@@ -0,0 +1,103 @@
+# tests/rhosocial/activerecord_sqlserver_test/feature/backend/test_backend_mixin_validation.py
+"""Offline tests for SQLServerBackendMixin validation and parameterization.
+
+Covers the whitelist/range validation branches of ``set_deadlock_priority``,
+``set_language`` and ``set_dateformat``, plus the parameterized identity
+queries, without requiring a live server.
+"""
+from unittest.mock import MagicMock
+
+import pytest
+
+from rhosocial.activerecord.backend.impl.sqlserver import SQLServerBackend
+from rhosocial.activerecord.backend.impl.sqlserver.config import SQLServerConnectionConfig
+
+
+def make_backend() -> SQLServerBackend:
+    config = SQLServerConnectionConfig(
+        host="localhost", port=1433, database="master",
+        username="sa", password="",
+    )
+    backend = SQLServerBackend(connection_config=config)
+    backend._connection = object()
+    return backend
+
+
+def make_cursor(backend):
+    cursor = MagicMock()
+    backend._get_cursor = lambda: cursor
+    return cursor
+
+
+class TestSetDeadlockPriority:
+    def test_integer_in_range(self):
+        backend = make_backend()
+        cursor = make_cursor(backend)
+        backend.set_deadlock_priority(-5)
+        cursor.execute.assert_called_once_with("SET DEADLOCK_PRIORITY -5")
+
+    def test_integer_out_of_range_raises(self):
+        backend = make_backend()
+        make_cursor(backend)
+        for value in (-11, 11):
+            with pytest.raises(ValueError, match="DEADLOCK_PRIORITY"):
+                backend.set_deadlock_priority(value)
+
+    def test_valid_name(self):
+        backend = make_backend()
+        cursor = make_cursor(backend)
+        backend.set_deadlock_priority("high")
+        cursor.execute.assert_called_once_with("SET DEADLOCK_PRIORITY HIGH")
+
+    def test_invalid_name_raises(self):
+        backend = make_backend()
+        make_cursor(backend)
+        with pytest.raises(ValueError, match="DEADLOCK_PRIORITY"):
+            backend.set_deadlock_priority("EVIL")
+
+
+class TestSetLanguage:
+    def test_valid_language_lowercased(self):
+        backend = make_backend()
+        cursor = make_cursor(backend)
+        backend.set_language("US_ENGLISH")
+        cursor.execute.assert_called_once_with("SET LANGUAGE 'us_english'")
+
+    def test_invalid_language_raises(self):
+        backend = make_backend()
+        make_cursor(backend)
+        with pytest.raises(ValueError, match="Unsupported SQL Server language"):
+            backend.set_language("klingon; DROP TABLE--")
+
+
+class TestSetDateformat:
+    def test_valid_format_lowercased(self):
+        backend = make_backend()
+        cursor = make_cursor(backend)
+        backend.set_dateformat("MDY")
+        cursor.execute.assert_called_once_with("SET DATEFORMAT mdy")
+
+    def test_invalid_format_raises(self):
+        backend = make_backend()
+        make_cursor(backend)
+        with pytest.raises(ValueError, match="DATEFORMAT"):
+            backend.set_dateformat("XYZ")
+
+
+class TestIdentityQueries:
+    def test_get_identity_current_parameterized(self):
+        backend = make_backend()
+        cursor = make_cursor(backend)
+        cursor.fetchone.return_value = (42,)
+        assert backend.get_identity_current("users") == 42
+        cursor.execute.assert_called_once_with(
+            "SELECT IDENT_CURRENT(?)", ("users",)
+        )
+
+    def test_reset_identity_parameterized(self):
+        backend = make_backend()
+        cursor = make_cursor(backend)
+        backend.reset_identity("users", 5)
+        cursor.execute.assert_called_once_with(
+            "DBCC CHECKIDENT(?, RESEED, ?)", ("users", 5)
+        )
@@ -0,0 +1,112 @@
+# tests/rhosocial/activerecord_sqlserver_test/feature/backend/test_introspection_sql_builders.py
+"""Offline tests for the parameterized SQL builder methods in the introspector.
+
+Covers the SQL injection hardening changes: every ``_build_*_sql`` method
+now returns parameterized SQL (``?`` placeholders) with separate params,
+instead of string-interpolated values.
+"""
+from rhosocial.activerecord.backend.impl.sqlserver import SQLServerBackend
+from rhosocial.activerecord.backend.impl.sqlserver.config import SQLServerConnectionConfig
+from rhosocial.activerecord.backend.impl.sqlserver.introspection import (
+    SyncSQLServerIntrospector,
+)
+
+
+def make_introspector() -> SyncSQLServerIntrospector:
+    config = SQLServerConnectionConfig(
+        host="localhost", port=1433, database="master", username="sa", password="",
+    )
+    backend = SQLServerBackend(connection_config=config)
+    backend._version = (16, 0, 0)
+    introspector = SyncSQLServerIntrospector(backend, executor=object())
+    return introspector
+
+
+class TestBuildTableListSql:
+    def test_default_schema_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_table_list_sql(None, False)
+        assert "TABLE_SCHEMA = ?" in sql
+        assert params == ("dbo",)
+
+    def test_with_table_type_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_table_list_sql("sys", False, table_type="BASE TABLE")
+        assert "TABLE_TYPE = ?" in sql
+        assert params == ("sys", "BASE TABLE")
+
+    def test_without_views_no_table_type(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_table_list_sql("dbo", False, include_views=False)
+        assert "BASE TABLE" in sql
+        assert params == ("dbo",)
+
+
+class TestBuildColumnInfoSql:
+    def test_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_column_info_sql("users", "dbo")
+        assert "c.TABLE_SCHEMA = ?" in sql
+        assert params == ("dbo", "users")
+
+
+class TestBuildPrimaryKeySql:
+    def test_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_primary_key_sql("users", "dbo")
+        assert "tc.TABLE_SCHEMA = ?" in sql
+        assert params == ("dbo", "users")
+
+
+class TestBuildIndexInfoSql:
+    def test_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_index_info_sql("users", "dbo")
+        assert "s.name = ?" in sql
+        assert params == ("dbo", "users")
+
+
+class TestBuildForeignKeySql:
+    def test_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_foreign_key_sql("users", "dbo")
+        assert "s.name = ?" in sql
+        assert params == ("dbo", "users")
+
+
+class TestBuildViewListSql:
+    def test_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_view_list_sql("dbo", False)
+        assert "TABLE_SCHEMA = ?" in sql
+        assert params == ("dbo",)
+
+
+class TestBuildViewInfoSql:
+    def test_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_view_info_sql("active_users", "dbo")
+        assert "TABLE_SCHEMA = ?" in sql
+        assert params == ("dbo", "active_users")
+
+
+class TestBuildTriggerListSql:
+    def test_with_table_name_parameterized(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_trigger_list_sql("orders", "dbo")
+        assert "AND t.name = ?" in sql
+        assert params == ("dbo", "orders")
+
+    def test_without_table_name(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_trigger_list_sql(None, "dbo")
+        assert "AND t.name = ?" not in sql
+        assert params == ("dbo",)
+
+
+class TestBuildDatabaseInfoSql:
+    def test_returns_sql(self):
+        introspector = make_introspector()
+        sql, params = introspector._build_database_info_sql()
+        assert "DB_NAME()" in sql
+        assert params == ()
@@ -0,0 +1,20 @@
+# tests/rhosocial/activerecord_sqlserver_test/feature/backend/test_main_parse_args.py
+"""Offline tests for ``__main__.parse_args`` with custom argv."""
+import pytest
+
+from rhosocial.activerecord.backend.impl.sqlserver.__main__ import parse_args
+
+
+class TestParseArgs:
+    def test_parse_args_with_help_exits(self):
+        with pytest.raises(SystemExit) as excinfo:
+            parse_args(["--help"])
+        assert excinfo.value.code == 0
+
+    def test_parse_args_with_query(self):
+        args = parse_args(["query", "SELECT 1"])
+        assert args.command == "query"
+
+    def test_parse_args_with_info(self):
+        args = parse_args(["info"])
+        assert args.command == "info"
@@ -0,0 +1,37 @@
+# tests/rhosocial/activerecord_sqlserver_test/feature/backend/test_transaction_deadlock_priority.py
+"""Offline tests for SQLServerTransactionManager.set_deadlock_priority delegation."""
+from unittest.mock import MagicMock
+
+import pytest
+
+from rhosocial.activerecord.backend.transaction import TransactionState
+from rhosocial.activerecord.backend.impl.sqlserver.transaction import (
+    SQLServerTransactionManager,
+)
+
+
+def make_manager() -> tuple[SQLServerTransactionManager, MagicMock]:
+    backend = MagicMock()
+    mgr = SQLServerTransactionManager(backend)
+    return mgr, backend
+
+
+class TestSetDeadlockPriority:
+    def test_delegates_to_backend(self):
+        mgr, backend = make_manager()
+        mgr._state = TransactionState.ACTIVE
+        mgr.set_deadlock_priority("LOW")
+        backend.set_deadlock_priority.assert_called_once_with("LOW")
+
+    def test_integer_delegates_to_backend(self):
+        mgr, backend = make_manager()
+        mgr._state = TransactionState.ACTIVE
+        mgr.set_deadlock_priority(-5)
+        backend.set_deadlock_priority.assert_called_once_with(-5)
+
+    def test_raises_without_active_transaction(self):
+        mgr, backend = make_manager()
+        mgr._state = TransactionState.INACTIVE
+        with pytest.raises(Exception, match="No active transaction"):
+            mgr.set_deadlock_priority("LOW")
+        backend.set_deadlock_priority.assert_not_called()