Every device carries a lifecycle — procured, deployed, maintained, refurbished, retired, erased — and every move between them is a chain-of-custody event recorded with the person who made it. The refusals are recorded too. That is the half a list of successful transitions throws away, and “why was this meter not erased on the 4th” is the question a chain of custody exists to answer.

Retiring a device is not refused. Erasing one is. A device is retired when it comes off the wall, and holding it in “deployed” until somebody produces a certificate would make the estate say a meter in a crate is in service. The certified erasure is a second, guarded step, refused until somebody records the method, the reference and the date — and who asserted it comes from the session, never from a form. This platform did not witness the erasure and never says it did; what it prints is the method, the reference and the name.

The export below is sealed and it reconciles: opening balance, movements in and out, closing balance, and the identity that ties them. A device that changed state twice inside the period is one device and two movements, and both numbers are shown, because a reader given one of them reads it as the other. If the balances do not add up, or the record did not fit in one read, no export is produced at all.

A cold room carries an excursion lifecycle — in band, door open, defrosting, above band, above the limit, and not reporting. The last of those is a state and not a flag, because a room nobody has heard from is not a room that is in band, and every figure below has to be able to tell those two apart.

A spoilage score is a claim about somebody’s stock, so it is never a bare number: it carries the thresholds it was measured against, the time above each of them, and the coverage of the window. A gap in the temperature history refuses it outright. An unmonitored hour contributes no minutes above any threshold, which is exactly what a compliant hour looks like — so a score computed across a gap reads silence as compliance, and that is how spoiled product gets certified. Nothing is interpolated across a gap; the gaps are listed instead.

The uptime figure is the number a customer gets paid on. It refuses a truncated read, an unfinished period, a period with no baseline, and any period containing time the room was not reporting — that time is neither up nor down, and both ways of absorbing it (counting it as up, or dividing by the observed time instead of the period) produce a real number about a different period from the one on the label.

Door-open analytics is about the door. Openings, durations and the hour of the day. There is no field for who opened it and there never will be (PRD-001).

Water demand, network-loss trend, air quality and flood level for a district — on the same measured primitive as the panel above, and never about a person, a household or a meter account (PRD-001).

Every point carries how many of the district’s sources reported into it. A point whose meters were mostly quiet is a gap, not a low reading, and it is never scaled up to stand for the whole district: a district with silent meters is not a district with low demand. Network loss is a difference and is computed only where both sides were observed — subtracting an absent reading yields the whole of supply as the loss, which is what a burst main looks like.

One page renders every dashboard. The document says which widgets and which aliases; the alias resolver says which devices, per tenant and per viewer. That is why a widget binds to an alias by NAME and never to a device: replace a pump and the dashboard is unchanged.

Saving carries the version you loaded. If somebody else has saved since, the write is refused and you are told, rather than their work being replaced by yours.

History is kept, bounded, and a restore moves forward. Every version this dashboard replaced is held, so “put the wall display back the way it was” has an answer at three in the morning. Restoring version 3 writes a NEW version whose content is old rather than setting the counter back — two documents sharing a number would break the refusal above. How far back the history goes is bounded, and the panel says how many older versions are no longer held, because a history that starts at version 400 otherwise looks exactly like one that starts at version 1.

A public link is a grant, not this dashboard without a login. Publishing freezes the devices the dashboard resolves to AT THAT MOMENT, and the link shows those and only those for as long as it lives. A dashboard that says “every pump” would otherwise publish the pump installed next March by an engineer who has never heard of the link. Adding a device to the estate does not add it to a link: publishing more is minting a new one, which is a decision with a date and a name on it. The URL is shown once, when it is minted, and this platform cannot show it again.

Switches, routers, UPSs, PDUs and substation gear speak SNMP and are already on the wall. A target says which agent to poll and which OID means which measurement; what comes back goes through the ordinary ingest path, so it is metered, scored and evaluated against rules exactly like a reading a device posted itself.

This platform cannot write over SNMP. There is no SET encoder and no constant for one. SNMP SET is how you reboot a switch or trip a relay, and that is actuation: it belongs to whoever owns the actuator, not to a monitoring platform.

Version 3 or version 2c, and the difference is not cosmetic. v2c sends its community string in cleartext in every packet. v3 authenticates every message and can encrypt it. Passphrases are never typed into a target: a target names a secret, and the value lives in the server’s secret store — the same arrangement the SMS gateways use.

A target is an outbound request to an address you choose. Loopback, link-local — including the cloud metadata address — and multicast are refused, because those are this platform’s own network rather than yours.

The pumps serviced under one contract, the sensors a fire officer signed off, everything on the Tuesday round. A group is a label you put on a set so a screen or a report can name it in one word.

A group is not a place. The site map answers where a thing is, and a thing is in exactly one container. A group answers something else, and a thing is in as many groups as you find useful.

Membership is a list you write, not a rule that computes. A saved filter is more convenient and is the wrong shape: a group is what a permission will be granted on, so a computed set would change when somebody renames a device or corrects its type. That person is looking at a device screen, has no idea this group exists, and has just moved a machine into or out of somebody’s access. If you want every pump, the device and asset lists already filter by type.

A member that no longer exists is shown as missing rather than quietly dropped, and deleting an entity takes it out of every group, because an id can be registered again and a leftover membership would attach itself to the next machine with that name.

A pump reports forty measurements. The contractor who services its bearings should see vibration and temperature, from the date their contract started, and nothing else. A view is that: one entity, a list of what may be read from it, and optionally a window of when.

A view narrows. It never grants. Holding one is not permission: every read still goes through your ordinary sign-in, and somebody who could not read the device cannot read a view of it either. What a view does is take somebody already entitled and give them less. When this platform has customers beneath a tenant, a grant will point at a view, and the restriction is already written.

You list what may be read, never what may not. A hide-list reads more naturally and fails on the next reading the device sends: somebody adds a measurement in six months, against a view written by a person who has left, and it is exposed by default. A view with nothing listed is refused rather than treated as unrestricted.

Attributes are separate and default to none. That is where a serial number, a site address and an installer’s phone number live — the fields least likely to be thought about by somebody writing a view about vibration.

Modbus was published in 1979 and is in every building management system, VFD, power meter, PLC, flow computer and RTU your sites already own. A target says which controller to read and which registers mean which measurement; what comes back goes through the ordinary ingest path, so it is metered, scored and evaluated against rules exactly like a reading a device posted itself.

This platform cannot write to a PLC. There is no encoder for a write function code and no constant for one. A Modbus write goes into the registers a controller keeps its setpoints in — a pump speed, a burner demand, a valve position, an interlock — and that belongs to whoever owns the plant and carries the hazard study, not to a monitoring platform.

A register has no type, so you have to say what it is. A holding register is sixteen bits and nothing more. A float is two of them, and the standard defines byte order within a register while saying nothing about the order of the registers themselves — so both are conformant and vendors are split. Guessing does not produce an error, it produces a plausible wrong number: a flow of 10.0 read the other way round is 2.3e-41 on Monday and something that looks reasonable on Tuesday. Every value wider than one register must declare its word order, and that is refused rather than defaulted.

Addresses here are wire addresses and count from zero. If the manual says 40001, the wire address is 0. Numbers in the 4xxxx and 3xxxx ranges are refused with the arithmetic done for you, because transcribing them is the commonest Modbus configuration mistake there is and it reads real data from the wrong place rather than failing.

The unit id matters even over TCP. A serial gateway fronts up to 247 slaves on one address and port, distinguished by that one byte. Unit 0 is the serial broadcast address and is refused: a gateway may answer it from whichever slave it likes.

Installing writes four ordinary device profiles — chiller, computer-room air handler, pump, energy-transfer station — plus the standard condition alarm rules and a plant dashboard. They are rows this tenant owns and can edit from the screens that already exist, not a hidden built-in the profile screen cannot see. Re-running never overwrites an edit: anything already here is kept and reported.

The unit is part of every key name (chw_supply_temp_c against chw_supply_temp_f), and that is deliberate. Changing a unit under a stable key name silently reinterprets every reading already recorded against it, so changing the unit has to be a new series rather than a re-labelled one. Pick the system the plant’s own gauges read in; it is the plant’s choice, not the server’s, so two tenants on one deployment may differ.

Nothing is installed into anybody’s tenant until somebody asks.

Delta-T is the return temperature minus the supply temperature on one loop: how much heat the water actually carried. kW/ton is electrical power divided by the cooling delivered — kilowatts over tons of refrigeration, which is an SI numerator over a US-customary denominator, so the conversion is stated on every figure that uses it.

Neither is a reading. Each is computed from two readings, and a row here shows a number only when both exist, are declared in the same unit, and were taken close enough together to describe one state of the plant. Otherwise the row says which of those was missing. A dead return sensor would otherwise produce a delta-T of zero, which reads as a plant that has stopped transferring heat, and a load sensor at zero would produce the most efficient chiller ever built. Both look exactly like measurements.

“No loop” and “no load declared” are not faults. A pump has a suction and a discharge pressure, which are not a supply and a return; an air handler does not measure the heat it moves. Those rows will never carry that figure and no sensor will fix it.

An image is verified before it is stored. The platform checks the vendor’s signature against the key configured for this deployment, and refuses anything that does not verify. A deployment with no key cannot accept firmware at all — unsigned firmware distribution is remote code execution with a rollout schedule.

The digest is checked again on the way out. The signature says who made these bytes; the digest says the bytes about to reach a fleet are still the ones that were checked.

Revoking keeps the record. A campaign that shipped an image is something somebody will read later, and a record pointing at a row that is gone is worse than one pointing at a row marked withdrawn.

The first batch is a canary, and every batch is followed by a hold. The hold is not politeness: it is the only moment at which evidence exists and somebody can still act on it. Nothing advances on its own — each batch is sent because a person asked for it.

Sent is not installed. Sent means this platform finished writing bytes. Installed means the device came back and said it is running the new build. A rollout continues only when enough devices have said so: a batch nobody has heard from has no failures, and would pass a failure threshold while telling you nothing at all.

Nothing is ever moved backwards. A device already on this version or newer is skipped, and so is one whose version could not be read — “I could not read it” is not “it is behind”.

Stop is final. Halting a rollout ends it. Continuing afterwards means planning a new one, which is a decision with a name on it.

An asset is anything that is not a device: a site, a building, a line, a machine. Containment is what a rollup walks, so this is the difference between a control room being told Line 3 is in alarm and being told a sensor id.

The state on a row is not stored anywhere. It is computed when this screen asks: the worst severity open beneath that asset at that moment. The alarm itself stays on the device and the rule that raised it, where it can still be acknowledged — copying it up the hierarchy would turn one bearing into five alarms, four of which nobody can acknowledge meaningfully.

Unknown is not clear. An asset with nothing beneath it has not been observed to be fine; it has not been observed at all. A map somebody has not finished wiring up must not read as a quiet plant.

A thing is contained by one thing. A second parent makes a rollup count the same alarm twice and leaves “where is this” with no answer, so the platform refuses it. Move it instead.

Inspect asks the rollup itself. The State column is a summary computed for the whole map in one pass; Inspect asks for one asset and gets the severity breakdown and the chain it hangs from. That chain is the answer to the question somebody standing in front of a sensor actually has, which is not “is anything wrong” but “what is this part of”.

An engineer standing in front of a machine photographs it, scans its tag and types what is on the rating plate. What arrives here is a proposal, not a change: the asset register is exactly as it was until somebody on this screen accepts it.

You cannot accept your own capture. The whole of this control is that somebody who was not standing in front of the asset checks what was read off it. An operator can capture and cannot accept at all; an administrator who captured a thing is refused on that row by name.

Read from says how each field was obtained, and it is what the confidence is computed from. A scanned code that passed its own check digit is the strongest thing here; a code that FAILED one is dropped rather than shown at a low number, because a failed check digit is a misread and not an uncertain read. Typed carries no confidence at all — it is a person’s eyesight, on the record and attributed, and not something this platform measured. So a capture containing anything typed shows “—” rather than a figure, and the figure you do see is the weakest field in the proposal, not an average: accepting is one act over all of them.

No photograph is read by a model in this deployment. The capability line below says so. The seam exists and is empty, and a field claiming to have come from a model is refused rather than accepted — nothing here called one.

Declining asks why. The next engineer is sent back to the same asset with the same phone, and without a reason they take the same photograph again.

Paste or open the plant's CSV register. One row per tag, repeating the asset id, with the columns listed below. It creates assets, containment and the tags' limit attributes.

The dry run is not optional. The Commit button is dead until a dry run has been taken, and it sends that dry run's digest back with the artefact — so if anything moved in between, the commit is refused rather than applying differences nobody looked at.

Nothing is deleted, ever. Not an asset, not an edge, not a measurement key this artefact happens not to mention. An import is the register arriving, not an authority over what is already here, so the keys it leaves alone are listed rather than removed.

It never creates a device. A row naming a device this tenant has not registered is a conflict. Registering one mints a credential that is handed over once, so an import that created devices could not be rolled back exactly — and an exact rollback is the whole point.

A conflict stops all of it. There is no “import the good rows”: that builds a hierarchy quietly missing branches, which is the failure a bulk tool is most able to hide.

No column for a person — owner, operator, contact, engineer. The import refuses the whole artefact and names the column (PRD-001). It is not dropped quietly, because a column the platform skipped is a column you believe was imported.

An edge node runs the same platform at a site that may lose its link, buffers what it observes while the link is down, and hands it over when the link returns. Entitle a tenant to edge and register the site here; a tenant with no nodes is the normal state, not a fault.

A node is scoped to the devices it serves. That list is the security boundary: an unscoped node could forge readings for the whole tenant, so it is required at registration and changing it bumps the node’s generation. The site does not know about the change until it next pulls its configuration, which is why the row shows what the site has actually collected rather than only what it has been told.

Last handover is not last contact. The cursor below is the last sequence this centre accepted from that node. A node that is up and has nothing new to say does not move it, and a node that has been off for a week does not either — so a stale cursor is a question, not a verdict.

Erasing a tenant does not reach these machines. Deleting Devices removes a node’s credential, so it can no longer sync and this centre can no longer reach it — and the readings already buffered on the hardware at the site stay on that hardware. Data is erased here, not everywhere (ADR-009 §6.4).

A gap is the node’s own account that observations existed at the site and no longer do — its buffer filled while the link was down, and the oldest records were dropped to keep taking new ones. It is the one thing a centre must never quietly discard: a centre that loses gap markers believes it holds a complete series for a period it does not, and every question asked of that series afterwards gets a confident wrong answer.

Episodes and records are different numbers, and the small one lies. One gap marker can cover forty thousand observations. A screen showing “1 gap” beside a node that lost a day of readings is telling you the opposite of what happened, which is why both columns are above and why this table is sorted by what was lost rather than by when.

A model runs at the site, over that site’s own readings or its own camera stream, and keeps running with the link down. What crosses to this centre is the output and a reference to the evidence — never the frames, which is the point: edge inference is how bulk video stays where it was recorded.

No model artefact ships with this platform. The registry, the deployment record, the rollback path and the refusals are built; the engine that actually runs is supplied by the deployment. A site with a version assigned and no engine to run it says so, in words, rather than producing nothing — see the table below.

A version is deployable only if its artefact was signed. The bytes travel the same path firmware does, which verifies a composite signature before it stores one. A version whose artefact this platform has never seen, or whose signature did not verify, stays on the record and is handed to no site. A model running unattended at a site is code, and the reason it is checked this hard is that a bad one is not recoverable from the next reading.

The metrics are as declared. This platform holds no evaluation set for an edge artefact and cannot reproduce a figure somebody reported, so what is shown is the claim with the method beside it. If you need it verified, there is somebody to ask.

An empty list here is not a quiet estate. It is also what a site nobody deployed a model to looks like, what a site whose model will not load looks like, and what a site nothing has ever asked looks like. Three of those are faults and one is good news, so the first table says what each site last said rather than leaving you to read the silence.

Every row below is a model’s output, not a reading. Each carries the whole distribution over the labels its version declared, how much of that mass the model committed at all, the version that produced it, and the time the site took it — which is not when it arrived here. Nothing on this platform acts on any of it: no alarm instructs, no case is opened and no actuation is proposed. Accepting or rejecting one is recorded against your name.

A chain is a graph of nodes a message passes through. The tenant’s root chain receives every telemetry and attribute post, beside the threshold rules on Rules & alarms — never instead of them. A chain’s alarms are ordinary Pulse alarms with the chain as their provenance, and a chain can never acknowledge one: acknowledging is a person’s act.

This is a JSON editor with validation on the server, not a visual editor. The document below is checked when it is saved — every relation, every label, every node’s configuration, and whether the graph has a cycle — and refused, naming the node, if anything is wrong. Simulate runs one message through every plan and performs nothing.

A test replays synthetic messages, or a recorded window of this tenant’s own history, through the chain in simulation: every plan, nothing performed, against a shadow of alarm state as it was when the window opened — not as it is today. Each assertion is PASS, FAIL or NOT-EVALUATED with its evidence, and NOT-EVALUATED is not a pass. A window whose history cannot be read to the end is refused, not judged in part.

With requires a passing test run on, making this chain the root — or saving it, or a chain it enters, while it is the root — is refused unless the latest run of every test against exactly that chain passed. To save a change, run the tests against the draft in the editor first.

A chain the AI layer wrote is AI-authored for good: editing it later does not change where it came from. Approving it saved it; it did not arm it. Arming — letting AI-authored logic process this tenant’s live readings, as the root chain or inside what the root reaches — is a separate act: replay it over every device’s recent history, read what it would have done, then arm it. Make root and Save refuse to do it for you. Stop sending readings to a chain always works.

The replay runs on the server in the background, one at a time, and is held in memory: a restart loses a replay that was still running, and this panel says so. The report it writes is kept, hashed, and cannot be edited. A report arms only exactly the chains it replayed, and only for a day after its window ended.

Describe what a rule chain should do and the AI layer drafts one. A draft does nothing. It is checked by the chain service’s own validator, then reviewed by the platform — sixteen fixed checks that do not ask the model — and the model’s own notes are added beside them, marked as its own. Every finding needs a resolution in your words before it can be approved.

Approving saves a new chain. It does not arm it. An approved chain is not the root and no reading reaches it until somebody arms it on Rule chains, after replaying it over recent history. Everything the model wrote is shown as text and never run on this page.

A destination is a place outside this platform that a rule chain may send to. A chain names a destination and never holds its address or its credential; the credential is kept in the secret store and is never shown again — not here, not in a chain, not in an export.

Every destination says what it does when it is called, and you choose:
• data-feed — this platform tells another system what it observed (a warehouse, a dashboard, a message channel). Rule chains may send to it.
• actuation — the other system does something in the world when called: opens a valve, moves a barrier, sounds a siren. No rule chain can reach it. It is reached only by a response proposal that a named person has authorised.

The platform cannot verify which one a destination really is. It cannot tell a gateway that opens a valve from one that stores a reading. What it does is record that you declared it, under your name, and keep that record. Declaring an actuation endpoint as a data feed lets every chain in this tenant drive it.

Most specific wins, and the order is fixed. A route for one vertical’s one alarm type beats a route for everything that vertical raises, which beats a route for every vertical in this tenant, which beats the deployment-wide setting. The order is a property of the KEY, never of when a row was written — so re-stating the tenant-wide default cannot silently un-route the one alarm type that had its own roster, and what you read here is what happens.

What this does NOT change. It decides where a notice goes and nothing else. No threshold moves. No severity moves — the thing that raised the alarm counted the vehicles or read the gauge, and a configuration screen cannot make an alarm more alarming than its raiser said it was. Nothing here raises an alarm, clears one, acknowledges one, or changes a word of what the message says.

And if nobody picks it up. The chase is the GROUP’s own escalation policy, set above. This table is what lets the escalation sweep find that group again an hour later — which it could not do before, because the group is not written on the alarm. The widens to column is read off each group’s policy, so a group with no policy is shown as what it is: an alarm announced once and never chased.

Stopping is recorded like starting. Withdrawing a route writes a new version carrying whoever withdrew it. Nothing here is ever edited or deleted, because the question this table gets asked is “an advisory was raised at 02:40 and nobody came — who was it meant to reach?”, and that is asked after somebody has already fixed it.

One-way, explicit, and a platform decision: neither side of an agreement can authorise it alone. These could be created through the API and then seen by nobody, including whoever created them. Revoking is recorded rather than deleted, because that data was shared for a period stays true after the sharing stops.
No data share yet moves anything. Nothing on this platform serves one tenant's rows to another under one of THESE agreements, so a share here authorises a flow that does not exist. It is the gate a future one has to pass through, not a switch that is currently on.
Corrected 24 Sep 2026. This paragraph used to say that nothing reads across tenants at all, and CIV-080 made that untrue. There is now exactly one cross-tenant read on the platform: a state or regional parent's consolidated view of its cities' AGGREGATE figures (CIV-053), authorised by the relation on the Tenants screen rather than by a share here, carrying counts and no rows. Leaving the old sentence standing would have been this console asserting an isolation property the platform no longer has in that absolute form.

What is being decided. The states a track’s path is drawn from — the positions, velocities and headings a replay reconstructs a history out of. Retention is enforced by dropping WHOLE MONTHLY PARTITIONS with DROP TABLE: there is nothing to undelete, no count of what went, and a replay over a destroyed month draws the hole rather than a shorter path that looks complete.

Decided by is the AUTHORITY, not you. It is the instrument the number comes from — the regulation, the contract clause, the ministerial instruction — in your own words, because no list of the world’s retention instruments exists. It is copied onto every eviction record, so “under which decision was this month destroyed” has an answer. There is no name field on this form: the person recording a decision is read from the verified session and goes into the audit trail and the chain of custody.

There is no suggested number on this screen. Not in the field, not as a placeholder, not as a “recommended” beside it. A number this platform offered would be the number every deployment accepted, and what it decides is how much of a track’s recorded path is destroyed.

A change is a new version, and it can only be made LONGER. Recording again writes a new version carrying the new authority; nothing here is ever edited or deleted, because the question this record gets asked is “what was the retention when those states were evicted” and it is asked afterwards. A SHORTER window is refused: every state older than the new window and newer than the old one was protected a moment ago and would become evictable at the next sweep, and there is no instant at which switching destroys nothing — so no delay makes it safe. Destroying states this platform already holds is an erasure act, which is audited and refuses under a legal hold.

Device profiles, the Modbus and SNMP tag maps, server-scope calibration, alarm rules and the edge assignments — captured together and restored together.

“Point-in-time” is not what this promises, and the document says so. The five components live in five stores with no isolation between them, so everything is read, read again, and compared. If anything moved in between the capture is refused and names what moved. That is weaker than snapshot isolation and it is written into every document as reread-verified rather than dressed up.

A restore installs every component or none. It runs as one unit of work, not component by component with an undo — an undo can itself fail, and a restore that reports success having put back four of five things is worse than one that refuses, because the operator walks away. Take the dry run first: it names everything that would change and carries a digest, and the restore refuses if anything has moved since.

A restore moves this centre’s generation and nothing else, so every site reads as pending until it calls in and says what it is running.

A model artefact is compiled for something. An int8 graph built for a neural accelerator does not run slowly on a plain processor — it fails to load. So which sites may receive which model version is a question about hardware, and it is answered here rather than at the cabinet.

A site nobody has described receives nothing. Not even a plain-CPU model. An undeclared node is not a node somebody decided was ordinary; it is a node nobody has looked at, and assuming a processor for it puts an artefact on the one board whose hardware is unknown while the rollout reports success. Declare it and it joins the next plan.

Two columns, and only the first decides anything. Declared is what an operator has stated; cabinet reports is what the node’s own probe found. A node may not widen its own capability — it could then pull an artefact it cannot run — but a cabinet that contradicts its declaration is withheld rather than sent on, and a cabinet reporting more than its declaration is the row that says go and re-declare it.

Per-unit task progress, idle time and the blocked ladder, folded from the flight recorder rather than reported by the robots.

A unit is escalated when its machine is in ESCALATED — not when this page works out that a deadline has passed. Those are two different facts and both are shown: the second, escalation due, means the sweep is late, which is something to see rather than something to paper over.

An intervention rate over a truncated page is not a rate. If any unit’s transition page was cut short the figure is withheld and says which units were truncated. No missions in the window is not a rate of zero either.

Nobody’s name appears on this screen. The recorder carries who moved each unit and it has to; a fleet screen is about places, assets and patterns (PRD-001).