Add T-SQL WHILE / BREAK / CONTINUE with flag-based loop control (BatchContext.LoopControl + LoopDepth), per-iteration cursor save/restore, @@rowcount=0 at exit, and Msg 135/136 compile-time scope check.

Author: RyanLamansky

CLAUDE.md

@@ -337,8 +337,8 @@ Creates a destination table from the projection's inferred schema, then copies r
 - **INTO without FROM** works (`SELECT 1 AS x INTO #t`) — synthesized-row path threads `IntoTarget` through.
 - **Quirk**: CTE-wrapped single-heap source drops identity and nullability — the simulator's CTE bindings synthesize `HeapColumn` entries with `nullable: true` and no identity, so the analyzer can't peer through. Real SQL Server propagates both. Fix would require propagating column metadata through CTE bindings; future bundle.
 
-### T-SQL control flow: `IF` / `BEGIN…END`
-`IF <boolean-expr> <stmt> [ELSE <stmt>]` and `BEGIN <stmt>+ END` compound blocks. WHILE/BREAK/CONTINUE/GOTO/labels and TRY/CATCH still aren't modeled. Probed against SQL Server 2025 (2026-05-11).
+### T-SQL control flow: `IF` / `BEGIN…END` / `WHILE` / `BREAK` / `CONTINUE`
+`IF <boolean-expr> <stmt> [ELSE <stmt>]`, `BEGIN <stmt>+ END` compound blocks, `WHILE <boolean-expr> <stmt>` loops with `BREAK` / `CONTINUE`. GOTO/labels and TRY/CATCH still aren't modeled. Probed against SQL Server 2025 (2026-05-11).
 
 - **Body grammar**: exactly one statement. The famous T-SQL footgun `IF cond SELECT 'a' SELECT 'b'` runs *both* SELECTs — only the first is the IF body; the second escapes the IF as a subsequent batch-level statement. Replicated.
 - **Dangling-else binds to the inner IF** (standard rule). `IF 1=0 IF 1=1 stmt ELSE stmt` → outer skips the entire inner-IF including its ELSE; no output.
@@ -348,11 +348,21 @@ Creates a destination table from the projection's inferred schema, then copies r
 - **Empty `BEGIN END`** (and `BEGIN ; END` with only separators) → **Msg 102** near `'end'`. Variables declared inside a block are batch-scoped, not block-scoped (visible after `END`) — matches existing batch-scope model on `BatchContext.Variables`.
 - **`@@ROWCOUNT`**: an IF that ran no branch (cond false, no ELSE) resets `@@ROWCOUNT` to 0. An IF whose body ran lets the body's last statement set `@@ROWCOUNT` normally. Probe-confirmed.
 
-**Un-taken-branch skip mode** (`BatchContext.IsSkipping`). The IF parser sets the flag around dispatch of the un-taken branch (THEN if cond false, ELSE if cond true), then restores in a `finally`. Skip-mode propagates through nested IF/BEGIN automatically — a nested IF inside a skipped block reads `IsSkipping=true`, short-circuits cond eval entirely (so a divide-by-zero inside un-evaluated cond doesn't fire), and dispatches both its branches in skip mode.
+**WHILE specifics**: `BooleanExpression.Parse` for cond (Msg 4145 on non-boolean, same path as IF). `ParserContext.SaveCheckpoint` captures the body-start; `RestoreCheckpoint` before each iteration so the body re-parses from scratch (variable references hold live `VariableSlot` references, so cond / body mutations between iterations are visible). After every exit path (cond initially false, cond goes false mid-loop, BREAK) `@@ROWCOUNT` resets to 0 — probe-confirmed, independent of what the body's last statement produced. Empty `BEGIN END` body raises Msg 102 (same rule as IF). One-statement-body footgun: `WHILE @i<2 set @i=@i+1 select @i` — the `SELECT` is *not* part of the body; it runs once after the loop exits.
+
+**BREAK / CONTINUE — flag-based, not exception-based.** `BatchContext.LoopControl` enum (`None` / `Break` / `Continue`). The BREAK parser sets it to `Break`; the CONTINUE parser sets it to `Continue`. The innermost WHILE consumes and clears the flag. The `IsSkipping` property OR's the flag into the skip predicate, so subsequent statements in the body block naturally no-op (`set @sum = @sum + 100;` after a `BREAK` doesn't run — probe-confirmed). Nested loops work because each WHILE clears its own flag before returning to its caller, so the outer never sees the inner's break/continue. This composes cleanly with iterator-based dispatch in a way exception-based signaling doesn't — see `feedback_no_exceptions_for_control_flow.md`.
+
+**BREAK / CONTINUE outside a loop** raises **Msg 135** / **Msg 136** verbatim: `"Cannot use a BREAK statement outside the scope of a WHILE statement."` / `"Cannot use a CONTINUE statement outside the scope of a WHILE statement."`. The check on `BatchContext.LoopDepth == 0` fires *unconditionally* — real SQL Server applies the loop-scope check at compile time, so the simulator does too. **This is distinct from the Q15 un-taken-branch fidelity gap**: `IF 1=0 BREAK` at batch top level fires Msg 135 even though the branch is un-taken. Inside a real WHILE, `LoopDepth > 0` lets BREAK in an un-taken IF body just no-op (because the `!IsSkipping` gate on the flag *write* prevents the actual control transfer).
+
+**Iteration cap** — simulator-only safety net at `BatchContext.LoopIterationLimit = 100_000` total iterations per batch. Real SQL Server has no such cap (timeouts handle runaway loops). The simulator throws `InvalidOperationException` so a buggy test doesn't hang CI.
+
+**`LoopDepth` is bumped unconditionally** (even when the WHILE itself is in skip mode) so BREAK / CONTINUE inside the body — including inside un-taken IF branches — never see Msg 135 / 136 fire incorrectly. The flag-write gate (`!IsSkipping`) handles the runtime "BREAK in skipped-IF inside WHILE" case.
+
+**Un-taken-branch skip mode** (`BatchContext.SkipModeFlag` + `IsSkipping` computed property). The IF parser sets `SkipModeFlag` around dispatch of the un-taken branch (THEN if cond false, ELSE if cond true), then restores in a `finally`. `IsSkipping = SkipModeFlag || LoopControl != None` is the combined predicate every statement parser reads. Skip-mode propagates through nested IF/BEGIN/WHILE automatically — a nested IF inside a skipped block reads `IsSkipping=true`, short-circuits cond eval entirely (so a divide-by-zero inside un-evaluated cond doesn't fire), and dispatches both its branches in skip mode. A WHILE in skip mode never iterates; it skip-dispatches its body once to advance the cursor and exits.
 
 Each statement parser still runs its full parse — the cursor advances normally, names resolve, expressions parse — but gates its state mutation on `!batch.IsSkipping`. Touchpoints: SELECT `Execute` call in the dispatch, `ProcessHeapInsert`'s heap insert + `LastIdentity` update, `CommitUpdate`'s heap delete+insert, `CommitDelete`'s heap delete, MERGE's INSERT branch, `TryParseCreate`'s dict add + Msg 2714 existence check, `DropOneTable`'s lookup + Msg 3701 + dict remove, `ExecuteSelectInto`'s create + bulk-insert, `TryParseSetVariable`'s `slot.Value =` (plus its RHS evaluation), `TryParseSetIdentityInsert`'s state change, `TryParseDeclare`'s dict add + Msg 134 duplicate check + initializer evaluation, `TryParseBeginTransaction` / `TryParseCommit` / `TryParseRollbackTransaction` / `TryParseSavepoint`'s state changes (including their no-active-tx error checks), `TryParseAlter`'s database property write, `TryParseDbcc`'s trace-flag mutation. The dispatch loop also suppresses `yield return` for SELECT results and the `LastStatementRowCount` update on skipped statements.
 
-**Dispatch refactor**: extracted `DispatchOneStatement(batch, requireSemicolonBeforeCte)` and `DispatchStatementsUntil(batch, endKeyword)` from `CreateResultSetsForCommand`. The top-level loop calls `DispatchStatementsUntil(null)`; `ParseBeginBlock` calls `DispatchStatementsUntil(Keyword.End)`; `ParseIfStatement` calls `DispatchOneStatement` directly (IF's body is exactly one statement). `IsStatementBoundary` now also includes `If` / `Else` / `End` so the cursor-normalization at the end of each dispatch correctly recognizes nested-control terminators. `Selection.ParseInner`'s projection-list terminator switch also lists `If` / `Else` / `End` (and `Drop`) so `SELECT ... ELSE` / `SELECT ... END` correctly stop at the keyword instead of throwing Msg 102.
+**Dispatch refactor**: extracted `DispatchOneStatement(batch, requireSemicolonBeforeCte)` and `DispatchStatementsUntil(batch, endKeyword)` from `CreateResultSetsForCommand`. The top-level loop calls `DispatchStatementsUntil(null)`; `ParseBeginBlock` calls `DispatchStatementsUntil(Keyword.End)`; `ParseIfStatement` and `ParseWhileStatement` call `DispatchOneStatement` directly (the body of each is exactly one statement). `IsStatementBoundary` includes `If` / `Else` / `End` / `While` / `Break` / `Continue` so the cursor-normalization at the end of each dispatch correctly recognizes nested-control terminators. `Selection.ParseInner`'s projection-list terminator switch lists the same set plus `Drop` so `SELECT ... ELSE` / `SELECT ... END` / `SELECT ... BREAK` / etc. correctly stop at the keyword instead of throwing Msg 102.
 
 **Fidelity gap** (Q15): real SQL Server defers name resolution for un-taken branches — `IF 1=0 SELECT bad_col FROM bad_table` runs silently. The simulator's parsers do name resolution inline with parsing, so un-taken branches with non-existent table/column refs still raise Msg 208 / Msg 207. Common idioms (safe-CREATE / safe-DROP / safe-INSERT against pre-existing tables) work end-to-end because referenced names exist when the branch is skipped.
 
@@ -399,7 +409,7 @@ Full `DbDataReader` contract. Typed accessors read `SqlValue` directly via the c
 - **Global temp tables (`##foo`)** — `NotSupportedException` at parse. Local `#foo` works; the lifecycle for global temps (drops when creator session closes, visible across sessions) is the deferred scope.
 - **`ALTER TABLE #foo`**, **`TRUNCATE TABLE #foo`**, **`OBJECT_ID('tempdb..#foo')`** — none modeled (none of those exist for regular tables either yet). The common `IF OBJECT_ID(...) IS NOT NULL DROP TABLE` cleanup pattern works via `DROP TABLE IF EXISTS #foo` instead.
 - **Three-part name resolution outside DROP TABLE**: `tempdb..#foo` in FROM / INSERT / UPDATE / DELETE / MERGE / SET IDENTITY_INSERT raises `InvalidObjectName` (Msg 208) on the qualifier; use bare `#foo`. DROP TABLE alone tolerates the qualifier (probe pattern).
-- T-SQL `WHILE` / `BREAK` / `CONTINUE` / `GOTO` / labels — `IF` / `BEGIN…END` ship; loops and unconditional jumps don't.
+- T-SQL `GOTO` / labels — `IF` / `BEGIN…END` / `WHILE` / `BREAK` / `CONTINUE` ship; unconditional jumps don't.
 - `TRY ... CATCH`, `THROW`, `RAISERROR`, `@@ERROR`, `RETURN`, `PRINT`, stored procs / UDFs. `BEGIN TRY` / `BEGIN ATOMIC` / `BEGIN DISTRIBUTED TRANSACTION` raise `NotSupportedException` at dispatch (peeked after `BEGIN`).
 - `hierarchyid`, `geography`, `geometry`.
 

SqlServerSimulator.Tests/WhileLoopTests.cs

@@ -0,0 +1,273 @@
+using static Microsoft.VisualStudio.TestTools.UnitTesting.Assert;
+
+namespace SqlServerSimulator;
+
+/// <summary>
+/// Tests for <c>WHILE cond stmt</c>, <c>BREAK</c>, and <c>CONTINUE</c>.
+/// Covers iteration with mutated cond, the one-statement-body footgun,
+/// nested loops (BREAK exits innermost), BREAK / CONTINUE scope check
+/// (Msg 135 / Msg 136 fire even from un-taken IF branches — real SQL
+/// Server's compile-time check), @@ROWCOUNT=0 at every exit path,
+/// non-boolean cond (Msg 4145), WHILE in un-taken IF (skip-mode), and
+/// the simulator's iteration cap. Behavior probed against SQL Server
+/// 2025 (2026-05-11).
+/// </summary>
+[TestClass]
+public sealed class WhileLoopTests
+{
+    [TestMethod]
+    public void BasicCounter_RunsToCompletion()
+        => AreEqual(3, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while @i < 3 set @i = @i + 1;
+            select @i
+            """));
+
+    /// <summary>
+    /// Body is exactly one statement — same footgun as IF. The second
+    /// statement after the body runs once *after* the loop, not per
+    /// iteration. Probe-confirmed.
+    /// </summary>
+    [TestMethod]
+    public void BodyOneStatement_SecondStatementEscapesLoop()
+        => AreEqual(2, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while @i < 2 set @i = @i + 1 select @i
+            """));
+
+    [TestMethod]
+    public void CondInitiallyFalse_NoIteration()
+        => AreEqual(0, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while 1 = 0 set @i = 99;
+            select @i
+            """));
+
+    [TestMethod]
+    public void NonBooleanCond_Msg4145()
+        => new Simulation().AssertSqlError("while 1 select 1", 4145);
+
+    [TestMethod]
+    public void NullCond_Msg4145()
+        => new Simulation().AssertSqlError("while null select 1", 4145);
+
+    [TestMethod]
+    public void EmptyBeginEnd_Msg102()
+        => new Simulation().AssertSqlError("while 1=0 begin end", 102);
+
+    // ---- BREAK ----
+
+    [TestMethod]
+    public void Break_ExitsLoop()
+        => AreEqual(2, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while 1 = 1
+            begin
+                set @i = @i + 1;
+                if @i >= 2 break;
+            end;
+            select @i
+            """));
+
+    /// <summary>
+    /// BREAK skips remaining statements in the same block — subsequent
+    /// statements after BREAK in the body never execute. Probe-confirmed.
+    /// </summary>
+    [TestMethod]
+    public void Break_SkipsRemainingStatementsInBlock()
+        => AreEqual(1, new Simulation().ExecuteScalar<int>("""
+            declare @sum int = 0;
+            while 1 = 1
+            begin
+                set @sum = @sum + 1;
+                break;
+                set @sum = @sum + 100;
+            end;
+            select @sum
+            """));
+
+    // ---- CONTINUE ----
+
+    /// <summary>
+    /// CONTINUE skips the remainder of the current iteration and re-
+    /// evaluates the cond. @hits counts only odd iterations because
+    /// even iterations continue before incrementing @hits.
+    /// </summary>
+    [TestMethod]
+    public void Continue_SkipsRemainderAndReevaluates()
+        => AreEqual(3, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0, @hits int = 0;
+            while @i < 5
+            begin
+                set @i = @i + 1;
+                if @i % 2 = 0 continue;
+                set @hits = @hits + 1;
+            end;
+            select @hits
+            """));
+
+    // ---- Scope check (Msg 135 / 136) ----
+
+    [TestMethod]
+    public void BreakOutsideLoop_Msg135()
+        => new Simulation().AssertSqlError("break", 135, "Cannot use a BREAK statement outside the scope of a WHILE statement.");
+
+    [TestMethod]
+    public void ContinueOutsideLoop_Msg136()
+        => new Simulation().AssertSqlError("continue", 136, "Cannot use a CONTINUE statement outside the scope of a WHILE statement.");
+
+    /// <summary>
+    /// BREAK inside an IF body (not in a WHILE) → Msg 135. The check is
+    /// compile-time in real SQL Server, so it fires even though the IF
+    /// might be un-taken at runtime. The simulator parses the IF body
+    /// statement-by-statement; BREAK's scope check fires at parse time
+    /// regardless of skip mode (probe-confirmed against SQL Server 2025).
+    /// </summary>
+    [TestMethod]
+    public void BreakInsideIfNoLoop_StillMsg135()
+        => new Simulation().AssertSqlError("if 1=1 break", 135);
+
+    [TestMethod]
+    public void BreakInsideUntakenIf_StillMsg135()
+        => new Simulation().AssertSqlError("if 1=0 break", 135);
+
+    [TestMethod]
+    public void BreakInsideBlock_NoLoop_StillMsg135()
+        => new Simulation().AssertSqlError("begin break end", 135);
+
+    /// <summary>
+    /// BREAK inside an IF inside a WHILE: the LoopDepth check passes
+    /// (we're in a WHILE), so no Msg 135. Iteration completes; outer
+    /// WHILE keeps iterating.
+    /// </summary>
+    [TestMethod]
+    public void BreakInsideIfInsideLoop_NoError()
+        => AreEqual(5, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while @i < 5
+            begin
+                set @i = @i + 1;
+                if 1 = 0 break;
+            end;
+            select @i
+            """));
+
+    // ---- Nested loops ----
+
+    /// <summary>
+    /// Inner BREAK exits inner WHILE only. Outer continues iterating.
+    /// Reset <c>@inner</c> inside the outer body via SET (not DECLARE —
+    /// re-declaring inside a loop body would fire Msg 134 on iteration 2).
+    /// </summary>
+    [TestMethod]
+    public void NestedBreak_ExitsInnerOnly()
+        => AreEqual(3, new Simulation().ExecuteScalar<int>("""
+            declare @outer int = 0, @inner int = 0;
+            while @outer < 3
+            begin
+                set @outer = @outer + 1;
+                set @inner = 0;
+                while 1 = 1
+                begin
+                    set @inner = @inner + 1;
+                    if @inner >= 2 break;
+                end;
+            end;
+            select @outer
+            """));
+
+    /// <summary>
+    /// Nested CONTINUE only re-iterates the inner loop. Outer iteration
+    /// continues normally after inner WHILE finishes.
+    /// </summary>
+    [TestMethod]
+    public void NestedContinue_ReiteratesInnerOnly()
+        => AreEqual(10, new Simulation().ExecuteScalar<int>("""
+            declare @outer int = 0, @inner int = 0, @total int = 0;
+            while @outer < 2
+            begin
+                set @outer = @outer + 1;
+                set @inner = 0;
+                while @inner < 4
+                begin
+                    set @inner = @inner + 1;
+                    if @inner % 2 = 0 continue;
+                    set @total = @total + 1;
+                end;
+            end;
+            select @total + (@outer * 3)
+            """));
+
+    // ---- WHILE in skipped IF ----
+
+    /// <summary>
+    /// WHILE inside an un-taken IF branch: the WHILE never iterates.
+    /// Critical because the body is <c>WHILE 1=1</c> (infinite loop) —
+    /// if skip-mode failed, the test would hit the iteration cap.
+    /// </summary>
+    [TestMethod]
+    public void WhileInsideSkippedIf_NeverIterates()
+        => AreEqual(0, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            if 1 = 0 while 1 = 1 set @i = 99;
+            select @i
+            """));
+
+    // ---- @@ROWCOUNT ----
+
+    [TestMethod]
+    public void RowCount_AfterWhileNoIter_IsZero()
+        => AreEqual(0, new Simulation().ExecuteScalar<int>("""
+            declare @prime int = 1;
+            while 1 = 0 set @prime = 99;
+            select @@rowcount
+            """));
+
+    [TestMethod]
+    public void RowCount_AfterWhileWithIters_IsZero()
+        => AreEqual(0, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while @i < 2 begin set @i = @i + 1 end;
+            select @@rowcount
+            """));
+
+    [TestMethod]
+    public void RowCount_AfterBreakExit_IsZero()
+        => AreEqual(0, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while 1 = 1
+            begin
+                set @i = @i + 1;
+                if @i >= 1 break;
+            end;
+            select @@rowcount
+            """));
+
+    // ---- Cond mutation across iterations ----
+
+    [TestMethod]
+    public void CondReferencesVariable_MutationVisibleAcrossIters()
+        => AreEqual(5, new Simulation().ExecuteScalar<int>("""
+            declare @i int = 0;
+            while @i < 5 set @i = @i + 1;
+            select @i
+            """));
+
+    // ---- Iteration cap ----
+
+    /// <summary>
+    /// Simulator-only safety: a runaway WHILE throws after the per-batch
+    /// iteration cap is exceeded. Real SQL Server has no such cap — query
+    /// timeouts handle this in production — but the simulator surfaces an
+    /// explicit error so a buggy test doesn't hang CI.
+    /// </summary>
+    [TestMethod]
+    public void IterationCap_ThrowsAfterLimit()
+    {
+        var ex = Throws<InvalidOperationException>(() => new Simulation().ExecuteNonQuery("""
+            declare @i int = 0;
+            while 1 = 1 set @i = @i + 1
+            """));
+        Contains("iteration cap exceeded", ex.Message, StringComparison.Ordinal);
+    }
+}