Merge branch 'feature/reduce_memory_usage' into galaga-tutorial

Reflow the approved reference cases, shorten local fixture comments, and split the executable docs line so the 80-byte input buffer can read every source line.

Co-authored-by: andrew <andrew@aklabs.net>

.gitea/workflows/ci.yaml

@@ -17,7 +17,7 @@ jobs:
           # Not recursive, deliberately. The top-level build needs
           # deps/libakerror and deps/libakstdlib, via add_subdirectory, and
           # nothing else: the golden corpus and the Commodore font now live in
-          # this repository (tests/language/ and assets/fonts/), so
+          # this repository (tests/reference/ and assets/fonts/), so
           # deps/basicinterpret is no longer a build dependency at all.
           # It does *not* need deps/libakgl, which is guarded behind
           # AKBASIC_WITH_AKGL and defaults OFF -- and recursing into it would
@@ -62,9 +62,11 @@ jobs:
         run: |
           cmake -S . -B build
           cmake --build build --parallel 2
-      # The suite is 112 cases: 65 language files with sibling expectations,
+      # The suite is 78 cases: 41 golden files byte-compared against the Go
-      # 43 unit tests, 3 embedding examples, and docs_examples.
+      # reference's own corpus (checked in at tests/reference/, see its README),
-      # Some unit tests assert the *correct* contract for known defects (TODO.md
+      # 9 local golden cases for verbs the reference never implemented, 25 unit
+      # tests, 2 embedding examples, and 1 known-failing test that asserts the
+      # *correct* contract for defects carried over from the reference (TODO.md
       # section 6). A green run therefore does not mean defect-free -- see
       # AKBASIC_KNOWN_FAILING_TESTS.
       #

CLAUDE.md

@@ -26,7 +26,7 @@ scripting engine for game authors.
 | [the issue tracker](https://source.starfort.tech/andrew/akbasic/issues) | **Outstanding defects and gaps.** Labelled by kind and blast radius; `status::grooming` means the scope is not settled yet |
 | [`TODO.md`](TODO.md) | The record: settled design decisions, the deviation register, defects already fixed, and the reasoning behind the measurements. §0.1 first — it retires the byte-for-byte fidelity constraint several later sections were written on |
 | [`README.md`](README.md) | What the project is and why, for somebody who has not seen it |
-| [`docs/`](docs/README.md) | The language itself: eighteen chapters, verb and function reference. [Chapter 14](docs/14-architecture.md) is the interpreter's architecture — the step loop, the pools, the two kinds of error, and how to debug it. [Chapter 15](docs/15-error-codes.md) is the error-code appendix. [Chapters 17](docs/17-tutorial-breakout.md) and [18](docs/18-tutorial-breakout-artwork.md) are tutorials that build the games in `examples/breakout/` |
+| [`docs/`](docs/README.md) | The language itself: twenty-one chapters, verb and function reference. [Chapter 14](docs/14-architecture.md) is the interpreter's architecture — the step loop, the pools, the two kinds of error, and how to debug it. [Chapter 15](docs/15-error-codes.md) is the error-code appendix. [Chapters 17](docs/17-tutorial-breakout.md) and [18](docs/18-tutorial-breakout-artwork.md) are tutorials that build the games in `examples/breakout/`; [Chapters 20](docs/20-tutorial-galaga.md) and [21](docs/21-tutorial-galaga-enemies.md) build the embedding host in `examples/galaga/` |
 | `deps/libakerror/AGENTS.md` | The `ATTEMPT`/`CLEANUP`/`PROCESS`/`HANDLE`/`FINISH` protocol, authoritatively |
 | `deps/libakerror/UPGRADING.md` | 1.0.0's status registry. Required before writing an error code |
 | `deps/<library>/AGENTS.md` | Per-repo rules. Read the relevant one **before editing a submodule** |
@@ -57,9 +57,9 @@ repeating where you will see them:
   `include/akgl/SDL_GameControllerDB.h`. Change the template or the generator script.
 - **Do not reformat code you are not otherwise changing.** Several files mix tabs and spaces
   and there is no repo-wide formatter; style conversions get their own commit.
-- **Keep `tests/language/` editable.** Its `.bas` programs and sibling `.txt` expectations
+- **Do not edit `tests/reference/`.** Those expectations came from the Go implementation and
-  are changed together when behavior changes. Record deliberate language decisions in
+  are never edited to suit this interpreter. A deliberate divergence goes in
-  `TODO.md` or `docs/13-differences.md`.
+  `tests/reference/README.md`'s divergence table and `docs/13-differences.md`.
 - **Open an issue for outstanding work; do not add it to `TODO.md`.**
   <https://source.starfort.tech/andrew/akbasic/issues>, or `tea issues create --repo
   andrew/akbasic`. Name the file and line, the functional consequence, and what closing it would

CMakeLists.txt

@@ -268,6 +268,69 @@ if(AKBASIC_BUILD_EXAMPLES)
   endforeach()
 endif()
 
+# The galaga example: a C game on libakgl with the interpreter embedded as its
+# enemy-behavior engine. Chapters 20 and 21 build it from an empty file, so it
+# is compiled and run by every AKGL build rather than rotting in a document.
+# The asset, script and font paths are baked in so the smoke test can launch
+# from any working directory; --assets and --script override them at runtime.
+if(AKBASIC_BUILD_EXAMPLES AND AKBASIC_WITH_AKGL)
+  add_executable(akbasic_example_galaga
+    examples/galaga/main.c
+    examples/galaga/script.c
+    examples/galaga/enemies.c
+    examples/galaga/player.c)
+  target_compile_options(akbasic_example_galaga PRIVATE -Wall -Wextra)
+  target_compile_definitions(akbasic_example_galaga PRIVATE
+    GALAGA_ASSET_DIR="${CMAKE_CURRENT_SOURCE_DIR}/examples/galaga/assets"
+    GALAGA_SCRIPT_PATH="${CMAKE_CURRENT_SOURCE_DIR}/examples/galaga/galaga.bas"
+    GALAGA_FONT_PATH="${CMAKE_CURRENT_SOURCE_DIR}/assets/fonts/C64_Pro_Mono-STYLE.ttf")
+  target_link_libraries(akbasic_example_galaga PRIVATE akbasic akgl
+    SDL3::SDL3 SDL3_ttf::SDL3_ttf SDL3_image::SDL3_image)
+  akbasic_instrument(akbasic_example_galaga)
+  # Ten seconds of scripted play under the headless drivers: the script boots,
+  # a wave enters and forms, the autoplay pilot shoots at it, and the program
+  # tears down and exits 0. A tutorial that stops working fails here rather
+  # than in front of a reader.
+  _add_test(NAME example_galaga COMMAND akbasic_example_galaga --frames 600 --autoplay)
+  _set_tests_properties(example_galaga PROPERTIES TIMEOUT 120
+    ENVIRONMENT "SDL_VIDEODRIVER=dummy;SDL_AUDIODRIVER=dummy;SDL_RENDER_DRIVER=software")
+
+  # The boundary's round-trip test: links the real script.c and the real
+  # galaga.bas, and fails the moment the two sides of the interop disagree.
+  add_executable(akbasic_example_galaga_interop
+    examples/galaga/interop_test.c
+    examples/galaga/script.c)
+  target_compile_options(akbasic_example_galaga_interop PRIVATE -Wall -Wextra)
+  target_compile_definitions(akbasic_example_galaga_interop PRIVATE
+    GALAGA_SCRIPT_PATH="${CMAKE_CURRENT_SOURCE_DIR}/examples/galaga/galaga.bas")
+  target_link_libraries(akbasic_example_galaga_interop PRIVATE akbasic akgl
+    SDL3::SDL3 m)
+  akbasic_instrument(akbasic_example_galaga_interop)
+  _add_test(NAME example_galaga_interop COMMAND akbasic_example_galaga_interop)
+  _set_tests_properties(example_galaga_interop PROPERTIES TIMEOUT 120)
+
+  # Regenerating the game figures in docs/ is a deliberate act, never part of
+  # a build, for the same reason docs_screenshots is: the PNGs are checked in.
+  # Wall-clock dt makes each regeneration differ by a few pixels of starfield,
+  # so expect a binary diff every time this runs; commit one only when the
+  # content changed on purpose. (docs_galaga_figures, not docs_game_figures:
+  # the libakgl submodule already owns that target name.)
+  add_custom_target(docs_galaga_figures
+    COMMAND ${CMAKE_COMMAND} -E env SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy
+            SDL_RENDER_DRIVER=software
+            $<TARGET_FILE:akbasic_example_galaga> --frames 40
+            --screenshot "${CMAKE_CURRENT_SOURCE_DIR}/docs/images/galaga-title.png"
+            --screenshot-frame 30
+    COMMAND ${CMAKE_COMMAND} -E env SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy
+            SDL_RENDER_DRIVER=software
+            $<TARGET_FILE:akbasic_example_galaga> --autoplay --frames 370
+            --screenshot "${CMAKE_CURRENT_SOURCE_DIR}/docs/images/galaga-wave.png"
+            --screenshot-frame 360
+    DEPENDS akbasic_example_galaga
+    COMMENT "Regenerating the galaga figures in docs/images"
+    VERBATIM)
+endif()
+
 # ---------------------------------------------------------------------------
 # Tests.
 #
@@ -448,7 +511,7 @@ if(AKBASIC_WITH_AKGL)
   # against.
   #
   # **A byte comparison of a rendered PNG is a deliberate bet**, the same bet
-  # the language corpus makes about golden output: that the dummy video
+  # tests/reference/ already makes about golden output: that the dummy video
   # driver and the software renderer are reproducible. They are, run to run and
   # build to build. What is untested is an SDL upgrade that shifts one pixel of
   # a diagonal, and the answer to that is to regenerate the figures in the same
@@ -531,20 +594,63 @@ if(AKBASIC_WILL_FAIL_TESTS OR AKBASIC_KNOWN_FAILING_TESTS)
   )
 endif()
 
-# The editable language corpus. One CTest case per .bas so a failure names the
+# The reference's own corpus, byte-compared against the sibling .txt. One CTest
-# file. Each program is paired with a sibling .txt expectation; see
+# case per .bas so a failure names the file.
-# tests/language/README.md for the editing rule.
 #
-# The corpus includes programs carried over from the deprecated Go implementation
+# It used to be driven in place out of deps/basicinterpret, on the reasoning that
-# and cases written for this interpreter. Their provenance is useful when
+# copying a submodule's corpus guarantees drift. That reasoning was sound and it
-# investigating a regression, but it does not make any case immutable.
+# has been overruled deliberately: the Go dependency is being deprecated, and a
+# build that cannot run its acceptance suite without cloning the implementation
+# it replaced is not finished. The copy is byte-identical to
+# basicinterpreter@d76162c and tests/reference/README.md records
+# where it came from and what the drift now costs.
+file(GLOB_RECURSE AKBASIC_GOLDEN_CASES
+  RELATIVE "${CMAKE_CURRENT_SOURCE_DIR}/tests/reference"
+  "${CMAKE_CURRENT_SOURCE_DIR}/tests/reference/*.bas"
+)
+
+foreach(_case IN LISTS AKBASIC_GOLDEN_CASES)
+  string(REGEX REPLACE "^tests/" "" _name "${_case}")
+  string(REGEX REPLACE "\\.bas$" "" _name "${_name}")
+  string(REPLACE "/" "_" _name "${_name}")
+  _add_test(
+    NAME golden_${_name}
+    COMMAND ${CMAKE_COMMAND}
+            -DBASIC=$<TARGET_FILE:basic>
+            -DCASE=${CMAKE_CURRENT_SOURCE_DIR}/tests/reference/${_case}
+            -P ${CMAKE_CURRENT_SOURCE_DIR}/tests/golden.cmake
+  )
+endforeach()
+
+if(AKBASIC_GOLDEN_CASES)
+  set(AKBASIC_GOLDEN_NAMES)
+  foreach(_case IN LISTS AKBASIC_GOLDEN_CASES)
+    string(REGEX REPLACE "^tests/" "" _name "${_case}")
+    string(REGEX REPLACE "\\.bas$" "" _name "${_name}")
+    string(REPLACE "/" "_" _name "${_name}")
+    list(APPEND AKBASIC_GOLDEN_NAMES golden_${_name})
+  endforeach()
+  _set_tests_properties(${AKBASIC_GOLDEN_NAMES} PROPERTIES TIMEOUT 30)
+  # An AKGL build of `basic` opens a window, and forty-one of them is not what
+  # anybody running the suite wanted. The dummy driver produces the same stdout,
+  # which is the only thing a golden case compares.
+  if(AKBASIC_WITH_AKGL)
+    _set_tests_properties(${AKBASIC_GOLDEN_NAMES} PROPERTIES
+      ENVIRONMENT "SDL_VIDEODRIVER=dummy;SDL_AUDIODRIVER=dummy;SDL_RENDER_DRIVER=software")
+  endif()
+endif()
+
+# The local golden corpus, for verbs the reference never implemented.
 #
-# Programs carried over from the deprecated Go implementation and cases written
+# Still separate now that the reference's corpus lives in this repository too,
-# for this interpreter use the same editable `.bas`/`.txt` contract. Registered
+# and the reason changed rather than went away: tests/reference/ is a *record* of
-# under local_ so every failure identifies the program that produced it.
+# what the Go implementation did and nothing in it should ever be edited to suit
+# this one, while tests/language/ is ours to change. Registered under local_ so a
+# failure says at a glance which of the two it came from -- and so a diff that
+# touches tests/reference/ stands out as the thing it is.
 #
 # Note what this can and cannot cover. The graphics and sound verbs draw and play
-# rather than print, so what a golden file sees of them is their refusals and
+# rather than print, so what a golden file sees of them is their *refusals* and
 # whatever a program can PRINT about the state they changed. The behaviour that
 # reaches a device is asserted against tests/mockdevice.h instead.
 file(GLOB_RECURSE AKBASIC_LOCAL_CASES

MAINTENANCE.md

@@ -88,7 +88,7 @@ source stays readable as documentation of what the original did. Neither is bind
 
 **It is not a build or test dependency.** Both configurations have been configured, built and
 run from scratch with it moved out of the tree. Its acceptance corpus is checked in at
-`tests/language/` and its Commodore font at `assets/fonts/`.
+`tests/reference/` and its Commodore font at `assets/fonts/`.
 
 ```sh norun
 cd deps/basicinterpret
@@ -351,10 +351,15 @@ name. That is not cosmetic: `add_executable` creates a dependency's targets even
 
 ### The golden corpora
 
-`tests/language/` is the editable language corpus. It includes cases carried over from the
+`tests/reference/` is the Go implementation's own acceptance suite, byte-compared.
-deprecated Go implementation as well as cases written for this interpreter. Every `.bas` file
+**Nothing in it is ever edited to suit this interpreter.** If a case fails, either this
-has a sibling `.txt` expectation, and a new language feature needs that pair as well as unit
+interpreter is wrong or the divergence is deliberate — and a deliberate one goes in
-tests. Change both deliberately in the same commit; provenance does not make a case immutable.
+`tests/reference/README.md`'s divergence table and `docs/13-differences.md`, not into the
+expectation file. `tests/reference/README.md`
+says the same thing at more length.
+
+`tests/language/` is ours and may be changed freely. A new language feature needs a
+`.bas`/`.txt` pair there as well as unit tests.
 
 ### Mutation-check a fix before you believe it
 

README.md

@@ -10,7 +10,7 @@ implementation that started from the Java Lox instructions in
 [craftinginterpreters.com](https://craftinginterpreters.com) and then struck off on its own. That
 project is deprecated. It is vendored here as the behavioural spec to read when a question about
 semantics comes up, and its acceptance corpus is checked in at
-[`tests/language/`](tests/language/README.md) and runs on every build — so nothing about
+[`tests/reference/`](tests/reference/README.md) and runs on every build — so nothing about
 building or testing this project needs it.
 
 ## Quickstart
@@ -24,7 +24,7 @@ ctest --test-dir build --output-on-failure
 
 ```sh norun
 ./build/basic                                          # the REPL
-./build/basic tests/language/functions.bas             # run a program
+./build/basic tests/reference/language/functions.bas   # run a program
 ```
 
 ```basic
@@ -126,10 +126,10 @@ version are catalogued in [`TODO.md`](TODO.md) and summarised for a BASIC progra
 
 | | |
 |---|---|
-| [`docs/`](docs/README.md) | The guide: eighteen chapters, the language then each hardware area then a reference section for every verb and function, [Chapter 14](docs/14-architecture.md) on the interpreter's own architecture, [Chapter 15](docs/15-error-codes.md) listing every error code, and [Chapters 17](docs/17-tutorial-breakout.md) and [18](docs/18-tutorial-breakout-artwork.md) building a whole game twice |
+| [`docs/`](docs/README.md) | The guide: twenty-one chapters, the language then each hardware area then a reference section for every verb and function, [Chapter 14](docs/14-architecture.md) on the interpreter's own architecture, [Chapter 15](docs/15-error-codes.md) listing every error code, [Chapters 17](docs/17-tutorial-breakout.md) and [18](docs/18-tutorial-breakout-artwork.md) building a whole game twice, and [Chapters 20](docs/20-tutorial-galaga.md) and [21](docs/21-tutorial-galaga-enemies.md) building a C game that embeds the interpreter |
 | [`MAINTENANCE.md`](MAINTENANCE.md) | For contributors and maintainers: the documentation-example harness, the three test lists, mutation testing, error-code allocation, style |
 | [`TODO.md`](TODO.md) | Outstanding defects, with file, line and consequence |
-| [`tests/language/README.md`](tests/language/README.md) | The editable language corpus and the rule for changing it |
+| [`tests/reference/README.md`](tests/reference/README.md) | Where the golden corpus came from, and the rule for changing it |
 
 API documentation builds with `doxygen Doxyfile`, into `build/docs/html`.
 

TODO.md

@@ -38,7 +38,7 @@ What it changes:
 - **§1.8's message-text contract is now a convention.** Improving a message is allowed; it costs
   a golden file, which is a cost rather than a veto.
 - **§5's bar drops** from "defensible against the golden suite" to defensible on its own merits.
-- **`tests/language/` is the editable language corpus rather than a protected specification.** Diverging from
+- **`tests/reference/` becomes a regression suite rather than a specification.** Diverging from
   it is allowed and must be deliberate and recorded — see its README.
 
 What it does **not** change:
@@ -306,13 +306,13 @@ to `Println`, which adds another.
 **This used to be a hard contract and is now a default.** The Go implementation is deprecated
 and will not be updated, so the two projects are no longer required to match — see §0.1. What
 survives is the practical half: these strings and this newline behaviour are what every
-expectation in `tests/language/` was written against, so changing one means changing the paired
+expectation in `tests/reference/` was written against, so changing one means changing golden
 files, and that is worth doing on purpose rather than by accident. A message that reads
 awkwardly *may* now be improved; do it deliberately, move the expectations in the same commit,
 and add a line to §5.
 
 Numeric formatting still matches the reference: integers via `%" PRId64 "`, floats via `%f`
-(Go's `%f` and C's `%f` both give six decimals — `tests/language/arithmetic/float.txt`
+(Go's `%f` and C's `%f` both give six decimals — `tests/reference/language/arithmetic/float.txt`
 confirms). No reason to change it, which is different from not being allowed to.
 
 ### 1.9 Which `libakstdlib` calls are cleared for use — **the bans are lifted**
@@ -375,7 +375,7 @@ Phases 0 through 6 of the original plan are done. The interpreter builds clean u
 
 It *did* reproduce the reference byte for byte, and that claim is retired rather than broken:
 §0.1 released it, and one case has since diverged deliberately (§6 item 16, listed in
-`tests/language/README.md`). Everything else still matches, which is worth knowing but is no
+`tests/reference/README.md`). Everything else still matches, which is worth knowing but is no
 longer a gate.
 
 ```sh
@@ -408,16 +408,17 @@ and the only path that existed — `AKBASIC_MODE_RUNSTREAM` reading through the
 is the code the README quotes, built by every build and registered as a CTest case so a
 signature change breaks the build rather than rotting the document.
 
-**The acceptance suite is the editable language corpus, checked in at `tests/language/`.** All
+**The acceptance suite is the reference's own corpus, checked in at `tests/reference/`.** All
-65 `.bas` files are registered as individual CTest cases and compared against their `.txt`
+41 `.bas` files are registered as individual CTest cases and byte-compared against their `.txt`
 — including the trailing double newline on an error line (§1.8).
 
 It was driven *in place* out of `deps/basicinterpret` until 2026-07-31, on the reasoning that
 copying a submodule's corpus guarantees drift. That reasoning was sound and was overruled
 deliberately: the Go dependency is being deprecated, and a build that cannot run its own
 acceptance suite without cloning the implementation it replaced is not finished. The copy is
-originally byte-identical to `basicinterpreter@d76162c`, and `tests/language/README.md` records the
+byte-identical to `basicinterpreter@d76162c`, and `tests/reference/README.md` records the
-provenance and the rule that programs and expectations are edited together deliberately.
+provenance, the cost of the drift nobody is watching for now, and the rule that those
+expectations are never edited to suit this interpreter.
 
 **Nothing in the build or the suite needs `deps/basicinterpret` any more**, and that is checked
 rather than assumed — both configurations were configured, built and run from scratch with the
@@ -1025,7 +1026,7 @@ deviations from the reference's *program*: `main.go` and the SDL half of
 
     **What it costs a program:** a listing that used `INPUT$`, `LEN#` or `GOTO%` as a variable
     stops parsing, and the fix is to rename the variable. One case in the reference's own corpus
-    did exactly that; see `tests/language/examples/strreverse.bas`.
+    did exactly that; see `tests/reference/README.md`.
 
 ### Deviations in statement separation
 
@@ -1390,10 +1391,10 @@ deviations from the reference's *program*: `main.go` and the SDL half of
     **This one moved a golden file.** A line with no number used to be filed under the loader's
     cursor unchanged — that is, on top of the line before it — so two unnumbered lines in a row
     silently lost the first, and a *blank* line erased whatever preceded it. The reference does
-    the same, and `tests/language/arithmetic/integer.bas` is the proof: four `PRINT`
+    the same, and `tests/reference/language/arithmetic/integer.bas` is the proof: four `PRINT`
     statements, an expectation with three values, and a trailing blank line that erased
     `40 PRINT 4 - 2` before the program ran. The expectation is now `4 4 2 2` and
-    `tests/language/README.md` records it.
+    `tests/reference/README.md` records it.
 
     In its place: `akbasic_runtime_file_line()` (`src/runtime.c`) is the one implementation of
     the rule, shared by `akbasic_runtime_load()`, RUNSTREAM and `DLOAD`. A numbered line is
@@ -1585,9 +1586,9 @@ be reproduced before it can be fixed.
 
     **It cost one golden case, exactly as predicted, and the cost turned out to be nothing.**
     The reference's `examples/strreverse.bas` names a variable `INPUT$`; the variable is renamed
-    to `SOURCE$` in `tests/language/examples/strreverse.bas`, the expectation is byte-for-byte unchanged — the program
+    to `SOURCE$` in `tests/reference/`, the expectation is byte-for-byte unchanged — the program
     still prints `REVERSED: OLLEH` — and the case keeps every bit of its coverage. Recorded in
-    `tests/language/README.md` records the corpus editing rule.
+    `tests/reference/README.md`'s divergence table, which this is the first entry in.
 
     This item sat parked because the corpus was the acceptance contract and lived in a submodule
     this repository could not edit. Both premises are gone: the corpus is checked in, and
@@ -2231,10 +2232,10 @@ update --init --recursive` gets them.
 
 ## 8. Status
 
-**The port is done.** The C interpreter passes the language corpus and passes clean
+**The port is done.** The C interpreter passes the Go reference's entire corpus and passes clean
 under ASan and UBSan. It reproduced that corpus byte for byte until §0.1 retired the
 requirement; two cases have diverged on purpose since, and
-`tests/language/README.md` lists them.
+`tests/reference/README.md` lists them.
 
 | Gate | Result |
 |---|---|
@@ -2242,7 +2243,7 @@ requirement; two cases have diverged on purpose since, and
 | `ctest` with `-DAKBASIC_WITH_AKGL=ON` | 112/112 headless, with `akgl_typing` skipping itself. The same set minus the four `no_device` cases the SDL driver contradicts, plus `akgl_backends`, `akgl_frontend`, `docs_screenshots` and `akgl_typing` — the last of which is the skip, and the `akgl_build` CI job is where it skips |
 | `docs_examples` | Every fenced block in `README.md`, `MAINTENANCE.md` and `docs/` executed and byte-compared: 71 programs, 9 transcripts, 79 output comparisons, 4 C snippets, 2 excerpts, 2 shell blocks and 19 figures in the default build. The C-snippet count reads 0 when the harness is run by hand without `--cflags-file`; CTest passes it. `MAINTENANCE.md` documents the fence-tag convention |
 | `docs_screenshots` | 19/19 figures re-rendered and byte-identical to the checked-in PNGs. AKGL build only — rendering a picture needs the SDL half |
-| Language corpus | 65/65 paired expectations — **and 65/65 again through the SDL binary**, which is most of what proves the frontend changes no output |
+| Golden corpus | 41/41 byte-exact from `tests/reference/` — **and 41/41 again through the SDL binary**, which is most of what proves the frontend changes no output |
 | ASan + UBSan | 112/112 |
 | Line coverage | 94.1% (7227/7681) — above the 90% gate |
 | Function coverage | 97.9% (474/484) |
@@ -2552,7 +2553,7 @@ What remains, in priority order:
       this whole arrangement exists against.
 
     The byte comparison is a deliberate bet that the dummy driver and the software renderer
-    are reproducible, which is the same bet `tests/language/` makes about golden
+    are reproducible, which is the same bet `tests/reference/` already makes about golden
     output. Verified run-to-run and build-to-build here; what is untested is an SDL upgrade
     that moves one pixel of a diagonal. **If that happens, regenerate the figures in the same
     commit as the bump** — do not weaken the test to a size check, which would pass for every
@@ -2635,7 +2636,7 @@ reduced against `build/basic`, the stdio build, unless it says otherwise.
 
    **It is narrower than it looks, and the golden corpus is why.** The first attempt
    released the scope on *any* skip, which broke
-   `tests/language/flowcontrol/nestedforloopwaitingforcommand.bas`: a zero-
+   `tests/reference/language/flowcontrol/nestedforloopwaitingforcommand.bas`: a zero-
    iteration `FOR` skips its body by the same mechanism, and there the orphan is
    load-bearing -- it is what absorbs the inner `NEXT` so the outer one still finds its
    `FOR`. Releasing it turns that case into "NEXT outside the context of FOR". So the

docs/10-embedding.md

@@ -100,6 +100,50 @@ bounded run is usually inside a `FOR` or `GOSUB` body, and a variable created th
 dies when the body pops — silently, with the script reading it correctly right up until
 it stops.
 
+## Calling a function every frame
+
+`akbasic_runtime_call_function()` calls a `DEF` by name with values you already
+hold — the entry point a game loop wants. A host that calls it repeatedly signs
+up for three rules the one-shot examples never meet:
+
+```c wrap=hostcalls
+CATCH(errctx, akbasic_runtime_call_function(&SCRIPT, "THINK", argp, 1, &result));
+/* ...consume the result... */
+CATCH(errctx, akbasic_environment_zero(SCRIPT.environment));
+```
+
+1. **Reset the value scratch after every call, once the result is consumed.**
+   Each call parks its result in the caller environment's per-line scratch
+   (`AKBASIC_MAX_VALUES` slots), and a host calling in a loop never crosses the
+   line boundary that would reset it. Skip the `akbasic_environment_zero()` and
+   the pool drains — measured at under two frames of forty calls — after which
+   every call fails with `Maximum values per line reached`. The reset also
+   invalidates `result`, which is why it comes after the consumption.
+2. **Force RUN mode once after the boot run.** A multi-line `DEF` body only
+   runs while the runtime is in RUN mode, and by the time a host can call, the
+   program that filed the definitions has ended. One
+   `akbasic_runtime_set_mode(&SCRIPT, AKBASIC_MODE_RUN)` after
+   `akbasic_runtime_run()` makes the bodies run, and the mode stays put because
+   nothing steps the runtime between calls. Issue #8 tracks making this
+   unnecessary.
+3. **Revive after a script error, deliberately.** A BASIC-level error inside a
+   called body reports through the sink, answers a stale value, and latches:
+   the runtime leaves RUN mode and every later call does nothing. When your
+   policy is to absorb the error and keep calling — a game marking one actor
+   dumb rather than killing the frame — the revival is two calls:
+   `akbasic_runtime_clear_error()`, then `akbasic_runtime_set_mode(RUN)` again.
+   The latch is deliberate for *programs* — the first error ends a run, once,
+   with one line — so nothing clears it for you.
+
+Do not pass structures as per-frame arguments. A structure or pointer parameter
+spends a value-pool slot on every call and the pool never reclaims, so the
+interface dies after about a thousand calls — issue #36 has the measurements.
+Bind the instance once with `akbasic_host_bind()` and point it at each object
+with `akbasic_host_rebind()` ([Chapter 16](16-structures.md)), which spends
+nothing per call. The GALAGA tutorial ([Chapters 20](20-tutorial-galaga.md)
+and [21](21-tutorial-galaga-enemies.md)) is this whole recipe as a working
+game, forty calls a frame.
+
 ## Where the output goes
 
 `PRINT` writes through an `akbasic_TextSink`, which is a record of function pointers plus

docs/14-architecture.md

@@ -743,8 +743,8 @@ way to see that something pushed a scope and never popped it.
 
 ```sh norun
 ctest --test-dir build --output-on-failure -R for_next     # one unit test
-ctest --test-dir build --output-on-failure -R local_       # the language corpus
+ctest --test-dir build --output-on-failure -R golden_      # the reference corpus
-./build/basic tests/language/functions.bas | diff - tests/language/functions.txt
+./build/basic tests/reference/language/functions.bas | diff - tests/reference/language/functions.txt
 ./tests/docs_examples.sh --root . --basic ./build/basic \
     --cflags-file build/docs_cflags.txt docs/14-architecture.md
 ```

docs/17-tutorial-breakout.md

@@ -685,9 +685,9 @@ seconds asks for fifty frames a second.
 ### Why `GOTO` rather than `DO ... LOOP`
 
 A `DO ... LOOP` around the frame would read better, and it is not usable here: **a `GOTO`
-that jumps out of a `FOR` or a `DO` does not release the loop's scope.** There are 32
+that jumps out of a `FOR` or a `DO` does not release the loop's scope.** There are 12
 scopes, so a game that leaves its main loop once per lost life stops on the
-thirty-second one:
+twelfth one:
 
 ```basic
 N# = 0
@@ -700,7 +700,7 @@ PRINT "SURVIVED " + N#
 ```
 
 ```output
-? 3 : PARSE ERROR Environment pool exhausted at line 3 (32 in use)
+? 3 : PARSE ERROR Environment pool exhausted at line 3 (12 in use)
 
 ```
 

docs/18-tutorial-breakout-artwork.md

@@ -1423,7 +1423,8 @@ IF STATE# = 2 THEN GOSUB UNSTICK
 RETURN
 
 LABEL PRESSPAUSE
-IF STATE# = 2 THEN STATE# = 6 : GMTYP# = 0 : BAN$ = "PAUSED" : GOSUB SETBANNER : RETURN
+IF STATE# = 2 THEN STATE# = 6 : GMTYP# = 0 : BAN$ = "PAUSED"
+IF STATE# = 2 THEN BAN$ = "PAUSED" : GOSUB SETBANNER : RETURN
 IF STATE# = 6 THEN STATE# = 2 : BAN$ = "" : GOSUB SETBANNER
 RETURN
 ```

docs/20-tutorial-galaga.md

@@ -0,0 +1,849 @@
+# 20. Tutorial: GALAGA — a C engine with a BASIC brain
+
+This chapter and [Chapter 21](21-tutorial-galaga-enemies.md) build a GALAGA-style
+fixed shooter from an empty file. The engine — window, starfield, bullets,
+collision, score, screens — is C on libakgl. The enemies think in BASIC: one
+script of `DEF` functions is called once per enemy per frame, and it reads and
+writes the engine's own structures with no marshalling in either direction.
+This chapter builds the engine and proves the boundary works; the next one
+fills in the data structures and the AI.
+
+The split is the point. Everything mechanical stays compiled, and everything an
+enemy *decides* is a text file you can edit and re-run without rebuilding. It is
+an academic exercise in *how* such an embed is done, not a claim that it is the
+best way to write a GALAGA.
+
+This is what the two chapters build:
+
+![A full wave: four green bosses, two rows of butterflies, bees still streaming into the grid, the player firing](images/galaga-wave.png)
+
+The finished program is [`examples/galaga/`](../examples/galaga/): four C files,
+one `galaga.bas`, and the assets. You do not need it to follow along, but it is
+the same program assembled.
+
+```sh norun
+$ cmake -S . -B build-akgl -DAKBASIC_WITH_AKGL=ON
+$ cmake --build build-akgl --target akbasic_example_galaga
+$ ./build-akgl/akbasic_example_galaga
+```
+
+| Key | Does |
+|---|---|
+| left / right | move the ship |
+| space | fire — two shots on screen at a time, the classic rule |
+| return | choose a menu entry |
+
+## What you will do
+
+- **[Step 1](#step-1-open-a-window)** — open a window, in the one startup order
+  that works
+- **[Step 2](#step-2-scatter-a-starfield)** — scatter a starfield and scroll it,
+  with no parallax machinery at all
+- **[Step 3](#step-3-put-a-ship-on-screen)** — put a ship on screen from a
+  sprite and a character file, and drive it from the keyboard
+- **[Step 4](#step-4-shots-and-collision)** — spawn shots from the actor heap
+  and collide them by hand
+- **[Step 5](#step-5-boot-the-interpreter)** — link the interpreter in, load a
+  script of definitions, and call one from C
+- **[Step 6](#step-6-the-update-hook)** — replace an actor's update hook so its
+  every frame is a BASIC call
+- **[Step 7](#step-7-first-light)** — watch one enemy move under BASIC control,
+  and read the same numbers from both sides
+- **[Step 8](#step-8-screens)** — add the title, game over and victory screens
+- **[Step 9](#step-9-run-it-headless)** — run the whole game headless, so CI can
+  play it every night
+
+Each step compiles and runs. The C fragments quote the finished example; the
+file layout there — `main.c` for the harness, `script.c` for the boundary,
+`enemies.c` and `player.c` for the actors — is a good one to copy.
+
+---
+
+## Step 1: Open a window
+
+**Goal: a black window with a title, from the canonical startup order.**
+
+libakgl has one startup sequence that works, documented at the top of its
+`include/akgl/game.h` and walked through in its own tutorial (libakgl
+docs/20-tutorial-sidescroller.md). The order matters twice: the screen
+properties are read by the renderer, so they must be set before it exists, and
+`akgl_game_init()` does **not** install a physics backend, so the application
+must.
+
+```c wrap=galagatypes requires=akgl
+static akerr_ErrorContext *startup(void)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, aksl_strncpy((char *)&akgl_game.name, sizeof(akgl_game.name),
+			      "akbasic galaga tutorial", sizeof(akgl_game.name) - 1));
+    PASS(errctx, aksl_strncpy((char *)&akgl_game.version, sizeof(akgl_game.version),
+			      "1.0.0", sizeof(akgl_game.version) - 1));
+    PASS(errctx, aksl_strncpy((char *)&akgl_game.uri, sizeof(akgl_game.uri),
+			      "net.aklabs.akbasic.galaga", sizeof(akgl_game.uri) - 1));
+
+    PASS(errctx, akgl_game_init());
+
+    PASS(errctx, akgl_set_property("game.screenwidth", "1280"));
+    PASS(errctx, akgl_set_property("game.screenheight", "960"));
+    PASS(errctx, akgl_render_2d_init(akgl_renderer));
+
+    FAIL_ZERO_RETURN(
+	errctx,
+	SDL_SetRenderLogicalPresentation(
+	    akgl_renderer->sdl_renderer,
+	    1280,
+	    960,
+	    SDL_LOGICAL_PRESENTATION_INTEGER_SCALE),
+	AKGL_ERR_SDL,
+	"%s",
+	SDL_GetError()
+	);
+    akgl_camera->x = 0.0f;
+    akgl_camera->y = 0.0f;
+    akgl_camera->w = 1280.0f;
+    akgl_camera->h = 960.0f;
+
+    PASS(errctx, akgl_physics_init_null(akgl_physics));
+    SUCCEED_RETURN(errctx);
+}
+```
+
+Three of those lines deserve their reasons.
+
+**The view is 1280x960 because the artwork is ~100 pixels wide.** libakgl draws
+a sprite at the sprite's own size — `akgl_Actor.scale` is overwritten every
+frame, so there is no way to draw one smaller (libakgl docs/12-actors.md) — and
+a ten-column formation of 100-pixel ships needs 1120 pixels plus margins. The
+view is sized to the art rather than the art resized to a view.
+
+**`akgl_physics_init_null()` is not optional.** Skip it and the first
+`akgl_game_update()` calls through a NULL `simulate` pointer. Null physics
+accepts every call and moves nothing, which is exactly right here: whatever
+writes `x` and `y` directly is the mover, and in this game that will be BASIC.
+
+**Error handling is the house protocol.** Every function returns
+`akerr_ErrorContext *`, `PASS` propagates, `ATTEMPT`/`CATCH`/`CLEANUP` brackets
+anything that must unwind. libakgl's docs/04-errors.md teaches it; this chapter
+just uses it, with two rules that keep the fragments compiling: **`CATCH` is
+only legal inside an `ATTEMPT` block, and `PASS` everywhere else** — swap them
+and the compiler objects about a stray `break` — and `main()` alone ends its
+block with `FINISH_NORETURN(errctx)` instead of `FINISH`, because `FINISH`
+expands a `return` of the context that an `int`-returning function cannot
+compile:
+
+```c wrap=galagatypes requires=akgl
+static int FAILED = 0;
+
+int main(int argc, char *argv[])
+{
+    PREPARE_ERROR(errctx);
+
+    (void)argc; (void)argv;
+    ATTEMPT {
+	/* CATCH each stage in order: startup, assets, the script boot,
+	 * the spawns, then the frame loop. */
+    } CLEANUP {
+	/* ...teardown, every call wrapped in IGNORE()... */
+    } PROCESS(errctx) {
+    } HANDLE_DEFAULT(errctx) {
+	LOG_ERROR_WITH_MESSAGE(errctx, "galaga could not run");
+	/* Set a flag rather than returning: leaving a HANDLE block early
+	 * skips FINISH's release and leaks the context's pool slot. */
+	FAILED = 1;
+    } FINISH_NORETURN(errctx);
+    return FAILED;
+}
+```
+
+The status codes this game raises are `AKERR_NULLPOINTER`,
+`AKERR_VALUE`, `AKERR_KEY`, `AKERR_IO`, `AKERR_OUTOFBOUNDS`, `AKGL_ERR_SDL`
+and `AKGL_ERR_HEAP` — there is no code this tutorial invents.
+
+The includes the engine files draw on, so nothing later has to be guessed —
+the SDL satellites use their own prefixes (`SDL3_ttf/SDL_ttf.h`, not
+`SDL3/SDL_ttf.h`):
+
+```c wrap=galagatypes requires=akgl
+#include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+#include <SDL3_image/SDL_image.h>
+#include <SDL3_ttf/SDL_ttf.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/character.h>
+#include <akgl/controller.h>
+#include <akgl/draw.h>
+#include <akgl/error.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+#include <akgl/physics.h>
+#include <akgl/registry.h>
+#include <akgl/renderer.h>
+#include <akgl/sprite.h>
+#include <akgl/text.h>
+#include <akgl/ui.h>
+#include <akgl/util.h>
+```
+
+The frame loop is the standard bracket, with one addition you will meet in
+Step 6 — for now, events in, world drawn, frame out:
+
+```c wrap=galagahost requires=akgl
+while ( SDL_PollEvent(&event) == true ) {
+    CATCH(errctx, akgl_controller_handle_event((void *)&akgl_game.state, &event));
+}
+CATCH(errctx, akgl_renderer->frame_start(akgl_renderer));
+CATCH(errctx, akgl_game_update(NULL));
+CATCH(errctx, akgl_renderer->frame_end(akgl_renderer));
+```
+
+`akgl_game_update(NULL)` is update-every-actor, step-the-physics,
+draw-the-world. It neither clears nor presents; the `frame_start` and
+`frame_end` calls own that.
+
+## Step 2: Scatter a starfield
+
+**Goal: a scrolling two-depth starfield, from an array and one draw call.**
+
+No parallax facility exists in libakgl and none is needed. A fixed array of
+stars, advanced per frame and drawn with `akgl_draw_point()` between
+`frame_start` and `akgl_game_update()`, is the whole feature. Two speed bands
+give the depth for free — the slow band reads as far away:
+
+```c wrap=galagatypes requires=akgl
+#define GALAGA_STARS 96
+
+static struct
+{
+    float x;
+    float y;
+    float speed;
+    Uint8 bright;
+} STARS[GALAGA_STARS];
+
+static akerr_ErrorContext *starfield_draw(float dt)
+{
+    SDL_Color color = { 255, 255, 255, 255 };
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    for ( i = 0; i < GALAGA_STARS; i++ ) {
+	STARS[i].y += STARS[i].speed * dt;
+	if ( STARS[i].y > 960.0f ) {
+	    STARS[i].y -= 960.0f;
+	}
+	color.r = STARS[i].bright;
+	color.g = STARS[i].bright;
+	color.b = STARS[i].bright;
+	PASS(errctx, akgl_draw_point(akgl_renderer, STARS[i].x, STARS[i].y, color));
+    }
+    SUCCEED_RETURN(errctx);
+}
+```
+
+Seed the array once at startup — even indexes slow and dim (speed 40, bright
+110), odd indexes fast and bright (speed 110, bright 220) — and the effect is
+done. A point is exactly one pixel (libakgl docs/09-drawing.md).
+
+## Step 3: Put a ship on screen
+
+**Goal: a player actor, drawn from a character file, moving on key input.**
+
+The art is Kenney's Space Shooter pack, CC0, used byte for byte — see
+[`examples/galaga/assets/art/PROVENANCE.md`](../examples/galaga/assets/art/PROVENANCE.md)
+for what each file is. An actor gets its looks from a **character**, which maps
+actor state words to **sprites** (libakgl docs/10 and 12). Both are JSON; load
+sprites first, because a character names its sprites and a character loaded
+first fails on the first name it cannot find.
+
+These are the names, so the loading lists and every
+`akgl_actor_set_character()` call in both chapters agree — each `sprite_*.json`
+and `character_*.json` lives in `assets/`:
+
+| Character | Sprite(s) it maps | Worn by |
+|---|---|---|
+| `galaga_player` | `galaga_player` | the ship |
+| `galaga_bee` | `galaga_bee` | bees |
+| `galaga_butterfly` | `galaga_butterfly` | butterflies |
+| `galaga_boss` | `galaga_boss`, and `galaga_boss_hurt` on state bit 13 | bosses |
+| `galaga_playershot` | `galaga_playershot` | the ship's shots |
+| `galaga_enemyshot` | `galaga_enemyshot` | enemy shots |
+| `galaga_boom` | `galaga_boom` | explosions |
+
+The spawn is four decisions after the two boilerplate calls:
+
+```c wrap=galagagame requires=akgl
+static akerr_ErrorContext *galaga_player_spawn(void)
+{
+    akgl_Actor *player = NULL;
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, akgl_heap_next_actor(&player));
+    PASS(errctx, akgl_actor_initialize(player, "player"));
+    PASS(errctx, akgl_actor_set_character(player, "galaga_player"));
+    /* AFTER initialize: it resets all seven hooks. */
+    player->updatefunc = &player_update;
+    player->movement_controls_face = false;
+    player->state = AKGL_ACTOR_STATE_ALIVE;
+    player->visible = true;
+    player->x = 590.0f;
+    player->y = 860.0f;
+
+    galaga_game.player = player;
+    SUCCEED_RETURN(errctx);
+}
+```
+
+Each of the four lines under the comment closes a trap:
+
+- **`updatefunc` after `akgl_actor_initialize()`**, never before — initialize
+  installs all seven default hooks, and a hook set first is a hook reset.
+- **`movement_controls_face = false`.** The default facing logic edits the
+  state word, a character mapping matches the **whole** word, and an actor
+  whose state matches no mapping is *silently not drawn*. Nothing here moves by
+  state bits, so facing stays out of the word entirely.
+- **`state = AKGL_ACTOR_STATE_ALIVE`** — the word the character mapping names.
+- **`visible = true`.** `akgl_actor_initialize()` does not raise it. In a
+  tilemap game the map loader copies visibility from map data; there is no map
+  here, so an actor that skips this line exists, moves, fires and collides —
+  invisibly. This one line cost this example its first screenshot.
+
+Input goes through a control map: push a control per key with handlers that set
+flags, and let the actor's update hook read the flags. A handler receives the
+map's target actor and the event, and returns through the error protocol like
+everything else — this pair is the whole pattern, repeated per key:
+
+```c wrap=galagagame requires=akgl
+static bool MOVELEFT = false;
+
+akerr_ErrorContext *left_on(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    MOVELEFT = true;
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *left_off(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    MOVELEFT = false;
+    SUCCEED_RETURN(errctx);
+}
+```
+
+(The example keeps the flags in its `galaga_Game` struct rather than statics;
+either works.) The bindings themselves are pushes onto map 0:
+
+```c wrap=galagagame requires=akgl
+static akerr_ErrorContext *galaga_player_controls(void)
+{
+    akgl_Control control;
+    PREPARE_ERROR(errctx);
+
+    memset(&control, 0, sizeof(control));
+    control.event_on = SDL_EVENT_KEY_DOWN;
+    control.event_off = SDL_EVENT_KEY_UP;
+
+    control.key = SDLK_LEFT;
+    control.handler_on = &left_on;
+    control.handler_off = &left_off;
+    PASS(errctx, akgl_controller_pushmap(0, &control));
+
+    control.key = SDLK_RIGHT;
+    control.handler_on = &right_on;
+    control.handler_off = &right_off;
+    PASS(errctx, akgl_controller_pushmap(0, &control));
+
+    control.key = SDLK_SPACE;
+    control.handler_on = &fire_on;
+    control.handler_off = &fire_off;
+    PASS(errctx, akgl_controller_pushmap(0, &control));
+
+    akgl_controlmaps[0].target = galaga_game.player;
+    SUCCEED_RETURN(errctx);
+}
+```
+
+Hand **every** polled event to `akgl_controller_handle_event()` — one that no
+control binds is not an error, it is a call that did nothing.
+
+## Step 4: Shots and collision
+
+**Goal: bullets that fly, hit, and give their actor slot back.**
+
+Bullets and collision are C forever — they are engine, not behavior. A shot is
+an actor from the same 64-slot heap pool, with its own tiny update hook: move,
+test, release.
+
+```c wrap=galagagame requires=akgl
+static akerr_ErrorContext *player_shot_update(akgl_Actor *obj)
+{
+    SDL_FRect mine;
+    SDL_FRect theirs;
+    bool hit = false;
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    obj->y -= 900.0f * galaga_game.dt;
+    if ( obj->y < -60.0f ) {
+	galaga_game.player_shots_live -= 1;
+	PASS(errctx, akgl_heap_release_actor(obj));
+	SUCCEED_RETURN(errctx);
+    }
+
+    shot_box(obj, &mine);
+    for ( i = 0; i < GALAGA_MAX_ENEMIES; i++ ) {
+	if ( galaga_enemy_actors[i] == NULL ) {
+	    continue;
+	}
+	enemy_box(galaga_enemy_actors[i], &theirs);
+	PASS(errctx, akgl_collide_rectangles(&mine, &theirs, &hit));
+	if ( !hit ) {
+	    continue;
+	}
+	galaga_enemies[i].hp -= 1;
+	if ( galaga_enemies[i].hp <= 0 ) {
+	    PASS(errctx, kill_enemy(i));
+	}
+	galaga_game.player_shots_live -= 1;
+	PASS(errctx, akgl_heap_release_actor(obj));
+	SUCCEED_RETURN(errctx);
+    }
+    SUCCEED_RETURN(errctx);
+}
+```
+
+Four conventions worth keeping:
+
+- **`akgl_collide_rectangles()` is the whole collision system.** At most 2
+  shots x 40 enemies of axis-aligned tests per frame is noise; the full
+  `akgl_CollisionWorld` machinery earns its keep on tilemaps, not here. The
+  `shot_box`/`enemy_box` helpers inset each box from the artwork's rectangle,
+  because the PNGs carry transparent margin that should not kill anybody.
+- **Releasing is despawning.** `akgl_heap_release_actor()` unregisters the
+  actor and stops it drawing; releasing mid-sweep is safe because
+  `akgl_game_update()` re-reads each slot's refcount as it goes.
+- **Names carry a serial** — `pshot17`, not `pshot1` reused — because the actor
+  registry is keyed by name, and two live actors with one name is a fight.
+- **Spawn caps are C-side refusals.** Two player shots, eight enemy shots; the
+  spawn functions simply decline past the cap.
+
+Give the enemy shots the same shape falling downward, and the ship a sweep over
+both — `examples/galaga/player.c` has all three loops.
+
+Explosions are the fourth actor kind, and they carry the one place this game
+*absorbs* an error instead of propagating it. `HANDLE` names the status it
+forgives; everything else still travels:
+
+```c wrap=galagagame requires=akgl
+static float BOOM_TTL[AKGL_MAX_HEAP_ACTOR];
+static uint32_t BOOM_SERIAL = 0;
+
+static akerr_ErrorContext *boom_update(akgl_Actor *obj)
+{
+    ptrdiff_t slot = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    slot = obj - akgl_heap_actors;
+    BOOM_TTL[slot] -= galaga_game.dt;
+    if ( BOOM_TTL[slot] <= 0.0f ) {
+	PASS(errctx, akgl_heap_release_actor(obj));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *galaga_boom_spawn(float x, float y)
+{
+    akgl_Actor *boom = NULL;
+    char name[32];
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    ATTEMPT {
+	CATCH(errctx, akgl_heap_next_actor(&boom));
+	BOOM_SERIAL += 1;
+	CATCH(errctx, aksl_snprintf(&count, name, sizeof(name), "boom%u", BOOM_SERIAL));
+	CATCH(errctx, akgl_actor_initialize(boom, name));
+	CATCH(errctx, akgl_actor_set_character(boom, "galaga_boom"));
+	boom->updatefunc = &boom_update;
+	boom->movement_controls_face = false;
+	boom->state = AKGL_ACTOR_STATE_ALIVE;
+	boom->visible = true;
+	boom->x = x;
+	boom->y = y;
+	BOOM_TTL[boom - akgl_heap_actors] = 0.25f;
+    } CLEANUP {
+    } PROCESS(errctx) {
+    } HANDLE(errctx, AKGL_ERR_HEAP) {
+	/* Explosions are decoration. When the heap is momentarily full the
+	 * right outcome is no explosion, not a dead frame. */
+    } FINISH(errctx, true);
+    SUCCEED_RETURN(errctx);
+}
+```
+
+## Step 5: Boot the interpreter
+
+**Goal: the engine calls a BASIC function and prints its answer.**
+
+Everything so far was libakgl. Now link the interpreter into the same
+executable. The whole CMake recipe, inside an akbasic checkout with
+`AKBASIC_WITH_AKGL=ON`:
+
+```cmake
+add_executable(mygalaga
+  main.c
+  script.c
+  enemies.c
+  player.c)
+target_compile_options(mygalaga PRIVATE -Wall -Wextra)
+target_compile_definitions(mygalaga PRIVATE
+  GALAGA_ASSET_DIR="${CMAKE_CURRENT_SOURCE_DIR}/assets"
+  GALAGA_SCRIPT_PATH="${CMAKE_CURRENT_SOURCE_DIR}/galaga.bas"
+  GALAGA_FONT_PATH="${CMAKE_CURRENT_SOURCE_DIR}/assets/fonts/C64_Pro_Mono-STYLE.ttf")
+target_link_libraries(mygalaga PRIVATE akbasic akgl
+  SDL3::SDL3 SDL3_ttf::SDL3_ttf SDL3_image::SDL3_image)
+```
+
+The three baked-in paths are what let the program launch from any working
+directory; `--assets` and `--script` flags can override them at runtime.
+
+Link `akbasic` — the interpreter only. Not `akbasic_akgl` (the device backends
+that let a script draw), and not `akbasic_frontend` (the standalone program's
+host). This game lends the script **no devices at all**: the scripts compute,
+the engine draws, and a script that tries `SPRITE` is refused by name. That
+refusal is enforced by the interpreter, not by convention —
+[Chapter 10](10-embedding.md) explains the device-lending model this game
+declines to use.
+
+The boot is the embedding host from Chapter 10, adapted to a script that only
+defines. Keep every line that touches the interpreter in one file — the
+example's `script.c` — so the boundary stays a place rather than a habit. That
+file's interpreter-facing includes and statics, exactly:
+
+```c wrap=galagatypes requires=akgl
+#include <akbasic/environment.h>
+#include <akbasic/error.h>
+#include <akbasic/host.h>
+#include <akbasic/runtime.h>
+#include <akbasic/sink.h>
+
+/* Static because an akbasic_Runtime is far too big for a stack frame --
+ * 2.40 MiB on this branch. */
+static akbasic_Runtime SCRIPT;
+static akbasic_TextSink SINK;
+static akbasic_StdioSink SINKSTATE;
+static char SOURCE[16384];
+```
+
+The boot itself:
+
+```c wrap=galagacalls requires=akgl
+CATCH(errctx, akbasic_error_register());
+CATCH(errctx, akbasic_sink_init_stdio(&SINK, &SINKSTATE, stdout, NULL));
+CATCH(errctx, akbasic_runtime_init(&SCRIPT, &SINK));
+
+CATCH(errctx, akbasic_runtime_load(&SCRIPT, SOURCE));
+CATCH(errctx, akbasic_runtime_start(&SCRIPT, AKBASIC_MODE_RUN));
+CATCH(errctx, akbasic_runtime_run(&SCRIPT, 4 * AKBASIC_MAX_SOURCE_LINES));
+CATCH(errctx, akbasic_runtime_set_mode(&SCRIPT, AKBASIC_MODE_RUN));
+```
+
+Two of those lines are the ones a first embedding gets wrong.
+
+**A "no top level code" script still has to run once.** The script is nothing
+but `DEF` blocks and a final `END`, and executing the `DEF` statements is what
+files the functions. The run is bounded — a script that is all definitions has
+no business taking more than a few steps per line, and an accidental loop at
+boot should be a diagnosis, not a hang.
+
+**The `set_mode` after the run is load-bearing.** The program has now ended and
+the runtime sits in QUIT mode, where a multi-line `DEF` called from the host
+returns a silent zero. Forcing the mode back to RUN makes the bodies run, and it
+stays put because nothing here ever steps the runtime again. Issue #8 tracks
+making this workaround unnecessary.
+
+`PRINT` inside the script goes through the stdio sink and lands on stdout —
+that is the script's debug channel for the rest of both chapters.
+
+Prove the wiring with one function. Put this in the script:
+
+```basic
+DEF ADDEM(A#, B#) = A# + B#
+END
+```
+
+And call it from C, with values you already have:
+
+```c wrap=galagacalls requires=akgl
+memset(&args[0], 0, sizeof(args[0]));
+memset(&args[1], 0, sizeof(args[1]));
+args[0].valuetype = AKBASIC_TYPE_INTEGER;
+args[0].intval = 17;
+args[1].valuetype = AKBASIC_TYPE_INTEGER;
+args[1].intval = 25;
+argp[0] = &args[0];
+argp[1] = &args[1];
+CATCH(errctx, akbasic_runtime_call_function(&SCRIPT, "ADDEM", argp, 2, &result));
+printf("ADDEM(17, 25) = %lld\n", (long long)result->intval);
+```
+
+```text
+ADDEM(17, 25) = 42
+```
+
+`akbasic_runtime_call_function()` is the host's entry point: a name and
+already-evaluated values in, the function's result out. The engine refuses to
+start when the script will not boot — a game whose enemies cannot think is not
+a game missing a feature, it is a game that does not run.
+
+## Step 6: The update hook
+
+**Goal: one actor whose every frame is a BASIC call.**
+
+`akgl_game_update()` calls each live actor's `updatefunc` exactly once per
+frame. Replacing that pointer is the whole integration: the actor's frame *is*
+a script call.
+
+```c wrap=galagagame requires=akgl
+static akerr_ErrorContext *enemy_update(akgl_Actor *obj)
+{
+    galaga_Enemy *enemy = NULL;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    enemy = (galaga_Enemy *)obj->actorData;
+    FAIL_ZERO_RETURN(errctx, enemy, AKERR_NULLPOINTER, "an enemy actor with no galaga_Enemy attached");
+
+    enemy->rnd = galaga_random();
+    PASS(errctx, galaga_script_update_enemy(enemy, obj, galaga_game.dt));
+    if ( enemy->fire != 0 ) {
+	PASS(errctx, enemy_fire(enemy, obj));
+    }
+    SUCCEED_RETURN(errctx);
+}
+```
+
+The hook's body is a protocol, and `galaga_script_update_enemy()` is its
+middle: **rebind, call, recover, reset.**
+
+```c wrap=galagacalls requires=akgl
+CATCH(errctx, akbasic_host_rebind(&SCRIPT, "SELF@", enemy));
+CATCH(errctx, akbasic_host_rebind(&SCRIPT, "ACTOR@", actor));
+
+memset(&dtval, 0, sizeof(dtval));
+dtval.valuetype = AKBASIC_TYPE_FLOAT;
+dtval.floatval = (double)dt;
+argp[0] = &dtval;
+CATCH(errctx, akbasic_runtime_call_function(&SCRIPT, "UPDATEBEE", argp, 1, &result));
+
+CATCH(errctx, akbasic_environment_zero(SCRIPT.environment));
+```
+
+`SELF@` and `ACTOR@` are **host bindings** — the enemy's record and the
+engine's live actor, shared with the script as structures it can read and
+write directly. [Chapter 21](21-tutorial-galaga-enemies.md) builds them; for
+this chapter, know that `akbasic_host_rebind()` points an existing binding at
+a different instance, which is how forty enemies share one script: one name,
+rebound per enemy, rather than forty names.
+
+**The `akbasic_environment_zero()` after every call is load-bearing.** Each
+call parks its result in the caller environment's per-line value scratch, and a
+host calling in a loop never crosses the line boundary that would reset it.
+Without this line the scratch drains in under two frames of a 40-enemy wave and
+every later call fails with `Maximum values per line reached`. Chapter 10's
+["Calling a function every frame"](10-embedding.md#calling-a-function-every-frame)
+section is the rule's home.
+
+## Step 7: First light
+
+**Goal: a C actor moving under BASIC control, and proof it is one memory.**
+
+Before any real AI, the smallest demonstration. One enemy, one function, a sine
+drift written entirely in BASIC through the actor binding:
+
+```basic
+DEF UPDATEBEE(DT%)
+  SELF@.T% = SELF@.T% + DT%
+  ACTOR@.X% = 590.0 + SIN(SELF@.T%) * 200
+  ACTOR@.Y% = 300.0
+  PRINT "BASIC SEES X = " + ACTOR@.X%
+  RETURN 0
+END
+```
+
+Spawn one enemy with the hook from Step 6, and have the engine print the same
+actor's position each frame from C:
+
+```c wrap=galagahost requires=akgl
+SDL_Log("C SEES X = %f", galaga_enemy_actors[0]->x);
+```
+
+```text
+BASIC SEES X = 593.191094
+INFO: C SEES X = 593.191094
+BASIC SEES X = 596.378593
+INFO: C SEES X = 596.378593
+```
+
+Same numbers, one memory. The script wrote `ACTOR@.X%`; the renderer read
+`akgl_Actor.x`; nothing copied anything anywhere. The ship swings in a slow
+arc, and the whole architecture is visible in that one motion: C owns the
+frame, BASIC owns the decision, and the actor is the same bytes to both.
+
+## Step 8: Screens
+
+**Goal: title, playing, game over, victory — a state machine around the loop.**
+
+The screens are libakgl's UI layer, in the three-state pattern of its uidemo
+example (libakgl docs/22-ui.md). A `galaga_Screen` enum, one `declare_*()`
+function per screen, and the UI bracket between `akgl_game_update()` and
+`frame_end` — exactly where the frame contract puts it:
+
+```c wrap=galagahost requires=akgl
+CATCH(errctx, akgl_ui_frame_begin());
+switch ( galaga_game.screen ) {
+case GALAGA_SCREEN_TITLE:
+    CATCH(errctx, declare_title());
+    break;
+case GALAGA_SCREEN_PLAY:
+    CATCH(errctx, declare_play());
+    break;
+case GALAGA_SCREEN_GAMEOVER:
+case GALAGA_SCREEN_VICTORY:
+    CATCH(errctx, declare_end());
+    break;
+}
+CATCH(errctx, akgl_ui_frame_end(akgl_renderer));
+```
+
+The playing screen is two `akgl_ui_label()` calls — a widget call per label,
+not a struct — formatted into `static` buffers, because the UI borrows label
+text until `frame_end` and a local buffer would be dangling by the time it
+draws:
+
+```c wrap=galagagame requires=akgl
+static char HUD_SCORE[64];
+static char HUD_LIVES[64];
+
+static akerr_ErrorContext *declare_play(void)
+{
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, aksl_snprintf(&count, HUD_SCORE, sizeof(HUD_SCORE),
+			       "SCORE %06d", galaga_game.score));
+    PASS(errctx, aksl_snprintf(&count, HUD_LIVES, sizeof(HUD_LIVES),
+			       "LIVES %d   WAVE %d", galaga_game.lives, galaga_shared.wave));
+    PASS(errctx, akgl_ui_label("score", HUD_SCORE, AKGL_UI_ANCHOR_TOP_LEFT, NULL));
+    PASS(errctx, akgl_ui_label("lives", HUD_LIVES, AKGL_UI_ANCHOR_TOP_RIGHT, NULL));
+    SUCCEED_RETURN(errctx);
+}
+```
+
+The title and end screens are an `akgl_ui_menu()` at the center, fed an
+`akgl_UiMenu` that lives in a `static` for the same borrowing reason. The
+struct is an id, the item strings, a count, the selected index, the
+`activated` output flag, and a style (`NULL` for the default):
+
+```c wrap=galagatypes requires=akgl
+static akgl_UiMenu TITLE_MENU = {
+    "titlemenu", { "START", "QUIT" }, 2, 0, false, NULL
+};
+
+static akerr_ErrorContext *declare_title(void)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, akgl_ui_menu(&TITLE_MENU));
+    SUCCEED_RETURN(errctx);
+}
+```
+
+Route events to the menu with
+`akgl_ui_menu_handle_event(&TITLE_MENU, event, &consumed)` — the menu for
+whichever screen is up, a `bool` out-parameter reporting whether the event was
+taken. Up and down move `selected`, return sets `activated`.
+
+The big **GALAGA** headline is direct text rather than a label:
+
+```c wrap=galagagame requires=akgl
+static akerr_ErrorContext *draw_banner(char *text)
+{
+    SDL_Color ink = { 235, 235, 235, 255 };
+    TTF_Font *font = NULL;
+    int w = 0;
+    int h = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, text, AKERR_NULLPOINTER, "text");
+    font = SDL_GetPointerProperty(AKGL_REGISTRY_FONT, "banner", NULL);
+    FAIL_ZERO_RETURN(errctx, font, AKERR_KEY, "the banner font is not loaded");
+    PASS(errctx, akgl_text_measure(font, text, &w, &h));
+    PASS(errctx, akgl_text_rendertextat(font, text, ink, 0, (1280 - w) / 2, 280));
+    SUCCEED_RETURN(errctx);
+}
+```
+
+The menu owns `AKGL_UI_ANCHOR_CENTER`, a label anchored there disappears
+behind it, and there is no top-center anchor — so the headline measures itself
+and draws at a coordinate, before the UI bracket so the menu still paints over
+it if the two ever meet.
+
+![The title screen: the banner, the menu, the starfield](images/galaga-title.png)
+
+Screen transitions are three rules read after the world updates: lives spent is
+GAME OVER, an empty wave is VICTORY, and a menu activation either restarts or
+quits. The menu never clears its own `activated` flag — the state machine that
+acts on it does.
+
+## Step 9: Run it headless
+
+**Goal: the same game, playable by a script, in CI every night.**
+
+The example takes five flags, in the pattern of libakgl's sidescroller:
+
+```sh norun
+$ SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy SDL_RENDER_DRIVER=software \
+    ./build-akgl/akbasic_example_galaga --frames 600 --autoplay
+```
+
+`--frames N` bounds the run; `--autoplay` is a scripted pilot that starts the
+game, sweeps the floor and holds fire until the wave assembles; `--screenshot
+PATH --screenshot-frame N` write a PNG from the render target — the figures in
+this chapter are that flag's output, not pictures somebody took once. Synthetic
+input goes through `akgl_controller_handle_event()` with constructed
+`SDL_Event`s, never by calling the handlers directly — the point of autoplay is
+to exercise the same path a keyboard does.
+
+The last line of every run is the evidence:
+
+```text
+galaga: 600 frames, screen 1, score 1910, alive 9, kills bee 19 bfly 12 boss 0, shots bee 0 bfly 3 boss 0, script errors 0
+```
+
+Exiting 0 is not proof the wave flew. The readout is: kills and shots counted
+per kind say the enemies entered, thought and fired, and **`script errors 0`**
+says every one of the ~24,000 BASIC calls in those ten seconds came back clean.
+A wave of dumb enemies still exits 0, and that count is how you notice. The
+CTest entry `example_galaga` runs exactly this under the dummy SDL drivers,
+which is what keeps both chapters honest.
+
+---
+
+That is the engine: a window, a starfield, a ship, bullets, screens, and an
+interpreter that answers when called. Everything on screen so far is C. What
+turns it into a GALAGA is [Chapter 21](21-tutorial-galaga-enemies.md) — the
+three shared structures, the script that thinks through them, and a full wave
+entering, breathing, diving and firing without another line of engine code.

docs/21-tutorial-galaga-enemies.md

@@ -0,0 +1,585 @@
+# 21. Tutorial: GALAGA — the structures and the AI
+
+[Chapter 20](20-tutorial-galaga.md) built a C engine that boots the interpreter
+and hands one actor to BASIC. This chapter builds everything that crosses the
+boundary — the three shared structures — and then the script that thinks
+through them: a full wave that enters, forms up, breathes, dives, fires and
+dies, without another line of engine code.
+
+![The wave assembling: bosses, butterflies and bees under BASIC control](images/galaga-wave.png)
+
+The finished script is
+[`examples/galaga/galaga.bas`](../examples/galaga/galaga.bas) — six `DEF`
+functions and an `END`, nothing else. Editing it and re-running the game is the
+whole development loop; the engine never rebuilds.
+
+## What you will do
+
+- **[Step 1](#step-1-declare-the-enemy-once-in-c)** — declare the enemy record
+  once, in C, and register it as a BASIC type
+- **[Step 2](#step-2-bind-the-engines-own-actor)** — bind the engine's own
+  actor as the second type, which is the point of the whole exercise
+- **[Step 3](#step-3-share-the-frame-and-the-dice)** — share the frame state,
+  and give the script randomness it cannot make itself
+- **[Step 4](#step-4-why-bindings-and-not-arguments)** — see why the structures
+  are bindings rather than function arguments
+- **[Step 5](#step-5-the-shape-of-the-script)** — learn the three language
+  rules that shape every enemy function
+- **[Step 6](#step-6-the-shared-maneuvers)** — write the shared maneuvers:
+  glide home, dive, decide to fire
+- **[Step 7](#step-7-the-three-kinds)** — write the bee, the butterfly and the
+  boss
+- **[Step 8](#step-8-the-formation-c-or-basic)** — decide who owns the
+  formation, and lay it out
+- **[Step 9](#step-9-when-a-script-dies)** — decide what a script error does to
+  the game, and make it do that
+- **[Step 10](#step-10-prove-it)** — prove the boundary with a test that links
+  the real files
+- **[Step 11](#step-11-the-cost-measured)** — measure what thinking in BASIC
+  costs, against the same logic in C
+
+---
+
+## Step 1: Declare the enemy once, in C
+
+**Goal: one struct that both languages read and write, with one source of truth.**
+
+An enemy is what the state machine needs to remember between frames, plus one
+inbox and one outbox:
+
+```c wrap=galagatypes requires=akgl
+#define GALAGA_ENEMY_BEE	0
+#define GALAGA_ENEMY_BUTTERFLY	1
+#define GALAGA_ENEMY_BOSS	2
+
+/*
+ * galaga_Enemy.state bits. The script owns these transitions; the engine only
+ * writes the word at spawn.
+ *
+ * 8             0
+ * 0 0 0 0 0 1 1 1
+ *           | | `-- ENTERING: flying its entry path toward the formation slot
+ *           | `---- FORMATION: holding (and breathing around) homex/homey
+ *           `------ DIVING: attacking, off the grid until it leaves the screen
+ */
+#define GALAGA_ES_ENTERING	(1 << 0)
+#define GALAGA_ES_FORMATION	(1 << 1)
+#define GALAGA_ES_DIVING	(1 << 2)
+
+typedef struct galaga_Enemy
+{
+    int32_t  kind;	/* GALAGA_ENEMY_BEE / BUTTERFLY / BOSS		*/
+    int32_t  state;	/* GALAGA_ES_* bit flags			*/
+    float    homex;	/* formation slot, in map pixels		*/
+    float    homey;
+    float    t;		/* parametric clock for the current maneuver	*/
+    int32_t  hp;
+    int32_t  fire;	/* outbox: script sets 1, engine consumes	*/
+    float    rnd;	/* inbox: engine writes fresh 0..1 each call	*/
+} galaga_Enemy;
+```
+
+The C struct *is* the BASIC type. `akbasic_host_register_type()` takes a table
+of field descriptors — the BASIC name with its suffix, the C representation,
+and where the member sits — and after that the language's own machinery works
+across the boundary with no second set of rules
+([Chapter 16](16-structures.md)):
+
+```c wrap=galagatypes requires=akgl
+typedef struct galaga_Enemy
+{
+    int32_t  kind;
+    int32_t  state;
+    float    homex;
+    float    homey;
+    float    t;
+    int32_t  hp;
+    int32_t  fire;
+    float    rnd;
+} galaga_Enemy;
+
+static const akbasic_HostField ENEMY_FIELDS[] = {
+    /*                  struct        member  BASIC name  C representation          */
+    AKBASIC_HOST_FIELD( galaga_Enemy, kind,   "KIND#",    AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, state,  "STATE#",   AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, homex,  "HOMEX%",   AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, homey,  "HOMEY%",   AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, t,      "T%",       AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, hp,     "HP#",      AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, fire,   "FIRE#",    AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, rnd,    "RND%",     AKBASIC_HOSTFIELD_FLOAT )
+};
+static const akbasic_HostType ENEMY_TYPE = {
+    "ENEMY", sizeof(galaga_Enemy), ENEMY_FIELDS, 8
+};
+```
+
+Three decisions are load-bearing here:
+
+- **`AKBASIC_HOST_FIELD` takes the offset and the width from the member
+  itself**, via `offsetof` — so the two sides cannot drift. Writing them out by
+  hand is two chances to name the wrong member and no way to notice.
+- **The script never declares a `TYPE`.** A host type and a script `TYPE` share
+  one namespace, and a script that tries to redeclare `ENEMY` is refused. The
+  "structure definitions" half of the boundary lives here, once.
+- **The suffixes are the dialect's**: `#` is integer, `%` is float
+  ([Chapter 3](03-the-language.md)). `HOMEX%` because a formation slot is a
+  pixel coordinate the glide arithmetic must not truncate.
+
+The limits that shape the struct: a type may carry 16 fields and the runtime 16
+types ([Chapter 16](16-structures.md)). `ENEMY` spends 8 fields; the game
+spends 3 types.
+
+## Step 2: Bind the engine's own actor
+
+**Goal: the script writes the same bytes the renderer reads.**
+
+The enemy record is the game's own invention. The second type is not — it is
+libakgl's `akgl_Actor`, registered field-for-field over the engine's real
+struct:
+
+```c wrap=galagatypes requires=akgl
+static const akbasic_HostField ACTOR_FIELDS[] = {
+    AKBASIC_HOST_FIELD( akgl_Actor, x,       "X%",       AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( akgl_Actor, y,       "Y%",       AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( akgl_Actor, state,   "STATE#",   AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( akgl_Actor, visible, "VISIBLE#", AKBASIC_HOSTFIELD_BOOL  )
+};
+static const akbasic_HostType ACTOR_TYPE = {
+    "ACTOR", sizeof(akgl_Actor), ACTOR_FIELDS, 4
+};
+```
+
+This is the demonstrative point of the whole exercise. When the script writes
+`ACTOR@.X%`, it writes `akgl_Actor.x` — the same memory the renderer reads on
+the same frame. There is no copy going in, no copy coming out, and no code
+between the script's decision and the engine's pixel. Null physics
+(Chapter 20, Step 1) is what makes that safe: nothing else is trying to move
+the actor.
+
+Registration and the first binding happen at boot, before the script loads —
+between `akbasic_runtime_init()` and `akbasic_runtime_load()` in Chapter 20's
+boot sequence. A binding is **borrowed, never copied**, so the placeholders it
+points at must be static storage:
+
+```c wrap=galagacalls requires=akgl
+CATCH(errctx, akbasic_host_register_type(&SCRIPT, &ENEMY_TYPE));
+CATCH(errctx, akbasic_host_register_type(&SCRIPT, &ACTOR_TYPE));
+CATCH(errctx, akbasic_host_register_type(&SCRIPT, &GAME_TYPE));
+
+CATCH(errctx, akbasic_host_bind(&SCRIPT, "SELF@", "ENEMY", &SCRATCH_ENEMY));
+CATCH(errctx, akbasic_host_bind(&SCRIPT, "ACTOR@", "ACTOR", &SCRATCH_ACTOR));
+CATCH(errctx, akbasic_host_bind(&SCRIPT, "GAME@", "GAME", &galaga_shared));
+```
+
+`akbasic_host_bind()` takes the script name, the registered type's name, and
+the instance; after that, `SELF@` and `ACTOR@` are only ever *re*bound.
+
+The per-frame call binds both names to *this* enemy before dispatching — one
+binding per name, pointed at forty enemies in turn, which is what
+`akbasic_host_rebind()` is for:
+
+```c wrap=galagacalls requires=akgl
+CATCH(errctx, akbasic_host_rebind(&SCRIPT, "SELF@", enemy));
+CATCH(errctx, akbasic_host_rebind(&SCRIPT, "ACTOR@", actor));
+```
+
+## Step 3: Share the frame, and the dice
+
+**Goal: everything a diving enemy needs to know about the world, in one record.**
+
+```c wrap=galagatypes requires=akgl
+typedef struct galaga_Shared
+{
+    float    playerx;	/* the player actor's position, this frame	*/
+    float    playery;
+    int32_t  wave;
+    float    rnd;	/* fresh 0..1 each frame; the issue #16 route	*/
+} galaga_Shared;
+```
+
+`GAME@` is bound once at boot to this one global instance and never rebound;
+the engine refreshes it at the top of every frame. The boss reads
+`GAME@.PLAYERX%` to lead its dive; the fire decision reads it to know whether
+anything is worth shooting at.
+
+The `rnd` fields — one here per frame, one on each enemy per call — exist
+because the engine's PRNG is the script's **only** source of randomness: write
+`SELF@.RND% < DT% * 1.5` and an enemy's trigger finger is a dice roll. There
+is no `RND` verb in this dialect; issue #16 tracks adding one, and Chapter
+17's breakout hand-rolls a linear congruential generator in BASIC as the other
+route. Here the engine fills the field, which also keeps a headless run the
+same game on every machine — the PRNG is the example's own, not libc's.
+
+## Step 4: Why bindings, and not arguments
+
+**Goal: know why `SELF@` is a bound global rather than a parameter.**
+
+The language can pass structures to functions — by value with `E@ AS ENEMY`,
+by reference with `E@ AS PTR TO ENEMY` ([Chapter 16](16-structures.md)) — and
+a host can construct those argument values, so the obvious alternative
+interface is honest functions:
+
+```basic norun
+DEF UPDATEBEE(E@ AS PTR TO ENEMY, A@ AS PTR TO ACTOR, G@ AS PTR TO GAME, DT%)
+```
+
+It was measured before this chapter chose. Pointer arguments work — writes
+through `E@->X%` land in the host struct, the type check refuses a wrong type,
+by-value copies exactly as documented. What rules them out is the pool math:
+
+| | bound globals | pointer arguments |
+|---|---|---|
+| value-pool slots per call | 0 | 1 per structure parameter, never returned |
+| calls before exhaustion | unbounded | 1,015 measured (2,048-slot pool, 2 pointer args) |
+| at 40 enemies per frame | unbounded | 25 frames |
+| per-call cost | 148 us | 251 us |
+
+A `@`-suffixed name always takes value-pool storage, and that pool never
+reclaims — a documented property of structures, because a pointer may outlive
+the scope that `DIM`med it. A *parameter* is a local that dies with the call,
+but it pays the storage price of a `DIM` that must survive one; the pool
+drains, and the wave stops thinking mid-flight. Issue #36 tracks it, with the
+reduction for whoever fixes it. Until then: **bind and rebind for per-frame
+host calls; pass structures only to functions called a bounded number of
+times.**
+
+## Step 5: The shape of the script
+
+**Goal: the three rules every enemy function is written under.**
+
+`galaga.bas` is definitions and an `END` — no top-level code, no line numbers,
+no `LABEL`s. Three rules of the dialect shape every body in it.
+
+**Rule 1: the left operand decides integer or float arithmetic**
+([Chapter 3](03-the-language.md)). This will bite every enemy script exactly
+once, so meet it now. The natural spelling of "move by speed times dt" moves
+nothing:
+
+```basic norun
+ACTOR@.Y% = ACTOR@.Y% + 260 * DT%
+```
+
+`260` is an integer, it is on the left of `*`, so `DT%` — a float around
+0.016 — is converted to integer **zero** before the multiply. Nothing fails;
+the enemy simply does not move. The working spelling puts the float first:
+
+```basic norun
+ACTOR@.Y% = ACTOR@.Y% + SPD% * DT%
+SPD% = SELF@.T% * 150 + 260
+```
+
+Every expression in the finished script is written float-first. When an enemy
+of yours will not move, this is the first thing to check.
+
+**Rule 2: only the last `RETURN` may start a line.** A multi-line `DEF` body
+runs until `RETURN` — and the *definition* is scanned the same way, ending at
+the first line that begins with one. An early return therefore always rides an
+`IF ... THEN RETURN 0` on one line, and exactly one line-leading `RETURN` ends
+each function. The stagger guard at the top of every update function is the
+idiom:
+
+```basic norun
+DEF UPDATEBEE(DT%)
+  SELF@.T% = SELF@.T% + DT%
+  IF SELF@.T% < 0 THEN RETURN 0
+```
+
+**Rule 3: the budgets are small and named.** Eight function slots exist
+(`AKBASIC_MAX_FUNCTIONS`), each a measured 36 KiB of the runtime's 2.40 MiB.
+This game defines six: three update functions, two shared maneuvers, one fire
+decision. Nesting draws from the twelve-slot environment pool exactly as
+`GOSUB` does; the deepest chain here is three (update → maneuver → nothing).
+If a design needs a ninth function, raising the limit is one `#define` and
++36 KiB per slot — weighed, not assumed.
+
+## Step 6: The shared maneuvers
+
+**Goal: three helpers that make the three kinds one page each.**
+
+Ease toward the formation slot, with a little entry swirl. Answers 1 once the
+slot is reached — the caller flips the state on that answer:
+
+```basic
+DEF GLIDEHOME(DT%)
+  DX% = SELF@.HOMEX% - ACTOR@.X%
+  DY% = SELF@.HOMEY% - ACTOR@.Y%
+  K% = DT% * 4.5
+  IF K% > 1 THEN K% = 1
+  ACTOR@.X% = ACTOR@.X% + DX% * K% + SIN(SELF@.T% * 6) * 90 * DT%
+  ACTOR@.Y% = ACTOR@.Y% + DY% * K%
+  IF ABS(DX%) < 3 AND ABS(DY%) < 3 THEN RETURN 1
+  RETURN 0
+END
+```
+
+One frame of a dive: accelerate downward, weave, lean toward the player's
+column, and glide back in from the top after falling out the bottom. The
+weave and the lean are parameters, which is what makes three kinds out of one
+maneuver:
+
+```basic
+DEF DIVESTEP(DT%, WEAVE%, LEAD%)
+  SPD% = SELF@.T% * 150 + 260
+  ACTOR@.Y% = ACTOR@.Y% + SPD% * DT%
+  ACTOR@.X% = ACTOR@.X% + SIN(SELF@.T% * 4) * WEAVE% * DT%
+  DX% = GAME@.PLAYERX% - ACTOR@.X%
+  IF DX% > 220 THEN DX% = 220
+  IF DX% < -220 THEN DX% = -220
+  ACTOR@.X% = ACTOR@.X% + DX% * LEAD% * DT%
+  IF ACTOR@.Y% > 1040 THEN BEGIN
+    ACTOR@.Y% = 0.0 - 90
+    SELF@.STATE# = 1
+    SELF@.T% = 0
+  BEND
+  RETURN 0
+END
+```
+
+Note the off-screen exit: state back to `1` (ENTERING), clock to zero, and the
+glide brings it home — a dive that misses rejoins the formation, which is the
+classic loop. `0.0 - 90` rather than `0 - 90` is Rule 1 again: the float goes
+first even to make a negative.
+
+The fire decision raises the flag when diving roughly above the player. The
+engine consumes `FIRE#` and does the spawning — the script only wishes,
+because spawning takes an actor from a bounded pool and pool exhaustion must
+be a C-side refusal with the house error context, not a script mystery:
+
+```basic
+DEF DECIDEFIRE(DT%)
+  DX% = GAME@.PLAYERX% - ACTOR@.X%
+  IF ABS(DX%) > 140 THEN RETURN 0
+  IF ACTOR@.Y% > GAME@.PLAYERY% THEN RETURN 0
+  IF SELF@.RND% < DT% * 1.5 THEN SELF@.FIRE# = 1
+  RETURN 0
+END
+```
+
+## Step 7: The three kinds
+
+**Goal: bee, butterfly, boss — one state machine, three characters.**
+
+Every kind is the same three-state machine, dispatched by the bits of
+`SELF@.STATE#`. The bee is the reference implementation:
+
+```basic
+DEF GLIDEHOME(DT%)
+  ACTOR@.X% = SELF@.HOMEX%
+  ACTOR@.Y% = SELF@.HOMEY%
+  RETURN 1
+
+DEF DIVESTEP(DT%, WEAVE%, LEAD%)
+  RETURN 0
+
+DEF DECIDEFIRE(DT%)
+  RETURN 0
+
+DEF UPDATEBEE(DT%)
+  SELF@.T% = SELF@.T% + DT%
+  IF SELF@.T% < 0 THEN RETURN 0
+  S# = SELF@.STATE#
+  IF (S# AND 1) > 0 THEN BEGIN
+    R# = GLIDEHOME(DT%)
+    IF R# = 1 THEN SELF@.STATE# = 2 : SELF@.T% = 0
+  BEND
+  IF (S# AND 2) > 0 THEN BEGIN
+    ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 1.7) * 16
+    ACTOR@.Y% = SELF@.HOMEY%
+    IF SELF@.RND% < DT% * 0.04 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+  BEND
+  IF (S# AND 4) > 0 THEN BEGIN
+    R# = DIVESTEP(DT%, 130, 0.2)
+    R# = DECIDEFIRE(DT%)
+  BEND
+  RETURN 0
+END
+```
+
+(The three helpers above are stubs so this listing runs alone; the real ones
+are Step 6's. The listing in `galaga.bas` is this function verbatim.)
+
+The shape to notice: `S#` is read **once**, so a state flipped this frame does
+not also run its new state's block this frame — transitions are frame-atomic.
+Each block is one `IF ... BEGIN`/`BEND`, never nested. The formation block
+computes position *relative to home* every frame — `HOMEX% + SIN(...)` — so
+the grid's idle breathing belongs to the script even though C placed the grid.
+
+The butterfly is the bee with a wide lateral weave — `DIVESTEP(DT%, 260, 0.1)`
+— and a slightly itchier trigger. The boss differs three ways: two hit points
+(C fills `HP#` at spawn), a dive that leads the player —
+`DIVESTEP(DT%, 60, 0.9)` — and one line that crosses the boundary in the other
+direction:
+
+```basic norun
+IF SELF@.HP# = 1 THEN ACTOR@.STATE# = ACTOR@.STATE# OR 8192
+```
+
+8192 is `AKGL_ACTOR_STATE_UNDEFINED_13`, one of the actor state bits libakgl
+reserves for the game. The boss's character file maps the state word
+`ALIVE` to the green sprite and `ALIVE`+bit-13 to the drained one — so when
+the script raises the bit, the engine's own character machinery swaps the
+sprite. BASIC decides *that* the boss looks hurt; C never hears about it.
+
+## Step 8: The formation: C or BASIC?
+
+**Goal: decide who owns the grid, from the trade-offs rather than taste.**
+
+Both can lay out the formation. The choice is argued, not asserted:
+
+| | C lays out the grid | BASIC lays out the grid |
+|---|---|---|
+| actor pool safety | refusal at spawn, house error path | script can ask for more than 64 exist |
+| tuning without rebuild | no | yes |
+| call budget | zero calls | one call per spawn |
+| who knows the screen size | the engine owns it anyway | needs it exported through `GAME@` |
+
+**Decision: C owns the grid, the wave table and the spawn timing; BASIC owns
+everything an enemy does after it exists.** The slot arrives in
+`SELF@.HOMEX%`/`HOMEY%`, so the breathing stays the script's (Step 7), and the
+pool stays behind a C-side refusal. The wave is the aligned table house style
+already prescribes for tabular data — one row per formation row:
+
+```c wrap=galagagame requires=akgl
+static const struct
+{
+    int32_t kind;	/* GALAGA_ENEMY_*	*/
+    int     row;	/* formation row	*/
+    int     first;	/* first column filled	*/
+    int     count;	/* columns filled	*/
+    int32_t hp;
+}
+WAVE_ROWS[] = {
+    /*  kind                    row  first  count  hp  */
+    { GALAGA_ENEMY_BOSS,	 0,     3,     4,   2 },
+    { GALAGA_ENEMY_BUTTERFLY,	 1,     1,     8,   1 },
+    { GALAGA_ENEMY_BUTTERFLY,	 2,     1,     8,   1 },
+    { GALAGA_ENEMY_BEE,		 3,     0,    10,   1 },
+    { GALAGA_ENEMY_BEE,		 4,     0,    10,   1 }
+};
+```
+
+Forty enemies: 4 bosses, 16 butterflies, 20 bees. The actor heap holds 64:
+
+```text
+player            1
+player shots      2      /* the classic two-on-screen rule           */
+enemies          40      /* 20 bees, 16 butterflies, 4 bosses        */
+enemy shots       8
+explosions        8      /* short-lived actors, released on a timer  */
+                ---
+                 59 of 64
+```
+
+The spawn walks the table, fills each `galaga_Enemy`, and staggers the entry
+clocks — `t = -0.08 * index`, so each enemy holds still until its own clock
+crosses zero and the wave pours in as a stream rather than a wall. The full
+loop is `examples/galaga/enemies.c`.
+
+## Step 9: When a script dies
+
+**Goal: a script error costs one enemy's wits, never the frame.**
+
+A BASIC-level error in an enemy's function — a misspelled field, arithmetic on
+the wrong type — reports through the sink and stops the script. The engine's
+policy, implemented around the call in `script.c`:
+
+- **The enemy goes dumb**: state cleared to a formation hold it will never
+  leave, outbox cleared. The other thirty-nine keep thinking.
+- **The runtime is revived**: a run's first error latches, and while it stands
+  every later call answers a stale value after doing nothing. Revival is two
+  calls — `akbasic_runtime_clear_error()`, then the same
+  `akbasic_runtime_set_mode(RUN)` the boot needed (issue #8's mechanics).
+- **The first failure is logged, the rest are counted.** Sixty a second of the
+  same message is how a log stops being read; the count lands in the closing
+  readout as `script errors N`, where a headless run cannot miss it.
+
+The same detection runs at boot: every function in the dispatch table is
+called once against a zeroed scratch enemy, so a script that cannot run fails
+at startup with the function's name in the message — not on frame one of the
+first wave.
+
+## Step 10: Prove it
+
+**Goal: a test that fails the moment the two sides disagree.**
+
+`examples/galaga/interop_test.c` links the real `script.c` and loads the real
+`galaga.bas` — not copies — and pins the four claims this chapter made:
+
+```text
+ok: a formation bee's sway is written into akgl_Actor.x/y by the script
+ok: a diving bee above the player raises FIRE# for the engine to consume
+ok: a boss at one hit point raises actor state bit 13 from BASIC
+ok: 24000 calls survive the per-call akbasic_environment_zero() regime
+```
+
+That last claim is the per-frame contract from Chapter 20 Step 6 under a full
+game's load — forty enemies at sixty frames a second for ten seconds. CTest
+runs it as `example_galaga_interop` beside the headless game itself.
+
+And because the script is data, the proof extends to scripts nobody planned:
+run the game with `--script` pointing at a variant — enemies that never dive,
+enemies that always dive — and the engine neither knows nor cares. That
+swap-a-brain-without-rebuilding property is what the two chapters were about;
+the readout tells you how each brain did:
+
+```text
+galaga: 3000 frames, screen 2, score 2350, alive 0, kills bee 20 bfly 15 boss 1, shots bee 1 bfly 1 boss 1, script errors 0
+```
+
+## Step 11: The cost, measured
+
+**Goal: the real price of the boundary, in numbers, next to the same logic in C.**
+
+The interop test binary ends with a benchmark: 24,000 formation-hold updates —
+forty enemies at sixty frames a second for ten seconds — once through
+`galaga_script_update_enemy()` and once through a line-for-line C translation
+of `UPDATEBEE` with its helpers inlined. Same guard, same branches, same
+arithmetic; the difference is the interpreter. On this repository's build
+machine (a two-core VM, the interpreter built `-O2`):
+
+```text
+benchmark: 24000 formation-hold updates, dt 0.016
+  BASIC through the boundary:   21.147 s   881.11 us/call  35.245 ms per 40-enemy frame
+  the same logic in C:           0.000 s     0.01 us/call   0.001 ms per 40-enemy frame
+  ratio: 61022x
+```
+
+The facts, without decoration:
+
+- **A BASIC-driven update costs about four orders of magnitude more than the
+  same logic compiled.** The C translation of the whole state machine costs
+  tens of *nano*seconds; the scripted call costs high hundreds of
+  *micro*seconds.
+- **The cost is per line executed, not per call.** The interpreter scans and
+  parses each body line from source text on every call; a 3-line body measured
+  ~148 us on this class of machine, and this ~15-line body measures ~881 us.
+  Body length is the knob.
+- **At this cost, forty thinking enemies spend ~35 ms per frame on this
+  hardware** — more than two 60 Hz frames. The shipped example visibly runs
+  below 60 fps on this machine while the whole wave is alive, and exactly at
+  its frame pace once the wave thins. A faster machine moves the numbers, not
+  the shape.
+
+This is the measured version of decisions the chapters already made on
+architectural grounds. Bullets, collision and the starfield are C
+([Chapter 20](20-tutorial-galaga.md), Steps 2 and 4) — at two shots and forty
+tests a frame, scripting them would multiply the call count for things that
+decide nothing. The fire decision is one flag rather than a per-bullet
+callback (Step 6): the script's call budget is bounded by the enemy count and
+nothing else. C owns the formation and the spawn timing (Step 8), so zero
+calls happen for enemies that do not exist yet. And the 36 KiB function slots
+and 2.40 MiB runtime (Step 5) are the memory half of the same bill.
+
+What the cost buys is the previous ten steps: behavior as data, edited and
+swapped without a compiler. Whether ~900 us per thinking entity per frame is
+acceptable is a per-project decision — fewer thinkers, shorter bodies, or a
+lower think rate (every Nth frame) are the standard levers, and all three are
+host-side choices this architecture leaves open.
+
+---
+
+Where to go from here: more waves are rows in the table; a new enemy kind is
+one table row, one character file and one `DEF`; a smarter boss is edits to a
+text file while the game is closed — or a different file handed to
+`--script`. The engine is done. That is the point.

docs/README.md

@@ -16,7 +16,10 @@ embedding it, debugging it or changing it.
 **[Chapters 17](17-tutorial-breakout.md)** and **[18](18-tutorial-breakout-artwork.md)**
 are tutorials rather than reference: they build one complete game twice, two different
 ways, in numbered steps you can type in one at a time. Start with 17 — it needs nothing
-but the earlier chapters, and 18 assumes it.
+but the earlier chapters, and 18 assumes it. **[Chapters 20](20-tutorial-galaga.md)** and
+**[21](21-tutorial-galaga-enemies.md)** are the third tutorial, from the other side of
+the boundary: a C game on libakgl that embeds the interpreter as its enemy-behavior
+engine, for anyone whose question is "how do I put this in *my* game".
 
 ## Chapters
 
@@ -41,6 +44,8 @@ but the earlier chapters, and 18 assumes it.
 | **[17. Tutorial: Breakout](17-tutorial-breakout.md)** | Build a whole game out of the text grid and two `DATA` sprites, in sixteen steps |
 | **[18. Tutorial: Breakout with artwork](18-tutorial-breakout-artwork.md)** | Build it again out of loaded artwork, powerups and a drawn colour HUD, in thirteen |
 | **[19. Menus and dialogs](19-user-interface.md)** | `MENU`, `DIALOG`, `HUD` and `UISTYLE` — the widgets, and who owns the keyboard |
+| **[20. Tutorial: GALAGA](20-tutorial-galaga.md)** | Build a C engine on libakgl that embeds the interpreter, boots a script and hands it an actor |
+| **[21. Tutorial: GALAGA enemies](21-tutorial-galaga-enemies.md)** | Share three C structs with the script, then write the wave's whole brain in BASIC |
 
 ## The shortest possible start
 

examples/galaga/README.md

@@ -0,0 +1,63 @@
+# GALAGA — a C engine with akbasic embedded as its enemy brain
+
+A GALAGA-style fixed shooter whose core engine is C on libakgl, with akbasic
+linked in as the scripting engine that owns every enemy's behavior. One BASIC
+script — `galaga.bas`, nothing but `DEF` functions and an `END` — is called
+once per enemy per frame through a custom `akgl_Actor` update hook. Bullets,
+collision, scoring and screens are C forever; everything an enemy *decides* is
+BASIC.
+
+This is the checked-in example behind two tutorial chapters, and the chapters
+are the intended way in:
+
+* **[Chapter 20](../../docs/20-tutorial-galaga.md)** — the engine and the
+  boundary: from an empty file to a C game that boots a script and hands one
+  actor to BASIC.
+* **[Chapter 21](../../docs/21-tutorial-galaga-enemies.md)** — the data
+  structures and the AI: from `SELF@` to a full attacking wave.
+
+It is an academic exercise demonstrating *how* such an embed is done, not a
+claim that it is the best way to write a GALAGA.
+
+## Building and running
+
+The example builds when both example and graphics builds are on:
+
+```
+cmake -S . -B build-akgl -DAKBASIC_WITH_AKGL=ON
+cmake --build build-akgl --target akbasic_example_galaga
+build-akgl/akbasic_example_galaga
+```
+
+| Key | Does |
+|---|---|
+| Left / Right | move the ship |
+| Space | fire (two shots on screen, the classic rule) |
+| Return | choose a menu entry |
+
+## Flags
+
+```
+akbasic_example_galaga [--assets DIR] [--script PATH] [--frames N]
+                       [--autoplay] [--screenshot PATH] [--screenshot-frame N]
+```
+
+`--script` points at a different enemy script, which is the whole point of the
+architecture: edit `galaga.bas`, run again, no rebuild. `--frames N` with
+`--autoplay` is the headless smoke test CI runs under the dummy SDL drivers;
+the final log line reports frames, score, kills and shots per kind, and the
+script-error count — a wave of dumb enemies still exits 0, and that count is
+how you notice.
+
+## The files
+
+| File | Owns |
+|---|---|
+| `galaga.h` | the shared structs — the whole boundary in one header |
+| `main.c` | startup order, the frame loop, screens, the starfield |
+| `script.c` | everything that touches the interpreter |
+| `enemies.c` | wave table, formation grid, the enemy update hook |
+| `player.c` | the ship, both bullet kinds, every collision |
+| `galaga.bas` | every decision an enemy makes |
+| `interop_test.c` | round-trip proof the boundary works, run by CTest |
+| `assets/` | sprite/character JSON, and Kenney CC0 art under `assets/art/` |

examples/galaga/assets/art/License.txt

@@ -0,0 +1,14 @@
+
+###############################################################################
+
+	Space Shooter (Remastered, plus fonts and sounds) by Kenney Vleugels (www.kenney.nl)
+
+			------------------------------
+
+			        License (CC0)
+	       http://creativecommons.org/publicdomain/zero/1.0/
+
+	You may use these graphics in personal and commercial projects.
+	Credit (Kenney or www.kenney.nl) would be nice but is not mandatory.
+
+###############################################################################

examples/galaga/assets/art/PROVENANCE.md

@@ -0,0 +1,39 @@
+# Where this art came from
+
+Every PNG in this directory is from **Kenney's Space Shooter (Remastered)**, released
+into the public domain under
+[Creative Commons Zero](http://creativecommons.org/publicdomain/zero/1.0/).
+`License.txt` is the pack's own licence file, copied here unedited.
+
+* Source: <https://kenney.nl/assets/space-shooter-remastered>
+* Downloaded: 2026-08-04, `kenney_space-shooter-remastered.zip`
+* Author: Kenney (<https://www.kenney.nl>)
+* Licence: CC0 1.0. Crediting is not required; it is here because it should be.
+
+The files are the pack's `PNG/` versions, byte for byte — nothing is resized,
+recoloured or re-encoded, so the checksum of any of them still matches the
+distributed archive. `playerShip1_blue.png` sits at the top of `PNG/`; the enemies
+are from `PNG/Enemies/` and the lasers from `PNG/Lasers/`.
+
+| File | Size | Used for |
+|---|---|---|
+| `playerShip1_blue.png` | 99x75  | the player's ship |
+| `enemyBlue1.png`       | 93x84  | the bee |
+| `enemyRed2.png`        | 104x84 | the butterfly |
+| `enemyGreen3.png`      | 103x84 | the boss, at full health |
+| `enemyBlack3.png`      | 103x84 | the boss at one hit point — same silhouette, drained colour |
+| `laserBlue01.png`      | 9x54   | the player's shot |
+| `laserRed01.png`       | 9x54   | an enemy's shot |
+| `laserBlue08.png`      | 48x46  | the explosion burst |
+
+The sprites are used at their distributed size: libakgl draws a sprite at the
+sprite's own dimensions (`akgl_Actor.scale` is overwritten every frame — libakgl
+docs/12-actors.md), so there is no way to draw these smaller, and the game's
+1280x960 view is sized to fit a ten-column formation of them instead. The boss's
+damage state is the same shape in a different colour deliberately: the swap has to
+read at a glance from the top of the screen.
+
+Everything else on screen — the starfield and the HUD — is drawn by the program
+with `akgl_draw_point()` and the UI layer. See `../../README.md` for the run
+instructions and the two tutorial chapters (docs/20, docs/21) for why only the
+things that move are artwork.

examples/galaga/assets/character_galaga_bee.json

@@ -0,0 +1,16 @@
+{
+    "name": "galaga_bee",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_bee"
+        }
+    ]
+}

examples/galaga/assets/character_galaga_boom.json

@@ -0,0 +1,16 @@
+{
+    "name": "galaga_boom",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_boom"
+        }
+    ]
+}

examples/galaga/assets/character_galaga_boss.json

@@ -0,0 +1,23 @@
+{
+    "name": "galaga_boss",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_boss"
+        },
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE",
+                "AKGL_ACTOR_STATE_UNDEFINED_13"
+            ],
+            "sprite": "galaga_boss_hurt"
+        }
+    ]
+}

examples/galaga/assets/character_galaga_butterfly.json

@@ -0,0 +1,16 @@
+{
+    "name": "galaga_butterfly",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_butterfly"
+        }
+    ]
+}

examples/galaga/assets/character_galaga_enemyshot.json

@@ -0,0 +1,16 @@
+{
+    "name": "galaga_enemyshot",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_enemyshot"
+        }
+    ]
+}

examples/galaga/assets/character_galaga_player.json

@@ -0,0 +1,16 @@
+{
+    "name": "galaga_player",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_player"
+        }
+    ]
+}

examples/galaga/assets/character_galaga_playershot.json

@@ -0,0 +1,16 @@
+{
+    "name": "galaga_playershot",
+    "speedtime": 200,
+    "speed_x": 0.0,
+    "speed_y": 0.0,
+    "acceleration_x": 0.0,
+    "acceleration_y": 0.0,
+    "sprite_mappings": [
+        {
+            "state": [
+                "AKGL_ACTOR_STATE_ALIVE"
+            ],
+            "sprite": "galaga_playershot"
+        }
+    ]
+}

examples/galaga/assets/sprite_galaga_bee.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/enemyBlue1.png",
+        "frame_width": 93,
+        "frame_height": 84
+    },
+    "name": "galaga_bee",
+    "width": 93,
+    "height": 84,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_boom.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/laserBlue08.png",
+        "frame_width": 48,
+        "frame_height": 46
+    },
+    "name": "galaga_boom",
+    "width": 48,
+    "height": 46,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_boss.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/enemyGreen3.png",
+        "frame_width": 103,
+        "frame_height": 84
+    },
+    "name": "galaga_boss",
+    "width": 103,
+    "height": 84,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_boss_hurt.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/enemyBlack3.png",
+        "frame_width": 103,
+        "frame_height": 84
+    },
+    "name": "galaga_boss_hurt",
+    "width": 103,
+    "height": 84,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_butterfly.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/enemyRed2.png",
+        "frame_width": 104,
+        "frame_height": 84
+    },
+    "name": "galaga_butterfly",
+    "width": 104,
+    "height": 84,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_enemyshot.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/laserRed01.png",
+        "frame_width": 9,
+        "frame_height": 54
+    },
+    "name": "galaga_enemyshot",
+    "width": 9,
+    "height": 54,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_player.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/playerShip1_blue.png",
+        "frame_width": 99,
+        "frame_height": 75
+    },
+    "name": "galaga_player",
+    "width": 99,
+    "height": 75,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/assets/sprite_galaga_playershot.json

@@ -0,0 +1,16 @@
+{
+    "spritesheet": {
+        "filename": "art/laserBlue01.png",
+        "frame_width": 9,
+        "frame_height": 54
+    },
+    "name": "galaga_playershot",
+    "width": 9,
+    "height": 54,
+    "speed": 200,
+    "loop": false,
+    "loopReverse": false,
+    "frames": [
+        0
+    ]
+}

examples/galaga/enemies.c

@@ -0,0 +1,314 @@
+/**
+ * @file enemies.c
+ * @brief The formation, the wave, and the hook that hands each enemy to BASIC.
+ *
+ * C owns the grid, the wave table and the spawn timing; BASIC owns everything
+ * an enemy does after it exists. The formation slot arrives in SELF@.HOMEX% /
+ * HOMEY%, so even the idle breathing of the grid is the script's, computed
+ * relative to home.
+ */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/error.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+
+#include "galaga.h"
+
+galaga_Enemy galaga_enemies[GALAGA_MAX_ENEMIES];
+akgl_Actor *galaga_enemy_actors[GALAGA_MAX_ENEMIES];
+
+/* Explosion lifetimes, indexed by heap slot. An explosion is an actor with
+ * nothing to decide, so its whole state is one countdown. */
+static float BOOM_TTL[AKGL_MAX_HEAP_ACTOR];
+
+/* A spawn serial per shot so registry names never collide while two shots
+ * with the same slot number are briefly both alive. */
+static uint32_t SHOT_SERIAL = 0;
+static uint32_t BOOM_SERIAL = 0;
+
+/*
+ * The wave, one row per formation row. Columns are 0..9 at GALAGA_COL_PITCH;
+ * `first` and `count` say which columns the row fills. 40 enemies: 4 bosses,
+ * 16 butterflies, 20 bees -- 59 of the 64 actor heap slots at peak, counting
+ * the player, two player shots, eight enemy shots and eight explosions.
+ */
+static const struct
+{
+    int32_t kind;	/* GALAGA_ENEMY_*	*/
+    int     row;	/* formation row	*/
+    int     first;	/* first column filled	*/
+    int     count;	/* columns filled	*/
+    int32_t hp;
+}
+WAVE_ROWS[] = {
+    /*  kind                    row  first  count  hp  */
+    { GALAGA_ENEMY_BOSS,	 0,     3,     4,   2 },
+    { GALAGA_ENEMY_BUTTERFLY,	 1,     1,     8,   1 },
+    { GALAGA_ENEMY_BUTTERFLY,	 2,     1,     8,   1 },
+    { GALAGA_ENEMY_BEE,		 3,     0,    10,   1 },
+    { GALAGA_ENEMY_BEE,		 4,     0,    10,   1 }
+};
+#define WAVE_ROW_COUNT ((int)(sizeof(WAVE_ROWS) / sizeof(WAVE_ROWS[0])))
+
+/* Enemy kind -> character name, the render half of the dispatch table. */
+static char *ENEMY_CHARACTER[GALAGA_ENEMY_KINDS] = {
+    "galaga_bee",
+    "galaga_butterfly",
+    "galaga_boss"
+};
+
+/* --------------------------------------------------------------- random --- */
+
+/*
+ * No RND verb exists (issue #16), so the engine is the script's only source
+ * of randomness: it refreshes GAME@.RND% each frame and SELF@.RND% each call
+ * from this PRNG. A hand-rolled LCG rather than rand() so a headless run is
+ * the same game on every libc.
+ */
+static uint32_t PRNG_STATE = 0x12345678u;
+
+float galaga_random(void)
+{
+    PRNG_STATE = PRNG_STATE * 1664525u + 1013904223u;
+    return (float)(PRNG_STATE >> 8) / (float)0x01000000u;
+}
+
+/* -------------------------------------------------------------- helpers --- */
+
+static akerr_ErrorContext *release_actor(akgl_Actor *actor)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, actor, AKERR_NULLPOINTER, "actor");
+    PASS(errctx, akgl_heap_release_actor(actor));
+    SUCCEED_RETURN(errctx);
+}
+
+/* ---------------------------------------------------------------- shots --- */
+
+/**
+ * @brief Move an enemy shot; release it once it has left the screen.
+ */
+static akerr_ErrorContext *enemy_shot_update(akgl_Actor *obj)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    obj->y += 380.0f * galaga_game.dt;
+    if ( obj->y > (float)GALAGA_VIEW_HEIGHT + 60.0f ) {
+	galaga_game.enemy_shots_live -= 1;
+	PASS(errctx, release_actor(obj));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief Consume an enemy's fire flag: take an actor and aim it downward.
+ *
+ * The script only raises a flag. Spawning takes a slot from the actor heap,
+ * and pool exhaustion must be a C-side refusal with the house error context --
+ * so C consumes the flag and does the spawn. The engine also enforces the
+ * eight-shot cap by simply not consuming the flag's wish.
+ */
+static akerr_ErrorContext *enemy_fire(galaga_Enemy *enemy, akgl_Actor *from)
+{
+    akgl_Actor *shot = NULL;
+    char name[32];
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, enemy, AKERR_NULLPOINTER, "enemy");
+    FAIL_ZERO_RETURN(errctx, from, AKERR_NULLPOINTER, "from");
+
+    enemy->fire = 0;
+    if ( galaga_game.enemy_shots_live >= GALAGA_MAX_ENEMY_SHOTS ) {
+	SUCCEED_RETURN(errctx);
+    }
+
+    SHOT_SERIAL += 1;
+    PASS(errctx, aksl_snprintf(&count, name, sizeof(name), "eshot%u", SHOT_SERIAL));
+    PASS(errctx, akgl_heap_next_actor(&shot));
+    PASS(errctx, akgl_actor_initialize(shot, name));
+    PASS(errctx, akgl_actor_set_character(shot, "galaga_enemyshot"));
+    /* AFTER initialize: it resets all seven hooks. */
+    shot->updatefunc = &enemy_shot_update;
+    shot->movement_controls_face = false;
+    shot->state = AKGL_ACTOR_STATE_ALIVE;
+    /* akgl_actor_initialize() does not raise `visible`; a hand-spawned actor
+     * that skips this line exists, moves and collides -- invisibly. */
+    shot->visible = true;
+    /* Actor x/y is a sprite's top-left corner; the shot leaves the enemy's
+     * midline. Enemy sprites run 93..104 wide, the shot is 9. */
+    shot->x = from->x + 46.0f;
+    shot->y = from->y + 60.0f;
+
+    galaga_game.enemy_shots_live += 1;
+    galaga_game.shots[enemy->kind] += 1;
+    SUCCEED_RETURN(errctx);
+}
+
+/* ----------------------------------------------------------- explosions --- */
+
+static akerr_ErrorContext *boom_update(akgl_Actor *obj)
+{
+    ptrdiff_t slot = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    slot = obj - akgl_heap_actors;
+    BOOM_TTL[slot] -= galaga_game.dt;
+    if ( BOOM_TTL[slot] <= 0.0f ) {
+	PASS(errctx, release_actor(obj));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *galaga_boom_spawn(float x, float y)
+{
+    akgl_Actor *boom = NULL;
+    char name[32];
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    ATTEMPT {
+	CATCH(errctx, akgl_heap_next_actor(&boom));
+	BOOM_SERIAL += 1;
+	CATCH(errctx, aksl_snprintf(&count, name, sizeof(name), "boom%u", BOOM_SERIAL));
+	CATCH(errctx, akgl_actor_initialize(boom, name));
+	CATCH(errctx, akgl_actor_set_character(boom, "galaga_boom"));
+	boom->updatefunc = &boom_update;
+	boom->movement_controls_face = false;
+	boom->state = AKGL_ACTOR_STATE_ALIVE;
+	boom->visible = true;
+	boom->x = x;
+	boom->y = y;
+	BOOM_TTL[boom - akgl_heap_actors] = 0.25f;
+    } CLEANUP {
+    } PROCESS(errctx) {
+    } HANDLE(errctx, AKGL_ERR_HEAP) {
+	/* Explosions are decoration. When the heap is momentarily full the
+	 * right outcome is no explosion, not a dead frame -- this is the one
+	 * spawn that absorbs exhaustion. */
+    } FINISH(errctx, true);
+    SUCCEED_RETURN(errctx);
+}
+
+/* --------------------------------------------------------------- enemies --- */
+
+/**
+ * @brief The custom update hook: one enemy, once per frame, thought in BASIC.
+ *
+ * The whole body is the protocol from docs/20: refresh the inbox, hand the
+ * pair to the script, consume the outbox. akgl_game_update() calls this in
+ * place of akgl_actor_update() because spawn replaced the hook.
+ */
+static akerr_ErrorContext *enemy_update(akgl_Actor *obj)
+{
+    galaga_Enemy *enemy = NULL;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    enemy = (galaga_Enemy *)obj->actorData;
+    FAIL_ZERO_RETURN(errctx, enemy, AKERR_NULLPOINTER, "an enemy actor with no galaga_Enemy attached");
+
+    enemy->rnd = galaga_random();
+    PASS(errctx, galaga_script_update_enemy(enemy, obj, galaga_game.dt));
+    if ( enemy->fire != 0 ) {
+	PASS(errctx, enemy_fire(enemy, obj));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *galaga_wave_spawn(void)
+{
+    akgl_Actor *actor = NULL;
+    galaga_Enemy *enemy = NULL;
+    char name[32];
+    int row = 0;
+    int col = 0;
+    int index = 0;
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    for ( row = 0; row < WAVE_ROW_COUNT; row++ ) {
+	for ( col = 0; col < WAVE_ROWS[row].count; col++ ) {
+	    FAIL_NONZERO_RETURN(errctx, (index >= GALAGA_MAX_ENEMIES), AKERR_OUTOFBOUNDS,
+				"The wave table places more than %d enemies", GALAGA_MAX_ENEMIES);
+	    enemy = &galaga_enemies[index];
+	    memset(enemy, 0, sizeof(*enemy));
+	    enemy->kind = WAVE_ROWS[row].kind;
+	    enemy->state = GALAGA_ES_ENTERING;
+	    enemy->homex = (float)(GALAGA_FORM_LEFT
+				   + (WAVE_ROWS[row].first + col) * GALAGA_COL_PITCH);
+	    enemy->homey = (float)(GALAGA_FORM_TOP + WAVE_ROWS[row].row * GALAGA_ROW_PITCH);
+	    enemy->hp = WAVE_ROWS[row].hp;
+	    /* Stagger the entries: each enemy's clock starts in the past, and
+	     * the script holds still until its own t crosses zero. */
+	    enemy->t = -0.08f * (float)index;
+
+	    PASS(errctx, aksl_snprintf(&count, name, sizeof(name), "enemy%02d", index));
+	    PASS(errctx, akgl_heap_next_actor(&actor));
+	    PASS(errctx, akgl_actor_initialize(actor, name));
+	    PASS(errctx, akgl_actor_set_character(actor, ENEMY_CHARACTER[enemy->kind]));
+	    /* AFTER initialize: it resets all seven hooks. */
+	    actor->updatefunc = &enemy_update;
+	    actor->actorData = enemy;
+	    /* Nothing here moves by state bits, and an actor whose state word
+	     * matches no character mapping is silently not drawn -- so facing
+	     * stays entirely out of the state word. */
+	    actor->movement_controls_face = false;
+	    actor->state = AKGL_ACTOR_STATE_ALIVE;
+	    /* akgl_actor_initialize() does not raise `visible` -- the map
+	     * loader copies it from map data, and there is no map here. Skip
+	     * this and the whole wave exists, moves, fires and dies without
+	     * ever being drawn. */
+	    actor->visible = true;
+	    /* Off screen above, pouring in from whichever side is closer. */
+	    actor->x = (enemy->homex < (float)GALAGA_VIEW_WIDTH / 2.0f)
+		? -80.0f : (float)GALAGA_VIEW_WIDTH + 80.0f;
+	    actor->y = -80.0f;
+
+	    galaga_enemy_actors[index] = actor;
+	    index += 1;
+	}
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *galaga_wave_release(void)
+{
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    for ( i = 0; i < GALAGA_MAX_ENEMIES; i++ ) {
+	if ( galaga_enemy_actors[i] != NULL ) {
+	    PASS(errctx, release_actor(galaga_enemy_actors[i]));
+	    galaga_enemy_actors[i] = NULL;
+	}
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+int galaga_enemies_alive(void)
+{
+    int i = 0;
+    int alive = 0;
+
+    for ( i = 0; i < GALAGA_MAX_ENEMIES; i++ ) {
+	if ( galaga_enemy_actors[i] != NULL ) {
+	    alive += 1;
+	}
+    }
+    return alive;
+}

examples/galaga/galaga.bas

@@ -0,0 +1,119 @@
+REM GALAGA enemy behavior. The C engine loads this file, runs it once so the
+REM definitions exist, and then calls one UPDATE function per enemy per frame.
+REM There is no top-level code: definitions, then END.
+REM
+REM Names the engine binds before every call:
+REM   SELF@  - this enemy's record (ENEMY): the state machine's memory
+REM   ACTOR@ - the engine's live actor (ACTOR): position is the real thing
+REM   GAME@  - shared frame state (GAME): player position, wave, randomness
+REM
+REM SELF@.STATE# bits: 1 = entering  2 = in formation  4 = diving
+REM
+REM Two rules of this dialect that bite here, both from docs/03:
+REM   - the LEFT operand decides integer or float arithmetic, so a float
+REM     always goes first: SELF@.T% * 150 + 260, never 260 + 150 * SELF@.T%
+REM   - RETURN at the start of a line ends the DEF body, so every early
+REM     return rides an IF ... THEN, and only the last RETURN starts a line
+
+REM Ease toward the formation slot, with a little entry swirl.
+REM Answers 1 once the slot is reached, else 0.
+DEF GLIDEHOME(DT%)
+  DX% = SELF@.HOMEX% - ACTOR@.X%
+  DY% = SELF@.HOMEY% - ACTOR@.Y%
+  K% = DT% * 4.5
+  IF K% > 1 THEN K% = 1
+  ACTOR@.X% = ACTOR@.X% + DX% * K% + SIN(SELF@.T% * 6) * 90 * DT%
+  ACTOR@.Y% = ACTOR@.Y% + DY% * K%
+  IF ABS(DX%) < 3 AND ABS(DY%) < 3 THEN RETURN 1
+  RETURN 0
+
+REM One frame of a dive: accelerate downward, weave, lean toward the
+REM player's column, and glide back in from the top after falling out.
+DEF DIVESTEP(DT%, WEAVE%, LEAD%)
+  SPD% = SELF@.T% * 150 + 260
+  ACTOR@.Y% = ACTOR@.Y% + SPD% * DT%
+  ACTOR@.X% = ACTOR@.X% + SIN(SELF@.T% * 4) * WEAVE% * DT%
+  DX% = GAME@.PLAYERX% - ACTOR@.X%
+  IF DX% > 220 THEN DX% = 220
+  IF DX% < -220 THEN DX% = -220
+  ACTOR@.X% = ACTOR@.X% + DX% * LEAD% * DT%
+  IF ACTOR@.Y% > 1040 THEN BEGIN
+    ACTOR@.Y% = 0.0 - 90
+    SELF@.STATE# = 1
+    SELF@.T% = 0
+  BEND
+  RETURN 0
+
+REM Raise the fire flag when diving roughly above the player. The engine
+REM consumes FIRE# and does the spawning; the script only wishes.
+DEF DECIDEFIRE(DT%)
+  DX% = GAME@.PLAYERX% - ACTOR@.X%
+  IF ABS(DX%) > 140 THEN RETURN 0
+  IF ACTOR@.Y% > GAME@.PLAYERY% THEN RETURN 0
+  IF SELF@.RND% < DT% * 1.5 THEN SELF@.FIRE# = 1
+  RETURN 0
+
+REM Bee: enter, breathe in formation, occasionally dive nearly straight.
+DEF UPDATEBEE(DT%)
+  SELF@.T% = SELF@.T% + DT%
+  IF SELF@.T% < 0 THEN RETURN 0
+  S# = SELF@.STATE#
+  IF (S# AND 1) > 0 THEN BEGIN
+    R# = GLIDEHOME(DT%)
+    IF R# = 1 THEN SELF@.STATE# = 2 : SELF@.T% = 0
+  BEND
+  IF (S# AND 2) > 0 THEN BEGIN
+    ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 1.7) * 16
+    ACTOR@.Y% = SELF@.HOMEY%
+    IF SELF@.RND% < DT% * 0.04 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+  BEND
+  IF (S# AND 4) > 0 THEN BEGIN
+    R# = DIVESTEP(DT%, 130, 0.2)
+    R# = DECIDEFIRE(DT%)
+  BEND
+  RETURN 0
+
+REM Butterfly: the same machine with a wide lateral weave on the dive.
+DEF UPDATEBFLY(DT%)
+  SELF@.T% = SELF@.T% + DT%
+  IF SELF@.T% < 0 THEN RETURN 0
+  S# = SELF@.STATE#
+  IF (S# AND 1) > 0 THEN BEGIN
+    R# = GLIDEHOME(DT%)
+    IF R# = 1 THEN SELF@.STATE# = 2 : SELF@.T% = 0
+  BEND
+  IF (S# AND 2) > 0 THEN BEGIN
+    ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 2.1) * 24
+    ACTOR@.Y% = SELF@.HOMEY%
+    IF SELF@.RND% < DT% * 0.05 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+  BEND
+  IF (S# AND 4) > 0 THEN BEGIN
+    R# = DIVESTEP(DT%, 260, 0.1)
+    R# = DECIDEFIRE(DT%)
+  BEND
+  RETURN 0
+
+REM Boss: two hit points, a slow sway, and a dive that leads the player.
+REM At one hit point it raises actor state bit 13 (8192), and the engine's
+REM character mapping swaps the sprite - the boundary crossed the other way.
+DEF UPDATEBOSS(DT%)
+  SELF@.T% = SELF@.T% + DT%
+  IF SELF@.T% < 0 THEN RETURN 0
+  IF SELF@.HP# = 1 THEN ACTOR@.STATE# = ACTOR@.STATE# OR 8192
+  S# = SELF@.STATE#
+  IF (S# AND 1) > 0 THEN BEGIN
+    R# = GLIDEHOME(DT%)
+    IF R# = 1 THEN SELF@.STATE# = 2 : SELF@.T% = 0
+  BEND
+  IF (S# AND 2) > 0 THEN BEGIN
+    ACTOR@.X% = SELF@.HOMEX% + SIN(SELF@.T% * 1.1) * 10
+    ACTOR@.Y% = SELF@.HOMEY%
+    IF SELF@.RND% < DT% * 0.03 THEN SELF@.STATE# = 4 : SELF@.T% = 0
+  BEND
+  IF (S# AND 4) > 0 THEN BEGIN
+    R# = DIVESTEP(DT%, 60, 0.9)
+    R# = DECIDEFIRE(DT%)
+  BEND
+  RETURN 0
+
+END

examples/galaga/galaga.h

@@ -0,0 +1,155 @@
+/**
+ * @file galaga.h
+ * @brief Shared declarations for the GALAGA embedding example.
+ *
+ * The engine is C on libakgl; the enemies think in BASIC. Everything the two
+ * sides share crosses in exactly one place: the three structures below, which
+ * script.c registers as host types so a script reads and writes them directly.
+ * docs/20-tutorial-galaga.md and docs/21-tutorial-galaga-enemies.md build this
+ * program from an empty file; the split between files follows the split
+ * between chapters.
+ */
+
+#ifndef _GALAGA_H_
+#define _GALAGA_H_
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include <akerror.h>
+
+#include <akgl/actor.h>
+
+/* ------------------------------------------------------------- geometry --- */
+
+/*
+ * The view is sized to the artwork rather than the other way round: the Kenney
+ * sprites are ~100 pixels wide, libakgl has no way to draw a sprite smaller
+ * than it is (akgl_Actor.scale is overwritten every frame -- libakgl
+ * docs/12-actors.md), and a ten-column formation of them needs 1120 pixels.
+ */
+#define GALAGA_VIEW_WIDTH	1280
+#define GALAGA_VIEW_HEIGHT	960
+
+#define GALAGA_FORM_COLUMNS	10	/* formation width, in slots	*/
+#define GALAGA_FORM_LEFT	136	/* x of column 0, map pixels	*/
+#define GALAGA_FORM_TOP		120	/* y of row 0, map pixels	*/
+#define GALAGA_COL_PITCH	112
+#define GALAGA_ROW_PITCH	100
+
+#define GALAGA_PLAYER_Y		860.0f
+#define GALAGA_PLAYER_SPEED	420.0f	/* map pixels per second	*/
+#define GALAGA_PLAYER_MARGIN	60.0f	/* how close to the edge it may go */
+
+/* ------------------------------------------------------------- entities --- */
+
+#define GALAGA_ENEMY_BEE	0
+#define GALAGA_ENEMY_BUTTERFLY	1
+#define GALAGA_ENEMY_BOSS	2
+#define GALAGA_ENEMY_KINDS	3
+
+#define GALAGA_MAX_ENEMIES	40
+#define GALAGA_MAX_PLAYER_SHOTS	2	/* the classic two-on-screen rule */
+#define GALAGA_MAX_ENEMY_SHOTS	8
+
+/*
+ * galaga_Enemy.state bits. The script owns these transitions; the engine only
+ * writes the word at spawn and when a script error forces an enemy dumb.
+ * galaga.bas spells the same three values as literals, with a REM naming them.
+ *
+ * 8             0
+ * 0 0 0 0 0 1 1 1
+ *           | | `-- ENTERING: flying its entry path toward the formation slot
+ *           | `---- FORMATION: holding (and breathing around) homex/homey
+ *           `------ DIVING: attacking, off the grid until it leaves the screen
+ */
+#define GALAGA_ES_ENTERING	(1 << 0)
+#define GALAGA_ES_FORMATION	(1 << 1)
+#define GALAGA_ES_DIVING	(1 << 2)
+
+/** @brief One enemy, as both sides see it. Hangs off akgl_Actor.actorData. */
+typedef struct galaga_Enemy
+{
+    int32_t  kind;	/* GALAGA_ENEMY_BEE / BUTTERFLY / BOSS		*/
+    int32_t  state;	/* GALAGA_ES_* bit flags			*/
+    float    homex;	/* formation slot, in map pixels		*/
+    float    homey;
+    float    t;		/* parametric clock for the current maneuver	*/
+    int32_t  hp;
+    int32_t  fire;	/* outbox: script sets 1, engine consumes	*/
+    float    rnd;	/* inbox: engine writes fresh 0..1 each call	*/
+} galaga_Enemy;
+
+/** @brief Frame state every enemy may read. Bound once as GAME@. */
+typedef struct galaga_Shared
+{
+    float    playerx;	/* the player actor's position, this frame	*/
+    float    playery;
+    int32_t  wave;
+    float    rnd;	/* fresh 0..1 each frame; the issue #16 route	*/
+} galaga_Shared;
+
+/* --------------------------------------------------------------- screens --- */
+
+typedef enum
+{
+    GALAGA_SCREEN_TITLE = 0,
+    GALAGA_SCREEN_PLAY,
+    GALAGA_SCREEN_GAMEOVER,
+    GALAGA_SCREEN_VICTORY
+} galaga_Screen;
+
+/* ------------------------------------------------------------ game state --- */
+
+typedef struct galaga_Game
+{
+    galaga_Screen screen;
+    int      frame;
+    float    dt;		/* seconds, clamped; see main.c		*/
+    bool     autoplay;
+
+    int      score;
+    int      lives;
+    int      kills[GALAGA_ENEMY_KINDS];
+    int      shots[GALAGA_ENEMY_KINDS];	/* shots each kind fired	*/
+    int      script_errors;
+
+    akgl_Actor *player;
+    float    fire_cooldown;
+    float    respawn_timer;	/* > 0 while the player is invulnerable	*/
+    bool     firing;
+    bool     moveleft;
+    bool     moveright;
+
+    int      player_shots_live;
+    int      enemy_shots_live;
+} galaga_Game;
+
+extern galaga_Game galaga_game;
+extern galaga_Shared galaga_shared;
+
+extern galaga_Enemy galaga_enemies[GALAGA_MAX_ENEMIES];
+extern akgl_Actor *galaga_enemy_actors[GALAGA_MAX_ENEMIES];
+
+/* ---------------------------------------------------------------- script --- */
+
+akerr_ErrorContext AKERR_NOIGNORE *galaga_script_boot(char *path);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_script_update_enemy(galaga_Enemy *enemy, akgl_Actor *actor, float dt);
+
+/* --------------------------------------------------------------- enemies --- */
+
+akerr_ErrorContext AKERR_NOIGNORE *galaga_wave_spawn(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_wave_release(void);
+int galaga_enemies_alive(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_boom_spawn(float x, float y);
+
+/* ---------------------------------------------------------------- player --- */
+
+akerr_ErrorContext AKERR_NOIGNORE *galaga_player_spawn(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_player_controls(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_player_autoplay(int frame);
+
+/** @brief A 0..1 random draw from the engine's own PRNG (see enemies.c). */
+float galaga_random(void);
+
+#endif // _GALAGA_H_

examples/galaga/interop_test.c

@@ -0,0 +1,265 @@
+/**
+ * @file interop_test.c
+ * @brief Round-trip test for the galaga boundary, hoststruct.c-style.
+ *
+ * Links the real script.c and the real galaga.bas -- not copies -- so this
+ * fails the moment the boundary and the script disagree. The four claims it
+ * pins:
+ *
+ *  1. The script writes the engine's actor memory: a formation enemy's sway
+ *     lands in akgl_Actor.x with no marshalling step.
+ *  2. The outbox works: a diving enemy above the player raises FIRE# and the
+ *     C side reads it.
+ *  3. The boss flips actor state bit 13 at one hit point -- the boundary
+ *     crossed engine-ward.
+ *  4. Sustained calling holds: 24000 calls through the per-call
+ *     akbasic_environment_zero() regime, the load a 40-enemy wave puts on
+ *     the runtime in ten seconds.
+ *
+ * Exit status equals the number of failed claims.
+ */
+
+#include <math.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+
+#include <akerror.h>
+
+#include <akgl/actor.h>
+
+#include "galaga.h"
+
+#ifndef GALAGA_SCRIPT_PATH
+#define GALAGA_SCRIPT_PATH "galaga.bas"
+#endif
+
+/* script.c reads these; main.c usually defines them. This test is the host. */
+galaga_Game galaga_game;
+galaga_Shared galaga_shared;
+
+static int FAILURES = 0;
+
+#define CLAIM(__cond, __text)						\
+    if ( !(__cond) ) {							\
+	fprintf(stderr, "FAILED: %s\n", __text);			\
+	FAILURES += 1;							\
+    } else {								\
+	printf("ok: %s\n", __text);					\
+    }
+
+static akerr_ErrorContext *run_claims(void)
+{
+    galaga_Enemy enemy;
+    akgl_Actor actor;
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, galaga_script_boot((char *)GALAGA_SCRIPT_PATH));
+
+    /* --- 1: formation sway lands in the actor ---------------------------- */
+    memset(&enemy, 0, sizeof(enemy));
+    memset(&actor, 0, sizeof(actor));
+    enemy.kind = GALAGA_ENEMY_BEE;
+    enemy.state = GALAGA_ES_FORMATION;
+    enemy.homex = 400.0f;
+    enemy.homey = 300.0f;
+    enemy.hp = 1;
+    actor.x = 0.0f;
+    actor.y = 0.0f;
+    PASS(errctx, galaga_script_update_enemy(&enemy, &actor, 0.016f));
+    CLAIM((fabsf(actor.x - enemy.homex) <= 16.5f) && (actor.y == enemy.homey),
+	  "a formation bee's sway is written into akgl_Actor.x/y by the script");
+
+    /* --- 2: the fire outbox ---------------------------------------------- */
+    memset(&enemy, 0, sizeof(enemy));
+    memset(&actor, 0, sizeof(actor));
+    enemy.kind = GALAGA_ENEMY_BEE;
+    enemy.state = GALAGA_ES_DIVING;
+    enemy.rnd = 0.0f;			/* 0.0 < DT% * 1.5: always willing */
+    actor.x = 600.0f;
+    actor.y = 200.0f;
+    galaga_shared.playerx = 610.0f;	/* just off the shot's column      */
+    galaga_shared.playery = 860.0f;	/* well below                      */
+    PASS(errctx, galaga_script_update_enemy(&enemy, &actor, 0.016f));
+    CLAIM(enemy.fire == 1,
+	  "a diving bee above the player raises FIRE# for the engine to consume");
+
+    /* --- 3: the boss's hurt bit ------------------------------------------ */
+    memset(&enemy, 0, sizeof(enemy));
+    memset(&actor, 0, sizeof(actor));
+    enemy.kind = GALAGA_ENEMY_BOSS;
+    enemy.state = GALAGA_ES_FORMATION;
+    enemy.homex = 500.0f;
+    enemy.homey = 120.0f;
+    enemy.hp = 1;
+    actor.state = AKGL_ACTOR_STATE_ALIVE;
+    PASS(errctx, galaga_script_update_enemy(&enemy, &actor, 0.016f));
+    CLAIM((actor.state & AKGL_ACTOR_STATE_UNDEFINED_13) != 0,
+	  "a boss at one hit point raises actor state bit 13 from BASIC");
+
+    /* --- 4: sustained calling --------------------------------------------- */
+    memset(&enemy, 0, sizeof(enemy));
+    memset(&actor, 0, sizeof(actor));
+    enemy.kind = GALAGA_ENEMY_BEE;
+    enemy.state = GALAGA_ES_FORMATION;
+    enemy.homex = 400.0f;
+    enemy.homey = 300.0f;
+    for ( i = 0; i < 24000; i++ ) {
+	enemy.rnd = 0.9f;		/* never dive: keep the state put */
+	PASS(errctx, galaga_script_update_enemy(&enemy, &actor, 0.016f));
+    }
+    CLAIM(galaga_game.script_errors == 0,
+	  "24000 calls survive the per-call akbasic_environment_zero() regime");
+    SUCCEED_RETURN(errctx);
+}
+
+/* ------------------------------------------------------------ benchmark --- */
+
+/**
+ * @brief UPDATEBEE's state machine, translated line for line into C.
+ *
+ * The native comparator for the benchmark below: the same guard, the same
+ * three branches, the same arithmetic as galaga.bas's UPDATEBEE with its
+ * helpers inlined. Nothing is simplified, so the timing difference is the
+ * interpreter's, not the algorithm's.
+ */
+static void native_updatebee(galaga_Enemy *enemy, akgl_Actor *actor, float dt)
+{
+    float dx = 0.0f;
+    float dy = 0.0f;
+    float k = 0.0f;
+    int32_t s = 0;
+
+    enemy->t += dt;
+    if ( enemy->t < 0.0f ) {
+	return;
+    }
+    s = enemy->state;
+    if ( (s & GALAGA_ES_ENTERING) != 0 ) {
+	dx = enemy->homex - actor->x;
+	dy = enemy->homey - actor->y;
+	k = dt * 4.5f;
+	if ( k > 1.0f ) {
+	    k = 1.0f;
+	}
+	actor->x += dx * k + sinf(enemy->t * 6.0f) * 90.0f * dt;
+	actor->y += dy * k;
+	if ( fabsf(dx) < 3.0f && fabsf(dy) < 3.0f ) {
+	    enemy->state = GALAGA_ES_FORMATION;
+	    enemy->t = 0.0f;
+	}
+    }
+    if ( (s & GALAGA_ES_FORMATION) != 0 ) {
+	actor->x = enemy->homex + sinf(enemy->t * 1.7f) * 16.0f;
+	actor->y = enemy->homey;
+	if ( enemy->rnd < dt * 0.04f ) {
+	    enemy->state = GALAGA_ES_DIVING;
+	    enemy->t = 0.0f;
+	}
+    }
+    if ( (s & GALAGA_ES_DIVING) != 0 ) {
+	actor->y += (enemy->t * 150.0f + 260.0f) * dt;
+	actor->x += sinf(enemy->t * 4.0f) * 130.0f * dt;
+	dx = galaga_shared.playerx - actor->x;
+	if ( dx > 220.0f ) {
+	    dx = 220.0f;
+	}
+	if ( dx < -220.0f ) {
+	    dx = -220.0f;
+	}
+	actor->x += dx * 0.2f * dt;
+	if ( actor->y > 1040.0f ) {
+	    actor->y = -90.0f;
+	    enemy->state = GALAGA_ES_ENTERING;
+	    enemy->t = 0.0f;
+	}
+	dx = galaga_shared.playerx - actor->x;
+	if ( fabsf(dx) <= 140.0f && actor->y <= galaga_shared.playery
+	     && enemy->rnd < dt * 1.5f ) {
+	    enemy->fire = 1;
+	}
+    }
+}
+
+static double seconds_since(const struct timespec *t0)
+{
+    struct timespec t1;
+
+    clock_gettime(CLOCK_MONOTONIC, &t1);
+    return (double)(t1.tv_sec - t0->tv_sec) + (double)(t1.tv_nsec - t0->tv_nsec) / 1e9;
+}
+
+/**
+ * @brief The cost of thinking in BASIC, measured against the same logic in C.
+ *
+ * Both loops run the identical formation-hold workload, 24,000 calls -- forty
+ * enemies at sixty frames a second for ten seconds. Informational: nothing
+ * asserts on the timing, because CI machines vary; the numbers print so the
+ * tutorial can quote a real measurement.
+ */
+static akerr_ErrorContext *run_benchmark(void)
+{
+    galaga_Enemy enemy;
+    akgl_Actor actor;
+    struct timespec t0;
+    double basic_s = 0.0;
+    double native_s = 0.0;
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    memset(&enemy, 0, sizeof(enemy));
+    memset(&actor, 0, sizeof(actor));
+    enemy.kind = GALAGA_ENEMY_BEE;
+    enemy.state = GALAGA_ES_FORMATION;
+    enemy.homex = 400.0f;
+    enemy.homey = 300.0f;
+    enemy.rnd = 0.9f;
+
+    clock_gettime(CLOCK_MONOTONIC, &t0);
+    for ( i = 0; i < 24000; i++ ) {
+	PASS(errctx, galaga_script_update_enemy(&enemy, &actor, 0.016f));
+    }
+    basic_s = seconds_since(&t0);
+
+    memset(&enemy, 0, sizeof(enemy));
+    memset(&actor, 0, sizeof(actor));
+    enemy.kind = GALAGA_ENEMY_BEE;
+    enemy.state = GALAGA_ES_FORMATION;
+    enemy.homex = 400.0f;
+    enemy.homey = 300.0f;
+    enemy.rnd = 0.9f;
+
+    clock_gettime(CLOCK_MONOTONIC, &t0);
+    for ( i = 0; i < 24000; i++ ) {
+	native_updatebee(&enemy, &actor, 0.016f);
+    }
+    native_s = seconds_since(&t0);
+
+    printf("benchmark: 24000 formation-hold updates, dt 0.016\n");
+    printf("  BASIC through the boundary: %8.3f s  %7.2f us/call  %6.3f ms per 40-enemy frame\n",
+	   basic_s, basic_s / 24000.0 * 1e6, basic_s / 24000.0 * 40.0 * 1e3);
+    printf("  the same logic in C:        %8.3f s  %7.2f us/call  %6.3f ms per 40-enemy frame\n",
+	   native_s, native_s / 24000.0 * 1e6, native_s / 24000.0 * 40.0 * 1e3);
+    printf("  ratio: %.0fx\n", basic_s / native_s);
+    SUCCEED_RETURN(errctx);
+}
+
+int main(void)
+{
+    PREPARE_ERROR(errctx);
+
+    ATTEMPT {
+	CATCH(errctx, run_claims());
+	CATCH(errctx, run_benchmark());
+    } CLEANUP {
+    } PROCESS(errctx) {
+    } HANDLE_DEFAULT(errctx) {
+	LOG_ERROR_WITH_MESSAGE(errctx, "the interop test could not run");
+	FAILURES += 1;
+    } FINISH_NORETURN(errctx);
+
+    return FAILURES;
+}

examples/galaga/main.c

@@ -0,0 +1,698 @@
+/**
+ * @file main.c
+ * @brief Startup, the frame loop, the screens, and teardown.
+ *
+ * The startup order is libakgl's one sequence that works (deps/libakgl
+ * include/akgl/game.h): metadata, akgl_game_init(), screen properties,
+ * akgl_render_2d_init(), a physics backend -- and then, new in this example,
+ * the interpreter. The scripts compute, the engine draws; the interpreter is
+ * lent no devices at all, so a script that tries SPRITE is refused by name.
+ */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+#include <SDL3_image/SDL_image.h>
+#include <SDL3_ttf/SDL_ttf.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/character.h>
+#include <akgl/controller.h>
+#include <akgl/draw.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+#include <akgl/physics.h>
+#include <akgl/registry.h>
+#include <akgl/renderer.h>
+#include <akgl/sprite.h>
+#include <akgl/text.h>
+#include <akgl/ui.h>
+
+#include "galaga.h"
+
+/** @brief Where the example's assets live. CMake defines it; `--assets` overrides. */
+#ifndef GALAGA_ASSET_DIR
+#define GALAGA_ASSET_DIR "."
+#endif
+
+/** @brief The enemy script. CMake defines it; `--script` overrides. */
+#ifndef GALAGA_SCRIPT_PATH
+#define GALAGA_SCRIPT_PATH "galaga.bas"
+#endif
+
+/** @brief The HUD font. CMake defines it; headless runs still need it for the UI. */
+#ifndef GALAGA_FONT_PATH
+#define GALAGA_FONT_PATH "font.ttf"
+#endif
+
+#define GALAGA_PATH_MAX 1024
+
+galaga_Game galaga_game;
+galaga_Shared galaga_shared;
+
+/** @brief Where `--screenshot` writes, and on which frame. NULL means never. */
+static char *SHOTPATH = NULL;
+static int SHOTFRAME = 0;
+
+/** @brief Set in HANDLE_DEFAULT and read after FINISH; see the note in main. */
+static int FAILED = 0;
+
+/* ------------------------------------------------------------- starfield --- */
+
+/*
+ * No parallax facility exists in libakgl and none is needed: a fixed array of
+ * stars advanced per frame and drawn with akgl_draw_point() between
+ * frame_start and akgl_game_update(). Two speed bands give the depth for
+ * free -- the slow band reads as far away.
+ */
+#define GALAGA_STARS 96
+
+static struct
+{
+    float x;
+    float y;
+    float speed;
+    Uint8 bright;
+} STARS[GALAGA_STARS];
+
+static void starfield_seed(void)
+{
+    int i = 0;
+
+    for ( i = 0; i < GALAGA_STARS; i++ ) {
+	STARS[i].x = galaga_random() * (float)GALAGA_VIEW_WIDTH;
+	STARS[i].y = galaga_random() * (float)GALAGA_VIEW_HEIGHT;
+	if ( (i % 2) == 0 ) {
+	    STARS[i].speed = 40.0f;		/* the far band  */
+	    STARS[i].bright = 110;
+	} else {
+	    STARS[i].speed = 110.0f;		/* the near band */
+	    STARS[i].bright = 220;
+	}
+    }
+}
+
+static akerr_ErrorContext *starfield_draw(void)
+{
+    SDL_Color color = { 255, 255, 255, 255 };
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    for ( i = 0; i < GALAGA_STARS; i++ ) {
+	STARS[i].y += STARS[i].speed * galaga_game.dt;
+	if ( STARS[i].y > (float)GALAGA_VIEW_HEIGHT ) {
+	    STARS[i].y -= (float)GALAGA_VIEW_HEIGHT;
+	    STARS[i].x = galaga_random() * (float)GALAGA_VIEW_WIDTH;
+	}
+	color.r = STARS[i].bright;
+	color.g = STARS[i].bright;
+	color.b = STARS[i].bright;
+	PASS(errctx, akgl_draw_point(akgl_renderer, STARS[i].x, STARS[i].y, color));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/* ------------------------------------------------------------ screenshots --- */
+
+/**
+ * @brief Read the render target back and write it out as a PNG.
+ *
+ * Called after everything has drawn and before the frame is presented,
+ * because SDL_RenderPresent is where the target stops being readable. The
+ * figures in docs/20 and docs/21 are output from this program rather than
+ * pictures somebody took once, so they cannot show a game that no longer
+ * exists.
+ */
+static akerr_ErrorContext *save_screenshot(char *path)
+{
+    SDL_Surface *shot = NULL;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, path, AKERR_NULLPOINTER, "path");
+    shot = SDL_RenderReadPixels(akgl_renderer->sdl_renderer, NULL);
+    FAIL_ZERO_RETURN(errctx, shot, AKGL_ERR_SDL, "SDL_RenderReadPixels: %s", SDL_GetError());
+    ATTEMPT {
+	FAIL_ZERO_BREAK(errctx, IMG_SavePNG(shot, path), AKGL_ERR_SDL,
+			"IMG_SavePNG(%s): %s", path, SDL_GetError());
+    } CLEANUP {
+	SDL_DestroySurface(shot);
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    SDL_Log("Wrote %s", path);
+    SUCCEED_RETURN(errctx);
+}
+
+/* ---------------------------------------------------------------- assets --- */
+
+static char *SPRITE_FILES[] = {
+    "sprite_galaga_player.json",
+    "sprite_galaga_bee.json",
+    "sprite_galaga_butterfly.json",
+    "sprite_galaga_boss.json",
+    "sprite_galaga_boss_hurt.json",
+    "sprite_galaga_playershot.json",
+    "sprite_galaga_enemyshot.json",
+    "sprite_galaga_boom.json",
+    NULL
+};
+
+static char *CHARACTER_FILES[] = {
+    "character_galaga_player.json",
+    "character_galaga_bee.json",
+    "character_galaga_butterfly.json",
+    "character_galaga_boss.json",
+    "character_galaga_playershot.json",
+    "character_galaga_enemyshot.json",
+    "character_galaga_boom.json",
+    NULL
+};
+
+static akerr_ErrorContext *asset_path(char *dir, char *name, char *dest, size_t size)
+{
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, dir, AKERR_NULLPOINTER, "dir");
+    FAIL_ZERO_RETURN(errctx, name, AKERR_NULLPOINTER, "name");
+    FAIL_ZERO_RETURN(errctx, dest, AKERR_NULLPOINTER, "dest");
+    PASS(errctx, aksl_snprintf(&count, dest, size, "%s/%s", dir, name));
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief Sprites first, characters second. Not a preference: a character's
+ * JSON names its sprites by registry name, so a character loaded first fails
+ * on the first sprite it cannot find.
+ */
+static akerr_ErrorContext *load_assets(char *assetdir)
+{
+    char path[GALAGA_PATH_MAX];
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, assetdir, AKERR_NULLPOINTER, "assetdir");
+    for ( i = 0; SPRITE_FILES[i] != NULL; i++ ) {
+	PASS(errctx, asset_path(assetdir, SPRITE_FILES[i], (char *)&path, sizeof(path)));
+	PASS(errctx, akgl_sprite_load_json((char *)&path));
+    }
+    for ( i = 0; CHARACTER_FILES[i] != NULL; i++ ) {
+	PASS(errctx, asset_path(assetdir, CHARACTER_FILES[i], (char *)&path, sizeof(path)));
+	PASS(errctx, akgl_character_load_json((char *)&path));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/* --------------------------------------------------------------- startup --- */
+
+/** @brief Replacement for akgl_game.lowfpsfunc, which logs a line per frame. */
+static void galaga_lowfps(void)
+{
+}
+
+static akerr_ErrorContext *startup(void)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, aksl_strncpy((char *)&akgl_game.name, sizeof(akgl_game.name),
+			      "akbasic galaga tutorial", sizeof(akgl_game.name) - 1));
+    PASS(errctx, aksl_strncpy((char *)&akgl_game.version, sizeof(akgl_game.version),
+			      "1.0.0", sizeof(akgl_game.version) - 1));
+    PASS(errctx, aksl_strncpy((char *)&akgl_game.uri, sizeof(akgl_game.uri),
+			      "net.aklabs.akbasic.galaga", sizeof(akgl_game.uri) - 1));
+
+    PASS(errctx, akgl_game_init());
+    akgl_game.lowfpsfunc = &galaga_lowfps;
+
+    /* Properties before the renderer: akgl_render_2d_init reads both, and an
+     * unset one defaults to the string "0" -- a zero-sized window. */
+    PASS(errctx, akgl_set_property("game.screenwidth", "1280"));
+    PASS(errctx, akgl_set_property("game.screenheight", "960"));
+    PASS(errctx, akgl_render_2d_init(akgl_renderer));
+
+    FAIL_ZERO_RETURN(
+	errctx,
+	SDL_SetRenderLogicalPresentation(
+	    akgl_renderer->sdl_renderer,
+	    GALAGA_VIEW_WIDTH,
+	    GALAGA_VIEW_HEIGHT,
+	    SDL_LOGICAL_PRESENTATION_INTEGER_SCALE),
+	AKGL_ERR_SDL,
+	"%s",
+	SDL_GetError()
+	);
+
+    /* The view is what the camera looks through, so it says the same thing. */
+    akgl_camera->x = 0.0f;
+    akgl_camera->y = 0.0f;
+    akgl_camera->w = (float)GALAGA_VIEW_WIDTH;
+    akgl_camera->h = (float)GALAGA_VIEW_HEIGHT;
+
+    /*
+     * akgl_game_init does NOT install a physics backend, whatever physics.h's
+     * file comment says (libakgl docs/14-physics.md). Null physics accepts
+     * every call and moves nothing: whatever writes x and y directly is the
+     * mover, and in this game that is BASIC writing through ACTOR@.
+     */
+    PASS(errctx, akgl_physics_init_null(akgl_physics));
+    SUCCEED_RETURN(errctx);
+}
+
+/* ---------------------------------------------------------------- the UI --- */
+
+static akgl_UiMenu TITLE_MENU = {
+    "titlemenu", { "START", "QUIT" }, 2, 0, false, NULL
+};
+static akgl_UiMenu AGAIN_MENU = {
+    "againmenu", { "PLAY AGAIN", "QUIT" }, 2, 0, false, NULL
+};
+
+/* Clay borrows label text until frame_end, so these cannot be locals. */
+static char HUD_SCORE[64];
+static char HUD_LIVES[64];
+
+/**
+ * @brief Draw a headline centred above the menu, in the banner font.
+ *
+ * Direct text rather than a ui label: the menu owns AKGL_UI_ANCHOR_CENTER,
+ * and a label anchored there disappears behind it -- there is no
+ * top-centre anchor to reach for. Drawn before the UI bracket, so the menu
+ * still paints over it if the two ever meet.
+ */
+static akerr_ErrorContext *draw_banner(char *text)
+{
+    SDL_Color ink = { 235, 235, 235, 255 };
+    TTF_Font *font = NULL;
+    int w = 0;
+    int h = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, text, AKERR_NULLPOINTER, "text");
+    font = SDL_GetPointerProperty(AKGL_REGISTRY_FONT, "banner", NULL);
+    FAIL_ZERO_RETURN(errctx, font, AKERR_KEY, "the banner font is not loaded");
+    PASS(errctx, akgl_text_measure(font, text, &w, &h));
+    PASS(errctx, akgl_text_rendertextat(font, text, ink, 0,
+					(GALAGA_VIEW_WIDTH - w) / 2, 280));
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *declare_title(void)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, akgl_ui_menu(&TITLE_MENU));
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *declare_play(void)
+{
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, aksl_snprintf(&count, HUD_SCORE, sizeof(HUD_SCORE),
+			       "SCORE %06d", galaga_game.score));
+    PASS(errctx, aksl_snprintf(&count, HUD_LIVES, sizeof(HUD_LIVES),
+			       "LIVES %d   WAVE %d", galaga_game.lives, galaga_shared.wave));
+    PASS(errctx, akgl_ui_label("score", HUD_SCORE, AKGL_UI_ANCHOR_TOP_LEFT, NULL));
+    PASS(errctx, akgl_ui_label("lives", HUD_LIVES, AKGL_UI_ANCHOR_TOP_RIGHT, NULL));
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *declare_end(void)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, akgl_ui_menu(&AGAIN_MENU));
+    SUCCEED_RETURN(errctx);
+}
+
+/* ------------------------------------------------------------ transitions --- */
+
+static akerr_ErrorContext *start_game(void)
+{
+    PREPARE_ERROR(errctx);
+
+    galaga_game.score = 0;
+    galaga_game.lives = 3;
+    memset(galaga_game.kills, 0, sizeof(galaga_game.kills));
+    memset(galaga_game.shots, 0, sizeof(galaga_game.shots));
+    galaga_game.respawn_timer = 0.0f;
+    galaga_shared.wave = 1;
+
+    galaga_game.player->x = (float)GALAGA_VIEW_WIDTH / 2.0f - 50.0f;
+    PASS(errctx, galaga_wave_spawn());
+    galaga_game.screen = GALAGA_SCREEN_PLAY;
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief End-of-round bookkeeping: notice a cleared wave or a spent ship.
+ */
+static akerr_ErrorContext *check_transitions(bool *running)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, running, AKERR_NULLPOINTER, "running");
+    (void)running;
+    if ( galaga_game.screen != GALAGA_SCREEN_PLAY ) {
+	SUCCEED_RETURN(errctx);
+    }
+    if ( galaga_game.lives <= 0 ) {
+	PASS(errctx, galaga_wave_release());
+	galaga_game.screen = GALAGA_SCREEN_GAMEOVER;
+	SUCCEED_RETURN(errctx);
+    }
+    if ( galaga_enemies_alive() == 0 ) {
+	galaga_game.screen = GALAGA_SCREEN_VICTORY;
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief Consume a menu activation. The menu never clears `activated`; the
+ * state machine that acts on it does.
+ */
+static akerr_ErrorContext *consume_menus(bool *running)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, running, AKERR_NULLPOINTER, "running");
+    if ( galaga_game.screen == GALAGA_SCREEN_TITLE && TITLE_MENU.activated ) {
+	TITLE_MENU.activated = false;
+	if ( TITLE_MENU.selected == 0 ) {
+	    PASS(errctx, start_game());
+	} else {
+	    *running = false;
+	}
+    }
+    if ( (galaga_game.screen == GALAGA_SCREEN_GAMEOVER
+	  || galaga_game.screen == GALAGA_SCREEN_VICTORY)
+	 && AGAIN_MENU.activated ) {
+	AGAIN_MENU.activated = false;
+	if ( AGAIN_MENU.selected == 0 ) {
+	    PASS(errctx, galaga_wave_release());
+	    PASS(errctx, start_game());
+	} else {
+	    *running = false;
+	}
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/* ------------------------------------------------------------- the frame --- */
+
+/**
+ * @brief Route one event: the UI gets first refusal, then the menus, then
+ * the controller. A consumed event goes no further.
+ */
+static akerr_ErrorContext *route_event(SDL_Event *event, bool *running)
+{
+    bool consumed = false;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, event, AKERR_NULLPOINTER, "event");
+    FAIL_ZERO_RETURN(errctx, running, AKERR_NULLPOINTER, "running");
+
+    if ( event->type == SDL_EVENT_QUIT ) {
+	*running = false;
+	SUCCEED_RETURN(errctx);
+    }
+    PASS(errctx, akgl_ui_handle_event((void *)&akgl_game.state, event, &consumed));
+    if ( consumed ) {
+	SUCCEED_RETURN(errctx);
+    }
+    if ( galaga_game.screen == GALAGA_SCREEN_TITLE ) {
+	PASS(errctx, akgl_ui_menu_handle_event(&TITLE_MENU, event, &consumed));
+    } else if ( galaga_game.screen == GALAGA_SCREEN_GAMEOVER
+		|| galaga_game.screen == GALAGA_SCREEN_VICTORY ) {
+	PASS(errctx, akgl_ui_menu_handle_event(&AGAIN_MENU, event, &consumed));
+    }
+    if ( consumed ) {
+	SUCCEED_RETURN(errctx);
+    }
+    /* Every event, unconditionally: one that no control map binds is not an
+     * error, it is a call that did nothing. */
+    PASS(errctx, akgl_controller_handle_event((void *)&akgl_game.state, event));
+    SUCCEED_RETURN(errctx);
+}
+
+/** @brief The previous frame's timestamp, for dt. Stamped once at loop start. */
+static uint64_t LAST_NS = 0;
+
+static akerr_ErrorContext *frame(bool *running)
+{
+    SDL_Event event;
+    uint64_t now = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, running, AKERR_NULLPOINTER, "running");
+
+    while ( SDL_PollEvent(&event) == true ) {
+	PASS(errctx, route_event(&event, running));
+    }
+
+    galaga_game.frame += 1;
+    if ( galaga_game.autoplay ) {
+	if ( galaga_game.screen == GALAGA_SCREEN_TITLE && galaga_game.frame >= 8 ) {
+	    PASS(errctx, start_game());
+	}
+	/*
+	 * On an end screen the pilot presses Return, which drives the real
+	 * menu path -- declare, handle, activate, restart -- so a headless
+	 * run that dies keeps exercising the game instead of idling.
+	 */
+	if ( galaga_game.screen == GALAGA_SCREEN_GAMEOVER
+	     || galaga_game.screen == GALAGA_SCREEN_VICTORY ) {
+	    if ( (galaga_game.frame % 30) == 0 ) {
+		SDL_Event press;
+		memset(&press, 0, sizeof(press));
+		press.type = SDL_EVENT_KEY_DOWN;
+		press.key.key = SDLK_RETURN;
+		PASS(errctx, route_event(&press, running));
+	    }
+	}
+	PASS(errctx, galaga_player_autoplay(galaga_game.frame));
+    }
+
+    /*
+     * dt from the wall clock, clamped: a debugger pause or a stalled runner
+     * must not become one frame of teleporting enemies. The clamp is a 30 Hz
+     * frame, the slowest game this is still worth playing at.
+     */
+    now = SDL_GetTicksNS();
+    galaga_game.dt = (float)(now - LAST_NS) / 1e9f;
+    LAST_NS = now;
+    if ( galaga_game.dt > (1.0f / 30.0f) ) {
+	galaga_game.dt = 1.0f / 30.0f;
+    }
+
+    /* The shared frame state, refreshed before any enemy thinks. The engine
+     * filling GAME@.RND% is the issue #16 route: no RND verb exists. */
+    galaga_shared.playerx = galaga_game.player->x + 50.0f;
+    galaga_shared.playery = galaga_game.player->y;
+    galaga_shared.rnd = galaga_random();
+
+    PASS(errctx, akgl_renderer->frame_start(akgl_renderer));
+    PASS(errctx, starfield_draw());
+
+    /*
+     * akgl_game_update is update-every-actor, step-the-physics, draw-the-
+     * world. Updating every actor is where the forty scripts run: each
+     * enemy's updatefunc is the hook in enemies.c, and that hook is a BASIC
+     * call. Held back on the menu screens so the world stands still there.
+     */
+    if ( galaga_game.screen == GALAGA_SCREEN_PLAY ) {
+	PASS(errctx, akgl_game_update(NULL));
+	PASS(errctx, check_transitions(running));
+    }
+
+    /* The banner is direct text, drawn before the UI bracket. */
+    if ( galaga_game.screen == GALAGA_SCREEN_TITLE ) {
+	PASS(errctx, draw_banner("GALAGA"));
+    } else if ( galaga_game.screen == GALAGA_SCREEN_GAMEOVER ) {
+	PASS(errctx, draw_banner("GAME OVER"));
+    } else if ( galaga_game.screen == GALAGA_SCREEN_VICTORY ) {
+	PASS(errctx, draw_banner("VICTORY"));
+    }
+
+    /* The UI bracket sits between akgl_game_update and frame_end, exactly as
+     * libakgl docs/22-ui.md draws it. */
+    PASS(errctx, akgl_ui_frame_begin());
+    switch ( galaga_game.screen ) {
+    case GALAGA_SCREEN_TITLE:
+	PASS(errctx, declare_title());
+	break;
+    case GALAGA_SCREEN_PLAY:
+	PASS(errctx, declare_play());
+	break;
+    case GALAGA_SCREEN_GAMEOVER:
+    case GALAGA_SCREEN_VICTORY:
+	PASS(errctx, declare_end());
+	break;
+    }
+    PASS(errctx, akgl_ui_frame_end(akgl_renderer));
+
+    PASS(errctx, consume_menus(running));
+
+    if ( (SHOTPATH != NULL) && (galaga_game.frame == SHOTFRAME) ) {
+	PASS(errctx, save_screenshot(SHOTPATH));
+    }
+    PASS(errctx, akgl_renderer->frame_end(akgl_renderer));
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *run(int frames)
+{
+    bool running = true;
+    PREPARE_ERROR(errctx);
+
+    LAST_NS = SDL_GetTicksNS();
+    while ( running == true ) {
+	PASS(errctx, frame(&running));
+	if ( (frames > 0) && (galaga_game.frame >= frames) ) {
+	    running = false;
+	}
+	/* A crude frame limiter. A game on a real display should ask SDL for
+	 * vsync; this one has to work under the dummy video driver, where
+	 * there is nothing to sync to. */
+	SDL_Delay(16);
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/* -------------------------------------------------------------- teardown --- */
+
+/**
+ * @brief Give back what the process is holding.
+ *
+ * There is no akgl_game_shutdown; teardown is the application's. Fonts have
+ * to unload before TTF_Quit destroys them underneath the registry. IGNORE()
+ * on every call: a teardown failure must not mask whatever error is already
+ * being reported.
+ */
+static void shutdown_game(void)
+{
+    int i = 0;
+
+    IGNORE(akgl_ui_shutdown());
+    IGNORE(akgl_text_unloadallfonts());
+    for ( i = 0; i < AKGL_MAX_HEAP_ACTOR; i++ ) {
+	if ( akgl_heap_actors[i].refcount > 0 ) {
+	    IGNORE(akgl_heap_release_actor(&akgl_heap_actors[i]));
+	}
+    }
+    TTF_Quit();
+    SDL_Quit();
+}
+
+/* ------------------------------------------------------------------ args --- */
+
+static akerr_ErrorContext *parse_args(int argc, char *argv[], char **assetdir,
+				      char **script, int *frames)
+{
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, assetdir, AKERR_NULLPOINTER, "assetdir");
+    FAIL_ZERO_RETURN(errctx, script, AKERR_NULLPOINTER, "script");
+    FAIL_ZERO_RETURN(errctx, frames, AKERR_NULLPOINTER, "frames");
+
+    for ( i = 1; i < argc; i++ ) {
+	if ( strcmp(argv[i], "--autoplay") == 0 ) {
+	    galaga_game.autoplay = true;
+	} else if ( strcmp(argv[i], "--frames") == 0 ) {
+	    i += 1;
+	    FAIL_NONZERO_RETURN(errctx, (i >= argc), AKERR_VALUE, "--frames needs a count");
+	    PASS(errctx, aksl_atoi(argv[i], frames));
+	} else if ( strcmp(argv[i], "--assets") == 0 ) {
+	    i += 1;
+	    FAIL_NONZERO_RETURN(errctx, (i >= argc), AKERR_VALUE, "--assets needs a directory");
+	    *assetdir = argv[i];
+	} else if ( strcmp(argv[i], "--script") == 0 ) {
+	    i += 1;
+	    FAIL_NONZERO_RETURN(errctx, (i >= argc), AKERR_VALUE, "--script needs a path");
+	    *script = argv[i];
+	} else if ( strcmp(argv[i], "--screenshot") == 0 ) {
+	    i += 1;
+	    FAIL_NONZERO_RETURN(errctx, (i >= argc), AKERR_VALUE, "--screenshot needs a path");
+	    SHOTPATH = argv[i];
+	} else if ( strcmp(argv[i], "--screenshot-frame") == 0 ) {
+	    i += 1;
+	    FAIL_NONZERO_RETURN(errctx, (i >= argc), AKERR_VALUE,
+				"--screenshot-frame needs a number");
+	    PASS(errctx, aksl_atoi(argv[i], &SHOTFRAME));
+	} else {
+	    FAIL_RETURN(
+		errctx,
+		AKERR_VALUE,
+		"usage: galaga [--assets DIR] [--script PATH] [--frames N]"
+		" [--autoplay] [--screenshot PATH] [--screenshot-frame N]"
+		);
+	}
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+int main(int argc, char *argv[])
+{
+    char *assetdir = GALAGA_ASSET_DIR;
+    char *script = GALAGA_SCRIPT_PATH;
+    int frames = 0;
+    uint16_t fontid = 0;
+    PREPARE_ERROR(errctx);
+
+    ATTEMPT {
+	CATCH(errctx, parse_args(argc, argv, &assetdir, &script, &frames));
+	CATCH(errctx, startup());
+	CATCH(errctx, load_assets(assetdir));
+	/* The engine refuses to start when the script will not boot: a game
+	 * whose enemies cannot think is not a game missing a feature. */
+	CATCH(errctx, galaga_script_boot(script));
+	CATCH(errctx, akgl_ui_init(GALAGA_VIEW_WIDTH, GALAGA_VIEW_HEIGHT));
+	CATCH(errctx, akgl_text_loadfont("hud", GALAGA_FONT_PATH, 28));
+	CATCH(errctx, akgl_text_loadfont("banner", GALAGA_FONT_PATH, 84));
+	CATCH(errctx, akgl_ui_font_register("hud", &fontid));
+	CATCH(errctx, galaga_player_spawn());
+	CATCH(errctx, galaga_player_controls());
+	starfield_seed();
+	galaga_game.screen = GALAGA_SCREEN_TITLE;
+	galaga_game.lives = 3;
+	CATCH(errctx, run(frames));
+    } CLEANUP {
+	shutdown_game();
+    } PROCESS(errctx) {
+    } HANDLE_DEFAULT(errctx) {
+	LOG_ERROR_WITH_MESSAGE(errctx, "galaga could not run");
+	/* Set a flag rather than returning: leaving a HANDLE block early
+	 * skips FINISH's RELEASE_ERROR and leaks the context's pool slot. */
+	FAILED = 1;
+	/* FINISH_NORETURN rather than FINISH: FINISH expands a return that an
+	 * int-returning function cannot compile. */
+    } FINISH_NORETURN(errctx);
+
+    /*
+     * The readout is the evidence: exiting 0 is not proof the wave flew. A
+     * headless CI log gets the same line a reader's terminal does, and the
+     * script-error count is the line's whole reason to exist -- a wave of
+     * dumb enemies still exits 0.
+     */
+    SDL_Log(
+	"galaga: %d frames, screen %d, score %d, alive %d, kills bee %d bfly %d boss %d,"
+	" shots bee %d bfly %d boss %d, script errors %d",
+	galaga_game.frame,
+	(int)galaga_game.screen,
+	galaga_game.score,
+	galaga_enemies_alive(),
+	galaga_game.kills[GALAGA_ENEMY_BEE],
+	galaga_game.kills[GALAGA_ENEMY_BUTTERFLY],
+	galaga_game.kills[GALAGA_ENEMY_BOSS],
+	galaga_game.shots[GALAGA_ENEMY_BEE],
+	galaga_game.shots[GALAGA_ENEMY_BUTTERFLY],
+	galaga_game.shots[GALAGA_ENEMY_BOSS],
+	galaga_game.script_errors);
+    return FAILED;
+}

examples/galaga/player.c

@@ -0,0 +1,407 @@
+/**
+ * @file player.c
+ * @brief The player's ship, its shots, and every collision in the game.
+ *
+ * Bullets and collision are C forever -- they are engine, not behavior. The
+ * per-frame budget for the script is spent on the forty things that think;
+ * nothing here thinks, it just moves and intersects.
+ */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/controller.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+#include <akgl/registry.h>
+#include <akgl/util.h>
+
+#include "galaga.h"
+
+/* Points per kill, indexed by enemy kind. */
+static const int KILL_SCORE[GALAGA_ENEMY_KINDS] = {
+    /* bee  butterfly  boss */
+       50,        80,   150
+};
+
+static uint32_t PSHOT_SERIAL = 0;
+
+/* -------------------------------------------------------------- hitboxes --- */
+
+/*
+ * Actor x/y is a sprite's top-left corner. Every box is inset from the
+ * artwork's rectangle, because the PNGs carry transparent margin and wing
+ * tips that should not kill anybody.
+ */
+static void player_box(akgl_Actor *actor, SDL_FRect *dest)
+{
+    dest->x = actor->x + 12.0f;
+    dest->y = actor->y + 8.0f;
+    dest->w = 75.0f;
+    dest->h = 60.0f;
+}
+
+static void enemy_box(akgl_Actor *actor, SDL_FRect *dest)
+{
+    dest->x = actor->x + 8.0f;
+    dest->y = actor->y + 8.0f;
+    dest->w = 78.0f;
+    dest->h = 68.0f;
+}
+
+static void shot_box(akgl_Actor *actor, SDL_FRect *dest)
+{
+    dest->x = actor->x;
+    dest->y = actor->y;
+    dest->w = 9.0f;
+    dest->h = 54.0f;
+}
+
+/* ---------------------------------------------------------- player shots --- */
+
+/**
+ * @brief Kill one enemy: score it, blow it up, free its slot.
+ */
+static akerr_ErrorContext *kill_enemy(int index)
+{
+    akgl_Actor *actor = NULL;
+    galaga_Enemy *enemy = NULL;
+    PREPARE_ERROR(errctx);
+
+    FAIL_NONZERO_RETURN(errctx, (index < 0 || index >= GALAGA_MAX_ENEMIES),
+			AKERR_OUTOFBOUNDS, "enemy index %d", index);
+    actor = galaga_enemy_actors[index];
+    FAIL_ZERO_RETURN(errctx, actor, AKERR_NULLPOINTER, "enemy %d is already gone", index);
+    enemy = &galaga_enemies[index];
+
+    galaga_game.score += KILL_SCORE[enemy->kind];
+    galaga_game.kills[enemy->kind] += 1;
+    PASS(errctx, galaga_boom_spawn(actor->x + 20.0f, actor->y + 20.0f));
+    PASS(errctx, akgl_heap_release_actor(actor));
+    galaga_enemy_actors[index] = NULL;
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief Move a player shot and test it against every live enemy.
+ *
+ * The classic O(shots x enemies) sweep: at most 2 x 40 rectangle tests a
+ * frame, which is noise. A hit costs the enemy a point of hp; the boss's
+ * second point is the script's business to survive, not this file's.
+ */
+static akerr_ErrorContext *player_shot_update(akgl_Actor *obj)
+{
+    SDL_FRect mine;
+    SDL_FRect theirs;
+    bool hit = false;
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+    obj->y -= 900.0f * galaga_game.dt;
+    if ( obj->y < -60.0f ) {
+	galaga_game.player_shots_live -= 1;
+	PASS(errctx, akgl_heap_release_actor(obj));
+	SUCCEED_RETURN(errctx);
+    }
+
+    shot_box(obj, &mine);
+    for ( i = 0; i < GALAGA_MAX_ENEMIES; i++ ) {
+	if ( galaga_enemy_actors[i] == NULL ) {
+	    continue;
+	}
+	enemy_box(galaga_enemy_actors[i], &theirs);
+	PASS(errctx, akgl_collide_rectangles(&mine, &theirs, &hit));
+	if ( !hit ) {
+	    continue;
+	}
+	galaga_enemies[i].hp -= 1;
+	if ( galaga_enemies[i].hp <= 0 ) {
+	    PASS(errctx, kill_enemy(i));
+	}
+	galaga_game.player_shots_live -= 1;
+	PASS(errctx, akgl_heap_release_actor(obj));
+	SUCCEED_RETURN(errctx);
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *player_fire(akgl_Actor *player)
+{
+    akgl_Actor *shot = NULL;
+    char name[32];
+    int count = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, player, AKERR_NULLPOINTER, "player");
+
+    PSHOT_SERIAL += 1;
+    PASS(errctx, aksl_snprintf(&count, name, sizeof(name), "pshot%u", PSHOT_SERIAL));
+    PASS(errctx, akgl_heap_next_actor(&shot));
+    PASS(errctx, akgl_actor_initialize(shot, name));
+    PASS(errctx, akgl_actor_set_character(shot, "galaga_playershot"));
+    /* AFTER initialize: it resets all seven hooks. */
+    shot->updatefunc = &player_shot_update;
+    shot->movement_controls_face = false;
+    shot->state = AKGL_ACTOR_STATE_ALIVE;
+    shot->visible = true;
+    shot->x = player->x + 45.0f;
+    shot->y = player->y - 44.0f;
+
+    galaga_game.player_shots_live += 1;
+    galaga_game.fire_cooldown = 0.22f;
+    SUCCEED_RETURN(errctx);
+}
+
+/* ----------------------------------------------------------- player hit --- */
+
+static akerr_ErrorContext *player_hit(akgl_Actor *player)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, player, AKERR_NULLPOINTER, "player");
+    galaga_game.lives -= 1;
+    galaga_game.respawn_timer = 2.0f;
+    PASS(errctx, galaga_boom_spawn(player->x + 25.0f, player->y + 10.0f));
+    player->x = (float)GALAGA_VIEW_WIDTH / 2.0f - 50.0f;
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief The player's own update hook: motion, fire, and what can kill it.
+ */
+static akerr_ErrorContext *player_update(akgl_Actor *obj)
+{
+    SDL_FRect mine;
+    SDL_FRect theirs;
+    bool hit = false;
+    float dx = 0.0f;
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, obj, AKERR_NULLPOINTER, "obj");
+
+    dx = 0.0f;
+    if ( galaga_game.moveleft ) {
+	dx -= GALAGA_PLAYER_SPEED;
+    }
+    if ( galaga_game.moveright ) {
+	dx += GALAGA_PLAYER_SPEED;
+    }
+    obj->x += dx * galaga_game.dt;
+    if ( obj->x < GALAGA_PLAYER_MARGIN ) {
+	obj->x = GALAGA_PLAYER_MARGIN;
+    }
+    if ( obj->x > (float)GALAGA_VIEW_WIDTH - GALAGA_PLAYER_MARGIN - 99.0f ) {
+	obj->x = (float)GALAGA_VIEW_WIDTH - GALAGA_PLAYER_MARGIN - 99.0f;
+    }
+
+    galaga_game.fire_cooldown -= galaga_game.dt;
+    if ( galaga_game.firing
+	 && galaga_game.fire_cooldown <= 0.0f
+	 && galaga_game.player_shots_live < GALAGA_MAX_PLAYER_SHOTS
+	 && galaga_game.screen == GALAGA_SCREEN_PLAY ) {
+	PASS(errctx, player_fire(obj));
+    }
+
+    /*
+     * Respawn grace: two seconds of blinking invulnerability. The blink is
+     * the `visible` flag, which is deliberate hiding -- the actor still
+     * updates, it just is not drawn on the off frames.
+     */
+    if ( galaga_game.respawn_timer > 0.0f ) {
+	galaga_game.respawn_timer -= galaga_game.dt;
+	obj->visible = ((galaga_game.frame / 6) % 2) == 0;
+	SUCCEED_RETURN(errctx);
+    }
+    obj->visible = true;
+
+    player_box(obj, &mine);
+
+    /* Enemy shots. */
+    for ( i = 0; i < AKGL_MAX_HEAP_ACTOR; i++ ) {
+	if ( akgl_heap_actors[i].refcount == 0 ) {
+	    continue;
+	}
+	if ( strncmp(akgl_heap_actors[i].name, "eshot", 5) != 0 ) {
+	    continue;
+	}
+	shot_box(&akgl_heap_actors[i], &theirs);
+	PASS(errctx, akgl_collide_rectangles(&mine, &theirs, &hit));
+	if ( hit ) {
+	    galaga_game.enemy_shots_live -= 1;
+	    PASS(errctx, akgl_heap_release_actor(&akgl_heap_actors[i]));
+	    PASS(errctx, player_hit(obj));
+	    SUCCEED_RETURN(errctx);
+	}
+    }
+
+    /* Diving enemies. The formation never reaches this low, so testing all
+     * forty is the same answer as testing the divers, without a state read. */
+    for ( i = 0; i < GALAGA_MAX_ENEMIES; i++ ) {
+	if ( galaga_enemy_actors[i] == NULL ) {
+	    continue;
+	}
+	enemy_box(galaga_enemy_actors[i], &theirs);
+	PASS(errctx, akgl_collide_rectangles(&mine, &theirs, &hit));
+	if ( hit ) {
+	    PASS(errctx, kill_enemy(i));
+	    PASS(errctx, player_hit(obj));
+	    SUCCEED_RETURN(errctx);
+	}
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+/* -------------------------------------------------------------- controls --- */
+
+static akerr_ErrorContext *left_on(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    galaga_game.moveleft = true;
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *left_off(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    galaga_game.moveleft = false;
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *right_on(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    galaga_game.moveright = true;
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *right_off(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    galaga_game.moveright = false;
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *fire_on(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    galaga_game.firing = true;
+    SUCCEED_RETURN(errctx);
+}
+
+static akerr_ErrorContext *fire_off(akgl_Actor *obj, SDL_Event *event)
+{
+    PREPARE_ERROR(errctx);
+    (void)obj; (void)event;
+    galaga_game.firing = false;
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *galaga_player_controls(void)
+{
+    akgl_Control control;
+    PREPARE_ERROR(errctx);
+
+    memset(&control, 0, sizeof(control));
+    control.event_on = SDL_EVENT_KEY_DOWN;
+    control.event_off = SDL_EVENT_KEY_UP;
+
+    control.key = SDLK_LEFT;
+    control.handler_on = &left_on;
+    control.handler_off = &left_off;
+    PASS(errctx, akgl_controller_pushmap(0, &control));
+
+    control.key = SDLK_RIGHT;
+    control.handler_on = &right_on;
+    control.handler_off = &right_off;
+    PASS(errctx, akgl_controller_pushmap(0, &control));
+
+    control.key = SDLK_SPACE;
+    control.handler_on = &fire_on;
+    control.handler_off = &fire_off;
+    PASS(errctx, akgl_controller_pushmap(0, &control));
+
+    akgl_controlmaps[0].target = galaga_game.player;
+    SUCCEED_RETURN(errctx);
+}
+
+/* ----------------------------------------------------------------- spawn --- */
+
+akerr_ErrorContext *galaga_player_spawn(void)
+{
+    akgl_Actor *player = NULL;
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, akgl_heap_next_actor(&player));
+    PASS(errctx, akgl_actor_initialize(player, "player"));
+    PASS(errctx, akgl_actor_set_character(player, "galaga_player"));
+    /* AFTER initialize: it resets all seven hooks. */
+    player->updatefunc = &player_update;
+    player->movement_controls_face = false;
+    player->state = AKGL_ACTOR_STATE_ALIVE;
+    player->visible = true;
+    player->x = (float)GALAGA_VIEW_WIDTH / 2.0f - 50.0f;
+    player->y = GALAGA_PLAYER_Y;
+
+    galaga_game.player = player;
+    SUCCEED_RETURN(errctx);
+}
+
+/* -------------------------------------------------------------- autoplay --- */
+
+/**
+ * @brief Send one synthetic key event through the controller.
+ *
+ * Through akgl_controller_handle_event(), never the handlers directly: the
+ * point of autoplay is to exercise the same path a keyboard does.
+ */
+static akerr_ErrorContext *synth_key(SDL_Keycode key, bool down)
+{
+    SDL_Event event;
+    PREPARE_ERROR(errctx);
+
+    memset(&event, 0, sizeof(event));
+    event.type = (down ? SDL_EVENT_KEY_DOWN : SDL_EVENT_KEY_UP);
+    event.key.key = key;
+    PASS(errctx, akgl_controller_handle_event((void *)&akgl_game.state, &event));
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief The scripted pilot for headless runs: hold fire, sweep the floor.
+ */
+akerr_ErrorContext *galaga_player_autoplay(int frame)
+{
+    int phase = 0;
+    PREPARE_ERROR(errctx);
+
+    /* Hold fire until the wave has mostly assembled: shooting the entry
+     * stream point-blank empties the formation before it exists, which makes
+     * both the game and its figure worse. */
+    if ( frame == 300 ) {
+	PASS(errctx, synth_key(SDLK_SPACE, true));
+    }
+    phase = frame % 240;
+    if ( phase == 30 ) {
+	PASS(errctx, synth_key(SDLK_LEFT, true));
+    } else if ( phase == 90 ) {
+	PASS(errctx, synth_key(SDLK_LEFT, false));
+	PASS(errctx, synth_key(SDLK_RIGHT, true));
+    } else if ( phase == 210 ) {
+	PASS(errctx, synth_key(SDLK_RIGHT, false));
+    }
+    SUCCEED_RETURN(errctx);
+}

examples/galaga/script.c

@@ -0,0 +1,281 @@
+/**
+ * @file script.c
+ * @brief The boundary: everything that touches the interpreter lives here.
+ *
+ * One runtime, one script, three host types, three bindings. The engine calls
+ * exactly one thing per enemy per frame -- galaga_script_update_enemy() -- and
+ * that function is the whole protocol: rebind, call, recover, reset.
+ *
+ * The structure types are declared once, in C, right below. The script never
+ * declares a TYPE of its own; akbasic_host_register_type() makes these structs
+ * *be* the BASIC types, offsets taken from offsetof() so the two sides cannot
+ * drift (include/akbasic/host.h).
+ */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+
+#include <akerror.h>
+
+#include <akbasic/environment.h>
+#include <akbasic/error.h>
+#include <akbasic/host.h>
+#include <akbasic/runtime.h>
+#include <akbasic/sink.h>
+
+#include "galaga.h"
+
+/* The interpreter. Static because an akbasic_Runtime is far too big for a
+ * stack frame -- 2.40 MiB on this branch. */
+static akbasic_Runtime SCRIPT;
+static akbasic_TextSink SINK;
+static akbasic_StdioSink SINKSTATE;
+
+/** @brief Longest galaga.bas this loader will accept. */
+#define GALAGA_MAX_SCRIPT_BYTES 16384
+
+static char SOURCE[GALAGA_MAX_SCRIPT_BYTES];
+
+/*
+ * Enemy kind -> BASIC function name. Dispatch is a table, not a conditional:
+ * adding a kind is one row here and one DEF in galaga.bas.
+ */
+static const char *UPDATE_FUNCTION[GALAGA_ENEMY_KINDS] = {
+    "UPDATEBEE",	/* GALAGA_ENEMY_BEE       */
+    "UPDATEBFLY",	/* GALAGA_ENEMY_BUTTERFLY */
+    "UPDATEBOSS"	/* GALAGA_ENEMY_BOSS      */
+};
+
+/* ---------------------------------------------------------- host types --- */
+
+static const akbasic_HostField ENEMY_FIELDS[] = {
+    /*                  struct        member  BASIC name  C representation          */
+    AKBASIC_HOST_FIELD( galaga_Enemy, kind,   "KIND#",    AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, state,  "STATE#",   AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, homex,  "HOMEX%",   AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, homey,  "HOMEY%",   AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, t,      "T%",       AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, hp,     "HP#",      AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, fire,   "FIRE#",    AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Enemy, rnd,    "RND%",     AKBASIC_HOSTFIELD_FLOAT )
+};
+static const akbasic_HostType ENEMY_TYPE = {
+    "ENEMY", sizeof(galaga_Enemy), ENEMY_FIELDS, 8
+};
+
+/*
+ * The live actor itself. This is the demonstrative point of the whole
+ * example: the script writes the engine's *real* actor memory -- the same x
+ * the renderer reads -- with no copy in either direction.
+ */
+static const akbasic_HostField ACTOR_FIELDS[] = {
+    AKBASIC_HOST_FIELD( akgl_Actor, x,       "X%",       AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( akgl_Actor, y,       "Y%",       AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( akgl_Actor, state,   "STATE#",   AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( akgl_Actor, visible, "VISIBLE#", AKBASIC_HOSTFIELD_BOOL  )
+};
+static const akbasic_HostType ACTOR_TYPE = {
+    "ACTOR", sizeof(akgl_Actor), ACTOR_FIELDS, 4
+};
+
+static const akbasic_HostField GAME_FIELDS[] = {
+    AKBASIC_HOST_FIELD( galaga_Shared, playerx, "PLAYERX%", AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Shared, playery, "PLAYERY%", AKBASIC_HOSTFIELD_FLOAT ),
+    AKBASIC_HOST_FIELD( galaga_Shared, wave,    "WAVE#",    AKBASIC_HOSTFIELD_INT32 ),
+    AKBASIC_HOST_FIELD( galaga_Shared, rnd,     "RND%",     AKBASIC_HOSTFIELD_FLOAT )
+};
+static const akbasic_HostType GAME_TYPE = {
+    "GAME", sizeof(galaga_Shared), GAME_FIELDS, 4
+};
+
+/* Placeholders the boot bindings point at until the first real rebind. A
+ * binding is borrowed, never copied, so these must be static storage. */
+static galaga_Enemy SCRATCH_ENEMY;
+static akgl_Actor SCRATCH_ACTOR;
+
+/* ---------------------------------------------------------------- boot --- */
+
+static akerr_ErrorContext *read_script(char *path)
+{
+    FILE *fp = NULL;
+    size_t got = 0;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, path, AKERR_NULLPOINTER, "path");
+    fp = fopen(path, "rb");
+    FAIL_ZERO_RETURN(errctx, fp, AKERR_IO, "Cannot open the enemy script %s", path);
+    ATTEMPT {
+	got = fread(SOURCE, 1, sizeof(SOURCE) - 1, fp);
+	SOURCE[got] = '\0';
+	FAIL_NONZERO_BREAK(errctx, (got >= sizeof(SOURCE) - 1), AKERR_OUTOFBOUNDS,
+			   "%s does not fit in the %d byte script buffer",
+			   path, GALAGA_MAX_SCRIPT_BYTES);
+    } CLEANUP {
+	fclose(fp);
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief One dry call of every dispatch-table function, at boot.
+ *
+ * A missing or misspelled DEF fails here, at startup, with the function's name
+ * in the message -- not on frame one of the first wave. The scratch enemy's
+ * state word is zero, so no maneuver block runs and nothing moves.
+ */
+static akerr_ErrorContext *dry_run(void)
+{
+    akbasic_Value dt;
+    akbasic_Value *argp[1];
+    akbasic_Value *result = NULL;
+    int i = 0;
+    PREPARE_ERROR(errctx);
+
+    memset(&SCRATCH_ENEMY, 0, sizeof(SCRATCH_ENEMY));
+    memset(&dt, 0, sizeof(dt));
+    dt.valuetype = AKBASIC_TYPE_FLOAT;
+    dt.floatval = 0.0;
+    argp[0] = &dt;
+
+    for ( i = 0; i < GALAGA_ENEMY_KINDS; i++ ) {
+	PASS(errctx, akbasic_host_rebind(&SCRIPT, "SELF@", &SCRATCH_ENEMY));
+	PASS(errctx, akbasic_host_rebind(&SCRIPT, "ACTOR@", &SCRATCH_ACTOR));
+	PASS(errctx, akbasic_runtime_call_function(&SCRIPT, (char *)UPDATE_FUNCTION[i],
+						   argp, 1, &result));
+	/*
+	 * A body that died reports through the sink and answers zero; the
+	 * dropped mode is the only signal C gets. At boot that must be fatal
+	 * and must say which function -- not frame one of the first wave.
+	 */
+	FAIL_NONZERO_RETURN(errctx, (SCRIPT.mode != AKBASIC_MODE_RUN), AKERR_VALUE,
+			    "%s died during the boot dry run; the interpreter's report"
+			    " is above", UPDATE_FUNCTION[i]);
+	PASS(errctx, akbasic_environment_zero(SCRIPT.environment));
+    }
+    SUCCEED_RETURN(errctx);
+}
+
+akerr_ErrorContext *galaga_script_boot(char *path)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, path, AKERR_NULLPOINTER, "path");
+
+    PASS(errctx, akbasic_error_register());
+    PASS(errctx, akbasic_sink_init_stdio(&SINK, &SINKSTATE, stdout, NULL));
+    PASS(errctx, akbasic_runtime_init(&SCRIPT, &SINK));
+
+    PASS(errctx, akbasic_host_register_type(&SCRIPT, &ENEMY_TYPE));
+    PASS(errctx, akbasic_host_register_type(&SCRIPT, &ACTOR_TYPE));
+    PASS(errctx, akbasic_host_register_type(&SCRIPT, &GAME_TYPE));
+
+    PASS(errctx, akbasic_host_bind(&SCRIPT, "SELF@", "ENEMY", &SCRATCH_ENEMY));
+    PASS(errctx, akbasic_host_bind(&SCRIPT, "ACTOR@", "ACTOR", &SCRATCH_ACTOR));
+    PASS(errctx, akbasic_host_bind(&SCRIPT, "GAME@", "GAME", &galaga_shared));
+
+    PASS(errctx, read_script(path));
+    PASS(errctx, akbasic_runtime_load(&SCRIPT, SOURCE));
+
+    /*
+     * A "no top level code" script still has to run once: executing the DEF
+     * statements is what files the functions. The run is bounded because a
+     * script that is all definitions has no business taking more than a step
+     * per line, and an accidental loop at boot should be a diagnosis, not a
+     * hang.
+     */
+    PASS(errctx, akbasic_runtime_start(&SCRIPT, AKBASIC_MODE_RUN));
+    PASS(errctx, akbasic_runtime_run(&SCRIPT, 4 * AKBASIC_MAX_SOURCE_LINES));
+
+    /*
+     * The program has now ended and the runtime sits in QUIT mode, where a
+     * multi-line DEF called from the host returns a silent zero. Forcing the
+     * mode back makes the bodies run, and it stays put because nothing here
+     * ever steps the runtime again. Issue #8 tracks making this unnecessary.
+     */
+    PASS(errctx, akbasic_runtime_set_mode(&SCRIPT, AKBASIC_MODE_RUN));
+
+    PASS(errctx, dry_run());
+    SUCCEED_RETURN(errctx);
+}
+
+/* ------------------------------------------------------------ per frame --- */
+
+akerr_ErrorContext *galaga_script_update_enemy(galaga_Enemy *enemy, akgl_Actor *actor, float dt)
+{
+    akbasic_Value dtval;
+    akbasic_Value *argp[1];
+    akbasic_Value *result = NULL;
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, enemy, AKERR_NULLPOINTER, "enemy");
+    FAIL_ZERO_RETURN(errctx, actor, AKERR_NULLPOINTER, "actor");
+    FAIL_NONZERO_RETURN(errctx, (enemy->kind < 0 || enemy->kind >= GALAGA_ENEMY_KINDS),
+			AKERR_VALUE, "Enemy kind %d has no update function", enemy->kind);
+
+    PASS(errctx, akbasic_host_rebind(&SCRIPT, "SELF@", enemy));
+    PASS(errctx, akbasic_host_rebind(&SCRIPT, "ACTOR@", actor));
+
+    memset(&dtval, 0, sizeof(dtval));
+    dtval.valuetype = AKBASIC_TYPE_FLOAT;
+    dtval.floatval = (double)dt;
+    argp[0] = &dtval;
+
+    /*
+     * An error in an enemy's function is that script's problem, not the
+     * engine's: the enemy goes dumb -- cleared to a formation hold it will
+     * never leave -- and the frame lives. HANDLE_DEFAULT absorbs whatever the
+     * interpreter raised; the first failure is logged with the function's
+     * name, the rest are counted, because sixty a second of the same message
+     * is how a log stops being read.
+     */
+    ATTEMPT {
+	CATCH(errctx, akbasic_runtime_call_function(&SCRIPT, (char *)UPDATE_FUNCTION[enemy->kind],
+						    argp, 1, &result));
+    } CLEANUP {
+    } PROCESS(errctx) {
+    } HANDLE_DEFAULT(errctx) {
+	if ( galaga_game.script_errors == 0 ) {
+	    LOG_ERROR_WITH_MESSAGE(errctx, "first script error; this enemy is now dumb");
+	}
+	galaga_game.script_errors += 1;
+	enemy->state = GALAGA_ES_FORMATION;
+	enemy->fire = 0;
+    } FINISH(errctx, true);
+
+    /*
+     * A BASIC-level error in the body is quieter than an interpreter error:
+     * it reports through the sink, the call answers a stale value, and the
+     * runtime falls out of RUN mode -- after which every later call is a
+     * silent no-op. The mode is the tell. Revival is two calls:
+     * clear_error(), because a run's first error latches and every line is
+     * skipped while it stands, and the same set_mode(RUN) the boot needed
+     * (issue #8's mechanics). The enemy is treated exactly like the
+     * interpreter-error case above.
+     */
+    if ( SCRIPT.mode != AKBASIC_MODE_RUN ) {
+	if ( galaga_game.script_errors == 0 ) {
+	    SDL_Log("first script error (reported by the interpreter above);"
+		    " enemy %s is now dumb", UPDATE_FUNCTION[enemy->kind]);
+	}
+	galaga_game.script_errors += 1;
+	enemy->state = GALAGA_ES_FORMATION;
+	enemy->fire = 0;
+	PASS(errctx, akbasic_runtime_clear_error(&SCRIPT));
+	PASS(errctx, akbasic_runtime_set_mode(&SCRIPT, AKBASIC_MODE_RUN));
+    }
+
+    /*
+     * Load-bearing: akbasic_runtime_call_function() parks every result in the
+     * caller environment's per-line value scratch, and a host calling in a
+     * loop never crosses the line boundary that would reset it. Without this
+     * the pool drains in under two frames of a 40-enemy wave.
+     */
+    PASS(errctx, akbasic_environment_zero(SCRIPT.environment));
+    SUCCEED_RETURN(errctx);
+}

examples/megademo/README.md

@@ -56,7 +56,10 @@ This is a tour of the interpreter's edges, on purpose:
   counterpoint: a genuine 24x21 `SPRSAV` type-in sprite, 63 bytes, which is
   everything `DATA` has room to say. The paint is the reveal, and the exit is a
   stride-63 column dissolve — 63 is coprime to 160, so the walk hits every
-  column once and looks random while carrying no state.
+  column once and looks random while carrying no state. The strings come in
+  64-character chunks because a source line is 80 columns, like the machines
+  this pretends to be — the decoder carries its cursor from one `IM$` entry to
+  the next, and the generator refuses to cut inside a run.
 - **And then the picture is video.** Six delta frames loop the floor grid toward
   you and crawl the sun's slice pattern — full motion video, 1.3 KB total, about
   220 bytes a frame. A delta re-encodes only the rows that changed: an `R`
@@ -82,6 +85,10 @@ This is a tour of the interpreter's edges, on purpose:
   batch a bar of noise drums. Noise is real: `ENVELOPE`'s sixth argument is a
   waveform, 0 to 3, which Chapter 7 forgot to mention. Voice 1 carries the tune so
   the collision blips (voice 2) and scene sweeps (voice 3) never steal its channel.
+  A batch is four `PLAY` statements, one bar each — the 80-column line limit will
+  not hold four bars in one string, and it does not need to: the parser's voice,
+  envelope and duration state persists across statements and every `PLAY` appends
+  to the same queue, so four bars queue exactly as one line would.
 
 It also probes for its hardware like a proper boot loader, with one `TRAP` per
 device: no graphics refuses by name and exits, no audio mutes the soundtrack, no

examples/megademo/megademo.bas

@@ -461,38 +461,78 @@ BS% = W# / 160
 IF BS% < 1 THEN BS% = 1
 REM  ---- PICTURE-BEGIN (generated by vaporwave.py; do not
 REM  ---- hand-edit -- rerun the script to change the picture)
-DIM IM$(16)
+DIM IM$(56)
 DIM VA#(6)
 DIM VB#(6)
-NS# = 9
+NS# = 32
-VA#(0) = 9
+VA#(0) = 32
-VB#(0) = 9
+VB#(0) = 35
-VA#(1) = 10
+VA#(1) = 36
-VB#(1) = 10
+VB#(1) = 39
-VA#(2) = 11
+VA#(2) = 40
-VB#(2) = 12
+VB#(2) = 43
-VA#(3) = 13
+VA#(3) = 44
-VB#(3) = 13
+VB#(3) = 47
-VA#(4) = 14
+VA#(4) = 48
-VB#(4) = 14
+VB#(4) = 51
-VA#(5) = 15
+VA#(5) = 52
-VB#(5) = 15
+VB#(5) = 55
-IM$(0) = "G9G9G9G9GPGHEHG9GTEHG9GTEHGPGPEHG9GTEHG9GTEHGHGXEHGTBAG8EHG9GTEHG5EHGPEHG5EHGPEHG5EHGAPAG3EHGPEHG5EHGPEHGXGHEHG5EHGPEHG5EHGFBAGIEHGPGPEHGPEHGHEHGPEHGPEHGHEHGPEHGHEHGPEHGPEHGHEHGBPAGMEHGPEHGHEHGPEHGHEHGPEHGPEHGHEHGPEHGPEHGHEHGPEHGHEPGHEHGPEH"
+IM$(0) = "G9G9G9G9GPGHEHG9GTEHG9GTEHGPGPEHG9GTEHG9GTEHGHGXEHGTBAG8EHG9GTEH"
-IM$(1) = "GHEPGHEHGPEHGHEPGHEHGHEGBAEHGHEHGPEHGHEPGHEHGPEHGHEHGPEHGHEPGHEHGPEHGHEPGHEHGPECPAEDGHEPGHEHGHEPGHEPGHEHGHEPGHEPGHEHGHEPGHEHGHEPGHEPGHECBAEDGHEPGHEPGHEHGHEPGHEHGHEPGHEPGHEHGHEPGHEPEPGHEPGHE5GHEPGHE5GHEHEXGHEPGHEEPAEZGHEPGHE5GHE5GHEPGHE5GHEP"
+IM$(1) = "G5EHGPEHG5EHGPEHG5EHGAPAG3EHGPEHG5EHGPEHGXGHEHG5EHGPEHG5EHGFBAGI"
-IM$(2) = "GHE5GHE9ETGHE9ETGHEXEHGHE9ETGHHAE9ESGHEPEPGBBAGEE9EMHOE9ETGHEHE9E7HUE9E6E9E4H0E9E3E9E3H2E9EHBAETEHKHE9ELH6E9ECKHEPEPKHE9EBH9HAE9EIKHEHEXKHE2H9HCE9EPKHE5KHEPKDH9HEKCEPKHE5KHE5KHEKH9HGEBKHEPKHEXEHKHE5KHEBH9HIEIKHEPKHEPEPKHEPKHEHKAH9HKKHEHKHEP"
+IM$(2) = "EHGPGPEHGPEHGHEHGPEHGPEHGHEHGPEHGHEHGPEHGPEHGHEHGBPAGMEHGPEHGHEH"
-IM$(3) = "KHEHKHEPKHEPKHH9HMEGKHEHKHEPKHEHKHEPKHEPH9HMEOKHEHKHEPKHEHKPEHKHEGH9HOKFEPKHEHKPEHKHEHKPEHKGH9HOEFKHEPKHEHKHEPKHEHKPEFH9HQKEEHKHEPKHEHKHEPKHEHKMH9HSKLEHKHEPKHEHKPEHKHEHKEH9HSEDKPEHKPEHKHEHKPEHKHEEH9HSKDEHKPEHKPKPEHKPEHKDH9HUECKHEHKPEHKHKXEH"
+IM$(3) = "GPEHGHEHGPEHGPEHGHEHGPEHGPEHGHEHGPEHGHEPGHEHGPEHGHEPGHEHGPEHGHEP"
-IM$(4) = "KPEDH9HUKCEHK5EHK5EHKLH9HUKKEHK5EHK5EHKCH9HWEBKPEHKXKHEHK8I9IWKZEHKPKPEHK0I9IWK7EHKHKXEHKSI9IWK9KFEHK9KOI9IWK9KNK9KOI9IWK9KNK9KOI9IWK9KNKPIHKZI9IYK6IHKHKXIHKSI9IWK9KFIHK5IHKKI9IWK9KNIHK5IHKCI9IYKPIHKXKHIHK5IHKPIHK5IHKPIHKPKPIHK0I9IWKJIHKPIH"
+IM$(4) = "GHEHGHEGBAEHGHEHGPEHGHEPGHEHGPEHGHEHGPEHGHEPGHEHGPEHGHEPGHEHGPEC"
-IM$(5) = "KHIHKPIHKPI9IZKBIHKHIHKPIHKHIHKPIHKKI9IWKJIHKHIHKPIHKHIHKPIHKDI9IXKPIHKHIHKHKHIHKHIPKHI9IYKCIHKPIHKHIHKPIHKHIPKHIHKPIHKHIPKHIHKPIHKHIHKPIHKHI9I9IHKHIHKPIHKHIPKHIHKHIEC9CSKDIPKHIPKHIHKHIPKHIHKEC9CSIDKHIPKHIPIPKHIPKHIFC9CQKEIHKHIPKHIHIXKHIPKG"
+IM$(5) = "PAEDGHEPGHEHGHEPGHEPGHEHGHEPGHEPGHEHGHEPGHEHGHEPGHEPGHECBAEDGHEP"
-IM$(6) = "C9COIFKHI5KHI5KHIPKHI5KHIPKHI5KHI5KHIPKHI5KHIPKHIXIHKHI9IDC9CMI4KHIPIPKHI6C9CKI9IDKHIHIXKHIZC9CII9IMKHI9IWC9CGI9IVI9I9I9I9IPI9I9I9I9IPQ9Q9Q9Q9QPE9E9E9E9EPE9E9E9E9EPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9"
+IM$(6) = "GHEPGHEHGHEPGHEHGHEPGHEPGHEHGHEPGHEPEPGHEPGHE5GHEPGHE5GHEHEXGHEP"
-IM$(7) = "Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9"
+IM$(7) = "GHEEPAEZGHEPGHE5GHE5GHEPGHE5GHEPGHE5GHE9ETGHE9ETGHEXEHGHE9ETGHHA"
-IM$(8) = "Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QP"
+IM$(8) = "E9ESGHEPEPGBBAGEE9EMHOE9ETGHEHE9E7HUE9E6E9E4H0E9E3E9E3H2E9EHBAET"
-IM$(9) = "RBRQ9QOKMQHK5RBSQ9QTI9IRRBXQ9QTKPQHKHQPKERBYQ9QPI9IHRB3Q9QSKAI5KHIJRB5Q9QTC9CMRB9Q9QWI9IGRCBQ9QYC9CCRCIA9A9A9A9APRCJE9E9E9E9EPRCNA9A9A9A9APRCOE9E9E9E9EPRCUA9A9A9A9APRCVE9E9E9E9EPRC5A9A9A9A9APRC7E9E9E9E9EP"
+IM$(9) = "EHKHE9ELH6E9ECKHEPEPKHE9EBH9HAE9EIKHEHEXKHE2H9HCE9EPKHE5KHEPKDH9"
-IM$(10) = "RBQQ9QOK9KIQHKFRBRQ9QOI9IQRBWQ9QPKLQHKHQHKPRBXQ9QTI9QLIERB2Q9QRIBKHIPKHIPKCRB4Q9QSC9CORB8Q9QVI3KHIGRCAQ9QXC9CERCJA9A9A9A9APRCKE9E9E9E9EPRCOA9A9A9A9APRCPE9E9E9E9EPRCVA9A9A9A9APRCXE9E9E9E9EPRC7A9A9A9A9APRDAE9E9E9E9EP"
+IM$(10) = "HEKCEPKHE5KHE5KHEKH9HGEBKHEPKHEXEHKHE5KHEBH9HIEIKHEPKHEPEPKHEPKH"
-IM$(11) = "RBPQ9QOK9KAQHKNRBQQ9QOI9IWRBVQ9QOKEQHKHQHKPQHKFRBWQ9QPI9IPRB1Q9QQKCIPKHIPKHIDRB3Q9QSC9CORB7Q9QUIWKHIPRB9Q9QWC9CGRCEA9A9A9A9APRCFE9E9E9E9EPRCGA9A9A9A9APRCHE9E9E9E9EPRCPA9A9A9A9APRCQE9E9E9E9EPRCXA9A9A9A9APRCZE9E9E9E9EPRDAA9A9A9A9APRDCE9E9E9E9"
+IM$(11) = "EHKAH9HKKHEHKHEPKHEHKHEPKHEPKHH9HMEGKHEHKHEPKHEHKHEPKHEPH9HMEOKH"
-IM$(12) = "EP"
+IM$(12) = "EHKHEPKHEHKPEHKHEGH9HOKFEPKHEHKPEHKHEHKPEHKGH9HOEFKHEPKHEHKHEPKH"
-IM$(13) = "RBOQ9QNK3QHKWRBPQ9QOI9IWRBUQ9QTKHQHKPQHKNRBVQ9QOI9IWRB0Q9QQIKKHIPKHIHKDRB1Q9QQC9CSRB2Q9QRC9CQRB6Q9QTIPKHIYRB8Q9QVC9CIRCKA9A9A9A9APRCLE9E9E9E9EPRCQA9A9A9A9APRCRE9E9E9E9EPRCZA9A9A9A9APRC1E9E9E9E9EPRDCA9A9A9A9APRDFE9E9E9E9EP"
+IM$(13) = "EHKPEFH9HQKEEHKHEPKHEHKHEPKHEHKMH9HSKLEHKHEPKHEHKPEHKHEHKEH9HSED"
-IM$(14) = "RBOQ9QNI9IYRBTQ9QOKEQHKPQHKVRBUQ9QTI9IRRBZQ9QTKHQHKPQHKHRB0Q9QQC9CSRB5Q9QTIHKHI5KARB7Q9QUC9CKRCBQ9QYI9ICRCHA9A9A9A9APRCIE9E9E9E9EPRCLA9A9A9A9APRCME9E9E9E9EPRCRA9A9A9A9APRCTE9E9E9E9EPRC1A9A9A9A9APRC3E9E9E9E9EPRDFA9A9A9A9APRDIE9E9E9E9EP"
+IM$(14) = "KPEHKPEHKHEHKPEHKHEEH9HSKDEHKPEHKPKPEHKPEHKDH9HUECKHEHKPEHKHKXEH"
-IM$(15) = "RBSQ9QTKPQHK3RBTQ9QOI9IWRBYQ9QPKDQHKPQHKHRBZQ9QTI9ILRB4Q9QSIAKHI5KHIBRB6Q9QTC9CMRCAQ9QXI9IERCEE9E9E9E9EPRCFA9A9A9A9APRCGE9E9E9E9EPRCMA9A9A9A9APRCNE9E9E9E9EPRCTA9A9A9A9APRCUE9E9E9E9EPRC3A9A9A9A9APRC5E9E9E9E9EPRDIA9A9A9A9AP"
+IM$(15) = "KPEDH9HUKCEHK5EHK5EHKLH9HUKKEHK5EHK5EHKCH9HWEBKPEHKXKHEHK8I9IWKZ"
+IM$(16) = "EHKPKPEHK0I9IWK7EHKHKXEHKSI9IWK9KFEHK9KOI9IWK9KNK9KOI9IWK9KNK9KO"
+IM$(17) = "I9IWK9KNKPIHKZI9IYK6IHKHKXIHKSI9IWK9KFIHK5IHKKI9IWK9KNIHK5IHKCI9"
+IM$(18) = "IYKPIHKXKHIHK5IHKPIHK5IHKPIHKPKPIHK0I9IWKJIHKPIHKHIHKPIHKPI9IZKB"
+IM$(19) = "IHKHIHKPIHKHIHKPIHKKI9IWKJIHKHIHKPIHKHIHKPIHKDI9IXKPIHKHIHKHKHIH"
+IM$(20) = "KHIPKHI9IYKCIHKPIHKHIHKPIHKHIPKHIHKPIHKHIPKHIHKPIHKHIHKPIHKHI9I9"
+IM$(21) = "IHKHIHKPIHKHIPKHIHKHIEC9CSKDIPKHIPKHIHKHIPKHIHKEC9CSIDKHIPKHIPIP"
+IM$(22) = "KHIPKHIFC9CQKEIHKHIPKHIHIXKHIPKGC9COIFKHI5KHI5KHIPKHI5KHIPKHI5KH"
+IM$(23) = "I5KHIPKHI5KHIPKHIXIHKHI9IDC9CMI4KHIPIPKHI6C9CKI9IDKHIHIXKHIZC9CI"
+IM$(24) = "I9IMKHI9IWC9CGI9IVI9I9I9I9IPI9I9I9I9IPQ9Q9Q9Q9QPE9E9E9E9EPE9E9E9"
+IM$(25) = "E9EPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QP"
+IM$(26) = "Q9Q9Q9Q9QPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9"
+IM$(27) = "Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9"
+IM$(28) = "QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9"
+IM$(29) = "Q9Q9Q9QPE9E9E9E9EPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9"
+IM$(30) = "Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QP"
+IM$(31) = "Q9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QPQ9Q9Q9Q9QP"
+IM$(32) = "RBRQ9QOKMQHK5RBSQ9QTI9IRRBXQ9QTKPQHKHQPKERBYQ9QPI9IHRB3Q9QSKAI5"
+IM$(33) = "KHIJRB5Q9QTC9CMRB9Q9QWI9IGRCBQ9QYC9CCRCIA9A9A9A9APRCJE9E9E9E9EP"
+IM$(34) = "RCNA9A9A9A9APRCOE9E9E9E9EPRCUA9A9A9A9APRCVE9E9E9E9EPRC5A9A9A9A9"
+IM$(35) = "APRC7E9E9E9E9EP"
+IM$(36) = "RBQQ9QOK9KIQHKFRBRQ9QOI9IQRBWQ9QPKLQHKHQHKPRBXQ9QTI9QLIERB2Q9QR"
+IM$(37) = "IBKHIPKHIPKCRB4Q9QSC9CORB8Q9QVI3KHIGRCAQ9QXC9CERCJA9A9A9A9APRCK"
+IM$(38) = "E9E9E9E9EPRCOA9A9A9A9APRCPE9E9E9E9EPRCVA9A9A9A9APRCXE9E9E9E9EP"
+IM$(39) = "RC7A9A9A9A9APRDAE9E9E9E9EP"
+IM$(40) = "RBPQ9QOK9KAQHKNRBQQ9QOI9IWRBVQ9QOKEQHKHQHKPQHKFRBWQ9QPI9IPRB1Q9"
+IM$(41) = "QQKCIPKHIPKHIDRB3Q9QSC9CORB7Q9QUIWKHIPRB9Q9QWC9CGRCEA9A9A9A9AP"
+IM$(42) = "RCFE9E9E9E9EPRCGA9A9A9A9APRCHE9E9E9E9EPRCPA9A9A9A9APRCQE9E9E9E9"
+IM$(43) = "EPRCXA9A9A9A9APRCZE9E9E9E9EPRDAA9A9A9A9APRDCE9E9E9E9EP"
+IM$(44) = "RBOQ9QNK3QHKWRBPQ9QOI9IWRBUQ9QTKHQHKPQHKNRBVQ9QOI9IWRB0Q9QQIKKH"
+IM$(45) = "IPKHIHKDRB1Q9QQC9CSRB2Q9QRC9CQRB6Q9QTIPKHIYRB8Q9QVC9CIRCKA9A9A9"
+IM$(46) = "A9APRCLE9E9E9E9EPRCQA9A9A9A9APRCRE9E9E9E9EPRCZA9A9A9A9APRC1E9E9"
+IM$(47) = "E9E9EPRDCA9A9A9A9APRDFE9E9E9E9EP"
+IM$(48) = "RBOQ9QNI9IYRBTQ9QOKEQHKPQHKVRBUQ9QTI9IRRBZQ9QTKHQHKPQHKHRB0Q9QQ"
+IM$(49) = "C9CSRB5Q9QTIHKHI5KARB7Q9QUC9CKRCBQ9QYI9ICRCHA9A9A9A9APRCIE9E9E9"
+IM$(50) = "E9EPRCLA9A9A9A9APRCME9E9E9E9EPRCRA9A9A9A9APRCTE9E9E9E9EPRC1A9A9"
+IM$(51) = "A9A9APRC3E9E9E9E9EPRDFA9A9A9A9APRDIE9E9E9E9EP"
+IM$(52) = "RBSQ9QTKPQHK3RBTQ9QOI9IWRBYQ9QPKDQHKPQHKHRBZQ9QTI9ILRB4Q9QSIAKH"
+IM$(53) = "I5KHIBRB6Q9QTC9CMRCAQ9QXI9IERCEE9E9E9E9EPRCFA9A9A9A9APRCGE9E9E9"
+IM$(54) = "E9EPRCMA9A9A9A9APRCNE9E9E9E9EPRCTA9A9A9A9APRCUE9E9E9E9EPRC3A9A9"
+IM$(55) = "A9A9APRC5E9E9E9E9EPRDIA9A9A9A9AP"
 REM  ---- PICTURE-END
 SS# = 0
 SE# = NS# - 1
@@ -1317,13 +1357,25 @@ TB# = TB# + 1
 IF TB# > 2 THEN TB# = 0
 RETURN
 
+REM  A batch is four PLAY statements, one bar each: the parser's V, T,
+REM  U and duration state persists across statements and every PLAY
+REM  appends to the same queue, so four bars queue exactly as one long
+REM  string would -- which the 80-column line limit no longer allows.
+REM  Each bar restates the prefix anyway, so a bar dropped by QFULL
+REM  never leaves the next one playing with drum-kit state.
 LABEL TUNEA
-PLAY "V1T3U9S O1AO2AO3AO2AO3AO4CEAO1AO2AO4CEAO5CO4AE O1FO2FO3FO2FO3FAO4CFO1FO2FO3AO4CFAO5CO4A O1CO2CO3CO2CO3CEGO4CO1CO2CO3EGO4CEGO5C O1GO2GO3GO2GO3GBO4DGO1GO2GO3BO4DGBO5DO4B"
+PLAY "V1T3U9S O1AO2AO3AO2AO3AO4CEAO1AO2AO4CEAO5CO4AE"
+PLAY "V1T3U9S O1FO2FO3FO2FO3FAO4CFO1FO2FO3AO4CFAO5CO4A"
+PLAY "V1T3U9S O1CO2CO3CO2CO3CEGO4CO1CO2CO3EGO4CEGO5C"
+PLAY "V1T3U9S O1GO2GO3GO2GO3GBO4DGO1GO2GO3BO4DGBO5DO4B"
 MT# = TI# + 270
 RETURN
 
 LABEL TUNEB
-PLAY "V1T3U9S O1AO2AO3AO2AO3AO4CEAO1AO2AO4CEAO5CEO4A O1FO2FO3FO2FO3FAO4CFO1FO2FO3AO4CFAO5CO4A O1DO2DO3DO2DO3DFAO4DO1DO2DO3FAO4DFAO5D O1EO2EO3EO2EO3E#GBO4EO1EO2EO3#GBO4E#GBO5E"
+PLAY "V1T3U9S O1AO2AO3AO2AO3AO4CEAO1AO2AO4CEAO5CEO4A"
+PLAY "V1T3U9S O1FO2FO3FO2FO3FAO4CFO1FO2FO3AO4CFAO5CO4A"
+PLAY "V1T3U9S O1DO2DO3DO2DO3DFAO4DO1DO2DO3FAO4DFAO5D"
+PLAY "V1T3U9S O1EO2EO3EO2EO3E#GBO4EO1EO2EO3#GBO4E#GBO5E"
 MT# = TI# + 270
 RETURN
 

examples/megademo/vaporwave.py

@@ -58,7 +58,14 @@ SKIP = "Q"
 ROWREC = "R"
 LENCH = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 MAXRUN = len(LENCH)
-PAYLOAD = 240
+
+# The interpreter reads source through an 80-byte line buffer and refuses
+# any line that fills it (AKBASIC_MAX_LINE_LENGTH, sink_stdio.c), so a
+# stored line is at most 78 characters plus its newline. 'IM$(NN) = "' and
+# the closing quote spend 12 of those; 64 keeps the emitted lines under
+# the ceiling with margin to spare while the index stays two digits.
+PAYLOAD = 64
+MAXLINE = 78
 
 SUN_CX, SUN_CY, SUN_R = 80, 50, 30
 HORIZON = 74
@@ -206,13 +213,32 @@ def encode_delta(prev, cur):
 
 
 def chop(blob):
-    return [blob[i:i + PAYLOAD] for i in range(0, len(blob), PAYLOAD)]
+    """Split a stream into strings of at most PAYLOAD characters, cutting
+    only between records. The decoder reads a record's tail characters
+    with MID on the string it is walking, so a run (two characters) or a
+    row record (three) that straddled two IM$ entries would decode as
+    garbage; DRAWSTREAM only carries the cursor, never a partial record."""
+    out, cur = [], ""
+    p = 0
+    while p < len(blob):
+        n = 3 if blob[p] == ROWREC else 2
+        if len(cur) + n > PAYLOAD:
+            out.append(cur)
+            cur = ""
+        cur += blob[p:p + n]
+        p += n
+    if cur:
+        out.append(cur)
+    return out
 
 
-def simulate(raster, blob):
+def simulate(raster, blob, x=0, y=0):
     """Apply one encoded stream to a raster exactly the way the BASIC
-    decoder does, skips-draw-nothing and all."""
+    decoder does, skips-draw-nothing and all. The cursor comes in and
-    x = y = p = 0
+    goes back out because DRAWSTREAM carries it from one IM$ entry to
+    the next -- decoding the chopped strings one at a time with the
+    cursor threaded through is exactly what the demo will execute."""
+    p = 0
     while p < len(blob):
         c = blob[p]
         if c == ROWREC:
@@ -230,20 +256,31 @@ def simulate(raster, blob):
             x = 0
             y += 1
         p += 2
+    return raster, x, y
+
+
+def simulate_lines(raster, lines):
+    """One stream as its chopped strings, cursor carried across the
+    boundaries the way DRAWSTREAM carries X# and Y#."""
+    x = y = 0
+    for line in lines:
+        raster, x, y = simulate(raster, line, x, y)
     return raster
 
 
-def verify(frames, base_blob, delta_blobs):
+def verify(frames, base_lines, delta_line_groups):
     """The base must reproduce frame 0 exactly, and each delta must
     carry the raster exactly to the next frame. A skip leaves the cell
     the encoder promised was already right, so equality is total and
-    any difference at all is an encoder bug."""
+    any difference at all is an encoder bug. This decodes the CHOPPED
+    strings, not the blobs, so a chop that split a record would fail
+    here instead of corrupting the screen."""
     raster = [[1] * W for _ in range(H)]
-    raster = simulate(raster, base_blob)
+    raster = simulate_lines(raster, base_lines)
     assert raster == frames[0], "base stream does not reproduce frame 0"
-    for i, blob in enumerate(delta_blobs):
+    for i, lines in enumerate(delta_line_groups):
         want = frames[(i + 1) % PHASES]
-        raster = simulate(raster, blob)
+        raster = simulate_lines(raster, lines)
         assert raster == want, "delta %d does not reproduce its frame" % i
 
 
@@ -261,6 +298,9 @@ def emit_block(base_lines, delta_ranges, all_lines):
     for i, s in enumerate(all_lines):
         out.append('IM$(%d) = "%s"' % (i, s))
     out.append("REM  ---- PICTURE-END")
+    for line in out:
+        assert len(line) <= MAXLINE, "emitted line over %d chars: %r" % (
+            MAXLINE, line)
     return out
 
 
@@ -303,15 +343,15 @@ def main():
     base_lines = chop(base_blob)
     all_lines = list(base_lines)
     delta_ranges = []
-    delta_blobs = []
+    delta_line_groups = []
     for i in range(PHASES):
         blob = encode_delta(frames[i], frames[(i + 1) % PHASES])
-        delta_blobs.append(blob)
         lines = chop(blob)
+        delta_line_groups.append(lines)
         delta_ranges.append((len(all_lines), len(all_lines) + len(lines) - 1))
         all_lines.extend(lines)
-    verify(frames, base_blob, delta_blobs)
+    verify(frames, base_lines, delta_line_groups)
-    dbytes = sum(len(b) for b in delta_blobs)
+    dbytes = sum(len(l) for g in delta_line_groups for l in g)
     print("base %d bytes in %d strings; video %d bytes in %d strings; "
           "%d strings total" %
           (sum(len(s) for s in base_lines), len(base_lines), dbytes,

include/akbasic/runtime.h

@@ -211,8 +211,12 @@ typedef struct akbasic_Runtime
      * not exist relative to the working directory, which is what makes a `.bas`
      * beside its art work from anywhere. Group F's disk verbs will want the
      * same, which is why it is on the runtime rather than in the sprite state.
+     *
+     * Sized to AKBASIC_MAX_SOURCE_PATH_LENGTH, not AKBASIC_MAX_LINE_LENGTH: a
+     * directory is a filesystem path, not a line of BASIC, and the two do not
+     * belong to the same budget.
      */
-    char sourcepath[AKBASIC_MAX_LINE_LENGTH];
+    char sourcepath[AKBASIC_MAX_SOURCE_PATH_LENGTH];
 
     /*
      * The armed interrupts, and the environment the one currently running was
@@ -365,7 +369,7 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_set_ui(akbasic_Runtime *obj,
  * @param path Path to the program file, or NULL for none.
  * @return `NULL` on success, otherwise an error context owned by the caller.
  * @throws AKERR_NULLPOINTER When `obj` is NULL.
- * @throws AKBASIC_ERR_BOUNDS When the path is longer than AKBASIC_MAX_LINE_LENGTH.
+ * @throws AKBASIC_ERR_BOUNDS When the path is longer than AKBASIC_MAX_SOURCE_PATH_LENGTH.
  */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_set_source_path(akbasic_Runtime *obj, const char *path);
 
@@ -628,6 +632,27 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_println(akbasic_Runtime *obj,
  */
 akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_set_mode(akbasic_Runtime *obj, int mode);
 
+/**
+ * @brief Forgive the last BASIC-level error, so a host may call again.
+ *
+ * A program run latches its first runtime error and ends -- deliberately, and
+ * a host cannot un-decide that with akbasic_runtime_set_mode() alone: the
+ * latch survives the mode change, every later line is skipped, and every
+ * later akbasic_runtime_call_function() answers a stale value after walking
+ * the whole source table doing nothing.
+ *
+ * A host that absorbed a script error -- reported through the sink, actor
+ * marked dumb, frame preserved -- calls this beside
+ * `akbasic_runtime_set_mode(obj, AKBASIC_MODE_RUN)` to put the runtime back
+ * in service. It is for hosts between calls, not for verbs during a run: a
+ * running program's first error still ends it, exactly once, with one line.
+ *
+ * @param obj Object to initialize, inspect, or modify.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKERR_NULLPOINTER When `obj` is NULL.
+ */
+akerr_ErrorContext AKERR_NOIGNORE *akbasic_runtime_clear_error(akbasic_Runtime *obj);
+
 /**
  * @brief Evaluate one AST leaf, drawing scratch values from the environment.
  * @param obj Object to initialize, inspect, or modify.

include/akbasic/symtab.h

@@ -23,9 +23,17 @@
  * serves variables, functions and labels. Capacity is a member; the table is
  * kept below a 75% load factor by construction because `capacity` counts slots
  * and the caller's logical maximum is smaller.
+ *
+ * 172 rather than the old 256: no caller passes akbasic_symtab_init() anything
+ * larger than AKBASIC_MAX_VARIABLES (128), and 172 keeps that under the 75%
+ * load factor the comment above promises (128 / 0.75 = 170.7).
+ *
+ * AKBASIC_SYMTAB_MAX_KEY 24 rather than 64: the longest identifier across
+ * examples/breakout and examples/megademo -- variables, DIMmed arrays, labels
+ * and DEF FN names alike -- is 11 characters (TITLESCREEN, CLEARPOWERS).
  */
-#define AKBASIC_SYMTAB_MAX_SLOTS	256
+#define AKBASIC_SYMTAB_MAX_SLOTS	172
-#define AKBASIC_SYMTAB_MAX_KEY		64
+#define AKBASIC_SYMTAB_MAX_KEY		24
 
 typedef struct
 {

include/akbasic/types.h

@@ -6,6 +6,7 @@
 #ifndef _AKBASIC_TYPES_H_
 #define _AKBASIC_TYPES_H_
 
+#include <limits.h>
 #include <stdbool.h>
 #include <stdint.h>
 
@@ -27,15 +28,39 @@
 #define AKBASIC_MAX_VALUES		64
 #define AKBASIC_MAX_VARIABLES		128
 
-/* Whole-runtime pools */
+/*
-#define AKBASIC_MAX_SOURCE_LINES	9999
+ * Whole-runtime pools.
-#define AKBASIC_MAX_LINE_LENGTH		256
+ *
+ * AKBASIC_MAX_SOURCE_LINES, AKBASIC_MAX_LINE_LENGTH, AKBASIC_MAX_ARRAY_VALUES,
+ * AKBASIC_MAX_ENVIRONMENTS and AKBASIC_MAX_FUNCTIONS were cut from their
+ * original values against measurements taken off examples/breakout and
+ * examples/megademo, the two most demanding programs this interpreter runs --
+ * see the memory-footprint discussion this commit's PR body links. Each is
+ * sized at roughly 1.5-2x the peak the reference corpus actually reaches, not
+ * at the peak itself.
+ *
+ * AKBASIC_MAX_LINE_LENGTH in particular follows Commodore BASIC's own 80-column
+ * line limit rather than a measurement, which is why sink_stdio.c now refuses a
+ * line that fills the buffer with no terminator instead of silently truncating
+ * it: at 256 bytes that failure mode was theoretical, and at 80 it is not.
+ *
+ * AKBASIC_MAX_SOURCE_PATH_LENGTH is its own constant rather than a reuse of
+ * AKBASIC_MAX_LINE_LENGTH, which is where it used to come from. `sourcepath`
+ * (runtime.h) holds a directory, not a line of BASIC, and the two ideas do not
+ * scale together: shrinking the line limit to 80 broke every golden test in
+ * this checkout, because this repository's own working directory is deeper
+ * than that. PATH_MAX is the actual bound a filesystem path is subject to, so
+ * it is the one this borrows.
+ */
+#define AKBASIC_MAX_SOURCE_LINES	2048
+#define AKBASIC_MAX_LINE_LENGTH		80	/* Commodore BASIC's own line limit */
+#define AKBASIC_MAX_SOURCE_PATH_LENGTH	PATH_MAX
 #define AKBASIC_MAX_ARRAY_DEPTH		64	/* dimensions per array */
 #define AKBASIC_MAX_ARRAY_ELEMENTS	1024	/* elements in one array */
-#define AKBASIC_MAX_ARRAY_VALUES	4096	/* array elements across all variables */
+#define AKBASIC_MAX_ARRAY_VALUES	2048	/* array elements across all variables */
 #define AKBASIC_MAX_STRING_LENGTH	256	/* see TODO.md 1.2 */
-#define AKBASIC_MAX_ENVIRONMENTS	32	/* new: Go allocated these unbounded */
+#define AKBASIC_MAX_ENVIRONMENTS	12	/* new: Go allocated these unbounded */
-#define AKBASIC_MAX_FUNCTIONS		64	/* new: Go used an unbounded map */
+#define AKBASIC_MAX_FUNCTIONS		8	/* new: Go used an unbounded map */
 #define AKBASIC_MAX_LABELS		64	/* new: Go used an unbounded map */
 /*
  * Leaves a DO/LOOP condition may use. Its own small pool rather than a second

include/akbasic/variable.h

@@ -13,12 +13,22 @@
 
 #include <akerror.h>
 
+#include <akbasic/symtab.h>
 #include <akbasic/types.h>
 #include <akbasic/value.h>
 
 typedef struct
 {
-    char name[AKBASIC_MAX_STRING_LENGTH];
+    /*
+     * Sized to AKBASIC_SYMTAB_MAX_KEY, not AKBASIC_MAX_STRING_LENGTH: this name
+     * only ever gets here by surviving akbasic_symtab_set() first
+     * (akbasic_environment_create() calls it right after this field is
+     * populated), and that call refuses anything AKBASIC_SYMTAB_MAX_KEY
+     * characters or longer with AKBASIC_ERR_BOUNDS. A variable whose name did
+     * not fit could never exist, so the wider buffer was 232 bytes of headroom
+     * nothing could ever put a byte into.
+     */
+    char name[AKBASIC_SYMTAB_MAX_KEY];
     akbasic_Type valuetype;
     akbasic_Value *values;			/** The pool, or `inlinevalue` for a scalar */
     int valuecount;

scripts/mutation_test.py

@@ -282,8 +282,9 @@ def copy_tree(src, dst):
     # and a coverage tree drags along every .gcno/.gcda as well.
     #
     # deps/ is copied wholesale and has to be: the build pulls libakerror and
-    # libakstdlib in with add_subdirectory. The language corpus is the other
+    # libakstdlib in with add_subdirectory. The golden corpus used to be the
-    # reason it comes along with the rest of the tree.
+    # other reason -- it was driven in place out of deps/basicinterpret -- and
+    # now lives in tests/reference/, which comes along with the rest of the tree.
     # Only vendored Windows DLLs are dead weight, hence "*.dll".
     #
     # **PNGs are ours or theirs, and the difference matters.** This used to drop

src/runtime.c

@@ -301,7 +301,7 @@ akerr_ErrorContext *akbasic_runtime_set_source_path(akbasic_Runtime *obj, const
     }
     FAIL_ZERO_RETURN(errctx, (length < sizeof(obj->sourcepath)), AKBASIC_ERR_BOUNDS,
 		     "Program path of %zu characters exceeds the %d character limit",
-		     length, AKBASIC_MAX_LINE_LENGTH - 1);
+		     length, AKBASIC_MAX_SOURCE_PATH_LENGTH - 1);
     PASS(errctx, aksl_memcpy(obj->sourcepath, path, length));
     obj->sourcepath[length] = '\0';
     SUCCEED_RETURN(errctx);
@@ -893,7 +893,7 @@ akerr_ErrorContext *akbasic_runtime_interpret(akbasic_Runtime *obj, akbasic_ASTL
 	     *
 	     * **Only a block skip**, which is what the `BEND` test is for. A
 	     * zero-iteration `FOR` skips its body the same way, and there the
-	     * orphan is load-bearing: `tests/language/.../nestedforloopwaiting
+	     * orphan is load-bearing: `tests/reference/.../nestedforloopwaiting
 	     * forcommand.bas` nests a loop inside one that runs zero times, and
 	     * the inner scope is what absorbs the inner `NEXT` so the outer `NEXT`
 	     * still finds its `FOR`. Popping it there turns that case into "NEXT
@@ -1114,9 +1114,33 @@ akerr_ErrorContext *akbasic_runtime_call_function(akbasic_Runtime *obj, const ch
      * answering wrongly -- which is worse. The fix wants the REPL's own line
      * cycle, and that is a larger change than a condition.
      */
-    while ( obj->environment != targetenv && obj->mode == AKBASIC_MODE_RUN ) {
+    ATTEMPT {
-	PASS(errctx, akbasic_runtime_process_line_run(obj));
+	while ( obj->environment != targetenv && obj->mode == AKBASIC_MODE_RUN ) {
-    }
+	    /*
+	     * The same per-line prologue akbasic_runtime_step() runs. Without
+	     * it the call environment's value scratch accumulates across the
+	     * whole body, and a body of ten real lines dies with "Maximum
+	     * values per line reached" -- a limit that is supposed to be per
+	     * line, not per call. step() cannot do this for us: this loop
+	     * drives process_line_run() directly.
+	     */
+	    CATCH(errctx, akbasic_runtime_zero(obj));
+	    CATCH(errctx, akbasic_scanner_zero(obj));
+	    CATCH(errctx, akbasic_runtime_process_line_run(obj));
+	}
+    } CLEANUP {
+	/*
+	 * A body that died mid-line -- a runtime error set run_finished_mode,
+	 * or a scanner error escaped (issue #4) -- left its scopes active.
+	 * Give them back, or a host absorbing script errors drains the
+	 * twelve-slot environment pool after twelve dead calls and every
+	 * call after that fails for a reason nobody can see in the script.
+	 */
+	while ( obj->environment != targetenv && obj->environment->parent != NULL ) {
+	    IGNORE(akbasic_runtime_prev_environment(obj));
+	}
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
     PASS(errctx, akbasic_environment_new_value(targetenv, &out));
     PASS(errctx, akbasic_value_clone(&targetenv->returnValue, out));
     *dest = out;
@@ -1262,7 +1286,7 @@ akerr_ErrorContext *akbasic_runtime_process_line_runstream(akbasic_Runtime *obj)
      * This mode used to file it like any other, under the cursor -- which for a
      * blank line is the number of the line *before* it. A file ending in a blank
      * line therefore had its last line erased before it ever ran, silently. The
-     * reference did the same, and `tests/language/arithmetic/integer.bas`
+     * reference did the same, and `tests/reference/language/arithmetic/integer.bas`
      * has an expectation with three values for four PRINT statements to prove it.
      */
     if ( buffer[0] == '\0' ) {
@@ -1918,6 +1942,15 @@ akerr_ErrorContext *akbasic_runtime_step(akbasic_Runtime *obj)
     SUCCEED_RETURN(errctx);
 }
 
+akerr_ErrorContext *akbasic_runtime_clear_error(akbasic_Runtime *obj)
+{
+    PREPARE_ERROR(errctx);
+
+    FAIL_ZERO_RETURN(errctx, (obj != NULL), AKERR_NULLPOINTER, "NULL runtime in clear_error");
+    obj->errclass = AKBASIC_ERRCLASS_NONE;
+    SUCCEED_RETURN(errctx);
+}
+
 akerr_ErrorContext *akbasic_runtime_run(akbasic_Runtime *obj, int maxsteps)
 {
     PREPARE_ERROR(errctx);

src/scanner.c

@@ -23,6 +23,7 @@ akerr_ErrorContext *akbasic_scanner_zero(akbasic_Runtime *obj)
     obj->current = 0;
     obj->start = 0;
     obj->hasError = false;
+    obj->tokentype = AKBASIC_TOK_UNDEFINED;
     SUCCEED_RETURN(errctx);
 }
 
@@ -409,6 +410,16 @@ akerr_ErrorContext *akbasic_scanner_scan(akbasic_Runtime *obj, const char *line,
     obj->current = 0;
     obj->start = 0;
     obj->hasError = false;
+    /*
+     * The `REM` early-exit below leaves `tokentype` holding AKBASIC_TOK_REM,
+     * and the loop's post-switch check reads it before the first character of
+     * the *next* line has assigned anything. A line whose first character
+     * carries no token of its own -- leading whitespace -- then re-triggered
+     * the REM break and scanned to nothing: every indented line after a REM
+     * was silently skipped. A numbered program never saw it, because the line
+     * number is the first token and overwrites the leftover.
+     */
+    obj->tokentype = AKBASIC_TOK_UNDEFINED;
     /*
      * Cleared here rather than by each caller, so the flag always describes the
      * line this call just scanned. It used to be cleared only in

src/sink_stdio.c

@@ -74,6 +74,19 @@ static akerr_ErrorContext *stdio_readline(akbasic_TextSink *self, char *dest, si
     if ( *eof ) {
 	SUCCEED_RETURN(errctx);
     }
+    /*
+     * aksl_fgets(3)'s own contract: a full buffer with no trailing newline is
+     * how a caller spots a line longer than the buffer, because the rest of it
+     * is still sitting unread in the stream. Refusing here is what makes that
+     * true -- without it, the unread remainder is picked up by the *next*
+     * readline() as if it were its own statement, which does not fail, it just
+     * runs the wrong program. AKBASIC_MAX_LINE_LENGTH is small enough now that
+     * this is not a hypothetical: examples/breakout's own longest line used to
+     * clear the old 256-byte ceiling by more than half.
+     */
+    FAIL_NONZERO_RETURN(errctx, (used == len - 1 && dest[used - 1] != '\n' && dest[used - 1] != '\r'),
+			AKBASIC_ERR_BOUNDS,
+			"Source line exceeds the %zu character limit", len - 1);
     /*
      * Strip the line terminator. The scanner treats \r and \n as end-of-line
      * anyway, but leaving them on would make a stored source line differ from

tests/docs_preludes/galagacalls.post

@@ -0,0 +1,10 @@
+    } CLEANUP {
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    (void)SCRIPT; (void)SINK; (void)SINKSTATE; (void)SOURCE;
+    (void)args; (void)argp; (void)dtval; (void)result;
+    (void)enemy; (void)actor; (void)dt;
+    (void)SCRATCH_ENEMY; (void)SCRATCH_ACTOR; (void)galaga_shared;
+    (void)ENEMY_TYPE; (void)ACTOR_TYPE; (void)GAME_TYPE;
+    SUCCEED_RETURN(errctx);
+}

tests/docs_preludes/galagacalls.pre

@@ -0,0 +1,84 @@
+/*
+ * Prelude for the interpreter-facing fragments in docs/20: the boot sequence,
+ * the ADDEM proof and the rebind-call-reset protocol, shown as runs of CATCH
+ * calls. The statics are the ones examples/galaga/script.c keeps; the locals
+ * are the superset every fragment draws from, void-cast in the postlude so an
+ * unused one is not a warning.
+ */
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+
+#include <akbasic/environment.h>
+#include <akbasic/error.h>
+#include <akbasic/host.h>
+#include <akbasic/runtime.h>
+#include <akbasic/sink.h>
+
+typedef struct galaga_docs_Enemy
+{
+    int32_t  kind;
+    int32_t  state;
+    float    homex;
+    float    homey;
+    float    t;
+    int32_t  hp;
+    int32_t  fire;
+    float    rnd;
+} galaga_docs_Enemy;
+
+typedef struct galaga_docs_Shared
+{
+    float    playerx;
+    float    playery;
+    int32_t  wave;
+    float    rnd;
+} galaga_docs_Shared;
+
+static akbasic_Runtime SCRIPT;
+static akbasic_TextSink SINK;
+static akbasic_StdioSink SINKSTATE;
+static char SOURCE[16384];
+
+static galaga_docs_Enemy SCRATCH_ENEMY;
+static akgl_Actor SCRATCH_ACTOR;
+static galaga_docs_Shared galaga_shared;
+
+static const akbasic_HostField ENEMY_FIELDS[] = {
+    AKBASIC_HOST_FIELD( galaga_docs_Enemy, kind, "KIND#", AKBASIC_HOSTFIELD_INT32 )
+};
+static const akbasic_HostType ENEMY_TYPE = {
+    "ENEMY", sizeof(galaga_docs_Enemy), ENEMY_FIELDS, 1
+};
+static const akbasic_HostField ACTOR_FIELDS[] = {
+    AKBASIC_HOST_FIELD( akgl_Actor, x, "X%", AKBASIC_HOSTFIELD_FLOAT )
+};
+static const akbasic_HostType ACTOR_TYPE = {
+    "ACTOR", sizeof(akgl_Actor), ACTOR_FIELDS, 1
+};
+static const akbasic_HostField GAME_FIELDS[] = {
+    AKBASIC_HOST_FIELD( galaga_docs_Shared, wave, "WAVE#", AKBASIC_HOSTFIELD_INT32 )
+};
+static const akbasic_HostType GAME_TYPE = {
+    "GAME", sizeof(galaga_docs_Shared), GAME_FIELDS, 1
+};
+
+akerr_ErrorContext AKERR_NOIGNORE *galaga_docs_fragment(galaga_docs_Enemy *enemy, akgl_Actor *actor, float dt);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_docs_fragment(galaga_docs_Enemy *enemy, akgl_Actor *actor, float dt)
+{
+    PREPARE_ERROR(errctx);
+    akbasic_Value args[2];
+    akbasic_Value *argp[2];
+    akbasic_Value dtval;
+    akbasic_Value *result = NULL;
+
+    ATTEMPT {

tests/docs_preludes/galagagame.pre

@@ -0,0 +1,121 @@
+/*
+ * Prelude for file-scope fragments in docs/20 and docs/21 that assume the
+ * galaga example's own declarations already exist -- the shared structures
+ * from examples/galaga/galaga.h and the helpers a fragment calls but does not
+ * define. The types are copied rather than included so a fragment compiles
+ * against exactly what the chapter has shown so far; the helper declarations
+ * are invented prototypes, per the prelude policy in MAINTENANCE.md.
+ */
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+#include <SDL3_ttf/SDL_ttf.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/character.h>
+#include <akgl/controller.h>
+#include <akgl/draw.h>
+#include <akgl/error.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+#include <akgl/physics.h>
+#include <akgl/registry.h>
+#include <akgl/renderer.h>
+#include <akgl/sprite.h>
+#include <akgl/text.h>
+#include <akgl/ui.h>
+#include <akgl/util.h>
+
+#include <akbasic/environment.h>
+#include <akbasic/error.h>
+#include <akbasic/host.h>
+#include <akbasic/runtime.h>
+#include <akbasic/sink.h>
+
+#define GALAGA_ENEMY_BEE	0
+#define GALAGA_ENEMY_BUTTERFLY	1
+#define GALAGA_ENEMY_BOSS	2
+#define GALAGA_ENEMY_KINDS	3
+#define GALAGA_MAX_ENEMIES	40
+#define GALAGA_MAX_PLAYER_SHOTS	2
+#define GALAGA_MAX_ENEMY_SHOTS	8
+#define GALAGA_ES_ENTERING	(1 << 0)
+#define GALAGA_ES_FORMATION	(1 << 1)
+#define GALAGA_ES_DIVING	(1 << 2)
+
+typedef struct galaga_Enemy
+{
+    int32_t  kind;
+    int32_t  state;
+    float    homex;
+    float    homey;
+    float    t;
+    int32_t  hp;
+    int32_t  fire;
+    float    rnd;
+} galaga_Enemy;
+
+typedef struct galaga_Shared
+{
+    float    playerx;
+    float    playery;
+    int32_t  wave;
+    float    rnd;
+} galaga_Shared;
+
+typedef enum
+{
+    GALAGA_SCREEN_TITLE = 0,
+    GALAGA_SCREEN_PLAY,
+    GALAGA_SCREEN_GAMEOVER,
+    GALAGA_SCREEN_VICTORY
+} galaga_Screen;
+
+typedef struct galaga_Game
+{
+    galaga_Screen screen;
+    int      frame;
+    float    dt;
+    bool     autoplay;
+    int      score;
+    int      lives;
+    int      kills[GALAGA_ENEMY_KINDS];
+    int      shots[GALAGA_ENEMY_KINDS];
+    int      script_errors;
+    akgl_Actor *player;
+    float    fire_cooldown;
+    float    respawn_timer;
+    bool     firing;
+    bool     moveleft;
+    bool     moveright;
+    int      player_shots_live;
+    int      enemy_shots_live;
+} galaga_Game;
+
+extern galaga_Game galaga_game;
+extern galaga_Shared galaga_shared;
+extern galaga_Enemy galaga_enemies[GALAGA_MAX_ENEMIES];
+extern akgl_Actor *galaga_enemy_actors[GALAGA_MAX_ENEMIES];
+
+float galaga_random(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_script_update_enemy(galaga_Enemy *enemy, akgl_Actor *actor, float dt);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_boom_spawn(float x, float y);
+akerr_ErrorContext AKERR_NOIGNORE *enemy_fire(galaga_Enemy *enemy, akgl_Actor *from);
+akerr_ErrorContext AKERR_NOIGNORE *kill_enemy(int index);
+akerr_ErrorContext AKERR_NOIGNORE *player_update(akgl_Actor *obj);
+akerr_ErrorContext AKERR_NOIGNORE *left_on(akgl_Actor *obj, SDL_Event *event);
+akerr_ErrorContext AKERR_NOIGNORE *left_off(akgl_Actor *obj, SDL_Event *event);
+akerr_ErrorContext AKERR_NOIGNORE *right_on(akgl_Actor *obj, SDL_Event *event);
+akerr_ErrorContext AKERR_NOIGNORE *right_off(akgl_Actor *obj, SDL_Event *event);
+akerr_ErrorContext AKERR_NOIGNORE *fire_on(akgl_Actor *obj, SDL_Event *event);
+akerr_ErrorContext AKERR_NOIGNORE *fire_off(akgl_Actor *obj, SDL_Event *event);
+void shot_box(akgl_Actor *actor, SDL_FRect *dest);
+void enemy_box(akgl_Actor *actor, SDL_FRect *dest);
+void player_box(akgl_Actor *actor, SDL_FRect *dest);

tests/docs_preludes/galagahost.post

@@ -0,0 +1,6 @@
+    } CLEANUP {
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    (void)event;
+    SUCCEED_RETURN(errctx);
+}

tests/docs_preludes/galagahost.pre

@@ -0,0 +1,55 @@
+/*
+ * Prelude for statement-context fragments in docs/20: runs of CATCH calls
+ * from the galaga frame loop, shown without their scaffolding because the
+ * ATTEMPT protocol is the scaffolding. Same policy as hostcalls.pre.
+ */
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+#include <SDL3_ttf/SDL_ttf.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/controller.h>
+#include <akgl/draw.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+#include <akgl/renderer.h>
+#include <akgl/ui.h>
+
+#include <akbasic/error.h>
+#include <akbasic/runtime.h>
+
+typedef enum
+{
+    GALAGA_SCREEN_TITLE = 0,
+    GALAGA_SCREEN_PLAY,
+    GALAGA_SCREEN_GAMEOVER,
+    GALAGA_SCREEN_VICTORY
+} galaga_Screen;
+
+struct galaga_docs_Game
+{
+    galaga_Screen screen;
+    float dt;
+    akgl_Actor *player;
+};
+extern struct galaga_docs_Game galaga_game;
+extern akgl_Actor *galaga_enemy_actors[40];
+
+akerr_ErrorContext AKERR_NOIGNORE *declare_title(void);
+akerr_ErrorContext AKERR_NOIGNORE *declare_play(void);
+akerr_ErrorContext AKERR_NOIGNORE *declare_end(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_docs_fragment(void);
+akerr_ErrorContext AKERR_NOIGNORE *galaga_docs_fragment(void)
+{
+    PREPARE_ERROR(errctx);
+    SDL_Event event;
+
+    ATTEMPT {

tests/docs_preludes/galagatypes.pre

@@ -0,0 +1,37 @@
+/*
+ * Prelude for the self-contained file-scope fragments in docs/20 and docs/21:
+ * blocks that define a struct, a table or a whole function from scratch need
+ * only the includes. Only compiled in the AKBASIC_WITH_AKGL build.
+ */
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <SDL3/SDL.h>
+#include <SDL3_ttf/SDL_ttf.h>
+
+#include <akerror.h>
+#include <akstdlib.h>
+
+#include <akgl/actor.h>
+#include <akgl/character.h>
+#include <akgl/controller.h>
+#include <akgl/draw.h>
+#include <akgl/error.h>
+#include <akgl/game.h>
+#include <akgl/heap.h>
+#include <akgl/physics.h>
+#include <akgl/registry.h>
+#include <akgl/renderer.h>
+#include <akgl/sprite.h>
+#include <akgl/text.h>
+#include <akgl/ui.h>
+#include <akgl/util.h>
+
+#include <akbasic/environment.h>
+#include <akbasic/error.h>
+#include <akbasic/host.h>
+#include <akbasic/runtime.h>
+#include <akbasic/sink.h>

tests/docs_preludes/hostcalls.post

@@ -2,5 +2,7 @@
     } PROCESS(errctx) {
     } FINISH(errctx, true);
     (void)score;
+    (void)argp;
+    (void)result;
     SUCCEED_RETURN(errctx);
 }

tests/docs_preludes/hostcalls.pre

@@ -7,6 +7,7 @@
  * surrounding prose says exists but does not print.
  */
 #include <akerror.h>
+#include <akbasic/environment.h>
 #include <akbasic/error.h>
 #include <akbasic/runtime.h>
 #include <akbasic/variable.h>
@@ -23,5 +24,7 @@ akerr_ErrorContext AKERR_NOIGNORE *akbasic_docs_fragment(void)
 {
     PREPARE_ERROR(errctx);
     int64_t score = 0;
+    akbasic_Value *argp[4];
+    akbasic_Value *result = NULL;
 
     ATTEMPT {

tests/for_semantics.c

@@ -81,7 +81,7 @@ static void test_counter_survives_the_loop(void)
  * `FOR I = 1 TO 1` executes the body one time on every BASIC there has ever
  * been. Here the entry test treats "the counter has reached the limit" as
  * "do not enter", so the body is skipped entirely -- and
- * tests/language/flowcontrol/forloopwaitingforcommand.bas pins that,
+ * tests/reference/language/flowcontrol/forloopwaitingforcommand.bas pins that,
  * which is why this cannot simply be corrected.
  */
 static void test_single_iteration_loop(void)

tests/language/README.md

@@ -1,16 +0,0 @@
-# The language test corpus
-
-The `.bas` files in this directory and their sibling `.txt` files are the editable language
-corpus. CMake registers every program as an individual `local_*` CTest case and compares its
-output with the sibling expectation.
-
-The corpus includes cases carried over from the deprecated Go implementation as well as cases
-written for this interpreter. Their provenance is useful when investigating a regression, but it
-does not make any case immutable or turn the old implementation into a specification.
-
-**Change a program and its expectation deliberately and in the same commit.** If the changed
-output represents an intentional language decision, record the reason in `TODO.md` or the
-relevant documentation. If it is an accidental change, fix the interpreter instead.
-
-The `examples/` subdirectory contains complete BASIC programs used as worked examples. It is
-part of the same corpus and follows the same `.bas`/`.txt` pairing rule.

tests/language/arrays_in_parameter_lists.bas

@@ -1,6 +1,6 @@
 10 REM An array reference used as a function argument, and as one of several.
 20 REM An identifier's subscript list used to hang off .right, which is also
-30 REM where an argument list chains its arguments -- so the arity counter walked
+30 REM where arguments chain their arguments -- so the arity counter walked
 40 REM straight into the subscripts and refused the call. TODO.md section 4.
 50 DIM C#(4)
 60 C#(1) = -9

tests/language/audio/filter_refused.bas

@@ -1,6 +1,6 @@
-10 REM FILTER has no device capability behind it -- akgl_audio_* synthesises and
+10 REM FILTER has no device capability -- audio synthesises and mixes but
-20 REM mixes but has no filter stage, and SDL3 supplies no primitive to build one
+20 REM has no filter stage; SDL3 supplies no primitive to build one from. It
-30 REM from. It is refused rather than silently ignored, so a program that asked
+30 REM is refused rather than silently ignored, so a program that asked
 40 REM for a low-pass finds out it did not get one.
 50 PRINT "BEFORE"
 60 FILTER 1000, 1, 0, 0, 5

tests/language/audio/no_device.bas

@@ -1,4 +1,4 @@
-10 REM The standalone driver lends the script no audio device. ENVELOPE, VOL and
+10 REM The standalone driver has no audio device. ENVELOPE, VOL and
 20 REM TEMPO only change interpreter state, so they work regardless; SOUND and
 30 REM PLAY need the device and must name themselves when there is none.
 40 ENVELOPE 1, 5, 9, 12, 2

tests/language/functions/recursion.bas

@@ -1,6 +1,6 @@
-10 REM A DEF call takes its environment from the pool, one per call, exactly as
+10 REM A DEF call takes an environment from the pool, one per call, exactly as
 20 REM GOSUB does. It used to be owned by the funcdef and reset on every call,
-30 REM which cost two silent defects: two calls in one expression shared a slot,
+30 REM which cost two silent defects: two calls shared a slot,
 40 REM and recursion never came back at all.
 50 DEF FACT(N#)
 60 IF N# <= 1 THEN RETURN 1
@@ -15,9 +15,9 @@
 150 DEF DBL(N#) = N# * 2
 160 PRINT DBL(10) + DBL(1)
 170 PRINT DBL(1) + DBL(10) + DBL(100)
-180 REM Depth answers to the environment pool now, so runaway recursion reports
+180 REM Depth answers to the pool, so runaway recursion reports
-190 REM "Environment pool exhausted" rather than hanging. It is not exercised here
+190 REM "Environment pool exhausted" rather than hanging. It is not exercised
-200 REM because the statement containing a failed call still prints a junk value
+200 REM here because a failed call's statement still prints a junk value
-210 REM afterwards -- a separate, pre-existing defect recorded in TODO.md, and one
+210 REM afterwards -- a TODO.md defect this file would pin
-220 REM this golden file would pin if it went in. tests/user_functions.c asserts
+220 REM if it went in. tests/user_functions.c asserts
 230 REM the message instead.

tests/language/graphics/argument_errors.bas

@@ -1,4 +1,4 @@
-10 REM A range check reported through the driver, end to end. The program stops
+10 REM A range check reported through the driver. The program stops
 20 REM at the first error, so this file covers one; the rest of the checks are
 30 REM asserted in tests/graphics_verbs.c against the recording backend.
 40 PRINT "BEFORE"

tests/language/graphics/no_device.bas

@@ -1,5 +1,5 @@
 10 REM The standalone driver lends the script no graphics device.
-20 REM COLOR, LOCATE and SCALE only touch interpreter state and must still work.
+20 REM COLOR, LOCATE and SCALE touch interpreter state and must still work.
 30 COLOR 1, 3
 40 LOCATE 40, 50
 50 SCALE 1, 640, 400

tests/language/housekeeping/verbs.bas

@@ -1,5 +1,5 @@
-10 REM Group B: the housekeeping verbs. None of these is in the Go reference --
+10 REM Group B: housekeeping verbs. None is in the Go reference --
-20 REM they are on its own unimplemented list -- so what each one means here is
+20 REM they are on its unimplemented list -- so what each one means here is
 30 REM a decision, recorded in src/runtime_housekeeping.c beside the verb.
 40 A# = 1 : B# = 2
 50 PRINT A# : PRINT B#
@@ -11,7 +11,7 @@
 110 P#(2) = 7 : Q#(2) = 9
 120 SWAP P#, Q#
 130 PRINT P#(2) : PRINT Q#(2)
-140 REM TRON prints each line number inline before the line runs, as a C128 does.
+140 REM TRON prints each line number inline, as a C128 does.
 150 TRON
 160 PRINT "TRACED"
 170 TROFF

tests/language/numeric/octal_literal.bas

@@ -1,7 +1,7 @@
-10 REM A leading zero is padding, not a radix. The reference selects base 8 for
+10 REM A leading zero is padding, not a radix. The reference selects base 8;
-20 REM any lexeme starting with 0, so 010 printed 8 and 08 was a parse error --
+20 REM 010 printed 8 and 08 was a parse error -- TODO.md section 6 item 10.
-30 REM TODO.md section 6 item 10, fixed. Commodore BASIC has no octal literals.
+30 REM Commodore BASIC has no octal literals.
-40 REM 0x is the one prefix that changes the base, and it now reaches the scanner
+40 REM 0x is the one prefix that changes the base and reaches the scanner
 50 REM whole: that was section 6 item 15.
 60 PRINT 010
 70 PRINT 08

tests/language/numeric/truth_value_arithmetic.bas

@@ -1,12 +1,12 @@
 10 REM A truth value carries its payload in boolvalue, not floatval. The three
 20 REM numeric operators were `if ( INTEGER ) ... else <treat as float>`, and
-30 REM that else was a catch-all rather than a float branch -- so a truth value
+30 REM that else was a catch-all, not a float branch -- so a truth value
 40 REM on the LEFT computed 0 - 1 into a field nothing reads, kept its BOOLEAN
 50 REM type, and printed `true` instead of -2. Silent, and wrong twice over.
 60 A# = 1
 70 PRINT (A# == 1)
-80 REM On the RIGHT it stays legal and stays -1, which is the same property that
+80 REM On the RIGHT it stays legal and stays -1, the same property that
-90 REM lets AND and OR double as logical operators. Refusing it here would have
+90 REM lets AND and OR double as logical operators. Refusing it would have
 100 REM broken every condition in the language.
 110 PRINT 5 - (A# == 1)
 120 PRINT 5 * (A# == 1)

tests/language/statements/multiple_per_line.bas

@@ -1,11 +1,11 @@
-10 REM Statements separated by colons. The COLON token existed from the start of
+10 REM Statements separated by colons. The COLON token existed from the start,
-20 REM the port and nothing consumed it, so a line could hold only one statement.
+20 REM but nothing consumed it, so a line could hold only one statement.
 30 PRINT "A" : PRINT "B"
 40 A# = 1 : B# = 2 : PRINT A# + B#
-50 REM An empty statement is not an error: a trailing separator, or a run of them.
+50 REM An empty statement is no error: a trailing separator or run of them.
 60 PRINT "C" :
 70 PRINT "D" :: PRINT "E"
-80 REM Everything after THEN belongs to the condition, which is BASIC 7.0 and is
+80 REM Everything after THEN belongs to the condition, as in BASIC 7.0, and is
 90 REM not something the reference had an opinion about -- it never got here.
 100 IF 1 == 1 THEN PRINT "TRUE-1" : PRINT "TRUE-2"
 110 IF 1 == 0 THEN PRINT "NEVER-1" : PRINT "NEVER-2"

tests/language/statements/rem_indented_line.bas

@@ -0,0 +1,14 @@
+REM The line after this comment is indented, and it must still run: the
+REM scanner's REM early-exit used to leave TOK_REM armed, and the next
+REM line's leading whitespace re-triggered it -- every indented line
+REM after a REM was silently skipped. Unnumbered on purpose: a numbered
+REM line's first token overwrites the leftover and hides the defect.
+PRINT 1
+REM an indented statement follows
+  PRINT 2
+REM an indented multi-line DEF body, the shape that found it
+DEF F(N#)
+  REM a comment inside the body
+  RETURN N# + 5
+PRINT F(10)
+END

tests/language/statements/rem_indented_line.txt

@@ -0,0 +1,3 @@
+1
+2
+15

tests/language/structures/missing_field.bas

@@ -1,5 +1,5 @@
-10 REM A field name is checked against a closed set the program declared, which
+10 REM A field name is checked against the type's closed set, which
-20 REM is the one thing in this language whose valid spellings are written down.
+20 REM is the one thing here whose valid spellings are written down.
 30 REM A misspelled *variable* is still silent -- see the last two lines.
 40 TYPE RECT
 50   W#

tests/language/structures/parameters.bas

@@ -17,7 +17,7 @@
 170 RETURN B@.W#
 180 PRINT WIDEN(A@)
 190 PRINT A@.W#
-200 REM To change one on purpose, pass a pointer. Assignment copies a pointer's
+200 REM To change one, pass a pointer. Assignment copies the pointer.
 210 REM reference, so the callee is looking at the caller's own record.
 220 DIM Q@ AS PTR TO CRATE
 230 POINT Q@ AT A@
@@ -37,7 +37,7 @@
 370 N2@.COUNT# = 20
 380 POINT N1@.TAIL@ AT N2@
 390 DEF TOTAL(P@ AS PTR TO NODE)
-395 REM A pointer is true when it points at something, which is how a walk knows
+395 REM A pointer is true when it points at something, so a walk knows
 396 REM where the list ends. NOT is the bitwise operator here, so the test is
 397 REM written the positive way round.
 400 IF P@->TAIL@ THEN RETURN P@->COUNT# + TOTAL(P@->TAIL@)

tests/language/structures/records.bas

@@ -1,4 +1,4 @@
-10 REM A TYPE declares its fields; each takes its own type from its own suffix,
+10 REM A TYPE declares fields; each takes its type from its own suffix,
 20 REM which is the same rule every other name in this language follows.
 30 TYPE COORD
 40   X#

tests/language/structures/reserved_names.bas

@@ -1,6 +1,6 @@
 10 REM A type name and a field name are bare words, and so is every verb, so
 20 REM they share a namespace whether we like it or not. Both are refused with
-30 REM the same rule the scanner already applies to variable names -- and a type
+30 REM the same rule the scanner applies to variable names -- and a type
 40 REM name is refused by the prescan, which can say so plainly rather than
 50 REM leaving the parser to report "Expected expression or literal".
 60 TYPE POINT

tests/reference/README.md

@@ -0,0 +1,63 @@
+# The reference interpreter's own test corpus
+
+These 41 `.bas` files and their 41 `.txt` expectations are **not this project's tests.** They
+are a byte-for-byte copy of the acceptance corpus belonging to the Go implementation this
+interpreter was ported from:
+
+| | |
+|---|---|
+| Source | `https://source.starfort.tech/andrew/basicinterpreter`, `tests/` |
+| Copied at | commit `d76162cb37eeaccddae2cf6cab7af7bc8175d6d2` ("Update README.md") |
+| Copied on | 2026-07-31 |
+| Verified | every file `cmp`-identical to the submodule at the time of the copy |
+
+They are registered as the `golden_*` CTest cases and run against `basic` on every build, in
+both the default and the `-DAKBASIC_WITH_AKGL=ON` configurations.
+
+## Why they are a copy, when they deliberately were not
+
+Until 2026-07-31 these were driven *in place* out of `deps/basicinterpret`, and the reasoning
+was written down in `CMakeLists.txt`: the corpus is a submodule, and copying a submodule's
+corpus guarantees drift.
+
+That reasoning was sound and it stopped applying. The Go project is deprecated and will not be
+updated, so there is nothing left to drift *from* — and a build that cannot run its own
+acceptance suite without cloning the implementation it replaced is not finished.
+
+## What these are for now
+
+**A regression suite, not a specification.** That distinction is the whole of how to treat
+them, and it changed on 2026-07-31 (`TODO.md` §0.1): matching the Go implementation is no
+longer a goal, so a difference between it and this interpreter is not automatically a bug in
+this one.
+
+What they are still good for is unchanged and is worth a lot: forty-one real BASIC programs
+with known-good output, covering arithmetic, arrays, flow control, every builtin function,
+`READ`/`DATA`, labels and three worked examples. That catches regressions whatever its
+provenance.
+
+## The rule for editing these
+
+**Diverge deliberately, never by accident.**
+
+A failure here means this interpreter's behaviour changed. Nine times in ten that is a bug you
+just introduced and the answer is to fix the code. The tenth time it is an improvement on the
+reference, and then the answer is:
+
+1. Change the expectation in the same commit as the code.
+2. Say why in the commit message.
+3. Add a line to `TODO.md` §5, which is the list of deliberate deviations.
+
+What is not acceptable is editing a `.txt` to make a red suite green without deciding which of
+the two you are doing.
+
+New cases for this project's own behaviour go in `tests/language/`, registered under `local_*`.
+The prefix says which corpus a failure came from, and a diff touching `tests/reference/` stands
+out as the thing it is.
+
+## Divergences so far
+
+| Case | Change | Why |
+|---|---|---|
+| `language/arithmetic/integer.txt` | Expectation grew from `4 4 2` to `4 4 2 2` | The program has **four** `PRINT` statements and the expectation had three values. The file ends in a blank line, and both interpreters filed a blank line under the loader's cursor — which for a line with no number of its own is the number of the line before it. So `40 PRINT 4 - 2` was erased before the program ran. The reference lost it the same way, which is why the expectation was written short. Fixed by skipping blank lines in RUNSTREAM, as `akbasic_runtime_load()` and `DLOAD` already did. `TODO.md` §5. |
+| `examples/strreverse.bas` | Variable `INPUT$` renamed to `SOURCE$` | `INPUT$` is a reserved word with a type suffix, which a real C128 refuses and which this interpreter now refuses too (`TODO.md` §6 item 16). The reference accepted it only because its own reserved-word check never fired. The expectation is byte-for-byte unchanged — the program still prints `REVERSED: OLLEH` — so the case keeps all of its value. |