Source candidate for REQ-SQLC-006 / AC-SQLC-006, REQ-REL-001/003 and AC-TSQL-003/006 under ADR-055, ADR-130 and ADR-132. Native source admission is distinct from compilation, whole-operation execution, Linux RF3, durability and resource qualification; all those gates remain open before actual joined evidence.
TSQL.InsertValues.v1 lowers one unqualified persisted typed table, unique explicit one-part columns and bounded VALUES rows to one existing Batch. Supported scalar inputs are native strings, null, finite exact native numeric values, parenthesized numeric unary signs and scalar parameters. Public SQL uses named variables; the native connection uses only its verified positional slots. Persisted Text primary keys supply canonical entity identifiers. Existing Text, Boolean, WholeNumber, FixedPoint and UtcTimestamp row rules remain authoritative; omitted columns are accepted only when nullable. No schema, primary key or trusted roles come from the caller.
The original nonempty SqlOperationRequest.CommandId and unchanged one-shot native session bridge identify the mutation. The existing connection grain and separately signed operation execution are unchanged. No operation tool or dispatcher is added. The generated internal InsertTypedRow mutation has stable Orleans alias keyload.contract.insert-typed-row.v1 and Id0 collection/Id1 JSON, and the insertTypedRow JSON discriminator in the existing Batch contract. Existing normalization, canonical fingerprints and native transport codecs cover the complete mutation. Its native generated payload is not a public serializer fallback.
Within the original node-local transaction, current persisted DocsWrite, default/current row access, declared field writes and index-field use are checked, then authoritative schema and primary key are resolved. Existing resource policy CAS keeps nonpolicy schema and primary key immutable. Ordinary row insertion requires no cluster-administrator role. Any prior canonical row, including a tombstone or a row staged earlier in this same VALUES operation, refuses with Conflict. An absent row expands to the existing ExpectedRevision0 PutDocument, retaining its complete schema/index/outbox validation. A later duplicate, invalid scalar, missing required column or unique-index conflict rolls back every staged row. The original requested collection advances the existing document epoch; emitted outbox effects are canonical PutDocument.
Fresh typed permissions apply before outcome selection. Successful cached replay additionally checks current row/default access, fields and indexes, without absence/CAS re-execution. The same original request returns the complete saved success or failure; changed content conflicts; revoked permissions and advanced epochs fence old outcomes. A first failed operation may retain its existing failed outcome/clock. Subsequent replay must preserve that complete original outcome, full raw image and cut. No absence pre-read, identity synthesis, overwrite or resurrection is allowed.
Existing validated source/token/depth/parameter, MaxBatchMutations, document, batch, payload and index bounds apply; no bound is increased. Each serialized row is charged before retention, and the original operation token is checked throughout lowering and execution. There is no retained AST, new session dispatcher or new resource setting. INSERT SELECT, DEFAULT VALUES, OUTPUT, identity/default/computed fields, schema-qualified targets, foreign keys and general DML remain explicit unsupported/open families. Existing graph/queue INSERT composition is preserved.
SqlTypedInsertWholeFlowTests proves independent complete scalar rows and SQL/AST pages, original successful and failed bytes, whole multirow duplicate/unique rollback, exact scalar/missing failures, declared write-grant and principal epoch fences/repair, native named/verified-positional parameter parity, bounded rejection and original-token cancellation, then full raw image/cut and independent receipts across two actual ZoneTree cold owners with fresh healthy INSERTs.
SqlTypedInsertRf3WholeFlowTests uses real SDK, official MCP and Npgsql against fixture-owned Aspire RF3. It retains independently literal six-field pages including FixedPoint and UTC values, complete minimum-token document reads, full receipt scope/vector/durability with authentic positive opaque RF3 positions, original success/failure replay, malformed and multirow rollback, fresh resource/principal revoke/repair, genuine admitted AuthorizationReload hold/cancellation/ProducerDisposed settlement and same-GUID healthy retry. Caller scopes settle before both all-three-node cold waves; each cold proves old receipts/pages and a fresh literal INSERT. Public document/outbox conservation does not claim a physical raw-image/global-memory measurement. No local source result closes Linux or full SQL/client compatibility.
Current principal denial precedes cached-result selection: removing DocsWrite returns the complete scope-denied result for both original command IDs. Restoring DocsWrite under a newer principal epoch reaches the distinct complete stored-epoch denial. Both stages preserve original outcome bytes, full no-effects images/cuts and fresh healthy continuation; a shared PermissionDenied code does not make their safe details interchangeable. Original native runtime failure is retained; current-source/compiler/runtime/Linux qualification remains open.
REQ-REL-001/003 and AC-SQLC-006 preserve the original-outcome movement authority under AC-MOVE-002/004/007. After genuine source retirement, only the already verified original successful command and its exact retained receipt may use current metadata admission. Typed INSERT permission and cached-effect checks must reuse that verified admission; they must not require the retired source to become the current physical write owner. Normal writes, unrelated commands and failed-outcome selection retain their existing physical fences. Fresh schema availability, DocsWrite, row/default access, field/index grants, fingerprint and principal epoch checks are unchanged; no absence/CAS expansion occurs during cached replay.
SqlTypedInsertRetiredOutcomeWholeFlowTests submits a real selected T-SQL INSERT and a distinct duplicate command through the original joined native journal before capture, then runs the existing complete two-owner prepare/capture/install/publish/retire flow. Its independent four-source/one-target extra-entry accounting preserves every original default-zero receipt and control-entry assertion. Warm and two same-directory cold owners check full original receipt, retained outcome/locator bytes, raw images, journal indices, cuts and independently literal typed rows. Resource write-grant denial and exact repair precede principal scope denial/restoration-epoch fences. A fresh caller-authored canonical Batch at the published target epoch supplies the healthy continuation; this does not claim a new SQL/session moved-epoch bridge. This native movement operation is not an RF3 transport or power-loss qualification. Native source admission, compilation, whole operation execution and exact-source Linux gates remain open until their actual receipts join.
The additional typed INSERT seed explicitly supplies its complete originally authored ResourceDefinition and exact four-source/one-target entry counts to the shared native movement fixture. Native phase authorization and capture include every persisted resource in the transaction domain under unchanged budgets, so the independent grant/capture/page-descriptor resource oracle adds that literal definition to the original four definitions. It must not use the actual returned grant or descriptor as its expected metadata. ReplicaCanonicalApply forwards each committed entry's index into DatabaseEngine.Apply; grant/fence expected positions therefore add the authored source-entry contribution to their original 12/13 indices. This is a replica-index contract, not a comparison with a separately routed public query cut.
Default empty extra definitions and zero entry contribution preserve all original resource, scope, identity, grant, receipt and full-byte oracles. Complete record-family/page/raw-image/digest, authorization/expiry, replay/cancellation and cold-owner conservation assertions remain intact. The retained original SqlTypedInsertRetiredOutcomeWholeFlowTests failure occurred before target replay; source correction, native preimage admission, semantic peer, compiler and actual whole-operation/Linux gates remain distinct, and the original failure is not discarded or reclassified as passing.
Under REQ-SQLC-006 / AC-SQLC-006, REQ-REL-001/003 and AC-MOVE-002/004/007, ordinary VALUES accepts an optional positive SqlOperationRequest.OwnershipEpoch at stable Orleans field Id 8. Omitted ownership retains the existing initial epoch 1. The assertion is forwarded unchanged into the original CommandRequest and signed canonical Batch payload. It is neither discovered from administrator state nor advanced on retry; changing an old GUID's original epoch changes its canonical identity and retains the existing conflict contract. Other SELECT/CREATE/EXEC/model-composition forms refuse a declared outer epoch rather than silently ignoring it.
The existing KeyLoad native one-shot identity profile admits either its original 16-byte RFC4122 display-order Guid or an explicit 24-byte Guid plus positive signed-Int64-range ownership epoch in big-endian hexadecimal display order. The catalog charges exactly 16 or 24 logical bytes before publication. The original take/clear, normal Sync preservation, error Sync release, cancellation, reply settlement and disconnect contracts remain unchanged. This is a bounded KeyLoad profile, not general SQL Server CONTEXT_INFO interoperability. Automatic authorized nonadministrator placement discovery and automatic SQL routing remain OPEN.
SqlTypedInsertOwnershipEpochWholeFlowTests drafts genuine counted native source capture/install/publication/retirement followed by real SQL compilation at epoch 2, original success and failed-authority conservation, zero/negative/stale/future refusals, field-policy and principal denial/repair, full independently authored receipts/rows and two same-directory cold owners. SqlTypedInsertPublishedOwnershipEpochRf3Tests drafts actual six-owner Aspire transfer followed by the persisted nonadministrator SDK/official MCP/Npgsql operation, exact original replay, stale/future fences, original epoch-1 minimum-token invalidation, authentic held original producer cancellation with joined ProducerDisposed, fresh same-GUID healthy SQL2 after cancellation, complete receipt scope/vector and independently literal rows, and two joined all-six native raw-cut cold cycles. Public local query cuts stay opaque; administrator placement capture is an independent scope oracle, not a nonadministrator discovery result. Native preimage/creation admission, semantic review, compiler, runtime and exact-source Linux/RF3 gates are separate; this draft does not qualify those operations or resource limits.
The original R59 full native run retained two failed positive movement operations: OriginalTypedInsertSurvivesRealRetirementCurrentPermissionFencesAndTwoColdOwners and ExplicitCallerFenceRetainsOriginalSqlAndInsertsAtPublishedOwnerAcrossTwoColdStores. Both reached the current placement and retained original outcome assertions, then failed their first ordinary target GetDocument in SqlTypedInsertRetiredAssertions.RowsAsync with OwnershipLost from RequireNoUnpublishedPartitionMoveTarget. The native target still has its published movement stage. Ordinary target reads are deliberately fenced unless they execute inside the existing validated PartitionControlResourceView; publication alone does not authorize an unframed local receiver read.
The existing controlled document path captures fresh persisted principal/resource/publication authority at the source, validates the receiving frame and its read grant, and revalidates the source after receiving the result. Replacing the raw target read with a direct store read, deleting its stage, weakening its fence, or constructing an unchecked control view would hide the failure. A complete fix must preserve the original whole-operation identities, literal rows, SQL/AST checks, original receipt/outcome bytes, current permission repair and both cold owners, and must use the real authorized routing/execution contract for the healthy write and query continuation. The ordinary direct target SQL query and Batch continuation have not yet reached runtime in these two cases; their success must not be inferred from the earlier receipt checks. No repair or acceptance is claimed by this diagnosis.