[luisleo526]

The defect

A scalar if that chooses the timeframe of a request.security call was lowered with its condition read from the chart fields once, at registration time, before the first bar exists, and that one choice was kept for the whole run. TradingView evaluates the condition on every bar and requests the timeframe that bar selects, so the requested value can differ from the first bar where the choice differs. Since the previous change this form compiled with that silent one-arm value; before it, the same source stopped in the C++ compile.

What changes

• A scalar if choosing a requested timeframe passes the same setup proof the replayed conditions already use: inputs, constants, setup-time members and pure operations over them are accepted as before; a condition that reads a chart series value (open, high, low, close, volume, bar_index, time, a history read, or a call that depends on one) is refused at the first token of the condition with the new code PF-E3110. The refusal is a labelled temporary gap for one exact shape and is lifted when the form is lowered per bar.
• The ternary form and the other selection forms are not changed by this pull request.
• The typed nested-block fixture used a name TradingView refuses as an identifier; it now uses the measured source with ordinary identifiers, and its test comment says so.
• A test row that pinned the series-condition if as translating moves to a test that expects the refusal.
• AGENTS.md and CLAUDE.md gain one sentence naming the exception to the no-new-refusal rule: a labelled temporary refusal of an exact proven shape that would otherwise compile to a wrong value, with its own catalog code, listed as a compile gap.
• The e2e harness makes the engine's scripts directory importable while it loads the corpus resampler, which the engine's resampler now needs.

Not in this change

• A series condition in the ternary form has the same one-arm behaviour and already compiled before this change; the per-bar lowering for both forms is separate work.
• An if with a statement prefix in its arms goes through another function and is not changed here.

Verification

• Full suite on a host without the engine checkout, base main and this head, same command: base 11,529 passed, 0 failed; head 11,541 passed, 0 failed; no test fails only on the head. The engine-dependent tests are skipped on both trees there.
• Full-population parity sweep against the active baseline (engine a3e7822e): verdict PASS, no improvement and no regression, for this exact head.
• Engine-paired test run, compile corpus and parity gate on the cloud runner: in progress for this head; the pull request's own CI runs the engine tests with the harness change.
• Red-first (measured on the refusal change alone, before the fix): the eight new refusal rows fail on the unchanged product.

🤖 Generated with Claude Code

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Not checked: tests were not run; formal verification proved 0 of 1 changed function(s) (1 not verified).

Formal verification. PR-changed functions: 0/1 verified (0 proven, 0 may-equivalent, 0 distinguished) · 1 not verified (1 unsupported).

Not verified on this run: \_security\_tf\_runtime\_expr (unsupported).

---

Graphify review — findings

Adds a temporary compile refusal, PF-E3110, for a requested-timeframe if selection whose condition reads a chart series value or otherwise can't be proven at setup. Timeframe registration runs before the first chart bar, so the error is reported at the condition's first token. Scalar ternaries keep their existing lowering, so only the if form goes through the setup-proof check. Records the labelled temporary refusal as the one exception to the "refuse only what TradingView rejects" rule in the agent guidance, and registers the new code in the catalog and its pin. Makes the e2e chart-feed helper put the engine's scripts directory on sys.path while the resampler loads, then removes it, so newer engines that import sibling modules still load.

Worth a look

• Series ternary selecting a request timeframe is still lowered at setup, despite the same one-arm flaw as the refused if-block — tests/test_security_selection_blocks.py:463 · Escalate · medium
  • NOT verified (no proof, no reproducing execution) — needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1055 functions depend on the 622 functions this change touches.

Health — grade A; 10 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• replay() — 102 callers, 4 callees (high)
• emit_stmt() — 2 callers, 17 callees (high)
• _assert_mutable_source_composer_refusal() — 3 callers, 11 callees (medium)
• expression() — 3 callers, 8 callees (medium)
• _generator() — 3 callers, 7 callees (medium)
• _replay_tape() — 3 callers, 6 callees (medium)
• _build() — 4 callers, 4 callees (medium)
• walk() — 1 callers, 15 callees (high)
• …and 2 more

Verification — 1055 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 1055 function(s) in the blast radius were not formally verified this run

Cross-repo impact

Cross-repo impact

No cross-repo impact detected among the indexed peer repo(s).

1 peer repo(s) in this group are not yet indexed — cross-repo impact may be incomplete.

Cross-repo linkage is derived (SCIP-moniker matches are sound; name/contract matches are heuristic) and ADVISORY — it never affects this check's conclusion.

Formal verification

Could not verify: Could not verify \_security\_tf\_runtime\_expr.

The verifier did not have enough to check \_security\_tf\_runtime\_expr, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: method — first parameter is `self`, which needs a constructed instance (not synthesizable)