When something goes wrong, you already have the shift.
Reconstructing a critical incident can take days: the historian, the alarm log, and three people’s memory of a shift that ended two weeks ago. With recording enabled, ArcUI keeps that operational record in a session you can open and replay, with who or what did what and when already in it.
Per value
Every value carries its own history.
Writer
Who or what produced it: an operator in XR, an instrument, an external system, ARIA.
Time
When it arrived, in the order it arrived.
Rule
The contract rule evaluated against it. In strict Operations an unauthorized write is refused with an explicit reason and does not reach the DataStore.
Link
A write that answers an alarm carries the alarm it answers, so response and cause stay attached.
Per session
One folder per session, and it is yours.
Journal
Append-only. While recording is armed, every value, action and intervention in the order it happened.
Manifest
A SHA-256 hash per file, signable for tamper-evident custody. Later modification is detectable.
Replay
Plays back inside the twin with the original sequence and timing — not a video of it.
Portable
A directory on disk. It reads without our servers and without a licence.
Agents
An agent in the loop is recorded like anyone else.
Internal
ARIA proposes actions through tool calls. An operator authorizes them before any governed action is dispatched.
External
AI clients reach the twin over MCP. Authenticated requests and exact responses served during an active bundle are journalled without copying authorization headers.
No exception
A write that reaches the DataStore is attributed. A governed action that is refused is recorded; a write blocked for lack of authority returns an explicit reason before it changes state. A safety-policy refusal is recorded as a safety intervention.
One recorded chain - 5 August 2026
Proposed, authorized, dispatched, confirmed.
Four events from one sealed bundle, five seconds apart, joined by a single decision id. An external agent asked, a person decided, the plant answered. This is a record of a run, not a description of what the system would do.
18:44:00 · proposed
An external client proposed the declared action engage_brake over MCP. Nothing was written: the bridge queues a proposal and never executes one.
18:44:05 · authorized
A person answered the card in the headset. The record names who proposed it, and carries confidence Unrated - no declared correlation backed an external proposal, so the field says that instead of filling it in.
18:44:05 · dispatched
WindTurbine_01.Brake_Command set to 2, attributed to the operator who authorized it rather than to the agent that asked for it.
18:44:05 · confirmed
The action declares an expected effect. ArcUI read WindTurbine_01.Brake_Status, observed 2, and recorded the outcome confirmed. An effect that does not hold inside its window is recorded as not confirmed and raises a warning on the panel.
Which equipment or process would you like to improve?