveOrderByOrdinal}).
     * This helper remains for {@link #buildSetOpOuterOrderByColumnRefs},
     * where ordinal lifting is deferred to slice 72 (set-op outer
     * ORDER BY needs output-position references against the set-op output
     * row type, not the single-SELECT output column list).
     */
    private static void rejectOrderByOrdinalOrConstant(TExpression sortKey) {
        if (sortKey.getExpressionType() != EExpressionType.simple_constant_t) {
            return;
        }
        String txt = sortKey.toString();
        boolean looksOrdinal = txt != null && txt.matches("\\d+");
        if (looksOrdinal) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_ORDINAL_NOT_SUPPORTED,
                    "ORDER BY ordinal '" + sortKey + "' is not supported yet "
                            + "(reference the column or expression directly)", sortKey));
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.ORDER_BY_CONSTANT_NOT_SUPPORTED,
                "ORDER BY constant '" + sortKey + "' is not supported yet "
                        + "(constant sort keys add no column dependency)", sortKey));
    }

    /**
     * Reject ORDER BY sort keys that contain a projection-alias reference
     * NESTED inside a compound expression (e.g.
     * {@code ORDER BY UPPER(<alias>)}). The visitor in
     * {@link #collectColumnRefs} skips column-alias nodes, so without an
     * explicit reject the IR would emit no column refs for them.
     *
     * <p><b>Slice 69:</b> the top-level bare-alias case (e.g.
     * {@code ORDER BY <alias>}) is now consumed by
     * {@link #tryResolveOrderByProjectionAlias} BEFORE this helper runs.
     * Only the deep-scan branch remains here; the top-level fast-path
     * was removed because it became unreachable.
     *
     * <p>{@link TOrderByItem#doParse} only retypes the top-level operand
     * to {@link TObjectName#ttobjColumnAlias} → dbObjectType
     * {@link EDbObjectType#column_alias}; inside nested expressions the
     * alias may or may not be retyped by resolver2 depending on schema
     * heuristics. Slice 9's
     * {@code orderByNestedAliasReferenceIsHandledSafely} documents the
     * three acceptable outcomes for deep aliases (reject by binding
     * failure, reject by this deep scan, or accept with a real column
     * dependency captured).
     */
    private static void rejectOrderByAliasReference(TExpression sortKey) {
        // Deep scan: an alias node nested inside an expression
        // (e.g. ORDER BY UPPER(x) where x is an alias) would otherwise be
        // silently dropped by the column-only visitor. The top-level
        // bare-alias case is consumed earlier by
        // tryResolveOrderByProjectionAlias (slice 69 lift).
        final boolean[] foundAlias = {false};
        final String[] aliasName = {null};
        sortKey.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TObjectName node) {
                if (foundAlias[0]) return;
                if (node.getDbObjectType() == EDbObjectType.column_alias) {
                    foundAlias[0] = true;
                    aliasName[0] = node.toString();
                }
            }
        });
        if (foundAlias[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.ORDER_BY_UNSUPPORTED_SORT_KEY_SHAPE,
                    "ORDER BY sort key '" + sortKey
                            + "' contains a projection alias reference '"
                            + aliasName[0] + "'; not supported yet "
                            + "(reference the underlying column directly)", sortKey));
        }
    }

    /**
     * Reject SELECT shapes outside current builder scope. The
     * {@code skipCteListCheck} flag is true only for the outer SELECT of a
     * WITH-bearing query whose CTEs were already extracted by
     * {@link #build}; nested WITH inside a CTE body is still rejected.
     */
    private static void rejectUnsupportedShape(TSelectSqlStatement select, boolean skipCteListCheck) {
        // Slice 12: top-level set-ops and CTE-body set-ops are dispatched
        // by build() to buildSetOpProgram BEFORE buildSelectStatement is
        // called. This rejection still fires when buildSelectStatement
        // is called from a recursive context (FROM-subquery / scalar-body
        // extraction) where the inner SELECT happens to be a set-op —
        // those nested cases remain out of scope.
        if (select.getSetOperatorType() != null && select.getSetOperatorType() != ESetOperatorType.none) {
            throw new SemanticIRBuildException(Diagnostic.error(DiagnosticCode.SET_OPERATION_NOT_SUPPORTED_IN_CONTEXT, "set operations (UNION/INTERSECT/MINUS) are not supported in this context yet", select));
        }
        if (!skipCteListCheck && select.getCteList() != null && select.getCteList().size() > 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.NESTED_WITH_NOT_SUPPORTED,
                    "nested WITH/CTE inside a CTE body or subquery is not supported yet", select));
        }
        // DISTINCT / UNIQUE / ALL handling is done in resolveDistinctFlag()
        // (called from buildSelectStatement). Only rejected row-filter shapes
        // bubble up as a SemanticIRBuildException; the rest become the
        // StatementGraph.distinct flag.
        // Slice 6 lifted GROUP BY; slice 10 lifted HAVING. The HAVING
        // expression itself (and the per-shape rejections for subqueries
        // and window functions inside it) are handled in
        // buildHavingColumnRefs so the rejection messages can mention the
        // specific shape.
        // Slices 70 and 71: all single-SELECT row-limit admit/reject
        // decisions live in buildRowLimit(select). rejectUnsupportedShape
        // no longer carries any row-limit logic. Set-op outer row-limits
        // remain handled by rejectSetOpRowLimit (slice 72 lifts).
        // Slice 125 lifted the slice-13 blanket QUALIFY reject. The
        // QUALIFY clause is now admitted and its filter refs collected in
        // buildQualifyColumnRefs (called from buildSelectStatementImpl,
        // which has the outputColumns needed for projection-alias
        // resolution). Subqueries in QUALIFY still reject there, reusing
        // the (repurposed) QUALIFY_NOT_SUPPORTED code.
        // ORDER BY itself is lifted in slice 9; see buildOrderByColumnRefs.
        // Vendor- and clause-level guards are checked there so the rejection
        // message can mention the specific sub-clause.
    }

    /**
     * Walk the FROM clause: each top-level {@link TJoin} contributes its
     * base table; each chained {@link TJoinItem} contributes one more base
     * table plus the column refs found in its ON-condition expression.
     * Comma-separated FROM lists (multiple top-level TJoins) and
     * single-source SELECTs both reduce to the same loop.
     */
    private static List<RelationSource> buildRelations(TSelectSqlStatement select,
                                                       NameBindingProvider provider,
                                                       List<ColumnRef> joinRefsOut,
                                                       boolean allowFromSubqueries) {
        return buildRelations(select, provider, joinRefsOut, allowFromSubqueries,
                /*allowJoinOnPredicateSubqueries=*/ false,
                /*stmtsForExtraction=*/ null,
                /*lineageForExtraction=*/ null,
                /*cteMapForExtraction=*/ null);
    }

    /**
     * Slice-23/24 overload of {@link #buildRelations}. When
     * {@code allowJoinOnPredicateSubqueries} is {@code true} (outer-SELECT
     * call site only), uncorrelated EXISTS subqueries inside JOIN ON
     * predicates are extracted as their own {@code <predicate_subquery_<i>>}
     * StatementGraphs appended to {@code stmtsForExtraction}. The extracted
     * subtrees are then skipped by the JOIN-ON window-function rejecter and
     * the JOIN-ON ref collector so their inner refs do not leak into outer
     * {@code joinColumnRefs}.
     *
     * <p>Slice 24: {@code cteMapForExtraction} carries outer's
     * CTE-name-to-statement-index map so the extracted predicate body can
     * emit STATEMENT_OUTPUT → STATEMENT_OUTPUT edges into outer-visible CTE
     * bodies via {@link #emitLineageForStatement}. Non-outer call sites
     * (where {@code allowJoinOnPredicateSubqueries=false}) pass {@code null}.
     */
    private static List<RelationSource> buildRelations(TSelectSqlStatement select,
                                                       NameBindingProvider provider,
                                                       List<ColumnRef> joinRefsOut,
                                                       boolean allowFromSubqueries,
                                                       boolean allowJoinOnPredicateSubqueries,
                                                       List<StatementGraph> stmtsForExtraction,
                                                       List<LineageEdge> lineageForExtraction,
                                                       Map<String, Integer> cteMapForExtraction) {
        if (select.joins == null || select.joins.size() == 0) {
            throw new SemanticIRBuildException(Diagnostic.error(DiagnosticCode.SELECT_NO_FROM_SOURCE, "SELECT must have at least one FROM source", select));
        }
        // Slice 62: comma-separated FROM lists (e.g. `FROM a, b`)
        // parse as multiple top-level TJoin elements and build as an
        // ordered cross-product relation graph with empty
        // {@code joinColumnRefs} (WHERE-side predicates feed
        // {@code filterColumnRefs} as usual).
        //
        // Slice 182 (GitHub #707 / MantisBT 4676) lifts the former
        // body-context reject. Slice 62 admitted comma-FROM only where
        // {@code allowFromSubqueries=true} (outer / CTE-body /
        // FROM-subquery-body) and rejected it in the synthetic body
        // contexts (scalar / set-op-branch / set-op-CTE / predicate) on
        // the theory that their shape contract "cannot host a
        // cross-product relation graph safely". That theory does not
        // hold: every one of those contracts constrains the body's
        // SELECT LIST (single column for scalar, column-count parity for
        // set-op branches, constant/single-column-ref for predicate
        // bodies), never its FROM relation count — which is why the same
        // bodies already accept the semantically identical
        // {@code FROM a JOIN b ON …} with two relations. The reject was
        // therefore purely syntactic and made Oracle's traditional
        // comma-FROM + WHERE-join style unanalyzable in any nested
        // position.
        //
        // {@code allowFromSubqueries} keeps its ONE genuine meaning:
        // a FROM-clause subquery operand is still rejected inside body
        // contexts by {@link #buildRelation}. The CROSS / USING / NATURAL
        // body rejects below are unchanged (separate slice contracts).
        // Slice 63: explicit CROSS JOIN admits at outer / CTE-body /
        // FROM-subquery-body call sites (allowFromSubqueries=true) but
        // stays rejected inside synthetic body contexts (scalar /
        // set-op-branch / set-op-CTE / predicate) because the body's
        // shape contract (single column for scalar; column-count parity
        // for set-op branches; constant or single column-ref for
        // predicates) cannot host a cross-product relation graph
        // safely. Predicate bodies also hit an earlier shape-specific
        // reject inside {@link #preflightPredicateSubqueryShape} so the
        // user-visible diagnostic mentions EXISTS / IN-SELECT context.
        if (!allowFromSubqueries) {
            for (TJoin join : select.joins) {
                TJoinItemList items = join.getJoinItems();
                if (items == null) continue;
                for (int i = 0; i < items.size(); i++) {
                    TJoinItem item = items.getJoinItem(i);
                    if (item == null) continue;
                    if (item.getJoinType() == EJoinType.cross) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.CROSS_JOIN_IN_BODY_NOT_SUPPORTED,
                                "CROSS JOIN is not supported inside scalar / "
                                        + "set-op-branch / set-op-CTE / predicate "
                                        + "body contexts yet; rewrite as INNER "
                                        + "JOIN ... ON in the body", item));
                    }
                    // Slice 64: USING admitted at outer / CTE-body /
                    // FROM-subquery-body call sites but rejected inside
                    // synthetic body contexts. The body's shape contract
                    // (single column for scalar, column-count parity for
                    // set-op branches, constant/column-ref for predicate
                    // bodies) cannot host the merged-key semantics safely.
                    if (item.getUsingColumns() != null
                            && item.getUsingColumns().size() > 0) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.USING_IN_BODY_NOT_SUPPORTED,
                                "JOIN ... USING (...) is not supported inside "
                                        + "scalar / set-op-branch / set-op-CTE / "
                                        + "predicate body contexts yet; rewrite "
                                        + "as JOIN ... ON in the body", item));
                    }
                    // Slice 66: NATURAL JOIN inside synthetic body
                    // contexts is rejected with a tuned diagnostic.
                    // Predicate bodies hit preflightPredicateSubqueryShape
                    // first, which emits a wrapper-aware message; this
                    // reject fires for scalar / set-op-branch /
                    // set-op-CTE bodies (and as defense-in-depth for
                    // predicate bodies if the preflight didn't catch
                    // a vendor-specific variant).
                    if (isNaturalJoinType(item.getJoinType())) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.NATURAL_IN_BODY_NOT_SUPPORTED,
                                "NATURAL JOIN is not supported inside "
                                        + "scalar / set-op-branch / set-op-CTE / "
                                        + "predicate body contexts yet; rewrite "
                                        + "as JOIN ... ON in the body", item));
                    }
                }
            }
        }
        List<RelationSource> relations = new ArrayList<>();
        // Join-graph COLUMN_BINDING_NON_EXACT degrade (GSP R6) for the JOIN ON
        // path. An unqualified ON-predicate operand that cannot be bound to
        // exactly one side (e.g. {@code JOIN cities ON city = name}) is a
        // which-side ambiguity, not a genuine error, WHEN the FROM is
        // catalog-less for at least one endpoint — exactly the case the
        // post-buildRelations SELECT/WHERE anchor already tolerates. The ON
        // refs are collected DURING this method (before that anchor is
        // installed), so compute the catalog-less eligibility here and hand the
        // ON collector an anchored provider. Every {@code collectJoinOnRefs}
        // call runs inside the join-item loop, where ≥2 endpoints are already
        // bound (driver + right), so the structural {@code relations.size() >= 2}
        // gate is satisfied by construction; only the catalog-less check
        // remains. A fully-cataloged FROM stays fatal (the catalog adjudicates).
        //
        // Whole-FROM scope is intentional and mirrors the post-buildRelations
        // SELECT/WHERE anchor (which gates on the same
        // {@code !fromRelationColumnsFullyKnown(select, provider)} for the whole
        // statement): a partially-cataloged FROM (one endpoint catalog-less)
        // degrades an unqualified ON miss because that operand MIGHT live on the
        // unknown side — exactly as an unqualified SELECT/WHERE column does. A
        // genuine typo over a fully-cataloged FROM still stays fatal.
        boolean joinGraphAnchorEligible = !fromRelationColumnsFullyKnown(select, provider);
        // Slice 179 (R4): stable FROM-order instance ordinal, assigned in the
        // SAME driver-then-join-items traversal order as buildJoinGraph, so
        // RelationSource.instanceId and JoinEndpoint.instanceId align by
        // construction (not by alias). Held in a one-element array so the
        // recursive appendJoinRelations helper can advance it across a nested
        // parenthesized <joined_table> sub-tree.
        int[] relInstanceId = {0};
        for (TJoin join : select.joins) {
            // Slice 66: per top-level TJoin LeftOutputState. Seeded with the
            // top-left table's catalog; updated as JoinItems walk left-to-right.
            // NATURAL JoinItems consume this state (catalog intersection) and
            // update it. Reset between top-level TJoins so comma-FROM groups
            // stay independent.
            LeftOutputState leftState = new LeftOutputState();
            appendJoinRelations(join, provider, allowFromSubqueries,
                    allowJoinOnPredicateSubqueries, stmtsForExtraction,
                    lineageForExtraction, cteMapForExtraction,
                    relations, joinRefsOut, relInstanceId, leftState,
                    joinGraphAnchorEligible);
        }
        rejectDuplicateAliases(relations, select.dbvendor, select.joins.size() > 1);
        return relations;
    }

    /**
     * Append the relations of one FROM-clause {@link TJoin} (its driver operand
     * plus each join item) to {@code relations}, populate {@code joinRefsOut}
     * with the join-condition column refs, advance {@code relInstanceId[0]} in
     * FROM order, and update {@code leftState} (the running row type used for
     * NATURAL key inference).
     *
     * <p>Recurses into a parenthesized / nested {@code <joined_table>} operand —
     * a {@link TJoin} reached via {@link TJoin#getJoin()} (driver) or
     * {@link TJoinItem#getJoin()} (right operand) when the corresponding
     * {@code getTable()} is null. So {@code FROM a JOIN (b JOIN c ON …) ON …}
     * collects all three relations, emits the inner join's refs, then attaches
     * the outer join's ON over the accumulated endpoints. The same
     * {@code leftState} is threaded through the recursion — both
     * {@code seedLeftOutput} and {@code appendRightToLeftOutput} only ADD
     * columns — so a NATURAL join that follows still sees the accumulated row
     * type. {@code FROM_SOURCE_NO_TABLE} / {@code JOIN_ITEM_NO_TABLE} stay fatal
     * only for an operand that is genuinely neither a table nor a nested join.
     */
    private static void appendJoinRelations(
            TJoin join,
            NameBindingProvider provider,
            boolean allowFromSubqueries,
            boolean allowJoinOnPredicateSubqueries,
            List<StatementGraph> stmtsForExtraction,
            List<LineageEdge> lineageForExtraction,
            Map<String, Integer> cteMapForExtraction,
            List<RelationSource> relations,
            List<ColumnRef> joinRefsOut,
            int[] relInstanceId,
            LeftOutputState leftState,
            boolean joinGraphAnchorEligible) {
        // ---- driver operand ----
        TTable leftTable = join.getTable();
        if (leftTable != null) {
            relations.add(buildRelation(leftTable, provider, allowFromSubqueries, relInstanceId[0]++));
            seedLeftOutput(leftState, leftTable, provider);
        } else if (join.getJoin() != null) {
            // Parenthesized joined-table as the driver operand — recurse,
            // threading the same leftState so it accumulates the sub-tree's
            // columns for any NATURAL join that follows at this level.
            appendJoinRelations(join.getJoin(), provider, allowFromSubqueries,
                    allowJoinOnPredicateSubqueries, stmtsForExtraction,
                    lineageForExtraction, cteMapForExtraction,
                    relations, joinRefsOut, relInstanceId, leftState,
                    joinGraphAnchorEligible);
        } else {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.FROM_SOURCE_NO_TABLE, "FROM source has no table", join));
        }

        TJoinItemList items = join.getJoinItems();
        if (items == null) return;
        for (int i = 0; i < items.size(); i++) {
            TJoinItem item = items.getJoinItem(i);
            rejectUnsupportedJoinShape(item);
            TTable rightTable = item.getTable();
            if (rightTable == null) {
                if (item.getJoin() != null) {
                    // NATURAL / USING merged-key inference needs a single right
                    // TTable to key against; over a parenthesized joined-table
                    // operand (a combined row type) it is not supported yet.
                    // Fail explicitly rather than silently dropping the merged-key
                    // refs in buildRelations while buildJoinGraph still emits a
                    // NATURAL/USING entity (codex P2). Plain ON / CROSS over a
                    // nested operand ARE supported.
                    if (isNaturalJoinType(item.getJoinType())
                            || (item.getUsingColumns() != null
                                    && item.getUsingColumns().size() > 0)) {
                        throw new SemanticIRBuildException(Diagnostic.error(
                                DiagnosticCode.NESTED_JOIN_MERGED_KEY_NOT_SUPPORTED,
                                "NATURAL / USING join over a parenthesized joined-table "
                                        + "operand is not supported yet; rewrite with an "
                                        + "explicit ON condition", item));
                    }
                    // Parenthesized joined-table as the right operand — recurse to
                    // collect its relations + inner join refs, then attach this
                    // outer join's ON over the accumulated endpoints. Use a FRESH
                    // row-state for the sub-tree so its inner NATURAL inference
                    // sees only its own columns (codex P1), then merge that row
                    // type into this level's leftState so a NATURAL join that
                    // FOLLOWS at this level still sees the accumulated columns.
                    LeftOutputState subState = new LeftOutputState();
                    appendJoinRelations(item.getJoin(), provider, allowFromSubqueries,
                            allowJoinOnPredicateSubqueries, stmtsForExtraction,
                            lineageForExtraction, cteMapForExtraction,
                            relations, joinRefsOut, relInstanceId, subState,
                            joinGraphAnchorEligible);
                    mergeLeftOutputState(leftState, subState);
                    collectJoinOnRefs(item.getOnCondition(), provider,
                            allowJoinOnPredicateSubqueries, stmtsForExtraction,
                            lineageForExtraction, cteMapForExtraction, joinRefsOut,
                            joinGraphAnchorEligible);
                    continue;
                }
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.JOIN_ITEM_NO_TABLE, "JOIN item has no table", item));
            }
            // Slice 17/18: subqueries on a JOIN side are extracted as their own
            // statements by extractFromSubqueriesAsStatements before
            // buildRelations runs (when allowFromSubqueries=true). Scalar /
            // set-op-branch / set-op-CTE-body builds pass allowFromSubqueries=
            // false; buildRelation rejects there.
            relations.add(buildRelation(rightTable, provider, allowFromSubqueries, relInstanceId[0]++));
            // Slice 66: NATURAL admission via catalog inference. When catalog
            // metadata is missing on either side we DEGRADE: skip the merged
            // refs, record a NATURAL_CATALOG_REQUIRED warning, and append the
            // right's columns to the running state.
            if (isNaturalJoinType(item.getJoinType())) {
                NaturalKeyResult r = naturalSharedKeys(leftState, rightTable, provider);
                if (r.kind != NaturalKeyResult.Kind.SUCCESS) {
                    recordNaturalDegradeWarning(r, item);
                    appendRightToLeftOutput(leftState, rightTable, provider);
                    continue;
                }
                emitMergedJoinRefs(JoinKind.NATURAL, r.keys, join, items, i,
                        rightTable, provider, joinRefsOut);
                mergeRightIntoLeftOutput(leftState, rightTable, provider, r.keys);
                continue;
            }
            // Slice 64: USING and ON are mutually exclusive (enforced by
            // rejectUnsupportedJoinShape). Populate per-key joinColumnRefs from
            // USING here, then skip the onCond branch.
            TObjectNameList usingCols = item.getUsingColumns();
            if (usingCols != null && usingCols.size() > 0) {
                populateUsingJoinRefs(join, items, i, rightTable,
                        usingCols, provider, joinRefsOut);
                // Slice 66: USING JoinItems also merge right into the
                // LeftOutputState so subsequent NATURAL JoinItems see the
                // accumulated row type (merged USING keys at their slots).
                List<String> usingKeyNames = new ArrayList<>(usingCols.size());
                for (int k = 0; k < usingCols.size(); k++) {
                    TObjectName usingKey = usingCols.getObjectName(k);
                    if (usingKey == null) continue;
                    String keyName = usingKey.getColumnNameOnly();
                    if (keyName != null && !keyName.isEmpty()) {
                        usingKeyNames.add(keyName);
                    }
                }
                mergeRightIntoLeftOutput(leftState, rightTable, provider, usingKeyNames);
                continue;
            }
            // Slice 66: ON / CROSS JoinItem — append right's catalog columns to
            // the running LeftOutputState; NATURAL JoinItems that follow see it.
            appendRightToLeftOutput(leftState, rightTable, provider);
            collectJoinOnRefs(item.getOnCondition(), provider,
                    allowJoinOnPredicateSubqueries, stmtsForExtraction,
                    lineageForExtraction, cteMapForExtraction, joinRefsOut,
                    joinGraphAnchorEligible);
        }
    }

    /**
     * Collect the column refs of a JOIN item's {@code ON} expression into
     * {@code joinRefsOut}, applying the same predicate-subquery extraction and
     * window-function / subquery rejections as the inline ON path. No-op when
     * {@code onCond} is null (CROSS / APPLY items carry no ON). Shared by the
     * flat and nested ({@link #appendJoinRelations}) traversal paths.
     */
    private static void collectJoinOnRefs(TExpression onCond, NameBindingProvider provider,
            boolean allowJoinOnPredicateSubqueries,
            List<StatementGraph> stmtsForExtraction,
            List<LineageEdge> lineageForExtraction,
            Map<String, Integer> cteMapForExtraction,
            List<ColumnRef> joinRefsOut,
            boolean joinGraphAnchorEligible) {
        if (onCond == null) {
            return;
        }
        // Join-graph COLUMN_BINDING_NON_EXACT degrade (GSP R6): the anchor wraps
        // ONLY the direct ON-condition ref binding below. Predicate-subquery
        // EXTRACTION keeps the un-anchored {@code provider} — each extracted
        // body is built via a nested entry that resets the anchor anyway, and
        // its inner binding does not enjoy the ON path's ≥2-bound-endpoint
        // invariant. The anchor only changes rejectNonExactBindings: an
        // unqualified ON operand that can't be placed on one side (a which-side
        // ambiguity over a catalog-less join) degrades to a warning instead of
        // aborting the whole analysis.
        NameBindingProvider refProvider = joinGraphAnchorEligible
                ? provider.withJoinStructureAnchor(true) : provider;
        if (allowJoinOnPredicateSubqueries) {
            // Slice 23/24/25: outer-SELECT JOIN ON path — extract uncorrelated
            // predicate-subquery wrappers as their own <predicate_subquery_<i>>
            // StatementGraphs and skip their subtrees during the window guard and
            // ref collection. The leak guard rejects everything that is NOT an
            // extracted wrapper.
            Set<TExpression> extractedRoots =
                    extractUncorrelatedPredicateSubqueriesFromJoinOn(onCond, provider,
                            stmtsForExtraction, lineageForExtraction, cteMapForExtraction);
            rejectAnyRemainingSubqueriesInJoinOn(onCond, extractedRoots);
            rejectWindowFunctionInScopeSkipping(onCond, "JOIN ON condition", extractedRoots);
            joinRefsOut.addAll(collectColumnRefsSkipping(onCond, refProvider, extractedRoots));
        } else {
            // Slice 13/17: reject window functions and predicate subqueries in
            // JOIN ON before collectColumnRefs descends (every non-outer call
            // site: FROM-subquery body, CTE body, scalar body, set-op branch).
            rejectWindowFunctionInScope(onCond, "JOIN ON condition");
            rejectSubqueriesInJoinOn(onCond);
            joinRefsOut.addAll(collectColumnRefs(onCond, refProvider));
        }
    }

    /**
     * Slice 17: reject predicate subqueries (EXISTS, IN-SELECT,
     * scalar-subquery comparisons, etc.) inside a JOIN ON expression.
     * Without this guard, slice-17's expanded JOIN surface (relation
     * subqueries on either side) would let predicate subqueries slip
     * past {@code collectColumnRefs} and produce incomplete IR. Applies
     * to every {@code buildRelations} call site; the slice-11
     * {@link #rejectSubqueriesInScalarBodyClauses} and slice-17
     * {@link #rejectSubqueriesInFromSubqueryBodyClauses} fire BEFORE
     * the recursive {@code buildSelectStatement}, so their context-
     * specific messages preempt this one.
     */
    private static void rejectSubqueriesInJoinOn(TExpression onCond) {
        if (containsAnySubqueryExpression(onCond)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.JOIN_ON_TOP_LEVEL_SUBQUERY_NOT_SUPPORTED,
                    "subquery in a top-level JOIN ON predicate is not supported yet", onCond));
        }
    }

    // ====================================================================
    // Slice 23: uncorrelated EXISTS subqueries in top-level outer-SELECT
    // JOIN ON.
    //
    // Approach: walk the JOIN-ON expression looking for `exists_t` nodes
    // (and `not_t(exists_t(...))` for NOT EXISTS); validate each as
    // uncorrelated with a constant-only inner projection; build the inner
    // SELECT as its own `<predicate_subquery_<i>>` StatementGraph; record
    // the extracted `exists_t` root in a Set so the JOIN-ON window guard
    // and ref collector can skip its subtree. Predicate bodies are
    // unreachable from outer (no relation, no lineage edge) so they
    // contribute zero canonical edges — matching dlineage's behaviour for
    // EXISTS-in-JOIN-ON shapes that project a constant (the inner-shape
    // preflight enforces constant-only projection so this invariant
    // holds).
    //
    // Process: codex round 1 + round 2 plan reviews; v3 plan locked.
    // See roadmap §14.25 (slice-23 entry).
    // ====================================================================

    /**
     * True iff {@code e} is the root of an EXISTS predicate that slice 23
     * may extract: either an {@code exists_t} expression, or a
     * {@code logical_not_t} whose <b>right</b> operand is {@code exists_t}.
     * NOT EXISTS unwraps to its inner {@code exists_t}.
     *
     * <p>Note: the GSP parser puts the operand of {@code logical_not_t} in
     * {@link TExpression#getRightOperand()}, not {@code getLeftOperand()}
     * (verified across Oracle / PostgreSQL / MSSQL / MySQL / BigQuery).
     * The root fast-path for {@code NOT EXISTS} is therefore "dead" in the
     * sense that the descendant walker on the wrapping {@code logical_not_t}
     * already visits the child {@code exists_t} — we still keep it here so
     * the symmetry between root EXISTS and root NOT EXISTS is explicit.
     *
     * <p>Slice 25 (kept as a dedicated helper for slice-23/24 callers and
     * for clarity): the slice-25 generalisation lives in
     * {@link #unwrapToInnerExtractableSubquery(TExpression)} which
     * recognises four wrapper shapes — including the two EXISTS shapes
     * here.
     */
    private static boolean isExistsRoot(TExpression e) {
        if (e == null) return false;
        if (e.getExpressionType() == EExpressionType.exists_t) return true;
        if (e.getExpressionType() == EExpressionType.logical_not_t
                && e.getRightOperand() != null
                && e.getRightOperand().getExpressionType() == EExpressionType.exists_t) {
            return true;
        }
        return false;
    }

    /** Return the actual {@code exists_t} node — unwrap a {@code logical_not_t} parent if present. */
    private static TExpression unwrapExistsRoot(TExpression e) {
        if (e.getExpressionType() == EExpressionType.exists_t) return e;
        return e.getRightOperand();
    }

    /**
     * Slice 25 / Slice 26: pure shape-recogniser for the predicate-
     * subquery wrappers admitted in TOP-LEVEL JOIN ON. Returns the inner
     * extractable node ({@code subquery_t} or {@code exists_t}) for the
     * wrapper shapes; null otherwise. Pure — performs NO validation and
     * throws NO exceptions.
     *
     * <p>Recognised wrappers:
     * <ul>
     *   <li>{@code exists_t} (slice-23 EXISTS) — returns {@code e}.</li>
     *   <li>{@code logical_not_t} with rightOperand {@code exists_t}
     *       (slice-23 NOT EXISTS) — returns the inner exists_t.</li>
     *   <li>{@code in_t} with rightOperand {@code subquery_t}
     *       (slice 25 IN-SELECT / NOT IN-SELECT) — returns the
     *       rightOperand. LHS-subquery {@code in_t} returns null
     *       (slice 26 boundary: dlineage's {@code fdr clause="on"}
     *       sources omit the outer column for IN-LHS, so admitting on
     *       the IR side would manufacture canonical-model divergence).</li>
     *   <li>{@code simple_comparison_t} (slice 25 + slice 26 scalar
     *       comparison) — returns the operand on whichever side is a
     *       {@code subquery_t}. RHS-subquery (slice 25) and LHS-
     *       subquery (slice 26) are both admitted; both-sides subquery
     *       returns null and falls through to {@link #findSubqueryOnLeftWrapper}'s
     *       new "both subqueries" rejection branch.</li>
     *   <li>{@code group_comparison_t} with rightOperand
     *       {@code subquery_t} AND non-null {@code getQuantifier()}
     *       (slice 25 ANY/ALL/SOME) — returns the rightOperand.
     *       LHS-subquery {@code group_comparison_t} returns null
     *       (slice 26 boundary: borderline grammar; not probed).</li>
     * </ul>
     *
     * <p>For null returns, the wrapper either is not a recognised shape
     * (falls through to the slice-23 generic remaining-subquery rejection
     * in {@link #rejectAnyRemainingSubqueriesInJoinOn}) OR has the right
     * outer shape but the LHS / RHS positioning is unsupported (subquery
     * on left side of IN/quantifier, both sides subquery for cmp, tuple
     * LHS / RHS, expression LHS / RHS). The walker validates the
     * non-subquery side via {@link #isAdmittedOuterLhsShape} or
     * {@link #isAdmittedOuterRhsShape} and throws a slice-25 / slice-26
     * tuned message before calling this helper for extraction.
     *
     * <p>The slice-23/24 EXISTS callers ({@code isExistsRoot} and
     * {@code unwrapExistsRoot}) remain in place — both are simple
     * boolean / unwrap helpers; this method consolidates the slice-25 /
     * slice-26 shape decision in one place.
     */
    private static TExpression unwrapToInnerExtractableSubquery(TExpression e) {
        if (e == null) return null;
        EExpressionType t = e.getExpressionType();
        if (t == EExpressionType.exists_t) return e;
        if (t == EExpressionType.logical_not_t
                && e.getRightOperand() != null
                && e.getRightOperand().getExpressionType() == EExpressionType.exists_t) {
            return e.getRightOperand();
        }
        TExpression l = e.getLeftOperand();
        TExpression r = e.getRightOperand();
        boolean lhsIsSubq = l != null && l.getExpressionType() == EExpressionType.subquery_t;
        boolean rhsIsSubq = r != null && r.getExpressionType() == EExpressionType.subquery_t;
        if (t == EExpressionType.in_t) {
            return rhsIsSubq ? r : null;
        }
        if (t == EExpressionType.simple_comparison_t) {
            // Slice 26: admit subquery on either single side. Both sides
            // → null (rejected via findSubqueryOnLeftWrapper's new
            // "both subqueries" branch — see isSubqueryOnLeftOfWrapper).
            if (lhsIsSubq && rhsIsSubq) return null;
            if (rhsIsSubq) return r;
            if (lhsIsSubq) return l;
            return null;
        }
        if (t == EExpressionType.group_comparison_t
                && e.getQuantifier() != null) {
            return rhsIsSubq ? r : null;
        }
        return null;
    }

    /**
     * Slice 25: admitted LHS shapes for non-EXISTS predicate-subquery
     * wrappers ({@code in_t} / {@code simple_comparison_t} /
     * {@code group_comparison_t}) when the subquery is on the RHS.
     *
     * <p>Admits ONLY {@link EExpressionType#simple_object_name_t} —
     * a single column reference, qualified or unqualified. Rejects:
     * tuple expressions ({@code (a, b) IN (...)}), parenthesized
     * wrapping ({@code (e.col) IN (...)}), arithmetic
     * ({@code e.col + 1 IN (...)}), function calls
     * ({@code UPPER(e.col) IN (...)}), scalar subqueries on LHS, and
     * any other non-column shape.
     *
     * <p>Slice-25 boundary; future slice may admit parenthesized
     * column refs (slice 26+).
     */
    private static boolean isAdmittedOuterLhsShape(TExpression lhs) {
        return lhs != null
                && lhs.getExpressionType() == EExpressionType.simple_object_name_t;
    }

    /**
     * Slice 26: admitted RHS shapes for {@code simple_comparison_t}
     * with subquery on the LHS. Mirror of
     * {@link #isAdmittedOuterLhsShape}: admits ONLY
     * {@link EExpressionType#simple_object_name_t} — a single column
     * reference, qualified or unqualified. Rejects tuple, parenthesized,
     * arithmetic, function-call, and subquery (the "both subqueries"
     * shape is rejected separately via
     * {@link #isSubqueryOnLeftOfWrapper}'s new
     * {@code simple_comparison_t} both-sides branch).
     *
     * <p>Slice-26 boundary: only {@code simple_comparison_t} reaches
     * this helper (the walker dispatches on which side is the
     * subquery). {@code in_t} / {@code group_comparison_t} with LHS
     * subquery return null from
     * {@link #unwrapToInnerExtractableSubquery} so they never reach
     * here.
     */
    private static boolean isAdmittedOuterRhsShape(TExpression rhs) {
        return rhs != null
                && rhs.getExpressionType() == EExpressionType.simple_object_name_t;
    }

    /**
     * Slice 25 (impl-review M1-fix): true iff {@code e} is a
     * {@code logical_not_t} wrapping a slice-25 IN / scalar-cmp /
     * ANY-ALL-SOME wrapper (i.e. NOT applied to an admitted slice-25
     * shape that ISN'T an EXISTS). The descendant walker would
     * otherwise traverse INTO this {@code logical_not_t} and find the
     * child wrapper, accidentally admitting
     * {@code NOT (e.col IN (SELECT ...))} which is NOT a slice-25
     * recognised shape ({@code unwrapToInnerExtractableSubquery}
     * matches {@code logical_not_t} only when the inner is
     * {@code exists_t}).
     *
     * <p>This helper is consulted by the extraction walker BEFORE it
     * descends into the children of a {@code logical_not_t}, so the
     * rejection happens at the wrapper level with a tuned message
     * pointing at the slice-25 boundary.
     */
    private static boolean isLogicalNotOverNonExistsWrapper(TExpression e) {
        if (e == null) return false;
        if (e.getExpressionType() != EExpressionType.logical_not_t) return false;
        TExpression r = e.getRightOperand();
        if (r == null) return false;
        // Strip parenthesis_t chain. The Oracle parser wraps
        // `NOT (e.col IN (SELECT...))` as
        // logical_not_t → parenthesis_t → in_t, so the immediate
        // right child is parenthesis_t. Descend through any chain of
        // parens to find the actual subject. Note:
        // {@code parenthesis_t} stores its child on
        // {@link TExpression#getLeftOperand()} (mirroring
        // {@link #isConstantExpression}'s descent).
        TExpression subject = r;
        while (subject != null
                && subject.getExpressionType() == EExpressionType.parenthesis_t) {
            subject = subject.getLeftOperand();
        }
        if (subject == null) return false;
        if (subject.getExpressionType() == EExpressionType.exists_t) return false;
        // Either an in_t / simple_comparison_t / group_comparison_t
        // with subquery RHS, or any of those types directly.
        return unwrapToInnerExtractableSubquery(subject) != null;
    }

    /**
     * Slice 25 / Slice 26: build a tuned outer-shape rejection message
     * for a non-EXISTS predicate-subquery wrapper. Called from the
     * extraction walker when {@link #unwrapToInnerExtractableSubquery}
     * returns non-null for an in_t / simple_comparison_t /
     * group_comparison_t but the non-subquery side is not admitted by
     * {@link #isAdmittedOuterLhsShape} (slice 25 — subquery on RHS) or
     * {@link #isAdmittedOuterRhsShape} (slice 26 — subquery on LHS).
     *
     * <p>{@code isLhsSubquery} indicates which side of the wrapper
     * carries the subquery: {@code true} = subquery on LHS (slice 26
     * path; we validate the wrapper's RHS), {@code false} = subquery
     * on RHS (slice 25 path; we validate the wrapper's LHS).
     *
     * <p>Returns only the reason text. The caller combines it with the
     * strongly typed predicate-subquery context so the rendered construct
     * and clause always describe the actual source wrapper.
     */
    private static String buildOuterShapeRejectionReason(TExpression wrapper,
                                                         boolean isLhsSubquery) {
        EExpressionType t = wrapper.getExpressionType();
        String shapeLabel;
        if (t == EExpressionType.in_t) shapeLabel = "IN";
        else if (t == EExpressionType.simple_comparison_t) shapeLabel = "comparison";
        else if (t == EExpressionType.group_comparison_t) shapeLabel = "ANY/ALL/SOME";
        else shapeLabel = String.valueOf(t);
        // Validate the side that does NOT carry the subquery.
        TExpression nonSubquerySide = isLhsSubquery
                ? wrapper.getRightOperand()
                : wrapper.getLeftOperand();
        String sideLabel = isLhsSubquery ? "RHS" : "LHS";
        EExpressionType sideType = nonSubquerySide == null
                ? null : nonSubquerySide.getExpressionType();
        String detail;
        if (nonSubquerySide == null) {
            detail = "missing " + sideLabel;
        } else if (sideType == EExpressionType.list_t) {
            detail = "tuple " + sideLabel;
        } else if (sideType == EExpressionType.parenthesis_t) {
            detail = "parenthesized " + sideLabel;
        } else if (sideType == EExpressionType.simple_object_name_t) {
            // Defensive: should not be reached when the corresponding
            // admitted-shape helper returns true.
            detail = "unexpected admitted " + sideLabel + " shape";
        } else {
            detail = "expression " + sideLabel + " (" + sideType + ")";
        }
        String boundary = isLhsSubquery ? "slice 26 boundary" : "slice 25 boundary";
        return shapeLabel + " wrapper has unsupported " + sideLabel + " shape ("
                + detail + "); only a single column reference "
                + "(simple_object_name_t) is admitted on the "
                + sideLabel
                + " of a comparison / IN / ANY-ALL-SOME "
                + "predicate subquery when the other side is a "
                + "subquery (" + boundary + ")";
    }

    /**
     * Slice 25 (rename of slice-23
     * {@code extractUncorrelatedExistsFromJoinOn}): walk the JOIN-ON
     * expression, extract every uncorrelated predicate-subquery wrapper
     * (EXISTS / NOT EXISTS / IN-SELECT / NOT IN-SELECT / scalar
     * comparison subquery / ANY-ALL-SOME) as its own
     * {@code <predicate_subquery_<i>>} StatementGraph, and return the
     * set of extracted inner nodes (the {@code exists_t} or
     * {@code subquery_t}, NOT the wrapping {@code in_t} /
     * {@code simple_comparison_t} / {@code group_comparison_t} /
     * {@code logical_not_t}) keyed on identity.
     *
     * <p>The set is consumed by the JOIN-ON window-function guard, the
     * JOIN-ON ref collector, and the slice-17 remaining-subquery
     * rejecter — each of those skips INTO / PAST these subtrees so
     * inner refs do not leak into outer joinColumnRefs. Critically,
     * the wrapper itself (e.g. an {@code in_t} whose RHS is the
     * {@code subquery_t}) is NOT in the set — this lets the LHS column
     * reference (e.g. {@code e.dept_id} in
     * {@code e.dept_id IN (SELECT ...)}) be collected normally into
     * outer's {@code joinColumnRefs}.
     *
     * <p>The walker handles BOTH the root-position case (the entire ON
     * IS one of the four wrappers, which {@code acceptChildren} would
     * not visit as a node) AND descendant positions (e.g.
     * {@code e.id = d.id AND e.dept_id IN (SELECT ...)}). Multiple
     * wrappers in one ON, multiple ON across multiple JOINs, and mixed
     * EXISTS / IN / cmp / ANY-ALL combinations are all handled.
     *
     * <p>Slice 25 / Slice 26 outer-shape validation: for non-EXISTS
     * wrappers, the side opposite the subquery must be a single
     * {@code simple_object_name_t} column ref. Slice 25 admits subquery
     * on RHS only and validates LHS via
     * {@link #isAdmittedOuterLhsShape}. Slice 26 lifts {@code
     * simple_comparison_t} to also admit subquery on LHS and validates
     * RHS via {@link #isAdmittedOuterRhsShape}. Tuple / parenthesized /
     * expression / function-call shapes on the validated side throw
     * {@link SemanticIRBuildException} with a tuned message via
     * {@link #buildOuterShapeRejectionReason}. The EXISTS branch has
     * no outer-shape gate (slice-23 carryover).
     *
     * <p>Snapshot/rollback wrapper at the outer-SELECT call site
     * ({@link #build}) catches a partial extraction (e.g. third
     * wrapper rejected after first two extracted) and truncates
     * {@code stmts}/{@code lineage} back to the snapshot.
     */
    /**
     * Slice 110 — context bag threading clause-specific
     * {@link DiagnosticCode}s and a clause-label into the slice-23+
     * predicate-subquery extraction pipeline so the same walker code can
     * power JOIN-ON (slice 23–33+) and UPDATE WHERE (slice 110) without
     * code duplication.
     *
     * <p>Two static instances exist:
     * <ul>
     *   <li>{@link #JOIN_ON} — preserves slice-23+ JOIN-ON semantic
     *       behavior and stable codes while diagnostics name the actual
     *       predicate wrapper.</li>
     *   <li>{@link #UPDATE_WHERE} — slice 110 UPDATE WHERE call site
     *       (parallel {@code UPDATE_WHERE_*} codes; "UPDATE WHERE clause"
     *       label).</li>
     * </ul>
     *
     * <p>Codes per clause are intentionally parallel (slice-80
     * granular-codes contract: each semantic reject reason gets its own
     * stable API code rather than an umbrella code with discriminating
     * message text).
     */
    private static final class PredicateClauseContext {
        /** Used as the "in &lt;label&gt;" piece of every diagnostic message. */
        final String clauseLabel;
        final DiagnosticCode existsBodyMissing;
        final DiagnosticCode existsInnerRelationUnknown;
        final DiagnosticCode existsCorrelatedUnknownOuterAlias;
        final DiagnosticCode predicateNotNot;
        final DiagnosticCode outerShapeRejected;
        final DiagnosticCode scalarComparisonBothSides;
        final DiagnosticCode predicateSubqueryOnLeft;
        final DiagnosticCode genericSubqueryNotSupported;

        private PredicateClauseContext(String clauseLabel,
                                       DiagnosticCode existsBodyMissing,
                                       DiagnosticCode existsInnerRelationUnknown,
                                       DiagnosticCode existsCorrelatedUnknownOuterAlias,
                                       DiagnosticCode predicateNotNot,
                                       DiagnosticCode outerShapeRejected,
                                       DiagnosticCode scalarComparisonBothSides,
                                       DiagnosticCode predicateSubqueryOnLeft,
                                       DiagnosticCode genericSubqueryNotSupported) {
            this.clauseLabel = clauseLabel;
            this.existsBodyMissing = existsBodyMissing;
            this.existsInnerRelationUnknown = existsInnerRelationUnknown;
            this.existsCorrelatedUnknownOuterAlias = existsCorrelatedUnknownOuterAlias;
            this.predicateNotNot = predicateNotNot;
            this.outerShapeRejected = outerShapeRejected;
            this.scalarComparisonBothSides = scalarComparisonBothSides;
            this.predicateSubqueryOnLeft = predicateSubqueryOnLeft;
            this.genericSubqueryNotSupported = genericSubqueryNotSupported;
        }

        static final PredicateClauseContext JOIN_ON = new PredicateClauseContext(
                "JOIN ON",
                DiagnosticCode.JOIN_ON_EXISTS_BODY_MISSING,
                DiagnosticCode.JOIN_ON_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.JOIN_ON_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.JOIN_ON_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.JOIN_ON_OUTER_SHAPE_REJECTED,
                DiagnosticCode.JOIN_ON_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.JOIN_ON_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.JOIN_ON_PREDICATE_GENERIC_NOT_SUPPORTED);

        static final PredicateClauseContext UPDATE_WHERE = new PredicateClauseContext(
                "UPDATE WHERE clause",
                DiagnosticCode.UPDATE_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.UPDATE_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.UPDATE_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.UPDATE_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.UPDATE_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.UPDATE_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.UPDATE_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.UPDATE_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        static final PredicateClauseContext DELETE_WHERE = new PredicateClauseContext(
                "DELETE WHERE clause",
                DiagnosticCode.DELETE_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.DELETE_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.DELETE_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.DELETE_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.DELETE_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.DELETE_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.DELETE_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.DELETE_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        static final PredicateClauseContext SELECT_WHERE = new PredicateClauseContext(
                "SELECT WHERE clause",
                DiagnosticCode.SELECT_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.SELECT_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.SELECT_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.SELECT_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        /**
         * Slice 113 — uncorrelated WHERE-side predicate subqueries on
         * set-op branches (UNION / INTERSECT / EXCEPT / MINUS branches).
         * Reuses every {@link DiagnosticCode} from {@link #SELECT_WHERE}
         * because a branch IS a SELECT — the shape rejects are
         * semantically identical to top-level SELECT WHERE. Only the
         * {@code clauseLabel} differs so diagnostic messages distinguish
         * the nested context (helpful when a multi-branch query reports
         * a reject and the user needs to know which branch). Keeping the
         * codes shared frees consumers from a new code-family migration
         * and preserves the enum count at 279.
         */
        static final PredicateClauseContext SET_OP_BRANCH_WHERE = new PredicateClauseContext(
                "set-op branch WHERE clause",
                DiagnosticCode.SELECT_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.SELECT_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.SELECT_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.SELECT_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        /**
         * Slice 114 — uncorrelated WHERE-side predicate subqueries
         * inside a non-set-op CTE body (the SELECT body of a single CTE
         * in a WITH list on SELECT / MERGE / UPDATE / DELETE). Reuses
         * every {@link DiagnosticCode} from {@link #SELECT_WHERE}
         * because a CTE body IS a SELECT — the shape rejects are
         * semantically identical to top-level SELECT WHERE. Only the
         * {@code clauseLabel} differs so a reject in a
         * {@code WITH cte AS (SELECT ... WHERE NOT (...))} shape can
         * identify the CTE-body host context in the diagnostic message.
         * Keeping the codes shared (slice 113 precedent) preserves the
         * enum count at 279 and frees consumers from another
         * code-family migration.
         */
        static final PredicateClauseContext CTE_BODY_WHERE = new PredicateClauseContext(
                "CTE body WHERE clause",
                DiagnosticCode.SELECT_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.SELECT_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.SELECT_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.SELECT_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        /**
         * Slice 120 — uncorrelated WHERE-side predicate subqueries inside
         * a FROM-subquery body (the inner SELECT of a {@code FROM (...)}
         * derived table). Reuses every {@link DiagnosticCode} from
         * {@link #SELECT_WHERE} (slice 113/114/116 precedent) because a
         * FROM-subquery body IS a SELECT — the shape rejects are
         * semantically identical to top-level SELECT WHERE. Only the
         * {@code clauseLabel} differs so a reject inside a
         * {@code FROM (SELECT ... WHERE NOT (...)) sub} shape can identify
         * the FROM-subquery host context in the diagnostic message. The
         * FROM-subquery body builder {@code processDirectSubqueryTable} is
         * shared by the SELECT, UPDATE (slice 83), and DELETE (slice 84)
         * FROM-subquery extractors, so this single context lifts all three.
         * Keeping the codes shared preserves the enum count at 279 and
         * frees consumers from another code-family migration.
         */
        static final PredicateClauseContext FROM_SUBQUERY_BODY_WHERE = new PredicateClauseContext(
                "FROM-subquery body WHERE clause",
                DiagnosticCode.SELECT_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.SELECT_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.SELECT_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.SELECT_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        /**
         * Slice 121 — uncorrelated WHERE-side predicate subqueries inside
         * a scalar projection subquery body (the inner SELECT of a
         * {@code SELECT (SELECT ...) AS m FROM ...} scalar projection).
         * Reuses every {@link DiagnosticCode} from {@link #SELECT_WHERE}
         * (slice 113/114/120 precedent) because a scalar body IS a SELECT —
         * the shape rejects are semantically identical to top-level SELECT
         * WHERE. Only the {@code clauseLabel} differs so a reject inside a
         * {@code (SELECT ... WHERE NOT (...)) AS m} shape can identify the
         * scalar-body host context in the diagnostic message. The lift is
         * applied at the shared projection scalar-body build in
         * {@code extractScalarSubqueriesAsStatementsInternal}, covering both
         * the recursive (outer / CTE-body) and non-recursive (set-op-branch)
         * scalar contexts. The UPDATE SET-RHS scalar path keeps the slice-11
         * WHERE reject ({@code SCALAR_SUBQUERY_INNER_SUBQUERY_IN_WHERE}).
         * Keeping the codes shared preserves the enum count at 279 and
         * frees consumers from another code-family migration.
         */
        static final PredicateClauseContext SCALAR_BODY_WHERE = new PredicateClauseContext(
                "scalar subquery body WHERE clause",
                DiagnosticCode.SELECT_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.SELECT_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.SELECT_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.SELECT_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);

        /**
         * Slice 116 — uncorrelated WHERE-side predicate subqueries on
         * MERGE per-WHEN action WHEREs ({@code TMergeUpdateClause.updateWhereClause},
         * {@code TMergeUpdateClause.deleteWhereClause},
         * {@code TMergeInsertClause.insertWhereClause}). Reuses every
         * {@link DiagnosticCode} from {@link #SELECT_WHERE} (slice 113/114
         * precedent) because a MERGE-action WHERE predicate IS a SELECT
         * WHERE in shape — the shape rejects are semantically identical to
         * top-level SELECT WHERE. Only the {@code clauseLabel} differs so a
         * reject inside a MERGE WHEN can identify the host context in the
         * diagnostic message. Keeping the codes shared preserves the enum
         * count at 279 and frees consumers from another code-family
         * migration.
         */
        static final PredicateClauseContext MERGE_WHEN_WHERE = new PredicateClauseContext(
                "MERGE WHEN action WHERE clause",
                DiagnosticCode.SELECT_WHERE_EXISTS_BODY_MISSING,
                DiagnosticCode.SELECT_WHERE_EXISTS_INNER_RELATION_UNKNOWN,
                DiagnosticCode.SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_NOT_SUPPORTED,
                DiagnosticCode.SELECT_WHERE_OUTER_SHAPE_REJECTED,
                DiagnosticCode.SELECT_WHERE_PREDICATE_SCALAR_COMPARISON_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_NOT_LIFTABLE,
                DiagnosticCode.SELECT_WHERE_PREDICATE_GENERIC_NOT_SUPPORTED);
    }

    /** Syntactic wrapper kind captured before predicate-subquery lowering. */
    private enum PredicateSubqueryKind {
        EXISTS,
        IN,
        SCALAR_COMPARISON,
        QUANTIFIED_COMPARISON
    }

    /**
     * Immutable provenance for one recognised predicate-subquery wrapper.
     *
     * <p>The context is constructed from AST enums and tokens at wrapper
     * recognition time, then threaded through every later validation stage.
     * Diagnostics therefore never have to infer the original construct from
     * a partially lowered inner statement or re-scan SQL text.
     */
    private static final class PredicateSubqueryContext {
        final PredicateSubqueryKind kind;
        final boolean negated;
        final String comparisonOperator;
        final EQuantifierType quantifier;
        final PredicateClauseContext clause;
        final SourceSpan wrapperSpan;
        final SourceSpan innerSpan;

        private PredicateSubqueryContext(PredicateSubqueryKind kind,
                                         boolean negated,
                                         String comparisonOperator,
                                         EQuantifierType quantifier,
                                         PredicateClauseContext clause,
                                         SourceSpan wrapperSpan,
                                         SourceSpan innerSpan) {
            this.kind = kind;
            this.negated = negated;
            this.comparisonOperator = comparisonOperator;
            this.quantifier = quantifier;
            this.clause = clause;
            this.wrapperSpan = wrapperSpan;
            this.innerSpan = innerSpan;
        }

        static PredicateSubqueryContext from(TExpression wrapper,
                                             TExpression extractableNode,
                                             PredicateClauseContext clause) {
            EExpressionType type = wrapper == null
                    ? null : wrapper.getExpressionType();
            PredicateSubqueryKind kind;
            boolean negated = false;
            String operator = null;
            EQuantifierType quantifier = EQuantifierType.none;

            if (type == EExpressionType.exists_t) {
                kind = PredicateSubqueryKind.EXISTS;
            } else if (type == EExpressionType.logical_not_t
                    && extractableNode != null
                    && extractableNode.getExpressionType() == EExpressionType.exists_t) {
                kind = PredicateSubqueryKind.EXISTS;
                negated = true;
            } else if (type == EExpressionType.in_t) {
                kind = PredicateSubqueryKind.IN;
                negated = wrapper.getNotToken() != null;
            } else if (type == EExpressionType.simple_comparison_t) {
                kind = PredicateSubqueryKind.SCALAR_COMPARISON;
                operator = comparisonOperatorOf(wrapper);
            } else if (type == EExpressionType.group_comparison_t) {
                kind = PredicateSubqueryKind.QUANTIFIED_COMPARISON;
                operator = comparisonOperatorOf(wrapper);
                quantifier = wrapper.getQuantifierType();
            } else {
                throw invalidPredicateSubqueryContext(wrapper, clause,
                        "recognised predicate-subquery wrapper has unexpected type " + type);
            }

            if ((kind == PredicateSubqueryKind.SCALAR_COMPARISON
                    || kind == PredicateSubqueryKind.QUANTIFIED_COMPARISON)
                    && (operator == null || operator.isEmpty())) {
                throw invalidPredicateSubqueryContext(wrapper, clause,
                        "comparison predicate-subquery wrapper has no operator token");
            }
            if (kind == PredicateSubqueryKind.QUANTIFIED_COMPARISON
                    && (quantifier == null || quantifier == EQuantifierType.none)) {
                throw invalidPredicateSubqueryContext(wrapper, clause,
                        "quantified predicate-subquery wrapper has no quantifier");
            }

            TSelectSqlStatement inner = extractableNode == null
                    ? null : extractableNode.getSubQuery();
            return new PredicateSubqueryContext(kind, negated, operator,
                    quantifier, clause, SourceSpan.of(wrapper), SourceSpan.of(inner));
        }

        private static String comparisonOperatorOf(TExpression wrapper) {
            return wrapper.getOperatorToken() == null
                    ? null : wrapper.getOperatorToken().toString().trim();
        }

        String constructDisplayName() {
            switch (kind) {
                case EXISTS:
                    return negated ? "NOT EXISTS subquery" : "EXISTS subquery";
                case IN:
                    return negated ? "NOT IN subquery" : "IN subquery";
                case SCALAR_COMPARISON:
                    return comparisonOperator + " scalar subquery comparison";
                case QUANTIFIED_COMPARISON:
                    return comparisonOperator + " "
                            + quantifier.name().toUpperCase(Locale.ROOT)
                            + " subquery comparison";
                default:
                    throw new IllegalStateException("unhandled predicate-subquery kind " + kind);
            }
        }
    }

    /**
     * Central renderer for unsupported predicate-subquery diagnostics.
     * Stable codes continue to identify the failed semantic capability;
     * message text and provenance identify the actual wrapper and clause.
     */
    private static final class PredicateSubqueryDiagnostics {
        private static final String WRAPPER_ROLE = "predicate-subquery-wrapper";

        static Diagnostic unsupported(DiagnosticCode code,
                                      PredicateSubqueryContext context,
                                      String reason,
                                      TParseTreeNode failureAnchor) {
            return unsupportedWithSpan(code, context, reason,
                    SourceSpan.of(failureAnchor));
        }

        static Diagnostic unsupportedWithSpan(DiagnosticCode code,
                                              PredicateSubqueryContext context,
                                              String reason,
                                              SourceSpan failureSpan) {
            SourceSpan primary = failureSpan != null
                    ? failureSpan
                    : (context.innerSpan != null
                            ? context.innerSpan : context.wrapperSpan);
            Diagnostic.Builder builder = Diagnostic.builder(code, Severity.ERROR,
                    context.constructDisplayName() + " in "
                            + context.clause.clauseLabel + ": " + reason)
                    .span(primary);
            if (context.wrapperSpan != null
                    && !context.wrapperSpan.equals(primary)) {
                builder.addRelatedLocation(RelatedLocation.of(
                        WRAPPER_ROLE,
                        "predicate subquery wrapper is here",
                        context.wrapperSpan));
            }
            return builder.build();
        }
    }

    private static SemanticIRBuildException invalidPredicateSubqueryContext(
            TExpression wrapper,
            PredicateClauseContext clause,
            String reason) {
        return new SemanticIRBuildException(
                Diagnostic.error(clause.genericSubqueryNotSupported,
                        "predicate subquery in " + clause.clauseLabel + ": " + reason,
                        wrapper));
    }

    /**
     * Slice 110 — preserved entry-point alias for the JOIN-ON walker.
     * Delegates to {@link #extractUncorrelatedPredicateSubqueriesFromClause}
     * with {@link PredicateClauseContext#JOIN_ON} so existing JOIN-ON
     * callers (single site in {@code buildRelations}) need no change and
     * the slice-23+ diagnostic byte-shape is preserved exactly.
     */
    private static Set<TExpression> extractUncorrelatedPredicateSubqueriesFromJoinOn(
            TExpression onCond,
            final NameBindingProvider provider,
            final List<StatementGraph> stmts,
            final List<LineageEdge> lineage,
            final Map<String, Integer> cteMapForExtraction) {
        return extractUncorrelatedPredicateSubqueriesFromClause(
                onCond, provider, stmts, lineage, cteMapForExtraction,
                PredicateClauseContext.JOIN_ON,
                /*correlationScope=*/ null);
    }

    /**
     * Slice 118 — overload preserved for the slice-110 / 111 / 112 / 113 /
     * 114 / 116 call sites that don't admit correlation. Delegates to the
     * 8-arg form with {@code correlationScope=null}.
     */
    private static Set<TExpression> extractUncorrelatedPredicateSubqueriesFromClause(
            TExpression onCond,
            final NameBindingProvider provider,
            final List<StatementGraph> stmts,
            final List<LineageEdge> lineage,
            final Map<String, Integer> cteMapForExtraction,
            final PredicateClauseContext ctx) {
        return extractUncorrelatedPredicateSubqueriesFromClause(onCond,
                provider, stmts, lineage, cteMapForExtraction, ctx,
                /*correlationScope=*/ null, /*semiFactsOut=*/ null,
                /*outerRelationAliases=*/ Collections.<String>emptySet());
    }

    /**
     * R8 — delegating overload preserving the pre-R8 7-arg signature
     * (correlationScope, no semi-join collector). MERGE / UPDATE / DELETE
     * predicate-WHERE callers route here; semi-join facts are collected
     * only on the SELECT WHERE path (which calls the 8-arg overload with a
     * non-null {@code semiFactsOut}).
     */
    private static Set<TExpression> extractUncorrelatedPredicateSubqueriesFromClause(
            TExpression onCond,
            final NameBindingProvider provider,
            final List<StatementGraph> stmts,
            final List<LineageEdge> lineage,
            final Map<String, Integer> cteMapForExtraction,
            final PredicateClauseContext ctx,
            final EnclosingScope correlationScope) {
        return extractUncorrelatedPredicateSubqueriesFromClause(onCond,
                provider, stmts, lineage, cteMapForExtraction, ctx,
                correlationScope, /*semiFactsOut=*/ null,
                /*outerRelationAliases=*/ Collections.<String>emptySet());
    }

    /**
     * Slice 118 — same as the 7-arg overload but threads an optional
     * {@code correlationScope} (target + USING source + outer CTEs) into
     * {@link #extractOnePredicateSubqueryBody}. When non-null, the inner
     * predicate-body build uses tolerant outer binding and the post-build
     * correlation walk PROMOTES outer-aliased refs into synthesised
     * OUTER_REFERENCE relations instead of rejecting them. The FILTER and
     * WITHIN GROUP correlation walks remain active (codex round-1 Q2
     * BLOCKING fix) so refs hidden inside FILTER subtrees or PG
     * {@code fn.withinGroup.orderBy} continue to reject.
     *
     * <p>All non-MERGE callers pass {@code correlationScope=null} and
     * therefore see the same semantic behaviour. Only
     * {@link #collectMergeActionWhere} passes a non-null scope (built once
     * per MERGE in {@code buildMerge} via
     * {@link #buildMergeEnclosingScope}).
     */
    private static Set<TExpression> extractUncorrelatedPredicateSubqueriesFromClause(
            TExpression onCond,
            final NameBindingProvider provider,
            final List<StatementGraph> stmts,
            final List<LineageEdge> lineage,
            final Map<String, Integer> cteMapForExtraction,
            final PredicateClauseContext ctx,
            final EnclosingScope correlationScope,
            final List<SemiJoinFact> semiFactsOut,
            final Set<String> outerRelationAliases) {
        // Defensive null assertions — the extraction path can only be
        // reached from buildRelations when
        // allowJoinOnPredicateSubqueries=true (outer-SELECT only), which
        // guarantees stmts/lineage/cteMap are non-null. Failing here means
        // a future refactor wired a non-outer call site through the slice-25
        // path without supplying the required state.
        if (onCond == null) {
            return Collections.newSetFromMap(new java.util.IdentityHashMap<TExpression, Boolean>());
        }
        if (stmts == null || lineage == null || cteMapForExtraction == null) {
            throw new IllegalStateException(
                    "extractUncorrelatedPredicateSubqueriesFromClause("
                            + ctx.clauseLabel + ") activated without required state — "
                            + "stmts=" + (stmts == null ? "null" : "ok")
                            + " lineage=" + (lineage == null ? "null" : "ok")
                            + " cteMap=" + (cteMapForExtraction == null ? "null" : "ok")
                            + "; caller misconfiguration");
        }
        final Set<TExpression> extractedRoots =
                Collections.newSetFromMap(new java.util.IdentityHashMap<TExpression, Boolean>());
        // Slice 25 (impl-review M1-fix): explicit reject for
        // {@code logical_not_t} over a slice-25 IN / scalar-cmp /
        // ANY-ALL-SOME wrapper at the root. The slice-23/24
        // {@code logical_not_t} over {@code exists_t} (NOT EXISTS)
        // remains admitted by unwrapToInnerExtractableSubquery.
        if (isLogicalNotOverNonExistsWrapper(onCond)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(ctx.predicateNotNot,
                    "predicate subquery in " + ctx.clauseLabel + ": NOT applied to "
                            + "a non-EXISTS predicate subquery wrapper "
                            + "(" + onCond.getRightOperand().getExpressionType()
                            + ") is not supported yet — the slice-25 boundary "
                            + "admits NOT only over EXISTS; "
                            + "rewrite e.g. NOT (a IN (SELECT ...)) as "
                            + "a NOT IN (SELECT ...)", onCond));
        }
        // Root fast path: acceptChildren never visits the root node, so
        // a clause whose entire expression IS a wrapper would be missed
        // by the descendant walker.
        TExpression rootExtractable = unwrapToInnerExtractableSubquery(onCond);
        if (rootExtractable != null) {
            PredicateSubqueryContext subqueryContext =
                    PredicateSubqueryContext.from(onCond, rootExtractable, ctx);
            // M1-fix + slice-26 dual-side: validate the non-subquery
            // side of non-EXISTS wrappers BEFORE extracting (so partial
            // extraction never lands). Slice 25 carryover: subquery on
            // RHS → validate LHS via isAdmittedOuterLhsShape.
            // Slice 26 NEW: subquery on LHS (simple_comparison_t only)
            // → validate RHS via isAdmittedOuterRhsShape.
            if (onCond.getExpressionType() != EExpressionType.exists_t
                    && onCond.getExpressionType() != EExpressionType.logical_not_t) {
                boolean isLhsSubquery = (rootExtractable == onCond.getLeftOperand());
                boolean nonSubquerySideOk = isLhsSubquery
                        ? isAdmittedOuterRhsShape(onCond.getRightOperand())
                        : isAdmittedOuterLhsShape(onCond.getLeftOperand());
                if (!nonSubquerySideOk) {
                    throw new SemanticIRBuildException(
                            PredicateSubqueryDiagnostics.unsupported(
                                    ctx.outerShapeRejected,
                                    subqueryContext,
                                    buildOuterShapeRejectionReason(
                                            onCond, isLhsSubquery),
                                    isLhsSubquery
                                            ? onCond.getRightOperand()
                                            : onCond.getLeftOperand()));
                }
            }
            extractOnePredicateSubqueryBody(onCond, rootExtractable, provider, stmts, lineage,
                    cteMapForExtraction, subqueryContext, correlationScope, semiFactsOut,
                    outerRelationAliases);
            extractedRoots.add(rootExtractable);
        }
        // Descendant walk: find every wrapper at any depth. Skip into
        // already-extracted subtrees (so we don't re-enter the body
        // looking for nested wrappers — covered by the inner-shape
        // preflight's "no nested predicate subqueries in body"
        // rejection).
        onCond.acceptChildren(new TParseTreeVisitor() {
            // Track depth into already-extracted roots and into wrapper
            // subtrees we've extracted. preVisit increments on the
            // wrapper (the parent that contained the inner extractable);
            // postVisit decrements on either the inner extractable
            // (extractedRoots.contains) or the wrapper
            // (unwrapToInnerExtractableSubquery != null). The
            // {@code skipDepth > 0} guard prevents the second
            // decrement from going negative when both apply (e.g. NOT
            // EXISTS — both the logical_not_t wrapper and the inner
            // exists_t fire).
            int skipDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (skipDepth > 0) return;
                if (extractedRoots.contains(e)) {
                    // Already-extracted inner being re-visited shouldn't
                    // happen in normal traversal but defensive guard
                    // avoids double-extraction if it ever did.
                    skipDepth++;
                    return;
                }
                // Slice 25 (impl-review M1-fix): explicit reject for
                // {@code logical_not_t} over a slice-25 wrapper at any
                // depth. Without this, the visitor would descend into
                // the wrapper child and silently extract — admitting
                // a shape (`NOT (a IN (SELECT ...))`) that the
                // slice-25 boundary does NOT admit.
                if (isLogicalNotOverNonExistsWrapper(e)) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(ctx.predicateNotNot,
                            "predicate subquery in " + ctx.clauseLabel + ": NOT applied to "
                                    + "a non-EXISTS predicate subquery wrapper "
                                    + "(" + e.getRightOperand().getExpressionType()
                                    + ") is not supported yet — the slice-25 "
                                    + "boundary admits NOT only over EXISTS; "
                                    + "rewrite e.g. NOT (a IN (SELECT ...)) as "
                                    + "a NOT IN (SELECT ...)", e));
                }
                TExpression toExtract = unwrapToInnerExtractableSubquery(e);
                if (toExtract != null) {
                    PredicateSubqueryContext subqueryContext =
                            PredicateSubqueryContext.from(e, toExtract, ctx);
                    // M1-fix + slice-26 dual-side: validate the non-
                    // subquery side BEFORE extracting (so partial
                    // extraction never lands). The slice-23/24
                    // NOT-EXISTS path uses logical_not_t, which has no
                    // outer-shape gate.
                    if (e.getExpressionType() != EExpressionType.exists_t
                            && e.getExpressionType() != EExpressionType.logical_not_t) {
                        boolean isLhsSubquery = (toExtract == e.getLeftOperand());
                        boolean nonSubquerySideOk = isLhsSubquery
                                ? isAdmittedOuterRhsShape(e.getRightOperand())
                                : isAdmittedOuterLhsShape(e.getLeftOperand());
                        if (!nonSubquerySideOk) {
                            throw new SemanticIRBuildException(
                                    PredicateSubqueryDiagnostics.unsupported(
                                            ctx.outerShapeRejected,
                                            subqueryContext,
                                            buildOuterShapeRejectionReason(
                                                    e, isLhsSubquery),
                                            isLhsSubquery
                                                    ? e.getRightOperand()
                                                    : e.getLeftOperand()));
                        }
                    }
                    if (extractedRoots.contains(toExtract)) return;
                    extractOnePredicateSubqueryBody(e, toExtract, provider, stmts, lineage,
                            cteMapForExtraction, subqueryContext, correlationScope, semiFactsOut,
                            outerRelationAliases);
                    extractedRoots.add(toExtract);
                    skipDepth++;
                }
            }

            @Override
            public void postVisit(TExpression e) {
                // M2-fix: decrement on EITHER the extracted inner
                // (extractedRoots.contains) OR the wrapper
                // (unwrapToInnerExtractableSubquery != null). The
                // {@code skipDepth > 0} guard prevents going negative
                // when both apply.
                if (skipDepth > 0
                        && (extractedRoots.contains(e)
                                || unwrapToInnerExtractableSubquery(e) != null)) {
                    skipDepth--;
                }
            }
        });
        return extractedRoots;
    }

    /**
     * R8 — a predicate-derived semi-join discovered during WHERE
     * predicate-subquery extraction. Carries the polarity (semi vs
     * anti-semi), the lifted inner block's statement index + label, the
     * optional outer relation alias (for the left endpoint), the
     * correlated outer↔inner column conditions (may be empty), and the
     * wrapper's source span / verbatim text. Converted to a
     * {@link JoinEntity} at JoinGraph-assembly time (which has the outer
     * relation list to resolve the left endpoint's qualified name).
     */
    private static final class SemiJoinFact {
        final SemanticJoinType polarity;
        final int innerStatementIndex;
        final String innerLabel;
        // Distinct outer relation aliases referenced by the correlation
        // (insertion order). Empty for an uncorrelated subquery. When a
        // single alias, the left endpoint is that relation; when several,
        // the left endpoint is the accumulated outer rowset (codex R8).
        final List<String> outerAliases;
        final List<Predicate> conditions; // never null; may be empty
        final SourceSpan span;            // nullable
        final String conditionText;       // nullable
        /**
         * Degrade only (GitHub #708): the body was never analyzed, so WHICH
         * outer relation the subquery correlates to is unknown — as opposed to
         * known-to-be-none, which is what an empty {@link #outerAliases} means
         * on the normal path. Anchors the left endpoint to the whole outer
         * rowset instead of letting the single-relation fallback name one.
         */
        final boolean outerAnchorUnknown;

        SemiJoinFact(SemanticJoinType polarity, int innerStatementIndex,
                     String innerLabel, List<String> outerAliases,
                     List<Predicate> conditions, SourceSpan span,
                     String conditionText) {
            this(polarity, innerStatementIndex, innerLabel, outerAliases,
                    conditions, span, conditionText, /*outerAnchorUnknown=*/ false);
        }

        SemiJoinFact(SemanticJoinType polarity, int innerStatementIndex,
                     String innerLabel, List<String> outerAliases,
                     List<Predicate> conditions, SourceSpan span,
                     String conditionText, boolean outerAnchorUnknown) {
            this.outerAnchorUnknown = outerAnchorUnknown;
            this.polarity = polarity;
            this.innerStatementIndex = innerStatementIndex;
            this.innerLabel = innerLabel;
            this.outerAliases = outerAliases == null
                    ? Collections.<String>emptyList() : outerAliases;
            this.conditions = conditions == null
                    ? Collections.<Predicate>emptyList() : conditions;
            this.span = span;
            this.conditionText = conditionText;
        }
    }

    /**
     * R8 — semi-join polarity for a predicate wrapper. {@code EXISTS} /
     * {@code IN} → {@link SemanticJoinType#SEMI}; {@code NOT EXISTS}
     * (logical_not over exists) / {@code NOT IN} ({@code in_t} with a NOT
     * token) → {@link SemanticJoinType#ANTI_SEMI}. Returns {@code null}
     * for wrappers that are not modelled as semi-joins (scalar comparison,
     * ANY/ALL/SOME) so the caller emits no semi-join fact for them.
     */
    private static SemanticJoinType semiJoinPolarity(TExpression wrapper) {
        if (wrapper == null) return null;
        EExpressionType t = wrapper.getExpressionType();
        if (t == EExpressionType.logical_not_t) {
            // NOT EXISTS — the slice-25 boundary admits NOT only over EXISTS.
            TExpression inner = wrapper.getRightOperand();
            if (inner != null && inner.getExpressionType() == EExpressionType.exists_t) {
                return SemanticJoinType.ANTI_SEMI;
            }
            return null;
        }
        if (t == EExpressionType.exists_t) {
            return SemanticJoinType.SEMI;
        }
        if (t == EExpressionType.in_t) {
            return wrapper.getNotToken() != null
                    ? SemanticJoinType.ANTI_SEMI : SemanticJoinType.SEMI;
        }
        return null;
    }

    /**
     * R8 — build the {@link SemiJoinFact} for an extracted predicate
     * subquery, or {@code null} when the wrapper is not a semi-join shape
     * ({@link #semiJoinPolarity} null) or no collector is requested.
     *
     * <p>Correlation pairing:
     * <ul>
     *   <li>{@code IN}: outer column = the non-subquery side of the
     *       {@code in_t}; inner column = the subquery's first output
     *       column source.</li>
     *   <li>{@code EXISTS} / {@code NOT EXISTS}: outer↔inner pairs are
     *       lifted from equi-conjuncts in the inner WHERE that compare an
     *       inner-local column to an outer (non-local) column.</li>
     * </ul>
     */
    private static SemiJoinFact buildSemiJoinFact(TExpression wrapper,
                                                  TExpression extractableNode,
                                                  TSelectSqlStatement inner,
                                                  StatementGraph innerStmt,
                                                  int innerIndex, String innerLabel,
                                                  Set<String> innerLocalAliases,
                                                  NameBindingProvider provider) {
        SemanticJoinType polarity = semiJoinPolarity(wrapper);
        if (polarity == null) return null;
        List<Predicate> conditions = new ArrayList<>();
        // Distinct outer aliases, insertion-ordered (codex R8: drives the
        // single-relation-vs-joined-rowset left-endpoint choice).
        java.util.LinkedHashSet<String> outerAliases = new java.util.LinkedHashSet<>();
        if (wrapper.getExpressionType() == EExpressionType.in_t) {
            // Membership equality: outer side (the non-subquery operand) =
            // the subquery's first output column. Both must be bare columns.
            boolean lhsIsSubquery = (extractableNode == wrapper.getLeftOperand());
            TExpression outerSide = lhsIsSubquery
                    ? wrapper.getRightOperand() : wrapper.getLeftOperand();
            ColumnRef outerCol = bareColumnRefOf(outerSide, provider);
            // codex R8 [P2 round 2]: the inner membership column must ALSO
            // be a bare column. `a.id IN (SELECT b.id + 1 FROM b)` projects
            // a compound expression — emitting `a.id = b.id` would be a
            // fabricated equality, so omit the membership pair there.
            ColumnRef innerCol = isFirstProjectionBareColumn(inner)
                    ? firstOutputColumnRefOf(innerStmt) : null;
            // codex R8 [P2 round 3]: the inner membership column must be a
            // genuine inner-local column. `a.id IN (SELECT a.id FROM t2 b)`
            // projects an OUTER column — emitting `a.id = a.id` would
            // misrepresent the predicate and not connect the right endpoint.
            if (outerCol != null && innerCol != null
                    && isLocalAlias(innerCol, innerLocalAliases)) {
                addOuterAlias(outerAliases, outerCol);
                conditions.add(equiPredicate(outerCol, innerCol,
                        SourceSpan.of(wrapper)));
            }
            // codex R8 [P1]: a correlated IN (e.g. `a.id IN (SELECT b.id
            // FROM b WHERE b.k = a.k)`) also carries correlation in the
            // inner WHERE — fold those pairs in too so they are not lost.
            for (ColumnRef[] pair : extractCorrelationPairs(inner,
                    innerLocalAliases, provider)) {
                addOuterAlias(outerAliases, pair[0]);
                conditions.add(equiPredicate(pair[0], pair[1], null));
            }
        } else {
            // EXISTS / NOT EXISTS — correlation lives in the inner WHERE.
            for (ColumnRef[] pair : extractCorrelationPairs(inner,
                    innerLocalAliases, provider)) {
                addOuterAlias(outerAliases, pair[0]);
                conditions.add(equiPredicate(pair[0], pair[1], null));
            }
        }
        return new SemiJoinFact(polarity, innerIndex, innerLabel,
                new ArrayList<>(outerAliases),
                conditions, SourceSpan.of(wrapper), verbatimText(wrapper));
    }

    private static void addOuterAlias(java.util.LinkedHashSet<String> aliases,
                                      ColumnRef outerCol) {
        if (outerCol != null && outerCol.getRelationAlias() != null
                && !outerCol.getRelationAlias().isEmpty()) {
            aliases.add(outerCol.getRelationAlias());
        }
    }

    /**
     * R8 — the resolved {@link ColumnRef} for an expression that is a
     * <em>bare, qualified column reference</em> ({@code simple_object_name_t}
     * with a relation alias), or {@code null} otherwise. Strict by design
     * (codex R8 review): a compound operand such as {@code b.k + 1} or
     * {@code lower(a.n)} returns {@code null} so we never synthesise a
     * misleading EQUI column predicate from a side that is not a plain
     * column (the pair is omitted instead).
     */
    private static ColumnRef bareColumnRefOf(TExpression expr,
                                             NameBindingProvider provider) {
        if (expr == null
                || expr.getExpressionType() != EExpressionType.simple_object_name_t) {
            return null;
        }
        try {
            List<ColumnRef> refs = collectColumnRefs(expr, provider);
            for (ColumnRef r : refs) {
                if (r != null && r.getRelationAlias() != null
                        && !r.getRelationAlias().isEmpty()) {
                    return r;
                }
            }
        } catch (RuntimeException ignore) {
            // Tolerant: an un-extractable column ref just yields no column.
        }
        return null;
    }

    /**
     * R8 — true iff the inner SELECT's first projection is a bare column
     * reference ({@code simple_object_name_t}). Guards the IN membership
     * equality so a compound projection ({@code SELECT b.id + 1 ...}) does
     * not produce a fabricated bare-column equality.
     */
    private static boolean isFirstProjectionBareColumn(TSelectSqlStatement inner) {
        if (inner == null || inner.getResultColumnList() == null
                || inner.getResultColumnList().size() == 0) {
            return false;
        }
        TResultColumn rc = inner.getResultColumnList().getResultColumn(0);
        if (rc == null || rc.getExpr() == null) {
            return false;
        }
        return rc.getExpr().getExpressionType() == EExpressionType.simple_object_name_t;
    }

    /** R8 — the first source {@link ColumnRef} of a block's first output column. */
    private static ColumnRef firstOutputColumnRefOf(StatementGraph innerStmt) {
        if (innerStmt == null) return null;
        List<OutputColumn> outs = innerStmt.getOutputColumns();
        if (outs == null || outs.isEmpty()) return null;
        List<ColumnRef> sources = outs.get(0).getSources();
        if (sources == null || sources.isEmpty()) return null;
        return sources.get(0);
    }

    /** R8 — synthesise an EQUI {@link Predicate} from two column refs. */
    private static Predicate equiPredicate(ColumnRef left, ColumnRef right,
                                           SourceSpan span) {
        return new Predicate(PredicateKind.EQUI, "=",
                PredicateOperand.column(left, null),
                PredicateOperand.column(right, null), span);
    }

    /**
     * R8 — lift outer↔inner correlation pairs from a correlated EXISTS
     * inner WHERE. Walks the top-level AND conjuncts iteratively (the
     * left-leaning binary tree of {@code logical_and_t} — never recurse,
     * per the project StackOverflow guard) and, for each {@code =}
     * comparison whose two sides are one inner-local column and one
     * outer (non-local) column, emits the pair {@code [outerCol, innerCol]}.
     * Returns an empty list for an uncorrelated EXISTS.
     */
    private static List<ColumnRef[]> extractCorrelationPairs(
            TSelectSqlStatement inner, Set<String> innerLocalAliases,
            NameBindingProvider provider) {
        List<ColumnRef[]> out = new ArrayList<>();
        if (inner == null || inner.getWhereClause() == null
                || inner.getWhereClause().getCondition() == null) {
            return out;
        }
        // Iterative DFS over AND-conjuncts (left-leaning tree).
        Deque<TExpression> stack = new ArrayDeque<>();
        stack.push(inner.getWhereClause().getCondition());
        int guard = 0;
        while (!stack.isEmpty() && guard++ < 100000) {
            TExpression e = stack.pop();
            if (e == null) continue;
            if (e.getExpressionType() == EExpressionType.logical_and_t) {
                if (e.getRightOperand() != null) stack.push(e.getRightOperand());
                if (e.getLeftOperand() != null) stack.push(e.getLeftOperand());
                continue;
            }
            if (e.getExpressionType() != EExpressionType.simple_comparison_t) {
                continue;
            }
            String op = e.getOperatorToken() != null
                    ? e.getOperatorToken().toString() : null;
            if (op == null || !"=".equals(op)) continue;
            ColumnRef l = bareColumnRefOf(e.getLeftOperand(), provider);
            ColumnRef r = bareColumnRefOf(e.getRightOperand(), provider);
            if (l == null || r == null) continue;
            boolean lLocal = isLocalAlias(l, innerLocalAliases);
            boolean rLocal = isLocalAlias(r, innerLocalAliases);
            // Exactly one side local → the other is the outer correlation.
            if (lLocal && !rLocal) {
                out.add(new ColumnRef[]{ r, l }); // [outer, inner]
            } else if (rLocal && !lLocal) {
                out.add(new ColumnRef[]{ l, r });
            }
        }
        return out;
    }

    private static boolean isLocalAlias(ColumnRef ref, Set<String> innerLocalAliases) {
        return ref.getRelationAlias() != null
                && innerLocalAliases.contains(
                        ref.getRelationAlias().toLowerCase(Locale.ROOT));
    }

    /**
     * R8 — true iff {@code alias} names a relation in the host SELECT's FROM
     * list ({@code outerRelationAliases}, lower-cased). Gates the
     * correlated-EXISTS degrade so only a genuine outer-relation correlation
     * degrades; an alias that is neither inner-local nor a known outer
     * relation (a typo) still rejects.
     */
    private static boolean isKnownOuterAlias(String alias,
                                             Set<String> outerRelationAliases) {
        return alias != null && outerRelationAliases != null
                && outerRelationAliases.contains(alias.toLowerCase(Locale.ROOT));
    }

    /**
     * Slice 25 (rename of slice-23 {@code extractOneExistsBody}):
     * extract a single predicate-subquery body's inner SELECT as its
     * own {@code <predicate_subquery_<i>>} StatementGraph. Runs the
     * inner-shape preflight before recursive build, then post-build
     * correlation check.
     *
     * <p>{@code extractableNode} is either an {@code exists_t}
     * (slice-23 EXISTS / slice-24 column-bearing EXISTS) or a
     * {@code subquery_t} (slice-25 IN-SELECT / scalar comparison /
     * ANY-ALL-SOME). Both expose the inner SELECT via
     * {@link TExpression#getSubQuery()}.
     *
     * <p>R8 — {@code wrapper} is the predicate wrapper containing
     * {@code extractableNode} ({@code exists_t} / {@code logical_not_t}
     * over exists / {@code in_t} / comparison). When {@code semiFactsOut}
     * is non-null and the wrapper is an EXISTS/IN shape, a
     * {@link SemiJoinFact} is appended for the JoinGraph. When
     * {@code correlationScope} is null a correlated EXISTS now DEGRADES
     * (records the correlation, does not throw) instead of failing with
     * {@code *_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS} (R8 degrade).
     */
    private static int extractOnePredicateSubqueryBody(TExpression wrapper,
                                                        TExpression extractableNode,
                                                        NameBindingProvider provider,
                                                        List<StatementGraph> stmts,
                                                        List<LineageEdge> lineage,
                                                        Map<String, Integer> cteMapForExtraction,
                                                        PredicateSubqueryContext context,
                                                        EnclosingScope correlationScope,
                                                        List<SemiJoinFact> semiFactsOut,
                                                        Set<String> outerRelationAliases) {
        if (!activeOptions().isDegradeUnsupportedNestedBlocks()) {
            return extractOnePredicateSubqueryBodyStrict(wrapper, extractableNode, provider,
                    stmts, lineage, cteMapForExtraction, context, correlationScope,
                    semiFactsOut, outerRelationAliases);
        }
        // Degrade mode. Mark every list the strict extractor appends to, so a
        // reject thrown midway (e.g. inside emitLineageForStatement, after the
        // body was already appended) cannot leave a half-built body behind.
        // `cteMapForExtraction` is not marked: the predicate body is built with
        // null extraction maps and registers no CTE of its own.
        final int stmtsMark = stmts.size();
        final int lineageMark = lineage.size();
        final int semiFactsMark = (semiFactsOut == null) ? 0 : semiFactsOut.size();
        try {
            return extractOnePredicateSubqueryBodyStrict(wrapper, extractableNode, provider,
                    stmts, lineage, cteMapForExtraction, context, correlationScope,
                    semiFactsOut, outerRelationAliases);
        } catch (SemanticIRBuildException e) {
            // Recovery is a capability policy, not an error-suppression
            // policy. Invalid syntax/dialect semantics must reach the caller
            // as the original ERROR instead of becoming a successful opaque
            // block with only NESTED_BLOCK_UNANALYZED.
            if (!DiagnosticDescriptorCatalog
                    .isUnsupportedNestedBlockRecoverable(e.getDiagnostics())) {
                throw e;
            }
            truncateTo(stmts, stmtsMark);
            truncateTo(lineage, lineageMark);
            if (semiFactsOut != null) {
                truncateTo(semiFactsOut, semiFactsMark);
            }
            return emitUnanalyzedPredicateBody(wrapper, extractableNode,
                    e.getDiagnostic(), stmts, semiFactsOut);
        }
    }

    /** Drop everything appended to {@code list} past {@code mark}. */
    private static void truncateTo(List<?> list, int mark) {
        while (list.size() > mark) {
            list.remove(list.size() - 1);
        }
    }

    /**
     * Degrade path — stand a {@link StatementGraph#KIND_UNANALYZED}
     * placeholder in for a predicate-subquery body the builder rejected, and
     * record the event as a {@link DiagnosticCode#NESTED_BLOCK_UNANALYZED}
     * warning.
     *
     * <p>This is sound precisely because a predicate body is unreachable from
     * its host block: no host relation names it and no lineage edge targets
     * it (see the "UNREACHABLE from outer" note in
     * {@link #extractOnePredicateSubqueryBodyStrict}). Dropping the body's own
     * facts therefore removes nothing the host block publishes — every fact
     * still returned was proved the same way it is proved today.
     *
     * <p>What IS lost is the body's own analysis plus the semi-join fact that
     * would have linked it to the host. That loss is explicit, not silent:
     * the placeholder occupies the body's slot with its synthetic name, its
     * kind reads {@code UNANALYZED} rather than {@code SELECT}, and it carries
     * the original ERROR diagnostic — anchored, when the reject site had no
     * span of its own, at the rejected inner block.
     *
     * @return the index of the placeholder in {@code stmts}
     */
    private static int emitUnanalyzedPredicateBody(TExpression wrapper,
                                                   TExpression extractableNode,
                                                   Diagnostic originalReason,
                                                   List<StatementGraph> stmts,
                                                   List<SemiJoinFact> semiFactsOut) {
        Diagnostic reason = originalReason;
        SourceSpan span = reason.getSpan();
        if (span == null) {
            // The reject site had no anchor. Fall back to the inner block
            // itself, then to the predicate wrapper node, so the caller can
            // still point at the offending text (the reporter's ask on
            // MantisBT 4676 / GitHub #708).
            TSelectSqlStatement inner = extractableNode.getSubQuery();
            span = SourceSpan.of(inner);
            if (span == null) {
                span = SourceSpan.of(extractableNode);
            }
            // Re-stamp the reason with the fallback anchor so
            // getUnanalyzedReason().getSpan() points at the skipped block even
            // when the reject site itself had nothing to anchor to. Code,
            // message and ERROR severity are preserved verbatim.
            if (span != null) {
                reason = reason.withSpan(span);
            }
        }
        int idx = stmts.size();
        String name = PREDICATE_BODY_PREFIX + idx + ">";
        recordBuildWarning(Diagnostic.warnWithSpan(
                DiagnosticCode.NESTED_BLOCK_UNANALYZED,
                "predicate subquery body '" + name + "' was not analyzed: "
                        + reason.getMessage(), span));
        stmts.add(StatementGraph.unanalyzed(name, reason, span));
        // Keep the semi-join. Its POLARITY is a property of the wrapper alone
        // ({@code EXISTS}/{@code IN} -> SEMI, {@code NOT EXISTS}/{@code NOT IN}
        // -> ANTI_SEMI): {@link #semiJoinPolarity} reads only `wrapper` and
        // never touches the body, so "the host has a semi-join against block
        // N" stays provable even though the body did not analyze. Dropping it
        // would delete a fact we can prove — the one thing degrade mode must
        // never do — and would leave the host JoinGraph claiming the EXISTS
        // simply is not there.
        //
        // The entity is deliberately OPAQUE: empty conditions and empty
        // outerAliases. Both are unknowable without the body, and empty
        // outerAliases routes {@link #outerEndpointFor} through the same
        // first-FROM-relation fallback an uncorrelated EXISTS already uses.
        // No predicate and no correlation pair is invented; the right endpoint
        // is the placeholder block, whose UNANALYZED kind tells the consumer
        // the other side was not analyzed.
        if (semiFactsOut != null) {
            SemanticJoinType polarity = semiJoinPolarity(wrapper);
            if (polarity != null) {
                semiFactsOut.add(new SemiJoinFact(polarity, idx, name,
                        Collections.<String>emptyList(),
                        Collections.<Predicate>emptyList(),
                        SourceSpan.of(wrapper),
                        // The wrapper is fully parsed, so its lexical text is
                        // provable even though its structure is not. Keep it —
                        // the supported path records the same thing.
                        verbatimText(wrapper),
                        /*outerAnchorUnknown=*/ true));
            }
        }
        return idx;
    }

    private static int extractOnePredicateSubqueryBodyStrict(TExpression wrapper,
                                                        TExpression extractableNode,
                                                        NameBindingProvider provider,
                                                        List<StatementGraph> stmts,
                                                        List<LineageEdge> lineage,
                                                        Map<String, Integer> cteMapForExtraction,
                                                        PredicateSubqueryContext context,
                                                        EnclosingScope correlationScope,
                                                        List<SemiJoinFact> semiFactsOut,
                                                        Set<String> outerRelationAliases) {
        PredicateClauseContext ctx = context.clause;
        TSelectSqlStatement inner = extractableNode.getSubQuery();
        if (inner == null) {
            // Degenerate node with no subquery; defensive.
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            ctx.existsBodyMissing, context,
                            "subquery body is missing", wrapper));
        }
        // (a–g) Inner-shape preflight (slice-23 boundary; slice 24 widens
        // (e) to admit single column-ref projection in addition to constant).
        preflightPredicateSubqueryShape(inner, context);

        // Slice 118 — when an enclosing correlation scope is supplied
        // (MERGE per-WHEN action WHERE only), decorate `provider` with
        // tolerant outer binding so the inner build admits qualified refs
        // to outer aliases (target / USING source / outer CTEs) as
        // synthetic EXACT_MATCH bindings instead of rejecting them as
        // COLUMN_BINDING_NON_EXACT. Mirrors the slice-117 pattern for
        // UPDATE SET-RHS correlated scalars. Computed BEFORE
        // buildSelectStatementImpl so the inner build's bindColumn calls
        // see the tolerant fallback already populated (codex round-5
        // ordering fix from slice 117). Qualifiers IN the inner's local
        // FROM aliases still strict-reject so real typos (`o.bad_col`
        // where `o` IS the inner FROM alias) still surface as
        // COLUMN_BINDING_NON_EXACT.
        final NameBindingProvider effectiveProvider;
        if (correlationScope != null) {
            Set<String> innerLocalAliasesForTolerant =
                    precomputeInnerLocalAliases(inner);
            effectiveProvider = innerLocalAliasesForTolerant.isEmpty()
                    ? provider
                    : provider.withTolerantOuterBinding(
                            innerLocalAliasesForTolerant);
        } else {
            effectiveProvider = provider;
        }

        // Build the inner SELECT as its own StatementGraph. SAME provider
        // as outer (codex round-1 MUST 3 — outer CTEs remain visible).
        // Slice 118: tolerant-decorated provider when correlationScope
        // != null (MERGE per-WHEN action WHERE only); same provider as
        // before otherwise.
        // hasOuterCteListAlreadyProcessed=false (codex round-2 SHOULD 1 —
        // generic nested-WITH guard remains active as belt-and-braces).
        // allowFromSubqueries=false (no FROM-subqueries in inner body for
        // slice 23). isPredicateBody=true: for constant-only inner emits one
        // synthetic OutputColumn (slice-23 path); for column-ref inner the
        // §4.1.2 short-circuit falls through to the normal column-ref path
        // (slice-24 widening).
        String predName = PREDICATE_BODY_PREFIX + stmts.size() + ">";
        StatementGraph innerStmt;
        if (isPivotSelect(inner)) {
            // Slice 141: a nested PIVOT / UNPIVOT in a predicate subquery body
            // (`WHERE k IN (SELECT ... PIVOT(...))` / EXISTS / scalar-comparison
            // / ANY-ALL-SOME). The slice-129 pivot router in
            // {@link #buildSelectStatementImpl} is gated to the OUTER SELECT
            // context (`name == null && !isPredicateBody`); the predicate body
            // carries `isPredicateBody=true` and the synthetic
            // `<predicate_subquery_N>` name, so the gate misses and the body
            // would otherwise fall to the normal path which can't bind a
            // `pivoted_table` (rejects with the misleading
            // TABLE_BINDING_UNRESOLVED "null(piviot_table)"). Route it to
            // {@link #buildPivotSelect} with the synthetic predicate-body name
            // so the body becomes a proper pivot StatementGraph.
            //
            // PIVOT extra-clause (WHERE/GROUP BY/etc.) / chained / malformed-
            // UNPIVOT / bare-`*`-without-catalog rejects stay deferred via
            // {@code buildPivotSelect}'s own guards. A bare `SELECT *` over a
            // pivot in a predicate body is rejected EARLIER by
            // {@link #preflightPredicateSubqueryShape}'s slice-23 / 24 single-column
            // contract — the preflight {@code "*"} check fires before this
            // routing site is reached. PIVOT-then-JOIN stays on the normal
            // path because {@code isPivotSelect} requires
            // `items.size() == 0`. A subquery-source pivot in a predicate body
            // is rejected by the slice-24 belt-and-braces relation-kind walk
            // BELOW (admits TABLE / CTE only) via the existing
            // {@code ctx.existsInnerRelationUnknown} code.
            //
            // Direct analogue of slice 138 ({@link #processDirectSubqueryTable}
            // FROM-subquery body), slice 139 (the four CTE walkers), and
            // slice 140 ({@link #buildSetOpProgramInternal} set-op branch).
            // This is the SIXTH (and final) SemanticIRBuilder routing site
            // that previously missed the pivot router.
            //
            // Slice-23 contract preserved: the predicate body remains
            // UNREACHABLE from outer (no outer relation points at it; no
            // STATEMENT_OUTPUT edge from outer to the body). The body's own
            // {@link #emitLineageForStatement} call BELOW emits the pivot
            // output -> source edges (TABLE_COLUMN for base-table source,
            // STATEMENT_OUTPUT for CTE source when the body sits inside an
            // outer-WITH). For correlation purposes (MERGE per-WHEN action
            // WHERE — slice 118), the pivot body's outputs / consumed-refs are
            // built directly against the LOCAL source alias by
            // {@code buildPivotSelect}; any outer-alias ref inside the inner
            // would surface via the post-build correlation walk below (the
            // walk traverses `innerStmt`'s clause-ref slots, which for a pivot
            // body are exactly the pivot's local TABLE / CTE relation).
            innerStmt = buildPivotSelect(inner, effectiveProvider, predName);
        } else {
            innerStmt = buildSelectStatementImpl(inner, effectiveProvider, predName,
                /*hasOuterCteListAlreadyProcessed=*/ false,
                /*allowFromSubqueries=*/ false,
                /*allowScalarProjectionSubqueries=*/ false,
                /*allowWindowProjection=*/ false,
                /*allowJoinOnPredicateSubqueries=*/ false,
                /*stmtsForExtraction=*/ null,
                /*lineageForExtraction=*/ null,
                /*cteMapForExtraction=*/ null,
                /*isPredicateBody=*/ true,
                /*whereClauseContext=*/ PredicateClauseContext.SELECT_WHERE,
                /*allowWherePredicateSubqueries=*/ false);
        }

        // Slice 24 (codex impl-review SHOULD 1): defensive relation-kind
        // walk. The preflight rejects FROM-subqueries; the post-build
        // correlation check below rejects OUTER_REFERENCE relations
        // (synthesised by promoteCorrelatedRefsToOuterReference for
        // outer refs we don't see). Belt-and-braces: the predicate body
        // must contain ONLY TABLE or CTE-bound relations. SUBQUERY /
        // OUTER_REFERENCE / UNION leaking through here would mean the
        // emitLineageForStatement call below routes through code paths
        // (e.g. the SUBQUERY-alias map) that we deliberately pass empty,
        // producing a SemanticIRBuildException about an unregistered
        // alias. Failing fast here surfaces the architectural violation
        // with a slice-24-tuned message instead.
        for (RelationSource r : innerStmt.getRelations()) {
            RelationKind kind = r.getBinding().getKind();
            if (kind != RelationKind.TABLE && kind != RelationKind.CTE) {
                throw new SemanticIRBuildException(
                        PredicateSubqueryDiagnostics.unsupported(
                                ctx.existsInnerRelationUnknown,
                                context,
                                "inner SELECT relation '"
                                + r.getAlias() + "' has unsupported binding kind "
                                + kind + "; only TABLE or CTE relations are admitted "
                                + "(slice 24 boundary)",
                                inner));
            }
        }
        // Post-build correlation check (codex round-1 MUST 2 + round-2 SHOULD 2).
        // Use the existing collectAllInnerRefs helper so clause coverage
        // stays in sync with promoteCorrelatedRefsToOuterReference.
        // Slice 24: collectAllInnerRefs includes OutputColumn.sources, so
        // a column-ref projection like `EXISTS (SELECT e.id FROM x)` where
        // `e` is the OUTER's alias trips the same correlation rejection —
        // no extra slice-24 code needed.
        //
        // Slice 118 — when correlationScope != null (MERGE per-WHEN action
        // WHERE only), instead of REJECTING outer-aliased refs we PROMOTE
        // them into synthesised OUTER_REFERENCE relations via
        // promoteCorrelatedRefsToOuterReference. Mirrors the slice-14 /
        // slice-117 pattern. Unknown outer aliases (not in target / USING
        // source / outer CTEs) still throw SCALAR_SUBQUERY_UNKNOWN_RELATION_ALIAS
        // (the promoter's existing boundary; diagnostic message says
        // "scalar subquery" — acceptable cosmetic limitation, slice 117
        // precedent). The slice-118 lift covers refs landing in
        // collectAllInnerRefs clauses (output sources, filter, join,
        // groupBy, having, orderBy, distinctOn); the FILTER and WITHIN
        // GROUP walks BELOW remain active so outer-aliased refs hidden
        // inside FILTER subtrees or PG fn.withinGroup.orderBy still
        // reject with SELECT_WHERE_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS
        // (codex round-1 Q2 BLOCKING preserved this boundary).
        Set<String> innerLocalAliases = new HashSet<>();
        for (RelationSource r : innerStmt.getRelations()) {
            innerLocalAliases.add(r.getAlias().toLowerCase(Locale.ROOT));
        }
        // R8 — DEGRADE GATE. A catalog-less correlated EXISTS / IN in a
        // top-level SELECT WHERE now analyzes (the correlation is surfaced
        // on the SEMI / ANTI_SEMI join entity) instead of failing with
        // *_EXISTS_CORRELATED_UNKNOWN_OUTER_ALIAS. The degrade is narrowly
        // scoped: only SELECT_WHERE, only non-MERGE (correlationScope ==
        // null), only genuine EXISTS/IN semi-join shapes. JOIN-ON, scalar
        // comparison, ANY/ALL, FROM-subquery / scalar / set-op-branch /
        // CTE bodies, UPDATE/DELETE WHERE, and MERGE all keep the prior
        // correlation reject.
        boolean degradeCorrelated = correlationScope == null
                && ctx == PredicateClauseContext.SELECT_WHERE
                && semiJoinPolarity(wrapper) != null;
        if (correlationScope != null) {
            // Pass a descriptive "outerAlias" so the promoter's diagnostic
            // messages identify the MERGE predicate-body host context if
            // promotion fails on an unknown alias.
            innerStmt = promoteCorrelatedRefsToOuterReference(
                    innerStmt,
                    "<merge predicate subquery " + (stmts.size()) + ">",
                    correlationScope);
        } else {
            for (ColumnRef ref : collectAllInnerRefs(innerStmt)) {
                if (!innerLocalAliases.contains(ref.getRelationAlias().toLowerCase(Locale.ROOT))) {
                    if (degradeCorrelated
                            && isKnownOuterAlias(ref.getRelationAlias(), outerRelationAliases)) {
                        // A genuine correlation to an outer FROM relation:
                        // the ref stays in the inner block's filterColumnRefs
                        // and the outer↔inner pairing is surfaced on the
                        // semi-join entity via buildSemiJoinFact. No throw.
                        // codex R8 [P1 round 2]: an alias that is NEITHER
                        // inner-local NOR a known outer relation (a typo like
                        // `z`) still rejects below.
                        continue;
                    }
                    throw new SemanticIRBuildException(
                            PredicateSubqueryDiagnostics.unsupportedWithSpan(
                                    ctx.existsCorrelatedUnknownOuterAlias,
                                    context,
                                    "correlated reference to outer alias '"
                                    + ref.getRelationAlias()
                                    + "' is not supported yet (this context accepts "
                                    + "uncorrelated predicate subqueries only)",
                                    ref.getSourceSpan()));
                }
            }
        }
        // Slice 28: projection-only FILTER-aware correlation walk. The
        // slice-28 source-skip in buildOutputColumns removes column refs
        // inside FILTER (WHERE ...) subtrees from OutputColumn.sources, so
        // a correlated FILTER ref in the inner projection (e.g.
        // `EXISTS (SELECT SUM(x.s) FILTER (WHERE e.region='EU') FROM x)`
        // where `e` is the outer alias) would slip past the loop above.
        // Existing collectAllInnerRefs continues to cover correlated
        // FILTER refs landing in inner WHERE / HAVING / GROUP BY / ORDER BY
        // / JOIN-ON because those clauses still collect via plain
        // collectColumnRefs which descends into FILTER subtrees.
        TResultColumnList rclForFilterWalk = inner.getResultColumnList();
        if (rclForFilterWalk != null) {
            for (int rci = 0; rci < rclForFilterWalk.size(); rci++) {
                TResultColumn rc = rclForFilterWalk.getResultColumn(rci);
                Set<TExpression> filterClauses = collectFilterClauses(rc);
                for (TExpression fclause : filterClauses) {
                    // Slice 118 — use effectiveProvider so under
                    // correlationScope != null, outer-aliased refs come
                    // back as synthetic EXACT_MATCH ColumnRefs (rather
                    // than throwing on tolerant fallback being absent).
                    // The alias-membership rejection below then fires
                    // for outer-aliased FILTER-inner refs, preserving
                    // the slice-118 boundary (codex round-1 Q2 BLOCKING
                    // fix: FILTER-inner correlation still rejects).
                    for (ColumnRef ref : collectColumnRefs(fclause, effectiveProvider)) {
                        boolean nonLocal = !innerLocalAliases.contains(
                                ref.getRelationAlias().toLowerCase(Locale.ROOT));
                        boolean degradeThisRef = degradeCorrelated
                                && isKnownOuterAlias(ref.getRelationAlias(),
                                        outerRelationAliases);
                        if (nonLocal && !degradeThisRef) {
                            // R8: the SELECT_WHERE semi-join degrade skips a
                            // genuine outer-relation correlation here; every
                            // other context (and unknown aliases) still reject.
                            throw new SemanticIRBuildException(
                                    PredicateSubqueryDiagnostics.unsupportedWithSpan(
                                            ctx.existsCorrelatedUnknownOuterAlias,
                                            context,
                                            "correlated reference to outer alias '"
                                            + ref.getRelationAlias()
                                            + "' inside FILTER (WHERE ...) is not supported yet",
                                            ref.getSourceSpan() != null
                                                    ? ref.getSourceSpan()
                                                    : SourceSpan.of(fclause)));
                        }
                    }
                }
            }
        }
        // Slice 30: projection-only direct WITHIN GROUP ORDER BY correlation
        // walk. PostgreSQL attaches WITHIN GROUP to fn.withinGroup directly,
        // and TFunctionCall.acceptChildren does NOT descend into that field —
        // so collectColumnRefs (and therefore collectAllInnerRefs above) is
        // blind to outer references inside `fn.withinGroup.orderBy`. A
        // correlated reference like
        // `mode() WITHIN GROUP (ORDER BY e.region)` (where `e` is the
        // outer alias) would slip past the slice-23 correlation loop above.
        // Catch it explicitly with a per-result-column WG ORDER BY scan.
        // Mirrors the slice-28 FILTER walk pattern. Also closes the same
        // correlation gap retroactively for slice-29-admitted aggregates
        // (LISTAGG / STRING_AGG / GROUP_CONCAT / ARRAY_AGG WITHIN GROUP),
        // see Slice30Test.pgCorrelatedListaggWithinGroupOrderByNowAlsoRejected.
        //
        // IMPORTANT: this walk uses a qualifier-only collector
        // ({@link #collectQualifierAliases}) instead of
        // {@link #collectColumnRefs}. Resolver2 also doesn't attach
        // ResolutionResult to TObjectName nodes inside PG's direct
        // fn.withinGroup field (it shares the AST asymmetry that lets
        // slice 29 admit these without a source-skip). Going through
        // {@code collectColumnRefs} → {@code provider.bindColumn} would
        // throw {@code non-exact column bindings} on legitimate
        // non-correlated refs (status=NOT_FOUND because Resolver2 skipped
        // them). The qualifier-only collector reads the qualifier alias
        // straight off the TObjectName, which matches slice-23's
        // correlation invariant: only qualified refs that name an outer
        // alias are caught — unqualified refs remain a documented
        // schema-less limitation.
        TResultColumnList rclForWgWalk = inner.getResultColumnList();
        if (rclForWgWalk != null) {
            for (int rci = 0; rci < rclForWgWalk.size(); rci++) {
                TResultColumn rc = rclForWgWalk.getResultColumn(rci);
                Set<TOrderBy> wgOrderBys = collectDirectWithinGroupOrderBys(rc);
                for (TOrderBy wgOrderBy : wgOrderBys) {
                    for (String alias : collectQualifierAliases(wgOrderBy)) {
                        boolean nonLocal = !innerLocalAliases.contains(
                                alias.toLowerCase(Locale.ROOT));
                        boolean degradeThisRef = degradeCorrelated
                                && isKnownOuterAlias(alias, outerRelationAliases);
                        if (nonLocal && !degradeThisRef) {
                            // R8: the SELECT_WHERE semi-join degrade skips a
                            // genuine outer-relation correlation here.
                            throw new SemanticIRBuildException(
                                    PredicateSubqueryDiagnostics.unsupported(
                                            ctx.existsCorrelatedUnknownOuterAlias,
                                            context,
                                            "correlated reference to outer alias '"
                                            + alias
                                            + "' inside WITHIN GROUP (ORDER BY ...) is not supported yet",
                                            wgOrderBy));
                        }
                    }
                }
            }
        }
        int idx = stmts.size();
        stmts.add(innerStmt);
        // Slice 24: emit lineage edges for the predicate body. For
        // constant-only inner (slice-23 carryover), the synthetic
        // OutputColumn has empty sources and emitLineageForStatement
        // emits zero edges — no shape change for slice 23. For
        // column-ref inner (slice 24), the real OutputColumn carries
        // one ColumnRef source pointing at the inner's local relation;
        // emitLineageForStatement emits a STATEMENT_OUTPUT → TABLE_COLUMN
        // edge (TABLE-bound inner) or STATEMENT_OUTPUT → STATEMENT_OUTPUT
        // edge (CTE-bound inner) that the projector's slice-24 pass uses
        // to resolve the JOIN canonical edge.
        //
        // SUBQUERY map is empty: inner-shape preflight rejects FROM-subqueries.
        // ScalarInfo map is empty: inner-shape preflight rejects scalar
        // projections (and column-ref projection is single-source, not a
        // scalar-subquery extraction).
        // Slice 118 — pass the enclosing scope's flattened SUBQUERY-alias
        // map under correlation mode so OUTER_REFERENCE-of-SUBQUERY refs
        // resolve to the enclosing MERGE's USING-subquery statement index
        // for cross-stmt lineage emission (mirrors slice 117 UPDATE-side
        // emit dispatch).
        Map<String, Integer> subqueryAliasMap = (correlationScope != null)
                ? correlationScope.flattenSubqueryAliasToIndex()
                : Collections.<String, Integer>emptyMap();
        emitLineageForStatement(innerStmt, idx, lineage,
                cteMapForExtraction,
                subqueryAliasMap,
                Collections.<Integer, ScalarInfo>emptyMap());
        // The predicate body remains UNREACHABLE from outer: no relation
        // in outer points at it, and no STATEMENT_OUTPUT lineage edge has
        // it as its `to`. Inner WHERE / inner JOIN refs of the predicate
        // body therefore cannot enter outer's row-influence walker. The
        // slice-24 projector pass iterates predicate bodies directly via
        // `isPredicateSubquerySyntheticName` to emit JOIN canonical edges
        // from their OutputColumn sources only (slice-24 §4.2.1).
        //
        // R8 — record the semi-join fact (EXISTS/IN → SEMI, NOT EXISTS/NOT
        // IN → ANTI_SEMI) so JoinGraph assembly can emit a JoinEntity
        // linking the outer relation to this lifted subquery block.
        if (semiFactsOut != null) {
            SemiJoinFact fact = buildSemiJoinFact(wrapper, extractableNode, inner,
                    innerStmt, idx, innerStmt.getName(), innerLocalAliases,
                    effectiveProvider);
            if (fact != null) {
                semiFactsOut.add(fact);
            }
        }
        return idx;
    }

    /**
     * Shared inner-shape preflight for every recognised predicate-subquery
     * wrapper. The context preserves the original wrapper and host clause
     * while this method validates the common lowered body shape.
     */
    private static void preflightPredicateSubqueryShape(
            TSelectSqlStatement inner,
            PredicateSubqueryContext context) {
        // (a) No set-op
        if (inner.getSetOperatorType() != null
                && inner.getSetOperatorType() != ESetOperatorType.none) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_IS_SET_OP,
                            context,
                            "inner SELECT may not be a set operation",
                            inner));
        }
        // (b) No nested CTE list
        if (inner.getCteList() != null && inner.getCteList().size() > 0) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_WITH,
                            context,
                            "inner SELECT may not have its own WITH clause",
                            inner.getCteList()));
        }
        // (c) No row-limit (delegated to rejectUnsupportedShape's row-limit
        //     guards which fire during buildSelectStatement). For an early,
        //     specific message we also fast-fail here.
        if (inner.getLimitClause() != null
                || inner.getTopClause() != null
                || inner.getFetchFirstClause() != null
                || inner.getOffsetClause() != null) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_ROW_LIMIT,
                            context,
                            "inner SELECT may not have a row-limit clause",
                            predicateRowLimitAnchor(inner)));
        }
        // (d) Inner FROM is required (codex round-2 MUST 2).
        if (inner.joins == null || inner.joins.size() == 0) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_MISSING_FROM,
                            context,
                            "inner SELECT must have a FROM clause "
                                    + "(degenerate predicate subquery SELECT is not in scope)",
                            inner));
        }
        // Slice 182 (GitHub #707 / MantisBT 4676): a comma-separated FROM
        // list in the predicate body is now built as an ordered
        // cross-product relation graph, exactly as the semantically
        // identical `FROM a JOIN b ON …` already was. The slice-62
        // predicate-body reject that used to live here (and its
        // {@link DiagnosticCode#JOIN_ON_EXISTS_INNER_COMMA_FROM} code) is
        // gone; the body's shape contract is enforced by the
        // single-result-column check in (e) below, which is independent
        // of the FROM relation count.
        // Slice 63: predicate body must not contain explicit CROSS JOIN
        // either. Surfaces a predicate-body-tuned diagnostic before the
        // gated reject inside buildRelations would fire with the
        // generic "scalar / set-op-branch / set-op-CTE / predicate"
        // message. The same shared preflight is used by EXISTS /
        // IN-SELECT / cmp-subquery / ANY-ALL-SOME wrappers.
        // Slice 64: same treatment for JOIN ... USING.
        for (TJoin j : inner.joins) {
            TJoinItemList items = j.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                if (item.getJoinType() == EJoinType.cross) {
                    throw new SemanticIRBuildException(
                            PredicateSubqueryDiagnostics.unsupported(
                                    DiagnosticCode.JOIN_ON_EXISTS_INNER_CROSS_JOIN,
                                    context,
                                    "CROSS JOIN in inner SELECT is not supported yet",
                                    item));
                }
                if (item.getUsingColumns() != null
                        && item.getUsingColumns().size() > 0) {
                    throw new SemanticIRBuildException(
                            PredicateSubqueryDiagnostics.unsupported(
                                    DiagnosticCode.JOIN_ON_EXISTS_INNER_USING,
                                    context,
                                    "JOIN ... USING (...) in inner SELECT is not supported yet",
                                    item));
                }
                // Slice 66: NATURAL JOIN inside a predicate-subquery body
                // is rejected with a wrapper-aware diagnostic. The
                // gated reject inside buildRelations would fire later
                // with the generic body-context message; surfacing here
                // gives users an EXISTS / IN-SELECT / cmp-subquery
                // friendly error.
                if (isNaturalJoinType(item.getJoinType())) {
                    throw new SemanticIRBuildException(
                            PredicateSubqueryDiagnostics.unsupported(
                                    DiagnosticCode.JOIN_ON_EXISTS_INNER_NATURAL,
                                    context,
                                    "NATURAL JOIN in inner SELECT is not supported yet",
                                    item));
                }
            }
        }
        // (d') No FROM-subquery on inner FROM/JOIN list. The recursive build
        //     passes allowFromSubqueries=false, so buildRelation would also
        //     reject; we surface a slice-23 specific message here.
        for (TJoin j : inner.joins) {
            if (j.getTable() != null
                    && j.getTable().getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
                throw new SemanticIRBuildException(
                        PredicateSubqueryDiagnostics.unsupported(
                                DiagnosticCode.JOIN_ON_EXISTS_INNER_FROM_SUBQUERY,
                                context,
                                "FROM-clause subquery in inner SELECT is not supported yet",
                                j.getTable()));
            }
            TJoinItemList items = j.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TTable r = items.getJoinItem(i).getTable();
                if (r != null && r.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
                    throw new SemanticIRBuildException(
                            PredicateSubqueryDiagnostics.unsupported(
                                    DiagnosticCode.JOIN_ON_EXISTS_INNER_FROM_SUBQUERY_ON_JOIN,
                                    context,
                                    "FROM-clause subquery on JOIN side in inner SELECT is not supported yet",
                                    r));
                }
            }
        }
        // (e) Result-column list: exactly one column projecting either a
        //     constant expression (slice 23), a single column reference
        //     (slice 24), an expression / function call / CASE /
        //     aggregate over inner columns (slice 27), an aggregate with
        //     FILTER (WHERE ...) over inner columns (slice 28), or — on
        //     PostgreSQL only — a whitelisted WITHIN GROUP aggregate
        //     (slice 29 admits LISTAGG / STRING_AGG / GROUP_CONCAT /
        //     ARRAY_AGG / count / sum / avg / min / max / stddev /
        //     variance family; slice 30 extends with `mode`).
        //     Multi-column / star / window function / scalar subquery /
        //     non-whitelisted WITHIN GROUP aggregate projections are
        //     rejected with shape-specific tuned messages — see
        //     {@link #findUnsupportedWithinGroupFunctionName} for the
        //     vendor + name gate.
        TResultColumnList rcl = inner.getResultColumnList();
        if (rcl == null || rcl.size() != 1) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_COLUMN_COUNT,
                            context,
                            "inner SELECT must project exactly one column, got "
                                    + (rcl == null ? 0 : rcl.size()),
                            rcl == null ? inner : rcl));
        }
        TResultColumn rc0 = rcl.getResultColumn(0);
        if ("*".equals(rc0.getColumnNameOnly())) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_NON_CONSTANT_PROJECTION,
                            context,
                            "inner SELECT must project a constant expression "
                                    + "or a single column reference, got SELECT *",
                            rc0));
        }
        TExpression projExpr = rc0.getExpr();
        if (projExpr == null || !isAdmittedPredicateProjection(projExpr)) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_NON_CONSTANT_PROJECTION,
                            context,
                            "inner SELECT must project a constant expression "
                            + "(e.g. SELECT 1), a single column reference "
                            + "(e.g. SELECT x.id), an expression / function call / "
                            + "CASE / aggregate over inner columns (e.g. SELECT x.id + 1, "
                            + "UPPER(x.region), MAX(x.id), CASE WHEN ...), an aggregate "
                            + "with FILTER (WHERE ...) over inner columns "
                            + "(e.g. SUM(x.id) FILTER (WHERE x.region = 'EU')), or a "
                            + "WITHIN GROUP (ORDER BY ...) aggregate over inner columns "
                            + "(PostgreSQL admits the direct fn.withinGroup attachment; "
                            + "Oracle and SQL Server admit the windowDef.withinGroup "
                            + "attachment via slice 31 when no OVER clause is present "
                            + "— see TWindowDef.isIncludingOverClause(); slice 44 also "
                            + "admits Snowflake hypothetical-set ordered-set aggregates "
                            + "(rank / dense_rank / percent_rank / cume_dist) via direct "
                            + "fn.withinGroup attachment); DB2 / Snowflake LISTAGG / "
                            + "STRING_AGG WITHIN GROUP remain rejected pending a probe "
                            + "of their parser-specific argument storage; window "
                            + "functions (any OVER-bearing form) and scalar subqueries "
                            + "are not supported yet (slice 31 boundary)",
                            projExpr == null ? rc0 : projExpr));
        }
        // Slice 29 / Slice 31: vendor-gated WITHIN GROUP rejecter.
        //
        // Two attachment styles, gated by vendor:
        //   * Direct attachment ({@code fn.getWithinGroup()}): PG admits
        //     because its visitor descent (TFunctionCall.acceptChildren)
        //     does NOT walk fn.withinGroup, leaving OutputColumn.sources
        //     populated exactly with the function's column-bearing args.
        //     Snowflake and DB2 use the same field but their parser-
        //     specific arg storage (DB2's stringExpr / separatorExpr for
        //     LISTAGG) may not be visitor-visible — silently-empty
        //     sources while dlineage walks fdd to the base column =
        //     manufactured IR_MISSING_DEPENDENCY divergence; rejected.
        //   * WindowDef attachment ({@code fn.getWindowDef().getWithinGroup()}
        //     with WITHIN-GROUP-only windowDef): Oracle / MSSQL admit via
        //     slice 31. The visitor DOES descend through
        //     {@code windowDef.withinGroup.orderBy}, so the slice-31
        //     source-skip in
        //     {@link #collectColumnRefsExcludingFilterAndWithinGroupClauses}
        //     keeps OutputColumn.sources from leaking the WITHIN GROUP
        //     ORDER BY column refs (probe Q1 / Q3 / Q4 / Q5 in
        //     {@code /tmp/probe31}).
        //
        // Probed: PG (Q1, Q5, Q6, Q9, Q10), Oracle (Q1-Q5 in
        // {@code /tmp/probe31}), MSSQL (Q11-Q12), SparkSQL (parser drops
        // WITHIN GROUP attachment, so containsAggregateWithWithinGroup
        // returns false and the lift applies).
        if (containsAggregateWithWithinGroup(projExpr)) {
            EDbVendor v = inner.dbvendor;
            // Slice 44 / 45: Snowflake admitted at this gate ONLY when
            // every WITHIN GROUP-bearing call in the inner projection
            // is an admitted Snowflake direct-attachment shape:
            //   * hypothetical-set (rank / dense_rank / percent_rank /
            //     cume_dist with fn.getWithinGroup()!=null and
            //     fn.getWindowDef()==null) — slice 44; or
            //   * mode() with the same direct-attachment shape — slice 45.
            // Snowflake LISTAGG / STRING_AGG / percentile_cont /
            // percentile_disc share the direct-attachment shape but
            // their parser-specific argument storage (stringExpr /
            // separatorExpr) and / or name-whitelist exclusion keep
            // the slice-31/44 rejection (see Slice44Test §C and
            // Slice45Test §C boundary tests).
            boolean snowflakeAdmittedShape = (v == EDbVendor.dbvsnowflake)
                    && allWithinGroupCallsAreAdmittedSnowflakeDirectAttachment(projExpr);
            if (v != EDbVendor.dbvpostgresql
                    && v != EDbVendor.dbvoracle
                    && v != EDbVendor.dbvmssql
                    && !snowflakeAdmittedShape) {
                throw new SemanticIRBuildException(
                        PredicateSubqueryDiagnostics.unsupported(
                                DiagnosticCode.JOIN_ON_EXISTS_WITHIN_GROUP_AGGREGATE,
                                context,
                                "WITHIN GROUP aggregate inner projection on vendor=" + v
                                + " is not supported yet — slice 31 admits PostgreSQL "
                                + "(direct fn.withinGroup attachment), Oracle, and "
                                + "SQL Server (windowDef.withinGroup attachment with "
                                + "isIncludingOverClause=false); slice 44 additionally "
                                + "admits Snowflake hypothetical-set ordered-set "
                                + "aggregates (rank / dense_rank / percent_rank / "
                                + "cume_dist) via direct fn.withinGroup attachment; "
                                + "slice 45 additionally admits Snowflake mode() via "
                                + "the same direct attachment; "
                                + "DB2 / Snowflake LISTAGG / STRING_AGG / "
                                + "percentile_cont / other direct-attachment vendors "
                                + "remain rejected pending a probe of their parser-"
                                + "specific argument storage",
                                projExpr));
            }
            // Codex impl-review round-3 MUST: name-whitelist guard. The PG
            // parser attaches WITHIN GROUP to generic `func_application`,
            // not only to whitelisted aggregate names. Without this check,
            // a non-whitelisted call like `foo(x.id) WITHIN GROUP (...)`
            // would slip through. Slice 31: same protection applies on
            // Oracle / MSSQL — the windowDef-attachment grammar admits
            // any function name (PERCENTILE_CONT, RANK, user-defined
            // foo); the name guard rejects them so the IR never sees a
            // shape whose canonical model is unverified.
            String unsupportedName = findUnsupportedWithinGroupFunctionName(
                    projExpr, inner.dbvendor);
            if (unsupportedName != null) {
                throw new SemanticIRBuildException(
                        PredicateSubqueryDiagnostics.unsupported(
                                DiagnosticCode.JOIN_ON_EXISTS_WITHIN_GROUP_NON_WHITELISTED,
                                context,
                                "WITHIN GROUP attached to non-whitelisted "
                                + "function '" + unsupportedName + "' is not supported yet — "
                                + "slice 31 admits whitelisted aggregates only "
                                + "(see SemanticIRBuilder.AGGREGATE_FUNCTION_NAMES); "
                                + "slice 43 additionally admits PostgreSQL hypothetical-set "
                                + "ordered-set aggregates (rank / dense_rank / percent_rank / "
                                + "cume_dist) via direct fn.getWithinGroup attachment",
                                projExpr));
            }
        }
        // (f) No subqueries in inner WHERE / inner JOIN ON / inner GROUP BY /
        //     inner HAVING / inner ORDER BY. Reuses the slice-11 helper
        //     style with a slice-23-specific message prefix.
        rejectSubqueriesInPredicateBodyClauses(inner, context);
        // (g) Window functions are caught by the rejecters that fire inside
        //     buildSelectStatement (rejectWindowFunctionInScope on WHERE /
        //     GROUP BY / HAVING / ORDER BY); the inner projection itself is
        //     a constant expression and cannot contain a window call.
    }

    private static TParseTreeNode predicateRowLimitAnchor(TSelectSqlStatement inner) {
        if (inner.getLimitClause() != null) return inner.getLimitClause();
        if (inner.getTopClause() != null) return inner.getTopClause();
        if (inner.getFetchFirstClause() != null) return inner.getFetchFirstClause();
        return inner.getOffsetClause();
    }

    /**
     * Slice 27: true iff {@code e} is an admitted predicate-subquery inner
     * projection shape. Admits (in priority order):
     * <ul>
     *   <li>{@link EExpressionType#simple_object_name_t} — single column
     *       ref (slice 24 carryover); one JOIN canonical edge per inner-
     *       column lineage terminal.</li>
     *   <li>{@link #isConstantExpression}-shaped constant (slice-23
     *       carryover); zero canonical contribution.</li>
     *   <li>Slice 27 widenings via {@link #isAdmittedSlice27ShapeRoot}:
     *       expression / function call / CASE / aggregate over inner
     *       columns. Probes 27 / 27b confirmed dlineage's
     *       {@code fdr clause="on"} canonical model walks fdd to the
     *       underlying base columns identically to the IR's
     *       slice-24 predicate-body sweep — so canonical equivalence
     *       holds. Aggregate-over-constants (e.g. {@code COUNT(*)},
     *       {@code SUM(1)}) produce empty {@code OutputColumn.sources}
     *       and zero predicate-body JOIN edges; canonical-equivalent
     *       to the slice-23 constant projection.</li>
     * </ul>
     * Hard rejecters fire BEFORE the {@link #isAdmittedSlice27ShapeRoot}
     * admit-list to keep the surface tight:
     * <ul>
     *   <li>{@link #containsAnySubqueryExpression} — slice-23 invariant.</li>
     *   <li>{@link #containsWindowFunction} — slice-13 invariant.
     *       Slice 31 narrowed the rejecter via {@link #isWindowDefBearingFunction}
     *       so a WITHIN-GROUP-only windowDef (Oracle / MSSQL plain
     *       WITHIN GROUP attachment) is NOT classified as a window
     *       function. Real OVER-bearing windowDef shapes ({@code OVER ()},
     *       {@code OVER (PARTITION BY ...)}, KEEP DENSE_RANK) continue to
     *       fire the rejecter. The complementary slice-31 source-skip in
     *       {@link #collectColumnRefsExcludingFilterAndWithinGroupClauses}
     *       removes the WITHIN GROUP ORDER BY column refs from
     *       {@code OutputColumn.sources} on Oracle / MSSQL so the visitor's
     *       descent through {@code windowDef.withinGroup.orderBy} doesn't
     *       leak into projection sources.</li>
     *   <li>Slice 29 / 31's vendor-gated WITHIN GROUP rejecter at the
     *       {@link #preflightPredicateSubqueryShape} call site — see that
     *       method's vendor gate. Slice 31 admits Oracle and MSSQL
     *       (windowDef.withinGroup attachment with
     *       {@code !isIncludingOverClause()}) alongside PostgreSQL.
     *       Snowflake and DB2 both attach {@code WITHIN GROUP} to the
     *       direct {@code fn.getWithinGroup()} field (same as PG), but
     *       their parser-specific argument storage may not be
     *       visitor-visible (DB2 stores LISTAGG args in
     *       {@code stringExpr} / {@code separatorExpr}, which
     *       {@code TFunctionCall.acceptChildren} does NOT walk); they
     *       remain rejected. SparkSQL silently drops the WITHIN GROUP
     *       attachment at parse time (both {@code fn.withinGroup} and
     *       {@code fn.windowDef} are null); after slice 29 SparkSQL
     *       admits the same shape as PG, parity-friendly per probe Q1
     *       SparkSQL.</li>
     * </ul>
     *
     * <p>Slice 28 lifted the prior {@code containsAggregateWithFilter}
     * rejecter; FILTER aggregates are now admitted, with the FILTER
     * predicate column refs excluded from {@code OutputColumn.sources}
     * globally via the FILTER-aware variant of {@link #collectColumnRefs}
     * used in {@link #buildOutputColumns}. See the slice-28 entry in
     * §14.5 of the unified roadmap and §B / §C of the slice history
     * archive for the load-bearing decision.
     *
     * <p>Slice 29 lifted the prior unconditional
     * {@code containsAggregateWithWithinGroup} rejecter and replaced it
     * with a vendor-gated rejecter at the
     * {@link #preflightPredicateSubqueryShape} call site (Snowflake / DB2 /
     * other non-PostgreSQL vendors that use the direct
     * {@code fn.getWithinGroup()} attachment remain rejected). PG
     * attaches {@code WITHIN GROUP} to the direct
     * {@code fn.getWithinGroup()} field, and
     * {@code TFunctionCall.acceptChildren} does NOT descend into that
     * field, so {@link #collectColumnRefs} never picks up the ORDER BY
     * column refs — no source-skip is needed. dlineage probes Q1–Q10
     * confirmed canonical-model JOIN-on edges include only the aggregate's
     * primary argument across all four vendors (the WITHIN GROUP ORDER
     * BY ref appears as {@code fdr clauseType="orderby"} on PG only, and
     * {@code DlineageXmlProjector.projectColumn} follows fdd not fdr).
     * Slice 29 is restricted to whitelisted aggregates whose names
     * appear in {@link #AGGREGATE_FUNCTION_NAMES}. As of slice 30 the
     * whitelist is: {@code count}, {@code sum}, {@code avg}, {@code min},
     * {@code max}, {@code stddev}, {@code variance}, {@code var_samp},
     * {@code var_pop}, {@code stddev_samp}, {@code stddev_pop},
     * {@code listagg}, {@code string_agg}, {@code group_concat},
     * {@code array_agg}, {@code mode} (slice-30 addition — PG
     * ordered-set aggregate, gated for the WITHIN GROUP path only;
     * see {@code DlineageXmlProjector.ORDER_BY_WITHIN_GROUP_AGGREGATE_NAMES}). The predicate-body short-circuit's
     * {@code aggregate=true} branch fires for these regardless of
     * {@code OutputColumn.sources} content — column-bearing args
     * (e.g. {@code LISTAGG(x.id, ',')}) produce a synthesized
     * {@code OutputColumn} with {@code sources=[x.id]} that the slice-24
     * sweep walks to base-column terminals, while literal-only args
     * (e.g. {@code LISTAGG('hello', ',')}) produce {@code sources=[]}
     * with zero JOIN canonical edges — canonically equivalent to
     * slice-23's constant projection.
     *
     * <p>Functions NOT in the whitelist (which on PG includes
     * {@code percentile_cont}, {@code percentile_disc}, {@code rank},
     * {@code dense_rank}, {@code percent_rank}, {@code cume_dist}, plus
     * any user-defined function with a direct {@code fn.withinGroup}
     * attachment) remain rejected by the
     * {@link #findUnsupportedWithinGroupFunctionName} guard at the
     * {@link #preflightPredicateSubqueryShape} call site. Slice 30 lifted
     * {@code mode} only — the one PG ordered-set aggregate with no
     * documented window form in any GSP-supported vendor. Lifting
     * {@code percentile_cont} / {@code percentile_disc} requires either
     * a vendor-scoped projector OR a structural discriminator strong
     * enough to distinguish the cross-vendor windowed forms (Redshift /
     * Vertica / BigQuery / Oracle / SQL Server emit
     * {@code PERCENTILE_CONT WITHIN GROUP OVER (...)} variants). Lifting
     * {@code rank}/{@code dense_rank}/{@code percent_rank}/{@code cume_dist}
     * requires distinguishing window form {@code RANK() OVER (ORDER BY)}
     * from hypothetical-set form {@code rank(0.5) WITHIN GROUP (ORDER BY)}
     * — dlineage XML for the two is structurally identical on PG. See
     * §14.6 of the unified roadmap.
     */
    private static boolean isAdmittedPredicateProjection(TExpression e) {
        if (e == null) return false;
        if (e.getExpressionType() == EExpressionType.simple_object_name_t) {
            return true;                                          // slice 24 (column ref)
        }
        if (isConstantExpression(e)) return true;                 // slice 23 (constant)
        // Slice 27: hard rejecters before admit-list. Slice 28 lifted the
        // FILTER rejecter; slice 29 replaced the unconditional WITHIN
        // GROUP rejecter with a vendor-gated rejecter at the
        // preflightPredicateSubqueryShape call site (see slice-29 §3.2).
        if (containsAnySubqueryExpression(e)) return false;       // slice 23 invariant
        if (containsWindowFunction(e)) return false;              // slice 13 invariant
        return isAdmittedSlice27ShapeRoot(e);
    }

    /**
     * Slice 29: detect a {@code WITHIN GROUP (ORDER BY ...)} attachment
     * on the direct {@code fn.getWithinGroup()} field anywhere in the
     * subtree. This is the PG / Snowflake / DB2 attachment style. Used
     * as a vendor-gated rejecter in {@link #preflightPredicateSubqueryShape}:
     * non-admitted vendors with this attachment remain rejected because
     * their parser-specific argument storage may not be visitor-visible
     * (DB2's {@code LISTAGG} stores args in {@code stringExpr} /
     * {@code separatorExpr}, which the default
     * {@code TFunctionCall.acceptChildren} does NOT walk —
     * {@code OutputColumn.sources} would be silently empty while dlineage
     * walks fdd to the base column, manufacturing
     * {@code IR_MISSING_DEPENDENCY} divergence).
     *
     * <p>Slice 31: also detects WITHIN GROUP attached to
     * {@code fn.getWindowDef().getWithinGroup()} when the windowDef is
     * {@link #isWithinGroupOnlyWindowDef WITHIN-GROUP-only} — the
     * Oracle / MSSQL attachment style. Both attachments are routed
     * through {@link #hasWithinGroupAnyAttachment}.
     */
    private static boolean containsAggregateWithWithinGroup(TExpression e) {
        if (e == null) return false;
        final boolean[] found = {false};
        e.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (hasWithinGroupAnyAttachment(fn)) found[0] = true;
            }
        });
        if (!found[0] && e.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = e.getFunctionCall();
            if (hasWithinGroupAnyAttachment(fn)) found[0] = true;
        }
        return found[0];
    }

    /**
     * Slice 31: shared predicate used by {@link #containsAggregateWithWithinGroup}
     * and {@link #findUnsupportedWithinGroupFunctionName}. Returns
     * {@code true} iff {@code fn} carries {@code WITHIN GROUP} via
     * either:
     * <ul>
     *   <li>direct {@code fn.getWithinGroup()} field (PG / Snowflake /
     *       DB2 / SparkSQL parser style);</li>
     *   <li>{@code fn.getWindowDef().getWithinGroup()} when the
     *       windowDef is {@link #isWithinGroupOnlyWindowDef WITHIN-GROUP-only}
     *       (Oracle / MSSQL parser style).</li>
     * </ul>
     */
    private static boolean hasWithinGroupAnyAttachment(TFunctionCall fn) {
        if (fn == null) return false;
        if (fn.getWithinGroup() != null) return true;
        return isWithinGroupOnlyWindowDef(fn.getWindowDef());
    }

    /**
     * Slice 29 (codex impl-review round-3 MUST): walk the expression
     * subtree and return the (lower-cased) function name of any
     * {@code TFunctionCall} that carries WITHIN GROUP — via direct
     * {@code fn.getWithinGroup()} (PG style) or via
     * {@code fn.getWindowDef().getWithinGroup()} when the windowDef is
     * {@link #isWithinGroupOnlyWindowDef WITHIN-GROUP-only} (Oracle /
     * MSSQL style; slice 31) — whose name is NOT in
     * {@link #AGGREGATE_FUNCTION_NAMES}. Returns {@code null} if every
     * WITHIN GROUP-bearing call uses a whitelisted aggregate name.
     * Used at the {@code preflightPredicateSubqueryShape} call site to reject
     * {@code foo(x.id) WITHIN GROUP (...)}-shaped projections where
     * {@code foo} isn't an aggregate the IR knows how to model.
     *
     * <p>Slice 43: now takes the inner {@link EDbVendor} so the
     * {@link #isAdmittedWithinGroupName} delegate can apply the
     * PG-only hypothetical-set carve-out
     * ({@link #isDirectAttachmentHypotheticalSetCall}; widened to
     * Snowflake by slice 44).
     */
    private static String findUnsupportedWithinGroupFunctionName(
            TExpression e, final EDbVendor vendor) {
        if (e == null) return null;
        final String[] firstUnsupported = {null};
        e.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (firstUnsupported[0] != null) return;
                if (!hasWithinGroupAnyAttachment(fn)) return;
                String name = fn.getFunctionName() == null
                        ? null : fn.getFunctionName().toString();
                if (isAdmittedWithinGroupName(fn, name, vendor)) return;
                firstUnsupported[0] = name == null ? "<unnamed>" : name;
            }
        });
        if (firstUnsupported[0] == null
                && e.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = e.getFunctionCall();
            if (hasWithinGroupAnyAttachment(fn)) {
                String name = fn.getFunctionName() == null
                        ? null : fn.getFunctionName().toString();
                if (!isAdmittedWithinGroupName(fn, name, vendor)) {
                    firstUnsupported[0] = name == null ? "<unnamed>" : name;
                }
            }
        }
        return firstUnsupported[0];
    }

    /**
     * Slice 42 helper used by {@link #findUnsupportedWithinGroupFunctionName}.
     * Returns {@code true} iff {@code name} is in the regular
     * {@link #AGGREGATE_FUNCTION_NAMES} whitelist, OR — under the
     * AST-shape constraint
     * {@link #isHypotheticalSetWithinGroupCall} — in the slice-42
     * {@link #HYPOTHETICAL_SET_AGGREGATE_NAMES} whitelist (Oracle /
     * MSSQL windowDef-bearing attachment), OR — under the slice-43
     * AST-shape constraint
     * {@link #isDirectAttachmentHypotheticalSetCall} — in the same
     * hypothetical-set whitelist on PostgreSQL (slice 43) or Snowflake
     * (slice 44) via direct {@code fn.getWithinGroup()} attachment.
     *
     * <p>The shape constraints pin the carve-outs by parser flavor:
     * Oracle / MSSQL produce {@code fn.getWindowDef()!=null} with
     * {@code wd.getWithinGroup()!=null} and {@code !wd.isIncludingOverClause()};
     * PG produces {@code fn.getWithinGroup()!=null} with
     * {@code fn.getWindowDef()==null}. Slice 43 admits that direct-
     * attachment hypothetical-set carve-out for PostgreSQL; slice 44
     * widens the same probe-confirmed shape to Snowflake. DB2 and other
     * direct-attachment vendors remain outside this helper until their
     * AST / dlineage parity is explicitly probed and covered.
     */
    private static boolean isAdmittedWithinGroupName(
            TFunctionCall fn, String name, EDbVendor vendor) {
        if (name == null || name.isEmpty()) return false;
        String lower = name.toLowerCase(Locale.ROOT);
        if (AGGREGATE_FUNCTION_NAMES.contains(lower)) return true;
        if (isHypotheticalSetWithinGroupCall(fn)) return true;
        return isDirectAttachmentHypotheticalSetCall(fn, vendor);
    }

    /**
     * Slice 43 / 44: true iff {@code fn} is a direct-attachment
     * hypothetical-set ordered-set aggregate call shape — {@code rank} /
     * {@code dense_rank} / {@code percent_rank} / {@code cume_dist} with
     * {@code fn.getWithinGroup()!=null} AND {@code fn.getWindowDef()==null},
     * AND {@code vendor} is in {PostgreSQL, Snowflake}.
     *
     * <p>Used as a name-whitelist exception inside
     * {@link #isAdmittedWithinGroupName} for predicate-body inner
     * projections only. Top-level admission is deliberately not granted:
     * top-level lifting requires a vendor-scoped projector override
     * (slice 43 introduces the API but defers the override to a future
     * slice because PG / Snowflake dlineage XML is structurally
     * indistinguishable between the WG and OVER forms — naive override
     * breaks {@code rank() OVER (ORDER BY x)} classification).
     *
     * <p>Vendor gate: PG (slice 43) and Snowflake (slice 44 — probe-
     * confirmed AST + dlineage XML byte-identical to PG for all
     * four hypothetical-set names). DB2 / Greenplum / Redshift parse-fail
     * on the syntax. Other direct-attachment vendors (e.g. SparkSQL drops
     * WITHIN GROUP attachment at parse time) remain rejected pending a
     * fresh probe.
     *
     * <p>Probe: {@code /tmp/probe43/Probe43.java} (slice 43) and
     * {@code probe44.Probe44Test} (slice 44, captured during slice-44
     * implementation) confirmed the AST predicate matches PG / Snowflake
     * hypothetical-set forms (and not the OVER form), and confirmed the
     * dlineage XML for {@code EXISTS (SELECT rank(0.5) WITHIN GROUP
     * (ORDER BY x.salary) FROM locations x)} contributes zero base-table
     * edges from the inner predicate body (literal arg + WG ORDER BY ref
     * via {@code clauseType="orderby"} fdr that the projector's
     * {@code clauseTypeToRole} does not map to FILTER/JOIN). Both
     * projectors therefore agree on zero predicate-body lineage edges
     * for the slice-43 / slice-44 shape — no projector change required.
     */
    private static boolean isDirectAttachmentHypotheticalSetCall(
            TFunctionCall fn, EDbVendor vendor) {
        if (fn == null) return false;
        if (vendor != EDbVendor.dbvpostgresql
                && vendor != EDbVendor.dbvsnowflake) return false;
        if (!isDirectAttachmentHypotheticalSetCallShape(fn)) return false;
        return true;
    }

    /**
     * Slice 44: vendor-agnostic shape predicate for the direct-attachment
     * hypothetical-set call form ({@code fn.getWithinGroup()!=null} AND
     * {@code fn.getWindowDef()==null} AND function name in
     * {@link #HYPOTHETICAL_SET_AGGREGATE_NAMES}). Used together with
     * {@link #isDirectAttachmentModeCallShape} (slice 45) by
     * {@link #allWithinGroupCallsAreAdmittedSnowflakeDirectAttachment} to
     * gate Snowflake admission. Snowflake LISTAGG / STRING_AGG /
     * percentile_cont WITHIN GROUP share this attachment style but their
     * parser-specific argument storage ({@code stringExpr} /
     * {@code separatorExpr}) and dlineage XML parity remain unprobed
     * (slice-31 boundary preserved).
     */
    private static boolean isDirectAttachmentHypotheticalSetCallShape(
            TFunctionCall fn) {
        if (fn == null) return false;
        if (fn.getWithinGroup() == null) return false;
        if (fn.getWindowDef() != null) return false;
        if (fn.getFunctionName() == null) return false;
        String name = fn.getFunctionName().toString();
        if (name == null || name.isEmpty()) return false;
        return HYPOTHETICAL_SET_AGGREGATE_NAMES.contains(
                name.toLowerCase(Locale.ROOT));
    }

    /**
     * Slice 45: vendor-agnostic shape predicate for the direct-attachment
     * {@code mode()} ordered-set aggregate call form
     * ({@code fn.getWithinGroup()!=null} AND
     * {@code fn.getWindowDef()==null} AND function name equals
     * {@code mode}). Parallel to
     * {@link #isDirectAttachmentHypotheticalSetCallShape}; used by
     * {@link #allWithinGroupCallsAreAdmittedSnowflakeDirectAttachment}
     * to admit Snowflake {@code mode() WITHIN GROUP (ORDER BY ...)}
     * predicate-body inner projections.
     *
     * <p>Probe-confirmed (see {@code /tmp/Probe45c.java} captured during
     * slice-45 implementation): Snowflake parses {@code mode() WITHIN
     * GROUP (ORDER BY x.salary)} with {@code fn.getWithinGroup() != null}
     * and {@code fn.getWindowDef() == null}, identical to PG. The
     * Snowflake dlineage XML for the predicate-body wrapper shape is
     * byte-equivalent to PG (same {@code resultset name="mode"
     * type="function"} wrapper, same {@code orderby} fdr that
     * {@code clauseTypeToRole} does not map to FILTER/JOIN); the
     * canonical model has zero predicate-body lineage edges, matching
     * the IR side (mode has no args, default visitor descent does not
     * walk direct {@code fn.withinGroup}).
     *
     * <p>Why mode is admitted but Snowflake LISTAGG / STRING_AGG /
     * percentile_cont aren't (slice-44/45 boundaries): mode has no
     * positional argument, so the OutputColumn.sources collection is
     * trivially empty and matches the dlineage zero-edge canonical model.
     * LISTAGG / STRING_AGG store args in parser-specific
     * {@code stringExpr} / {@code separatorExpr} fields whose visitor
     * descent has not been probed; admitting them risks
     * silently-empty IR sources against a non-empty dlineage column-arg
     * fdd. percentile_cont / percentile_disc use a literal arg
     * (slice-44 §C boundary preserved) but are not in
     * {@link #AGGREGATE_FUNCTION_NAMES}, so the slice-29 name-whitelist
     * guard fires inside {@link #findUnsupportedWithinGroupFunctionName}
     * and rejects regardless of vendor gate.
     */
    private static boolean isDirectAttachmentModeCallShape(
            TFunctionCall fn) {
        if (fn == null) return false;
        if (fn.getWithinGroup() == null) return false;
        if (fn.getWindowDef() != null) return false;
        if (fn.getFunctionName() == null) return false;
        String name = fn.getFunctionName().toString();
        if (name == null || name.isEmpty()) return false;
        return "mode".equals(name.toLowerCase(Locale.ROOT))
                && hasNoFunctionArgs(fn);
    }

    private static boolean hasNoFunctionArgs(TFunctionCall fn) {
        return fn != null && (fn.getArgs() == null || fn.getArgs().size() == 0);
    }

    /**
     * Slice 45 (renamed and widened from the slice-44 helper
     * {@code allWithinGroupCallsAreDirectAttachmentHypotheticalSet}):
     * returns {@code true} iff {@code e} contains at least one WITHIN
     * GROUP-bearing function call AND every such call uses an
     * <i>admitted</i> Snowflake direct-attachment shape — either
     * hypothetical-set ({@link #isDirectAttachmentHypotheticalSetCallShape},
     * slice 44) or mode ({@link #isDirectAttachmentModeCallShape},
     * slice 45). Used to gate the predicate-body vendor whitelist widen
     * at the {@code preflightPredicateSubqueryShape} call site so Snowflake is
     * admitted only on these probe-confirmed shapes — Snowflake LISTAGG /
     * STRING_AGG / percentile_cont / percentile_disc / other names
     * remain rejected (their parser-specific argument storage and
     * dlineage XML parity are unprobed; slice-31/44 boundary
     * preserved).
     *
     * <p>Mixed expressions (e.g. {@code mode() WG (...) || rank(0.5)
     * WG (...)} in a single predicate-body inner projection) are
     * admitted when every WG-bearing call is admitted-shape;
     * one non-admitted-shape call blocks the whole expression
     * (Slice45Test §D).
     */
    private static boolean allWithinGroupCallsAreAdmittedSnowflakeDirectAttachment(
            TExpression e) {
        if (e == null) return false;
        final boolean[] sawAny = {false};
        final boolean[] sawNonAdmitted = {false};
        e.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (!hasWithinGroupAnyAttachment(fn)) return;
                sawAny[0] = true;
                if (!isDirectAttachmentHypotheticalSetCallShape(fn)
                        && !isDirectAttachmentModeCallShape(fn)) {
                    sawNonAdmitted[0] = true;
                }
            }
        });
        if (e.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = e.getFunctionCall();
            if (fn != null && hasWithinGroupAnyAttachment(fn)) {
                sawAny[0] = true;
                if (!isDirectAttachmentHypotheticalSetCallShape(fn)
                        && !isDirectAttachmentModeCallShape(fn)) {
                    sawNonAdmitted[0] = true;
                }
            }
        }
        return sawAny[0] && !sawNonAdmitted[0];
    }

    /**
     * Slice 27: fail-closed enumeration of admitted projection root shapes
     * after the slice-23/24 fast paths and the hard-rejecter guards have
     * been considered by {@link #isAdmittedPredicateProjection}.
     * Open-ended type checks are intentionally avoided
     * (slice-history §C / codex round-1 SHOULD 5).
     *
     * <p>Admits:
     * <ul>
     *   <li>{@code function_t} — any function call (aggregate or scalar).
     *       OVER-bearing window functions are rejected by the caller's
     *       {@code containsWindowFunction} guard (slice 31 narrowed via
     *       {@link #isWindowDefBearingFunction} so WITHIN-GROUP-only
     *       windowDef passes; OVER-bearing forms still rejected).
     *       {@code FILTER (WHERE ...)} was admitted in slice 28 (with
     *       FILTER predicate refs excluded from {@code OutputColumn.sources}
     *       via {@link #collectColumnRefsExcludingFilterClauses} —
     *       slice 31 widens to
     *       {@link #collectColumnRefsExcludingFilterAndWithinGroupClauses}).
     *       PG-style direct {@code fn.withinGroup} attachment was admitted
     *       in slice 29 via the vendor-gated rejecter at the
     *       {@link #preflightPredicateSubqueryShape} call site; slice 31 extends
     *       admission to Oracle / MSSQL windowDef-bearing WITHIN GROUP
     *       (Snowflake / DB2 / other direct-attachment vendors remain
     *       rejected pending probe).</li>
     *   <li>{@code case_t} — simple or searched CASE.</li>
     *   <li>Pure binary ({@link TExpression#isPureBinaryForDoParse}) —
     *       arithmetic, concat, comparison.</li>
     *   <li>{@code parenthesis_t} — descend.</li>
     *   <li>{@code typecast_t} — PostgreSQL / Snowflake / Redshift
     *       {@code expr::TYPE} (slice 37; cross-vendor probe slice 38).
     *       Admit unconditionally; the slice-13 invariant rejecters
     *       ({@link #containsAnySubqueryExpression} /
     *       {@link #containsWindowFunction}) fire BEFORE this admit check
     *       inside {@link #isAdmittedPredicateProjection}, so
     *       {@code (SELECT 1)::INT} and {@code (ROW_NUMBER() OVER ())::INT}
     *       are still rejected. The default visitor descent walks
     *       {@code typecast_t.getLeftOperand()} so
     *       {@code OutputColumn.sources} populates with the underlying
     *       column refs (probe-verified for PG —
     *       {@code /tmp/probe37/Probe37.java}; slice 38 extended the probe
     *       to Snowflake and Redshift —
     *       {@code /tmp/probe38/Probe38.java}, {@code CheckCurrent.java} —
     *       and confirmed byte-identical AST + dlineage XML to PG for both
     *       {@code x.id::VARCHAR [AS lst]} and {@code LOWER(x.id)::VARCHAR}
     *       composed forms with zero divergence; slice 39 extended the probe
     *       to Greenplum, Vertica, GaussDB, Netezza —
     *       {@code /tmp/probe39/Probe39.java}, {@code Probe39b.java} — and
     *       confirmed AST + dlineage XML byte-identical to the PG / Snowflake /
     *       Redshift contract for both aliased and unaliased forms with zero
     *       divergence; slice 40 extended the probe to BigQuery, Trino, Presto,
     *       EDB, DuckDB, Databricks —
     *       {@code /tmp/probe40/Probe40.java}, {@code Probe40b.java},
     *       {@code Probe40c.java}, {@code Probe40d.java}, {@code Probe40e.java}
     *       — and confirmed AST + dlineage XML byte-identical to the
     *       PG / Snowflake / Redshift contract for aliased, unaliased, and
     *       {@code LOWER(x.id)::VARCHAR} composed forms with zero divergence;
     *       slice 41 closes out the residual vendor matrix —
     *       {@code /tmp/probe41/Probe41.java}, {@code Probe41b.java} —
     *       confirming Informix native {@code typecast_t} (AST + dlineage XML
     *       byte-identical to the PG / Snowflake / Redshift contract);
     *       ClickHouse parser auto-lowers {@code expr::TYPE} to
     *       {@code function_t} so the slice-27 admission applies;
     *       Sybase / Flink / Dameng parse-fail on {@code ::TYPE} but accept
     *       {@code CAST(x AS TYPE)} via {@code function_t} (slice-27
     *       carryover); Exasol / AzureSQL parse {@code expr::TYPE} as
     *       {@code simple_object_name_t} (vendor-quirk — the {@code ::} is
     *       interpreted as a qualified-name separator, mirroring T-SQL's
     *       {@code tablename::method()} schema-qualified syntax) so the
     *       slice-32 exclusion routes via normal column handling;
     *       OceanBase / Impala / StarRocks parse-fail boundary locked in).
     *       Oracle uses {@code CAST(x AS TYPE)} which parses as
     *       {@code function_t} (already admitted above), so no Oracle-specific
     *       {@code typecast_t} admission is needed; Hive / SparkSQL parse-fail
     *       on the {@code ::TYPE} syntax — slice 39 pins this boundary; slice
     *       40 extends the parse-fail boundary lock-in to DB2, Teradata, MySQL,
     *       and HANA so a future grammar lift fires loudly and re-probe is
     *       required before relying on zero-divergence for those dialects.
     *       The slice-37 admission remains structural (no vendor gate); future
     *       vendors that surface {@code typecast_t} will be admitted
     *       automatically — re-probe before relying on zero-divergence
     *       guarantees.</li>
     * </ul>
     * Implicitly rejects {@code list_t}, {@code subquery_t} (caught by the
     * caller), and any unknown expression type.
     */
    private static boolean isAdmittedSlice27ShapeRoot(TExpression e) {
        if (e == null) return false;
        EExpressionType t = e.getExpressionType();
        if (t == EExpressionType.function_t) return true;
        if (t == EExpressionType.case_t) return true;
        if (t == EExpressionType.parenthesis_t) {
            return e.getLeftOperand() != null
                    && isAdmittedSlice27ShapeRoot(e.getLeftOperand());
        }
        if (t == EExpressionType.typecast_t) return true;     // slice 37 (cross-vendor parity probed in slice 38; widened in slice 39 + slice 40; residual vendors locked in by slice 41 — Informix typecast_t)
        if (TExpression.isPureBinaryForDoParse(t)) return true;
        return false;
    }

    /**
     * Slice 27: visitor-based deep window-function detector. Mirrors
     * {@link #rejectWindowFunctions} (line ~4530) but boolean-returning so
     * it can be used as a guard inside
     * {@link #isAdmittedPredicateProjection}.
     *
     * <p>Slice 31: discriminates WITHIN-GROUP-only windowDef shapes
     * (Oracle / MSSQL plain {@code WITHIN GROUP (ORDER BY ...)} attachment
     * without OVER) from OVER-bearing ones via
     * {@link #isWindowDefBearingFunction}. Plain WITHIN GROUP no longer
     * counts as a window function for predicate-body inner-projection
     * admission. NOTE: only this helper and {@link #isAggregateFunction}
     * are lifted — every other slice-13 invariant rejecter
     * ({@link #rejectHavingWindowFunction},
     * {@link #rejectOrderByWindowFunction},
     * {@link #rejectWindowFunctionInScope},
     * {@link #rejectWindowFunctions},
     * {@link #rejectEmbeddedWindowFunction},
     * {@link #isTopLevelWindowProjection}, and the OVER ORDER BY
     * window check inside {@code buildWindowOrderRefs}) keeps the
     * strict {@code wd != null} check unchanged so HAVING / ORDER BY /
     * WHERE / GROUP BY / JOIN ON / top-level projection contexts still
     * reject WITHIN-GROUP-only attachments — slice 31 boundary.
     */
    private static boolean containsWindowFunction(TExpression e) {
        if (e == null) return false;
        final boolean[] found = {false};
        e.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (isWindowDefBearingFunction(fn)) found[0] = true;
            }
        });
        if (!found[0] && e.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = e.getFunctionCall();
            if (isWindowDefBearingFunction(fn)) found[0] = true;
        }
        return found[0];
    }

    /**
     * Slice 31: discriminate WITHIN-GROUP-only {@link TWindowDef} shapes
     * from OVER-bearing ones. Returns {@code true} iff:
     * <ul>
     *   <li>{@code wd.getWithinGroup() != null} — the discriminating
     *       attachment;</li>
     *   <li>{@code !wd.isIncludingOverClause()} — no OVER syntax of any
     *       kind (including empty {@code OVER ()});</li>
     *   <li>{@code wd.getKeepDenseRankClause() == null} — Oracle KEEP
     *       DENSE_RANK FIRST/LAST is a slice-22 deferred shape and must
     *       remain windowed.</li>
     * </ul>
     *
     * <p>Probe-validated: {@code TWindowDef.isIncludingOverClause()} is
     * {@code false} for plain {@code WITHIN GROUP} and {@code true} for
     * any OVER-bearing form (probe Q8 / Q9 / Q11 in
     * {@code /tmp/probe31}).
     *
     * <p>Used by {@link #isWindowDefBearingFunction} (the slice-13
     * invariant lift's discriminator).
     */
    private static boolean isWithinGroupOnlyWindowDef(TWindowDef wd) {
        if (wd == null) return false;
        if (wd.isIncludingOverClause()) return false;
        if (wd.getWithinGroup() == null) return false;
        if (wd.getKeepDenseRankClause() != null) return false;
        return true;
    }

    /**
     * Slice 31: a {@link TFunctionCall} is an OVER-bearing window-def
     * function iff its {@code windowDef} is non-null AND not
     * {@link #isWithinGroupOnlyWindowDef WITHIN-GROUP-only}. Replaces
     * the historical {@code fn.getWindowDef() != null} check inside
     * {@link #containsWindowFunction} and {@link #isAggregateFunction};
     * every other rejecter retains the strict {@code wd != null} check
     * unchanged (slice 31 narrow lift).
     */
    private static boolean isWindowDefBearingFunction(TFunctionCall fn) {
        if (fn == null) return false;
        TWindowDef wd = fn.getWindowDef();
        if (wd == null) return false;
        return !isWithinGroupOnlyWindowDef(wd);
    }

    /**
     * Slice 33: a {@link TFunctionCall} is an admitted top-level
     * WITHIN-GROUP-only aggregate iff:
     *
     * <ul>
     *   <li>{@link #isWithinGroupOnlyWindowDef} returns true on its
     *       windowDef (Oracle / MSSQL plain {@code WITHIN GROUP}, no
     *       OVER, no KEEP DENSE_RANK);</li>
     *   <li>{@code vendor} is Oracle or MSSQL — explicit gate mirroring
     *       the slice-31 predicate-body gate at line ~3860. PG /
     *       Snowflake / DB2 / SparkSQL produce direct
     *       {@code fn.withinGroup} attachment with {@code windowDef=null}
     *       and don't reach this helper today, but the explicit gate
     *       keeps the contract narrow against future parser changes;</li>
     *   <li>The function name is in {@link #AGGREGATE_FUNCTION_NAMES}
     *       (LISTAGG / STRING_AGG / SUM / MIN / MAX / MODE / etc.).</li>
     * </ul>
     *
     * <p>Used only by {@link #buildOutputColumns} to fall through to the
     * normal aggregate path. The slice-13 invariant rejecters
     * ({@link #isTopLevelWindowProjection},
     * {@link #rejectWindowFunctions},
     * {@link #rejectEmbeddedWindowFunction},
     * {@link #rejectHavingWindowFunction},
     * {@link #rejectOrderByWindowFunction},
     * {@link #rejectWindowFunctionInScope})
     * keep the strict {@code wd != null} check unchanged; slice 33
     * admission is gated by a single boolean local to
     * {@code buildOutputColumns}.
     *
     * <p>Non-whitelisted names (PERCENTILE_CONT / PERCENTILE_DISC /
     * RANK / DENSE_RANK / PERCENT_RANK / CUME_DIST / user-defined)
     * keep routing to {@link #buildWindowOutputColumn} where the
     * {@link #WINDOW_FUNCTION_NAMES} guard rejects them as
     * "unsupported window function".
     */
    private static boolean isAdmittedTopLevelWithinGroupAggregate(
            TFunctionCall fn, EDbVendor vendor) {
        if (fn == null) return false;
        if (!isWithinGroupOnlyWindowDef(fn.getWindowDef())) return false;
        if (vendor != EDbVendor.dbvoracle && vendor != EDbVendor.dbvmssql) {
            return false;
        }
        if (fn.getFunctionName() == null) return false;
        String name = fn.getFunctionName().toString();
        if (name == null || name.isEmpty()) return false;
        String lower = name.toLowerCase(Locale.ROOT);
        if (AGGREGATE_FUNCTION_NAMES.contains(lower)) return true;
        // Slice 42: hypothetical-set ordered-set aggregates (RANK /
        // DENSE_RANK / PERCENT_RANK / CUME_DIST) admitted on
        // Oracle / MSSQL with WITHIN-GROUP-only windowDef shape. The
        // surrounding {@code isWithinGroupOnlyWindowDef} guard above
        // already enforces the shape; the name-set membership here keeps
        // PERCENTILE_CONT / PERCENTILE_DISC / user-defined names rejected.
        return HYPOTHETICAL_SET_AGGREGATE_NAMES.contains(lower);
    }

    /**
     * Slice 35 / 36 / 46: top-level direct-attachment WITHIN GROUP
     * aggregate.
     *
     * <p>PG stores {@code LISTAGG(... ) WITHIN GROUP (...)} (slice 35) and
     * {@code STRING_AGG(... ) WITHIN GROUP (...)} (slice 36) in
     * {@code fn.getWithinGroup()} with {@code windowDef=null}. Both bypass
     * the slice-33 Oracle/MSSQL helper above, but the plain aggregate path
     * is otherwise already correct: the root is not a window function,
     * {@link #isAggregateFunction} sees the whitelisted name, and default
     * visitor descent does not walk direct {@code fn.withinGroup}, so
     * sources contain the function argument but not the WITHIN GROUP ORDER
     * BY ref. This helper exists only to unlock the slice-34 expression-text
     * fallback for the unaliased top-level form.
     *
     * <p>Slice 36 widens the PG name whitelist from {@code {listagg}} to
     * {@code {listagg, string_agg}}. Snowflake / DB2 / SparkSQL
     * {@code LISTAGG} / {@code STRING_AGG} WG remain rejected because
     * their argument-storage shape (e.g. DB2's {@code stringExpr}/
     * {@code separatorExpr}) is not yet probed for visitor descent and
     * silent empty {@code OutputColumn.sources} would manufacture
     * {@code IR_MISSING_DEPENDENCY} divergence.
     *
     * <p>Slice 46 widens the vendor gate to additionally admit
     * Snowflake — but only for {@code mode}, the only Snowflake
     * direct-attachment WITHIN GROUP name whose dlineage XML has been
     * probe-confirmed byte-equivalent to PG (the projector's slice-30
     * vendor-agnostic {@code AGGREGATE_FUNCTION_NAMES} +
     * {@code ORDER_BY_WITHIN_GROUP_AGGREGATE_NAMES} entries already
     * cover {@code mode}, so no projector change is needed). Snowflake
     * {@code listagg} / {@code string_agg} / hypothetical-set names
     * stay out of slice-46 scope.
     *
     * <p>Slice 47 widens the PG name whitelist from
     * {@code {listagg, string_agg}} to {@code {listagg, string_agg, mode}},
     * the symmetrical lift to slice 46's Snowflake widen. The slice-46
     * pre-plan probe ({@code /tmp/Probe46Slice30.java}) already
     * confirmed PG aliased {@code mode()} WG was zero-divergence and the
     * unaliased form was blocked only by {@code effectiveOutputName}; PG
     * top-level {@code mode()} dlineage XML is byte-identical to
     * Snowflake's. No projector change is needed (slice 30 already
     * registered {@code mode}, vendor-agnostic).
     */
    private static boolean isAdmittedTopLevelDirectWithinGroupAggregate(
            TFunctionCall fn, EDbVendor vendor) {
        if (fn == null) return false;
        if (fn.getWithinGroup() == null) return false;
        if (fn.getWindowDef() != null) return false;
        if (fn.getFunctionName() == null) return false;
        String name = fn.getFunctionName().toString();
        if (name == null || name.isEmpty()) return false;
        String lower = name.toLowerCase(Locale.ROOT);
        if (vendor == EDbVendor.dbvpostgresql) {
            // Slice 35/36: PG LISTAGG / STRING_AGG WG.
            // Slice 47: PG mode() WG (parallels slice-46 Snowflake mode
            // lift; probed mode() carries no positional argument so
            // OutputColumn.sources is trivially empty matching
            // dlineage's zero-edge canonical model).
            return "listagg".equals(lower)
                    || "string_agg".equals(lower)
                    || ("mode".equals(lower) && hasNoFunctionArgs(fn));
        }
        if (vendor == EDbVendor.dbvsnowflake) {
            // Slice 46: Snowflake mode() WG only. The admitted shape is
            // constrained to the probed no-arg mode() form: OutputColumn.
            // sources is trivially empty (matching dlineage's zero-edge
            // canonical model), and dlineage XML was probe-confirmed
            // byte-identical to PG's mode() WG XML for both aliased and
            // unaliased forms.
            return "mode".equals(lower) && hasNoFunctionArgs(fn);
        }
        return false;
    }
    /**
     * Slice 27: detect {@code FILTER (WHERE ...)} on any function call in
     * the expression subtree. Probe Q5 (PostgreSQL) confirmed dlineage's
     * {@code fdr clause="on"} omits FILTER-predicate column refs while
     * {@link #collectColumnRefs} would include them — canonical-model
     * divergence. Reject as slice-27 boundary.
     */
    private static boolean containsAggregateWithFilter(TExpression e) {
        if (e == null) return false;
        final boolean[] found = {false};
        e.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (fn.getFilterClause() != null) found[0] = true;
            }
        });
        if (!found[0] && e.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = e.getFunctionCall();
            if (fn != null && fn.getFilterClause() != null) found[0] = true;
        }
        return found[0];
    }

    /**
     * Slice 23: true iff every leaf of {@code e} is a {@code simple_constant_t}.
     * Admits {@code 1}, {@code 1+1}, {@code (1)}, {@code 'a' || 'b'} (vendor-
     * dependent). Slice 61 additionally admits unary {@code +}/{@code -}
     * wrappers over a constant operand so common signed literals like
     * {@code -1} and {@code -1.5} count as constants. Rejects column refs,
     * function calls (including {@code COALESCE}), CASE, scalar subqueries,
     * etc. The predicate body may STILL have inner WHERE / GROUP BY /
     * HAVING / ORDER BY referencing inner columns — only the projection
     * must be constant.
     */
    private static boolean isConstantExpression(TExpression e) {
        if (e == null) return false;
        EExpressionType t = e.getExpressionType();
        if (t == EExpressionType.simple_constant_t) return true;
        if (t == EExpressionType.parenthesis_t) {
            return e.getLeftOperand() != null && isConstantExpression(e.getLeftOperand());
        }
        // Slice 61: unary +/- over a constant operand. The Oracle parser
        // emits `-1` as {@code unary_minus_t} with {@code left=null} and
        // {@code right=simple_constant_t(1)}. Pre-slice-61 this fell
        // through and was rejected; slice 61 lifts it so signed literals
        // like `SELECT -1 FROM t` and `SELECT -1 UNION ALL SELECT -2`
        // round-trip through the constant-projection path.
        if (t == EExpressionType.unary_minus_t || t == EExpressionType.unary_plus_t) {
            TExpression operand = e.getRightOperand() != null
                    ? e.getRightOperand()
                    : e.getLeftOperand();
            return operand != null && isConstantExpression(operand);
        }
        // Pure binary ops (slice-22 isPureBinaryForDoParse helper) — both
        // operands must be constant. Concatenation, arithmetic, etc.
        if (TExpression.isPureBinaryForDoParse(t)) {
            TExpression l = e.getLeftOperand();
            TExpression r = e.getRightOperand();
            return l != null && isConstantExpression(l)
                    && r != null && isConstantExpression(r);
        }
        return false;
    }

    /**
     * Reject subqueries in a predicate-subquery body's inner WHERE / JOIN ON /
     * GROUP BY / HAVING / ORDER BY (would be predicate subqueries OR scalar
     * subqueries). Mirrors the slice-11
     * {@link #rejectSubqueriesInScalarBodyClauses} structure but renders
     * through the shared predicate-subquery diagnostic context.
     */
    private static void rejectSubqueriesInPredicateBodyClauses(
            TSelectSqlStatement inner,
            PredicateSubqueryContext context) {
        TWhereClause where = inner.getWhereClause();
        if (where != null && containsAnySubquery(where)) {
            throw new SemanticIRBuildException(
                    PredicateSubqueryDiagnostics.unsupported(
                            DiagnosticCode.JOIN_ON_EXISTS_INNER_SUBQUERY_IN_WHERE,
                            context,
                            "inner SELECT has a subquery in its WHERE clause; "
                                    + "not supported yet",
                            where));
        }
        if (inner.joins != null) {
            for (TJoin join : inner.joins) {
                TJoinItemList items = join.getJoinItems();
                if (items == null) continue;
                for (int i = 0; i < items.size(); i++) {
                    TJoinItem item = items.getJoinItem(i);
                    TExpression onCond = item == null ? null : item.getOnCondition();
                    if (onCond != null && containsAnySubqueryExpression(onCond)) {
                        throw new SemanticIRBuildException(
                                PredicateSubqueryDiagnostics.unsupported(
                                        DiagnosticCode.JOIN_ON_EXISTS_INNER_SUBQUERY_IN_JOIN_ON,
                                        context,
                                        "inner SELECT has a subquery in a JOIN ON "
                                                + "clause; not supported yet",
                                        onCond));
                    }
                }
            }
        }
        TGroupBy groupBy = inner.getGroupByClause();
        if (groupBy != null) {
            TGroupByItemList items = groupBy.getItems();
            if (items != null && containsAnySubquery(items)) {
                throw new SemanticIRBuildException(
                        PredicateSubqueryDiagnostics.unsupported(
                                DiagnosticCode.JOIN_ON_EXISTS_INNER_SUBQUERY_IN_GROUP_BY,
                                context,
                                "inner SELECT has a subquery in a GROUP BY clause; "
                                        + "not supported yet",
                                groupBy));
            }
        }
        // HAVING / ORDER BY subqueries are caught by the slice-9 / 10
        // deep-scan rejecters that fire during the recursive build.
    }

    /**
     * Slice 25 (impl-review S2-fix): walk {@code onCond} (root + every
     * descendant outside {@code extractedRoots}) and return the first
     * wrapper expression whose <b>left</b> operand is a
     * {@code subquery_t}. Returns null if none.
     */
    private static TExpression findSubqueryOnLeftWrapper(TExpression onCond,
                                                          final Set<TExpression> extractedRoots) {
        if (onCond == null) return null;
        if (isSubqueryOnLeftOfWrapper(onCond)) return onCond;
        final TExpression[] found = {null};
        onCond.acceptChildren(new TParseTreeVisitor() {
            int skipDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (found[0] != null) return;
                if (extractedRoots.contains(e)) {
                    skipDepth++;
                    return;
                }
                if (skipDepth > 0) return;
                if (isSubqueryOnLeftOfWrapper(e)) {
                    found[0] = e;
                }
            }

            @Override
            public void postVisit(TExpression e) {
                if (extractedRoots.contains(e) && skipDepth > 0) {
                    skipDepth--;
                }
            }
        });
        return found[0];
    }

    /**
     * Slice 25 / Slice 26: true iff {@code e} is a comparison/IN/
     * quantifier wrapper that the slice-25 / slice-26 surface still
     * rejects on subquery-positioning grounds.
     *
     * <p>Slice 26 narrowing: {@code simple_comparison_t} with subquery
     * on the LHS and a non-subquery RHS is now ADMITTED (returns
     * false here so the post-extraction rejecter doesn't fire). Other
     * shapes still fail:
     * <ul>
     *   <li>{@code in_t} with LHS=subquery: dlineage's
     *       {@code fdr clause="on"} sources omit the outer column for
     *       IN-LHS, so admitting on the IR side would manufacture
     *       canonical-model divergence (still rejected).</li>
     *   <li>{@code group_comparison_t} with LHS=subquery: borderline
     *       grammar; defensively rejected (slice-26 boundary).</li>
     *   <li>{@code simple_comparison_t} with subqueries on BOTH
     *       sides: would require dual extraction; deferred to a future
     *       slice (slice-26 boundary). Caller emits a tuned message.</li>
     * </ul>
     */
    private static boolean isSubqueryOnLeftOfWrapper(TExpression e) {
        if (e == null) return false;
        EExpressionType t = e.getExpressionType();
        TExpression l = e.getLeftOperand();
        TExpression r = e.getRightOperand();
        boolean lhsIsSubq = l != null && l.getExpressionType() == EExpressionType.subquery_t;
        boolean rhsIsSubq = r != null && r.getExpressionType() == EExpressionType.subquery_t;
        if (t == EExpressionType.in_t) {
            return lhsIsSubq;
        }
        if (t == EExpressionType.group_comparison_t) {
            return lhsIsSubq;
        }
        if (t == EExpressionType.simple_comparison_t) {
            // Slice 26: lifted UNLESS both sides are subqueries.
            return lhsIsSubq && rhsIsSubq;
        }
        return false;
    }

    /**
     * Slice 26: true iff {@code e} is a {@code simple_comparison_t}
     * whose BOTH operands are {@code subquery_t}. Used by the
     * post-extraction rejecter to emit a slice-26-specific tuned
     * message distinguishing this case from the slice-25 LHS-subquery
     * shapes.
     */
    private static boolean isComparisonWithBothSubqueries(TExpression e) {
        if (e == null) return false;
        if (e.getExpressionType() != EExpressionType.simple_comparison_t) return false;
        TExpression l = e.getLeftOperand();
        TExpression r = e.getRightOperand();
        return l != null && l.getExpressionType() == EExpressionType.subquery_t
                && r != null && r.getExpressionType() == EExpressionType.subquery_t;
    }

    /**
     * Slice 23: after extraction, any remaining subquery-bearing expression in
     * the JOIN-ON tree is an unsupported shape — EXISTS that failed
     * extraction (inner-shape rejection), correlated wrappers, subquery on
     * left side, etc. Catch them here with a tuned message before
     * {@link #collectColumnRefsSkipping} would otherwise descend into them
     * and bind their inner refs against the outer scope.
     *
     * <p>Slice 25 (impl-review S2-fix): subquery-on-LEFT cases get a
     * tuned outer-shape reason via {@link #findSubqueryOnLeftWrapper};
     * the shared predicate-subquery context supplies the actual wrapper
     * and host clause in the final diagnostic.
     *
     * <p>Slice 26: a NEW first pass (before the slice-25 LHS-subquery
     * pass) detects {@code simple_comparison_t} wrappers with
     * subqueries on BOTH sides via
     * {@link #findComparisonWithBothSubqueries} and emits a slice-26
     * tuned message. Both-sides shape satisfies
     * {@link #isSubqueryOnLeftOfWrapper} (which slice 26 narrowed to
     * {@code lhsIsSubq && rhsIsSubq} for {@code simple_comparison_t}),
     * so ordering matters — without the both-sides first pass, the
     * slice-25 LHS-subquery wording would fire first.
     */
    private static void rejectAnyRemainingSubqueriesInJoinOn(TExpression onCond,
                                                              final Set<TExpression> extractedRoots) {
        rejectAnyRemainingSubqueriesFromClause(onCond, extractedRoots,
                PredicateClauseContext.JOIN_ON);
    }

    /**
     * Slice 110 — clause-agnostic remaining-subquery rejecter. Mirrors
     * the slice-26 logic in {@link #rejectAnyRemainingSubqueriesInJoinOn}
     * but uses {@code ctx.*} codes / labels so the same body powers JOIN-ON
     * (slice 26) and UPDATE WHERE (slice 110).
     */
    private static void rejectAnyRemainingSubqueriesFromClause(TExpression onCond,
                                                                final Set<TExpression> extractedRoots,
                                                                final PredicateClauseContext ctx) {
        if (onCond == null) return;
        // Slice 26: tuned message for a comparison with subqueries on
        // BOTH sides. Fires at root or any descent. Checked BEFORE the
        // slice-25 subquery-on-LEFT pass because both-subqueries
        // satisfies isSubqueryOnLeftOfWrapper too — without this
        // ordering the slice-25 wording would fire first.
        TExpression bothSubqueriesWrapper = findComparisonWithBothSubqueries(onCond,
                extractedRoots);
        if (bothSubqueriesWrapper != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(ctx.scalarComparisonBothSides,
                    "predicate subquery in " + ctx.clauseLabel + ": scalar comparison with "
                            + "subqueries on both sides is not supported yet "
                            + "(slice 26 admits exactly one subquery side, with a "
                            + "single column reference on the other side; rewrite "
                            + "as a join across a derived table or a CTE)", null));
        }
        // Slice 25 (impl-review S2-fix): tuned message for subquery
        // on the LEFT side of a wrapper. Fires at root or any descent.
        // Slice 26 narrowed isSubqueryOnLeftOfWrapper:
        // simple_comparison_t with LHS=subquery and non-subquery RHS is
        // now ADMITTED, so this rejecter only fires for in_t-LHS-subq /
        // group_comparison_t-LHS-subq (still rejected as asymmetric /
        // borderline shapes).
        TExpression leftSubqueryWrapper = findSubqueryOnLeftWrapper(onCond, extractedRoots);
        if (leftSubqueryWrapper != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(ctx.predicateSubqueryOnLeft,
                    "predicate subquery in " + ctx.clauseLabel + ": "
                            + leftSubqueryWrapper.getExpressionType()
                            + " wrapper has a subquery on the LEFT side "
                            + "(only RHS-subquery IN / ANY-ALL-SOME and "
                            + "either-side scalar comparison are admitted; "
                            + "rewrite to put the subquery on the right side, "
                            + "or rewrite as a join across a derived table)", null));
        }
        // Root check: if the entire condition IS an EXISTS root and it WASN'T
        // extracted (meaning extraction threw an exception, which should not
        // reach here, OR some other root subquery shape), reject. The root
        // walker would otherwise miss it.
        TExpression rootSubject = isExistsRoot(onCond) ? unwrapExistsRoot(onCond) : onCond;
        if (rootSubject != null
                && (rootSubject.getExpressionType() == EExpressionType.subquery_t
                        || rootSubject.getSubQuery() != null
                        || rootSubject.getExpressionType() == EExpressionType.exists_t)
                && !extractedRoots.contains(rootSubject)) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(ctx.genericSubqueryNotSupported,
                    "subquery in " + ctx.clauseLabel + " predicate is not supported yet "
                            + "(slice 26 accepts only uncorrelated EXISTS / "
                            + "IN-SELECT / scalar-comparison / ANY-ALL-SOME with "
                            + "single column-ref or constant-only inner projection "
                            + "and a single column ref on the non-subquery side)", null));
        }
        final boolean[] found = {false};
        onCond.acceptChildren(new TParseTreeVisitor() {
            int skipDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (found[0]) return;
                if (extractedRoots.contains(e)) {
                    skipDepth++;
                    return;
                }
                if (skipDepth > 0) return;
                if (e.getExpressionType() == EExpressionType.subquery_t
                        || e.getSubQuery() != null
                        || e.getExpressionType() == EExpressionType.exists_t) {
                    found[0] = true;
                }
            }

            @Override
            public void postVisit(TExpression e) {
                if (extractedRoots.contains(e) && skipDepth > 0) {
                    skipDepth--;
                }
            }
        });
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(ctx.genericSubqueryNotSupported,
                    "subquery in " + ctx.clauseLabel + " predicate is not supported yet "
                            + "(slice 26 accepts only uncorrelated EXISTS / "
                            + "IN-SELECT / scalar-comparison / ANY-ALL-SOME with "
                            + "single column-ref or constant-only inner projection "
                            + "and a single column ref on the non-subquery side)", null));
        }
    }

    /**
     * Slice 26: walk {@code onCond} (root + every descendant outside
     * {@code extractedRoots}) and return the first
     * {@code simple_comparison_t} expression whose BOTH operands are
     * {@code subquery_t}. Returns null if none.
     */
    private static TExpression findComparisonWithBothSubqueries(TExpression onCond,
                                                                final Set<TExpression> extractedRoots) {
        if (onCond == null) return null;
        if (isComparisonWithBothSubqueries(onCond)) return onCond;
        final TExpression[] found = {null};
        onCond.acceptChildren(new TParseTreeVisitor() {
            int skipDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (found[0] != null) return;
                if (extractedRoots.contains(e)) {
                    skipDepth++;
                    return;
                }
                if (skipDepth > 0) return;
                if (isComparisonWithBothSubqueries(e)) {
                    found[0] = e;
                }
            }

            @Override
            public void postVisit(TExpression e) {
                if (extractedRoots.contains(e) && skipDepth > 0) {
                    skipDepth--;
                }
            }
        });
        return found[0];
    }

    /**
     * Slice 23: variant of {@link #rejectWindowFunctionInScope} that skips
     * subtrees in {@code skipRoots}. The outer-SELECT JOIN-ON path passes the
     * extracted EXISTS roots so a window function inside an extracted body
     * is NOT incorrectly rejected as a window in the outer JOIN-ON. (The
     * inner statement's own buildSelectStatement does its own
     * rejectWindowFunctionInScope sweeps on WHERE / GROUP BY / HAVING /
     * ORDER BY, so legitimate inner-window violations still surface.)
     */
    private static void rejectWindowFunctionInScopeSkipping(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            String clauseLabel,
            final Set<TExpression> skipRoots) {
        if (root == null) return;
        // Root fast path: if the root itself IS a skipped subtree, nothing to
        // check. (acceptChildren wouldn't see the root anyway.)
        if (root instanceof TExpression && skipRoots.contains(root)) {
            return;
        }
        final boolean[] found = {false};
        root.acceptChildren(new TParseTreeVisitor() {
            int skipDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (skipRoots.contains(e)) {
                    skipDepth++;
                }
            }

            @Override
            public void postVisit(TExpression e) {
                if (skipRoots.contains(e) && skipDepth > 0) {
                    skipDepth--;
                }
            }

            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0] || skipDepth > 0) return;
                if (fn.getWindowDef() != null) found[0] = true;
            }
        });
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.CLAUSE_WINDOW_FUNCTION_LEAK,
                    clauseLabel + " contains a window function (OVER (...)); "
                            + "window functions are not allowed in " + clauseLabel
                            + " per standard SQL", root));
        }
    }

    /**
     * Slice 23: variant of {@link #collectColumnRefs} that skips subtrees in
     * {@code skipRoots}. Used by the outer-SELECT JOIN-ON path so the
     * extracted EXISTS bodies' inner refs do not leak into outer
     * {@code joinColumnRefs}.
     */
    private static List<ColumnRef> collectColumnRefsSkipping(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            final NameBindingProvider provider,
            final Set<TExpression> skipRoots) {
        // Slice 31 refactor: delegate to the extended variant with no
        // TWithinGroup skips. Behavior preserved exactly for the
        // existing slice-28 caller (outer JOIN-ON path at line ~3021)
        // and for the new slice-31 caller via
        // {@link #collectColumnRefsExcludingFilterAndWithinGroupClauses}.
        return collectColumnRefsSkippingExtended(root, provider,
                skipRoots, Collections.<TWithinGroup>emptySet());
    }

    /**
     * Slice 28: collect every non-null {@link TFunctionCall#getFilterClause()}
     * subtree reachable from {@code root}. The returned set is identity-keyed
     * (uses {@link IdentityHashMap}) — required because the parser may yield
     * two structurally-equal FILTER WHERE expressions with different
     * identities; a value-keyed set would coalesce them and the
     * downstream {@link #collectColumnRefsSkipping} call would skip only one.
     *
     * <p>Contract: {@code root} is one of {@link TResultColumn} or
     * {@link TExpression}. Both call sites
     * ({@link #collectColumnRefsExcludingFilterClauses} for projection
     * source collection; the slice-28 correlation walk inside
     * {@link #extractOnePredicateSubqueryBody}) pass values of those
     * two types. Other {@code TParseTreeNode} subclasses are accepted
     * defensively (the visitor scan still works) but the top-level
     * direct-check fast paths only cover {@code TResultColumn} and
     * {@code TExpression}; this is intentional — adding a
     * {@code TFunctionCall} fast path would be reachable only if a
     * future call site were added with a {@code TFunctionCall} root.
     *
     * <p>Visitor-driven; descends into all expression subtrees the
     * standard {@code TFunctionCall.acceptChildren} path visits — function
     * args, {@code OVER} (analyticFunction / windowDef), FILTER, CASE arms,
     * parenthesised sub-expressions, AND the
     * {@code windowDef.withinGroup.orderBy} path on Oracle / MSSQL /
     * SparkSQL parsers. Note: the PostgreSQL parser stores WITHIN GROUP
     * on the direct {@code fn.withinGroup} field, which
     * {@code TFunctionCall.acceptChildren} does NOT visit, so PG WITHIN
     * GROUP ORDER BY refs are invisible to this collector. Slice 29
     * relies on that asymmetry to admit PG WITHIN GROUP aggregates in
     * predicate-subquery inner projections without a source-skip.
     * Used by:
     * <ul>
     *   <li>{@link #collectColumnRefsExcludingFilterClauses} (Pass 1) — the
     *       global source-skip in {@link #buildOutputColumns}.</li>
     *   <li>{@link #extractOnePredicateSubqueryBody}'s slice-28 correlation
     *       walk — projection-only correlation check for FILTER predicate
     *       refs.</li>
     * </ul>
     */
    private static Set<TExpression> collectFilterClauses(
            gudusoft.gsqlparser.nodes.TParseTreeNode root) {
        final Set<TExpression> out =
                Collections.newSetFromMap(new IdentityHashMap<TExpression, Boolean>());
        if (root == null) return out;
        // Visitor descends into all expression subtrees; preVisit on
        // TFunctionCall records the filter clause if present. The
        // visitor's preVisit(TFunctionCall) does NOT fire for a top-level
        // function_t expression's root TFunctionCall (matches the slice-13 /
        // slice-27 visitor descent behavior); the defensive direct checks
        // below cover the top-level case for the two supported root types.
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                TExpression f = fn.getFilterClause();
                if (f != null) out.add(f);
            }
        });
        if (root instanceof TExpression) {
            TExpression e = (TExpression) root;
            if (e.getExpressionType() == EExpressionType.function_t) {
                TFunctionCall fn = e.getFunctionCall();
                if (fn != null && fn.getFilterClause() != null) {
                    out.add(fn.getFilterClause());
                }
            }
        } else if (root instanceof TResultColumn) {
            TResultColumn rc = (TResultColumn) root;
            TExpression e = rc.getExpr();
            if (e != null && e.getExpressionType() == EExpressionType.function_t) {
                TFunctionCall fn = e.getFunctionCall();
                if (fn != null && fn.getFilterClause() != null) {
                    out.add(fn.getFilterClause());
                }
            }
        }
        return out;
    }

    /**
     * Slice 30: collect every qualifier alias (the {@code x} of an
     * {@code x.region} TObjectName column reference) reachable from
     * {@code root}, without going through the resolver. Used by the
     * slice-30 WITHIN GROUP ORDER BY correlation walk in
     * {@link #extractOnePredicateSubqueryBody}.
     *
     * <p>Why bypass the resolver: PostgreSQL's parser stores WITHIN GROUP
     * on the direct {@code fn.withinGroup} field. {@code TFunctionCall.acceptChildren}
     * does NOT descend into that field, AND Resolver2 follows the same
     * traversal, so its {@code ResolutionResult} is null on TObjectName
     * nodes inside {@code fn.withinGroup.orderBy}. Calling
     * {@link #collectColumnRefs} on the WG ORDER BY would route through
     * {@code provider.bindColumn} → {@code NOT_FOUND}, and the
     * {@code non-exact column bindings} check would throw on legitimate
     * non-correlated refs. The qualifier-only collector here reads the
     * alias straight off the TObjectName via {@link TObjectName#getTableString()},
     * matching the slice-23 correlation invariant: qualified refs only.
     * Unqualified refs are out of scope (same schema-less limitation as
     * the rest of slice-23).
     *
     * <p>Returned in iteration order (so error messages identify the
     * first offender) using a list rather than a set.
     */
    private static List<String> collectQualifierAliases(
            gudusoft.gsqlparser.nodes.TParseTreeNode root) {
        final List<String> out = new ArrayList<>();
        if (root == null) return out;
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TObjectName node) {
                if (node.getDbObjectType() != EDbObjectType.column) return;
                String t = node.getTableString();
                if (t != null && !t.isEmpty()) out.add(t);
            }
        });
        return out;
    }

    /**
     * Slice 30 / Slice 31: collect every WITHIN-GROUP {@code ORDER BY}
     * clause anywhere in the subtree, identity-keyed so two
     * structurally-equal order-by clauses don't collapse.
     *
     * <p>Two attachment styles are covered:
     * <ul>
     *   <li><b>Slice 30 — direct attachment</b>: PostgreSQL /
     *       Snowflake / DB2 / SparkSQL parsers store WITHIN GROUP on
     *       {@code fn.getWithinGroup()}. The default
     *       {@code TFunctionCall.acceptChildren} does NOT descend into
     *       that field, so the slice-23 {@link #collectAllInnerRefs}
     *       walk is blind to outer-alias references inside the ORDER BY.
     *       The slice-30 correlation walk needs explicit access, hence
     *       this helper.</li>
     *   <li><b>Slice 31 — windowDef attachment</b>: Oracle / MSSQL
     *       parsers store WITHIN GROUP on
     *       {@code fn.getWindowDef().getWithinGroup()} when the
     *       windowDef is {@link #isWithinGroupOnlyWindowDef
     *       WITHIN-GROUP-only}. The default {@code acceptChildren}
     *       DOES descend through {@code windowDef.acceptChildren}
     *       which calls {@code withinGroup.acceptChildren} which calls
     *       {@code orderBy.acceptChildren}, so column refs would
     *       already appear in {@link #collectAllInnerRefs}-driven
     *       walks. <b>However</b>, the slice-31 source-skip in
     *       {@link #collectColumnRefsExcludingFilterAndWithinGroupClauses}
     *       removes those refs from {@link OutputColumn#getSources()};
     *       the slice-23 correlation walk only sees {@code OutputColumn.sources}
     *       for the projection bucket, so a correlated
     *       {@code LISTAGG(x.id) WITHIN GROUP (ORDER BY e.region)} on
     *       Oracle would slip past the slice-23 loop after the source-
     *       skip. This dual-attachment helper closes that asymmetry.
     *       (Inner WHERE / JOIN / HAVING / ORDER BY clauses are
     *       independently rejected by the slice-13 strict
     *       {@code rejectWindowFunctionInScope} family — Oracle
     *       LISTAGG WG inside a clause never reaches this helper.)</li>
     * </ul>
     *
     * <p>The visitor's {@code preVisit(TFunctionCall)} does NOT fire for
     * a top-level {@code function_t} expression's root TFunctionCall;
     * defensive direct checks below cover the top-level case for both
     * {@link TExpression} and {@link TResultColumn} roots, mirroring
     * {@link #collectFilterClauses}.
     *
     * <p>Used by {@link #extractOnePredicateSubqueryBody}'s
     * projection-only correlation walk (line ~3690) for both
     * direct-attachment (slice 30) and windowDef-attachment (slice 31)
     * outer-alias references inside WITHIN GROUP ORDER BY.
     */
    private static Set<TOrderBy> collectDirectWithinGroupOrderBys(
            gudusoft.gsqlparser.nodes.TParseTreeNode root) {
        final Set<TOrderBy> out =
                Collections.newSetFromMap(new IdentityHashMap<TOrderBy, Boolean>());
        if (root == null) return out;
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                TOrderBy direct = fn.getWithinGroup() == null
                        ? null : fn.getWithinGroup().getOrderBy();
                if (direct != null) out.add(direct);
                TWindowDef wd = fn.getWindowDef();
                if (isWithinGroupOnlyWindowDef(wd)) {
                    TOrderBy wdOb = wd.getWithinGroup().getOrderBy();
                    if (wdOb != null) out.add(wdOb);
                }
            }
        });
        if (root instanceof TExpression) {
            TExpression e = (TExpression) root;
            if (e.getExpressionType() == EExpressionType.function_t) {
                addWithinGroupOrderByIfPresent(e.getFunctionCall(), out);
            }
        } else if (root instanceof TResultColumn) {
            TResultColumn rc = (TResultColumn) root;
            TExpression e = rc.getExpr();
            if (e != null && e.getExpressionType() == EExpressionType.function_t) {
                addWithinGroupOrderByIfPresent(e.getFunctionCall(), out);
            }
        }
        return out;
    }

    /**
     * Slice 30 / 31: helper for top-level direct check inside
     * {@link #collectDirectWithinGroupOrderBys}. Adds the WITHIN GROUP
     * ORDER BY clause to {@code out} for whichever attachment style
     * the function carries.
     */
    private static void addWithinGroupOrderByIfPresent(TFunctionCall fn,
                                                       Set<TOrderBy> out) {
        if (fn == null) return;
        if (fn.getWithinGroup() != null && fn.getWithinGroup().getOrderBy() != null) {
            out.add(fn.getWithinGroup().getOrderBy());
        }
        TWindowDef wd = fn.getWindowDef();
        if (isWithinGroupOnlyWindowDef(wd) && wd.getWithinGroup().getOrderBy() != null) {
            out.add(wd.getWithinGroup().getOrderBy());
        }
    }

    /**
     * Slice 28: variant of {@link #collectColumnRefs} that excludes column
     * refs inside {@code FILTER (WHERE ...)} clauses on any function call
     * in the subtree. Used by {@link #buildOutputColumns} for ALL output
     * source collection so the IR's per-projection {@code OutputColumn.sources}
     * matches dlineage's lineage-relationship view (which omits FILTER
     * predicate column refs entirely; see slice-28 probes Q1–Q4).
     *
     * <p>For projections that contain no FILTER aggregates (the common case),
     * Pass 1 yields zero skip-roots and Pass 2 reduces to the plain
     * {@link #collectColumnRefs}. The asymmetry between projection sources
     * (FILTER-skipped) and clause refs ({@code filterColumnRefs},
     * {@code joinColumnRefs}, {@code groupByColumnRefs},
     * {@code havingColumnRefs}, {@code orderByColumnRefs} — NOT
     * FILTER-skipped) is intentional: it keeps the existing
     * {@link #collectAllInnerRefs}-driven correlation check at line ~3603
     * sufficient for FILTER refs landing in non-projection clauses, while
     * the slice-28 correlation walk in {@link #extractOnePredicateSubqueryBody}
     * covers projection-FILTER refs.
     */
    private static List<ColumnRef> collectColumnRefsExcludingFilterClauses(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            NameBindingProvider provider) {
        Set<TExpression> filterClauses = collectFilterClauses(root);
        if (filterClauses.isEmpty()) {
            return collectColumnRefs(root, provider);
        }
        return collectColumnRefsSkipping(root, provider, filterClauses);
    }

    /**
     * Slice 31: identity-keyed set of every {@link TWithinGroup} reachable
     * from {@code root} via {@code fn.getWindowDef().getWithinGroup()} —
     * the Oracle / MSSQL attachment style for plain {@code WITHIN GROUP
     * (ORDER BY ...)} aggregates. Used as additional skip-roots in
     * {@link #collectColumnRefsExcludingFilterAndWithinGroupClauses} so
     * the column refs inside the WITHIN GROUP ORDER BY do NOT enter
     * {@link OutputColumn#getSources()} on Oracle / MSSQL — matching
     * dlineage's omission of those refs from {@code fdr clause="on"}
     * sources (probe Q1 / Q3 / Q4 / Q5 in {@code /tmp/probe31}).
     *
     * <p>Discriminator: {@link #isWithinGroupOnlyWindowDef}. OVER-bearing
     * windowDefs (real window functions) are NOT collected here — the
     * slice-13 invariant rejecters keep them rejected before this
     * collector ever fires for projection sources, so they cannot
     * reach the source-skip in practice. Defensive: even if they did,
     * the discriminator excludes them so PARTITION BY / OVER ORDER BY
     * column refs (slice-13 / slice-19 alias-bound contracts) keep
     * their existing semantics.
     *
     * <p>The PostgreSQL direct {@code fn.getWithinGroup()} attachment
     * is NOT collected here because PG's
     * {@code TFunctionCall.acceptChildren} does not descend into the
     * direct field — slice 29 relied on that asymmetry to admit PG
     * WITHIN GROUP aggregates without any source-skip; slice 31
     * preserves that asymmetry on PG.
     */
    private static Set<TWithinGroup> collectWithinGroupClausesFromWindowDef(
            gudusoft.gsqlparser.nodes.TParseTreeNode root) {
        final Set<TWithinGroup> out =
                Collections.newSetFromMap(new IdentityHashMap<TWithinGroup, Boolean>());
        if (root == null) return out;
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                TWindowDef wd = fn.getWindowDef();
                if (isWithinGroupOnlyWindowDef(wd)) {
                    out.add(wd.getWithinGroup());
                }
            }
        });
        if (root instanceof TExpression) {
            TExpression e = (TExpression) root;
            if (e.getExpressionType() == EExpressionType.function_t) {
                addWithinGroupFromWindowDefIfPresent(e.getFunctionCall(), out);
            }
        } else if (root instanceof TResultColumn) {
            TResultColumn rc = (TResultColumn) root;
            TExpression e = rc.getExpr();
            if (e != null && e.getExpressionType() == EExpressionType.function_t) {
                addWithinGroupFromWindowDefIfPresent(e.getFunctionCall(), out);
            }
        }
        return out;
    }

    /**
     * Slice 31: helper for top-level direct check inside
     * {@link #collectWithinGroupClausesFromWindowDef}. Mirrors the
     * slice-30 {@link #addWithinGroupOrderByIfPresent} helper but adds
     * the {@link TWithinGroup} node itself to {@code out} (the entire
     * WITHIN GROUP subtree is the skip-root, not just its ORDER BY).
     */
    private static void addWithinGroupFromWindowDefIfPresent(TFunctionCall fn,
                                                             Set<TWithinGroup> out) {
        if (fn == null) return;
        TWindowDef wd = fn.getWindowDef();
        if (isWithinGroupOnlyWindowDef(wd)) {
            out.add(wd.getWithinGroup());
        }
    }

    /**
     * Slice 31: extends slice-28's filter-skipping projection-source
     * collector with an additional skip for Oracle / MSSQL
     * {@code fn.windowDef.withinGroup} subtrees. Reduces to slice-28
     * behavior on PostgreSQL (where windowDef is null) and to plain
     * {@link #collectColumnRefs} when neither FILTER nor WITHIN GROUP
     * is present.
     *
     * <p>Used by {@link #buildOutputColumns} for ALL projection source
     * collection (predicate-body short-circuit at line ~4952 and
     * normal projection loop at line ~5069) so the IR's
     * {@link OutputColumn#getSources()} matches dlineage's
     * lineage-relationship view across PG / Oracle / MSSQL. The
     * non-projection clause-bucket collectors
     * ({@code filterColumnRefs}, {@code joinColumnRefs},
     * {@code groupByColumnRefs}, {@code havingColumnRefs},
     * {@code orderByColumnRefs}) intentionally keep using plain
     * {@link #collectColumnRefs} — the slice-13 strict
     * {@code rejectWindowFunctionInScope} family rejects any
     * {@code wd != null} function in those clauses BEFORE collection
     * descends into them, so WITHIN GROUP refs cannot leak into
     * clause buckets in practice.
     */
    private static List<ColumnRef> collectColumnRefsExcludingFilterAndWithinGroupClauses(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            NameBindingProvider provider) {
        Set<TExpression> filterClauses = collectFilterClauses(root);
        Set<TWithinGroup> withinGroupClauses = collectWithinGroupClausesFromWindowDef(root);
        if (filterClauses.isEmpty() && withinGroupClauses.isEmpty()) {
            return collectColumnRefs(root, provider);
        }
        return collectColumnRefsSkippingExtended(root, provider,
                filterClauses, withinGroupClauses);
    }

    /**
     * Slice 31: variant of {@link #collectColumnRefsSkipping} that
     * additionally skips column refs inside {@link TWithinGroup}
     * subtrees in {@code wgSkipRoots} (Oracle / MSSQL
     * {@code fn.windowDef.withinGroup} attachment). The existing
     * {@code exprSkipRoots} carries the slice-28 FILTER subtrees.
     * Returns column refs in iteration order.
     *
     * <p>Refactor note: {@link #collectColumnRefsSkipping} now delegates
     * to this method with an empty {@code wgSkipRoots} set so its
     * behavior is preserved exactly for legacy callers (the outer
     * JOIN-ON path at line ~3021).
     */
    private static List<ColumnRef> collectColumnRefsSkippingExtended(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            final NameBindingProvider provider,
            final Set<TExpression> exprSkipRoots,
            final Set<TWithinGroup> wgSkipRoots) {
        final LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        final List<String> rejects = new ArrayList<>();
        // True if any reject is a QUALIFIED column miss (e.g. b.id pointing at
        // the wrong side). Such a miss is a genuine error and must stay fatal;
        // only all-unqualified rejects are eligible for the join-graph degrade.
        final boolean[] sawQualifiedReject = {false};
        // Root fast path: if root IS a skipped TExpression subtree, return empty.
        if (root instanceof TExpression && exprSkipRoots.contains(root)) {
            return new ArrayList<>(refs);
        }
        root.acceptChildren(new TParseTreeVisitor() {
            int skipDepth = 0;
            int nestedSelectDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (exprSkipRoots.contains(e)) skipDepth++;
            }

            @Override
            public void postVisit(TExpression e) {
                if (exprSkipRoots.contains(e) && skipDepth > 0) skipDepth--;
            }

            @Override
            public void preVisit(TWithinGroup wg) {
                if (wgSkipRoots.contains(wg)) skipDepth++;
            }

            @Override
            public void postVisit(TWithinGroup wg) {
                if (wgSkipRoots.contains(wg) && skipDepth > 0) skipDepth--;
            }

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TObjectName node) {
                if (skipDepth > 0) return;
                if (nestedSelectDepth > 0) return;
                appendMergedOrBoundColumnRef(node, provider, refs, rejects,
                        sawQualifiedReject);
            }
        });
        if (!rejects.isEmpty()) {
            rejectNonExactBindings(rejects, provider, !sawQualifiedReject[0]);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Reject join shapes that would silently drop predicate semantics:
     * semi/anti, vendor-specific kinds; predicate-bearing joins with
     * no ON and no USING clause; CROSS / NATURAL JOIN with ON or
     * USING. Slice 63 admits {@code CROSS JOIN} via
     * {@link #ALLOWED_ON_LESS_JOIN_TYPES}. Slice 64 admits
     * {@code JOIN ... USING (...)} on predicate join types; the
     * per-key {@code joinColumnRefs} emission is handled in
     * {@link #buildRelations}. Slice 66 admits {@code NATURAL JOIN}
     * via {@link #NATURAL_JOIN_TYPES} when catalog metadata is
     * available on both sides; the catalog-required reject fires
     * inside {@link #buildRelations}, not here.
     */
    private static void rejectUnsupportedJoinShape(TJoinItem item) {
        EJoinType jt = item.getJoinType();
        boolean isPredicate = jt != null && ALLOWED_PREDICATE_JOIN_TYPES.contains(jt);
        boolean isOnLess = jt != null && ALLOWED_ON_LESS_JOIN_TYPES.contains(jt);
        boolean isNatural = isNaturalJoinType(jt);
        boolean isLateral = isLateralJoinType(jt);
        if (!isPredicate && !isOnLess && !isNatural && !isLateral) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.UNSUPPORTED_JOIN_TYPE,
                    "join type " + jt + " is not supported yet; "
                            + "only INNER/LEFT/RIGHT/FULL [OUTER] JOIN ... ON, "
                            + "JOIN ... USING (...), CROSS JOIN, CROSS/OUTER APPLY, and "
                            + "NATURAL [INNER/LEFT/RIGHT/FULL [OUTER]] JOIN are accepted", item));
        }
        boolean hasUsing = item.getUsingColumns() != null
                && item.getUsingColumns().size() > 0;
        boolean hasOn = item.getOnCondition() != null;
        if (isLateral) {
            // CROSS/OUTER APPLY is an ON-less lateral join; the correlation
            // lives inside the right operand, never on an ON/USING clause.
            // The parser does not attach ON/USING to APPLY items, so these
            // are defensive guards (reuse the CROSS_WITH_* codes — no new
            // diagnostic code is introduced for APPLY).
            if (hasOn) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.CROSS_WITH_ON,
                        "CROSS/OUTER APPLY must not carry an ON condition; the "
                                + "correlation belongs inside the right operand", item));
            }
            if (hasUsing) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.CROSS_WITH_USING,
                        "CROSS/OUTER APPLY must not carry a USING clause; the "
                                + "correlation belongs inside the right operand", item));
            }
            return;
        }
        if (isNatural) {
            if (hasOn) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.NATURAL_WITH_ON,
                        "NATURAL JOIN must not carry an ON condition; rewrite "
                                + "as JOIN ... ON, or drop the NATURAL keyword", item));
            }
            if (hasUsing) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.NATURAL_WITH_USING,
                        "NATURAL JOIN must not carry a USING clause; choose "
                                + "either NATURAL or USING, not both", item));
            }
            return;
        }
        if (isOnLess) {
            if (hasOn) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.CROSS_WITH_ON,
                        "CROSS JOIN must not carry an ON condition; rewrite "
                                + "as INNER JOIN ... ON, or drop the ON clause", item));
            }
            if (hasUsing) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.CROSS_WITH_USING,
                        "CROSS JOIN must not carry a USING clause; rewrite "
                                + "as INNER JOIN ... USING (...) or drop USING", item));
            }
            return;
        }
        // Predicate-bearing path.
        if (hasUsing && hasOn) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.JOIN_WITH_BOTH_ON_AND_USING,
                    "JOIN cannot carry both ON and USING; choose one", item));
        }
        if (!hasUsing && !hasOn) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.JOIN_MISSING_ON_OR_USING,
                    "JOIN with no ON or USING condition is not supported yet "
                            + "(implicit joins must be explicit and supported)", item));
        }
    }

    /**
     * Slice 64 — populate {@code joinColumnRefs} for a USING-shaped
     * join item. Emits refs in <b>left-then-right</b> order per key.
     *
     * <p>Column-source resolution looks at two sources, in order:
     * <ol>
     *   <li>The catalog (via
     *       {@link NameBindingProvider#getRelationColumnNames(TTable)})
     *       for base tables;</li>
     *   <li>The slice-60 in-scope-relation-columns map (via
     *       {@link NameBindingProvider#getInScopeRelationColumns()})
     *       for CTE and FROM-subquery relations, keyed by effective
     *       alias.</li>
     * </ol>
     *
     * <p>Left side uses these two sources to narrow to the prior
     * relations that actually declare the USING key, walking
     * {@code topJoin.getTable()} then
     * {@code items[0..itemIndex-1].getTable()} in FROM order.
     *
     * <p>Right side is always {@code item.getTable()}. When either
     * source declares the right relation's columns and the USING key
     * is absent there, the build is failed-fast with a
     * non-exact-binding-style reject — matching what the resolver
     * does for plain {@code SELECT k} where {@code k} doesn't exist.
     *
     * <p>When neither source has any column info for the prior
     * relations (no catalog and no in-scope map), fall back to
     * emitting one ref for the immediately-prior relation so the
     * slice-64 admission still works without a catalog. Same
     * fallback applies to the right side (emit unconditionally).
     *
     * <p>This matches resolver2's all-chain-tables linkage
     * ({@code ScopeBuilder.preVisit(TJoinItem)}) for the cases where
     * catalog/in-scope info is missing, without adopting its
     * over-approximation when info IS available.
     */
    private static void populateUsingJoinRefs(TJoin topJoin,
                                              TJoinItemList items,
                                              int itemIndex,
                                              TTable rightTable,
                                              TObjectNameList usingCols,
                                              NameBindingProvider provider,
                                              List<ColumnRef> joinRefsOut) {
        // Slice 66: collect the SQL-written USING key spellings and
        // delegate to the shared {@link #emitMergedJoinRefs} helper
        // which serves both USING (this path) and NATURAL.
        List<String> keyNames = new ArrayList<>(usingCols.size());
        for (int k = 0; k < usingCols.size(); k++) {
            TObjectName usingKey = usingCols.getObjectName(k);
            if (usingKey == null) continue;
            String keyName = usingKey.getColumnNameOnly();
            if (keyName == null || keyName.isEmpty()) continue;
            keyNames.add(keyName);
        }
        emitMergedJoinRefs(JoinKind.USING, keyNames, topJoin, items,
                itemIndex, rightTable, provider, joinRefsOut);
    }

    /**
     * Slice 66 — discriminator for {@link #emitMergedJoinRefs}. USING
     * comes from a syntactic clause and enforces left-and-right
     * "key-must-exist" rejects; NATURAL comes from catalog inference
     * and never has a missing key by construction.
     */
    private enum JoinKind { USING, NATURAL }

    /**
     * Slice 66 — shared emit-refs helper used by USING and NATURAL.
     * Emits per-key {@code joinColumnRefs} in <b>left-then-right</b>
     * order, walking every prior FROM relation for the left side. The
     * {@code kind} discriminator controls:
     *
     * <ul>
     *   <li><b>CTE-explicit-column-list deferral</b>: applies to BOTH
     *       (the diagnostic wording mentions JOIN kind);</li>
     *   <li><b>Right-side "missing key" reject</b>: USING-only —
     *       NATURAL keys come from catalog intersection so the key
     *       must be present on the right by construction;</li>
     *   <li><b>Left-side "missing key" reject</b>: USING-only — same
     *       rationale.</li>
     * </ul>
     *
     * <p>Spelling: the caller supplies the emitted spelling (USING
     * passes the SQL-written spelling; NATURAL passes the catalog-
     * declared spelling of the first contributor — see
     * {@link #naturalSharedKeys}).
     */
    private static void emitMergedJoinRefs(JoinKind kind,
                                           List<String> keyNames,
                                           TJoin topJoin,
                                           TJoinItemList items,
                                           int itemIndex,
                                           TTable rightTable,
                                           NameBindingProvider provider,
                                           List<ColumnRef> joinRefsOut) {
        String rightAlias = effectiveAliasOf(rightTable);
        List<TTable> priorRelations = new ArrayList<>();
        if (topJoin.getTable() != null) {
            priorRelations.add(topJoin.getTable());
        }
        for (int j = 0; j < itemIndex; j++) {
            TJoinItem prevItem = items.getJoinItem(j);
            if (prevItem != null && prevItem.getTable() != null) {
                priorRelations.add(prevItem.getTable());
            }
        }
        // Slice 60 / 64 / 66 originally rejected USING / NATURAL joins
        // against a CTE with an explicit column list because the CTE
        // body's StatementGraph published inner-projection names rather
        // than the renamed list. Slice 103 lifts that rejection by
        // wiring the slice-102 rename helper into the SELECT-side CTE
        // walker; the published column list now matches the explicit
        // list, so lookupRelationColumnNames returns the renamed names
        // from the in-scope map and the merged-key emit below works.
        // `MERGED_JOIN_AGAINST_CTE_WITH_EXPLICIT_COLUMN_LIST` stays
        // declared-but-unreached (slice 71/72/82/86/95/96/97/98/99/100/
        // 101/102 precedent).
        for (String keyName : keyNames) {
            if (keyName == null || keyName.isEmpty()) continue;

            // Left side FIRST (matches ON-clause natural reading order).
            // For USING: priorRelations with metadata-unknown or
            // declared-key emit a ref; missing-key skips. If no ref
            // emitted and all priors had known info → USING-only
            // reject (NATURAL never reaches this because the catalog
            // intersection guarantees at least one contributor).
            boolean emittedAnyLeft = false;
            boolean allPriorsHadColumnInfo = true;
            for (TTable prior : priorRelations) {
                List<String> cols = lookupRelationColumnNames(prior, provider);
                if (cols == null) {
                    allPriorsHadColumnInfo = false;
                    joinRefsOut.add(new ColumnRef(
                            effectiveAliasOf(prior), keyName));
                    emittedAnyLeft = true;
                    continue;
                }
                for (String c : cols) {
                    if (c != null && c.equalsIgnoreCase(keyName)) {
                        joinRefsOut.add(new ColumnRef(
                                effectiveAliasOf(prior), keyName));
                        emittedAnyLeft = true;
                        break;
                    }
                }
            }
            if (kind == JoinKind.USING
                    && !emittedAnyLeft && allPriorsHadColumnInfo
                    && !priorRelations.isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.USING_KEY_NOT_DECLARED,
                        "USING key '" + keyName + "' is not declared on "
                                + "any left-side relation; check that the "
                                + "key exists on at least one of the "
                                + "joined-in relations", rightTable));
            }

            // Right side. USING: must exist OR catalog unknown.
            // NATURAL: by construction the key is in right's catalog.
            // For the unknown-catalog case we still emit (over-approximate).
            List<String> rightCols = lookupRelationColumnNames(rightTable, provider);
            if (rightCols == null) {
                joinRefsOut.add(new ColumnRef(rightAlias, keyName));
            } else {
                boolean rightHasKey = false;
                for (String c : rightCols) {
                    if (c != null && c.equalsIgnoreCase(keyName)) {
                        rightHasKey = true;
                        break;
                    }
                }
                if (!rightHasKey) {
                    if (kind == JoinKind.USING) {
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.USING_KEY_NOT_DECLARED,
                                "USING key '" + keyName + "' is not declared on "
                                        + "right-side relation '" + rightAlias
                                        + "'; USING requires the key to exist on "
                                        + "both sides", rightTable));
                    }
                    // NATURAL: silently skip — should be unreachable
                    // because keys come from the intersection.
                    continue;
                }
                joinRefsOut.add(new ColumnRef(rightAlias, keyName));
            }
        }
    }

    /**
     * Slice 64 — true iff the given table reference is a CTE with an
     * explicit column list (e.g. {@code WITH x(a, b) AS ...}). Slice
     * 64 originally used this to defer USING joins against such CTEs;
     * slice 103 lifted that deferral by wiring the slice-102 rename
     * helper into the SELECT-side CTE walker. The helper is retained
     * for {@link #buildUsingScope}'s ambiguity check (defense in depth)
     * and may be reused by future call sites that need to discriminate
     * the shape.
     */
    private static boolean hasExplicitCteColumnList(TTable table) {
        if (table == null) return false;
        TCTE cte = table.getCTE();
        return cte != null && cte.getColumnList() != null
                && cte.getColumnList().size() > 0;
    }

    /**
     * Slice 65 — read the renamed column names from a CTE's explicit
     * column list ({@code WITH x(a, b) AS ...}). Used by
     * {@link #buildUsingScope}'s ambiguity check as a defense-in-depth
     * complement to {@link #lookupRelationColumnNames}. Slice 65
     * originally needed this because the CTE body's StatementGraph
     * published inner-projection names; slice 103 lifted that gap by
     * applying the slice-102 rename helper on the SELECT side, so the
     * in-scope-map path now returns the renamed list too.
     */
    private static java.util.List<String> explicitCteColumnNames(TTable table) {
        if (table == null) return null;
        TCTE cte = table.getCTE();
        if (cte == null) return null;
        if (cte.getColumnList() == null || cte.getColumnList().size() == 0) {
            return null;
        }
        java.util.List<String> names = new java.util.ArrayList<>(cte.getColumnList().size());
        for (int i = 0; i < cte.getColumnList().size(); i++) {
            TObjectName col = cte.getColumnList().getObjectName(i);
            if (col == null) continue;
            String n = col.getColumnNameOnly();
            if (n == null || n.isEmpty()) continue;
            names.add(n);
        }
        return names.isEmpty() ? null : names;
    }

    /**
     * Slice 64 — look up column names for a FROM-clause relation
     * combining the slice-58 base-table catalog and the slice-60
     * in-scope CTE/subquery map. Returns {@code null} when neither
     * source has column info for the table.
     *
     * <p>The in-scope map is consulted <b>first</b>: when a CTE or
     * FROM-subquery has the same name as a base table in the catalog,
     * the scoped definition shadows the catalog (codex diff-review
     * round-2 P2 #1 — without this precedence, USING against the CTE
     * would see the catalog table's columns and reject a valid join).
     *
     * <p>Slice 103 — CTEs with an explicit column list are no longer
     * rejected upstream. The SELECT-side CTE walker now invokes the
     * slice-102 rename helper, so {@code ctePublishedColumns} carries
     * the renamed names; {@code addRelationToInScopeMap} reads from
     * that map, and this lookup returns the renamed list. (Slice 64's
     * older comment said the rename was deferred — that deferral was
     * lifted by slice 103.)
     */
    private static List<String> lookupRelationColumnNames(TTable table,
                                                          NameBindingProvider provider) {
        String key = effectiveAliasLowerCaseOrNull(table);
        if (key != null) {
            java.util.Map<String, List<String>> inScope = provider.getInScopeRelationColumns();
            if (inScope != null) {
                List<String> scoped = inScope.get(key);
                if (scoped != null) return scoped;
            }
        }
        return provider.getRelationColumnNames(table);
    }

    /**
     * True when EVERY FROM relation of {@code select} has a known column list
     * (catalog metadata via {@link NameBindingProvider#getRelationColumnNames}
     * or in-scope derived columns via {@code getInScopeRelationColumns}). Used to
     * gate the join-graph {@code COLUMN_BINDING_NON_EXACT} degrade: the degrade
     * is justified only when the FROM is catalog-less for at least one endpoint,
     * because then an unqualified column that fails to bind <em>might</em> live
     * on the unknown side and we cannot prove otherwise. When every endpoint's
     * columns are known, the resolver can adjudicate — an unqualified column
     * matching no side is a genuine error and must stay fatal.
     *
     * <p>Returns {@code false} (i.e. not fully known → degrade-eligible) for an
     * empty/absent FROM list; callers gate on {@code relations.size() >= 2}
     * first, so that branch is not reached in practice.
     */
    private static boolean fromRelationColumnsFullyKnown(TSelectSqlStatement select,
                                                         NameBindingProvider provider) {
        if (select == null) {
            return false;
        }
        gudusoft.gsqlparser.nodes.TTableList tables = select.getTables();
        if (tables == null || tables.size() == 0) {
            return false;
        }
        for (int i = 0; i < tables.size(); i++) {
            TTable t = tables.getTable(i);
            if (t == null) {
                continue;
            }
            List<String> cols = lookupRelationColumnNames(t, provider);
            if (cols == null || cols.isEmpty()) {
                return false;
            }
        }
        return true;
    }

    /**
     * Slice 66 — accumulated row type of the LEFT side of a top-level
     * {@code TJoin}. Maintained per top-level TJoin so that mixed
     * ON/CROSS/USING/NATURAL chains can be reasoned about against the
     * full visible row type (NATURAL JOIN's right operand sees every
     * column visible in the accumulated left, not just the immediate
     * prior table).
     *
     * <p>{@link #complete} flips to {@code false} when any contributor
     * along the chain has no resolvable catalog. A {@code false}
     * {@code complete} blocks subsequent NATURAL JoinItems from
     * inferring their shared-key list — they reject with a tuned
     * catalog-required diagnostic naming whichever side(s) lack
     * catalog metadata.
     */
    private static final class LeftOutputState {
        final java.util.LinkedHashMap<String, List<TTable>> columns = new java.util.LinkedHashMap<>();
        boolean complete = true;
        final List<String> missingAliases = new ArrayList<>();

        void markMissing(TTable t) {
            complete = false;
            String alias = effectiveAliasOf(t);
            if (alias != null && !alias.isEmpty()) {
                if (!missingAliases.contains(alias)) {
                    missingAliases.add(alias);
                }
            }
        }
    }

    /**
     * Slice 66 — result of {@link #naturalSharedKeys}. Either a SUCCESS
     * (with the inferred key list in left-output insertion order) or
     * one of three failure kinds:
     *
     * <ul>
     *   <li>{@code INCOMPLETE_LEFT}: at least one prior contributor on
     *       the accumulated left side had null/empty catalog;</li>
     *   <li>{@code MISSING_RIGHT}: right table has null/empty catalog;</li>
     *   <li>{@code BOTH_MISSING}: both above conditions hold.</li>
     * </ul>
     *
     * <p>Failures carry diagnostic aliases so the caller can produce
     * a side-specific reject message.
     */
    private static final class NaturalKeyResult {
        enum Kind { SUCCESS, INCOMPLETE_LEFT, MISSING_RIGHT, BOTH_MISSING }
        final Kind kind;
        final List<String> keys;
        final List<String> leftMissingAliases;
        final String rightAlias;

        private NaturalKeyResult(Kind kind, List<String> keys,
                                 List<String> leftMissingAliases,
                                 String rightAlias) {
            this.kind = kind;
            this.keys = keys;
            this.leftMissingAliases = leftMissingAliases;
            this.rightAlias = rightAlias;
        }
        static NaturalKeyResult success(List<String> keys) {
            return new NaturalKeyResult(Kind.SUCCESS, keys, null, null);
        }
        static NaturalKeyResult incompleteLeft(List<String> missing) {
            return new NaturalKeyResult(Kind.INCOMPLETE_LEFT, null, missing, null);
        }
        static NaturalKeyResult missingRight(String alias) {
            return new NaturalKeyResult(Kind.MISSING_RIGHT, null, null, alias);
        }
        static NaturalKeyResult bothMissing(List<String> missing, String alias) {
            return new NaturalKeyResult(Kind.BOTH_MISSING, null, missing, alias);
        }
    }

    /**
     * Slice 66 — seed the {@link LeftOutputState} with the top-left
     * table of a top-level TJoin. Used at the start of each TJoin walk.
     */
    private static void seedLeftOutput(LeftOutputState state, TTable t,
                                       NameBindingProvider provider) {
        if (t == null) return;
        List<String> cols = lookupRelationColumnNames(t, provider);
        if (cols == null || cols.isEmpty()) {
            state.markMissing(t);
            return;
        }
        for (String c : cols) {
            if (c == null || c.isEmpty()) continue;
            String colLC = c.toLowerCase(Locale.ROOT);
            List<TTable> contributors = state.columns.get(colLC);
            if (contributors == null) {
                contributors = new ArrayList<>();
                state.columns.put(colLC, contributors);
            }
            contributors.add(t);
        }
    }

    /**
     * Slice 66 — append the right table of an ON-shaped or CROSS
     * JoinItem into the running {@link LeftOutputState}. Each catalog
     * column is added as a new entry (or extends the contributor list
     * for an existing same-named entry). Mirrors
     * {@link #seedLeftOutput} but additive.
     */
    /**
     * Merge the row type accumulated in {@code src} (a nested joined-table
     * operand's own {@link LeftOutputState}) into {@code dst} (the enclosing
     * join's running state). Used after recursing into a parenthesized
     * {@code <joined_table>} right operand so that a NATURAL join FOLLOWING the
     * nested operand at the enclosing level sees the sub-tree's columns, while
     * the sub-tree's own inner NATURAL inference ran against a fresh state.
     */
    private static void mergeLeftOutputState(LeftOutputState dst, LeftOutputState src) {
        if (src == null) return;
        for (Map.Entry<String, List<TTable>> e : src.columns.entrySet()) {
            List<TTable> contributors = dst.columns.get(e.getKey());
            if (contributors == null) {
                contributors = new ArrayList<>();
                dst.columns.put(e.getKey(), contributors);
            }
            contributors.addAll(e.getValue());
        }
        if (!src.complete) {
            dst.complete = false;
            for (String a : src.missingAliases) {
                if (!dst.missingAliases.contains(a)) {
                    dst.missingAliases.add(a);
                }
            }
        }
    }

    private static void appendRightToLeftOutput(LeftOutputState state, TTable right,
                                                NameBindingProvider provider) {
        if (right == null) return;
        List<String> cols = lookupRelationColumnNames(right, provider);
        if (cols == null || cols.isEmpty()) {
            state.markMissing(right);
            return;
        }
        for (String c : cols) {
            if (c == null || c.isEmpty()) continue;
            String colLC = c.toLowerCase(Locale.ROOT);
            List<TTable> contributors = state.columns.get(colLC);
            if (contributors == null) {
                contributors = new ArrayList<>();
                state.columns.put(colLC, contributors);
            }
            contributors.add(right);
        }
    }

    /**
     * Slice 66 — merge the right table of a USING-shaped or
     * NATURAL-shaped JoinItem. Columns in {@code mergedKeys} are
     * appended to the existing same-named contributor list at their
     * original output position (no new slot); other columns are
     * appended as new entries (or contributed to an existing same-named
     * entry — slice-59 plain-vs-plain duplicate admit).
     */
    private static void mergeRightIntoLeftOutput(LeftOutputState state, TTable right,
                                                 NameBindingProvider provider,
                                                 List<String> mergedKeys) {
        if (right == null) return;
        java.util.Set<String> mergedKeysLC = new HashSet<>();
        if (mergedKeys != null) {
            for (String k : mergedKeys) {
                if (k != null && !k.isEmpty()) {
                    mergedKeysLC.add(k.toLowerCase(Locale.ROOT));
                }
            }
        }
        List<String> cols = lookupRelationColumnNames(right, provider);
        if (cols == null || cols.isEmpty()) {
            state.markMissing(right);
            return;
        }
        for (String c : cols) {
            if (c == null || c.isEmpty()) continue;
            String colLC = c.toLowerCase(Locale.ROOT);
            // mergedKeysLC.contains(colLC) — append to existing entry;
            // !mergedKeysLC.contains(colLC) && state.columns.containsKey(colLC)
            //   — append to existing entry (plain-vs-plain duplicate);
            // !state.columns.containsKey(colLC) — new entry.
            List<TTable> contributors = state.columns.get(colLC);
            if (contributors == null) {
                contributors = new ArrayList<>();
                state.columns.put(colLC, contributors);
            }
            contributors.add(right);
        }
    }

    /**
     * Slice 66 — infer the NATURAL JOIN shared-column list for the
     * current JoinItem. Returns one of four results per §6.1 of the
     * slice-66 plan. The shared list uses catalog-declared spelling
     * from the FIRST contributor that publishes each key (NATURAL has
     * no SQL-written key token, so the catalog form is the only
     * source of truth).
     */
    private static NaturalKeyResult naturalSharedKeys(LeftOutputState leftState,
                                                     TTable right,
                                                     NameBindingProvider provider) {
        List<String> rightCols = lookupRelationColumnNames(right, provider);
        boolean rightMissing = (rightCols == null || rightCols.isEmpty());
        if (!leftState.complete && rightMissing) {
            return NaturalKeyResult.bothMissing(leftState.missingAliases,
                    effectiveAliasOf(right));
        }
        if (!leftState.complete) {
            return NaturalKeyResult.incompleteLeft(leftState.missingAliases);
        }
        if (rightMissing) {
            return NaturalKeyResult.missingRight(effectiveAliasOf(right));
        }
        java.util.Set<String> rightLC = new HashSet<>();
        for (String c : rightCols) {
            if (c != null && !c.isEmpty()) {
                rightLC.add(c.toLowerCase(Locale.ROOT));
            }
        }
        List<String> shared = new ArrayList<>();
        for (java.util.Map.Entry<String, List<TTable>> e
                : leftState.columns.entrySet()) {
            String keyLC = e.getKey();
            if (rightLC.contains(keyLC)) {
                shared.add(firstCatalogSpelling(e.getValue(), keyLC, provider));
            }
        }
        return NaturalKeyResult.success(shared);
    }

    /**
     * Slice 66 — return the catalog-declared spelling of {@code keyLC}
     * from the first contributor in insertion order that publishes the
     * key with a non-null spelling. Defensive fallback to {@code keyLC}
     * if no contributor exposes the spelling (unreachable in practice
     * because contributors are catalogued by construction).
     */
    private static String firstCatalogSpelling(List<TTable> contributors,
                                               String keyLC,
                                               NameBindingProvider provider) {
        if (contributors != null) {
            for (TTable t : contributors) {
                List<String> cols = lookupRelationColumnNames(t, provider);
                if (cols == null) continue;
                for (String c : cols) {
                    if (c != null && c.equalsIgnoreCase(keyLC)) {
                        return c;
                    }
                }
            }
        }
        return keyLC;
    }

    /**
     * Slice 66 — diagnostic helper. Joins a list of aliases for the
     * NATURAL-required catalog reject message.
     */
    private static String formatAliasList(List<String> aliases) {
        if (aliases == null || aliases.isEmpty()) return "<none>";
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < aliases.size(); i++) {
            if (i > 0) sb.append(", ");
            sb.append("'").append(aliases.get(i)).append("'");
        }
        return sb.toString();
    }

    /**
     * Slice 66 — turn a {@link NaturalKeyResult} failure into a
     * structured diagnostic for the gated reject inside
     * {@link #buildRelations}.
     */
    private static String formatNaturalCatalogReject(NaturalKeyResult r) {
        switch (r.kind) {
            case INCOMPLETE_LEFT:
                return "NATURAL JOIN requires catalog metadata for both sides; "
                        + "left-side row type is incomplete due to uncatalogued "
                        + "relation(s) " + formatAliasList(r.leftMissingAliases)
                        + "; supply a TSQLEnv (or in-scope CTE / FROM-subquery "
                        + "body) for the missing relation(s), or rewrite as "
                        + "JOIN ... ON";
            case MISSING_RIGHT:
                return "NATURAL JOIN requires catalog metadata for both sides; "
                        + "right-side relation '" + r.rightAlias
                        + "' has no resolvable column list; supply a TSQLEnv "
                        + "(or in-scope CTE / FROM-subquery body) for this "
                        + "relation, or rewrite as JOIN ... ON";
            case BOTH_MISSING:
                return "NATURAL JOIN requires catalog metadata for both sides; "
                        + "left-side row type is incomplete due to uncatalogued "
                        + "relation(s) " + formatAliasList(r.leftMissingAliases)
                        + " and right-side relation '" + r.rightAlias
                        + "' also has no resolvable column list; supply a "
                        + "TSQLEnv for the missing relation(s), or rewrite "
                        + "as JOIN ... ON";
            default:
                return "NATURAL JOIN: unexpected result kind " + r.kind;
        }
    }

    /**
     * Slice 65 — fail fast when a JOIN ON clause references a USING
     * merged key by its bare (unqualified) name. JOIN ON requires
     * per-position scope (only relations BEFORE that JoinItem are
     * visible), which slice 65 does not yet model; the merged-key
     * collector applied by other clauses would over-include later
     * relations. Reject the shape so the slice-66+ slice can lift
     * with proper per-position scope.
     *
     * <p>This is the narrowed replacement for slice-64's
     * {@code rejectUnqualifiedUsingKeyReferences}, which scanned the
     * entire SELECT body. Slice 65 admits unqualified USING-key refs
     * in every other clause via the merged-key collector.
     *
     * <p>Qualified references (e.g. {@code a.k}, {@code b.k}) and
     * column references whose names don't match a USING key are
     * unaffected.
     */
    private static void rejectUnqualifiedMergedKeyInJoinOn(TSelectSqlStatement select,
                                                           NameBindingProvider provider) {
        if (select.joins == null) return;
        // Walk each TOP-LEVEL TJoin independently — each comma-FROM
        // group has its own scope for JOIN ON purposes (codex slice-65
        // diff-review round-4 P2 #1). Within one TJoin, walk JoinItems
        // in FROM order and track which merged keys (USING-declared OR
        // NATURAL-inferred) have been established. An ON clause is only
        // checked against keys that are ALREADY merged at that position;
        // a bare `k` in an ON before any USING(k) / NATURAL is just
        // resolver2's unqualified-binding case.
        //
        // Slice 66: NATURAL JoinItems contribute their catalog-inferred
        // key list to declaredKeysSoFar. When NATURAL would fail the
        // catalog requirement (INCOMPLETE_LEFT / MISSING_RIGHT /
        // BOTH_MISSING), the preflight silently skips recording this
        // JoinItem's keys — the gated reject in buildRelations will
        // fire with a catalog-required diagnostic and the user sees
        // that error first.
        //
        // Identity skip set: USING-clause own TObjectNames are
        // declarations not references; never matched against the
        // declaredKeysSoFar set since the preflight only walks ON
        // conditions. Kept as a defensive no-op.
        final java.util.Set<TObjectName> skip =
                java.util.Collections.newSetFromMap(
                        new java.util.IdentityHashMap<TObjectName, Boolean>());
        for (int j = 0; j < select.joins.size(); j++) {
            TJoin top = select.joins.getJoin(j);
            if (top == null) continue;
            TJoinItemList items = top.getJoinItems();
            if (items == null) continue;
            // Reset per top-level TJoin so independent comma-FROM
            // groups don't poison each other's ON clauses.
            final java.util.Set<String> declaredKeysSoFar = new java.util.HashSet<>();
            LeftOutputState leftState = new LeftOutputState();
            seedLeftOutput(leftState, top.getTable(), provider);
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                // Check ON FIRST (uses scope BEFORE this JoinItem), then
                // record this JoinItem's USING/NATURAL declarations so
                // future siblings see them.
                TExpression onCond = item.getOnCondition();
                if (onCond != null && !declaredKeysSoFar.isEmpty()) {
                    final java.util.Set<String> alreadyDeclared =
                            new java.util.HashSet<>(declaredKeysSoFar);
                    onCond.acceptChildren(new TParseTreeVisitor() {
                        int nestedSelectDepth = 0;

                        @Override
                        public void preVisit(TSelectSqlStatement nested) {
                            nestedSelectDepth++;
                        }

                        @Override
                        public void postVisit(TSelectSqlStatement nested) {
                            nestedSelectDepth--;
                        }

                        @Override
                        public void preVisit(TObjectName node) {
                            if (nestedSelectDepth > 0) return;
                            if (skip.contains(node)) return;
                            if (node.getDbObjectType() != EDbObjectType.column) return;
                            String name = node.getColumnNameOnly();
                            if (name == null || name.isEmpty() || "*".equals(name)) return;
                            if (!alreadyDeclared.contains(name.toLowerCase(Locale.ROOT))) return;
                            String qualifier = node.getTableString();
                            if (qualifier == null || qualifier.isEmpty()) {
                                throw new SemanticIRBuildException(
                                        Diagnostic.error(DiagnosticCode.UNQUALIFIED_MERGED_KEY_IN_JOIN_ON,
                                        "unqualified reference to merged key '"
                                                + name + "' inside a JOIN ON condition "
                                                + "is deferred to a future slice "
                                                + "(per-position scope semantics needed); "
                                                + "qualify with a table alias "
                                                + "(e.g. a." + name + ") to disambiguate", null));
                            }
                        }
                    });
                }
                // Record this JoinItem's contribution to declaredKeysSoFar
                // and update leftState for NATURAL's accumulated-left
                // semantics.
                TTable rightTable = item.getTable();
                TObjectNameList usingCols = item.getUsingColumns();
                if (usingCols != null && usingCols.size() > 0) {
                    List<String> usingKeyNames = new ArrayList<>(usingCols.size());
                    for (int k = 0; k < usingCols.size(); k++) {
                        TObjectName n = usingCols.getObjectName(k);
                        if (n == null) continue;
                        skip.add(n);
                        String name = n.getColumnNameOnly();
                        if (name != null && !name.isEmpty()) {
                            declaredKeysSoFar.add(name.toLowerCase(Locale.ROOT));
                            usingKeyNames.add(name);
                        }
                    }
                    if (rightTable != null) {
                        mergeRightIntoLeftOutput(leftState, rightTable, provider, usingKeyNames);
                    }
                } else if (isNaturalJoinType(item.getJoinType()) && rightTable != null) {
                    NaturalKeyResult r = naturalSharedKeys(leftState, rightTable, provider);
                    if (r.kind == NaturalKeyResult.Kind.SUCCESS) {
                        for (String s : r.keys) {
                            if (s != null && !s.isEmpty()) {
                                declaredKeysSoFar.add(s.toLowerCase(Locale.ROOT));
                            }
                        }
                        mergeRightIntoLeftOutput(leftState, rightTable, provider, r.keys);
                    } else {
                        // Catalog-required reject fires upstream in
                        // buildRelations. Defensively append for state
                        // consistency.
                        appendRightToLeftOutput(leftState, rightTable, provider);
                    }
                } else if (rightTable != null) {
                    appendRightToLeftOutput(leftState, rightTable, provider);
                }
            }
        }
    }

    /**
     * Slice 65 — compute the {@link UsingScope} for the current SELECT
     * body from its FROM-clause USING joins. Walks every {@link TJoin}
     * in {@code select.joins} and for each USING(k) JoinItem, builds
     * the per-key equivalence class via DSU-like union over prior
     * relations + the right-side relation. Then materializes each
     * class by a separate FROM-order pass with identity dedup so
     * chained USING joins (`a JOIN b USING(k) JOIN c USING(k)`)
     * produce {@code [a, b, c]}, never duplicates.
     *
     * <p>For each class, builds a {@link UsingScope.MergedKeyEntry}
     * with FROM-ordered merged source refs (one per relation that
     * publishes the key per catalog / in-scope map; unknown-metadata
     * priors emit refs unconditionally, matching slice-64's over-
     * approximation policy in {@link #populateUsingJoinRefs}).
     *
     * <p>Ambiguity is precomputed:
     * <ul>
     *   <li>{@code entries.size() > 1}: two disconnected USING classes
     *       share the same key name.</li>
     *   <li>{@code entries.size() == 1} AND a FROM relation outside
     *       the class has catalog metadata that declares the key:
     *       out-of-class same-named column.</li>
     * </ul>
     *
     * <p>Returns {@link UsingScope#EMPTY} when no USING clauses are
     * present in {@code select.joins}.
     */
    private static UsingScope buildUsingScope(TSelectSqlStatement select,
                                              NameBindingProvider provider) {
        if (select.joins == null) return UsingScope.EMPTY;
        // Slice 86 — delegate to the shared TJoinList-taking helper so
        // joined UPDATE (slice 86 buildUpdateUsingScope) can reuse the
        // identical scope-build pipeline.
        return buildUsingScopeFromJoinList(select.joins, provider);
    }

    /**
     * Slice 86 — compute the {@link UsingScope} for a joined UPDATE's
     * FROM clause via {@code update.getJoins()}. Mirrors slice-65
     * {@link #buildUsingScope}: USING / NATURAL JoinItems contribute
     * merged-key equivalence classes; unqualified merged-key references
     * in SET RHS / WHERE / RETURNING resolve to the merged source list.
     *
     * <p>Returns {@link UsingScope#EMPTY} when no USING/NATURAL JoinItems
     * appear in the FROM clause.
     */
    private static UsingScope buildUpdateUsingScope(TUpdateSqlStatement update,
                                                    NameBindingProvider provider) {
        if (update == null) return UsingScope.EMPTY;
        return buildUsingScopeFromJoinList(update.getJoins(), provider);
    }

    /**
     * Slice 86 — shared {@link UsingScope} computation extracted from
     * slice-65 {@link #buildUsingScope}. Takes the {@link TJoinList}
     * directly so it can be invoked from both SELECT
     * ({@link #buildUsingScope}) and joined UPDATE
     * ({@link #buildUpdateUsingScope}).
     *
     * <p>Behavior identical to slice 65/66: per-key DSU union over prior
     * relations + right-side relation per top-level {@link TJoin};
     * disconnected comma-FROM groups keep their own per-key components;
     * NATURAL JoinItems infer shared keys against accumulated left row
     * type via {@link LeftOutputState}; ambiguity detection walks all
     * FROM relations for out-of-class same-named columns.
     */
    private static UsingScope buildUsingScopeFromJoinList(TJoinList joins,
                                                          NameBindingProvider provider) {
        if (joins == null) return UsingScope.EMPTY;
        // Pass 1: per-key DSU. For each USING(k) or NATURAL JoinItem,
        // union the prior relations PUBLISHING the key (catalog-narrowed
        // per codex slice-66 round-1 P1 #1) with the right-side relation,
        // scoped to the enclosing top-level TJoin (chained merges within
        // one TJoin transitively connect through DSU). Disconnected
        // top-level TJoins (comma-FROM) keep their own per-key components.
        // Slice 66 maintains a LeftOutputState alongside the loop so
        // NATURAL JoinItems can infer their shared-key list against the
        // accumulated left row type.
        java.util.Map<String, java.util.List<java.util.List<TTable>>> perKeyComponents =
                new java.util.LinkedHashMap<>();
        // Track the SQL-written spelling of each merged key (the first
        // occurrence in FROM order). For USING keys this is the
        // SQL-written USING-clause case (slice-64 contract); for
        // NATURAL keys this is the catalog-declared spelling from the
        // first contributor.
        java.util.Map<String, String> originalSpellingByKey = new java.util.HashMap<>();
        // Catalog-less NATURAL JOIN degrade: ordered (FROM-order) list of
        // left-side relation aliases for NATURAL joins whose shared-key set
        // could not be computed. Lets unqualified references to a merged
        // NATURAL key resolve deterministically to the left side instead of
        // failing as COLUMN_BINDING_NON_EXACT (GSP R6 degrade-not-fail).
        java.util.List<String> naturalDegradeAliases = new java.util.ArrayList<>();
        // The degrade only applies when the FROM is PURELY NATURAL-connected —
        // a single top-level TJoin whose every join item is NATURAL. A mixed
        // FROM (plain ON/CROSS/USING item, or a comma-separated second TJoin)
        // introduces an independent relation, so an unqualified reference there
        // is genuinely ambiguous and MUST still reject (doc §5.3: "do not apply
        // this special-case rule to non-NATURAL joins"). Cleared below if any
        // non-NATURAL linkage is seen.
        boolean pureNatural = (joins.size() == 1);
        for (int jx = 0; jx < joins.size(); jx++) {
            TJoin top = joins.getJoin(jx);
            if (top == null) continue;
            TJoinItemList items = top.getJoinItems();
            if (items == null) continue;
            TTable topTable = top.getTable();
            // Slice 66: per-TJoin LeftOutputState for NATURAL inference.
            LeftOutputState leftState = new LeftOutputState();
            seedLeftOutput(leftState, topTable, provider);
            // Per-key in-progress chain for THIS top-level TJoin.
            java.util.Map<String, java.util.List<TTable>> inProgressByKey =
                    new java.util.HashMap<>();
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                TTable rightTable = item.getTable();
                if (rightTable == null) continue;

                // Determine merged keys for this JoinItem and the
                // emitted spelling per key. Three cases:
                //   USING:   keys = syntactic usingCols; spelling = USING-clause text.
                //   NATURAL: keys = catalog intersection (when SUCCESS);
                //            spelling = catalog spelling.
                //   ON/CROSS/other: skip — append to leftState only.
                List<String> keyNames;
                java.util.Map<String, String> spellingByKeyLC = new java.util.HashMap<>();
                TObjectNameList usingCols = item.getUsingColumns();
                if (usingCols != null && usingCols.size() > 0) {
                    // USING introduces an explicit (non-NATURAL) merge — the
                    // FROM is no longer purely NATURAL, so disable the degrade.
                    pureNatural = false;
                    keyNames = new java.util.ArrayList<>(usingCols.size());
                    for (int k = 0; k < usingCols.size(); k++) {
                        TObjectName keyNode = usingCols.getObjectName(k);
                        if (keyNode == null) continue;
                        String keyName = keyNode.getColumnNameOnly();
                        if (keyName == null || keyName.isEmpty()) continue;
                        keyNames.add(keyName);
                        spellingByKeyLC.put(keyName.toLowerCase(Locale.ROOT), keyName);
                    }
                } else if (isNaturalJoinType(item.getJoinType())) {
                    NaturalKeyResult r = naturalSharedKeys(leftState, rightTable, provider);
                    if (r.kind != NaturalKeyResult.Kind.SUCCESS) {
                        // Catalog-required reject already fired (or will
                        // fire) inside buildRelations. Defensively skip
                        // this JoinItem in the scope build; it does NOT
                        // contribute to the merged-key scope. Record the
                        // left-side relation so unqualified references to a
                        // merged NATURAL key degrade rather than reject.
                        String leftAlias = effectiveAliasOf(topTable);
                        if (leftAlias != null && !leftAlias.isEmpty()
                                && !naturalDegradeAliases.contains(leftAlias)) {
                            naturalDegradeAliases.add(leftAlias);
                        }
                        appendRightToLeftOutput(leftState, rightTable, provider);
                        continue;
                    }
                    keyNames = r.keys;
                    for (String s : keyNames) {
                        if (s != null && !s.isEmpty()) {
                            spellingByKeyLC.put(s.toLowerCase(Locale.ROOT), s);
                        }
                    }
                } else {
                    // ON / CROSS / other — no merged-key contribution. This
                    // join item introduces an independent relation, so an
                    // unqualified reference is genuinely ambiguous: disable the
                    // NATURAL degrade for the whole FROM.
                    pureNatural = false;
                    appendRightToLeftOutput(leftState, rightTable, provider);
                    continue;
                }

                // Prior relations for this JoinItem in FROM order:
                // topTable + items[0..i-1].getTable().
                java.util.List<TTable> priorRelations = new java.util.ArrayList<>();
                if (topTable != null) priorRelations.add(topTable);
                for (int p = 0; p < i; p++) {
                    TJoinItem prev = items.getJoinItem(p);
                    if (prev != null && prev.getTable() != null) {
                        priorRelations.add(prev.getTable());
                    }
                }
                for (String keyName : keyNames) {
                    if (keyName == null || keyName.isEmpty()) continue;
                    String keyLC = keyName.toLowerCase(Locale.ROOT);
                    // Record the first emitted spelling we see for this
                    // key. USING uses SQL-written spelling; NATURAL uses
                    // catalog-declared spelling.
                    if (!originalSpellingByKey.containsKey(keyLC)) {
                        originalSpellingByKey.put(keyLC, spellingByKeyLC.get(keyLC));
                    }
                    java.util.List<TTable> chain = inProgressByKey.get(keyLC);
                    if (chain == null) {
                        chain = new java.util.ArrayList<>();
                        inProgressByKey.put(keyLC, chain);
                    }
                    // Slice 66 catalog-narrowed union (codex round-1 P1 #1):
                    // for each prior relation, include in this key's
                    // equivalence class only if (a) catalog is unknown
                    // (over-approximate; slice-64 fallback), or (b)
                    // catalog declares the key. Skip if catalog is
                    // known and the key is proven absent.
                    for (TTable prior : priorRelations) {
                        if (containsByIdentity(chain, prior)) continue;
                        List<String> priorCols = lookupRelationColumnNames(prior, provider);
                        if (priorCols == null) {
                            chain.add(prior);
                            continue;
                        }
                        boolean priorPublishes = false;
                        for (String pc : priorCols) {
                            if (pc != null && pc.equalsIgnoreCase(keyLC)) {
                                priorPublishes = true;
                                break;
                            }
                        }
                        if (priorPublishes) {
                            chain.add(prior);
                        }
                    }
                    if (!containsByIdentity(chain, rightTable)) {
                        chain.add(rightTable);
                    }
                }
                // After the merged-key bookkeeping, merge right into
                // the leftState so subsequent NATURAL JoinItems see
                // the accumulated row type.
                mergeRightIntoLeftOutput(leftState, rightTable, provider, keyNames);
            }
            // Flush this TJoin's in-progress chains as one component
            // per key.
            for (java.util.Map.Entry<String, java.util.List<TTable>> e :
                    inProgressByKey.entrySet()) {
                java.util.List<java.util.List<TTable>> bucket = perKeyComponents.get(e.getKey());
                if (bucket == null) {
                    bucket = new java.util.ArrayList<>();
                    perKeyComponents.put(e.getKey(), bucket);
                }
                bucket.add(e.getValue());
            }
        }
        // Mixed FROM (any non-NATURAL linkage seen): drop the degrade fallback
        // so genuinely-ambiguous unqualified references still reject.
        if (!pureNatural) {
            naturalDegradeAliases.clear();
        }
        if (perKeyComponents.isEmpty()) {
            // No merged-key scope, but a catalog-less NATURAL JOIN may still
            // need the degrade fallback for unqualified merged-key refs.
            return naturalDegradeAliases.isEmpty()
                    ? UsingScope.EMPTY
                    : new UsingScope(
                            java.util.Collections.<String, java.util.List<UsingScope.MergedKeyEntry>>emptyMap(),
                            java.util.Collections.<String, String>emptyMap(),
                            naturalDegradeAliases);
        }
        // Pass 2: materialize EquivalenceClass + MergedKeyEntry per
        // component. FROM-order is already preserved by Pass 1's
        // accumulation order (priorRelations + rightTable).
        java.util.Map<String, java.util.List<UsingScope.MergedKeyEntry>> entriesByName =
                new java.util.LinkedHashMap<>();
        for (java.util.Map.Entry<String, java.util.List<java.util.List<TTable>>> e :
                perKeyComponents.entrySet()) {
            String keyLC = e.getKey();
            // ColumnRef-emit spelling: SQL-written USING-clause spelling
            // (matches slice-64 populateUsingJoinRefs). Falls back to
            // keyLC if no spelling was recorded (defensive).
            String emitKeyName = originalSpellingByKey.containsKey(keyLC)
                    ? originalSpellingByKey.get(keyLC)
                    : keyLC;
            java.util.List<UsingScope.MergedKeyEntry> entries = new java.util.ArrayList<>();
            for (java.util.List<TTable> componentMembers : e.getValue()) {
                if (componentMembers.isEmpty()) continue;
                UsingScope.EquivalenceClass cls = new UsingScope.EquivalenceClass(
                        keyLC, componentMembers);
                java.util.List<ColumnRef> sources = new java.util.ArrayList<>();
                java.util.Set<String> seenAliases = new java.util.HashSet<>();
                for (TTable t : componentMembers) {
                    String effAlias = effectiveAliasOf(t);
                    if (effAlias == null || effAlias.isEmpty()) continue;
                    String aliasKey = effAlias.toLowerCase(Locale.ROOT);
                    if (seenAliases.contains(aliasKey)) continue;
                    java.util.List<String> cols = lookupRelationColumnNames(t, provider);
                    if (cols == null) {
                        // Metadata-unknown: emit ref (over-approximate).
                        sources.add(new ColumnRef(effAlias, emitKeyName));
                        seenAliases.add(aliasKey);
                        continue;
                    }
                    for (String c : cols) {
                        if (c != null && c.equalsIgnoreCase(keyLC)) {
                            sources.add(new ColumnRef(effAlias, emitKeyName));
                            seenAliases.add(aliasKey);
                            break;
                        }
                    }
                }
                if (!sources.isEmpty()) {
                    entries.add(new UsingScope.MergedKeyEntry(cls, sources));
                }
            }
            if (!entries.isEmpty()) {
                entriesByName.put(keyLC, entries);
            }
        }
        if (entriesByName.isEmpty()) {
            return naturalDegradeAliases.isEmpty()
                    ? UsingScope.EMPTY
                    : new UsingScope(
                            java.util.Collections.<String, java.util.List<UsingScope.MergedKeyEntry>>emptyMap(),
                            java.util.Collections.<String, String>emptyMap(),
                            naturalDegradeAliases);
        }
        // Pass 3: precompute ambiguity per key.
        java.util.Map<String, String> ambiguityByName = new java.util.HashMap<>();
        java.util.List<TTable> allFromRelations = walkAllFromRelationsFromJoinList(joins);
        for (java.util.Map.Entry<String, java.util.List<UsingScope.MergedKeyEntry>> e :
                entriesByName.entrySet()) {
            String keyLC = e.getKey();
            java.util.List<UsingScope.MergedKeyEntry> entries = e.getValue();
            if (entries.size() > 1) {
                ambiguityByName.put(keyLC,
                        "multiple disconnected USING(" + keyLC + ") equivalence "
                                + "classes appear in this FROM (their merged "
                                + "columns share the same key name)");
                continue;
            }
            // Single class. Walk all FROM relations; if any out-of-class
            // relation is catalog-known to publish the key, mark ambiguous.
            UsingScope.EquivalenceClass cls = entries.get(0).getEquivClass();
            java.util.IdentityHashMap<TTable, Boolean> inClass = new java.util.IdentityHashMap<>();
            for (TTable m : cls.getMembers()) inClass.put(m, Boolean.TRUE);
            for (TTable r : allFromRelations) {
                if (inClass.containsKey(r)) continue;
                // Slice 65 diff-review round-3 P2 #2 (slice 103 update):
                // post-slice-103 both branches return the same data —
                // `lookupRelationColumnNames` consults the in-scope map
                // populated from `ctePublishedColumns`, which now holds
                // the renamed names. The discriminator is retained as a
                // defense-in-depth path for any call site that bypasses
                // the SELECT-side CTE walker but still wants to detect
                // renamed-key collisions; the slice-103 path falls into
                // the `lookupRelationColumnNames` branch and gets the
                // same renamed list.
                java.util.List<String> cols;
                if (hasExplicitCteColumnList(r)) {
                    cols = explicitCteColumnNames(r);
                } else {
                    cols = lookupRelationColumnNames(r, provider);
                }
                if (cols == null) continue;          // unknown → trust writer
                for (String c : cols) {
                    if (c != null && c.equalsIgnoreCase(keyLC)) {
                        String outAlias = effectiveAliasOf(r);
                        ambiguityByName.put(keyLC,
                                "the USING(" + keyLC + ") merged column collides "
                                        + "with column '" + keyLC + "' on relation '"
                                        + (outAlias != null ? outAlias : "<unnamed>")
                                        + "' which is not part of the USING equivalence class");
                        break;
                    }
                }
                if (ambiguityByName.containsKey(keyLC)) break;
            }
        }
        return new UsingScope(entriesByName, ambiguityByName, naturalDegradeAliases);
    }

    private static boolean containsByIdentity(java.util.List<TTable> list, TTable t) {
        for (TTable x : list) {
            if (x == t) return true;
        }
        return false;
    }

    /**
     * Slice 65 — every FROM-clause relation reachable directly from
     * {@code select.joins} (every {@code top.getTable()} + every
     * {@code joinItem.getTable()}). Used by {@link #buildUsingScope}
     * to detect out-of-equivalence-class same-named columns.
     */
    private static java.util.List<TTable> walkAllFromRelations(TSelectSqlStatement select) {
        if (select == null) return new java.util.ArrayList<>();
        return walkAllFromRelationsFromJoinList(select.joins);
    }

    /**
     * Slice 86 — shared {@link TJoinList}-taking walker for ambiguity
     * detection inside {@link #buildUsingScopeFromJoinList}. Used by both
     * SELECT ({@link #walkAllFromRelations}) and joined UPDATE
     * ({@link #buildUpdateUsingScope}).
     */
    private static java.util.List<TTable> walkAllFromRelationsFromJoinList(TJoinList joins) {
        java.util.List<TTable> out = new java.util.ArrayList<>();
        if (joins == null) return out;
        for (int j = 0; j < joins.size(); j++) {
            TJoin top = joins.getJoin(j);
            if (top == null) continue;
            if (top.getTable() != null) out.add(top.getTable());
            TJoinItemList items = top.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item != null && item.getTable() != null) {
                    out.add(item.getTable());
                }
            }
        }
        return out;
    }

    /**
     * Slice 64 — true iff any TJoinItem in {@code select.joins}
     * carries a non-empty USING list. Used by {@link #tryExpandStar}
     * to defer bare {@code *} over USING JOIN to S65 (merged-key
     * output naming).
     */
    private static boolean hasUsingInFromClause(TSelectSqlStatement select) {
        if (select.joins == null) return false;
        for (int j = 0; j < select.joins.size(); j++) {
            TJoin top = select.joins.getJoin(j);
            if (top == null) continue;
            TJoinItemList items = top.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item != null
                        && item.getUsingColumns() != null
                        && item.getUsingColumns().size() > 0) {
                    return true;
                }
            }
        }
        return false;
    }

    /**
     * Slice 66 — true iff any JoinItem is NATURAL AND its inferred
     * shared-column list is non-empty (catalog-resolved on both sides
     * and the intersection contains at least one column).
     *
     * <p>Routes bare {@code *} expansion through
     * {@link #expandBareStarOverUsing} when NATURAL contributes merged
     * keys. NATURAL with empty intersection or with INCOMPLETE_LEFT /
     * MISSING_RIGHT / BOTH_MISSING returns false for THIS JoinItem
     * (codex slice-66 round-4 P2 #3) — the bare-* path then falls
     * through to per-relation expansion, which is correct for an
     * empty-intersection NATURAL (Cartesian, no dedup needed). The
     * catalog-required reject for NATURAL fires upstream inside
     * {@link #buildRelations} before bare-* runs.
     *
     * <p>The walk maintains its own per-top-level-TJoin
     * {@link LeftOutputState} (so NATURAL inference against accumulated
     * left works the same way as in {@link #buildUsingScope} and
     * {@link #buildRelations}).
     */
    private static boolean hasNaturalJoinMergedKeysInFromClause(
            TSelectSqlStatement select, NameBindingProvider provider) {
        if (select.joins == null) return false;
        for (int j = 0; j < select.joins.size(); j++) {
            TJoin top = select.joins.getJoin(j);
            if (top == null) continue;
            TJoinItemList items = top.getJoinItems();
            if (items == null) continue;
            LeftOutputState leftState = new LeftOutputState();
            seedLeftOutput(leftState, top.getTable(), provider);
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                TTable rightTable = item.getTable();
                if (rightTable == null) continue;
                if (isNaturalJoinType(item.getJoinType())) {
                    NaturalKeyResult r = naturalSharedKeys(leftState, rightTable, provider);
                    if (r.kind == NaturalKeyResult.Kind.SUCCESS
                            && r.keys != null && !r.keys.isEmpty()) {
                        return true;
                    }
                    appendRightToLeftOutput(leftState, rightTable, provider);
                    continue;
                }
                TObjectNameList usingCols = item.getUsingColumns();
                if (usingCols != null && usingCols.size() > 0) {
                    List<String> usingKeyNames = new ArrayList<>(usingCols.size());
                    for (int k = 0; k < usingCols.size(); k++) {
                        TObjectName usingKey = usingCols.getObjectName(k);
                        if (usingKey == null) continue;
                        String keyName = usingKey.getColumnNameOnly();
                        if (keyName != null && !keyName.isEmpty()) {
                            usingKeyNames.add(keyName);
                        }
                    }
                    mergeRightIntoLeftOutput(leftState, rightTable, provider, usingKeyNames);
                } else {
                    appendRightToLeftOutput(leftState, rightTable, provider);
                }
            }
        }
        return false;
    }

    /**
     * Two relations sharing the same effective alias would make
     * {@link ColumnRef#getRelationAlias()} ambiguous in the IR. Resolver2
     * may already flag column references in this case, but the IR-level
     * invariant still needs to hold.
     */
    /**
     * Reject two FROM relations whose aliases are the SAME NAME under the
     * vendor's identifier rules — they would make every {@link ColumnRef}
     * qualified by that alias ambiguous.
     *
     * <p>Slice 182 (GitHub #707, codex round-1 P2): this compared raw strings
     * with {@code HashSet<String>.add}, so it only caught a byte-identical
     * repeat. Oracle {@code FROM employees A1, departments a1} is ONE alias
     * under Oracle's case-folding rules but two distinct strings, and it built
     * a StatementGraph with two same-named relations. The outer / CTE-body /
     * FROM-subquery-body paths were shielded by
     * {@link #preflightDirectFromList}, which folds with
     * {@code toLowerCase(Locale.ROOT)}; the synthetic body contexts never call
     * that preflight, so the miss was reachable there — already via
     * {@code JOIN … ON}, and (before this fix) newly via comma FROM as well.
     *
     * <p>Keyed by {@link SQLUtil#canonKey} per the repo's one-canonical-equality
     * rule, which is also stricter than the preflight's naive fold in the right
     * direction: a delimited {@code "a1"} stays distinct from an unquoted
     * {@code a1} on a case-folding vendor, because quote state is part of a
     * name's identity. Keyed as {@code dotTable} because a relation alias lives
     * in the table namespace — the same object type every resolver2 / dlineage
     * alias comparison already uses.
     *
     * <p>SECOND CONDITION, APPLIED ONLY TO A COMMA FROM LIST — the
     * comma-promotion collision guard (codex round-2 P2, narrowed after codex
     * round-3 P2). Two aliases that canonical equality calls DISTINCT can still
     * collapse in the comma-join promotion, which keys aliases by
     * {@code toLowerCase(Locale.ROOT)} in {@code collectConjunctRelationAliases}
     * and {@code endpointAliasesLowerCase}. Oracle
     * {@code FROM employees "A1", departments "a1"} is two legitimately distinct
     * names that fold to one key, and the measured result was a SILENT WRONG
     * ANSWER: the graph came back {@code IMPLICIT_CROSS} with no conditions,
     * because the WHERE predicate was never seen as spanning two sides and so
     * was never promoted, while the {@code JOIN … ON} spelling of the same
     * query correctly returned {@code INNER}.
     *
     * <p>Gated on {@code fromUsesCommaList} because the promotion is the ONLY
     * consumer that turns this collision into a wrong answer on a path this
     * slice opened. Round 3 supplied the counterexample that forced the gate:
     * {@code EXISTS (SELECT 1 FROM employees "A1" JOIN departments "a1" ON 1=1)}
     * was analyzed CORRECTLY before this slice (two relations, INNER/EXPLICIT) —
     * {@code emitLineageForStatement}'s alias map does overwrite an entry, but a
     * source-free output never consults it — so an ungated reject deleted a
     * correct result, which this repo forbids outright.
     *
     * <p>The gate makes the guard non-regressing BY CONSTRUCTION: a comma FROM
     * inside a body context did not analyze at all before this slice, and on the
     * outer / CTE-body / FROM-subquery-body paths the same pair is already
     * refused by {@code preflightOneTable}'s own lowercase fold. So no shape
     * that previously produced a correct graph stops producing one.
     *
     * <p>FOLLOW-UP, out of scope for #707: key the promotion (and the lineage
     * alias map, whose last-write-wins overwrite is a pre-existing latent bug
     * reachable only when a colliding alias feeds a sourced output) by canonical
     * identity, then drop this second condition and the fold in
     * {@code preflightOneTable}. Piecemeal is unsafe — loosening a guard before
     * its consumers are collision-safe turns a visible rejection into a silent
     * overwrite.
     */
    private static void rejectDuplicateAliases(List<RelationSource> relations,
                                               EDbVendor vendor,
                                               boolean fromUsesCommaList) {
        Set<Object> seenCanonical = new HashSet<>();
        Set<String> seenPromotionKey = new HashSet<>();
        for (RelationSource r : relations) {
            String alias = r.getAlias();
            Object canonical = (alias == null)
                    ? null
                    : SQLUtil.canonKey(vendor, ESQLDataObjectType.dotTable, alias);
            if (!seenCanonical.add(canonical)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DUPLICATE_RELATION_ALIAS,
                        "duplicate relation alias '" + alias
                                + "' is not supported (would make ColumnRef ambiguous)", null));
            }
            // Distinct names that still collide in the comma-join promotion's
            // lowercased alias sets — see the javadoc. Rejected rather than
            // analyzed, because analyzing publishes IMPLICIT_CROSS for what is
            // really an INNER join, with nothing to flag it. Only the comma
            // form reaches that promotion, so only the comma form is gated.
            if (!fromUsesCommaList) continue;
            String promotionKey = (alias == null)
                    ? null
                    : alias.toLowerCase(Locale.ROOT);
            if (!seenPromotionKey.add(promotionKey)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.DUPLICATE_RELATION_ALIAS,
                        "relation aliases '" + alias + "' and an earlier alias differ only "
                                + "in letter case; they are distinct names for this vendor, "
                                + "but a comma-separated FROM list with such a pair cannot "
                                + "yet be analyzed (the join-condition promotion would "
                                + "collide them and report a cross join). Rename one of "
                                + "them, or use an explicit JOIN ... ON", null));
            }
        }
    }

    private static RelationSource buildRelation(TTable table, NameBindingProvider provider,
                                                boolean allowFromSubqueries) {
        return buildRelation(table, provider, allowFromSubqueries,
                RelationSource.NO_INSTANCE_ID);
    }

    private static RelationSource buildRelation(TTable table, NameBindingProvider provider,
                                                boolean allowFromSubqueries, int instanceId) {
        // Reject FROM-subqueries when the caller did not extract them as
        // separate statements. After slice 18 the still-uncovered scopes
        // are scalar bodies (slice-11 boundary), set-op branches (slice-16
        // boundary), and set-op CTE bodies (build()'s set-op CTE dispatch
        // passes allowFromSubqueries=false to each branch).
        if (table.getTableType() == gudusoft.gsqlparser.ETableSource.subquery
                && !allowFromSubqueries) {
            // Slice 74: use effectiveAliasOf so anonymous subqueries
            // surface their synth name in the diagnostic instead of the
            // empty-string the prior `getAliasName() == null` ternary
            // produced.
            String bodyAlias = effectiveAliasOf(table);
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.FROM_SUBQUERY_IN_BODY_CONTEXT_NOT_SUPPORTED,
                    "FROM-clause subquery '" + (bodyAlias == null || bodyAlias.isEmpty() ? "<anonymous>" : bodyAlias)
                            + "' inside a scalar body, set-op branch, or set-op CTE body is not supported yet", table));
        }
        RelationBinding binding = provider.bindRelation(table);
        if (binding == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.TABLE_BINDING_UNRESOLVED,
                    "could not bind table " + safeName(table) + " (only base tables and in-scope CTEs are supported)", table));
        }
        // Effective alias: prefer the SQL-written alias, then the slice-74
        // synthetic alias for anonymous FROM-subqueries, then the table
        // name (mirrors effectiveAliasOf so RelationSource.alias and
        // ColumnRef.relationAlias stay aligned).
        String alias = effectiveAliasOf(table);
        // Slice 164 (S3): attach the FROM-clause table-reference span
        // (includes alias, e.g. "t1 a"). Null-safe via SourceSpan.of.
        // Slice 179 (R4): carry the stable FROM-order instanceId.
        return new RelationSource(alias, binding, SourceSpan.of(table), instanceId);
    }

    private static String safeName(TTable t) {
        try {
            return t.getName();
        } catch (RuntimeException e) {
            return "<unnamed>";
        }
    }

    // -----------------------------------------------------------------
    // Slice 167 (join-analysis S6) — ordered, chain-correct structured
    // JoinGraph (GAP 1). Walks the same TJoinList the flat join refs come
    // from, but stops flattening: each TJoinItem becomes a JoinEntity, and
    // comma-separated top-level TJoins become IMPLICIT_CROSS entities.
    //
    // Left-deep chaining: the right endpoint is always the newly added
    // RELATION; the left endpoint is the first RELATION for join order 0,
    // else the JOIN_RESULT accumulated by the prior join. No predicate
    // decomposition here (that is slice 168). The flat joinColumnRefs are
    // untouched.
    // -----------------------------------------------------------------
    /**
     * R8 — append predicate-derived semi-join entities to a FROM-clause
     * {@link JoinGraph}. Each {@link SemiJoinFact} becomes a
     * {@link SemanticJoinType#SEMI} / {@link SemanticJoinType#ANTI_SEMI}
     * {@link JoinEntity} whose left endpoint is the outer relation owning
     * the correlated outer column (resolved from {@code relations} by
     * alias; falls back to the first FROM relation) and whose right
     * endpoint is the lifted subquery's {@link JoinEndpointKind#SUBQUERY}
     * block. Orders continue after the FROM joins. Returns the input graph
     * unchanged when there are no facts.
     */
    private static JoinGraph appendSemiJoins(JoinGraph base,
                                             List<SemiJoinFact> semiFacts,
                                             List<RelationSource> relations) {
        if (semiFacts == null || semiFacts.isEmpty()) {
            return base;
        }
        List<JoinEntity> joins = new ArrayList<>(base.getJoins());
        int order = joins.size();
        for (SemiJoinFact f : semiFacts) {
            JoinEndpoint left = f.outerAnchorUnknown
                    ? unknownOuterEndpointFor(relations, joins, order)
                    : outerEndpointFor(f.outerAliases, relations, joins);
            if (left == null) {
                // No FROM relation to anchor the outer side — skip rather
                // than fabricate an endpoint (honest omission).
                continue;
            }
            JoinEndpoint right = JoinEndpoint.subquery(f.innerStatementIndex, f.innerLabel);
            joins.add(new JoinEntity(f.polarity, left, right, order++,
                    JoinSourceSyntax.SEMI, /*natural=*/ false,
                    /*usingColumns=*/ null, f.conditions, f.span,
                    f.conditionText, /*lateral=*/ false));
        }
        return joins.isEmpty() ? JoinGraph.EMPTY : new JoinGraph(joins);
    }

    /**
     * R8 — left endpoint for a semi-join. When the correlation references a
     * single outer relation, that relation is the endpoint. When it
     * references several (or none can be matched but FROM joins exist), the
     * endpoint is the accumulated outer rowset (a {@link JoinEndpointKind#JOIN_RESULT}
     * over the last FROM join, carrying every FROM alias) — codex R8 [P2]:
     * a single-relation endpoint would be wrong when the semi-join's
     * conditions span multiple outer relations. Falls back to the first
     * FROM relation; returns {@code null} only when there is no FROM
     * relation to anchor.
     */
    /**
     * Degrade only (GitHub #708) — left endpoint for a semi-join whose body was
     * never analyzed. The correlation target is UNKNOWN, so anchoring to a
     * specific relation would publish a wrong edge: for
     * {@code FROM A, B ... EXISTS (<unsupported>)} correlating to B, naming A
     * is not a missing fact, it is a false one. Anchor to the whole outer
     * rowset ({@link JoinEndpointKind#JOIN_RESULT}) instead — true whichever
     * relation the body referenced.
     *
     * <p>A single-relation host is the one case where the relation IS provable
     * (there is nothing else it could correlate to), so it keeps the precise
     * RELATION endpoint.
     */
    private static JoinEndpoint unknownOuterEndpointFor(List<RelationSource> relations,
                                                        List<JoinEntity> priorJoins,
                                                        int order) {
        if (relations == null || relations.isEmpty()) {
            return null;
        }
        if (relations.size() == 1) {
            return outerEndpointFor(Collections.<String>emptyList(), relations, priorJoins);
        }
        List<String> allAliases = new ArrayList<>();
        for (RelationSource rs : relations) {
            if (rs.getAlias() != null && !rs.getAlias().isEmpty()) {
                allAliases.add(rs.getAlias());
            }
        }
        // Order of the join that produced the outer rowset. Prefer the last
        // real join; fall back to this entity's own order slot when the host
        // has several relations but no join entity to point at.
        int producing = (priorJoins != null && !priorJoins.isEmpty())
                ? priorJoins.get(priorJoins.size() - 1).getOrder()
                : order;
        return JoinEndpoint.joinResult(producing, allAliases);
    }

    private static JoinEndpoint outerEndpointFor(List<String> outerAliases,
                                                 List<RelationSource> relations,
                                                 List<JoinEntity> priorJoins) {
        if (relations == null || relations.isEmpty()) {
            return null;
        }
        // Multiple distinct outer relations → the joined outer rowset.
        if (outerAliases != null && countMatchingRelations(outerAliases, relations) > 1
                && priorJoins != null && !priorJoins.isEmpty()) {
            List<String> allAliases = new ArrayList<>();
            for (RelationSource rs : relations) {
                if (rs.getAlias() != null && !rs.getAlias().isEmpty()) {
                    allAliases.add(rs.getAlias());
                }
            }
            int lastOrder = priorJoins.get(priorJoins.size() - 1).getOrder();
            return JoinEndpoint.joinResult(lastOrder, allAliases);
        }
        // Single outer relation: match it by alias, else the first FROM relation.
        RelationSource chosen = null;
        if (outerAliases != null) {
            for (String a : outerAliases) {
                for (RelationSource rs : relations) {
                    if (rs.getAlias() != null && rs.getAlias().equalsIgnoreCase(a)) {
                        chosen = rs;
                        break;
                    }
                }
                if (chosen != null) break;
            }
        }
        if (chosen == null) {
            chosen = relations.get(0);
        }
        String alias = chosen.getAlias();
        if (alias == null || alias.isEmpty()) {
            return null;
        }
        String qn = chosen.getBinding() == null
                ? null : chosen.getBinding().getQualifiedName();
        return JoinEndpoint.relation(alias, qn, chosen.getInstanceId());
    }

    /** R8 — count how many FROM relations are named by {@code outerAliases}. */
    private static int countMatchingRelations(List<String> outerAliases,
                                              List<RelationSource> relations) {
        int n = 0;
        for (RelationSource rs : relations) {
            if (rs.getAlias() == null) continue;
            for (String a : outerAliases) {
                if (rs.getAlias().equalsIgnoreCase(a)) {
                    n++;
                    break;
                }
            }
        }
        return n;
    }

    private static JoinGraph buildJoinGraph(TSelectSqlStatement select,
                                            NameBindingProvider provider) {
        if (select == null || select.getJoins() == null || select.getJoins().size() == 0) {
            return JoinGraph.EMPTY;
        }
        List<JoinEntity> entities = new ArrayList<JoinEntity>();
        JoinEndpoint currentLeft = null;
        List<String> accumulated = new ArrayList<String>();
        int order = 0;
        boolean firstRelationSeen = false;
        // Slice 179 (R4): same FROM-order ordinal as buildRelations (driver
        // first, then each join-item right table) so endpoint instanceIds
        // align with RelationSource instanceIds by construction.
        int relInstanceId = 0;

        for (int j = 0; j < select.getJoins().size(); j++) {
            TJoin topJoin = select.getJoins().getJoin(j);
            if (topJoin == null) continue;
            TTable driver = topJoin.getTable();
            if (driver != null) {
                String dAlias = effectiveAliasOf(driver);
                String dQn = relationQnOf(driver);
                if (!firstRelationSeen) {
                    currentLeft = JoinEndpoint.relation(safeAlias(dAlias, dQn), dQn, relInstanceId++);
                    accumulated.add(currentLeft.getAlias());
                    firstRelationSeen = true;
                } else {
                    // Comma-FROM: implicit cross between the accumulated
                    // left result and this new top-level relation. A
                    // `FROM m, LATERAL (...)` operand is a lateral cross — mark
                    // the entity lateral (and surface LATERAL syntax) so a
                    // consumer does not flag it as an accidental cartesian.
                    boolean driverLateral = isLateralTable(driver);
                    JoinEndpoint right = JoinEndpoint.relation(safeAlias(dAlias, dQn), dQn, relInstanceId++);
                    entities.add(new JoinEntity(SemanticJoinType.IMPLICIT_CROSS,
                            currentLeft, right, order,
                            driverLateral ? JoinSourceSyntax.LATERAL : JoinSourceSyntax.COMMA,
                            false, null, null, SourceSpan.of(driver), null, driverLateral));
                    accumulated.add(right.getAlias());
                    currentLeft = JoinEndpoint.joinResult(order, new ArrayList<String>(accumulated));
                    order++;
                }
            } else if (topJoin.getJoin() != null) {
                // Parenthesized joined-table as the top-level driver operand,
                // e.g. `FROM (a JOIN b ON …) JOIN c ON …`. Recurse to emit the
                // sub-tree's entities and obtain its result endpoint, then treat
                // it as this position's left input (or comma-cross partner).
                int[] o = {order};
                int[] rid = {relInstanceId};
                JoinEndpoint sub = buildJoinGraphForJoin(topJoin.getJoin(), provider, entities, o, rid);
                order = o[0];
                relInstanceId = rid[0];
                if (sub == null) return JoinGraph.EMPTY;
                if (!firstRelationSeen) {
                    currentLeft = sub;
                    accumulated.addAll(aliasesOf(sub));
                    firstRelationSeen = true;
                } else {
                    entities.add(new JoinEntity(SemanticJoinType.IMPLICIT_CROSS,
                            currentLeft, sub, order, JoinSourceSyntax.COMMA,
                            false, null, null, SourceSpan.of(topJoin), null));
                    accumulated.addAll(aliasesOf(sub));
                    currentLeft = JoinEndpoint.joinResult(order, new ArrayList<String>(accumulated));
                    order++;
                }
            }
            TJoinItemList items = topJoin.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                TTable right = item.getTable();
                JoinEndpoint rightEp;
                if (right != null) {
                    String rAlias = effectiveAliasOf(right);
                    String rQn = relationQnOf(right);
                    rightEp = JoinEndpoint.relation(safeAlias(rAlias, rQn), rQn, relInstanceId++);
                } else if (item.getJoin() != null) {
                    // Parenthesized joined-table as the right operand,
                    // e.g. `FROM a JOIN (b JOIN c ON …) ON …`. Recurse to emit
                    // the sub-tree's inner entities and use its result endpoint
                    // as the right side of this outer join.
                    int[] o = {order};
                    int[] rid = {relInstanceId};
                    rightEp = buildJoinGraphForJoin(item.getJoin(), provider, entities, o, rid);
                    order = o[0];
                    relInstanceId = rid[0];
                    if (rightEp == null) return JoinGraph.EMPTY;
                } else {
                    // Genuinely neither a table nor a nested join — skip safely
                    // (no endpoint guesswork).
                    continue;
                }
                if (currentLeft == null) {
                    // A join item with no established left input — never guess a
                    // left endpoint; surface the graph as empty.
                    return JoinGraph.EMPTY;
                }
                SemanticJoinType jt = mapSemanticJoinType(item.getJoinType());
                boolean natural = isNaturalJoinType(item.getJoinType());
                // Lateral via the APPLY join type (SQL Server) OR a LATERAL
                // right operand (ANSI / PostgreSQL `CROSS JOIN LATERAL (...)`,
                // `JOIN LATERAL (...) ON ...`, `LEFT JOIN LATERAL (...) ON ...`).
                boolean lateral = isLateralJoinType(item.getJoinType())
                        || isLateralTable(item.getTable());
                List<String> using = usingColumnNames(item);
                // Slice 168 (S7): decompose this join's ON condition into
                // resolved predicate trees and attach them to the entity.
                // CROSS/OUTER APPLY carry no ON (correlation is inside the
                // right operand), so onPredicates stays null and conditions
                // stay empty — the correlation is preserved by the child
                // StatementGraph the right derived table produces.
                List<Predicate> onPredicates = (item.getOnCondition() != null)
                        ? PredicateTreeBuilder.build(item.getOnCondition(), provider)
                        : null;
                // Slice 177 (R1): verbatim ON-condition text (null when no ON).
                String conditionText = verbatimText(item.getOnCondition());
                // A condition-less lateral join (APPLY, CROSS JOIN LATERAL) is
                // self-described by sourceSyntax=LATERAL plus the isLateral flag
                // so a consumer never mistakes its empty condition for a buggy
                // cartesian INNER. A lateral join that DOES carry an explicit
                // condition (`JOIN LATERAL ... ON`, or a USING/NATURAL form)
                // keeps EXPLICIT syntax — the user wrote an explicit join
                // condition; its laterality rides on the orthogonal isLateral
                // flag only.
                boolean hasExplicitCondition = item.getOnCondition() != null
                        || (using != null && !using.isEmpty()) || natural;
                JoinSourceSyntax syntax = (lateral && !hasExplicitCondition)
                        ? JoinSourceSyntax.LATERAL : JoinSourceSyntax.EXPLICIT;
                // R7: a USING join's TJoinItem ends at the last USING column
                // name, not the closing ')', so SourceSpan.of(item) drops the
                // ')'. Extend the span end to one-past the closing ')' for
                // USING joins. ON / NATURAL / CROSS items already reach their
                // true clause end, so they keep SourceSpan.of(item).
                SourceSpan joinSpan = usingJoinSpan(item);
                entities.add(new JoinEntity(jt, currentLeft, rightEp, order,
                        syntax, natural, using, onPredicates,
                        joinSpan, conditionText, lateral));
                accumulated.addAll(aliasesOf(rightEp));
                currentLeft = JoinEndpoint.joinResult(order, new ArrayList<String>(accumulated));
                order++;
            }
        }
        return new JoinGraph(entities);
    }

    /**
     * Recursive join-graph builder for a parenthesized / nested
     * {@code <joined_table>} sub-tree (a {@link TJoin} reached via
     * {@link TJoinItem#getJoin()} or {@link TJoin#getJoin()}). Emits the
     * sub-tree's {@link JoinEntity}s into {@code entities}, advances the shared
     * {@code order} and {@code relInstanceId} counters (one-element arrays so the
     * caller sees the updates), and returns the sub-tree's result endpoint to be
     * used as a left/right endpoint of the enclosing join. Returns {@code null}
     * when an operand is genuinely neither a table nor a nested join, so the
     * caller surfaces the graph as empty rather than guessing.
     *
     * <p>Traversal order (driver first, then items left-to-right, recursing
     * inline) is identical to {@link #appendJoinRelations}, so endpoint
     * instanceIds align with RelationSource instanceIds by construction.
     */
    private static JoinEndpoint buildJoinGraphForJoin(TJoin join, NameBindingProvider provider,
            List<JoinEntity> entities, int[] order, int[] relInstanceId) {
        if (join == null) return null;
        JoinEndpoint currentLeft;
        List<String> accumulated = new ArrayList<String>();
        TTable driver = join.getTable();
        if (driver != null) {
            String dAlias = effectiveAliasOf(driver);
            String dQn = relationQnOf(driver);
            currentLeft = JoinEndpoint.relation(safeAlias(dAlias, dQn), dQn, relInstanceId[0]++);
            accumulated.add(currentLeft.getAlias());
        } else if (join.getJoin() != null) {
            currentLeft = buildJoinGraphForJoin(join.getJoin(), provider, entities, order, relInstanceId);
            if (currentLeft == null) return null;
            accumulated.addAll(aliasesOf(currentLeft));
        } else {
            return null;
        }
        TJoinItemList items = join.getJoinItems();
        for (int i = 0; items != null && i < items.size(); i++) {
            TJoinItem item = items.getJoinItem(i);
            if (item == null) continue;
            JoinEndpoint rightEp;
            TTable right = item.getTable();
            if (right != null) {
                String rAlias = effectiveAliasOf(right);
                String rQn = relationQnOf(right);
                rightEp = JoinEndpoint.relation(safeAlias(rAlias, rQn), rQn, relInstanceId[0]++);
            } else if (item.getJoin() != null) {
                rightEp = buildJoinGraphForJoin(item.getJoin(), provider, entities, order, relInstanceId);
                if (rightEp == null) return null;
            } else {
                return null;
            }
            SemanticJoinType jt = mapSemanticJoinType(item.getJoinType());
            boolean natural = isNaturalJoinType(item.getJoinType());
            boolean lateral = isLateralJoinType(item.getJoinType())
                    || isLateralTable(item.getTable());
            List<String> using = usingColumnNames(item);
            List<Predicate> onPredicates = (item.getOnCondition() != null)
                    ? PredicateTreeBuilder.build(item.getOnCondition(), provider)
                    : null;
            String conditionText = verbatimText(item.getOnCondition());
            boolean hasExplicitCondition = item.getOnCondition() != null
                    || (using != null && !using.isEmpty()) || natural;
            JoinSourceSyntax syntax = (lateral && !hasExplicitCondition)
                    ? JoinSourceSyntax.LATERAL : JoinSourceSyntax.EXPLICIT;
            SourceSpan joinSpan = usingJoinSpan(item);
            entities.add(new JoinEntity(jt, currentLeft, rightEp, order[0],
                    syntax, natural, using, onPredicates,
                    joinSpan, conditionText, lateral));
            accumulated.addAll(aliasesOf(rightEp));
            currentLeft = JoinEndpoint.joinResult(order[0], new ArrayList<String>(accumulated));
            order[0]++;
        }
        return currentLeft;
    }

    /**
     * FROM-order aliases contributed by a join endpoint: the full contributing
     * list for a join result, or the single alias for a relation / subquery
     * endpoint. Used to extend the accumulated alias list when a nested join
     * sub-tree is folded into an enclosing join.
     */
    private static List<String> aliasesOf(JoinEndpoint ep) {
        if (ep == null) return new ArrayList<String>();
        List<String> contrib = ep.getContributingAliases();
        if (contrib != null && !contrib.isEmpty()) {
            return new ArrayList<String>(contrib);
        }
        List<String> single = new ArrayList<String>();
        if (ep.getAlias() != null && !ep.getAlias().isEmpty()) {
            single.add(ep.getAlias());
        }
        return single;
    }

    /**
     * R7 — compute the {@link SourceSpan} for a join entity, extending a
     * {@code USING (...)} join's span to include the closing {@code ')'}.
     *
     * <p>For a {@code USING} join the {@link TJoinItem}'s end token is the
     * last USING column name (e.g. {@code k} in {@code USING (id, k)}), so
     * {@link SourceSpan#of(TParseTreeNode)} ends one token early and the
     * slice drops the trailing {@code ')'}. Here we advance the span end to
     * one-past the closing {@code ')'} that follows the USING column list.
     *
     * <p>ON / NATURAL / CROSS / APPLY items already reach their true clause
     * end (the ON condition expression reaches the clause end; the others
     * carry no parenthesised key list), so they fall through to the plain
     * {@code SourceSpan.of(item)}.
     */
    private static SourceSpan usingJoinSpan(TJoinItem item) {
        if (item == null) return null;
        TObjectNameList using = item.getUsingColumns();
        TSourceToken start = item.getStartToken();
        if (using == null || using.size() == 0 || start == null) {
            return SourceSpan.of(item);
        }
        TSourceToken end = using.getEndToken();
        if (end == null) {
            return SourceSpan.of(item);
        }
        // Advance to the closing ')' that follows the USING column list. The
        // list's end token is the last column name; the next solid token is
        // the ')'. Scan a small bounded window so a stray whitespace/comment
        // layout never wedges the walk, and never run past it.
        if (!")".equals(end.getAstext())) {
            TSourceToken t = end.nextSolidToken();
            int guard = 0;
            while (t != null && guard++ < 8 && !")".equals(t.getAstext())) {
                t = t.nextSolidToken();
            }
            if (t != null && ")".equals(t.getAstext())) {
                end = t;
            }
        }
        return SourceSpan.of(start, end);
    }

    /**
     * Slice 177 (R1) — reconstruct the verbatim source substring spanned by
     * a node, by concatenating the token chain from start to end WITHOUT
     * inserting separators (so original whitespace / comments are
     * preserved). Returns null when the node or its boundary tokens are
     * null. Used to populate {@code JoinEntity.conditionText} so consumers
     * don't re-implement span-slicing for the common "show me the ON text"
     * case.
     */
    private static String verbatimText(TParseTreeNode node) {
        if (node == null) return null;
        TSourceToken s = node.getStartToken();
        TSourceToken e = node.getEndToken();
        if (s == null || e == null) return null;
        StringBuilder sb = new StringBuilder();
        TSourceToken c = s;
        int guard = 0;
        boolean reachedEnd = false;
        while (c != null && guard++ < 2_000_000) {
            if (c.astext != null) sb.append(c.astext);
            if (c == e) {
                reachedEnd = true;
                break;
            }
            c = c.getNextTokenInChain();
        }
        // If the end token was not reachable from the start (or the guard
        // tripped), the accumulated prefix would be truncated/unrelated SQL.
        // Return null (unavailable) rather than silently-wrong verbatim text.
        if (!reachedEnd) return null;
        return sb.length() == 0 ? null : sb.toString();
    }

    /** Endpoint alias: the effective alias, falling back to the qualified name. */
    private static String safeAlias(String alias, String qn) {
        if (alias != null && !alias.isEmpty()) return alias;
        if (qn != null && !qn.isEmpty()) return qn;
        return "<anonymous>";
    }

    /** Bare relation name for an endpoint's qualifiedName; null when unavailable. */
    private static String relationQnOf(TTable t) {
        if (t == null) return null;
        TObjectName n = t.getTableName();
        if (n != null) {
            String s = n.toString();
            if (s != null && !s.isEmpty()) return s;
        }
        return null;
    }

    /** USING column names (empty for non-USING joins). */
    private static List<String> usingColumnNames(TJoinItem item) {
        List<String> out = new ArrayList<String>();
        if (item.getUsingColumns() != null) {
            for (int u = 0; u < item.getUsingColumns().size(); u++) {
                TObjectName c = item.getUsingColumns().getObjectName(u);
                if (c != null) {
                    String name = c.getColumnNameOnly();
                    if (name == null || name.isEmpty()) name = c.toString();
                    if (name != null && !name.isEmpty()) out.add(name);
                }
            }
        }
        return out;
    }

    /**
     * Map the parser's {@link EJoinType} to the stable
     * {@link SemanticJoinType}. NATURAL variants map to the underlying
     * join type ({@code natural_left} -&gt; LEFT); the NATURAL semantics
     * are carried by {@code JoinEntity.isNatural()}. Bare {@code natural}
     * maps to {@link SemanticJoinType#NATURAL}. {@code crossapply} /
     * {@code outerapply} degrade to INNER / LEFT with the lateral nature
     * carried by {@code JoinEntity.isLateral()}. Shapes the semantic
     * builder does not admit (nested / semi / anti / vendor extensions)
     * map to {@link SemanticJoinType#UNSUPPORTED} — never guessed.
     */
    private static SemanticJoinType mapSemanticJoinType(EJoinType jt) {
        if (jt == null) return SemanticJoinType.UNSUPPORTED;
        switch (jt) {
            case inner:
            case join:
            case straight:
            case natural_inner:
                return SemanticJoinType.INNER;
            case left:
            case leftouter:
            case natural_left:
            case natural_leftouter:
                return SemanticJoinType.LEFT;
            case right:
            case rightouter:
            case natural_right:
            case natural_rightouter:
                return SemanticJoinType.RIGHT;
            case full:
            case fullouter:
            case natural_full:
            case natural_fullouter:
                return SemanticJoinType.FULL;
            case cross:
                return SemanticJoinType.CROSS;
            case crossapply:
                // SQL Server CROSS APPLY: inner lateral join (drops left
                // rows with no right match). Lateral nature carried by
                // JoinEntity.isLateral().
                return SemanticJoinType.INNER;
            case outerapply:
                // SQL Server OUTER APPLY: left lateral join (keeps left
                // rows, right side nullable).
                return SemanticJoinType.LEFT;
            case natural:
                return SemanticJoinType.NATURAL;
            default:
                return SemanticJoinType.UNSUPPORTED;
        }
    }

    // -----------------------------------------------------------------
    // Slice 58 / 59 — catalog-backed SELECT * expansion.
    //
    // The hook in buildOutputColumns calls tryExpandStar(rc, select,
    // provider, isPredicateBody, stmtName) for any result column whose
    // columnNameOnly is "*" (and as defense in depth for any
    // EExpressionType.list_t expression). tryExpandStar returns a
    // StarExpansionResult that is either EXPANDED (with a list of
    // OutputColumns) or one of several reasoned rejection kinds. The
    // hook then either appends the expanded columns or throws a
    // structured SemanticIRBuildException whose message is unique per
    // kind so external callers can pattern-match without parsing a
    // generic "not supported yet" string.
    //
    // Scope (slice 58):
    //   - single base-table FROM (1 join, no join items)
    //   - bare `*` or qualified `t.*`
    //   - catalog provided via NameBindingProvider#getRelationColumnNames
    //
    // Slice 59 lift:
    //   - multi-relation FROM is now supported when a single top-level
    //     TJoin carries one or more explicit JOIN clauses (joinItems).
    //     Each FROM relation must individually satisfy slice-58 rules
    //     (binding kind TABLE, catalog declares columns). Bare `*`
    //     concatenates per-relation expansions in FROM order; qualified
    //     `t.*` selects the one relation whose effective alias matches.
    //   - qualifier matching is now effective-alias only
    //     (alias if present, else table name) — case-insensitive. This
    //     unifies the rule across single- and multi-relation paths;
    //     `SELECT employees.* FROM employees e` rejects because the
    //     effective alias is `e`, not `employees`.
    //   - star expansion is rejected inside synthetic body contexts
    //     (scalar-subquery / set-op-branch / predicate-subquery) via
    //     SYNTHETIC_BODY_CONTEXT; the slice-58 path silently allowed
    //     this for catalog-equipped builds even though a multi-column
    //     expansion would corrupt scalar-body shape downstream.
    //
    // Slice 60 lift:
    //   - CTE star and FROM-subquery star (`a.*` and bare `*` over a CTE
    //     or FROM-clause subquery alias) are now supported via the
    //     in-scope-relation-columns map carried on the provider. The
    //     map is populated at each consuming-SELECT call site in build()
    //     and extractFromSubqueriesAsStatements before the consumer's
    //     buildOutputColumns runs; tryExpandStar reads it for CTE /
    //     SUBQUERY bindings. Explicit CTE column lists
    //     (`WITH a(x, y) AS ...`) stay rejected because the CTE body's
    //     StatementGraph publishes inner-projection names, not the
    //     explicit list, and emitLineageForStatement would point at
    //     non-existent body outputs. Lifting that path needs either
    //     body-output renaming or a published-name → body-name lineage
    //     map; deferred to a future slice.
    //
    // Slice 62 lift:
    //   - Comma-FROM (multiple top-level TJoin elements parsed from
    //     `FROM a, b, c`) is now admitted at the outer / CTE-body /
    //     FROM-subquery-body call sites. {@link #tryExpandStar} walks
    //     every top-level TJoin and accumulates relations in FROM
    //     order; bare `*` concatenates per-relation expansions and
    //     qualified `t.*` selects the matching effective-alias.
    //     Synthetic body contexts (scalar / set-op-branch / set-op-CTE
    //     / predicate) still reject comma-FROM via the gated reject
    //     in buildRelations and the slice-62 reject inside
    //     preflightPredicateSubqueryShape.
    //
    // Out of scope (slice 60+):
    //   - SELECT * EXCEPT/REPLACE (BigQuery extensions; no slice scheduled)
    //   - Explicit CTE column list star expansion (slice 61+)
    // -----------------------------------------------------------------

    enum StarExpansionKind {
        EXPANDED,
        PREDICATE_BODY_GUARD,
        // Defensive catch-all for malformed FROM lists: missing top-level
        // TJoin, null table on a top-level TJoin or a join item, or
        // empty {@code select.joins}. Slice 62 made comma-FROM admit
        // here (the walk iterates every top-level TJoin), so reaching
        // this kind indicates a parse-tree anomaly rather than a comma-
        // FROM rejection.
        MULTI_RELATION_FROM,
        NON_BASE_TABLE_RELATION,
        QUALIFIER_NOT_FOUND,
        // Slice 59: a qualifier matches 2+ relations (case-insensitive
        // effective-alias collision). Real SQL never reaches this case
        // unless `rejectDuplicateAliases` permitted a case-only collision
        // (it is case-sensitive at SemanticIRBuilder.java:5621).
        QUALIFIER_AMBIGUOUS,
        NO_CATALOG_OR_UNKNOWN_TABLE,
        // Slice 59: star expansion in synthetic body contexts
        // (scalar-subquery, set-op-branch, predicate-subquery) is rejected
        // because multi-column expansion would violate the body's shape
        // contract (e.g. scalar bodies must project exactly one column).
        SYNTHETIC_BODY_CONTEXT,
        // Slice 60: CTE has an explicit column list
        // (`WITH a(x, y) AS ...`). Deferred to a future slice because
        // the CTE body's StatementGraph publishes inner-projection
        // names, not the explicit list, and lineage emission cannot
        // bridge that without either body-output renaming or a
        // published-name → body-name map.
        EXPLICIT_CTE_COLUMN_LIST_DEFERRED,
        // Slice 60: CTE / SUBQUERY binding's published-column map
        // lookup returned null or empty. This indicates a builder
        // invariant failure (the body should have been built and
        // registered before the consumer's buildOutputColumns runs);
        // user SQL cannot reach this kind under normal builds — only
        // fabricated providers or a missed plumbing path would. The
        // diagnostic names the binding kind and qualified name so
        // regressions are loud, not silent.
        NO_INSCOPE_RELATION_COLUMNS
    }

    static final class StarExpansionResult {
        final StarExpansionKind kind;
        final List<OutputColumn> columns;
        final String qualifier;
        final String detail;

        private StarExpansionResult(StarExpansionKind kind,
                                    List<OutputColumn> columns,
                                    String qualifier,
                                    String detail) {
            this.kind = kind;
            this.columns = columns;
            this.qualifier = qualifier;
            this.detail = detail;
        }

        static StarExpansionResult expanded(List<OutputColumn> cols) {
            return new StarExpansionResult(StarExpansionKind.EXPANDED, cols, null, null);
        }

        static StarExpansionResult reject(StarExpansionKind kind) {
            return new StarExpansionResult(kind, null, null, null);
        }

        static StarExpansionResult reject(StarExpansionKind kind, String qualifier, String detail) {
            return new StarExpansionResult(kind, null, qualifier, detail);
        }
    }

    /**
     * Effective alias for a FROM-clause {@link TTable}: the SQL-written
     * alias if present, else the slice-74 synthetic alias for unaliased
     * FROM-subquery TTables (position-keyed via
     * {@link FromSubqueryNaming#synthAliasFor}), else the table name.
     * Mirrors the rule used by {@link #buildRelation} so
     * {@link ColumnRef#getRelationAlias()} stays aligned with what the
     * lineage emitter expects.
     */
    private static String effectiveAliasOf(TTable t) {
        if (t == null) return null;
        String alias = t.getAliasName();
        if (alias != null && !alias.isEmpty()) return alias;
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
            return FromSubqueryNaming.synthAliasFor(t);
        }
        return t.getName();
    }

    /**
     * Slice 58 / 59 — attempt to expand a {@code SELECT *} or
     * {@code SELECT alias.*} result column using the catalog exposed via
     * {@link NameBindingProvider#getRelationColumnNames(TTable)}.
     *
     * <p>Slice 58 supported only single-base-table FROM. Slice 59 lifts
     * the multi-relation case to JOIN forms (single top-level TJoin with
     * explicit JOIN clauses). Comma-FROM stays rejected by
     * {@code buildRelations}.
     *
     * <p>Returns {@link StarExpansionKind#EXPANDED} with one
     * {@link OutputColumn} per catalog-declared column on success.
     * Otherwise returns a reasoned rejection so the caller can throw a
     * shape-specific {@link SemanticIRBuildException}.
     */
    /**
     * True when some FROM operand of {@code select} is a parenthesized / nested
     * {@code <joined_table>}: a {@link TJoin} reached via {@link TJoin#getJoin()}
     * (nested driver) or {@link TJoinItem#getJoin()} (nested right operand) whose
     * {@code getTable()} is null. Used to scope the MULTI_RELATION_FROM
     * star-expansion degrade to the genuinely-analyzable nested-join shape — a
     * null FROM table WITHOUT a nested join, or a null top-level {@link TJoin},
     * is a broken invariant and stays fatal.
     */
    private static boolean hasNestedJoinOperand(TSelectSqlStatement select) {
        if (select == null || select.joins == null) {
            return false;
        }
        for (int j = 0; j < select.joins.size(); j++) {
            TJoin topJoin = select.joins.getJoin(j);
            if (topJoin == null) {
                continue;
            }
            if (topJoin.getTable() == null && topJoin.getJoin() != null) {
                return true;
            }
            TJoinItemList items = topJoin.getJoinItems();
            for (int i = 0; items != null && i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item != null && item.getTable() == null && item.getJoin() != null) {
                    return true;
                }
            }
        }
        return false;
    }

    private static StarExpansionResult tryExpandStar(TResultColumn rc,
                                                     TSelectSqlStatement select,
                                                     NameBindingProvider provider,
                                                     boolean isPredicateBody,
                                                     String stmtName) {
        if (isPredicateBody) {
            // Defensive: the active rejection lives in
            // preflightPredicateSubqueryShape (~line 3880) and fires before
            // this code runs. Slice-24 EXISTS-with-* tests pin that path.
            return StarExpansionResult.reject(StarExpansionKind.PREDICATE_BODY_GUARD);
        }
        // Slice 59: reject star expansion in synthetic body contexts.
        // Scalar-subquery bodies must project exactly one column;
        // set-op-branch bodies must keep per-branch column-count parity;
        // predicate-subquery bodies are constant or column-ref shapes
        // (slice 23/24/27). Multi-column expansion would corrupt all
        // three. The preflight at SemanticIRBuilder.java:1007 only
        // checks AST result-column count/name, not "*", so without this
        // guard a catalog-equipped scalar body `SELECT * FROM small`
        // would silently emit multiple OutputColumns.
        if (stmtName != null
                && (isScalarSyntheticName(stmtName)
                        || isSetOpBranchSyntheticName(stmtName)
                        || isPredicateSubquerySyntheticName(stmtName))) {
            return StarExpansionResult.reject(
                    StarExpansionKind.SYNTHETIC_BODY_CONTEXT, null,
                    "star expansion is not supported inside synthetic body '"
                            + stmtName + "' (scalar, set-op branch, or predicate body)");
        }
        // Extract qualifier (empty string for bare `*`, alias/name for `t.*`).
        String qualifier = "";
        TExpression expr = rc.getExpr();
        if (expr != null && expr.getObjectOperand() != null) {
            String q = expr.getObjectOperand().getTableString();
            if (q != null && !q.isEmpty()) {
                qualifier = q;
            }
        }
        // FROM-clause shape gate. Slice 59 supported a single top-level
        // TJoin with zero or more explicit JOIN clauses. Slice 62 lifts
        // comma-FROM to multi-TJoin: walk every top-level TJoin in
        // {@code select.joins} (a comma-FROM list parses as multiple
        // top-level TJoins) and accumulate every relation in FROM order.
        if (select.joins == null || select.joins.size() == 0) {
            return StarExpansionResult.reject(StarExpansionKind.MULTI_RELATION_FROM);
        }
        List<TTable> fromRelations = new ArrayList<>();
        for (int j = 0; j < select.joins.size(); j++) {
            TJoin topJoin = select.joins.getJoin(j);
            if (topJoin == null) {
                return StarExpansionResult.reject(StarExpansionKind.MULTI_RELATION_FROM);
            }
            TTable leftTable = topJoin.getTable();
            if (leftTable == null) {
                return StarExpansionResult.reject(StarExpansionKind.MULTI_RELATION_FROM);
            }
            fromRelations.add(leftTable);
            TJoinItemList items = topJoin.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                TTable rightTable = item.getTable();
                if (rightTable == null) {
                    return StarExpansionResult.reject(StarExpansionKind.MULTI_RELATION_FROM);
                }
                fromRelations.add(rightTable);
            }
        }
        // Slice 65 / 66: bare `*` over a USING / NATURAL JOIN collapses
        // merged keys. For each FROM relation in order, walk catalog/
        // in-scope columns; emit one OutputColumn per merged key (sources
        // = merged ref list) and one per non-merged column. Qualified
        // `t.*` is unaffected (single-relation path, no merged-key dedup).
        if (qualifier.isEmpty()
                && (hasUsingInFromClause(select)
                        || hasNaturalJoinMergedKeysInFromClause(select, provider))) {
            return expandBareStarOverUsing(select, provider, fromRelations);
        }
        // Qualified `t.*`: pick the (unique) FROM relation whose
        // effective alias matches the qualifier (case-insensitive).
        // Effective alias = `alias != null && !alias.isEmpty() ? alias :
        // tableName`, matching buildRelation at line 5649. Slice 58's
        // alias-OR-name match (line 5785 before slice 59) is replaced
        // here so `SELECT employees.* FROM employees e` rejects
        // (qualifier=`employees` ≠ effective alias `e`), consistent
        // with standard SQL correlation-name semantics.
        if (!qualifier.isEmpty()) {
            List<TTable> matches = new ArrayList<>();
            for (TTable t : fromRelations) {
                String ea = effectiveAliasOf(t);
                if (ea != null && ea.equalsIgnoreCase(qualifier)) {
                    matches.add(t);
                }
            }
            if (matches.isEmpty()) {
                return StarExpansionResult.reject(
                        StarExpansionKind.QUALIFIER_NOT_FOUND, qualifier, null);
            }
            if (matches.size() > 1) {
                StringBuilder names = new StringBuilder();
                for (int i = 0; i < matches.size(); i++) {
                    if (i > 0) names.append(", ");
                    names.append(effectiveAliasOf(matches.get(i)));
                }
                return StarExpansionResult.reject(
                        StarExpansionKind.QUALIFIER_AMBIGUOUS, qualifier,
                        "matches " + matches.size() + " FROM-clause relations: "
                                + names);
            }
            return expandSingleRelation(matches.get(0), provider, qualifier);
        }
        // Bare `*`: expand every FROM relation in order. Fail fast on
        // the first relation that does not satisfy the slice-58 rules
        // (binding kind TABLE, catalog declares columns); the caller
        // sees the per-relation rejection kind and detail. No partial
        // outputs are returned.
        List<OutputColumn> all = new ArrayList<>();
        for (TTable t : fromRelations) {
            StarExpansionResult one = expandSingleRelation(t, provider, "");
            if (one.kind != StarExpansionKind.EXPANDED) {
                return one;
            }
            all.addAll(one.columns);
        }
        return StarExpansionResult.expanded(all);
    }

    /**
     * Slice 58 / 59 — pure per-relation star expander. Applies the
     * base-table-only + catalog rules and builds one
     * {@link OutputColumn} per catalog-declared column with a
     * {@link ColumnRef} whose {@code relationAlias} is the effective
     * alias of {@code target}. Returns {@link StarExpansionKind#EXPANDED}
     * on success, otherwise a tuned rejection.
     *
     * <p>The {@code qualifier} parameter is the SQL-written qualifier
     * for qualified `t.*` (empty for bare `*`); it is plumbed back into
     * the rejection result so the caller can include it in
     * user-visible diagnostics.
     */
    private static StarExpansionResult expandSingleRelation(TTable target,
                                                            NameBindingProvider provider,
                                                            String qualifier) {
        // The TTable's tableType cannot distinguish CTE from base table —
        // CTE references arrive as ETableSource.objectname. Use the
        // provider's bindRelation to get the resolved RelationKind.
        RelationBinding binding = provider.bindRelation(target);
        if (binding == null) {
            String diagAlias = effectiveAliasOf(target);
            return StarExpansionResult.reject(
                    StarExpansionKind.NON_BASE_TABLE_RELATION, qualifier,
                    "FROM source '"
                            + (diagAlias != null ? diagAlias : "<unnamed>")
                            + "' could not be bound (only base tables, in-scope CTEs, and FROM-subqueries are supported)");
        }
        RelationKind kind = binding.getKind();
        if (kind == RelationKind.TABLE) {
            // Slice 58 catalog-backed path. Returns null when no
            // catalog, when the catalog doesn't declare this table,
            // or when the table has no columns.
            List<String> columnNames = provider.getRelationColumnNames(target);
            if (columnNames == null || columnNames.isEmpty()) {
                String diagAlias = effectiveAliasOf(target);
                return StarExpansionResult.reject(
                        StarExpansionKind.NO_CATALOG_OR_UNKNOWN_TABLE, qualifier,
                        diagAlias);
            }
            return buildExpansionFromColumnNames(target, columnNames);
        }
        if (kind == RelationKind.CTE) {
            // Slice 60 + Slice 103: key by EFFECTIVE ALIAS in the consuming
            // SELECT, not by CTE name. This avoids a collision when a
            // FROM-subquery alias equals a visible CTE name and the
            // CTE is referenced under a different alias (codex
            // diff-review): `WITH a AS (...) SELECT c.*, a.* FROM a c
            // JOIN (SELECT ...) a ON ...` — both 'a' (CTE) and 'a'
            // (subquery alias) live in the FROM clause; effective
            // aliases are 'c' and 'a' respectively, so per-relation
            // entries cannot overwrite each other.
            //
            // Slice 103 — explicit CTE column lists (WITH a(x, y) AS ...)
            // are no longer rejected here. The slice-102 rename helper now
            // runs on the SELECT-side CTE walker too; the in-scope map
            // populated by addRelationToInScopeMap reads from
            // ctePublishedColumns, which the helper has populated with the
            // renamed names. Star expansion just falls through to the
            // in-scope lookup below; the renamed list comes back.
            String lookupKey = effectiveAliasLowerCaseOrNull(target);
            List<String> cteColumns = (lookupKey == null) ? null
                    : provider.getInScopeRelationColumns().get(lookupKey);
            if (cteColumns == null || cteColumns.isEmpty()) {
                String diagAlias = effectiveAliasOf(target);
                return StarExpansionResult.reject(
                        StarExpansionKind.NO_INSCOPE_RELATION_COLUMNS,
                        qualifier,
                        "CTE '" + diagAlias + "' has no published columns in "
                                + "the in-scope map (builder invariant: the "
                                + "CTE body should have been built and "
                                + "registered before this consumer ran)");
            }
            return buildExpansionFromColumnNames(target, cteColumns);
        }
        if (kind == RelationKind.SUBQUERY) {
            // Slice 60: same effective-alias keying as the CTE branch
            // above (codex diff-review). For a subquery the effective
            // alias IS the alias the SQL writer wrote (preflight
            // rejects anonymous subqueries), so this branch is also
            // unambiguous under the alias-collision example.
            String lookupKey = effectiveAliasLowerCaseOrNull(target);
            List<String> subColumns = (lookupKey == null) ? null
                    : provider.getInScopeRelationColumns().get(lookupKey);
            if (subColumns == null || subColumns.isEmpty()) {
                String diagAlias = effectiveAliasOf(target);
                return StarExpansionResult.reject(
                        StarExpansionKind.NO_INSCOPE_RELATION_COLUMNS,
                        qualifier,
                        "FROM-clause subquery '"
                                + (diagAlias != null ? diagAlias : "<unnamed>")
                                + "' has no published columns in the in-scope "
                                + "map (builder invariant: the subquery body "
                                + "should have been extracted and registered "
                                + "before this consumer ran)");
            }
            return buildExpansionFromColumnNames(target, subColumns);
        }
        // OUTER_REFERENCE / UNION / UNKNOWN: keep the slice-58 / 59
        // rejection contract. None of these arrive on a slice-60
        // FROM-clause relation via the current builder paths
        // (OUTER_REFERENCE bindings live only on RelationSource for
        // correlated scalar lookup; UNION is a set-op branch concept,
        // not a FROM-clause relation). Defensive catch-all.
        String diagAlias = effectiveAliasOf(target);
        String detail;
        switch (kind) {
            case OUTER_REFERENCE:
                detail = "OUTER_REFERENCE star expansion is not supported (relation '"
                        + diagAlias + "')";
                break;
            case UNION:
            case UNKNOWN:
            default:
                detail = "FROM source '" + diagAlias
                        + "' must be a base table, CTE, or FROM-subquery (got kind="
                        + kind + ")";
                break;
        }
        return StarExpansionResult.reject(
                StarExpansionKind.NON_BASE_TABLE_RELATION, qualifier, detail);
    }

    /**
     * Slice 60 — shared helper that turns a column-name list into the
     * star-expansion OutputColumn list with one {@link ColumnRef} per
     * column whose {@code relationAlias} is the effective alias of the
     * target table (alias if present, else the table name). Used by all
     * three slice-58 / 59 / 60 paths.
     */
    private static StarExpansionResult buildExpansionFromColumnNames(
            TTable target, List<String> columnNames) {
        String alias = effectiveAliasOf(target);
        List<OutputColumn> outputs = new ArrayList<>(columnNames.size());
        for (String colName : columnNames) {
            ColumnRef ref = new ColumnRef(alias, colName);
            outputs.add(new OutputColumn(
                    colName,
                    /*derived=*/ false,
                    /*aggregate=*/ false,
                    Collections.singletonList(ref),
                    /*windowSpec=*/ null));
        }
        return StarExpansionResult.expanded(outputs);
    }

    /**
     * Slice 65 — bare {@code *} over a USING JOIN: deduplicate the
     * merged key within each equivalence class. For each FROM relation
     * in order:
     * <ul>
     *   <li>look up columns via the existing
     *       {@link #lookupRelationColumnNames} (catalog + in-scope map);
     *       reject with {@link StarExpansionKind#NO_CATALOG_OR_UNKNOWN_TABLE}
     *       when null (we can't dedup without knowing what's there);</li>
     *   <li>for each column, check
     *       {@link UsingScope#entryContaining(String, TTable)};
     *       if a class contains this relation, emit a single
     *       merged-source {@link OutputColumn} the first time the class
     *       is seen and skip duplicates from later class members;</li>
     *   <li>otherwise emit a plain single-source OutputColumn.</li>
     * </ul>
     *
     * <p>Duplicate-output guard fires ONLY when the conflicting names
     * involve a USING-merged entry (merged-vs-plain or two disconnected
     * merged classes for the same key). Plain duplicates from
     * non-USING multi-relation expansion remain admitted (slice-59
     * behavior).
     *
     * <p>Output column order is <b>left-table order with USING-key
     * dedup within each equivalence class</b>: the merged column
     * appears at the position of its first member in FROM order. E.g.
     * {@code a(id, k), b(k, name)} → {@code [id, k, name]}.
     *
     * <p>This is INTENTIONALLY DIFFERENT from the ANSI/PostgreSQL
     * physical column order (which puts USING columns first, then
     * remaining left, then remaining right — would yield
     * {@code [k, id, name]}). The Semantic IR is not a query
     * executor; the order it surfaces is a lineage-tracking
     * presentation choice. Left-table order:
     * <ol>
     *   <li>matches the slice-65 roadmap resume protocol
     *       ({@code docs/designs/sql-semantic-governance-unified-roadmap.md}
     *       §13.1) which fixed this order before implementation;</li>
     *   <li>keeps the merged column physically adjacent to its
     *       left-side neighbors, matching how lineage tooling
     *       traditionally renders combined JOIN output;</li>
     *   <li>does not depend on USING-clause ordering (which is a
     *       syntactic choice, not a semantic one).</li>
     * </ol>
     * Codex diff-review round 5 flagged this as P2 (non-ANSI). The
     * choice was confirmed in plan-review and is locked by
     * {@code bareStarOverUsingLeftPositionPreserved} so any future
     * change to ANSI order is a deliberate observable contract
     * change, not a silent fix.
     */
    private static StarExpansionResult expandBareStarOverUsing(
            TSelectSqlStatement select,
            NameBindingProvider provider,
            List<TTable> fromRelations) {
        UsingScope scope = provider.getUsingScope();
        if (scope.isEmpty()) {
            // The slice-65 caller checks hasUsingInFromClause before
            // routing here, so an empty scope here means buildUsingScope
            // computed empty entries (unreachable in practice). Fall
            // back to a generic reject so the caller surfaces a
            // structured diagnostic.
            return StarExpansionResult.reject(
                    StarExpansionKind.SYNTHETIC_BODY_CONTEXT, null,
                    "bare * over JOIN ... USING reached the merged-key expander "
                            + "with an empty UsingScope (builder invariant failure)");
        }
        LinkedHashSet<String> emittedNamesLC = new LinkedHashSet<>();
        Set<String> mergedNamesLC = new HashSet<>();
        java.util.IdentityHashMap<UsingScope.EquivalenceClass, Boolean> emittedClasses =
                new java.util.IdentityHashMap<>();
        List<OutputColumn> outputs = new ArrayList<>();
        for (TTable t : fromRelations) {
            // Slice 103 lifted the explicit-CTE-column-list deferral:
            // populateUsingJoinRefs no longer rejects, and
            // lookupRelationColumnNames returns the renamed names from
            // the in-scope map (populated by the slice-102 rename
            // helper that the SELECT-side CTE walker now invokes).
            List<String> cols = lookupRelationColumnNames(t, provider);
            if (cols == null) {
                return StarExpansionResult.reject(
                        StarExpansionKind.NO_CATALOG_OR_UNKNOWN_TABLE, null,
                        effectiveAliasOf(t));
            }
            for (String c : cols) {
                if (c == null) continue;
                String keyLC = c.toLowerCase(Locale.ROOT);
                UsingScope.MergedKeyEntry entry = scope.entryContaining(keyLC, t);
                if (entry != null) {
                    // USING-merged column. Dedup per class.
                    if (emittedClasses.containsKey(entry.getEquivClass())) {
                        continue;
                    }
                    emittedClasses.put(entry.getEquivClass(), Boolean.TRUE);
                    OutputColumn cand = new OutputColumn(
                            c, /*derived=*/ false, /*aggregate=*/ false,
                            entry.getSources(), /*windowSpec=*/ null);
                    StarExpansionResult dup = appendMergedAwareOrReject(
                            outputs, emittedNamesLC, mergedNamesLC, cand, /*isMerged=*/ true);
                    if (dup != null) return dup;
                } else {
                    // Plain column. Slice-59 behavior: duplicate plain
                    // names are admitted. Codex round-5: the merged-aware
                    // guard fires only when ONE side is merged.
                    OutputColumn cand = new OutputColumn(
                            c, /*derived=*/ false, /*aggregate=*/ false,
                            Collections.singletonList(new ColumnRef(effectiveAliasOf(t), c)),
                            /*windowSpec=*/ null);
                    StarExpansionResult dup = appendMergedAwareOrReject(
                            outputs, emittedNamesLC, mergedNamesLC, cand, /*isMerged=*/ false);
                    if (dup != null) return dup;
                }
            }
        }
        return StarExpansionResult.expanded(outputs);
    }

    /**
     * Slice 65 — duplicate-output helper for
     * {@link #expandBareStarOverUsing}. Fires the merged-vs-non-merged
     * collision guard. Returns a {@link StarExpansionResult} when the
     * caller should reject; returns {@code null} when the candidate is
     * appended successfully.
     */
    private static StarExpansionResult appendMergedAwareOrReject(
            List<OutputColumn> outputs,
            LinkedHashSet<String> emittedNamesLC,
            Set<String> mergedNamesLC,
            OutputColumn cand,
            boolean isMerged) {
        String nameLC = cand.getName().toLowerCase(Locale.ROOT);
        boolean alreadyEmitted = emittedNamesLC.contains(nameLC);
        boolean alreadyMerged = mergedNamesLC.contains(nameLC);
        // Reject only when at least one side is a USING-merged entry.
        // Plain-vs-plain duplicates remain admitted (slice-59 behavior).
        if (alreadyEmitted && (isMerged || alreadyMerged)) {
            return StarExpansionResult.reject(
                    StarExpansionKind.SYNTHETIC_BODY_CONTEXT, null,
                    "bare * over JOIN ... USING produces ambiguous output "
                            + "column '" + cand.getName() + "': a USING-merged "
                            + "entry and a same-named column from outside the "
                            + "USING equivalence class collide (or two disconnected "
                            + "USING classes share the same key name); qualify "
                            + "with t.* per relation or rename a column to "
                            + "disambiguate");
        }
        emittedNamesLC.add(nameLC);
        if (isMerged) mergedNamesLC.add(nameLC);
        outputs.add(cand);
        return null;
    }

    /**
     * Slice 60 — read the published column names for an already-built
     * statement (CTE body or FROM-subquery body) from its
     * {@link StatementGraph#getOutputColumns()}. Used by {@code build()}
     * and {@code extractFromSubqueriesAsStatements} to populate the
     * in-scope map before each consuming SELECT's
     * {@code buildOutputColumns} runs.
     */
    private static List<String> outputColumnNames(StatementGraph body) {
        List<OutputColumn> cols = body.getOutputColumns();
        List<String> names = new ArrayList<>(cols.size());
        for (OutputColumn c : cols) names.add(c.getName());
        return Collections.unmodifiableList(names);
    }

    /**
     * Slice 60 — effective alias of a TTable lower-cased, or null when
     * the table has neither an alias nor a name. The alias-collision
     * fix (codex diff-review) replaced CTE-name / subquery-alias
     * keying with effective-alias keying; this helper centralises the
     * lookup-key computation.
     */
    private static String effectiveAliasLowerCaseOrNull(TTable t) {
        String alias = effectiveAliasOf(t);
        if (alias == null || alias.isEmpty()) return null;
        return alias.toLowerCase(Locale.ROOT);
    }

    /**
     * Slice 60 — build a per-consumer effective-alias-keyed map of
     * "FROM-clause relation alias → published column names" by walking
     * the consumer's direct FROM/JOIN list (single top-level TJoin,
     * left table + each joinItem.getTable()).
     *
     * <p>Each CTE-bound relation contributes its effective alias →
     * {@code ctePublishedColumns.get(cteName.toLowerCase())}. Each
     * FROM-subquery contributes its alias → {@code
     * outputColumnNames(stmts.get(subqueryAliasToIndex.get(alias)))}.
     * Base-table relations are skipped because their star expansion
     * uses the catalog path (TSQLEnv); adding them here would force
     * dialect-specific catalog walks before catalog access is required.
     *
     * <p>The codex diff-review found that a single name-keyed map
     * collides when a FROM-subquery alias equals a visible CTE name
     * (`WITH a AS (...) ... FROM a c JOIN (SELECT ...) a ...`). Keying
     * by effective alias (which is unique per FROM clause —
     * {@link #preflightDirectFromList} rejects duplicates) closes the
     * collision class.
     *
     * @param consumer              the SELECT whose FROM list to walk
     * @param consumerProvider      provider used only for bindRelation
     *                              (CTE vs TABLE discrimination)
     * @param ctePublishedColumns   CTE-name → columns lookup
     *                              populated as CTE bodies are built
     * @param subqueryAliasToIndex  this consumer's own subquery alias
     *                              → stmts index lookup
     * @param stmts                 already-built statement list
     * @return mutable effective-alias-keyed in-scope map for this
     *         consumer; callers wrap it via
     *         {@code provider.withInScopeRelationColumns(map)}
     */
    private static Map<String, List<String>> buildEffectiveAliasInScopeMap(
            TSelectSqlStatement consumer,
            NameBindingProvider consumerProvider,
            Map<String, List<String>> ctePublishedColumns,
            Map<String, Integer> subqueryAliasToIndex,
            List<StatementGraph> stmts) {
        Map<String, List<String>> result = new HashMap<>();
        if (consumer.joins == null) return result;
        for (TJoin join : consumer.joins) {
            addRelationToInScopeMap(join.getTable(), consumerProvider,
                    ctePublishedColumns, subqueryAliasToIndex, stmts, result);
            TJoinItemList items = join.getJoinItems();
            if (items == null) continue;
            for (int i = 0; i < items.size(); i++) {
                TJoinItem item = items.getJoinItem(i);
                if (item == null) continue;
                addRelationToInScopeMap(item.getTable(), consumerProvider,
                        ctePublishedColumns, subqueryAliasToIndex, stmts, result);
            }
        }
        return result;
    }

    private static void addRelationToInScopeMap(
            TTable t,
            NameBindingProvider consumerProvider,
            Map<String, List<String>> ctePublishedColumns,
            Map<String, Integer> subqueryAliasToIndex,
            List<StatementGraph> stmts,
            Map<String, List<String>> result) {
        if (t == null) return;
        // Slice 137 — a PIVOT / UNPIVOT source can itself be a FROM-subquery
        // (or CTE): `FROM (SELECT ...) [alias] PIVOT(...)`. Unwrap the
        // pivoted_table to its source relation so the source's published
        // columns are registered under the SAME effective alias that
        // lookupRelationColumnNames resolves in expandPivot/UnpivotBareStar.
        // The source-subquery alias is already registered in
        // subqueryAliasToIndex by the slice-136 processDirectSubqueryTable
        // pre-pass (which performs the same unwrap), so the subquery branch
        // below finds its statement index. A base-table pivot source falls
        // through unchanged: bindRelation returns TABLE → no in-scope entry,
        // and the slice-133 catalog path (getRelationColumnNames) handles it.
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.pivoted_table
                && t.getPivotedTable() != null
                && !t.getPivotedTable().getRelations().isEmpty()) {
            TTable src = t.getPivotedTable().getRelations().get(0);
            if (src == null) return;
            t = src;
        }
        String key = effectiveAliasLowerCaseOrNull(t);
        if (key == null) return;
        if (t.getTableType() == gudusoft.gsqlparser.ETableSource.subquery) {
            Integer idx = subqueryAliasToIndex.get(key);
            if (idx != null) {
                result.put(key, outputColumnNames(stmts.get(idx)));
            }
            return;
        }
        // objectname (base-table OR CTE reference). Use bindRelation
        // to discriminate; base tables don't need an in-scope entry
        // (slice 58 catalog path handles them via getRelationColumnNames).
        RelationBinding b = consumerProvider.bindRelation(t);
        if (b == null) return;
        if (b.getKind() == RelationKind.CTE) {
            String cteName = t.getName();
            if (cteName == null) return;
            List<String> cols = ctePublishedColumns.get(cteName.toLowerCase(Locale.ROOT));
            if (cols != null && !cols.isEmpty()) {
                result.put(key, cols);
            }
        }
        // For TABLE, OUTER_REFERENCE, UNION, UNKNOWN bindings the
        // in-scope map is intentionally not populated; the
        // base-table catalog path or rejection path applies.
    }

    /**
     * Build the {@link OutputColumn} list. Slice 4 lifts the
     * simple-object-name / single-source restriction: any expression with at
     * least one column reference is accepted, and the column is marked
     * {@link OutputColumn#isDerived()} when the expression is anything
     * other than a direct column reference. Slice 61 also admits
     * canonical constant-only projections (zero column refs) outside
     * scalar-subquery bodies, using alias-or-expression text naming.
     */
    private static List<OutputColumn> buildOutputColumns(TSelectSqlStatement select,
                                                         NameBindingProvider provider,
                                                         boolean allowScalarProjectionSubqueries,
                                                         boolean allowWindowProjection,
                                                         boolean isPredicateBody,
                                                         String stmtName) {
        TResultColumnList rcl = select.getResultColumnList();
        if (rcl == null || rcl.size() == 0) {
            throw new SemanticIRBuildException(Diagnostic.error(DiagnosticCode.SELECT_NO_PROJECTED_COLUMNS, "SELECT has no projected columns", select));
        }
        // Slice 23/24/27: predicate-body short-circuit. The preflight
        // (§4.4 / slice-24 §4.1.1 / slice-27 §4.1) already validated that
        // the inner SELECT projects exactly one column, of an admitted
        // shape — constant (slice 23), simple column ref (slice 24), or
        // expression / function call / CASE / aggregate over inner
        // columns (slice 27). Discriminate on the shape:
        //
        // - Constant: bypass the regular result-column loop (which would
        //   reject empty-source non-aggregate projections via the
        //   "no column refs" guard at line ~4397) and emit one synthetic
        //   OutputColumn with empty sources. The synthesised name
        //   `<predicate_subquery_<i>>_const_0` guarantees no collision
        //   with real column names.
        //
        // - Slice-24 column ref (simple_object_name_t with name): fall
        //   through to the normal loop; effectiveOutputName(rc) returns
        //   the column name. OutputColumn carries name, derived=false,
        //   aggregate=false, sources=[ColumnRef(...)].
        //
        // - Slice-27 expression / function / CASE / aggregate without
        //   alias: synthesise the OutputColumn here. The normal loop's
        //   {@link #effectiveOutputName} would throw on rc with neither
        //   alias nor column name (a slice-6 invariant for OUTER
        //   projections); for predicate bodies the OutputColumn name is
        //   internal scaffolding only — no consumer references it
        //   externally — so a synthetic name is sound. For aggregate-over-
        //   constants (COUNT(*), SUM(1)) sources is empty and aggregate=true
        //   matches the line-4397 guard's intent. The slice-24 projector
        //   pass walks OutputColumn.sources to base-column terminals and
        //   emits JOIN canonical edges (zero terminals → zero edges,
        //   multi-source → multiple edges).
        if (isPredicateBody) {
            TResultColumn rc0 = rcl.getResultColumn(0);
            if (rc0.getExpr() != null && isConstantExpression(rc0.getExpr())) {
                String synthName = (stmtName != null ? stmtName : "<predicate_subquery_?>")
                        + "_const_0";
                return Collections.singletonList(new OutputColumn(
                        synthName, /*derived=*/ true, /*aggregate=*/ false,
                        Collections.<ColumnRef>emptyList(), /*windowSpec=*/ null));
            }
            // Slice 27 + Slice 32: synthesise the OutputColumn for any
            // slice-27/31-admitted predicate-body projection EXCEPT the
            // slice-24 simple_object_name_t shape. Slice 27 fired this
            // branch only when both alias AND columnNameOnly were absent
            // (missingName=true); slice 32 widens it to also fire when
            // alias is present, so aliased Oracle / MSSQL plain
            // {@code LISTAGG(x.id, ',') WITHIN GROUP (ORDER BY ...) AS lst}
            // is admitted (the slice-31 boundary lifted by slice 32).
            //
            // The simple_object_name_t exclusion is intentional. That
            // shape MUST keep falling through to the normal loop, where
            // {@link #effectiveOutputName} returns the column name (or
            // alias if present), {@code derived=false}, and
            // {@code sources=[ColumnRef(...)]} — the slice-24 baseline.
            // Per {@code TResultColumn.getColumnNameOnly()}, only
            // {@code simple_object_name_t}, {@code typecast_t}, and
            // {@code sqlserver_proprietary_column_alias_t} populate
            // columnNameOnly; function_t / case_t / pure-binary all
            // return empty, so the cascade below is alias > _proj_0
            // (no columnNameOnly intermediate).
            if (rc0.getExpr() != null
                    && rc0.getExpr().getExpressionType() != EExpressionType.simple_object_name_t) {
                String alias = rc0.getColumnAlias();
                String name;
                if (alias != null && !alias.isEmpty()) {
                    // Slice 32 widening: aliased projection. Use the
                    // alias as the OutputColumn name.
                    name = alias;
                } else {
                    // Slice 27 carryover: unaliased non-column-ref
                    // projection. Synthesise a stable name. The synth
                    // name is used internally by
                    // {@link gudusoft.gsqlparser.ir.semantic.diff.SemanticIRProjector}
                    // (line ~161 — BFS start key keyed by
                    // {@code stmtOutputKey(idx, out.getName())}) to walk
                    // predicate-body lineage to base columns; uniqueness
                    // within the single-column predicate body is
                    // sufficient for that walk. {@code _proj_0} is also
                    // exposed by the JSON exporter but is not externally
                    // referenced by callers — only the inner JOIN
                    // canonical edges (target.column omitted; role=JOIN)
                    // are visible to consumers.
                    name = (stmtName != null ? stmtName : "<predicate_subquery_?>")
                            + "_proj_0";
                }
                boolean aggregate = isAggregateFunction(rc0.getExpr());
                // Slice 43 / 44: PG (slice 43) and Snowflake (slice 44)
                // hypothetical-set ordered-set aggregates ({@code rank} /
                // {@code dense_rank} / {@code percent_rank} /
                // {@code cume_dist}) via direct {@code fn.getWithinGroup()}
                // attachment do not satisfy
                // {@link #isHypotheticalSetWithinGroupCall} (which requires
                // a non-null windowDef) and are not in the regular
                // {@link #AGGREGATE_FUNCTION_NAMES} whitelist. Inside the
                // predicate-body branch they are admitted as aggregates
                // when the slice-43 / 44 vendor-gated shape predicate
                // fires — contained here (NOT folded into
                // {@code isAggregateFunction}) so the carve-out cannot
                // accidentally lift the top-level PG / Snowflake case
                // (whose dlineage XML is structurally identical to the
                // OVER form — see Slice43Test / Slice44Test javadoc).
                if (!aggregate
                        && rc0.getExpr().getExpressionType() == EExpressionType.function_t
                        && isDirectAttachmentHypotheticalSetCall(
                                rc0.getExpr().getFunctionCall(), select.dbvendor)) {
                    aggregate = true;
                }
                // Slice 28: FILTER-aware collector excludes column refs inside
                // FILTER (WHERE ...) subtrees so OutputColumn.sources matches
                // dlineage's lineage-relationship view (FILTER predicate refs
                // absent from fdd / fdr).
                // Slice 31: also excludes column refs inside Oracle / MSSQL
                // {@code fn.windowDef.withinGroup} (the WITHIN GROUP ORDER BY)
                // so plain {@code LISTAGG(x.id, ',') WITHIN GROUP (ORDER BY x.region)}
                // emits sources=[x.id] only — matching dlineage's omission of the
                // WITHIN GROUP ORDER BY ref from {@code fdr clause="on"} sources
                // (probe Q1 in {@code /tmp/probe31}). Slice 32 reuses the
                // same collector unchanged.
                List<ColumnRef> sources = collectColumnRefsExcludingFilterAndWithinGroupClauses(rc0, provider);
                if (sources.isEmpty() && !aggregate) {
                    // Non-aggregate with no inner column refs: should be
                    // covered by the constant short-circuit above. If we
                    // reach here, fall through to the normal loop's
                    // line-4397 guard for a conservative tuned message.
                } else {
                    return Collections.singletonList(new OutputColumn(
                            name, /*derived=*/ true, aggregate,
                            sources, /*windowSpec=*/ null));
                }
            }
            // simple_object_name_t falls through (slice-24 carryover):
            // the normal loop produces derived=false /
            // sources=[ColumnRef(...)] using effectiveOutputName.
        }
        // Slice 19 (alias-bound PARTITION BY discriminator): the resolver
        // synthesises EXACT_MATCH bindings for PARTITION BY <name> when no
        // schema metadata is available (TableNamespace.resolveColumn
        // inferred_from_usage fallback), even when <name> is a SELECT-list
        // alias on a calculated expression. The discriminator is exposed
        // by NameBindingProvider#isCalculatedProjectionAliasFallback and
        // consulted in buildWindowPartitionRefs / buildWindowOrderRefs;
        // see Slice13Test#partitionByExpressionAliasIsRejectedAsAliasBound
        // and the shadowing-with-metadata companion. Slice 19 prefers
        // conservative rejection in the no-metadata case; with TSQLEnv
        // declaring the shadowed column, ColumnSource#hasDefiniteEvidence
        // returns true and the discriminator falls through.
        List<OutputColumn> out = new ArrayList<>(rcl.size());
        for (int i = 0; i < rcl.size(); i++) {
            TResultColumn rc = rcl.getResultColumn(i);
            if (rc.getExpr() == null) {
                throw new SemanticIRBuildException(Diagnostic.error(DiagnosticCode.RESULT_COLUMN_NULL_EXPRESSION, "result column " + rc + " has null expression", rc));
            }
            EExpressionType type = rc.getExpr().getExpressionType();
            // Slice 58: catalog-backed star expansion for a single base
            // table. Star projections were rejected by slices 1-57 with
            // "SELECT * / list expansions are deferred"; slice 58 lifts
            // the single-base-table case when a catalog is available via
            // NameBindingProvider#getRelationColumnNames(TTable). Bare
            // `*` and qualified `t.*` both arrive here as
            // simple_object_name_t with rc.getColumnNameOnly() == "*"
            // (probed; see slice-58 plan); the prior EExpressionType.list_t
            // branch is dead defense for stars in practice but stays in
            // case a future grammar variant routes them differently.
            String colNameOnly = rc.getColumnNameOnly();
            if ("*".equals(colNameOnly) || type == EExpressionType.list_t) {
                StarExpansionResult exp = tryExpandStar(rc, select, provider,
                        isPredicateBody, stmtName);
                switch (exp.kind) {
                    case EXPANDED:
                        out.addAll(exp.columns);
                        continue;
                    case PREDICATE_BODY_GUARD:
                        // Defensive; preflightPredicateSubqueryShape at line ~3880
                        // rejects SELECT * in EXISTS earlier with a tuned
                        // message. This branch only fires if a future call
                        // site enters buildOutputColumns with isPredicateBody
                        // and a star still present.
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_PREDICATE_BODY,
                                "result column " + rc + " is a star expansion (SELECT *) "
                                        + "inside a predicate body; not supported yet", rc));
                    case SYNTHETIC_BODY_CONTEXT:
                        // Slice 59: star expansion is rejected inside a
                        // synthetic body (scalar-subquery / set-op-branch /
                        // predicate-subquery). Multi-column expansion would
                        // violate the body's shape contract; the slice-58
                        // path could silently produce this for
                        // catalog-equipped builds.
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_SYNTHETIC_BODY,
                                "result column " + rc + " is a star expansion (SELECT *); "
                                        + (exp.detail != null ? exp.detail
                                                : "star expansion is not supported inside a synthetic body"), rc));
                    case MULTI_RELATION_FROM: {
                        // GSP R6 degrade (star-expansion-multi-relation-from-
                        // degrade.md): tryExpandStar returns this kind when a
                        // FROM operand is a parenthesized / nested <joined_table>
                        // (TJoin.getTable() / TJoinItem.getTable() is null), so
                        // the single-relation expander cannot pick one relation.
                        // The parenthesized-join recursion (buildRelations /
                        // buildJoinGraph) already builds a complete multi-relation
                        // join graph for exactly this FROM shape, so failing here
                        // would discard a fully-analyzable program. DEGRADE just
                        // like the NO_CATALOG_OR_UNKNOWN_TABLE arm below: record a
                        // non-fatal warning, emit the star as an UNEXPANDED MARKER
                        // output column (no sources — never fabricate names), and
                        // continue. Synthetic bodies are caught earlier as
                        // SYNTHETIC_BODY_CONTEXT (set-op parity unaffected);
                        // catalog-present flat expansion still returns EXPANDED.
                        //
                        // Scope the degrade to the genuinely-analyzable nested-join
                        // shape: a null FROM table caused by a parenthesized
                        // <joined_table> operand, for which buildRelations /
                        // buildJoinGraph already built the graph. A
                        // MULTI_RELATION_FROM with NO nested operand (the
                        // defensive topJoin==null path, or a null FROM table with
                        // no nested join) is a broken invariant with no graph to
                        // preserve — keep it fatal rather than fabricating a
                        // valid-looking program with a sourceless marker.
                        if (!hasNestedJoinOperand(select)) {
                            throw new SemanticIRBuildException(
                                    Diagnostic.error(DiagnosticCode.STAR_EXPANSION_MULTI_RELATION_FROM,
                                    "result column " + rc + " is a star expansion (SELECT *); "
                                            + "FROM source could not be determined", rc));
                        }
                        recordBuildWarning(Diagnostic.warn(
                                DiagnosticCode.STAR_EXPANSION_MULTI_RELATION_FROM,
                                "result column " + rc + " is a star expansion (SELECT *) "
                                        + "over a parenthesized / nested join — left "
                                        + "unexpanded (catalog-less degrade)", rc));
                        String mrStarQualifier = null;
                        if (rc.getExpr() != null && rc.getExpr().getObjectOperand() != null) {
                            mrStarQualifier = rc.getExpr().getObjectOperand().getTableString();
                        }
                        String mrStarName = (mrStarQualifier != null && !mrStarQualifier.isEmpty())
                                ? mrStarQualifier + ".*" : "*";
                        out.add(new OutputColumn(mrStarName, /*derived=*/ false,
                                /*aggregate=*/ false,
                                Collections.<ColumnRef>emptyList(),
                                /*windowSpec=*/ null));
                        continue;
                    }
                    case NON_BASE_TABLE_RELATION:
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_NON_BASE_TABLE,
                                "result column " + rc + " is a star expansion (SELECT *); "
                                        + (exp.detail != null ? exp.detail
                                                : "FROM source must be a base table"), rc));
                    case QUALIFIER_NOT_FOUND:
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_QUALIFIER_NOT_FOUND,
                                "result column " + rc + " (qualified star "
                                        + (exp.qualifier == null ? "?" : exp.qualifier)
                                        + ".*) does not match any FROM-clause relation", rc));
                    case QUALIFIER_AMBIGUOUS:
                        // Slice 59: 2+ FROM relations have the same
                        // effective alias. Real SQL never reaches this
                        // unless rejectDuplicateAliases:~5621 (case-
                        // sensitive) allowed a case-only collision.
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_QUALIFIER_AMBIGUOUS,
                                "result column " + rc + " (qualified star "
                                        + (exp.qualifier == null ? "?" : exp.qualifier)
                                        + ".*) is ambiguous: "
                                        + (exp.detail != null ? exp.detail
                                                : "multiple FROM-clause relations match"), rc));
                    case NO_CATALOG_OR_UNKNOWN_TABLE: {
                        // GSP R6 degrade (star-expansion-no-catalog-degrade.md):
                        // a catalog-less SELECT * / t.* cannot be expanded to
                        // real column names, but the join structure is fixed by
                        // the FROM / ON clauses and does NOT depend on star
                        // expansion. Rather than discarding the whole statement
                        // graph (relations + join graph + scope), DEGRADE:
                        // record a non-fatal warning and emit the star as an
                        // UNEXPANDED MARKER output column (no sources — never
                        // fabricate column names), then continue the build.
                        //
                        // Catalog-present expansion is unaffected (it returns
                        // EXPANDED above). Synthetic bodies (scalar / set-op
                        // branch / predicate) are caught earlier as
                        // SYNTHETIC_BODY_CONTEXT and stay fatal, so set-op
                        // column-count parity is never relaxed by this degrade.
                        // Mirrors the NATURAL (NATURAL_CATALOG_REQUIRED) and
                        // USING (COLUMN_BINDING_NON_EXACT) catalog-less degrades.
                        String relationLabel;
                        if (exp.qualifier != null && !exp.qualifier.isEmpty()) {
                            relationLabel = exp.qualifier;
                        } else if (exp.detail != null && !exp.detail.isEmpty()) {
                            relationLabel = exp.detail;
                        } else {
                            relationLabel = "the FROM relation";
                        }
                        recordBuildWarning(Diagnostic.warn(
                                DiagnosticCode.STAR_EXPANSION_NO_CATALOG,
                                "result column " + rc + " is a star expansion (SELECT *); "
                                        + "requires catalog with column declarations for "
                                        + relationLabel
                                        + " — left unexpanded (catalog-less degrade)", rc));
                        // Unexpanded-star marker: the star's own text (`*` or
                        // `t.*`), no sources. Derived=false so the empty-source
                        // RESULT_COLUMN_NO_COLUMN_REFS guard does not apply
                        // (that guard targets derived no-ref expressions).
                        String starQualifier = null;
                        if (rc.getExpr() != null && rc.getExpr().getObjectOperand() != null) {
                            starQualifier = rc.getExpr().getObjectOperand().getTableString();
                        }
                        String starName = (starQualifier != null && !starQualifier.isEmpty())
                                ? starQualifier + ".*" : "*";
                        out.add(new OutputColumn(starName, /*derived=*/ false,
                                /*aggregate=*/ false,
                                Collections.<ColumnRef>emptyList(),
                                /*windowSpec=*/ null));
                        continue;
                    }
                    case EXPLICIT_CTE_COLUMN_LIST_DEFERRED:
                        // Slice 103 lifted the explicit-CTE-column-list
                        // deferral: the SELECT-side CTE walker now runs
                        // the slice-102 rename helper, so the in-scope
                        // map publishes the renamed columns and
                        // expandSingleRelation returns EXPANDED instead
                        // of falling into this arm. The case is kept
                        // declared-but-unreached for API stability and
                        // exhaustive-switch coverage (slice 71/72/82/86
                        // /95/96/97/98/99/100/101/102 precedent). If a
                        // future call path re-introduces the kind, the
                        // throw still fires with a faithful diagnostic.
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_EXPLICIT_CTE_COLUMN_LIST,
                                "result column " + rc + " is a star expansion (SELECT *); "
                                        + (exp.detail != null ? exp.detail
                                                : "star expansion through an explicit CTE column list is deferred to a future slice"), rc));
                    case NO_INSCOPE_RELATION_COLUMNS:
                        // Slice 60: builder invariant failure — a CTE
                        // or FROM-subquery body was not registered in
                        // the provider's in-scope-relation-columns map
                        // before this consumer ran. User SQL cannot
                        // reach this kind under normal build()
                        // execution; reaching it indicates a missing
                        // call site is not narrowing the provider
                        // before invoking buildOutputColumns.
                        throw new SemanticIRBuildException(
                                Diagnostic.error(DiagnosticCode.STAR_EXPANSION_NO_INSCOPE_RELATION_COLUMNS,
                                "result column " + rc + " is a star expansion (SELECT *); "
                                        + (exp.detail != null ? exp.detail
                                                : "in-scope CTE/subquery column map is empty for this relation (builder invariant failure)"), rc));
                    // No `default`: switch is intentionally exhaustive
                    // over StarExpansionKind. The post-switch throw
                    // below is the actual runtime guard if a future
                    // enum value is added without updating this
                    // switch.
                }
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.STAR_EXPANSION_UNHANDLED_KIND,
                        "result column " + rc + " is a star expansion (SELECT *); "
                                + "unhandled StarExpansionKind=" + exp.kind, rc));
            }
            // Top-level scalar subquery in projection (slice 11). When the
            // caller permits it (allowScalarProjectionSubqueries=true), the
            // outer caller has already extracted the inner SELECT as its
            // own statement via extractScalarSubqueriesAsStatements; here
            // we just construct the OutputColumn shell with empty sources
            // and let emitLineageForStatement wire the
            // STATEMENT_OUTPUT → STATEMENT_OUTPUT edge.
            if (type == EExpressionType.subquery_t) {
                if (!allowScalarProjectionSubqueries) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.NESTED_SCALAR_SUBQUERY_IN_PROJECTION,
                            "nested scalar subquery in projection (inside another "
                                    + "scalar subquery body or FROM-clause subquery body) "
                                    + "is not supported yet", rc));
                }
                String alias = rc.getColumnAlias();
                if (alias == null || alias.isEmpty()) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.SCALAR_SUBQUERY_ALIAS_REQUIRED,
                            "scalar subquery projection must have an alias", rc));
                }
                out.add(new OutputColumn(alias, /*derived=*/ true,
                        /*aggregate=*/ false,
                        Collections.<ColumnRef>emptyList(),
                        /*windowSpec=*/ null));
                continue;
            }
            // Slice 13: detect top-level window function before deep scans
            // so the embedded-window rejecter can identity-skip the
            // legitimate top-level window function call.
            boolean topLevelWindow = isTopLevelWindowProjection(rc.getExpr());
            // Slice 33: detect Oracle / MSSQL plain WITHIN-GROUP-only
            // aggregate at the projection root. When admitted, the root
            // function carries fn.windowDef!=null but is the legitimate
            // top-level form — the slice-13 invariant rejecters
            // (isTopLevelWindowProjection / rejectWindowFunctions /
            // rejectEmbeddedWindowFunction) keep their strict wd!=null
            // check unchanged; this local boolean is what discriminates
            // them. The admission helper combines:
            //   - isWithinGroupOnlyWindowDef (no OVER, no KEEP DENSE_RANK)
            //   - explicit EDbVendor gate (Oracle / MSSQL only — mirrors
            //     the slice-31 predicate-body gate at line ~3860)
            //   - function name in AGGREGATE_FUNCTION_NAMES whitelist
            // PG / Snowflake / DB2 / SparkSQL produce direct fn.withinGroup
            // (windowDef=null) and never reach this admission helper; their
            // top-level WG already builds today via the normal aggregate
            // path (with pre-existing AGGREGATION_MISMATCH divergence on
            // the dlineage projector side that slice 33 deliberately does
            // not address — see the slice-30 rationale on
            // ORDER_BY_WITHIN_GROUP_AGGREGATE_NAMES for why a name-only
            // projector override is unsafe across the dual-form aggregates
            // SUM / MIN / MAX / LISTAGG that have OVER (PARTITION BY)
            // forms on Oracle).
            TFunctionCall slice33RootFn = rc.getExpr().getExpressionType() == EExpressionType.function_t
                    ? rc.getExpr().getFunctionCall()
                    : null;
            boolean slice33TopLevelWG = isAdmittedTopLevelWithinGroupAggregate(
                    slice33RootFn, select.dbvendor);
            boolean slice35TopLevelDirectWG = isAdmittedTopLevelDirectWithinGroupAggregate(
                    slice33RootFn, select.dbvendor);
            // Reject scalar subqueries embedded inside larger projection
            // expressions (slice 11 + codex round-2 MUST 7). Catches both
            // top-level subquery_t hidden under a wrapping expression
            // (e.g. UPPER((SELECT ...)) — though the parser sometimes
            // strips the wrap) AND predicate subqueries that don't surface
            // as subquery_t (EXISTS in projection, IN-projection).
            // Slice 9/10 deep-scan pattern.
            rejectEmbeddedSubqueryInProjection(rc.getExpr(), rc);
            // Slice 13: reject window functions embedded inside larger
            // projection expressions (e.g. `ROW_NUMBER() OVER (...) + 1`,
            // `UPPER(LAG(...) OVER (...))`). The helper identity-skips
            // the legitimate top-level window function call when
            // `topLevelWindow=true`.
            //
            // Slice 33: also identity-skip the top-level WITHIN-GROUP-only
            // aggregate root. TFunctionCall.acceptChildren preVisits the
            // root function (TFunctionCall.java:1528), so without
            // skipTopLevel=true the visitor would catch the slice-33-
            // admitted root (fn.windowDef!=null). Embedded WG inside
            // UPPER / CASE still rejects because the visitor finds a
            // non-root function whose windowDef!=null — the inner
            // function is not == identity to the root, so the skip
            // doesn't apply.
            rejectEmbeddedWindowFunction(rc.getExpr(), rc, topLevelWindow || slice33TopLevelWG);
            // Slice 33/35 fast path: WITHIN-GROUP-only aggregate — fall
            // through to the normal aggregate path. Oracle / MSSQL use the
            // windowDef attachment (slice 33); PostgreSQL direct attachment
            // is already on the normal aggregate path but shares the
            // unaliased expression-text fallback below (slice 35).
            if (slice33TopLevelWG || slice35TopLevelDirectWG) {
                // No special branch — fall through to the plain aggregate
                // / expression / column path below.
            } else if (topLevelWindow) {
                if (!allowWindowProjection) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_AS_PROJECTION_NOT_SUPPORTED,
                            "result column " + rc + " is a window function; not supported "
                                    + "inside this body (e.g. scalar-subquery body)", rc));
                }
                out.add(buildWindowOutputColumn(rc, select, provider));
                continue;
            }
            // Plain aggregate / expression / column path. The
            // rejectWindowFunctions call below is now defensive — the
            // top-level-window fast path above intercepts legitimate
            // windows, and rejectEmbeddedWindowFunction caught any
            // descendant window functions.
            //
            // Slice 33: skip rejectWindowFunctions for the slice-33-
            // admitted shape. The root function has windowDef!=null but
            // is the legitimate top-level form; calling
            // rejectWindowFunctions here would reject it via the
            // strict-wd!=null check (kept unchanged per slice-31
            // invariant).
            if (!slice33TopLevelWG && !slice35TopLevelDirectWG) {
                rejectWindowFunctions(rc.getExpr(), rc);
            }
            boolean derived = (type != EExpressionType.simple_object_name_t);
            boolean aggregate = isAggregateFunction(rc.getExpr());
            // Slice 28: FILTER-aware collector excludes column refs inside
            // FILTER (WHERE ...) subtrees so OutputColumn.sources matches
            // dlineage's lineage-relationship view (FILTER predicate refs
            // absent from fdd / fdr).
            // Slice 31: also excludes column refs inside Oracle / MSSQL
            // {@code fn.windowDef.withinGroup} so plain WITHIN GROUP
            // aggregates emit sources from function args only. Defense-
            // in-depth here: the slice-31 lift only admits Oracle / MSSQL
            // plain WITHIN GROUP at the unaliased predicate-body
            // short-circuit (line ~5216) — the strict
            // {@link #rejectWindowFunctions} call above keeps top-level
            // windowDef-bearing projections rejected outside the
            // predicate-body context, so this collector reduces to the
            // slice-28 FILTER-only variant in practice today.
            List<ColumnRef> sources = collectColumnRefsExcludingFilterAndWithinGroupClauses(rc, provider);
            if (sources.isEmpty() && !aggregate) {
                boolean canonicalConstant = isConstantExpression(rc.getExpr());
                boolean inScalarBody = isScalarSyntheticName(stmtName);
                if (canonicalConstant && !inScalarBody) {
                    // Slice 61: constant-only projection lift. Predicate
                    // bodies still use the earlier slice-23 short-circuit,
                    // while scalar-subquery bodies intentionally keep the
                    // slice-11/20 invariant that scalar body projections
                    // must have a column source.
                    String alias = rc.getColumnAlias();
                    String name = (alias != null && !alias.isEmpty())
                            ? alias
                            : rc.getExpr().toString();
                    out.add(new OutputColumn(name, /*derived=*/ true,
                            /*aggregate=*/ false,
                            Collections.<ColumnRef>emptyList(),
                            /*windowSpec=*/ null));
                    continue;
                }
                // Join-structure degrade (GSP R6): a plain unqualified column
                // that could not be bound under a fully-built join graph (its
                // COLUMN_BINDING_NON_EXACT was downgraded to a warning by
                // rejectNonExactBindings) is emitted with no sources rather
                // than aborting the whole analysis. The join structure is
                // intact; only this column's source side is unknown without a
                // catalog (honest: not fabricated). Both anchors qualify:
                //   - a JOIN ... USING merged-key scope, OR
                //   - an explicit ON / CROSS / comma join graph
                //     (hasJoinStructureAnchor()).
                // A qualified miss never reaches here — it already aborted
                // fatally in the column collector (rejectNonExactBindings with
                // allRejectsUnqualified=false). Derived expressions
                // (e.g. UPPER('lit')) keep the !derived guard and stay fatal,
                // as do scalar bodies (they must carry a column source).
                if (!derived && !inScalarBody
                        && (provider.getUsingScope().hasMergedKeys()
                                || provider.hasJoinStructureAnchor())) {
                    String alias = rc.getColumnAlias();
                    String name = (alias != null && !alias.isEmpty())
                            ? alias
                            : rc.getExpr().toString();
                    out.add(new OutputColumn(name, /*derived=*/ false,
                            /*aggregate=*/ false,
                            Collections.<ColumnRef>emptyList(),
                            /*windowSpec=*/ null));
                    continue;
                }
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.RESULT_COLUMN_NO_COLUMN_REFS,
                        "result column " + rc + " has no column references "
                                + "and is not a constant or aggregate expression "
                                + "(e.g. UPPER('literal') / CAST / current_date - not supported yet)", rc));
            }
            // Slice 34: when the slice-33-admitted top-level Oracle / MSSQL
            // WITHIN-GROUP-only aggregate has no alias, fall back to the
            // parser's expression text. {@code effectiveOutputName} would
            // throw "neither alias nor column name" because
            // {@code function_t} returns "" from getColumnNameOnly().
            // Probe-verified that {@code rc.getExpr().toString()} byte-
            // matches dlineage's <select_list> column name attribute on
            // Oracle / MSSQL for this shape, so canonical SELECT-edge
            // outputName remains in parity with no projector change.
            // Gated tightly on slice33TopLevelWG so unrelated unaliased
            // shapes (function calls / CASE / expressions outside the
            // slice-33 admit set) keep failing loudly via
            // effectiveOutputName until each is probed and admitted
            // explicitly. See Slice34Test.
            String name;
            if (slice33TopLevelWG || slice35TopLevelDirectWG) {
                String alias = rc.getColumnAlias();
                name = (alias != null && !alias.isEmpty())
                        ? alias
                        : rc.getExpr().toString();
            } else {
                name = effectiveOutputName(rc);
            }
            out.add(new OutputColumn(name, derived, aggregate, sources, /*windowSpec=*/ null));
        }
        return out;
    }

    /**
     * Reject scalar subqueries embedded inside larger projection
     * expressions (slice 11). Catches:
     *
     * <ul>
     *   <li>{@code SELECT UPPER((SELECT MAX(salary) AS m FROM employees))
     *       AS x FROM ...} — scalar nested inside a function call.</li>
     *   <li>{@code SELECT EXISTS (SELECT 1 FROM employees) AS has_emp
     *       FROM ...} — EXISTS doesn't surface as
     *       {@link EExpressionType#subquery_t} but carries
     *       {@code getSubQuery() != null} (slice-9 round-3 lesson).</li>
     *   <li>Other in-expression subqueries that
     *       {@link #collectColumnRefs} would otherwise descend into.</li>
     * </ul>
     *
     * <p>Only top-level {@code subquery_t} projections are extracted as
     * separate statements (handled in
     * {@link #extractScalarSubqueriesAsStatements}); embedded subqueries
     * remain rejected because the IR doesn't yet model the "expression
     * over subquery result" shape.
     */
    private static void rejectEmbeddedSubqueryInProjection(TExpression expr, TResultColumn rc) {
        if (expr == null) return;
        final boolean[] found = {false};
        expr.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TExpression e) {
                if (found[0]) return;
                if (e.getExpressionType() == EExpressionType.subquery_t
                        || e.getSubQuery() != null) {
                    found[0] = true;
                }
            }
        });
        if (!found[0]) {
            // Top-level expression itself may carry a subquery (e.g. EXISTS
            // at the projection root, where rc.getExpr() is exists_t with
            // non-null getSubQuery() but is NOT subquery_t — so the
            // top-level subquery_t branch above didn't extract it).
            if (expr.getExpressionType() != EExpressionType.subquery_t
                    && expr.getSubQuery() != null) {
                found[0] = true;
            }
        }
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.RESULT_COLUMN_SCALAR_SUBQUERY_EMBEDDED,
                    "result column " + rc + " contains a scalar subquery embedded "
                            + "in a larger projection expression; not supported yet "
                            + "(only top-level scalar subquery projections are extracted)", rc));
        }
    }

    /**
     * Detect whether an expression contains an aggregate function call
     * anywhere in its subtree. Slice 6 uses a name whitelist via
     * {@link #AGGREGATE_FUNCTION_NAMES}. Walking recursively means
     * {@code SUM(salary) + 1} and {@code COUNT(*) + 1} are both classified
     * as aggregate (and thus permitted with empty sources via
     * {@link #buildOutputColumns}). Wrapped in a helper so slice 7+ can
     * swap in deeper detection (e.g. vendor-specific function classification
     * on TFunctionCall) without touching call sites.
     *
     * <p>Note on aggregate literals like {@code COUNT(1)} or {@code SUM(1)}:
     * the visitor finds no column refs, so {@code sources=[]}. Slice 6
     * permits these as aggregates with no lineage edges; consumers must
     * read {@link OutputColumn#isAggregate()} to know the value is
     * row-collapsing without column lineage.
     */
    private static boolean isAggregateFunction(TExpression expr) {
        if (expr == null) return false;
        // Slice 13: short-circuit for top-level window function. The
        // upstream `rejectEmbeddedWindowFunction` has already rejected any
        // embedded window functions, but this short-circuit ensures
        // `AVG(salary) OVER (...)` is never classified as an aggregate
        // even if it somehow slips past the upstream guard.
        //
        // Slice 31: discriminate WITHIN-GROUP-only windowDef (Oracle /
        // MSSQL plain WITHIN GROUP attachment without OVER) so
        // `LISTAGG(x.id, ',') WITHIN GROUP (ORDER BY x.region)` stays
        // classified as an aggregate. Uses {@link #isWindowDefBearingFunction}
        // — only this check and {@link #containsWindowFunction} are
        // lifted; every other slice-13 invariant rejecter is unchanged.
        if (expr.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall rootFn = expr.getFunctionCall();
            // Slice 42: hypothetical-set ordered-set aggregate root
            // (Oracle / MSSQL {@code RANK(100) WITHIN GROUP (ORDER BY x)})
            // — short-circuit aggregate=true. The shape predicate
            // {@link #isHypotheticalSetWithinGroupCall} requires WITHIN-
            // GROUP-only windowDef AND a name in
            // {@link #HYPOTHETICAL_SET_AGGREGATE_NAMES}, so PG direct
            // attachment ({@code fn.getWindowDef()==null}) and OVER-
            // bearing forms cannot fire it.
            if (isHypotheticalSetWithinGroupCall(rootFn)) {
                return true;
            }
            if (isWindowDefBearingFunction(rootFn)) {
                return false;
            }
        }
        final boolean[] found = {false};
        expr.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                // Slice 13 codex round-2 SHOULD 3: skip windowed function
                // calls inside the visitor too, defensively. Upstream
                // rejection should already have fired, but this removes
                // overlap risk for `sum/count/avg`.
                //
                // Slice 31: same WITHIN-GROUP-only carve-out as the root
                // short-circuit above so an Oracle / MSSQL plain WITHIN
                // GROUP aggregate nested inside CASE/UPPER (slice-27
                // admit) is still picked up as aggregate.
                //
                // Slice 42: hypothetical-set ordered-set aggregate carve-
                // out — descendants matching the shape predicate count
                // as aggregate (defense-in-depth; the slice-13 embedded-
                // window rejecter already fires on inner WG-bearing
                // calls, so this branch is mostly unreachable today).
                if (isHypotheticalSetWithinGroupCall(fn)) {
                    found[0] = true;
                    return;
                }
                if (isWindowDefBearingFunction(fn)) return;
                if (fn.getFunctionName() == null) return;
                String name = fn.getFunctionName().toString();
                if (name == null || name.isEmpty()) return;
                if (AGGREGATE_FUNCTION_NAMES.contains(name.toLowerCase(Locale.ROOT))) {
                    found[0] = true;
                }
            }
        });
        // The root expression itself is not visited by acceptChildren — only
        // its children. If the root is the function call (the common case
        // for `SUM(salary)` with no enclosing arithmetic), check it too.
        if (!found[0] && expr.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = expr.getFunctionCall();
            if (fn != null && fn.getFunctionName() != null) {
                String name = fn.getFunctionName().toString();
                if (name != null && !name.isEmpty()
                        && AGGREGATE_FUNCTION_NAMES.contains(name.toLowerCase(Locale.ROOT))) {
                    found[0] = true;
                }
            }
        }
        return found[0];
    }

    /**
     * Reject window-function projections like {@code AVG(salary) OVER (...)}.
     * In the GSP AST these still parse as {@code function_t} with a
     * non-null {@code TFunctionCall.getWindowDef()}, but their semantics
     * are row-preserving (analytic), not row-collapsing (aggregate). Slice
     * 6 owns plain GROUP BY aggregation only; window functions deserve
     * their own slice.
     */
    private static void rejectWindowFunctions(TExpression expr, TResultColumn rc) {
        if (expr == null) return;
        final boolean[] found = {false};
        expr.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (fn.getWindowDef() != null) found[0] = true;
            }
        });
        if (!found[0] && expr.getExpressionType() == EExpressionType.function_t) {
            TFunctionCall fn = expr.getFunctionCall();
            if (fn != null && fn.getWindowDef() != null) found[0] = true;
        }
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_USED_NOT_SUPPORTED,
                    "result column " + rc + " uses a window function (OVER (...)); not supported yet", rc));
        }
    }

    /**
     * Slice 13: detect whether the projection root is a top-level
     * window-function call. Returns {@code true} iff
     * {@code expr.getExpressionType() == function_t} AND the function
     * call carries a non-null {@code TWindowDef}. The result drives
     * three things in {@link #buildOutputColumns}:
     *
     * <ul>
     *   <li>The {@code skipTopLevel} arg to
     *       {@link #rejectEmbeddedWindowFunction} so the legitimate
     *       top-level window call is identity-skipped during embedded
     *       detection.</li>
     *   <li>The fast-path dispatch into
     *       {@link #buildWindowOutputColumn} when window projections
     *       are allowed.</li>
     *   <li>The scalar-body / future-context rejection when window
     *       projections are forbidden in the surrounding context
     *       (slice-13 {@code allowWindowProjection=false}).</li>
     * </ul>
     */
    private static boolean isTopLevelWindowProjection(TExpression expr) {
        if (expr == null) return false;
        if (expr.getExpressionType() != EExpressionType.function_t) return false;
        TFunctionCall fn = expr.getFunctionCall();
        return fn != null && fn.getWindowDef() != null;
    }

    /**
     * Slice 13: reject window functions embedded inside a larger
     * projection expression (mirrors slice 11's
     * {@link #rejectEmbeddedSubqueryInProjection}). The {@code skipTopLevel}
     * flag is set when the caller has identified
     * {@code expr} as a legitimate top-level window-function projection
     * — without identity-skipping that exact {@code TFunctionCall} the
     * visitor would reject every valid top-level window.
     *
     * <p>Visitor-only (no post-visitor fallback): unlike
     * {@code subquery_t} which can be wrapped in expression types that
     * do not surface as {@code subquery_t}, a window function is always
     * reachable through {@code TExpression.acceptChildren} →
     * {@code TFunctionCall.preVisit}. Codex round-3 MUST 1.
     */
    private static void rejectEmbeddedWindowFunction(TExpression expr,
                                                     TResultColumn rc,
                                                     boolean skipTopLevel) {
        if (expr == null) return;
        final TFunctionCall topLevelFn =
                skipTopLevel
                        && expr.getExpressionType() == EExpressionType.function_t
                        ? expr.getFunctionCall()
                        : null;
        final boolean[] found = {false};
        expr.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (fn == topLevelFn) return;            // identity-skip
                if (fn.getWindowDef() != null) found[0] = true;
            }
        });
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_EMBEDDED_NOT_SUPPORTED,
                    "result column " + rc + " contains a window function embedded "
                            + "in a larger projection expression; not supported yet "
                            + "(only top-level window-function projections are supported)", rc));
        }
    }

    /**
     * Lower-cased function names accepted as window functions in slice 13.
     * Includes every name in {@link #AGGREGATE_FUNCTION_NAMES} (aggregates
     * can be windowed: {@code SUM(...) OVER (...)}, {@code AVG(...) OVER (...)},
     * etc.) plus the analytic-only names. New analytic functions must be
     * added here explicitly to avoid silent acceptance of an unfamiliar
     * window function whose semantics the slice does not yet model.
     *
     * <p>Slice 30 exception: {@code mode} is added to
     * {@link #AGGREGATE_FUNCTION_NAMES} for the WITHIN GROUP path but
     * REMOVED from this allowlist via {@code s.remove("mode")} below —
     * {@code mode()} has no documented window form in any GSP-supported
     * vendor and the explicit removal keeps {@code mode() OVER (...)}
     * (which the PostgreSQL parser accepts) rejected by
     * {@code buildWindowOutputColumn}.
     */
    private static final Set<String> WINDOW_FUNCTION_NAMES;
    static {
        Set<String> s = new HashSet<>();
        // Aggregate names that can be windowed.
        s.addAll(AGGREGATE_FUNCTION_NAMES);
        // Slice 30: mode is an ordered-set-only aggregate; remove from the
        // window allowlist (it was added to AGGREGATE_FUNCTION_NAMES for the
        // WITHIN GROUP path but never appears as a real window function in
        // any GSP-supported vendor — see Slice30Test.pgModeOverStillRejected
        // AtOuterProjection for the lock-in).
        s.remove("mode");
        // Analytic-only window functions.
        s.add("row_number");
        s.add("rank");
        s.add("dense_rank");
        s.add("lag");
        s.add("lead");
        s.add("ntile");
        s.add("first_value");
        s.add("last_value");
        s.add("percent_rank");
        s.add("cume_dist");
        s.add("nth_value");
        WINDOW_FUNCTION_NAMES = Collections.unmodifiableSet(s);
    }

    /**
     * Slice 13: build an {@link OutputColumn} for a top-level
     * window-function projection. Caller must have already verified
     * {@link #isTopLevelWindowProjection(TExpression)}, run the
     * {@link #rejectEmbeddedSubqueryInProjection} and
     * {@link #rejectEmbeddedWindowFunction} guards, and confirmed the
     * surrounding body permits window projections (i.e., the
     * {@code !allowWindowProjection} fast-path in
     * {@link #buildOutputColumns} did not fire).
     *
     * <p>The constructed {@link OutputColumn} carries:
     * <ul>
     *   <li>{@code derived = true} (window functions are computed)</li>
     *   <li>{@code aggregate = false} (window functions are
     *       row-preserving — see slice-13 §14)</li>
     *   <li>{@code sources} = column refs from the function args only
     *       (PARTITION BY / OVER ORDER BY refs are excluded so that
     *       canonical SELECT lineage matches dlineage's
     *       function-arg-only SELECT BFS)</li>
     *   <li>{@code windowSpec = WindowSpec(partitionRefs, orderRefs, frame)}
     *       (slice 22 — frame may be null when the SQL has no
     *       {@code ROWS}/{@code RANGE}/{@code GROUPS BETWEEN ...} clause)</li>
     * </ul>
     */
    private static OutputColumn buildWindowOutputColumn(TResultColumn rc,
                                                        TSelectSqlStatement enclosingSelect,
                                                        NameBindingProvider provider) {
        TFunctionCall fn = rc.getExpr().getFunctionCall();
        TWindowDef wd = fn.getWindowDef();

        // 1. Function-name allowlist (codex round-1 MUST 3).
        String fnName = fn.getFunctionName() == null ? null : fn.getFunctionName().toString();
        if (fnName == null || !WINDOW_FUNCTION_NAMES.contains(fnName.toLowerCase(Locale.ROOT))) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_UNSUPPORTED,
                    "result column " + rc + " uses unsupported window function '"
                            + fnName + "'; supported names are " + WINDOW_FUNCTION_NAMES, rc));
        }

        // 2. Reject vendor-specific function-level surfaces (codex round-1 MUST 4).
        if (fn.getFilterClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FILTER_NOT_SUPPORTED,
                    "result column " + rc + " uses FILTER (WHERE ...) on a "
                            + "window function; not supported yet", rc));
        }
        if (fn.getWithinGroup() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_WITHIN_GROUP_NOT_SUPPORTED,
                    "result column " + rc + " uses WITHIN GROUP on a "
                            + "window function; not supported yet", rc));
        }
        if (fn.getOrderByList() != null && fn.getOrderByList().size() > 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_LEVEL_ORDER_BY_NOT_SUPPORTED,
                    "result column " + rc + " uses function-level ORDER BY "
                            + "(LISTAGG-style); not supported yet", rc));
        }
        if (fn.getSortClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FUNCTION_LEVEL_SORT_NOT_SUPPORTED,
                    "result column " + rc + " uses function-level SORT clause; "
                            + "not supported yet", rc));
        }

        // 3. Reject vendor-specific window-def surfaces (codex round-1 MUSTs 5, 7).
        if (wd.getName() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_NAMED_WINDOW_DECLARATION_NOT_SUPPORTED,
                    "result column " + rc + " declares a named window "
                            + "(WINDOW name AS); not supported yet", rc));
        }
        if (wd.getReferenceName() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_NAMED_WINDOW_REFERENCE_NOT_SUPPORTED,
                    "result column " + rc + " references a named window via "
                            + "OVER name; not supported yet", rc));
        }
        if (wd.getWithinGroup() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_WITHIN_GROUP_INSIDE_PROJECTION_NOT_SUPPORTED,
                    "result column " + rc + " uses WITHIN GROUP inside the "
                            + "OVER clause; not supported yet", rc));
        }
        if (wd.getKeepDenseRankClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_KEEP_DENSE_RANK_NOT_SUPPORTED,
                    "result column " + rc + " uses KEEP DENSE_RANK FIRST/LAST; "
                            + "not supported yet", rc));
        }
        if (wd.getDistributeBy() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_DISTRIBUTE_BY_NOT_SUPPORTED,
                    "result column " + rc + " uses Hive DISTRIBUTE BY in window; "
                            + "not supported yet", rc));
        }
        if (wd.getClusterBy() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_CLUSTER_BY_NOT_SUPPORTED,
                    "result column " + rc + " uses Hive CLUSTER BY in window; "
                            + "not supported yet", rc));
        }
        if (wd.getSortBy() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_SORT_BY_NOT_SUPPORTED,
                    "result column " + rc + " uses Hive SORT BY in window; "
                            + "not supported yet", rc));
        }
        // Slice 22: frame clauses are now built into WindowSpec.frame; the
        // slice-13 wholesale rejection is gone. Frame build happens AFTER
        // empty-OVER reject below so a frame-only OVER (...) fails on
        // empty-OVER first (the more user-tuned error message).

        // 4. Reject empty OVER () (slice-13 boundary; dlineage parity —
        // empty OVER () is byte-identical to a plain aggregate in the XML).
        TPartitionClause pc = wd.getPartitionClause();
        TOrderBy ob = wd.getOrderBy();
        boolean hasPartitionBy = pc != null
                && pc.getExpressionList() != null
                && pc.getExpressionList().size() > 0;
        boolean hasOverOrderBy = ob != null
                && ob.getItems() != null
                && ob.getItems().size() > 0;
        if (!hasPartitionBy && !hasOverOrderBy) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_EMPTY_OVER_NOT_SUPPORTED,
                    "result column " + rc + " uses empty OVER (); not supported yet "
                            + "(dlineage XML cannot discriminate from a plain aggregate)", rc));
        }

        // 5. Reject Hive PARTITION BY ... SORT (...).
        if (pc != null && pc.getSortedColumns() != null && pc.getSortedColumns().size() > 0) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_SORT_NOT_SUPPORTED,
                    "result column " + rc + " uses Hive PARTITION BY ... SORT (...); "
                            + "not supported yet", rc));
        }

        // 6. Build PARTITION BY refs.
        List<ColumnRef> partitionRefs = hasPartitionBy
                ? buildWindowPartitionRefs(pc, rc, enclosingSelect, provider)
                : new ArrayList<ColumnRef>();

        // 7. Build OVER ORDER BY refs.
        List<ColumnRef> orderRefs = hasOverOrderBy
                ? buildWindowOrderRefs(ob, rc, enclosingSelect, provider)
                : new ArrayList<ColumnRef>();

        // 8. Build frame (slice 22). Null when the SQL has no ROWS/RANGE/
        // GROUPS clause inside OVER (...).
        WindowFrame frame = wd.getWindowFrame() == null
                ? null
                : buildWindowFrame(wd.getWindowFrame(), rc);

        // 9. Build sources from args only — PARTITION BY / OVER ORDER BY
        // refs must NOT leak into OutputColumn.sources because canonical
        // SELECT lineage on the dlineage side only walks fdd edges
        // (function args), not fdr edges (PARTITION BY / OVER ORDER BY).
        List<ColumnRef> sources = (fn.getArgs() == null || fn.getArgs().size() == 0)
                ? new ArrayList<ColumnRef>()
                : collectColumnRefs(fn.getArgs(), provider);

        // 10. Construct OutputColumn. aggregate=false ALWAYS for window
        // functions (row-preserving). The OutputColumn ctor enforces
        // the windowSpec!=null AND aggregate=false invariant.
        String name = effectiveOutputName(rc);
        return new OutputColumn(name, /*derived=*/ true, /*aggregate=*/ false,
                sources, new WindowSpec(partitionRefs, orderRefs, frame));
    }

    /**
     * Slice 22: build a {@link WindowFrame} from a parser
     * {@link TWindowFrame}. Frame information is presentation-only
     * (dlineage XML harvests no frame data — see
     * {@code DataFlowAnalyzer.java:20558-20575}); this helper captures
     * the surface shape into the IR for governance consumers without
     * touching the canonical lineage model.
     *
     * <p>Direct field access via {@link TWindowFrame#getStartBoundary()} /
     * {@link TWindowFrame#getEndBoundary()}; visitors are NOT used because
     * {@code TWindowFrame.acceptChildren()} doesn't recurse into the
     * boundaries (codex round-1 SHOULD 3).
     *
     * <p>Order of guards (codex round-2 SHOULD 2): EXCLUDE first so the
     * error message is tuned to the actual surface; then null-guard the
     * boundary type (defensive — current parsers always pass it); then
     * map the {@code EBoundaryType} via an exhaustive switch
     * (slice-14 process lesson #17 — no catch-all); then check the
     * {@code boundaryNumber} expression type and reject non-constant
     * offsets (codex round-1 SHOULD 1 — PG {@code simple_object_name_t}
     * and ANSI {@code parenthesis_t} are reachable).
     *
     * <p>Null guards on the frame's {@link ELimitRowType} and
     * {@code startBoundary} fields are defensive / forward-compat: every
     * vendor grammar surveyed (codex round-4 NOTE 1) passes these
     * arguments together when constructing a {@code TWindowFrame}, so the
     * guards are unexercised by current parsers but protect against
     * future parser drift.
     */
    private static WindowFrame buildWindowFrame(TWindowFrame wf, TResultColumn rc) {
        // Defensive null guards (codex round-2 MUST 2; codex round-4
        // SHOULD 1 — labelled DEFENSIVE / FORWARD-COMPAT).
        if (wf.getLimitRowType() == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FRAME_NULL_LIMIT_ROW_TYPE,
                    "result column " + rc + " has a frame with null limitRowType "
                            + "(forward-compat / unexpected parser shape); not supported", rc));
        }
        if (wf.getStartBoundary() == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FRAME_NULL_START_BOUNDARY,
                    "result column " + rc + " has a frame with null start boundary "
                            + "(forward-compat / unexpected parser shape); not supported", rc));
        }
        WindowFrame.Unit unit = mapFrameUnit(wf.getLimitRowType());
        FrameBound start = buildFrameBound(wf.getStartBoundary(), rc, /*end=*/ false);
        FrameBound end = wf.getEndBoundary() == null
                ? null
                : buildFrameBound(wf.getEndBoundary(), rc, /*end=*/ true);
        return new WindowFrame(unit, start, end);
    }

    /**
     * Slice 22: map the parser's {@link ELimitRowType} to the IR's
     * {@link WindowFrame.Unit}. Exhaustive switch (slice-14 process
     * lesson #17 — no catch-all); a future enum addition fails closed.
     */
    private static WindowFrame.Unit mapFrameUnit(ELimitRowType type) {
        switch (type) {
            case Rows:
                return WindowFrame.Unit.ROWS;
            case Range:
                return WindowFrame.Unit.RANGE;
            case Groups:
                return WindowFrame.Unit.GROUPS;
            default:
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_FRAME_UNSUPPORTED_LIMIT_ROW_TYPE,
                        "unsupported window frame limitRowType: " + type, null));
        }
    }

    /**
     * Slice 22: build a {@link FrameBound} from a parser
     * {@link TWindowFrameBoundary}. The {@code end} parameter is for
     * error messages only (start vs end disambiguation).
     *
     * <p>Per-bound check order: EXCLUDE → boundaryType-null → kind switch
     * → boundaryNumber shape (codex round-2 SHOULD 2 + slice-22 invariant).
     */
    private static FrameBound buildFrameBound(TWindowFrameBoundary boundary,
                                              TResultColumn rc,
                                              boolean end) {
        String which = end ? "end" : "start";

        // (a) EXCLUDE first (codex round-1 MUST 2 + Netezza probe).
        // Netezza populates getExclusionClause() on the END boundary for
        // EXCLUDE CURRENT ROW / GROUP / TIES / NO OTHERS; rejecting here
        // surfaces the unsupported clause with a tuned message rather
        // than letting the offset-shape check fire on an unrelated
        // surface.
        if (boundary.getExclusionClause() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FRAME_EXCLUDE_NOT_SUPPORTED,
                    "result column " + rc + " has a frame " + which
                            + " boundary with EXCLUDE clause "
                            + "(EXCLUDE CURRENT ROW / GROUP / TIES / NO OTHERS); "
                            + "not supported yet", rc));
        }

        // (b) Null-guard the boundary type (defensive).
        if (boundary.getBoundaryType() == null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_FRAME_NULL_BOUNDARY_TYPE,
                    "result column " + rc + " has a frame " + which
                            + " boundary with null boundaryType "
                            + "(forward-compat / unexpected parser shape); not supported", rc));
        }

        // (c) Map the kind via exhaustive switch.
        FrameBound.Kind kind = mapBoundaryKind(boundary.getBoundaryType());

        // (d) Capture the optional offset literal. Reject non-constant
        // offsets (codex round-1 SHOULD 1 + slice-22 PG/ANSI probe — PG
        // accepts simple_object_name_t (column ROWS BETWEEN x PRECEDING ...),
        // ANSI accepts parenthesis_t ((x+1))).
        String offsetLiteral = null;
        TExpression offsetExpr = boundary.getBoundaryNumber();
        if (offsetExpr != null) {
            // Slice-22 codex impl-review SHOULD 1: when the kind forbids
            // an offset (UNBOUNDED_*/CURRENT_ROW), reject with
            // SemanticIRBuildException so the failure stays inside the
            // builder's error contract — without this guard, a parser
            // surfacing a stray boundary number on CURRENT_ROW would
            // escape as IllegalArgumentException from
            // FrameBound's ctor.
            boolean offsetAllowed = (kind == FrameBound.Kind.PRECEDING
                    || kind == FrameBound.Kind.FOLLOWING);
            if (!offsetAllowed) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_FRAME_UNEXPECTED_OFFSET,
                        "result column " + rc + " has a frame " + which
                                + " boundary of kind " + kind
                                + " carrying an unexpected offset '"
                                + offsetExpr + "' (forward-compat / "
                                + "unexpected parser shape); not supported", rc));
            }
            EExpressionType offsetType = offsetExpr.getExpressionType();
            if (offsetType != EExpressionType.simple_constant_t) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_FRAME_OFFSET_NON_CONSTANT,
                        "result column " + rc + " has a frame " + which
                                + " offset that is not a simple constant "
                                + "(got " + offsetType + " '" + offsetExpr + "'); "
                                + "not supported yet", rc));
            }
            offsetLiteral = offsetExpr.toString();
        }
        return new FrameBound(kind, offsetLiteral);
    }

    /**
     * Slice 22: map the parser's {@link EBoundaryType} to the IR's
     * {@link FrameBound.Kind}. Exhaustive switch (slice-14 process
     * lesson #17).
     */
    private static FrameBound.Kind mapBoundaryKind(EBoundaryType type) {
        switch (type) {
            case ebtUnboundedPreceding:
                return FrameBound.Kind.UNBOUNDED_PRECEDING;
            case ebtUnboundedFollowing:
                return FrameBound.Kind.UNBOUNDED_FOLLOWING;
            case ebtCurrentRow:
                return FrameBound.Kind.CURRENT_ROW;
            case ebtPreceding:
                return FrameBound.Kind.PRECEDING;
            case ebtFollowing:
                return FrameBound.Kind.FOLLOWING;
            default:
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_FRAME_UNSUPPORTED_BOUNDARY_TYPE,
                        "unsupported frame boundary type: " + type, null));
        }
    }

    /**
     * Slice 13: build the PARTITION BY ref list. Every item must be a
     * physical column reference ({@code simple_object_name_t} resolving
     * via the provider to {@code EXACT_MATCH}). Other shapes are
     * rejected with a tuned message — slice-9 / slice-13
     * rejection-over-silent-loss.
     */
    private static List<ColumnRef> buildWindowPartitionRefs(TPartitionClause pc,
                                                             TResultColumn rc,
                                                             TSelectSqlStatement enclosingSelect,
                                                             NameBindingProvider provider) {
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        TExpressionList list = pc.getExpressionList();
        for (int i = 0; i < list.size(); i++) {
            TExpression item = list.getExpression(i);
            EExpressionType t = item.getExpressionType();
            if (t == EExpressionType.simple_constant_t) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_LITERAL,
                        "result column " + rc + " has PARTITION BY literal '"
                                + item + "'; not supported yet", rc));
            }
            if (t == EExpressionType.subquery_t || item.getSubQuery() != null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_SUBQUERY,
                        "result column " + rc + " has PARTITION BY containing "
                                + "a subquery; not supported yet", rc));
            }
            if (t == EExpressionType.function_t) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_AGGREGATE,
                        "result column " + rc + " has PARTITION BY containing "
                                + "a function call '" + item + "'; not supported yet", rc));
            }
            if (t != EExpressionType.simple_object_name_t) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_UNKNOWN_REFERENCE,
                        "result column " + rc + " has PARTITION BY using an "
                                + "unsupported expression shape (" + t + "): " + item, rc));
            }
            // Defensive: reject if the parser/resolver has retyped this
            // item as a projection alias. Current Oracle parsers leave
            // PARTITION BY <alias> as dbType=column even for projection
            // aliases; this guard fires for vendors that may behave
            // differently. The slice-19 discriminator below catches the
            // Oracle case where dbType stays "column" but the binding
            // came from the schema-less inferred-from-usage fallback.
            TObjectName on = item.getObjectOperand();
            if (on != null && on.getDbObjectType() == EDbObjectType.column_alias) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_PROJECTION_ALIAS,
                        "result column " + rc + " has PARTITION BY referencing "
                                + "a projection alias '" + item + "'; not supported yet", rc));
            }
            // Slice 19: alias-bound discriminator. Reject when the
            // resolver's binding lacks definite FROM-scope evidence and
            // the name matches a calculated SELECT-list alias of the
            // enclosing SELECT. Without schema metadata the resolver
            // cannot tell alias from real column; rejection-over-silent-
            // guess matches the slice-9/-10/-13 invariant.
            if (on != null && provider.isCalculatedProjectionAliasFallback(on, enclosingSelect)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_CALCULATED_ALIAS,
                        "result column " + rc + " has PARTITION BY referencing a "
                                + "SELECT-list alias on a calculated expression ('" + item
                                + "'); not supported yet — requires schema metadata to "
                                + "discriminate alias from base column", rc));
            }
            // Resolve the column ref through the provider. EXACT_MATCH is
            // required (slice-1 fail-fast invariant); collectColumnRefs
            // does the heavy lifting and rejects anything else.
            List<ColumnRef> built = collectColumnRefs(item, provider);
            if (built.isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_PARTITION_BY_ITEM_UNUSABLE,
                        "result column " + rc + " has PARTITION BY item '"
                                + item + "' with no resolvable column refs", rc));
            }
            refs.addAll(built);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 13: build the OVER ORDER BY ref list. Every sort key must
     * be a physical column reference (mirrors slice-9 outer ORDER BY
     * rejection set). Ordinals, projection aliases, expressions,
     * subqueries, window functions, and SIBLINGS / RESET WHEN are
     * rejected with tuned messages.
     */
    private static List<ColumnRef> buildWindowOrderRefs(TOrderBy ob,
                                                         TResultColumn rc,
                                                         TSelectSqlStatement enclosingSelect,
                                                         NameBindingProvider provider) {
        // Slice-13 codex impl-review MUST 2: defense in depth, mirror outer
        // ORDER BY's slice-9 SIBLINGS / RESET WHEN guards.
        if (ob.isSiblings()) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_SIBLINGS_NOT_SUPPORTED,
                    "result column " + rc + " has OVER ORDER BY SIBLINGS; not supported yet "
                            + "(Oracle hierarchical-query syntax in window OVER clause)", rc));
        }
        if (ob.getResetWhenCondition() != null) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_RESET_WHEN_NOT_SUPPORTED,
                    "result column " + rc + " has OVER ORDER BY ... RESET WHEN; not supported yet "
                            + "(Teradata window-style restart)", rc));
        }
        LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        TOrderByItemList items = ob.getItems();
        for (int i = 0; i < items.size(); i++) {
            TOrderByItem item = items.getOrderByItem(i);
            TExpression key = item.getSortKey();
            if (key == null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_NULL_SORT_KEY,
                        "result column " + rc + " has OVER ORDER BY item with "
                                + "null sort key", rc));
            }
            EExpressionType t = key.getExpressionType();
            if (t == EExpressionType.simple_constant_t) {
                // Catches both ordinal sort keys and string-literal sort keys.
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_LITERAL,
                        "result column " + rc + " has OVER ORDER BY literal/ordinal '"
                                + key + "'; not supported yet", rc));
            }
            if (t == EExpressionType.subquery_t || key.getSubQuery() != null) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_SUBQUERY,
                        "result column " + rc + " has OVER ORDER BY containing a "
                                + "subquery; not supported yet", rc));
            }
            if (t == EExpressionType.function_t) {
                TFunctionCall innerFn = key.getFunctionCall();
                if (innerFn != null && innerFn.getWindowDef() != null) {
                    throw new SemanticIRBuildException(
                            Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_WINDOW_FUNCTION,
                            "result column " + rc + " has OVER ORDER BY containing a "
                                    + "window function; not supported yet", rc));
                }
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_AGGREGATE,
                        "result column " + rc + " has OVER ORDER BY containing a "
                                + "function call '" + key + "'; not supported yet", rc));
            }
            if (t != EExpressionType.simple_object_name_t) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_UNKNOWN_REFERENCE,
                        "result column " + rc + " has OVER ORDER BY using an "
                                + "unsupported expression shape (" + t + "): " + key, rc));
            }
            // NOTE: Oracle's parser DOES retype OVER ORDER BY refs to
            // column_alias when they match a SELECT alias (mirrors
            // slice-9 outer ORDER BY behaviour). The defensive
            // column_alias guard from PARTITION BY is intentionally
            // omitted here — `collectColumnRefs` already skips
            // column_alias-typed nodes, and the empty-refs guard below
            // catches the resulting unresolvable item with a clear
            // message. Outer ORDER BY aliases use the same path.
            //
            // Slice 19: defensive symmetry with PARTITION BY. A future
            // vendor whose parser does NOT retype OVER ORDER BY refs to
            // column_alias would land here as `simple_object_name_t`
            // with an inferred-from-usage resolution; the discriminator
            // catches that case before collectColumnRefs descends. As of
            // slice 19, every supported vendor retypes (probe in
            // §14.21), so this branch is unreachable in current tests
            // — kept for forward-compat.
            TObjectName on = key.getObjectOperand();
            if (on != null && provider.isCalculatedProjectionAliasFallback(on, enclosingSelect)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_CALCULATED_ALIAS,
                        "result column " + rc + " has OVER ORDER BY referencing a "
                                + "SELECT-list alias on a calculated expression ('" + key
                                + "'); not supported yet — requires schema metadata to "
                                + "discriminate alias from base column", rc));
            }
            List<ColumnRef> built = collectColumnRefs(key, provider);
            if (built.isEmpty()) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WINDOW_OVER_ORDER_BY_ITEM_UNUSABLE,
                        "result column " + rc + " has OVER ORDER BY item '"
                                + key + "' with no resolvable column refs", rc));
            }
            refs.addAll(built);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Slice 13: reject any window function ({@code FUNC(...) OVER (...)})
     * appearing in a {@link TParseTreeNode} subtree. Used by the
     * WHERE / GROUP BY / JOIN ON guards before the visitor would
     * otherwise descend into the OVER clause and leak PARTITION BY /
     * OVER ORDER BY refs into the wrong column-ref bucket. Mirrors
     * {@link #rejectHavingWindowFunction} (slice 10) and
     * {@link #rejectOrderByWindowFunction} (slice 9).
     */
    /**
     * Slice 85 — admit RETURNING (PG / Oracle) and OUTPUT (SQL Server)
     * projections on INSERT / UPDATE / DELETE statements. Returns the
     * list of {@link OutputColumn}s for the {@code returningColumns}
     * slot on the DML's {@link StatementGraph}, and appends one
     * {@link LineageEdge} per source column ref to {@code lineage}:
     * <pre>
     *   from = LineageRef.statementOutput(dmlIdx, returningColumns[i].name)
     *   to   = LineageRef.tableColumn(targetQName, sourceColumnName)
     * </pre>
     * (consumer ← producer direction; mirrors slice-78 INSERT's
     * {@code target ← source} convention but with the DML's own output
     * as the consumer and the target table's column as the producer.)
     *
     * <p>At most one of {@code ret} and {@code out} is non-null. When
     * both are null (no RETURNING / OUTPUT clause), returns an empty
     * list and emits no edges.
     *
     * <p>Reject ordering (codex round-3 Q2 BLOCKING fix — two-pass):
     * <ol>
     *   <li>Pass 1, statement-level: empty projection list →
     *       {@link DiagnosticCode#RETURNING_EMPTY_PROJECTION}.</li>
     *   <li>Pass 1.5, OUTPUT-only DML-kind / pseudo-table mismatch scan:
     *       INSERT with any {@code DELETED.col} →
     *       {@link DiagnosticCode#OUTPUT_DELETED_ON_INSERT_NOT_SUPPORTED};
     *       DELETE with any {@code INSERTED.col} →
     *       {@link DiagnosticCode#OUTPUT_INSERTED_ON_DELETE_NOT_SUPPORTED}.
     *       Fires on the first matching column regardless of position.</li>
     *   <li>Pass 2, per-column (in SQL declaration order):
     *     <ul>
     *       <li>{@code *} → {@link DiagnosticCode#RETURNING_STAR_NOT_SUPPORTED}</li>
     *       <li>any subquery →
     *           {@link DiagnosticCode#RETURNING_HAS_SUBQUERY_NOT_SUPPORTED}</li>
     *       <li>any window function over a base ref → reuses
     *           {@link DiagnosticCode#CLAUSE_WINDOW_FUNCTION_LEAK} via
     *           {@link #rejectWindowFunctionInScope}</li>
     *       <li>any aggregate function over a base ref →
     *           {@link DiagnosticCode#RETURNING_HAS_AGGREGATE_NOT_SUPPORTED}
     *           (aggregates are not legal in DML RETURNING / OUTPUT per
     *           spec — fires defensively when parser admits them)</li>
     *     </ul>
     *   </li>
     * </ol>
     *
     * <p>OUTPUT_INTO_NOT_SUPPORTED is rejected at the caller (before
     * any FROM walk / SET / WHERE processing) so multi-violation shapes
     * route through the cheaper structural code first.
     *
     * @param ret RETURNING clause; null when this DML uses OUTPUT or
     *            no projection at all
     * @param out OUTPUT clause; null when this DML uses RETURNING or
     *            no projection at all
     * @param dmlKind "INSERT" / "UPDATE" / "DELETE" — only relevant for
     *                the pseudo-table mismatch scan (UPDATE admits both
     *                INSERTED and DELETED; INSERT admits only INSERTED;
     *                DELETE admits only DELETED)
     * @param targetQName the target table's qualified name; used as the
     *                    {@code to} endpoint of every emitted LineageEdge
     * @param fromSideAliasToStmtIndex slice-123 alias&rarr;statement-index map
     *                    keyed lowercase for SUBQUERY-kind FROM-side relations
     *                    that own a producing {@link StatementGraph}
     *                    (slice-84 USING-(SELECT) sub / slice-106 USING-CTE on
     *                    DELETE; slice-82/83/105 FROM-subquery / CTE-as-relation
     *                    on UPDATE). When a RETURNING/OUTPUT source ref resolves
     *                    to such a relation, the emitted edge's {@code to}
     *                    endpoint is the producer's
     *                    {@code STATEMENT_OUTPUT(idx, col)} rather than the
     *                    fictitious {@code TABLE_COLUMN(<alias>, col)}. Pass an
     *                    empty map to keep the slice-85 TABLE_COLUMN behaviour
     *                    (INSERT, MERGE)
     * @param provider name-binding provider; same instance used for
     *                 SET RHS / WHERE / JOIN ON ref collection so
     *                 FROM-side relation refs (slice-82 joined UPDATE,
     *                 slice-84 joined DELETE) resolve correctly
     * @param dmlIdx the DML statement's position in
     *               {@link SemanticProgram#getStatements()}; used as the
     *               {@code statementIndex} on the {@code from} endpoint
     * @param lineage in/out: collected edges are appended here
     * @param anchor parse-tree anchor for diagnostics
     */
    private static List<OutputColumn> buildReturningColumns(
            TReturningClause ret,
            TOutputClause out,
            String dmlKind,
            String targetQName,
            String targetAlias,
            TTable targetTable,
            List<RelationSource> fromSideRelations,
            Map<String, Integer> fromSideAliasToStmtIndex,
            NameBindingProvider provider,
            int dmlIdx,
            List<LineageEdge> lineage,
            TParseTreeNode anchor) {
        if (ret == null && out == null) {
            return Collections.emptyList();
        }
        // Oracle host-variable form: `RETURNING col INTO :v` — AST shape
        // is columnValueList + variableList populated, resultExprList null.
        // Slice 88 admits it: extract column exprs from columnValueList,
        // discard variableList (bind sinks have no semantic IR relevance).
        // The still-unsupported degenerate case (resultExprList=null AND
        // columnValueList=null) keeps RETURNING_INTO_NOT_SUPPORTED so the
        // code stays declared-not-unreachable per the slice-71/72/82 precedent.
        boolean isOracleInto = (ret != null && ret.getResultExprList() == null
                && ret.getColumnValueList() != null);
        if (ret != null && ret.getResultExprList() == null && !isOracleInto) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.RETURNING_INTO_NOT_SUPPORTED,
                    "Oracle `RETURNING col INTO :host_var` with no column list "
                            + "is not supported; admits the standard INTO form only",
                    anchor));
        }
        // Extract the source column list.
        TResultColumnList items = null;
        TExpressionList intoExprs = null;
        if (isOracleInto) {
            intoExprs = ret.getColumnValueList();
        } else if (ret != null) {
            items = ret.getResultExprList();
        } else {
            items = out.getSelectItemList();
        }
        int colCount = isOracleInto
                ? (intoExprs == null ? 0 : intoExprs.size())
                : (items == null ? 0 : items.size());
        // Pass 1: empty projection list (defensive — the parser usually
        // refuses to produce an empty list, but a malformed AST should
        // surface a clean diagnostic).
        if (colCount == 0) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.RETURNING_EMPTY_PROJECTION,
                    dmlKind + (ret != null ? " RETURNING" : " OUTPUT")
                            + " clause has no projection columns",
                    anchor));
        }
        // Pass 1.5: OUTPUT-only DML-kind / pseudo-table mismatch scan
        // (codex round-1 Q4 BLOCKING — deep-walk all TObjectName leaves
        // so compound exprs like `OUTPUT INSERTED.a + DELETED.b` also
        // reject deterministically). The parser sets pseudoTableType
        // on the fieldAttr for SIMPLE column references but leaves
        // it null on the leaf TObjectNames inside compound expressions;
        // we detect those by checking the objectToken spelling against
        // "INSERTED" / "DELETED".
        // The Oracle INTO path skips this scan (no INSERTED/DELETED pseudo-tables).
        if (out != null && !isOracleInto) {
            final String targetAliasFinal = targetAlias;
            final String targetQNameFinal = targetQName;
            final List<RelationSource> relsFinal = fromSideRelations;
            for (int i = 0; i < items.size(); i++) {
                TResultColumn rc = items.getResultColumn(i);
                final String dmlKindFinal = dmlKind;
                final TResultColumn rcFinal = rc;
                scanOutputPseudoTableLeaves(rc.getExpr(),
                        new TParseTreeVisitor() {
                            @Override
                            public void preVisit(TObjectName n) {
                                EPseudoTableType pt = detectPseudoTable(
                                        n, rcFinal, targetAliasFinal,
                                        targetQNameFinal, relsFinal);
                                if (pt == EPseudoTableType.deleted
                                        && "INSERT".equals(dmlKindFinal)) {
                                    throw new SemanticIRBuildException(Diagnostic.error(
                                            DiagnosticCode.OUTPUT_DELETED_ON_INSERT_NOT_SUPPORTED,
                                            "INSERT OUTPUT references DELETED."
                                                    + bareColumnNameOf(n)
                                                    + " but there is no deleted-row "
                                                    + "image on INSERT; use INSERTED.* instead",
                                            rcFinal));
                                }
                                if (pt == EPseudoTableType.inserted
                                        && "DELETE".equals(dmlKindFinal)) {
                                    throw new SemanticIRBuildException(Diagnostic.error(
                                            DiagnosticCode.OUTPUT_INSERTED_ON_DELETE_NOT_SUPPORTED,
                                            "DELETE OUTPUT references INSERTED."
                                                    + bareColumnNameOf(n)
                                                    + " but there is no inserted-row "
                                                    + "image on DELETE; use DELETED.* instead",
                                            rcFinal));
                                }
                            }
                        });
            }
        }
        // Pass 2: per-column. Build OutputColumns, emit edges.
        List<OutputColumn> outputs = new ArrayList<>(colCount);
        for (int i = 0; i < colCount; i++) {
            // For the Oracle INTO path rc is null — the INTO column list
            // carries bare expressions, not TResultColumn wrappers.
            TResultColumn rc = isOracleInto ? null
                    : items.getResultColumn(i);
            TExpression expr = isOracleInto
                    ? intoExprs.getExpression(i)
                    : (rc == null ? null : rc.getExpr());
            if (expr == null) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.RESULT_COLUMN_NULL_EXPRESSION,
                        dmlKind + (ret != null ? " RETURNING" : " OUTPUT")
                                + " column #" + (i + 1) + " has no expression",
                        rc != null ? rc : anchor));
            }
            // Slice 98 — MSSQL MERGE OUTPUT `$action` pseudo-column.
            // Returns the merge action string per output row ('INSERT' /
            // 'UPDATE' / 'DELETE') — it has no underlying base column.
            // Detected case-insensitively because parser tokens come out
            // as `$action` regardless of how the user wrote it; bracketed
            // `[$action]` is a delimited identifier and is NOT treated
            // as the pseudo-column (codex Q1 confirmed YES — slice-98
            // detection is literal text equality on the un-bracketed
            // spelling). The check is gated on dmlKind="MERGE" so
            // INSERT/UPDATE/DELETE OUTPUT (slice 85) are unaffected.
            if ("MERGE".equals(dmlKind)
                    && isMergeActionPseudoColumn(expr)) {
                String actionName = (rc != null && rc.getColumnAlias() != null
                        && !rc.getColumnAlias().toString().isEmpty())
                        ? rc.getColumnAlias().toString()
                        : expr.toString();
                outputs.add(new OutputColumn(actionName,
                        /*derived=*/ true,
                        /*aggregate=*/ false,
                        Collections.<ColumnRef>emptyList()));
                // No LineageEdge — $action has no producer column.
                continue;
            }
            // STAR check — bare `RETURNING *` parses as
            // simple_object_name_t with toString="*"; qualified star
            // forms like `RETURNING t.*` / `OUTPUT inserted.*` /
            // `OUTPUT deleted.*` parse as simple_object_name_t with
            // partToken (and getColumnNameOnly()) equal to "*"
            // (codex round-4 BLOCKING fix).
            // Slice 90: standard RETURNING star attempts catalog-backed expansion.
            // Slice 99: MSSQL MERGE OUTPUT INSERTED.* / DELETED.*
            //   attempts catalog-backed expansion against the target table.
            // Oracle INTO star and non-MERGE OUTPUT star (and bare /
            // target-alias / source-alias MERGE OUTPUT star) remain rejected.
            if (isStarReference(expr)) {
                if (isOracleInto) {
                    // Oracle INTO star: keep existing reject.
                    throw new SemanticIRBuildException(Diagnostic.error(
                            DiagnosticCode.RETURNING_STAR_NOT_SUPPORTED,
                            dmlKind + " RETURNING INTO * star expansion "
                                    + "is not yet supported; use explicit column names",
                            rc != null ? rc : expr));
                }
                if (out != null) {
                    // Slice 99 / Slice 100 — MSSQL pseudo-table
                    // OUTPUT INSERTED.* / DELETED.* routes to catalog-
                    // backed expansion against the target table. The
                    // pseudo-table discriminator is the parser-set
                    // EPseudoTableType.inserted / .deleted flag on the
                    // star qualifier (slice-85 primary discriminator).
                    // Slice 99 lifted the reject for dmlKind="MERGE";
                    // slice 100 generalises to all DML kinds (INSERT /
                    // UPDATE / DELETE) — the parser sets pseudoTableType
                    // identically on non-MERGE OUTPUT stars, and Pass
                    // 1.5 has already rejected cross-direction
                    // mismatches (INSERT OUTPUT DELETED.* /
                    // DELETE OUTPUT INSERTED.*) before this branch.
                    // OUTPUT *, t.*, s.* (no pseudo-table marker) still
                    // reject — they're either ambiguous (bare *) or
                    // refer to non-pseudo relations.
                    EPseudoTableType pseudo = EPseudoTableType.none;
                    TObjectName starObj = expr.getObjectOperand();
                    if (starObj != null
                            && starObj.getPseudoTableType() != null) {
                        pseudo = starObj.getPseudoTableType();
                    }
                    if (pseudo == EPseudoTableType.inserted
                            || pseudo == EPseudoTableType.deleted) {
                        expandOutputPseudoTableStarColumns(
                                expr, rc, pseudo, dmlKind,
                                targetTable, targetQName,
                                provider, dmlIdx, lineage, anchor, outputs);
                        continue;
                    }
                    // Non-pseudo OUTPUT star (bare *, target-alias *,
                    // source-alias *): keep existing reject.
                    throw new SemanticIRBuildException(Diagnostic.error(
                            DiagnosticCode.RETURNING_STAR_NOT_SUPPORTED,
                            dmlKind + " OUTPUT * star expansion is not "
                                    + "yet supported; use explicit column names",
                            rc != null ? rc : expr));
                }
                // Standard RETURNING star: attempt catalog-backed expansion.
                // On success, the helper adds to `outputs` and `lineage` in place
                // and we `continue` past the normal single-column build below.
                expandReturningStarColumns(
                        expr, rc, dmlKind, targetTable, targetAlias, targetQName,
                        fromSideRelations, provider, dmlIdx, lineage, anchor, outputs);
                continue;
            }
            // Subquery / aggregate / window — guarded by !isOracleInto
            // because Oracle's INTO column list forbids nested queries and
            // aggregates at the grammar level; skip the checks to avoid
            // false rejects on unusual AST shapes.
            if (!isOracleInto) {
                if (containsAnySubqueryExpression(expr)) {
                    throw new SemanticIRBuildException(Diagnostic.error(
                            DiagnosticCode.RETURNING_HAS_SUBQUERY_NOT_SUPPORTED,
                            dmlKind + " " + (ret != null ? "RETURNING" : "OUTPUT")
                                    + " column #" + (i + 1) + " contains a subquery; "
                                    + "slice 85 admits scalar expressions over base columns only",
                            rc));
                }
                rejectWindowFunctionInScope(expr,
                        dmlKind + " " + (ret != null ? "RETURNING" : "OUTPUT"));
                if (isAggregateFunction(expr)) {
                    throw new SemanticIRBuildException(Diagnostic.error(
                            DiagnosticCode.RETURNING_HAS_AGGREGATE_NOT_SUPPORTED,
                            dmlKind + " " + (ret != null ? "RETURNING" : "OUTPUT")
                                    + " column #" + (i + 1) + " contains an aggregate "
                                    + "function; aggregates are not legal in DML "
                                    + "RETURNING / OUTPUT projection per SQL spec",
                            rc));
                }
            }
            // Name extraction.
            // INTO path: no alias possible, use expr.toString() directly.
            // Normal path: use the projection-side helper which strips
            // INSERTED./DELETED. qualifiers on OUTPUT pseudo-table refs.
            String outName = isOracleInto
                    ? expr.toString()
                    : returningOutputName(rc, expr, dmlKind, ret != null);
            if (outName == null || outName.isEmpty()) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.RESULT_COLUMN_NO_NAME,
                        dmlKind + " RETURNING INTO column #" + (i + 1)
                                + " has no resolvable name",
                        anchor));
            }
            // Source collection via manual walker (slice-89 fix registers
            // RETURNING refs in Resolver2 allColumnReferences for DELETE/UPDATE;
            // INSERT RETURNING lacks an InsertScope so Resolver2 path is partial).
            // rc=null is safe for the INTO path: synthRefForReturningLeaf
            // only dereferences rc inside the `if (isOutput)` guard,
            // which is false for all RETURNING (non-OUTPUT) paths.
            List<ColumnRef> sources = collectReturningSourceRefs(
                    expr, rc, out != null && !isOracleInto,
                    targetAlias, targetQName, fromSideRelations);
            boolean derived = expr.getExpressionType()
                    != EExpressionType.simple_object_name_t;
            outputs.add(new OutputColumn(outName, derived,
                    /*aggregate=*/ false, sources));
            // Emit one LineageEdge per source column ref.
            // Edge direction (consumer ← producer; slice-85 convention
            // documented on getReturningColumns()):
            //   from = STATEMENT_OUTPUT(dmlIdx, returningName)
            //   to   = TABLE_COLUMN(<producer-qualified-name>, <colName>)
            // The producer qualified-name is:
            //   - target table qname when the source ref's relationAlias
            //     is INSERTED / DELETED (MSSQL OUTPUT pseudo-tables both
            //     ultimately reference the physical target row)
            //   - target table qname when the source ref's relationAlias
            //     matches the target alias
            //   - FROM-side relation's binding qualifiedName when the
            //     ref's relationAlias matches a FROM-side relation
            //   - the relationAlias verbatim otherwise (defensive)
            for (ColumnRef src : sources) {
                String srcCol = src.getColumnName();
                if (srcCol == null || srcCol.isEmpty()) continue;
                String alias = src.getRelationAlias();
                // Slice 123 — when the source ref binds to a SUBQUERY-kind
                // FROM-side relation that owns its own producing
                // StatementGraph (slice-84 USING-(SELECT) sub / slice-106
                // USING-CTE on DELETE; slice-82/83/105 FROM-subquery or
                // CTE-as-relation on UPDATE), emit the canonical cross-stmt
                // STATEMENT_OUTPUT → STATEMENT_OUTPUT edge into the producer
                // rather than the fictitious TABLE_COLUMN(<alias>, col).
                // Base TABLE-kind FROM-side relations (slice-82/84 joined
                // RETURNING, pinned by Slice85Test §B/§C) and target /
                // INSERTED / DELETED refs fall through to the slice-85
                // TABLE_COLUMN path via resolveReturningEdgeTarget.
                Integer subIdx = returningSubquerySourceIndex(alias,
                        targetAlias, targetQName, fromSideRelations,
                        fromSideAliasToStmtIndex);
                if (subIdx != null) {
                    lineage.add(new LineageEdge(
                            LineageRef.statementOutput(dmlIdx, outName),
                            LineageRef.statementOutput(subIdx, srcCol)));
                } else {
                    String to = resolveReturningEdgeTarget(alias,
                            targetAlias, targetQName, fromSideRelations);
                    lineage.add(new LineageEdge(
                            LineageRef.statementOutput(dmlIdx, outName),
                            LineageRef.tableColumn(to, srcCol)));
                }
            }
        }
        return outputs;
    }

    /**
     * Slice 98 helper — true when an expression is the MSSQL MERGE
     * OUTPUT {@code $action} pseudo-column.
     *
     * <p>Detection rule: the expression is a
     * {@code simple_object_name_t} and its {@code toString()} matches
     * {@code "$action"} case-insensitively. Bracketed delimited
     * identifiers like {@code [$action]} parse with the brackets in
     * the token string, so they are NOT matched here — a column
     * actually named {@code $action} (delimited) is treated as a
     * normal target column, not the pseudo-column (codex Q1 confirmed).
     *
     * <p>Caller gates the check on {@code dmlKind == "MERGE"} so the
     * slice-85 INSERT/UPDATE/DELETE OUTPUT path is unaffected.
     */
    private static boolean isMergeActionPseudoColumn(TExpression expr) {
        if (expr == null) return false;
        if (expr.getExpressionType() != EExpressionType.simple_object_name_t) {
            return false;
        }
        String text = expr.toString();
        return text != null && "$action".equalsIgnoreCase(text);
    }

    /**
     * Slice 85 helper — true when an expression is a star reference
     * (bare {@code *} or qualified {@code t.*} / {@code INSERTED.*} /
     * {@code DELETED.*}). Covers both forms: bare star has
     * {@code expr.toString()=="*"}; qualified star is a
     * simple_object_name_t whose leaf TObjectName has
     * {@code partToken=="*"} (codex round-4 BLOCKING fix —
     * qualified stars were previously slipping past the bare-only
     * check and producing bogus ColumnRefs).
     */
    private static boolean isStarReference(TExpression expr) {
        if (expr == null) return false;
        if (expr.getExpressionType() != EExpressionType.simple_object_name_t) {
            return false;
        }
        if ("*".equals(expr.toString())) return true;
        TObjectName n = expr.getObjectOperand();
        if (n == null) return false;
        if (n.getPartToken() != null && "*".equals(n.getPartToken().toString())) {
            return true;
        }
        String colOnly = n.getColumnNameOnly();
        return colOnly != null && "*".equals(colOnly);
    }

    /**
     * Slice 90 helper — expand a standard {@code RETURNING *} /
     * {@code RETURNING t.*} star into per-column
     * {@link OutputColumn} entries using catalog metadata from
     * {@link #lookupRelationColumnNames(TTable, NameBindingProvider)}.
     *
     * <p>Called only for standard PG/Oracle RETURNING (not MSSQL OUTPUT,
     * not Oracle INTO). Adds expanded columns to {@code outputs} and
     * matching {@link LineageEdge}s to {@code lineage} in place.
     *
     * <p>Qualifier matching mirrors Slice 59 SELECT star semantics:
     * alias-only — the qualifier must equal the target's effective alias,
     * not the schema-qualified name. For INSERT without alias the effective
     * alias is the bare table name, so {@code RETURNING employees.*} matches
     * {@code INSERT INTO schema.employees}.
     *
     * <p>Throws {@link SemanticIRBuildException} on any failure:
     * <ul>
     *   <li>{@link DiagnosticCode#RETURNING_STAR_CATALOG_REQUIRED} — no
     *       catalog metadata available for the target relation;</li>
     *   <li>{@link DiagnosticCode#RETURNING_STAR_NOT_SUPPORTED} — the
     *       qualifier matches a FROM-side relation alias but FROM-side
     *       star expansion is deferred to a future slice;</li>
     *   <li>{@link DiagnosticCode#RETURNING_STAR_QUALIFIER_UNKNOWN} — the
     *       qualifier does not match the target alias or any FROM-side
     *       relation alias.</li>
     * </ul>
     */
    private static void expandReturningStarColumns(
            TExpression expr,
            TResultColumn rc,
            String dmlKind,
            TTable targetTable,
            String targetAlias,
            String targetQName,
            List<RelationSource> fromSideRelations,
            NameBindingProvider provider,
            int dmlIdx,
            List<LineageEdge> lineage,
            TParseTreeNode anchor,
            List<OutputColumn> outputs) {
        // Extract qualifier: empty for bare `*`, table/alias name for `t.*`.
        String qualifier = "";
        TObjectName n = (expr != null) ? expr.getObjectOperand() : null;
        if (n != null) {
            String q = n.getTableString();
            if (q != null && !q.isEmpty()) qualifier = q;
        }
        // Rendered star form for use in diagnostic messages.
        String starForm = qualifier.isEmpty() ? "*" : qualifier + ".*";
        // Determine which relation to expand.
        // Rule (Slice 90, mirrors Slice 59 correlation-name semantics):
        //   effective alias only — bare name without alias counts as alias.
        boolean matchesTarget = qualifier.isEmpty()
                || qualifier.equalsIgnoreCase(targetAlias);
        if (matchesTarget) {
            // Attempt catalog-backed expansion of the target table.
            List<String> cols = lookupRelationColumnNames(targetTable, provider);
            if (cols == null || cols.isEmpty()) {
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.RETURNING_STAR_CATALOG_REQUIRED,
                        dmlKind + " RETURNING " + starForm
                                + " requires catalog metadata for target '"
                                + targetQName + "' to expand; supply a Catalog via "
                                + "SqlSemanticAnalyzer.analyze(sql, vendor, catalog)",
                        rc != null ? rc : anchor));
            }
            for (String colName : cols) {
                ColumnRef ref = new ColumnRef(targetAlias, colName);
                outputs.add(new OutputColumn(colName, /*derived=*/ false,
                        /*aggregate=*/ false, Collections.singletonList(ref)));
                lineage.add(new LineageEdge(
                        LineageRef.statementOutput(dmlIdx, colName),
                        LineageRef.tableColumn(targetQName, colName)));
            }
            return;
        }
        // Qualifier doesn't match target. Check FROM-side relations.
        for (RelationSource rs : fromSideRelations) {
            if (qualifier.equalsIgnoreCase(rs.getAlias())) {
                // Known FROM-side relation, but expansion is deferred.
                throw new SemanticIRBuildException(Diagnostic.error(
                        DiagnosticCode.RETURNING_STAR_NOT_SUPPORTED,
                        dmlKind + " RETURNING " + starForm + " — "
                                + "star expansion for FROM-side/USING relations "
                                + "is deferred to a future slice; use explicit "
                                + "column names for FROM-side RETURNING refs",
                        rc != null ? rc : anchor));
            }
        }
        // Qualifier is truly unknown (doesn't match target or any FROM-side relation).
        throw new SemanticIRBuildException(Diagnostic.error(
                DiagnosticCode.RETURNING_STAR_QUALIFIER_UNKNOWN,
                dmlKind + " RETURNING " + starForm + " — qualifier '"
                        + qualifier + "' does not match the DML target alias '"
                        + targetAlias + "' or any FROM-side relation; "
                        + "use the target's effective alias for RETURNING star expansion",
                rc != null ? rc : anchor));
    }

    /**
     * Slice 99 / Slice 100 helper — expand MSSQL pseudo-table
     * {@code OUTPUT INSERTED.*} / {@code OUTPUT DELETED.*} into
     * per-column {@link OutputColumn} entries using catalog metadata
     * from {@link #lookupRelationColumnNames(TTable, NameBindingProvider)}.
     *
     * <p>Slice 99 originally introduced this helper for MSSQL MERGE
     * OUTPUT. Slice 100 generalised it to all DML kinds (INSERT / UPDATE
     * / DELETE / MERGE): the parser sets {@code pseudoTableType=inserted/deleted}
     * on the star qualifier identically for non-MERGE DML, so the
     * expansion is mechanically the same — only the catalog-missing
     * message text varies by {@code dmlKind} per the slice-80
     * message-text-discrimination contract.
     *
     * <p>Mirrors the slice-90 standard-RETURNING star design with two
     * differences:
     * <ul>
     *   <li>The pseudo-table qualifier ({@code INSERTED} / {@code DELETED})
     *       is normalized to UPPERCASE on
     *       {@link ColumnRef#getRelationAlias()} regardless of the SQL
     *       case, matching slice-85
     *       {@code synthRefForReturningLeaf}'s
     *       {@code new ColumnRef("INSERTED", ...)} convention.</li>
     *   <li>The catalog lookup target is the DML target table (the
     *       pseudo-table rows physically reference target rows), not a
     *       FROM-side relation.</li>
     * </ul>
     *
     * <p>Catalog miss reuses {@link DiagnosticCode#RETURNING_STAR_CATALOG_REQUIRED}
     * (slice-90 code) with a discriminating message text formatted as
     * {@code "<dmlKind> OUTPUT <pseudoLabel>.* requires catalog metadata
     * for target '<qname>' ..."}.
     *
     * <p>Adds expanded columns to {@code outputs} and matching
     * {@link LineageEdge}s to {@code lineage} in place.
     *
     * @param dmlKind one of {@code "INSERT"}, {@code "UPDATE"},
     *                {@code "DELETE"}, {@code "MERGE"} — feeds the
     *                catalog-missing message text only; expansion is
     *                identical regardless of kind because the parser
     *                sets {@code pseudoTableType} on the star qualifier
     *                uniformly.
     */
    private static void expandOutputPseudoTableStarColumns(
            TExpression expr,
            TResultColumn rc,
            EPseudoTableType pseudoTable,
            String dmlKind,
            TTable targetTable,
            String targetQName,
            NameBindingProvider provider,
            int dmlIdx,
            List<LineageEdge> lineage,
            TParseTreeNode anchor,
            List<OutputColumn> outputs) {
        // Slice-85 convention: relationAlias is normalized to UPPERCASE.
        String pseudoLabel = (pseudoTable == EPseudoTableType.inserted)
                ? "INSERTED"
                : "DELETED";
        List<String> cols = lookupRelationColumnNames(targetTable, provider);
        if (cols == null || cols.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.RETURNING_STAR_CATALOG_REQUIRED,
                    dmlKind + " OUTPUT " + pseudoLabel + ".* requires catalog "
                            + "metadata for target '" + targetQName
                            + "' to expand; supply a Catalog via "
                            + "SqlSemanticAnalyzer.analyze(sql, vendor, catalog)",
                    rc != null ? rc : anchor));
        }
        for (String colName : cols) {
            ColumnRef ref = new ColumnRef(pseudoLabel, colName);
            outputs.add(new OutputColumn(colName, /*derived=*/ false,
                    /*aggregate=*/ false, Collections.singletonList(ref)));
            // INSERTED / DELETED both physically reference the target
            // row image; lineage edge target is the target qname.
            lineage.add(new LineageEdge(
                    LineageRef.statementOutput(dmlIdx, colName),
                    LineageRef.tableColumn(targetQName, colName)));
        }
    }

    /**
     * Slice 85 helper — pull the pseudo-table type for an OUTPUT
     * column (SQL Server). Returns {@link EPseudoTableType#none} for
     * RETURNING (PG / Oracle) columns and for OUTPUT columns whose
     * top-level expression doesn't carry an INSERTED / DELETED
     * qualifier. For compound expressions, the parser sets the
     * pseudo-table type on the fieldAttr only for SIMPLE column
     * references; compound shapes must be deep-walked separately
     * via {@link #scanOutputPseudoTableLeaves}.
     */
    private static EPseudoTableType pseudoTableOf(TResultColumn rc) {
        if (rc == null) return EPseudoTableType.none;
        TObjectName fa = rc.getFieldAttr();
        if (fa == null) return EPseudoTableType.none;
        EPseudoTableType pt = fa.getPseudoTableType();
        return (pt == null) ? EPseudoTableType.none : pt;
    }

    /**
     * Slice 85 helper — walk an OUTPUT projection expression and
     * invoke {@code visitor} on every TObjectName leaf for the
     * pseudo-table mismatch scan. Skips function-name TObjectNames
     * via the dbObjectType filter so {@code OUTPUT FUNC(inserted.x)}
     * still surfaces the leaf inserted.x ref.
     */
    private static void scanOutputPseudoTableLeaves(
            TExpression expr, final TParseTreeVisitor visitor) {
        if (expr == null) return;
        // Collect function-name identities first (codex round-2 Q1
        // BLOCKING — dialect-portable structural filter).
        final java.util.Set<TObjectName> fnLeaves =
                collectFunctionNameLeaves(expr);
        // Fast path: leaf simple_object_name_t.
        if (expr.getExpressionType() == EExpressionType.simple_object_name_t) {
            TObjectName n = expr.getObjectOperand();
            if (n != null && !isFunctionNameObjectName(n, fnLeaves)) {
                visitor.preVisit(n);
            }
            return;
        }
        // Compound expression — walk for TObjectName leaves.
        expr.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;
            @Override
            public void preVisit(TSelectSqlStatement s) { nestedSelectDepth++; }
            @Override
            public void postVisit(TSelectSqlStatement s) { nestedSelectDepth--; }
            @Override
            public void preVisit(TObjectName node) {
                if (nestedSelectDepth > 0) return;
                if (isFunctionNameObjectName(node, fnLeaves)) return;
                visitor.preVisit(node);
            }
        });
    }

    /**
     * Slice 85 helper — detect the pseudo-table type (INSERTED /
     * DELETED) for a TObjectName leaf in an OUTPUT projection,
     * honouring both the parser-set fieldAttr.pseudoTableType (for
     * simple leaf refs where the parser ran its qualifier swap) AND
     * the objectToken spelling (for compound expressions where the
     * parser left pseudoTableType=none on leaf TObjectNames).
     *
     * <p>Codex round-2 Q3 BLOCKING fix — MSSQL permits "INSERTED" /
     * "DELETED" as real identifiers via ColId, so the text-match
     * fallback fires ONLY when no FROM-side relation alias /
     * qualifiedName / bare-component matches the qualifier. With a
     * real table named "INSERTED" in scope, the text-match is
     * suppressed and the leaf surfaces as a normal column ref.
     */
    private static EPseudoTableType detectPseudoTable(TObjectName n,
                                                       TResultColumn rc,
                                                       String targetAlias,
                                                       String targetQName,
                                                       List<RelationSource> fromSideRelations) {
        if (n == null) return EPseudoTableType.none;
        // Direct: parser-set pseudoTableType.
        if (n.getPseudoTableType() != null
                && n.getPseudoTableType() != EPseudoTableType.none) {
            return n.getPseudoTableType();
        }
        // Indirect: if this leaf is the result column's fieldAttr,
        // read from the fieldAttr's pseudoTableType (slice-78
        // TOutputClause.doParse sets it there for simple refs).
        if (rc != null && rc.getFieldAttr() == n) {
            EPseudoTableType pt = pseudoTableOf(rc);
            if (pt != null && pt != EPseudoTableType.none) return pt;
        }
        // Compound expression leaf — the parser leaves
        // pseudoTableType=none on the leaf TObjectNames but the
        // objectToken spelling is preserved. Text-match
        // INSERTED / DELETED case-insensitively, but only when no
        // real FROM-side relation shadows the pseudo name (codex
        // round-2 Q3 BLOCKING).
        if (n.getObjectToken() != null && n.getPartToken() != null) {
            String obj = n.getObjectToken().toString();
            if (obj == null) return EPseudoTableType.none;
            boolean shadowedByRealRelation =
                    qualifierMatchesAnyRelation(obj, targetAlias,
                            targetQName, fromSideRelations);
            if (shadowedByRealRelation) return EPseudoTableType.none;
            if ("INSERTED".equalsIgnoreCase(obj)) return EPseudoTableType.inserted;
            if ("DELETED".equalsIgnoreCase(obj)) return EPseudoTableType.deleted;
        }
        return EPseudoTableType.none;
    }

    /**
     * Slice 85 helper — true when {@code qualifier} matches some
     * real relation in scope (target alias / qualified name / bare
     * component, or any FROM-side relation alias / qualified name /
     * bare component). Used by {@link #detectPseudoTable} to
     * suppress the INSERTED / DELETED text-match when a real table
     * by that name is in scope.
     */
    private static boolean qualifierMatchesAnyRelation(String qualifier,
            String targetAlias, String targetQName,
            List<RelationSource> fromSideRelations) {
        if (qualifier == null || qualifier.isEmpty()) return false;
        if (targetAlias != null && targetAlias.equalsIgnoreCase(qualifier)) {
            return true;
        }
        if (targetQName != null
                && (targetQName.equalsIgnoreCase(qualifier)
                        || bareLastDotComponent(targetQName)
                                .equalsIgnoreCase(qualifier))) {
            return true;
        }
        if (fromSideRelations != null) {
            for (RelationSource rs : fromSideRelations) {
                String a = rs.getAlias();
                if (a != null && a.equalsIgnoreCase(qualifier)) return true;
                String qn = rs.getBinding() == null ? null
                        : rs.getBinding().getQualifiedName();
                if (qn != null
                        && (qn.equalsIgnoreCase(qualifier)
                                || bareLastDotComponent(qn)
                                        .equalsIgnoreCase(qualifier))) {
                    return true;
                }
            }
        }
        return false;
    }

    /**
     * Slice 85 helper — collect identities of every TObjectName that
     * is a function-name in the given expression tree (codex round-2
     * Q1 BLOCKING — {@code EDbObjectType.function} is unreliable
     * across dialects: Oracle builtins surface as {@code constant},
     * MSSQL XML methods as {@code method}). The walker uses
     * {@link IdentityHashMap}-style reference equality so the
     * column-ref walker can structurally skip function-name leaves
     * regardless of dbType.
     */
    private static java.util.Set<TObjectName> collectFunctionNameLeaves(
            TExpression expr) {
        final java.util.Set<TObjectName> set = java.util.Collections.newSetFromMap(
                new IdentityHashMap<TObjectName, Boolean>());
        if (expr == null) return set;
        expr.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                TObjectName name = fn.getFunctionName();
                if (name != null) set.add(name);
            }
        });
        return set;
    }

    /**
     * Slice 85 helper — true when this TObjectName is in the
     * function-name set collected for the current expression
     * (codex round-2 Q1 BLOCKING fix — structural identity rather
     * than dbType). {@code functionNameLeaves} may be null (empty
     * set semantics) when the caller doesn't have the set in hand.
     */
    private static boolean isFunctionNameObjectName(TObjectName n,
            java.util.Set<TObjectName> functionNameLeaves) {
        if (n == null) return false;
        if (functionNameLeaves != null && functionNameLeaves.contains(n)) {
            return true;
        }
        // Best-effort fallback: dbType check catches the
        // single-leaf simple_object_name_t function case (rare —
        // those normally arrive as TFunctionCall). Kept defensively.
        EDbObjectType t = n.getDbObjectType();
        return t == EDbObjectType.function;
    }

    /**
     * Slice 85 helper — best-effort spelling of the bare column name
     * for an OUTPUT pseudo-table ref like INSERTED.foo. Used only in
     * diagnostic message text.
     */
    private static String safePseudoColumn(TResultColumn rc) {
        if (rc == null) return "<unknown>";
        TObjectName fa = rc.getFieldAttr();
        if (fa == null) return "<unknown>";
        if (fa.getPartToken() != null) return fa.getPartToken().toString();
        if (fa.getPropertyToken() != null) return fa.getPropertyToken().toString();
        return rc.toString();
    }

    /**
     * Slice 85 helper — derive the OutputColumn name for a RETURNING /
     * OUTPUT projection column. Uses the explicit alias when present,
     * else the bare column name (for OUTPUT INSERTED.col / DELETED.col
     * the bare partToken spelling, stripping the pseudo-table
     * qualifier). Falls back to {@code expr.toString()} for derived
     * expressions without alias (e.g. {@code RETURNING a + 1} → name
     * = "a + 1").
     */
    private static String returningOutputName(TResultColumn rc,
                                              TExpression expr,
                                              String dmlKind,
                                              boolean isReturning) {
        String alias = rc.getColumnAlias();
        if (alias != null && !alias.isEmpty()) {
            return alias;
        }
        // OUTPUT pseudo-table ref without alias — strip the qualifier
        // so the OutputColumn.name carries the bare column spelling.
        if (!isReturning) {
            EPseudoTableType pt = pseudoTableOf(rc);
            if (pt != EPseudoTableType.none) {
                TObjectName fa = rc.getFieldAttr();
                if (fa != null && fa.getPartToken() != null) {
                    return fa.getPartToken().toString();
                }
            }
        }
        // RETURNING bare column or derived expression — fall back to
        // the expression's toString(). For simple_object_name_t this is
        // the verbatim bare or qualified column spelling; for
        // arithmetic / function expressions it is the rendered text.
        String s = expr.toString();
        if (s == null || s.isEmpty()) {
            throw new SemanticIRBuildException(Diagnostic.error(
                    DiagnosticCode.RESULT_COLUMN_NO_NAME,
                    dmlKind + (isReturning ? " RETURNING" : " OUTPUT")
                            + " column has no resolvable name",
                    rc));
        }
        return s;
    }

    /**
     * Slice 85 helper — collect ColumnRefs from a RETURNING / OUTPUT
     * projection expression. Slice 89 fixed TReturningClause.acceptChildren()
     * to descend into children so Resolver2 now registers RETURNING refs in
     * allColumnReferences for DELETE/UPDATE (INSERT RETURNING lacks InsertScope
     * so Resolver2 coverage there is partial). This walker remains the
     * authoritative source for Semantic IR because it maps qualifier tokens
     * directly onto the DML's known relation set:
     *
     * <ul>
     *   <li>OUTPUT pseudo-table ref ({@code INSERTED.col} /
     *       {@code DELETED.col}, detected via
     *       {@code fieldAttr.pseudoTableType}) → ColumnRef with
     *       uppercase {@code "INSERTED"} / {@code "DELETED"} as the
     *       relationAlias, preserving temporal phase (codex round-2
     *       Q2 BLOCKING).</li>
     *   <li>Qualified ref matching a FROM-side relation's alias
     *       (slice-82 joined UPDATE / slice-84 joined DELETE)
     *       → ColumnRef with that alias.</li>
     *   <li>Qualified ref matching the target table's effective alias
     *       or its qualified name → ColumnRef with the target alias.</li>
     *   <li>Unqualified ref → ColumnRef with the target alias
     *       (default scope).</li>
     *   <li>Qualified ref matching nothing known → ColumnRef with the
     *       parser's qualifier verbatim. Lineage consumers can spot
     *       the unresolved relation via the relationAlias they see.</li>
     * </ul>
     *
     * <p>Match policy: case-insensitive on alias / qualified name,
     * to match the slice-83 codex Q3 advisory and stay forgiving of
     * dialect-specific identifier casing.
     */
    private static List<ColumnRef> collectReturningSourceRefs(
            TExpression expr,
            TResultColumn rc,
            boolean isOutput,
            String targetAlias,
            String targetQName,
            List<RelationSource> fromSideRelations) {
        final LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        // Collect function-name identities first (codex round-2 Q1
        // BLOCKING — dialect-portable structural filter; see
        // {@link #collectFunctionNameLeaves} javadoc for the
        // dbObjectType unreliability rationale).
        final java.util.Set<TObjectName> fnLeaves = collectFunctionNameLeaves(expr);
        // Fast path: simple_object_name_t leaf — handle directly so
        // OUTPUT INSERTED.col / DELETED.col resolves through fieldAttr.
        if (expr.getExpressionType() == EExpressionType.simple_object_name_t) {
            ColumnRef r = synthRefForReturningLeaf(
                    rc, expr.getObjectOperand(), isOutput,
                    targetAlias, targetQName, fromSideRelations, fnLeaves);
            if (r != null) refs.add(r);
            return new ArrayList<>(refs);
        }
        // Compound expression — walk for TObjectName leaves. We don't
        // descend into nested subqueries (already rejected upstream)
        // and don't try to resolve fieldAttr for compound expressions
        // (pseudo-table qualifier inside arithmetic / function args is
        // a rare shape; slice 85 surfaces the bare column ref against
        // the target alias as a best-effort).
        expr.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;
            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }
            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }
            @Override
            public void preVisit(TObjectName node) {
                if (nestedSelectDepth > 0) return;
                // Codex round-1 Q1 / round-2 Q1 BLOCKING — skip
                // function-name leaves via structural identity.
                if (isFunctionNameObjectName(node, fnLeaves)) return;
                ColumnRef r = synthRefForReturningLeaf(
                        rc, node, isOutput,
                        targetAlias, targetQName, fromSideRelations, fnLeaves);
                if (r != null) refs.add(r);
            }
        });
        return new ArrayList<>(refs);
    }

    /**
     * Slice 85 helper — build one ColumnRef for a TObjectName leaf in
     * a RETURNING / OUTPUT projection. Returns null when the node is
     * not a column-name reference (e.g. a function name token).
     */
    private static ColumnRef synthRefForReturningLeaf(
            TResultColumn rc,
            TObjectName node,
            boolean isOutput,
            String targetAlias,
            String targetQName,
            List<RelationSource> fromSideRelations,
            java.util.Set<TObjectName> functionNameLeaves) {
        if (node == null) return null;
        // Codex round-1 Q1 / round-2 Q1 BLOCKING — skip function-name
        // TObjectNames via structural identity (the "UPPER" leaf in
        // `RETURNING UPPER(name)`).
        if (isFunctionNameObjectName(node, functionNameLeaves)) return null;
        String colName = bareColumnNameOf(node);
        if (colName == null || colName.isEmpty()) return null;
        // OUTPUT pseudo-table ref (INSERTED / DELETED). Detect via
        // fieldAttr on the result column (parser surfaces it there
        // for simple refs) OR objectToken spelling (compound exprs;
        // codex round-1 Q4 BLOCKING — same deep detection as
        // detectPseudoTable). Both INSERTED and DELETED ultimately
        // reference the target table's row; only the temporal phase
        // surfaces on ColumnRef.relationAlias.
        if (isOutput) {
            EPseudoTableType pt = detectPseudoTable(node, rc,
                    targetAlias, targetQName, fromSideRelations);
            if (pt == EPseudoTableType.inserted) {
                return new ColumnRef("INSERTED", partColumnNameOf(node, colName));
            }
            if (pt == EPseudoTableType.deleted) {
                return new ColumnRef("DELETED", partColumnNameOf(node, colName));
            }
        }
        // Qualifier resolution: bare or qualified.
        String qualifier = qualifierOf(node);
        if (qualifier == null || qualifier.isEmpty()) {
            return new ColumnRef(targetAlias, colName);
        }
        // Codex round-2 Q2 + round-3 BLOCKING fix — single-pass
        // count-all-candidates matcher. A relation "matches" the
        // qualifier if any of (alias, qualifiedName, bare-last-dot
        // component of qualifiedName) compares case-insensitive-
        // equal. Multiple matches (e.g. unaliased `FROM s1.t s2.t`
        // both have effectiveAlias "t" via TTable.getName() fallback,
        // both have bareComponent "t") are ambiguous and fall through
        // to the verbatim qualifier path so consumers see the
        // ambiguity rather than a silent order-dependent pick.
        int totalMatches = 0;
        // Single-match accumulators (one each — only valid when
        // totalMatches == 1):
        RelationSource matchedRelation = null;
        boolean matchedIsTarget = false;
        if (fromSideRelations != null) {
            for (RelationSource rs : fromSideRelations) {
                if (relationCandidateMatch(rs, qualifier)) {
                    totalMatches++;
                    matchedRelation = rs;
                }
            }
        }
        if (targetCandidateMatch(targetAlias, targetQName, qualifier)) {
            totalMatches++;
            matchedIsTarget = true;
        }
        if (totalMatches == 1) {
            if (matchedIsTarget) {
                return new ColumnRef(
                        targetAlias != null ? targetAlias : targetQName, colName);
            }
            String a = matchedRelation.getAlias();
            String qn = matchedRelation.getBinding() == null ? null
                    : matchedRelation.getBinding().getQualifiedName();
            return new ColumnRef((a != null && !a.isEmpty()) ? a : qn, colName);
        }
        // Zero matches or ambiguous — pass through verbatim. Lineage
        // consumers can spot the unresolved / ambiguous relation.
        return new ColumnRef(qualifier, colName);
    }

    /**
     * Slice 85 helper — true when a FROM-side relation is a match
     * candidate for the qualifier under any of: alias, full
     * qualifiedName, or bare last-dot component of qualifiedName
     * (case-insensitive). Caller uses {@link #synthRefForReturningLeaf}'s
     * single-pass count-then-pick policy to disambiguate.
     */
    private static boolean relationCandidateMatch(RelationSource rs,
                                                   String qualifier) {
        if (rs == null || qualifier == null || qualifier.isEmpty()) return false;
        String a = rs.getAlias();
        if (a != null && a.equalsIgnoreCase(qualifier)) return true;
        String qn = rs.getBinding() == null ? null
                : rs.getBinding().getQualifiedName();
        if (qn == null) return false;
        return qn.equalsIgnoreCase(qualifier)
                || bareLastDotComponent(qn).equalsIgnoreCase(qualifier);
    }

    /**
     * Slice 85 helper — true when the target table is a candidate
     * match for the qualifier (alias / qualifiedName / bare
     * component, case-insensitive).
     */
    private static boolean targetCandidateMatch(String targetAlias,
                                                 String targetQName,
                                                 String qualifier) {
        if (qualifier == null || qualifier.isEmpty()) return false;
        if (targetAlias != null && targetAlias.equalsIgnoreCase(qualifier)) {
            return true;
        }
        if (targetQName != null
                && (targetQName.equalsIgnoreCase(qualifier)
                        || bareLastDotComponent(targetQName)
                                .equalsIgnoreCase(qualifier))) {
            return true;
        }
        return false;
    }

    /**
     * Slice 85 helper — strip everything up to and including the
     * last dot in a qualified name. Returns the input unchanged when
     * no dot is present.
     */
    private static String bareLastDotComponent(String qname) {
        if (qname == null) return "";
        int dot = qname.lastIndexOf('.');
        return (dot < 0) ? qname : qname.substring(dot + 1);
    }

    /**
     * Slice 85 helper — map a ColumnRef.relationAlias to the qualified
     * table name used on the LineageEdge {@code to} endpoint. INSERTED
     * / DELETED both collapse to the target's qualified name; FROM-side
     * aliases route to their bound qualifiedName; target alias / qname
     * stays on the target; unknown aliases pass through verbatim.
     */
    private static String resolveReturningEdgeTarget(
            String alias, String targetAlias, String targetQName,
            List<RelationSource> fromSideRelations) {
        if ("INSERTED".equals(alias) || "DELETED".equals(alias)) {
            return targetQName;
        }
        if (targetAlias != null && targetAlias.equalsIgnoreCase(alias)) {
            return targetQName;
        }
        if (targetQName != null && targetQName.equalsIgnoreCase(alias)) {
            return targetQName;
        }
        if (fromSideRelations != null) {
            for (RelationSource rs : fromSideRelations) {
                if (rs.getAlias() != null
                        && rs.getAlias().equalsIgnoreCase(alias)) {
                    String qn = rs.getBinding() == null ? null
                            : rs.getBinding().getQualifiedName();
                    return (qn != null && !qn.isEmpty()) ? qn : alias;
                }
            }
        }
        return alias != null ? alias : targetQName;
    }

    /**
     * Slice 123 — resolve a RETURNING/OUTPUT source ref's relation alias to
     * the statement index of a SUBQUERY-kind FROM-side relation that owns
     * its own producing {@link StatementGraph}, so the slice-85 walker can
     * emit a cross-stmt {@code STATEMENT_OUTPUT(dmlIdx, ret) →
     * STATEMENT_OUTPUT(subOrCteIdx, col)} edge instead of the fictitious
     * {@code TABLE_COLUMN(<alias>, col)} edge.
     *
     * <p>Returns the producing statement index iff ALL of:
     * <ul>
     *   <li>{@code fromSideAliasToStmtIndex} is non-empty and {@code alias}
     *       is non-empty;</li>
     *   <li>{@code alias} is NOT an OUTPUT pseudo-table ({@code INSERTED} /
     *       {@code DELETED}) and does NOT match the target alias or qname —
     *       those stay on the slice-85 {@code TABLE_COLUMN(targetQName)}
     *       path (mirrors {@link #resolveReturningEdgeTarget}'s priority);</li>
     *   <li>a {@link RelationSource} in {@code fromSideRelations} matches the
     *       alias (case-insensitive) AND is {@link RelationKind#SUBQUERY}-kind
     *       (mirrors the slice-83 {@link #emitUpdateSubquerySourceEdges}
     *       filter — base TABLE-kind FROM relations are never promoted);</li>
     *   <li>the alias has an entry in {@code fromSideAliasToStmtIndex}
     *       (keyed lowercase).</li>
     * </ul>
     * Otherwise returns {@code null} and the caller keeps the TABLE_COLUMN
     * edge. No producer-column publication check (consistent with
     * {@link #emitUpdateSubquerySourceEdges}).
     *
     * <p>Invariant — the {@link RelationKind#SUBQUERY} filter and the map are
     * consistent by construction, so the filter never spuriously suppresses a
     * real producer. Every alias in {@code fromSideAliasToStmtIndex} comes from
     * one of three sources, all of which add only SUBQUERY-kind relations for
     * the matching alias:
     * <ul>
     *   <li>{@link #buildDeleteCombinedAliasToSubIdx} /
     *       {@link #buildUpdateCombinedAliasToSubIdx} (DELETE / UPDATE), whose
     *       two entry sources are (a) slice-84/83 FROM-subquery aliases —
     *       always SUBQUERY-kind relations — and (b) slice-106/105
     *       CTE-as-FROM-relation aliases, which {@code buildDeleteRelation} /
     *       {@code buildUpdateRelation} record as SUBQUERY-kind (NOT
     *       {@link RelationKind#CTE});</li>
     *   <li>slice-124 MERGE {@code aliasToSubIdx}, whose entries are the
     *       USING alias for the USING-(SELECT) subquery branch and for the
     *       USING-as-CTE branch — both add a SUBQUERY-kind relation. The
     *       USING-as-CTE branch also registers an inert bare-CTE-name key with
     *       no matching relation in {@code fromSideRelations}, so it is never
     *       reached by the per-alias relation match below.</li>
     * </ul>
     * The filter is kept as defense-in-depth (a stale TABLE-kind entry would
     * never be promoted) and for parity with the slice-83
     * {@code emitUpdateSubquerySourceEdges}, which carries the identical
     * SUBQUERY-kind guard.
     */
    private static Integer returningSubquerySourceIndex(
            String alias, String targetAlias, String targetQName,
            List<RelationSource> fromSideRelations,
            Map<String, Integer> fromSideAliasToStmtIndex) {
        if (alias == null || alias.isEmpty()) return null;
        if (fromSideAliasToStmtIndex == null
                || fromSideAliasToStmtIndex.isEmpty()) {
            return null;
        }
        // Pseudo-tables and target self-refs are never cross-stmt sources.
        if ("INSERTED".equals(alias) || "DELETED".equals(alias)) return null;
        if (targetAlias != null && targetAlias.equalsIgnoreCase(alias)) {
            return null;
        }
        if (targetQName != null && targetQName.equalsIgnoreCase(alias)) {
            return null;
        }
        if (fromSideRelations == null) return null;
        for (RelationSource rs : fromSideRelations) {
            if (rs.getAlias() == null
                    || !rs.getAlias().equalsIgnoreCase(alias)) {
                continue;
            }
            if (rs.getBinding() == null
                    || rs.getBinding().getKind() != RelationKind.SUBQUERY) {
                return null;
            }
            return fromSideAliasToStmtIndex.get(
                    alias.toLowerCase(Locale.ROOT));
        }
        return null;
    }

    /**
     * Slice 85 helper — extract the bare column name from a TObjectName
     * leaf, honouring partToken / propertyToken / objectToken in the
     * order set by the parser. Returns null when no column-name token
     * is present.
     */
    private static String bareColumnNameOf(TObjectName node) {
        // partToken is the column name in `qualifier.col` form;
        // for bare `col`, the parser may put it on objectToken.
        if (node.getPartToken() != null) {
            return node.getPartToken().toString();
        }
        if (node.getColumnNameOnly() != null
                && !node.getColumnNameOnly().isEmpty()) {
            return node.getColumnNameOnly();
        }
        if (node.getObjectToken() != null) {
            return node.getObjectToken().toString();
        }
        return null;
    }

    /**
     * Slice 85 helper — qualifier (table alias or schema-table) of a
     * column-name reference. Returns null for bare references.
     */
    private static String qualifierOf(TObjectName node) {
        // For `t.col`, parser populates objectToken=t, partToken=col.
        if (node.getPartToken() != null && node.getObjectToken() != null) {
            return node.getObjectToken().toString();
        }
        return null;
    }

    /**
     * Slice 85 helper — pseudo-table partToken column name for OUTPUT
     * INSERTED.col / DELETED.col. Falls back to the bare column name
     * when partToken is null (e.g. raw bare reference).
     */
    private static String partColumnNameOf(TObjectName node, String fallbackColName) {
        if (node.getPartToken() != null) {
            return node.getPartToken().toString();
        }
        return fallbackColName;
    }

    private static void rejectWindowFunctionInScope(gudusoft.gsqlparser.nodes.TParseTreeNode root,
                                                    String clauseLabel) {
        if (root == null) return;
        final boolean[] found = {false};
        root.acceptChildren(new TParseTreeVisitor() {
            @Override
            public void preVisit(TFunctionCall fn) {
                if (found[0]) return;
                if (fn.getWindowDef() != null) found[0] = true;
            }
        });
        if (found[0]) {
            throw new SemanticIRBuildException(
                    Diagnostic.error(DiagnosticCode.CLAUSE_WINDOW_FUNCTION_LEAK,
                    clauseLabel + " contains a window function (OVER (...)); "
                            + "window functions are not allowed in " + clauseLabel
                            + " per standard SQL", root));
        }
    }

    private static String effectiveOutputName(TResultColumn rc) {
        String alias = rc.getColumnAlias();
        if (alias != null && !alias.isEmpty()) {
            return alias;
        }
        String colName = rc.getColumnNameOnly();
        if (colName != null && !colName.isEmpty()) {
            return colName;
        }
        throw new SemanticIRBuildException(
                Diagnostic.error(DiagnosticCode.RESULT_COLUMN_NO_NAME,
                "result column " + rc + " has neither alias nor column name", rc));
    }

    private static List<ColumnRef> buildFilterColumnRefs(TSelectSqlStatement select,
                                                         NameBindingProvider provider,
                                                         boolean allowPredicateSubqueries,
                                                         List<StatementGraph> stmtsForExtraction,
                                                         List<LineageEdge> lineageForExtraction,
                                                         Map<String, Integer> cteMapForExtraction,
                                                         PredicateClauseContext whereClauseContext,
                                                         List<SemiJoinFact> semiFactsOut,
                                                         Set<String> outerRelationAliases) {
        TWhereClause where = select.getWhereClause();
        if (where == null || where.getCondition() == null) {
            return new ArrayList<>();
        }
        Set<TExpression> extractedWhereRoots =
                Collections.<TExpression>emptySet();
        if (containsAnySubquery(where)) {
            if (!allowPredicateSubqueries) {
                // Slice 112 — non-outer SELECTs (FROM-subquery, scalar
                // projection subquery body, predicate body) keep the
                // slice-80 blanket reject. The outermost SELECT path
                // (slice 112) and set-op branch path (slice 113) thread
                // {@code allowPredicateSubqueries=true} plus the live
                // extraction context so the slice-23+ walker can lift
                // uncorrelated predicate-subquery wrappers. Inner
                // contexts also have earlier preflight rejecters
                // ({@code rejectSubqueriesInFromSubqueryBodyClauses} for
                // FROM-subquery bodies, {@code rejectSubqueriesInPredicateBodyClauses}
                // for slice-23 predicate bodies); this remains the
                // fallback path for any unanticipated nested SELECTs
                // that bypass those preflights.
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.WHERE_HAS_SUBQUERY_NOT_SUPPORTED,
                        "WHERE clause contains a subquery; subqueries in WHERE "
                                + "are not supported yet in nested SELECTs",
                        select));
            }
            // Slice 112 / 113 — outer SELECT WHERE and set-op branch
            // WHERE lift the slice-80 blanket subquery reject by
            // routing uncorrelated predicate-subquery wrappers
            // (IN-SELECT / EXISTS / NOT EXISTS / scalar comparison /
            // ANY-ALL-SOME) through the slice-23+ JOIN-ON extraction
            // pipeline refactored by slice 110 to take a
            // PredicateClauseContext. Slice 112 added the SELECT_WHERE
            // constant for outer SELECT WHERE; slice 113 adds the
            // SET_OP_BRANCH_WHERE constant for nested set-op branch
            // WHERE — both reuse the same SELECT_WHERE_* DiagnosticCode
            // family (a branch IS a SELECT, only nested) and differ
            // only in the {@code clauseLabel} for diagnostic messages.
            // Each extracted wrapper lands as its own
            // <predicate_subquery_<i>> StatementGraph BEFORE the host
            // outer SELECT or set-op branch in {@code stmts} (selectIdx
            // = stmts.size() naturally accounts for them — slice-83
            // dynamic-index pattern, slice 110/111 precedent).
            //
            // Remaining non-subquery refs flow into filterColumnRefs
            // via collectColumnRefsSkipping. Window functions in
            // non-subquery subtrees still reject via
            // rejectWindowFunctionInScopeSkipping. The {@code provider}
            // already carries withCteContext / withInScopeRelationColumns
            // from the outer build chain (slice-65 withUsingScope
            // preserves both facets), so the predicate body's inner
            // FROM cte routes through RelationKind.CTE and the body's
            // own lineage edge becomes STATEMENT_OUTPUT(predicateIdx,
            // col) -> STATEMENT_OUTPUT(cteIdx, col) instead of
            // TABLE_COLUMN (slice 110/111 precedent).
            extractedWhereRoots =
                    extractUncorrelatedPredicateSubqueriesFromClause(
                            where.getCondition(), provider,
                            stmtsForExtraction, lineageForExtraction,
                            cteMapForExtraction,
                            whereClauseContext,
                            /*correlationScope=*/ null,
                            semiFactsOut,
                            outerRelationAliases);
            rejectAnyRemainingSubqueriesFromClause(
                    where.getCondition(), extractedWhereRoots,
                    whereClauseContext);
        }
        // Slice 13: reject window functions in WHERE before
        // collectColumnRefs descends into OVER (...) and leaks
        // PARTITION BY / OVER ORDER BY refs into filterColumnRefs.
        // Slice 112 — skip extracted predicate-subquery subtrees so
        // inner window functions do not leak into the outer reject
        // (mirrors the slice-110/111 UPDATE/DELETE WHERE behaviour).
        rejectWindowFunctionInScopeSkipping(where, "WHERE clause",
                extractedWhereRoots);
        return collectColumnRefsSkipping(where, provider, extractedWhereRoots);
    }

    /**
     * Slice 65 — shared visitor body that emits either the merged-key
     * source list (when {@code node} is an unqualified reference to a
     * USING merged key in the current SELECT's
     * {@link UsingScope}) or the resolver2-bound {@link ColumnRef}.
     *
     * <p>Used by every visitor that walks expression subtrees and
     * collects column refs ({@link #collectColumnRefs},
     * {@link #collectColumnRefsSkippingExtended}, the derived FILTER /
     * WITHIN-GROUP-excluding variants). Each visitor remains
     * responsible for its own skip-depth and nested-SELECT-depth
     * tracking; only the column-emit body is shared.
     *
     * <p>Behavior:
     * <ul>
     *   <li>If the node is not a column, name is null/empty/star → no-op.</li>
     *   <li>If the node is unqualified AND its name matches a USING
     *       key in {@code provider.getUsingScope()} AND that scope
     *       reports the reference as ambiguous (two disconnected
     *       classes, or a catalog-proven out-of-class same-named
     *       relation) → throw {@link SemanticIRBuildException}.</li>
     *   <li>Otherwise if the unqualified name matches a USING key
     *       unambiguously → emit each {@link ColumnRef} from the
     *       merged source list (FROM-ordered, deduped per relation).</li>
     *   <li>Otherwise → delegate to
     *       {@link NameBindingProvider#bindColumn} and emit the bound
     *       {@link ColumnRef}; any non-EXACT_MATCH binding records a
     *       reject (caller throws after collecting all rejects).</li>
     * </ul>
     *
     * <p>The qualifier check is the SQL-written prefix
     * ({@link TObjectName#getTableString()}); when present the
     * merged-key path is skipped so {@code a.k} continues to resolve
     * to {@code (a, k)} regardless of {@code k}'s USING-key status.
     */
    private static void appendMergedOrBoundColumnRef(
            TObjectName node,
            NameBindingProvider provider,
            LinkedHashSet<ColumnRef> refsOut,
            List<String> rejectsOut,
            boolean[] sawQualifiedRejectOut) {
        if (node.getDbObjectType() != EDbObjectType.column) return;
        String name = node.getColumnNameOnly();
        if (name == null || "*".equals(name)) return;
        UsingScope scope = provider.getUsingScope();
        String qualifier = node.getTableString();
        if ((qualifier == null || qualifier.isEmpty()) && scope.has(name)) {
            if (scope.isAmbiguous(name)) {
                throw new SemanticIRBuildException(
                        Diagnostic.error(DiagnosticCode.UNQUALIFIED_COLUMN_AMBIGUOUS,
                        "unqualified reference to '" + name + "' is ambiguous: "
                                + scope.ambiguityReason(name)
                                + "; qualify with a table alias", null));
            }
            for (ColumnRef ref : scope.mergedSourcesFor(name)) {
                refsOut.add(ref);
            }
            return;
        }
        ColumnBinding binding = provider.bindColumn(node);
        boolean unqualified = (qualifier == null || qualifier.isEmpty());
        // Catalog-less NATURAL JOIN degrade (GSP R6): an unqualified
        // reference that fails to bind exactly, when the FROM clause carries
        // a catalog-less NATURAL join, is a reference to the merged NATURAL
        // key — unambiguous under NATURAL semantics. Resolve it to the
        // deterministic left-side relation instead of failing the whole
        // analysis. Only fires for NATURAL FROM clauses; plain-join
        // unqualified ambiguity still rejects below.
        if (unqualified
                && (binding == null || binding.getStatus() != ResolutionStatus.EXACT_MATCH)
                && scope.hasNaturalDegrade()) {
            refsOut.add(new ColumnRef(scope.naturalDegradeFallbackAlias(), name));
            return;
        }
        if (binding == null) {
            rejectsOut.add(node + "[no binding]");
            if (!unqualified && sawQualifiedRejectOut != null) {
                sawQualifiedRejectOut[0] = true;
            }
            return;
        }
        if (binding.getStatus() != ResolutionStatus.EXACT_MATCH) {
            rejectsOut.add(node + "[" + binding.getStatus() + "]");
            if (!unqualified && sawQualifiedRejectOut != null) {
                sawQualifiedRejectOut[0] = true;
            }
            return;
        }
        // Slice 164 (S3): attach the source-text span of the originating
        // TObjectName. Slice 165 (S4): attach the GAP-5 resolution from the
        // binding's final table. Both are excluded from ColumnRef identity,
        // so the LinkedHashSet dedupe and emission order are unaffected.
        refsOut.add(new ColumnRef(binding.getRelationAlias(), binding.getColumnName(),
                null, SourceSpan.of(node), resolutionOf(binding)));
    }

    /**
     * Slice 165 (S4) — map a {@link ColumnBinding}'s final table to an
     * explicit {@link ColumnResolution} (GAP 5). A non-null final-table
     * qualified name yields RESOLVED; a null one yields UNRESOLVED (the
     * resolver did not produce a base table — never fabricated). This path
     * only sees EXACT_MATCH bindings; non-exact / null bindings are
     * rejected upstream, so strict diagnostics are not loosened.
     */
    static ColumnResolution resolutionOf(ColumnBinding binding) {
        String finalTableQn = binding.getFinalTableQualifiedName();
        return (finalTableQn != null && !finalTableQn.isEmpty())
                ? ColumnResolution.resolved(finalTableQn)
                : ColumnResolution.UNRESOLVED;
    }

    /**
     * Visit every column-typed {@link TObjectName} reachable from the given
     * subtree, ask the provider to bind it, and return de-duplicated
     * {@link ColumnRef}s. Any non-EXACT_MATCH binding aborts the build.
     *
     * <p>Slice 65: when the provider carries a non-empty
     * {@link UsingScope}, unqualified references that match a USING
     * merged key are expanded to the merged source list (one ref per
     * relation in the equivalence class) before delegating to
     * {@link NameBindingProvider#bindColumn}. See
     * {@link #appendMergedOrBoundColumnRef}.
     */
    private static List<ColumnRef> collectColumnRefs(gudusoft.gsqlparser.nodes.TParseTreeNode root,
                                                     final NameBindingProvider provider) {
        final LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        final List<String> rejects = new ArrayList<>();
        // True if any reject is a QUALIFIED column miss (e.g. b.id pointing at
        // the wrong side). Such a miss is a genuine error and must stay fatal;
        // only all-unqualified rejects are eligible for the join-graph degrade.
        final boolean[] sawQualifiedReject = {false};
        root.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TObjectName node) {
                if (nestedSelectDepth > 0) return;
                appendMergedOrBoundColumnRef(node, provider, refs, rejects,
                        sawQualifiedReject);
            }
        });
        if (!rejects.isEmpty()) {
            rejectNonExactBindings(rejects, provider, !sawQualifiedReject[0]);
        }
        return new ArrayList<>(refs);
    }

    /**
     * Tolerant variant of {@link #collectColumnRefs} for the MySQL
     * self-reference DELETE path (slice 92 Codex P1 fix).
     *
     * <p>The MySQL parser populates {@code stmt.tables} with 3 entries for
     * {@code DELETE T1 FROM T1 WHERE id = 1} (target + {@code joins[0]} +
     * {@code referenceJoins[0]}). Resolver2's {@code inferredCandidates}
     * then sees 3 candidates for any unqualified column ref and marks the
     * binding as NOT_FOUND, which {@link #collectColumnRefs} rejects as
     * {@code COLUMN_BINDING_NON_EXACT}.
     *
     * <p>This variant emits EXACT_MATCH bindings verbatim and falls back
     * to the SQL-written qualifier (or {@code null} for unqualified refs)
     * for non-exact bindings instead of throwing. Subquery children are
     * not descended into (matches the strict collector's behaviour).
     */
    /**
     * @param fallbackRelationAlias used when the binding is non-exact and the
     *        SQL-written qualifier is absent; for the MySQL self-reference path
     *        this is {@code targetQName} so unqualified refs like
     *        {@code WHERE id = 1} emit {@code ColumnRef(targetName, "id")}
     *        instead of crashing on the non-null constraint on
     *        {@link ColumnRef#ColumnRef(String, String)}.
     */
    private static List<ColumnRef> collectColumnRefsTolerant(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            final NameBindingProvider provider,
            final String fallbackRelationAlias) {
        return collectColumnRefsTolerant(root, provider, fallbackRelationAlias,
                Collections.<TExpression>emptySet());
    }

    /**
     * Slice 111 — variant of the slice-92 tolerant collector that also
     * skips any descendants of {@code skipRoots} (extracted predicate
     * subquery wrappers). Mirrors the
     * {@link #collectColumnRefsSkipping} skipping behavior so DELETE
     * WHERE-side IN-SELECT / EXISTS / scalar-comparison wrappers
     * extracted by
     * {@link #extractUncorrelatedPredicateSubqueriesFromClause} are
     * not double-collected as outer filter refs on the MySQL self-ref
     * DELETE path. For the non-self-ref DELETE path the
     * {@link #collectColumnRefsSkipping} helper handles the same job;
     * this helper exists only for the slice-92 path which needs the
     * tolerant binding behavior to survive Resolver2's
     * NOT_FOUND / NON_EXACT bindings on unqualified self-ref refs.
     */
    private static List<ColumnRef> collectColumnRefsTolerant(
            gudusoft.gsqlparser.nodes.TParseTreeNode root,
            final NameBindingProvider provider,
            final String fallbackRelationAlias,
            final Set<TExpression> skipRoots) {
        final LinkedHashSet<ColumnRef> refs = new LinkedHashSet<>();
        // Root fast path: if root IS a skipped TExpression subtree, return empty.
        if (root instanceof TExpression && skipRoots.contains(root)) {
            return new ArrayList<>(refs);
        }
        root.acceptChildren(new TParseTreeVisitor() {
            int nestedSelectDepth = 0;
            int skipDepth = 0;

            @Override
            public void preVisit(TExpression e) {
                if (skipRoots.contains(e)) skipDepth++;
            }

            @Override
            public void postVisit(TExpression e) {
                if (skipRoots.contains(e) && skipDepth > 0) skipDepth--;
            }

            @Override
            public void preVisit(TSelectSqlStatement nested) {
                nestedSelectDepth++;
            }

            @Override
            public void postVisit(TSelectSqlStatement nested) {
                nestedSelectDepth--;
            }

            @Override
            public void preVisit(TObjectName node) {
                if (skipDepth > 0) return;
                if (nestedSelectDepth > 0) return;
                if (node.getDbObjectType() != EDbObjectType.column) return;
                String name = node.getColumnNameOnly();
                if (name == null || "*".equals(name)) return;
                ColumnBinding binding = provider.bindColumn(node);
                if (binding != null
                        && binding.getStatus() == ResolutionStatus.EXACT_MATCH) {
                    refs.add(new ColumnRef(
                            binding.getRelationAlias(), binding.getColumnName()));
                } else {
                    // Non-exact or null binding: prefer SQL-written qualifier;
                    // fall back to the single delete-target name so the
                    // ColumnRef non-null constraint is satisfied.
                    String qualifier = node.getTableString();
                    String alias = (qualifier != null && !qualifier.isEmpty())
                            ? qualifier : fallbackRelationAlias;
                    refs.add(new ColumnRef(alias, name));
                }
            }
        });
        return new ArrayList<>(refs);
    }

    /**
     * Thrown when the input falls outside current builder scope or a
     * binding fails. Slice 67 attached a {@link Diagnostic} to every
     * throw site so external callers can pattern-match on
     * {@link DiagnosticCode} rather than parsing message text. The
     * legacy {@code (String)} constructor was removed in slice 67;
     * use one of the {@link Diagnostic#error} factories and the
     * {@link #SemanticIRBuildException(Diagnostic)} constructor.
     */
    public static final class SemanticIRBuildException extends RuntimeException {
        private final List<Diagnostic> diagnostics;

        public SemanticIRBuildException(Diagnostic diagnostic) {
            this(Collections.singletonList(
                            java.util.Objects.requireNonNull(diagnostic, "diagnostic")),
                    diagnostic.getMessage());
        }

        /**
         * Construct a rejection with its primary diagnostic first, followed by
         * any related diagnostics emitted atomically by the same build step.
         */
        public static SemanticIRBuildException withDiagnostics(
                List<Diagnostic> diagnostics) {
            return new SemanticIRBuildException(
                    diagnostics, primaryMessage(diagnostics));
        }

        private SemanticIRBuildException(List<Diagnostic> diagnostics,
                                         String primaryMessage) {
            super(primaryMessage);
            List<Diagnostic> copy = new ArrayList<>(diagnostics);
            for (Diagnostic diagnostic : copy) {
                java.util.Objects.requireNonNull(diagnostic,
                        "diagnostics must not contain null");
            }
            this.diagnostics = Collections.unmodifiableList(copy);
        }

        /**
         * @return the structured diagnostic for this rejection. Always
         *         non-null after slice 67.
         */
        public Diagnostic getDiagnostic() {
            for (Diagnostic diagnostic : diagnostics) {
                if (diagnostic.getSeverity() == Severity.ERROR) {
                    return diagnostic;
                }
            }
            return diagnostics.get(0);
        }

        /** @return immutable complete diagnostic list; never empty. */
        public List<Diagnostic> getDiagnostics() {
            return diagnostics;
        }

        private static String primaryMessage(List<Diagnostic> diagnostics) {
            java.util.Objects.requireNonNull(diagnostics, "diagnostics");
            if (diagnostics.isEmpty()) {
                throw new IllegalArgumentException("diagnostics must not be empty");
            }
            Diagnostic first = null;
            for (Diagnostic diagnostic : diagnostics) {
                Diagnostic nonNull = java.util.Objects.requireNonNull(
                        diagnostic, "diagnostics must not contain null");
                if (first == null) {
                    first = nonNull;
                }
                if (nonNull.getSeverity() == Severity.ERROR) {
                    return nonNull.getMessage();
                }
            }
            return first.getMessage();
        }
    }
}