@pineforge/codegen-pyodide 0.10.4 → 1.0.0

package/pineforge_codegen/codegen/helpers.py

@@ -4,8 +4,8 @@ Mixin holding stateless / near-stateless name-mangling and AST-walk
 helpers used everywhere in the codegen. Lives here so the heavier
 visitor / emitter mixins can depend on it without owning its
 implementation. Keep this module free of imports from any other
-``codegen/*`` submodule so it stays at the bottom of the dependency
-graph.
+``codegen/*`` submodule (the generated data module ``host_members``
+aside) so it stays at the bottom of the dependency graph.
 
 Mixin contract: ``NamingHelper`` reads at most one piece of host state,
 ``self._all_member_names`` (used by ``_func_safe_name``). The class
@@ -14,23 +14,363 @@ mixing this in (``CodeGen``) sets that attribute in its constructor.
 
 from __future__ import annotations
 
+import re
+
 from ..ast_nodes import (
-    Identifier, MemberAccess,
+    Identifier, MemberAccess, TypeDecl, EnumDecl, FuncDef, MethodDef,
     VarDecl, Assignment, TupleAssign, ForStmt, ForInStmt,
 )
+from ..limits import iter_ast_nodes
+from ..signatures import SESSION_FLAG_MEMBERS
+from .host_members import HOST_MEMBER_NAMES
+
+
+# Integer C++ types an na-capable ``double`` expression may be narrowed into.
+# ``bool`` has its own Pine truthiness lowering below: unlike a C++ cast, it
+# treats both the floating NaN and the integer ``na`` sentinel as false.
+NA_PRESERVING_INT_TYPES = ("int", "int64_t")
+_INT_LITERAL_TEXT = re.compile(
+    r"^\s*\(?(?:[-+]?\d+)(?:LL|ULL|L|U)?\)?\s*$"
+)
+
+
+def na_preserving_int_cast(value_cpp: str, int_cpp_type: str = "int") -> str:
+    """Narrow a numeric expression to an integer type without losing ``na``.
+
+    An *implicit* ``double`` -> ``int`` conversion of a NaN is undefined
+    behaviour ([conv.fpint]), and compilers disagree in practice: AppleClang
+    arm64 and g++ aarch64 produce 0 at every ``-O``, g++ x86-64 produces
+    ``INT_MIN`` at ``-O0``/``-O1`` and 0 from ``-O2``. The engine's contract
+    (``include/pineforge/na.hpp``) is that an integer ``na`` *is*
+    ``std::numeric_limits<T>::min()``, which is what ``is_na(T)`` tests, so
+    every such narrowing must be spelled out. Check the original value type:
+    converting an ``int64_t`` na sentinel to ``double`` first erases it.
+
+    The value is evaluated exactly once. ``na`` in, ``na<T>()`` out; anything
+    else truncates toward zero exactly as the implicit conversion did, so a
+    non-``na`` result is bit-for-bit what it was before. A floating value
+    outside ``int`` reads ``na<int>()`` too: its conversion is undefined, and
+    x86-64 (``cvttsd2si``: ``INT_MIN``, the ``na`` sentinel) and arm64
+    (``fcvtzs``: saturation) disagreed on an epoch a missed provenance
+    narrowed (W9-CG-EPOCH-INT64); ``na<int>()`` is the x86-64 answer, so
+    Linux runs keep their bits.
+    """
+    # Integer literals are proven non-``na``. Keep the historical explicit
+    # cast for these tiny paths so a helper does not churn every matrix/color
+    # call that passes a literal index or channel.
+    if _INT_LITERAL_TEXT.fullmatch(value_cpp):
+        return f"({int_cpp_type})({value_cpp})"
+    if int_cpp_type == "int":
+        return (f"[&](){{ auto _pf_v = ({value_cpp}); "
+                f"if constexpr (std::is_floating_point_v<decltype(_pf_v)>) "
+                f"return (_pf_v >= -2147483648.0 && _pf_v < 2147483648.0) "
+                f"? (int)_pf_v : na<int>(); "
+                f"else return is_na(_pf_v) ? na<int>() : (int)_pf_v; }}()")
+    return (f"[&](){{ auto _pf_v = ({value_cpp}); "
+            f"return is_na(_pf_v) ? na<{int_cpp_type}>() : "
+            f"({int_cpp_type})_pf_v; }}()")
+
+
+# C++ whose evaluation cannot be observed, so reading it twice -- or once per
+# loop iteration -- is harmless: a literal, a name or member chain (a history
+# read of it at a literal offset included), an na.
+_PLAIN_READ_CPP = re.compile(
+    r"[A-Za-z_]\w*(?:(?:\.|->)[A-Za-z_]\w*)*(?:\[\d+\])?"
+    r"|[-+]?(?:\d+\.?\d*|\.\d+)(?:[eE][-+]?\d+)?"
+    r'|std::string\("(?:[^"\\]|\\.)*"\)'
+    r"|na<[\w:]+>\(\)"
+)
+
+
+def _strip_outer_parens(text: str) -> str:
+    text = text.strip()
+    while text.startswith("(") and text.endswith(")"):
+        depth = 0
+        for i, ch in enumerate(text):
+            depth += ch == "("
+            depth -= ch == ")"
+            if depth == 0 and i < len(text) - 1:
+                return text  # the first "(" closes before the end: "(a) + (b)"
+        text = text[1:-1].strip()
+    return text
+
+
+def cpp_is_plain_read(value_cpp: str) -> bool:
+    """True when evaluating ``value_cpp`` more than once cannot be observed."""
+    return _PLAIN_READ_CPP.fullmatch(_strip_outer_parens(value_cpp)) is not None
+
+
+def evaluate_args_once(args: list[str], indices, render, token: str) -> str:
+    """``render(args)`` with every argument evaluated once, left to right.
+
+    Pine evaluates each call argument exactly once. A lowering template that
+    reads an argument twice, or once per loop iteration, re-runs that
+    argument's C++, so a stateful call in it (a ``ta.*`` compute(), a user
+    function with state) runs more than once per execution. Every argument
+    in ``indices`` that is not a plain read is bound once to a lambda local,
+    together with every earlier argument that is not, so the left-to-right
+    order holds; the template then reads the bindings. A call whose
+    ``indices`` arguments are all plain reads renders exactly as before.
+    """
+    need = [i for i in indices if i < len(args) and not cpp_is_plain_read(args[i])]
+    if not need:
+        return render(list(args))
+    bound = list(args)
+    decls = []
+    for i in range(max(need) + 1):
+        if cpp_is_plain_read(args[i]):
+            continue
+        decls.append(f"auto&& {token}{i} = ({args[i]});")
+        bound[i] = f"{token}{i}"
+    return f"([&]() {{ {' '.join(decls)} return {render(bound)}; }}())"
+
+
+def pine_index_int_cast(value_cpp: str) -> str:
+    """Narrow a numeric index after checking its *original* na sentinel.
+
+    Table-driven matrix methods receive C++ text without the source AST.
+    Converting an integer sentinel to ``double`` first loses it (INT64_MIN is
+    finite as a double), so this helper retains the source C++ type until the
+    `is_na` check. Bool has no separate na state in Pine v6.
+    """
+    if _INT_LITERAL_TEXT.fullmatch(value_cpp):
+        return f"(int)({value_cpp})"
+    return (
+        f"([&](){{ auto _pf_idx_v = ({value_cpp}); "
+        f"using _pf_idx_t = std::decay_t<decltype(_pf_idx_v)>; "
+        f"if constexpr (std::is_same_v<_pf_idx_t, bool>) "
+        f"return (int)_pf_idx_v; "
+        f"else return is_na(_pf_idx_v) ? na<int>() : (int)_pf_idx_v; }}())"
+    )
+
+
+def pine_truth_cast(value_cpp: str) -> str:
+    """Convert one scalar expression using Pine's boolean truthiness.
+
+    Pine's boolean context is false for ``na``.  C++ differs for both numeric
+    sentinels: ``bool(NaN)`` is true and ``bool(INT_MIN)`` is true.  Keep the
+    expression single-evaluation and use ``if constexpr`` so the generated
+    lambda is valid for either a real ``bool`` or a numeric scalar.  The final
+    branch is intentionally a normal C++ conversion for a type that cannot
+    carry Pine ``na`` (for example an engine handle); callers only use this
+    helper at scalar boolean boundaries.
+    """
+    return (
+        f"[&](){{ auto _pf_bool_v = ({value_cpp}); "
+        f"using _pf_bool_t = std::decay_t<decltype(_pf_bool_v)>; "
+        f"if constexpr (std::is_same_v<_pf_bool_t, bool>) {{ "
+        f"return _pf_bool_v; }} "
+        f"else if constexpr (std::is_floating_point_v<_pf_bool_t> || "
+        f"std::is_integral_v<_pf_bool_t>) {{ "
+        f"return is_na(_pf_bool_v) ? false : (_pf_bool_v != 0); }} "
+        f"else {{ return static_cast<bool>(_pf_bool_v); }} }}()"
+    )
+
+
+def unary_sign_cpp(op: str, operand_cpp: str) -> str:
+    """``(-x)`` / ``(+x)``, the operand parenthesized when its text starts
+    with a sign: a negative constant inlined as its literal (``NEG = -5``)
+    under ``-`` was ``(--5)``, a decrement of a literal, which does not
+    compile. Every other operand keeps its spelling."""
+    if operand_cpp[:1] in ("-", "+"):
+        return f"({op}({operand_cpp}))"
+    return f"({op}{operand_cpp})"
 
 
-# C++ reserved names that conflict with PineScript identifiers when used
-# verbatim as variable names. Carried forward from the historic codegen.py
-# table; intentionally narrower than the full C++ keyword set because Pine
-# already reserves keywords like ``if``/``else``/``for``/``return`` so they
-# can never reach codegen as identifier strings. Lives here (not base.py)
-# so the mixin can read it without forcing an import cycle on ``base``.
-CPP_RESERVED = {
+def color_alpha_cast(value_cpp: str, whole: bool = False) -> str:
+    """Convert Pine transparency without feeding ``na<int>()`` to color.hpp.
+
+    color.hpp's ``new_color`` takes the transparency as a double and stores
+    the alpha byte nearest 255 * (100 - t) / 100, as TradingView does, so a
+    finite value passes through unrounded: ``color.new(c, 10.5)`` reads back
+    11 (tests/test_e2e_color_tapes.py). TradingView's
+    ``color.new``/``color.rgb`` treat a missing transparency as 100 (fully
+    transparent); the integer ``na`` sentinel would read as a transparency
+    far below 0. ``whole`` marks an integer literal from 0 to 100, which keeps
+    the historic ``(int)`` conversion: it leaves the value as it is.
+    """
+    value = "(int)_pf_color_v" if whole else "(double)_pf_color_v"
+    return (
+        f"[&](){{ auto _pf_color_v = ({value_cpp}); "
+        f"using _pf_color_t = std::decay_t<decltype(_pf_color_v)>; "
+        f"if constexpr (std::is_same_v<_pf_color_t, bool>) "
+        f"return _pf_color_v ? 1 : 0; "
+        f"else return is_na(_pf_color_v) ? 100 : {value}; }}()"
+    )
+
+
+# A comment or a string or character literal of the generated C++, which
+# spells no raw string literal and no digit separator.
+_CPP_COMMENT_OR_LITERAL = re.compile(
+    r"//[^\n]*|/\*.*?\*/|\"(?:\\.|[^\"\\\n])*\"|'(?:\\.|[^'\\\n])*'", re.S
+)
+
+
+def cpp_code_only(cpp: str) -> str:
+    """``cpp`` with every comment and string or character literal replaced by
+    a space: what is left is code, which a script's string cannot spell."""
+    return _CPP_COMMENT_OR_LITERAL.sub(" ", cpp)
+
+
+# Preserve the historic spelling for names already escaped in released TUs.
+LEGACY_CPP_RESERVED = frozenset({
     "exp", "log", "abs", "max", "min", "and", "or", "not",
     "int", "float", "bool", "string", "short", "long", "new", "delete",
     "class", "struct", "return", "void", "auto", "const", "static",
-}
+    "prepare_script_run",
+})
+
+# Every C++17 keyword and alternative operator token, plus the C++20
+# additions.  Pine reserves some of these itself, but the others are legal
+# Pine identifiers and must not reach a C++ declaration unchanged.
+CPP_KEYWORDS = frozenset("""
+    alignas alignof and and_eq asm auto bitand bitor bool break case catch
+    char char8_t char16_t char32_t class co_await co_return co_yield compl
+    concept const consteval constexpr constinit const_cast continue decltype
+    default delete do double dynamic_cast else enum explicit export extern
+    false float for friend goto if inline int long mutable namespace new
+    noexcept not not_eq nullptr operator or or_eq private protected public
+    register reinterpret_cast requires return short signed sizeof static
+    static_assert static_cast struct switch template this thread_local throw
+    true try typedef typeid typename union unsigned using virtual void
+    volatile wchar_t while xor xor_eq
+""".split())
+
+# C++20 contextual spellings can be identifiers in some contexts, but can
+# become special after future emitter changes or on newer compilers.
+CPP_CONTEXTUAL = frozenset({"final", "override", "import", "module"})
+
+# Macros visible through the standard and engine headers included by every
+# generated TU.  Their expansion in a member declaration is invalid C++.
+CPP_STANDARD_MACROS = frozenset("""
+    __LINE__ __FILE__ __DATE__ __TIME__ __TIMESTAMP__ __cplusplus
+    __STDC__ __STDC_HOSTED__ __STDC_VERSION__ __STDC_MB_MIGHT_NEQ_WC__
+    __STDC_UTF_16__ __STDC_UTF_32__
+    NULL EOF NAN INFINITY HUGE_VAL HUGE_VALF HUGE_VALL
+    stdin stdout stderr assert offsetof va_start va_end va_arg va_copy
+    EXIT_SUCCESS EXIT_FAILURE RAND_MAX MB_CUR_MAX EDOM ERANGE EILSEQ
+    CHAR_BIT CHAR_MIN CHAR_MAX SCHAR_MIN SCHAR_MAX UCHAR_MAX
+    SHRT_MIN SHRT_MAX USHRT_MAX INT_MIN INT_MAX UINT_MAX
+    LONG_MIN LONG_MAX ULONG_MAX LLONG_MIN LLONG_MAX ULLONG_MAX
+    INT8_MIN INT8_MAX UINT8_MAX INT16_MIN INT16_MAX UINT16_MAX
+    INT32_MIN INT32_MAX UINT32_MAX INT64_MIN INT64_MAX UINT64_MAX
+    INTPTR_MIN INTPTR_MAX UINTPTR_MAX PTRDIFF_MIN PTRDIFF_MAX
+    SIZE_MAX SIG_ATOMIC_MIN SIG_ATOMIC_MAX WCHAR_MIN WCHAR_MAX
+    WINT_MIN WINT_MAX INTMAX_MIN INTMAX_MAX UINTMAX_MAX
+    M_E M_PI M_LOG2E M_LOG10E M_LN2 M_LN10 M_PI_2 M_PI_4
+    M_1_PI M_2_PI M_2_SQRTPI M_SQRT2 M_SQRT1_2
+    PINEFORGE_HAS_NATIVE_LOWERING_V1 PINEFORGE_HAS_NATIVE_LIVE_V1
+    PINEFORGE_HAS_AUX_SECURITY_FEED_V1 PINEFORGE_HAS_SCRIPT_RUN_PREPARE_V1
+    PINEFORGE_HAS_EXPLICIT_PINE_CAP_V1
+    PINEFORGE_HAS_EXPLICIT_PINE_EXECUTION_ADAPTER_V1
+    PINEFORGE_NO_STRATEGY_DECLS PF_PINE_TIME_HAS_SESSION_DAY
+    PF_PINE_TIME_SESSION_DAY_ARGS PF_VWAP_HAS_SESSION_ANCHOR
+    PF_VWAP_SESSION_ANCHOR_ARGS PF_ALMA_HAS_FLOOR
+    PF_KC_HAS_USE_TRUE_RANGE PF_VWAP_HAS_ANCHOR_INPUT
+    PF_PIVOT_LEVELS_HAS_ANCHOR
+""".split())
+
+# Identifiers used by the emitter as class/type names, namespaces, and
+# generated or inherited methods.  A user member with one of these names can
+# hide a type/callee, or (GeneratedStrategy) conflict with the constructor.
+CPP_EMITTER_NAMES = frozenset("""
+    GeneratedStrategy BacktestEngine Bar Series PineArray PineMap PineMatrix
+    PineGenericMatrix PineStrategyConfig PineStrategyHost StrategyOverrides
+    SymInfo ReportC MagnifierDistribution ChartPoint Line Box Label Linefill
+    std pineforge ta math
+    on_bar on_source_bar prepare_script_run configure_pine_strategy
+    configure_security_evaluators snapshot_script_state restore_script_state
+    commit_script_state set_strategy_override set_input
+    set_magnifier_volume_weighted strategy_declares_bar_magnifier fill_report run
+    precalculate
+    strategy_entry strategy_close strategy_close_all strategy_exit
+    strategy_exit_cancel_bracket strategy_cancel strategy_cancel_all strategy_order
+    pine_bar_index pine_last_bar_index prev_chart_close is_first_tick is_last_tick
+    history_advances_new_bar security_series_slot_is_new last_bar_dual_entry_path
+    live_position_size pending_order_count market_admission_journal
+    pine_time pine_time_close pine_time_tradingday pine_random
+    pine_runtime_error pine_enum_str_at pine_session_ismarket
+    pine_session_ispostmarket pine_session_ispremarket _PFSessionMarket
+    _pf_session_market_ script_tf_
+    tf_change tf_is_daily tf_is_intraday tf_is_monthly tf_is_seconds
+    tf_is_weekly tf_multiplier tf_to_seconds time_close timestamp main_period
+    round_to_mintick calc_qty
+    pf_noop
+    pf_line_new pf_line_new_pts pf_line_copy pf_line_delete
+    pf_line_get_price pf_line_get_x1 pf_line_get_x2 pf_line_get_y1 pf_line_get_y2
+    pf_line_set_first_point pf_line_set_second_point pf_line_set_x1 pf_line_set_x2
+    pf_line_set_xloc pf_line_set_xy1 pf_line_set_xy2 pf_line_set_y1 pf_line_set_y2
+    pf_label_new pf_label_new_pt pf_label_copy pf_label_delete
+    pf_label_get_text pf_label_get_x pf_label_get_y pf_label_set_point
+    pf_label_set_text pf_label_set_x pf_label_set_xloc pf_label_set_xy
+    pf_label_set_y pf_label_set_yloc
+    pf_box_new pf_box_new_pts pf_box_copy pf_box_delete
+    pf_box_get_bottom pf_box_get_left pf_box_get_right pf_box_get_top
+    pf_box_set_bottom pf_box_set_bottom_right_point pf_box_set_left
+    pf_box_set_lefttop pf_box_set_right pf_box_set_rightbottom pf_box_set_top
+    pf_box_set_top_left_point pf_box_set_xloc
+    pf_linefill_new pf_linefill_delete pf_linefill_get_line1 pf_linefill_get_line2
+    _PF_DRAWING_UNBOUNDED _PFDrawingArg _pf_drawing_get _pf_drawing_set
+    _pf_drawing_na _pf_collect_drawings _pf_collect_lines_ _pf_collect_boxes_
+    _pf_collect_labels_ _pf_new _pf_held
+    get_input_int get_input_float get_input_bool get_input_string
+    trace is_na na nz fixnan
+""".split())
+
+# The generated history members, ``_<kind>_<n>`` (codegen/base.py
+# _prepare_inline_history_members), numbered past any script name spelled
+# like one.
+INLINE_HISTORY_KINDS = (
+    "hist_call", "series_arg", "udf_series_arg", "session_call", "fn_global_hist",
+)
+
+
+# HOST_MEMBER_NAMES (codegen/host_members.py, derived by
+# scripts/gen_host_members.py from the emitter and the host header): the host
+# members the generated class reads or writes unqualified. A script identifier
+# with one of these names would hide the member (``session_isfirstbar_ =
+# close > open`` became the value of ``session.isfirstbar``).
+CPP_RESERVED = set(
+    LEGACY_CPP_RESERVED | CPP_KEYWORDS | CPP_CONTEXTUAL |
+    CPP_STANDARD_MACROS | CPP_EMITTER_NAMES | HOST_MEMBER_NAMES
+)
+
+# Temporaries the emitter declares in the C++ it generates around a user's
+# expression: nz's ``[&]{ auto _nz_v = (x); ... }()``, a comparison's
+# ``_pna_l`` / ``_pna_r``, a history read's ``_hv``, a switch's
+# ``__switch_val_N``, timestamp()'s calendar fields, the str.* / array.*
+# templates' locals (``__pf_s``, ``__pf_it``, ...). An authored identifier
+# spelled like one was captured: the generated local shadowed it where the
+# user's expression read it (``nz(x, _nz_v)`` read the lambda's own
+# ``_nz_v``) or initialized itself from itself (``_pna_l > close`` did not
+# compile). ``_safe_name`` escapes an authored spelling of any of them. A
+# temporary whose name the emitter allocates against the authored spellings
+# itself (``__pf_map_iter_N``, ``_pf_udt_Item__pf2``) is not listed.
+CPP_TEMPORARY_NAMES = frozenset("""
+    _nz_v _nz_y _fixnan_v _pna_l _pna_r _pfc_l _pfc_r _pfc_eq _hv _hidx _sv
+    _out _func_ret _pf_v _pf_idx_v _pf_idx_t _pf_bool_v _pf_bool_t
+    _pf_color_v _pf_color_t _pf_color_base _pf_color_alpha _pf_sign_v
+    _pf_series_raw _pf_raw _pf_val_t _pf_out _pf_prior
+    _pf_hist_offset_raw _pf_hist_offset_numeric _pf_hist_offset _pf_hist_bar
+    _pf_calendar_ts _pf_calendar_tz
+    _tz _yr _mo _dy _hr _min _sc _res _old _old_tz _had_old _secs
+    _last_tz _last_yr _last_mo _last_dy _last_hr _last_min _last_sc
+    _last_res
+    __pf_s __pf_r __pf_p __pf_i __pf_j __pf_t __pf_it __pf_m __pf_c __pf_n
+    __pf_k __pf_b __pf_ma __pf_mb __pf_f __pf_d __pf_best __pf_bc __pf_rank
+    __pf_idx __pf_occ
+""".split())
+_CPP_TEMPORARY_PATTERN = re.compile(
+    r"_v\d+|_secval_\d+(?:_v\d+)?|_tuple_result_\d+|_tuple_unused_\d+|__switch_val_\d+"
+    r"|_for_(?:start|end|end_eval)_\d+|_pf_(?:str|array|round)_a\d+"
+    r"|_pf_every_bar_ta_\d+|_pf_shared_\d+_\d+|__pf_array\w*|__pf_raw_\w+"
+)
+
+
+def is_emitter_temporary(name: str) -> bool:
+    """Whether ``name`` is spelled like a temporary of the emitter's."""
+    return (name in CPP_TEMPORARY_NAMES
+            or _CPP_TEMPORARY_PATTERN.fullmatch(name) is not None)
 
 
 # Bare C++ identifiers that ``strategy.*`` (and a few other) read-only
@@ -55,6 +395,9 @@ BUILTIN_ACCESSOR_NAMES = {
     "avg_winning_trade_percent", "avg_losing_trade_percent",
     "margin_liquidation_price", "open_profit", "current_equity",
     "open_trades_capital_held",
+    # The host's own ``time_close()``: a ``time_close[k]`` history Series
+    # member of that name would shadow the call its value is pushed from.
+    "time_close",
 }
 
 
@@ -77,12 +420,90 @@ class NamingHelper:
             .replace('"', '\\"')
             .replace("\n", "\\n")
             .replace("\r", "\\r")
+            .replace("\t", "\\t")
         )
 
+    def _initialise_safe_names(self, ast) -> None:
+        """Reserve all authored spellings before assigning escaped ones.
+
+        A fixed ``_name_`` escape can itself collide with an authored
+        ``_name_``.  Pre-allocating against the entire AST makes the mapping
+        stable and one-to-one regardless of emission order.
+        """
+        authored: set[str] = set()
+        bound: set[str] = set()
+        for node, _depth in iter_ast_nodes(ast):
+            for attr in ("name", "var", "member"):
+                value = getattr(node, attr, None)
+                if isinstance(value, str) and value:
+                    authored.add(value)
+            for attr in ("names", "vars", "params", "members"):
+                values = getattr(node, attr, None)
+                if isinstance(values, list):
+                    authored.update(value for value in values
+                                    if isinstance(value, str) and value)
+            if isinstance(node, TypeDecl):
+                authored.update(field.name for field in node.fields)
+                bound.add(node.name)
+                bound.update(field.name for field in node.fields)
+            elif isinstance(node, EnumDecl):
+                bound.add(node.name)
+                bound.update(node.members)
+            elif isinstance(node, VarDecl):
+                bound.add(node.name)
+            elif isinstance(node, TupleAssign):
+                bound.update(node.names)
+            elif isinstance(node, (FuncDef, MethodDef)):
+                bound.add(node.name)
+                bound.update(node.params)
+            elif isinstance(node, (ForStmt, ForInStmt)):
+                if node.var:
+                    bound.add(node.var)
+                if isinstance(getattr(node, "vars", None), list):
+                    bound.update(node.vars)
+        # A history-read builtin becomes a Series member of its own name.
+        ctx = getattr(self, "ctx", None)
+        if "time_close" in getattr(ctx, "series_vars", ()):
+            bound.add("time_close")
+        self._safe_name_map: dict[str, str] = {}
+        self._safe_name_occupied = authored
+        self._safe_name_bound = bound
+        for name in sorted(bound):
+            if (name in CPP_RESERVED or name in BUILTIN_ACCESSOR_NAMES
+                    or is_emitter_temporary(name)):
+                self._allocate_safe_name(name)
+
+    def _allocate_safe_name(self, name: str) -> str:
+        if name in LEGACY_CPP_RESERVED or name in BUILTIN_ACCESSOR_NAMES:
+            base = f"_{name}_"
+        else:
+            base = f"pf_safe_{name}"
+        occupied = getattr(self, "_safe_name_occupied", set())
+        candidate = base
+        suffix = 2
+        while (candidate in occupied or candidate in CPP_RESERVED
+               or candidate in BUILTIN_ACCESSOR_NAMES
+               or is_emitter_temporary(candidate)):
+            candidate = f"{base}_{suffix}"
+            suffix += 1
+        self._safe_name_map[name] = candidate
+        occupied.add(candidate)
+        return candidate
+
     def _safe_name(self, name: str) -> str:
-        """Rename identifiers that collide with C++ reserved words."""
-        if name in CPP_RESERVED or name in BUILTIN_ACCESSOR_NAMES:
-            return f"_{name}_"
+        """Rename Pine identifiers that collide with emitted C++ names."""
+        mapping = getattr(self, "_safe_name_map", None)
+        if mapping is not None and name in mapping:
+            return mapping[name]
+        if mapping is not None and name not in self._safe_name_bound:
+            return name
+        if (name in CPP_RESERVED or name in BUILTIN_ACCESSOR_NAMES
+                or is_emitter_temporary(name)):
+            if mapping is None:
+                return (f"_{name}_" if name in LEGACY_CPP_RESERVED
+                        or name in BUILTIN_ACCESSOR_NAMES
+                        else f"pf_safe_{name}")
+            return self._allocate_safe_name(name)
         return name
 
     def _func_safe_name(self, name: str) -> str:

package/pineforge_codegen/codegen/host_members.py

@@ -0,0 +1,162 @@
+"""Host members the generated C++ can read or write. GENERATED: do not
+edit; run ``scripts/gen_host_members.py``.
+
+Every public or protected member of ``pineforge::source::PineStrategyHost`` and its
+bases that the emitter's string constants spell. A script identifier
+with one of these names would hide the host's member from the generated
+strategy class, so ``_safe_name`` renames it.
+"""
+
+HOST_MEMBER_NAMES = frozenset({
+    "_src_close_",
+    "_src_high_",
+    "_src_hl2_",
+    "_src_hlc3_",
+    "_src_hlcc4_",
+    "_src_low_",
+    "_src_ohlc4_",
+    "_src_open_",
+    "_src_series_active_",
+    "_src_volume_",
+    "avg_losing_trade",
+    "avg_losing_trade_percent",
+    "avg_trade",
+    "avg_trade_percent",
+    "avg_winning_trade",
+    "avg_winning_trade_percent",
+    "bar_index_",
+    "barstate_islast_",
+    "cancel",
+    "cancel_all",
+    "clear_security",
+    "closed_trade_commission",
+    "closed_trade_direction",
+    "closed_trade_entry_bar_index",
+    "closed_trade_entry_comment",
+    "closed_trade_entry_id",
+    "closed_trade_entry_price",
+    "closed_trade_entry_time",
+    "closed_trade_equity",
+    "closed_trade_exit_bar_index",
+    "closed_trade_exit_comment",
+    "closed_trade_exit_id",
+    "closed_trade_exit_price",
+    "closed_trade_exit_time",
+    "closed_trade_max_drawdown",
+    "closed_trade_max_drawdown_percent",
+    "closed_trade_max_runup",
+    "closed_trade_max_runup_percent",
+    "closed_trade_profit",
+    "closed_trade_profit_percent",
+    "closed_trade_size",
+    "commit_script_state",
+    "configure_pine_strategy",
+    "configure_security_evaluators",
+    "count_losstrades",
+    "count_wintrades",
+    "current_bar_",
+    "current_equity",
+    "evaluate_security",
+    "eventrades",
+    "fill_report",
+    "foreign_context_",
+    "get_input_bool",
+    "get_input_double",
+    "get_input_int",
+    "get_input_int64",
+    "get_input_source",
+    "get_input_string",
+    "get_syminfo_metadata",
+    "gross_loss",
+    "gross_profit",
+    "grossloss_percent",
+    "grossprofit_percent",
+    "history_advances_new_bar",
+    "initial_capital_",
+    "input_tf_",
+    "is_first_tick",
+    "is_last_tick_",
+    "last_bar_time_",
+    "main_period",
+    "margin_liquidation_price",
+    "max_contracts_held_all",
+    "max_contracts_held_long",
+    "max_contracts_held_short",
+    "max_drawdown_",
+    "max_drawdown_percent",
+    "max_runup_",
+    "max_runup_percent",
+    "net_profit",
+    "on_source_bar",
+    "open_profit",
+    "open_trade_commission",
+    "open_trade_direction",
+    "open_trade_entry_bar_index",
+    "open_trade_entry_comment",
+    "open_trade_entry_id",
+    "open_trade_entry_price",
+    "open_trade_entry_time",
+    "open_trade_max_drawdown",
+    "open_trade_max_drawdown_percent",
+    "open_trade_max_runup",
+    "open_trade_max_runup_percent",
+    "open_trade_profit",
+    "open_trade_profit_percent",
+    "open_trade_size",
+    "open_trades_capital_held",
+    "pine_bar_index",
+    "pine_last_bar_index",
+    "pine_session_ismarket",
+    "pine_session_ispostmarket",
+    "pine_session_ispremarket",
+    "pine_time_offset",
+    "position_entry_name",
+    "position_entry_price_",
+    "prepare_script_run",
+    "prev_bar_timestamp_",
+    "prev_chart_close",
+    "pyramid_entries_",
+    "recorded_series_",
+    "recorded_series_value",
+    "register_security_eval",
+    "register_security_lower_tf_eval",
+    "restore_script_state",
+    "round_to_mintick",
+    "run",
+    "script_tf_",
+    "security_column_value",
+    "security_eval_states_",
+    "security_lower_tf_sub_bar_index",
+    "security_series_slot_is_new",
+    "session_isfirstbar_",
+    "session_isfirstbar_regular_",
+    "session_islastbar_",
+    "session_islastbar_regular_",
+    "session_ismarket_",
+    "set_input",
+    "set_magnifier_volume_weighted",
+    "set_pine_risk_direction",
+    "set_pine_risk_max_cons_loss_days",
+    "set_pine_risk_max_drawdown",
+    "set_pine_risk_max_intraday_filled_orders",
+    "set_pine_risk_max_intraday_loss",
+    "set_pine_risk_max_position_size",
+    "set_strategy_override",
+    "signed_position_size",
+    "snapshot_script_state",
+    "strategy_cancel",
+    "strategy_cancel_all",
+    "strategy_close",
+    "strategy_entry",
+    "strategy_exit",
+    "strategy_exit_cancel_bracket",
+    "strategy_order",
+    "symbol_facts_",
+    "symbol_feeds_",
+    "syminfo_",
+    "syminfo_mintick_",
+    "time_close",
+    "trace",
+    "trace_enabled_",
+    "trades_",
+})