@@ -143,7 +143,7 @@ jobs:
     steps: *sql-test-steps
 
   dolt-integration:
-    name: Dolt ${{ matrix.dolt }} read-only / fail-closed integration
+    name: Dolt ${{ matrix.dolt }} default-write integration
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
 
@@ -96,25 +96,27 @@ SAV/ZSAV export for the semantics exposed by that engine. SQLite is the local
 reference path.
 PostgreSQL, MySQL, MariaDB, and Dolt are each covered by separate service-backed CI
 conformance checks. Dolt support is an independent core profile for the
-canonical stable range `>=2.2.2,<2.3.0`; earlier patches, other families,
-noncanonical versions, and unknown MySQL-wire products fail closed.
+exact write-supported versions 2.2.2 and 2.2.3; all other versions (including
+2.3.0), noncanonical versions, and unknown MySQL-wire products fail closed for writes.
 
 The supported family claims are broader than the deliberately exact CI
 evidence points: PostgreSQL 17.x/18.x is exercised at 17.10/18.4, MySQL
 8.4.x/9.7.x at 8.4.11/9.7.2, and MariaDB 11.4.x/11.8.x/12.3.x at
 11.4.12/11.8.8/12.3.2. Each service job checks the normalized live server
 version against its exact matrix entry before that run can count as evidence.
-Dolt claims the conservative 2.2.x range `>=2.2.2,<2.3.0`; its full service
-suite is exercised independently at exact versions 2.2.2 and 2.2.3 using
-immutable container-image digests.
+Dolt's default-write service checks run independently at exact versions 2.2.2
+and 2.2.3 using immutable container-image digests. Release/CI owns this evidence;
+normal callers need no declaration or evidence files. The optional explicit
+`DoltConformanceSource` override remains strict and does not fall back to the
+default policy if its declarations are missing, invalid, or mismatched.
 
 | Engine/profile | Runtime supported policy | Exact CI-tested versions |
 | --- | --- | --- |
 | SQLite core / optional workflow | Core `>=3.24.0,<4.0.0`; optional workflow `>=3.35.0,<4.0.0` | Runtime-provided SQLite on Python 3.11–3.14 runners; not a pinned server image |
 | PostgreSQL | 17.x and 18.x | 17.10 and 18.4 |
 | MySQL | 8.4.x and 9.7.x | 8.4.11 and 9.7.2 |
 | MariaDB | 11.4.x, 11.8.x, and 12.3.x | 11.4.12, 11.8.8, and 12.3.2 |
-| Dolt | 2.2.x with `>=2.2.2,<2.3.0` | 2.2.2 and 2.2.3 |
+| Dolt writes | Exactly 2.2.2 and 2.2.3 | 2.2.2 and 2.2.3 |
 
 Microsoft SQL Server (MSSQL) remains roadmap-only and is not a supported
 runtime profile; see the specification's [MSSQL roadmap](https://github.com/OpenStatSpec/specification/blob/main/docs/mssql-dialect-roadmap.md).
@@ -124,7 +126,7 @@ Use these explicit SQLAlchemy URLs:
 - SQLite: `sqlite:///dataset.sqlite`
 - PostgreSQL: `postgresql+psycopg://user:password@host/database`
 - MySQL/MariaDB: `mysql+pymysql://user:password@host/database`
-- Dolt `>=2.2.2,<2.3.0`: `mysql+pymysql://user:password@host/database` (detected by server identity)
+- Dolt 2.2.2 or 2.2.3: `mysql+pymysql://user:password@host/database` (detected by server identity)
 
 The Dolt core profile supports strict wide-table import, validation, and export;
 the separate Transformation Workflow is unsupported.
@@ -135,8 +137,12 @@ dictionary semantics cannot be reproduced, it stops until you pass the exact
 diagnostic code with `--allow-loss`. Diagnostics are returned to the caller, not
 persisted. Reads, validation, and SAV/ZSAV export never write to the database,
 including on failure. Export returns no `operation_id` and needs only read
-permissions; Dolt reads do not require a write-conformance declaration. Imports
-and transformations still require an exact matching Dolt write declaration.
+permissions; Dolt reads have no write-version gate. Imports and transformations
+use the packaged exact-version policy by default. Active driver/identity checks,
+limit preflight, and the clean expected branch/HEAD guard for in-place apply
+remain mandatory. Dolt's reported limits are adapter safety budgets, narrowed
+by the active packet limit, not proven native server ceilings; full boundary
+conformance is not claimed.
 
 The matrix is also available to Python callers as
 `openstatspec.capability_matrix()`. It distinguishes supported semantics from
 
@@ -20,15 +20,17 @@ database contract.
 | PostgreSQL | `postgresql+psycopg://…` | 17.x and 18.x | 17.10 and 18.4 |
 | MySQL | `mysql+pymysql://…` | 8.4.x and 9.7.x | 8.4.11 and 9.7.2 |
 | MariaDB | `mysql+pymysql://…` | 11.4.x, 11.8.x, and 12.3.x | 11.4.12, 11.8.8, and 12.3.2 |
-| Dolt | `mysql+pymysql://…` | 2.2.x with `>=2.2.2,<2.3.0` | 2.2.2 and 2.2.3 |
+| Dolt writes | `mysql+pymysql://…` | Exactly 2.2.2 and 2.2.3 | 2.2.2 and 2.2.3 |
 
 Separate service matrices test the shared MySQL/MariaDB profile contract while
 retaining distinct active-server identities and version claims. Dolt is an
-independent core profile that accepts only canonical stable versions in
-`>=2.2.2,<2.3.0`; the optional Transformation Workflow remains SQLite-only. This does not
-claim coverage for every server configuration. The machine-readable capability
-declaration reports both the theoretical profile boundaries and effective
-limits observed from the active connection.
+independent core profile with a packaged exact-version write policy; normal
+callers supply no conformance files. An explicit external declaration source
+remains a strict override. Read-only validation/export has no write-version gate.
+The optional Transformation Workflow remains SQLite-only. This does not claim
+coverage for every server configuration or proven Dolt native limit ceilings.
+Dolt capabilities report adapter safety budgets and active packet constraints;
+full boundary conformance remains pending.
 Every server service job compares the normalized live product version with its
 exact matrix entry, so a moved or mismatched image cannot substantiate the CI
 declaration. SQLite's optional Transformation Workflow retains its narrower
@@ -102,6 +104,27 @@ implemented openstatspec.frontends.spss package. Stata and SAS remain empty
 source-tree placeholders and must expose no compiler, apply API, CLI choice,
 capability claim, or implied support.
 
+## Default Dolt write verification
+
+Local release verification used the exact 2.2.2 and 2.2.3 image digests in
+`.github/workflows/ci.yml`, isolated ports 13482/13483, and disposable `/tmp`
+database directories. With `PYTHONPATH=src:../pyspssio`,
+`OPENSTATSPEC_SPECIFICATION_DIR=/tmp/oss-php-spec-cd8f198`, and each matching
+`OPENSTATSPEC_DOLT_URL` / `OPENSTATSPEC_EXPECTED_DOLT_VERSION`:
+
+- `../python/.venv/bin/python -m pytest`: **366 passed, 49 skipped per pin**.
+- CI selection `-m 'services and not candidate_evidence'`: **7 passed,
+  41 skipped per pin**; other database services were not configured locally.
+- Dolt 2.3.0 on port 13387: read-only export and unknown-version write rejection
+  checks passed (**19 passed**) using disposable fixture databases/users.
+- `python -m compileall -q src tests` and `git diff --check` passed.
+
+Live failures exposed and now cover two previously dormant write blockers:
+owned table additions being misclassified as unrelated diffs, and Dolt retaining
+`@@autocommit=1` despite the driver's setting. Writes now explicitly begin their
+transaction. The candidate storage/identifier/column smoke probe also passed on
+both pins; it does **not** establish full value/row/statement limit conformance.
+
 ## Maintainer checks before tagging
 
 1. Publish the pinned `openstatspec-pyspssio==0.5.1.post2` engine distribution
@@ -110,7 +133,12 @@ capability claim, or implied support.
 2. Run `python -m pytest -m "not services"`.
 3. Confirm the GitHub Actions matrix is green for exact PostgreSQL 17.10/18.4,
    MySQL 8.4.11/9.7.2, MariaDB 11.4.12/11.8.8/12.3.2, and exact Dolt
-   2.2.2/2.2.3 service evidence from the immutable image pins in CI.
+   2.2.2/2.2.3 service evidence from the immutable image pins in CI. The Dolt
+   jobs must perform default import/validate/SAV+ZSAV export, in-place recode
+   and labels with unchanged dataset/table counts and HEAD, injected data,
+   catalog, and audit rollback checks, and failed-import cleanup. Release/CI
+   owns this evidence, not per-user runtime declaration files. Candidate limit
+   probes remain non-claiming and separate from these write gates.
 4. Build with `python -m build` and install the generated wheel in a clean
    environment.
 5. Confirm `openstatspec capabilities` reflects the intended support boundary.
 
@@ -24,8 +24,10 @@
 
 DOLT_WRITE_CONFORMANCE = {
     "declaration_schema_id": "openstatspec-dolt-adapter-declaration-v1",
-    "write_enabled": False,
-    "status": "adapter_owned_concrete_declarations_required",
+    "write_enabled": True,
+    "status": "packaged_exact_version_policy",
+    "declaration_count": 0,
+    "declarations_available": False,
 }
 
 
@@ -82,7 +84,7 @@ def _dolt_driver_eligible(database_url: str) -> bool:
 def dolt_operational_write_enabled(
     active: Mapping[str, Any], *, declaration_matched: bool,
 ) -> bool:
-    """Require both exact declaration and claimed active driver for writes."""
+    """Require an exact write-policy match and the claimed active driver."""
     return declaration_matched and bool(active.get("driver_eligible", False))
 
 
@@ -91,7 +93,12 @@ def _dolt_write_enabled(
     *,
     active_product_version: str | None = None,
 ) -> bool:
-    conformance = _conformance_source(source)
+    if source is None:
+        return (
+            True if active_product_version is None
+            else active_product_version.strip() in SERVER_POLICIES["dolt"]["claimed"]
+        )
+    conformance = source
     if active_product_version is None:
         return bool(conformance.status()["write_enabled"])
     conformance.require_exact_match(
@@ -115,8 +122,8 @@ def _dolt_write_enabled(
         "ci": ["MariaDB 11.4.12", "MariaDB 11.8.8", "MariaDB 12.3.2"],
     },
     "dolt": {
-        "claimed": [],
-        "ci": [],
+        "claimed": ["2.2.2", "2.2.3"],
+        "ci": ["2.2.2", "2.2.3"],
     },
     "postgresql": {
         "claimed": ["PostgreSQL 17.x", "PostgreSQL 18.x"],
@@ -131,13 +138,13 @@ def profile_declarations(
     dolt_conformance_source: DoltConformanceSource | None = None,
 ) -> dict[str, dict[str, Any]]:
     """Declare every profile and, optionally, one active connection."""
-    source = _conformance_source(dolt_conformance_source)
+    source = dolt_conformance_source
     active = (
         active_connection(database_url, dolt_conformance_source=source)
         if database_url else None
     )
     dolt_declaration = None
-    if active and active["profile"] == "dolt":
+    if source is not None and active and active["profile"] == "dolt":
         try:
             dolt_declaration = source.require_exact_match(
                 active_product_version=active["raw_product_version"],
@@ -290,7 +297,7 @@ def effective_profile(
     *,
     dolt_conformance_source: DoltConformanceSource | None = None,
 ) -> tuple[SqlProfile, dict[str, Any]]:
-    """Resolve and enforce the write profile, including exact Dolt conformance."""
+    """Enforce the write profile and exact Dolt policy or explicit declaration."""
     return _effective_profile(database_url, dolt_conformance_source, for_write=True)
 
 
@@ -307,7 +314,7 @@ def _effective_profile(
     database_url: str, dolt_conformance_source: DoltConformanceSource | None,
     *, for_write: bool,
 ) -> tuple[SqlProfile, dict[str, Any]]:
-    source = _conformance_source(dolt_conformance_source)
+    source = dolt_conformance_source
     configured = validate_connection_url(database_url)
     active = active_connection(database_url, dolt_conformance_source=source)
     if configured is not MYSQL and active["profile"] != configured.name:
@@ -326,7 +333,7 @@ def _effective_profile(
         # write-conformance envelope or INSERT statement/packet limits.
         return DOLT, active
     dolt_declaration = None
-    if active["profile"] == "dolt":
+    if active["profile"] == "dolt" and source is not None:
         dolt_declaration = source.require_exact_match(
             active_product_version=active["raw_product_version"],
             specification_commit=_bound_specification_commit(),
@@ -392,13 +399,18 @@ def _profile(
     dolt_declaration: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
     dolt_envelope = name == "dolt"
+    default_dolt = dolt_envelope and dolt_conformance_source is None
+    dolt_supported = bool(
+        default_dolt and active and active["profile"] == "dolt"
+        and server_version_supported("dolt", active["raw_product_version"])
+    )
     identifier = {
         "value": profile.identifier_limit,
         "unit": "characters" if name in {"mysql", "mariadb"} else "bytes",
         "source": (
             "MySQL/MariaDB native identifier limit" if name in {"mysql", "mariadb"}
             else "PostgreSQL NAMEDATALEN minus one native byte limit" if name == "postgresql"
-            else "OpenStatSpec Dolt adapter envelope pending pinned live boundary evidence"
+            else "OpenStatSpec Dolt adapter safety envelope (not a proven server ceiling)"
             if dolt_envelope
             else "OpenStatSpec profile boundary; SQLite has no fixed native identifier limit"
         ),
@@ -416,7 +428,7 @@ def _profile(
     if dolt_envelope:
         adapter_envelope = {
             **profile_limits,
-            "limit_basis": "proposed_adapter_envelope",
+            "limit_basis": "adapter_safety_envelope",
             "evidence_status": "pending_pinned_live_conformance",
         }
         theoretical = {
@@ -435,15 +447,16 @@ def _profile(
     effective = None
     status = "not_connected"
     if active and active["profile"] == name and (
-        not dolt_envelope or dolt_declaration is not None
+        not dolt_envelope or dolt_declaration is not None or dolt_supported
     ):
         effective = (
             dolt_effective_limits(dolt_declaration)
             if dolt_envelope and dolt_declaration is not None
+            else dict(adapter_envelope) if default_dolt
             else dict(theoretical)
         )
         default_source = (
-            "proposed adapter envelope pending pinned live conformance"
+            "adapter safety envelope; full boundary conformance not claimed"
             if dolt_envelope else "profile theoretical engine ceiling"
         )
         sources = {
@@ -482,7 +495,9 @@ def _profile(
             effective["maximum_value_bytes"] = min(
                 effective["maximum_value_bytes"], payload,
             )
-            effective["maximum_statement_bytes"] = payload
+            effective["maximum_statement_bytes"] = min(
+                effective["maximum_statement_bytes"] or payload, payload,
+            )
             sources["maximum_value_bytes"] = "active @@max_allowed_packet worst-case payload"
             sources["maximum_statement_bytes"] = "active @@max_allowed_packet worst-case payload"
             status = "active_connection_mixed"
@@ -494,20 +509,25 @@ def _profile(
     policy = SERVER_POLICIES[name]
     dolt_declarations = (
         _validated_dolt_declarations(dolt_conformance_source)
-        if dolt_envelope else ()
+        if dolt_envelope and not default_dolt else ()
     )
     dolt_claimed_versions = sorted({
         version
         for declaration in dolt_declarations
-        for version in declaration["claimed_product_versions"]
+        for version in declaration.get(
+            "claimed_product_versions", [declaration["active_product_version"]],
+        )
     })
     dolt_tested_versions = sorted({
         version
         for declaration in dolt_declarations
-        for version in declaration["tested_product_versions"]
+        for version in declaration.get(
+            "tested_product_versions", [declaration["active_product_version"]],
+        )
     })
     dolt_status = (
-        _conformance_source(dolt_conformance_source).status()
+        DOLT_WRITE_CONFORMANCE if default_dolt
+        else _conformance_source(dolt_conformance_source).status()
         if dolt_envelope else None
     )
     return {
@@ -520,10 +540,10 @@ def _profile(
         "specification_commit": SPECIFICATION_COMMIT,
         "driver": "psycopg" if name == "postgresql" else "PyMySQL" if name in MYSQL_WIRE_PROFILES else "sqlite3",
         "claimed_server_versions": (
-            dolt_claimed_versions if dolt_envelope else policy["claimed"]
+            dolt_claimed_versions if dolt_envelope and not default_dolt else policy["claimed"]
         ),
         "ci_tested_server_versions": (
-            dolt_tested_versions if dolt_envelope else policy["ci"]
+            dolt_tested_versions if dolt_envelope and not default_dolt else policy["ci"]
         ),
         "write_conformance": (
             {
@@ -543,7 +563,7 @@ def _profile(
         ),
         "operational_write_enabled": (
             dolt_operational_write_enabled(
-                active, declaration_matched=dolt_declaration is not None,
+                active, declaration_matched=dolt_declaration is not None or dolt_supported,
             )
             if dolt_envelope and active and active["profile"] == name
             else (
@@ -599,7 +619,6 @@ def server_version_supported(
         "postgresql": {(17,), (18,)},
         "mysql": {(8, 4), (9, 7)},
         "mariadb": {(11, 4), (11, 8), (12, 3)},
-        "dolt": {(2, 2, 2)},
     }[profile]
     width = len(next(iter(allowed)))
     return version[:width] in allowed
 
@@ -1,4 +1,7 @@
-"""Adapter-owned validation for language-neutral Dolt declarations."""
+"""Optional strict validation for external, adapter-owned Dolt declarations.
+
+Default writes use the exact-version policy in capabilities, not this registry.
+"""
 
 from __future__ import annotations
 
@@ -280,7 +283,7 @@ class DoltConformanceSource:
 
     @classmethod
     def packaged(cls) -> "DoltConformanceSource":
-        """Return the empty built-in registry; no Dolt write claim is packaged."""
+        """Return the legacy empty registry, not the default write-version policy."""
         return cls()
 
     @classmethod
 
@@ -984,6 +984,9 @@ def _run_in_place_submission(
                     # catalog mutations roll back together before the write lock
                     # is released.
                     connection.exec_driver_sql("BEGIN")
+                if profile.name == "dolt":
+                    # Dolt may retain @@autocommit=1 despite PyMySQL's setting.
+                    connection.exec_driver_sql("BEGIN")
                 require_verified_catalog(connection)
                 if profile.name == "dolt":
                     if not expected_branch or not expected_head: