TEXTPTR fabricates a 16-byte signature+FNV-1a-64-column-hash pointer (varbinary(16), NULL for NULL cells, that TEXTVALID validates against its name's column segment with row identity deliberately unencoded since READTEXT/WRITETEXT/UPDATETEXT are still unmodeled, FULLTEXTCATALOGPROPERTY reads stored catalog metadata, CERTENCODED/CERTPRIVATEKEY return the no-such-certificate NULL (varbinary(max), and GET_FILESTREAM_TRANSACTION_CONTEXT returns the FILESTREAM-idle NULL.

Author: RyanLamansky

CLAUDE.md

@@ -225,7 +225,7 @@ Comparison (Msg 402), ORDER BY/DISTINCT (Msg 306), and aggregates (Msg 8117 from
 Per-feature deep-dives live under `docs/claude/`.
 Each entry below is a trigger: read the linked file on demand when working in the matching area.
 
-- **Built-in scalars** — math; date (DATETRUNC / DATE_BUCKET / SWITCHOFFSET / TODATETIMEOFFSET / `*FROMPARTS` / AT TIME ZONE / current-time); string (CONCAT / SOUNDEX / TRANSLATE / STRING_ESCAPE / DIFFERENCE); CHOOSE / IIF; bit (BIT_COUNT / GET_BIT / SET_BIT / shifts); CHECKSUM / BINARY_CHECKSUM; FORMAT / FORMATMESSAGE; RAND; STRING_SPLIT / GENERATE_SERIES; COMPRESS / DECOMPRESS; PWDENCRYPT / PWDCOMPARE / LOGINPROPERTY; sys.fn_varbintohexsubstring / sys.fn_varbintohexstr (varbinary→hex, sys-qualified system functions); `@@`-constants (incl. the system statistical counters + `sys.fn_virtualfilestats`) + HOST_NAME / APP_NAME / GETANSINULL / ORIGINAL_DB_NAME; session-state (SESSION_CONTEXT / sp_set_session_context / CONTEXT_INFO / CONNECTIONPROPERTY / SESSIONPROPERTY); SQL_VARIANT_PROPERTY → [`scalars.md`](docs/claude/scalars.md).
+- **Built-in scalars** — math; date (DATETRUNC / DATE_BUCKET / SWITCHOFFSET / TODATETIMEOFFSET / `*FROMPARTS` / AT TIME ZONE / current-time); string (CONCAT / SOUNDEX / TRANSLATE / STRING_ESCAPE / DIFFERENCE); CHOOSE / IIF; bit (BIT_COUNT / GET_BIT / SET_BIT / shifts); CHECKSUM / BINARY_CHECKSUM; FORMAT / FORMATMESSAGE; RAND; STRING_SPLIT / GENERATE_SERIES; COMPRESS / DECOMPRESS; PWDENCRYPT / PWDCOMPARE / LOGINPROPERTY; sys.fn_varbintohexsubstring / sys.fn_varbintohexstr (varbinary→hex, sys-qualified system functions); `@@`-constants (incl. the system statistical counters + `sys.fn_virtualfilestats`) + HOST_NAME / APP_NAME / GETANSINULL / ORIGINAL_DB_NAME; session-state (SESSION_CONTEXT / sp_set_session_context / CONTEXT_INFO / CONNECTIONPROPERTY / SESSIONPROPERTY); SQL_VARIANT_PROPERTY; legacy text-pointer (TEXTPTR / TEXTVALID — column-identity pointer, no READTEXT/WRITETEXT/UPDATETEXT consumer); NULL placeholders (CERTENCODED / CERTPRIVATEKEY / GET_FILESTREAM_TRANSACTION_CONTEXT) → [`scalars.md`](docs/claude/scalars.md).
 - **`SqlType.Promote` / `PromoteForArithmetic` / decimal precision-scale / int↔string promotion / string+binary literal value-width typing + width algebra (concat sum-cap, CASE/COALESCE/set-op max, per-function widths)** → [`arithmetic.md`](docs/claude/arithmetic.md).
 - **`Cast` / coercion error paths** (CAST/CONVERT narrow targets, TRY_CAST/TRY_CONVERT swallow set, PARSE/TRY_PARSE culture-aware parsing) → [`casting.md`](docs/claude/casting.md).
 - **`SimulatedDbDataReader` client surface** (typed accessors, `datetime` client-millisecond rounding, `GetOrdinal` precedence, GetBytes/GetChars materialization divergence) → [`data-reader.md`](docs/claude/data-reader.md).
@@ -262,7 +262,7 @@ Each entry below is a trigger: read the linked file on demand when working in th
 - **Application locks** (`sp_getapplock` / `sp_releaseapplock` / `APPLOCK_MODE` / `APPLOCK_TEST`, return-code-vs-raised-error asymmetry, EF 9/10 `Database.Migrate()`'s `__EFMigrationsLock`) → [`app-locks.md`](docs/claude/app-locks.md).
 - **`hierarchyid` type** (OrdPath storage, byte-identical CAST/wire/DATALENGTH, tier table + opaque passthrough) → [`hierarchyid.md`](docs/claude/hierarchyid.md).
 - **`GRANT` / `REVOKE` / `DENY`, principal DDL (incl. server logins: `CREATE/ALTER/DROP LOGIN`), fixed-principal seed, principal scalars** (`USER_NAME` / `SUSER_SNAME` / `DATABASE_PRINCIPAL_ID` / `CURRENT_USER` / `SESSION_USER` / `ORIGINAL_LOGIN` / `HAS_PERMS_BY_NAME` / `IS_MEMBER`) → [`permissions.md`](docs/claude/permissions.md).
-- **`CREATE FULLTEXT CATALOG`/`INDEX`, `CONTAINS`/`FREETEXT` rejection** → [`full-text.md`](docs/claude/full-text.md).
+- **`CREATE FULLTEXT CATALOG`/`INDEX`, `CONTAINS`/`FREETEXT` rejection, FULLTEXTCATALOGPROPERTY / FULLTEXTSERVICEPROPERTY** → [`full-text.md`](docs/claude/full-text.md).
 - **`xml` type, XML schema collections, XML methods (`.value()` / `.nodes()` / `.query()` / `.exist()` via an XQuery-subset evaluator; `.modify()` XML-DML skip-with-diagnostic), XML indexes** → [`xml.md`](docs/claude/xml.md).
 - **`geography` / `geometry` types, spatial methods, spatial indexes** → [`spatial.md`](docs/claude/spatial.md).
 - **`ALTER DATABASE SET <option>` accept-list + database-level `COLLATE` clause** → [`database-options.md`](docs/claude/database-options.md).

docs/claude/backlog.md

@@ -59,14 +59,10 @@ Blocked on a larger unmodeled parent feature (shipping a function here implies t
 
 Low priority / niche — simulatable (as placeholder constants or a small model) but rarely hit, so not worth attention yet:
 
-- **Legacy text/image** — TEXTPTR / TEXTVALID (the `text` / `ntext` / `image` types ship; these navigate the deprecated READTEXT / WRITETEXT / UPDATETEXT pointer path).
-- **Certificates** — CERTENCODED / CERTPRIVATEKEY (needs a small certificate-name → bytes model, or NULL placeholders).
-- **Full-text properties** — FULLTEXTCATALOGPROPERTY (the `CREATE FULLTEXT CATALOG` / `INDEX` DDL already ships; this reads its metadata).
 - **`sql_variant` minor quirk** (cross-type family ordering and one-side-variant comparison both shipped 2026-07-19 — see [`scalars.md`](scalars.md#sql_variant-expression-semantics)): a decimal-declared inner reports BaseType `numeric` rather than real's `decimal`.
   Probed 2026-07-19: real preserves the declared keyword *distinctly* — `decimal` and `numeric` never collapse — through literals, table columns, variant columns, and variant variables assigned from typed variables.
   The faithful fix splits the per-`(p, s)` `DecimalSqlType` singleton by declared keyword, forking the reference-identity space the row encoder, promote paths, and catalog surfaces key on — a medium refactor whose blast radius far exceeds the one metadata string it corrects, so it's deliberately deferred.
   Deliberate exclusion, don't re-pitch: `msdb.dbo.syspolicy_configuration.current_value` stays `nvarchar` — it's a *view-body* projection (not a resource column) mixing `int` rows with a `binary` GUID row, every consumer reads a single named row and CASTs it, so a variant migration there would only touch the view SQL text for no observable gain.
-- **FILESTREAM** — GET_FILESTREAM_TRANSACTION_CONTEXT (needs a FILESTREAM storage binding; NULL is a faithful "no FILESTREAM context" placeholder).
 
 ## Fidelity gaps in shipped behavior
 

docs/claude/full-text.md

@@ -81,7 +81,14 @@ The simulator reports Full-Text as installed (`SERVERPROPERTY('IsFullTextInstall
 The reference box returns `0` only because Full-Text isn't installed there — and while uninstalled it returns NULL for the resource-tuning properties too, so their installed values can't be probed.
 The simulator reports the installed value of `0` for each: `ConnectTimeout`, `LoadOSResources`, `ResourceUsage`, `VerifyResourceUsage`.
 An unrecognized property name returns NULL `int` (probe-confirmed convention); names are case-insensitive.
-`FULLTEXTCATALOGPROPERTY` is not modeled.
+
+## `FULLTEXTCATALOGPROPERTY('catalog_name', 'property')`
+
+`Parser/Expressions/FullTextCatalogProperty.cs`.
+Returns an `int` property of a full-text catalog resolved by name against `Database.FullTextCatalogs` (probe-confirmed return type; 2026-07-20).
+The simulator has no indexing engine, so the population / size / status properties report the idle-empty answers a freshly created catalog gives — `ItemCount`, `IndexSize`, `PopulateStatus`, `PopulateCompletionAge`, `MergeStatus`, `ImportStatus`, `UniqueKeyCount`, `LogSize` all `0`.
+`AccentSensitivity` reflects the catalog's DDL-captured `ACCENT_SENSITIVITY` option (`FullTextCatalog.IsAccentSensitive`, defaulting `1` / accent-sensitive) — the one property that varies with catalog state.
+An unknown catalog name or unrecognized property returns NULL; property names are case-insensitive.
 
 ## Known gaps
 

docs/claude/scalars.md

@@ -591,3 +591,33 @@ Probe-confirmed against SQL Server 2025 (2026-05-23).
 - **`SID_BINARY(name)`** is constant NULL — probe-confirmed against SQL Server 2025: it resolves only Windows / Entra-ID directory principals and returns NULL even for existing SQL-auth logins, so NULL is faithful for every input the simulator can host.
   The argument still parses and evaluates.
   Surfaced by SSMS's Select-Top-1000 server-properties batch (`suser_sname(sid_binary(@SqlGroup))`).
+
+## Legacy text-pointer scalars: `TEXTPTR` / `TEXTVALID`
+
+`Parser/Expressions/TextPointer.cs` (`LegacyTextPointer` helper + `TextPointer`), `Parser/Expressions/TextValid.cs`.
+Probe-confirmed against SQL Server 2025 (2026-07-20).
+
+- **`TEXTPTR(column)`** returns the 16-byte `varbinary` text pointer of a base-table `text` / `ntext` / `image` column, or NULL when the cell is NULL.
+  The argument must be a base-table column reference: a literal, CAST, or computed expression raises **Msg 280** (`Only base table columns are allowed in the TEXTPTR function.`), and a column of any other type (including `varchar(max)`) raises **Msg 8116** (`Argument data type <t> is invalid for argument 1 of textptr function.`).
+  Real varies the pointer per row; the simulator fabricates a shape carrying only column identity — an 8-byte signature plus an 8-byte FNV-1a-64 hash of the case-folded column name — since the only sanctioned consumers (`READTEXT` / `WRITETEXT` / `UPDATETEXT`) stay unmodeled.
+  Two non-NULL cells of one column therefore share a pointer (a divergence with no observable consumer).
+- **`TEXTVALID('table.column', text_ptr)`** returns `int` `1` when the pointer is valid for the named column, else `0`.
+  A NULL pointer / NULL name, a pointer that isn't a simulator-fabricated text pointer (e.g. arbitrary bytes), and a name whose final (column) segment doesn't match the pointer's source column all return `0`.
+  The name must have at least two dotted parts (`table.column`) — a bare single-part name returns `0`, matching real — but only its column segment is matched against the pointer's embedded column-identity hash; the table portion is not resolved against the catalog.
+  A syntactically valid name whose column segment matches the pointer's source column therefore returns `1` even if its table portion names a different table (real cross-checks the exact column object); this is unobservable through the sanctioned `TEXTVALID('t.c', TEXTPTR(c))` idiom, where the two column names always agree.
+
+## Placeholder security / FILESTREAM scalars: `CERTENCODED` / `CERTPRIVATEKEY` / `GET_FILESTREAM_TRANSACTION_CONTEXT`
+
+`Parser/Expressions/CertificateFunctions.cs` (`CertificateFunction`, `isPrivateKey` flag), `Parser/Expressions/GetFilestreamTransactionContext.cs`.
+The simulator models no certificate store or FILESTREAM storage, so each returns a NULL `varbinary(max)` — the faithful answer for the state the simulator is always in.
+Probe-confirmed against SQL Server 2025 (2026-07-20).
+
+- **`CERTENCODED(cert_id)`** → NULL (the answer real gives for a nonexistent certificate id).
+  Exactly one argument; any other count raises **Msg 174** (`The CertEncoded function requires 1 argument(s).` — PascalCase function name, unlike the lowercase-rendered `PI` / `ISNULL` form).
+- **`CERTPRIVATEKEY(cert_id, N'encryption_password' [, N'decryption_password'])`** → NULL.
+  Two or three arguments; any other count raises **Msg 189** (`The CertPrivateKey function requires 2 to 3 arguments.`, via `SimulatedSqlException.FunctionArgumentCountRange`).
+- **`GET_FILESTREAM_TRANSACTION_CONTEXT()`** → NULL, the faithful "no active FILESTREAM transaction" answer a FILESTREAM-enabled server gives outside such a transaction.
+  (A reference instance with FILESTREAM file-system access disabled at the instance level instead raises Msg 5592; the simulator returns the enabled-but-idle answer.)
+  Zero arguments; any argument raises **Msg 174** (`The get_filestream_transaction_context function requires 0 argument(s).` — lowercase function name).
+
+The untyped-NULL-literal argument diagnostic (real raises Msg 8116 for `CERTENCODED(NULL)` because an untyped `NULL` literal has no type) is not modeled — the simulator's untyped `NULL` literal carries `Type=Int32`, so it flows through as a valid int argument and returns NULL.

src/SqlServerSimulator/Errors/SimulatedSqlException.QueryErrors.cs

@@ -147,6 +147,15 @@ internal static SimulatedSqlException FetchMustBeGreaterThanZero() =>
     internal static SimulatedSqlException FunctionRequiresNArguments(string functionLowerName, int argumentCount) =>
         new($"The {functionLowerName} function requires {argumentCount} argument(s).", 174, 15, 1);
 
+    /// <summary>
+    /// Mimics SQL Server error 280 — <c>TEXTPTR</c> was applied to something
+    /// other than a base-table <c>text</c> / <c>ntext</c> / <c>image</c> column
+    /// (a literal, a CAST, or any computed expression). Probe-confirmed against
+    /// SQL Server 2025 (2026-07-20).
+    /// </summary>
+    internal static SimulatedSqlException OnlyBaseTableColumnsInTextPtr() =>
+        new("Only base table columns are allowed in the TEXTPTR function.", 280, 16, 1);
+
     /// <summary>
     /// Mimics SQL Server error 6607: the password-encryption machinery
     /// rejected an input — fired by <c>PWDENCRYPT</c> for a clear text over

src/SqlServerSimulator/Errors/SimulatedSqlException.SyntaxErrors.cs

@@ -150,6 +150,17 @@ internal static SimulatedSqlException MustBeFirstStatementInBatch(string stateme
     internal static SimulatedSqlException FunctionArgumentCount(string lowercaseFunctionName, int min) =>
         new($"The {lowercaseFunctionName} function requires {min} to 254 arguments.", 189, 15, 1);
 
+    /// <summary>
+    /// Mimics SQL Server error 189 with an explicit upper bound: a built-in
+    /// function received the wrong number of arguments where the accepted count
+    /// is a small range (e.g. <c>"The CertPrivateKey function requires 2 to 3
+    /// arguments."</c>). Probe-confirmed against SQL Server 2025 (2026-07-20) —
+    /// the function name is rendered with its documented PascalCase spelling,
+    /// unlike the lowercase-rendered <see cref="FunctionArgumentCount"/> family.
+    /// </summary>
+    internal static SimulatedSqlException FunctionArgumentCountRange(string functionName, int min, int max) =>
+        new($"The {functionName} function requires {min} to {max} arguments.", 189, 15, 1);
+
     /// <summary>
     /// Mimics SQL Server error 3902: a <c>COMMIT</c> was issued with no
     /// active transaction. Probe-confirmed against SQL Server 2025

src/SqlServerSimulator/Parser/Expression.cs

@@ -882,6 +882,7 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
                 "REVERSE" => new Reverse(context),
                 "SET_BIT" => new SetBit(context),
                 "SOUNDEX" => new Soundex(context),
+                "TEXTPTR" => new TextPointer(context),
                 "TYPE_ID" => new TypeId(context),
                 "UNICODE" => new UnicodeCodepoint(context),
                 "USER_ID" => new PrincipalIdLookup(context, PrincipalIdKind.UserId),
@@ -924,6 +925,7 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
                 "SCHEMA_ID" => new SchemaId(context),
                 "SUBSTRING" => new Substring(context),
                 "SUSER_SID" => new SUserSid(context),
+                "TEXTVALID" => new TextValid(context),
                 "TRANSLATE" => new Translate(context),
                 "TRY_PARSE" => new ParseFunction(context, tryMode: true),
                 "TYPE_NAME" => new TypeName(context),
@@ -958,6 +960,7 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
             },
             11 => uppercaseName switch
             {
+                "CERTENCODED" => new CertificateFunction(context, isPrivateKey: false),
                 "DATE_BUCKET" => new DateBucket(context),
                 "ERROR_STATE" => new ErrorStateFunction(context),
                 "FIRST_VALUE" => WindowExpression.ParseFirstValue(context),
@@ -1008,6 +1011,7 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
             },
             14 => uppercaseName switch
             {
+                "CERTPRIVATEKEY" => new CertificateFunction(context, isPrivateKey: true),
                 "COLUMNPROPERTY" => new ColumnProperty(context),
                 "ERROR_SEVERITY" => new ErrorSeverityFunction(context),
                 "FILEGROUP_NAME" => new FilegroupName(context),
@@ -1082,9 +1086,15 @@ private static Expression ResolveBuiltIn(string name, ParserContext context)
             23 => uppercaseName switch
             {
                 "DATETIMEOFFSETFROMPARTS" => new DatePartsBuilder(context, DatePartsBuilderKind.DateTimeOffsetFromParts),
+                "FULLTEXTCATALOGPROPERTY" => new FullTextCatalogProperty(context),
                 "FULLTEXTSERVICEPROPERTY" => new FullTextServiceProperty(context),
                 _ => null
             },
+            34 => uppercaseName switch
+            {
+                "GET_FILESTREAM_TRANSACTION_CONTEXT" => new GetFilestreamTransactionContext(context),
+                _ => null
+            },
             _ => (Expression?)null
         } ?? throw SimulatedSqlException.UnrecognizedBuiltInFunction(name);
     }

src/SqlServerSimulator/Parser/Expressions/CertificateFunctions.cs

@@ -0,0 +1,62 @@
+using SqlServerSimulator.Storage;
+
+namespace SqlServerSimulator.Parser.Expressions;
+
+/// <summary>
+/// SQL <c>CERTENCODED(cert_id)</c> and
+/// <c>CERTPRIVATEKEY(cert_id, N'encryption_password' [, N'decryption_password'])</c>:
+/// return the public certificate / private key bytes as <c>varbinary(max)</c>.
+/// The simulator models no certificate store, so both return NULL — the exact
+/// answer real SQL Server gives for a certificate id that doesn't exist
+/// (probe-confirmed against SQL Server 2025). Argument-count violations raise
+/// the same Msg 174 (<c>CERTENCODED</c>) / Msg 189 (<c>CERTPRIVATEKEY</c>) real
+/// does. References:
+/// https://learn.microsoft.com/en-us/sql/t-sql/functions/certencoded-transact-sql,
+/// https://learn.microsoft.com/en-us/sql/t-sql/functions/certprivatekey-transact-sql
+/// </summary>
+internal sealed class CertificateFunction : Expression
+{
+    private readonly Expression certId;
+    private readonly Expression? password;
+    private readonly Expression? decryptionPassword;
+
+    public CertificateFunction(ParserContext context, bool isPrivateKey)
+    {
+        if (isPrivateKey)
+        {
+            if (context.Token is Tokens.Operator { Character: ')' })
+                throw SimulatedSqlException.FunctionArgumentCountRange("CertPrivateKey", 2, 3);
+            this.certId = Parse(context);
+            if (context.Token is not Tokens.Operator { Character: ',' })
+                throw SimulatedSqlException.FunctionArgumentCountRange("CertPrivateKey", 2, 3);
+            this.password = Parse(context.MoveNextRequiredReturnSelf());
+            if (context.Token is Tokens.Operator { Character: ',' })
+                this.decryptionPassword = Parse(context.MoveNextRequiredReturnSelf());
+            if (context.Token is not Tokens.Operator { Character: ')' })
+                throw SimulatedSqlException.FunctionArgumentCountRange("CertPrivateKey", 2, 3);
+        }
+        else
+        {
+            if (context.Token is Tokens.Operator { Character: ')' })
+                throw SimulatedSqlException.FunctionRequiresNArguments("CertEncoded", 1);
+            this.certId = Parse(context);
+            if (context.Token is not Tokens.Operator { Character: ')' })
+                throw SimulatedSqlException.FunctionRequiresNArguments("CertEncoded", 1);
+        }
+    }
+
+    public override SqlValue Run(RuntimeContext runtime) => SqlValue.Null(SqlType.VarbinaryMax);
+
+    public override SqlType GetSqlType(BatchContext batch, Func<MultiPartName, SqlType> resolveColumnType) => SqlType.VarbinaryMax;
+
+    internal override string DebugDisplay() => this.password is null
+        ? $"CERTENCODED({this.certId.DebugDisplay()})"
+        : $"CERTPRIVATEKEY({this.certId.DebugDisplay()}, …)";
+
+    internal override void VisitColumnReferences(Action<MultiPartName> visit)
+    {
+        this.certId.VisitColumnReferences(visit);
+        this.password?.VisitColumnReferences(visit);
+        this.decryptionPassword?.VisitColumnReferences(visit);
+    }
+}