Preserve NuGet lock graph identity

DEVELOPER_GUIDE.md

@@ -1810,7 +1810,7 @@ Process exit codes are coarse (`0` success including valid zero-row queries, `1`
 - **Ambiguous source extensions stay explicit** — `.m` and `.pl` are not assigned to Objective-C and Perl by default. `FileIndexer` checks an authoritative recognized shebang, then a 64 KiB bounded prefix for strong mutually exclusive Objective-C/MATLAB or Perl/Prolog markers, then at most 256 entries per ancestor directory for conservative project markers. Conflicting or weak evidence is indexed as `ambiguous_m` / `ambiguous_pl`; unresolved `.m` files run the bounded MATLAB and Objective-C symbol/reference paths after a shared position-preserving comment mask, while Prolog and `ambiguous_pl` advertise conservative reference/graph support and the ambiguous `.pl` bucket uses union symbol/reference rules without changing content-based classification (#4612, #4738, #4746).
 - **Dynamic reference-graph readiness follows extractor contracts** — when indexed Crystal, Groovy, Tcl, Prolog, or `ambiguous_pl` rows have a missing or stale symbol-extractor version stamp, status reports `dynamic_reference_graph_contract_stale` and keeps `reference_graph_complete` / `graph_data_current` false until a normal index refresh rewrites those rows (#4746).
 - **Hotspot marker fingerprints share one bounded tree traversal** — full/update CLI and MCP indexing compute C#, VB, F#, and MSBuild marker fingerprints together instead of walking the directory tree once per language. Each distinct marker glob retains the platform filesystem's matching behavior and is enumerated once per visited directory, while child directories are enumerated once; marker sets, budgets, truncation sentinels, and warning order remain isolated per language. The single-language API delegates to the same engine, preserving ignore rules, nested-repository/submodule boundaries, and MCP authorized-read failures.
-- **Lock-file dependency graphs model package relationships** — `packages.lock.json`, `package-lock.json`, and `npm-shrinkwrap.json` keep package declarations as symbols, but emit `dependency` references only for explicit parent-package to child-package entries. The parent package is stored as the reference container, so `callers` can identify which package requires a child and `deps` does not infer lock-file-to-lock-file similarity merely because two files contain the same resolved package set (#4409).
+- **Lock-file dependency graphs model package relationships** — `packages.lock.json`, `package-lock.json`, and `npm-shrinkwrap.json` keep package declarations as symbols, but emit `dependency` references only for explicit parent-package to child-package entries. NuGet lock symbols and references preserve the current file, target/RID, parent package, and exact JSON property span; candidate resolution stays file-local, while file-level `deps` suppresses cross-file package-name inference. Normal index updates invalidate the prior dependency-lock extraction and reference-identity contracts, so `callers` identifies the requiring package without connecting unrelated lock files or collapsing repeated declarations to the first matching line (#4409, #4845).
 - **Dependency-cycle audits separate analysis from display** — CLI `deps --cycles` and MCP `deps` with `cycles=true` analyze a deterministic, path-ordered edge set up to the independent `--graph-budget` / `graphBudget` before computing and stably ranking strongly connected components. `--limit` / `limit` only paginates that ranked SCC set, and opaque cursors are bound to the filters, graph budget, and indexed graph that produced them. Machine-readable responses expose `analysis_complete`, graph edge count/budget, stable ranking mode, authoritative total-cycle status, and continuation metadata; exhausting the graph budget is reported as an explicitly incomplete analysis rather than a complete cycle audit (#4731).
 - **No ORM** — Raw `Microsoft.Data.Sqlite` with parameterized queries. Keeps dependencies minimal and control explicit.
 - **Batch commits** — 500 records per transaction for write performance. Reduces fsync overhead.
@@ -4999,7 +4999,7 @@ USER_GUIDEの[終了コード](USER_GUIDE.md#終了コード)セクションを
 - **曖昧な source extension は曖昧なまま明示** — `.m` と `.pl` を既定で Objective-C / Perl に割り当てません。`FileIndexer` は authoritative な認識済み shebang、64 KiB 上限 prefix 内の相互排他的で強い Objective-C/MATLAB または Perl/Prolog marker、各 ancestor directory 最大 256 entry の保守的な project marker の順に確認します。競合または弱い証拠は `ambiguous_m` / `ambiguous_pl` として index し、未確定の `.m` は位置を保つ共通コメントマスクの後で上限付きの MATLAB / Objective-C symbol・reference 経路を実行します。一方、Prolog と `ambiguous_pl` は保守的な reference / graph 対応を広告し、曖昧な `.pl` bucket は content-based classification を変えずに symbol / reference rule の和集合を使います（#4612、#4738、#4746）。
 - **動的言語の reference-graph readiness は extractor contract に従う** — index 済みの Crystal、Groovy、Tcl、Prolog、`ambiguous_pl` row で symbol-extractor version stamp が欠落または古い場合、status は `dynamic_reference_graph_contract_stale` を報告し、通常の index refresh が対象 row を更新するまで `reference_graph_complete` / `graph_data_current` を false に保ちます（#4746）。
 - **hotspot marker fingerprint は上限付きtree traversalを1回共有** — full/update CLIとMCP indexingは、directory treeを言語ごとに歩かず、C#、VB、F#、MSBuildのmarker fingerprintをまとめて計算します。各directoryでは固有marker globごとにplatform filesystemのmatching挙動を保って1回ずつ列挙し、child directoryも1回だけ列挙する一方、marker集合、budget、truncation sentinel、warning順は言語別に分離します。single-language APIも同じengineへ委譲し、ignore rule、nested repository/submodule境界、MCP authorized read failureを維持します。
-- **lock file の依存グラフは package 間の関係をモデル化** — `packages.lock.json`、`package-lock.json`、`npm-shrinkwrap.json` は package 宣言を symbol として保持しますが、`dependency` reference は明示された親 package → 子 package の項目だけに出力します。親 package を reference container に保存するため、`callers` はどの package が子 package を必要としているかを特定でき、`deps` は同じ resolved package 集合を持つだけの lock file 同士を類似関係として推論しません（#4409）。
+- **lock file の依存グラフは package 間の関係をモデル化** — `packages.lock.json`、`package-lock.json`、`npm-shrinkwrap.json` は package 宣言を symbol として保持しますが、`dependency` reference は明示された親 package → 子 package の項目だけに出力します。NuGet lock の symbol / reference は現在の file、target/RID、親 package、正確な JSON property span を保持し、candidate 解決を file 内に限定します。file 単位の `deps` は package 名による file 間推論を抑止し、通常の index update は以前の dependency-lock 抽出 contract と reference-identity contract を無効化します。そのため、`callers` は無関係な lock file を接続したり、反復宣言を最初の一致行へ畳み込んだりせず、要求元 package を特定できます（#4409、#4845）。
 - **依存サイクル監査では解析と表示を分離** — CLI の `deps --cycles` と MCP `deps` の `cycles=true` は、独立した `--graph-budget` / `graphBudget` まで path 順で決定的な edge 集合を解析してから、強連結成分を安定順位付けします。`--limit` / `limit` はその SCC 順位集合をページ分割するだけで、不透明 cursor は生成時の filter、graph budget、indexed graph に結び付けます。machine-readable 応答は `analysis_complete`、graph edge 件数/予算、安定 ranking mode、authoritative な総 cycle 件数かどうか、continuation metadata を公開し、graph budget 枯渇時は完全な cycle 監査を装わず明示的な未完了解析として報告します（#4731）。
 - **ORMなし** — `Microsoft.Data.Sqlite`でパラメータ化クエリを直接使用。依存関係を最小限に、制御を明確に。
 - **バッチコミット** — 書き込み性能のため1トランザクション500レコード。fsyncオーバーヘッドを削減。

TESTING_GUIDE.md

@@ -540,7 +540,7 @@ Use `docs/test-doc-maintenance-plan.md` before moving oversized suites or adding
   State-changing notification authentication coverage stays table-driven across cancellation, roots, shutdown, and exit methods; every denied notification must remain response-free, emit only a bounded diagnostic, and leave cancellation, roots, and lifecycle state unchanged.
   `resources/read` coverage shares the seeded resource helpers for range, UTF-8 byte-boundary, and cursor-reassembly assertions. Keep deterministic coverage for a concurrent reindex during a read snapshot, stale cursors at direct and transport boundaries, empty and newline-only resources, leading/middle/trailing chunk gaps, missing content and chunk tables, chunk-count and aggregate-scan caps, and escape-heavy responses under both stdio and HTTP response ceilings. Range-seek plan and execution checks share the production SQL strings, verify VM-step scaling and the legacy VM-step budget, and confirm that a budget abort leaves the connection reusable. Consume `maxLines` cursors through exact reconstruction, and cover immutable legacy databases that have only `idx_chunks_file`. Keep real stdio and HTTP wire coverage for aggregate response budgeting across batched `resources/read` calls, including long error responses that must retain every request ID through compact budget errors, plus a real `StdioMcpTransport` wire test for both long single-line and multi-line resources, so regressions cannot hide behind direct handler tests.
 - `DependencyPackageExtractorTests.cs`
-  Dependency-lock graph fixtures assert explicit parent-package to child-package references and the absence of synthetic top-level package references. Keep NuGet and npm coverage aligned so shared resolved package sets cannot recreate lock-file-to-lock-file similarity edges while `callers` retains the requiring package as its container.
+  Dependency-lock graph fixtures assert explicit parent-package to child-package references and the absence of synthetic top-level package references. Keep NuGet and npm coverage aligned so shared resolved package sets cannot recreate lock-file-to-lock-file similarity edges in either `deps` or caller traversal while `callers` retains the requiring package as its container. NuGet query regressions must use two unrelated lock files and repeated packages across targets and multiple RIDs, then assert file-local definitions, owner-scoped callers/callees, and every JSON node's real line. Upgrade regressions must also prove that prior dependency-lock extractor and reference-identity contract stamps invalidate unchanged rows and stale candidates.
 - `HttpMcpTransportTests.cs`
   HTTP MCP transport behavior, including authentication responses, warm server reuse, concurrent requests, and request logging. Request-log assertions must validate recorded contents without assuming callback order between independently handled HTTP requests.
   Its default database fixture follows the same thread-safe lazy-initialization rule as `McpServerTests`, so tests that use an isolated loopback/direct harness do not create an unused schema while concurrent access still initializes the fixture once.
@@ -1476,6 +1476,8 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
   timeout 対象 hook の delay は callback budget より十分長く、かつ bounded な leak-observation window より短く保ってください。高負荷 runner で hook が timeout 境界上に完了する競合を避けながら、worker kill の回帰を観測可能にします。
 - `GitHubIssueReporterTests.cs`
   GitHubトークン解決ロジック（CDIDX_GITHUB_TOKENのみ。汎用GITHUB_TOKENは無視）、送信前のコード scrubbing、冪等性チェック、rate-limit diagnostics を扱います。
+- `DependencyPackageExtractorTests.cs`
+  dependency-lock graph の fixture は明示的な親 package → 子 package reference と、合成された top-level package reference が存在しないことを検証します。NuGet と npm の coverage を揃え、同じ resolved package 集合から `deps` と caller traversal のいずれにも lock-file 間の類似 edge が再生成されず、`callers` が要求元 package を container として維持することを確認してください。NuGet の query regression では無関係な2つの lock file と、複数 target / RID に反復する package を使い、file 内に限定された定義、owner scope の callers/callees、各 JSON node の実際の行を検証します。upgrade regression では、以前の dependency-lock extractor / reference-identity contract stamp により unchanged row と stale candidate が無効化されることも検証します。
 - `PackagesLockTests.cs`
   すべての target framework で同期が必要な direct package reference の NuGet lock-file guard。CI の locked restore を通すための net9.0 compatibility reference も対象です。
   workflow restore contract の coverage では、release native lane の locked `net8.0` test-project restore と cross-compile lane の locked production-project restore を区別しつつ、全 surface の exact cache key を維持します。

changelog.d/unreleased/4845.fixed.md

@@ -0,0 +1,29 @@
+---
+category: fixed
+issues:
+  - 4845
+affected:
+  - src/CodeIndex/Indexer/DependencyPackageExtractor.cs
+  - src/CodeIndex/Indexer/DependencyPackageExtractor.JsonLocations.cs
+  - src/CodeIndex/Indexer/Symbols/SymbolExtractor.Contracts.cs
+  - src/CodeIndex/Database/DbContext.SchemaMetadata.cs
+  - src/CodeIndex/Database/DbReader.Dependencies.cs
+  - src/CodeIndex/Database/DbWriter.References.cs
+  - src/CodeIndex/Database/DbReader.cs
+  - src/CodeIndex/Database/DbReader.GraphQueries.cs
+  - tests/CodeIndex.Tests/DatabaseTests.cs
+  - tests/CodeIndex.Tests/DbReaderTests.cs
+  - tests/CodeIndex.Tests/DbReaderInspectCandidateTests.cs
+  - tests/CodeIndex.Tests/SymbolExtractorTests.cs
+  - DEVELOPER_GUIDE.md
+  - tests/CodeIndex.Tests/IndexCommandRunnerUpdateTests.cs
+  - TESTING_GUIDE.md
+---
+
+## English
+
+- **NuGet lock graphs now preserve file, target, owner, and JSON-node identity (#4845)** — `packages.lock.json` symbols retain each declaration's real property span, nested dependency references retain their parent package and target/RID, and dependency-lock candidate resolution stays within the current file. Default caller/callee traversal includes these ownership edges, file-level `deps` suppresses cross-lock name inference, and normal index updates invalidate prior extraction/identity contracts, preventing the #4409 regression that connected unrelated lock files or attached children to the project scope.
+
+## 日本語
+
+- **NuGet lock graph で file、target、owner、JSON node の identity を保持するようにしました (#4845)** — `packages.lock.json` の symbol は各宣言の実際の property span を保持し、入れ子 dependency reference は親 package と target/RID を維持し、dependency-lock の candidate 解決は現在の file 内に限定されます。既定の caller/callee traversal はこの所有関係 edge を含み、file 単位の `deps` は lock file 間の名前推論を抑止し、通常の index update は以前の抽出 / identity contract を無効化するため、無関係な lock file を接続したり、子 package を project scope に関連付けたりした #4409 の regression を防ぎます。

src/CodeIndex/Database/DbContext.SchemaMetadata.cs

@@ -62,14 +62,13 @@ public static string BuildIncompleteHotspotFamilyMarkerFingerprint(string? finge
     public const string SqlGraphContractVersionMetaKey = "sql_graph_contract_version";
     public const int HdlGraphContractVersion = 1;
     public const string HdlGraphContractVersionMetaKey = "hdl_graph_contract_version";
-    // Version 3 (#4825) invalidates persisted reference candidates written before C#
-    // type references were constrained to type-like symbols with compatible generic arity.
-    // Version 2 DBs can otherwise keep authoritative-looking property bindings and false
-    // dependency edges until an explicit index refresh.
-    // バージョン 3 (#4825) では、C# の型参照を型相当 symbol と互換 generic arity に限定する
-    // 前に永続化された reference candidate を無効化する。バージョン 2 の DB をそのまま信頼すると、
-    // 明示的な index 更新まで property への誤結合と偽 dependency edge が残るためである。
-    public const int ReferenceIdentityContractVersion = 3;
+    // Version 4 (#4845) invalidates dependency-lock candidates written before resolution
+    // became file-local. Version 3 (#4825) previously invalidated C# type-reference
+    // candidates written before type-like kind and compatible generic-arity constraints.
+    // バージョン 4 (#4845) では、解決を file 内に限定する前に書かれた dependency-lock
+    // candidate を無効化する。バージョン 3 (#4825) では、それ以前に C# 型参照の
+    // type-like kind / 互換 generic arity 制約より前に書かれた candidate を無効化した。
+    public const int ReferenceIdentityContractVersion = 4;
     public const string ReferenceIdentityContractVersionMetaKey = "reference_identity_contract_version";
     public static string GetDynamicReferenceGraphContractVersionMetaKey(string lang) =>
         $"dynamic_reference_graph_contract_version_{lang}";