Furth FortuneM9 reference

Mission foundation / System overview

Thalassa

One scene scaled from a watch to a headset

Thalassa renders one declared scene on devices with different screen, memory, and graphics limits. Each backend reads the same render program and is checked against a software reference image.

Inside the system

Architecture plates

Each plate preserves the internal layout, paths, boundaries, and highlighted decisions. Use the short label first, then follow the lines through the system.

Plate 01

Four layers, and the one test that keeps them apart

core data and UI · scenario and policy · kernels and math · render

CORE DATA / UI · C, PURE SCENARIO / POLICY · TRIDENT KERNELS + MATH · C RENDER · GLINT ⊥ ⊥ ⊥ thalassa_reef_ui.h structure and behaviour, no look the scene .tri and its libs values, choices, sequencing native/keel + t.math generic parameterized compute the Glint IR render only, by charter UiPhysicsData mass, collider, restitution inert hook: the core never solves device_tier.tri every tier threshold declared a threshold in C is the defect phys_world_set_gravity gravity is DATA, per scene keel_physics_world.h consumes transforms no physics in a shader narrow GPU subset SrControlProfile scene-owned movement data no solver and no policy in C framebudget.tri target, ladders, dwell frames outputs a level, never a pass keel_spatial_index.h one Morton octree backs AOI, broadphase, streaming, cull, LOD glint_soft the CPU oracle and the on-device floor THE BOUNDARY TEST · ASK IT ABOUT EVERY NEW LINE A SCENARIO CONSTANT IN C IS THE DEFECT A value, a model choice, a sequencing, or a policy that varies per run or per app belongs to Trident. Baking it into C forks the platform one device at a time. PARAMETERIZE THE KERNEL, DO NOT MOVE IT The repair is never to push the compute out of C. Keep the kernel in C for speed, take the value, the choice, and the order as parameters from the scene, and lower a whole composite when you can.
Plate 02

Reef: one front door, one program, one executor

gfx.scene · ReefProgram · verify, order, execute

DECLARE · TRIDENT gfx.scene(graph, opts) the one render-graph front door 7 node kinds, one kind per call gfx.patch(id, items) the one retained-delta edge dry run first, then atomic apply runtime output per runtime, revisioned, scoped th_runtime_output pulls it THE PROGRAM · PURE DATA ReefProgram ReefResource[] texture, vertex, index, instance, depth, storage buffer, storage texture ReefBlock[] tag plus canonical Glint: mtsrc or ir ReefNode[] block, reads, writes, attachments, params, optional draw fb size and time are set each frame EXECUTE reef_verify(program, manifest) requirements, structure, limit footprint topo-order, Kahn over reads and writes a cycle refuses as program-invalid allocate or reuse into a ResMap reuse keyed on identity, shape, revision reef_execute_into(be, program, out) backend-neutral: one render_node per node THE ONE THING EVERY BLOCK MUST CARRY no mtsrc and no ir → REFUSED raw WGSL is not an authoring path on any backend every block carries checked Glint WGSL, HLSL, SPIR-V and MSL are derived lowerings
Plate 03

One checked IR, five lowerings, one oracle

parse · type and check · the canonical module · five emitters

FRONT END Glint source ReefBlock.mtsrc glint_parse_module user fns inlined at parse time glint_type · glint_check swizzle range, arity, stage IO GlintModule the single source of truth held on ReefBlock.ir glint_soft CPU interpreter, the ground-truth oracle glint_wgsl WGSL for wgpu, browser and desktop glint_hlsl HLSL for D3D11 and D3D12 glint_spirv binary SPIR-V for native Vulkan glint_msl MSL for native Metal, macOS and iOS THE TEXT EMITTERS SIZE THEMSELVES Each returns the bytes the whole lowering needs, including the NUL. A zero cap is a measure pass. A short buffer gets an EMPTY string, never a shader cut off in the middle. THE PROOF STANDARD glint_soft must produce the correct pixels, and every GPU emitter is graded against it. Its transcendentals come from thalassa_reef_det_math.h, not libm, so the reference is reproducible. thalassa.shader.all 234 ordered members in one suite shader/run-all.sh is a thin entry over it
Plate 04

How a GPU earns its verdict

pixel diff · typed-output parity · what the leaves declare

A · A PATH THAT RASTERIZES · PIXEL DIFF one GlintModule one block, one node glint_soft raster the reference RGBA device raster D3D11, wgpu or Vulkan pixel diff vs the oracle a small declared tolerance GOLDEN SCOPE GPU transcendentals are not bit-reproducible across vendors, so a few fBm and hard-threshold blocks are golden-exempt: rendered and compile-gated, not pixel-compared. B · A PATH THAT DOES NOT RASTERIZE · TYPED-OUTPUT PARITY 51 compute kernels the whole checked catalog glint_soft_compute storage buffers on the CPU real device dispatch VK_KHR pipelines or wgpu every storage binding diffed zero exclusions WHY TYPED, NOT PIXELS A compute kernel writes numbers, not a frame. A screenshot proves nothing about it. The gate reads back the bindings the kernel wrote and compares them value by value. C · THE renderPolicy EVERY THALASSA LEAF DECLARES soft-oracle · 128 graded against the CPU oracle gpu-preferred · 11 runs on a device when present backend-parity · 2 diffs one backend against another none · 583 declares no render lane
Plate 05

Admission: refuse a missing feature, degrade a limit

verify · the typed verdict · two classes · refuse versus degrade

INPUTS ReefProgram resources, blocks, nodes GpuManifest features and numeric limits reef_verify 1 requirements: version and features 2 structure: refs, names, acyclic graph 3 limits: sizes against device ceilings ReefVerdict errors[] each bound to its typed reason first_reason · dominant_class collects EVERY rejection, not the first TWO CLASSES · THIS IS WHAT A CALLER BRANCHES ON ENVIRONMENT · 7 reasons no-gpu client-out-of-date missing-device-feature exceeds-device-limit backend-unsupported not-yet-supported out-of-memory Another device, another client, or a declared degraded variant might run it as authored. PROGRAM · 4 reasons resource-invalid block-invalid node-invalid program-invalid Malformed regardless of device. Degradation cannot help. PROGRAM dominates ENVIRONMENT dominates NONE: fix the program before you blame the device. A MISSING FEATURE REFUSES · A NUMERIC LIMIT DEGRADES 11 declared feature bits An unadvertised bit refuses the program at verify time, named. It never renders the wrong thing. a polled limit degrades and stays available GBuffer over the attachment cap steps to forward. No TimestampQuery leaves every gpu_ns at zero.
Plate 06

The device spectrum: measured facts, declared thresholds

probe · declare · classify · cap · budget

MEASURE · C GpuManifest probe tail probe_compute_mops probe_mem_bytes probe_bandwidth_mbps probe_rt_krays DECLARE · TRIDENT device_tier.tri declareProbes(config, probes) thresholdsDeclare(cfg) 4 axes, each cut list ascending an empty axis abstains, by design CLASSIFY classify(probes, thresholds) axis tier = the cuts it meets a 0 probe floors that axis deviceTier = MIN over the axes pure and deterministic deviceTier one number it caps every tier-gated ladder RESOLVE · ONE SCENE, MANY RUNGS ladderCap(featureEntry, tier) slices the richest-first candidates to those the tier admits a candidate with no minTier is REFUSED framebudget.step(state, cfg, ms) over budget: degrade one level real headroom: upgrade one level a dwell countdown stops flapping candidateFor(entry, level) the budget picks WITHIN the cap the cap never picks no admitted candidate: clamp to floor GUESSING UP HAS NO CODE PATH A zero probe on a discriminating axis puts that axis at the floor and records it. An unprobed, unknown, or half-declared device is structurally held to the floor rung. That is the whole point. AND IT STILL NEVER REFUSES LOAD A tier that admits no candidate resolves the ladder's FLOOR candidate instead. Do less, or do it less often, and stay available. Graceful degradation, never a hard limit.
Plate 07

The host is a narrow trusted edge, and it stays narrow

boot · the frame loop · the shared supervisor · three verb tiers

THE HOST OWNS main() AND THE OS HANDLES thalassa_host_thalassa_webgpu.c window, GPU, swapchain, sockets th_host_new then th_init th_host_boot(host, boot .tri) EVERY FRAME, IN THIS ORDER th_reset_frame th_fire_pending_fault th_drain_input_events th_frame_advance th_runtime_output th_drain_effects then present the aggregated output ThHostSupervisor · SHARED, PLATFORM-AGNOSTIC thalassa_engine_supervisor.c runtimes · scene stack · app catalog capture registry · pending faults input queues · frame arenas host verbs · effect drain ONE GENERIC HOST-VERB HOOK th_host_verb reaches th_host_verb_active and th_provision_runtime wires it onto EVERY runtime: the root, each entered scene, and the Fathom worker pool. An unknown verb returns 0. Fail-closed. shared minimum gfx.* publish, compute and record, ui.root, audio.bed, sys.*, scene.key and db.*, on every runtime, at default caps capability-gated device.* · media.* · io.* DENIED without a declared grant a failed io.load inside a boot fails it adapter extension the aux_verb hook, checked AFTER the generic families. Extends, never forks. THE TWO RULES THAT KEEP THE EDGE THIN ASK BEFORE YOU ADD OR EDIT A HOST FILE Host code is the easy way to leak scenario and policy into C. A broad feature request is not approval. Name the file and the capability first. A MISSING CAPABILITY IS A PRIMITIVE Any capability a deployment lacks becomes a generic platform verb or a .tri library, never app-specific C inside a host.
Plate 08

Input is a stream of transitions, and the stack routes it

queue · route · propagate · the retained control tree

AT OS-EVENT TIME host adapter WindowProc, OpenXR, web, or a network client SrInputQueue lock-free SPSC ring, 256 records 5 kinds, each stamped seq and t drain in order once per frame, every queued record map raw to action on DRAIN, not on push per-scene input map ROUTING OVER THE SCENE CONTEXT STACK SrStack · capacity 32 sr_route_raw_modifiers walks it from the top down SR_OPAQUE swallows unbound codes SR_PASSTHROUGH lets them fall sr_propagate capture, then target, then bubble one pointer owner per source one text owner for the stack a RESYNC record rebases held state a typed input event dispatched into the routed context an unbound or modally swallowed code is DROPPED, never guessed the scene handles it as data THE RETAINED CONTROL TREE · DECLARED BY THE SCENE, RETAINED BY C rui_declare(u, specs, n) the scene declares a tree C reconciles it BY ID and keeps caret, scroll, focus and sessions rui_layout two passes: measure, then arrange logical units, zero-alloc arena dock, anchor, flow, wrap, grid rui_input_source hit-test the resolved rects derive one state per control 8 pointer sessions at once 11 semantic events press, click, change, commit, focus, toggle, grab, drag, release, ...
Plate 09

Declare the stable product, patch the small delta

the footgun · the contract · the cadence guard

THE FOOTGUN · RE-AUTHOR THE WORLD EVERY FRAME gfx.scene with the same retained id, every tick the front door accepts it; nothing is malformed the whole graph deep-copies each frame into the runtime output arena, which is not reclaimed arena OOM with a top-consumers report the principled, non-heuristic fail-closed THE CONTRACT · DECLARE ONCE, PATCH THE DELTA gfx.scene with mode retained and a stable id once: topology, formats, node count, capacities gfx.patch(id, items) uniforms, transforms, same-shape ranges, revisions validated in a dry run, then applied atomically type, shape, target identity and capacity preserved THE GUARD IS BOUNDARY-AWARE, AND IT ONLY TEACHES th_render_guard_declare 3 retained kinds are tracked: pass · geometry · screens all state is per TridentRuntime, no global and no function static a patch never touches the guard CADENCE, NOT COUNT renders_since == 0 a redundant back-to-back declare renders_since == 1 the per-frame footgun, so WARN renders_since >= 2: occasional, silent WHY IT WARNS AND NEVER KILLS A topology switch legitimately re-declares one stable id at a few boundaries. A fatal on that guess breaks a correct run. The stakes of a warning are one log line. A STRUCTURAL CHANGE IS NOT A PATCH Topology, format, dimensions, node count, or material graph: each is a new declaration, and the patcher refuses it.
Plate 10

One overlay, many stages, none of them bespoke

register · claim a key · declare settings · one publish

A SYSTEM CONTRIBUTES DATA · IT NEVER DRAWS the system snapshots live state into a caller buffer, or into a runtime panel debug_stage_register(name, label) or the gated form with a capability registration order is publish order debug_stage_push(name, surfaces) the stage's current surfaces a non-empty push stamps health ok and a frame TOGGLES AND SETTINGS ARE DECLARED DATA debug_stage_bind_toggle The first claimant in a scene keeps the key. A second claim is refused and logged, and the bind never happens. The refused stage stays fully usable from the shared stage list. declared settings bool, range and enum, each with a default and a stage/key identity. The overlay renders them generically from the declared schema, so no view hardcodes its own settings UI. the two default keys F1 claims the runtime panel F11 claims the profiler Both go through the same claim seam as every other stage. 118 stage files sit in this one directory. ONE PUBLISH, COMPOSED FROM MANY STAGES enabled? off by default toggled live, no rebuild tier-granted? a required capability resolve anything but available hides it concatenate surfaces in registration order many stages visible at once one ui.overlay the compositor is the single caller of it ui.overlay SETS the output root; it does not accumulate Before the compositor each view called it directly, so the last call of the frame clobbered every other view.

Key parts

What the system does

These are the main boundaries, inputs, outputs, and failure rules. The examples show a specific use of each part.

One scene description

Teams describe the information and interaction once. The platform chooses the best supported presentation for each device.

Specific example

A common operating picture can appear as a simple watch alert, a tablet map, or an immersive maintenance view.

Measured device fit

The engine uses known device limits and declared policy. It does not guess which features are safe to use.

Specific example

A rugged field device can receive a lighter view while a command workstation receives richer detail from the same source.

Consistent visual proof

Every rendering path is checked against a common reference. This helps keep colors, shapes, and decisions consistent across hardware.

Specific example

A threat zone or maintenance warning can keep the same meaning when operators move between devices.

Uses

Example uses

Pilot questions

What the team must decide

Which devices must share the same scene

What information must remain visible on the smallest device

What visual differences are acceptable by mission role

Request a technical briefing

Connected references

Mission foundation Nautilus Open reference Assurance fabric Operational Debug Views Open reference Platform M9 Open reference
Return to the M9 reference library