Fix generator teardown leaks, add RETURN-in-GEN and LOOP conditions on DO EACH

Review findings and follow-ups from PR #61 review:

- runtime_generator.c: akbasic_runtime_release_generator() now releases the
  forGeneratorEnv of every scope it walks through. Abandoning a generator
  that was itself suspended inside a FOR EACH over another generator
  stranded the inner generator's pool slot; a loop doing so exhausted the
  twelve-slot pool and died far from the cause.
- runtime.c/runtime.h: new akbasic_runtime_unwind_to_environment(), the
  shared teardown for the error unwinds in pump_generator() and
  call_function() -- both previously bare prev_environment() loops with the
  same suspended-generator blindness.
- runtime_commands.c: bare RETURN standing in a GEN's own frame ends the
  generator exactly as END GEN does -- a GEN is a function at heart. RETURN
  with a value there is refused (values leave a GEN only through EMIT). The
  no-frame error message now says "GOSUB, DEF, or GEN".
- runtime_structure.c: LOOP WHILE/UNTIL composes with DO EACH -- checked
  after each trip with the loop variable still holding that trip's value; a
  condition that stops the loop abandons the generator exactly as EXIT
  does. Previously the condition was silently ignored, while the verb
  reference documented it as working.
- parser_commands.c: trailing tokens after the generator call on a FOR
  EACH/DO EACH line are refused at parse. Previously they sat unparsed and
  blew up only after the loop completed, when the parent scope resumed the
  line mid-statement -- an error at the loop's end pointing at its start.
- tests/generators.c: pool-exhaustion tests for the nested-abandonment and
  LOOP-condition paths, RETURN semantics tests, and a direct test of the
  unwind primitive. Three new golden pairs cover RETURN, LOOP conditions
  and the misplaced-condition parse error.
- docs: RETURN and LOOP-condition semantics in 04-control-flow.md and
  11-verb-reference.md; corrected the self-recursion analogy (functions
  are re-entrant here). TODO.md 1.10 records the generator design
  decisions the code comments were already citing, plus the zero-arg
  parameter-list limitation. MAINTENANCE.md gains the abandoned-generators
  invariant those comments also cited.

Co-Authored-By: Andrew Kesterson <andrew@aklabs.net>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/mutation.yaml

@@ -0,0 +1,48 @@
+name: akbasic Mutation Testing
+run-name: ${{ gitea.actor }} akbasic mutation test
+
+# Mutation testing is intentionally isolated from push and merge checks. The
+# complete src/ tree takes hours and must not consume the shared CI capacity
+# during normal development.
+on:
+  # Gitea schedules use UTC. 07:00 UTC is 02:00 EST (the requested fixed
+  # Eastern Standard Time slot).
+  schedule:
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+
+jobs:
+  full_mutation:
+    runs-on: ubuntu-latest
+    timeout-minutes: 720
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: dependencies
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y cmake gcc python3 moreutils
+      - name: mutation testing (full tree)
+        run: |
+          python3 scripts/mutation_test.py \
+            --junit mutation-junit.xml \
+            --threshold 65
+      - name: publish mutation results
+        if: always()
+        uses: mikepenz/action-junit-report@v4
+        with:
+          report_paths: 'mutation-junit.xml'
+          annotate_only: true
+          detailed_summary: true
+          include_passed: true
+          fail_on_failure: 'false'
+      - name: upload mutation report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mutation-report
+          path: mutation-junit.xml
+          if-no-files-found: warn
+      - run: echo "🍏 This job's status is ${{ job.status }}."

.gitea/workflows/release.yaml

@@ -1,24 +1,13 @@
 name: akbasic Release Build
 run-name: ${{ gitea.actor }} akbasic release checks
-# Manual only. Nothing here runs on push: the full mutation set is thousands of
+# Manual only. Nothing here runs on push: documentation is a release gate, not
-# mutants and hours of runner time, which is a release-gate cost, not a
+# a per-commit check. The expensive mutation suite has its own daily schedule.
-# per-commit one. Trigger it from the Actions tab.
 on:
   workflow_dispatch:
-    inputs:
-      mutation_threshold:
-        description: "Fail if the mutation score falls below this percentage"
-        required: false
-        default: "65"
-      mutation_targets:
-        description: "Space-separated files to mutate; empty means the whole src/ tree"
-        required: false
-        default: ""
 
 jobs:
   # Moved here from ci.yaml. The docs are wanted for a release, not on every
-  # push, and building them beside the release mutation run keeps the two
+  # push.
-  # artefacts a release needs in one place.
   docs:
     runs-on: ubuntu-latest
     steps:
@@ -52,89 +41,3 @@ jobs:
           path: build/docs/html/
           if-no-files-found: error
       - run: echo "🍏 This job's status is ${{ job.status }}."
-
-  full_mutation:
-    runs-on: ubuntu-latest
-    # 3675 mutants across the whole src/ tree. Cost per mutant is one incremental
-    # rebuild plus one full ctest run, which measures at roughly 2s for a leaf
-    # file and 11s for src/value.c, where almost everything links against it.
-    # Budget most of a day and expect it to finish well inside that; the ceiling
-    # exists so a mutant that wedges the runner cannot hold it forever.
-    timeout-minutes: 720
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v4
-        with:
-          # The harness copies the repo and configures a build inside the copy,
-          # so it needs the same submodules the main build does. The golden
-          # corpus is part of what kills mutants and it is checked in now, so
-          # that is libakerror and libakstdlib and nothing else.
-          submodules: true
-      # moreutils for errno(1), which deps/libakerror's scripts/generrno.sh needs
-      # to generate its errno table. Without it the generated table is empty and
-      # every AKERR_* code collapses onto a low integer -- see the long note on
-      # ci.yaml's cmake_build job for what that breaks and how it presents.
-      - name: dependencies
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y cmake gcc python3 moreutils
-      # The whole akbasic-owned src/ tree. ci.yaml runs a two-file subset on every
-      # push; this is the one that actually covers the interpreter.
-      #
-      # Mutation testing is the only gate that sees the error-handling control
-      # flow at all: libakerror's ATTEMPT/CATCH/PASS macros expand at their call
-      # sites, so gcov attributes them to the caller and line coverage cannot
-      # measure them.
-      #
-      # The default threshold matches ci.yaml's rather than being stricter.
-      # Whole-tree coverage is uneven -- src/symtab.c is the only file measured
-      # on the push path, at 74.1%, and the rest is unmeasured, so a tighter
-      # number here would be a guess. Raise it with the workflow input once a
-      # full run has established a real baseline.
-      #
-      # The two inputs arrive through the environment rather than being
-      # interpolated straight into the script. ${{ }} substitution happens before
-      # the shell sees the line, so a value containing shell metacharacters would
-      # otherwise run as code. This workflow is manual and owner-triggered, but
-      # the safe form costs nothing.
-      - name: mutation testing (full tree)
-        env:
-          MUTATION_TARGETS: ${{ gitea.event.inputs.mutation_targets }}
-          MUTATION_THRESHOLD: ${{ gitea.event.inputs.mutation_threshold }}
-        run: |
-          set -eu
-          # Word-splitting is the point here: the input is a space-separated
-          # list. An empty input leaves $targets empty and the harness falls
-          # through to its own default, which is the whole src/ tree.
-          targets=""
-          for f in ${MUTATION_TARGETS:-}; do
-            targets="$targets --target $f"
-          done
-          # shellcheck disable=SC2086
-          python3 scripts/mutation_test.py \
-            $targets \
-            --junit mutation-junit.xml \
-            --threshold "${MUTATION_THRESHOLD:-65}"
-      # Publish even when the threshold gate fails, so survivors are visible --
-      # each one is a missing test. Display-only (fail_on_failure: false); the
-      # --threshold above is the gate. annotate_only avoids the Checks API 404
-      # on Gitea (mikepenz/action-junit-report#23).
-      - name: publish mutation results
-        if: always()
-        uses: mikepenz/action-junit-report@v4
-        with:
-          report_paths: 'mutation-junit.xml'
-          annotate_only: true
-          detailed_summary: true
-          include_passed: true
-          fail_on_failure: 'false'
-      # Keep the raw report as well as the annotations: a release wants the
-      # survivor list on file, and the job summary is not durable.
-      - name: upload mutation report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: mutation-report
-          path: mutation-junit.xml
-          if-no-files-found: warn
-      - run: echo "🍏 This job's status is ${{ job.status }}."

CMakeLists.txt

@@ -51,12 +51,14 @@ option(AKBASIC_SANITIZE  "Build with ASan + UBSan"                           OFF
 # through: the dependencies set target and directory properties that their own
 # builds depend on.
 #
-# libakerror additionally namespaces its `mutation` target when embedded but not
+# All three dependencies now namespace both their `coverage` and their
-# its `coverage` target (deps/libakerror/CMakeLists.txt:194 vs :172), so a
+# `mutation` targets when embedded, so there is no custom-target collision left
-# coverage build collides on the `coverage` target and fails to configure at all.
+# to work around. libakerror was the last holdout -- it namespaced `mutation`
-# Rename the dependency's on the way past. Remove this once libakerror applies
+# but not `coverage`, and a coverage build collided on the bare name and failed
-# the same CMAKE_SOURCE_DIR test to `coverage` that it already applies to
+# to configure at all. 2.0.2 applies the same CMAKE_SOURCE_DIR test to both
-# `mutation` -- filed as libakerror issue #15.
+# (deps/libakerror/CMakeLists.txt:429-434), closing libakerror issue #15, and
+# the add_custom_target() shadow that renamed it on the way past is gone with
+# this comment.
 #
 # **Only one project in a tree may shadow add_test(), and this is that project.**
 # CMake exposes an overridden command as `_name` and chains exactly one level: a
@@ -86,14 +88,6 @@ function(set_property _scope)
   endif()
 endfunction()
 
-function(add_custom_target _name)
-  if(AKBASIC_SUPPRESS_ADD_TEST AND _name STREQUAL "coverage")
-    _add_custom_target(akerror_coverage ${ARGN})
-  else()
-    _add_custom_target(${ARGV})
-  endif()
-endfunction()
-
 add_subdirectory(deps/libakerror EXCLUDE_FROM_ALL)
 add_subdirectory(deps/libakstdlib EXCLUDE_FROM_ALL)
 if(AKBASIC_WITH_AKGL)
@@ -149,6 +143,7 @@ set(AKBASIC_SOURCES
   src/runtime_disk.c
   src/runtime_format.c
   src/runtime_functions.c
+  src/runtime_generator.c
   src/runtime_graphics.c
   src/runtime_housekeeping.c
   src/runtime_machine.c
@@ -358,6 +353,7 @@ set(AKBASIC_TESTS
   error_codes
   for_next
   format_verbs
+  generators
   grammar_leaves
   graphics_verbs
   hoststruct

Doxyfile

@@ -12,3 +12,4 @@ WARN_AS_ERROR          = FAIL_ON_WARNINGS
 GENERATE_HTML          = YES
 GENERATE_LATEX         = NO
 QUIET                  = YES
+DOT_GRAPH_MAX_NODES    = 100

MAINTENANCE.md

@@ -68,12 +68,19 @@ the `akgl_*` or `aksl_*` entry point should look like, and what tests would cove
 decision, which is true of *changing* it and not of *reporting* it. Follow the prose-paragraph style of the entries already
 there. Growing the dependency to serve the interpreter is a wanted outcome, not a detour.
 
-It works. Four gaps were filed this way — text measurement, immediate-mode drawing, audio,
+It works. **Five** gaps were filed this way and all five landed upstream: text measurement,
-and a non-blocking keystroke read — and all four landed upstream as `akgl_text_measure`, the
+immediate-mode drawing, audio and a non-blocking keystroke read became `akgl_text_measure`,
-`akgl_draw_*` family, `akgl_audio_*` and `akgl_controller_poll_key`. `FILTER` is the one verb
+the `akgl_draw_*` family, `akgl_audio_*` and `akgl_controller_poll_key`; and the
-still blocked on a gap, and `DIRECTORY` is refused pending an `opendir`/`readdir` wrapper in
+directory-reading wrapper `DIRECTORY` was waiting on became `aksl_opendir`, `aksl_readdir`,
-`libakstdlib`. Both refuse at execution and say so, rather than being silently ignored: a
+`aksl_closedir` and `aksl_rewinddir` — `libakstdlib` issue #10, in the revision this tree
-program that asks for a low-pass filter and gets an unfiltered square wave has been lied to.
+pins.
+
+That leaves the two refusals in different positions, and the difference is worth keeping
+straight. **`FILTER` is the one verb still blocked on a gap** — there is no filter stage in
+`akgl_audio_*` to configure. **`DIRECTORY` is no longer blocked on anything**; it is simply
+unwritten, and its refusal says so rather than naming a wrapper that now exists. Both refuse
+at execution and say so, rather than being silently ignored: a program that asks for a
+low-pass filter and gets an unfiltered square wave has been lied to.
 
 ### The Go reference
 
@@ -156,10 +163,10 @@ guards every dependency with `if(NOT TARGET ...)`, so a top-level build must def
 `akerror::akerror` and `akstdlib::akstdlib` from `deps/libakerror` and `deps/libakstdlib`
 **before** `add_subdirectory(deps/libakgl)`, or the targets are declared twice.
 
-That order is load-bearing for a second reason: `deps/libakerror` is at **2.0.1**, whose 2.0.0
+That order is load-bearing for a second reason: `deps/libakerror` is at **2.0.3**, whose 2.0.0
 was a source and ABI break carrying an soname (`libakerror.so.2`). `libakstdlib` and `libakgl`
 must be compiled against that header, not a 1.x one, and an installed `libakerror.so.1` must
-not be picked up. The break is quiet if you get it wrong: `__akerr_last_ignored` became
+not be picked up. The break is quiet if you get it wrong: the context behind `IGNORE` became
 thread-local and `akerr_next_error()` now returns a context that already holds a reference, so
 a mixed build leaks pool slots or frees one twice rather than failing to link.
 
@@ -167,10 +174,23 @@ a mixed build leaks pool slots or frees one twice rather than failing to link.
 
 | Submodule | Version | soname | ABI rule | Version API |
 |---|---|---|---|---|
-| `deps/libakerror` | 2.0.1 | `libakerror.so.2` | major only | **none** — no version macro; `include/akbasic/error.h` feature-tests `AKERR_THREAD_SAFE` and `AKERR_EXIT_STATUS_UNREPRESENTABLE` instead |
+| `deps/libakerror` | 2.0.3 | `libakerror.so.2` | major only | **none** — no version macro; `include/akbasic/error.h` feature-tests `AKERR_THREAD_SAFE` and `AKERR_EXIT_STATUS_UNREPRESENTABLE` instead |
 | `deps/libakstdlib` | 0.2.0 | `libakstdlib.so.0.2` | **`MAJOR.MINOR` while major is 0** | `AKSL_VERSION_*`, `aksl_version()`, `AKSL_VERSION_CHECK()` |
 | `deps/libakgl` | 0.9.0 | `libakgl.so.0.9` | **`MAJOR.MINOR` while major is 0** | `AKGL_VERSION*`, `akgl_version()`, `AKGL_VERSION_AT_LEAST()` |
 
+`project(akerror VERSION ...)` now stamps 2.0.3, matching that library's own "Release 2.0.3"
+release notes. It previously disagreed — the soname and `akerrorConfigVersion.cmake` still
+said 2.0.2 while the notes described 2.0.3 — but that was `libakerror` issue #38, which is
+closed; the table and the notes agree again.
+
+`IGNORE` still takes a *copy* of the ignored context so the pool slot can be released, which
+fixes a real leak, but the copy no longer costs TLS per translation unit. It was a file-scope
+`static` in the public header — one copy per TU, 37,296 bytes each, 1.35 MiB of thread-local
+storage in `build/basic` alone, plus 84 `-Wunused-variable` warnings for every TU that never
+called `IGNORE`. `libakerror` issue #37 moved it to an `extern` declaration in the header with
+a single definition in `src/error.c`, which restores one copy per thread and silences the
+warning. Issue #37 is closed and this subsection is gone accordingly.
+
 For both 0.x libraries the soname carries `MAJOR.MINOR` deliberately: 0.1 and 0.2 are
 *different* ABIs, and both become major-only at 1.0. Do not read `0.1 → 0.2` as a compatible
 bump — both libraries have actually made that jump, so anything built against the 0.1 headers
@@ -196,16 +216,32 @@ precedes the build tree on the include path and a stray copy there would shadow
 one and pin every consumer. It publishes `AKGL_VERSION_AT_LEAST(major, minor, patch)` — the
 compile-time test `libakstdlib` could not write against `libakerror` — and `akgl_version()`.
 
-**Version-pinning in `find_package` is asymmetric, and that is deliberate.**
+**Version-pinning in `find_package` used to be asymmetric. It no longer is.**
 `find_package(akstdlib 0.1)` and `find_package(akgl 0.1)` both work; each ships a
-`ConfigVersion.cmake` at `SameMinorVersion`, mirroring its soname. `find_package(akerror 1.0)`
+`ConfigVersion.cmake` at `SameMinorVersion`, mirroring its soname. `libakerror` shipped
-**fails against a correct install**, because `libakerror` ships `akerrorConfig.cmake` and
+`akerrorConfig.cmake` and `akerrorTargets.cmake` but no `akerrorConfigVersion.cmake`, so any
-`akerrorTargets.cmake` but no `akerrorConfigVersion.cmake`. Ask for `akerror` unversioned. Its
+versioned request failed against a correct install and the advice here was to ask for
-floor is enforced instead by an `#error` feature-testing `AKERR_FIRST_CONSUMER_STATUS`, which
+`akerror` unversioned. That was `libakerror` issue #16 — closed — and `libakstdlib` issue #5,
-`akstdlib.h`, `akgl/error.h` and our own `include/akbasic/error.h` all carry — include any of
+which tracks the same fix from the other side and is still open only because nobody has shut
-them and you inherit the guard. The missing version file is filed in
+it. It has landed: `libakerror` now writes `akerrorConfigVersion.cmake` at
-`libakstdlib` issue #5 and `libakerror` issue #16; when it lands, add the `1.0` floor to the `find_dependency`
+**`SameMajorVersion`**, matching the soname's major-only rule, rather than the
-calls.
+`SameMinorVersion` the other two use to match theirs.
+
+Two things follow, and the second is the one that bites:
+
+- **A versioned request now works** — but the floor to ask for is **`2.0`**, not the `1.0`
+  this file used to say. `find_package(akerror 1.0)` fails *harder* than before: it is a
+  request for major 1 against a major-2 install, which `SameMajorVersion` correctly rejects.
+- **There is nothing in this repository to change.** `akbasic` reaches all three dependencies
+  by `add_subdirectory`, not `find_package`, and ships no CMake package config of its own —
+  so it has no `find_dependency` calls to add a floor to. The instruction that used to live
+  here was written for a consumer this project never became. It matters to anyone *installing*
+  these libraries and linking `akbasic` against the installed copies, which is why it is
+  recorded rather than deleted.
+
+The compile-time floor is unchanged and still the real guard: an `#error` feature-testing
+`AKERR_FIRST_CONSUMER_STATUS`, which `akstdlib.h`, `akgl/error.h` and our own
+`include/akbasic/error.h` all carry — include any of them and you inherit it.
 
 ### Embedding all three dependencies collides four ways
 
@@ -250,14 +286,19 @@ CTest names. `libakstdlib` still uses bare `test_<name>` targets. **Name every t
 this repo `akbasic_test_<name>`** — it costs nothing and it is the collision that actually
 stopped a build.
 
-**3. Duplicate custom targets.** `libakerror` namespaces its `mutation` target when embedded
+**3. Duplicate custom targets — fixed upstream, and the workaround is gone.** `libakerror`
-but **not** its `coverage` target, so any coverage-enabled top-level build fails with *"another
+used to namespace its `mutation` target when embedded but **not** its `coverage` target, so
-target with the same name already exists"*. We shadow `add_custom_target` and rename that one
+any coverage-enabled top-level build failed with *"another target with the same name already
-to `akerror_coverage` on the way past. `libakstdlib` (both targets) and `libakgl` (its
+exists"*. This project shadowed `add_custom_target` and renamed that one to
-`mutation` target) namespace themselves correctly. **The real fix is upstream in
+`akerror_coverage` on the way past, and recorded the real fix as `libakerror` issue #15: the
-`libakerror`** — the same `CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR` test it already
+same `CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR` test it already applied to
-applies to `mutation` — and it is filed as `libakerror` issue #15. Delete the
+`mutation`.
-workaround when it lands.
+
+That landed in 2.0.2. `libakerror` now picks `akerror_coverage` itself when embedded, so the
+shadow was dead code that could only ever fire on a name the dependency had stopped using —
+and it is deleted. All three dependencies namespace both targets correctly now, so **there is
+no custom-target collision left**; only collisions 1, 2 and 4 below are live. The heading says
+four because four is what a reader coming from the issue tracker will be looking for.
 
 **4. Stale build trees poison the coverage report.** See below; it is the reason for
 `cmake -S . -B build`.
@@ -657,6 +698,26 @@ as a commit co-author, and this repository follows the same rule.
 Each dependency carries its own `AGENTS.md` with authoritative per-repo rules. Read the
 relevant one before editing a submodule.
 
+### Abandoned generators
+
+The one invariant generators (`GEN`/`EMIT`, `FOR EACH`/`DO EACH`) add to the environment
+pool: **a suspended generator hangs off its loop scope's `forGeneratorEnv` as a *child*,
+off the parent chain, so no walk up `->parent` ever finds it.** Any path that discards a
+loop scope — `EXIT`, a mismatched `NEXT`, a `LOOP` condition saying stop, an error unwind
+through `akbasic_runtime_pump_generator()` or `akbasic_runtime_call_function()` — must
+release that generator too, or its pool slot is stranded until the next `RUN`; with
+twelve slots, a loop that abandons a dozen of them kills the program with "Environment
+pool exhausted" far from the cause.
+
+Two functions own the invariant, and every discard path goes through one of them:
+`akbasic_runtime_release_generator()` (walks a detached generator chain up through its
+call frame, recursing into any `forGeneratorEnv` it passes) and
+`akbasic_runtime_unwind_to_environment()` (pops the *active* chain down to a target,
+releasing each popped scope's suspended generator on the way). If you add a new path
+that pops or discards environments, use one of these — a bare
+`akbasic_runtime_prev_environment()` loop reintroduces the leak, and
+`tests/generators.c` holds the pool-exhaustion tests that will say so.
+
 ---
 
 ## Editing the documentation

README.md

@@ -138,12 +138,13 @@ API documentation builds with `doxygen Doxyfile`, into `build/docs/html`.
 Everything is a submodule; `git submodule update --init --recursive` gets all of it. There is
 nothing to install first.
 
-* [libakerror](https://source.starfort.tech/andrew/libakerror) 2.0.1 — TRY/CATCH-style error
+* [libakerror](https://source.starfort.tech/andrew/libakerror) 2.0.2 — TRY/CATCH-style error
   contexts. Every function that can fail returns one. 2.0.0 made it thread safe and broke the
   ABI; anything built against a 1.x header must be rebuilt rather than relinked.
 * [libakstdlib](https://source.starfort.tech/andrew/libakstdlib) 0.2.0 — libc wrappers that
   report through `libakerror`. String-to-number conversion goes straight to it, which is why
-  `VAL("garbage")` is an error rather than a silent `0`.
+  `VAL("garbage")` is an error rather than a silent `0`. Its public header now also pulls in
+  `<dirent.h>` and `<sys/stat.h>` for the directory and file-metadata wrappers.
 * [libakgl](https://source.starfort.tech/andrew/libakgl) 0.9.0 — **optional**, only for
   `-DAKBASIC_WITH_AKGL=ON`. Pulls in SDL3. Its soname carries `MAJOR.MINOR` while the major is 0,
   so rebuild rather than relink.

TODO.md

@@ -366,6 +366,36 @@ One caveat survives the upgrade unchanged: `aksl_strhash_djb2` still sign-extend
 high-bit byte hashes differently from the `unsigned char` answer. BASIC identifiers are 7-bit
 ASCII so the symbol tables cannot reach it — see §1.3, which is still accurate.
 
+### 1.10 Generators share the `DEF` namespace, and the rest of their v1 semantics
+
+Decided with issue #57 and its review. `GEN` and `DEF` live in the same functions table —
+one lookup, one "unknown function" error path, a name cannot be both. What follows from
+that and from the review of PR #61, all settled:
+
+- A `GEN` called like a function (`X# = COUNTUP(3)`) is refused at the call, before
+  anything is pushed — `akbasic_FunctionDef.isGenerator` exists for exactly this check.
+- Bare `RETURN` standing in a `GEN`'s own frame ends the generator exactly as `END GEN`
+  does; `RETURN expr` there is an error, because values leave a `GEN` only through `EMIT`.
+  Both inherit the interpreter-wide restriction that `RETURN` does not unwind nested
+  `FOR`/`DO` scopes — lifting that everywhere (the C64 reference *does* unwind) is filed
+  separately.
+- `DO EACH ... LOOP WHILE c | UNTIL c` composes: the condition is checked after each trip,
+  with the loop variable still holding that trip's value, and stopping abandons the
+  generator exactly as `EXIT` does. A condition on the `DO EACH` line itself is a parse
+  error.
+- Self-recursion — a `GEN` reached again down its own parent chain — is refused; sibling
+  and nested invocations of the same `GEN` are each a fresh pool environment and are fine.
+- Every path that discards a `FOR EACH`/`DO EACH` scope must release the generator
+  suspended off it; see MAINTENANCE.md's "Abandoned generators" note for the invariant
+  and `akbasic_runtime_unwind_to_environment()` for the one primitive that enforces it.
+
+One known limitation, pre-existing and shared with `DEF`: `parse_def_parameters()` does
+not accept an empty parameter list, so `GEN NAME()` cannot be written — every generator
+takes at least one parameter whether it wants one or not. Location:
+`src/parser_commands.c`, `parse_def_parameters()`. Consequence: pointless parameters in
+programs. Blast radius: cosmetic, both `DEF` and `GEN` headers. Closure: teach the shared
+helper to accept `()`, one test each for `DEF` and `GEN`; filed as its own issue.
+
 ---
 
 ## 2. What exists — **the core port is complete and green**
@@ -2339,9 +2369,9 @@ Dependency baseline:
 
 | Submodule | Version | Notes |
 |---|---|---|
-| `deps/libakerror` | 2.0.1 | Private ownership-enforced status registry. akbasic reserves 512–767 in `akbasic_error_register()`. Does not namespace its `coverage` target when embedded — worked around in our `CMakeLists.txt`. **2.0.0 is thread safe and an ABI break** (`libakerror.so.2`): `__akerr_last_ignored` is thread-local and `akerr_next_error()` returns an owned reference, neither of which fails to link when mismatched. **2.0.1 fixes an exit status that mattered more to this band than to any other** — see below. |
+| `deps/libakerror` | 2.0.2 | Private ownership-enforced status registry. akbasic reserves 512–767 in `akbasic_error_register()`. **2.0.0 is thread safe and an ABI break** (`libakerror.so.2`): the `IGNORE` context is thread-local and `akerr_next_error()` returns an owned reference, neither of which fails to link when mismatched. **2.0.1 fixes an exit status that mattered more to this band than to any other** — see below. **2.0.2** namespaces its embedded `coverage` target (issue #15 — our `add_custom_target` shadow is deleted), installs `akerrorConfigVersion.cmake` at `SameMajorVersion` (issue #16), fixes the `AKERR_USE_STDLIB=OFF` build, retires `PATH_MAX` for `AKERR_MAX_ERROR_FNAME_LENGTH`, and turns the `IGNORE` slot into a released copy — `__akerr_last_ignored` was an `extern` pointer and is now a per-TU `static akerr_last_ignored`. **That last one costs us 1.35 MiB of thread-local storage**: 38 translation units x 37,296 bytes, measured as the whole TLS segment of `build/basic`, where 2.0.1 produced no TLS segment at all. Filed upstream as libakerror issue #37, along with the 84 `-Wunused-variable` warnings it emits. Its `UPGRADING.md` describes a 2.0.3 that `project()` never stamped — libakerror issue #38, which is why the version above reads 2.0.2. |
-| `deps/libakstdlib` | 0.2.0 | soname `libakstdlib.so.0.2`. `AKSL_VERSION_CHECK()` asserted in `tests/version_check.c`. This release fixed all six confirmed defects the port was working around — see §1.9, where the bans are now lifted. |
+| `deps/libakstdlib` | 0.2.0 | soname `libakstdlib.so.0.2`. `AKSL_VERSION_CHECK()` asserted in `tests/version_check.c`. This release fixed all six confirmed defects the port was working around — see §1.9, where the bans are now lifted. Since then, and with no version bump: **directory wrappers landed** (`aksl_opendir`/`readdir`/`closedir`/`rewinddir`, issue #10) — the gap `DIRECTORY` was refused for, so that refusal now says only that the verb is unwritten; file-metadata wrappers landed; and `aksl_snprintf` keeps its `int *count` but now reports the *required* length on truncation rather than 0. Only read on success here, so nothing moved. |
-| `deps/libakgl` | 0.7.0 | soname `libakgl.so.0.7`. Owns status codes 256–260. Linked and tested under `-DAKBASIC_WITH_AKGL=ON`, which still defaults OFF so the core library and its whole suite build on a machine with no SDL. **0.3.0 closed every API gap this port had filed** — see §7 — so the four workarounds §3 used to list are gone. 0.4.0 was a leak-and-overread release that changed no public struct. **0.5.0 is the first that broke our source as well as our ABI**: it namespaced every exported symbol, so `akgl_render_bind2d` is `akgl_render_2d_bind`, `akgl_sprite_sheet_coords_for_frame` is `akgl_spritesheet_coords_for_frame`, the `renderer`/`camera`/`window` globals carry the prefix, and `_akgl_renderer`/`_akgl_camera` are `akgl_default_renderer`/`akgl_default_camera`. `include/akbasic/akgl.h` asserts the floor. **0.6.0 and 0.7.0 broke nothing here** — 0.6.0 is three arcade-physics fixes and a `physics.max_timestep` property this port does not use, and 0.7.0 reports failures `libakstdlib`'s wrappers were already catching and takes `libakerror` 2.0.1. The floor moved anyway, because deciding for ourselves which of libakgl's minor releases were really compatible is the judgement the soname exists to take away. |
+| `deps/libakgl` | 0.9.0 | soname `libakgl.so.0.9`. Owns status codes 256–262. Linked and tested under `-DAKBASIC_WITH_AKGL=ON`, which still defaults OFF so the core library and its whole suite build on a machine with no SDL. **0.3.0 closed every API gap this port had filed** — see §7 — so the four workarounds §3 used to list are gone. 0.4.0 was a leak-and-overread release that changed no public struct. **0.5.0 is the first that broke our source as well as our ABI**: it namespaced every exported symbol, so `akgl_render_bind2d` is `akgl_render_2d_bind`, `akgl_sprite_sheet_coords_for_frame` is `akgl_spritesheet_coords_for_frame`, the `renderer`/`camera`/`window` globals carry the prefix, and `_akgl_renderer`/`_akgl_camera` are `akgl_default_renderer`/`akgl_default_camera`. `include/akbasic/akgl.h` asserts the floor. **0.6.0 and 0.7.0 broke nothing here** — 0.6.0 is three arcade-physics fixes and a `physics.max_timestep` property this port does not use, and 0.7.0 reports failures `libakstdlib`'s wrappers were already catching and takes `libakerror` 2.0.1. **0.8.0 and 0.9.0 broke nothing here either** — 0.8.0 is the collision subsystem (`AKGL_ERR_COLLISION`, code 261, and the vendored `libccd` and `tg` submodules that come with it), and 0.9.0 is the `akgl_ui` subsystem (`AKGL_ERR_UI`, code 262, and vendored `clay`), which is what `src/ui_akgl.c` draws through. Both widen libakgl's reserved band from five codes to seven; the range map in `MAINTENANCE.md` carries it. The floor moved anyway, because deciding for ourselves which of libakgl's minor releases were really compatible is the judgement the soname exists to take away. **Note `deps/libakgl/deps/` pins its own `libakerror` and `libakstdlib` older than ours**; the top-level build declares both targets first and libakgl's `if(NOT TARGET ...)` guards mean its copies are never configured, so what libakgl actually compiles against is what this tree pins. |
 
 **An unhandled error in this band used to exit zero, and 512 is the worst possible base for
 that.** `libakerror`'s default unhandled-error handler ended in `exit(errctx->status)`, and a

docs/04-control-flow.md

@@ -146,6 +146,143 @@ condition at all loops forever until an `EXIT` or a `GOTO` leaves it.
 
 `EXIT` works here too.
 
+## GEN ... EMIT and FOR EACH / DO EACH
+
+A `GEN` is a subroutine that hands back more than one value, one at a time, instead of
+returning once. It looks like a multi-line `DEF`, except its body runs `EMIT` where a
+function would `RETURN`, and it ends in `END GEN` rather than `RETURN`:
+
+```basic
+10 GEN COUNTUP(N#)
+20     FOR I# = 1 TO N#
+30         EMIT I#
+40     NEXT I#
+50 END GEN
+60 FOR EACH V# IN COUNTUP(3)
+70     PRINT V#
+80 NEXT V#
+```
+
+```output
+1
+2
+3
+```
+
+`FOR EACH` is what runs a `GEN`: it calls `COUNTUP(3)` the way `FOR EACH V# IN` says,
+and each `EMIT` inside the generator's body becomes one trip through the loop, with `V#`
+holding whatever was emitted. When the generator's body reaches `END GEN` with nothing
+left to emit, the loop ends -- there is no separate "no more values" check to write.
+
+`DO EACH ... LOOP` does the same thing:
+
+```basic
+10 GEN COUNTUP(N#)
+20     FOR I# = 1 TO N#
+30         EMIT I#
+40     NEXT I#
+50 END GEN
+60 DO EACH V# IN COUNTUP(3)
+70     PRINT V#
+80 LOOP
+```
+
+```output
+1
+2
+3
+```
+
+A `GEN`'s body is ordinary BASIC: it may hold its own `FOR`, `DO`, `IF` or `GOSUB`
+around the `EMIT`s, and even invoke another `GEN` with its own `FOR EACH`/`DO EACH` --
+the same generator invoked with different arguments, nested or side by side, is not
+recursion. A `GEN` invoking *itself* from within its own currently-running body is
+refused: unlike a function call, which runs to completion and returns, the outer
+invocation is suspended mid-body waiting on the same loop, and there is no answer to
+"which EMIT feeds which loop" that is not a surprise.
+
+`EXIT` leaves a `FOR EACH`/`DO EACH` loop early, exactly as it does a plain `FOR` or
+`DO`, and the generator it was consuming stops there -- nothing forces the rest of it to
+run just because the loop started it:
+
+```basic
+10 GEN COUNTUP(N#)
+20     FOR I# = 1 TO N#
+30         EMIT I#
+40     NEXT I#
+50 END GEN
+60 FOR EACH V# IN COUNTUP(100)
+70     PRINT V#
+80     IF V# = 3 THEN EXIT
+90 NEXT V#
+100 PRINT "STOPPED"
+```
+
+```output
+1
+2
+3
+STOPPED
+```
+
+`RETURN` ends a `GEN` from the inside, exactly as it ends a multi-line `DEF` or a
+`GOSUB`: the generator is done, the loop consuming it ends, and the program carries on
+after the loop. What a generator's `RETURN` cannot do is carry a value -- values leave
+a `GEN` one at a time, through `EMIT`, and `RETURN 99` inside one is an error. Like a
+`GOSUB`'s or a `DEF`'s, the `RETURN` must stand in the `GEN`'s own scope: from inside
+a `FOR` or `DO` the body opened, it is an error, though `IF ... THEN RETURN` is fine
+because `IF` opens no scope of its own.
+
+```basic
+10 GEN FIRSTFEW(N#)
+20     EMIT 1
+30     IF N# < 2 THEN RETURN
+40     EMIT 2
+50     IF N# < 3 THEN RETURN
+60     EMIT 3
+70 END GEN
+80 FOR EACH V# IN FIRSTFEW(2)
+90     PRINT V#
+100 NEXT V#
+110 PRINT "DONE"
+```
+
+```output
+1
+2
+DONE
+```
+
+A `DO EACH`'s `LOOP` may carry a `WHILE` or `UNTIL`, and the two compose: the condition
+is checked after each trip through the body, with the loop variable still holding that
+trip's value, and a condition that says stop abandons the rest of the generator exactly
+as `EXIT` does. The condition belongs on the `LOOP` -- putting it on the `DO` line is
+an error, since the `DO` line already says what the loop consumes.
+
+```basic
+10 GEN COUNTUP(N#)
+20     FOR I# = 1 TO N#
+30         EMIT I#
+40     NEXT I#
+50 END GEN
+60 DO EACH V# IN COUNTUP(10)
+70     PRINT V#
+80 LOOP UNTIL V# = 3
+90 PRINT "STOPPED"
+```
+
+```output
+1
+2
+3
+STOPPED
+```
+
+A `GEN` shares its namespace with `DEF` -- the same name cannot be both -- but it is not
+a function and cannot be called like one: `X# = COUNTUP(3)` is refused, because nothing
+about an ordinary call means "resume where the last `EMIT` left off." `FOR EACH`/`DO
+EACH` is the only thing that consumes a `GEN`.
+
 ## GOTO and GOSUB
 
 ```basic

docs/09-files-and-disk.md

@@ -126,7 +126,7 @@ exists, and reading into one you never sized writes over something else.
 | `COLLECT` | validates a disk's block allocation map. There is no map |
 | `BACKUP` | duplicates one disk onto another. There are no disks |
 | `BOOT` | loads and runs a boot sector. There is no boot sector |
-| `DIRECTORY` / `CATALOG` | needs a directory-reading wrapper the standard library does not have yet. Filed upstream |
+| `DIRECTORY` / `CATALOG` | not written yet. It was blocked on a directory-reading wrapper in the standard library; that landed, so only the verb is outstanding |
 
 `DCLEAR` is the exception among the drive verbs: resetting a drive also closes its
 channels, and closing the channels is real, so that is what it does.

docs/11-verb-reference.md

@@ -35,19 +35,22 @@ for the reasoning in each case.
 | `DIALOG` | `DIALOG ["text"]` | Show a text panel across the bottom of the screen. No argument takes it down. See Chapter 19. |
 | `DIM` | `DIM A#(n [,...])` | Make an array. Subscripts start at zero; `n` is the count. |
 | `DIM` … `AS` | `DIM S@ AS T`, `DIM P@ AS PTR TO T` | Make a structure, or a strict pointer to one. See Chapter 16. |
-| `DIRECTORY` | `DIRECTORY` | **Refused.** Needs a directory-reading wrapper that does not exist yet. |
+| `DIRECTORY` | `DIRECTORY` | **Refused.** Not written yet; the standard-library wrapper it waited on has landed. |
 | `DLOAD` | `DLOAD "name"` | Load a program from a file. |
-| `DO` | `DO [WHILE c | UNTIL c]` | Start a loop. The condition may be here, on the `LOOP`, or neither. |
+| `DO` | `DO [WHILE c | UNTIL c]`, `DO EACH V IN gen(args)` | Start a loop. The condition may be here, on the `LOOP`, or neither. `EACH` consumes a `GEN` instead, and takes its condition only on the `LOOP`; see Chapter 4. |
 | `DOPEN` | `DOPEN n, "name" [,W]` | Open a file on channel `n`. `W` opens it for writing. |
 | `DRAW` | `DRAW src, x, y [TO x, y ...]` | Plot a point or draw a polyline. |
 | `DSAVE` | `DSAVE "name"` | Save the program to a file. |
 | `DVERIFY` | `DVERIFY "name"` | The other name for `VERIFY`. |
+| `EMIT` | `EMIT expr` | Yield one value from a `GEN` body. Only valid inside one; see Chapter 4. |
 | `END` | `END` | Stop the program. Does not arm `CONT`. |
+| `END GEN` | `END GEN` | Close a `GEN` body, the way `RETURN` closes a multi-line `DEF`. |
 | `ENVELOPE` | `ENVELOPE n, a, d, s, r` | Define one of `PLAY`'s ten envelope presets. |
-| `EXIT` | `EXIT` | Leave the innermost `FOR` or `DO` loop. |
+| `EXIT` | `EXIT` | Leave the innermost `FOR`, `FOR EACH`, `DO` or `DO EACH` loop. |
 | `FETCH` | `FETCH count, from, to` | Copy bytes. The same as `STASH`; there is no expansion RAM. |
 | `FILTER` | `FILTER ...` | **Refused.** There is no filter stage in the audio backend. |
-| `FOR` | `FOR V = a TO b [STEP c]` | Start a counted loop, ended by `NEXT`. |
+| `FOR` | `FOR V = a TO b [STEP c]`, `FOR EACH V IN gen(args)` | Start a counted loop, ended by `NEXT`. `EACH` consumes a `GEN` instead; see Chapter 4. |
+| `GEN` | `GEN NAME(args) ... END GEN` | Define a generator: a subroutine that yields more than once via `EMIT`, consumed by `FOR EACH`/`DO EACH`. See Chapter 4. |
 | `GET` | `GET V` | Take a keystroke if one is waiting, without stopping. |
 | `GETKEY` | `GETKEY V` | Wait for a keystroke, holding the program but not the host. |
 | `GETMENU` | `GETMENU n, V%` | Wait for a menu choice, holding the program but not the host. Assigns the entry number. See Chapter 19. |
@@ -67,11 +70,11 @@ for the reasoning in each case.
 | `LIST` | `LIST [n][-n]` | List the program, or part of it. |
 | `LOAD` | `LOAD "name"` | The other name for `DLOAD`. |
 | `LOCATE` | `LOCATE x, y` | Move the pixel cursor. |
-| `LOOP` | `LOOP [WHILE c | UNTIL c]` | End a `DO` loop. |
+| `LOOP` | `LOOP [WHILE c | UNTIL c]` | End a `DO` loop, including a `DO EACH`. |
 | `MENU` | `MENU [n [,"item", ...]]` | Show a menu the player picks from. No entries retires it; no arguments retire them all. See Chapter 19. |
 | `MOVSPR` | `MOVSPR n, ...` | Move a sprite. Four forms; see Chapter 8. |
 | `NEW` | `NEW` | Erase the program and every variable. |
-| `NEXT` | `NEXT V` | End a `FOR` loop and advance its counter. |
+| `NEXT` | `NEXT V` | End a `FOR` loop and advance its counter, or resume a `FOR EACH` for its next value. |
 | `ON` | `ON e GOTO|GOSUB t [,...]` | Branch to the `e`th target, counting from one. |
 | `PAINT` | `PAINT src, x, y` | Flood-fill the region containing a point. |
 | `PLAY` | `PLAY "notes"` | Queue notes. Does not block. |
@@ -87,7 +90,7 @@ for the reasoning in each case.
 | `RENUMBER` | `RENUMBER [start [,step [,from]]]` | Renumber lines, rewriting every branch to match. |
 | `RESTORE` | `RESTORE [line]` | Reset the `READ` cursor, optionally to a line. |
 | `RESUME` | `RESUME [NEXT | line]` | Return from a `TRAP` handler. |
-| `RETURN` | `RETURN [expr]` | Return from a `GOSUB` or a multi-line `DEF`. |
+| `RETURN` | `RETURN [expr]` | Return from a `GOSUB` or a multi-line `DEF`. Inside a `GEN`, a bare `RETURN` ends the generator early; `RETURN expr` there is an error. |
 | `RUN` | `RUN [line]` | Run the program, optionally from a line. |
 | `SAVE` | `SAVE "name"` | The other name for `DSAVE`. |
 | `SCALE` | `SCALE on [,xmax, ymax]` | Turn user coordinates on or off. |

docs/13-differences.md

@@ -199,7 +199,8 @@ interpreter's error code, which bears no relation to a Commodore error number. P
 - **`BLOAD` requires a length.**
 - **`HEADER`, `COLLECT`, `BACKUP` and `BOOT` are refused.** They operate on a physical
   disk.
-- **`DIRECTORY` is refused** pending a wrapper in the standard library.
+- **`DIRECTORY` is refused** because it is not written yet. The standard-library
+  wrapper it was waiting on has landed, so the remaining work is the verb.
 
 ## Machine
 

docs/14-architecture.md

@@ -407,6 +407,8 @@ block structure is executing: the `FOR` bounds and step, the `DO`/`LOOP` conditi
 | `GOSUB` | `RETURN` |
 | A call to a multi-line user function | that function's `RETURN` |
 | An interrupt firing | the handler's `RETURN` |
+| `FOR EACH`/`DO EACH` — the loop's own scope, during parsing | the `NEXT`/`LOOP` that finds the generator exhausted, or an `EXIT` |
+| A `FOR EACH`/`DO EACH` invoking a `GEN` | `END GEN` reached for real, or the loop's own abandonment |
 
 That `FOR` entry is not a typo. `akbasic_parse_for()` pushes the new environment while
 parsing the line, parks `TO` and `STEP` in it as unevaluated leaves, and makes it active
@@ -454,6 +456,59 @@ Three consequences follow, and all three are things people report as bugs:
   the value correctly inside the loop and gets `0` immediately after it, with nothing
   raised anywhere.
 
+### Generators: a scope that outlives the verb that pushed it
+
+Everything above pops a scope by *releasing* it — `akbasic_runtime_prev_environment()`
+gives its variables and its own pool slot back in the same motion that hands control to
+its parent. A `GEN` needed a third option, because `EMIT` has to survive being
+"returned" from: the next value comes from resuming exactly where the last `EMIT` left
+off, not from starting over.
+
+`akbasic_runtime_prev_environment()` is now built from two smaller pieces:
+
+- `akbasic_runtime_detach_environment()` — moves `obj->environment` to the parent,
+  *without* releasing anything.
+- `akbasic_runtime_release_environment()` — gives a scope's variables and pool slot
+  back, callable on a scope that is not necessarily the active one.
+
+A `FOR EACH`/`DO EACH` invocation therefore holds **two** environments at once, for as
+long as the loop is running:
+
+```text
+loop environment (isEachLoop)          <- pushed like a plain FOR/DO's, at parse time
+    forGeneratorEnv -----------> generator environment (isGenerator)
+                                      <- pushed once, by akbasic_runtime_generator_invoke(),
+                                         and never released until the generator is
+                                         exhausted or abandoned
+```
+
+`EMIT` finds its generator environment by walking *up* from wherever it is actually
+standing — a `GEN` body is ordinary BASIC and may nest its own `FOR`, `DO` or `GOSUB`
+around an `EMIT`, each pushing scopes of its own — to the nearest ancestor with
+`isGenerator` set. It assigns the emitted value into the loop's `forNextVariable`,
+records *exactly* where it is standing (which may be several environments below the
+generator's own call frame) as `forGeneratorEnv`, and moves `obj->environment` straight
+to the loop environment — detaching, not popping, so every environment between the two
+survives untouched.
+
+`NEXT`/`LOOP` reactivate a suspended generator by setting `obj->environment` back to
+`forGeneratorEnv` and driving the step loop (`akbasic_runtime_pump_generator()`) until
+either another `EMIT` detaches it again or `END GEN` is reached for real — meaning
+`isGenerator` is set and nothing is skipping forward to it, exactly the same test
+`RETURN` makes for a multi-line `DEF`. Real exhaustion releases the generator
+environment (`akbasic_runtime_prev_environment()`, same as anything else that pops) and
+clears `forGeneratorEnv`, which is what tells the loop apart from one still waiting to
+resume.
+
+**Abandoning a live generator has to release it explicitly.** `EXIT` out of a `FOR
+EACH`/`DO EACH` pops the loop environment the same way it always has, but a generator
+paused mid-run is not on that direct parent chain from the loop back to the root — it
+hangs off `forGeneratorEnv` instead, possibly several environments deep if `EMIT` last
+ran inside a nested `FOR`/`DO` in the `GEN`'s own body. `akbasic_runtime_release_generator()`
+is what walks that chain and releases all of it; every place that pops a `FOR EACH`/`DO
+EACH` loop out from under a live generator calls it first, or the pool leaks one
+generator at a time.
+
 ## Values
 
 `akbasic_Value` carries its string **inline**, not behind a pointer, so a copy is a struct

docs/17-tutorial-breakout.md

@@ -1049,17 +1049,17 @@ every program. It remains a useful from-scratch PRNG example:
 ```basic norun
 SEED# = 12345
 RMAX# = 6
-RND# = 0
+ROLL# = 0
 I# = 0
 FOR I# = 1 TO 5
   GOSUB RANDOM
-  PRINT "ROLL " + (RND# + 1)
+  PRINT "ROLL " + (ROLL# + 1)
 NEXT I#
 END
 
 LABEL RANDOM
 SEED# = MOD(((SEED# * 1103515245) + 12345), 2147483648)
-RND# = MOD((SEED# / 65536), RMAX#)
+ROLL# = MOD((SEED# / 65536), RMAX#)
 RETURN
 ```
 

docs/21-tutorial-galaga-enemies.md

@@ -20,7 +20,7 @@ whole development loop; the engine never rebuilds.
 - **[Step 2](#step-2-bind-the-engines-own-actor)** — bind the engine's own
   actor as the second type, which is the point of the whole exercise
 - **[Step 3](#step-3-share-the-frame-and-the-dice)** — share the frame state,
-  and give the script randomness it cannot make itself
+  and hand the script dice the engine controls
 - **[Step 4](#step-4-why-bindings-and-not-arguments)** — see why the structures
   are bindings rather than function arguments
 - **[Step 5](#step-5-the-shape-of-the-script)** — learn the three language
@@ -75,7 +75,7 @@ typedef struct galaga_Enemy
     float    t;		/* parametric clock for the current maneuver	*/
     int32_t  hp;
     int32_t  fire;	/* outbox: script sets 1, engine consumes	*/
-    float    rnd;	/* inbox: engine writes fresh 0..1 each call	*/
+    float    rnd;	/* inbox: fresh 0..1 each call; ROLL% in BASIC	*/
 } galaga_Enemy;
 ```
 
@@ -107,7 +107,7 @@ static const akbasic_HostField ENEMY_FIELDS[] = {
     AKBASIC_HOST_FIELD( galaga_Enemy, t,      "T%",       AKBASIC_HOSTFIELD_FLOAT ),
     AKBASIC_HOST_FIELD( galaga_Enemy, hp,     "HP#",      AKBASIC_HOSTFIELD_INT32 ),
     AKBASIC_HOST_FIELD( galaga_Enemy, fire,   "FIRE#",    AKBASIC_HOSTFIELD_INT32 ),
-    AKBASIC_HOST_FIELD( galaga_Enemy, rnd,    "RND%",     AKBASIC_HOSTFIELD_FLOAT )
+    AKBASIC_HOST_FIELD( galaga_Enemy, rnd,    "ROLL%",    AKBASIC_HOSTFIELD_FLOAT )
 };
 static const akbasic_HostType ENEMY_TYPE = {
     "ENEMY", sizeof(galaga_Enemy), ENEMY_FIELDS, 8
@@ -194,7 +194,7 @@ typedef struct galaga_Shared
     float    playerx;	/* the player actor's position, this frame	*/
     float    playery;
     int32_t  wave;
-    float    rnd;	/* fresh 0..1 each frame; the issue #16 route	*/
+    float    rnd;	/* fresh 0..1 each frame; ROLL% to the script	*/
 } galaga_Shared;
 ```
 
@@ -203,13 +203,24 @@ the engine refreshes it at the top of every frame. The boss reads
 `GAME@.PLAYERX%` to lead its dive; the fire decision reads it to know whether
 anything is worth shooting at.
 
-The `rnd` fields — one here per frame, one on each enemy per call — exist
+The `rnd` fields — one here per frame, one on each enemy per call — carry the
-because the engine's PRNG is the script's **only** source of randomness: write
+engine's PRNG into the script: write `SELF@.ROLL% < DT% * 1.5` and an enemy's
-`SELF@.RND% < DT% * 1.5` and an enemy's trigger finger is a dice roll. There
+trigger finger is a dice roll.
-is no `RND` verb in this dialect; issue #16 tracks adding one, and Chapter
+
-17's breakout hand-rolls a linear congruential generator in BASIC as the other
+The dialect does now have a native `RND` function — issue #16 closed, and
-route. Here the engine fills the field, which also keeps a headless run the
+[Chapter 12](12-function-reference.md) documents it — so this is no longer the
-same game on every machine — the PRNG is the example's own, not libc's.
+*only* route; Chapter 17's breakout hand-rolls a linear congruential generator
+in BASIC as a third. The engine keeps filling the field here on purpose,
+because it buys something `RND` cannot: the numbers come from the example's own
+PRNG rather than libc's, so a headless run is the same game on every machine,
+which is what makes `example_galaga` a test and not just a demo.
+
+**The BASIC name is `ROLL%`, not `RND%`.** A host field is a bare word and
+shares a namespace with every verb and function, so once `RND` became a
+function name a field could no longer be called that — the scanner refuses it
+with *"Reserved word in variable name"*. The C member stays `rnd`; only the
+name the script sees had to move. [Chapter 16](16-structures.md) has the same
+rule for `TYPE` declarations.
 
 ## Step 4: Why bindings, and not arguments
 
@@ -351,7 +362,7 @@ DEF DECIDEFIRE(DT%)
   DX% = GAME@.PLAYERX% - ACTOR@.X%
   IF ABS(DX%) > 140 THEN RETURN 0
   IF ACTOR@.Y% > GAME@.PLAYERY% THEN RETURN 0
-  IF SELF@.RND% < DT% * 1.5 THEN SELF@.FIRE# = 1
+  IF SELF@.ROLL% < DT% * 1.5 THEN SELF@.FIRE# = 1
   RETURN 0
 END
 ```
@@ -386,7 +397,7 @@ DEF UPDATEBEE(DT%)
   IF (S# AND 2) > 0 THEN BEGIN
     ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 1.7) * 16
     ACTOR@.Y% = SELF@.HOMEY%
-    IF SELF@.RND% < DT% * 0.04 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+    IF SELF@.ROLL% < DT% * 0.04 THEN SELF@.STATE# = 4 : SELF@.T% = 0
   BEND
   IF (S# AND 4) > 0 THEN BEGIN
     R# = DIVESTEP(DT%, 130, 0.2)

examples/breakout/characters/breakout.bas

@@ -145,7 +145,7 @@ RX# = 0
 N# = 0
 MROW# = 0
 RMAX# = 2
-RND# = 0
+ROLL# = 0
 SND# = 0
 P$ = ""
 H$ = ""
@@ -172,7 +172,8 @@ BSG$(4) = "[--]"
 BSG$(5) = "[--]"
 
 REM --- the seed -------------------------------------------------------
-REM There is no RND in this dialect. TI# is jiffies off the host's clock
+REM RND exists now, but this program keeps its own LCG so a headless run
+REM is the same game every time. TI# is jiffies off the host's clock
 REM and is host uptime rather than zero-based, which makes it a fine seed.
 SEED# = TI#
 
@@ -389,17 +390,18 @@ BY# = PY# - 10
 RMAX# = 2
 GOSUB RANDOM
 BVX# = BSPD#
-IF RND# = 0 THEN BVX# = 0 - BSPD#
+IF ROLL# = 0 THEN BVX# = 0 - BSPD#
 BVY# = 0 - BSPD#
 PDEC# = 0
 GOSUB SHOWSPR
 RETURN
 
-REM A linear congruential generator, because this dialect has no RND.
+REM A linear congruential generator. RND(n) would do this in one token
+REM now; the LCG stays because its sequence is reproducible.
 REM The multiply stays inside int64 for any seed under 2^31.
 LABEL RANDOM
 SEED# = MOD(((SEED# * 1103515245) + 12345), 2147483648)
-RND# = MOD((SEED# / 65536), RMAX#)
+ROLL# = MOD((SEED# / 65536), RMAX#)
 RETURN
 
 REM ####################################################################
@@ -632,7 +634,7 @@ NUDGE# = 0
 STALL# = 0
 RMAX# = 4
 GOSUB RANDOM
-BVX# = (RND# * 3) - 6
+BVX# = (ROLL# * 3) - 6
 IF BVX# = 0 THEN BVX# = 3
 RETURN
 
@@ -641,7 +643,7 @@ REM like something with a hand on the paddle rather than a mirror.
 LABEL DEMOAIM
 RMAX# = 81
 GOSUB RANDOM
-DOFF# = RND# - 40
+DOFF# = ROLL# - 40
 RETURN
 
 REM ####################################################################

examples/breakout/sprites/breakout.bas

@@ -241,7 +241,8 @@ SLX# = 0
 SLY# = 0
 SLI# = 0
 REM The two eraser stamps. Declared here for exactly the same reason -- built
-REM inside DRAWPROTOS and left undeclared, they were SHAPE:6 and SHAPE:7 inside
+REM inside DRAWPROTOS and left undeclared, they were SHAPE:6 and SHAPE:7
+REM inside
 REM it and empty everywhere else.
 BL$ = ""
 HBL$ = ""
@@ -254,10 +255,13 @@ REM cursor through every DATA item in the program in the order they appear
 REM in the file, so whichever loader runs first gets the DATA that is
 REM written first. The tables are written first.
 REM The text layer repaints every row it owns, opaque, so it has to be moved
-REM out of the way before anything drawn can be seen. Two rows at the bottom is
+REM out of the way before anything drawn can be seen. Two rows at the bottom
+REM is
 REM enough for the final score, and hands the other thirty-five to the drawing
-REM verbs. Everything this game draws then simply stays there -- a drawing goes
+REM verbs. Everything this game draws then simply stays there -- a drawing
-REM into a layer the frame composites, so nothing here is captured into a sprite
+REM goes
+REM into a layer the frame composites, so nothing here is captured into a
+REM sprite
 REM and nothing is redrawn every frame.
 WINDOW 0, 35, 49, 36
 
@@ -293,7 +297,8 @@ ENVELOPE 0, 0, 6, 0, 4
 TEMPO 12
 
 COLLISION 2, BRICKHIT
-REM The stamps, once. They used to be rebuilt whenever the SSHAPE pool ran dry,
+REM The stamps, once. They used to be rebuilt whenever the SSHAPE pool ran
+REM dry,
 REM because every frame's capture spent another slot; nothing captures now, so
 REM eight slots are spent here and never again.
 GOSUB DRAWPROTOS
@@ -374,7 +379,8 @@ COLOR 1, 1
 FOR K# = 0 TO 15
   DRAW 1, 0, 130 + K# TO 67, 130 + K#
 NEXT K#
-REM And an eighth the width of the HUD strip, for the same reason: the strip is
+REM And an eighth the width of the HUD strip, for the same reason: the strip
+REM is
 REM rewritten whenever a number in it changes, and the old digits have to go
 REM somewhere first.
 FOR K# = 0 TO 59
@@ -393,7 +399,8 @@ DPLAY# = 1
 DHUD# = 1
 RETURN
 
-REM Take one brick off the screen: stamp the blank over it. Called when a brick
+REM Take one brick off the screen: stamp the blank over it. Called when a
+REM brick
 REM breaks, so the field is never redrawn as a whole during play -- which is
 REM what lets the whole live-list machinery go.
 LABEL ERASEBRICK
@@ -444,7 +451,8 @@ WIDTH 1
 COLOR 0, 1 : COLOR 1, 4 : COLOR 2, 8 : COLOR 3, 5
 COLOR 4, 11 : COLOR 5, 16 : COLOR 6, 6
 REM The old strip goes first. Nothing here clears the screen -- a drawing
-REM stays, which is the whole point -- so the digits that were there have to be
+REM stays, which is the whole point -- so the digits that were there have to
+REM be
 REM stamped over before the new ones are drawn.
 Z$ = HBL$
 GSHAPE Z$, 0, 0
@@ -495,7 +503,10 @@ IF SNDON# = 0 THEN VOL 0
 RETURN
 
 LABEL PRESSPAUSE
-IF STATE# = 2 THEN STATE# = 6 : GMTYP# = 0 : BAN$ = "PAUSED" : GOSUB SETBANNER : RETURN
+IF STATE# <> 2 THEN GOTO PRESSPAUSE2
+STATE# = 6 : GMTYP# = 0 : BAN$ = "PAUSED" : GOSUB SETBANNER
+RETURN
+LABEL PRESSPAUSE2
 IF STATE# = 6 THEN STATE# = 2 : BAN$ = "" : GOSUB SETBANNER
 RETURN
 

examples/galaga/enemies.c

@@ -71,10 +71,15 @@ static char *ENEMY_CHARACTER[GALAGA_ENEMY_KINDS] = {
 /* --------------------------------------------------------------- random --- */
 
 /*
- * No RND verb exists (issue #16), so the engine is the script's only source
+ * The engine is this script's source of randomness: it refreshes GAME@.ROLL%
- * of randomness: it refreshes GAME@.RND% each frame and SELF@.RND% each call
+ * each frame and SELF@.ROLL% each call from this PRNG. A hand-rolled LCG
- * from this PRNG. A hand-rolled LCG rather than rand() so a headless run is
+ * rather than rand() so a headless run is the same game on every libc, which
- * the same game on every libc.
+ * is what lets interop_test.c assert exact counts. The dialect gained a native
+ * RND (issue #16) after this example was written; the field stays because RND
+ * would reintroduce exactly the per-machine variation this avoids.
+ *
+ * The BASIC-visible name is ROLL%, not RND%: host field names share a
+ * namespace with verbs and functions, so RND stopped being available as one.
  */
 static uint32_t PRNG_STATE = 0x12345678u;
 

examples/galaga/galaga.bas

@@ -50,7 +50,7 @@ DEF DECIDEFIRE(DT%)
   DX% = GAME@.PLAYERX% - ACTOR@.X%
   IF ABS(DX%) > 140 THEN RETURN 0
   IF ACTOR@.Y% > GAME@.PLAYERY% THEN RETURN 0
-  IF SELF@.RND% < DT% * 1.5 THEN SELF@.FIRE# = 1
+  IF SELF@.ROLL% < DT% * 1.5 THEN SELF@.FIRE# = 1
   RETURN 0
 
 REM Bee: enter, breathe in formation, occasionally dive nearly straight.
@@ -65,7 +65,7 @@ DEF UPDATEBEE(DT%)
   IF (S# AND 2) > 0 THEN BEGIN
     ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 1.7) * 16
     ACTOR@.Y% = SELF@.HOMEY%
-    IF SELF@.RND% < DT% * 0.04 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+    IF SELF@.ROLL% < DT% * 0.04 THEN SELF@.STATE# = 4 : SELF@.T% = 0
   BEND
   IF (S# AND 4) > 0 THEN BEGIN
     R# = DIVESTEP(DT%, 130, 0.2)
@@ -85,7 +85,7 @@ DEF UPDATEBFLY(DT%)
   IF (S# AND 2) > 0 THEN BEGIN
     ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 2.1) * 24
     ACTOR@.Y% = SELF@.HOMEY%
-    IF SELF@.RND% < DT% * 0.05 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+    IF SELF@.ROLL% < DT% * 0.05 THEN SELF@.STATE# = 4 : SELF@.T% = 0
   BEND
   IF (S# AND 4) > 0 THEN BEGIN
     R# = DIVESTEP(DT%, 260, 0.1)
@@ -108,7 +108,7 @@ DEF UPDATEBOSS(DT%)
   IF (S# AND 2) > 0 THEN BEGIN
     ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 1.1) * 10
     ACTOR@.Y% = SELF@.HOMEY%
-    IF SELF@.RND% < DT% * 0.03 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+    IF SELF@.ROLL% < DT% * 0.03 THEN SELF@.STATE# = 4 : SELF@.T% = 0
   BEND
   IF (S# AND 4) > 0 THEN BEGIN
     R# = DIVESTEP(DT%, 60, 0.9)

examples/galaga/galaga.h

@@ -77,7 +77,7 @@ typedef struct galaga_Enemy
     float    t;		/* parametric clock for the current maneuver	*/
     int32_t  hp;
     int32_t  fire;	/* outbox: script sets 1, engine consumes	*/
-    float    rnd;	/* inbox: engine writes fresh 0..1 each call	*/
+    float    rnd;	/* inbox: fresh 0..1 each call; ROLL% in BASIC	*/
 } galaga_Enemy;
 
 /** @brief Frame state every enemy may read. Bound once as GAME@. */
@@ -86,7 +86,7 @@ typedef struct galaga_Shared
     float    playerx;	/* the player actor's position, this frame	*/
     float    playery;
     int32_t  wave;
-    float    rnd;	/* fresh 0..1 each frame; the issue #16 route	*/
+    float    rnd;	/* fresh 0..1 each frame; ROLL% to the script	*/
 } galaga_Shared;
 
 /* --------------------------------------------------------------- screens --- */

examples/galaga/main.c

@@ -491,7 +491,8 @@ static akerr_ErrorContext *frame(bool *running)
     }
 
     /* The shared frame state, refreshed before any enemy thinks. The engine
-     * filling GAME@.RND% is the issue #16 route: no RND verb exists. */
+     * fills GAME@.ROLL% from its own PRNG rather than letting the script call
+     * the native RND, so a headless run is the same game on every machine. */
     galaga_shared.playerx = galaga_game.player->x + 50.0f;
     galaga_shared.playery = galaga_game.player->y;
     galaga_shared.rnd = galaga_random();

examples/galaga/script.c

@@ -62,7 +62,7 @@ static const akbasic_HostField ENEMY_FIELDS[] = {
     AKBASIC_HOST_FIELD( galaga_Enemy, t,      "T%",       AKBASIC_HOSTFIELD_FLOAT ),
     AKBASIC_HOST_FIELD( galaga_Enemy, hp,     "HP#",      AKBASIC_HOSTFIELD_INT32 ),
     AKBASIC_HOST_FIELD( galaga_Enemy, fire,   "FIRE#",    AKBASIC_HOSTFIELD_INT32 ),
-    AKBASIC_HOST_FIELD( galaga_Enemy, rnd,    "RND%",     AKBASIC_HOSTFIELD_FLOAT )
+    AKBASIC_HOST_FIELD( galaga_Enemy, rnd,    "ROLL%",    AKBASIC_HOSTFIELD_FLOAT )
 };
 static const akbasic_HostType ENEMY_TYPE = {
     "ENEMY", sizeof(galaga_Enemy), ENEMY_FIELDS, 8
@@ -87,7 +87,7 @@ static const akbasic_HostField GAME_FIELDS[] = {
     AKBASIC_HOST_FIELD( galaga_Shared, playerx, "PLAYERX%", AKBASIC_HOSTFIELD_FLOAT ),
     AKBASIC_HOST_FIELD( galaga_Shared, playery, "PLAYERY%", AKBASIC_HOSTFIELD_FLOAT ),
     AKBASIC_HOST_FIELD( galaga_Shared, wave,    "WAVE#",    AKBASIC_HOSTFIELD_INT32 ),
-    AKBASIC_HOST_FIELD( galaga_Shared, rnd,     "RND%",     AKBASIC_HOSTFIELD_FLOAT )
+    AKBASIC_HOST_FIELD( galaga_Shared, rnd,     "ROLL%",    AKBASIC_HOSTFIELD_FLOAT )
 };
 static const akbasic_HostType GAME_TYPE = {
     "GAME", sizeof(galaga_Shared), GAME_FIELDS, 4

examples/megademo/megademo.bas

@@ -10,7 +10,7 @@ REM  A demoscene production for the akbasic interpreter, written as if
 REM  it were 1985 and this dialect were the machine under the tree.
 REM  It leans on every corner of the interpreter on purpose:
 REM
-REM    - there is no RND, so it carries chapter 17's LCG and seeds it
+REM    - it carries chapter 17's LCG rather than the native RND, and seeds it
 REM      from the jiffy clock
 REM    - the palette cannot be rewritten, so every "colour cycle" is an
 REM      honest redraw of the same strokes in the next colour
@@ -81,7 +81,7 @@ REM  machine and a predeclared scratch variable occupies one forever,
 REM  where a scoped one gives its slot back. The first cut of this
 REM  program predeclared everything and ran the pool dry.
 RMAX# = 0
-RND# = 0
+ROLL# = 0
 TX% = 0
 TB# = 0
 
@@ -816,11 +816,12 @@ REM =====================================================================
 REM  Subroutines.
 REM =====================================================================
 
-REM  Chapter 17's generator, verbatim: there is no RND in this dialect.
+REM  Chapter 17's historical generator, verbatim. RND(n) is built in now;
-REM  Answers 0 to RMAX#-1 in RND#, from the middle bits of the seed.
+REM  this stays so the demo runs identically on every machine.
+REM  Answers 0 to RMAX#-1 in ROLL#, from the middle bits of the seed.
 LABEL RANDOM
 SEED# = MOD(((SEED# * 1103515245) + 12345), 2147483648)
-RND# = MOD((SEED# / 65536), RMAX#)
+ROLL# = MOD((SEED# / 65536), RMAX#)
 RETURN
 
 REM  NS# stars in four brightnesses. Two LCG pulls a star, and the
@@ -830,10 +831,10 @@ SI# = 0
 DO WHILE SI# < NS#
   RMAX# = W#
   GOSUB RANDOM
-  X# = RND#
+  X# = ROLL#
   RMAX# = H#
   GOSUB RANDOM
-  Y# = RND#
+  Y# = ROLL#
   B# = MOD(SEED#, 4)
   COLOR 1, STC#(B#)
   DRAW 1, X#, Y#
@@ -1291,7 +1292,7 @@ LABEL REHOME
 MOVSPR L2#, 0.5 * W#, 0.5 * H#
 RMAX# = 360
 GOSUB RANDOM
-SBG#(L2#) = RND#
+SBG#(L2#) = ROLL#
 MOVSPR L2#, SBG#(L2#) # 5
 RETURN
 

include/akbasic/akgl.h

@@ -296,7 +296,7 @@ typedef struct
      *
      * Claimed up front rather than per scan for two reasons. The pool is shared
      * with whatever host this interpreter is embedded in -- a game with its own
-     * shaped actors draws from the same #AKGL_MAX_HEAP_COLLISION_PROXY -- so
+     * shaped actors draws from the same `AKGL_MAX_HEAP_COLLISION_PROXY` -- so
      * running out is a real possibility, and it should be an init-time failure
      * naming the pool rather than a collision scan that starts refusing halfway
      * through a game. And a proxy carries a *copy* of its shape, so there is

include/akbasic/environment.h

@@ -72,6 +72,37 @@ typedef struct akbasic_Environment
      */
     bool exiting;
 
+    /*
+     * Generator state (GEN / EMIT / FOR EACH / DO EACH).
+     *
+     * `isGenerator` is set on the environment a GEN call pushes -- the one
+     * whose body is actually running the GEN's lines, as opposed to the loop's
+     * own environment. `generatorFn` records *which* GEN it is running, so a
+     * FOR EACH/DO EACH that would invoke a GEN currently running higher up the
+     * parent chain (self-recursion) can be told apart from one invoking it
+     * fresh, or invoking a sibling instance of the same GEN sitting detached in
+     * someone else's `forGeneratorEnv`. It carries an akbasic_FunctionDef *, kept
+     * as void * for the same reason akbasic_environment_get_function() does:
+     * runtime.h includes this header, not the other way around.
+     */
+    bool isGenerator;
+    void *generatorFn;
+    /**
+     * Set on a FOR EACH or DO EACH loop's own environment, distinguishing it
+     * from a plain FOR/DO for verbs that need to know which kind of loop this
+     * is -- EXIT, NEXT and LOOP all read it.
+     */
+    bool isEachLoop;
+    /**
+     * The generator environment a FOR EACH/DO EACH loop is suspended on
+     * between iterations -- alive, detached from the step loop, but not
+     * released, so its own `nextline` still says where to resume. NULL means
+     * either "not an EACH loop" or "the generator is exhausted": both leave
+     * nothing to resume, and by the time either becomes true the loop
+     * environment itself is on its way out too.
+     */
+    struct akbasic_Environment *forGeneratorEnv;
+
     int64_t gosubReturnLine;
 
     /* READ state. The identifier leaves are deep copies, so they need storage. */

include/akbasic/error.h

@@ -12,9 +12,12 @@
  * libakerror 2.0.0 is the floor, raised from 1.0.0 because 2.0.0 is an ABI break
  * that a compile against the wrong header cannot survive quietly:
  *
- *   - `__akerr_last_ignored` became thread-local. `IGNORE` expands at *our* call
+ *   - The context behind `IGNORE` became thread-local. `IGNORE` expands at *our*
- *     site, so our objects reference that symbol under whichever storage model
+ *     call site, so our objects reference that storage under whichever model the
- *     the header on the include path declared.
+ *     header on the include path declared. 2.0.2 went further and made it a
+ *     per-translation-unit `static` snapshot named `akerr_last_ignored`, copied
+ *     from the pool slot so the slot can be released; the old spelling
+ *     `__akerr_last_ignored` was an `extern` pointer and no longer exists.
  *   - `akerr_next_error()` now returns a context that already holds a reference,
  *     and `ENSURE_ERROR_READY` no longer increments. Objects compiled against a
  *     1.x header count every reference twice and never give a slot back.

include/akbasic/runtime.h

@@ -102,6 +102,15 @@ typedef struct
     akbasic_ASTLeaf *arglist;
     akbasic_ASTLeaf *expression;
     int64_t lineno;
+    /*
+     * Set by akbasic_parse_gen(), left false by akbasic_parse_def(). GEN and
+     * DEF share this table (TODO.md's namespace decision for generators), so
+     * this is what lets akbasic_runtime_call_function() refuse to run a GEN
+     * called like an ordinary function -- cleanly, before anything is pushed,
+     * rather than relying on EMIT to fail deep inside a call whose BASIC-level
+     * error a caller driving its own step loop would not see raised.
+     */
+    bool isGenerator;
     /*
      * There is deliberately no environment here. It used to be owned by the
      * funcdef and reset on every call, which made a function not re-entrant --
@@ -595,6 +604,115 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_new_environment(akbasic_Runti
  */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_prev_environment(akbasic_Runtime *obj);
 
+/**
+ * @brief Return control to the active scope's parent, without releasing it.
+ *
+ * The half of akbasic_runtime_prev_environment() that pops; the other half,
+ * akbasic_runtime_release_environment(), gives the scope's variables and its
+ * pool slot back. Split for EMIT: a generator suspended between iterations
+ * has to keep existing -- its own `nextline` is where NEXT resumes it -- so
+ * detaching without releasing is what lets `obj->environment` move on to the
+ * loop while the generator's scope stays alive, reachable through
+ * `forGeneratorEnv`.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKBASIC_ERR_ENVIRONMENT When the active scope is the root.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_detach_environment(akbasic_Runtime *obj);
+/**
+ * @brief Give a scope's variables and its pool slot back.
+ *
+ * The other half of akbasic_runtime_prev_environment(): unlike that function,
+ * @p env need not be `obj->environment` -- a generator environment sitting
+ * detached in some loop's `forGeneratorEnv` is released this way once it is
+ * exhausted or abandoned, without disturbing whatever scope is active now.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @param env The scope to release; must not be NULL and must not be the root.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKERR_NULLPOINTER When `env` is NULL.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_release_environment(akbasic_Runtime *obj, akbasic_Environment *env);
+
+/**
+ * @brief Pop and release every scope from the active one up to @p target.
+ *
+ * The shared teardown for every path that abandons part of the environment
+ * chain at once instead of popping it a verb at a time: the error unwinds in
+ * akbasic_runtime_pump_generator() and akbasic_runtime_call_function(). Each
+ * popped scope's suspended generator (`forGeneratorEnv`), if it still holds
+ * one, is released through akbasic_runtime_release_generator() -- a suspended
+ * generator is a *child* of its loop scope, so no walk up the parent chain
+ * would ever reach it.
+ *
+ * Stops without error at the root if @p target is not on the chain: callers
+ * are already cleaning up after a failure, and releasing everything is the
+ * least-wrong answer to a target that has gone missing.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @param target The scope to stop at; it is left active and untouched.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKERR_NULLPOINTER When @p target is NULL.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_unwind_to_environment(akbasic_Runtime *obj, akbasic_Environment *target);
+
+/**
+ * @brief Push a GEN's environment, bind its parameters and run it to its first EMIT.
+ *
+ * Shared by the EACH branches of `FOR` and `DO`: both look up the same kind of
+ * call expression (an `AKBASIC_LEAF_FUNCTION` leaf naming a GEN), guard
+ * against invoking a GEN that is already running higher up this same parent
+ * chain, evaluate the call's arguments in the caller's scope, bind them into a
+ * fresh environment the way a function call does, and run that environment
+ * until EMIT detaches it or END GEN ends it with nothing emitted.
+ *
+ * @p loopenv is left in the state a caller checks afterwards:
+ * `loopenv->forGeneratorEnv` is the live generator environment when
+ * something was emitted, or NULL when the GEN produced nothing at all.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @param loopenv The FOR EACH/DO EACH loop's own environment; becomes the new
+ *        generator environment's parent.
+ * @param callexpr The generator call, e.g. `ROOMOBJECTS(CURROOM%)`.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKBASIC_ERR_STATE When the named GEN is already running higher up
+ *         this same parent chain.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_generator_invoke(akbasic_Runtime *obj, akbasic_Environment *loopenv, akbasic_ASTLeaf *callexpr);
+/**
+ * @brief Run a suspended generator until it next detaches.
+ *
+ * Shared by the EACH branches of `NEXT` and `LOOP`: `obj->environment` is
+ * expected to already be the generator environment to resume (a caller sets
+ * that from `loopenv->forGeneratorEnv` before calling), and this drives the
+ * step loop until either EMIT detaches it back to @p loopenv with another
+ * value, or END GEN really ends it -- in which case it releases the
+ * generator environment itself and clears `loopenv->forGeneratorEnv`.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @param loopenv The FOR EACH/DO EACH loop's own environment, and the pump's
+ *        stopping point.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_pump_generator(akbasic_Runtime *obj, akbasic_Environment *loopenv);
+
+/**
+ * @brief Release a live, abandoned generator, wherever EMIT left it suspended.
+ *
+ * `env` is expected to be a loop's `forGeneratorEnv` -- the resume point, not
+ * necessarily the GEN's own call frame, since EMIT may have run several
+ * levels below it inside a FOR/DO/GOSUB the body wrote. Walks up from there,
+ * releasing every environment through the call frame itself inclusive, so
+ * nothing above the resume point is left behind.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @param env The suspended resume point to release.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKERR_NULLPOINTER When `env` is NULL.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_release_generator(akbasic_Runtime *obj, akbasic_Environment *env);
+
 /**
  * @brief Report a BASIC error on the current line, in the reference's format.
  *
@@ -832,13 +950,6 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_reserve_globals(akbasic_Runti
  * @throws AKBASIC_ERR_BOUNDS When every variable slot is in use.
  */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_new_variable(akbasic_Runtime *obj, akbasic_Variable **dest);
-/**
- * @brief Take an unused function definition from the runtime's pool.
- * @param obj Object to initialize, inspect, or modify.
- * @param dest Output destination populated by the function.
- * @return `NULL` on success, otherwise an error context owned by the caller.
- * @throws AKBASIC_ERR_BOUNDS When every function slot is in use.
- */
 /**
  * @brief Call a user-defined function with values a caller already has.
  *
@@ -865,6 +976,13 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_new_variable(akbasic_Runtime
  */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_call_function(struct akbasic_Runtime *obj, const char *name, akbasic_Value **args, int nargs, akbasic_Value **dest);
 
+/**
+ * @brief Take an unused function definition from the runtime's pool.
+ * @param obj Object to initialize, inspect, or modify.
+ * @param dest Output destination populated by the function.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKBASIC_ERR_BOUNDS When every function slot is in use.
+ */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_new_function(akbasic_Runtime *obj, akbasic_FunctionDef **dest);
 /**
  * @brief File one already-scanned source line under its line number.

include/akbasic/sprite.h

@@ -59,7 +59,7 @@
  * with headroom. The ceiling matters because these come out of libakgl's
  * collision proxy pool, which is shared with whatever host this interpreter is
  * embedded in: eight sprites plus sixty-four solids is seventy-two of
- * #AKGL_MAX_HEAP_COLLISION_PROXY, and the rest is the host's.
+ * `AKGL_MAX_HEAP_COLLISION_PROXY`, and the rest is the host's.
  */
 #ifndef AKBASIC_MAX_SOLIDS
 #define AKBASIC_MAX_SOLIDS		64
@@ -117,7 +117,7 @@ typedef struct
     int speed;			/*   clockwise from vertical, and 0-15		*/
 
     /**
-     * SPRHIT's collision shape: one of the #AKBASIC_SHAPE_* kinds, and a
+     * SPRHIT's collision shape: one of the `AKBASIC_SHAPE_*` kinds, and a
      * rectangle measured from the sprite's top-left corner.
      *
      * `shapeexplicit` is what separates "the program asked for the whole frame"

src/environment.c

@@ -35,6 +35,10 @@ akerr_ErrorContext *akbasic_environment_init(akbasic_Environment *obj, akbasic_R
     obj->doConditionLeaf = NULL;
     obj->doConditionKind = AKBASIC_LOOPCOND_NONE;
     obj->isDoLoop = false;
+    obj->isGenerator = false;
+    obj->generatorFn = NULL;
+    obj->isEachLoop = false;
+    obj->forGeneratorEnv = NULL;
     obj->gosubReturnLine = 0;
     obj->readReturnLine = 0;
     obj->readIdentifierIdx = 0;

src/parser_commands.c

@@ -20,6 +20,9 @@
 
 #include "verbs.h"
 
+/* Shared by akbasic_parse_for() and akbasic_parse_do(); defined after akbasic_parse_def(). */
+static akerr_ErrorContext *parse_each_clause(akbasic_Parser *parser, akbasic_ASTLeaf **var, akbasic_ASTLeaf **callexpr);
+
 akerr_ErrorContext *akbasic_parse_arglist(akbasic_Parser *parser, akbasic_ASTLeaf **dest)
 {
     PREPARE_ERROR(errctx);
@@ -309,8 +312,58 @@ akerr_ErrorContext *akbasic_parse_do(akbasic_Parser *parser, akbasic_ASTLeaf **d
     akbasic_Environment *newenv = NULL;
     akbasic_ASTLeaf *expr = NULL;
     akbasic_ASTLeaf *condition = NULL;
+    akbasic_Token *peeked = NULL;
     int kind = AKBASIC_LOOPCOND_NONE;
     int64_t firstline = parent->lineno + 1;
+    int cmp = 0;
+
+    /*
+     * DO EACH <variable> IN <generator call> ... LOOP. Mutually exclusive with
+     * DO WHILE/UNTIL on the same DO, so this is checked first and returns
+     * before any of the WHILE/UNTIL machinery runs.
+     */
+    peeked = akbasic_parser_peek(parser);
+    if ( peeked != NULL && peeked->tokentype == AKBASIC_TOK_COMMAND ) {
+	PASS(errctx, aksl_strcmp(peeked->lexeme, "EACH", &cmp));
+	if ( cmp == 0 ) {
+	    akbasic_ASTLeaf *var = NULL;
+	    akbasic_ASTLeaf *callexpr = NULL;
+
+	    (void)akbasic_parser_match1(parser, AKBASIC_TOK_COMMAND);
+
+	    PASS(errctx, akbasic_runtime_new_environment(runtime));
+	    newenv = runtime->environment;
+	    runtime->environment = parent;
+
+	    PASS(errctx, parse_each_clause(parser, &var, &callexpr));
+
+	    /*
+	     * Same guard as akbasic_parse_for()'s EACH branch, with the likely
+	     * mistake named: a condition belongs on the LOOP, where it is
+	     * checked against each emitted value, not here on the DO.
+	     */
+	    peeked = akbasic_parser_peek(parser);
+	    FAIL_NONZERO_RETURN(errctx,
+				(peeked != NULL &&
+				 peeked->tokentype != AKBASIC_TOK_UNDEFINED &&
+				 peeked->tokentype != AKBASIC_TOK_COLON),
+				AKBASIC_ERR_SYNTAX,
+				"DO EACH takes its WHILE/UNTIL on the LOOP, and nothing else here");
+
+	    newenv->isDoLoop = true;
+	    newenv->isEachLoop = true;
+	    newenv->loopFirstLine = firstline;
+	    /* See akbasic_parse_for()'s EACH branch for why this is not cloned. */
+	    newenv->forToLeaf = callexpr;
+
+	    PASS(errctx, akbasic_parser_new_leaf(parser, &expr));
+	    PASS(errctx, akbasic_leaf_new_command(expr, "DO", var));
+
+	    runtime->environment = newenv;
+	    *dest = expr;
+	    SUCCEED_RETURN(errctx);
+	}
+    }
 
     PASS(errctx, akbasic_runtime_new_environment(runtime));
     newenv = runtime->environment;
@@ -883,6 +936,134 @@ akerr_ErrorContext *akbasic_parse_def(akbasic_Parser *parser, akbasic_ASTLeaf **
     SUCCEED_RETURN(errctx);
 }
 
+/*
+ * GEN NAME(parameters) ... END GEN
+ *
+ * A DEF that yields more than once, in the same shape a multi-line DEF is:
+ * the header is parsed, the parameter list is read with parse_def_parameters()
+ * (GEN and DEF share the functions table -- TODO.md's namespace decision for
+ * this feature -- so a name cannot be both), and the body is skipped on this,
+ * the definitional pass, by arming akbasic_environment_wait_for_command() for
+ * "END GEN" instead of "RETURN". It only really executes when a FOR EACH/DO
+ * EACH invokes it through akbasic_runtime_generator_invoke(), which sets
+ * `nextline` to `fndef->lineno` directly and never runs this line again.
+ *
+ * There is no single-expression form: a GEN with nothing to loop over is just
+ * a DEF, and EMIT already needs a body to sit in.
+ */
+akerr_ErrorContext *akbasic_parse_gen(akbasic_Parser *parser, akbasic_ASTLeaf **dest)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Runtime *runtime = parser->runtime;
+    akbasic_ASTLeaf *identifier = NULL;
+    akbasic_ASTLeaf *arglist = NULL;
+    akbasic_ASTLeaf *command = NULL;
+    akbasic_FunctionDef *fndef = NULL;
+    size_t namelen = 0;
+    size_t i = 0;
+
+    PASS(errctx, akbasic_parser_primary(parser, &identifier));
+    FAIL_ZERO_RETURN(errctx, (identifier->leaftype == AKBASIC_LEAF_IDENTIFIER),
+		     AKBASIC_ERR_SYNTAX, "Expected identifier");
+
+    PASS(errctx, parse_def_parameters(parser, &arglist));
+
+    PASS(errctx, akbasic_runtime_new_function(runtime, &fndef));
+
+    /* Uppercase the name: verbs, functions and generators are all case-insensitive. */
+    PASS(errctx, aksl_strlen(identifier->identifier, &namelen));
+    FAIL_ZERO_RETURN(errctx, (namelen < sizeof(fndef->name)),
+		     AKBASIC_ERR_BOUNDS, "Function name '%s' is too long", identifier->identifier);
+    for ( i = 0; i < namelen; i++ ) {
+	char c = identifier->identifier[i];
+	fndef->name[i] = (char)((c >= 'a' && c <= 'z') ? (c - 'a' + 'A') : c);
+    }
+    fndef->name[namelen] = '\0';
+
+    fndef->expression = NULL;
+    fndef->isGenerator = true;
+    PASS(errctx, akbasic_environment_wait_for_command(runtime->environment, "END GEN"));
+    PASS(errctx, akbasic_leaf_clone(arglist, &fndef->leafpool, &fndef->arglist));
+    fndef->lineno = runtime->environment->lineno + 1;
+
+    PASS(errctx, akbasic_symtab_set(&runtime->environment->functions, fndef->name, fndef, 0));
+
+    PASS(errctx, akbasic_parser_new_leaf(parser, &command));
+    PASS(errctx, akbasic_leaf_new_command(command, "GEN", NULL));
+    *dest = command;
+    SUCCEED_RETURN(errctx);
+}
+
+/*
+ * END [GEN]
+ *
+ * Bare END finishes the program, the default command path's job before this
+ * handler existed. `END GEN` is a GEN body's own closing verb, and it is
+ * never scanned as one token -- GEN follows END as an ordinary COMMAND token
+ * on the same line -- so this is what tells the two apart and builds the
+ * compound leaf akbasic_cmd_end_gen dispatches on, the same trick
+ * akbasic_parse_print() uses for `PRINT #`.
+ */
+akerr_ErrorContext *akbasic_parse_end(akbasic_Parser *parser, akbasic_ASTLeaf **dest)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_ASTLeaf *expr = NULL;
+    akbasic_ASTLeaf *right = NULL;
+    akbasic_Token *peeked = NULL;
+    int cmp = 0;
+
+    peeked = akbasic_parser_peek(parser);
+    if ( peeked != NULL && peeked->tokentype == AKBASIC_TOK_COMMAND ) {
+	PASS(errctx, aksl_strcmp(peeked->lexeme, "GEN", &cmp));
+	if ( cmp == 0 ) {
+	    (void)akbasic_parser_match1(parser, AKBASIC_TOK_COMMAND);
+	    PASS(errctx, akbasic_parser_new_leaf(parser, &expr));
+	    PASS(errctx, akbasic_leaf_new_command(expr, "END GEN", NULL));
+	    *dest = expr;
+	    SUCCEED_RETURN(errctx);
+	}
+    }
+
+    /* A plain END, matching what the default command path used to do. */
+    if ( peeked != NULL && peeked->tokentype != AKBASIC_TOK_UNDEFINED &&
+	 peeked->tokentype != AKBASIC_TOK_COLON ) {
+	PASS(errctx, akbasic_parser_expression(parser, &right));
+    }
+    PASS(errctx, akbasic_parser_new_leaf(parser, &expr));
+    PASS(errctx, akbasic_leaf_new_command(expr, "END", right));
+    *dest = expr;
+    SUCCEED_RETURN(errctx);
+}
+
+/*
+ * EACH <variable> IN <generator call>
+ *
+ * Shared by akbasic_parse_for() and akbasic_parse_do(), both of which consume
+ * the leading EACH themselves (it is what tells them this is an EACH loop
+ * rather than their ordinary form) before calling this for the rest.
+ */
+static akerr_ErrorContext *parse_each_clause(akbasic_Parser *parser, akbasic_ASTLeaf **var, akbasic_ASTLeaf **callexpr)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Token *word = NULL;
+    int cmp = 0;
+
+    PASS(errctx, akbasic_parser_expression(parser, var));
+    FAIL_ZERO_RETURN(errctx, (*var != NULL && akbasic_leaf_is_identifier(*var)), AKBASIC_ERR_SYNTAX,
+		     "Expected EACH (variable) IN (generator call)");
+
+    FAIL_ZERO_RETURN(errctx, akbasic_parser_match1(parser, AKBASIC_TOK_COMMAND), AKBASIC_ERR_SYNTAX,
+		     "Expected IN after EACH (variable)");
+    PASS(errctx, akbasic_parser_previous(parser, &word));
+    PASS(errctx, aksl_strcmp(word->lexeme, "IN", &cmp));
+    FAIL_NONZERO_RETURN(errctx, cmp, AKBASIC_ERR_SYNTAX, "Expected IN after EACH (variable)");
+
+    PASS(errctx, akbasic_parser_expression(parser, callexpr));
+    FAIL_ZERO_RETURN(errctx, (*callexpr != NULL && (*callexpr)->leaftype == AKBASIC_LEAF_FUNCTION),
+		     AKBASIC_ERR_SYNTAX, "Expected a generator call after IN");
+    SUCCEED_RETURN(errctx);
+}
+
 /*
  * FOR     ...        TO ....        [STEP    ...]
  * COMMAND ASSIGNMENT    EXPRESSION  [COMMAND EXPRESSION]
@@ -898,11 +1079,72 @@ akerr_ErrorContext *akbasic_parse_for(akbasic_Parser *parser, akbasic_ASTLeaf **
     akbasic_ASTLeaf *assignment = NULL;
     akbasic_ASTLeaf *expr = NULL;
     akbasic_Token *operator_ = NULL;
+    akbasic_Token *peeked = NULL;
     akbasic_Environment *parent = runtime->environment;
     akbasic_Environment *newenv = NULL;
     int64_t firstline = 0;
     int cmp = 0;
 
+    /*
+     * FOR EACH <variable> IN <generator call>. Checked before the leaf right of
+     * FOR is required to be an assignment, because EACH is the one other thing
+     * that leaf is allowed to be.
+     */
+    peeked = akbasic_parser_peek(parser);
+    if ( peeked != NULL && peeked->tokentype == AKBASIC_TOK_COMMAND ) {
+	PASS(errctx, aksl_strcmp(peeked->lexeme, "EACH", &cmp));
+	if ( cmp == 0 ) {
+	    akbasic_ASTLeaf *var = NULL;
+	    akbasic_ASTLeaf *callexpr = NULL;
+
+	    (void)akbasic_parser_match1(parser, AKBASIC_TOK_COMMAND);
+	    firstline = parent->lineno + 1;
+
+	    /*
+	     * Pushed the same way a plain FOR's environment is: while the
+	     * parent is still active, so the call expression's identifiers
+	     * resolve in the caller's scope rather than the loop's own.
+	     */
+	    PASS(errctx, akbasic_runtime_new_environment(runtime));
+	    newenv = runtime->environment;
+	    runtime->environment = parent;
+
+	    PASS(errctx, parse_each_clause(parser, &var, &callexpr));
+
+	    /*
+	     * Nothing may follow the generator call but another statement.
+	     * Without this, a stray clause sits unparsed on the line and only
+	     * blows up after the whole loop has run, when the parent scope
+	     * resumes the line mid-statement -- an error at the loop's end
+	     * pointing at its beginning.
+	     */
+	    peeked = akbasic_parser_peek(parser);
+	    FAIL_NONZERO_RETURN(errctx,
+				(peeked != NULL &&
+				 peeked->tokentype != AKBASIC_TOK_UNDEFINED &&
+				 peeked->tokentype != AKBASIC_TOK_COLON),
+				AKBASIC_ERR_SYNTAX,
+				"FOR EACH takes nothing after the generator call");
+
+	    newenv->isEachLoop = true;
+	    newenv->loopFirstLine = firstline;
+	    /*
+	     * Stashed on forToLeaf rather than cloned into a leaf pool: unlike
+	     * DO's condition, this expression is evaluated exactly once, by
+	     * akbasic_cmd_for() on this same pass before the per-line leaf
+	     * storage it lives in is reused -- see akbasic_runtime_generator_invoke().
+	     */
+	    newenv->forToLeaf = callexpr;
+
+	    PASS(errctx, akbasic_parser_new_leaf(parser, &expr));
+	    PASS(errctx, akbasic_leaf_new_command(expr, "FOR", var));
+
+	    runtime->environment = newenv;
+	    *dest = expr;
+	    SUCCEED_RETURN(errctx);
+	}
+    }
+
     PASS(errctx, akbasic_parser_assignment(parser, &assignment));
     FAIL_ZERO_RETURN(errctx, akbasic_parser_match1(parser, AKBASIC_TOK_COMMAND),
 		     AKBASIC_ERR_SYNTAX,

src/runtime.c

@@ -143,17 +143,24 @@ akerr_ErrorContext *akbasic_runtime_new_environment(akbasic_Runtime *obj)
     SUCCEED_RETURN(errctx);
 }
 
-akerr_ErrorContext *akbasic_runtime_prev_environment(akbasic_Runtime *obj)
+akerr_ErrorContext *akbasic_runtime_detach_environment(akbasic_Runtime *obj)
 {
     PREPARE_ERROR(errctx);
-    akbasic_Environment *popped = NULL;
-    int i = 0;
 
-    FAIL_ZERO_RETURN(errctx, (obj != NULL), AKERR_NULLPOINTER, "NULL runtime in prev_environment");
+    FAIL_ZERO_RETURN(errctx, (obj != NULL), AKERR_NULLPOINTER, "NULL runtime in detach_environment");
     FAIL_ZERO_RETURN(errctx, (obj->environment->parent != NULL), AKBASIC_ERR_ENVIRONMENT,
 		     "No previous environment to return to");
-    popped = obj->environment;
+    obj->environment = obj->environment->parent;
-    obj->environment = popped->parent;
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_runtime_release_environment(akbasic_Runtime *obj, akbasic_Environment *env)
+{
+    PREPARE_ERROR(errctx);
+    int i = 0;
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL && env != NULL), AKERR_NULLPOINTER,
+		     "NULL argument in release_environment");
 
     /*
      * Give back the variables this scope created, as well as the scope.
@@ -173,9 +180,9 @@ akerr_ErrorContext *akbasic_runtime_prev_environment(akbasic_Runtime *obj)
      * times exhausted the 128-slot pool and reported "Maximum runtime variables
      * reached" on a four-line program.
      */
-    for ( i = 0; i < popped->variables.capacity; i++ ) {
+    for ( i = 0; i < env->variables.capacity; i++ ) {
-	akbasic_Variable *variable = (akbasic_Variable *)popped->variables.slots[i].value;
+	akbasic_Variable *variable = (akbasic_Variable *)env->variables.slots[i].value;
-	if ( popped->variables.slots[i].used && variable != NULL ) {
+	if ( env->variables.slots[i].used && variable != NULL ) {
 	    variable->used = false;
 	}
     }
@@ -185,7 +192,51 @@ akerr_ErrorContext *akbasic_runtime_prev_environment(akbasic_Runtime *obj)
      * here the pool is finite, so an unreleased environment is a bug that shows
      * up as exhaustion a few thousand GOSUBs later.
      */
-    popped->used = false;
+    env->used = false;
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_runtime_prev_environment(akbasic_Runtime *obj)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Environment *popped = NULL;
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL), AKERR_NULLPOINTER, "NULL runtime in prev_environment");
+    popped = obj->environment;
+    PASS(errctx, akbasic_runtime_detach_environment(obj));
+    PASS(errctx, akbasic_runtime_release_environment(obj, popped));
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_runtime_unwind_to_environment(akbasic_Runtime *obj, akbasic_Environment *target)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Environment *popped = NULL;
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL && target != NULL), AKERR_NULLPOINTER,
+		     "NULL argument in unwind_to_environment");
+    /*
+     * Stops early at the root rather than failing on it: every caller is an
+     * error-unwind path, where "release whatever there is" beats raising a
+     * second failure on top of the one being cleaned up after.
+     */
+    while ( obj->environment != target && obj->environment->parent != NULL ) {
+	popped = obj->environment;
+	obj->environment = popped->parent;
+	/*
+	 * An EACH loop scope on its way out takes its suspended generator with
+	 * it -- the generator is a *child* of the scope, off the parent chain,
+	 * and this walk is the only thing that will ever see it again. Guarded
+	 * on `used` because a generator that was being pumped when the failure
+	 * hit is *on* the chain being unwound, already released by the time
+	 * the walk reaches the loop scope that references it.
+	 */
+	if ( popped->forGeneratorEnv != NULL && popped->forGeneratorEnv->used ) {
+	    PASS(errctx, akbasic_runtime_release_generator(obj, popped->forGeneratorEnv));
+	}
+	popped->forGeneratorEnv = NULL;
+	PASS(errctx, akbasic_runtime_release_environment(obj, popped));
+    }
     SUCCEED_RETURN(errctx);
 }
 
@@ -1028,6 +1079,18 @@ akerr_ErrorContext *akbasic_runtime_call_function(akbasic_Runtime *obj, const ch
 
     PASS(errctx, akbasic_environment_get_function(obj->environment, name, &fnptr));
     fndef = (akbasic_FunctionDef *)fnptr;
+    /*
+     * A GEN is not a function: it yields more than once, through EMIT, and
+     * nothing about an ordinary call ever resumes it for a second value.
+     * Refused here, before anything is pushed, rather than left to fail
+     * inside the call -- a BASIC-level error down in EMIT is swallowed by
+     * process_line_run() the same way any statement's is, so a caller
+     * driving its own step loop would see this "succeed" with whatever
+     * garbage was left in the return slot instead of failing at all.
+     */
+    FAIL_NONZERO_RETURN(errctx, fndef->isGenerator, AKBASIC_ERR_STATE,
+			"%s is a GEN; call it with FOR EACH or DO EACH, not as a function",
+			fndef->name);
 
     /*
      * **One environment per call, from the pool -- exactly as GOSUB does.**
@@ -1135,10 +1198,11 @@ akerr_ErrorContext *akbasic_runtime_call_function(akbasic_Runtime *obj, const ch
 	 * Give them back, or a host absorbing script errors drains the
 	 * twelve-slot environment pool after twelve dead calls and every
 	 * call after that fails for a reason nobody can see in the script.
+	 * The unwind, not a bare prev_environment() loop, because a body that
+	 * died inside a FOR EACH leaves a suspended generator hanging off the
+	 * loop scope, and only the unwind knows to take it down too.
 	 */
-	while ( obj->environment != targetenv && obj->environment->parent != NULL ) {
+	IGNORE(akbasic_runtime_unwind_to_environment(obj, targetenv));
-	    IGNORE(akbasic_runtime_prev_environment(obj));
-	}
     } PROCESS(errctx) {
     } FINISH(errctx, true);
     PASS(errctx, akbasic_environment_new_value(targetenv, &out));

src/runtime_commands.c

@@ -161,8 +161,22 @@ akerr_ErrorContext *akbasic_cmd_return(akbasic_Runtime *obj, akbasic_ASTLeaf *ex
 	SUCCEED_TRUE(obj, dest);
 	SUCCEED_RETURN(errctx);
     }
+    /*
+     * A GEN is a function at heart, and RETURN ends it the way it ends a DEF
+     * or a GOSUB: early, cleanly, from its own frame. What a generator's
+     * RETURN cannot do is carry a value -- values leave a GEN one at a time,
+     * through EMIT, and there is no caller waiting on a return slot.
+     */
+    if ( obj->environment->isGenerator ) {
+	FAIL_NONZERO_RETURN(errctx, (expr != NULL && expr->right != NULL), AKBASIC_ERR_STATE,
+			    "A GEN yields values through EMIT; RETURN here takes none");
+	PASS(errctx, akbasic_runtime_prev_environment(obj));
+	obj->environment->forGeneratorEnv = NULL;
+	SUCCEED_TRUE(obj, dest);
+	SUCCEED_RETURN(errctx);
+    }
     FAIL_ZERO_RETURN(errctx, (obj->environment->gosubReturnLine != 0), AKBASIC_ERR_STATE,
-		     "RETURN outside the context of GOSUB");
+		     "RETURN outside the context of GOSUB, DEF, or GEN");
 
     if ( expr != NULL && expr->right != NULL ) {
 	PASS(errctx, akbasic_runtime_evaluate(obj, expr->right, &result));
@@ -840,6 +854,31 @@ akerr_ErrorContext *akbasic_cmd_for(akbasic_Runtime *obj, akbasic_ASTLeaf *expr,
     bool met = false;
 
     (void)lval; (void)rval;
+    if ( obj->environment->isEachLoop ) {
+	akbasic_Environment *loopenv = obj->environment;
+
+	FAIL_ZERO_RETURN(errctx, (expr != NULL && akbasic_leaf_is_identifier(expr->right)),
+			 AKBASIC_ERR_SYNTAX, "Expected FOR EACH (variable) IN (generator call)");
+	FAIL_ZERO_RETURN(errctx, (loopenv->forToLeaf != NULL), AKBASIC_ERR_STATE,
+			 "Expected FOR EACH (variable) IN (generator call)");
+
+	PASS(errctx, akbasic_environment_get(loopenv, expr->right->identifier,
+					     &loopenv->forNextVariable));
+	FAIL_ZERO_RETURN(errctx, (loopenv->forNextVariable != NULL), AKBASIC_ERR_UNDEFINED,
+			 "Unable to get loop variable %s", expr->right->identifier);
+
+	PASS(errctx, akbasic_runtime_generator_invoke(obj, loopenv, loopenv->forToLeaf));
+	loopenv->forToLeaf = NULL;
+
+	if ( loopenv->forGeneratorEnv == NULL ) {
+	    /* The generator produced nothing: skip the body by waiting for NEXT,
+	       exactly as a zero-iteration plain FOR does. */
+	    PASS(errctx, akbasic_environment_wait_for_command(loopenv, "NEXT"));
+	}
+	SUCCEED_TRUE(obj, dest);
+	SUCCEED_RETURN(errctx);
+    }
+
     FAIL_ZERO_RETURN(errctx, (obj->environment->forToLeaf != NULL && expr != NULL && expr->right != NULL),
 		     AKBASIC_ERR_STATE, "Expected FOR ... TO [STEP ...]");
     FAIL_ZERO_RETURN(errctx,
@@ -891,10 +930,16 @@ akerr_ErrorContext *akbasic_cmd_next(akbasic_Runtime *obj, akbasic_ASTLeaf *expr
 		     "NEXT outside the context of FOR");
     FAIL_ZERO_RETURN(errctx, (expr != NULL && expr->right != NULL), AKBASIC_ERR_SYNTAX,
 		     "Expected NEXT IDENTIFIER");
-    FAIL_ZERO_RETURN(errctx,
+    if ( obj->environment->isEachLoop ) {
-		     (expr->right->leaftype == AKBASIC_LEAF_IDENTIFIER_INT ||
+	/* EACH accepts any emitted type; the numeric-only check is for plain FOR. */
-		      expr->right->leaftype == AKBASIC_LEAF_IDENTIFIER_FLOAT),
+	FAIL_ZERO_RETURN(errctx, akbasic_leaf_is_identifier(expr->right), AKBASIC_ERR_SYNTAX,
-		     AKBASIC_ERR_TYPE, "FOR ... NEXT only valid over INT and FLOAT types");
+			 "Expected NEXT IDENTIFIER");
+    } else {
+	FAIL_ZERO_RETURN(errctx,
+			 (expr->right->leaftype == AKBASIC_LEAF_IDENTIFIER_INT ||
+			  expr->right->leaftype == AKBASIC_LEAF_IDENTIFIER_FLOAT),
+			 AKBASIC_ERR_TYPE, "FOR ... NEXT only valid over INT and FLOAT types");
+    }
 
     obj->environment->loopExitLine = obj->environment->lineno + 1;
 
@@ -909,6 +954,14 @@ akerr_ErrorContext *akbasic_cmd_next(akbasic_Runtime *obj, akbasic_ASTLeaf *expr
 	PASS(errctx, akbasic_environment_stop_waiting(obj->environment, "NEXT"));
 	FAIL_ZERO_RETURN(errctx, (obj->environment->parent != NULL), AKBASIC_ERR_ENVIRONMENT,
 			 "NEXT in an orphaned environment");
+	/*
+	 * A live generator abandoned mid-run: release it too, or it never comes
+	 * back to the pool. See MAINTENANCE.md's note on abandoned generators.
+	 */
+	if ( obj->environment->forGeneratorEnv != NULL ) {
+	    PASS(errctx, akbasic_runtime_release_generator(obj, obj->environment->forGeneratorEnv));
+	    obj->environment->forGeneratorEnv = NULL;
+	}
 	obj->environment->parent->nextline = obj->environment->loopExitLine;
 	PASS(errctx, akbasic_runtime_prev_environment(obj));
 	*dest = &obj->staticFalseValue;
@@ -924,12 +977,37 @@ akerr_ErrorContext *akbasic_cmd_next(akbasic_Runtime *obj, akbasic_ASTLeaf *expr
     if ( cmp != 0 ) {
 	FAIL_ZERO_RETURN(errctx, (obj->environment->parent != NULL), AKBASIC_ERR_ENVIRONMENT,
 			 "NEXT in an orphaned environment");
+	if ( obj->environment->forGeneratorEnv != NULL ) {
+	    PASS(errctx, akbasic_runtime_release_generator(obj, obj->environment->forGeneratorEnv));
+	    obj->environment->forGeneratorEnv = NULL;
+	}
 	obj->environment->parent->nextline = obj->environment->nextline;
 	PASS(errctx, akbasic_runtime_prev_environment(obj));
 	*dest = &obj->staticFalseValue;
 	SUCCEED_RETURN(errctx);
     }
 
+    if ( obj->environment->isEachLoop ) {
+	akbasic_Environment *loopenv = obj->environment;
+
+	PASS(errctx, akbasic_environment_stop_waiting(obj->environment, "NEXT"));
+	if ( loopenv->forGeneratorEnv != NULL ) {
+	    obj->environment = loopenv->forGeneratorEnv;
+	    PASS(errctx, akbasic_runtime_pump_generator(obj, loopenv));
+	}
+	if ( loopenv->forGeneratorEnv == NULL ) {
+	    /* Exhausted: pop the loop, same landing NEXT always uses when done. */
+	    FAIL_ZERO_RETURN(errctx, (loopenv->parent != NULL), AKBASIC_ERR_ENVIRONMENT,
+			     "NEXT in an orphaned environment");
+	    loopenv->parent->nextline = loopenv->loopExitLine;
+	    PASS(errctx, akbasic_runtime_prev_environment(obj));
+	    *dest = &obj->staticFalseValue;
+	    SUCCEED_RETURN(errctx);
+	}
+	SUCCEED_TRUE(obj, dest);
+	SUCCEED_RETURN(errctx);
+    }
+
     PASS(errctx, akbasic_environment_get(obj->environment, expr->right->identifier, &nextvar));
     FAIL_ZERO_RETURN(errctx, (nextvar != NULL), AKBASIC_ERR_UNDEFINED,
 		     "Unable to get loop variable %s", expr->right->identifier);
@@ -972,7 +1050,7 @@ akerr_ErrorContext *akbasic_cmd_exit(akbasic_Runtime *obj, akbasic_ASTLeaf *expr
      */
     FAIL_NONZERO_RETURN(errctx,
 			(obj->environment->forToValue.valuetype == AKBASIC_TYPE_UNDEFINED &&
-			 !obj->environment->isDoLoop),
+			 !obj->environment->isDoLoop && !obj->environment->isEachLoop),
 			AKBASIC_ERR_STATE, "EXIT outside the context of FOR or DO");
     FAIL_ZERO_RETURN(errctx, (obj->environment->parent != NULL), AKBASIC_ERR_ENVIRONMENT,
 		     "EXIT in an orphaned environment");

src/runtime_disk.c

@@ -407,17 +407,22 @@ akerr_ErrorContext *akbasic_cmd_directory(akbasic_Runtime *obj, akbasic_ASTLeaf
     FAIL_ZERO_RETURN(errctx, (obj != NULL && dest != NULL), AKERR_NULLPOINTER,
 		     "NULL argument in DIRECTORY");
     /*
-     * Refused rather than half-built. Listing a directory needs opendir/readdir,
+     * Refused rather than half-built. This was blocked upstream: listing a
-     * which `libakstdlib` does not wrap -- and this project's rule is that a
+     * directory needs opendir/readdir, `libakstdlib` did not wrap them, and
-     * missing capability gets filed upstream rather than worked around here
+     * this project's rule is that a missing capability gets filed upstream
-     * (MAINTENANCE.md). Filed as libakstdlib issue #10.
+     * rather than worked around here (MAINTENANCE.md). That was libakstdlib
+     * issue #10, and it landed -- aksl_opendir, aksl_readdir, aksl_closedir
+     * and aksl_rewinddir all exist as of the revision this tree pins.
      *
-     * The alternative was shelling out to `ls`, which a library has no business
+     * So the blocker is gone and only the work is left. Writing the verb needs
-     * doing, or calling readdir directly and stepping outside the error
+     * decisions this commit is not the place for: what a listing looks like on
-     * convention every other call in this file follows.
+     * a filesystem with no disk-image block counts, which of the Commodore
+     * wildcard forms to honour, and where the entries go. Tracked as akbasic
+     * issue #55; the refusal stays honest until then rather than growing a
+     * half-listing nobody specified.
      */
     FAIL_RETURN(errctx, AKBASIC_ERR_DEVICE,
-		"DIRECTORY is not implemented: libakstdlib has no directory-reading wrapper yet");
+		"DIRECTORY is not implemented yet");
 }
 
 /* ------------------------------------------------------------ BSAVE/BLOAD -- */

src/runtime_generator.c

@@ -0,0 +1,307 @@
+/**
+ * @file runtime_generator.c
+ * @brief GEN, EMIT and END GEN, plus the machinery FOR EACH/DO EACH share.
+ *
+ * A GEN is a DEF that yields more than once. Its body is skipped on the
+ * definitional pass exactly as a multi-line DEF's is -- `akbasic_parse_gen()`
+ * arms `akbasic_environment_wait_for_command(env, "END GEN")` the same way
+ * `akbasic_parse_def()` arms one for `RETURN` -- and it only ever really runs
+ * when a `FOR EACH`/`DO EACH` invokes it.
+ *
+ * That invocation pushes one environment for the whole lifetime of the loop,
+ * exactly as a GOSUB or a function call does, except that `EMIT` does not pop
+ * it: it hands control back to the loop without releasing anything, so the
+ * environment EMIT actually ran in -- which may be nested several levels
+ * below the GEN's own call frame, inside a FOR/DO/GOSUB the body wrote --
+ * still says exactly where to resume when `NEXT`/`LOOP` calls back into
+ * akbasic_runtime_pump_generator(). Only `END GEN` reached for real --
+ * meaning `obj->environment->isGenerator` is true and nothing is skipping
+ * forward to it -- actually releases the call frame, the way `RETURN`
+ * releases a DEF's call environment.
+ */
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akbasic/error.h>
+#include <akbasic/runtime.h>
+#include <akbasic/scanner.h>
+
+#include "verbs.h"
+
+/* Most verbs answer "did something happen"; this is that answer. */
+#define SUCCEED_TRUE(__obj, __dest)			\
+    do {						\
+	*(__dest) = &(__obj)->staticTrueValue;		\
+    } while ( 0 )
+
+akerr_ErrorContext *akbasic_runtime_pump_generator(akbasic_Runtime *obj, akbasic_Environment *loopenv)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL && loopenv != NULL), AKERR_NULLPOINTER,
+		     "NULL argument in pump_generator");
+    /*
+     * The same per-line prologue akbasic_runtime_step() and
+     * akbasic_runtime_call_function() run, driving process_line_run() directly
+     * rather than through the ordinary step loop: a generator body is not the
+     * top-level program and nothing else is going to advance it.
+     */
+    ATTEMPT {
+	while ( obj->environment != loopenv && obj->mode == AKBASIC_MODE_RUN ) {
+	    CATCH(errctx, akbasic_runtime_zero(obj));
+	    CATCH(errctx, akbasic_scanner_zero(obj));
+	    CATCH(errctx, akbasic_runtime_process_line_run(obj));
+	}
+    } CLEANUP {
+	/*
+	 * CLEANUP runs unconditionally -- it is not a `catch` -- so it is
+	 * guarded on the one thing that tells success and failure apart here:
+	 * whether `obj->environment` is still `loopenv`. On the ordinary
+	 * success path it already is (that is the ATTEMPT loop's own exit
+	 * condition), so this is a no-op there, exactly as it is meant to be.
+	 * Only a genuine C-level failure -- the scanner or parser raised, or a
+	 * runtime error escaped the swallow process_line_run() ordinarily does
+	 * for a BASIC-level one -- leaves scopes active between here and
+	 * loopenv, and only then does this force them back, taking
+	 * `forGeneratorEnv` down with them since whatever it pointed at is
+	 * among the scopes just released.
+	 */
+	if ( obj->environment != loopenv ) {
+	    IGNORE(akbasic_runtime_unwind_to_environment(obj, loopenv));
+	    loopenv->forGeneratorEnv = NULL;
+	}
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief Release a live generator, however deep EMIT left it suspended.
+ *
+ * `loopenv->forGeneratorEnv` is the *resume point*, not necessarily the GEN's
+ * own call frame -- EMIT may have run several levels down, inside a FOR/DO/
+ * GOSUB the body wrote around it. Abandoning it (EXIT) has to give back every
+ * environment from there up through the call frame itself, or everything
+ * above the resume point leaks.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @param env The suspended resume point; walks up through its own parents.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ */
+akerr_ErrorContext *akbasic_runtime_release_generator(akbasic_Runtime *obj, akbasic_Environment *env)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Environment *walk = env;
+    akbasic_Environment *next = NULL;
+    bool isgen = false;
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL && env != NULL), AKERR_NULLPOINTER,
+		     "NULL argument in release_generator");
+    while ( walk != NULL ) {
+	isgen = walk->isGenerator;
+	next = walk->parent;
+	/*
+	 * A scope between the resume point and the call frame may be an EACH
+	 * loop with its *own* generator suspended off to the side. Releasing
+	 * the loop scope without releasing that generator strands it in the
+	 * pool -- the walk goes through parents and a suspended generator is a
+	 * child. Guarded on `used` so a generator already released as part of
+	 * some enclosing teardown is not released twice.
+	 */
+	if ( walk->forGeneratorEnv != NULL && walk->forGeneratorEnv->used ) {
+	    PASS(errctx, akbasic_runtime_release_generator(obj, walk->forGeneratorEnv));
+	}
+	walk->forGeneratorEnv = NULL;
+	PASS(errctx, akbasic_runtime_release_environment(obj, walk));
+	if ( isgen ) {
+	    break;
+	}
+	walk = next;
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_runtime_generator_invoke(akbasic_Runtime *obj, akbasic_Environment *loopenv, akbasic_ASTLeaf *callexpr)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Environment *callenv = NULL;
+    akbasic_Environment *walk = NULL;
+    akbasic_FunctionDef *fndef = NULL;
+    akbasic_ASTLeaf *fnarg = NULL;
+    akbasic_ASTLeaf *paramleaf = NULL;
+    akbasic_Value *argvals[AKBASIC_MAX_CALL_ARGUMENTS];
+    akbasic_Value *unused = NULL;
+    void *fnptr = NULL;
+    int nargs = 0;
+    int i = 0;
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL && loopenv != NULL && callexpr != NULL), AKERR_NULLPOINTER,
+		     "NULL argument in generator_invoke");
+    FAIL_ZERO_RETURN(errctx, (callexpr->leaftype == AKBASIC_LEAF_FUNCTION), AKBASIC_ERR_SYNTAX,
+		     "Expected a generator call after IN");
+
+    /*
+     * GEN and DEF share the functions table (TODO.md's namespace decision for
+     * this feature), so this is the same lookup akbasic_runtime_call_function()
+     * does. The parser already proved the name resolves and the arity matches
+     * when it parsed `callexpr` -- akbasic_parser_expression() would not have
+     * produced an AKBASIC_LEAF_FUNCTION leaf otherwise -- so a miss here would
+     * mean the function table changed out from under a leaf built against it,
+     * which is not a case this needs its own message for.
+     */
+    PASS(errctx, akbasic_environment_get_function(loopenv, callexpr->identifier, &fnptr));
+    fndef = (akbasic_FunctionDef *)fnptr;
+    FAIL_ZERO_RETURN(errctx, fndef->isGenerator, AKBASIC_ERR_STATE,
+		     "%s is a DEF, not a GEN -- FOR EACH/DO EACH needs a generator",
+		     fndef->name);
+
+    /*
+     * Self-recursion: walk the *parent* chain, not the pool. An environment
+     * reachable only through some other loop's `forGeneratorEnv` is a sibling
+     * invocation sitting detached between its own iterations, not an ancestor
+     * of this call -- nothing points from here to it via `parent`, so it never
+     * matches and independent or nested FOR EACH/DO EACH over the same GEN
+     * (even the same GEN with different arguments) is unaffected.
+     */
+    for ( walk = loopenv; walk != NULL; walk = walk->parent ) {
+	if ( walk->isGenerator && walk->generatorFn == (void *)fndef ) {
+	    FAIL_RETURN(errctx, AKBASIC_ERR_STATE,
+			"GEN %s cannot FOR EACH/DO EACH over itself from its own body",
+			fndef->name);
+	}
+    }
+
+    /*
+     * Evaluated in the caller's own scope, before anything is pushed -- the
+     * same reason akbasic_runtime_user_function() evaluates every argument
+     * before binding the first one: a later argument must not see an earlier
+     * one already sitting in the callee's scope.
+     */
+    fnarg = akbasic_leaf_first_argument(callexpr);
+    for ( ; fnarg != NULL; fnarg = fnarg->next ) {
+	FAIL_ZERO_RETURN(errctx, (nargs < AKBASIC_MAX_CALL_ARGUMENTS), AKBASIC_ERR_BOUNDS,
+			 "%s was called with more than %d arguments",
+			 callexpr->identifier, AKBASIC_MAX_CALL_ARGUMENTS);
+	PASS(errctx, akbasic_runtime_evaluate(obj, fnarg, &argvals[nargs]));
+	nargs += 1;
+    }
+
+    /*
+     * One environment for the whole lifetime of the loop, exactly as GOSUB and
+     * a function call take one from the pool -- and unlike either, this one
+     * survives past the verb that pushed it, held alive by `loopenv`'s own
+     * reference until NEXT/LOOP exhausts or EXIT abandons it.
+     */
+    PASS(errctx, akbasic_runtime_new_environment(obj));
+    callenv = obj->environment;
+    callenv->isGenerator = true;
+    callenv->generatorFn = (void *)fndef;
+    callenv->nextline = fndef->lineno;
+    loopenv->forGeneratorEnv = callenv;
+
+    paramleaf = (fndef->arglist != NULL ? fndef->arglist->right : NULL);
+    for ( i = 0; i < nargs && paramleaf != NULL; i++ ) {
+	PASS(errctx, akbasic_environment_assign(callenv, paramleaf, argvals[i], &unused));
+	paramleaf = paramleaf->next;
+    }
+
+    PASS(errctx, akbasic_runtime_pump_generator(obj, loopenv));
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_cmd_gen(akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest)
+{
+    PREPARE_ERROR(errctx);
+
+    (void)expr; (void)lval; (void)rval;
+    /* The parse handler already installed the generator, exactly as DEF's does. */
+    SUCCEED_TRUE(obj, dest);
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_cmd_emit(akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Environment *genenv = NULL;
+    akbasic_Environment *loopenv = NULL;
+    akbasic_Value *value = NULL;
+    int64_t zerosubscript[1] = { 0 };
+
+    (void)lval; (void)rval;
+    FAIL_ZERO_RETURN(errctx, (expr != NULL && expr->right != NULL), AKBASIC_ERR_SYNTAX,
+		     "Expected EMIT (expression)");
+    /*
+     * EMIT is not necessarily standing directly in the environment
+     * akbasic_runtime_generator_invoke() pushed: a GEN body is ordinary BASIC
+     * and may nest its own FOR, DO or GOSUB around an EMIT, each of which
+     * pushes an environment of its own -- exactly what the issue's own
+     * ROOMOBJECTS example does. Walk up to the nearest one that really is a
+     * GEN's own call frame.
+     */
+    for ( genenv = obj->environment; genenv != NULL && !genenv->isGenerator; genenv = genenv->parent ) {
+    }
+    FAIL_ZERO_RETURN(errctx, (genenv != NULL), AKBASIC_ERR_STATE,
+		     "EMIT outside the context of a GEN body");
+    loopenv = genenv->parent;
+    FAIL_ZERO_RETURN(errctx, (loopenv != NULL), AKBASIC_ERR_ENVIRONMENT,
+		     "EMIT from an orphaned environment");
+
+    PASS(errctx, akbasic_runtime_evaluate(obj, expr->right, &value));
+    /*
+     * Straight into the loop variable's storage, bypassing the arithmetic
+     * akbasic_environment_assign() and evaluate_for_condition() carry for a
+     * plain FOR: an EACH variable takes whatever type the GEN emits, string or
+     * structure element included, and there is no TO/STEP to compare it
+     * against.
+     */
+    PASS(errctx, akbasic_variable_set_subscript(loopenv->forNextVariable, value, zerosubscript, 1));
+    loopenv->nextline = loopenv->loopFirstLine;
+    /*
+     * The resume point, which may be several levels below `genenv` -- whatever
+     * nested FOR/DO/GOSUB environment this EMIT actually ran in. NEXT/LOOP
+     * reactivates exactly this one, so the nested structure picks up exactly
+     * where it left off rather than restarting at the top of the GEN body.
+     */
+    loopenv->forGeneratorEnv = obj->environment;
+    /*
+     * Not a pop, and not a single-level detach either: everything between here
+     * and `loopenv` -- `genenv` and any of its own descendants -- has to
+     * survive untouched to be resumed, so control moves to `loopenv` directly
+     * rather than walking the chain one release at a time.
+     */
+    obj->environment = loopenv;
+    SUCCEED_TRUE(obj, dest);
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *akbasic_cmd_end_gen(akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest)
+{
+    PREPARE_ERROR(errctx);
+    bool waiting = false;
+
+    (void)expr; (void)lval; (void)rval;
+    /*
+     * A END GEN reached while skipping forward to one is the end of a GEN
+     * body's *definition*, not the end of a call -- the same distinction
+     * RETURN draws for DEF.
+     */
+    PASS(errctx, akbasic_environment_is_waiting_for(obj->environment, "END GEN", &waiting));
+    if ( waiting ) {
+	PASS(errctx, akbasic_environment_stop_waiting(obj->environment, "END GEN"));
+	SUCCEED_TRUE(obj, dest);
+	SUCCEED_RETURN(errctx);
+    }
+    FAIL_ZERO_RETURN(errctx, (obj->environment->isGenerator), AKBASIC_ERR_STATE,
+		     "END GEN outside the context of a generator invocation");
+    /*
+     * Real exhaustion: release this environment and detach in the same
+     * motion prev_environment() always does, then clear the parent's
+     * reference to it so a caller pumping this loop can tell "still alive"
+     * apart from "nothing left to resume".
+     */
+    PASS(errctx, akbasic_runtime_prev_environment(obj));
+    obj->environment->forGeneratorEnv = NULL;
+    SUCCEED_TRUE(obj, dest);
+    SUCCEED_RETURN(errctx);
+}

src/runtime_structure.c

@@ -80,6 +80,31 @@ akerr_ErrorContext *akbasic_cmd_do(akbasic_Runtime *obj, akbasic_ASTLeaf *expr,
     FAIL_ZERO_RETURN(errctx, obj->environment->isDoLoop, AKBASIC_ERR_STATE,
 		     "DO did not establish its own scope");
 
+    if ( obj->environment->isEachLoop ) {
+	akbasic_Environment *loopenv = obj->environment;
+	akbasic_ASTLeaf *var = (expr != NULL ? expr->right : NULL);
+
+	FAIL_ZERO_RETURN(errctx, (var != NULL && akbasic_leaf_is_identifier(var)),
+			 AKBASIC_ERR_SYNTAX, "Expected DO EACH (variable) IN (generator call)");
+	FAIL_ZERO_RETURN(errctx, (loopenv->forToLeaf != NULL), AKBASIC_ERR_STATE,
+			 "Expected DO EACH (variable) IN (generator call)");
+
+	PASS(errctx, akbasic_environment_get(loopenv, var->identifier, &loopenv->forNextVariable));
+	FAIL_ZERO_RETURN(errctx, (loopenv->forNextVariable != NULL), AKBASIC_ERR_UNDEFINED,
+			 "Unable to get loop variable %s", var->identifier);
+
+	PASS(errctx, akbasic_runtime_generator_invoke(obj, loopenv, loopenv->forToLeaf));
+	loopenv->forToLeaf = NULL;
+
+	if ( loopenv->forGeneratorEnv == NULL ) {
+	    /* The generator produced nothing: skip the body, same as DO WHILE
+	       false does. */
+	    PASS(errctx, akbasic_environment_wait_for_command(loopenv, "LOOP"));
+	}
+	SUCCEED_TRUE(obj, dest);
+	SUCCEED_RETURN(errctx);
+    }
+
     PASS(errctx, loop_continues(obj, obj->environment->doConditionLeaf,
 				obj->environment->doConditionKind, &enter));
     if ( !enter ) {
@@ -114,7 +139,37 @@ akerr_ErrorContext *akbasic_cmd_loop(akbasic_Runtime *obj, akbasic_ASTLeaf *expr
     if ( obj->environment->exiting ) {
 	obj->environment->exiting = false;
 	PASS(errctx, akbasic_environment_stop_waiting(obj->environment, "LOOP"));
+	/* A live generator abandoned mid-run: release it too. */
+	if ( obj->environment->forGeneratorEnv != NULL ) {
+	    PASS(errctx, akbasic_runtime_release_generator(obj, obj->environment->forGeneratorEnv));
+	    obj->environment->forGeneratorEnv = NULL;
+	}
 	again = false;
+    } else if ( obj->environment->isEachLoop ) {
+	akbasic_Environment *loopenv = obj->environment;
+
+	PASS(errctx, akbasic_environment_stop_waiting(obj->environment, "LOOP"));
+	/*
+	 * A condition on the LOOP composes with EACH: it is checked after each
+	 * trip through the body, with the loop variable still holding that
+	 * trip's value, before the generator is pumped for the next one. A
+	 * condition that says stop abandons the generator exactly as EXIT does.
+	 */
+	again = true;
+	arg = (expr != NULL ? expr->right : NULL);
+	if ( arg != NULL ) {
+	    kind = (int)arg->literal_int;
+	    PASS(errctx, loop_continues(obj, arg->left, kind, &again));
+	}
+	if ( !again && loopenv->forGeneratorEnv != NULL ) {
+	    PASS(errctx, akbasic_runtime_release_generator(obj, loopenv->forGeneratorEnv));
+	    loopenv->forGeneratorEnv = NULL;
+	}
+	if ( again && loopenv->forGeneratorEnv != NULL ) {
+	    obj->environment = loopenv->forGeneratorEnv;
+	    PASS(errctx, akbasic_runtime_pump_generator(obj, loopenv));
+	}
+	again = (again && loopenv->forGeneratorEnv != NULL);
     } else {
 	PASS(errctx, akbasic_environment_stop_waiting(obj->environment, "LOOP"));
 	/*

src/scanner.c

@@ -48,6 +48,7 @@ static akerr_ErrorContext *is_at_end(akbasic_Runtime *obj, bool *dest)
 
 /**
  * @brief The character under the cursor.
+ * @param obj The runtime whose scan cursor is being read.
  * @param[out] dest The character. Untouched when there is none.
  * @param[out] got  Whether there was one. The old `bool` return.
  */
@@ -70,6 +71,7 @@ static akerr_ErrorContext *peek(akbasic_Runtime *obj, char *dest, bool *got)
 
 /**
  * @brief The character one past the cursor.
+ * @param obj The runtime whose scan cursor is being read.
  * @param[out] dest The character. Untouched when there is none.
  * @param[out] got  Whether there was one. The old `bool` return.
  */
@@ -145,6 +147,10 @@ static akerr_ErrorContext *add_token(akbasic_Runtime *obj, akbasic_TokenType tok
 
 /**
  * @brief Consume one more character when it matches, choosing between two token types.
+ * @param obj The runtime whose scan cursor is being advanced.
+ * @param cm The character that must be next for the match to succeed.
+ * @param truetype The token type to report when @p cm matches.
+ * @param falsetype The token type to report when it does not.
  * @param[out] matched Whether the character was consumed. The old `bool` return.
  *
  * On the chain below `peek`, so it reports the same way. See libakstdlib #38.

src/sprite_akgl.c

@@ -875,7 +875,7 @@ static akerr_ErrorContext AKERR_NOIGNORE *run_scan(akbasic_AkglSprites *state)
  * proxy carries the owner only so a resolver can push something. Nothing here
  * resolves anything, so the field stays empty and the shape is what matters.
  *
- * Layers are the other half. A wall sits on #AKGL_COLLISION_LAYER_STATIC and
+ * Layers are the other half. A wall sits on `AKGL_COLLISION_LAYER_STATIC` and
  * responds to nothing, which is the asymmetry libakgl's masks exist for: the
  * sprite's own `collidemask` includes STATIC, so a sprite finds a wall and two
  * walls never test against each other. Sixty-four motionless rectangles

src/verbs.c

@@ -74,14 +74,32 @@ static const akbasic_Verb VERBS[] = {
     { "DRAW",         AKBASIC_TOK_COMMAND,              -1, akbasic_parse_draw,    akbasic_cmd_draw },
     { "DSAVE",        AKBASIC_TOK_COMMAND_IMMEDIATE,    -1, NULL,                  akbasic_cmd_dsave },
     { "DVERIFY",      AKBASIC_TOK_COMMAND_IMMEDIATE,    -1, akbasic_parse_arglist, akbasic_cmd_dverify },
+    /*
+     * EACH is never dispatched on its own -- akbasic_parse_for() and
+     * akbasic_parse_do() consume it directly, the same way TO, STEP, WHILE and
+     * UNTIL are. It exists here only so the scanner gives it a COMMAND token
+     * rather than letting it scan as a plain identifier.
+     */
+    { "EACH",         AKBASIC_TOK_COMMAND,              -1, NULL,                  NULL },
     { "ELSE",         AKBASIC_TOK_COMMAND,              -1, NULL,                  NULL },
-    { "END",          AKBASIC_TOK_COMMAND,              -1, NULL,                  akbasic_cmd_end },
+    { "EMIT",         AKBASIC_TOK_COMMAND,              -1, NULL,                  akbasic_cmd_emit },
+    { "END",          AKBASIC_TOK_COMMAND,              -1, akbasic_parse_end,     akbasic_cmd_end },
+    /*
+     * `END GEN` is never scanned as one token -- END and GEN are ordinary
+     * COMMAND tokens on the same line -- so this row is reached only from
+     * akbasic_parse_end(), which builds a leaf carrying this exact name after
+     * it sees GEN follow END. It still has to be here, and in order, because
+     * dispatch is a bsearch on the leaf's name; the same reason INPUT# and
+     * PRINT# are.
+     */
+    { "END GEN",      AKBASIC_TOK_COMMAND,              -1, NULL,                  akbasic_cmd_end_gen },
     { "ENVELOPE",     AKBASIC_TOK_COMMAND,              -1, akbasic_parse_arglist, akbasic_cmd_envelope },
     { "ERR",          AKBASIC_TOK_FUNCTION,              1, NULL,                  akbasic_fn_err },
     { "EXIT",         AKBASIC_TOK_COMMAND,              -1, NULL,                  akbasic_cmd_exit },
     { "FETCH",        AKBASIC_TOK_COMMAND,              -1, akbasic_parse_arglist, akbasic_cmd_fetch },
     { "FILTER",       AKBASIC_TOK_COMMAND,              -1, akbasic_parse_arglist, akbasic_cmd_filter },
     { "FOR",          AKBASIC_TOK_COMMAND,              -1, akbasic_parse_for,     akbasic_cmd_for },
+    { "GEN",          AKBASIC_TOK_COMMAND,              -1, akbasic_parse_gen,     akbasic_cmd_gen },
     { "GET",          AKBASIC_TOK_COMMAND,              -1, NULL,                  akbasic_cmd_get },
     { "GETKEY",       AKBASIC_TOK_COMMAND,              -1, NULL,                  akbasic_cmd_getkey },
     { "GETMENU",      AKBASIC_TOK_COMMAND,              -1, akbasic_parse_arglist, akbasic_cmd_getmenu },
@@ -94,6 +112,9 @@ static const akbasic_Verb VERBS[] = {
     { "HEX",          AKBASIC_TOK_FUNCTION,              1, NULL,                  akbasic_fn_hex },
     { "HUD",          AKBASIC_TOK_COMMAND,              -1, akbasic_parse_optional_arglist, akbasic_cmd_hud },
     { "IF",           AKBASIC_TOK_COMMAND,              -1, akbasic_parse_if,      akbasic_cmd_if },
+    /* IN is consumed directly by akbasic_parse_for()/akbasic_parse_do()'s EACH
+       clause, the same way EACH itself is. */
+    { "IN",           AKBASIC_TOK_COMMAND,              -1, NULL,                  NULL },
     { "INPUT",        AKBASIC_TOK_COMMAND,              -1, akbasic_parse_input,   akbasic_cmd_input },
     /*
      * `INPUT#` and `PRINT#` are never scanned as verb names -- the scanner reads

src/verbs.h

@@ -20,6 +20,8 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_data(struct akbasic_Parser *par
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_graphic(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_draw(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_def(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_gen(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_end(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_dim(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_for(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_parse_if(struct akbasic_Parser *parser, akbasic_ASTLeaf **dest);
@@ -111,6 +113,11 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_swap(struct akbasic_Runtime *obj,
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_troff(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_tron(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);
 
+/* Group L generator verbs -- src/runtime_generator.c */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_gen(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_emit(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_end_gen(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);
+
 /* Verb handlers -- src/runtime_commands.c */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_auto(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_cmd_data(struct akbasic_Runtime *obj, akbasic_ASTLeaf *expr, akbasic_Value *lval, akbasic_Value *rval, akbasic_Value **dest);

tests/disk_verbs.c

@@ -244,10 +244,16 @@ static void test_no_drive_verbs(void)
 	harness_stop();
     }
 
-    /* DIRECTORY is refused for a different reason, and says which. */
+    /*
+     * DIRECTORY is refused for a different reason than the five above: not for
+     * want of a drive, but because it is unwritten. It used to name the missing
+     * libakstdlib wrapper; that wrapper landed, so naming it would be a lie.
+     */
     TEST_REQUIRE_OK(run_program("10 DIRECTORY\n"));
-    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "libakstdlib") != NULL,
+    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "not implemented") != NULL,
-		 "DIRECTORY should name the missing wrapper, got \"%s\"", HARNESS_OUTPUT);
+		 "DIRECTORY should say it is unwritten, got \"%s\"", HARNESS_OUTPUT);
+    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "libakstdlib") == NULL,
+		 "DIRECTORY must not still blame libakstdlib, got \"%s\"", HARNESS_OUTPUT);
     harness_stop();
 }
 

tests/generators.c

@@ -0,0 +1,360 @@
+/**
+ * @file generators.c
+ * @brief Generators: GEN/EMIT/END GEN and the FOR EACH/DO EACH loops over them.
+ *
+ * The golden corpus (tests/language/flowcontrol/generators_*.bas) covers the
+ * ordinary shapes: the issue's own ROOMOBJECTS example in both loop forms, an
+ * empty generator, a non-numeric EMIT and nested/interleaved invocations. This
+ * file covers what a byte-compared program cannot: that abandoning a
+ * generator with EXIT gives its environment back to the pool rather than
+ * leaking it, and that misusing a GEN fails cleanly rather than corrupting the
+ * environment stack.
+ */
+
+#include <string.h>
+
+#include <akbasic/error.h>
+#include <akbasic/runtime.h>
+
+#include "harness.h"
+#include "testutil.h"
+
+/** @brief Run a program to completion under an explicit step budget. */
+static akerr_ErrorContext AKERR_NOIGNORE *run_program_bounded(const char *source, int64_t steps)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, harness_start(NULL));
+    PASS(errctx, akbasic_runtime_load(&HARNESS_RUNTIME, source));
+    PASS(errctx, akbasic_runtime_start(&HARNESS_RUNTIME, AKBASIC_MODE_RUN));
+    PASS(errctx, akbasic_runtime_run(&HARNESS_RUNTIME, steps));
+    SUCCEED_RETURN(errctx);
+}
+
+/** @brief Run a program to completion, bounded so a hang fails rather than waits. */
+static akerr_ErrorContext AKERR_NOIGNORE *run_program(const char *source)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, run_program_bounded(source, 20000));
+    SUCCEED_RETURN(errctx);
+}
+
+/** @brief The issue's own example, as a sanity check independent of the golden corpus. */
+static void test_room_objects_smoke(void)
+{
+    TEST_REQUIRE_OK(run_program("10 DIM OBJ#(3)\n"
+				"20 OBJ#(0) = 100\n"
+				"30 OBJ#(1) = 200\n"
+				"40 OBJ#(2) = 300\n"
+				"50 GEN ROOMOBJECTS(R#)\n"
+				"60   FOR I# = 0 TO 2\n"
+				"70     IF I# <> 1 THEN EMIT OBJ#(I#)\n"
+				"80   NEXT I#\n"
+				"90 END GEN\n"
+				"100 FOR EACH O# IN ROOMOBJECTS(0)\n"
+				"110   PRINT O#\n"
+				"120 NEXT O#\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "100\n300\n");
+    harness_stop();
+}
+
+/**
+ * @brief EXIT out of a FOR EACH loop releases its generator, not just the loop.
+ *
+ * Run more FOR EACH/EXIT constructs than AKBASIC_MAX_ENVIRONMENTS -- each one
+ * takes two environments (the loop's own and the generator's) -- in a single
+ * program. If EXIT abandoned the generator environment instead of releasing
+ * it, this exhausts the pool partway through and the run reports "Environment
+ * pool exhausted" instead of finishing.
+ */
+static void test_exit_releases_generator_for_each(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN ONE(X#)\n"
+				"20   EMIT 1\n"
+				"30 END GEN\n"
+				"40 FOR K# = 1 TO 13\n"
+				"50   FOR EACH V# IN ONE(0)\n"
+				"60     EXIT\n"
+				"70   NEXT V#\n"
+				"80 NEXT K#\n"
+				"90 PRINT \"DONE\"\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "DONE\n");
+    harness_stop();
+}
+
+/** @brief The same leak check for DO EACH/EXIT. */
+static void test_exit_releases_generator_do_each(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN ONE(X#)\n"
+				"20   EMIT 1\n"
+				"30 END GEN\n"
+				"40 FOR K# = 1 TO 13\n"
+				"50   DO EACH V# IN ONE(0)\n"
+				"60     EXIT\n"
+				"70   LOOP\n"
+				"80 NEXT K#\n"
+				"90 PRINT \"DONE\"\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "DONE\n");
+    harness_stop();
+}
+
+/**
+ * @brief EXIT partway through, with more of the generator left to run, still
+ * frees the environment for the next construct that needs one.
+ */
+static void test_exit_partway_through(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN COUNTUP(N#)\n"
+				"20   FOR I# = 1 TO N#\n"
+				"30     EMIT I#\n"
+				"40   NEXT I#\n"
+				"50 END GEN\n"
+				"60 FOR EACH V# IN COUNTUP(10)\n"
+				"70   PRINT V#\n"
+				"80   IF V# = 2 THEN EXIT\n"
+				"90 NEXT V#\n"
+				"100 PRINT \"AFTER\"\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "1\n2\nAFTER\n");
+    harness_stop();
+}
+
+/**
+ * @brief Abandoning a generator that is itself suspended inside a FOR EACH
+ * over another generator releases the inner generator too.
+ *
+ * The inner generator's environment hangs off the *loop* scope inside OUTER's
+ * body as a child, off the parent chain -- the one place a bare parent walk
+ * never looks. Before akbasic_runtime_release_generator() recursed into
+ * `forGeneratorEnv`, every trip through this loop stranded one pool slot and
+ * the 13th trip died with "Environment pool exhausted".
+ */
+static void test_exit_releases_nested_generators(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN INNER(N#)\n"
+				"20   EMIT 1\n"
+				"30   EMIT 2\n"
+				"40 END GEN\n"
+				"50 GEN OUTER(N#)\n"
+				"60   FOR EACH I# IN INNER(0)\n"
+				"70     EMIT I#\n"
+				"80   NEXT I#\n"
+				"90 END GEN\n"
+				"100 FOR K# = 1 TO 40\n"
+				"110   FOR EACH V# IN OUTER(0)\n"
+				"120     EXIT\n"
+				"130   NEXT V#\n"
+				"140 NEXT K#\n"
+				"150 PRINT \"DONE\"\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "DONE\n");
+    harness_stop();
+}
+
+/**
+ * @brief A LOOP UNTIL that stops a DO EACH early releases the generator it
+ * abandons, every time.
+ */
+static void test_loop_condition_releases_generator(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN COUNTUP(N#)\n"
+				"20   FOR I# = 1 TO N#\n"
+				"30     EMIT I#\n"
+				"40   NEXT I#\n"
+				"50 END GEN\n"
+				"60 FOR K# = 1 TO 40\n"
+				"70   DO EACH V# IN COUNTUP(10)\n"
+				"80   LOOP UNTIL V# = 2\n"
+				"90 NEXT K#\n"
+				"100 PRINT \"DONE\"\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "DONE\n");
+    harness_stop();
+}
+
+/**
+ * @brief RETURN standing in a GEN's own frame ends the generator early,
+ * exactly as END GEN would -- a GEN is a function at heart.
+ */
+static void test_return_ends_generator(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN G(N#)\n"
+				"20   EMIT 1\n"
+				"30   RETURN\n"
+				"40   EMIT 2\n"
+				"50 END GEN\n"
+				"60 FOR EACH V# IN G(0)\n"
+				"70   PRINT V#\n"
+				"80 NEXT V#\n"
+				"90 PRINT \"DONE\"\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "1\nDONE\n");
+    harness_stop();
+}
+
+/**
+ * @brief RETURN with a value inside a GEN is refused: values leave a GEN one
+ * at a time, through EMIT, and there is no return slot waiting.
+ */
+static void test_return_value_in_generator_refused(void)
+{
+    TEST_REQUIRE_OK(run_program_bounded("10 GEN G(N#)\n"
+					"20   EMIT 1\n"
+					"30   RETURN 99\n"
+					"40 END GEN\n"
+					"50 FOR EACH V# IN G(0)\n"
+					"60   PRINT V#\n"
+					"70 NEXT V#\n"
+					"80 PRINT \"UNREACHABLE\"\n", 2000));
+    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "1\n") != NULL,
+		 "expected the first EMIT in \"%s\"", HARNESS_OUTPUT);
+    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "UNREACHABLE") == NULL,
+		 "RETURN with a value must stop the run, got \"%s\"", HARNESS_OUTPUT);
+    harness_stop();
+}
+
+/**
+ * @brief The unwind primitive releases a popped scope's suspended generator.
+ *
+ * Built by hand rather than through BASIC because the paths that need this --
+ * the error unwinds in pump_generator() and call_function() -- only trigger
+ * on C-level failures a program cannot politely ask for. The shape is the
+ * one EMIT leaves behind: a loop scope holding a detached generator child,
+ * with a further scope active above it.
+ */
+static void test_unwind_releases_suspended_generators(void)
+{
+    akbasic_Environment *root = NULL;
+    akbasic_Environment *loopenv = NULL;
+    akbasic_Environment *genenv = NULL;
+    akbasic_Environment *forenv = NULL;
+
+    TEST_REQUIRE_OK(harness_start(NULL));
+    root = HARNESS_RUNTIME.environment;
+
+    TEST_REQUIRE_OK(akbasic_runtime_new_environment(&HARNESS_RUNTIME));
+    loopenv = HARNESS_RUNTIME.environment;
+    loopenv->isEachLoop = true;
+
+    TEST_REQUIRE_OK(akbasic_runtime_new_environment(&HARNESS_RUNTIME));
+    genenv = HARNESS_RUNTIME.environment;
+    genenv->isGenerator = true;
+    TEST_REQUIRE_OK(akbasic_runtime_detach_environment(&HARNESS_RUNTIME));
+    loopenv->forGeneratorEnv = genenv;
+
+    TEST_REQUIRE_OK(akbasic_runtime_new_environment(&HARNESS_RUNTIME));
+    forenv = HARNESS_RUNTIME.environment;
+
+    TEST_REQUIRE_OK(akbasic_runtime_unwind_to_environment(&HARNESS_RUNTIME, root));
+    TEST_REQUIRE(HARNESS_RUNTIME.environment == root,
+		 "unwind must land on the target scope");
+    TEST_REQUIRE(!forenv->used && !loopenv->used && !genenv->used,
+		 "unwind must release the chain and the suspended generator");
+    harness_stop();
+}
+
+/**
+ * @brief A GEN invoked like an ordinary function, rather than through FOR
+ * EACH/DO EACH, fails cleanly.
+ *
+ * EMIT requires `isGenerator`, which only a FOR EACH/DO EACH invocation sets
+ * -- an ordinary call pushes a plain environment, exactly as a DEF's does --
+ * so the first EMIT the call reaches is where this is refused.
+ */
+static void test_called_like_a_function(void)
+{
+    akbasic_Value *args[1];
+    akbasic_Value argvalue;
+    akbasic_Value *out = NULL;
+
+    TEST_REQUIRE_OK(harness_start(NULL));
+    TEST_REQUIRE_OK(akbasic_runtime_load(&HARNESS_RUNTIME,
+					 "10 GEN ONE(N#)\n"
+					 "20   EMIT N#\n"
+					 "30 END GEN\n"));
+    TEST_REQUIRE_OK(akbasic_runtime_start(&HARNESS_RUNTIME, AKBASIC_MODE_RUN));
+    TEST_REQUIRE_OK(akbasic_runtime_run(&HARNESS_RUNTIME, 100));
+
+    TEST_REQUIRE_OK(akbasic_value_zero(&argvalue));
+    argvalue.valuetype = AKBASIC_TYPE_INTEGER;
+    argvalue.intval = 5;
+    args[0] = &argvalue;
+    TEST_REQUIRE_ANY_ERROR(akbasic_runtime_call_function(&HARNESS_RUNTIME, "ONE", args, 1, &out));
+    harness_stop();
+}
+
+/** @brief EMIT reached with no enclosing GEN invocation is refused. */
+static void test_emit_outside_gen(void)
+{
+    akbasic_ASTLeaf *leaf = NULL;
+    akbasic_Value *out = NULL;
+
+    TEST_REQUIRE_OK(harness_start(NULL));
+    TEST_REQUIRE_OK(akbasic_environment_zero(HARNESS_RUNTIME.environment));
+    TEST_REQUIRE_OK(harness_parse("EMIT 5", &leaf));
+    TEST_REQUIRE_ANY_ERROR(akbasic_runtime_evaluate(&HARNESS_RUNTIME, leaf, &out));
+    harness_stop();
+}
+
+/**
+ * @brief A GEN invoking itself, directly, is refused rather than recursing.
+ *
+ * Bounded tightly: a program that recursed forever would hang the whole
+ * suite, and this is exactly the case that must not.
+ */
+static void test_self_recursion_refused(void)
+{
+    TEST_REQUIRE_OK(run_program_bounded("10 GEN RECURSIVE(N#)\n"
+					"20   FOR EACH X# IN RECURSIVE(N# + 1)\n"
+					"30     EMIT X#\n"
+					"40   NEXT X#\n"
+					"50 END GEN\n"
+					"60 PRINT \"BEFORE\"\n"
+					"70 FOR EACH R# IN RECURSIVE(1)\n"
+					"80   PRINT R#\n"
+					"90 NEXT R#\n"
+					"100 PRINT \"UNREACHABLE\"\n", 2000));
+    /* Whatever else happened, the line before the recursive call ran and the
+       one two lines after invoking it -- which would only print after the
+       loop completed successfully -- did not. */
+    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "BEFORE\n") != NULL,
+		 "expected \"BEFORE\" in \"%s\"", HARNESS_OUTPUT);
+    TEST_REQUIRE(strstr(HARNESS_OUTPUT, "UNREACHABLE") == NULL,
+		 "self-recursion must not reach \"UNREACHABLE\", got \"%s\"", HARNESS_OUTPUT);
+    harness_stop();
+}
+
+/**
+ * @brief Independent (sibling) FOR EACH invocations of the same GEN are not
+ * self-recursion, even nested.
+ */
+static void test_sibling_invocations_allowed(void)
+{
+    TEST_REQUIRE_OK(run_program("10 GEN COUNTUP(N#)\n"
+				"20   FOR I# = 1 TO N#\n"
+				"30     EMIT I#\n"
+				"40   NEXT I#\n"
+				"50 END GEN\n"
+				"60 FOR EACH A# IN COUNTUP(2)\n"
+				"70   FOR EACH B# IN COUNTUP(2)\n"
+				"80     PRINT A# * 10 + B#\n"
+				"90   NEXT B#\n"
+				"100 NEXT A#\n"));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "11\n12\n21\n22\n");
+    harness_stop();
+}
+
+int main(void)
+{
+    test_room_objects_smoke();
+    test_exit_releases_generator_for_each();
+    test_exit_releases_generator_do_each();
+    test_exit_partway_through();
+    test_exit_releases_nested_generators();
+    test_loop_condition_releases_generator();
+    test_return_ends_generator();
+    test_return_value_in_generator_refused();
+    test_unwind_releases_suspended_generators();
+    test_called_like_a_function();
+    test_emit_outside_gen();
+    test_self_recursion_refused();
+    test_sibling_invocations_allowed();
+    return akbasic_test_failures;
+}

tests/language/flowcontrol/generators_call_as_function.bas

@@ -0,0 +1,6 @@
+10 REM A GEN invoked like an ordinary function is refused, not silently run.
+20 GEN ONE(N#)
+30     EMIT N#
+40 END GEN
+50 X# = ONE(5)
+60 PRINT "UNREACHABLE"

tests/language/flowcontrol/generators_call_as_function.txt

@@ -0,0 +1,2 @@
+? 50 : RUNTIME ERROR ONE is a GEN; call it with FOR EACH or DO EACH, not as a function
+

tests/language/flowcontrol/generators_do_condition_misplaced.bas

@@ -0,0 +1,8 @@
+10 REM A DO EACH takes its condition on the LOOP, not on the DO line.
+20 GEN ONE(N#)
+30     EMIT N#
+40 END GEN
+50 DO EACH V# IN ONE(1) WHILE V# < 9
+60     PRINT V#
+70 LOOP
+80 PRINT "UNREACHABLE"

tests/language/flowcontrol/generators_do_condition_misplaced.txt

@@ -0,0 +1,2 @@
+? 50 : PARSE ERROR DO EACH takes its WHILE/UNTIL on the LOOP, and nothing else here
+

tests/language/flowcontrol/generators_doeach.bas

@@ -0,0 +1,14 @@
+10 REM Same generator as generators_foreach.bas, via DO EACH ... LOOP.
+20 DIM OBJ#(3)
+30 OBJ#(0) = 100
+40 OBJ#(1) = 200
+50 OBJ#(2) = 300
+60 GEN ROOMOBJECTS(R#)
+70     FOR I# = 0 TO 2
+80         IF I# <> 1 THEN EMIT OBJ#(I#)
+90     NEXT I#
+100 END GEN
+110 DO EACH O# IN ROOMOBJECTS(0)
+120     PRINT O#
+130 LOOP
+140 PRINT "DONE"

tests/language/flowcontrol/generators_doeach.txt

@@ -0,0 +1,3 @@
+100
+300
+DONE

tests/language/flowcontrol/generators_emit_outside.bas

@@ -0,0 +1,3 @@
+10 REM EMIT outside any GEN invocation is refused cleanly.
+20 EMIT 5
+30 PRINT "UNREACHABLE"

tests/language/flowcontrol/generators_emit_outside.txt

@@ -0,0 +1,2 @@
+? 20 : RUNTIME ERROR EMIT outside the context of a GEN body
+

tests/language/flowcontrol/generators_empty.bas

@@ -0,0 +1,11 @@
+10 REM A GEN with no EMIT at all runs its FOR EACH/DO EACH body zero times.
+20 GEN NOTHING(N#)
+30 END GEN
+40 FOR EACH X# IN NOTHING(0)
+50     PRINT "NEVER FOR"
+60 NEXT X#
+70 PRINT "AFTER FOR"
+80 DO EACH Y# IN NOTHING(0)
+90     PRINT "NEVER DO"
+100 LOOP
+110 PRINT "AFTER DO"

tests/language/flowcontrol/generators_empty.txt

@@ -0,0 +1,2 @@
+AFTER FOR
+AFTER DO

tests/language/flowcontrol/generators_foreach.bas

@@ -0,0 +1,15 @@
+10 REM The GEN/FOR EACH example from issue #57, with real arrays standing in
+20 REM for OBJCOUNT%/VISIBLE/OBJ%.
+30 DIM OBJ#(3)
+40 OBJ#(0) = 100
+50 OBJ#(1) = 200
+60 OBJ#(2) = 300
+70 GEN ROOMOBJECTS(R#)
+80     FOR I# = 0 TO 2
+90         IF I# <> 1 THEN EMIT OBJ#(I#)
+100     NEXT I#
+110 END GEN
+120 FOR EACH O# IN ROOMOBJECTS(0)
+130     PRINT O#
+140 NEXT O#
+150 PRINT "DONE"

tests/language/flowcontrol/generators_foreach.txt

@@ -0,0 +1,3 @@
+100
+300
+DONE

tests/language/flowcontrol/generators_loop_condition.bas

@@ -0,0 +1,15 @@
+10 REM A WHILE or UNTIL on the LOOP composes with DO EACH: it is checked
+20 REM after each trip through the body, with the loop variable still
+30 REM holding that trip's value. Stopping abandons the generator cleanly.
+40 GEN COUNTUP(N#)
+50     FOR I# = 1 TO N#
+60         EMIT I#
+70     NEXT I#
+80 END GEN
+90 DO EACH V# IN COUNTUP(10)
+100     PRINT V#
+110 LOOP UNTIL V# = 3
+120 DO EACH W# IN COUNTUP(4)
+130     PRINT W# * 10
+140 LOOP WHILE W# < 3
+150 PRINT "DONE"

tests/language/flowcontrol/generators_loop_condition.txt

@@ -0,0 +1,7 @@
+1
+2
+3
+10
+20
+30
+DONE

tests/language/flowcontrol/generators_mismatched_next.bas

@@ -0,0 +1,10 @@
+10 REM A stray NEXT with nothing open behaves like the plain-FOR case: the
+20 REM FOR EACH's own NEXT closes it cleanly, and a second one errors.
+30 GEN ONE(N#)
+40     EMIT N#
+50 END GEN
+60 FOR EACH O# IN ONE(1)
+70     PRINT O#
+80 NEXT O#
+90 NEXT O#
+100 PRINT "UNREACHABLE"

tests/language/flowcontrol/generators_mismatched_next.txt

@@ -0,0 +1,3 @@
+1
+? 90 : RUNTIME ERROR NEXT outside the context of FOR
+

tests/language/flowcontrol/generators_nested.bas

@@ -0,0 +1,22 @@
+10 REM Nested FOR EACH/DO EACH over the same GEN with different arguments,
+20 REM in every combination of the two loop shapes.
+30 GEN COUNTUP(N#)
+40     FOR I# = 1 TO N#
+50         EMIT I#
+60     NEXT I#
+70 END GEN
+80 FOR EACH A# IN COUNTUP(2)
+90     FOR EACH B# IN COUNTUP(3)
+100         PRINT A# * 10 + B#
+110     NEXT B#
+120 NEXT A#
+130 DO EACH C# IN COUNTUP(2)
+140     DO EACH D# IN COUNTUP(2)
+150         PRINT C# * 100 + D#
+160     LOOP
+170 LOOP
+180 FOR EACH E# IN COUNTUP(2)
+190     DO EACH F# IN COUNTUP(2)
+200         PRINT E# * 1000 + F#
+210     LOOP
+220 NEXT E#

tests/language/flowcontrol/generators_nested.txt

@@ -0,0 +1,14 @@
+11
+12
+13
+21
+22
+23
+101
+102
+201
+202
+1001
+1002
+2001
+2002

tests/language/flowcontrol/generators_return.bas

@@ -0,0 +1,15 @@
+10 REM RETURN ends a GEN early, exactly as END GEN would: a GEN is a
+20 REM function at heart, and only EMIT is different about it. Like a
+30 REM GOSUB's or DEF's RETURN, it must stand in the GEN's own scope,
+40 REM not inside a FOR or DO the body opened.
+50 GEN FIRSTFEW(N#)
+60     EMIT 1
+70     IF N# < 2 THEN RETURN
+80     EMIT 2
+90     IF N# < 3 THEN RETURN
+100     EMIT 3
+110 END GEN
+120 FOR EACH V# IN FIRSTFEW(2)
+130     PRINT V#
+140 NEXT V#
+150 PRINT "DONE"

tests/language/flowcontrol/generators_return.txt

@@ -0,0 +1,3 @@
+1
+2
+DONE

tests/language/flowcontrol/generators_string.bas

@@ -0,0 +1,11 @@
+10 REM FOR EACH/DO EACH accept any emitted type, not just numeric.
+20 GEN WORDS(N#)
+30     EMIT "HELLO"
+40     EMIT "WORLD"
+50 END GEN
+60 FOR EACH W$ IN WORDS(0)
+70     PRINT W$
+80 NEXT W$
+90 DO EACH V$ IN WORDS(0)
+100     PRINT V$
+110 LOOP

tests/language/flowcontrol/generators_string.txt

@@ -0,0 +1,4 @@
+HELLO
+WORLD
+HELLO
+WORLD

tests/verbs_table.c

@@ -66,15 +66,18 @@ int main(void)
     /*
      * These rows have no exec handler because another verb's parse path consumes
      * them; they are never evaluated on their own. `WHILE` and `UNTIL` belong to
-     * DO and LOOP the way `TO` and `STEP` belong to FOR. Any other missing
+     * DO and LOOP the way `TO` and `STEP` belong to FOR, and `EACH`/`IN` belong
-     * handler is a verb that would report "Unknown command" at runtime.
+     * to FOR EACH and DO EACH the same way. Any other missing handler is a verb
+     * that would report "Unknown command" at runtime.
      */
     for ( i = 0; i < count; i++ ) {
 	if ( table[i].exec != NULL ) {
 	    continue;
 	}
 	TEST_REQUIRE(strcmp(table[i].name, "AND") == 0 ||
+		     strcmp(table[i].name, "EACH") == 0 ||
 		     strcmp(table[i].name, "ELSE") == 0 ||
+		     strcmp(table[i].name, "IN") == 0 ||
 		     strcmp(table[i].name, "NOT") == 0 ||
 		     strcmp(table[i].name, "OR") == 0 ||
 		     strcmp(table[i].name, "REM") == 0 ||