How It Works
How ReefLogic works
This part is written for scientists, engineers, and conservation-technology readers who want to understand not just what ReefLogic does but how it does it, and why each method is the right one. The goal is to teach: every step of the pipeline is walked through, and at each step the underlying reason it works is made explicit. ReefLogic uses established, citable computer-vision and geospatial methods, applied carefully to the peculiarities of the underwater environment - no satellite fix, refracted optics, rough natural surfaces, and a subject that grows and breaks over years. The narrative falls naturally into two movements: first seeing the reef - turning video into a measured model and using that model as a positioning system - and then tracking the life of each coral that lives on it.
Seeing the reef: from dive video to a measured 3D model
Everything ReefLogic does begins with one deceptively ordinary input: video of the reef, shot by a diver swimming a loose lawnmower pattern over the area of interest. There are no rails, no rigs, no survey-grade instruments - just overlapping footage of the bottom. From that footage the platform reconstructs the reef's three-dimensional shape, to scale, as a textured digital model you can rotate, measure, and return to. The technique is photogrammetry, and specifically the modern pipeline of Structure-from-Motion followed by multi-view stereo dense reconstruction, meshing, and texturing.
The pipeline opens by turning continuous video back into still images. Frames are sampled at a tunable rate and each candidate is scored for sharpness, because the single most damaging input to a reconstruction is motion blur: a blurred frame contributes features that cannot be matched precisely, and imprecise matches poison the geometry downstream. Discarding soft frames before the expensive stages is cheap insurance. What survives is a set of crisp, heavily overlapping views of the same patch of reef from many slightly different positions - exactly the raw material from which depth can be triangulated.
The first heavy stage is Structure-from-Motion (SfM), and it is worth understanding why it can recover three-dimensional structure from a pile of unordered two-dimensional photographs with no knowledge of where the camera was. SfM rests on a simple geometric fact: if the same physical point on the reef is visible in two or more images, and you can identify it as the same point across those images, then the rays from each camera through that image point must all intersect at one place in space. With enough such points seen across enough views, the only mutually consistent explanation of all those intersections is a particular arrangement of camera positions, camera orientations, and 3D point locations. SfM searches for that arrangement.
It proceeds in three movements. First, feature detection finds salient, repeatable points in each image - corners, blobs, textured spots that can be re-recognized from a different angle and distance. ReefLogic uses a learned feature detector and descriptor rather than only hand-engineered features, because reefs are visually treacherous: low contrast, caustic light flicker, repetitive coral texture, and color attenuation with depth all defeat classical detectors that assume crisp, well-lit corners. A detector trained on real imagery learns descriptors that stay stable across the viewpoint and illumination changes that an underwater swim actually produces. Second, feature matching establishes which detected points in one image correspond to which in another. Here ReefLogic uses a learned matcher that reasons jointly over all the candidate features in an image pair - weighing their spatial layout and mutual consistency as a whole - instead of matching each point in isolation by nearest-descriptor. That global reasoning is what lets it find correct correspondences on weakly textured, self-similar reef surfaces where independent per-point matching would drown in ambiguity.
Third, and most importantly, comes bundle adjustment. Given the web of cross-image correspondences, the system jointly solves for every camera's six-degree-of-freedom pose - its position and orientation - together with the cameras' internal optical parameters and the 3D coordinates of every matched point, by minimizing reprojection error: the total pixel distance between where each 3D point lands when projected back into each camera and where its feature was actually observed. This is a large non-linear least-squares optimization, built up incrementally as images are added, and it is the mathematical heart of the reconstruction. The reason it produces a trustworthy result is that it is massively over-determined - each 3D point is pinned by many rays, each camera is constrained by many points, and the single pose-and-structure configuration that simultaneously satisfies all of them is what survives. The output of SfM is a sparse model: the recovered camera poses plus a sparse cloud of the well-triangulated feature points. The sparse cloud is too thin to look like a reef yet, but it carries the skeleton that everything else hangs on - and, as we will see, it is also the map against which the reef will later recognize itself.
The sparse model feeds dense multi-view stereo reconstruction. With the cameras now precisely located, the system goes back to the images and estimates a depth for essentially every pixel, not just the sparse feature points, by matching small image patches across the calibrated views and triangulating them. Fusing those per-view depth maps yields a dense point cloud - millions of points that genuinely trace the reef's surface. From that cloud a continuous surface mesh is reconstructed, turning a swarm of points into watertight geometry, and finally the original imagery is projected back onto the mesh to build a photographic texture, so the model not only has the right shape but looks like the reef it came from. The result is a measured, navigable 3D model of that patch of reef.
A genuine practical subtlety is worth naming. When footage comes from a single moving camera rather than a multi-camera rig, the texturing step's seam-leveling - the color-blending that hides boundaries between images contributed by different viewpoints - can diverge and corrupt the texture atlas even while the underlying geometry remains perfectly sound. For single-camera capture, ReefLogic disables that blending; a faithful-but-unblended texture on correct geometry is far more useful than a smeared one.
What rugosity captures, and why it matters
From the finished surface the platform derives terrain products and structural-complexity metrics. The most ecologically meaningful of these is rugosity - the ratio of true three-dimensional surface area to the flat planar area it projects onto. A pane of glass has a rugosity near one; a reef bristling with branching coral, overhangs, and crevices has a much higher value. This single number is a robust proxy for habitat quality, and the reason is biological: the nooks, ledges, and interstitial spaces that drive up surface area are precisely the refuges that shelter juvenile fish and invertebrates from predators and current. Structural complexity, not living coral cover alone, is what a reef offers as habitat, and it is one of the first things to collapse when a reef degrades and its dead skeleton erodes flat. Because rugosity is computed directly from the reconstructed mesh, ReefLogic measures habitat structure objectively and repeatably, where a diver's eye gives only an impression. Alongside it the platform produces a digital elevation model, slope, and a shaded-relief rendering, giving the reef a quantitative terrain description rather than a qualitative one.
Positioning by visual relocalization - the central idea
The hardest problem in underwater restoration tracking is also the one most quietly taken for granted on land: where is this thing? On land a phone answers instantly from satellites. Underwater, that answer is unavailable - radio frequencies attenuate within centimeters of seawater, so a satellite fix simply cannot reach a submerged diver. Acoustic positioning systems exist, and ReefLogic can ingest their fixes when they are present, but they are costly, coarse, and rarely rigged on a working restoration dive. The platform therefore does not depend on any external positioning signal at all. Instead, it positions the camera against the reef's own reconstructed model, using the very same geometry that built that model. This is visual relocalization (camera re-localization), and it is the conceptual center of ReefLogic.
The mechanism is the natural inverse of Structure-from-Motion. SfM took many images and recovered both the scene and the cameras. Relocalization takes the scene as already known - the reef's sparse model, with its 3D points fixed - and asks only one question of a single new image: where was the camera that took it? Learned features are detected in the new image exactly as during reconstruction, and matched against the model's stored point cloud, producing a set of two-dimensional-to-three-dimensional correspondences: this pixel in the new photo is that known 3D point on the reef. Given enough such correspondences, recovering the camera's pose is the classic Perspective-n-Point (PnP) problem - find the single camera position and orientation for which all those known 3D points project onto their observed image pixels. The solution is the camera's full six-degree-of-freedom pose, expressed directly in the reef model's coordinate frame. No satellite, no world map, no external instrument: the reef recognizes itself, the way you recognize a street corner from an old photograph, and from the match the platform knows exactly where you were standing.
That pose solve runs inside RANSAC robust estimation, and this is not a formality - it is what makes relocalization survive the real world. RANSAC repeatedly hypothesizes a pose from a small random subset of correspondences and counts how many of all the correspondences agree with it; the hypothesis with the largest consensus wins, and the disagreeing minority is rejected as outliers. Visual matching always produces some wrong correspondences, and a single bad match, taken at face value, can wreck a least-squares pose. RANSAC's consensus logic lets the geometrically consistent majority outvote the mistakes, so the recovered pose reflects the true reef structure rather than the noise.
Layered coordinates: why most of the work never needs a world map
A recurring confusion in reef mapping is conflating three quite different notions of "where," and ReefLogic keeps them strictly separate because they become available at different costs and are needed for different things. Think of them as three rungs on a ladder, each adding capability over the one below.
The first rung is the model-local frame: the reconstruction's own internal axes. A point here is simply a coordinate in the SfM model - "this coral sits here in the reconstruction." The origin is an arbitrary artifact of how the reconstruction was built, not any physically meaningful reef landmark, but that does not matter, because a model-local position is already enough to do two essential things: render the coral in its place on the reef mesh, and re-find it later by relocalizing a new image into the same model. A large fraction of the entire restoration workflow lives entirely on this rung.
The second rung adds metric scale. A bare SfM reconstruction is correct in shape but ambiguous in size - it knows the reef's proportions but not whether a given branch is ten centimeters or twenty, because no single photograph reveals absolute scale. ReefLogic resolves this by including an object of known length in the footage - a machined bar carrying fiducial markers, or a simple measured bar on solo dives - and calibrating the model's units against it during reconstruction. Once one real distance is known, every distance in the model is known. That is the threshold for spatial reasoning: with metric scale, distance-based rules such as "keep this genotype at least a meter from that one" become evaluable. Crucially, this still requires no world map - only a known length somewhere inside the model.
The third and final rung is a geodetic, world-map anchor: tying the model into global latitude, longitude, and depth so it can be placed on a chart alongside other sites. This is the only capability that genuinely requires an external world fix, and it is the last and most optional layer. The design insight that shapes the whole platform is that most of the work never reaches this rung at all: pinning corals, tracing lineage, evaluating spacing rules, and re-finding a planted fragment year over year all run happily in the local metric frame. The world-map anchor matters only when you want to see the reef on a map of the world, not when you want to find a coral on the reef.
Because these layers are independent, a model-local position and a world position can coexist without either being silently derived from the other before a real transform between them exists. An unknown world position is recorded as genuinely unknown, never invented. And when a world anchor is eventually established for a model, the transform back into the model's local frame is kept invertible by remembering a fixed pivot point in the local frame - because the reconstruction's origin is an arbitrary centroid, not the physical reef, and forgetting that distinction would silently shift every local position the moment a global anchor was applied.
The fallen coral is a robust-estimation outlier - and that is exactly right
Restoration works with corals of opportunity: fragments that have already broken loose and lie on the substrate, slowly dying, which a diver rescues without ever breaking live coral from the reef. This biological fact has a clean geometric consequence for relocalization. When a diver photographs the spot where a loose coral was found and that image is relocalized against the reef model, the loose coral in the foreground is not part of the model - the model was built from the surrounding, established reef. So the features on that fallen coral have no correct 3D correspondence to match against, and the relocalizer treats them as exactly what they are: outliers, which RANSAC discards. The pose is recovered from the stable reef behind and around the coral.
What relocalization therefore returns is the camera's pose - the found-spot on the reef - not the coral's own coordinates. This is not a limitation; it is the correct answer. A fallen coral's resting place is biologically incidental: it tumbled there. A coarse found-spot is entirely sufficient for the moment of collection. Precision matters at the other end of the coral's journey - at the deliberate replant, where a fragment is placed exactly and must be re-found accurately on every future dive. The same machinery serves both, and the outlier-rejecting nature of robust estimation is what lets it ignore the transient object and lock onto the permanent reef.
Calibrating optics through the water
One underwater-specific correction is essential to all of the above. Light bends as it crosses the boundary between water and the camera housing's flat or domed port, and that refraction changes the camera's effective focal length and lens distortion - the optical model is no longer the one the manufacturer specified in air. If left uncorrected, this systematic distortion biases both reconstruction and relocalization. ReefLogic handles it by calibrating the camera together with its housing, underwater, exactly once. The refractive effect is then baked into the stored lens parameters, so every subsequent dive with that rig is geometrically correct from the first frame, with no per-dive correction step required. Calibrate once, in the medium you will actually shoot in, and the optics are right thereafter.
Tracking the life of a coral
A measured reef model is the stage. The coral is the actor, and what makes restoration auditable rather than anecdotal is that ReefLogic follows each individual coral across its entire life - from the moment a diver lifts it off the sand to the day, seasons later, when a return survey confirms it has taken hold and grown. Tracking a life is a harder problem than mapping a place, because a life branches: one rescued coral becomes a family of clones, each handled, moved, split again, and finally returned to the reef. The challenge is to keep every one of them distinguishable, attributable, and re-findable without ever leaving a mark on the reef. ReefLogic solves it with a deliberate sequence of ideas: a physical identity that exists only while the coral is in human hands, a hand-off from that physical identity to a position in the reef model at the moment of replanting, three independent and permanent histories, and an ecological reasoning engine that decides where each coral should go.
An identity that does not pollute the reef
The dangerous moment in any restoration program is the one-to-many split. A single rescued colony is fragmented into clones; those clones are mounted on nursery ropes, grow, and are split again; eventually dozens of genetically identical pieces are spread across a nursery and then carried back to the reef. At every one of those branch points, two corals that look identical can be confused, and a single confusion silently corrupts the lineage of everything downstream. Relying on a diver's memory - "this is the third fragment from the colony we pulled off the north slope on Tuesday" - does not survive contact with a working dive season. Mix-ups are not a failure of diligence; they are the expected outcome of asking a human to disambiguate identical objects by recollection, underwater, at scale.
ReefLogic removes memory from the equation by giving each handled coral a small, durable, machine-readable identity marker: a dense two-dimensional matrix code, of the robust error-corrected kind used to mark industrial parts, laser-engraved on a small anodized-metal token that clips to a plug or a nursery mount. The code carries no meaning of its own - it is a short opaque string that the system resolves to a particular coral. That opacity is intentional: nothing about the coral is exposed on the token, and the token can be reused without leaking history. What matters is that a scan is deterministic. Pointing a reader at the token turns the question "which coral is this?" from an act of fallible recall into a time-stamped, attributable, machine-resolved event - this code, this coral, this operator, this instant. Every split, every move, every measurement is then anchored to an identity that cannot be misremembered, and the branch points that would otherwise breed errors become the best-documented moments in the coral's life.
The decisive design choice is where the token lives and where it does not. The token rides with the coral only inside the managed handling chain - on the boat and in the nursery, where corals are dense, anonymous, and constantly rearranged, and where a reliable physical handle genuinely earns its keep. It never goes onto the reef. Permanent reef markers are simply marine debris in slow motion: tags work loose, cable ties embrittle and shed microplastic, and a reef studded with plastic is a reef you have polluted in the very act of trying to heal it. So at the moment of replanting, identity hands off from the physical token to the coral's recorded position in the reef's three-dimensional model. The token is recovered, cleaned, and cycled back into a pool to mark the next coral; the coral, now planted, is identified from that point forward by where it sits in the measured reef. The permanent locator is the coral's identity paired with its position in a versioned model of the reef around it - and a coral is re-found not by reading something bolted to it, but by recognizing the reef in which it lives. The reef stays clean, and the only trace the restoration leaves behind is the corals themselves.
This is why the visual relocalization described earlier is load-bearing rather than a convenience. Because the long-term identity of a planted coral is its position in the reef model, re-finding it on a later dive is exactly the act of re-surveying that patch of reef and recovering the camera's pose against it. Identity and location become the same fact, and that fact lives in the reef, not on it.
Provenance as three separate, append-only histories
A coral's life produces three fundamentally different kinds of fact, and ReefLogic refuses to blur them. There is the question of descent - which coral this fragment came from, and what it was split into. There is the question of movement - every physical thing that was done to it, in order. And there is the question of condition - how healthy it was, observed over time. These are kept as three separate, append-only records, each individually auditable, because conflating them would make the history harder to query and easier to corrupt.
Lineage is the structural record: who descends from whom. A rescued colony is the root, and each physically tracked piece points back to the fragment it was cut from, so the whole family forms a tree. Because the relationship is recursive - fragments of fragments of fragments - ancestry and descendant questions are answered by walking that tree transitively, which lets an operator stand at any clone years later and trace an unbroken line back to the original rescued colony, or stand at the colony and enumerate every living descendant. Heritable properties such as genotype and family are recorded once on the colony and inherited by everything beneath it, so the genetic story never has to be re-entered and never drifts between siblings.
Movement is the event record: a typed, time-ordered log of everything that physically happened. Each entry names what occurred - a coral was donated from a site, mounted in a nursery, split into clones, relocated, outplanted, or replanted into the reef - and names the corals it came from and the corals it produced. This event-sourced shape is what makes the timeline and the journey of any coral reconstructable: to retell a coral's story you simply replay the events that reference it, in order. Splits are first-class events that fan one source out to several products, which is precisely how the lineage tree and the movement log stay consistent with each other - the same act that branches the family is logged as the act that branches the family.
Health is the observational record: an append-only stream of condition reports - thriving, stressed, bleached, diseased, dead, or simply not yet assessed - attached to corals, fragments, sites, or surveys, alongside structured measurements and free-text notes. Survival is not a flag that gets toggled; it is the shape of this stream over time. A coral that was healthy, then stressed, then healthy again has a recoverable arc, and a coral that was planted and never seen alive again has a gap rather than a fabricated success.
What ties these three records together is a single discipline: they are append-only and immutable. Nothing is ever edited; nothing is ever deleted. A correction is a new entry, not an overwrite, and the original observation survives alongside it. This is what turns a database into a chain of custody. The reason append-only logs are tamper-evident is structural rather than procedural: when the only legal operation is to add, any attempt to quietly change the past has to leave the past in place, so a discrepancy between what a later record asserts and what the earlier records show is always visible. There is no destructive edit path in which an inconvenient history can simply vanish. A reviewer - a scientist, an auditor, a funder - can read the entire life of a coral as it was actually recorded, in the order it was recorded, and trust that the absence of an entry means the absence of the event rather than its deletion.
Crucially, immutability does not mean rigidity. The real world produces exceptions that a rule cannot anticipate - a coral that must go into a spot the spacing rule would forbid, because that is genuinely where it belongs. ReefLogic lets the operator record that exception. A replant that violates a rule can still be written; the violation is captured as a reason attached to the event - a warning or a noted, knowing override in the permanent log - rather than as a wall that stops work. The judgment of the person in the water is preserved and the fact that a rule was knowingly overridden is preserved, which is exactly the behavior a credible chain of custody demands: it records what happened, including the human decisions, instead of pretending the world conforms to the model.
Ecologically-informed replanting
Deciding where to replant is not a matter of finding open water; it is a matter of finding the right open substrate, and then reasoning about it the way the reef's own history says you should. A coral needs bare, plantable rock - a genuine empty patch - not a spot already claimed by living coral or by an outplant from a previous dive. ReefLogic finds those patches by reading the reef's top-down orthomosaic, the seamless overhead image stitched from the survey, and applying semantic benthic segmentation to label every region of the seabed by what it is: living coral of various kinds, rubble, sand, pavement. The classified map of occupied and plantable surface is then reconciled against the movement record - every position already taken by a logged outplant is subtracted - so what remains is the set of patches that are both physically plantable and not already spoken for. Benthic segmentation answers "what is the seabed made of, and where is it free," and the provenance log answers "where have we already put corals," and the empty-patch set is the difference between the two.
A free patch is not automatically a good patch, and this is where the reasoning engine earns its place. ReefLogic scores each candidate gap against the site's own accumulated history using a rules engine the operator defines - not a fixed, opaque policy baked into the software, but an explicit, editable set of ecological constraints that can evolve as a program learns its reef. The engine weighs the things that determine whether an outplant will thrive and whether the patch as a whole will be resilient: it keeps corals of the same genotype or family from being crowded together, because monoculture is fragile; it favors genetic diversity across the patch; it respects the site's carrying capacity and the appropriate depth band; and it steers away from micro-locations where corals have repeatedly died before, because the health stream remembers those graves even when the seabed looks inviting. The output is a concrete dive plan: which corals to pull from which nursery positions, and the exact target points on the reef where each should go, each annotated with the verdict the rules produced - clear, a soft warning, or blocked - so the team dives with both a placement map and the reasoning behind it.
The reason this entire decision can be made without a world map is the same insight that lets the reef be surveyed without GPS. Every quantity the rules engine cares about is a relationship within one reef model: the distance from this candidate patch to the nearest sibling genotype, whether a spot lies inside the high-mortality zone recorded last season, how many corals the site already holds. None of those are questions about where the reef sits on the globe; they are questions about the geometry of the reef relative to itself. With metric scale calibrated into the model - recovered from a physical scale reference captured in the same footage - a distance in the model's own coordinates becomes a distance in meters, and "no closer than a meter to that genotype" becomes a checkable predicate. The spatial reasoning lives entirely in the local metric frame, which is precisely the frame the survey already delivers. A latitude and longitude would add nothing to the decision; it is needed only to draw the result on a chart of the world, and so it is never on the critical path of getting a coral into the right gap.
Watching the reef change over time
Restoration is a time series, not a snapshot; the scientific payoff is change. Did an outplant grow? Hold? Break? Die? To answer this, the same reef is surveyed on repeat dives, and ReefLogic compares the resulting models. The difficulty is that each dive produces its own reconstruction in its own arbitrary internal frame - a different origin, a different orientation, and (before scaling) a different size - so two surveys of one reef do not overlay by default. They float apart. Comparison therefore proceeds in two stages: first bring the surveys into a common frame, then measure the difference between their surfaces rigorously.
The first stage is co-registration, and it uses the same registration machinery as relocalization. The models can be aligned geometrically by Iterative Closest Point (ICP), which repeatedly pairs each point in one cloud with its nearest neighbor in the other and solves for the rigid transform that minimizes those pairings, iterating until the two surfaces seat together; or by matching visual features between the surveys; or, most robustly, by registering the new survey's images directly into the prior reconstruction so the two share a coordinate frame natively from the start. Applying the established metric scale then makes the aligned models comparably sized, which is not optional for change measurement: without a shared scale, a real few-percent growth is indistinguishable from a scaling artifact of reconstruction.
The second stage measures surface change with M3C2 - Multiscale Model-to-Model Cloud Comparison, the established method for detecting change on rough natural surfaces. Understanding why M3C2 is the right tool requires seeing why the obvious alternative fails. The naive approach, cloud-to-cloud distance, takes each point in the new survey and measures the distance to the nearest point in the old one. On a smooth plane that is fine; on a reef bristling with structure it is badly biased, because the nearest point is often on a different feature - the side of an adjacent branch rather than the same surface - and the measurement is unsigned, unable to say whether the reef grew outward or eroded inward, and carries no notion of its own reliability.
M3C2 instead measures change the way an observer naturally would: along the surface. At each point it estimates the local surface normal - the direction perpendicular to the reef surface there - at a scale matched to the local roughness, and then measures the signed distance from the old surface to the new one along that normal. The sign is the whole point: accretion and growth read positive, breakage and mortality read negative, so the result is a sign-aware map of where the reef gained or lost material, not just where it differs. Equally important, M3C2 attaches to every point a confidence interval propagated from two real sources of error - the residual uncertainty of the co-registration, and the local roughness of the surface being compared. This is what makes the change map defensible: it does not merely assert that a point moved a few millimeters, it states whether that movement is statistically significant or lies within the noise of registration and surface texture. A reef monitored this way produces growth-and-loss maps in which one can distinguish genuine biological change from measurement artifact - precisely the discrimination the underwater-photogrammetry reef-monitoring literature converged on M3C2 to provide, because reef surfaces are rough and registration is never perfect.
Two further results fall out of the same alignment. Because outplant positions live in the model-local frame, overlaying the surveys carries those positions forward through the registration transform, so each planted fragment can be followed across dives - persisted, grew, or died - without re-finding it by hand each time, and so that re-surveying a reef never orphans the positions recorded against the previous reconstruction. Comparison and long-term coral monitoring are, underneath, the same registration problem; and like the rest of seeing the reef, both run entirely in the local metric frame, with no world map required.
Integrity and scale
Small-scale coral restoration programs can rely on basic manual logging, but managing thousands of corals per season requires a robust, data-driven framework. ReefLogic features an uncompromised system architecture built specifically to deliver both data integrity and high scalability. Three properties carry the weight.
Storage is content-addressed and verifiable. Every artifact - a reconstruction, a texture, a survey clip - is stored under an address derived from a cryptographic hash of its own bytes. Identical content therefore stores exactly once, which keeps a multi-season archive from ballooning, and any corruption is self-announcing: re-hash the bytes and a single flipped bit no longer matches the address it was filed under. The heavy artifact bodies live in this verifiable store while the lightweight catalog of what-relates-to-what lives in the database, so the system can hold an enormous volume of imagery and models without the metadata that ties a coral's life together becoming slow to query.
Provenance is immutable, which is a chain-of-custody property but equally a scaling property. Because the lineage, movement, and health records only ever grow, there is no contention over editing shared history and no class of bug in which a concurrent correction clobbers a prior fact. The records of many thousands of corals interleave safely because every writer only ever appends its own events, and the timeline and journey queries that read them back are made fast by indexing on the relationships - which coral produced which - rather than by scanning the whole log.
Workspaces are isolated by organization. Every record carries the identity of the program it belongs to, and every query is scoped to that program at the data layer, so multiple restoration efforts share one platform without ever seeing or contending with each other's corals. Combined with an authentication model that resolves each person to a stable identity and grants them only the operations their role permits, isolation means scale in the number of programs as well as the number of corals.
The identity scheme scales for a quieter reason: the tokens cycle. Because a marker is recovered at replanting and reused, the inventory in flight at any moment is measured in the thousands of physical tokens a program actually has in hand, not in the hundreds of thousands of corals it will handle over its lifetime. The symbology costs nothing to generate, the engraved tokens are durable, and the only genuinely scarce resource is human attention - the labor of scanning and binding corals on a rocking boat - which the deterministic, batchable scan-to-bind workflow is built to economize. The system scales because the expensive thing, human disambiguation, has been replaced by a cheap, repeatable, attributable machine event, and the durable record of that event costs almost nothing to keep forever.
All of it rests on one principle, the same principle that lets a reef be mapped without satellites and a coral be tracked before any world anchor exists: record what you know, in the frame you know it in. A coral's identity is recorded as a scan when it is in your hand and as a position in the reef when it is not. Its descent, its movements, and its health are recorded as three growing histories that can be replayed but never rewritten. Its replanting is reasoned out in the reef's own metric frame, because that is the only frame the question actually requires. Nothing is invented to fill a slot that has not been measured, and nothing is discarded once it has. That discipline is what lets ReefLogic make a claim most restoration efforts cannot: not merely that corals were planted, but that each one was followed, faithfully, through its whole life.
