The Determinism Dividend

« La perfection est [sera] atteinte, non pas lorsqu'il n'y a plus rien à ajouter, mais lorsqu'il n'y a plus rien à retirer. » — Antoine de Saint-Exupéry, Terre des hommes (1939).

0. Reading contract

This paper had o be made for the reader who wants to know how, and for the quieter reader in a DIY project cave or an industrial and security procurement office who wants to know how do you prove it. Both get the same document, because there is only one truth and it is version-controlled.

What follows describes a 128-voice polyphonic synthesis engine written in C11 under MISRA C 2012, forbidden at the compiler level from touching floating-point arithmetic, heap allocation, or data-dependent execution time — and the verification estate that makes those prohibitions enforceable rather than aspirational. It is the work of one person, February to July 2026, which is either a warning sign or the whole point. We will argue the latter, with evidence, and address the obvious risk it implies without flinching (§8.4).

1. Thesis: the worst case is the only case

A real-time instrument has one obligation: a finished block before the deadline, every time. At 64 samples and 44 100 Hz the budget is 1.451 ms. The listener does not grade on a curve, and neither does a live rig, a broadcast chain, or a simulator running a training scenario at 03:00.

The prevailing craft meets this obligation on average: floating-point cost varies with operand pathology, allocators pause when they please, data-dependent branches give algorithms a worst case far from their advertised case. Each is a tail risk, and tail risks in audio are not performance details — they are the click at the wrong moment, forever associated with your logo.

GDVP's premise is older than the plugin industry: engineer the worst case, and the average case takes care of itself. Three standing constraints each execute that premise by removing a variance class entirely rather than managing it. Everything else in this paper is consequence.

2. The constraint envelope

CR-001 — no runtime floating point. All synthesis arithmetic is Q16.16 fixed point; transcendentals resolve through statically generated tables. Enforcement is the interesting part: every engine translation unit is compiled with -mgeneral-regs-only — the compiler is denied the FPU registers the way one denies a toddler the scissors. A float cannot sneak in through an optimizer's good intentions, because the instruction cannot be emitted. Two designated translation units at the host boundary (the "Airlock") are the sole, documented exemptions; the gate lists them by name.

CR-002 — no dynamic allocation. The host supplies one static buffer — 900 KB for the full 128-voice configuration — partitioned in O(1) at initialization into voice pool, node pool (8 192 slots of exactly 32 bytes, _Static_assert-enforced), bus fabric, and workspace. Reset is O(1). Nothing fragments; hour three is byte-identical to boot. Use-after-free is not a bug we fixed; it is a sentence that cannot be written.

CR-003 — bounded execution. Dispatch is a static function-pointer table indexed by node type; inner loops are loop-invariant; cross-thread traffic rides lock-free single-producer/single-consumer rings and a sequence-locked telemetry channel. The engine does the same work on silence as on 128 voices of audio-rate cross-modulation. Worst-case block time is gated below 1.3 ms — 89.6 % of budget at the theoretical maximum, with measured p99 far below — on physically pinned bare-metal hardware, because timing measured in a shared cloud runner is astrology.

MISRA C 2012 rides over all three, as a blocking analysis gate with deviations documented inline and their proliferation itself policed. We are aware "military-grade" is a phrase the industry has worn smooth. We use the standards the phrase originally meant, and we publish the gate logs.

3. Anatomy of the engine

3.1 The graph compiler

Patches are directed acyclic graphs; the engine contains a genuine compiler for them. Kahn's algorithm performs the topological sort over a stack-resident bounded workspace (the compiler obeys CR-002 even in its scratch space). When the sort starves with nodes remaining — a cycle — the compiler does not reject the patch: it selects a back-edge, marks it, and the executor services it with a one-sample delay. Feedback is thereby legal by construction, with analog semantics (z⁻¹), derived automatically from topology. Patch edits arrive through a staged transaction and become audible via an atomic plan swap at a block boundary: live re-patching without a glitch, the modular-synthesist's dream with hard-real-time table manners.

The part we are quietly proudest of: rate-domain partitioning. Nodes flagged for oversampling are analyzed as connected regions; the compiler injects up/down-sampling bridges only at true domain boundaries, keeps audio-rate FM chains fused inside a single 2× domain end to end, routes modulation around the bridges (control voltages do not need resampling), allocates bridge identities collision-safely above user ID space, and re-heals the routing if the host edits edges mid-flight. Alias suppression applied exactly where FM sidebands demand it and nowhere it would waste cycles. This is optimizing-compiler behavior living inside a MISRA C synthesizer, and we did check whether anyone else ships it. If they do, they are as bad at marketing as we are.

3.2 Concurrency, with the corpses shown

Thread roles are segregated at the translation-unit level and enforced by the linker; the only crossings are the SPSC event ring (in), the SeqLock telemetry channel (out), and the float<->fixed Airlock (parameters). We will not pretend this was born correct. The engine's concurrency history includes a staging-pool data race that cost weeks, a teardown race on the voice-activity flags, and four relatives : the atomic node-flags byte, the patch-load activity barrier, the block-generation grace window, and a mutual-exclusion case ultimately settled by Dekker's algorithm, which predates MIDI by two decades and still shows up to work. Every one is closed, and the closure is not just a claim: a ThreadSanitizer harness drives a live host thread against a live audio executor on every merge, as a blocking gate, with the flip's commit and green-run identifiers recorded inside the gate file. Any new race fails the build before it can fail a performance.

3.3 The voice system, where feel is decided

Unison spread is computed as a zero-centered rational mapping with round-half-away-from-zero — the boundary voices land exactly on the detune limits and the field is perfectly symmetric about the root, which is the arithmetic difference between a unison that sits in tune and one that leans. Glide is not a parameter ramp bolted on top: legato allocation sends a pitch target and lets the oscillator's intrinsic Q16.16 exponential-slew produce constant-time portamento, while a cold strike sets an atomic hard-reset for phase-aligned attack. And when polyphony forces a steal, the executor's Analog Momentum detection downgrades that hard reset to preserve amplitude continuity — punch when you strike, continuity when you steal, both chosen, both in writing. The MIDI layer implements the full pedal grammar — sustain integrated into the eviction logic, sostenuto's selective capture, legato footswitch, portamento pedal driving the slew — plus 14-bit controller pairing with correct MSB latching. The instrument answers to a keyboard player's right foot, not only to automation lanes.

3.4 Nonlinearity as ROM

All waveshaping lives in precomputed tables: a Padé-approximant tanh soft clip, hard rails, a triangle wavefold for the West-Coast constituency, half-wave rectification, and an eight-segment µ-law — yes, the telephone companding curve; it is a beautiful, historically load-bearing nonlinearity and we will not apologize for enjoying it. The master stage ("Iron Ceiling") is a three-region transfer function: exact unity below a −2.5 dB knee, a slope-matched C1-continuous LUT-tanh region, a hard rail at 1.5× — with the 32-bit overflow arithmetic worked in the source comment, because a comment that cannot show its arithmetic is an opinion.

3.5 A worked example: killing a reverb properly

The feedback-delay-network reverb once carried a defect worth confessing in public: decay gain was applied per sample instead of per loop revolution — RT60 collapsed by orders of magnitude. The fix is the kind of thing this codebase exists for. Per-line loop gain is recomputed as g_line = g_rev^(L_line/L_ref) in Q0.16 via a bounded integer power series, with a minimum-loss floor guaranteeing that every tail provably reaches silence; requantization noise in the feedback path is error-fed-back into the absorbed high band (noise shaping, inside a reverb tank, in fixed point); the Hadamard mixing stage carries DC-bias-corrected rounding; and when tank energy decays below the floor, the line snaps to true zero and hands the voice back to the allocator before polyphony stealing engages — reverb physics and voice economics co-designed. The original bug's arithmetic remains in the comment, as a headstone. We write post-mortems into source the way older trades carved dates into roof beams.

4. Evidence, not adjectives

Claims about reliability are cheap; gates are not. The estate, briefly, all live: two-tier CI (hosted correctness on every push; bare-metal, CPU-pinned timing for the physics, artifacts retained); reproducible builds verified by hash identity across independent runners — the binary is a pure function of the source; a phase-inversion null test rendering golden patches and demanding silence to the sample; fuzzing on the two attacker-facing surfaces (license buffer, patch parser) with a guard-page replay gate that makes every historical crash a permanent regression test; sanitizers with recovery disabled, so undefined behavior fails builds instead of writing forum posts; a coverage floor enforced at the measured value — currently 82 % lines (measured 82.1 %, with 86.1 % of functions and 66.6 % of branches), and yes, we publish those numbers precisely because branch coverage is the unglamorous one and it is the one still trailing; the floor ratchets upward and the trajectory is the claim — it began at 58, then 59, then 76, then 81, and now stands at 82; and a workflow-health layer that watches the watchers, because our CI once failed unreadably and we took it personally.

Errata, uncut. A 16-bit pool cursor once wrapped at exactly the reservation arithmetic the comment now quotes. A gate comment once claimed a stricter configuration than the YAML implemented; the configuration governs, the comment lied, and the reconciliation is itself tracked as a finding — comment-versus-config drift is the most dangerous rot in any codebase because it defeats the very reader the comments serve. We enumerate our failures with the same typography as our features. Readers from the certification world will recognize the posture; readers from the plugin world may find it eccentric. Both are correct.

5. What the discipline sounds like

The medium is 16-bit, 44 100 Hz, Q16.16 — chosen, not endured. This is the converter mathematics of the golden era of digital voicing, the DX7 to the VP1 to Roland's S sampler lineage, and its quantization floor and LUT-sine character are the instrument's timbre the way tape hiss belonged to tape. On top of it sits the property no floating-point engine can offer: archival determinism. Bit-exact rendering means a patch is a recording — the same .gvp file produces the same samples on any supported machine, this year or in 2046, exhumable and identical. Call it funerary engineering if you like; we prefer to think of it as the only heart felt answer software has ever given to the question "will this still work?"

We validated the claim the French way: by rendering Ravel's Boléro. One hundred twenty-eight voices, sixteen instrument patches, sixty thousand six hundred twenty-eight events, Ravel's fifteen-minute crescendo as a worst-case stress harness — a piece constructed as a single monotonic increase in orchestral load, which is to say, a torture test with a snare drum. It found many release-blocking defects. Ravel, as ever, unimpressed by insufficient discipline. The factory corpus that shipped afterward spans 808 drum synthesis, proud acid squelch built on a filter that is unconditionally stable through self-oscillation, the five canonical DX7 archetypes done in homage, filtered-disco organs and supersaws from the French Touch canon, and the dust-and-air textures of the crate. The engine was built in Paris by some dev' who programs raï patterns on an MPC for recreation; the corpus was never going to be neutral.

6. The Vessel: how this reaches a DAW

The plugin line wraps the engine in an out-of-process architecture — the engine lives in its own process behind shared-memory rings, a heartbeat watchdog, and a specified failure ladder. A host crash cannot take the instrument's integrity with it, and the converse — the industry's dirtier secret — cannot occur at all. The ladder's terminal state is the feature competitors cannot copy without our constraints: resurrection. Kill the engine process mid-render — we do, deliberately, a hundred times per release... — and the watchdog respawns it, state restores from the patch snapshot, and because rendering is deterministic, what returns within a quarter second is not "approximately recovered." It is the same instrument, to the bit, resuming at a block boundary.

Above the architecture sits a published behavioral contract — eleven measured clauses covering bit-determinism, true-zero silence, transition energy bounds (no lifecycle event may exceed −72 dBFS RMS in any 5 ms window: "no pops" as an inequality, not a promise), poison-value immunity, exact latency truthfulness, resampling-frontier fidelity to −120 dBFS, deadline conformance, honest bypass, zipper-free automation, state round-trip fidelity, and the resurrection drill. The release infrastructure signs binaries over the hash of the validation dossier; an artifact without a complete green dossier cannot be signed, and unsigned artifacts cannot ship. "Only via validation" is not our quality philosophy. It is our release mechanism's type system.

7. Comparison, offered with reserve

We hold the mainstream in genuine respect: the celebrated virtual-analog houses and the great free wavetable engines represent enormous craft, and in raw feature breadth they exceed us — we do not ship a sampler, a wavetable morpher, or four thousand presets, and pretending otherwise would insult both of us. The comparison we can make is narrower and, we think, more interesting: it is about what can be known.

None of the majors publish a p99. We do not believe this is concealment; the question is simply not askable of a floating-point heap with raw confidence, and they are honest people. We rebuilt the foundation so the question would have an answer. That is the entire difference, and we will let it be the only boast in this document... well, that and the graph compiler.

8. For industry, integrators, defense and researchers

8.1 What you actually receive. Every release carries its dossier: reproducible-build hash manifest, MISRA report with enumerated deviations, sanitizer and race-harness results, coverage against the declared floor, WCET percentiles from pinned hardware, conformance logs, and the golden-render corpus. Your diligence team may read artifacts, not adjectives. The audit trail includes an externally-styled findings register — raised, severity-classified, and closed with source-verified remediations — because a vendor who has never been audited is merely a vendor who has never looked.

8.2 Integration profile. Pure C11, zero third-party runtime dependencies beyond one vetted crypto TU, one 900 KB static buffer, no floats, no allocator, no OS assumptions on the audio path. If your target has an ALU and 1 MB, GDVP runs where your RTOS lives — automotive acoustic signatures and AVAS, simulator and training-system audio, industrial HMI sonification, any environment where "it usually doesn't glitch" is a disqualifying sentence. The determinism that gives musicians archival patches gives your test department something rarer: reproducible acceptance testing — the same stimulus vector yields the same output vector, forever, which turns audio QA from statistics into equality.

8.3 Protection and provenance. The proprietary voicing tables ship as a sealed ROM — AEAD-encrypted, unlocked by a machine-bound key delivered inside an Ed25519-signed license whose validator is fail-closed, length-bounded, fuzzed against the Wycheproof corpus, and authentic in its own runbook and doc about which attacks its obfuscation does defeat. Bespoke licensing, source escrow, and export-control review are handled as first-class contract articles, not afterthoughts; we are French, we use to take paperwork seriously, and our documentations and logs are engineered to outlive the software — which, given §5, is saying something.

8.4 The uncomfortable question, answered plainly. Yes: one author. The estate's honest largest risk is its bus factor, and we mitigate it the only credible way we have — by making the machine the second engineer. The author built an admin RBAC access layer to a knowledge base with abundant documentation and MIL-covered Doxygen-built code documentation; the gates encode the review a team would perform; continuity provisions (key escrow, maintainer handbook) are contractual deliverables for the tiers that need them. We would rather name the risk in our own white paper than have your diligence name it for us.

9. Limits, stated plainly

GDVP renders at 44 100 Hz, 16-bit, 64-sample blocks, by charter; the plugin frontier adapts to host rates through a deterministic resampler with published fidelity bounds, and the determinism guarantee is stated per-domain rather than fudged. Capacities are compile-time and finite. The effect family covers delay, diffusion, phase, dynamics, and modulation within the same constraint envelope — it does not attempt to be a mastering suite — Yet... There still is no sampler wired in, no soundpack economy, no cloud. Some of these are roadmap; some are refusals. A specification that cannot say "no" is a mood board and we all felt for it one day or another. It will not happen in this codebase.

Colophon

Written between the authors home in the quartier latin, Paris 6e and the Pygmalion recording studios in the Marais, Paris 3e — districts that spent centuries moving books fabric and now moves packets and most of the parisian cultural economy, both on deadline. Composed in a bitmap-font development environment the author refuses to modernize on the grounds that anti-aliased text is a lie about where the pixels are. The tooling is 2026; the temperament is 1995; the paperwork is Dantonian. The author is aware he is considered out of the box. The code seems to agrees with him.

General Digital Voicing Program. Engineered by François-Xavier Briollais. Licensed, not sold. Technical contact: contact@gdvp.net · The actul pipeline, not this paper, is authoritative. Feel free to inquire

CR001_CFLAGS="-std=c11 -Wall -Wextra -Werror -pedantic \
  -Werror=float-conversion -Werror=double-promotion -Werror=float-equal \
  -mgeneral-regs-only ..."

# Airlock TUs exempt from CR-001 (float-to-fixed boundary by design)
EXEMPT="gdvp_ui_controller.c|gdvp_client_api.c"

_Static_assert(sizeof(gdvp_node_t) == 32,
               "CR-002 FATAL: Polymorphic node must be exactly 32 bytes");
_Static_assert(alignof(gdvp_node_t) == 32,
               "CR-002 FATAL: Polymorphic node lacks 32-byte alignment");

/* Total: 460,800 16-bit words = 900KB */
#define GDVP_CLIENT_ARENA_SIZE_WORDS 460800U

# F-06 flipped to blocking 2026-07-15 (run 29423142308, commit 3d736e4): the
# full race register S1 + R1..R5 is closed (atomic node flags byte + patch-load
# is_active barrier + block_gen grace + EFX Dekker). Any new data race now blocks.
tsan:
  name: Linux ThreadSanitizer (blocking gate)
  continue-on-error: false

# enforces COVERAGE_FLOOR (81; measured 81.5%)

#   1. Same-runner determinism: two clean builds on ONE runner must hash-match
#   2. Cross-runner determinism: a second, independent runner rebuilds the same

C1 Determinism · C2 True black · C3 No pops · C4 Poison values · C5 Latency truth
C6 Frontier fidelity · C7 Deadline · C8 Honest bypass · C9 Zipper-free
C10 State round-trip · C11 Resurrection

C3: transition energy <= -72 dBFS RMS per 5 ms window; no single-sample
    step > -48 dBFS outside musical content

The release signer signs over H(binary + dossier-manifest); absent a complete
green dossier for that exact SHA, the fail-closed `-signed` contract refuses,
and no installable artifact exists.