@woosh/meep-engine 3.11.2 → 3.12.0

package/src/shade/renderer/scene/hierarchy/shader_nodes_update_transform_hierarchy.js

@@ -1,373 +1,372 @@
-import { atomic_u32, u32 } from "../../shader/type/WEBGPU_WGSL_PRIMITIVE_TYPES.js";
-import { WebGPUArray } from "../../shader/type/WebGPUArray.js";
-import { COLLECTION_U32_STRUCT_READ } from "../../gpu_primitive/COLLECTION_U32_STRUCT_READ.js";
-import { chunk_scene_database_access_rw } from "../chunk_scene_database_access.js";
-import { NODE3D_SCENE_ID } from "../NODE3D_STRUCT.js";
-import { chunk_mat4_compose_transform } from "../../shader/chunk/geometry/mat4/chunk_mat4_compose_transform.js";
-import { CodeChunk } from "../../shader/compiler/CodeChunk.js";
-import { ComputeShader } from "../../shader/ComputeShader.js";
-import { ShaderResourceSetDescriptor } from "../../shader/resource/ShaderResourceSetDescriptor.js";
-import { TRANSFORM_HIERARCHY_PARTITION_SIZE } from "./TRANSFORM_HIERARCHY_PARTITION_SIZE.js";
-
-/**
- * Maximum depth of parent chain a thread walks via the local-fallback
- * path. Sized to `PARTITION_SIZE` so any thread is guaranteed enough
- * steps to escape its own tile: once the walk crosses a tile boundary,
- * the fast-path read of `published_globals` can take over. A smaller
- * bound silently truncates in-input chains that live entirely inside
- * one tile (e.g. a 1024-bone chain laid out sequentially); chains
- * deeper than `PARTITION_SIZE` *within a single tile* will still
- * truncate, but that's a contrived case worth raising the bound for
- * if it ever shows up in a real workload.
- *
- * @type {number}
- */
-const MAX_PARENT_WALK = TRANSFORM_HIERARCHY_PARTITION_SIZE;
-
-/**
- * How many times a stuck workgroup spins reading a predecessor tile's
- * spine flag before falling back to walking the parent chain via local
- * matrices. A higher value gives the predecessor more time to publish
- * its `global` — useful when the predecessor is doing real work — at
- * the cost of latency when it's actually stalled.
- *
- * @type {number}
- */
-const MAX_SPIN_COUNT = 4;
-
-/**
- * Per-tile spine slot states. Mirrors the FLAG_NOT_READY / FLAG_INCLUSIVE
- * convention from the prefix-scan CSDLDF shader, minus FLAG_READY — we
- * don't have an intermediate "I have a partial value" state, since each
- * tile either has fully written all its `global`s or hasn't.
- */
-const FLAG_NOT_READY = 0;
-const FLAG_INCLUSIVE = 1;
-
-/**
- * The CSDLDF-style ("Chained Scan with Decoupled Lookback Decoupled
- * Fallback") propagation pass for scene-graph node transforms.
- *
- * **Inputs**
- *  - `input`: COLLECTION_U32 of node IDs to update. Assumed
- *    *partially* topologically sorted — nodes at lower depth come
- *    earlier — but the shader doesn't trust this beyond using it for
- *    the lookback fast path; correctness doesn't depend on it.
- *  - `scene_database`: the GPUDatabase backing store; we read each
- *    node's `local` and `parent` fields and overwrite `global`.
- *  - `node_to_tile`: a lookup populated by the setup shader. Slot
- *    `node_id` is `0` if `node_id` is not in the input (its `global`
- *    is trusted as-is), or `position + 1` if it is. Position indexes
- *    `published_globals`; tile is derived as `position / PARTITION`
- *    for the spine check.
- *  - `spine`: per-tile flag, `FLAG_INCLUSIVE` once that tile has
- *    finished publishing all of its nodes' `global`s atomically.
- *  - `published_globals`: per-input-position atomic mat4 buffer.
- *    Cross-tile readers consume from here, NOT from
- *    `scene_database.global`. See the "Memory ordering" section
- *    below for why.
- *
- * **Per-thread work**
- *
- * One thread per input position. Each thread walks its node's parent
- * chain accumulating the cumulative transform left-multiplied by each
- * ancestor's `local`. The walk terminates as soon as we hit any of:
- *  - `parent == NODE3D_SCENE_ID` — reached the scene root, walk stops
- *    here. Top-level nodes inherit row 0, and `0` is the natural
- *    value of a freshly-zeroed buffer, so this sentinel doubles as a
- *    "no further ancestor" marker.
- *  - parent is *not* in the input — its `global` is trusted (stable
- *    this dispatch), read it directly from `scene_database`,
- *    prepend, stop.
- *  - parent is in an *earlier* tile and that tile's spine slot is
- *    `FLAG_INCLUSIVE` — read parent's mat4 from `published_globals`
- *    (atomic loads, see ordering note), prepend, stop.
- *
- * If the spine isn't ready yet, we spin a bounded number of times then
- * **fall back** to the slow path: prepend `parent.local` and step up to
- * the parent's parent. The fallback is always correct: `local` matrices
- * are stable this dispatch (only `global` is being rewritten), so the
- * walk is independent of any other workgroup's progress.
- *
- * After every thread in the workgroup has finished publishing its
- * `global` to `published_globals` and to `scene_database` (a
- * `workgroupBarrier` ensures this), thread 0 atomically stores
- * `FLAG_INCLUSIVE` to this tile's spine slot. The release point for
- * cross-tile readers is the spine flag.
- *
- * **Memory ordering — trusts WGSL SeqCst across separate atomic words.**
- *
- * The Decoupled Fallback paper (Smith/Levien/Owens, SPAA '25, §4.3)
- * specifically AVOIDS this pattern: it packs tile state into the same
- * atomic word as the data via "atomic splitting", because *relaxed*
- * atomics — which the paper assumes — don't order non-atomic stores
- * relative to atomic stores across separate memory locations. WGSL
- * atomics are spec'd as sequentially consistent (not relaxed), so a
- * separate atomic flag DOES order earlier atomic data stores via the
- * single global total order on atomic operations. We rely on that here
- * because atomic-splitting a 64-byte mat4 means ~32 atomic_u32 per
- * published global with state bits per word — roughly 2× the memory
- * traffic of "data atomics + flag atomic".
- *
- * Why we accept the risk: this feature isn't shipping yet, the primary
- * Dawn backends (Vulkan/Metal/D3D12) translate WGSL atomics to
- * backend-equivalent SeqCst operations, and we expect spec conformance
- * to tighten. If real-world testing on Apple/ARM (which the paper
- * specifically benchmarks as FPG-lacking) shows visibility violations,
- * the fix is to switch `published_globals` to atomic-splitting style:
- * pack the mat4 across more atomic words, each carrying state bits in
- * its high bits, and have the reader verify all words agree on
- * INCLUSIVE before trusting the value (paper §4.3, Figure 5).
- *
- * Failure mode if SeqCst is broken: a reader sees the spine flag as
- * INCLUSIVE but reads stale (or zero) entries from `published_globals`,
- * propagating a wrong world transform with no fallback safety net (the
- * fallback only fires on FLAG_NOT_READY, not on a stale-but-flagged
- * read).
- *
- * @see graph_prefix_scan_csdldf — same lookback / fallback shape.
- * @type {ComputeShader}
- */
-const resources = new ShaderResourceSetDescriptor();
-resources.createGroup()
-    .addStorageBuffer("input", COLLECTION_U32_STRUCT_READ)
-    .addStorageBuffer("scene_database", WebGPUArray.from(u32), true)
-    .addStorageBuffer("node_to_tile", WebGPUArray.from(u32))
-    .addStorageBuffer("spine", WebGPUArray.from(atomic_u32), true)
-    .addStorageBuffer("published_globals", WebGPUArray.from(atomic_u32), true);
-
-const body = CodeChunk.from(
-    //language=WGSL
-    `
-const SCENE_NODE: u32 = ${NODE3D_SCENE_ID}u;
-
-const NOT_IN_INPUT: u32 = 0u;
-
-const FLAG_NOT_READY: u32 = ${FLAG_NOT_READY}u;
-const FLAG_INCLUSIVE: u32 = ${FLAG_INCLUSIVE}u;
-
-const MAX_PARENT_WALK: u32 = ${MAX_PARENT_WALK}u;
-const MAX_SPIN_COUNT: u32 = ${MAX_SPIN_COUNT}u;
-
-const PARTITION_SIZE: u32 = ${TRANSFORM_HIERARCHY_PARTITION_SIZE}u;
-
-// 16 f32 columns-major; a mat4x4<f32> is published as 16 atomic_u32
-// entries starting at \`pos * MAT4_STRIDE\`.
-const MAT4_STRIDE: u32 = 16u;
-
-// Atomically publish \`m\` to slot \`pos\` of \`published_globals\`. Stores
-// columns 0..3 in order, x..w within each column. Pair with
-// \`read_published_global\` on the reader side. The 16 atomicStores are
-// individually ordered relative to subsequent atomic operations by WGSL
-// SeqCst — see header doc for why we rely on that.
-fn publish_global(pos: u32, m: mat4x4<f32>) {
-    let base = pos * MAT4_STRIDE;
-    atomicStore(&published_globals[base + 0u],  bitcast<u32>(m[0].x));
-    atomicStore(&published_globals[base + 1u],  bitcast<u32>(m[0].y));
-    atomicStore(&published_globals[base + 2u],  bitcast<u32>(m[0].z));
-    atomicStore(&published_globals[base + 3u],  bitcast<u32>(m[0].w));
-    atomicStore(&published_globals[base + 4u],  bitcast<u32>(m[1].x));
-    atomicStore(&published_globals[base + 5u],  bitcast<u32>(m[1].y));
-    atomicStore(&published_globals[base + 6u],  bitcast<u32>(m[1].z));
-    atomicStore(&published_globals[base + 7u],  bitcast<u32>(m[1].w));
-    atomicStore(&published_globals[base + 8u],  bitcast<u32>(m[2].x));
-    atomicStore(&published_globals[base + 9u],  bitcast<u32>(m[2].y));
-    atomicStore(&published_globals[base + 10u], bitcast<u32>(m[2].z));
-    atomicStore(&published_globals[base + 11u], bitcast<u32>(m[2].w));
-    atomicStore(&published_globals[base + 12u], bitcast<u32>(m[3].x));
-    atomicStore(&published_globals[base + 13u], bitcast<u32>(m[3].y));
-    atomicStore(&published_globals[base + 14u], bitcast<u32>(m[3].z));
-    atomicStore(&published_globals[base + 15u], bitcast<u32>(m[3].w));
-}
-
-// Reads a previously-published mat4 from \`published_globals\`. Caller
-// must have already observed FLAG_INCLUSIVE on the parent's tile spine
-// slot — that observation is what serializes these atomicLoads against
-// the publishing workgroup's atomicStores.
-fn read_published_global(pos: u32) -> mat4x4<f32> {
-    let base = pos * MAT4_STRIDE;
-    return mat4x4<f32>(
-        vec4<f32>(
-            bitcast<f32>(atomicLoad(&published_globals[base + 0u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 1u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 2u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 3u])),
-        ),
-        vec4<f32>(
-            bitcast<f32>(atomicLoad(&published_globals[base + 4u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 5u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 6u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 7u])),
-        ),
-        vec4<f32>(
-            bitcast<f32>(atomicLoad(&published_globals[base + 8u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 9u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 10u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 11u])),
-        ),
-        vec4<f32>(
-            bitcast<f32>(atomicLoad(&published_globals[base + 12u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 13u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 14u])),
-            bitcast<f32>(atomicLoad(&published_globals[base + 15u])),
-        ),
-    );
-}
-
-@compute @workgroup_size(${TRANSFORM_HIERARCHY_PARTITION_SIZE})
-fn main(
-    @builtin(global_invocation_id) gid: vec3<u32>,
-    @builtin(local_invocation_id) lid: vec3<u32>,
-    @builtin(workgroup_id) wid: vec3<u32>,
-) {
-    let pos = gid.x;
-    let my_tile = wid.x;
-
-    // Threads beyond input.count still need to participate in the
-    // workgroupBarrier below (uniform control flow), but they don't do
-    // any work and don't read or write \`global\`.
-    let in_range = pos < input.count;
-
-    if(in_range){
-        let node_id = input.elements[pos];
-
-        var node = scene_read_node_rw(&scene_database, node_id);
-
-        // Capture this node's current \`global\` as last frame's
-        // value, before the new compose overwrites it later in this
-        // function. The full transforms row was just loaded above —
-        // reading the field here is free, and writing prev_global
-        // ahead of the new global means downstream consumers reading
-        // both (motion-vector generation, TAA) never see a window
-        // where prev and current describe the same frame.
-        scene_write_node_prev_global(&scene_database, node_id, node.global);
-
-        // acc accumulates ancestor.local * ... * parent.local * node.local
-        // (a correct world-space transform once we hit a trusted ancestor
-        // or root). The local transform isn't stored as a matrix — we
-        // build it on the fly from the node's TRS triplet.
-        var acc = mat4_compose_transform(node.local_translation, node.local_rotation, node.local_scale);
-        var parent_id = node.parent;
-
-        // Walk up the parent chain. Each iteration either commits — by
-        // prepending a trusted parent.global onto the accumulator and
-        // breaking — or falls back: prepends parent.local and steps to
-        // the next ancestor.
-        var walk_steps = 0u;
-        loop {
-            if(parent_id == SCENE_NODE){
-                // Reached the scene root — acc IS the world transform.
-                // The scene's TRS is composed implicitly here by stopping
-                // before reading row 0; if a future scene-level pose is
-                // wanted, replace the break with a read+prepend of the
-                // scene's compose.
-                break;
-            }
-            if(walk_steps >= MAX_PARENT_WALK){
-                break; // bail out on pathological depth
-            }
-            walk_steps = walk_steps + 1u;
-
-            let slot = node_to_tile[parent_id];
-
-            if(slot == NOT_IN_INPUT){
-                // Parent isn't being updated this dispatch. Whatever
-                // \`global\` is on the database is what downstream
-                // consumers will see — use it.
-                let parent = scene_read_node_rw(&scene_database, parent_id);
-                acc = parent.global * acc;
-                break;
-            }
-
-            let parent_pos = slot - 1u;                     // undo the +1 encoding
-            let parent_tile = parent_pos / PARTITION_SIZE;  // tile derived from position
-
-            if(parent_tile < my_tile){
-                // Parent's tile must have published before us — but it
-                // might still be in flight. Spin briefly on the spine
-                // flag; if we time out, fall back to walking via
-                // parent.local. The fallback is always correct, just
-                // potentially redundant work.
-                var spin = 0u;
-                var got_inclusive = false;
-                loop {
-                    if(atomicLoad(&spine[parent_tile]) == FLAG_INCLUSIVE){
-                        got_inclusive = true;
-                        break;
-                    }
-                    spin = spin + 1u;
-                    if(spin >= MAX_SPIN_COUNT){
-                        break;
-                    }
-                }
-
-                if(got_inclusive){
-                    // Spine flag observed INCLUSIVE → WGSL SeqCst's total
-                    // order on atomics guarantees the publishing
-                    // workgroup's atomicStores into published_globals are
-                    // visible to these atomicLoads. Read via the atomic
-                    // buffer, NOT scene_database.global (which is a
-                    // non-atomic view and not ordered against the flag).
-                    acc = read_published_global(parent_pos) * acc;
-                    break;
-                }
-            }
-
-            // Fallback / parent in same-or-later tile: walk via local.
-            // (The "later tile" case shouldn't hit with strict
-            // topological ordering, but if it does, walking via local
-            // is still correct.)
-            let parent = scene_read_node_rw(&scene_database, parent_id);
-            let parent_local = mat4_compose_transform(parent.local_translation, parent.local_rotation, parent.local_scale);
-            acc = parent_local * acc;
-            parent_id = parent.parent;
-        }
-
-        // Atomic publish first — these 16 atomicStores into
-        // published_globals[pos] are what the spine flag's atomicStore
-        // (below) releases to other tiles via WGSL's SeqCst order on
-        // atomic operations.
-        publish_global(pos, acc);
-
-        // Mirror to the database for downstream non-atomic consumers
-        // (rendering, raymarching, etc., reading scene_database.global
-        // after this dispatch's command-buffer barrier). Only the
-        // "global" field is written: the whole-struct write that used
-        // to live here was a hazard — if "scene_read_node_rw" above
-        // ever returned zeros for any reason (buffer not yet uploaded,
-        // page-lookup race, anything), "node.local_T/R/S" would be
-        // zero and the writeback would *persist* those zeros into the
-        // row. The next frame's hierarchy reads the persisted zeros,
-        // composes a zero matrix, propagates it down — every
-        // descendant collapses to the origin and stays there. Touching
-        // only "global" means a transient stale read can't poison
-        // local_TRS.
-        scene_write_node_global(&scene_database, node_id, acc);
-    }
-
-    // Publish: every thread in this workgroup has finished its
-    // atomicStores into published_globals by the barrier. Thread 0's
-    // atomicStore on the spine slot is the single release point — any
-    // other workgroup that observes FLAG_INCLUSIVE on this slot is
-    // guaranteed (under WGSL SeqCst) to see all 16 published_globals
-    // atomicStores from any thread of this workgroup.
-    workgroupBarrier();
-    if(lid.x == 0u){
-        atomicStore(&spine[my_tile], FLAG_INCLUSIVE);
-    }
-}
-`, [
-        chunk_scene_database_access_rw,
-        chunk_mat4_compose_transform,
-    ]);
-
-/**
- * @see {@link graph_nodes_update_transform_hierarchy} — frame-graph harness.
- * @type {ComputeShader}
- */
-export const shader_nodes_update_transform_hierarchy = ComputeShader.from({
-    label: "SceneGraph/UpdateTransformHierarchy",
-    body,
-    resources,
-    group_size: [TRANSFORM_HIERARCHY_PARTITION_SIZE, 1, 1],
-});
+import { atomic_u32, u32 } from "../../shader/type/WEBGPU_WGSL_PRIMITIVE_TYPES.js";
+import { WebGPUArray } from "../../shader/type/WebGPUArray.js";
+import { COLLECTION_U32_STRUCT_READ } from "../../gpu_primitive/COLLECTION_U32_STRUCT_READ.js";
+import { chunk_scene_database_access_rw } from "../chunk_scene_database_access.js";
+import { NODE3D_SCENE_ID } from "../NODE3D_STRUCT.js";
+import { chunk_mat4_compose_transform } from "../../shader/chunk/geometry/mat4/chunk_mat4_compose_transform.js";
+import { CodeChunk } from "../../shader/compiler/CodeChunk.js";
+import { ComputeShader } from "../../shader/ComputeShader.js";
+import { ShaderResourceSetDescriptor } from "../../shader/resource/ShaderResourceSetDescriptor.js";
+import { TRANSFORM_HIERARCHY_PARTITION_SIZE } from "./TRANSFORM_HIERARCHY_PARTITION_SIZE.js";
+
+/**
+ * Maximum depth of parent chain a thread walks via the local-fallback
+ * path. Sized to `PARTITION_SIZE` so any thread is guaranteed enough
+ * steps to escape its own tile: once the walk crosses a tile boundary,
+ * the fast-path read of `published_globals` can take over. A smaller
+ * bound silently truncates in-input chains that live entirely inside
+ * one tile (e.g. a 1024-bone chain laid out sequentially); chains
+ * deeper than `PARTITION_SIZE` *within a single tile* will still
+ * truncate, but that's a contrived case worth raising the bound for
+ * if it ever shows up in a real workload.
+ *
+ * @type {number}
+ */
+const MAX_PARENT_WALK = TRANSFORM_HIERARCHY_PARTITION_SIZE;
+
+/**
+ * How many times a stuck workgroup spins reading a predecessor tile's
+ * spine flag before falling back to walking the parent chain via local
+ * matrices. A higher value gives the predecessor more time to publish
+ * its `global` — useful when the predecessor is doing real work — at
+ * the cost of latency when it's actually stalled.
+ *
+ * @type {number}
+ */
+const MAX_SPIN_COUNT = 4;
+
+/**
+ * Per-tile spine slot states. Mirrors the FLAG_NOT_READY / FLAG_INCLUSIVE
+ * convention from the prefix-scan CSDLDF shader, minus FLAG_READY — we
+ * don't have an intermediate "I have a partial value" state, since each
+ * tile either has fully written all its `global`s or hasn't.
+ */
+const FLAG_NOT_READY = 0;
+const FLAG_INCLUSIVE = 1;
+
+/**
+ * The CSDLDF-style ("Chained Scan with Decoupled Lookback Decoupled
+ * Fallback") propagation pass for scene-graph node transforms.
+ *
+ * **Inputs**
+ *  - `input`: COLLECTION_U32 of node IDs to update. Assumed
+ *    *partially* topologically sorted — nodes at lower depth come
+ *    earlier — but the shader doesn't trust this beyond using it for
+ *    the lookback fast path; correctness doesn't depend on it.
+ *  - `scene_database`: the GPUDatabase backing store; we read each
+ *    node's `local` and `parent` fields and overwrite `global`.
+ *  - `node_to_tile`: a lookup populated by the setup shader. Slot
+ *    `node_id` is `0` if `node_id` is not in the input (its `global`
+ *    is trusted as-is), or `position + 1` if it is. Position indexes
+ *    `published_globals`; tile is derived as `position / PARTITION`
+ *    for the spine check.
+ *  - `spine`: per-tile flag, `FLAG_INCLUSIVE` once that tile has
+ *    finished publishing all of its nodes' `global`s atomically.
+ *  - `published_globals`: per-input-position atomic mat4 buffer.
+ *    Cross-tile readers consume from here, NOT from
+ *    `scene_database.global`. See the "Memory ordering" section
+ *    below for why.
+ *
+ * **Per-thread work**
+ *
+ * One thread per input position. Each thread walks its node's parent
+ * chain accumulating the cumulative transform left-multiplied by each
+ * ancestor's `local`. The walk terminates as soon as we hit any of:
+ *  - `parent == NODE3D_SCENE_ID` — reached the scene root, walk stops
+ *    here. Top-level nodes inherit row 0, and `0` is the natural
+ *    value of a freshly-zeroed buffer, so this sentinel doubles as a
+ *    "no further ancestor" marker.
+ *  - parent is *not* in the input — its `global` is trusted (stable
+ *    this dispatch), read it directly from `scene_database`,
+ *    prepend, stop.
+ *  - parent is in an *earlier* tile and that tile's spine slot is
+ *    `FLAG_INCLUSIVE` — read parent's mat4 from `published_globals`
+ *    (atomic loads, see ordering note), prepend, stop.
+ *
+ * If the spine isn't ready yet, we spin a bounded number of times then
+ * **fall back** to the slow path: prepend `parent.local` and step up to
+ * the parent's parent. The fallback is always correct: `local` matrices
+ * are stable this dispatch (only `global` is being rewritten), so the
+ * walk is independent of any other workgroup's progress.
+ *
+ * After every thread in the workgroup has finished publishing its
+ * `global` to `published_globals` and to `scene_database` (a
+ * `workgroupBarrier` ensures this), thread 0 atomically stores
+ * `FLAG_INCLUSIVE` to this tile's spine slot. The release point for
+ * cross-tile readers is the spine flag.
+ *
+ * **Memory ordering — trusts WGSL SeqCst across separate atomic words.**
+ *
+ * The Decoupled Fallback paper (Smith/Levien/Owens, SPAA '25, §4.3)
+ * specifically AVOIDS this pattern: it packs tile state into the same
+ * atomic word as the data via "atomic splitting", because *relaxed*
+ * atomics — which the paper assumes — don't order non-atomic stores
+ * relative to atomic stores across separate memory locations. WGSL
+ * atomics are spec'd as sequentially consistent (not relaxed), so a
+ * separate atomic flag DOES order earlier atomic data stores via the
+ * single global total order on atomic operations. We rely on that here
+ * because atomic-splitting a 64-byte mat4 means ~32 atomic_u32 per
+ * published global with state bits per word — roughly 2× the memory
+ * traffic of "data atomics + flag atomic".
+ *
+ * Why we accept the risk: this feature isn't shipping yet, the primary
+ * Dawn backends (Vulkan/Metal/D3D12) translate WGSL atomics to
+ * backend-equivalent SeqCst operations, and we expect spec conformance
+ * to tighten. If real-world testing on Apple/ARM (which the paper
+ * specifically benchmarks as FPG-lacking) shows visibility violations,
+ * the fix is to switch `published_globals` to atomic-splitting style:
+ * pack the mat4 across more atomic words, each carrying state bits in
+ * its high bits, and have the reader verify all words agree on
+ * INCLUSIVE before trusting the value (paper §4.3, Figure 5).
+ *
+ * Failure mode if SeqCst is broken: a reader sees the spine flag as
+ * INCLUSIVE but reads stale (or zero) entries from `published_globals`,
+ * propagating a wrong world transform with no fallback safety net (the
+ * fallback only fires on FLAG_NOT_READY, not on a stale-but-flagged
+ * read).
+ *
+ * @see graph_prefix_scan_csdldf — same lookback / fallback shape.
+ * @type {ComputeShader}
+ */
+const resources = new ShaderResourceSetDescriptor();
+resources.createGroup()
+    .addStorageBuffer("input", COLLECTION_U32_STRUCT_READ)
+    .addStorageBuffer("scene_database", WebGPUArray.from(u32), true)
+    .addStorageBuffer("node_to_tile", WebGPUArray.from(u32))
+    .addStorageBuffer("spine", WebGPUArray.from(atomic_u32), true)
+    .addStorageBuffer("published_globals", WebGPUArray.from(atomic_u32), true);
+
+const body = CodeChunk.from(
+    //language=WGSL
+    `
+const SCENE_NODE: u32 = ${NODE3D_SCENE_ID}u;
+
+const NOT_IN_INPUT: u32 = 0u;
+
+const FLAG_NOT_READY: u32 = ${FLAG_NOT_READY}u;
+const FLAG_INCLUSIVE: u32 = ${FLAG_INCLUSIVE}u;
+
+const MAX_PARENT_WALK: u32 = ${MAX_PARENT_WALK}u;
+const MAX_SPIN_COUNT: u32 = ${MAX_SPIN_COUNT}u;
+
+const PARTITION_SIZE: u32 = ${TRANSFORM_HIERARCHY_PARTITION_SIZE}u;
+
+// 16 f32 columns-major; a mat4x4<f32> is published as 16 atomic_u32
+// entries starting at \`pos * MAT4_STRIDE\`.
+const MAT4_STRIDE: u32 = 16u;
+
+// Atomically publish \`m\` to slot \`pos\` of \`published_globals\`. Stores
+// columns 0..3 in order, x..w within each column. Pair with
+// \`read_published_global\` on the reader side. The 16 atomicStores are
+// individually ordered relative to subsequent atomic operations by WGSL
+// SeqCst — see header doc for why we rely on that.
+fn publish_global(pos: u32, m: mat4x4<f32>) {
+    let base = pos * MAT4_STRIDE;
+    atomicStore(&published_globals[base + 0u],  bitcast<u32>(m[0].x));
+    atomicStore(&published_globals[base + 1u],  bitcast<u32>(m[0].y));
+    atomicStore(&published_globals[base + 2u],  bitcast<u32>(m[0].z));
+    atomicStore(&published_globals[base + 3u],  bitcast<u32>(m[0].w));
+    atomicStore(&published_globals[base + 4u],  bitcast<u32>(m[1].x));
+    atomicStore(&published_globals[base + 5u],  bitcast<u32>(m[1].y));
+    atomicStore(&published_globals[base + 6u],  bitcast<u32>(m[1].z));
+    atomicStore(&published_globals[base + 7u],  bitcast<u32>(m[1].w));
+    atomicStore(&published_globals[base + 8u],  bitcast<u32>(m[2].x));
+    atomicStore(&published_globals[base + 9u],  bitcast<u32>(m[2].y));
+    atomicStore(&published_globals[base + 10u], bitcast<u32>(m[2].z));
+    atomicStore(&published_globals[base + 11u], bitcast<u32>(m[2].w));
+    atomicStore(&published_globals[base + 12u], bitcast<u32>(m[3].x));
+    atomicStore(&published_globals[base + 13u], bitcast<u32>(m[3].y));
+    atomicStore(&published_globals[base + 14u], bitcast<u32>(m[3].z));
+    atomicStore(&published_globals[base + 15u], bitcast<u32>(m[3].w));
+}
+
+// Reads a previously-published mat4 from \`published_globals\`. Caller
+// must have already observed FLAG_INCLUSIVE on the parent's tile spine
+// slot — that observation is what serializes these atomicLoads against
+// the publishing workgroup's atomicStores.
+fn read_published_global(pos: u32) -> mat4x4<f32> {
+    let base = pos * MAT4_STRIDE;
+    return mat4x4<f32>(
+        vec4<f32>(
+            bitcast<f32>(atomicLoad(&published_globals[base + 0u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 1u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 2u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 3u])),
+        ),
+        vec4<f32>(
+            bitcast<f32>(atomicLoad(&published_globals[base + 4u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 5u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 6u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 7u])),
+        ),
+        vec4<f32>(
+            bitcast<f32>(atomicLoad(&published_globals[base + 8u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 9u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 10u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 11u])),
+        ),
+        vec4<f32>(
+            bitcast<f32>(atomicLoad(&published_globals[base + 12u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 13u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 14u])),
+            bitcast<f32>(atomicLoad(&published_globals[base + 15u])),
+        ),
+    );
+}
+
+@compute @workgroup_size(${TRANSFORM_HIERARCHY_PARTITION_SIZE})
+fn main(
+    @builtin(global_invocation_id) gid: vec3<u32>,
+    @builtin(local_invocation_id) lid: vec3<u32>,
+    @builtin(workgroup_id) wid: vec3<u32>,
+) {
+    let pos = gid.x;
+    let my_tile = wid.x;
+
+    // Threads beyond input.count still need to participate in the
+    // workgroupBarrier below (uniform control flow), but they don't do
+    // any work and don't read or write \`global\`.
+    let in_range = pos < input.count;
+
+    if(in_range){
+        let node_id = input.elements[pos];
+
+        var node = scene_read_node_rw(&scene_database, node_id);
+
+        // Capture this node's current \`global\` as last frame's
+        // value, before the new compose overwrites it later in this
+        // function. The full transforms row was just loaded above —
+        // reading the field here is free, and writing prev_global
+        // ahead of the new global means downstream consumers reading
+        // both (motion-vector generation, TAA) never see a window
+        // where prev and current describe the same frame.
+        scene_write_node_prev_global(&scene_database, node_id, node.global);
+
+        // acc accumulates ancestor.local * ... * parent.local * node.local
+        // (a correct world-space transform once we hit a trusted ancestor
+        // or root). The local transform isn't stored as a matrix — we
+        // build it on the fly from the node's TRS triplet.
+        var acc = mat4_compose_transform(node.local_translation, node.local_rotation, node.local_scale);
+        var parent_id = node.parent;
+
+        // Walk up the parent chain. Each iteration either commits — by
+        // prepending a trusted parent.global onto the accumulator and
+        // breaking — or falls back: prepends parent.local and steps to
+        // the next ancestor.
+        var walk_steps = 0u;
+        loop {
+            if(parent_id == SCENE_NODE){
+                // Reached the scene root — acc IS the world transform.
+                // The scene's TRS is composed implicitly here by stopping
+                // before reading row 0; if a future scene-level pose is
+                // wanted, replace the break with a read+prepend of the
+                // scene's compose.
+                break;
+            }
+            if(walk_steps >= MAX_PARENT_WALK){
+                break; // bail out on pathological depth
+            }
+            walk_steps = walk_steps + 1u;
+
+            let slot = node_to_tile[parent_id];
+
+            if(slot == NOT_IN_INPUT){
+                // Parent isn't being updated this dispatch. Whatever
+                // \`global\` is on the database is what downstream
+                // consumers will see — use it.
+                let parent = scene_read_node_rw(&scene_database, parent_id);
+                acc = parent.global * acc;
+                break;
+            }
+
+            let parent_pos = slot - 1u;                     // undo the +1 encoding
+            let parent_tile = parent_pos / PARTITION_SIZE;  // tile derived from position
+
+            if(parent_tile < my_tile){
+                // Parent's tile must have published before us — but it
+                // might still be in flight. Spin briefly on the spine
+                // flag; if we time out, fall back to walking via
+                // parent.local. The fallback is always correct, just
+                // potentially redundant work.
+                var spin = 0u;
+                var got_inclusive = false;
+                loop {
+                    if(atomicLoad(&spine[parent_tile]) == FLAG_INCLUSIVE){
+                        got_inclusive = true;
+                        break;
+                    }
+                    spin = spin + 1u;
+                    if(spin >= MAX_SPIN_COUNT){
+                        break;
+                    }
+                }
+
+                if(got_inclusive){
+                    // Spine flag observed INCLUSIVE → WGSL SeqCst's total
+                    // order on atomics guarantees the publishing
+                    // workgroup's atomicStores into published_globals are
+                    // visible to these atomicLoads. Read via the atomic
+                    // buffer, NOT scene_database.global (which is a
+                    // non-atomic view and not ordered against the flag).
+                    acc = read_published_global(parent_pos) * acc;
+                    break;
+                }
+            }
+
+            // Fallback / parent in same-or-later tile: walk via local.
+            // (The "later tile" case shouldn't hit with strict
+            // topological ordering, but if it does, walking via local
+            // is still correct.)
+            let parent = scene_read_node_rw(&scene_database, parent_id);
+            let parent_local = mat4_compose_transform(parent.local_translation, parent.local_rotation, parent.local_scale);
+            acc = parent_local * acc;
+            parent_id = parent.parent;
+        }
+
+        // Atomic publish first — these 16 atomicStores into
+        // published_globals[pos] are what the spine flag's atomicStore
+        // (below) releases to other tiles via WGSL's SeqCst order on
+        // atomic operations.
+        publish_global(pos, acc);
+
+        // Mirror to the database for downstream non-atomic consumers
+        // (rendering, raymarching, etc., reading scene_database.global
+        // after this dispatch's command-buffer barrier). Only the
+        // "global" field is written: the whole-struct write that used
+        // to live here was a hazard — if "scene_read_node_rw" above
+        // ever returned zeros for any reason (buffer not yet uploaded,
+        // page-lookup race, anything), "node.local_T/R/S" would be
+        // zero and the writeback would *persist* those zeros into the
+        // row. The next frame's hierarchy reads the persisted zeros,
+        // composes a zero matrix, propagates it down — every
+        // descendant collapses to the origin and stays there. Touching
+        // only "global" means a transient stale read can't poison
+        // local_TRS.
+        scene_write_node_global(&scene_database, node_id, acc);
+    }
+
+    // Publish: every thread in this workgroup has finished its
+    // atomicStores into published_globals by the barrier. Thread 0's
+    // atomicStore on the spine slot is the single release point — any
+    // other workgroup that observes FLAG_INCLUSIVE on this slot is
+    // guaranteed (under WGSL SeqCst) to see all 16 published_globals
+    // atomicStores from any thread of this workgroup.
+    workgroupBarrier();
+    if(lid.x == 0u){
+        atomicStore(&spine[my_tile], FLAG_INCLUSIVE);
+    }
+}
+`, [
+        chunk_scene_database_access_rw,
+        chunk_mat4_compose_transform,
+    ]);
+
+/**
+ * @see {@link graph_nodes_update_transform_hierarchy} — frame-graph harness.
+ * @type {ComputeShader}
+ */
+export const shader_nodes_update_transform_hierarchy = ComputeShader.from({
+    label: "SceneGraph/UpdateTransformHierarchy",
+    body,
+    resources,
+});