MARS ships over the TDS endpoint: prelogin acks MARS only when requested, post-login traffic runs through an SMP multiplexer whose send window advances from every inbound frame's WNDW field and logical sessions execute under serialized cooperative multiplexing preserving the engine's one-executor-per-connection contract, with parity for shared SPID/temp-table/SET/transaction state across overlapping commands, per-session attention isolation, and EF Core lazy-loading via UseLazyLoadingProxies covered in-process and over the wire. SMP frame shape pinned to a cleartext capture of the real server's mux (no server SYN, piggybacked windows, mid-message-only ACKs), the deviation set that native SNI rejects with SMux error 19 but managed SNI tolerates.

Author: RyanLamansky

CLAUDE.md

@@ -165,7 +165,7 @@ Per-feature deep-dives live under `docs/claude/`. Each entry below is a trigger:
 - **New top-level statement parser or dispatch-loop separator rules, double-quoted identifiers / QUOTED_IDENTIFIER** → [`grammar.md`](docs/claude/grammar.md) + [`control-flow.md`](docs/claude/control-flow.md).
 - **BACPAC import** (`Simulation.ImportBacpac` — multi-database via repeated calls, `BacpacImportOptions`, `ModelXmlReader` dispatcher, BCP wire format, `BacpacBuilder` test harness) → [`bacpac-loader.md`](docs/claude/bacpac-loader.md).
 - **Linked servers** (`Simulation.AddRemoteSimulation`, `sp_addlinkedserver` / `sp_dropserver`, four-part FROM routing through the remote's ADO.NET pipeline, `OPENQUERY(server,'query')` ad-hoc pass-through + compile-time schema discovery, `sys.servers`) → [`linked-servers.md`](docs/claude/linked-servers.md).
-- **TDS network endpoint** (`Simulation.ListenAsync` → `SimulatedNetworkListener`; real SqlClient over loopback TCP+TLS; SQLBatch/RPC/TM/BulkLoad (`SqlBulkCopy`); TVP (`0xF3` `SqlDbType.Structured`) RPC params via the shared `TdsColumnDecoder`; `sp_cursor*` API-server-cursor RPC family; mid-stream attention (cancel / `CommandTimeout`) via a carry-forward concurrent read → `DONE_ATTN` ack + probed XACT_ABORT tx semantics; credential enforcement via the `CREATE LOGIN` registry, Msg 18456 on mismatch; EF via plain `UseSqlServer`; oracles = `*.Tests.SqlClient` + `*.Tests.Smo`, the real-SMO consumer oracle) → [`tds-endpoint.md`](docs/claude/tds-endpoint.md).
+- **TDS network endpoint** (`Simulation.ListenAsync` → `SimulatedNetworkListener`; real SqlClient over loopback TCP+TLS; SQLBatch/RPC/TM/BulkLoad (`SqlBulkCopy`); TVP (`0xF3` `SqlDbType.Structured`) RPC params via the shared `TdsColumnDecoder`; `sp_cursor*` API-server-cursor RPC family; mid-stream attention (cancel / `CommandTimeout`) via a carry-forward concurrent read → `DONE_ATTN` ack + probed XACT_ABORT tx semantics; MARS (`MultipleActiveResultSets=True`) via an SMP demux/mux over one shared connection with serialized cooperative multiplexing + per-session attention; credential enforcement via the `CREATE LOGIN` registry, Msg 18456 on mismatch; EF via plain `UseSqlServer`; oracles = `*.Tests.SqlClient` + `*.Tests.Smo`, the real-SMO consumer oracle) → [`tds-endpoint.md`](docs/claude/tds-endpoint.md).
 
 ## Not modeled
 

SqlServerSimulator.Tests.EFCore/EFCoreLazyLoadMars.cs

@@ -0,0 +1,170 @@
+using Microsoft.EntityFrameworkCore;
+using SqlServerSimulator.EFCore;
+
+namespace SqlServerSimulator;
+
+/// <summary>
+/// EF Core lazy-loading proxies over the simulator — the canonical MARS
+/// (Multiple Active Result Sets) shape: iterating a parent query keeps its
+/// reader open while touching a navigation property fires a second query per
+/// row. Under vanilla <c>UseSqlServer</c> that throws "There is already an open
+/// DataReader" unless MARS is enabled; the in-process
+/// <see cref="SimulatedDbConnection"/> permits the overlap natively (a MARS-
+/// enabled superset), and the wire endpoint now negotiates MARS so plain
+/// <c>UseSqlServer</c> with <c>MultipleActiveResultSets=True</c> works too.
+/// The same model also exercises <c>AsSplitQuery</c> and a nested foreach over
+/// two independent queries — both natural MARS shapes.
+/// </summary>
+[TestClass]
+public class EFCoreLazyLoadMars
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    // Lazy-loading proxies subclass the entities at runtime, so they must be
+    // public/protected-constructible and their navigations virtual.
+    public class Blog
+    {
+        public int Id { get; set; }
+
+        public string Name { get; set; } = "";
+
+        public virtual List<Post> Posts { get; set; } = [];
+    }
+
+    public class Post
+    {
+        public int Id { get; set; }
+
+        public string Title { get; set; } = "";
+
+        public int BlogId { get; set; }
+
+        public virtual Blog? Blog { get; set; }
+    }
+
+    private sealed class BlogContext(Action<DbContextOptionsBuilder> configure) : DbContext
+    {
+        public DbSet<Blog> Blogs => this.Set<Blog>();
+
+        public DbSet<Post> Posts => this.Set<Post>();
+
+        protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder) =>
+            configure(optionsBuilder.UseLazyLoadingProxies());
+
+        protected override void OnModelCreating(ModelBuilder modelBuilder)
+        {
+            _ = modelBuilder.Entity<Blog>(b =>
+            {
+                _ = b.Property(x => x.Id).ValueGeneratedNever();
+                _ = b.Property(x => x.Name).HasColumnType("nvarchar(50)");
+            });
+            _ = modelBuilder.Entity<Post>(p =>
+            {
+                _ = p.Property(x => x.Id).ValueGeneratedNever();
+                _ = p.Property(x => x.Title).HasColumnType("nvarchar(50)");
+            });
+        }
+    }
+
+    private static void Seed(Simulation simulation)
+    {
+        _ = simulation
+            .CreateOpenConnection()
+            .CreateCommand("""
+                create table Blogs (Id int not null primary key, Name nvarchar(50) not null);
+                create table Posts (Id int not null primary key, Title nvarchar(50) not null, BlogId int not null);
+                insert into Blogs values (1, 'Tech'), (2, 'Food'), (3, 'Travel');
+                insert into Posts values
+                    (10, 'A', 1), (11, 'B', 1), (12, 'C', 1),
+                    (20, 'D', 2), (21, 'E', 2),
+                    (30, 'F', 3);
+                """)
+            .ExecuteNonQuery();
+    }
+
+    private static Dictionary<int, int> ExpectedCounts() => new() { [1] = 3, [2] = 2, [3] = 1 };
+
+    [TestMethod]
+    public void InProcess_LazyLoad_NavigationPerRow_WhileReaderOpen()
+    {
+        var simulation = new Simulation();
+        Seed(simulation);
+        using var context = new BlogContext(o => o.UseSqlServerSimulator(simulation.CreateDbConnection()));
+
+        var counts = new Dictionary<int, int>();
+        // Streaming the outer query keeps its reader open; touching Posts fires a
+        // lazy-load query per blog on the same connection — the overlap the
+        // in-process connection permits natively.
+        foreach (var blog in context.Blogs.OrderBy(b => b.Id))
+            counts[blog.Id] = blog.Posts.Count;
+
+        CollectionAssert.AreEquivalent(ExpectedCounts(), counts);
+    }
+
+    [TestMethod]
+    public async Task OverWire_LazyLoad_NavigationPerRow_RequiresMars()
+    {
+        var simulation = new Simulation();
+        Seed(simulation);
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        var connectionString =
+            $"Server=127.0.0.1,{listener.Port};User ID=sa;Password=x;TrustServerCertificate=True;" +
+            "MultipleActiveResultSets=True;Connect Timeout=15";
+
+        using var context = new BlogContext(o => o.UseSqlServer(connectionString));
+
+        var counts = new Dictionary<int, int>();
+        foreach (var blog in context.Blogs.OrderBy(b => b.Id))
+            counts[blog.Id] = blog.Posts.Count;
+
+        CollectionAssert.AreEquivalent(ExpectedCounts(), counts);
+    }
+
+    [TestMethod]
+    public async Task OverWire_SplitQuery_LoadsCollectionsAcrossSessions()
+    {
+        var simulation = new Simulation();
+        Seed(simulation);
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        var connectionString =
+            $"Server=127.0.0.1,{listener.Port};User ID=sa;Password=x;TrustServerCertificate=True;" +
+            "MultipleActiveResultSets=True;Connect Timeout=15";
+
+        using var context = new BlogContext(o => o.UseSqlServer(connectionString));
+
+        var blogs = await context.Blogs
+            .Include(b => b.Posts)
+            .AsSplitQuery()
+            .OrderBy(b => b.Id)
+            .ToListAsync(TestContext.CancellationToken);
+
+        var counts = blogs.ToDictionary(b => b.Id, b => b.Posts.Count);
+        CollectionAssert.AreEquivalent(ExpectedCounts(), counts);
+    }
+
+    [TestMethod]
+    public async Task OverWire_NestedForeachOverTwoQueries_OnOneContext()
+    {
+        var simulation = new Simulation();
+        Seed(simulation);
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        var connectionString =
+            $"Server=127.0.0.1,{listener.Port};User ID=sa;Password=x;TrustServerCertificate=True;" +
+            "MultipleActiveResultSets=True;Connect Timeout=15";
+
+        using var context = new BlogContext(o => o.UseSqlServer(connectionString));
+
+        var pairs = new List<string>();
+        // Two independent streaming queries interleaved on one context — the
+        // inner reader opens while the outer reader is still draining.
+        foreach (var blog in context.Blogs.OrderBy(b => b.Id))
+        {
+            foreach (var post in context.Posts.Where(p => p.BlogId == blog.Id).OrderBy(p => p.Id))
+                pairs.Add($"{blog.Id}:{post.Id}");
+        }
+
+        CollectionAssert.AreEqual(
+            new[] { "1:10", "1:11", "1:12", "2:20", "2:21", "3:30" },
+            pairs);
+    }
+}

SqlServerSimulator.Tests.EFCore/SqlServerSimulator.Tests.EFCore.csproj

@@ -23,6 +23,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.2" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.2" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.3.0" />
     <PackageReference Include="MSTest.TestAdapter" Version="4.1.0" />

SqlServerSimulator.Tests.Internal/SmpFrameTests.cs

@@ -0,0 +1,201 @@
+using System.Buffers.Binary;
+using System.Net;
+using System.Net.Sockets;
+using SqlServerSimulator.Network;
+using static Microsoft.VisualStudio.TestTools.UnitTesting.Assert;
+
+namespace SqlServerSimulator;
+
+/// <summary>
+/// Frame-level regression guard pinning the server-to-client SMP (Session
+/// Multiplex Protocol) shape the real SQL Server 2025 emits — captured
+/// cleartext (Encrypt=False login-only encryption) via a tee proxy on
+/// 2026-07-18. The critical facts, and why they matter: Windows native SNI
+/// validates SMUX strictly and drops the physical connection ("Physical
+/// connection is not usable", SMux error 19) on shapes managed SNI (Linux)
+/// tolerates. These assertions fail on Linux if the multiplexer regresses,
+/// rather than only surfacing on a Windows host.
+/// <list type="bullet">
+/// <item>The server sends NO SYN frame — a client SYN opens a session and the
+/// server's first frame on it is the DATA response.</item>
+/// <item>A complete (EOM) request gets NO standalone ACK; its DATA response
+/// piggybacks the advanced receive window (received + slack).</item>
+/// <item>A mid-message (EOM-clear) packet of a multi-packet request DOES get a
+/// standalone ACK advancing the window, since no response comes until the whole
+/// message arrives.</item>
+/// <item>Session close echoes a FIN whose SEQNUM is the last DATA sequence sent
+/// and whose WNDW is received + slack.</item>
+/// </list>
+/// The multiplexer is driven directly over a loopback socket pair through the
+/// <see cref="ISmpHost"/> seam with a canned session runner, so the test needs
+/// no TLS / login / engine.
+/// </summary>
+[TestClass]
+public sealed class SmpFrameTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const byte Syn = Tds.SmpFlagSyn;
+    private const byte Ack = Tds.SmpFlagAck;
+    private const byte Fin = Tds.SmpFlagFin;
+    private const byte Data = Tds.SmpFlagData;
+
+    private sealed record Frame(byte Flags, ushort Sid, uint Length, uint Seq, uint Window, byte[] Payload);
+
+    /// <summary>
+    /// Canned host: reads one whole TDS message per session then writes a single
+    /// tabular-result packet as the response, mirroring the real session loop's
+    /// FIN on completion. No engine involved.
+    /// </summary>
+    private sealed class CannedHost : ISmpHost
+    {
+        public SmpMultiplexer Multiplexer = null!;
+
+        public async Task RunMarsSessionAsync(SmpSession session, CancellationToken cancellationToken)
+        {
+            using var stream = new SmpSessionStream(session);
+            var transport = new TdsPacketTransport(stream) { PacketSize = Tds.DefaultPacketSize };
+            var message = await transport.ReadMessageAsync(cancellationToken).ConfigureAwait(false);
+            if (message is not null)
+                await transport.WritePacketAsync(Tds.PacketTabularResult, new byte[] { Tds.TokenDone, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, endOfMessage: true, cancellationToken).ConfigureAwait(false);
+            await this.Multiplexer.SendFinAsync(session, CancellationToken.None).ConfigureAwait(false);
+        }
+
+        public void CancelConnectionExecution()
+        {
+        }
+    }
+
+    private static byte[] BuildFrame(byte flags, ushort sid, uint seq, uint window, byte[]? payload = null)
+    {
+        payload ??= [];
+        var frame = new byte[Tds.SmpHeaderSize + payload.Length];
+        frame[0] = Tds.SmpSmid;
+        frame[1] = flags;
+        BinaryPrimitives.WriteUInt16LittleEndian(frame.AsSpan(2), sid);
+        BinaryPrimitives.WriteUInt32LittleEndian(frame.AsSpan(4), (uint)frame.Length);
+        BinaryPrimitives.WriteUInt32LittleEndian(frame.AsSpan(8), seq);
+        BinaryPrimitives.WriteUInt32LittleEndian(frame.AsSpan(12), window);
+        payload.CopyTo(frame.AsSpan(Tds.SmpHeaderSize));
+        return frame;
+    }
+
+    /// <summary>A minimal single-packet SQLBatch TDS packet (header + trivial body).</summary>
+    private static byte[] TdsBatchPacket(bool endOfMessage)
+    {
+        var body = new byte[] { 0, 0, 0, 0, 1, 0 }; // ALL_HEADERS-free trivial payload; content is irrelevant to framing.
+        var packet = new byte[Tds.HeaderSize + body.Length];
+        packet[0] = Tds.PacketSqlBatch;
+        packet[1] = endOfMessage ? Tds.StatusEndOfMessage : (byte)0;
+        packet[2] = (byte)((Tds.HeaderSize + body.Length) >> 8);
+        packet[3] = (byte)(Tds.HeaderSize + body.Length);
+        body.CopyTo(packet.AsSpan(Tds.HeaderSize));
+        return packet;
+    }
+
+    private static async Task<List<Frame>> RunAsync(CancellationToken cancellationToken, params byte[][] clientFrames)
+    {
+        using var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        using var clientSocket = new TcpClient();
+        var acceptTask = listener.AcceptTcpClientAsync(cancellationToken).AsTask();
+        await clientSocket.ConnectAsync(IPAddress.Loopback, ((IPEndPoint)listener.LocalEndpoint).Port, cancellationToken);
+        using var serverTcp = await acceptTask;
+        await using var serverStream = serverTcp.GetStream();
+        await using var clientStream = clientSocket.GetStream();
+
+        var host = new CannedHost();
+        using var mux = new SmpMultiplexer(serverStream, host);
+        host.Multiplexer = mux;
+        var muxTask = mux.RunAsync(cancellationToken);
+
+        foreach (var frame in clientFrames)
+        {
+            await clientStream.WriteAsync(frame, cancellationToken);
+            await clientStream.FlushAsync(cancellationToken);
+        }
+
+        var frames = new List<Frame>();
+        var header = new byte[Tds.SmpHeaderSize];
+        using var readCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        readCts.CancelAfter(TimeSpan.FromSeconds(5));
+        try
+        {
+            while (true)
+            {
+                await clientStream.ReadExactlyAsync(header, readCts.Token);
+                var length = BinaryPrimitives.ReadUInt32LittleEndian(header.AsSpan(4));
+                var payload = new byte[length - Tds.SmpHeaderSize];
+                if (payload.Length > 0)
+                    await clientStream.ReadExactlyAsync(payload, readCts.Token);
+                frames.Add(new Frame(
+                    header[1],
+                    BinaryPrimitives.ReadUInt16LittleEndian(header.AsSpan(2)),
+                    length,
+                    BinaryPrimitives.ReadUInt32LittleEndian(header.AsSpan(8)),
+                    BinaryPrimitives.ReadUInt32LittleEndian(header.AsSpan(12)),
+                    payload));
+
+                // Stop once every opened session has been FIN-ed by the server.
+                if ((header[1] & Fin) != 0)
+                    break;
+            }
+        }
+        catch (OperationCanceledException)
+        {
+        }
+        catch (EndOfStreamException)
+        {
+        }
+
+        return frames;
+    }
+
+    [TestMethod]
+    public async Task CompleteRequest_ServerEmitsNoSyn_DataThenFin()
+    {
+        var frames = await RunAsync(
+            TestContext.CancellationToken,
+            BuildFrame(Syn, sid: 1, seq: 0, window: 4),
+            BuildFrame(Data, sid: 1, seq: 1, window: 4, TdsBatchPacket(endOfMessage: true)));
+
+        var synCount = frames.Count(f => (f.Flags & Syn) != 0);
+        var ackCount = frames.Count(f => (f.Flags & Ack) != 0);
+        AreEqual(0, synCount, "Server must never emit a SYN frame (native SNI drops the connection on one).");
+        AreEqual(0, ackCount, "A complete request needs no standalone ACK — the DATA response piggybacks the window.");
+
+        var data = frames.Single(f => (f.Flags & Data) != 0);
+        AreEqual((ushort)1, data.Sid);
+        AreEqual(1u, data.Seq);
+        AreEqual(5u, data.Window); // received 1 + slack 4
+
+        var fin = frames.Single(f => (f.Flags & Fin) != 0);
+        AreEqual((ushort)1, fin.Sid);
+        AreEqual(1u, fin.Seq); // SEQNUM = last DATA sequence sent
+        AreEqual(5u, fin.Window);
+    }
+
+    [TestMethod]
+    public async Task MultiPacketRequest_MidMessagePacketGetsAck()
+    {
+        var frames = await RunAsync(
+            TestContext.CancellationToken,
+            BuildFrame(Syn, sid: 1, seq: 0, window: 4),
+            BuildFrame(Data, sid: 1, seq: 1, window: 4, TdsBatchPacket(endOfMessage: false)),
+            BuildFrame(Data, sid: 1, seq: 2, window: 5, TdsBatchPacket(endOfMessage: true)));
+
+        var synCount = frames.Count(f => (f.Flags & Syn) != 0);
+        AreEqual(0, synCount, "Server must never emit a SYN frame.");
+
+        // The mid-message (EOM-clear) first packet is ACKed to advance the send
+        // window; the completing second packet is not (its response piggybacks).
+        var ack = frames.Single(f => f.Flags == Ack);
+        AreEqual((ushort)1, ack.Sid);
+        AreEqual(5u, ack.Window); // received 1 + slack 4
+
+        var dataCount = frames.Count(f => (f.Flags & Data) != 0);
+        var finCount = frames.Count(f => (f.Flags & Fin) != 0);
+        IsGreaterThan(0, dataCount, "The completed request must produce a DATA response.");
+        IsGreaterThan(0, finCount, "The session must be FIN-ed on completion.");
+    }
+}