Release/v1.2.0

README.md

@@ -43,8 +43,9 @@ The application runs entirely in a browser and works from the local filesystem.
 > source SQL and the target database.
 
 For the first stable release, see
-[RELEASE_NOTE_v1.0.0.md](RELEASE_NOTE_v1.0.0.md). For the v1.1.0 release, see
-[RELEASE_NOTE_1.1.0.md](docs/RELEASE_NOTE_1.1.0.md).
+[RELEASE_NOTE_v1.0.0.md](docs/RELEASE_NOTE_v1.0.0.md). For the v1.1.0 release, see
+[RELEASE_NOTE_1.1.0.md](docs/RELEASE_NOTE_1.1.0.md). For the v1.2.0 release, see
+[RELEASE_NOTE_1.2.0.md](docs/RELEASE_NOTE_1.2.0.md).
 
 ## Start here
 
@@ -60,7 +61,7 @@ For the first stable release, see
 
 ## 60-second quick start
 
-1. Download the `v1.1.0` archive from
+1. Download the `v1.2.0` archive from
    [GitHub Releases](https://github.com/ikelaiah/ProcFlow/releases) or clone
    this repository.
 2. Extract the complete archive. Keep `index.html`, `styles.css`, `dist/`, and
@@ -127,7 +128,7 @@ statements.
    analysis to another engineer.
 
 ProcFlow imports SQL text, not report-definition files. SSRS/RDL import is on
-the roadmap; for v1.1.0, paste or export the dataset SQL itself.
+the roadmap; for v1.2.0, paste or export the dataset SQL itself.
 
 ## What ProcFlow can show
 
@@ -185,7 +186,7 @@ than silently disappearing from the diagram.
 
 ## Supported SQL
 
-ProcFlow v1.1.0 recognises:
+ProcFlow v1.2.0 recognises:
 
 - Microsoft T-SQL
 - IBM DB2 SQL PL
@@ -196,9 +197,10 @@ Supported inputs include procedures, functions, triggers, views, plain SQL
 statements, report dataset queries, and multi-object scripts where those object
 types apply to the selected dialect.
 
-Dialect-specific v1.1.0 coverage includes:
+Dialect-specific v1.2.0 coverage includes:
 
-- **T-SQL:** `TRY`/`CATCH`, `THROW`, `RAISERROR` severity, `XACT_STATE()`,
+- **T-SQL:** semicolon-free statements with grammar-driven boundaries, `TRY`/
+  `CATCH`, `THROW`, `RAISERROR` severity, `XACT_STATE()`,
   `@@TRANCOUNT`, nested transaction depth, savepoints, `SET XACT_ABORT`, and
   invalid transaction-action termination.
 - **DB2 SQL PL:** scoped handlers, cursors, `NOT FOUND` flow, and labelled loop
@@ -209,6 +211,9 @@ Dialect-specific v1.1.0 coverage includes:
   conditional `WHERE`, and searched `CASE` paths.
 
 Detection is automatic and can be overridden from the **Dialect** selector.
+When detection is uncertain and several dialects score equally, an explicit
+`dialect_ambiguous` diagnostic is reported along with the usual
+low-confidence warning.
 
 ## Importing SQL
 
@@ -241,7 +246,7 @@ endorsed by draw.io.
 
 ### Quick answers
 
-| Question | ProcFlow v1.1.0 behavior |
+| Question | ProcFlow v1.2.0 behavior |
 |---|---|
 | Is SQL uploaded? | No. Analysis and rendering happen in the browser tab. |
 | Does it connect to a database? | No. There is no driver, connection string, or query execution. |
@@ -275,7 +280,7 @@ network-submission code. The only bundled third-party runtime is the pinned
 Mermaid 10.9.1 renderer. Its MIT licence is stored at
 `vendor/mermaid/LICENSE`.
 
-The SHA-256 of `vendor/mermaid/mermaid.min.js` in v1.1.0 is:
+The SHA-256 of `vendor/mermaid/mermaid.min.js` in v1.2.0 is:
 
 ```text
 61B335A46DF05A7CE1C98378F60E5F3E77A7FB608A1056997E8A649304A936D6
@@ -286,7 +291,7 @@ so the release checksum remains reproducible across operating systems.
 
 ### Guidance for security review
 
-1. Review and pin the `v1.1.0` tag or its exact commit.
+1. Review and pin the `v1.2.0` tag or its exact commit.
 2. Verify the vendored Mermaid checksum.
 3. Review the runtime files listed above.
 4. Open the reviewed files locally or serve them from an approved internal
@@ -316,14 +321,16 @@ and contains no automatic data-submission path.
 - Parsing is heuristic and does not provide the guarantees of the target
   database engine's parser.
 - Dynamic SQL is opaque.
-- Semicolon-free or unusually formatted batches can produce inaccurate
-  statement boundaries.
+- Statement boundaries no longer depend on newline position: semicolons are
+  authoritative and omitted semicolons are split by control keywords and
+  statement grammar. Exceptionally malformed batches can still produce imperfect
+  splits.
 - Query lineage is object-level rather than column-level.
 - Comma-separated sources and some vendor-specific table expressions might not
   be detected.
 - Temporary-table, synonym, linked-server, and cross-database resolution is
   lightweight.
-- SSRS/RDL files are not imported in v1.1.0.
+- SSRS/RDL files are not imported in v1.2.0.
 - Large draw.io exports can require manual rearrangement.
 
 Always confirm critical dependencies, execution paths, transaction behavior,
@@ -389,11 +396,11 @@ Then open:
 - `http://127.0.0.1:8000/tests/ui.html` — browser interaction and local-runtime
   tests
 
-The v1.1.0 baseline is:
+The v1.2.0 baseline is:
 
-- 131 focused golden tests
+- 156 golden and boundary assertions
 - 400 deterministic mutation cases
-- 12 browser interaction tests
+- 13 browser interaction tests
 
 GitHub Actions installs dependencies, type-checks, builds, verifies generated
 files, runs the local-file smoke test, checks that the runtime remains
@@ -406,7 +413,7 @@ request.
 index.html
 styles.css
 README.md
-RELEASE_NOTE_v1.0.0.md
+ROADMAP.md
 package.json
 package-lock.json
 tsconfig.json
@@ -416,6 +423,14 @@ tsconfig.json
     └── correctness.yml
 assets/
 └── procflow-logo.svg  # adaptive light/dark README wordmark
+docs/
+├── PR_NOTE_1.1.0.md
+├── PR_NOTE_1.2.0.md
+├── RELEASE_NOTE_1.1.0.md
+├── RELEASE_NOTE_1.2.0.md
+├── RELEASE_NOTE_v1.0.0.md
+├── RELEASE_NOTE_v1.1.0.md
+└── RELEASE_NOTE_v1.2.0.md
 scripts/
 └── file-smoke.mjs    # dependency-free local-file release smoke test
 src/
@@ -434,6 +449,8 @@ tests/
 ├── fuzz.html
 ├── ui.html
 ├── fixtures.ts
+├── tsql-fixtures.ts
+├── boundary.ts
 ├── tests.ts
 ├── fuzz.ts
 ├── ui-tests.ts
@@ -470,12 +487,12 @@ Then verify:
 2. `git status --short` shows only the intended release changes.
 3. Generated `dist/` files match their TypeScript sources.
 4. The Mermaid SHA-256 matches the value in this README and the workflow.
-5. `RELEASE_NOTE_1.1.0.md` matches the final tag contents.
+5. `RELEASE_NOTE_1.2.0.md` matches the final tag contents.
 6. The complete archive opens locally with `index.html`.
-7. The tag is named `v1.1.0`.
+7. The tag is named `v1.2.0`.
 
-The release can then be created manually from the `v1.1.0` tag using
-[RELEASE_NOTE_1.1.0.md](docs/RELEASE_NOTE_1.1.0.md).
+The release can then be created manually from the `v1.2.0` tag using
+[RELEASE_NOTE_1.2.0.md](docs/RELEASE_NOTE_1.2.0.md).
 
 ## Roadmap after v1.0.0