@pineforge/codegen-pyodide 1.2.0 → 1.3.0

package/LICENSE

@@ -1,6 +1,14 @@
-PineForge Source License 1.1
+PineForge Source License 1.2
 ============================
 
+Version 1.2, 2026-10-05. Compared with 1.1, two places change. In the
+Personal Trading section, the last bullet now says that an account a
+proprietary-trading firm or funded-trader program provides or allocates,
+including a challenge, evaluation or simulated account, is not the
+person's own account or capital. In the Commercial Use section, the
+definition of investment capital now covers the capital in such an
+account, real or simulated.
+
 Copyright 2025-2026 pineforge, LLC
 
 Required Notice: Copyright 2025-2026 pineforge, LLC (https://github.com/pineforge-4pass/pineforge-codegen-oss)
@@ -134,7 +142,12 @@ For Personal Trading:
     program or anyone else outside the person's household provides or
     allocates to the person to trade, and that the provider still owns or
     whose losses the provider bears, is not the person's own capital, even
-    if the person shares in the profits.
+    if the person shares in the profits. An account that a
+    proprietary-trading firm or a funded-trader program provides or
+    allocates to the person to trade, including a challenge, evaluation or
+    simulated account, whether the capital in it is real or simulated, is
+    likewise not the person's own account and is not funded by the
+    person's own capital.
 
 
 ## Commercial Use
@@ -149,7 +162,10 @@ in each case whoever the capital belongs to and whether or not for a fee.
 trading, including capital belonging to any other person or entity, such as a
 friend or relative, clients or investors, an endowment, a pension or
 retirement fund, a sovereign or other public fund, or the treasury or reserves
-of a foundation or other organization.
+of a foundation or other organization. The capital in an account that a
+proprietary-trading firm or a funded-trader program provides or allocates
+to a person or entity to trade, including a challenge, evaluation or
+simulated account, is investment capital whether it is real or simulated.
 
 **Commercial Use** means any use of the software that is not a permitted
 purpose, other than distributing copies under the Distribution License

package/README.md

@@ -19,7 +19,8 @@ Stable releases are on the `latest` dist-tag. A prerelease (for example
 - `pineforge_codegen/diagnostics_catalog.json` — the diagnostics catalog (since 1.2.0), also
   importable as `@pineforge/codegen-pyodide/diagnostics_catalog.json`; the repository's
   `docs/PUBLIC_CONTRACT.md` describes it.
-- `LICENSE` — the PineForge Source License 1.1 (since 1.2.0), which `package.json` names.
+- `LICENSE` — the PineForge Source License (since 1.2.0), which `package.json` names:
+  version 1.1 in release 1.2.0, version 1.2 from release 1.3.0 on.
 
 ## Publishing (maintainers)
 A `v*` tag push, which the release workflow makes, publishes through npm OIDC Trusted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pineforge/codegen-pyodide",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Gate-validated Pyodide payload for the PineScript v6 -> C++ transpiler: archive (run in Pyodide), unpacked source, introspected tables, and release metadata.",
   "type": "module",
   "main": "index.mjs",

package/pineforge_codegen/codegen/base.py

@@ -240,6 +240,9 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
     def __init__(self, ctx: AnalyzerContext,
                  budget: TimeBudget | None = None) -> None:
         self.ctx = ctx
+        self._order_shape_calls = {}
+        self._order_shape_host_reads: set[str] = set()
+        self._order_shape_constructor: list[str] = []
         self._budget = budget
         self._budget_visit_count = 0
         self._initialise_safe_names(ctx.ast)
@@ -4490,7 +4493,8 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
         self._prepare_lazy_source_clock_sites()
         self.block_locals_needing_names = self._block_locals_needing_names()
 
-        lines: list[str] = []
+        from .order_shapes import HostReadLines
+        lines: list[str] = HostReadLines(self._order_shape_host_reads)
 
         # Series<T> ctor-arg suffix from any max_bars_back directive (empty when
         # absent, so directive-free output is byte-identical to before).
@@ -5450,7 +5454,12 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
         if self._uses_session_market:
             lines.insert(_session_market_member_at, SESSION_MARKET_MEMBER)
             lines.insert(_session_market_at, SESSION_MARKET_CPP)
+            self._capabilities_export_at += 2
 
+        from .capabilities import emit_capabilities_exports
+        exports: list[str] = []
+        emit_capabilities_exports(self, exports)
+        lines[self._capabilities_export_at:self._capabilities_export_at] = exports
         cpp = "\n".join(lines)
         self._settle_session_reads(cpp)
         return cpp

package/pineforge_codegen/codegen/capabilities.py

@@ -3,7 +3,7 @@
 import json
 import math
 
-from ..ast_nodes import BoolLiteral, FuncCall, Identifier, MemberAccess, NumberLiteral, StrategyDecl, StringLiteral, UnaryOp, VarDecl
+from ..ast_nodes import BoolLiteral, FuncCall, Identifier, MemberAccess, NumberLiteral, StrategyDecl, StringLiteral, Subscript, UnaryOp, VarDecl
 from ..external_requests import CAPABILITY_UNPINNED_ANNOTATION
 from ..limits import iter_ast_nodes
 
@@ -34,6 +34,28 @@ DECLARATION_DEFAULTS = {
     "calc_on_every_history_tick": False,
 }
 
+MODELED_ORDER_ARGUMENTS = {
+    "strategy.entry": frozenset(("id", "direction", "limit", "stop")),
+    "strategy.exit": frozenset(("id", "from_entry", "limit", "stop")),
+    "strategy.close": frozenset(("id", "immediately")),
+    "strategy.close_all": frozenset(("immediately",)),
+}
+READ_ONLY_STRATEGY_CALLS = frozenset(
+    f"strategy.{namespace}.{accessor}"
+    for namespace in ("opentrades", "closedtrades")
+    for accessor in ("entry_id", "entry_price", "entry_time", "entry_bar_index", "size",
+                     "profit", "profit_percent", "commission", "max_runup", "max_runup_percent",
+                     "max_drawdown", "max_drawdown_percent", "exit_id", "exit_price",
+                     "exit_time", "exit_bar_index", "entry_comment", "exit_comment")
+) | frozenset(("strategy.convert_to_account", "strategy.convert_to_symbol"))
+ORDER_SETTINGS = frozenset(("pyramiding", "default_qty_type", "default_qty_value", "initial_capital",
+                           "slippage", "commission_type", "commission_value", "close_entries_rule",
+                           "margin_long", "margin_short", "risk_free_rate"))
+PROVEN_BRACKET_SETTINGS = {"default_qty_type": "strategy.fixed", "default_qty_value": 1,
+                          "commission_type": "strategy.commission.percent", "commission_value": 0}
+PROVEN_SLIPPED_SETTINGS = {"default_qty_type": "strategy.percent_of_equity",
+                          "default_qty_value": 100, "slippage": 15}
+
 
 def _expression(node):
     if isinstance(node, (StringLiteral, NumberLiteral, BoolLiteral)):
@@ -44,6 +66,8 @@ def _expression(node):
         return f"{_expression(node.object)}.{node.member}"
     if isinstance(node, FuncCall):
         return f"{_expression(node.callee)}({','.join(str(_expression(arg)) for arg in node.args)})"
+    if isinstance(node, Subscript):
+        return f"{_expression(node.object)}[{_expression(node.index)}]"
     return None
 
 
@@ -61,13 +85,57 @@ def _literal(node):
     return _expression(node), False
 
 
-def capabilities_document(emitter) -> str:
+def _order_arguments(node):
+    name = _expression(node.callee)
+    positional = {
+        "strategy.entry": ("id", "direction", "qty", "limit", "stop", "oca_name", "oca_type", "comment", "alert_message", "disable_alert"),
+        "strategy.exit": ("id", "from_entry", "qty", "qty_percent", "profit", "limit", "loss", "stop", "trail_price", "trail_points", "trail_offset", "oca_name", "comment", "alert_message", "alert_profit", "alert_loss", "alert_trailing", "disable_alert"),
+        "strategy.close": ("id", "comment", "qty", "qty_percent", "alert_message", "immediately", "disable_alert"),
+        "strategy.close_all": ("comment", "alert_message", "immediately", "disable_alert"),
+    }.get(name, ())
+    arguments = {positional[index] if index < len(positional) else f"positional_{index}": argument
+                 for index, argument in enumerate(node.args)}
+    if arguments.keys() & node.kwargs.keys():
+        arguments["duplicate_argument"] = None
+    arguments.update(node.kwargs)
+    return arguments
+
+
+def _order_shape(node, short_ids):
+    name = _expression(node.callee)
+    arguments = _order_arguments(node)
+    if name not in MODELED_ORDER_ARGUMENTS or not set(arguments) <= MODELED_ORDER_ARGUMENTS[name]:
+        return name + (" (unproven exit terms)" if name == "strategy.exit" else " (unproven order shape)")
+    if name != "strategy.close_all" and not isinstance(arguments.get("id"), StringLiteral):
+        return name + " (unproven order id)"
+    if name == "strategy.entry" and _expression(arguments.get("direction")) in ("strategy.long", "strategy.short"):
+        priced = {key for key in ("limit", "stop") if key in arguments}
+        if len(priced) < 2 and not (set(arguments) & {"oca_name", "oca_type"}):
+            return "entry:" + (next(iter(priced)) if priced else "market")
+    if name == "strategy.exit":
+        if (set(arguments) & {"profit", "loss", "trail_price", "trail_points", "trail_offset", "qty", "qty_percent"}):
+            return name + " (unproven exit terms)"
+        if ("limit" in arguments and "stop" in arguments
+                and isinstance(arguments.get("from_entry"), StringLiteral)
+                and _expression(arguments["from_entry"]) in short_ids):
+            return "exit:short_bracket"
+    if name in ("strategy.close", "strategy.close_all"):
+        immediate = arguments.get("immediately")
+        if immediate is None or isinstance(immediate, BoolLiteral) and not immediate.value:
+            if not (set(arguments) & {"qty", "qty_percent"}):
+                return "close:market"
+    return name + " (unproven order shape)"
+
+
+def capabilities_documents(emitter) -> tuple[str, str]:
     declarations = dict(DECLARATION_DEFAULTS)
     unresolved = []
     requests = []
     lower_symbols = {}
     intrabar = False
     recorded = False
+    order_nodes = []
+    order_settings = {}
     for node, _depth in iter_ast_nodes(emitter.ctx.ast):
         if isinstance(node, StrategyDecl):
             arguments = {STRATEGY_PARAMETERS[index] if index < len(STRATEGY_PARAMETERS)
@@ -75,6 +143,8 @@ def capabilities_document(emitter) -> str:
                          for index, argument in enumerate(node.args)}
             unresolved.extend(arguments.keys() & node.kwargs.keys())
             arguments.update(node.kwargs)
+            order_settings.update({name: _literal(argument)[0] for name, argument in arguments.items()
+                                   if name in ORDER_SETTINGS})
             for name, argument in arguments.items():
                 value, valid = _literal(argument)
                 default = DECLARATION_DEFAULTS.get(name)
@@ -92,6 +162,9 @@ def capabilities_document(emitter) -> str:
             intrabar |= node.is_varip
         elif isinstance(node, FuncCall):
             name, namespace = emitter._resolve_callee(node.callee)
+            qualified = _expression(node.callee) or ""
+            if qualified.startswith("strategy.") and qualified not in READ_ONLY_STRATEGY_CALLS:
+                order_nodes.append(node)
             if namespace == "request" and name == "security_lower_tf":
                 expression = node.args[2] if len(node.args) > 2 else node.kwargs.get("expression")
                 lower_symbols[id(expression)] = node.args[0] if node.args else node.kwargs.get("symbol")
@@ -118,22 +191,27 @@ def capabilities_document(emitter) -> str:
             unresolved.append(f"{_expression(node)} (stream endpoint is not batch-equivalent)")
 
     auxiliary = False
+    confirmed_requests = []
+    lowering_sites = {site["sec_id"]: site for site in emitter._security_eval_info}
     for site in emitter._security_calls:
+        lowering = lowering_sites[site["sec_id"]]
         symbol_node = site.get("symbol_node")
         if site.get("is_lower_tf_array"):
             symbol_node = lower_symbols.get(id(site.get("expr_node")), symbol_node)
         if isinstance(symbol_node, FuncCall) and site.get("heikinashi") and symbol_node.args:
             symbol_node = symbol_node.args[0]
         symbol = _expression(symbol_node) if symbol_node is not None else "syminfo.tickerid"
-        timeframe = _expression(site.get("tf_node"))
+        timeframe = lowering.get("tf")
+        if timeframe is None:
+            timeframe = "timeframe.period" if lowering.get("tf_expr") == "script_tf_" else _expression(site.get("tf_node"))
         lookahead = _expression(site.get("lookahead_node")) or "barmerge.lookahead_off"
         gaps = _expression(site.get("gaps_node")) or "barmerge.gaps_off"
         if isinstance(symbol_node, Identifier) and symbol_node.name not in emitter._global_mutable_infos:
             symbol = _expression((getattr(emitter.ctx, "global_expr_map", {}) or {}).get(
                 symbol_node.name, symbol_node))
-        feed = "chart" if symbol in ("syminfo.tickerid", "syminfo.ticker", "") else "auxiliary"
+        feed = "auxiliary" if lowering.get("foreign") else "chart"
         auxiliary |= feed == "auxiliary"
-        if not isinstance(site.get("tf_node"), StringLiteral) and timeframe != "timeframe.period":
+        if lowering.get("tf") is None and timeframe != "timeframe.period":
             unresolved.append(f"request.security[{site['sec_id']}].timeframe")
         if lookahead not in ("barmerge.lookahead_off", "barmerge.lookahead_on"):
             unresolved.append(f"request.security[{site['sec_id']}].lookahead")
@@ -143,9 +221,14 @@ def capabilities_document(emitter) -> str:
             "timeframe": timeframe,
             "lookahead": lookahead,
             "gaps": gaps,
-            "heikinashi": bool(site.get("heikinashi")),
+            "heikinashi": bool(lowering.get("heikinashi")),
             "feed": feed,
         })
+        expression = _expression(site.get("expr_node"))
+        if expression in ("close", "close[1]", "ta.sma(close,4)", "ta.ema(close,3)") and "close" in (
+                getattr(emitter.ctx, "global_expr_map", {}) or {}):
+            unresolved.append("request.security.expression (user-bound close)")
+        confirmed_requests.append({**requests[-1], "expression": expression})
     for index, site in enumerate((emitter.ctx.ast.annotations or {}).get(CAPABILITY_UNPINNED_ANNOTATION, ())):
         requests.append({
             "function": site["function"],
@@ -166,13 +249,46 @@ def capabilities_document(emitter) -> str:
         "historical_probe_overrides": False,
         "intrabar_persistence": intrabar,
     }
-    return json.dumps({"version": 1, "declarations": declarations, "requests": requests,
-                       "requirements": requirements, "unresolved": sorted(set(unresolved))},
-                      sort_keys=True, separators=(",", ":"), allow_nan=False)
+    short_ids = set()
+    conflicting_ids = set()
+    dynamic_entry_id = False
+    for node in order_nodes:
+        if _expression(node.callee) != "strategy.entry":
+            continue
+        arguments = _order_arguments(node)
+        identifier = arguments.get("id")
+        if not isinstance(identifier, StringLiteral):
+            dynamic_entry_id = True
+        elif _expression(arguments.get("direction")) == "strategy.short":
+            short_ids.add(identifier.value)
+        else:
+            conflicting_ids.add(identifier.value)
+    if dynamic_entry_id or conflicting_ids:
+        short_ids.clear()
+    orders = set(_order_shape(node, short_ids - conflicting_ids) for node in order_nodes)
+    if declarations["process_orders_on_close"]:
+        bracket = orders == {"entry:market", "exit:short_bracket"}
+        proven = (not order_settings and not bracket) or (
+            bracket and order_settings == PROVEN_BRACKET_SETTINGS) or (
+            orders == {"entry:market"} and order_settings == PROVEN_SLIPPED_SETTINGS
+            and not confirmed_requests and not intrabar)
+        if not proven:
+            orders.add("strategy() (unproven POOC sizing, slippage or account settings)")
+    confirmed = {"version": 1, "requests": confirmed_requests,
+                 "orders": sorted(orders),
+                 "intrabar_persistence": intrabar}
+    encode = lambda value: json.dumps(value, sort_keys=True, separators=(",", ":"), allow_nan=False)
+    return (encode({"version": 1, "declarations": declarations, "requests": requests,
+                    "requirements": requirements, "unresolved": sorted(set(unresolved))}), encode(confirmed))
+
+
+def capabilities_document(emitter) -> str:
+    return capabilities_documents(emitter)[0]
 
 
 def emit_capabilities_exports(emitter, lines: list[str]) -> None:
-    literal = json.dumps(capabilities_document(emitter))
+    legacy, confirmed = capabilities_documents(emitter)
+    literal = json.dumps(legacy)
     lines.extend([
         "#ifdef PF_SETTINGS_API_VERSION",
         "#ifdef PF_CAPABILITIES_API_VERSION",
@@ -182,5 +298,22 @@ def emit_capabilities_exports(emitter, lines: list[str]) -> None:
         "        return ::pineforge::checked_settings::boundary(error, error_capacity, [&] {",
         '            ::pineforge::checked_settings::require(s != nullptr, "null strategy");',
         f"            ::pineforge::checked_settings::receipt({literal}, json, capacity, required);",
+        "        });", "    }",
+        "    uint32_t strategy_confirmed_bar_api_version(void) { return 1u; }",
+        "    int strategy_confirmed_bar_receipt(void* s, char* json, size_t capacity, size_t* required, char* error, size_t error_capacity) {",
+        "        if (required) *required = 0;",
+        "        return ::pineforge::checked_settings::boundary(error, error_capacity, [&] {",
+        '            ::pineforge::checked_settings::require(s != nullptr, "null strategy");',
+        f"            ::pineforge::checked_settings::receipt({json.dumps(confirmed)}, json, capacity, required);",
         "        });", "    }", "#endif", "#endif",
     ])
+    from .order_shapes import order_shapes_document
+    lines[-2:-2] = [
+        "    uint32_t strategy_order_shapes_api_version(void) { return 1u; }",
+        "    int strategy_order_shapes_receipt(void* s, char* json, size_t capacity, size_t* required, char* error, size_t error_capacity) {",
+        "        if (required) *required = 0;",
+        "        return ::pineforge::checked_settings::boundary(error, error_capacity, [&] {",
+        '            ::pineforge::checked_settings::require(s != nullptr, "null strategy");',
+        f"            ::pineforge::checked_settings::receipt({json.dumps(order_shapes_document(emitter))}, json, capacity, required);",
+        "        });", "    }",
+    ]

package/pineforge_codegen/codegen/checked_settings.py

@@ -1,7 +1,36 @@
 """Opt-in settings metadata, validation and exception-contained C exports."""
 
+import re
+
 from ..ast_nodes import Identifier, MemberAccess
 from ..errors import CompileError
+from .tables import ALERT_FREQ_VALUES, NAME_ECHO_STRING_MEMBERS, ORDER_DIRECTION_MAP
+
+
+_QUOTED_STRING = r'"(?:[^"\\]|\\.)*"'
+_STRING_LITERAL = re.compile(rf'(?:std::string\({_QUOTED_STRING}\)|{_QUOTED_STRING})')
+
+
+def _string_setting_arg(expr, lowered: str) -> str | None:
+    """Use the body's known string constants, never its inert visual codes.
+
+    Name-echo strings are accepted only for inventoried currency/format members.
+    Unknown constants leave the checked input unsupported; legacy getters
+    and setters retain their existing execution semantics.
+    """
+    if isinstance(expr, MemberAccess):
+        if not isinstance(expr.object, Identifier):
+            return None
+        namespace = expr.object.name
+        known = (
+            namespace == "alert" and expr.member in ALERT_FREQ_VALUES
+            or namespace == "order" and expr.member in ORDER_DIRECTION_MAP
+            or namespace == "session" and expr.member in ("regular", "extended")
+            or expr.member in NAME_ECHO_STRING_MEMBERS.get(namespace, ())
+        )
+        if not known:
+            return None
+    return lowered if _STRING_LITERAL.fullmatch(lowered) else None
 
 
 def _visit_setting_arg(emitter, expr) -> str:
@@ -51,7 +80,8 @@ def emit_settings_members(emitter, lines: list[str], constructor: list[str]) ->
         key = emitter._input_key_literal(name)
         default = emitter._get_input_default(node)
         getter = emitter._input_getter_for_call(node, func_name, namespace)
-        default_cpp = _visit_setting_arg(emitter, default) if default is not None else "0"
+        default_lowered = _visit_setting_arg(emitter, default) if default is not None else "0"
+        default_cpp = default_lowered
         default_cpp = emitter._coerce_string_input_default(getter, default_cpp)
         value_type = {
             "get_input_int": "int", "get_input_int64": "int",
@@ -63,6 +93,11 @@ def emit_settings_members(emitter, lines: list[str], constructor: list[str]) ->
         option_values = []
         supported = "true"
         default_serialized = None
+        if getter == "get_input_string":
+            default_serialized = _string_setting_arg(default, default_lowered)
+            if default_serialized is None:
+                default_serialized = 'std::string("")'
+                supported = "false"
         names, merged = emitter._merged_args(node, func_name, namespace)
         arguments = dict(zip(names or [], merged))
         arguments.update(node.kwargs)
@@ -103,8 +138,19 @@ def emit_settings_members(emitter, lines: list[str], constructor: list[str]) ->
             if declared:
                 for option in declared:
                     option_cpp = _visit_setting_arg(emitter, option)
-                    options.append(option_cpp if getter == "get_input_string" else
-                                   f'::pineforge::checked_settings::number({option_cpp})')
+                    if getter == "get_input_string":
+                        option_cpp = _string_setting_arg(option, option_cpp)
+                        if option_cpp is None:
+                            supported = "false"
+                        else:
+                            options.append(option_cpp)
+                    else:
+                        options.append(f'::pineforge::checked_settings::number({option_cpp})')
+            if getter == "get_input_string":
+                if arguments.get("options") is not None and declared is None:
+                    supported = "false"
+                if supported == "false":
+                    options = []
             expression = f'{getter}({key}, {default_cpp})'
             effective = (expression if getter == "get_input_string" else
                          f'::pineforge::checked_settings::number({expression})')

package/pineforge_codegen/codegen/emit_top.py

@@ -1281,6 +1281,7 @@ class TopLevelEmitter:
         lines.append("        pineforge::source::PineStrategyHost::set_strategy_override(overrides);")
         lines.append("    }")
         from .checked_settings import emit_settings_members
+        self._order_shape_constructor = tuple(ctor_body)
         emit_settings_members(self, lines, ctor_body)
 
         if self._uses_recorded_requests():
@@ -1314,7 +1315,7 @@ class TopLevelEmitter:
                 tf = info.get("tf")
                 tf_expr = info.get("tf_expr")
                 if tf:
-                    tf_expr = f'"{tf}"'
+                    tf_expr = self._security_tf_literal(tf)
                 elif tf == "" and not tf_expr:
                     # An empty timeframe string is the chart's.
                     tf_expr = "input_tf_"
@@ -1421,7 +1422,7 @@ class TopLevelEmitter:
         sec_id = info["sec_id"]
         symbol = self._security_tf_runtime_expr(info["symbol_node"])
         column = self._security_footprint_column(sec_id)
-        column = f', "{column}"' if column else ""
+        column = f', "{self._cpp_string_escape(column)}"' if column else ""
         ignore_node = info.get("ignore_invalid_node")
         if ignore_node is None:
             ignore = "false"
@@ -1886,7 +1887,7 @@ class TopLevelEmitter:
         for pragma in pragmas:
             cpp_expr = self._visit_expr(pragma.expr_node)
             lines.append(
-                f'{inner}trace(std::string("{pragma.name}"), '
+                f'{inner}trace(std::string("{self._cpp_string_escape(pragma.name)}"), '
                 f"(double)({cpp_expr}));"
             )
         lines.append(f"{pad}}}")
@@ -1998,8 +1999,7 @@ class TopLevelEmitter:
         lines.append("    }")
         from .checked_settings import emit_settings_exports
         emit_settings_exports(lines)
-        from .capabilities import emit_capabilities_exports
-        emit_capabilities_exports(self, lines)
+        self._capabilities_export_at = len(lines)
         if self._declares_bar_magnifier():
             # TradingView runs a script that declares use_bar_magnifier = true
             # on its bar magnifier; the host reads this export to run it on

package/pineforge_codegen/codegen/helpers.py

@@ -434,6 +434,12 @@ class NamingHelper:
             .replace("\t", "\\t")
         )
 
+    @staticmethod
+    def _cpp_comment_escape(s: str) -> str:
+        """Keep text (a script's string rendered into it) inside the C++
+        ``/* ... */`` comment it is written in."""
+        return s.replace("/*", "/ *").replace("*/", "* /")
+
     def _initialise_safe_names(self, ast) -> None:
         """Reserve all authored spellings before assigning escaped ones.
 

package/pineforge_codegen/codegen/order_shapes.py

@@ -0,0 +1,356 @@
+"""Immutable facts about emitted order parameters and execution context."""
+
+from collections import ChainMap, Counter
+from dataclasses import dataclass
+import json
+import math
+import re
+
+from ..ast_nodes import (
+    BinOp, BoolLiteral, ForInStmt, ForStmt, FuncCall, FuncDef, Identifier, IfStmt,
+    MemberAccess, MethodDef, NumberLiteral, StringLiteral, SwitchStmt, TupleAssign,
+    UnaryOp, VarDecl, WhileStmt,
+)
+from ..limits import iter_ast_nodes, syntax_children
+from .capabilities import READ_ONLY_STRATEGY_CALLS, _expression
+from .host_members import HOST_MEMBER_NAMES
+
+
+NUMERIC_PARAMETERS = frozenset((
+    "limit", "stop", "qty", "qty_percent", "trail_points", "trail_offset",
+    "trail_price", "profit_ticks", "loss_ticks",
+))
+FINITE_BAR_VALUES = frozenset(("open", "high", "low", "close", "hl2", "hlc3", "ohlc4", "hlcc4"))
+ENUM_VALUES = {
+    "strategy.oca.none": 0, "strategy.oca.cancel": 1, "strategy.oca.reduce": 2,
+    "strategy.fixed": 0, "strategy.percent_of_equity": 1, "strategy.cash": 2,
+}
+SETTING_DEFAULTS = {
+    "initial_capital": 10000.0, "default_qty_type": "fixed", "default_qty_value": 1.0,
+    "pyramiding": 1, "commission_type": "percent", "commission_value": 0.0,
+    "slippage": 0, "margin_long": 100.0, "margin_short": 100.0,
+    "close_entries_rule": "FIFO",
+}
+SETTING_ENUMS = {
+    "QtyType::FIXED": "fixed", "QtyType::PERCENT_OF_EQUITY": "percent_of_equity",
+    "QtyType::CASH": "cash", "CommissionType::PERCENT": "percent",
+    "CommissionType::CASH_PER_ORDER": "cash_per_order",
+    "CommissionType::CASH_PER_CONTRACT": "cash_per_contract",
+}
+CPP_TOKENS = re.compile(
+    r'R"(?P<delimiter>[^ ()\\\t\r\n]{0,16})\(.*?\)(?P=delimiter)"'
+    r'|"(?:\\.|[^"\\])*"|\'(?:\\.|[^\'\\])*\''
+    r'|//[^\n]*|/\*.*?(?:\*/|\Z)|[A-Za-z_][A-Za-z_0-9]*',
+    re.DOTALL,
+)
+
+
+def scan_host_reads(cpp: str) -> set[str]:
+    """Cross-check host tokens, excluding C++ strings and comments."""
+    return {match.group() for match in CPP_TOKENS.finditer(cpp)
+            if match.group() in HOST_MEMBER_NAMES}
+
+
+class HostReadLines(list):
+    """Record scaffold references when each fragment enters the emission buffer."""
+
+    def __init__(self, reads: set[str]):
+        super().__init__()
+        self.reads = reads
+        self.in_comment = False
+
+    def _record(self, fragment: str) -> None:
+        if self.in_comment:
+            end = fragment.find("*/")
+            if end < 0:
+                return
+            fragment = fragment[end + 2:]
+            self.in_comment = False
+        for match in CPP_TOKENS.finditer(fragment):
+            token = match.group()
+            if token in HOST_MEMBER_NAMES:
+                self.reads.add(token)
+            if token.startswith("/*") and not token.endswith("*/"):
+                self.in_comment = True
+
+    def append(self, fragment: str) -> None:
+        self._record(fragment)
+        super().append(fragment)
+
+    def extend(self, fragments) -> None:
+        if fragments is self:
+            fragments = list(fragments)
+        for fragment in fragments:
+            self.append(fragment)
+
+    def _record_rewrite(self) -> None:
+        self.in_comment = False
+        for fragment in self:
+            self._record(fragment)
+
+    def insert(self, index: int, fragment: str) -> None:
+        super().insert(index, fragment)
+        self._record_rewrite()
+
+    def __setitem__(self, index, fragments) -> None:
+        super().__setitem__(index, fragments)
+        self._record_rewrite()
+
+    def __iadd__(self, fragments):
+        self.extend(fragments)
+        return self
+
+    def __imul__(self, count):
+        super().__imul__(count)
+        self._record_rewrite()
+        return self
+
+    def __delitem__(self, index) -> None:
+        super().__delitem__(index)
+        self._record_rewrite()
+
+    def clear(self) -> None:
+        super().clear()
+        self._record_rewrite()
+
+    def pop(self, index=-1):
+        fragment = super().pop(index)
+        self._record_rewrite()
+        return fragment
+
+    def remove(self, fragment) -> None:
+        super().remove(fragment)
+        self._record_rewrite()
+
+    def reverse(self) -> None:
+        super().reverse()
+        self._record_rewrite()
+
+    def sort(self, *, key=None, reverse=False) -> None:
+        try:
+            super().sort(key=key, reverse=reverse)
+        finally:
+            self._record_rewrite()
+
+
+@dataclass(frozen=True)
+class LoweredParameter:
+    text: str
+    node: object
+    default: str | None = None
+
+
+@dataclass
+class LoweredCall:
+    node: FuncCall
+    call: str
+    parameters: dict[str, LoweredParameter]
+    context: str
+    form: str | None = None
+
+
+def record_order_call(emitter, node, call, parameters, form=None) -> None:
+    """Called only by a branch that lowers the corresponding order command."""
+    key = (id(node), getattr(emitter, "_current_instance_name", None))
+    emitter._order_shape_calls.setdefault(key, LoweredCall(
+        node, call, {name: LoweredParameter(*value) for name, value in parameters.items()},
+        "repeatable" if getattr(emitter, "_current_func_body", None) is not None else "straight", form,
+    ))
+
+
+def _literal(node, bindings):
+    if isinstance(node, (NumberLiteral, StringLiteral, BoolLiteral)):
+        return node.value
+    if isinstance(node, Identifier):
+        return bindings.get(node.name)
+    if isinstance(node, UnaryOp) and node.op in ("+", "-"):
+        value = _literal(node.operand, bindings)
+        if type(value) in (int, float):
+            return value if node.op == "+" else -value
+    return None
+
+
+def _finite(value) -> bool:
+    return type(value) in (int, float) and math.isfinite(value)
+
+
+def _never_na(node, bindings) -> bool:
+    if _finite(_literal(node, bindings)):
+        return True
+    if isinstance(node, Identifier):
+        return node.name in FINITE_BAR_VALUES and node.name not in bindings
+    if isinstance(node, UnaryOp) and node.op in ("+", "-"):
+        return _never_na(node.operand, bindings)
+    if isinstance(node, BinOp):
+        if node.op in ("+", "-"):
+            return _never_na(node.left, bindings) and _never_na(node.right, bindings)
+        if node.op == "*":
+            return ((_finite(_literal(node.left, bindings)) and _never_na(node.right, bindings))
+                    or (_finite(_literal(node.right, bindings)) and _never_na(node.left, bindings)))
+    return False
+
+
+def parameter_class(name, parameter, bindings):
+    if parameter.text == parameter.default:
+        return "absent"
+    value = _literal(parameter.node, bindings)
+    if name in ("id", "from_entry"):
+        if parameter.node is None and parameter.text == '\"\"':
+            value = ""
+        if isinstance(value, str):
+            return ("global" if not value else "named") if name == "from_entry" else (
+                "literal" if value else "empty")
+        return "dynamic"
+    if name == "direction":
+        if parameter.text == "true":
+            return "long"
+        if parameter.text == "false":
+            return "short"
+        return "dynamic"
+    if name in NUMERIC_PARAMETERS:
+        if _finite(value):
+            return "literal"
+        return "never_na" if _never_na(parameter.node, bindings) else "maybe_na"
+    if name in ("comment", "oca_name"):
+        if value == "":
+            return "absent"
+        return "literal" if isinstance(value, str) else "dynamic"
+    if name in ("oca_type", "qty_type"):
+        if isinstance(parameter.node, MemberAccess):
+            value = ENUM_VALUES.get(_expression(parameter.node))
+        if _finite(value) and str(int(value)) == parameter.default and value == int(value):
+            return "absent"
+        return f"literal:{int(value)}" if _finite(value) and value == int(value) else "dynamic"
+    if name == "immediately":
+        return "literal:true" if value is True else "dynamic"
+    raise ValueError(f"unclassified lowered order parameter: {name}")
+
+
+def _site_facts(ast, mutable_globals, recorded_nodes):
+    """Source ordering, lexical shadows, and repeatability for authored call sites."""
+    bindings = {}
+    for node in ast.body:
+        if isinstance(node, VarDecl):
+            value = _literal(node.value, bindings)
+            bindings[node.name] = (value if not node.is_var and not node.is_varip
+                                   and node.name not in mutable_globals else None)
+    facts = {}
+
+    def block(statements, repeatable, visible, names=()):
+        local = {name: None for name in names}
+        scope = ChainMap(local, visible)
+        for statement in statements:
+            walk(statement, repeatable, scope)
+            if isinstance(statement, VarDecl):
+                local[statement.name] = None
+            elif isinstance(statement, TupleAssign):
+                local.update({name: None for name in statement.names})
+
+    def walk(node, repeatable, visible):
+        if id(node) in recorded_nodes:
+            facts[id(node)] = (len(facts), "repeatable" if repeatable else "straight", dict(visible))
+        if isinstance(node, (FuncDef, MethodDef)):
+            block(node.body, True, visible,
+                  (name if isinstance(name, str) else name[0] for name in node.params))
+        elif isinstance(node, (ForStmt, ForInStmt, WhileStmt)):
+            for field in ("start", "end", "step", "iterable", "condition"):
+                expression = getattr(node, field, None)
+                if expression is not None:
+                    walk(expression, True, visible)
+            names = ([node.var] if node.var else node.vars or []) if isinstance(node, (ForStmt, ForInStmt)) else ()
+            block(node.body, True, visible, names)
+        elif isinstance(node, IfStmt):
+            walk(node.condition, repeatable, visible)
+            block(node.body, repeatable, visible)
+            block(node.else_body, repeatable, visible)
+        elif isinstance(node, SwitchStmt):
+            if node.expr is not None:
+                walk(node.expr, repeatable, visible)
+            for condition, statements in node.cases:
+                if condition is not None:
+                    walk(condition, repeatable, visible)
+                block(statements, repeatable, visible)
+            block(node.default_body, repeatable, visible)
+        else:
+            for child in reversed(list(syntax_children(node))):
+                walk(child, repeatable, visible)
+
+    for statement in ast.body:
+        walk(statement, False, bindings)
+    return facts
+
+
+def settings_echo(constructor):
+    settings = dict(SETTING_DEFAULTS)
+    pooc = False
+    for statement in constructor:
+        match = re.fullmatch(r"        cfg\.(\w+) = (.*);", statement)
+        if match is None:
+            continue
+        name, text = match.groups()
+        if name == "process_orders_on_close":
+            pooc = text == "true"
+        elif name == "close_entries_rule_any":
+            settings["close_entries_rule"] = "ANY" if text == "true" else "FIFO"
+        elif name in settings:
+            if text.startswith("static_cast<int>("):
+                settings[name] = SETTING_ENUMS[text[len("static_cast<int>("):-1]]
+            else:
+                value = float(text)
+                settings[name] = (int(value) if name in ("pyramiding", "slippage") else value) if math.isfinite(value) else None
+    return settings, pooc
+
+
+def order_shapes_document(emitter) -> str:
+    recorded_nodes = {id(record.node) for record in emitter._order_shape_calls.values()}
+    facts = _site_facts(emitter.ctx.ast, emitter.ctx.global_mutable_infos, recorded_nodes)
+    records = sorted(emitter._order_shape_calls.values(), key=lambda record: (
+        record.node.loc.line if record.node.loc else 0,
+        record.node.loc.col if record.node.loc else 0,
+        facts.get(id(record.node), (len(facts),))[0],
+    ))
+    calls = []
+    ids = []
+    for site, record in enumerate(records):
+        _order, context, bindings = facts.get(id(record.node), (site, record.context, {}))
+        descriptor = {"site": site, "call": record.call, "context": context}
+        if record.form is not None:
+            descriptor["form"] = record.form
+        descriptor.update({name: parameter_class(name, parameter, bindings)
+                           for name, parameter in record.parameters.items()})
+        calls.append(descriptor)
+        ids.append({name: _literal(parameter.node, bindings) if parameter.node is not None else ""
+                    for name, parameter in record.parameters.items() if name in ("id", "from_entry")})
+    entries = [(site, ids[site].get("id"), call.get("direction"))
+               for site, call in enumerate(calls) if call["call"] in ("entry", "order")
+               and call["id"] in ("literal", "empty")]
+    long_ids = {name for _site, name, direction in entries if direction == "long"}
+    short_ids = {name for _site, name, direction in entries if direction == "short"}
+    for site, call in enumerate(calls):
+        if call["call"] not in ("exit", "close", "cancel"):
+            continue
+        target = ids[site].get("from_entry" if call["call"] == "exit" else "id")
+        global_target = target == "" and call["call"] in ("exit", "close")
+        matching = [(entry_site, direction) for entry_site, name, direction in entries
+                    if global_target or target is not None and target == name]
+        directions = {direction for _entry_site, direction in matching}
+        call["target"] = ("both" if "dynamic" in directions or directions >= {"long", "short"}
+                          else "long" if "long" in directions else "short" if "short" in directions
+                          else "dangling")
+        if call["call"] == "exit":
+            before = any(entry_site > site for entry_site, _direction in matching)
+            after = any(entry_site < site for entry_site, _direction in matching)
+            call["order"] = "mixed" if before and after or not matching else "before" if before else "after"
+    counts = Counter(name for _site, name, _direction in entries)
+    settings, pooc = settings_echo(emitter._order_shape_constructor)
+    unmodeled = {_expression(node.callee) for node, _depth in iter_ast_nodes(emitter.ctx.ast)
+                 if isinstance(node, FuncCall) and (_expression(node.callee) or "").startswith("strategy.")
+                 and _expression(node.callee) not in READ_ONLY_STRATEGY_CALLS
+                 and id(node) not in recorded_nodes}
+    return json.dumps({
+        "version": 1, "process_orders_on_close": pooc, "calls": calls,
+        "entry_ids": {"long": len(long_ids), "short": len(short_ids),
+                      "shared": len(long_ids & short_ids), "multi_site": sum(count > 1 for count in counts.values())},
+        "host_reads": sorted(emitter._order_shape_host_reads), "settings": settings,
+        "unmodeled": sorted(unmodeled),
+    }, sort_keys=True, separators=(",", ":"), allow_nan=False)

package/pineforge_codegen/codegen/security.py

@@ -194,13 +194,19 @@ class SecurityEmitter:
         chart timeframe — its evaluator result is never read. Any other
         timeframe registration cannot compute is refused: it used to register
         the chart timeframe, silently.
+
+        Every timeframe string resolved from the script -- the literal, a
+        constant, a helper parameter's argument, a ternary or switch arm --
+        is a Pine timeframe (``_refuse_invalid_security_tf``).
         """
         if isinstance(tf_node, StringLiteral):
+            self._refuse_invalid_security_tf(tf_node.value, tf_node)
             return tf_node.value, None
         if isinstance(tf_node, SwitchStmt):
             # Keep diagnostics from the registration-time switch renderer
             # visible; the broad expression fallback below intentionally
             # catches ordinary unresolved expressions.
+            self._check_security_tf_arms(tf_node, set())
             return None, self._security_tf_runtime_expr(tf_node)
         if isinstance(tf_node, Identifier):
             name = tf_node.name
@@ -209,6 +215,7 @@ class SecurityEmitter:
             if (name in self._known_vars and name not in self._input_backed_vars
                     and not self._known_var_is_lexically_shadowed(name)
                     and isinstance(self._known_vars[name], str)):
+                self._refuse_invalid_security_tf(self._known_vars[name], tf_node)
                 return self._known_vars[name], None
             if (name in self._input_backed_vars
                     and name in self._input_var_to_call
@@ -216,6 +223,7 @@ class SecurityEmitter:
                 return None, self._visit_expr(self._input_var_to_call[name])
             global_expr_map = getattr(self.ctx, "global_expr_map", {}) or {}
             if name in global_expr_map:
+                self._check_security_tf_arms(global_expr_map[name], {name})
                 expanded = self._security_tf_runtime_expr(
                     global_expr_map[name], resolving={name}
                 )
@@ -238,6 +246,7 @@ class SecurityEmitter:
             self._security_tf_unresolved(tf_node, f"timeframe '{name}'")
         # any other expression — visit if it resolves at class scope
         try:
+            self._check_security_tf_arms(tf_node, set())
             expanded = self._security_tf_runtime_expr(tf_node)
             return None, expanded if expanded is not None else self._visit_expr(tf_node)
         except CompileError:
@@ -245,6 +254,45 @@ class SecurityEmitter:
         except Exception:
             self._security_tf_unresolved(tf_node, "timeframe expression")
 
+    def _refuse_invalid_security_tf(self, value: str, node) -> None:
+        """Refuse a timeframe string resolved from the script that is not a
+        Pine timeframe, with the support checker's diagnostic for the same
+        string written in the call (``invalid_tf_literal``): it reaches the
+        C++ registration. An empty string registers the chart's timeframe."""
+        if not value:
+            return
+        from ..support_checker import invalid_tf_literal
+        fn_label = ("request.security_lower_tf" if getattr(self, "_security_tf_lower", False)
+                    else "request.security")
+        refusal = invalid_tf_literal(value, fn_label)
+        if refusal is not None:
+            message, hint = refusal
+            self._codegen_error(node, message, hint=hint)
+
+    def _check_security_tf_arms(self, node, resolving: set[str]) -> None:
+        """Refuse an invalid timeframe string a registration-time timeframe
+        expression can select: the expression itself, a ternary or switch
+        arm, read through the constants and globals it names."""
+        def check(value) -> None:
+            if isinstance(value, StringLiteral):
+                self._refuse_invalid_security_tf(value.value, value)
+            elif isinstance(value, Ternary):
+                check(value.true_val)
+                check(value.false_val)
+            elif isinstance(value, SwitchStmt):
+                arms = [body for _case, body in value.cases]
+                for body in arms + ([value.default_body] if value.default_body else []):
+                    if len(body) == 1 and isinstance(body[0], ExprStmt):
+                        check(self._substitute_tf_input_reads(body[0].expr, resolving))
+
+        check(node if isinstance(node, SwitchStmt)
+              else self._substitute_tf_input_reads(node, resolving))
+
+    def _security_tf_literal(self, tf: str) -> str:
+        """A timeframe string as the C++ string literal registration and the
+        evaluator's ``timeframe.*`` reads spell it."""
+        return f'"{self._cpp_string_escape(tf)}"'
+
     def _security_tf_unresolved(self, tf_node, what: str) -> None:
         """Refuse a request.security timeframe registration cannot compute."""
         self._codegen_error(
@@ -1981,8 +2029,9 @@ class SecurityEmitter:
         parts = request.annotations[RECORDED_KEY_ANNOTATION]
         tail = (f"|{parts['field']}|{parts['period']}|gaps_{parts['gaps']}"
                 f"|lookahead_{parts['lookahead']}")
-        return (f'(std::string("{parts["fn"]}|") + {self._visit_expr(request.args[0])} + '
-                f'std::string("{tail}"))')
+        fn = self._cpp_string_escape(parts["fn"])
+        return (f'(std::string("{fn}|") + {self._visit_expr(request.args[0])} + '
+                f'std::string("{self._cpp_string_escape(tail)}"))')
 
     def _recorded_sites(self) -> dict[int, int]:
         """Each recorded request's index N: ``_pf_recorded`` sets its
@@ -2709,7 +2758,7 @@ class SecurityEmitter:
         """C++ expression for the timeframe of a request.security evaluator."""
         info = self._security_eval_info[sec_id]
         if info.get("tf"):
-            return f'"{info["tf"]}"'
+            return self._security_tf_literal(info["tf"])
         if info.get("tf_expr"):
             return info["tf_expr"]
         return "input_tf_"
@@ -2775,7 +2824,7 @@ class SecurityEmitter:
             if series_name in self._security_string_series
             else "_security_helper_series_"
         )
-        return f'{store}["{series_name}"]'
+        return f'{store}["{self._cpp_string_escape(series_name)}"]'
 
     def _security_helper_var_state_type(self, stmt: VarDecl) -> str:
         """The type family of a helper ``var`` whose declaration reads
@@ -6377,7 +6426,7 @@ class SecurityEmitter:
         if column is not None and self._security_foreign(sec_id):
             # request.footprint(...) of another symbol: the delta its feed
             # records for the requested bar (the value its delta() reads).
-            return f'_pf_symbol_column({sec_id}, "{column}")'
+            return f'_pf_symbol_column({sec_id}, "{self._cpp_string_escape(column)}")'
 
         if resolving is None:
             resolving = set()

package/pineforge_codegen/codegen/tables.py

@@ -545,6 +545,18 @@ ORDER_DIRECTION_MAP = {
     "descending": 'std::string("descending")',
 }
 
+NAME_ECHO_STRING_MEMBERS = {
+    "currency": frozenset({
+        "AED", "ARS", "AUD", "BDT", "BHD", "BRL", "BTC", "CAD", "CHF", "CLP",
+        "CNY", "COP", "CZK", "DKK", "EGP", "ETH", "EUR", "GBP", "HKD", "HUF",
+        "IDR", "ILS", "INR", "ISK", "JPY", "KES", "KRW", "KWD", "LKR", "MAD",
+        "MXN", "MYR", "NGN", "NOK", "NONE", "NZD", "PEN", "PHP", "PKR", "PLN",
+        "QAR", "RON", "RSD", "RUB", "SAR", "SEK", "SGD", "THB", "TND", "TRY",
+        "TWD", "USD", "USDT", "VES", "VND", "ZAR",
+    }),
+    "format": frozenset({"inherit", "price", "volume", "percent", "mintick"}),
+}
+
 
 # ---------------------------------------------------------------------------
 # Array / Map / Matrix method dispatch

package/pineforge_codegen/codegen/visit_call.py

@@ -432,6 +432,7 @@ class CallVisitor:
 
         close = "true" if func_name == "time_close" else "false"
         empty = 'std::string("")'
+        self._order_shape_host_reads.add("pine_time_offset")
         return (
             f"pine_time_offset(current_bar_.timestamp, {offset('bars_back')}, "
             f"{text('timeframe', 'script_tf_')}, {text('session', empty)}, "
@@ -3166,6 +3167,7 @@ class CallVisitor:
         return f"{token}ULL"
 
     def _visit_strategy_call(self, func_name: str, node: FuncCall) -> str:
+        from .order_shapes import record_order_call
         if func_name in ("convert_to_account", "convert_to_symbol"):
             p = self._resolve_func_args(node, f"strategy.{func_name}")
             v = self._visit_expr(p.get("value")) if p.get("value") is not None else "0.0"
@@ -3200,6 +3202,16 @@ class CallVisitor:
             if stop is not None or limit is not None or qty is not None or oca_name is not None or oca_type is not None or qty_type is not None:
                 limit_val = self._visit_expr(limit) if limit else "na<double>()"
                 stop_val = self._visit_expr(stop) if stop else "na<double>()"
+                record_order_call(self, node, "entry", {
+                    "id": (entry_id, p.get("id")), "direction": (direction, direction_node),
+                    "limit": (limit_val, limit, "na<double>()"),
+                    "stop": (stop_val, stop, "na<double>()"),
+                    "qty": (qty_val, qty, "na<double>()"),
+                    "comment": (comment_val, comment, '""'),
+                    "oca_name": (oca_name_val, oca_name, '""'),
+                    "oca_type": (oca_type_val, oca_type, "0"),
+                    "qty_type": (qty_type_val, qty_type, "-1"),
+                })
                 # pineforge-engine v0.2 dropped the vestigial `market_price`
                 # third positional from `BacktestEngine::strategy_entry`
                 # (the runtime never read it; fill price always came from
@@ -3207,6 +3219,15 @@ class CallVisitor:
                 # matches the new signature: (id, direction, limit, stop,
                 # qty, comment, oca_name, oca_type, qty_type).
                 return f"strategy_entry({entry_id}, {direction}, {limit_val}, {stop_val}, {qty_val}, {comment_val}, {oca_name_val}, {oca_type_val}, {qty_type_val})"
+            record_order_call(self, node, "entry", {
+                "id": (entry_id, p.get("id")), "direction": (direction, direction_node),
+                "limit": ("na<double>()", None, "na<double>()"),
+                "stop": ("na<double>()", None, "na<double>()"),
+                "qty": ("na<double>()", None, "na<double>()"),
+                "comment": (comment_val, comment, '""'),
+                "oca_name": ('""', None, '""'), "oca_type": ("0", None, "0"),
+                "qty_type": ("-1", None, "-1"),
+            })
             return f"strategy_entry({entry_id}, {direction}, na<double>(), na<double>(), na<double>(), {comment_val})"
 
         if func_name == "close":
@@ -3223,6 +3244,12 @@ class CallVisitor:
                 if immediately_node is not None else "false"
             )
             callsite = self._strategy_close_callsite_token(node)
+            record_order_call(self, node, "close", {
+                "id": (close_id, p.get("id")), "comment": (comment, p.get("comment"), '""'),
+                "qty": (qty, p.get("qty"), "na<double>()"),
+                "qty_percent": (qty_pct, p.get("qty_percent"), "na<double>()"),
+                "immediately": (immediately, immediately_node, "false"),
+            })
             return f"strategy_close({close_id}, {comment}, {qty}, {qty_pct}, {immediately}, {callsite})"
 
         if func_name == "close_all":
@@ -3235,6 +3262,12 @@ class CallVisitor:
                 )
                 if immediately_node is not None else "false"
             )
+            record_order_call(self, node, "close_all", {
+                "comment": (comment, p.get("comment"), '""'),
+                "qty": ("na<double>()", None, "na<double>()"),
+                "qty_percent": ("na<double>()", None, "na<double>()"),
+                "immediately": (immediately, immediately_node, "false"),
+            })
             # The engine's ID-less strategy_close path closes the complete
             # position. Reuse it so close_all preserves the Pine order comment
             # and same-tick fill flag instead of silently discarding both.
@@ -3278,18 +3311,38 @@ class CallVisitor:
                 if loss_n and not stop_n:
                     loss_ticks = self._visit_expr(loss_n)
 
+                record_order_call(self, node, "exit", {
+                    "id": (exit_id, p.get("id")), "from_entry": (from_id, p.get("from_entry")),
+                    "limit": (limit_val, limit_n, "na<double>()"),
+                    "stop": (stop_val, stop_n, "na<double>()"),
+                    "trail_points": (trail_pts, trail_pts_n, "na<double>()"),
+                    "trail_offset": (trail_off, trail_off_n, "na<double>()"),
+                    "trail_price": (trail_pr, trail_pr_n, "na<double>()"),
+                    "qty_percent": (qty_pct, qty_pct_n, "100.0"),
+                    "comment": (comment, comment_n, '""'),
+                    "qty": (qty_val, qty_n, "na<double>()"),
+                    "oca_name": (oca_val, oca_name_n, '""'),
+                    "profit_ticks": (profit_ticks, profit_n if not limit_n else None, "na<double>()"),
+                    "loss_ticks": (loss_ticks, loss_n if not stop_n else None, "na<double>()"),
+                }, form="levels")
                 return (f"strategy_exit({exit_id}, {from_id}, {limit_val}, {stop_val}, "
                         f"{trail_pts}, {trail_off}, {trail_pr}, {qty_pct}, {comment}, "
                         f"{qty_val}, {oca_val}, {profit_ticks}, {loss_ticks})")
             comment = self._visit_expr(comment_n) if comment_n is not None else '""'
+            record_order_call(self, node, "exit", {
+                "id": (exit_id, p.get("id")), "from_entry": (from_id, p.get("from_entry")),
+                "comment": (comment, comment_n, '""'),
+            }, form="cancel_bracket")
             return f"strategy_exit_cancel_bracket({exit_id}, {from_id}, {comment})"
 
         if func_name == "cancel":
             p = self._resolve_func_args(node, "strategy.close")  # same shape: id first
             cancel_id = self._visit_expr(p.get("id")) if "id" in p else '""'
+            record_order_call(self, node, "cancel", {"id": (cancel_id, p.get("id"))})
             return f"strategy_cancel({cancel_id})"
 
         if func_name == "cancel_all":
+            record_order_call(self, node, "cancel_all", {})
             return "strategy_cancel_all()"
 
         if func_name == "order":
@@ -3307,6 +3360,14 @@ class CallVisitor:
             stop_arg = self._visit_expr(p.get("stop")) if "stop" in p else "na<double>()"
             oca_name = self._visit_expr(p.get("oca_name")) if "oca_name" in p else '""'
             oca_type = self._visit_expr(p.get("oca_type")) if "oca_type" in p else "0"
+            record_order_call(self, node, "order", {
+                "id": (order_id, p.get("id")), "direction": (direction, direction_node),
+                "qty": (qty, p.get("qty"), "0"),
+                "limit": (limit_arg, p.get("limit"), "na<double>()"),
+                "stop": (stop_arg, p.get("stop"), "na<double>()"),
+                "oca_name": (oca_name, p.get("oca_name"), '""'),
+                "oca_type": (oca_type, p.get("oca_type"), "0"),
+            })
             return f"strategy_order({order_id}, {direction}, {qty}, {limit_arg}, {stop_arg}, {oca_name}, {oca_type})"
 
         if func_name == "risk":

package/pineforge_codegen/codegen/visit_expr.py

@@ -952,6 +952,7 @@ class ExprVisitor:
                 if node.member == "isfirst":
                     return "(bar_index_ == 0)"
                 if node.member == "islast":
+                    self._order_shape_host_reads.add("barstate_islast_")
                     return "barstate_islast_"
                 if node.member == "isnew":
                     return "is_first_tick()"
@@ -962,6 +963,7 @@ class ExprVisitor:
                 if node.member == "isrealtime":
                     return "false"
                 if node.member == "islastconfirmedhistory":
+                    self._order_shape_host_reads.add("barstate_islast_")
                     return "barstate_islast_"
                 return "false"
             if ns in ("backadjustment", "settlement_as_close"):
@@ -1046,12 +1048,16 @@ class ExprVisitor:
                         return ismarket
                     return f"(!{ismarket} && {predicate})"
                 if node.member == "isfirstbar":
+                    self._order_shape_host_reads.add("session_isfirstbar_")
                     return "session_isfirstbar_"
                 if node.member == "islastbar":
+                    self._order_shape_host_reads.add("session_islastbar_")
                     return "session_islastbar_"
                 if node.member == "isfirstbar_regular":
+                    self._order_shape_host_reads.add("session_isfirstbar_regular_")
                     return "session_isfirstbar_regular_"
                 if node.member == "islastbar_regular":
+                    self._order_shape_host_reads.add("session_islastbar_regular_")
                     return "session_islastbar_regular_"
                 return "false"
             if ns == "syminfo":
@@ -1083,7 +1089,7 @@ class ExprVisitor:
             if ns in SKIP_NAMESPACES:
                 return "0"
             if ns == "currency":
-                return f'std::string("{node.member}")'
+                return f'std::string("{self._cpp_string_escape(node.member)}")'
             if ns == "order":
                 # order.ascending / order.descending. Unknown member -> "ascending".
                 return ORDER_DIRECTION_MAP.get(node.member, 'std::string("ascending")')
@@ -1163,7 +1169,7 @@ class ExprVisitor:
                 return f"{safe}.{node.member}"
             if name not in self.ctx.series_vars:
                 # Unknown identifier — likely an enum value
-                return f'std::string("{node.member}")'
+                return f'std::string("{self._cpp_string_escape(node.member)}")'
         return f"{obj}.{node.member}"
 
     def _operand_na_kind(self, node, cpp_type: str) -> str | None:

package/pineforge_codegen/codegen/visit_stmt.py

@@ -1100,10 +1100,8 @@ class StmtVisitor:
             # the backtest runtime. See: pineforge-codegen issue #10.
             if self._is_omitted_udt_field(node.target):
                 recv = self._visit_expr(node.target.object)
-                lines.append(
-                    f"{pad}/* drawing field assignment omitted: "
-                    f"{recv}.{node.target.member} {node.op} ... */"
-                )
+                omitted = self._cpp_comment_escape(f"{recv}.{node.target.member} {node.op}")
+                lines.append(f"{pad}/* drawing field assignment omitted: {omitted} ... */")
                 return
             # General expression target (e.g., member access)
             target_cpp = self._visit_mutable_expr(node.target)

package/pineforge_codegen/support_checker.py

@@ -2843,8 +2843,9 @@ class SupportChecker:
             # Bare suffix shorthand — Pine treats "D"/"W"/"M"/"S" as 1<suffix>.
             # Accept the same shorthand here.
             return None
-        if not digits.isdigit():
-            # catches "1.5", "-15", "abc", etc.
+        if not digits.isdecimal():
+            # catches "1.5", "-15", "abc", and digits int() does not read
+            # ("²"), etc.
             return f"non-integer timeframe magnitude '{digits}'"
         n = int(digits)
         if n <= 0:
@@ -2859,15 +2860,11 @@ class SupportChecker:
             return
         if not isinstance(tf_node, StringLiteral):
             return
-        err = self._validate_pine_tf_literal(tf_node.value)
-        if err is None:
+        refusal = invalid_tf_literal(tf_node.value, fn_label)
+        if refusal is None:
             return
-        self._err(
-            tf_node,
-            f"{fn_label}: invalid timeframe literal '{tf_node.value}'. "
-            "Expected Pine TF format like '1', '15', '1H', '1D', '15S'.",
-            hint=err,
-        )
+        message, hint = refusal
+        self._err(tf_node, message, hint=hint)
 
     def _check_request_security_lower_tf_symbol(self, node: FuncCall) -> None:
         """``request.security_lower_tf`` reads the chart's intrabars: the
@@ -2912,6 +2909,18 @@ class SupportChecker:
         self._check_tf_literal(tf_node, "request.security_lower_tf")
 
 
+def invalid_tf_literal(tf_str: str, fn_label: str) -> tuple[str, str] | None:
+    """``(message, hint)`` refusing ``tf_str`` as the timeframe of
+    ``fn_label`` (``request.security`` / ``request.security_lower_tf``), or
+    None when it is a Pine timeframe. The codegen refuses a timeframe string
+    it resolves from a constant or a helper parameter with the same text."""
+    err = SupportChecker._validate_pine_tf_literal(tf_str)
+    if err is None:
+        return None
+    return (f"{fn_label}: invalid timeframe literal '{tf_str}'. "
+            "Expected Pine TF format like '1', '15', '1H', '1D', '15S'.", err)
+
+
 # ---------------------------------------------------------------------------
 # Convenience entry point
 # ---------------------------------------------------------------------------

package/release.json

@@ -1,7 +1,7 @@
 {
-  "codegen": "1.2.0",
+  "codegen": "1.3.0",
   "pyodide": "314.0.0",
   "python": "3.14.0",
   "emscripten": "emscripten_5_0_3",
-  "sha256": "7c9654f79d188babd5034d3ebedd2cdd60a8ec2866b70d8ad863a9f06341420e"
+  "sha256": "b058ef7c8ded42e7a80ccf551e62985e052d1e306aebf615ab9937544f060839"
 }

package/tables.json

@@ -1,5 +1,5 @@
 {
-  "CODEGEN_VERSION": "1.2.0",
+  "CODEGEN_VERSION": "1.3.0",
   "TA_CLASS_MAP_KEYS": [
     "sma",
     "ema",