Enforce Msg 8141 at CREATE TABLE — reject inline column-level CHECK predicates that reference any column other than the owning column. Structural walk via Expression.VisitColumnReferences (Reference / Parenthesized / TwoSidedExpression / Cast / Length covered) + BooleanExpression.VisitOperandExpressions (every subclass). Coverage gap documented: peer refs buried in less-common containers (DATEPART, SUBSTRING, nested CASE, JSON, etc.) still escape and surface at INSERT.

Author: RyanLamansky

CLAUDE.md

@@ -237,7 +237,7 @@ NOT swallowed: Msg 529 (explicit-cast disallowed pair like `int → date`), Msg
 String-source truncation isn't a "conversion failure" path either way — `TRY_CAST('hello' AS varchar(3))` → `'hel'`. EF doesn't emit TRY_CAST/TRY_CONVERT from idiomatic LINQ (raw SQL only).
 
 ### Constraints
-- `CHECK`: inline single-column and table-level forms; Msg 547 per row on definitely-false predicate.
+- `CHECK`: inline single-column and table-level forms; Msg 547 per row on definitely-false predicate. Inline column-level CHECK predicates may only reference their owning column — peer references raise **Msg 8141** at CREATE TABLE (probe-confirmed verbatim wording). The walker is structural via `Expression.VisitColumnReferences` + `BooleanExpression.VisitOperandExpressions`; coverage is currently limited to common container subclasses (`Reference`, `Parenthesized`, `TwoSidedExpression`, `Cast`, `Length`) — peer refs buried in less-common containers (`DATEPART`, `SUBSTRING`, nested `CASE`, etc.) silently escape the CREATE-TABLE check and surface at INSERT instead. Table-level CHECK has no peer restriction.
 - `PRIMARY KEY` / `UNIQUE`: linear scan (O(N) per insert); no B-tree.
 
 ### Transactions
@@ -420,7 +420,6 @@ Full `DbDataReader` contract. Typed accessors read `SqlValue` directly via the c
 - `LEN(ntext)` raising Msg 8116; legacy `READTEXT` / `WRITETEXT` / `UPDATETEXT`.
 - `OUTPUT INTO @table_var`, `OUTPUT DELETED.*` / `INSERTED.*` star expansion.
 - MERGE source subqueries; MERGE target column refs in `ON`; `WHEN MATCHED` UPDATE/DELETE branches; `$action`.
-- Msg 8141 (inline CHECK referencing a peer column — SQL Server rejects at CREATE TABLE; simulator allows).
 - `PRIMARY KEY` / `UNIQUE` on a computed column (`NotSupportedException`).
 - Heap allocation tracking (flat page list, no IAM/PFS).
 - Compound assignment (`SET @v += expr` / `-=` / `*=` etc.) — rewrite as `SET @v = @v + expr`. The arithmetic-operator runtime is locked behind `protected` instance methods on `TwoSidedExpression`; exposing them as static helpers is the prerequisite refactor.

SqlServerSimulator.Tests/CheckConstraintTests.cs

@@ -177,4 +177,78 @@ insert t values ('A'), ('B')
         var ex = Assert.Throws<DbException>(() => simulation.ExecuteNonQuery("insert t values ('C')"));
         Assert.AreEqual("547", ex.Data["HelpLink.EvtID"]);
     }
+
+    // Msg 8141: an inline column-level CHECK constraint may only reference
+    // its owning column. Table-level CHECK has no such restriction. Probed
+    // against SQL Server 2025 (2026-05-11).
+
+    [TestMethod]
+    public void InlineCheck_ReferencesPeerColumn_Msg8141()
+        => new Simulation().AssertSqlError(
+            "create table t (a int check (b > 0), b int)",
+            8141,
+            "Column CHECK constraint for column 'a' references another column, table 't'.");
+
+    [TestMethod]
+    public void InlineCheck_OwningAndPeer_StillMsg8141()
+        => new Simulation().AssertSqlError(
+            "create table t (a int check (a > 0 and b > 0), b int)",
+            8141);
+
+    [TestMethod]
+    public void InlineCheck_PeerOnSecondColumn_Msg8141()
+        => new Simulation().AssertSqlError(
+            "create table t (a int, b int check (a > 0))",
+            8141,
+            "Column CHECK constraint for column 'b' references another column, table 't'.");
+
+    [TestMethod]
+    public void InlineCheck_PeerInsideFunctionCall_Msg8141()
+        => new Simulation().AssertSqlError(
+            "create table t (a int, b nvarchar(10) check (len(a) > 0))",
+            8141);
+
+    [TestMethod]
+    public void InlineCheck_PeerInsideInList_Msg8141()
+        => new Simulation().AssertSqlError(
+            "create table t (a int check (a in (b, 1, 2)), b int)",
+            8141);
+
+    [TestMethod]
+    public void InlineCheck_NamedConstraint_PeerColumn_Msg8141()
+        => new Simulation().AssertSqlError(
+            "create table t (a int constraint ck_peer check (b > 0), b int)",
+            8141);
+
+    [TestMethod]
+    public void InlineCheck_OnlyOwningColumn_Works()
+        => _ = new Simulation().ExecuteNonQuery("""
+            create table t (a int check (a > 0), b int);
+            insert t values (1, 100)
+            """);
+
+    /// <summary>
+    /// Predicate has no column references at all — should not trip Msg 8141.
+    /// </summary>
+    [TestMethod]
+    public void InlineCheck_NoColumnRef_Works()
+        => _ = new Simulation().ExecuteNonQuery("""
+            create table t (a int check (1 = 1), b int);
+            insert t values (1, 2)
+            """);
+
+    [TestMethod]
+    public void TableLevelCheck_ReferencesMultipleColumns_Works()
+    {
+        // Table-level CHECK (no owning column) is allowed to reference any
+        // columns — the Msg 8141 rule is inline-only.
+        var simulation = new Simulation();
+        _ = simulation.ExecuteNonQuery("""
+            create table t (a int, b int, check (a < b));
+            insert t values (1, 2)
+            """);
+
+        var ex = Assert.Throws<DbException>(() => simulation.ExecuteNonQuery("insert t values (5, 3)"));
+        Assert.AreEqual("547", ex.Data["HelpLink.EvtID"]);
+    }
 }

SqlServerSimulator/Errors/SimulatedSqlException.QueryErrors.cs

@@ -348,4 +348,18 @@ internal static SimulatedSqlException IncorrectWaitForTimeSyntax(string value) =
     /// </summary>
     internal static SimulatedSqlException WaitForCannotBeTimeType() =>
         new("Waitfor delay and waitfor time cannot be of type time.", 9815, 16, 0);
+
+    /// <summary>
+    /// Mimics SQL Server's Msg 8141 — an inline column-level CHECK constraint
+    /// (i.e. one written next to a column definition rather than at the
+    /// table level) references a column other than its owning column. Real
+    /// SQL Server enforces a "one-column scope" rule on inline CHECKs:
+    /// they may only reference the column they're attached to. Probe-confirmed
+    /// against SQL Server 2025 (2026-05-11): Class 16, State 0, first-line
+    /// wording verbatim (real SQL Server appends a second "Could not create
+    /// constraint or index. See previous errors." sentence which the simulator
+    /// doesn't model; apps that string-match the error read the first line).
+    /// </summary>
+    internal static SimulatedSqlException InlineCheckReferencesAnotherColumn(string owningColumn, string tableName) =>
+        new($"Column CHECK constraint for column '{owningColumn}' references another column, table '{tableName}'.", 8141, 16, 0);
 }

SqlServerSimulator/Parser/BooleanExpression.cs

@@ -255,6 +255,19 @@ private static BooleanExpression ParseInList(Expression left, ParserContext cont
     /// </summary>
     internal abstract string DebugDisplay();
 
+    /// <summary>
+    /// Visits every top-level <see cref="Expression"/> operand carried by
+    /// this predicate, recursing into nested <see cref="BooleanExpression"/>
+    /// children (e.g. <c>AND</c> / <c>OR</c> / <c>NOT</c>) so the visitor
+    /// only ever sees Expression nodes. Used by CREATE TABLE's inline-CHECK
+    /// validator to enumerate column references via the standard
+    /// <see cref="Expression.GetSqlType"/> resolver — the Expression-side
+    /// walk is unchanged because every <c>Reference</c> already feeds the
+    /// resolver, so callers only need to drive the BooleanExpression-side
+    /// traversal from here.
+    /// </summary>
+    internal abstract void VisitOperandExpressions(Action<Expression> visitor);
+
     /// <summary>
     /// Three-valued <c>AND</c>: <c>false AND x = false</c> regardless of
     /// <c>x</c>; <c>true AND x = x</c>; <c>NULL AND NULL = NULL</c>. Short-
@@ -276,6 +289,12 @@ private sealed class AndExpression(BooleanExpression left, BooleanExpression rig
         }
 
         internal override string DebugDisplay() => $"{left.DebugDisplay()} AND {right.DebugDisplay()}";
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor)
+        {
+            left.VisitOperandExpressions(visitor);
+            right.VisitOperandExpressions(visitor);
+        }
     }
 
     /// <summary>
@@ -297,6 +316,12 @@ private sealed class OrExpression(BooleanExpression left, BooleanExpression righ
         }
 
         internal override string DebugDisplay() => $"{left.DebugDisplay()} OR {right.DebugDisplay()}";
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor)
+        {
+            left.VisitOperandExpressions(visitor);
+            right.VisitOperandExpressions(visitor);
+        }
     }
 
     /// <summary>
@@ -313,6 +338,8 @@ private sealed class IsNullExpression(Expression source, bool negated) : Boolean
             source.Run(runtime).IsNull ^ negated;
 
         internal override string DebugDisplay() => $"{source.DebugDisplay()} IS {(negated ? "NOT NULL" : "NULL")}";
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor) => visitor(source);
     }
 
     /// <summary>
@@ -351,6 +378,13 @@ internal override string DebugDisplay()
             var keyword = negated ? "NOT IN" : "IN";
             return $"{source.DebugDisplay()} {keyword} ({string.Join(", ", candidates.Select(c => c.DebugDisplay()))})";
         }
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor)
+        {
+            visitor(source);
+            foreach (var candidate in candidates)
+                visitor(candidate);
+        }
     }
 
     /// <summary>
@@ -367,6 +401,11 @@ private sealed class ExistsExpression(Selection inner) : BooleanExpression
             inner.Execute(runtime.Batch, runtime.ResolveColumn).RowBytes.Any();
 
         internal override string DebugDisplay() => "EXISTS (...)";
+
+        // No top-level Expression operands — the subquery's references are
+        // unreachable from this validator (and a subquery in inline CHECK
+        // raises Msg 1046 in real SQL Server anyway).
+        internal override void VisitOperandExpressions(Action<Expression> visitor) { }
     }
 
     /// <summary>
@@ -405,6 +444,10 @@ private sealed class InSubqueryExpression(Expression source, Selection inner, bo
         }
 
         internal override string DebugDisplay() => $"{source.DebugDisplay()} {(negated ? "NOT IN" : "IN")} (...)";
+
+        // Only the LHS source is a reachable Expression operand; the subquery
+        // side is a Selection (handled by its own machinery).
+        internal override void VisitOperandExpressions(Action<Expression> visitor) => visitor(source);
     }
 
     /// <summary>
@@ -423,6 +466,8 @@ private sealed class NotExpression(BooleanExpression inner) : BooleanExpression
         };
 
         internal override string DebugDisplay() => $"NOT {inner.DebugDisplay()}";
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor) => inner.VisitOperandExpressions(visitor);
     }
 
     /// <summary>
@@ -462,6 +507,12 @@ private protected CompareExpression(Expression left, ParserContext context)
         /// </summary>
         protected static bool? ComparePromoted(Expression left, Expression right, RuntimeContext runtime, string operatorName, Func<SqlValue, SqlValue, bool> compare) =>
             CompareValuesPromoted(left.Run(runtime), right.Run(runtime), operatorName, compare);
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor)
+        {
+            visitor(this.left);
+            visitor(this.right);
+        }
     }
 
     /// <summary>
@@ -701,5 +752,13 @@ private static int TranslateClass(string pattern, int start, StringBuilder sb)
         internal override string DebugDisplay() => this.escape is null
             ? $"{left.DebugDisplay()} {(this.negated ? "NOT LIKE" : "LIKE")} {right.DebugDisplay()}"
             : $"{left.DebugDisplay()} {(this.negated ? "NOT LIKE" : "LIKE")} {right.DebugDisplay()} ESCAPE {this.escape.DebugDisplay()}";
+
+        internal override void VisitOperandExpressions(Action<Expression> visitor)
+        {
+            visitor(this.left);
+            visitor(this.right);
+            if (this.escape is not null)
+                visitor(this.escape);
+        }
     }
 }

SqlServerSimulator/Parser/Expression.cs

@@ -340,6 +340,31 @@ private static void ParseWithinGroupOrderBy(AggregateExpression aggregate, Parse
         _ => false,
     };
 
+    /// <summary>
+    /// Visits every <see cref="Reference"/> node in this expression's tree,
+    /// calling <paramref name="visit"/> with each reference's
+    /// <see cref="MultiPartName"/>. Used by CREATE TABLE's inline-CHECK
+    /// validator (Msg 8141) to enumerate column references statically —
+    /// distinct from <see cref="GetSqlType"/>'s walk because the latter is
+    /// optimized for type inference and several function-call subclasses
+    /// shortcut to a fixed result type without visiting their child
+    /// expressions. Default implementation is empty; container Expression
+    /// subclasses override to recurse into their child Expressions.
+    /// </summary>
+    /// <remarks>
+    /// Coverage gap: only the most common container subclasses
+    /// (<see cref="Reference"/>, <see cref="Parenthesized"/>, the binary
+    /// arithmetic / bitwise via <see cref="TwoSidedExpression"/>,
+    /// <see cref="Cast"/>, <see cref="Length"/>) currently override this.
+    /// Less-common containers (date-arithmetic functions, JSON functions,
+    /// nested CASE, etc.) fall through to the empty default, so peer
+    /// references buried inside them silently escape Msg 8141 detection at
+    /// CREATE TABLE. Real SQL Server catches these; the simulator surfaces
+    /// the runtime error at INSERT instead. New overrides can be added as
+    /// applications surface the gap.
+    /// </remarks>
+    internal virtual void VisitColumnReferences(Action<MultiPartName> visit) { }
+
     /// <summary>
     /// Parses a grouped expression starting at the opening <c>(</c>. Two
     /// shapes share the leading paren: a parenthesized expression

SqlServerSimulator/Parser/Expressions/Cast.cs

@@ -65,6 +65,8 @@ public override SqlValue Run(RuntimeContext runtime)
     internal override string DebugDisplay() =>
         $"{(this.tryMode ? "TRY_CAST" : "CAST")}({source.DebugDisplay()} AS {targetType})";
 
+    internal override void VisitColumnReferences(Action<MultiPartName> visit) => this.source.VisitColumnReferences(visit);
+
     /// <summary>
     /// Parses the optional <c>(length)</c> or <c>(precision, scale)</c> spec
     /// after a CAST/CONVERT target type name and resolves the type. The caller

SqlServerSimulator/Parser/Expressions/Length.cs

@@ -34,4 +34,6 @@ public override SqlValue Run(RuntimeContext runtime)
     public override SqlType GetSqlType(Func<MultiPartName, SqlType> resolveColumnType) => SqlType.Int32;
 
     internal override string DebugDisplay() => $"LEN({source.DebugDisplay()})";
+
+    internal override void VisitColumnReferences(Action<MultiPartName> visit) => source.VisitColumnReferences(visit);
 }

SqlServerSimulator/Parser/Expressions/Parenthesized.cs

@@ -17,4 +17,6 @@ internal sealed class Parenthesized(Expression wrapped) : Expression
     public override Storage.SqlType GetSqlType(Func<MultiPartName, Storage.SqlType> resolveColumnType) => this.Wrapped.GetSqlType(resolveColumnType);
 
     internal override string DebugDisplay() => $"( {this.Wrapped.DebugDisplay()} )";
+
+    internal override void VisitColumnReferences(Action<MultiPartName> visit) => this.Wrapped.VisitColumnReferences(visit);
 }

SqlServerSimulator/Parser/Expressions/Reference.cs

@@ -53,4 +53,6 @@ public Reference(string qualifier, string column)
     internal override string DebugDisplay() => this.ReferencedName.ToString();
 
     internal override bool ResultIsNullable(Func<MultiPartName, bool> resolveColumnNullable) => resolveColumnNullable(this.ReferencedName);
+
+    internal override void VisitColumnReferences(Action<MultiPartName> visit) => visit(this.ReferencedName);
 }

SqlServerSimulator/Parser/Expressions/TwoSidedExpression.cs

@@ -364,4 +364,10 @@ private static long TicksFromBase(SqlValue v) =>
     protected abstract char Operator { get; }
 
     internal sealed override string DebugDisplay() => $"{left.DebugDisplay()} {Operator} {right.DebugDisplay()}";
+
+    internal sealed override void VisitColumnReferences(Action<MultiPartName> visit)
+    {
+        this.left.VisitColumnReferences(visit);
+        this.right.VisitColumnReferences(visit);
+    }
 }