fix(erd): preserve PostgreSQL relation identity in inference

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 - [BE] 🔒 **Cryptography 50+ 보안 경계 갱신**: `pyproject.toml`과 두 hash-locked 요구사항 파일을 동일한 Cryptography 50+ 해석으로 정합화하여 PKCS#7 오류·타이밍 구분으로 인한 CVE-2026-69247 완화를 실제 설치·검증 경로에 반영했습니다.
+- [FE] 🧭 **관계 추론의 PostgreSQL 식별자 보존**: 자동 관계 추론은 snapshot의 정확한 `relation_name`을 사용하고 ASCII allowlist나 마지막 점 구간으로 식별자를 다시 쓰지 않습니다. 따라서 공백·대소문자 혼합·Unicode·점이 포함된 quoted relation 이름도 손실 없이 연결되며, 모호한 trailing-segment 별칭이 잘못된 테이블을 선택하지 않는 회귀 테스트로 고정했습니다.
 - [FE] ⚡ **검색 노드 참조 안정화 및 순차 스냅샷 폴링**: 같은 정규화 검색어와 원본 테이블 데이터에는 장식된 `node.data` 참조를 재사용하여 드래그 중 불필요한 하위 렌더링과 할당을 줄입니다. 스냅샷 폴링은 이전 요청이 끝난 뒤에만 다음 요청을 예약하며, 선택 변경·언마운트 후 도착한 오래된 성공 또는 실패 응답을 무시합니다.
 - [BE] 🔒 **공유 export 전 경로 redaction**: 공개 share의 SQL / index-design / reversing-spec export에서 코멘트·`example_value`를 제거합니다. 단위 테스트로 누출을 차단합니다.
 - [BE] 🛠️ **함수 인덱스 중복 오탐 수정**: `lower(email)` 등 expression index를 평문 컬럼 인덱스의 중복으로 잘못 판단하지 않도록 괄호 파서를 강화했습니다.

docs/doctoring/postgresql-identifier-fidelity.md

@@ -0,0 +1,52 @@
+# PostgreSQL identifier fidelity in relationship inference
+
+## Status
+
+Implemented in `frontend/src/erd/autoInfer.ts` and guarded by `frontend/src/erd/__tests__/autoInfer.postgresIdentifiers.test.ts`.
+
+## Defect
+
+Relationship inference used a display title as an identity source, split it on every period, and then passed the discovered name through an ASCII-only replacement function. Those transformations are not SQL quoting boundaries. They can silently change PostgreSQL relation identity for quoted identifiers containing spaces, non-Latin letters, mixed case, or periods, and can alias `Order.Items` to an unrelated `Items` table.
+
+## Decision
+
+Snapshot conversion carries PostgreSQL's exact `relation_name` as structured node data. Relationship inference uses that value as its identity key. A title-only fallback exists only for manually constructed legacy nodes and removes at most the first schema separator; it does not collapse subsequent periods or create trailing-segment aliases.
+
+```text
+snapshot relation_name
+→ exact relation identity key
+→ `_id` naming candidate
+→ exact map lookup
+→ inferred edge
+```
+
+The browser helper does not construct or execute SQL. Identifier rendering and SQL generation remain responsible for context-aware quoting at their own boundaries. Character deletion or last-segment aliasing is not SQL-injection prevention and can change which object is referenced.
+
+## Invariants
+
+- Snapshot relation names are propagated as structured data rather than re-parsed from presentation text.
+- Unicode, mixed-case, space-containing, and period-containing quoted relation names retain exact identity.
+- `Order.Items` is not registered as an alias for `Items`; ambiguity resolves only by exact relation name.
+- The inference heuristic still requires a matching existing table key; arbitrary column text cannot create a new target object.
+- Self-relations remain excluded by exact relation-name comparison.
+- SQL execution authority is unchanged and remains outside the browser inference helper.
+
+## Test-first evidence
+
+The regression suite was added before the production repair and covers Korean, space-containing mixed-case, period-containing quoted identifiers, and the ambiguous pair `Order.Items` versus `Items`. On the protected-base implementation the test does not compile because structured `relation_name` is absent; after that representation is introduced, the ambiguity assertion also prevents reintroducing trailing-segment aliasing.
+
+Exact-head repository CI, type checking, frontend coverage, security workflows, and independent review remain authoritative; commit order records TDD intent but does not replace those gates.
+
+## Monitoring and rollback
+
+Monitor inferred candidates and accepted inferred edges by coarse identifier class without logging full customer identifiers. A post-release drop limited to non-ASCII or quoted identifiers indicates a regression. Do not roll back to ASCII rewriting or terminal-segment aliasing. Roll back only to an implementation that preserves exact model identity and applies quoting exclusively when SQL is rendered.
+
+## References
+
+PostgreSQL Global Development Group. (2026). *4.1. Lexical structure*. In *PostgreSQL 18 documentation*. https://www.postgresql.org/docs/18/sql-syntax-lexical.html
+
+PostgreSQL Global Development Group. (2026). *9.4. String functions and operators*. In *PostgreSQL 18 documentation*. https://www.postgresql.org/docs/18/functions-string.html
+
+Rahm, E., & Bernstein, P. A. (2001). A survey of approaches to automatic schema matching. *The VLDB Journal, 10*(4), 334–350. https://doi.org/10.1007/s007780100057
+
+Rahm and Bernstein distinguish name/language evidence from structural and constraint evidence in schema matching. That distinction supports keeping the identifier token intact at the name-matching boundary instead of destructively normalizing it into a different database object identity.

frontend/src/erd/__tests__/autoInfer.postgresIdentifiers.test.ts

@@ -0,0 +1,85 @@
+import type { Node } from "@xyflow/react";
+import { describe, expect, it } from "vitest";
+
+import { inferRelationships } from "../autoInfer";
+import type { TableNodeData } from "../convert";
+
+function tableNode(
+  id: string,
+  title: string,
+  relationName: string,
+  columns: TableNodeData["columns"],
+): Node<TableNodeData> {
+  return {
+    id,
+    position: { x: 0, y: 0 },
+    data: {
+      title,
+      relation_name: relationName,
+      columns,
+      badges: {
+        pk: columns.some((column) => column.is_pk),
+        fk: columns.some((column) => column.column_name.endsWith("_id")),
+      },
+    },
+  };
+}
+
+describe("inferRelationships PostgreSQL identifier fidelity", () => {
+  it("preserves Unicode, spaces, mixed case, and periods in relation identity", () => {
+    const nodes: Node<TableNodeData>[] = [
+      tableNode("unicode_target", "public.사용자", "사용자", [
+        { column_name: "id", data_type: "bigint", is_not_null: true, is_pk: true },
+      ]),
+      tableNode("unicode_source", "public.활동", "활동", [
+        { column_name: "사용자_id", data_type: "bigint", is_not_null: true, is_pk: false },
+      ]),
+      tableNode("quoted_target", "public.Order Items", "Order Items", [
+        { column_name: "id", data_type: "bigint", is_not_null: true, is_pk: true },
+      ]),
+      tableNode("quoted_source", "public.Order Audit", "Order Audit", [
+        { column_name: "Order Items_id", data_type: "bigint", is_not_null: true, is_pk: false },
+      ]),
+      tableNode("dotted_target", "public.Order.Items", "Order.Items", [
+        { column_name: "id", data_type: "bigint", is_not_null: true, is_pk: true },
+      ]),
+      tableNode("dotted_source", "public.Order.Audit", "Order.Audit", [
+        { column_name: "Order.Items_id", data_type: "bigint", is_not_null: true, is_pk: false },
+      ]),
+    ];
+
+    const edges = inferRelationships(nodes);
+
+    expect(edges).toHaveLength(3);
+    expect(edges.find((edge) => edge.source === "unicode_source")).toMatchObject({
+      target: "unicode_target",
+      data: { sourceColumns: ["사용자_id"], targetColumns: ["id"] },
+    });
+    expect(edges.find((edge) => edge.source === "quoted_source")).toMatchObject({
+      target: "quoted_target",
+      data: { sourceColumns: ["Order Items_id"], targetColumns: ["id"] },
+    });
+    expect(edges.find((edge) => edge.source === "dotted_source")).toMatchObject({
+      target: "dotted_target",
+      data: { sourceColumns: ["Order.Items_id"], targetColumns: ["id"] },
+    });
+  });
+
+  it("does not alias a dotted relation to its trailing identifier segment", () => {
+    const nodes: Node<TableNodeData>[] = [
+      tableNode("dotted_target", "public.Order.Items", "Order.Items", [
+        { column_name: "id", data_type: "bigint", is_not_null: true, is_pk: true },
+      ]),
+      tableNode("plain_target", "public.Items", "Items", [
+        { column_name: "id", data_type: "bigint", is_not_null: true, is_pk: true },
+      ]),
+      tableNode("source", "public.Audit", "Audit", [
+        { column_name: "Items_id", data_type: "bigint", is_not_null: true, is_pk: false },
+      ]),
+    ];
+
+    expect(inferRelationships(nodes)).toContainEqual(
+      expect.objectContaining({ source: "source", target: "plain_target" }),
+    );
+  });
+});

frontend/src/erd/autoInfer.ts

@@ -1,7 +1,17 @@
 import type { Edge, Node } from "@xyflow/react";
 import type { TableNodeData } from "./convert";
 import { sourceColumnHandleId, targetColumnHandleId } from "./handleUtils";
-import { sanitizeTableName } from "./securityUtils";
+
+function relationName(node: Node<TableNodeData>): string {
+  if (node.data.relation_name) {
+    return node.data.relation_name;
+  }
+
+  const firstSeparator = node.data.title.indexOf(".");
+  return firstSeparator >= 0
+    ? node.data.title.slice(firstSeparator + 1)
+    : node.data.title;
+}
 
 /**
  * 인자로 받은 노드 목록을 바탕으로 관계(Edge)를 추론하여 반환합니다.
@@ -12,32 +22,26 @@ export function inferRelationships(
 ): Edge[] {
   const newEdges: Edge[] = [];
 
-  // ⚡ Bolt: Use Map for O(1) table name lookups instead of Set + Array.find(),
-  // reducing complexity from O(N^2) to O(N).
+  // Use exact PostgreSQL relation identity for O(1) lookups. Do not register
+  // trailing segments such as "Items" for a distinct "Order.Items" relation.
   const nodesByTableName = new Map<string, Node<TableNodeData>>();
-  for (const n of nodes) {
-    const parts = n.data.title.split(".");
-    const tableName = parts[parts.length - 1];
-    // Preserve Original .find behavior by only setting the first occurrence
-    if (!nodesByTableName.has(tableName)) {
-      nodesByTableName.set(tableName, n);
+  for (const node of nodes) {
+    const exactRelationName = relationName(node);
+    if (!nodesByTableName.has(exactRelationName)) {
+      nodesByTableName.set(exactRelationName, node);
     }
   }
 
   for (const sourceNode of nodes) {
-    const srcParts = sourceNode.data.title.split(".");
-    const srcTableName = srcParts[srcParts.length - 1];
+    const sourceRelationName = relationName(sourceNode);
 
     for (const column of sourceNode.data.columns) {
       const colName = column.column_name;
 
-      // xxxx_id 형태인지 확인
       if (colName.endsWith("_id")) {
-        const targetEntity = colName.slice(0, -3); // "_id" 제거
+        const targetEntity = colName.slice(0, -3);
 
         let targetTableName = "";
-
-        // 대상 테이블 이름 추측 (단수형/복수형 등 간단히)
         if (nodesByTableName.has(targetEntity)) {
           targetTableName = targetEntity;
         } else if (nodesByTableName.has(targetEntity + "s")) {
@@ -46,56 +50,49 @@ export function inferRelationships(
           targetTableName = targetEntity + "es";
         }
 
-        // 자기 참조는 일단 제외
-        if (targetTableName && targetTableName !== srcTableName) {
-          // ⚡ Bolt: O(1) lookup instead of O(N) string splitting array scan
-          const safeTargetTableName = sanitizeTableName(targetTableName);
-          const targetNode = nodesByTableName.get(safeTargetTableName);
+        if (targetTableName && targetTableName !== sourceRelationName) {
+          const targetNode = nodesByTableName.get(targetTableName);
+          if (!targetNode) {
+            continue;
+          }
 
-          if (targetNode) {
-            // 대상 테이블에 'id' 필드가 있는지, 혹은 PK 컬럼이 하나인지 확인
-            // 여기서는 단순하게 'id' 컬럼이 있거나, 첫 번째 PK 컬럼으로 연결
-            let targetColName = "";
-            let idCol = undefined;
-            let pkCol = undefined;
+          let targetColName = "";
+          let idCol = undefined;
+          let pkCol = undefined;
 
-            // ⚡ Bolt: Single pass O(C) search instead of two O(C) array scans with intermediate functions
-            for (const c of targetNode.data.columns) {
-              if (c.column_name === "id") {
-                idCol = c;
-                break; // id found, early exit
-              }
-              if (c.is_pk && !pkCol) {
-                pkCol = c;
-              }
+          for (const candidate of targetNode.data.columns) {
+            if (candidate.column_name === "id") {
+              idCol = candidate;
+              break;
             }
-
-            if (idCol) {
-              targetColName = "id";
-            } else {
-              if (pkCol) {
-                targetColName = pkCol.column_name;
-              } else if (targetNode.data.columns.length > 0) {
-                 targetColName = targetNode.data.columns[0].column_name;
-              }
+            if (candidate.is_pk && !pkCol) {
+              pkCol = candidate;
             }
+          }
 
-            if (targetColName) {
-              newEdges.push({
-                id: `inferred_${sourceNode.id}_${colName}_${targetNode.id}_${targetColName}`,
-                source: sourceNode.id,
-                target: targetNode.id,
-                sourceHandle: sourceColumnHandleId(colName),
-                targetHandle: targetColumnHandleId(targetColName),
-                type: "smoothstep",
-                animated: true,
-                label: "inferred_fk",
-                data: {
-                  sourceColumns: [colName],
-                  targetColumns: [targetColName],
-                },
-              });
-            }
+          if (idCol) {
+            targetColName = "id";
+          } else if (pkCol) {
+            targetColName = pkCol.column_name;
+          } else if (targetNode.data.columns.length > 0) {
+            targetColName = targetNode.data.columns[0].column_name;
+          }
+
+          if (targetColName) {
+            newEdges.push({
+              id: `inferred_${sourceNode.id}_${colName}_${targetNode.id}_${targetColName}`,
+              source: sourceNode.id,
+              target: targetNode.id,
+              sourceHandle: sourceColumnHandleId(colName),
+              targetHandle: targetColumnHandleId(targetColName),
+              type: "smoothstep",
+              animated: true,
+              label: "inferred_fk",
+              data: {
+                sourceColumns: [colName],
+                targetColumns: [targetColName],
+              },
+            });
           }
         }
       }

frontend/src/erd/convert.ts

@@ -8,6 +8,7 @@ import type { SnapshotJson } from '../types'
 
 export type TableNodeData = {
   title: string
+  relation_name?: string
   comment?: string | null
   columns: Array<{ column_name: string; data_type: string; is_not_null: boolean; is_pk: boolean; column_comment?: string | null; example_value?: string | number | boolean | null }>
   indexes?: IndexRecommendation[]
@@ -134,6 +135,7 @@ export function snapshotToGraph(snapshot: SnapshotJson): { nodes: Array<Node<Tab
       position: { x: (i % GRID_COLUMNS) * GRID_X_GAP, y: Math.floor(i / GRID_COLUMNS) * GRID_Y_GAP },
       data: {
         title: `${t.schema_name}.${t.relation_name}`,
+        relation_name: t.relation_name,
         comment: t.relation_comment,
         columns: cols,
         badges: {