[tanjiroK-coder]

TablesNamesFinder skips three expression slots that the parser models: the TOP expression of a PlainSelect, the REPLACE and APPLY items of a * or t.* column transformer, and the initializers of DECLARE. The AllColumns, AllTableColumns and DeclareStatement visits were empty, and visitPlainSelectBody never looked at getTop(). A subquery in any of those positions is dropped from the result, so SELECT TOP ((SELECT count(*) FROM secrets)) a FROM t and SELECT * REPLACE ((SELECT max(pw) FROM secrets) AS a) FROM t return only t, and DECLARE @x INT = (SELECT max(pw) FROM secrets) returns no table at all, although each statement reads secrets. A table allowlist built on findTables lets those reads through. I found them by placing one subquery in about 270 expression positions and checking which ones the finder missed. The visitor now walks the TOP expression, the transformer apply and replace items and each DECLARE default expression, the same way the COLUMNS(...) visit already walks its transformers. The time-travel clauses (FOR SYSTEM_TIME AS OF ...) and DECLARE TABLE column specs are kept as raw strings by the parser, so they stay out of scope here. Seven parameterized TablesNamesFinderTest cases fail before and pass after, and ./gradlew check passes.