macSQL

Build 78 administration: Engine 0.78.0

Administration is SQL.

CREATE LOGIN, ALTER ROLE … ADD MEMBER, and GRANT/DENY/REVOKE execute over the same encrypted TDS connection every client uses, gated on the authenticated login's own role — the SQL Server model, from SSMS's query window or any driver, with no loopback tool and no token. An adopted KrakenSQL login's password now verifies and upgrades itself on first sign-in.

Build 78 is a source candidate. It has not been through release qualification and is installed nowhere.

Build 77 authorization: Engine 0.77.0

DENY means no.

A denied permission is refused no matter which road reaches it. The engine used to consult a principal's role before its DENYs, so any permission the role allowed could not be denied — and making DENY reachable exposed five routes around it: MERGE, derived tables, subqueries in expression positions, and INSERT … SELECT. All five are closed, and the authorization walkers are now exhaustive: a new statement shape fails to compile until someone decides what it may reach.

Build 77 passed source qualification and was installed on the live server on 2026-08-18; its production-form gate has not been rerun there.

Build 76 app-free engine: Engine 0.76.0

The engine ships as a service, not as an application.

Until now the server was delivered inside a Mac application bundle: the installer staged /Applications/macSQL.app with the engine inside it and copied the engine back out to the service directory. The graphical client is now its own product, macSQL Studio, so the package carries the engine directly and installs nothing into /Applications.

Build 76 was installed on the live server on 2026-08-17 together with the KrakenSQL data-root adoption; its production-form gate has not been rerun there.

Build 74 client reachability: GUI 1.0 build 74 · Engine 0.1.74

An application can call the procedure it wrote.

Build 73 made a procedure something you could write down and run. Build 74 makes it something your application can call. Every client library invokes a procedure by RPC — CommandType.StoredProcedure, CallableStatement, {CALL p(?)}, request.execute() — and that path now works, with OUTPUT parameters and return codes travelling back to the caller. Parameters are bound rather than pasted into the statement text, so a value can never become part of a query's syntax.

Build 74 is a source candidate. It has not been through release qualification and is installed nowhere; the installed release below remains Build 73.

Build 73 stored procedures: GUI 1.0 build 73 · Engine 0.1.73

A procedure can be written down, and it runs.

CREATE PROCEDURE was an explicit parser rejection until this build, which is the first reason an application written for SQL Server does not start on macSQL. It parses now in all three forms — CREATE, ALTER, CREATE OR ALTER — and EXEC runs what they stored. A body is captured verbatim and validated when the procedure is created, so a body that cannot parse is refused then rather than at some later call; the object names inside it resolve when it runs, as SQL Server defers them, because a deployment script may legally create a procedure before the table it reads.

• Arguments bind positionally, by name, or from their declared defaults, each converted to the parameter's declared type.
• OUTPUT parameters and a return code travel back to the caller; EXEC @rc = p works.
• WHILE, BREAK, CONTINUE and RETURN are real statements, in a procedure body or an ordinary batch.
• One statement can return more than one result set, verified over TDS against both Microsoft's ODBC driver and an independent TDS implementation.
• A procedure body runs in a scope of its own, and nesting is bounded at 32 levels rather than exhausting the stack.
• Roughly twenty correctness defects fixed alongside it, found by probing a running engine, then by an adversarial review of the finished work, then by writing one ordinary procedure and calling it.

Build 72 namespace integrity: GUI 1.0 build 72 · Engine 0.1.72

An object cannot be destroyed by creating another one.

Build 72 is a corrective release, installed on 2026-08-13. CREATE TABLE over the name of an existing view destroyed that view with no error: a view's catalog entry has no columns, which is the same shape as a zero-column table shell left by an older build, so the create fell through a repair branch meant for those shells and overwrote the definition. View DDL was also invisible to permission enforcement, so a principal holding only read access could create and drop views. Both are refused now, at the executor and again at the catalog boundary. Build 71's package was cut before those fixes were committed, which is why this build exists.

• CREATE TABLE and DROP TABLE refuse any object that is not a table, and name the statement to use instead.
• View DDL requires the same permission table DDL requires.
• A stored-procedure catalog: sys.procedures, sys.parameters, sys.sql_modules, and the first INFORMATION_SCHEMA.ROUTINES and INFORMATION_SCHEMA.PARAMETERS in this engine. No syntax creates a procedure yet; the phase is a verified no-op for existing databases.
• The package build can embed the engine again — it could not, after the desktop app became a pure client — and the packaging scripts are covered by a release gate for the first time.

Build 71 Management Studio catalog: GUI 1.0 build 71 · Engine 0.1.71

SQL Server Management Studio browses macSQL.

Build 71 makes Object Explorer work. SSMS drives its tree with enumeration queries that join three to six catalog views at a time and filter on OBJECTPROPERTY; macSQL answered none of them, because the sys.* catalog lived in the wire layer behind a dispatcher that refused joins, grouping, CTEs, and set operations outright. The catalog now resolves inside the executor as ordinary query sources, so those enumerations are just SELECTs — they join, group, aggregate, sort, and compose like any other statement. Object identity is single-valued across every view and metadata scalar, so OBJECT_ID(...) returns the id sys.tables reports and the two can be joined; previously a second, incompatible id implementation meant every tool join silently returned nothing. All 22 Object Explorer query shapes answer over encrypted TDS. Build 71 was the installed release until Build 72 replaced it on 2026-08-13.

• The sys.* and INFORMATION_SCHEMA.* catalog resolves in the executor, ahead of user tables, as ordinary materialized sources.
• Multi-view Object Explorer joins execute unmodified: tables, columns with their types, indexes, keys, foreign keys with both endpoints, check and default constraints, identity columns, and view scripting.
• One canonical object identity shared by every catalog view and metadata scalar; the server's second, incompatible OBJECT_ID/DB_ID hash is gone.
• OBJECT_ID, OBJECT_NAME, OBJECT_SCHEMA_NAME, SCHEMA_NAME, SCHEMA_ID, DB_ID, OBJECTPROPERTY, COLUMNPROPERTY, COL_NAME, COL_LENGTH, and TYPE_NAME answer from the live catalog on every statement route, including DECLARE/SET, IF conditions, and EXEC'd batches.
• Column metadata reports what was declared: fractional-second precision for DATETIME2(p) and DATETIMEOFFSET(p), real capacities for large-object types, and correct numeric-versus-temporal-versus-character classification in INFORMATION_SCHEMA.COLUMNS.
• Catalog queries aggregate and group: COUNT(*), GROUP BY, and HAVING over the views were previously refused outright.
• An adversarial review of the tranche confirmed 14 defects and refuted 14; every confirmed defect is fixed in the same commit.

Build 70 engine-rival tranche: GUI 1.0 build 70 · Engine 0.1.70

Concurrent writers, bounded memory, and thirteen real clients over encrypted TDS.

Build 70 is the engine-rival tranche. The engine switches to table-granularity strict two-phase locking with concurrent writers, FIFO admission, deadlock detection, and cooperative mid-query KILL. Page format v3 stamps a persisted page-kind byte that drives load-time structural validation, with seal-forward migration for existing databases. Every single-table statement shape — plain, ordered, aggregate/GROUP BY/HAVING, DISTINCT, and the UPDATE/DELETE scans — now runs in bounded memory through streaming scans and an external merge sort that spills to unlinked temp files. ORDER BY, set-operator, and HAVING binding follow T-SQL rules (aliases, ordinals, combined-result ordering, aggregate scope). The native wire types and seven MS-TDS/MC-SMP protocol corrections passed the strict no-skip encrypted thirteen-client matrix — 13 passed, 0 skipped, 0 failed — including 120 KB MAX-type round-trips over encrypted MARS. Build 70 was signed, notarized, and stapled, and is the installed, protected, published developer preview.

• Concurrent writers under table-granularity strict 2PL with FIFO fence-edge deadlock detection and 1222/1205 telemetry.
• Cooperative cancellation reaches scans, DML loops, joins, sorts, and lock waits: KILL interrupts a running statement.
• Page format v3: a persisted page-kind byte validates every loaded page structurally, with pool-batched seal-forward migration and restore compatibility for pre-v3 backups.
• Per-query memory accounting across every operator with a shared statement accumulator and fail-closed budget errors.
• Streaming scans and external merge sort: ordered, aggregated, DISTINCT, and DML single-table statements over tables far larger than the budget succeed in bounded memory.
• Incremental aggregate accumulators reproduce exact DECIMAL SUM semantics with the 38-digit cap through spilled group sorts.
• UPDATE and DELETE stream a bounded row-location snapshot instead of materializing tables, preserving Halloween safety.
• ORDER BY binds select-list aliases, ordinals, and expressions like T-SQL, with compile-style unknown-column errors and the DISTINCT select-list rule.
• Trailing set-operator ORDER BY/OFFSET/FETCH order the combined result; SELECT 1 UNION SELECT 2 shapes and CTE visibility across branches are correct.
• HAVING evaluates in aggregate scope — HAVING COUNT(*) > 1 works, HAVING without GROUP BY aggregates the whole table, and ungrouped columns fail like SQL Server error 8120.
• MARS transactions are connection-scoped: a transaction begun through the TDS transaction manager is visible to every multiplexed command, exactly like SQL Server.
• MC-SMP flow control follows the spec: stable ACK sequence numbers, correct window advertisements, one TDS packet per SMP frame, and an inline ACK pump for large transfers in both directions.
• ENVCHANGE tokens use spec B_VARCHAR encoding and acknowledge the negotiated packet size; RETURNVALUE tokens carry nullable type info as MS-TDS requires.
• RPC responses keep their statement DONEINPROC with affected-row counts — Node mssql recordsets and SqlClient ExecuteNonQuery counts are exact.
• SET accepts T-SQL comma-separated option lists and semicolon-free driver connection batches, with driver-default invariants admitted at their fixed values.
• CRC-32C page and WAL checksums use slice-by-8 tables, bit-identical to the reference implementation.
• The strict no-skip encrypted thirteen-client matrix passed 13/0/0 against a source-built Build 70 server with TLS-required hostname verification.
• Select the greatest valid retained-WAL catalog snapshot regardless of staged/main/backup filename order, and reject divergent equal-LSN candidates.
• Persist ALTER TABLE dbo.Students ALTER COLUMN FamilyId BIGINT NULL across repeated managed restarts.
• Reconcile positive and negative identity sequences from durable rows before allocation, including rollback and overflow boundaries.
• Prove the Student and Audit row, nullable metadata, page chains, and identity state survive the same forced process crash.
• Honor qualified, mixed-case, parameterized virtual-catalog predicates and reject unsupported query shapes instead of returning every row.
• Canonical _macsql reinstall is zero-write; only the tightly proven macOS RealName normalization is reconciled, and a root-owned marker binds UID/GID plus both GeneratedUID values.
• Listener-free preflight inventories every database before mutation and emits a mode-0600 closed-world digest outside Data.
• Every database is migrated and verified in an APFS copy-on-write sibling stage before atomic staged/live publication.
• A failed preflight exits with its original status before cloning; a failed migration can never verify, swap, bootstrap, or commit.
• Machine-readable summaries must report the exact mode, root, digests, database inventory, per-database success states, and WAL transition before installation advances.
• Rollback swaps the old WAL-v2 Data tree back before restoring the old runtime and app; an old engine is never launched over WAL-v3 Data.
• Catalog-changing transactions recover in first-catalog-LSN order, so an older aborted or incomplete transaction cannot erase a later committed outcome.
• WAL format 3 requires typed PageAlloc provenance; bounded legacy upgrades reject unexplained gaps before mutation.
• Startup selects only a catalog at a proved WAL boundary and verifies every durable page and checksum before repair, replay, or publication.
• Failed checksum publication leaves dirty frames retryable and cannot advance live metadata ahead of disk.
• TDS makes QUOTED_IDENTIFIER ON/OFF stateful within/across batches, bounds TEXTSIZE for MAX/text/blob payloads without changing bounded columns, advertises LOGINACK 17.0.0.0, and passes real sqlcmd plus PDO post-error source regressions.
• The installer migrates only canonical legacy Backups, WALArchive, and RestoreStages roots to _macsql, with strict symlink and boundary rejection.
• Installed identity verification recognizes dsAttrTypeNative:IsHidden, and server-security verification defines the canonical macSQL log root.
• The protected-account cutoff query preserves bound parameter typing and consistent numeric-text comparison at the configured failed-login threshold.
• The installer runs the daemon as a hidden, authentication-disabled _macsql identity with explicit root/service ownership boundaries.
• The identity parser admits only managed attributes, ignores unrelated native multiline payloads, and normalizes macOS's native IsHidden alias.
• The exact Build 62 server record is a regression fixture, while malformed managed lines still fail closed before mutation.
• Directory Services user/group state is completely classified before mutation; a query error is distinct from a genuinely missing record.
• Only recognized macSQL partial records are completed. Foreign, malformed, and UID/GID-colliding identities are rejected unchanged.
• Behavioral failure-injection and retry tests interrupt every provisioning step and prove safe deterministic convergence.
• The previous job, PID, TDS listener, and wire listener are fully quiesced before live data ownership changes, eliminating the Build 60 upgrade race.
• A root-only, secret-safe installer transcript and bundled redacting diagnostic make PackageKit failures attributable.
• The finished PKG proves that its staged preinstall and postinstall scripts match the corrected source.
• Protected-release publication follows package install, installed-server gate, publication, GUI update, then protected-web gate and verifies the receipt, installed identities, dedicated process, and authenticated runtime before a rollback-safe staged site/feed swap.
• The production contract requires exactly thirteen encrypted real-client paths and detached X.509-signed evidence bound to the complete release and gate results.
• Unsupported audited session, procedural, savepoint, constraint, storage-option, and compatibility-procedure paths fail explicitly instead of returning fabricated success.
• SET NOCOUNT is stateful and @@TRANCOUNT reflects the real connection transaction for driver cleanup.
• DATEDIFF, DATEDIFF_BIG, DATEADD, and recursive ON DELETE CASCADE execute through direct regression tests.
• A versioned AES-256-GCM envelope and rotating keyring foundation is present; required mode intentionally refuses startup until page, WAL, catalog, and backup encryption is live.
• Independent read-only autocommit transactions hold shared database admission and can execute concurrently.
• Writers and explicit transactions hold exclusive admission until durable commit plus page/catalog persistence, or complete rollback and index restoration.
• FIFO writer admission prevents starvation and keeps queued online-backup maintenance ahead of later writes.
• Bounded waits report SQL Server error 1222; unsupported shared-to-exclusive upgrades are deterministic 1205 victims and release their waiter state.
• READ COMMITTED, REPEATABLE READ, and SERIALIZABLE requests parse explicitly; unsupported isolation and session timeout requests fail closed.
• .admin.status exposes the lock model, active/waiting readers and writers, peak readers, timeout policy, and timeout/victim counters.
• The packaged installed-server gate is implemented to require shared-reader overlap, writer timeout error 1222, disconnect rollback, and an exact concurrent 64-update result.
• Declared DATETIME2(p) columns advertise TDS DATETIME2 with their scale instead of falling back to NVARCHAR.
• Microsoft.Data.SqlClient exposes temporal rows as System.DateTime, and the PHMA reader can use GetDateTime().
• The encrypted real-client gate executes multiple ordered PHMA ledger rows with family filtering, every typed getter, prepared-statement reuse, overlapping MARS readers, pooled close/reopen, and NULL-only and empty result metadata.
• Malformed temporal RPC scales, lengths, dates, times, and offsets fail closed, while GETUTCDATE() is evaluated in UTC.
• Exact DATETIME2(7) values are preserved across daemon restart and logical backup/restore.
• Logical backup metadata uses canonical, parser-round-trippable SQL type names for NUMERIC, temporal precision, and MAX text/binary declarations instead of Rust debug formatting.
• The release gate verifies one macOS 14+ ARM64 contract across application and engine Mach-O binaries, the installer package, protected feed, and Sparkle appcast.
• The update client blocks incompatible systems, never offers a server package to remote-client-only Macs, and sends account credentials only to the exact HTTPS macSQL gateway.
• SUM(DECIMAL - DECIMAL) retains exact DECIMAL(38,2) TDS metadata for populated and zero-balance PHMA families.
• The real Microsoft.Data.SqlClient gate executes the live-shaped correlated family query with bound search parameters and strict typed getters.
• Every RPC, including sp_unprepare, returns RETURNSTATUS before final DONEPROC.
• Native PDO_SQLSRV qualification destroys prepared statements and immediately reuses the same physical connection.
• The protected-account gate runs the real throttle, lookup, password verification, BIT audit, and reset sequence in an isolated database.
• The website explicitly uses PDO::SQLSRV_ATTR_DIRECT_QUERY for its intended direct execution path.
• Procedural SQLSRV can drain a bound SELECT ?, dispose it, and execute the next statement on the same connection.
• Failed RPCs preserve their error completion, and SQL command identifiers use the SQL Server SELECT/INSERT/DELETE/UPDATE/EXECUTE values.
• BIT columns retain Boolean metadata and values through scans, expressions, grouping, CTEs, set operations, MARS, and parameterized writes.
• TINYINT, SMALLINT, INT, and BIGINT advertise and encode their exact SQL Server widths with range-safe conversion.
• NVARCHAR(MAX) and VARBINARY(MAX) retain MAX metadata for empty, NULL, short, and large values instead of changing type shape with each row.
• Correlated scalar subqueries retain outer-row context inside COALESCE and other scalar wrappers, including indexed parent lookups.
• COUNT() is exposed as SQL INT, and SUM(DECIMAL) remains exact TDS DECIMALN for GetDecimal().
• Microsoft.Data.SqlClient qualification checks field types, provider type names, typed getters, bound BIT writes, MARS, pooling, NULL/empty results, and large JSON payloads.
• Backup health reports snapshot and archive continuity, verification state, recoverable boundaries, and operator-actionable failures.
• Retention supports a deterministic preview before an authenticated apply, and never deletes outside the managed backup set.
• The packaged installed PITR drill is implemented to record full, LSN, and time restore timings while verifying types, Unicode, constraints, indexes, identities, and large values.
• A retained cross-process database lock prevents two engines from writing the same files and is released by the operating system after a crash.
• A checksummed manifest binds a database UUID and timeline to explicit page, WAL, catalog, checkpoint, archive, reserved encryption, and fencing formats.
• Unknown versions, corrupt checksums, mixed identities, archive discontinuities, and invalid catalog/page metadata fail closed.
• Durable checkpoints order WAL, data, catalog, page-checksum, manifest, file-sync, atomic-rename, and parent-directory-sync barriers.
• Online backup uses a bounded maintenance gate, lets active transactions finish, checkpoints, archives WAL, and atomically publishes a verified snapshot.
• Immutable WAL segments are database/timeline bound, gap and overlap checked, and linked through SHA-256 sidecars.
• Backup list, verification, retention, full restore, and point-in-time restore are exposed through authenticated administration commands.
• Restore always targets a new database, validates it in a private stage, rebuilds indexes, and publishes atomically or quarantines the failure.
• PITR selects an exact LSN or RFC-3339 time boundary from a verified snapshot and contiguous archive chain.
• Build 64 installed and passed its engine, real-client, account-throttle, strict-2PL, recovery, RBAC, and integrity checks, but two verifier-boundary gates failed and it was not published.
• Build 67 is rejected for write durability; Build 69 is the current installed, protected, published, and live-qualified developer preview.
• The app observes the complete connection lifecycle and discards failed or cancelled sockets.
• Every recovered session is a normal, fully read/write session; there is no read-only fallback.
• TCP keepalive and an authenticated non-SQL heartbeat keep idle GUI sessions warm without query-audit writes.
• An idle mutation preflight verifies or replaces the connection before sending SQL.
• Only explicitly classified read-only metadata may be replayed once; arbitrary SQL and DDL are never replayed after transmission.
• A lost response is reported as an unknown outcome so the user can verify state without risking a duplicate write.
• Queued cancellation and the transmission boundary prevent a cancelled write from running later.
• Every request carries the selected database explicitly, including after transport replacement.
• Schema refresh is atomic and preserves the last known-good explorer tree and stable object identities on failure.
• Ambiguous create, drop, and mixed-DDL outcomes trigger safe metadata reconciliation without replaying the mutation.
• The authenticated wire idle timeout defaults to 30 minutes, survives upgrades, and is reported by .admin.status.
• Credentialed real-TCP tests cover heartbeat, invalid-auth closure, DDL, metadata, health, and reconnect database context.
• Only active, approved website accounts can download releases.
• Browser downloads use revocable hashed sessions.
• The Mac app uses the same account from Keychain over HTTPS.
• An offline-root/internal CA issues a separate TDS server leaf.
• The engine verifies the certificate chain, DNS or IP SAN, server-auth EKU, validity window, and matching private key.
• Production-required TLS fails closed instead of silently generating or accepting an untrusted identity.
• Versioned certificate activation restarts and verifies the daemon, then rolls back automatically on failure.
• The production gate requires hostname-verified encryption across thirteen real-client paths with no skips.
• Dated, cryptographically signed evidence binds the release artifacts, installed app and engine, certificate, CA, client matrix, protected updates, recovery, reboot, and rollback results.
• Licensed accounts renew a server-bound write lease with up to 30 days of offline use.
• An expired lease preserves read and export access instead of shutting down the database.
• Failed statements, rollbacks, and disconnected transactions undo page and catalog changes.
• Heap mutations and page links follow WAL-before-data ordering.
• Middle-WAL corruption fails closed while torn final records are repaired.
• NOT NULL, primary/composite keys, UNIQUE, and unique indexes are enforced.
• TDS batches, parameter RPCs, prepared statements, MARS, and pooled resets retain their authenticated identity and LOGIN7 database.
• RESETCONNECTION and sp_reset_connection can no longer switch application queries into Abyss.
• Server, database, and object GRANT/DENY rules apply across every qualified path.
• Password hashes use versioned PBKDF2 with automatic legacy upgrade.
• Management is loopback-first with an independent trusted-LAN installer choice.
• SQL Server 2025 product identity: version 17 and compatibility level 170.
• GUI and engine identities are displayed separately.
• The finished PKG is extracted and its engine signature is verified before publication.
• The installer rejects a damaged engine before replacing a working daemon.
• Build 51's managed-CA, TLS-required TDS protections remain in place.
• Engine runtime source target is 0.1.73.