[jtomaszewski]

Problem

treeman gives every Conductor worktree its own Postgres database plus a clone per test worker. A project whose source of truth is SQL Server got nothing — one shared container on a fixed name and port, hardcoded row ids, and a test tier that two worktrees (or two jest workers) cannot run at the same time.

This adds mssql as a full engine family: per-worktree databases, cached snapshot templates, per-test-worker clones, pre-warmed spares, prefix reclaim, branch_scoped, doctor/MCP coverage.

connections:
  mssql:
    host: 127.0.0.1
    port: 14333
    user: sa
    password: $MSSQL_SA_PASSWORD
    collation: Polish_CI_AS
databases:
  - engine: mssql              # or `sqlserver`
    name_template: tm_app_{slug}
    migrate: { run: ./migrate.sh, env: { DB_DATABASE: "{target_db}" } }
    test_clones: { clones: 8, name_template: tm_app_{slug}_w{n} }

How a clone works, and why it isn't a TEMPLATE

SQL Server has no CREATE DATABASE … TEMPLATE, and the two things that look like one are not: DBCC CLONEDATABASE copies schema and statistics without rows, and a database snapshot is read-only. The only database copy a client can drive is BACKUP + RESTORE.

So a template here is a pair — the template database (which is what treeman's DatabaseExists cache-hit probe asks about, identically for every engine) plus one .bak file beside it that every clone restores from. Captured once, hydrated N times.

Everything goes over TDS, the file paths included: TO DISK, FROM DISK and MOVE … TO all accept variables, so paths are bound as parameters and only database names are interpolated — through the same strict [A-Za-z0-9_] validator the other engines use (ident.QuoteMSSQL, bracket-quoted so QUOTED_IDENTIFIER can't matter).

Three engine differences worth a reviewer's attention

• Restored files carry a random token, not the database's name. The spare claim is ALTER DATABASE … MODIFY NAME, which moves the database but not its files — so a claimed spare keeps files named for the spare, and naming files after the database would collide on the next restore of that freed name. TestClaimSpareRename covers exactly that sequence.
• Drops take the database single-user first. There is no pg_terminate_backend, and DROP DATABASE fails outright while anybody is connected — which a jest worker's idle pool routinely is. TestDropMatchingEvictsConnections holds a live connection open across the drop.
• dump: is rejected, with the reason in the message. RESTORE reads a path on the server, which for a containerised server is a different filesystem; a host path would silently restore whatever happens to sit there, or nothing. Seed from seed: instead — it is a command, so it can copy the file to the server. db_dump refuses for the same reason (sqlcmd is not a pg_dump equivalent).

WriteWatermark declines (returns "") rather than guessing. The caller skips a capture when the token is unchanged, and SQL Server's per-database write counters are per index — writes to a heap move nothing, and the rows vanish on restart — so a token that can miss a write is worse than none.

Beyond the registry

docs/internals.md promised "≤4 touchpoints". The registry does cover prepare, teardown, GC and recovery, but four places switch on the concrete adapter type instead, and each fails silently: prepareFamily, connectBranchEngine (branch_scoped quietly no-ops), branchreap's untrackedMarker + listDurableCandidates (durables leak forever), and resolve's credential copy-back (a password: $NAME ref resolves to empty). That section now names all four. snapshot.SpareCounts was also hardcoded to Postgres — stale since MySQL became prewarm-capable — so it now walks every prewarm-capable family.

Verification

• go test ./... — 1252 pass. golangci-lint run ./... — clean (two pre-existing findings in internal/daemon/socket_unix_other.go remain, confirmed present before this branch). golangci-lint fmt --diff clean. Schemas and generated docs regenerated.
• go test -tags e2e ./e2e/mssql/ — 12 pass, against SQL Server 2022 (the suite's image) and 2025 (by hand). The prepare cycle end to end — cold build → cache hit → input edit → rebuild → fan-out → teardown keeping the cache — plus the driver's own behaviour: eight concurrent restores of one template, the configured collation reaching the databases treeman creates (and SIMPLE recovery reaching the restored ones), LIKE-escaping against the sibling-wipe, the rename race having exactly one winner and leaving the loser usable, a drop with a live connection open, and a restore after the backup file was deleted behind the template's back.
• Registered in BATCHES[engines], so just test-e2e engines runs it. Note SQL Server ships no arm64 image: on an Apple Silicon host the suite runs under emulation (it does pass there — that is where these numbers come from), and the compose file caps the server at 2 GB because its default is "all of it".

Fork bookkeeping

This is the first patch that edits upstream's own files rather than only adding ours — an engine family has to touch the engine registry, the config schema, prepare, resolve and the docs. FORK.md carries the P4 row (why, upstream intent, drop-when) and fsh-vet.yml's allowlist carries the blast radius; the allowlist was checked against the actual diff and covers it exactly.

One dependency added, github.com/microsoft/go-mssqldb v1.11.2: no OSV advisory of its own, and it drags golang.org/x/crypto from 0.33.0 to 0.55.0, clearing 34 of the 37 advisories that single stale indirect contributes to the baseline. The three left on 0.55.0 are all already baselined, so the deps check stays green with no re-baseline. Its Azure, Key Vault and Kerberos modules are in its go.mod but not in ours — they belong to packages we do not import, and module-graph pruning keeps them out of go.sum.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​microsoft/​go-mssqldb@​v1.11.2
	golang/​golang.org/​x/​sys@​v0.46.0 ⏵ v0.47.0
	golang/​golang.org/​x/​sync@​v0.21.0 ⏵ v0.22.0	+1

View full report