sys.dm_hadr_cluster returns a single non-clustered row, SUSER_SID resolves against the login surface, SID_BINARY is constant NULL, and a bare THROW inside a CATCH whose TRY body succeeded no longer raises Msg 10704: the rethrow compile-check is lexical, so skip-dispatching an un-taken CATCH body now bumps CatchDepth.

RyanLamansky · RyanLamansky · commit 6bf2c51fcbd5 · 2026-07-15T14:09:15.000-05:00
diff --git a/SqlServerSimulator.Tests/PrincipalScalarTests.cs b/SqlServerSimulator.Tests/PrincipalScalarTests.cs
@@ -86,4 +86,43 @@ public void Combined_AllConverge_ReturnDbo()
         => AreEqual(1, new Simulation().ExecuteScalar("""
             select iif(current_user = user_name() and user_name() = original_login() and user = current_user, 1, 0)
             """));
+
+    // === SUSER_SID / SID_BINARY ===
+
+    [TestMethod]
+    public void SuserSid_NoArg_ReturnsWellKnownSid()
+        => CollectionAssert.AreEqual(new byte[] { 0x01 }, (byte[]?)new Simulation().ExecuteScalar("select suser_sid()"));
+
+    [TestMethod]
+    public void SuserSid_Sa_ReturnsWellKnownSid()
+        => CollectionAssert.AreEqual(new byte[] { 0x01 }, (byte[]?)new Simulation().ExecuteScalar("select suser_sid(N'sa')"));
+
+    [TestMethod]
+    public void SuserSid_RegistryLogin_MatchesServerPrincipalsSid()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login probe_login with password = 'p@ss'");
+        AreEqual(1, sim.ExecuteScalar(
+            "select iif(suser_sid(N'probe_login') = (select sid from sys.server_principals where name = N'probe_login'), 1, 0)"));
+    }
+
+    [TestMethod]
+    public void SuserSid_Unknown_ReturnsNull()
+        => AreEqual(DBNull.Value, new Simulation().ExecuteScalar("select suser_sid(N'nosuchlogin')"));
+
+    [TestMethod]
+    public void SuserSid_SecondParameter_Accepted()
+        => AreEqual(DBNull.Value, new Simulation().ExecuteScalar("select suser_sid(N'nosuchlogin', 0)"));
+
+    [TestMethod]
+    public void SidBinary_AlwaysNull_EvenForExistingLogin()
+    {
+        // Probe-confirmed against SQL Server 2025: SID_BINARY resolves only
+        // Windows / Entra-ID directory principals — it returns NULL even for
+        // an existing SQL-auth login, so constant NULL is faithful here.
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login probe_login2 with password = 'p@ss'");
+        AreEqual(DBNull.Value, sim.ExecuteScalar("select sid_binary(N'probe_login2')"));
+        AreEqual(DBNull.Value, sim.ExecuteScalar("select sid_binary(N'')"));
+    }
 }
diff --git a/SqlServerSimulator.Tests/SsmsProgrammabilityNodeCatalogTests.cs b/SqlServerSimulator.Tests/SsmsProgrammabilityNodeCatalogTests.cs
@@ -176,6 +176,22 @@ public void DatabaseFiles_ResolvesCrossDatabaseThroughMaster()
         AreEqual("master_Log", (string?)sim.ExecuteScalar("select name from master.sys.database_files where file_id = 2"));
     }
 
+    /// <summary>
+    /// Probe-confirmed against a non-clustered SQL Server 2025: the DMV
+    /// returns one row even with no failover cluster — empty name,
+    /// NODE_MAJORITY (0), NORMAL_QUORUM (1). SSMS's Select-Top-1000
+    /// server-properties batch reads it inside a TRY/CATCH that rethrows
+    /// everything except permission errors, so zero rows or Msg 208
+    /// escape to the user.
+    /// </summary>
+    [TestMethod]
+    public void DmHadrCluster_SingleNonClusteredRow()
+        => AreEqual(1, new Simulation().ExecuteScalar("""
+            select iif(cluster_name = N'' and quorum_type = 0 and quorum_type_desc = N'NODE_MAJORITY'
+                       and quorum_state = 1 and quorum_state_desc = N'NORMAL_QUORUM', 1, 0)
+            from sys.dm_hadr_cluster
+            """));
+
     [TestMethod]
     public void Views_ScriptAsColumns_ZeroForOrdinaryView()
     {
diff --git a/SqlServerSimulator.Tests/TryCatchTests.cs b/SqlServerSimulator.Tests/TryCatchTests.cs
@@ -163,6 +163,24 @@ public void NestedTry_InnerCatchOwnError_OuterDoesntSee()
     public void Throw_NoArgs_OutsideCatch_Msg10704()
         => new Simulation().AssertSqlError("throw", 10704);
 
+    /// <summary>
+    /// The Msg 10704 check is lexical — a bare THROW inside a CATCH whose
+    /// TRY body succeeded (so the CATCH skip-parses) must not raise it.
+    /// SSMS's Select-Top-1000 server-properties batch has this shape:
+    /// the CATCH rethrows unless ERROR_NUMBER() is a tolerated permission
+    /// error, and the TRY body normally succeeds.
+    /// </summary>
+    [TestMethod]
+    public void Throw_NoArgs_InsideSkippedCatch_Parses()
+        => AreEqual(7, new Simulation().ExecuteScalar("""
+            declare @x int;
+            begin try set @x = 1 end try
+            begin catch
+                if (error_number() not in (297, 300)) begin throw end
+            end catch
+            select 7
+            """));
+
     [TestMethod]
     public void Throw_NoArgs_InsideCatch_Rethrows()
     {
diff --git a/SqlServerSimulator/BuiltInResources.Security.cs b/SqlServerSimulator/BuiltInResources.Security.cs
@@ -319,7 +319,7 @@ private static IEnumerable<SqlValue[]> EnumerateSysDatabaseRoleMembers(Parser.Ba
     /// four 32-bit quadrants with a per-quadrant-salted FNV-1a hash so the same
     /// name always maps to the same bytes without persisting a GUID.
     /// </summary>
-    private static byte[] DeriveLoginSid(string name)
+    internal static byte[] DeriveLoginSid(string name)
     {
         var sid = new byte[16];
         for (var quadrant = 0; quadrant < 4; quadrant++)
diff --git a/SqlServerSimulator/BuiltInResources.ServerAndDatabases.cs b/SqlServerSimulator/BuiltInResources.ServerAndDatabases.cs
@@ -380,6 +380,22 @@ void Sys(string name, HeapColumn[] columns, Func<Parser.BatchContext, Database,
             new("cluster_connection_options", SqlType.NVarchar, 4000, true),
         ], static (_, _) => EmptyCatalogRows);
 
+        // sys.dm_hadr_cluster: single-row failover-clustering DMV. Probe-
+        // confirmed against a non-clustered SQL Server 2025: even with no
+        // cluster the view returns ONE row — empty cluster_name,
+        // quorum_type 0 / NODE_MAJORITY, quorum_state 1 / NORMAL_QUORUM —
+        // and SSMS's Select-Top-1000 server-properties batch reads it inside
+        // a TRY/CATCH that tolerates only permission errors, so an empty
+        // view (or Msg 208) escapes as a THROW.
+        Sys("dm_hadr_cluster",
+        [
+            new("cluster_name", SqlType.NVarchar, 256, false),
+            new("quorum_type", SqlType.TinyInt, null, false),
+            new("quorum_type_desc", nvarchar60Catalog, 60, false),
+            new("quorum_state", SqlType.TinyInt, null, false),
+            new("quorum_state_desc", nvarchar60Catalog, 60, false),
+        ], static (_, _) => DmHadrClusterRows);
+
         // sys.dm_hadr_database_replica_states: server-scope AlwaysOn DMV,
         // always empty (no AGs). SSMS's enumeration does
         // `insert into #tmp select group_database_id, synchronization_state,
@@ -613,6 +629,21 @@ void Metric(string metric, bool aggregatesNullable)
     /// </summary>
     private static readonly SqlValue[][] DmOsHostInfoRows = [BuildDmOsHostInfoRow()];
 
+    /// <summary>
+    /// The single <c>sys.dm_hadr_cluster</c> row — a non-clustered
+    /// instance's values, probe-confirmed against SQL Server 2025.
+    /// </summary>
+    private static readonly SqlValue[][] DmHadrClusterRows =
+    [
+        [
+            SqlValue.FromNVarchar(string.Empty),
+            SqlValue.FromByte(0),
+            SqlValue.FromString(NVarcharSqlType.Get(60, Collation.Catalog, Coercibility.Implicit), "NODE_MAJORITY"),
+            SqlValue.FromByte(1),
+            SqlValue.FromString(NVarcharSqlType.Get(60, Collation.Catalog, Coercibility.Implicit), "NORMAL_QUORUM"),
+        ],
+    ];
+
     private static SqlValue[] BuildDmOsHostInfoRow()
     {
         string platform, distribution, release;
diff --git a/SqlServerSimulator/Parser/Expression.cs b/SqlServerSimulator/Parser/Expression.cs
@@ -750,6 +750,7 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
                 "REPLICATE" => new Replicate(context),
                 "SCHEMA_ID" => new SchemaId(context),
                 "SUBSTRING" => new Substring(context),
+                "SUSER_SID" => new SUserSid(context),
                 "TRANSLATE" => new Translate(context),
                 "TRY_PARSE" => new ParseFunction(context, tryMode: true),
                 "TYPE_NAME" => new TypeName(context),
@@ -775,6 +776,7 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
                 "PWDCOMPARE" => new PwdCompare(context),
                 "PWDENCRYPT" => new PwdEncrypt(context),
                 "ROW_NUMBER" => WindowExpression.ParseRowNumber(context),
+                "SID_BINARY" => new SidBinary(context),
                 "STATS_DATE" => new StatsDate(context),
                 "STRING_AGG" => AggregateExpression.Parse(context, AggregateKind.StringAgg),
                 "SUSER_NAME" => new SUserName(context, isSidVariant: false),
diff --git a/SqlServerSimulator/Parser/Expressions/PrincipalScalarFunctions.cs b/SqlServerSimulator/Parser/Expressions/PrincipalScalarFunctions.cs
@@ -104,6 +104,92 @@ internal override string DebugDisplay() => this.arg is null
         : $"{(this.isSidVariant ? "SUSER_SNAME" : "SUSER_NAME")}({this.arg.DebugDisplay()})";
 }
 
+/// <summary>
+/// SQL <c>SUSER_SID([login [, Param2]])</c>: returns the binary SID for a
+/// server login — the calling session's login with no argument. Mirrors the
+/// <c>sys.server_principals</c> sid surface: <c>sa</c> is the well-known
+/// single byte <c>0x01</c>, registry logins (<c>CREATE LOGIN</c>) get their
+/// deterministic 16-byte synthetic sid, and an unknown name returns NULL.
+/// The no-argument form returns <c>0x01</c>, matching the
+/// <c>sys.dm_exec_sessions.security_id</c> placeholder for the simulator's
+/// fixed session principal. The optional <c>Param2</c> (real's
+/// skip-name-validation flag) parses and is ignored. Result type is
+/// <c>varbinary(85)</c>.
+/// </summary>
+internal sealed class SUserSid : Expression
+{
+    private readonly Expression? loginArg;
+
+    public SUserSid(ParserContext context)
+    {
+        if (context.Token is Tokens.Operator { Character: ')' })
+            return;
+        this.loginArg = Parse(context);
+        if (context.Token is Tokens.Operator { Character: ',' })
+        {
+            context.MoveNextRequired();
+            _ = Parse(context);
+        }
+        if (context.Token is not Tokens.Operator { Character: ')' })
+            throw SimulatedSqlException.SyntaxErrorNear(context);
+    }
+
+    public override SqlValue Run(RuntimeContext runtime)
+    {
+        if (this.loginArg is null)
+            return SqlValue.FromVarbinary([0x01]);
+        var nameValue = this.loginArg.Run(runtime);
+        if (nameValue.IsNull)
+            return SqlValue.Null(SqlType.Varbinary);
+        var name = nameValue.CoerceTo(SqlType.SystemName).AsString;
+        return Collation.Baseline.Equals(name, "sa")
+            ? SqlValue.FromVarbinary([0x01])
+            : runtime.Batch.Connection.Simulation.Logins.ContainsKey(name)
+                ? SqlValue.FromVarbinary(BuiltInResources.DeriveLoginSid(name))
+                : SqlValue.Null(SqlType.Varbinary);
+    }
+
+    public override SqlType GetSqlType(BatchContext batch, Func<MultiPartName, SqlType> resolveColumnType) => SqlType.Varbinary;
+
+    internal override bool ResultIsNullable(Func<MultiPartName, bool> resolveColumnNullable) => true;
+
+    internal override string DebugDisplay() => this.loginArg is null ? "SUSER_SID()" : $"SUSER_SID({this.loginArg.DebugDisplay()})";
+}
+
+/// <summary>
+/// SQL <c>SID_BINARY(name)</c>: resolves a Windows / Entra-ID principal
+/// name to its binary SID. Probe-confirmed against SQL Server 2025: it
+/// returns NULL even for existing SQL-auth logins (<c>sid_binary(N'sa')</c>
+/// is NULL) — it only resolves directory principals, which the simulator
+/// never hosts — so a constant NULL <c>varbinary(85)</c> is faithful for
+/// every input the simulator can see. The argument is still parsed and
+/// evaluated (one required argument). SSMS's Select-Top-1000
+/// server-properties batch calls it on the service's Windows group name.
+/// </summary>
+internal sealed class SidBinary : Expression
+{
+    private readonly Expression arg;
+
+    public SidBinary(ParserContext context)
+    {
+        this.arg = Parse(context);
+        if (context.Token is not Tokens.Operator { Character: ')' })
+            throw SimulatedSqlException.SyntaxErrorNear(context);
+    }
+
+    public override SqlValue Run(RuntimeContext runtime)
+    {
+        _ = this.arg.Run(runtime);
+        return SqlValue.Null(SqlType.Varbinary);
+    }
+
+    public override SqlType GetSqlType(BatchContext batch, Func<MultiPartName, SqlType> resolveColumnType) => SqlType.Varbinary;
+
+    internal override bool ResultIsNullable(Func<MultiPartName, bool> resolveColumnNullable) => true;
+
+    internal override string DebugDisplay() => $"SID_BINARY({this.arg.DebugDisplay()})";
+}
+
 /// <summary>
 /// SQL <c>ORIGINAL_LOGIN()</c>: returns the original login of the session
 /// before any <c>EXECUTE AS</c> impersonation. The simulator doesn't model
diff --git a/SqlServerSimulator/Simulation/Simulation.TryCatch.cs b/SqlServerSimulator/Simulation/Simulation.TryCatch.cs
@@ -133,16 +133,22 @@ private IEnumerable<SimulatedStatementOutcome> ParseTryCatch(BatchContext batch)
         {
             // No error caught — skip-dispatch CATCH body to advance the
             // cursor past END CATCH. Matches the "outer skipping" branch in
-            // ParseWhileStatement.
+            // ParseWhileStatement. CatchDepth still bumps: it tracks LEXICAL
+            // containment, and the bare-THROW rethrow check (Msg 10704) is a
+            // compile-time structural rule that must accept a THROW inside a
+            // skipped CATCH body — SSMS's Select-Top-1000 server-properties
+            // batch has exactly that shape once its TRY body succeeds.
             var wasSkipModeFlag = batch.SkipModeFlag;
             batch.SkipModeFlag = true;
+            batch.CatchDepth++;
             try
             {
                 foreach (var o in DispatchStatementsUntil(batch, endKeyword: Keyword.End))
                     yield return o;
             }
             finally
             {
+                batch.CatchDepth--;
                 batch.SkipModeFlag = wasSkipModeFlag;
             }
         }
diff --git a/docs/claude/backlog.md b/docs/claude/backlog.md
diff --git a/docs/claude/catalog-views.md b/docs/claude/catalog-views.md
diff --git a/docs/claude/control-flow.md b/docs/claude/control-flow.md
diff --git a/docs/claude/scalars.md b/docs/claude/scalars.md

Original file line number	Diff line number	Diff line change
`@@ -319,7 +319,7 @@ private static IEnumerable<SqlValue[]> EnumerateSysDatabaseRoleMembers(Parser.Ba`
`319`	`319`	`/// four 32-bit quadrants with a per-quadrant-salted FNV-1a hash so the same`
`320`	`320`	`/// name always maps to the same bytes without persisting a GUID.`
`321`	`321`	`/// </summary>`
`322`		`- private static byte[] DeriveLoginSid(string name)`
	`322`	`+ internal static byte[] DeriveLoginSid(string name)`
`323`	`323`	`{`
`324`	`324`	`var sid = new byte[16];`
`325`	`325`	`for (var quadrant = 0; quadrant < 4; quadrant++)`
Original file line number	Diff line number	Diff line change
`@@ -133,16 +133,22 @@ private IEnumerable<SimulatedStatementOutcome> ParseTryCatch(BatchContext batch)`
`133`	`133`	`{`
`134`	`134`	`// No error caught — skip-dispatch CATCH body to advance the`
`135`	`135`	`// cursor past END CATCH. Matches the "outer skipping" branch in`
`136`		`- // ParseWhileStatement.`
	`136`	`+ // ParseWhileStatement. CatchDepth still bumps: it tracks LEXICAL`
	`137`	`+ // containment, and the bare-THROW rethrow check (Msg 10704) is a`
	`138`	`+ // compile-time structural rule that must accept a THROW inside a`
	`139`	`+ // skipped CATCH body — SSMS's Select-Top-1000 server-properties`
	`140`	`+ // batch has exactly that shape once its TRY body succeeds.`
`137`	`141`	`var wasSkipModeFlag = batch.SkipModeFlag;`
`138`	`142`	`batch.SkipModeFlag = true;`
	`143`	`+ batch.CatchDepth++;`
`139`	`144`	`try`
`140`	`145`	`{`
`141`	`146`	`foreach (var o in DispatchStatementsUntil(batch, endKeyword: Keyword.End))`
`142`	`147`	`yield return o;`
`143`	`148`	`}`
`144`	`149`	`finally`
`145`	`150`	`{`
	`151`	`+ batch.CatchDepth--;`
`146`	`152`	`batch.SkipModeFlag = wasSkipModeFlag;`
`147`	`153`	`}`
`148`	`154`	`}`