pineforge-codegen 0.10.1__tar.gz → 0.10.2__tar.gz

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/.github/workflows/release.yml

@@ -124,7 +124,7 @@ jobs:
       # failure would leave npm shipping a version PyPI never got.
       - name: Publish to PyPI
         if: ${{ !inputs.dry_run }}
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
 
       # Commit + tag + push AFTER PyPI succeeds. The `git push --tags` triggers
       # publish-pyodide.yml for npm (which re-runs the gate — defense in depth),

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: pineforge-codegen
-Version: 0.10.1
+Version: 0.10.2
 Summary: PineScript v6 to C++ transpiler that targets the pineforge-engine runtime.
 Project-URL: Homepage, https://github.com/pineforge-4pass/pineforge-codegen-oss
 Project-URL: Issues, https://github.com/pineforge-4pass/pineforge-codegen-oss/issues

pineforge_codegen-0.10.2/VERSION

@@ -0,0 +1 @@
+0.10.2

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/docs/codegen-coverage-gaps.md

@@ -76,3 +76,55 @@ were added to convert the most fragile defensive paths from
 silent-on-bug to loud-on-bug.
 
 No new follow-up work identified by this audit.
+
+## Residuals left open by the array-bounds guard (2026-07-25)
+
+`array.insert`, the 3-argument `array.fill`, and `array.slice` now reject an
+out-of-range index instead of emitting raw STL iterator arithmetic (undefined
+behaviour). Three questions the bounds work deliberately does NOT settle:
+
+1. **`array.slice` shares storage with its source; codegen deep-copies.**
+   The Pine v6 reference says "Changing the elements in a slice directly
+   changes the elements in the original array, and vice versa", while both
+   lowerings construct a fresh `std::vector` from the iterator range. Any
+   write through a slice (or through the source while a slice is live) is
+   therefore lost. Closing this needs a view/alias type over the receiver's
+   storage, not an index check, so it is a separate and much larger change.
+   The extent of the aliasing is itself unsettled: the reference sentence
+   says "an object from the slice", which is unambiguous for arrays of
+   reference-like elements (UDT instances) but does NOT establish that a
+   primitive `array<float>` slice aliases element-for-element. Pin that
+   against TradingView before designing the view type — the answer decides
+   whether the fix is "arrays of UDTs only" or "all arrays".
+
+2. **Inverted ranges (`index_from > index_to`) are rejected, not clamped.**
+   No evidence pins TradingView's behaviour for `array.fill(id, v, 2, 1)` /
+   `array.slice(id, 2, 1)`. Rejecting is the fail-closed choice and the
+   3-argument `fill` range form has no current corpus exposure, but a
+   TradingView probe could show TV treats it as an empty range instead.
+
+3. **Negative endpoints for `fill`/`slice` are rejected.** The reference
+   lists only `array.get`/`array.set`/`array.insert`/`array.remove` as
+   negative-indexing functions, so `fill`/`slice` follow `array.percentrank`
+   and reject. If TradingView in fact normalises them, this is an
+   over-rejection (a valid script fails to transpile), not a wrong result.
+
+## Residual left open by the request.security rebind guard (2026-07-25)
+
+`_scalar_rebinds` is keyed by BARE NAME with no scope resolution, mirroring
+the existing `_scalar_defs`. A divergent `:=` rebind of a *local* named `sym`
+inside a user function therefore also disqualifies an unrelated *global*
+`sym` used as a `request.security` symbol. That direction is fail-closed
+(over-rejection, never a silent wrong-symbol run), but a scoped symbol table
+would be the exact fix. A 788-source differential shows the over-rejection
+costs nothing on the current corpus.
+
+**Still open — the ternary branch hole (KI-47(a)).** `_is_current_symbol_expr`
+still accepts `cond ? "EXCH:OTHER" : syminfo.tickerid` because EITHER branch
+resolving to the chart symbol is enough. Tightening it to require BOTH
+branches is correct in principle but rejects
+`data/standard/doriannnq-tjr-v4-strategy`, whose alternate branch is
+unreachable at its declared input configuration (`smtSym` defaults to `""`)
+and which grades Excellent at 44/44 / 100% match. Closing this needs the
+checker to see the effective input configuration, which it currently cannot
+(see the analysis in the R6 handoff). Held deliberately, not overlooked.

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/pineforge_codegen/codegen/base.py

@@ -514,6 +514,15 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
         # the declaration-derived checkpoint inventory.
         self._inline_history_members: list[dict] = []
         self._inline_history_member_by_key: dict[tuple, str] = {}
+        # request.security/request.security_lower_tf inline their Pine helper
+        # expressions on the requested clock instead of calling the ordinary
+        # emitted UDF methods.  The chart-clocked plain-UDF history factor must
+        # therefore exclude those source nodes and any emitted helper context
+        # reached only through them.
+        self._requested_context_inline_node_ids: set[int] = set()
+        self._requested_context_only_inline_contexts: set[
+            tuple[str, str | None]
+        ] = set()
         # Unique lambda-local names used when an array lowering references its
         # receiver more than once.  The binding keeps temporary-producing or
         # side-effectful receivers single-evaluation (see TypeInferer).
@@ -3173,7 +3182,11 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
         """
         self._inline_history_members = []
         self._inline_history_member_by_key = {}
-        counters = {"hist_call": 0, "series_arg": 0}
+        counters = {
+            "hist_call": 0,
+            "series_arg": 0,
+            "udf_series_arg": 0,
+        }
 
         def walk_nodes(value):
             """Yield AST nodes in stable field order, including tuple elements.
@@ -3345,6 +3358,113 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
             lexical.update(self._func_collection_types.get(owner, {}))
             return lexical
 
+        def plain_udf_info(call: FuncCall):
+            if not isinstance(call.callee, Identifier):
+                return None
+            candidate = self._func_info_map.get(call.callee.name)
+            if (
+                candidate is None
+                or candidate.node is None
+                or getattr(candidate, "is_udt_method", False)
+            ):
+                return None
+            return candidate
+
+        # Requested-context UDF expressions are lowered independently by
+        # security.py.  Classify their otherwise-emitted helper variants so
+        # this chart-clocked factor neither allocates unused buffers for them
+        # nor changes the legacy bodies that remain in generated C++.
+        requested_node_ids: set[int] = set()
+        for security_call in self._security_calls:
+            expression = security_call.get("expr_node")
+            if expression is None:
+                continue
+            requested_node_ids.update(
+                id(child) for child in walk_nodes(expression)
+            )
+        self._requested_context_inline_node_ids = requested_node_ids
+
+        def emitted_context_for_call(
+            fi,
+            call: FuncCall,
+            owner: str | None,
+            owner_context: str | None,
+        ) -> str | None:
+            dispatch = self._instance_dispatch.get(
+                (owner_context, id(call))
+            )
+            if dispatch is not None:
+                return dispatch
+            target_cs = target_cs_for_context(
+                fi, call, owner, owner_context
+            )
+            if target_cs is not None:
+                return f"{self._func_cpp_base_name(fi.name)}_cs{target_cs}"
+            return None
+
+        requested_roots: set[tuple[str, str | None]] = set()
+        chart_roots: set[tuple[str, str | None]] = set()
+        context_edges: dict[
+            tuple[str, str | None], set[tuple[str, str | None]]
+        ] = {}
+        for call in (
+            candidate
+            for candidate in walk_nodes(self.ctx.ast)
+            if isinstance(candidate, FuncCall)
+        ):
+            fi = plain_udf_info(call)
+            if fi is None:
+                continue
+            owner = owner_by_node.get(id(call))
+            if id(call) in requested_node_ids:
+                owner_contexts = (
+                    [None]
+                    if owner is None
+                    else self._inline_history_contexts_for_owner(owner)
+                )
+                for owner_context in owner_contexts:
+                    requested_roots.add((
+                        fi.name,
+                        emitted_context_for_call(
+                            fi, call, owner, owner_context
+                        ),
+                    ))
+                continue
+            if owner is None:
+                target = (
+                    fi.name,
+                    emitted_context_for_call(fi, call, None, None),
+                )
+                chart_roots.add(target)
+                continue
+            for owner_context in self._inline_history_contexts_for_owner(owner):
+                source = (owner, owner_context)
+                target = (
+                    fi.name,
+                    emitted_context_for_call(
+                        fi, call, owner, owner_context
+                    ),
+                )
+                context_edges.setdefault(source, set()).add(target)
+
+        def reachable(
+            roots: set[tuple[str, str | None]],
+        ) -> set[tuple[str, str | None]]:
+            found = set(roots)
+            pending = list(roots)
+            while pending:
+                source = pending.pop()
+                for target in context_edges.get(source, ()):
+                    if target in found:
+                        continue
+                    found.add(target)
+                    pending.append(target)
+            return found
+
+        self._requested_context_only_inline_contexts = (
+            reachable(requested_roots) - reachable(chart_roots)
+        )
+
         for node in walk_nodes(self.ctx.ast):
             owner = owner_by_node.get(id(node))
             if isinstance(node, Subscript) and isinstance(node.object, FuncCall):
@@ -3403,6 +3523,26 @@ class CodeGen(CallVisitor, ExprVisitor, StmtVisitor, TopLevelEmitter, SecurityEm
                     expected_cpp_type = self._series_param_element_cpp_type(
                         fi, idx, target_cs
                     )
+                    # Pine gives each plain-UDF written call its own
+                    # chart-aligned parameter history.  Even an exact Series
+                    # actual therefore needs a call-site-owned buffer: skipped
+                    # evaluations hold the last value in that bar's slot
+                    # instead of exposing the caller's independently changing
+                    # history.  Typed methods retain their established direct
+                    # binding/bridge behavior below.
+                    chart_execution_context = (
+                        id(node) not in requested_node_ids
+                        and (owner, context)
+                        not in self._requested_context_only_inline_contexts
+                    )
+                    if not method_call and chart_execution_context:
+                        register_one(
+                            "udf_series_arg",
+                            (id(node), idx),
+                            expected_cpp_type,
+                            context,
+                        )
+                        continue
                     needs_bridge = True
                     if isinstance(arg, Identifier):
                         if (

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/pineforge_codegen/codegen/emit_top.py

@@ -949,6 +949,21 @@ class TopLevelEmitter:
                 f"{info['member_name']}.clear();"
             )
 
+        # A history-reading plain-UDF parameter advances on the chart clock,
+        # even when lazy control flow skips its written call on this bar.  Seed
+        # the new slot with the prior current value (``na`` before first reach);
+        # an executed call later in the bar updates this same slot with its
+        # scalar actual.  Typed-method ``series_arg`` bridges intentionally keep
+        # their existing execution-clock behavior.
+        for info in self._inline_history_members:
+            if info["kind"] != "udf_series_arg":
+                continue
+            member = info["member_name"]
+            lines.append(
+                f"        if (history_advances_new_bar()) "
+                f"{member}.push({member}.current());"
+            )
+
         # a. Push bar field series (with bar magnifier support)
         for field_name in sorted(self.ctx.series_bar_fields):
             push_expr = BAR_SERIES_PUSH.get(field_name, f"current_bar_.{field_name}")

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/pineforge_codegen/codegen/security.py

@@ -2844,6 +2844,156 @@ class SecurityEmitter:
         )
         return out
 
+    def _security_lazy_ta_keys(
+        self,
+        sec_id: int,
+        expr_node,
+        info: dict,
+    ) -> set[tuple[int, tuple]]:
+        """``(ta_index, binding_signature)`` pairs Pine reaches only lazily.
+
+        Pine evaluates ``and``/``or`` with left-to-right short-circuit and a
+        ternary evaluates its condition plus exactly one branch. A ``ta.*``
+        call sitting in a skipped operand is **not evaluated on that bar**, so
+        its series state does not advance. The evaluator used to hoist every
+        collected site into an unconditional ``auto _secval_N = ...compute(...)``
+        prologue, which advanced every site on every HTF bar and desynchronised
+        the series against TradingView.
+
+        A site returned here is dropped from that prologue. ``_build_security_expr``
+        then falls through to its inline
+        ``(security_series_slot_is_new(N) ? m.compute(a) : m.recompute(a))``
+        form, emitted in expression position — C++'s own ``&&`` / ``||`` /
+        ``?:`` short-circuit then advances the state exactly when Pine would,
+        and the relational lowering's ``_pna_l`` / ``_pna_r`` temporaries keep
+        the evaluation order left-to-right.
+
+        Deliberately conservative — anything not provably single-reach and
+        conditional keeps the existing eager hoist, so scripts without
+        conditional security TA regenerate byte-identically:
+
+        - A site reached more than once must stay hoisted: sharing one
+          ``_secval_*`` is what keeps it to a single advance per bar, whereas
+          two inline copies would advance it twice (or zero times).
+        - Laziness does **not** propagate through a global binding. In the
+          requested context that global is its own unconditional top-level
+          statement, so it evaluates on every HTF bar wherever it is read
+          (this is what keeps chart-side ``t0``-shaped code exact).
+        - Sites with a history offset (``ta.ema(close, 55)[1]``) keep the
+          committed ``_secval_*`` their per-bar Series push reads.
+        - Securities that rebind mutable globals, and multi-statement helper
+          calls, bail entirely: both lower through statement emitters that
+          consume ``ta_results`` outside this expression.
+        """
+        if info.get("mutable_globals"):
+            return set()
+
+        occurrences: dict[tuple[int, tuple], list[bool]] = {}
+        unsafe = False
+
+        def walk(node, lazy: bool, binding_stack, resolving: set[str]) -> None:
+            nonlocal unsafe
+            if node is None or unsafe:
+                return
+
+            if isinstance(node, Identifier):
+                binding = None
+                if not self._security_identifier_is_global_binding(node):
+                    binding = self._security_lookup_helper_binding_context(
+                        node.name, binding_stack
+                    )
+                if binding is not None:
+                    bound, bound_stack = binding
+                    if isinstance(bound, str):
+                        return
+                    bind_key = f"bind:{id(bound)}"
+                    if bind_key in resolving:
+                        return
+                    resolving.add(bind_key)
+                    walk(bound, lazy, bound_stack, resolving)
+                    resolving.discard(bind_key)
+                    return
+
+                if self._global_mutable_infos.get(node.name) is not None:
+                    unsafe = True
+                    return
+
+                global_expr_map = getattr(self.ctx, "global_expr_map", {}) or {}
+                if (
+                    self._security_identifier_is_global_binding(node)
+                    and node.name in global_expr_map
+                    and node.name not in resolving
+                ):
+                    resolving.add(node.name)
+                    walk(global_expr_map[node.name], False, (), resolving)
+                    resolving.remove(node.name)
+                    return
+
+            if isinstance(node, FuncCall) and isinstance(node.callee, Identifier):
+                func_name = node.callee.name
+                if func_name in self._func_names:
+                    call_key = f"func:{func_name}"
+                    if call_key in resolving:
+                        return
+                    resolving.add(call_key)
+                    plan = self._security_helper_call_plan(node, binding_stack)
+                    if plan["mode"] == "expr":
+                        walk(plan["expr"], lazy, plan["binding_stack"], resolving)
+                    else:
+                        unsafe = True
+                    resolving.discard(call_key)
+                    return
+
+            if isinstance(node, BinOp) and node.op in ("and", "or"):
+                walk(node.left, lazy, binding_stack, resolving)
+                walk(node.right, True, binding_stack, resolving)
+                return
+
+            if isinstance(node, Ternary):
+                walk(node.condition, lazy, binding_stack, resolving)
+                walk(node.true_val, True, binding_stack, resolving)
+                walk(node.false_val, True, binding_stack, resolving)
+                return
+
+            site = self._get_ta_site(node)
+            if site is not None:
+                idx = self._ta_index_by_site_id.get(id(site))
+                if idx is not None:
+                    key = (idx, self._security_binding_stack_signature(binding_stack))
+                    occurrences.setdefault(key, []).append(lazy)
+
+            for child in vars(node).values():
+                walk_value(child, lazy, binding_stack, resolving)
+
+        def walk_value(value, lazy: bool, binding_stack, resolving: set[str]) -> None:
+            if value is None or unsafe:
+                return
+            if hasattr(value, "__dict__"):
+                walk(value, lazy, binding_stack, resolving)
+                return
+            if isinstance(value, (list, tuple)):
+                for item in value:
+                    walk_value(item, lazy, binding_stack, resolving)
+                return
+            if isinstance(value, dict):
+                for item in value.values():
+                    walk_value(item, lazy, binding_stack, resolving)
+
+        walk(expr_node, False, (), set())
+        if unsafe:
+            return set()
+
+        hist_indices = set(self._security_ta_hist_idx_by_sec.get(sec_id, ()))
+        inline_helper_ta_indices = set(info.get("inline_helper_ta_indices", []))
+        return {
+            key
+            for key, reaches in occurrences.items()
+            if key[0] not in hist_indices
+            and key[0] not in inline_helper_ta_indices
+            and len(reaches) == 1
+            and reaches[0]
+        }
+
     def _emit_security_ohlc_hist_pushes(self, sec_id: int, lines: list[str]) -> None:
         """Emit the OHLC history-offset Series pushes for ``sec_id``, gated on
         ``is_complete``.
@@ -2909,6 +3059,7 @@ class SecurityEmitter:
             ta_indices = info.get("ta_indices") or []
             security_mutable_names = set(info.get("mutable_globals", []))
             inline_helper_ta_indices = set(info.get("inline_helper_ta_indices", []))
+            lazy_ta_keys = self._security_lazy_ta_keys(sec_id, expr_node, info)
 
             lines.append(f"    void _eval_security_{sec_id}(const Bar& bar, bool is_complete) {{")
 
@@ -2949,6 +3100,15 @@ class SecurityEmitter:
                     site = self.ctx.ta_call_sites[idx]
                     variants = (info.get("ta_variants") or {}).get(idx, [])
                     for variant in variants:
+                        if (idx, variant["signature"]) in lazy_ta_keys:
+                            # Pine only reaches this site through a
+                            # short-circuited operand or an untaken ternary
+                            # branch. Leave it out of the eager prologue:
+                            # _build_security_expr emits its
+                            # compute()/recompute() inline in expression
+                            # position, where C++'s &&/||/?: short-circuit
+                            # advances the series exactly on the bars Pine does.
+                            continue
                         helper_binding_stack = variant.get("binding_stack", ())
                         compute_args = self._security_ta_compute_args_for_site(
                             sec_id,

{pineforge_codegen-0.10.1 → pineforge_codegen-0.10.2}/pineforge_codegen/codegen/tables.py

@@ -459,45 +459,143 @@ ORDER_DIRECTION_MAP = {
 # ---------------------------------------------------------------------------
 
 
-def _checked_array_index_prelude(*, normalize_negative: bool = True) -> str:
+def _checked_array_index_prelude(
+    *,
+    normalize_negative: bool = True,
+    allow_size: bool = False,
+    name: str = "index",
+) -> str:
     """C++ body shared by checked single-index operations.
 
-    Pine v6 explicitly gives end-relative negative indices to the checked
-    ``get``, ``set``, and ``remove`` cluster. Other indexed functions such as
-    ``percentrank`` still need the same NA/non-finite/range checks, but must
-    reject negative indices instead of normalizing them. ``insert`` remains a
-    separately bounded residual.
+    Pine v6 explicitly gives end-relative negative indices to ``array.get``,
+    ``array.set``, ``array.insert``, and ``array.remove``. Other indexed
+    functions such as ``percentrank`` and the ``fill``/``slice`` range
+    endpoints still need the same NA/non-finite/range checks, but must reject
+    negative indices instead of normalizing them (``normalize_negative``).
+
+    ``allow_size`` widens the upper bound from ``index < size`` to
+    ``index <= size``. An *element access* is invalid at ``size``, but an
+    *insertion point* is not: ``array.insert(id, size, v)`` appends, and the
+    half-open ``[index_from, index_to)`` ranges of ``array.fill`` /
+    ``array.slice`` legally end at ``size``.
+
+    ``name`` renames every emitted local so two endpoints can be checked in
+    one C++ scope without colliding. ``name="index"`` reproduces the original
+    identifiers byte-for-byte.
     """
+    raw_value = f"__pf_raw_{name}_value"
+    raw_type = f"__pf_raw_{name}_type"
+    raw_text = f"__pf_raw_{name}_text"
+    raw_wide = f"__pf_raw_{name}_wide"
+    raw = f"__pf_raw_{name}"
+    checked = f"__pf_array_{name}"
+    size = "__pf_array_size" if name == "index" else f"__pf_array_size_{name}"
     checked_index = (
-        "__pf_raw_index<0?__pf_raw_index+__pf_array_size:__pf_raw_index"
-        if normalize_negative
-        else "__pf_raw_index"
+        f"{raw}<0?{raw}+{size}:{raw}" if normalize_negative else raw
     )
+    upper = ">" if allow_size else ">="
     return (
-        "using __pf_raw_index_type=std::decay_t<decltype(__pf_raw_index_value)>; "
-        "if constexpr(!std::is_same_v<__pf_raw_index_type,bool>) { "
-        "if(is_na(__pf_raw_index_value)) "
+        f"using {raw_type}=std::decay_t<decltype({raw_value})>; "
+        f"if constexpr(!std::is_same_v<{raw_type},bool>) {{ "
+        f"if(is_na({raw_value})) "
         "pine_runtime_error(std::string(\"Index na is out of bounds. Array size is \")+"
         "std::to_string((int64_t)__pf_array.size())); } "
-        "if constexpr(std::is_floating_point_v<__pf_raw_index_type>) { "
-        "if(!std::isfinite(__pf_raw_index_value)) { "
-        "std::string __pf_raw_index_text=__pf_raw_index_value>0?\"inf\":\"-inf\"; "
-        "pine_runtime_error(std::string(\"Index \")+__pf_raw_index_text+"
+        f"if constexpr(std::is_floating_point_v<{raw_type}>) {{ "
+        f"if(!std::isfinite({raw_value})) {{ "
+        f"std::string {raw_text}={raw_value}>0?\"inf\":\"-inf\"; "
+        f"pine_runtime_error(std::string(\"Index \")+{raw_text}+"
         "\" is out of bounds. Array size is \"+"
         "std::to_string((int64_t)__pf_array.size())); } "
-        "long double __pf_raw_index_wide=(long double)__pf_raw_index_value; "
-        "if(__pf_raw_index_wide<(long double)std::numeric_limits<int64_t>::min()||"
-        "__pf_raw_index_wide>(long double)std::numeric_limits<int64_t>::max()) "
+        f"long double {raw_wide}=(long double){raw_value}; "
+        f"if({raw_wide}<(long double)std::numeric_limits<int64_t>::min()||"
+        f"{raw_wide}>(long double)std::numeric_limits<int64_t>::max()) "
         "pine_runtime_error(std::string(\"Index \")+"
-        "std::to_string((double)__pf_raw_index_value)+"
+        f"std::to_string((double){raw_value})+"
         "\" is out of bounds. Array size is \"+"
         "std::to_string((int64_t)__pf_array.size())); } "
-        "int64_t __pf_raw_index=(int64_t)__pf_raw_index_value; "
-        "int64_t __pf_array_size=(int64_t)__pf_array.size(); "
-        f"int64_t __pf_array_index={checked_index}; "
-        "if(__pf_array_index<0||__pf_array_index>=__pf_array_size) "
-        "pine_runtime_error(std::string(\"Index \")+std::to_string(__pf_raw_index)+"
-        "\" is out of bounds. Array size is \"+std::to_string(__pf_array_size)); "
+        f"int64_t {raw}=(int64_t){raw_value}; "
+        f"int64_t {size}=(int64_t)__pf_array.size(); "
+        f"int64_t {checked}={checked_index}; "
+        f"if({checked}<0||{checked}{upper}{size}) "
+        f"pine_runtime_error(std::string(\"Index \")+std::to_string({raw})+"
+        f"\" is out of bounds. Array size is \"+std::to_string({size})); "
+    )
+
+
+def _checked_array_range_prelude() -> str:
+    """Validate the half-open ``[index_from, index_to)`` range of fill/slice.
+
+    Both endpoints are checked with ``allow_size`` (``index_to`` is exclusive,
+    so ``size`` is a legal endpoint) and without negative normalization
+    (neither function appears in the Pine v6 reference's negative-indexing
+    set). An inverted range is rejected rather than silently treated as empty:
+    ``begin()+from > begin()+to`` is undefined behaviour in the STL forms this
+    replaces, and no evidence pins TradingView's behaviour there.
+    """
+    return (
+        _checked_array_index_prelude(
+            normalize_negative=False, allow_size=True, name="index_from"
+        )
+        + _checked_array_index_prelude(
+            normalize_negative=False, allow_size=True, name="index_to"
+        )
+        + "if(__pf_array_index_from>__pf_array_index_to) "
+        "pine_runtime_error(std::string(\"Index range \")+"
+        "std::to_string(__pf_array_index_from)+\"..\"+"
+        "std::to_string(__pf_array_index_to)+"
+        "\" is invalid. Array size is \"+"
+        "std::to_string(__pf_array_size_index_from)); "
+    )
+
+
+def _checked_array_insert(a: str, args: list[str]) -> str:
+    """``array.insert(id, index, value)`` — index is an INSERTION point.
+
+    ``index == size`` appends, so the bound is ``index <= size``; a negative
+    index is end-relative, exactly as for ``get``/``set``/``remove``.
+    """
+    check = _checked_array_index_prelude(allow_size=True)
+    return (
+        "[&](auto&& __pf_array){ "
+        "return [&](auto&& __pf_raw_index_value){ "
+        "return [&](auto&& __pf_array_value){ "
+        f"{check}"
+        "__pf_array.insert(__pf_array.begin()+(size_t)__pf_array_index, "
+        "__pf_array_value); "
+        f"}}(({args[1]})); }}(({args[0]})); }}(({a}))"
+    )
+
+
+def _checked_array_fill_range(a: str, args: list[str]) -> str:
+    """``array.fill(id, value, index_from, index_to)`` — bounded range fill."""
+    check = _checked_array_range_prelude()
+    return (
+        "[&](auto&& __pf_array){ "
+        "return [&](auto&& __pf_array_value){ "
+        "return [&](auto&& __pf_raw_index_from_value){ "
+        "return [&](auto&& __pf_raw_index_to_value){ "
+        f"{check}"
+        "std::fill(__pf_array.begin()+(size_t)__pf_array_index_from, "
+        "__pf_array.begin()+(size_t)__pf_array_index_to, __pf_array_value); "
+        f"}}(({args[2]})); }}(({args[1]})); }}(({args[0]})); }}(({a}))"
+    )
+
+
+def checked_array_slice(a: str, args: list[str], *, result_type: str) -> str:
+    """``array.slice(id, index_from, index_to)`` — bounded range extraction.
+
+    ``result_type`` stays caller-supplied so the typed method lane keeps
+    emitting the receiver's own element type; only the bounds checks are new.
+    """
+    check = _checked_array_range_prelude()
+    return (
+        "[&](auto&& __pf_array){ "
+        "return [&](auto&& __pf_raw_index_from_value){ "
+        "return [&](auto&& __pf_raw_index_to_value){ "
+        f"{check}"
+        f"return {result_type}(__pf_array.begin()+(size_t)__pf_array_index_from, "
+        "__pf_array.begin()+(size_t)__pf_array_index_to); "
+        f"}}(({args[1]})); }}(({args[0]})); }}(({a}))"
     )
 
 
@@ -600,7 +698,7 @@ ARRAY_METHODS = {
     "set":       _checked_array_set,
     "push":      lambda a, args: f"{a}.push_back({args[0]})",
     "unshift":   lambda a, args: f"{a}.insert({a}.begin(), {args[0]})",
-    "insert":    lambda a, args: f"{a}.insert({a}.begin() + (int)({args[0]}), {args[1]})",
+    "insert":    _checked_array_insert,
     "pop":       lambda a, args: _checked_array_end_remove(a, "pop"),
     "shift":     lambda a, args: _checked_array_end_remove(a, "shift"),
     "remove":    _checked_array_remove,
@@ -609,7 +707,7 @@ ARRAY_METHODS = {
     "size":      lambda a, args: f"(double){a}.size()",
     "clear":     lambda a, args: f"{a}.clear()",
     "fill":      lambda a, args: f"std::fill({a}.begin(), {a}.end(), {args[0]})" if len(args) == 1
-                                 else f"std::fill({a}.begin()+(int)({args[1]}), {a}.begin()+(int)({args[2]}), {args[0]})",
+                                 else _checked_array_fill_range(a, args),
     "includes":  lambda a, args: f"(std::find({a}.begin(), {a}.end(), {args[0]}) != {a}.end())",
     "indexof":   lambda a, args: f"[&](){{ auto it=std::find({a}.begin(),{a}.end(),{args[0]}); return it!={a}.end()?(double)(it-{a}.begin()):-1.0; }}()",
     "lastindexof": lambda a, args: f"[&](){{ for(int i=(int){a}.size()-1;i>=0;i--)if({a}[i]=={args[0]})return(double)i; return -1.0; }}()",
@@ -619,7 +717,7 @@ ARRAY_METHODS = {
     ),
     "reverse":   lambda a, args: f"std::reverse({a}.begin(),{a}.end())",
     "copy":      lambda a, args: f"std::vector<double>({a})",
-    "slice":     lambda a, args: f"std::vector<double>({a}.begin()+(int)({args[0]}),{a}.begin()+(int)({args[1]}))",
+    "slice":     lambda a, args: checked_array_slice(a, args, result_type="std::vector<double>"),
     "concat":    lambda a, args: f"{a}.insert({a}.end(),{args[0]}.begin(),{args[0]}.end())",
     "sum":       lambda a, args: f"({a}.empty()?na<double>():std::accumulate({a}.begin(),{a}.end(),0.0))",
     "avg":       lambda a, args: f"({a}.empty()?na<double>():std::accumulate({a}.begin(),{a}.end(),0.0)/{a}.size())",
@@ -667,6 +765,9 @@ CHECKED_ARRAY_METHOD_KWARGS: dict[str, list[str]] = {
     "set": ["index", "value"],
     "remove": ["index"],
     "percentrank": ["index"],
+    "insert": ["index", "value"],
+    "fill": ["value", "index_from", "index_to"],
+    "slice": ["index_from", "index_to"],
     "first": [],
     "last": [],
     "pop": [],