vxlan 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d63ce72a439c443b93146031919d9c1a6959608263a755cc93b633b442cfe6d8
-  data.tar.gz: c7a77c3ea5d30f0ed8208a34d8a3ea2ca471fbd62c80d4fc5692f56fab76d261
+  metadata.gz: 41317f98c5496446fedd54ad973ea187cc30c234d45f8582ba7bfab4f4b359ce
+  data.tar.gz: 6db8bbc8223f8f105dd64db42535b46faa5e15a9c9ea37da6d06f092856390d3
 SHA512:
-  metadata.gz: 7f6a22391a2237744aa371a3a8db3ce2f88ef1e06b229e23b3fc1dcaaa034b55a1fa83f0fa0f4f85416fa545a88f228b349d5c74c9ab2f455ba69cdb9d0617ca
-  data.tar.gz: 5035dc852c9e249aadb9017b5cccd273bdded71624ccbe4980d263c1590c8adbc337a55b8069766d95578e8c2fa2b48a040dd13aac2d0560e4b34e9a93db9157
+  metadata.gz: 77e6a998e4ddb67b5d31ab5087877c9cedc5e374873e62d351b222f1f39b349a8b324383662a77b8d4ff6deea347675eb1746400424b38a1920597ef298da1cc
+  data.tar.gz: 72336196c2ae2300094558822f3b2b3e3dbc9a3aa90e0a29668be4bb79f111c5fb7641a7281ab71d17f16e796c526523b8174b063835051d7db7433a8c2162c7

data/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 Changes to the public contract are recorded here. Versions follow Semantic Versioning.
 
+## 0.2.1 (2026-10-17)
+
+- Require ctx_parser and ctx_driver 0.2.x so configuration APIs and command capture behavior resolve consistently.
+
+## 0.2.0 (2026-10-17)
+
+### Changed
+
+- Breaking: replace `L2routeParser` with `RuntimeParser`, rename `CiscoNxos::ConfigurationDocument` to `CiscoNxos::Document`, and move configuration helpers from `ConfigurationParsing` to `Syntax`.
+- Breaking: rename `CiscoNxos::Profile::CATALOG` to `DECLARATIONS` and adopt the shared `CtxParser::Configuration`, `Commands`, and address conversion APIs.
+- Require symbol observation names and matching `Observation` values in snapshot dimensions; string interpolation now exposes metadata only.
+
+### Fixed
+
+- Copy collection identity and dimension selection before connector callbacks can mutate them.
+- Reject paginated or terminal-edited runtime output with no records, and keep affected configuration captures incomplete.
+- Exclude conflicting port-channel members across wrapped lines and groups, and stop continuations at invalid rows or table boundaries.
+- Exclude conflicting singleton configuration values and prevent inheritance or default values from restoring ambiguous derived facts.
+- Keep unsupported routing nesting partial and process deeply nested unrelated configuration without exhausting the Ruby call stack.
+- Reduce repeated scans and copies in BGP statistics, policy sequence checks, prefix-list references, and wrapped L2RIB next hops while preserving ordering and duplicate rejection.
+
 ## 0.1.0 (2026-10-16)
 
 ### Added

data/README-zh.md

@@ -21,7 +21,7 @@ gem "vxlan"
 
 然后执行 `bundle install`；也可直接执行 `gem install vxlan`。Ruby 加载入口为 `vxlan`，公开命名空间为 `Vxlan`；gem 包名与 Ruby 命名空间分别维护。
 
-模块运行依赖：[`ctx_parser`](https://github.com/gatework/ctx_parser), [`ctx_driver`](https://github.com/gatework/ctx_driver)。 gemspec 的运行依赖不添加版本约束；应用应提交自己的 `Gemfile.lock`，保持部署可复现。使用本库不需要启动 Rails 或配置兄弟模块的本地路径。
+模块运行依赖：[`ctx_parser`](https://github.com/gatework/ctx_parser), [`ctx_driver`](https://github.com/gatework/ctx_driver)。 共享 Gatework 依赖要求兼容的 0.2.x API；应用应提交自己的 `Gemfile.lock`，保持部署可复现。使用本库不需要启动 Rails 或配置兄弟模块的本地路径。
 
 发布产物和校验值见 [GitHub Releases](https://github.com/gatework/vxlan/releases)，已发布版本以 [RubyGems](https://rubygems.org/gems/vxlan) 为准。
 
@@ -60,12 +60,22 @@ observation.records.each { |record| p record }
 
 `Collector#collect(connector:, target:, fabric_key:, model: nil, dimensions:)` 使用宿主提供的 connector；设备身份、凭据、持久化、库存对账和并发策略由宿主负责。本 gem 不包含 fabric 规划、配置下发、Rails 模型或 `Vxlan::Sync`。加载库或运行离线示例不会访问设备。
 
+采集器在打开连接前复制目标身份、Fabric 身份和维度选择。`Observation` 的名称必须为 Symbol；`Snapshot` 的维度值必须是名称与键一致的 `Observation`。两种对象的字符串插值均使用只含元数据的 `inspect` 表示。
+
+接口、NVE、路由、VRF 和 vPC 等单值配置发生冲突时，移除歧义字段并保留部分证据。VRF 冲突的接口、配置冲突的 BGP 邻居或模板在推导地址或继承事实前被排除；未解析的 peer-template 不生成邻居投影。不支持的路由嵌套也保持 `partial`。运行回显含分页或终端编辑控制符时，因无法信任行边界，返回无记录的 `partial`。Port-channel 成员冲突检查同时覆盖续行及不同聚合组。
+
 详细厂商语义、历史验证记录和 Motor 专用集成说明保留在[架构参考](docs/architecture-zh.md)。其中宿主集成代码需要 Motor，不属于独立 gem API。适配层位于 [Motor 仓库](https://github.com/gatework/motor/tree/main/backend/lib) 的 `backend/lib/baseline`、`backend/lib/vxlan` 和 `backend/lib/wireless`。
 
 生命周期 connector 是宿主适配器，提供 `open { |session| }`，VXLAN 和 Wireless 还要求 `platform`；原生 `Net::Connector::Base` 实例并不提供这一宿主生命周期协议。已连接的原生会话可传入 `CtxDriver::Reader` 或 `CtxChecker::Collector#collect_session`，不会隐式连接或重试。
 
+## 领域术语
+
+VLAN ID、VNI、VRF、NVE 成员是不同身份。配置审查通过 VNI 关联 VLAN 映射与 NVE 成员，不推断运行可达性。`BgpNeighbors` 枚举应用 peer-template 继承后的配置邻居，不代表已建立的 BGP 会话。`PrefixListReferences` 表达 route-map 选择器及路由使用方的引用关系，引用本身不能证明路由被接受。
+
 ## 开发与测试
 
+共享类按实际职责命名，平台信息放在命名空间中。直接对应设备命令的解析器保留文件名和类名。
+
 ```sh
 bundle install
 bundle exec rake
@@ -77,6 +87,8 @@ bundle exec rake build
 
 使用声明的最低 Ruby 版本检查兼容性。方法用途统一使用简明中文注释；复杂实现还需说明业务规则、实现思路及关键分支。保持公开返回值与错误契约。真实回显和凭据不可进入示例、fixture、日志或发布包。
 
+运行 `bundle exec ruby -Ilib benchmark/tables.rb`，比较 500、2,000、5,000 条数据下的本地解析及引用构建开销。每组核对结果，报告三次采样中的最快耗时与对象分配数。合成输入不代表设备或网络性能。
+
 ## 发布
 
 本目录可独立维护为 [vxlan](https://github.com/gatework/vxlan) 仓库。更新 `VERSION` 和 `CHANGELOG.md`，运行上述验证与构建命令，检查包内文件，再创建 `vVERSION` 标签。

data/README.md

@@ -21,7 +21,7 @@ gem "vxlan"
 
 Then run `bundle install`, or install directly with `gem install vxlan`. The require path is `vxlan` and the public namespace is `Vxlan`; package names and Ruby namespaces are intentionally separate.
 
-Internal runtime dependencies: [`ctx_parser`](https://github.com/gatework/ctx_parser), [`ctx_driver`](https://github.com/gatework/ctx_driver). The gemspec declares runtime dependencies without version constraints. Applications should commit their own `Gemfile.lock` to make deployments reproducible. No Rails boot or sibling checkout paths are required.
+Internal runtime dependencies: [`ctx_parser`](https://github.com/gatework/ctx_parser), [`ctx_driver`](https://github.com/gatework/ctx_driver). Shared Gatework dependencies require the compatible 0.2.x API. Applications should commit their own `Gemfile.lock` to make deployments reproducible. No Rails boot or sibling checkout paths are required.
 
 Release artifacts and checksums are available from [GitHub Releases](https://github.com/gatework/vxlan/releases). Check [RubyGems](https://rubygems.org/gems/vxlan) for published versions.
 
@@ -60,12 +60,22 @@ Complete transport is necessary but insufficient for complete parsing: unknown s
 
 `Collector#collect(connector:, target:, fabric_key:, model: nil, dimensions:)` uses a host-supplied connector; device identity, credentials, persistence, reconciliation, and concurrency policy belong to the host. This gem includes no fabric planner, provisioning engine, Rails models, or `Vxlan::Sync`. Loading or running the offline example does not access a device.
 
+The collector copies target identity, fabric identity, and dimension selection before opening the connection. `Observation` names must be symbols; each `Snapshot` dimension must hold an `Observation` with a matching name. Both objects use their metadata-only `inspect` representation for string interpolation.
+
+Conflicting singleton configuration values are excluded and reported as partial evidence, including interface, NVE, routing, VRF, and vPC settings. An interface with a conflicting VRF, or a BGP neighbor or template with conflicting settings, is excluded before deriving addresses or inherited facts; unresolved peer templates produce no neighbor projection. Unsupported routing nesting stays partial. Runtime output containing pagination or terminal editing controls returns `partial` with no records because its row boundaries cannot be trusted. Port-channel member conflicts are excluded across both wrapped lines and separate groups.
+
 Detailed vendor behavior, historical validation notes, and Motor-only integration are preserved in [the architecture reference](docs/architecture-zh.md). Host integration examples in that reference require Motor; they are not standalone gem APIs. Motor adapters live under `backend/lib/baseline`, `backend/lib/vxlan`, and `backend/lib/wireless` in the [Motor repository](https://github.com/gatework/motor/tree/main/backend/lib).
 
 The lifecycle connector is a host adapter exposing `open { |session| }` (and `platform` for VXLAN and Wireless). It is distinct from a native `Net::Connector::Base` device instance. Borrowed native sessions are accepted by `CtxDriver::Reader` and `CtxChecker::Collector#collect_session`; they are never implicitly connected or retried.
 
+## Domain vocabulary
+
+VLAN IDs, VNIs, VRFs, and NVE members are separate identities. Configuration review joins VLAN mappings and NVE members by VNI; it does not infer operational reachability. `BgpNeighbors` enumerates configured neighbors after peer-template inheritance, not established BGP sessions. `PrefixListReferences` describes route-map selectors and their routing consumers; those references do not by themselves prove route acceptance.
+
 ## Development and tests
 
+Name shared classes by their responsibility and use the namespace for platform context. Preserve filenames and class names that directly match device commands.
+
 ```sh
 bundle install
 bundle exec rake
@@ -77,6 +87,8 @@ bundle exec rake build
 
 Use the declared minimum Ruby version for compatibility checks. Document source methods and non-obvious business logic in concise Chinese, preserve public return/error contracts, and never add raw device captures or credentials to examples, fixtures, logs, or release archives.
 
+Run `bundle exec ruby -Ilib benchmark/tables.rb` to compare local parsing and reference-building costs for 500, 2,000, and 5,000 entries. Each case checks its result and reports the fastest of three samples plus allocated objects. These synthetic measurements do not measure device or network performance.
+
 ## Release
 
 This directory can be maintained as the independent [vxlan](https://github.com/gatework/vxlan) repository. Update `VERSION` and `CHANGELOG.md`, run the validation and build commands above, and inspect the packaged file list before tagging `vVERSION`.

data/docs/architecture-zh.md

@@ -13,7 +13,7 @@ Motor::Device
   → Motor::Devices::Connector（凭据、平台、严格主机密钥、超时、会话生命周期）
   → CtxDriver::Reader（net-connector 单命令采集边界）
   → Vxlan::Collector（同一设备逐条读取）
-  → Configuration / RuntimeParser / L2routeParser（维度与 Observation 适配）
+  → Configuration / RuntimeParser（维度与 Observation 适配）
   → CiscoNxos::Profile / Parsers::Show*（平台与型号策略、按命令解析）
   → Snapshot / Observation
   → Vxlan::Sync（锁设备、复核来源与版本、事务）
@@ -49,7 +49,7 @@ bundle exec rake 'motor:netstack:vxlan[456,LAB]'
 
 Cisco N9K 的具体策略位于 [`lib/vxlan/cisco_nxos`](../lib/vxlan/cisco_nxos/profile.rb)，按命令拆分为 `parsers/show_ip_ospf_neighbors.rb` 等独立文件。直接调用 `Vxlan::CiscoNxos::Parsers::ShowIpOspfNeighbors.parse(cli_output, complete: true)` 即可离线解析。`ParserRegistry.fetch(:cisco_nxos, model: device.model)` 选择平台与型号策略；命令清单和解析类统一在 `CiscoNxos::Profile` 中声明。原解析入口继续转换为 `Vxlan::Observation`。公共接口、结果对象和扩展方式见 [`../ctx_parser`](https://github.com/gatework/ctx_parser)。
 
-配置解析按职责组合：`ShowRunningConfig` 编排命令解析，`ConfigurationParsing::Interfaces/Routing/Policies` 分别解释接口/NVE、路由上下文及策略语法，`CtxParser::ConfigurationParser` 管理逐行状态、嵌套来源路径与捕获，`CiscoNxos::Configuration` 在全部块解析后归约特性列表、校验 BGP 模板引用并关联 SVI/VLAN/VNI 网段。接口地址与网段使用 `CtxParser::Values.ipv4_prefix` 的同一校验。重复身份仍排除歧义记录；语法未知、引用不完整与来源行号继续进入原有 `Result`，供入库边界判断。
+配置解析按职责组合：`ShowRunningConfig` 编排命令解析，`Syntax::Interfaces/Routing/Policies` 分别解释接口/NVE、路由上下文及策略语法，`CtxParser::Configuration` 管理逐行状态、嵌套来源路径与捕获，`CiscoNxos::Configuration` 在全部块解析后归约特性列表、校验 BGP 模板引用并关联 SVI/VLAN/VNI 网段。接口地址与网段使用 `CtxParser::Values.ipv4_prefix` 的同一校验。重复身份仍排除歧义记录；语法未知、引用不完整与来源行号继续进入原有 `Result`，供入库边界判断。
 
 设备连接默认关闭旧版 SSH 算法协商。确认单台旧设备确有算法兼容需求后，可在其现有 `settings["connector"]["legacy_ssh"]` 中显式保存布尔值 `true`；省略或 `false` 保持关闭，字符串、NULL 等非布尔值会在连接前拒绝。该设置直接传给 net-connector，主机密钥仍严格核验 `storage/net_connector/known_hosts`，不启用 Telnet 回退。连接异常仅保留允许列表中的诊断码（例如 `unsupported_host_key_algorithm`），未知码归为 `connection_failed`；VXLAN 未采集维度保存该原因，不保存底层异常文案或 cause。
 
@@ -84,7 +84,7 @@ NVE 的内联 `member vni ... mcast-group ...` 与嵌套组播声明归一为相
 
 `ip unnumbered` 保留借用接口关系；同 VRF 的唯一 Loopback IPv4 地址归约到 `unnumbered_addresses`。Underlay 清单使用该物理接口和借用的 /32 主机地址，不猜测链路子网。缺失、歧义、循环或跨 VRF 引用保持 partial；IPv6 Underlay 未被伪装成已支持的 IPv4 清单。
 
-NX-OS 的 `ConfigurationDocument` 与 Baseline 共用 `CtxParser::Banner` 状态机，banner 正文不会生成配置事实；EOF 未闭合会产生 `incomplete_banner`。
+NX-OS 的 `Document` 与 Baseline 共用 `CtxParser::Banner` 状态机，banner 正文不会生成配置事实；EOF 未闭合会产生 `incomplete_banner`。
 
 完整配置的 `review_findings` 输出 VLAN/VNI/NVE/EVPN 关联核查项，不改变语法完整性，也不直接表示运行故障。`review_status` 为 partial 时不根据缺失数据生成关联结论。这样保留“配置收到且语法已理解”和“业务关联需要核实”两个事实。
 

data/lib/vxlan/bgp_neighbors.rb

@@ -14,14 +14,18 @@ module Vxlan
     def each
       return enum_for(:each) unless block_given?
 
-      templates = @bgp.fetch(:templates, {})
-      { "default" => @bgp }.merge(@bgp.fetch(:vrfs, {})).each do |vrf, scope|
-        scope.fetch(:neighbors, {}).each do |peer, child|
-          parent = templates.fetch(child[:inherit_peer], {})
-          families = parent.fetch(:address_families, {}).merge(child.fetch(:address_families, {})) do |_name, inherited, explicit|
-            inherited.merge(explicit.compact).merge(route_maps: inherited.fetch(:route_maps, {}).merge(explicit.fetch(:route_maps, {})))
+      peer_templates = @bgp.fetch(:templates, {})
+      { "default" => @bgp }.merge(@bgp.fetch(:vrfs, {})).each do |vrf, vrf_configuration|
+        vrf_configuration.fetch(:neighbors, {}).each do |peer, neighbor_configuration|
+          inherited_name = neighbor_configuration[:inherit_peer]
+          # 未解析或已冲突的模板不能生成看似有效的邻居投影。
+          next if inherited_name && !peer_templates.key?(inherited_name)
+
+          peer_template = peer_templates.fetch(inherited_name, {})
+          address_families = peer_template.fetch(:address_families, {}).merge(neighbor_configuration.fetch(:address_families, {})) do |_name, template_family, neighbor_family|
+            template_family.merge(neighbor_family.compact).merge(route_maps: template_family.fetch(:route_maps, {}).merge(neighbor_family.fetch(:route_maps, {})))
           end
-          yield vrf, peer, parent.merge(child.compact).merge(address_families: families)
+          yield vrf, peer, peer_template.merge(neighbor_configuration.compact).merge(address_families: address_families)
         end
       end
     end

data/lib/vxlan/cisco_nxos/{configuration_document.rb → document.rb}

@@ -2,11 +2,12 @@
 
 require "ctx_parser/document"
 require "ctx_parser/banner"
+require_relative "terminal"
 
 module Vxlan
   module CiscoNxos
     # NX-OS 横幅始终作为词法文本处理，即使其正文看起来像命令。
-    class ConfigurationDocument < CtxParser::Document
+    class Document < CtxParser::Document
       protected
 
       # 区分配置结构行与引号、横幅中的文本内容。
@@ -14,7 +15,7 @@ module Vxlan
         @banner ||= CtxParser::Banner.new
         return :ignored if @banner.consume(line.text)
 
-        if /--\s*More\s*--|\e\[/i.match?(line.text)
+        if Terminal.invalid_output?(line.raw)
           issues << { code: :incomplete_configuration, line: line.number }
           return :ignored
         end
@@ -24,6 +25,7 @@ module Vxlan
 
       # 报告配置文档结束时仍未闭合的横幅。
       def finish
+        issues.each { |issue| cursor.mark(issue.fetch(:line) - 1, state: :invalid) }
         issues << { code: :incomplete_banner } if @banner&.open?
       end
     end

data/lib/vxlan/cisco_nxos/evpn_l2route.rb

@@ -18,7 +18,7 @@ module Vxlan
       def parse_rows(text)
         type = self.class::TYPE
         @totals = []
-        fields = previous = nil
+        fields = previous = next_hop_index = nil
         text.each_line.with_index(1) do |source, number|
           line = source.strip
           next if line.empty? || line.match?(/\A[-=\s]+\z/) || line.match?(/\A(?:Flags\s*-\s*)?(?:\([A-Za-z0-9]+\):[A-Za-z0-9 ,\/-]+\s*)+\z/)
@@ -45,9 +45,21 @@ module Vxlan
                 values = line.split(/\s+/, fields.size)
                 raise ArgumentError unless values.size == fields.size
                 previous = route(fields.zip(values).to_h, type)
+                next_hop_index = nil
                 @rows << previous
               elsif previous && source.match?(/\A\s+/)
-                previous[:next_hops] = (previous[:next_hops] + next_hops(line)).uniq
+                hops = next_hops(line)
+                # 首条续行建立索引，后续仅追加新下一跳；非法续行不会改动已有事实。
+                unless next_hop_index
+                  previous[:next_hops].uniq!
+                  next_hop_index = previous[:next_hops].to_h { |hop| [ hop, true ] }
+                end
+                hops.each do |hop|
+                  next if next_hop_index.key?(hop)
+
+                  previous[:next_hops] << hop
+                  next_hop_index[hop] = true
+                end
               else
                 raise ArgumentError
               end
@@ -73,9 +85,9 @@ module Vxlan
       def route(values, type)
         values[:topology_id] = number(values[:topology_id])
         raise ArgumentError unless values[:mac].match?(/\A(?:[0-9a-f]{4}(?:\.[0-9a-f]{4}){2}|(?:[0-9a-f]{2}:){5}[0-9a-f]{2})\z/i)
-        values[:mac] = CtxParser::Values.mac(values[:mac])
+        values[:mac] = CtxParser::Values.mac_address(values[:mac])
         values[:sequence] = number(values[:sequence]) if values[:sequence]
-        values[:host_ip] = host(values.fetch(:host_ip)) if type == :mac_ip
+        values[:host_ip] = ip_address(values.fetch(:host_ip)) if type == :mac_ip
         values[:next_hops] = next_hops(values.fetch(:next_hops))
         values
       end
@@ -91,7 +103,7 @@ module Vxlan
           when /\ALocal\z/i then { local: true }
           when /\AIfindex\s+(\d+)\z/i then { ifindex: number($1) }
           when /\A(?:Eth|Po|nve|Lo|Vlan|vPC)/i then { interface: token }
-          else { address: host(token) }
+          else { address: ip_address(token) }
           end
           value[:label] = number(match[:label]) if match[:label]
           result << value
@@ -110,8 +122,8 @@ module Vxlan
       end
 
       # 归一化主机地址，保留 IPv4 与 IPv6 语义。
-      def host(value)
-        CtxParser::Values.host(value, allow_zone: true)
+      def ip_address(value)
+        CtxParser::Values.ip_address(value, allow_zone: true)
       end
     end
   end

data/lib/vxlan/cisco_nxos/parser.rb

@@ -4,6 +4,7 @@ require "ctx_parser/parser"
 require "ctx_parser/records"
 require "ctx_parser/input"
 require "ctx_parser/values"
+require_relative "terminal"
 
 module Vxlan
   module CiscoNxos
@@ -23,6 +24,10 @@ module Vxlan
         rescue EncodingError
           return CtxParser::Result.new(status: :partial, issues: [ { code: :invalid_encoding } ])
         end
+        if Terminal.invalid_output?(text)
+          line = text.each_line.with_index(1).find { |source, _number| Terminal.invalid_output?(source) }.last
+          return CtxParser::Result.new(status: :partial, issues: [ { code: :invalid_terminal_output, line: line } ])
+        end
         if self.class::UNSUPPORTED&.match?(text)
           return CtxParser::Result.new(status: :unsupported, issues: [ { code: :command_unsupported } ])
         end
@@ -89,8 +94,8 @@ module Vxlan
       end
 
       # 校验主机地址有效性，不让格式错误值继续传播。
-      def valid_host?(value)
-        CtxParser::Values.valid_host?(value, allow_zone: true)
+      def ip_address?(value)
+        CtxParser::Values.ip_address?(value, allow_zone: true)
       end
 
       # 返回可作为权威清单的结果前，先识别身份冲突。

data/lib/vxlan/cisco_nxos/parsers/show_bgp_l2vpn_evpn_summary.rb

@@ -19,7 +19,7 @@ module Vxlan
 
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
-          scope, prefix_columns, prefix_seen = {}, nil, []
+          scope, prefix_columns, prefix_seen, peers = {}, nil, {}, {}
           lines(text) do |line, number|
             if HEADER.match?(line)
               @header = true
@@ -28,23 +28,23 @@ module Vxlan
               prefix_columns = nil
             elsif (match = /\ABGP router identifier (\S+), local AS number (\S+)/.match(line))
               scope.merge!(router_id: match[1].delete_suffix(","), local_as: match[2])
-              reject(number) unless valid_host?(scope[:router_id]) && scope[:local_as].match?(/\A\d+(?:\.\d+)?\z/)
+              reject(number) unless ip_address?(scope[:router_id]) && scope[:local_as].match?(/\A\d+(?:\.\d+)?\z/)
             elsif line.match?(/\ANeighbor\s+T\s+AS\s+PfxRcd\s+Type-2\s+Type-3\s+Type-4\s+Type-5(?:\s+Type-12)?\z/)
               prefix_columns = line.end_with?("Type-12") ? %i[type2 type3 type4 type5 type12] : %i[type2 type3 type4 type5]
             elsif prefix_columns
               words = line.split
-              peer = @rows.find { |row| row[:peer_ip] == words[0] && row[:vrf] == scope[:vrf] }
+              peer = peers[[ scope[:vrf], scope[:address_family], words[0] ]]
               if words.size == prefix_columns.size + 4 && %w[I E].include?(words[1]) && words.drop(2).all? { |word| word.match?(/\A\d+\z/) } &&
-                peer && !prefix_seen.include?(peer.object_id) && peer[:remote_as] == words[2].to_i && peer[:prefixes_received] == words[3].to_i
+                peer && !prefix_seen.key?(peer.object_id) && peer[:remote_as] == words[2].to_i && peer[:prefixes_received] == words[3].to_i
                 peer[:prefixes_by_type] = prefix_columns.zip(words.drop(4).map(&:to_i)).to_h
-                prefix_seen << peer.object_id
+                prefix_seen[peer.object_id] = true
               else
                 reject(number)
               end
             elsif (match = ROW.match(line))
               row = FIELDS.zip(match.captures).to_h.merge(scope)
               INTEGERS.each { |key| row[key] = row[key].to_i }
-              unless valid_host?(row[:peer_ip]) && row[:version] == 4 && (1..4_294_967_295).cover?(row[:remote_as]) &&
+              unless ip_address?(row[:peer_ip]) && row[:version] == 4 && (1..4_294_967_295).cover?(row[:remote_as]) &&
                 row[:state].match?(/\A(?:\d+|Idle(?: \(Admin\))?|Active|Connect|OpenSent|OpenConfirm|Shutdown)\z/i)
                 reject(number)
                 next
@@ -53,6 +53,8 @@ module Vxlan
               row[:prefixes_received] = row[:state].match?(/\A\d+\z/) ? row[:state].to_i : nil
               row[:state] = "established" if row[:prefixes_received]
               @rows << row
+              # 统计表按完整作用域查找；重复邻居仍由最终身份检查整体隔离。
+              peers[row.values_at(:vrf, :address_family, :peer_ip)] ||= row
             elsif !line.match?(/\A(?:BGP table version is \d+(?:, L2VPN EVPN config peers \d+, capable peers \d+)?|\d+ network entries and \d+ paths using \d+ bytes of memory|BGP attribute entries \[\d+\/\d+\], BGP AS path entries \[\d+\/\d+\]|BGP community entries \[\d+\/\d+\], BGP clusterlist entries \[\d+\/\d+\])\z/i)
               reject(number)
             end

data/lib/vxlan/cisco_nxos/parsers/show_cdp_neighbors_detail.rb

@@ -43,7 +43,7 @@ module Vxlan
             when /\AMgmt address\(es\):(?:\s+\d+)?\z/i then scope = :management_addresses
             when /\AIP(?:v[46])? Address:\s*(\S+)\z/i
               value = $1
-              if %i[interface_addresses management_addresses].include?(scope) && valid_host?(value)
+              if %i[interface_addresses management_addresses].include?(scope) && ip_address?(value)
                 row[scope] << IPAddr.new(value).to_s
               else
                 reject(number)

data/lib/vxlan/cisco_nxos/parsers/show_interface_brief.rb

@@ -33,7 +33,7 @@ module Vxlan
               case layout
               when /\APort\s+VRF/i
                 if state == 2 && [ 4, 6 ].include?(words.size) && (words.size == 4 || words[5].match?(/\A\d+\z/)) &&
-                  (words[3] == "--" || valid_host?(words[3]))
+                  (words[3] == "--" || ip_address?(words[3]))
                   row.merge!(vrf: words[1], ip_address: words[3])
                   row.merge!(speed: words[4], mtu: words[5].to_i) if words.size == 6
                 else

data/lib/vxlan/cisco_nxos/parsers/show_ip_ospf_neighbors.rb

@@ -29,7 +29,7 @@ module Vxlan
             elsif (match = ROW.match(line))
               row = FIELDS.zip(match.captures).to_h.merge(scope)
               row[:priority] = row[:priority].to_i
-              unless valid_host?(row[:neighbor_id]) && valid_host?(row[:address]) && (0..255).cover?(row[:priority]) &&
+              unless ip_address?(row[:neighbor_id]) && ip_address?(row[:address]) && (0..255).cover?(row[:priority]) &&
                 row[:state].match?(/\A(?:DOWN|ATTEMPT|INIT|2WAY|EXSTART|EXCHANGE|LOADING|FULL)\/(?:\s*(?:DR|BDR|DROTHER|-))\z/i)
                 reject(number)
                 next

data/lib/vxlan/cisco_nxos/parsers/show_mac_address_table.rb

@@ -21,7 +21,7 @@ module Vxlan
                 reject(number)
                 next
               end
-              @rows << { vlan_id: match[1] == "-" ? nil : match[1].to_i, mac: CtxParser::Values.mac(match[2]),
+              @rows << { vlan_id: match[1] == "-" ? nil : match[1].to_i, mac: CtxParser::Values.mac_address(match[2]),
                 type: match[3].downcase, age: match[4], secure: match[5].upcase == "T", notify: match[6].upcase == "T", destination: match[7],
                 flags: line[/\A([*+GOCR~])\s+/, 1] }
             elsif !line.match?(/\A(?:Legend:|\* - primary entry, G - Gateway MAC, \(R\) - Routed MAC, O - Overlay MAC|age - seconds since last seen,\+ - primary entry using vPC Peer-Link,|\(T\) - True, \(F\) - False, C - ControlPlane MAC, ~ - vsan,?|\(NA\)- Not Applicable(?: A [–-] ESI Active Path, S [–-] ESI Standby Path)?)\z/i)

data/lib/vxlan/cisco_nxos/parsers/show_nve_peers.rb

@@ -20,7 +20,7 @@ module Vxlan
           lines(text) do |line, number|
             if HEADER.match?(line)
               @header = true
-            elsif (match = ROW.match(line)) && valid_host?(match[2])
+            elsif (match = ROW.match(line)) && ip_address?(match[2])
               @rows << FIELDS.zip(match.captures).to_h.merge(state: match[3].downcase)
             else
               reject(number)

data/lib/vxlan/cisco_nxos/parsers/show_port_channel_summary.rb

@@ -15,20 +15,34 @@ module Vxlan
         # 解析当前命令的记录，保留无法识别行的诊断。
         def parse_rows(text)
           totals = []
+          previous = nil
           lines(text) do |line, number|
+            issue_count = @issues.size
             if line.match?(/\AGroup\s+Port-(?:Channel)?\s+Type\s+Protocol\s+Member Ports\z/i)
               @header = true
+              previous = nil
             elsif line == "Channel" && @header
+              previous = nil
               next
             elsif (match = /\A(\d+)\s+(Po\d+)\(([^\s()]+)\)\s+(\S+)\s+(\S+)\s*(.*)\z/i.match(line))
-              @rows << { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5], members: members(match[6]) }
-            elsif line.match?(/\A(?:Eth(?:ernet)?\S+\([^)]+\)\s*)+\z/i) && @rows.any?
-              @rows.last[:members].concat(members(line))
+              previous = { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5], members: members(match[6]) }
+              @rows << previous
+            elsif line.match?(/\A(?:Eth(?:ernet)?\S+\([^)]+\)\s*)+\z/i) && previous
+              previous[:members].concat(members(line))
             elsif (match = /\ANumber of port-channels\s*:\s*(\d+)\z/i.match(line))
               totals << match[1].to_i
+              previous = nil
             elsif !line.match?(/\A(?:Flags:\s+D - Down\s+P - Up in port-channel \(members\)|I - Individual\s+H - Hot-standby \(LACP only\)|s - Suspended\s+r - Module-removed|b - BFD Session Wait|S - Switched\s+R - Routed|U - Up \(port-channel\)|p - Up in delay-lacp mode \(member\)|M - Not in use\. Min-links not met)\z/)
               reject(number)
+              previous = nil
             end
+            previous = nil if @issues.size > issue_count
+          end
+          entries = @rows.flat_map { |row| row[:members] }
+          remove_duplicates(entries, nil) { |member| member[:interface].sub(/\AEth(?:ernet)?/i, "Eth") }
+          unambiguous = entries.each_with_object({}.compare_by_identity) { |member, index| index[member] = true }
+          @rows.each do |row|
+            row[:members].select! { |member| unambiguous.key?(member) }
           end
           totals.each { |total| mismatch(total, @rows.size) }
           @empty = true if totals == [ 0 ] && @rows.empty?

data/lib/vxlan/cisco_nxos/parsers/show_running_config.rb

@@ -2,23 +2,23 @@
 
 require "digest"
 require "ipaddr"
-require_relative "../configuration_parsing/interfaces"
-require_relative "../configuration_parsing/routing"
-require_relative "../configuration_parsing/policies"
-require_relative "../configuration_document"
+require_relative "../syntax/interfaces"
+require_relative "../syntax/routing"
+require_relative "../syntax/policies"
+require_relative "../document"
 require_relative "../configuration"
 require_relative "../../configuration_review"
-require "ctx_parser/configuration_parser"
+require "ctx_parser/configuration"
 require "ctx_parser/values"
 
 module Vxlan
   module CiscoNxos
     module Parsers
       # 按 NX-OS 缩进确定作用域；相关语法不受支持时保留部分结果。
-      class ShowRunningConfig < CtxParser::ConfigurationParser
-        include ConfigurationParsing::Interfaces
-        include ConfigurationParsing::Routing
-        include ConfigurationParsing::Policies
+      class ShowRunningConfig < CtxParser::Configuration
+        include Syntax::Interfaces
+        include Syntax::Routing
+        include Syntax::Policies
 
         private
 
@@ -27,11 +27,14 @@ module Vxlan
           configuration = CiscoNxos::Configuration.new
           @issues = configuration.issues
           @conflicts = {}
+          @policy_sequences = {}
           @sources = {}
+          @setting_sources = {}.compare_by_identity
+          @configuration_conflict_count = 0
           @feature_sources = []
           @disabled_feature_sources = []
           data = configuration.data
-          read_configuration(text, comments: /\A!/, boundaries: /\Aend\z/, document_class: ConfigurationDocument).each { |block| parse_block(block, data) }
+          read_configuration(text, comments: /\A!/, boundaries: /\Aend\z/, document_class: Document).each { |block| parse_block(block, data) }
           @issues.concat(document.issues)
           # 所有声明读取完毕后再关联模板与网段，避免配置先后顺序改变关联结果。
           configuration.finish
@@ -76,6 +79,11 @@ module Vxlan
               data[:nve] = scope(block, [ :nve ]) { nve(block).merge(interface: name) }
             else
               store(data[:interfaces], name, block, path: [ :interfaces, name ]) { interface(block) }
+              settings = data[:interfaces][name]
+              # VRF 歧义不能等同于默认 VRF；排除此接口，阻止跨接口借址和网段推导。
+              if settings && @setting_sources.fetch(settings, {}).key?(:vrf) && !settings.key?(:vrf)
+                exclude_conflicted_scope(data[:interfaces], name, block)
+              end
             end
           when /\Avlan ([\d,-]+)\z/
             ids = $1.split(",", -1).flat_map do |part|
@@ -121,7 +129,7 @@ module Vxlan
           when /\Aroute-map (\S+) (permit|deny) (\d+)\z/
             name, action, sequence = $1, $2, integer($3, 1..65_535)
             entries = (data[:route_maps][name] ||= [])
-            issue(block, :duplicate_route_map_entry) if entries.any? { |entry| entry[:sequence] == sequence }
+            issue(block, :duplicate_route_map_entry) if register_policy_sequence(:route_maps, name, sequence)
             entries << scope(block, [ :route_maps, name, entries.size ]) { route_map(block).merge(action: action, sequence: sequence) }
           when /\Aip access-list (\S+)\z/
             name = $1
@@ -141,11 +149,11 @@ module Vxlan
           when /\Aip route /
             data[:static_routes] << scope(block, [ :static_routes, data[:static_routes].size ]) { static_route(block) }
           when "nv overlay evpn", "no nv overlay evpn"
-            data[:nv_overlay_evpn] = block.text == "nv overlay evpn"
-            capture(block, data[:nv_overlay_evpn], [ :nv_overlay_evpn ])
+            assign(data, :nv_overlay_evpn, block.text == "nv overlay evpn", block)
+            capture(block, data[:nv_overlay_evpn], [ :nv_overlay_evpn ]) if data.key?(:nv_overlay_evpn)
           when /\Afabric forwarding anycast-gateway-mac (\S+)\z/
-            data[:anycast_mac] = $1
-            capture(block, data[:anycast_mac], [ :anycast_mac ])
+            assign(data, :anycast_mac, $1, block)
+            capture(block, data[:anycast_mac], [ :anycast_mac ]) if data.key?(:anycast_mac)
           when /\A(?:interface|vlan|vrf|router|vpc|evpn|feature|ip prefix-list|ipv6 prefix-list|route-map)\b/ then issue(block)
           when /\A(?:%|ERROR:|Invalid command|--More--)/i then issue(block, :invalid_command_output)
           else
@@ -158,8 +166,8 @@ module Vxlan
           values = { route_targets: [], routes: [] }
           analyze_children(block) do |child|
             case child.text
-            when /\Avni (\d+)\z/ then values[:vni] = integer($1, 1..16_777_215)
-            when /\Ard (\S+)\z/ then values[:rd] = $1
+            when /\Avni (\d+)\z/ then assign(values, :vni, integer($1, 1..16_777_215), child)
+            when /\Ard (\S+)\z/ then assign(values, :rd, $1, child)
             when /\Aroute-target / then values[:route_targets] << route_target(child)
             when /\Aaddress-family (.+)\z/
               family = $1
@@ -202,8 +210,8 @@ module Vxlan
           values = { peer_keepalive: {}, virtual_peer_link: {}, peer_gateway: false, peer_switch: false, layer3_peer_router: false }
           analyze_children(block) do |child|
             case child.text
-            when /\Apeer-keepalive (.+)\z/ then values[:peer_keepalive] = pairs($1, %w[destination source vrf])
-            when /\Avirtual peer-link (.+)\z/ then values[:virtual_peer_link] = pairs($1, %w[destination source dscp])
+            when /\Apeer-keepalive (.+)\z/ then assign(values, :peer_keepalive, pairs($1, %w[destination source vrf]), child)
+            when /\Avirtual peer-link (.+)\z/ then assign(values, :virtual_peer_link, pairs($1, %w[destination source dscp]), child)
             when "peer-gateway" then values[:peer_gateway] = true
             when "peer-switch" then values[:peer_switch] = true
             when "layer3 peer-router" then values[:layer3_peer_router] = true
@@ -241,16 +249,38 @@ module Vxlan
 
         # 校验接口地址，同时保留网络前缀。
         def address(value)
-          CtxParser::Values.host(value, allow_zone: true)
+          CtxParser::Values.ip_address(value, allow_zone: true)
         end
 
         # 校验网络前缀，不静默修正错误语法。
-        def prefix(value, host: false) = CtxParser::Values.ipv4_prefix(value, host: host)
+        def prefix(value, preserve_host_bits: false) = CtxParser::Values.ipv4_prefix(value, preserve_host_bits: preserve_host_bits)
+
+        # 单值配置可重复确认，冲突后移除歧义字段并使两端来源失效。
+        def assign(values, key, value, block)
+          sources = (@setting_sources[values] ||= {})
+          if sources.key?(key) && (!values.key?(key) || values[key] != value)
+            @cursor.mark(sources.fetch(key).index, state: :invalid)
+            values.delete(key)
+            @configuration_conflict_count += 1
+            issue(block, :conflicting_configuration_value)
+          else
+            sources[key] ||= block
+            values[key] = value
+          end
+        end
+
+        # 排除身份后保留冲突状态，后续重复块不能重新恢复歧义事实。
+        def exclude_conflicted_scope(collection, key, block)
+          collection.delete(key)
+          @conflicts[[ collection.object_id, key ]] = true
+          issue(block, :conflicting_configuration_value)
+        end
 
         # 保存已解析配置，同时保留其来源。
         def store(hash, key, block, path:)
           identity = [ hash.object_id, key ]
           if hash.key?(key) || @conflicts[identity]
+            @configuration_conflict_count += 1
             @conflicts[identity] = true
             hash.delete(key)
             @cursor.mark(@sources[identity].index, state: :invalid) if @sources[identity]
@@ -267,12 +297,16 @@ module Vxlan
 
         # 忽略无关系统设置，但不将位置错误的已建模语法视为完整。
         def check_unhandled(block)
-          if /\A(?:no )?(?:hostname|interface|vlan|vrf|router|vpc|evpn|feature|ip address|ip router ospf|ip access-group|ip prefix-list|ipv6 prefix-list|ip access-list|route-map|vn-segment|member vni|route-target|channel-group|fabric forwarding|mtu|ip unnumbered|ip ospf network|switchport mode|switchport access vlan|ip forward|ipv6 address)\b/.match?(block.text)
-            issue(block)
-          else
-            @cursor.mark(block.index, state: :ignored)
+          pending = [ block ]
+          until pending.empty?
+            entry = pending.pop
+            if /\A(?:no )?(?:hostname|interface|vlan|vrf|router|vpc|evpn|feature|ip address|ip router ospf|ip access-group|ip prefix-list|ipv6 prefix-list|ip access-list|route-map|vn-segment|member vni|route-target|channel-group|fabric forwarding|mtu|ip unnumbered|ip ospf network|switchport mode|switchport access vlan|ip forward|ipv6 address)\b/.match?(entry.text)
+              issue(entry)
+            else
+              @cursor.mark(entry.index, state: :ignored)
+            end
+            pending.concat(entry.children.reverse)
           end
-          block.children.each { |child| check_unhandled(child) }
         end
 
         # 忽略已知叶子语句时，不能隐藏其嵌套配置作用域。

data/lib/vxlan/cisco_nxos/profile.rb

@@ -18,7 +18,7 @@ module Vxlan
   module CiscoNxos
     # 声明 Cisco N9K NX-OS 命令，并通过 MODEL_PARSERS 逐命令覆盖型号差异。
     class Profile < CtxParser::Profile
-      CATALOG = CtxParser::CommandCatalog.new([
+      DECLARATIONS = CtxParser::Commands.new([
         { dimensions: [ :configuration ], command: "show running-config", parser: Parsers::ShowRunningConfig },
         { dimensions: [ :cdp_neighbors ], command: "show cdp neighbors detail", parser: Parsers::ShowCdpNeighborsDetail },
         { dimensions: [ :nve_peers ], command: "show nve peers", parser: Parsers::ShowNvePeers },
@@ -32,8 +32,8 @@ module Vxlan
         { dimensions: [ :l2route_macs ], command: "show l2route evpn mac all", parser: Parsers::ShowL2routeEvpnMacAll },
         { dimensions: [ :l2route_mac_ips ], command: "show l2route evpn mac-ip all", parser: Parsers::ShowL2routeEvpnMacIpAll }
       ])
-      COMMANDS = CATALOG.commands
-      PARSERS = CATALOG.parsers
+      COMMANDS = DECLARATIONS.by_dimension
+      PARSERS = DECLARATIONS.parsers
     end
   end
 end

data/lib/vxlan/cisco_nxos/{configuration_parsing → syntax}/interfaces.rb

@@ -2,7 +2,7 @@
 
 module Vxlan
   module CiscoNxos
-    module ConfigurationParsing
+    module Syntax
       # 接口与 NVE 语法共用命令解析器的来源边界。
       module Interfaces
         private
@@ -12,24 +12,24 @@ module Vxlan
           values = { addresses: [], acl_bindings: {}, anycast: false }
           analyze_children(block) do |child|
             case child.text
-            when /\Aip address (\S+)(?: secondary)?\z/ then values[:addresses] << prefix($1, host: true)
-            when /\Aip unnumbered (loopback\d+)\z/i then values[:unnumbered_interface] = $1
-            when /\Avrf member (\S+)\z/ then values[:vrf] = $1
-            when /\Aip router ospf (\S+) area (\S+)\z/ then values[:ospf] = "#{$1} area #{$2}"
-            when /\Aip ospf network (point-to-point|broadcast)\z/ then values[:ospf_network_type] = $1
-            when /\Amtu (\d+)\z/ then values[:mtu] = integer($1, 1..65_535)
-            when /\Aswitchport mode (access|trunk|dot1q-tunnel|fex-fabric)\z/ then values[:switchport_mode] = $1
-            when /\Aswitchport access vlan (\d+)\z/ then values[:access_vlan] = integer($1, 1..4094)
-            when "switchport", "no switchport" then values[:switchport] = child.text == "switchport"
-            when "ip forward", "no ip forward" then values[:ip_forward] = child.text == "ip forward"
+            when /\Aip address (\S+)(?: secondary)?\z/ then values[:addresses] << prefix($1, preserve_host_bits: true)
+            when /\Aip unnumbered (loopback\d+)\z/i then assign(values, :unnumbered_interface, $1, child)
+            when /\Avrf member (\S+)\z/ then assign(values, :vrf, $1, child)
+            when /\Aip router ospf (\S+) area (\S+)\z/ then assign(values, :ospf, "#{$1} area #{$2}", child)
+            when /\Aip ospf network (point-to-point|broadcast)\z/ then assign(values, :ospf_network_type, $1, child)
+            when /\Amtu (\d+)\z/ then assign(values, :mtu, integer($1, 1..65_535), child)
+            when /\Aswitchport mode (access|trunk|dot1q-tunnel|fex-fabric)\z/ then assign(values, :switchport_mode, $1, child)
+            when /\Aswitchport access vlan (\d+)\z/ then assign(values, :access_vlan, integer($1, 1..4094), child)
+            when "switchport", "no switchport" then assign(values, :switchport, child.text == "switchport", child)
+            when "ip forward", "no ip forward" then assign(values, :ip_forward, child.text == "ip forward", child)
             when "fabric forwarding mode anycast-gateway" then values[:anycast] = true
-            when /\Aip access-group (\S+) (in|out)\z/ then values[:acl_bindings][$2.to_sym] = $1
-            when /\Avpc (\d+)\z/ then values[:vpc_id] = integer($1, 1..4096)
+            when /\Aip access-group (\S+) (in|out)\z/ then assign(values[:acl_bindings], $2.to_sym, $1, child)
+            when /\Avpc (\d+)\z/ then assign(values, :vpc_id, integer($1, 1..4096), child)
             when "vpc peer-link" then values[:peer_link] = true
-            when /\Achannel-group (\d+)(?: mode \S+)?\z/ then values[:channel_group] = integer($1, 1..4096)
-            when /\Adescription (.+)\z/ then values[:description] = $1
-            when "shutdown" then values[:shutdown] = true
-            when "no shutdown" then values[:shutdown] = false
+            when /\Achannel-group (\d+)(?: mode \S+)?\z/ then assign(values, :channel_group, integer($1, 1..4096), child)
+            when /\Adescription (.+)\z/ then assign(values, :description, $1, child)
+            when "shutdown" then assign(values, :shutdown, true, child)
+            when "no shutdown" then assign(values, :shutdown, false, child)
             else check_unhandled(child)
             end
           end
@@ -49,14 +49,14 @@ module Vxlan
               raise ArgumentError if member[:replication] == "bgp" && member[:multicast_group]
 
               store(values[:members], id, child, path: @source_path + [ :members, id ]) { member }
-            when /\Adescription (.+)\z/ then values[:description] = $1
-            when /\Aglobal mcast-group (\S+)\z/ then values[:multicast_group] = multicast_address($1)
-            when /\Asource-interface (\S+)\z/ then values[:source_interface] = $1
-            when /\Ahost-reachability protocol (\S+)\z/ then values[:host_reachability] = $1
-            when "shutdown" then values[:shutdown] = true
-            when "no shutdown" then values[:shutdown] = false
+            when /\Adescription (.+)\z/ then assign(values, :description, $1, child)
+            when /\Aglobal mcast-group (\S+)\z/ then assign(values, :multicast_group, multicast_address($1), child)
+            when /\Asource-interface (\S+)\z/ then assign(values, :source_interface, $1, child)
+            when /\Ahost-reachability protocol (\S+)\z/ then assign(values, :host_reachability, $1, child)
+            when "shutdown" then assign(values, :shutdown, true, child)
+            when "no shutdown" then assign(values, :shutdown, false, child)
             when "advertise virtual-rmac", "no advertise virtual-rmac"
-              values[:advertise_virtual_rmac] = child.text == "advertise virtual-rmac"
+              assign(values, :advertise_virtual_rmac, child.text == "advertise virtual-rmac", child)
             else issue(child)
             end
           end
@@ -72,8 +72,8 @@ module Vxlan
             raise ArgumentError if member[:multicast_group] && member[:multicast_group] != group
 
             member[:multicast_group] = group
-          when "suppress-arp" then member[:suppress_arp] = true
-          when "no suppress-arp" then member[:suppress_arp] = false
+          when "suppress-arp" then assign(member, :suppress_arp, true, setting)
+          when "no suppress-arp" then assign(member, :suppress_arp, false, setting)
           else issue(setting)
           end
         end

data/lib/vxlan/cisco_nxos/{configuration_parsing → syntax}/policies.rb

@@ -2,7 +2,7 @@
 
 module Vxlan
   module CiscoNxos
-    module ConfigurationParsing
+    module Syntax
       # 前缀列表与路由映射保留地址族及引用选择器。
       module Policies
         private
@@ -18,12 +18,20 @@ module Vxlan
           raise ArgumentError if (ge && !(length..width).cover?(ge)) || (le && !((ge || length)..width).cover?(le))
           entries = (lists[match[1]] ||= [])
           sequence = integer(match[2], 1..4_294_967_295)
-          raise ArgumentError if entries.any? { |entry| entry[:sequence] == sequence }
-          entries << { sequence: sequence, action: match[3], prefix: subnet, ge: ge, le: le }
           collection = family == "ipv6" ? :ipv6_prefix_lists : :prefix_lists
+          raise ArgumentError if register_policy_sequence(collection, match[1], sequence)
+          entries << { sequence: sequence, action: match[3], prefix: subnet, ge: ge, le: le }
           capture(block, entries.last, [ collection, match[1], entries.size - 1 ])
         end
 
+        # 单次解析用索引识别重复序号，避免长策略逐条扫描已有条目。
+        def register_policy_sequence(collection, name, sequence)
+          key = [ collection, name, sequence ]
+          duplicate = @policy_sequences.key?(key)
+          @policy_sequences[key] = true
+          duplicate
+        end
+
         # 解析有序 route-map 条目及策略引用。
         def route_map(block)
           values = { prefix_lists: [], additional_matches: [], sets: [] }

data/lib/vxlan/cisco_nxos/syntax/routing.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module Vxlan
+  module CiscoNxos
+    module Syntax
+      # 路由作用域保留邻居、模板、VRF 与地址族的归属。
+      module Routing
+        private
+
+        # 解析支持的路由作用域及协议关系。
+        def routing(block, protocol, context = :process)
+          values = { vrfs: {}, neighbors: {}, templates: {}, address_families: {}, redistribute: [] }
+          analyze_children(block) do |child|
+            case child.text
+            when /\Avrf (\S+)\z/ then routing_scope(values, :vrfs, $1, child, protocol, context)
+            when /\Atemplate peer (\S+)\z/ then routing_scope(values, :templates, $1, child, protocol, context)
+            when /\Aneighbor (\S+)\z/ then routing_scope(values, :neighbors, $1, child, protocol, context)
+            when /\Aaddress-family (.+)\z/ then routing_scope(values, :address_families, $1, child, protocol, context)
+            when /\Arouter-id (\S+)\z/ then assign(values, :router_id, address($1), child)
+            when /\Aremote-as (\S+)\z/
+              value = $1
+              integer(value, 1..4_294_967_295) unless %w[internal external].include?(value)
+              assign(values, :remote_as, value, child)
+            when /\Ainherit peer (\S+)\z/ then assign(values, :inherit_peer, $1, child)
+            when /\Aupdate-source (\S+)\z/ then assign(values, :update_source, $1, child)
+            when /\Adescription (.+)\z/ then assign(values, :description, $1, child)
+            when /\Aroute-map (\S+) (in|out)\z/
+              name, direction = $1, $2.to_sym
+              maps = (values[:route_maps] ||= {})
+              assign(maps, direction, name, child)
+            when /\A(no )?next-hop-self( all)?\z/
+              assign(values, :next_hop_self, $1.nil?, child)
+              assign(values, :next_hop_self_all, $1.nil? && !$2.nil?, child)
+            when /\A(no )?(bfd|route-reflector-client|advertise-pip|advertise l2vpn evpn)\z/
+              enabled, setting = $1.nil?, $2
+              key = { "bfd" => :bfd, "route-reflector-client" => :route_reflector_client,
+                "advertise-pip" => :advertise_pip, "advertise l2vpn evpn" => :advertise_l2vpn_evpn }.fetch(setting)
+              assign(values, key, enabled, child)
+            when /\A(no )?send-community(?: (extended|both))?\z/
+              enabled, kind = $1.nil?, $2
+              assign(values, :standard_community, enabled, child) unless kind == "extended"
+              assign(values, :extended_community, enabled, child) if kind
+            when /\Anetwork (\S+)(?: route-map (\S+))?\z/
+              subnet, route_map = $1, $2
+              raise ArgumentError unless protocol == :bgp
+
+              (values[:networks] ||= []) << { prefix: network_prefix(subnet), route_map: route_map }.compact
+            when /\Aredistribute (\S+)(?: (?!route-map\b)(\S+))?(?: route-map (\S+))?\z/
+              values[:redistribute] << { protocol: $1, process: $2, route_map: $3 }.compact
+            when /\Aretain route-target (all|route-map \S+)\z/ then assign(values, :retain_route_target, $1, child)
+            when /\A(?:no )?(?:log-neighbor-changes|log-adjacency-changes|soft-reconfiguration inbound|passive-interface)\b/,
+              /\A(?:maximum-paths|default-information originate|auto-cost reference-bandwidth)\b/ then ignore(child)
+            else issue(child)
+            end
+          end
+          values
+        end
+
+        # 只进入当前事实模型可表达的子作用域，阻止任意递归及跨协议误归属。
+        def routing_scope(values, kind, name, block, protocol, context)
+          supported = case kind
+          when :vrfs then context == :process
+          when :templates then protocol == :bgp && context == :process
+          when :neighbors then protocol == :bgp && %i[process vrfs].include?(context)
+          when :address_families then protocol == :bgp && %i[process vrfs neighbors templates].include?(context)
+          end
+          return issue(block) unless supported
+
+          conflicts_before = @configuration_conflict_count
+          store(values[kind], name, block, path: @source_path + [ kind, name ]) { routing(block, protocol, kind) }
+          # 邻居及模板的子地址族冲突也使继承身份失效；保留同进程其他邻居。
+          if protocol == :bgp && %i[neighbors templates].include?(kind) && @configuration_conflict_count > conflicts_before
+            exclude_conflicted_scope(values[kind], name, block)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vxlan/cisco_nxos/terminal.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Vxlan
+  module CiscoNxos
+    # 分页及终端编辑控制会破坏事实边界；保留正常换行和制表符。
+    module Terminal
+      INVALID = /--[ \t]*More[ \t]*--|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/i
+      private_constant :INVALID
+
+      # 检查原始正文，避免 strip 或字段解析先吞掉控制字符。
+      def self.invalid_output?(text) = INVALID.match?(text)
+    end
+  end
+end

data/lib/vxlan/collector.rb

@@ -23,6 +23,9 @@ module Vxlan
       unless dimensions.is_a?(Array) && dimensions.any? && dimensions.uniq == dimensions && (dimensions - COMMANDS.keys).empty?
         raise ArgumentError, "Unknown or duplicate VXLAN dimensions"
       end
+      target = CtxParser::Immutable.copy(target)
+      fabric_key = CtxParser::Immutable.copy(fabric_key)
+      dimensions = dimensions.dup.freeze
       raise ArgumentError, "VXLAN requires Cisco NX-OS" unless connector.platform.to_s == "cisco_nxos"
       profile = ParserRegistry.fetch(connector.platform, model: model)
 

data/lib/vxlan/configuration_review.rb

@@ -13,27 +13,27 @@ module Vxlan
       raise ArgumentError, "Completeness must be boolean" unless [ true, false ].include?(complete)
       return [] unless complete
 
-      members = @configuration.fetch(:nve).fetch(:members, {})
-      vlans = @configuration.fetch(:vlan_vnis).group_by { |_vlan, vni| vni }
-      evpn = @configuration.fetch(:evpn)
+      nve_members_by_vni = @configuration.fetch(:nve).fetch(:members, {})
+      vlan_mappings_by_vni = @configuration.fetch(:vlan_vnis).group_by { |_vlan, vni| vni }
+      evpn_vnis = @configuration.fetch(:evpn)
       findings = []
-      vlans.each do |vni, entries|
-        next unless vni && !members.key?(vni)
+      vlan_mappings_by_vni.each do |vni, entries|
+        next unless vni && !nve_members_by_vni.key?(vni)
 
         findings << { code: :vlan_vni_without_nve, vni: vni, vlan_ids: entries.map(&:first).sort }
       end
-      members.each do |vni, settings|
+      nve_members_by_vni.each do |vni, settings|
         next if settings[:associate_vrf]
 
-        findings << { code: :nve_l2_without_vlan, vni: vni } unless vlans.key?(vni)
-        if @configuration[:nv_overlay_evpn] && !evpn.key?(vni)
+        findings << { code: :nve_l2_without_vlan, vni: vni } unless vlan_mappings_by_vni.key?(vni)
+        if @configuration[:nv_overlay_evpn] && !evpn_vnis.key?(vni)
           findings << { code: :nve_l2_without_evpn, vni: vni }
         end
       end
-      evpn.each_key { |vni| findings << { code: :evpn_vni_without_nve, vni: vni } unless members.key?(vni) }
+      evpn_vnis.each_key { |vni| findings << { code: :evpn_vni_without_nve, vni: vni } unless nve_members_by_vni.key?(vni) }
       @configuration.fetch(:vrfs).each do |name, settings|
         next unless settings[:vni]
-        member = members[settings[:vni]]
+        member = nve_members_by_vni[settings[:vni]]
         code = member ? (!member[:associate_vrf] ? :vni_layer_conflict : nil) : :l3_vni_without_nve
         findings << { code: code, vni: settings[:vni], vrf: name } if code
       end

data/lib/vxlan/observation.rb

@@ -7,6 +7,7 @@ module Vxlan
   Observation = Data.define(:name, :status, :records, :issues, :evidence, :started_at, :completed_at) do
     # 冻结单个维度的记录、状态及诊断元数据。
     def initialize(name:, status:, records: [], issues: [], evidence: [], started_at: nil, completed_at: nil)
+      raise ArgumentError, "Observation name must be a symbol" unless name.is_a?(Symbol)
       raise ArgumentError, "Invalid observation status" unless %i[complete partial failed unsupported not_requested].include?(status)
       raise ArgumentError, "Records must be hashes" unless records.is_a?(Array) && records.all? { |row| row.is_a?(Hash) }
 
@@ -20,5 +21,6 @@ module Vxlan
 
     # 展示对象身份与状态，避免泄露原始回显或凭据。
     def inspect = "#<#{self.class.name} name=#{name} status=#{status} records=#{records.size}>"
+    alias to_s inspect
   end
 end

data/lib/vxlan/prefix_list_references.rb

@@ -14,23 +14,24 @@ module Vxlan
     def call(address_family: "ipv4")
       raise ArgumentError, "Unsupported address family" unless %w[ipv4 ipv6].include?(address_family)
 
-      bindings = route_map_bindings
-      @configuration.fetch(:route_maps).each_with_object({}) do |(name, entries), references|
+      bindings = route_map_bindings.transform_values(&:uniq)
+      references = @configuration.fetch(:route_maps).each_with_object({}) do |(name, entries), result|
         entries.sort_by { |entry| entry.fetch(:sequence) }.each do |entry|
           matches = entry.fetch(:prefix_list_matches) do
             [ { address_family: "ipv4", selector: "address", names: entry.fetch(:prefix_lists, []) } ]
           end
           matches.select { |match| match[:address_family] == address_family }.each do |match|
-            caller = { type: "route_map", name: name, sequence: entry.fetch(:sequence), action: entry.fetch(:action),
-              bindings: bindings.fetch(name, []).uniq }
-            caller[:selector] = match[:selector] unless match[:selector] == "address"
+            route_map_reference = { type: "route_map", name: name, sequence: entry.fetch(:sequence), action: entry.fetch(:action),
+              bindings: bindings.fetch(name, []).dup }
+            route_map_reference[:selector] = match[:selector] unless match[:selector] == "address"
             match.fetch(:names).uniq.each do |prefix_list|
-              callers = (references[prefix_list] ||= [])
-              callers << caller unless callers.include?(caller)
+              (result[prefix_list] ||= []) << route_map_reference
             end
           end
         end
       end
+      # 一次去重保留首次出现顺序，避免每个条目都扫描已有引用。
+      references.transform_values(&:uniq)
     end
 
     private

data/lib/vxlan/snapshot.rb

@@ -1,14 +1,19 @@
 # frozen_string_literal: true
 
 require "ctx_parser/immutable"
+require_relative "observation"
 
 module Vxlan
   # 携带单设备 Fabric 身份及观测结果，不管理资产清单。
   Snapshot = Data.define(:target, :fabric_key, :dimensions, :observed_at) do
     # 事实由不可变领域观测持有；仅复制维度选择，不重复复制事实。
     def initialize(target:, fabric_key:, dimensions:, observed_at:)
+      unless dimensions.is_a?(Hash) && dimensions.all? { |name, value| value.is_a?(Observation) && value.name == name }
+        raise ArgumentError, "Dimensions must match their observations"
+      end
+
       super(target: CtxParser::Immutable.copy(target), fabric_key: CtxParser::Immutable.copy(fabric_key),
-        dimensions: dimensions.dup.freeze, observed_at: observed_at&.dup&.freeze)
+        dimensions: dimensions.to_h { |name, value| [ name, value ] }.freeze, observed_at: observed_at&.dup&.freeze)
     end
 
     # 判断所有已选事实是否都有完整证据支持。
@@ -19,5 +24,6 @@ module Vxlan
 
     # 展示对象身份与状态，避免泄露原始回显或凭据。
     def inspect = "#<#{self.class.name} fabric=#{fabric_key.inspect} complete=#{complete?}>"
+    alias to_s inspect
   end
 end

data/lib/vxlan/version.rb

@@ -2,5 +2,5 @@
 
 module Vxlan
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.1.0"
+  VERSION = "0.2.1"
 end

data/lib/vxlan.rb

@@ -9,7 +9,6 @@ require_relative "vxlan/observation"
 require_relative "vxlan/snapshot"
 require_relative "vxlan/configuration"
 require_relative "vxlan/runtime_parser"
-require_relative "vxlan/l2route_parser"
 require_relative "vxlan/bgp_neighbors"
 require_relative "vxlan/configuration_review"
 require_relative "vxlan/prefix_list_references"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vxlan
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Gatework contributors
@@ -13,30 +13,30 @@ dependencies:
   name: ctx_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: ctx_driver
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: digest
   requirement: !ruby/object:Gem::Requirement
@@ -81,10 +81,7 @@ files:
 - lib/vxlan.rb
 - lib/vxlan/bgp_neighbors.rb
 - lib/vxlan/cisco_nxos/configuration.rb
-- lib/vxlan/cisco_nxos/configuration_document.rb
-- lib/vxlan/cisco_nxos/configuration_parsing/interfaces.rb
-- lib/vxlan/cisco_nxos/configuration_parsing/policies.rb
-- lib/vxlan/cisco_nxos/configuration_parsing/routing.rb
+- lib/vxlan/cisco_nxos/document.rb
 - lib/vxlan/cisco_nxos/evpn_l2route.rb
 - lib/vxlan/cisco_nxos/parser.rb
 - lib/vxlan/cisco_nxos/parsers/show_bgp_l2vpn_evpn_summary.rb
@@ -100,10 +97,13 @@ files:
 - lib/vxlan/cisco_nxos/parsers/show_running_config.rb
 - lib/vxlan/cisco_nxos/parsers/show_vpc_brief.rb
 - lib/vxlan/cisco_nxos/profile.rb
+- lib/vxlan/cisco_nxos/syntax/interfaces.rb
+- lib/vxlan/cisco_nxos/syntax/policies.rb
+- lib/vxlan/cisco_nxos/syntax/routing.rb
+- lib/vxlan/cisco_nxos/terminal.rb
 - lib/vxlan/collector.rb
 - lib/vxlan/configuration.rb
 - lib/vxlan/configuration_review.rb
-- lib/vxlan/l2route_parser.rb
 - lib/vxlan/observation.rb
 - lib/vxlan/parser_registry.rb
 - lib/vxlan/prefix_list_references.rb

data/lib/vxlan/cisco_nxos/configuration_parsing/routing.rb

@@ -1,62 +0,0 @@
-# frozen_string_literal: true
-
-module Vxlan
-  module CiscoNxos
-    module ConfigurationParsing
-      # 路由作用域保留邻居、模板、VRF 与地址族的归属。
-      module Routing
-        private
-
-        # 解析支持的路由作用域及协议关系。
-        def routing(block, protocol)
-          values = { vrfs: {}, neighbors: {}, templates: {}, address_families: {}, redistribute: [] }
-          analyze_children(block) do |child|
-            case child.text
-            when /\Avrf (\S+)\z/ then store(values[:vrfs], $1, child, path: @source_path + [ :vrfs, $1 ]) { routing(child, protocol) }
-            when /\Atemplate peer (\S+)\z/ then store(values[:templates], $1, child, path: @source_path + [ :templates, $1 ]) { routing(child, protocol) }
-            when /\Aneighbor (\S+)\z/ then store(values[:neighbors], $1, child, path: @source_path + [ :neighbors, $1 ]) { routing(child, protocol) }
-            when /\Aaddress-family (.+)\z/ then store(values[:address_families], $1, child, path: @source_path + [ :address_families, $1 ]) { routing(child, protocol) }
-            when /\Arouter-id (\S+)\z/ then values[:router_id] = address($1)
-            when /\Aremote-as (\S+)\z/
-              value = $1
-              integer(value, 1..4_294_967_295) unless %w[internal external].include?(value)
-              values[:remote_as] = value
-            when /\Ainherit peer (\S+)\z/ then values[:inherit_peer] = $1
-            when /\Aupdate-source (\S+)\z/ then values[:update_source] = $1
-            when /\Adescription (.+)\z/ then values[:description] = $1
-            when /\Aroute-map (\S+) (in|out)\z/
-              name, direction = $1, $2.to_sym
-              maps = (values[:route_maps] ||= {})
-              raise ArgumentError if maps.key?(direction)
-
-              maps[direction] = name
-            when /\A(no )?next-hop-self( all)?\z/
-              values[:next_hop_self], values[:next_hop_self_all] = $1.nil?, $1.nil? && !$2.nil?
-            when /\A(no )?(bfd|route-reflector-client|advertise-pip|advertise l2vpn evpn)\z/
-              enabled, setting = $1.nil?, $2
-              key = { "bfd" => :bfd, "route-reflector-client" => :route_reflector_client,
-                "advertise-pip" => :advertise_pip, "advertise l2vpn evpn" => :advertise_l2vpn_evpn }.fetch(setting)
-              values[key] = enabled
-            when /\A(no )?send-community(?: (extended|both))?\z/
-              enabled, kind = $1.nil?, $2
-              values[:standard_community] = enabled unless kind == "extended"
-              values[:extended_community] = enabled if kind
-            when /\Anetwork (\S+)(?: route-map (\S+))?\z/
-              subnet, route_map = $1, $2
-              raise ArgumentError unless protocol == :bgp
-
-              (values[:networks] ||= []) << { prefix: network_prefix(subnet), route_map: route_map }.compact
-            when /\Aredistribute (\S+)(?: (?!route-map\b)(\S+))?(?: route-map (\S+))?\z/
-              values[:redistribute] << { protocol: $1, process: $2, route_map: $3 }.compact
-            when /\Aretain route-target (all|route-map \S+)\z/ then values[:retain_route_target] = $1
-            when /\A(?:no )?(?:log-neighbor-changes|log-adjacency-changes|soft-reconfiguration inbound|passive-interface)\b/,
-              /\A(?:maximum-paths|default-information originate|auto-cost reference-bandwidth)\b/ then ignore(child)
-            else issue(child)
-            end
-          end
-          values
-        end
-      end
-    end
-  end
-end

data/lib/vxlan/l2route_parser.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "runtime_parser"
-
-module Vxlan
-  # 保留 L2RIB 公共入口，由平台策略选择解析实现。
-  class L2routeParser
-    TYPES = { l2route_macs: :mac, l2route_mac_ips: :mac_ip }.freeze
-
-    # 选择 EVPN 路由维度使用的运行解析器。
-    def initialize(platform: :cisco_nxos, model: nil)
-      @parser = RuntimeParser.new(platform: platform, model: model)
-    end
-
-    # 校验 L2RIB 维度，将 EVPN 路由解析委派给平台策略。
-    def parse(name, text, complete:)
-      TYPES.fetch(name)
-      @parser.parse(name, text, complete: complete)
-    end
-  end
-end