nomen-lang 0.8.0 → 0.10.0

package/core/System/Buffer.nm

@@ -23,13 +23,13 @@ pub struct Buffer<T> {
 	// both backends. They run once per container op (never per element), so
 	// the aarch64 inline-method ABI cost that keeps the per-limb load/store
 	// primitives raw (see BigInt.nm) doesn't apply here.
-	internal func alloc_u32 = (ref self, int size, out int: out >= size) {
+	internal func alloc_u32 = (ref self {}, int size, out int: out >= size) {
 		self.cap = size
 		self.data = calloc(size, 4)
 		return self.cap
 	}
 
-	internal func grow_u32 = (ref self, int needed, out int: out >= needed) {
+	internal func grow_u32 = (ref self {}, int needed, out int: out >= needed) {
 		if self.cap >= needed {
 			return self.cap
 		}
@@ -44,7 +44,7 @@ pub struct Buffer<T> {
 		return self.cap
 	}
 
-	internal func zero_u32 = (ref self, int len) {
+	internal func zero_u32 = (ref self {}, int len) {
 		memset(self.data, 0, len * 4)
 	}
 
@@ -63,7 +63,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal inline func store_u32 = (ref self, int i: i >= 0 && i < self.cap, uint32 val) {
+	internal inline func store_u32 = (ref self {}, int i: i >= 0 && i < self.cap, uint32 val) {
 		```
 		#arch: c
 		((unsigned int*)(unsigned long long)self->data)[i] = val;
@@ -77,7 +77,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal inline func store_or_u32 = (ref self, int i: i >= 0 && i < self.cap, uint32 val) {
+	internal inline func store_or_u32 = (ref self {}, int i: i >= 0 && i < self.cap, uint32 val) {
 		```
 		#arch: c
 		((unsigned int*)(unsigned long long)self->data)[i] |= val;
@@ -109,7 +109,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal inline func store_u8 = (ref self, int i: i >= 0 && i < self.cap, uint8 val) {
+	internal inline func store_u8 = (ref self {}, int i: i >= 0 && i < self.cap, uint8 val) {
 		```
 		#arch: c
 		((unsigned char*)(unsigned long long)self->data)[i] = val;
@@ -122,13 +122,12 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal func alloc_int = (ref self, int size, out int: out >= size) {
+	internal func alloc_int = (ref self {}, int size, out int: out >= size) {
 		self.cap = size
 		self.data = calloc(size, 8)
 		return self.cap
 	}
-
-	internal func grow_int = (ref self, int needed, out int: out >= needed) {
+	internal func grow_int = (ref self {}, int needed, out int: out >= needed) {
 		if self.cap >= needed {
 			return self.cap
 		}
@@ -157,7 +156,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal inline func store_int = (ref self, int i: i >= 0 && i < self.cap, int val) {
+	internal inline func store_int = (ref self {}, int i: i >= 0 && i < self.cap, int val) {
 		```
 		#arch: c
 		((long*)(unsigned long long)self->data)[i] = val;
@@ -171,11 +170,132 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// Labeled delegation point for raw-body callers in other containers
+	// (StableList's chunked storage calls this). Deliberately a RAW bitwise
+	// slot load — NOT a delegation to `load`: the owning-specialized `load`
+	// body materializes an owned copy (strdup) for string elements, while
+	// the accessor-family classification of every name that reaches user
+	// bindings (`at`, `load_tail` → this) promises a BORROW — the slot keeps
+	// sole ownership and the caller's binding is never freed. A strdup here
+	// would pair a counted allocation with a borrow binding that never frees
+	// it (audit LEAK).
+	internal func load_from = (self, int i: i >= 0 && i < self.cap, out T) {
+		```
+		#arch: c
+		return ((T*)(unsigned long long)self->data)[i];
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = i. The return register convention is per type
+		// KIND: `string` returns the fat pair in x0/x1 (T_FAT folds to 1),
+		// composites larger than 8 bytes return through the x8 sret buffer,
+		// scalars are width-matched into x0.
+		mov x14, #T_FAT
+		cmp x14, #1
+		b.eq .Lbuffer_load_from_fat
+		ldr x0, [x19, #8]
+		mov x3, #T_SIZE
+		madd x1, x1, x3, xzr
+		add x0, x0, x1
+		cmp x3, #16
+		b.gt .Lbuffer_load_from_copy
+		cmp x3, #8
+		b.gt .Lbuffer_load_from_pair
+		cmp x3, #1
+		b.eq .Lbuffer_load_from_1
+		cmp x3, #2
+		b.eq .Lbuffer_load_from_2
+		cmp x3, #4
+		b.eq .Lbuffer_load_from_4
+		ldr x0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_1:
+		ldrb w0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_2:
+		ldrh w0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_4:
+		ldr w0, [x0]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_pair:
+		// Word-pair load (T_SIZE <= 16): both words into the sret
+		// buffer, no call.
+		ldp x9, x10, [x0]
+		stp x9, x10, [x8]
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_copy:
+		mov x1, x0
+		mov x0, x8
+		mov x2, x3
+		bl _memcpy
+		b .Lbuffer_load_from_end
+		.Lbuffer_load_from_fat:
+		ldr x0, [x19, #8]
+		lsl x2, x1, #4
+		add x0, x0, x2
+		ldp x0, x1, [x0]
+		.Lbuffer_load_from_end:
+		```
+	}
+
+	// Initialize this buffer as a VIEW over a foreign slab (INTERNAL — the
+	// chunked-container primitive): `data` becomes `slab` and `cap` becomes
+	// `fill`, and the buffer owns NOTHING — the slab keeps its real owner
+	// (never grown, never freed by the view). The mono'd slot family
+	// (`store`/`load`/`load_from`/`shift`) then runs against the view
+	// unchanged, with its per-element specializations intact. This is how
+	// StableList's directory chunks reach the typed store without a staging
+	// relay — the same stack view the raw bodies build by hand, in typed
+	// Nomen. The holder must clear the view afterwards (see clear_view):
+	// an owning Buffer FIELD is destroyed by its holder's teardown.
+	internal func init_view = (ref self {}, uint64 slab, int fill: fill >= 0) {
+		self.data = slab
+		self.cap = fill
+	}
+
+	// Clear a view initialized by init_view: `data`/`cap` back to zero, so
+	// the holder's own field destroy reclaims nothing (the slab's real owner
+	// still owns it).
+	internal func clear_view = (ref self {}) {
+		self.data = 0
+		self.cap = 0
+	}
+
+	// Store `val` into slot `slot` of a foreign slab at `slab` (fill `fill`)
+	// through this buffer as a transient view — INTERNAL (StableList's
+	// directory chunks): init the view, run the mono'd `store` (the per-
+	// element deep-copy specialization), then clear the view so the holder's
+	// teardown reclaims nothing. The holder passes a Buffer FIELD, never a
+	// local — a local owning Buffer would be auto-destroyed at scope exit
+	// and free the slab it only borrows.
+	internal func store_in_slab = (
+		ref self {},
+		uint64 slab,
+		int fill: fill >= 0,
+		int slot: slot >= 0,
+		T val
+	) {
+		self.init_view(slab, fill)
+		// `val` arrives owned from the container's `mv T` push parameter: a
+		// value-struct element that OWNS resources moves into the chunk slot
+		// (store_take — the caller's storage zeroes, no deep copy). A
+		// non-owning value struct is a legal bare argument, so it keeps the
+		// copying store (taking it would zero the caller's copy); strings
+		// keep the deep-copying store too (their pair arrives by value).
+		if T_TAKES_OWNERSHIP {
+			self.store_take(slot, val)
+		} else {
+			self.store(slot, val)
+		}
+		self.clear_view()
+	}
+
 	// Move a value out of a slot: return it and clear the slot to 0. This is
 	// the ownership-extracting primitive (used by e.g. List.pop) — unlike
 	// load_int (a borrow read), it relinquishes the slot so the buffer no
 	// longer owns the value.
-	internal inline func move_int = (ref self, int i: i >= 0 && i < self.cap, out int) {
+	internal inline func move_int = (ref self {}, int i: i >= 0 && i < self.cap, out int) {
 		```
 		#arch: c
 		long *slots = (long*)(unsigned long long)self->data;
@@ -196,7 +316,7 @@ pub struct Buffer<T> {
 	// Store into a slot, freeing the previous value when the buffer holds
 	// owned class pointers (has_class_refs). For non-class buffers this is a
 	// plain store, so it is safe to use anywhere store_int would be.
-	internal inline func replace_int = (ref self, int i: i >= 0 && i < self.cap, int val) {
+	internal inline func replace_int = (ref self {}, int i: i >= 0 && i < self.cap, int val) {
 		```
 		#arch: c
 		((long*)(unsigned long long)self->data)[i] = val;
@@ -210,16 +330,17 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal inline func zero_int = (ref self, int len) {
+	internal inline func zero_int = (ref self {}, int len) {
 		memset(self.data, 0, len * 8)
 	}
 
 	// T_SIZE-aware primitives for value-struct elements. Slab is sized in
-	// multiples of T_SIZE; load/store use memcpy so multi-word structs work
-	// correctly. Classes route to ClassBuffer<T> (per-element destroy), so T
+	// multiples of T_SIZE; multi-word slots copy as one word pair at
+	// T_SIZE <= 16 (ldp/stp — no call) and via memcpy above that, so
+	// structs of any width work correctly. Classes route to ClassBuffer<T> (per-element destroy), so T
 	// reaching here is always a value type (primitive or struct).
 
-	func alloc = (ref self, int size, out int: out >= size) {
+	func alloc = (ref self {}, int size, out int: out >= size) {
 		// Reclaim the old slab before the fresh calloc (the raw body runs
 		// for scalar / trivially-destructible elements — plain bytes, so a
 		// straight free is sound; mv element types take the specialized
@@ -233,7 +354,7 @@ pub struct Buffer<T> {
 		return self.cap
 	}
 
-	func grow = (ref self, int needed, out int: out >= needed) {
+	func grow = (ref self {}, int needed, out int: out >= needed) {
 		if self.cap >= needed {
 			return self.cap
 		}
@@ -264,8 +385,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x1, x1, x3, xzr
 		add x0, x0, x1
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_load_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_load_T_pair
 		// Width-matched load (zero-extends) — an 8-byte ldr on a sub-8
 		// element would read past the slab's end and leave garbage in the
 		// upper bits.
@@ -286,6 +409,12 @@ pub struct Buffer<T> {
 		.Lbuffer_load_T_4:
 		ldr w0, [x0]
 		b .Lbuffer_load_T_end
+		.Lbuffer_load_T_pair:
+		// Word-pair load (T_SIZE <= 16): both words into the sret
+		// buffer, no call.
+		ldp x9, x10, [x0]
+		stp x9, x10, [x8]
+		b .Lbuffer_load_T_end
 		.Lbuffer_load_T_copy:
 		mov x1, x0
 		mov x0, x8
@@ -303,7 +432,7 @@ pub struct Buffer<T> {
 	// value) — this is the primitive every container's `set` uses.
 	// Internal: assumes a FRESH slot (see the contract comment). The public
 	// write is `replace`, which is correct on fresh and occupied slots alike.
-	internal inline func store = (ref self, int i: i >= 0 && i < self.cap, T val) {
+	internal inline func store = (ref self {}, int i: i >= 0 && i < self.cap, T val) {
 		```
 		#arch: c
 		((T*)(unsigned long long)self->data)[i] = val;
@@ -315,8 +444,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x1, x1, x3, xzr
 		add x0, x0, x1
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_store_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_store_T_pair
 		// Sub-8 element types must use a width-matched store: an 8-byte str
 		// would clobber the following slots (and run past the slab's end).
 		cmp x3, #1
@@ -336,6 +467,12 @@ pub struct Buffer<T> {
 		.Lbuffer_store_T_4:
 		str w2, [x0]
 		b .Lbuffer_store_T_end
+		.Lbuffer_store_T_pair:
+		// Word-pair store (T_SIZE <= 16): the value's address (x2)
+		// feeds both words, no call.
+		ldp x9, x10, [x2]
+		stp x9, x10, [x0]
+		b .Lbuffer_store_T_end
 		.Lbuffer_store_T_copy:
 		mov x1, x2
 		mov x2, x3
@@ -344,12 +481,100 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// TAKE a value into slot `i`. The caller's storage (`val`'s source — on
+	// both backends a value-struct parameter arrives as a POINTER to the
+	// caller's value) is byte-copied into the fresh slot and then ZEROED, so
+	// the buffer becomes the sole owner and the caller's own teardown frees
+	// nothing. The ownership-taking counterpart of `store` (which deep-copies
+	// a borrowed value): the `add`/`alloc` family's bodies use it when
+	// `T_IS_VALUE_STRUCT` folds true, eliding the per-slot deep copy.
+	// INTERNAL: only valid for a value-struct `T` (the only shape whose
+	// parameter is a pointer to the caller's storage — a `string`'s fat pair
+	// arrives by value, so take-store would zero the callee's copy and leave
+	// the caller's buffer shared).
+	internal inline func store_take = (ref self {}, int i: i >= 0 && i < self.cap, T val) {
+		```
+		#arch: c
+		{
+		T* _st = (T*)(unsigned long long)self->data;
+		#if T_IS_VALUE_STRUCT
+		// A value-struct parameter is a POINTER to the caller's storage.
+		T* _src = &(*val);
+		_st[i] = *_src;
+		memset((void*)_src, 0, T_SIZE);
+		#else
+		// Never called for a non-value-struct instantiation (the container
+		// bodies fold their `T_IS_VALUE_STRUCT` arm); this arm only keeps the
+		// emitted instance compiling.
+		T _tmp = val;
+		T* _src = &_tmp;
+		_st[i] = *_src;
+		(void)_src;
+		#endif
+		}
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = i, x2 = &val (the caller's storage)
+		ldr x0, [x19, #8]
+		mov x3, #T_SIZE
+		madd x1, x1, x3, xzr
+		add x0, x0, x1
+		cmp x3, #16
+		b.gt .Lbuffer_take_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_take_T_pair
+		cmp x3, #1
+		b.eq .Lbuffer_take_T_1
+		cmp x3, #2
+		b.eq .Lbuffer_take_T_2
+		cmp x3, #4
+		b.eq .Lbuffer_take_T_4
+		ldr x9, [x2]
+		str x9, [x0]
+		str xzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_1:
+		ldrb w9, [x2]
+		strb w9, [x0]
+		strb wzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_2:
+		ldrh w9, [x2]
+		strh w9, [x0]
+		strh wzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_4:
+		ldr w9, [x2]
+		str w9, [x0]
+		str wzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_pair:
+		ldp x9, x10, [x2]
+		stp x9, x10, [x0]
+		stp xzr, xzr, [x2]
+		b .Lbuffer_take_T_end
+		.Lbuffer_take_T_copy:
+		mov x4, x2
+		mov x1, x2
+		mov x2, x3
+		stp x4, x3, [sp, #-16]!
+		bl _memcpy
+		ldp x4, x3, [sp], #16
+		mov x0, x4
+		mov x1, #0
+		mov x2, x3
+		bl _memset
+		.Lbuffer_take_T_end:
+		```
+	}
+
 	// Move a value out of a T_SIZE-sized slot: return it and zero the slot so the
 	// buffer no longer holds a (possibly mv) copy. Declared `mv out T` so
 	// the result is treated as OWNED by the borrow checker — the slot is
 	// relinquished, so the caller is the sole remaining owner. The value
 	// counterpart of ClassBuffer.move_int — used by List.pop for any value T.
-	inline func move = (ref self, int i: i >= 0 && i < self.cap, mv out T) {
+	inline func move = (ref self {}, int i: i >= 0 && i < self.cap, mv out T) {
 		```
 		#arch: c
 		T* _slots = (T*)(unsigned long long)self->data;
@@ -364,8 +589,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x5, x1, x3, xzr
 		add x5, x4, x5
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_move_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_move_T_pair
 		// Width-matched load + zero-clear: an 8-byte access on a sub-8
 		// element would zero the following slots and run past the slab.
 		cmp x3, #1
@@ -389,6 +616,14 @@ pub struct Buffer<T> {
 		ldr w0, [x5]
 		str wzr, [x5]
 		b .Lbuffer_move_T_end
+		.Lbuffer_move_T_pair:
+		// Word-pair move (T_SIZE <= 16): the sret pair takes both
+		// words and the slot zeroes, no calls.
+		ldp x9, x10, [x5]
+		stp x9, x10, [x8]
+		stp xzr, xzr, [x5]
+		mov x0, x8
+		b .Lbuffer_move_T_end
 		.Lbuffer_move_T_copy:
 		mov x0, x8
 		mov x1, x5
@@ -419,7 +654,7 @@ pub struct Buffer<T> {
 	// this raw form is correct for trivially-copyable elements only. NOT
 	// `inline`: the body calls through the fn pointer, so splicing the raw
 	// block into a caller would bypass the per-element specializations.
-	func modify = (ref self, int i: i >= 0 && i < self.cap, func(T, out T) f) {
+	func modify = (ref self {}, int i: i >= 0 && i < self.cap, func(T, out T) f) {
 		```
 		#arch: c
 		((T*)(unsigned long long)self->data)[i] = ((T (*)(void *, T))f->code)(f->env, ((T*)(unsigned long long)self->data)[i]);
@@ -506,7 +741,7 @@ pub struct Buffer<T> {
 	// value, then deep-copies (strdup per string field). See
 	// owning_buffer_specialize.ts (both backends). ClassBuffer.replace
 	// destroys+frees class slots soundly.
-	inline func replace = (ref self, int i: i >= 0 && i < self.cap, T val) {
+	inline func replace = (ref self {}, int i: i >= 0 && i < self.cap, T val) {
 		```
 		#arch: c
 		((T*)(unsigned long long)self->data)[i] = val;
@@ -518,8 +753,10 @@ pub struct Buffer<T> {
 		mov x3, #T_SIZE
 		madd x1, x1, x3, xzr
 		add x0, x0, x1
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_replace_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_replace_T_pair
 		// Width-matched store: an 8-byte str on a sub-8 element would
 		// clobber the following slots and run past the slab's end.
 		cmp x3, #1
@@ -539,6 +776,12 @@ pub struct Buffer<T> {
 		.Lbuffer_replace_T_4:
 		str w2, [x0]
 		b .Lbuffer_replace_T_end
+		.Lbuffer_replace_T_pair:
+		// Word-pair store (T_SIZE <= 16): the value's address (x2)
+		// feeds both words, no call.
+		ldp x9, x10, [x2]
+		stp x9, x10, [x0]
+		b .Lbuffer_replace_T_end
 		.Lbuffer_replace_T_copy:
 		mov x1, x2
 		mov x2, x3
@@ -554,10 +797,56 @@ pub struct Buffer<T> {
 	// cannot accept the `mv` keyword, so a borrow being transferred
 	// (e.g. a loaded element) must go through here rather than be bound to
 	// a freed local.
-	pub func set = (ref self, int i: i >= 0 && i < self.cap, mv T value) {
+	pub func set = (ref self {}, int i: i >= 0 && i < self.cap, mv T value) {
 		self.replace(i, value)
 	}
 
+	// Reclaim slot i's owned heap state WITHOUT writing the slot (the raw
+	// no-op below is correct for trivially-destructible elements; for
+	// `string` and mv value-struct elements both backends specialize this
+	// body — free the displaced pointer / guarded T_destroy — the same
+	// dispatch replace_T gets). This is the DESTROY half of replace,
+	// separated from the copy so the in-place store lowering can reclaim
+	// the displaced value and then CONSTRUCT the new one straight into the
+	// slot (no donor, no deep copy). Contract: the slot must be
+	// overwritten before it is read or destroyed again — Map.set_slot_ptr
+	// (the probe-then-construct primitive) and the in-place `set` splice
+	// are the callers, and both overwrite immediately.
+	internal func destroy_at = (ref self {}, int i: i >= 0 && i < self.cap) {
+		```
+		#arch: c
+		T* _slots = (T*)(unsigned long long)self->data;
+		#if T_NEEDS_STRDUP
+		// A string slot owns its strdup'd bytes — free the buffer before the
+		// zero. Owning value-struct elements never reach this body: their
+		// destroy_at is replaced at the call site by the owning-buffer
+		// specialization (payload reclaim + zero).
+		free(_slots[i].ptr);
+		#endif
+		memset((void*)&_slots[i], 0, T_SIZE);
+		```
+		```
+		#arch: aarch64
+		// Same contract as the C body: string slots free their strdup'd
+		// buffer first (the T_NEEDS_STRDUP dispatch folds away for every
+		// other element kind); owning value-struct elements take the
+		// call-site specialization instead.
+		ldr x4, [x19, #8]
+		mov x3, #T_SIZE
+		madd x5, x1, x3, xzr
+		add x5, x4, x5
+		mov x9, #T_NEEDS_STRDUP
+		cbz x9, .Lbuffer_destroy_at_T_zero
+		ldr x0, [x5]
+		bl _free
+		.Lbuffer_destroy_at_T_zero:
+		mov x0, x5
+		mov x1, #0
+		mov x2, #T_SIZE
+		bl _memset
+		```
+	}
+
 	// Address of slot `i` (library-only): the ELEMENT BORROW primitive —
 	// `ref T x = list.at(i)` (docs/HANDLERS.md Stage 4, the dynamic-tree
 	// dispatch) lowers to this, binding the alias to the slot itself rather
@@ -567,7 +856,7 @@ pub struct Buffer<T> {
 	// borrow-invalidation rules. Library-internal: the caller (the `List`
 	// wrapper, or trusted internals) bounds-checks; the body is raw-only so
 	// the missing-return net does not apply to the raw return.
-	pub func slot_ptr = (ref self, int i, out ptr T) {
+	internal func slot_ptr = (ref self {}, int i, out ptr T) {
 		```
 		#arch: c
 		return (T*)(unsigned long long)self->data + i;
@@ -593,7 +882,7 @@ pub struct Buffer<T> {
 	// owning_buffer_specialize.ts); this raw form is correct for
 	// trivially-destructible elements only.
 	inline func shift = (
-		ref self,
+		ref self {},
 		int dst: dst >= 0 && dst < self.cap,
 		int src: src >= 0 && src < self.cap
 	) {
@@ -614,8 +903,10 @@ pub struct Buffer<T> {
 		madd x6, x2, x3, x4
 		cmp x5, x6
 		b.eq .Lbuffer_shift_T_end
-		cmp x3, #8
+		cmp x3, #16
 		b.gt .Lbuffer_shift_T_copy
+		cmp x3, #8
+		b.gt .Lbuffer_shift_T_pair
 		// Width-matched mv: an 8-byte access on a sub-8 element would
 		// clobber the following slot (and run past the slab's end).
 		cmp x3, #1
@@ -643,6 +934,13 @@ pub struct Buffer<T> {
 		str w7, [x5]
 		str wzr, [x6]
 		b .Lbuffer_shift_T_end
+		.Lbuffer_shift_T_pair:
+		// Word-pair shift (T_SIZE <= 16): both words move wholesale
+		// and the source pair zeroes, no calls.
+		ldp x7, x9, [x6]
+		stp x7, x9, [x5]
+		stp xzr, xzr, [x6]
+		b .Lbuffer_shift_T_end
 		.Lbuffer_shift_T_copy:
 		mov x0, x5
 		mov x1, x6
@@ -658,6 +956,67 @@ pub struct Buffer<T> {
 		```
 	}
 
+	// Bulk transfer for backward-shift deletion: move the `count` slots at
+	// `src` down to `dst` (src >= dst) as ONE block move, then zero the
+	// source slots the destination never covers — for the contiguous
+	// deletion shape (src = dst + 1) that is exactly one tail slot, so a
+	// whole range shift costs one memmove + one memset instead of
+	// count × (memcpy + memset) per-element `shift` calls. PROOF
+	// OBLIGATION on the caller (INTERNAL, byte-level like `shift`): every
+	// slot in [dst, dst + count) must be DEAD — zeroed by a move-out or
+	// otherwise unowned — because the block move overwrites them without
+	// reclaiming (the ownership proof is why the deletion algorithms zero
+	// and relocate in lockstep; a live displaced value belongs in `shift`,
+	// which reclaims dst first). The bytes transfer wholesale, so the move
+	// carries mv elements' heap pointers with them — correct for every
+	// element kind, raw for both backends (never names T).
+	internal inline func move_range = (
+		ref self {},
+		int dst: dst >= 0,
+		int src: src >= dst,
+		int count: count >= 0 && src + count <= self.cap
+	) {
+		```
+		#arch: c
+		if (count > 0) {
+			T* _slots = (T*)(unsigned long long)self->data;
+			memmove((void*)&_slots[dst], (void*)&_slots[src],
+				(unsigned long long)count * T_SIZE);
+			// Zero the source slots the destination does not overwrite:
+			// [dst + count, src + count) — one slot for the contiguous
+			// deletion shape, the gap+1 slots for a strided one.
+			memset((void*)&_slots[dst + count], 0,
+				(unsigned long long)(src - dst) * T_SIZE);
+		}
+		```
+		```
+		#arch: aarch64
+		// x19 = self, x1 = dst, x2 = src, x3 = count. x0-x18 die across the
+		// bl calls, so the block math parks on the stack around _memmove.
+		cbz x3, .Lbuffer_move_range_T_end
+		ldr x4, [x19, #8]
+		mov x5, #T_SIZE
+		madd x6, x1, x5, x4
+		madd x7, x2, x5, x4
+		madd x9, x3, x5, xzr
+		sub x10, x2, x1
+		madd x10, x10, x5, xzr
+		stp x6, x9, [sp, #-16]!
+		str x10, [sp, #-16]!
+		mov x0, x6
+		mov x1, x7
+		mov x2, x9
+		bl _memmove
+		ldr x10, [sp], #16
+		ldp x6, x9, [sp], #16
+		add x0, x6, x9
+		mov x1, #0
+		mov x2, x10
+		bl _memset
+		.Lbuffer_move_range_T_end:
+		```
+	}
+
 	// A non-mv (ptr, len) slice [start, end) over this buffer's element
 	// storage, returned as a `view T`. It borrows from self: it may not outlive
 	// self's scope and is invalidated if self is reassigned. This is the single
@@ -688,7 +1047,7 @@ pub struct Buffer<T> {
 	}
 
 	// Internal: zeroes slots without reclaiming mv elements.
-	internal inline func zero = (ref self, int len) {
+	internal inline func zero = (ref self {}, int len) {
 		memset(self.data, 0, len * T_SIZE)
 	}
 
@@ -719,7 +1078,7 @@ pub struct Buffer<T> {
 		return dst
 	}
 
-	internal inline func store_or_int = (ref self, int i: i >= 0 && i < self.cap, int val) {
+	internal inline func store_or_int = (ref self {}, int i: i >= 0 && i < self.cap, int val) {
 		```
 		#arch: c
 		((long*)(unsigned long long)self->data)[i] |= val;
@@ -735,7 +1094,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal func alloc_float = (ref self, int size, out int: out >= size) {
+	internal func alloc_float = (ref self {}, int size, out int: out >= size) {
 		self.cap = size
 		self.data = calloc(size, 8)
 		return self.cap
@@ -755,7 +1114,7 @@ pub struct Buffer<T> {
 		```
 	}
 
-	internal inline func store_float = (ref self, int i: i >= 0 && i < self.cap, float val) {
+	internal inline func store_float = (ref self {}, int i: i >= 0 && i < self.cap, float val) {
 		```
 		#arch: c
 		((double*)(unsigned long long)self->data)[i] = val;