carray 3.0.0 → 3.0.2

data/ext/ca_obj_binop.c

@@ -70,11 +70,21 @@ typedef struct CABinOp {
                              collapse and attach lifecycle traversal) */
   uint32_t  attach;
   uint8_t   nosync;
+  /* ---- CAMultiParent conformance (CA_FLAG_MULTI_PARENTS): n_parents and
+         parents[] sit immediately after the CAView header, as the layout
+         convention in carray.h requires, so generic code that would walk a
+         single ->parent folds over both operands instead.  What this buys
+         here is ca_has_mask: it answers for a two-parent view by asking both
+         and creating the mask on demand, which lets the mask stay unbuilt
+         until something reads it. ---- */
+  int32_t   n_parents;        /* always 2 */
+  CArray  **parents;          /* = &operands[0]; no separate allocation */
   /* CABinOp-specific tail */
   CArray   *right;
   uint16_t  op_id;
   uint8_t   right_is_scalar;  /* 1 ⇒ right has elements == 1, walk
                                  with element-stride 0 (= broadcast) */
+  CArray   *operands[2];      /* {left, right}; what parents points at */
 } CABinOp;
 
 static size_t
@@ -125,7 +135,7 @@ ca_binop_setup (CABinOp *ca, CArray *left, CArray *right, uint16_t op_id)
 
   ca->obj_type  = CA_OBJ_BINOP;
   ca->data_type = out_dt;
-  ca->flags     = CA_FLAG_READ_ONLY;
+  ca->flags     = CA_FLAG_READ_ONLY | CA_FLAG_MULTI_PARENTS;
   ca->ndim      = left->ndim;
   ca->bytes     = out_bytes;
   ca->elements  = left->elements;
@@ -139,6 +149,10 @@ ca_binop_setup (CABinOp *ca, CArray *left, CArray *right, uint16_t op_id)
   ca->nosync    = 0;
   ca->right     = right;
   ca->op_id     = op_id;
+  ca->operands[0] = left;
+  ca->operands[1] = right;
+  ca->parents     = ca->operands;
+  ca->n_parents   = 2;
   /* right_is_scalar fast path: when right holds a single element,
      xfer_stride pulls only that cell into scratch and walks the
      kernel with element-stride 0 (broadcast).  The symmetric
@@ -148,9 +162,10 @@ ca_binop_setup (CABinOp *ca, CArray *left, CArray *right, uint16_t op_id)
 
   memcpy(ca->dim, left->dim, left->ndim * sizeof(ca_size_t));
 
-  if ( ca_has_mask(left) || ca_has_mask(right) ) {
-    ca_create_mask(ca);
-  }
+  /* The mask is NOT built here.  ca_has_mask folds over parents[] for a
+     multi-parent view and creates it on demand, so an expression whose mask
+     nobody reads never allocates one -- and a chain of masked nodes builds
+     one array at the end rather than one per node. */
 
   if ( ca_is_scalar(left) && ca_is_scalar(right) ) {
     ca_set_flag(ca, CA_FLAG_SCALAR);
@@ -291,25 +306,25 @@ ca_binop_func_xfer_stride (void *ap, ca_size_t *starts, ca_size_t *counts,
       one_counts[k]  = 1;
       one_strides[k] = right_bytes;
     }
-    scratch = ca_lazy_arena_acquire(right_bytes);
+    scratch = ( bo->data_type == CA_OBJECT )
+                ? ca_lazy_arena_acquire_object(1)
+                : ca_lazy_arena_acquire(right_bytes);
     ca_binop_scratch_acquire_count++;
     ca_xfer_stride(bo->right, one_starts, one_counts, one_strides,
                    scratch, CA_XFER_GET);
     right_step = 0;
   }
   else {
-    /* Same-shape right.  Pull with the same byte layout the caller
-       requested for the output; right.bytes matches output.bytes
-       because right.data_type == out.data_type by cast-before. */
-    ca_size_t right_strides[CA_RANK_MAX];
-    ca_size_t s = right_bytes;
-    for ( k = bo->ndim - 1; k >= 0; k-- ) {
-      right_strides[k] = s;
-      s *= counts[k];
-    }
-    scratch = ca_lazy_arena_acquire(slab_n * right_bytes);
+    /* Same-shape right.  `strides` is the step through the operand, the
+       same one the left was pulled with -- recomputing a packed one here
+       reads the right operand's cells 0, 1, 2 against the left's 0, 2, 4.
+       right.bytes matches output.bytes because right.data_type ==
+       out.data_type by cast-before, so the same steps serve both. */
+    scratch = ( bo->data_type == CA_OBJECT )
+                ? ca_lazy_arena_acquire_object(slab_n)
+                : ca_lazy_arena_acquire(slab_n * right_bytes);
     ca_binop_scratch_acquire_count++;
-    ca_xfer_stride(bo->right, starts, counts, right_strides, scratch,
+    ca_xfer_stride(bo->right, starts, counts, strides, scratch,
                    CA_XFER_GET);
     right_step = 1;
   }
@@ -438,6 +453,14 @@ ca_binop_func_allocate (void *ap)
 {
   CABinOp *ca = (CABinOp *) ap;
   ca->ptr = xmalloc(ca_length(ca));
+  /* CA_OBJECT cells are VALUEs and this buffer is about to be marked as
+     soon as the view is, so it must not be handed to the GC as raw
+     xmalloc garbage. */
+  if ( ca->data_type == CA_OBJECT ) {
+    VALUE *p = (VALUE *) ca->ptr;
+    ca_size_t i;
+    for ( i = 0; i < ca->elements; i++ ) *p++ = Qnil;
+  }
 }
 
 static void
@@ -459,6 +482,14 @@ ca_binop_func_attach (void *ap)
   s = ca->bytes;
   for ( k = ca->ndim - 1; k >= 0; k-- ) { native[k] = s; s *= ca->dim[k]; }
   for ( k = 0; k < ca->ndim; k++ ) starts[k] = 0;
+  /* CA_OBJECT cells are VALUEs and this buffer is about to be marked as
+     soon as the view is, so it must not be handed to the GC as raw
+     xmalloc garbage. */
+  if ( ca->data_type == CA_OBJECT ) {
+    VALUE *p = (VALUE *) ca->ptr;
+    ca_size_t i;
+    for ( i = 0; i < ca->elements; i++ ) *p++ = Qnil;
+  }
   ca_binop_func_xfer_stride(ca, starts, ca->dim, native, ca->ptr, CA_XFER_GET);
 }
 
@@ -517,6 +548,19 @@ ca_binop_func_create_mask (void *ap)
              ( bo->op_id == CA_BINOP_BIT_AND || bo->op_id == CA_BINOP_BIT_OR ) );
   is_or  = ( bo->op_id == CA_BINOP_BIT_OR );
 
+  /* One masked operand and no Kleene resolution: the answer is that
+     operand's mask, cell for cell.  Share it the way CAMonOp shares its
+     parent's, rather than allocating a copy per node -- a chain of k
+     binops over one masked array then holds one boolean array, not k. */
+  if ( ! kleene && ( has_l != has_r ) ) {
+    CArray *src = has_l ? l : r;
+    if ( src->elements == bo->elements ) {
+      bo->mask = (CArray *) ca_refer_new(src->mask, CA_BOOLEAN,
+                                         bo->ndim, bo->dim, 0, 0);
+      return;
+    }
+  }
+
   bo->mask = (CArray *) carray_new(CA_BOOLEAN, bo->ndim, bo->dim, 0, NULL);
   dst = (boolean8_t *) bo->mask->ptr;
   n = bo->elements;
@@ -524,8 +568,18 @@ ca_binop_func_create_mask (void *ap)
   /* Kleene needs operand values even where an operand is unmasked. */
   need_l = has_l || kleene;
   need_r = has_r || kleene;
-  if ( need_l ) ca_attach(l);
-  if ( need_r ) ca_attach(r);
+  /* Only Kleene reads operand values.  Every other op reads the operand
+     masks alone, and attaching the operand to reach its mask materialises
+     the whole subexpression under it -- so a chain of k masked binops
+     evaluates its own subtree k times over.  Attach what is read. */
+  if ( kleene ) {
+    if ( need_l ) ca_attach(l);
+    if ( need_r ) ca_attach(r);
+  }
+  else {
+    if ( has_l ) ca_attach(l->mask);
+    if ( has_r ) ca_attach(r->mask);
+  }
 
   lm = has_l ? (boolean8_t *) l->mask->ptr : NULL;
   rm = has_r ? (boolean8_t *) r->mask->ptr : NULL;
@@ -550,8 +604,14 @@ ca_binop_func_create_mask (void *ap)
     dst[i] = m;
   }
 
-  if ( need_l ) ca_detach(l);
-  if ( need_r ) ca_detach(r);
+  if ( kleene ) {
+    if ( need_r ) ca_detach(r);
+    if ( need_l ) ca_detach(l);
+  }
+  else {
+    if ( has_r ) ca_detach(r->mask);
+    if ( has_l ) ca_detach(l->mask);
+  }
 }
 
 ca_operation_function_t ca_binop_func = {
@@ -682,8 +742,7 @@ rb_ca_binop_build (VALUE l_cary, VALUE r_cary, uint16_t op_id)
 
   /* === Step 2: broadcast via ca_broadcast_pair (same-ndim size-1
      expansion).  No-op when shapes already match or either operand
-     is scalar; also a no-op for incompatible shapes, which the
-     final elements-mismatch check below catches. */
+     is scalar; refuses a pair that cannot be brought to one shape. */
   ca_broadcast_pair(&l_resolved, &r_resolved);
   TypedData_Get_Struct(l_resolved, CArray, &carray_data_type, l);
   TypedData_Get_Struct(r_resolved, CArray, &carray_data_type, r);
@@ -735,14 +794,12 @@ rb_ca_binop_build (VALUE l_cary, VALUE r_cary, uint16_t op_id)
       }
     }
     else {
-      /* Cross-ndim or otherwise incompatible shapes; see the
-         builder header comment for why CArray rejects implicit
-         cross-ndim promotion. */
+      /* Unreachable from Ruby: ca_broadcast_pair above refuses a pair
+         it cannot bring to one shape, and states the rule there.  Kept
+         so a caller reaching this builder by another route still finds
+         the kernel guarded. */
       rb_raise(rb_eArgError,
-               "CABinOp: shape mismatch (%lld vs %lld) — only same-"
-               "ndim size-1 broadcast is supported; cross-ndim "
-               "promotion is not adopted in CArray "
-               "(reshape explicitly)",
+               "CABinOp: element count mismatch (%lld vs %lld)",
                (long long) l->elements, (long long) r->elements);
     }
   }
@@ -866,7 +923,6 @@ Init_ca_obj_binop (void)
   rb_define_const(rb_cCABinOp, "OP_AND",        INT2NUM(CA_BINOP_AND));
   rb_define_const(rb_cCABinOp, "OP_OR",         INT2NUM(CA_BINOP_OR));
   rb_define_const(rb_cCABinOp, "OP_XOR",        INT2NUM(CA_BINOP_XOR));
-  rb_define_const(rb_cCABinOp, "OP_REMINDER",   INT2NUM(CA_BINOP_REMINDER));
 
   rb_define_alloc_func(rb_cCABinOp, rb_ca_binop_s_allocate);
   rb_define_method(rb_cCABinOp, "initialize_copy",

data/ext/ca_obj_block.c

@@ -269,8 +269,10 @@ rb_cb_initialize_copy (VALUE self, VALUE other)
 }
 
 /* Per-axis accessor macro: defines a method that returns the named
-   CABlock tail array (size0 / start / step / count) as a Ruby Array.
-   `offset` is a single Integer and uses its own accessor below. */
+   CABlock tail array (size0 / start / step) as a Ruby Array.
+   `offset` is a single Integer and uses its own accessor below.
+   `count` has no accessor: it is what `shape` already answers, and the
+   name belongs to CArray#count. */
 #define rb_cb_get_attr_ary(name)                    \
 rb_cb_ ## name (VALUE self)                         \
 {                                                   \
@@ -288,7 +290,6 @@ rb_cb_ ## name (VALUE self)                         \
 static VALUE rb_cb_get_attr_ary(size0)
 static VALUE rb_cb_get_attr_ary(start)
 static VALUE rb_cb_get_attr_ary(step)
-static VALUE rb_cb_get_attr_ary(count)
 
 static VALUE
 rb_cb_offset (VALUE self)
@@ -376,7 +377,6 @@ Init_ca_obj_block (void)
   rb_define_method(rb_cCABlock, "size0",  rb_cb_size0, 0);
   rb_define_method(rb_cCABlock, "start",  rb_cb_start, 0);
   rb_define_method(rb_cCABlock, "step",   rb_cb_step, 0);
-  rb_define_method(rb_cCABlock, "count",  rb_cb_count, 0);
   rb_define_method(rb_cCABlock, "offset", rb_cb_offset, 0);
 
   rb_define_method(rb_cCABlock, "idx2addr0",   rb_cb_idx2addr0, -1);

data/ext/ca_obj_const_string.c

@@ -38,10 +38,10 @@
 typedef struct {
   /* === CAView prefix === */
   int16_t    obj_type;
-  int8_t     data_type;        /* CA_FIXLEN surface (numeric gate); storage is int64 */
+  int8_t     data_type;        /* CA_FIXLEN surface (numeric gate); storage is fixlen-16 */
   int8_t     ndim;
   int32_t    flags;            /* CA_FLAG_IS_FACE set */
-  ca_size_t  bytes;            /* sizeof(int64_t) = 8 (one offset per element) */
+  ca_size_t  bytes;            /* 2 * sizeof(int64_t) = 16 (one (start,end) pair per element) */
   ca_size_t  elements;
   ca_size_t *dim;
   char      *ptr;
@@ -227,7 +227,9 @@ ca_operation_function_t ca_const_string_func = {
   ca_face_xfer_addrs,
   NULL,                              /* fold_stride: identity Face is not foldable */
   ca_face_xfer_stride,
-  ca_face_xfer_all
+  ca_face_xfer_all,
+  .fill_addrs  = ca_face_fill_addrs,
+  .fill_stride = ca_face_fill_stride,
 };
 
 /* ------------------------------------------------------------------- */
@@ -297,6 +299,54 @@ rb_ca_const_string_wrap (VALUE parent_val, VALUE buffer, int encoding_id)
     rb_raise(rb_eTypeError, "CAConstString.wrap: buffer: must be a String");
   }
 
+  /* This is the one door through which already-built offsets enter, so it
+     validates rather than assumes.  Everything downstream -- the per-cell
+     decode, the native byte scans, the sort comparator -- reads `buf + start`
+     for `end - start` bytes on the strength of these pairs; an out-of-range
+     one is an out-of-bounds read of the heap, not a wrong answer.  Refuse it
+     here, while the input is still in the caller's hands, rather than letting
+     it surface as an IndexError from a decode or as a crash from a scan.
+
+     A masked cell is exempt: its bytes may be anything at all, that being the
+     CArray mask contract, and no reader dereferences them (the scan skips on
+     the mask before touching an offset; `.value`, the explicit strip, raises
+     from the decode). */
+  {
+    ca_size_t i, n;
+    int64_t *pair;
+    boolean8_t *m;
+
+    ca_attach(parent);
+    ca_update_mask(parent);
+    n    = parent->elements;
+    pair = (int64_t *) parent->ptr;
+    m    = parent->mask ? (boolean8_t *) parent->mask->ptr : NULL;
+    for ( i = 0; i < n; i++ ) {
+      int64_t start = pair[2 * i], end = pair[2 * i + 1];
+      if ( m && m[i] ) {
+        continue;
+      }
+      if ( start < 0 || end < start || end > (int64_t) RSTRING_LEN(buffer) ) {
+        ca_detach(parent);
+        rb_raise(rb_eArgError,
+                 "CAConstString.wrap: element %lld has range [%lld,%lld), "
+                 "outside the %ld-byte buffer",
+                 (long long) i, (long long) start, (long long) end,
+                 (long) RSTRING_LEN(buffer));
+      }
+    }
+    ca_detach(parent);
+  }
+
+  /* Take ownership of the offsets, the way CACategorical.from_codes takes
+     ownership of its codes.  Without this the Face is read-only but its
+     storage is not, so `cs.parent[i] = <anything>` walks straight past the
+     check above and back into an out-of-bounds read.  The flag rather than
+     #freeze, for the reason from_codes gives: freeze would propagate through
+     views and Faces.  A caller that wants to keep a mutable entity of its own
+     passes `.copy`. */
+  ca_set_flag(parent, CA_FLAG_READ_ONLY);
+
   ca  = ca_const_string_new(parent, rb_str_freeze(buffer), encoding_id);
   obj = TypedData_Wrap_Struct(rb_cCAConstString, &catext_data_type, ca);
   rb_ca_set_parent(obj, parent_val);   /* pin parent VALUE for GC */
@@ -395,10 +445,13 @@ rb_ca_const_string_encoding (VALUE self)
   return rb_enc_from_encoding(rb_enc_from_index(ca->encoding_id));
 }
 
-/* `CAConstString#buffer` — returns the frozen internal byte buffer
-   (length-prefix format).  Exposes the defining tail state for
-   introspection and the Arrow-boundary component-buffer export
-   path. */
+/* `CAConstString#buffer` — returns the frozen internal byte buffer: a pure
+   concatenation of the element bytes, with no per-record length prefix (=
+   the Arrow values buffer).  Exposes the defining tail state for
+   introspection and the Arrow-boundary component-buffer export path.  The
+   ranges that index it live in the storage, one (start,end) int64 pair per
+   element; `wrap` is where a hand-built pair array is checked against a
+   buffer. */
 static VALUE
 rb_ca_const_string_buffer (VALUE self)
 {
@@ -538,7 +591,7 @@ ca_const_string_scan_end (ca_const_string_scan_t *s)
    so element i occupies s->off[2*i] (start) .. s->off[2*i+1] (end).
    The buffer is a pure concatenation; length = end - start. */
 static inline int
-ca_const_string_record (ca_const_string_scan_t *s, ca_size_t i, const char **pp, int32_t *plen)
+ca_const_string_record (ca_const_string_scan_t *s, ca_size_t i, const char **pp, int64_t *plen)
 {
   int64_t start, end;
   if ( s->m && s->m[i] ) {
@@ -547,7 +600,7 @@ ca_const_string_record (ca_const_string_scan_t *s, ca_size_t i, const char **pp,
   start = s->off[2 * i];
   end   = s->off[2 * i + 1];
   *pp   = s->buf + start;
-  *plen = (int32_t) (end - start);
+  *plen = (int64_t) (end - start);
   return 1;
 }
 
@@ -596,7 +649,7 @@ rb_ca_const_string_byte_length (VALUE self)
   CArray *co;
   int64_t *op;
   const char *p;
-  int32_t len;
+  int64_t len;
   ca_size_t i;
 
   ca_const_string_scan_begin(self, &s);
@@ -631,7 +684,7 @@ ca_const_string_predicate (VALUE self, VALUE query, int op)
   boolean8_t *out;
   const char *qp, *p;
   long qlen;
-  int32_t len;
+  int64_t len;
   ca_size_t i;
 
   if ( TYPE(query) != T_STRING ) {
@@ -684,7 +737,7 @@ rb_ca_const_string_eq (VALUE self, VALUE other)
        they are read only when both records are valid, but GCC cannot prove
        that -- initialize to keep -Wmaybe-uninitialized quiet and defensive. */
     const char *pa = NULL, *pb = NULL;
-    int32_t la = 0, lb = 0;
+    int64_t la = 0, lb = 0;
     ca_size_t i;
 
     ca_const_string_scan_begin(self, &a);
@@ -715,7 +768,7 @@ rb_ca_const_string_count (VALUE self, VALUE query)
   ca_const_string_scan_t s;
   const char *qp, *p;
   long qlen;
-  int32_t len;
+  int64_t len;
   ca_size_t i, c = 0;
 
   if ( TYPE(query) != T_STRING ) {
@@ -745,7 +798,7 @@ rb_ca_const_string_search (VALUE self, VALUE query)
   ca_const_string_scan_t s;
   const char *qp, *p;
   long qlen;
-  int32_t len;
+  int64_t len;
   ca_size_t i;
   VALUE result = Qnil;
 
@@ -784,7 +837,7 @@ ca_const_string_byte_cmp (const void *a, const void *b)
   /* sort raises on masked input, so record() always sets these here; the
      initializers keep -Wmaybe-uninitialized quiet and stay defensive. */
   const char *pa = NULL, *pb = NULL;
-  int32_t la = 0, lb = 0;
+  int64_t la = 0, lb = 0;
   int c;
   ca_const_string_record(ca_const_string_sort_ctx, ia, &pa, &la);
   ca_const_string_record(ca_const_string_sort_ctx, ib, &pb, &lb);
@@ -834,9 +887,15 @@ rb_ca_const_string_sort_index (VALUE self)
   return vout;
 }
 
-/* CAConstString#sort is defined in Ruby (lib/carray/const_string.rb) as `self[sort_index]`,
-   i.e. a no-copy view over the offset source (buffer + offsets shared, only
-   the gather order changes) — consistent with CArray#sort being a view. */
+/* The ordering surface is defined in Ruby (lib/carray/const_string.rb) on
+   top of these three: a storage cell is a byte range, so storage order is
+   insertion order rather than string order, and every member has to read
+   the bytes.  What is native here is the flat form, which is the common one
+   for a string column and which a byte scan does an order of magnitude
+   faster than decoding a Ruby String per cell; the per-axis forms go
+   through #to_string.  These are spelled as internals because the public
+   names carry CArray's meanings: what the permutation below answers is
+   sort_addr (view-flat addresses in sorted order), not sort_index. */
 
 /* CAConstString#min / #max → the byte-min / byte-max element as a frozen String,
    skipping masked elements; nil if empty or all masked. */
@@ -845,7 +904,7 @@ ca_const_string_extremum (VALUE self, int want_max)
 {
   ca_const_string_scan_t s;
   const char *p, *bestp = NULL;
-  int32_t len, bestlen = 0;
+  int64_t len, bestlen = 0;
   ca_size_t i;
   int found = 0;
 
@@ -892,9 +951,9 @@ rb_ca_const_string_initialize_copy (VALUE self, VALUE other)
   CAConstString *ca, *cs;
   TypedData_Get_Struct(self,  CAConstString, &catext_data_type, ca);
   TypedData_Get_Struct(other, CAConstString, &catext_data_type, cs);
-  /* T.0/T.1: shallow re-setup (shares buffer + offset-source).  T.3 will
-     replace this with compacting deep copy (rebased offsets + compacted
-     buffer + detach). */
+  /* Shallow re-setup: shares the buffer and the offset source, which is the
+     documented `dup` semantics for a view.  `copy` is the compacting deep
+     copy (rebased offsets, compacted buffer, detached). */
   if ( ca_func[CA_OBJ_CONST_STRING].pool_init ) {
     ca_array_pool_alloc(ca, CA_OBJ_CONST_STRING, cs->parent->ndim);
   }
@@ -947,11 +1006,13 @@ Init_ca_obj_const_string (void)
   rb_define_method(rb_cCAConstString, "search",           rb_ca_const_string_search, 1);
   rb_define_method(rb_cCAConstString, "find_value_index",  rb_ca_const_string_search, 1);
 
-  /* native sort_index / min / max (§3.7), byte-memcmp comparator.
-     sort / sort_copy are defined in Ruby on top of sort_index. */
-  rb_define_method(rb_cCAConstString, "sort_index", rb_ca_const_string_sort_index, 0);
-  rb_define_method(rb_cCAConstString, "min",        rb_ca_const_string_min, 0);
-  rb_define_method(rb_cCAConstString, "max",        rb_ca_const_string_max, 0);
+  /* Native flat sort permutation / min / max (§3.7), byte-memcmp
+     comparator.  The public ordering surface is built on these in
+     lib/carray/const_string.rb; see the comment above their definitions. */
+  rb_define_method(rb_cCAConstString, "__sort_addr_bytes__",
+                                      rb_ca_const_string_sort_index, 0);
+  rb_define_method(rb_cCAConstString, "__min_bytes__", rb_ca_const_string_min, 0);
+  rb_define_method(rb_cCAConstString, "__max_bytes__", rb_ca_const_string_max, 0);
 
   /* Y-pilot: Face-local C-level fast path for per-cell scalar fetch. */
   ca_face_register_storage_to_scalar(CA_OBJ_CONST_STRING, rb_ca_const_string_storage_to_scalar);

data/ext/ca_obj_face.c

@@ -66,6 +66,21 @@ ca_face_fill_data (void *ap, void *ptr)
   ca_fill(cav->parent, ptr);
 }
 
+void
+ca_face_fill_addrs (void *ap, ca_size_t n, ca_size_t *addrs, void *ptr)
+{
+  CAView *cav = (CAView *) ap;
+  ca_fill_addrs(cav->parent, n, addrs, ptr);
+}
+
+void
+ca_face_fill_stride (void *ap, ca_size_t base, int8_t ndim,
+                            ca_size_t *counts, ca_size_t *steps, void *ptr)
+{
+  CAView *cav = (CAView *) ap;
+  ca_fill_stride(cav->parent, base, ndim, counts, steps, ptr);
+}
+
 void
 ca_face_xfer_index (void *ap, ca_size_t *idx, void *data, int dir)
 {
@@ -270,6 +285,71 @@ ca_face_lift (VALUE view, VALUE face_parent)
   return lifted;
 }
 
+/* ca_lazy_marker_lift(view, marker) — the CALazyMarker half of
+ * ca_wrapper_lift.  Same invariant as the Face lift (wrapper on top, view
+ * built against what the wrapper wraps) reached by a shorter route: a
+ * marker carries no subclass state, so there is nothing for
+ * rb_ca_face_template's struct copy to preserve, and building a fresh
+ * marker over the view gets data_type, bytes, shape, mask and flags right
+ * by construction.  That last part is load-bearing for `refer(type)`,
+ * where the view's data_type differs from the one the old marker copied
+ * off the entity.
+ *
+ * The one piece it shares with the Face lift is the one-level swap: the
+ * builder handed us a view whose parent is the marker, and leaving it
+ * there would stack a redundant marker in the middle. */
+static VALUE
+ca_lazy_marker_lift (VALUE view, VALUE marker)
+{
+  CArray *view_ca, *mp;
+  extern VALUE rb_ca_lazy_marker_new (VALUE cary);
+
+  TypedData_Get_Struct(view, CArray, &carray_data_type, view_ca);
+
+  /* Idempotent: a builder that wrapped internally already returned a
+     marker (mirrors the same guard in ca_face_lift). */
+  if ( ca_is_lazy_marker(view_ca) ) {
+    return view;
+  }
+
+  TypedData_Get_Struct(marker, CArray, &carray_data_type, mp);
+
+  /* One-level swap (CAFace.md section 8.3, same reasoning): move the view
+     off the marker and onto what the marker wraps.  Guarded on pointer
+     equality so only a view built directly on this marker fires. */
+  if ( ca_is_view(view_ca)
+       && ((CAView *) view_ca)->parent == mp
+       && ! ca_test_flag(view_ca, CA_FLAG_MULTI_PARENTS) ) {
+    ((CAView *) view_ca)->parent = ((CAView *) mp)->parent;  /* C pointer */
+    rb_ca_set_parent(view, rb_ca_parent(marker));            /* @parent ivar */
+  }
+
+  return rb_ca_lazy_marker_new(view);
+}
+
+/* ca_wrapper_lift(view, wrapper, wrapper_ca) — dispatch for
+ * CA_WRAPPER_LIFT.  The macro has already established that wrapper_ca
+ * carries one of the two flags and that view is a CArray. */
+VALUE
+ca_wrapper_lift (VALUE view, VALUE wrapper, void *wrapper_ca)
+{
+  CArray *ca = (CArray *) wrapper_ca;
+
+  if ( ca_is_face(ca) ) {
+    CArray *view_ca;
+    TypedData_Get_Struct(view, CArray, &carray_data_type, view_ca);
+    /* Some builders (select / repeat / ...) lift their own result; a
+       second lift here would double-wrap.  Mirrors the guard the `[]`
+       call site used to carry inline. */
+    if ( ca_is_face(view_ca) ) {
+      return view;
+    }
+    return ca_face_lift(view, wrapper);
+  }
+
+  return ca_lazy_marker_lift(view, wrapper);
+}
+
 /* ca_strip_face(src) — walk down through Face parents to the storage
  * CArray.  Called at kernel_iterator entry and lazy chain endpoints
  * where downstream code needs to observe the storage layout, not the
@@ -515,6 +595,30 @@ ca_face_class_has_portable_method (VALUE klass)
   return ( owner != rb_singleton_class(rb_cCArray) ) ? 1 : 0;
 }
 
+VALUE
+ca_face_operand_descend (VALUE operand, const char *name)
+{
+  CArray *op;
+  if ( ! RTEST(rb_obj_is_carray(operand)) ) {
+    return operand;
+  }
+  TypedData_Get_Struct(operand, CArray, &carray_data_type, op);
+  if ( ! ca_is_face(op) ) {
+    return operand;
+  }
+  if ( ca_test_flag(op, CA_FLAG_FACE_COMPARABLE_STORAGE) ) {
+    return rb_ca_strip_face_value(operand);
+  }
+  rb_raise(rb_eArgError,
+           "%s: cannot take a %s operand: its storage is not its surface "
+           "(a cell encodes the value rather than being it), so comparing "
+           "the storage would compare the encoding. Convert the operand to "
+           "the receiver's space first -- #to_string for a string Face -- "
+           "or pass .parent on both sides to work in storage space",
+           name, rb_obj_classname(operand));
+  return Qnil;   /* not reached */
+}
+
 int
 ca_face_state_portable (int obj_type, VALUE klass)
 {

data/ext/ca_obj_face.h

@@ -34,7 +34,8 @@
                via parent)
      - detach: release ptr alias, parent detach
      - xfer_*: delegate to parent's xfer_* (= identical shape / index space)
-     - fill_data: delegate to parent's ca_fill (= identical storage bytes)
+     - fill_data / fill_*: delegate to parent (= identical storage bytes,
+       and the identity layout makes the parent's addresses ours)
 
    Subclasses may override as needed (= default policy, not an invariant;
    does not preclude a future transform Face). */
@@ -43,6 +44,9 @@ void ca_face_attach     (void *ap);
 void ca_face_sync       (void *ap);
 void ca_face_detach     (void *ap);
 void ca_face_fill_data  (void *ap, void *ptr);
+void ca_face_fill_addrs (void *ap, ca_size_t n, ca_size_t *addrs, void *ptr);
+void ca_face_fill_stride(void *ap, ca_size_t base, int8_t ndim,
+                                 ca_size_t *counts, ca_size_t *steps, void *ptr);
 void ca_face_xfer_index (void *ap, ca_size_t *idx,
                                  void *data, int dir);
 void ca_face_xfer_addrs (void *ap, ca_size_t n, ca_size_t *addrs,
@@ -112,6 +116,34 @@ VALUE   rb_ca_record_get_data_class (CArray *ca);
   }                                                               \
 } while (0)
 
+/* -- wrapper lift (Face or CALazyMarker) --
+
+   A Face and a CALazyMarker are both storage-identical wrappers: they add
+   an interpretation over their parent's bytes without changing them.  Both
+   want the same invariant at a view-creating method -- the wrapper stays on
+   top, and the view is built against what the wrapper wraps.  For a Face
+   that keeps `dt.shift(1)` a CATime; for a marker it keeps a fuse block's
+   expression lazy instead of dropping out of the chain.
+
+   The flag test comes first and covers both bits in one mask, so an
+   ordinary array leaves through a single AND.  That matters: `[]` is the
+   hottest method this is deployed on (see devel/bench_index_percall.rb).
+
+   NOT interchangeable with CA_FACE_LIFT_IF_FACE.  Face is lifted at ~24
+   sites, including ones a marker must not follow it through -- `copy` owns
+   its data, `sort` reorders values, `value` and `strip_mask` change what
+   the mask means.  Deploy this only where the result is a view whose shape
+   was fixed at construction and which only moves positions
+   (PROPOSAL_LAZY_MARKER_LIFT section 4). */
+#define CA_WRAPPER_LIFT(obj, self, ca) do {                          \
+  if ( ca_test_flag((ca), CA_FLAG_IS_FACE | CA_FLAG_IS_LAZY_MARKER)  \
+       && rb_obj_is_kind_of((obj), rb_cCArray) ) {                   \
+    (obj) = ca_wrapper_lift((obj), (self), (ca));                    \
+  }                                                                  \
+} while (0)
+
+VALUE ca_wrapper_lift (VALUE view, VALUE wrapper, void *wrapper_ca);
+
 /* -- Scalar fetch decode hook (storage -> surface) --
    On the scalar-return path (= tail of rb_ca_fetch_index /
    rb_ca_fetch_addr), if a Face-derived subclass defines a
@@ -227,6 +259,21 @@ void ca_face_register_state_portable (int obj_type, int portable);
    (= falls through to default). */
 int ca_face_state_portable (int obj_type, VALUE klass);
 
+/* Bring a Face *operand* into the reference's storage space, or refuse.
+
+   The gate asks `fz_face_descend`'s question -- "is your storage your
+   surface?" -- of the receiver, and for a long time asked nothing at all of
+   the operand: a COMPARABLE receiver stripped any Face handed to it, and got
+   back that Face's encoding rather than its values.  Where the two encodings
+   happened to be the same width the comparison then answered, wrongly and
+   silently.  Call this instead of stripping an operand by hand.
+
+   A Face passes only if it declares COMPARABLE_STORAGE, i.e. its storage
+   cells *are* the values it shows.  Anything else -- a byte range, a code, a
+   tick -- is refused rather than compared as bytes.  Non-Face operands are
+   returned untouched.  `name` opens the message. */
+VALUE ca_face_operand_descend (VALUE operand, const char *name);
+
 #define CA_FACE_STORAGE_TO_SCALAR_IF_FACE(obj, self, ca) do {                \
   if ( ca_is_face(ca) && (obj) != CA_UNDEF && (obj) != Qnil                  \
        && ! rb_obj_is_kind_of((obj), rb_cCArray) ) {                         \