Added statement-level atomicity (Bundle 1 of the transactions arc): a per-statement undo log restores heap state when an INSERT / UPDATE / DELETE / MERGE throws mid-execution, matching SQL Server's auto-commit-mode rollback behavior.

RyanLamansky · RyanLamansky · commit 38ba889af3d1 · 2026-05-07T21:58:41.000-05:00
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -196,6 +196,15 @@ Per-type keyword compatibility mirrors SQL Server (verified against Kardax7 2026
 - `CHECK`: inline single-column and table-level forms; Msg 547 per row on definitely-false predicate.
 - `PRIMARY KEY` / `UNIQUE`: linear scan (O(N) per insert); no B-tree backing.
 
+### Transactions (statement-level atomicity, Bundle 1)
+Auto-commit-mode statement atomicity: a single INSERT / UPDATE / DELETE / MERGE that throws mid-execution rolls back its partial writes. A multi-row INSERT whose third row violates a constraint leaves zero rows behind, not two. Probe-confirmed against SQL Server 2025 (2026-05-08).
+
+`Storage/UndoLog.cs` records heap mutations as a row-level LIFO list (`(Heap, UndoKind, pageIdx, slotIdx)` tuples). `Heap.Insert` / `Heap.DeleteAt` take an optional log; on success they append. `Simulation.RunMutation` wraps each mutation statement: install a fresh log on `ParserContext.CurrentUndoLog`, run the body, on exception walk the log backwards (insert → tombstone slot, delete → clear tombstone) before re-raising.
+
+Identity counters and the database-scoped rowversion counter intentionally bypass the log — probe-confirmed: both keep advancing even when their consuming inserts are rolled back. LOB chains allocated for rolled-back inserts also bypass the log; they leak the same way committed deletes leak (existing quirk).
+
+Explicit transactions (`Database.BeginTransaction()`, `BEGIN TRANSACTION` / `COMMIT` / `ROLLBACK` SQL) aren't yet wired through. `BeginTransaction` returns a `SimulatedDbTransaction` whose `Commit()` is a no-op and whose `Rollback()` still throws `NotImplementedException`. Bundle 2 will lift the log to a per-connection lifetime spanning multiple statements; Bundle 3 will add SQL-text BEGIN / COMMIT / ROLLBACK and TRANCOUNT semantics.
+
 ### UPDATE / DELETE
 - `UPDATE table SET col = expr [, col = expr]* [WHERE pred]` and `DELETE [FROM] table [WHERE pred]`.
 - Multi-table-syntax form (`UPDATE alias SET alias.col = expr FROM table AS alias [WHERE pred]`, `DELETE FROM alias FROM table AS alias [WHERE pred]`) is the EF7+ `ExecuteUpdate` / `ExecuteDelete` shape. Single-source-only — additional sources or joins on the FROM clause raise `NotSupportedException`. Two-pass parsing: collect raw `(columnName, expr)` pairs without resolving ordinals, then bind to the FROM-clause table once known. SET LHS supports both bare `col = expr` and alias-qualified `[a].[col] = expr`; the alias prefix is accepted verbatim and not cross-checked against the FROM-clause's alias since the simulator's row resolvers use `name.Leaf` (the alias is moot for single-source). OUTPUT is only supported on the single-table form (EF doesn't combine OUTPUT with multi-table-syntax) — see `Simulation.Update.cs` / `Simulation.Delete.cs` for the deferred-table-binding pattern.
@@ -246,7 +255,7 @@ Type-metadata accessors (`GetDataTypeName` / `GetFieldType`) read from `Simulate
 
 ## Not modeled
 
-- Transactions / locks / MVCC.
+- Explicit transactions across statements (Bundle 2): `Database.BeginTransaction()` returns a `SimulatedDbTransaction` whose `Commit()` is a no-op and whose `Rollback()` throws `NotImplementedException`. SQL-text `BEGIN TRANSACTION` / `COMMIT` / `ROLLBACK` (Bundle 3) and TRANCOUNT semantics. Savepoints (`SAVE TRANSACTION` / `ROLLBACK TRANSACTION sp`). Locks / MVCC / isolation levels.
 - `RIGHT JOIN` (rewrite as LEFT with sources swapped); `FULL OUTER JOIN`. Both raise `NotSupportedException` at parse.
 - Comma-separated FROM (legacy ANSI-89 join syntax).
 - Plain derived tables in FROM (without APPLY) don't see outer scope — they execute eagerly at parse time. Lateral access requires `CROSS APPLY` / `OUTER APPLY`. SQL Server actually allows derived-table-sees-outer in any FROM subquery; the gap shows up in compound shapes like `(SELECT … FROM (SELECT TOP(N) … WHERE outer.col = …) AS t)` where the inner correlation isn't expressed via APPLY.
diff --git a/SqlServerSimulator.Tests.EFCore/EFCorePrimaryKey.cs b/SqlServerSimulator.Tests.EFCore/EFCorePrimaryKey.cs
@@ -42,6 +42,30 @@ public void SaveChanges_DuplicateKey_RaisesDbUpdateException()
         Assert.Contains("WIDGET-A", ex.InnerException.Message);
     }
 
+    [TestMethod]
+    public void SaveChanges_BatchWithMidBatchPkViolation_RollsBackEntireBatch()
+    {
+        // EF Core 10 batches multiple Add()s of the same entity type into a
+        // single multi-row INSERT statement. SQL Server's auto-commit-mode
+        // statement atomicity (Bundle 1) means a mid-batch PK collision rolls
+        // back the entire INSERT — neither the valid rows before nor after
+        // the collision land in the table.
+        using var context = new TestDbContext(TestDbContext.CreateInventorySimulation());
+        _ = context.Inventory.Add(new Inventory { Sku = "EXISTING", Quantity = 1 });
+        _ = context.SaveChanges();
+
+        using var context2 = new TestDbContext(context.Simulation);
+        _ = context2.Inventory.Add(new Inventory { Sku = "NEW-1", Quantity = 10 });
+        _ = context2.Inventory.Add(new Inventory { Sku = "EXISTING", Quantity = 99 });
+        _ = context2.Inventory.Add(new Inventory { Sku = "NEW-2", Quantity = 30 });
+
+        _ = Assert.Throws<DbUpdateException>(() => context2.SaveChanges());
+
+        using var context3 = new TestDbContext(context.Simulation);
+        var skus = context3.Inventory.AsNoTracking().Select(i => i.Sku).OrderBy(s => s).ToArray();
+        CollectionAssert.AreEqual(new[] { "EXISTING" }, skus);
+    }
+
     [TestMethod]
     public async Task SaveChangesAsync_DuplicateKey_RaisesDbUpdateException()
     {
diff --git a/SqlServerSimulator.Tests/StatementAtomicityTests.cs b/SqlServerSimulator.Tests/StatementAtomicityTests.cs
@@ -0,0 +1,176 @@
+using System.Data.Common;
+using static Microsoft.VisualStudio.TestTools.UnitTesting.Assert;
+
+namespace SqlServerSimulator;
+
+/// <summary>
+/// Tests for SQL Server's statement-level atomicity in auto-commit mode:
+/// when a single statement (multi-row INSERT, multi-row UPDATE, MERGE)
+/// fails mid-execution, the partial writes are rolled back. Probe-confirmed
+/// against SQL Server 2025 (2026-05-08): a multi-row INSERT whose third row
+/// violates a constraint leaves zero rows behind, not two. Identity and
+/// rowversion counters intentionally stay outside the rollback — they keep
+/// advancing even when the writes that consumed them are undone.
+/// </summary>
+[TestClass]
+public sealed class StatementAtomicityTests
+{
+    private static int CountRows(DbConnection conn, string table) =>
+        (int)conn.CreateCommand($"select count(*) from {table}").ExecuteScalar()!;
+
+    [TestMethod]
+    public void MultiRowInsert_PrimaryKeyViolation_RollsBackEntireStatement()
+    {
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int primary key, val int)").ExecuteNonQuery();
+
+        // First row inserts (id=1); second row violates PK. SQL Server rolls
+        // back the entire statement → 0 rows. Without statement atomicity the
+        // simulator would have left (1, 100) behind.
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("insert into t values (1, 100), (1, 200), (3, 300)").ExecuteNonQuery());
+        AreEqual(0, CountRows(connection, "t"));
+    }
+
+    [TestMethod]
+    public void MultiRowInsert_CheckViolation_RollsBackEntireStatement()
+    {
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int, val int check (val < 100))").ExecuteNonQuery();
+
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("insert into t values (1, 50), (2, 150), (3, 80)").ExecuteNonQuery());
+        AreEqual(0, CountRows(connection, "t"));
+    }
+
+    [TestMethod]
+    public void MultiRowInsert_NotNullViolation_RollsBackEntireStatement()
+    {
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int, val int not null)").ExecuteNonQuery();
+
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("insert into t values (1, 10), (2, null), (3, 30)").ExecuteNonQuery());
+        AreEqual(0, CountRows(connection, "t"));
+    }
+
+    [TestMethod]
+    public void MultiRowUpdate_KeyCollisionMidBatch_RollsBackEntireStatement()
+    {
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int primary key, val int)").ExecuteNonQuery();
+        _ = connection.CreateCommand("insert into t values (1, 10), (2, 20), (3, 30)").ExecuteNonQuery();
+
+        // Setting id = id + 100 to one row at a time would fail if id=1 collides with id=101 etc.
+        // Bulk update: set id = 99 for both rows where id < 3 — both target the same key.
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("update t set id = 99 where id < 3").ExecuteNonQuery());
+
+        // All three pre-update rows visible; no row got the new id=99.
+        var rows = new List<(int, int)>();
+        using var reader = connection.CreateCommand("select id, val from t order by id").ExecuteReader();
+        while (reader.Read()) rows.Add((reader.GetInt32(0), reader.GetInt32(1)));
+        CollectionAssert.AreEqual(new[] { (1, 10), (2, 20), (3, 30) }, rows);
+    }
+
+    [TestMethod]
+    public void MultiRowDelete_NeverFails_AllRowsRemoved()
+    {
+        // DELETE doesn't have constraint failures — it just tombstones rows.
+        // This test confirms the undo log doesn't accidentally undo successful
+        // deletes (the log discards on success).
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int)").ExecuteNonQuery();
+        _ = connection.CreateCommand("insert into t values (1), (2), (3)").ExecuteNonQuery();
+        _ = connection.CreateCommand("delete from t where id < 3").ExecuteNonQuery();
+        AreEqual(1, CountRows(connection, "t"));
+    }
+
+    [TestMethod]
+    public void Merge_WhenNotMatchedInsert_PartialFailure_RollsBackBatch()
+    {
+        // EF SaveChanges multi-row shape: MERGE INTO target USING (VALUES …) ...
+        // WHEN NOT MATCHED THEN INSERT. A constraint violation on the second
+        // VALUES row should leave zero rows in the target.
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int primary key, val int)").ExecuteNonQuery();
+        _ = connection.CreateCommand("insert into t values (5, 500)").ExecuteNonQuery();
+
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand(
+                "merge into t using (values (1, 10), (5, 50), (3, 30)) as src(id, val) " +
+                "on t.id = src.id " +
+                "when not matched then insert (id, val) values (src.id, src.val);").ExecuteNonQuery());
+
+        // The PK collision on (5, 50) should roll back the (1, 10) insert too.
+        var rows = new List<(int, int)>();
+        using var reader = connection.CreateCommand("select id, val from t order by id").ExecuteReader();
+        while (reader.Read()) rows.Add((reader.GetInt32(0), reader.GetInt32(1)));
+        CollectionAssert.AreEqual(new[] { (5, 500) }, rows);
+    }
+
+    [TestMethod]
+    public void IdentityCounter_AdvancesEvenOnRollback()
+    {
+        // Probe-confirmed against SQL Server 2025: identity advances even when
+        // the inserts that consumed values are rolled back.
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand(
+            "create table t (id int identity(1,1) primary key, val int check (val < 100))").ExecuteNonQuery();
+        _ = connection.CreateCommand("insert into t (val) values (50)").ExecuteNonQuery();
+
+        // Second insert violates CHECK; statement rolls back. Identity should
+        // still have advanced (the value 2 is "consumed" and gapped).
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("insert into t (val) values (200)").ExecuteNonQuery());
+
+        // Third insert: id should be 3, not 2 (matching SQL Server's gap behavior).
+        _ = connection.CreateCommand("insert into t (val) values (60)").ExecuteNonQuery();
+        var ids = new List<int>();
+        using var reader = connection.CreateCommand("select id from t order by id").ExecuteReader();
+        while (reader.Read()) ids.Add(reader.GetInt32(0));
+        CollectionAssert.AreEqual(new[] { 1, 3 }, ids);
+    }
+
+    [TestMethod]
+    public void RowVersion_AdvancesEvenOnRollback()
+    {
+        // Same probe-confirmed semantic for rowversion: the database-scoped
+        // counter advances even when the inserts are rolled back.
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int primary key, rv rowversion)").ExecuteNonQuery();
+        _ = connection.CreateCommand("insert into t (id) values (1)").ExecuteNonQuery();
+        var rv1 = (byte[])connection.CreateCommand("select rv from t where id = 1").ExecuteScalar()!;
+
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("insert into t values (1, 0x0000000000000000)").ExecuteNonQuery());
+
+        _ = connection.CreateCommand("insert into t (id) values (3)").ExecuteNonQuery();
+        var rv3 = (byte[])connection.CreateCommand("select rv from t where id = 3").ExecuteScalar()!;
+
+        // Big-endian 8-byte counter; rv3 should be > rv1 + 1 (rolled-back insert consumed a value).
+        var v1 = System.Buffers.Binary.BinaryPrimitives.ReadInt64BigEndian(rv1);
+        var v3 = System.Buffers.Binary.BinaryPrimitives.ReadInt64BigEndian(rv3);
+        IsGreaterThan(v1 + 1, v3, $"Expected gap in rowversion (v1={v1}, v3={v3}); rolled-back insert should consume a value.");
+    }
+
+    [TestMethod]
+    public void RolledBackInsert_DoesNotPersist_ButTableRemainsUsable()
+    {
+        // After a rolled-back statement, subsequent statements still work
+        // — the heap is in a consistent state.
+        using var connection = new Simulation().CreateOpenConnection();
+        _ = connection.CreateCommand("create table t (id int primary key)").ExecuteNonQuery();
+        _ = connection.CreateCommand("insert into t values (1)").ExecuteNonQuery();
+
+        _ = Throws<DbException>(() =>
+            _ = connection.CreateCommand("insert into t values (2), (1), (3)").ExecuteNonQuery());
+
+        // A subsequent legitimate insert succeeds.
+        _ = connection.CreateCommand("insert into t values (4)").ExecuteNonQuery();
+        var ids = new List<int>();
+        using var reader = connection.CreateCommand("select id from t order by id").ExecuteReader();
+        while (reader.Read()) ids.Add(reader.GetInt32(0));
+        CollectionAssert.AreEqual(new[] { 1, 4 }, ids);
+    }
+}
diff --git a/SqlServerSimulator/Parser/ParserContext.cs b/SqlServerSimulator/Parser/ParserContext.cs
@@ -52,6 +52,20 @@ internal sealed class ParserContext(SimulatedDbCommand command)
     /// </summary>
     public Token? Token;
 
+    /// <summary>
+    /// Heap-mutation undo log scoped to the current top-level statement. Set
+    /// by <see cref="Simulation.CreateResultSetsForCommand"/>'s mutation
+    /// dispatch around each INSERT / UPDATE / DELETE / MERGE; the
+    /// <see cref="Heap.Insert"/> / <see cref="Heap.DeleteAt"/>
+    /// call sites read it from here and append entries on success. A
+    /// statement that throws mid-execution (e.g. a multi-row INSERT whose
+    /// fourth row violates a constraint) walks the log backwards before
+    /// the exception propagates, restoring the heap to its pre-statement
+    /// state. Bundle 2 will reuse the same log shape, lifetime extended
+    /// across statements when an explicit <c>BeginTransaction</c> is open.
+    /// </summary>
+    public UndoLog? CurrentUndoLog;
+
     /// <summary>
     /// True while an <c>Expression.Parse</c> call is running for a
     /// <c>CREATE TABLE</c> column's <c>DEFAULT</c> clause. Set by the
diff --git a/SqlServerSimulator/Simulation.Delete.cs b/SqlServerSimulator/Simulation.Delete.cs
@@ -98,7 +98,7 @@ SqlValue Resolve(MultiPartName name)
         }
 
         foreach (var (pageIndex, slotIndex, _) in deleted)
-            table.Heap.DeleteAt(pageIndex, slotIndex);
+            table.Heap.DeleteAt(pageIndex, slotIndex, context.CurrentUndoLog);
 
         if (output is not null)
         {
diff --git a/SqlServerSimulator/Simulation.Insert.cs b/SqlServerSimulator/Simulation.Insert.cs
@@ -217,7 +217,7 @@ private static SimulatedStatementOutcome ProcessHeapInsert(HeapTable destination
 
             var storedValues = ProjectStoredValues(destinationTable, rowValues);
             EnforceKeyConstraints(destinationTable, storedValues);
-            destinationTable.Heap.Insert(RowEncoder.EncodeRow(destinationTable.StoredColumns, storedValues, destinationTable.Heap));
+            destinationTable.Heap.Insert(RowEncoder.EncodeRow(destinationTable.StoredColumns, storedValues, destinationTable.Heap), context.CurrentUndoLog);
 
             if (output is { } o)
                 outputRows!.Add(o.ProjectRow(rowValues, sourceRowValues: null));
diff --git a/SqlServerSimulator/Simulation.Merge.cs b/SqlServerSimulator/Simulation.Merge.cs
@@ -311,7 +311,7 @@ SqlValue ResolveSource(MultiPartName name)
 
             var storedValues = ProjectStoredValues(destinationTable, rowValues);
             EnforceKeyConstraints(destinationTable, storedValues);
-            destinationTable.Heap.Insert(RowEncoder.EncodeRow(destinationTable.StoredColumns, storedValues, destinationTable.Heap));
+            destinationTable.Heap.Insert(RowEncoder.EncodeRow(destinationTable.StoredColumns, storedValues, destinationTable.Heap), context.CurrentUndoLog);
             insertedCount++;
 
             if (output is { } o)
diff --git a/SqlServerSimulator/Simulation.Update.cs b/SqlServerSimulator/Simulation.Update.cs
@@ -216,12 +216,16 @@ SqlValue ResolveOriginal(MultiPartName name)
         // Phase 2: PK / UNIQUE validation against the post-update virtual state.
         EnforceKeyConstraintsForUpdate(table, affected);
 
-        // Phase 3: tombstone old, insert new. Validation has already passed,
-        // so no rollback is required.
+        // Phase 3: tombstone old, insert new. Validation has already passed —
+        // no statement-level rollback gets triggered for these writes, but
+        // pass the undo log anyway so an explicit transaction (Bundle 2) can
+        // unwind them later. Each pair (delete-old, insert-new) records two
+        // log entries; LIFO walk pops the insert first, then the delete,
+        // restoring the original row.
         foreach (var (pageIndex, slotIndex, _, _) in affected)
-            table.Heap.DeleteAt(pageIndex, slotIndex);
+            table.Heap.DeleteAt(pageIndex, slotIndex, context.CurrentUndoLog);
         foreach (var (_, _, fullNew, _) in affected)
-            table.Heap.Insert(RowEncoder.EncodeRow(table.StoredColumns, ProjectStoredValues(table, fullNew), table.Heap));
+            table.Heap.Insert(RowEncoder.EncodeRow(table.StoredColumns, ProjectStoredValues(table, fullNew), table.Heap), context.CurrentUndoLog);
 
         if (output is not null)
         {
diff --git a/SqlServerSimulator/Simulation.cs b/SqlServerSimulator/Simulation.cs
diff --git a/SqlServerSimulator/Storage/Heap.cs b/SqlServerSimulator/Storage/Heap.cs
diff --git a/SqlServerSimulator/Storage/HeapPage.cs b/SqlServerSimulator/Storage/HeapPage.cs
diff --git a/SqlServerSimulator/Storage/UndoLog.cs b/SqlServerSimulator/Storage/UndoLog.cs

Original file line number	Diff line number	Diff line change
`@@ -98,7 +98,7 @@ SqlValue Resolve(MultiPartName name)`
`98`	`98`	`}`
`99`	`99`
`100`	`100`	`foreach (var (pageIndex, slotIndex, _) in deleted)`
`101`		`- table.Heap.DeleteAt(pageIndex, slotIndex);`
	`101`	`+ table.Heap.DeleteAt(pageIndex, slotIndex, context.CurrentUndoLog);`
`102`	`102`
`103`	`103`	`if (output is not null)`
`104`	`104`	`{`