ISS-049: operator writes audited per AUDIT_INFO; mode buttons on CIENG_Tank, 19b_audit_item_df

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/audit-trail/tasks/configure-audit.md

@@ -2,7 +2,7 @@
 task: Choose what AUDIT Service stores (classifier STORAGE, AUDIT_INFO), define selection groups, run an event logger (ADTLOG)
 version: R1.03
 source: IM 36K10L25-01EN §2.4, §3, §4.2, App. 1; practiced on CI-Eng-Sample 2026-10-01
-status: verified (operator-side ITEM.* value events from docs, ISS-049)
+status: verified (PROCESS-side ITEM.* events from docs)
 ---
 
 # Configure the audit trail
@@ -33,12 +33,17 @@ switching anything off.
 
 ### Item option *Audit trailing wanted* (`AUDIT_INFO`)
 
-`ITEM_DF` / `SUB_ITEM_DF` / `EXTERNAL_ALARM_DF` field `AUDIT_INFO` (default 0). It did **not**
+`ITEM_DF` / `SUB_ITEM_DF` / `EXTERNAL_ALARM_DF` field `AUDIT_INFO` (default 0). It switches the
-change what the tested tools record: DSS and Engineering Module value writes are audited for all
+`ITEM.*` / `SUB-ITEM.*` events raised by ITEM Service for **operator writes**. Verified on
-items, `itmval -p` for none. It is meant for the `ITEM.*` / `SUB-ITEM.*` classifiers (value,
+`CI-Eng-Sample.PUMP1.MODE` with the buttons on display `CIENG_Tank`:
-status, limits) raised by ITEM Service for operator and PROCESS writes; PROCESS (`COMPUTE`) also
+- `AUDIT_INFO` 1: a button write 0 → 1 stored `ITEM` `VALUE` `MODIFY` `OPER-INTERFACE`, user
-needs `AUDIT = YES` in `tls\sup\opc.sup` (installed `NO`) and its classifiers are off by default.
+  `ADMIN`, old 0 / new 1, plus `ITEM` `STATUS` `MODIFY` (13 → 9).
-Not verified (ISS-049).
+- `AUDIT_INFO` 0: the write 1 → 0 left **no** audit record.
+
+It does not affect DSS writes (`dssqld`, Engineering Module: always audited as `ITEM_VAL`
+dataset events) or `itmval -p` (never audited). Sample: `19b_audit_item_df.qli` (`dssqld -m`,
+`NAME,AUDIT_INFO`). PROCESS writes (`COMPUTE`) also need `AUDIT = YES` in `tls\sup\opc.sup`
+(installed `NO`) and their classifiers are off by default; not tested.
 
 ## 2. Selection groups
 

.claude/skills/audit-trail/tasks/read-audit-trail.md

@@ -35,11 +35,11 @@ Read-only. Dataset `AUDIT_TRAIL` (storage group `ADT`); every field is read-only
 | Engineering Module: change an item field | `ITEM_DF` `<FIELD>` `MODIFY`, source `LOC-ENG-MOD`, user `ADMIN` (the logged-in user) |
 | Engineering Module: right-click item › *Update value* | `ITEM_VAL` `ITEM_VALUE_STR` `MODIFY` (old/new) and `ITEM_VAL` `STATUS` `MODIFY`, source `LOC-ENG-MOD` |
 | Engineering Module / Operator / OPC UA server login | `CI-SERVER` `LOGIN` / `LOGOUT`, source `LOC-ENG-MOD`, `OPER-INTERFACE`, `VIA-OPC-UAS` |
+| Operator display write (button / input) on an item with *Audit trailing wanted* (`AUDIT_INFO` 1) | `ITEM` `VALUE` `MODIFY` `OPER-INTERFACE` (old/new) and `ITEM` `STATUS` `MODIFY`, user = operator; with `AUDIT_INFO` 0 **nothing** |
 | `itmval -p` (ITEM Service API) | **nothing**, even with `AUDIT_INFO` 1 |
 
-The `ITEM.VALUE.MODIFY.*` style classifiers (subject `ITEM`) were not produced by any of these
+So `AUDIT_INFO` matters only for operator (and PROCESS) writes; DSS changes are always
-tools; they are expected from operator displays and PROCESS Service on items with
+audited. The `SUBJECT_SOURCE` of a user interface comes from its *audit
-`AUDIT_INFO` 1 (open: ISS-049). The `SUBJECT_SOURCE` of a user interface comes from its *audit
 trail id* in `dssana.sup` `USER_INTERFACE` (Engineering Module = `LOC-ENG-MOD`).
 
 ## 3. Export

.claude/skills/graphics/tasks/create-display.md

@@ -38,6 +38,12 @@ grep -n "<html>\|<width>\|<height>\|itemName\|itemId\|<source" <DisplayName>.xml
 - `<html>true</html>` = HTML mode; `<width>`/`<height>` must be set for the HTML display.
 - Item connections: `<itemName>` + `<itemId>` (node.group.number…); trend pens:
   `<source type="sourceID" uri="ci:/item/<item>"/>` (`uri=""` = empty pen).
+- Write a fixed value with a button (verified in the HTML display, `CIENG_Tank` *Manual (0)* /
+  *Auto (1)*): `<button>` › `<data>` › `<action type="actionSetItemAttribute">` with
+  `<event type="event" event="On action"/>`, `<filter type="filter"><value>1.0</value></filter>`
+  and a `<connection>` with `<direction>2</direction>`, `<itemName>`, `<itemAttribute>ItemValue`
+  (the factory popups use `ItemValueOW`, presumably the overwrite variant like `itmval -o`; not tested). The factory popup `AOG_SetNumberPV` uses the
+  same action behind its *Apply* button.
 - After the item is deleted and loaded again it gets a **new id**; the display still validates,
   but on 2026-10-01 the HTML display showed **0** and the popup `ITM-E-NO_MAIN, No main item
   found` for a number field whose stored `<itemId>` was stale, also in a fresh session. Deleting

examples/CI-Eng-Sample/19b_audit_item_df.qli

@@ -0,0 +1,15 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample: switch on "Audit trailing wanted" (AUDIT_INFO) for PUMP1.MODE (loaded with
+! dssqld -m). Operator writes from a display (buttons Manual (0) / Auto (1) on CIENG_Tank) are
+! then stored as ITEM.VALUE.MODIFY.OPER-INTERFACE with old and new value; with AUDIT_INFO 0 they
+! are not audited at all. Changes through DSS (dssqld, Engineering Module) are audited anyway.
+@FIELDS
+NAME,AUDIT_INFO
+
+@ITEM_DF
+"CI-Eng-Sample.PUMP1.MODE",1

examples/CI-Eng-Sample/README.md

@@ -110,7 +110,8 @@ New items start with status 13 (`NOT INIT`) until a value is written.
 | `equipment/eqpciengslv_start.cmd`, `_stop.cmd` | Start/stop the Modbus slave mirror (copy to `tls\com`) |
 | `76_`…`93_remove_*.qli` | Names to delete, in reverse order (audit `79`, reports and printer `83`/`84` first, alarm definitions last, `93`) |
 | `load.cmd`, `remove.cmd` | Run the steps in the right order |
-| `displays/CIENG_Tank.xml` | Display (HTML mode): title, number field on `TANK1.LEVEL`, alarm overview, trend of `TANK1.LEVEL`, button *Operator layout* |
+| `displays/CIENG_Tank.xml` | Display (HTML mode): title, number field on `TANK1.LEVEL`, `PUMP1.MODE` field with buttons *Manual (0)* / *Auto (1)* (write the item), alarm overview, trend of `TANK1.LEVEL`, button *Operator layout* |
+| `19b_audit_item_df.qli` | *Audit trailing wanted* for `PUMP1.MODE` (loaded with `dssqld -m`) |
 | `displays/CIENG_Menu.xml` | Navigation display (200 x 700): *Tank 1*, *Current Alarm* (main frame), *Tank 1 popup* (layout `popup`) |
 | `layouts/CIENG_Operator.xml`, `layouts/layout.ps1` | Operator layout block and the script that adds/removes it in `Layouts.xml` |
 | `displays/deploy_displays.cmd`, `remove_displays.cmd` | Copy the displays into the operator interface and export their HTML versions / delete them |
@@ -205,6 +206,9 @@ Engineering Module is in the audit trail (skill `audit-trail`):
 
 - Generate `CIENG_AUDIT` (ad hoc, like the other reports) to list the last hour of changes on
   `CI-Eng-Sample.*`: time, dataset, field, action, source, user, old and new value.
+- Operator writes: with the displays deployed, click *Manual (0)* / *Auto (1)* on `CIENG_Tank`;
+  each click is stored as `ITEM.VALUE.MODIFY.OPER-INTERFACE` because `PUMP1.MODE` has *Audit
+  trailing wanted* (`19b_audit_item_df.qli`).
 - Export: `dssqld -e audit.qlo -d AUDIT_TRAIL` (whole trail) or a qli with `@SELECT` (keep `NAME`
   in `@FIELDS`).
 - Event logger (optional, admin): copy `audit\adtlogci.sup` to `%TLS_ROOT_PATH%\tls\sup\`, then

examples/CI-Eng-Sample/displays/CIENG_Tank.xml

@@ -70,7 +70,7 @@
       <htmlId>1</htmlId>
       <name>Layer1</name>
     </visualizationLayer>
-    <componentCountHint>5</componentCountHint>
+    <componentCountHint>9</componentCountHint>
     <text type="componentData">
       <htmlId>7</htmlId>
       <value>CI-Eng-Sample Tank 1</value>
@@ -487,5 +487,70 @@
         </action>
       </data>
     </button>
+    <text type="componentData">
+      <htmlId>12</htmlId>
+      <value>Pump 1 mode (0 manual, 1 auto)</value>
+      <stroke type="stroke" width="1.0"/>
+      <keepOriginalSize>true</keepOriginalSize>
+      <x>330.0</x>
+      <y>120.0</y>
+      <top>5.3125</top>
+      <bottom>5.3125</bottom>
+      <left>90.0</left>
+      <right>90.0</right>
+      <rotation>0.0</rotation>
+      <shear>0.0</shear>
+    </text>
+    <numberField type="componentData" x="480.0" y="120.0" top="16.0" bottom="16.0" left="30.0" right="30.0" rotation="0.0" shear="0.0">
+      <htmlId>13</htmlId>
+      <data type="data">
+        <action type="actionConnectTo">
+          <property type="property" name="numberField.value"/>
+          <filter type="filter">
+            <value>0.0</value>
+          </filter>
+          <connection type="connection">
+            <itemName>CI-Eng-Sample.PUMP1.MODE</itemName>
+            <itemAttribute>ItemValue</itemAttribute>
+          </connection>
+        </action>
+      </data>
+    </numberField>
+    <button type="componentData" x="590.0" y="120.0" top="16.0" bottom="16.0" left="56.0" right="56.0" rotation="0.0" shear="0.0">
+      <htmlId>14</htmlId>
+      <label>Manual (0)</label>
+      <data type="data">
+        <action type="actionSetItemAttribute">
+          <event type="event" event="On action"/>
+          <filter type="filter">
+            <value>0.0</value>
+          </filter>
+          <connection type="connection">
+            <direction>2</direction>
+            <location type="nodeName" node="$default$"/>
+            <itemName>CI-Eng-Sample.PUMP1.MODE</itemName>
+            <itemAttribute>ItemValue</itemAttribute>
+          </connection>
+        </action>
+      </data>
+    </button>
+    <button type="componentData" x="716.0" y="120.0" top="16.0" bottom="16.0" left="56.0" right="56.0" rotation="0.0" shear="0.0">
+      <htmlId>15</htmlId>
+      <label>Auto (1)</label>
+      <data type="data">
+        <action type="actionSetItemAttribute">
+          <event type="event" event="On action"/>
+          <filter type="filter">
+            <value>1.0</value>
+          </filter>
+          <connection type="connection">
+            <direction>2</direction>
+            <location type="nodeName" node="$default$"/>
+            <itemName>CI-Eng-Sample.PUMP1.MODE</itemName>
+            <itemAttribute>ItemValue</itemAttribute>
+          </connection>
+        </action>
+      </data>
+    </button>
   </coreObjectDefinition>
 </visualization>

examples/CI-Eng-Sample/load.cmd

@@ -44,3 +44,5 @@ dssqld -i 17_printer_df.qli -l 17_printer_df.qlo
 dssqld -i 18_report_df.qli -l 18_report_df.qlo
 rem Audit trail: selection group (compiled on load) and an ad-hoc audit report.
 dssqld -i 19_audit_df.qli -l 19_audit_df.qlo
+rem Audit trailing wanted for PUMP1.MODE (modify existing record)
+dssqld -m 19b_audit_item_df.qli -l 19b_audit_item_df.qlo

knowledge/issues.md

@@ -68,7 +68,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-046 | 2026-10-01 | DATABASE (`dssqld` memo) | A memo field loaded from a file (`@"<file>"@`, IM 36K10L50 §3.10) fails with a relative name (`CRL-E-ENOENT`, the file is read on the server side) and with a long absolute path (`DSSG-E-STRBUFSMAL`, buffer 83); a short absolute path works. The manual gives no limits. | closed | Documented: use inline memos, or an absolute path ≤ 82 characters. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/dss-tools.md` §2; `knowledge/manuals/IM36K10L50-01EN.md` §4 |
 | ISS-047 | 2026-10-01 | REPORT (RQL manuals) | The manuals disagree: default `@WORKSPACE` 500 KB (IM 36K10R40 §2.2.2) vs 16 KB (IM 36K10C30 table 2.1-1, IM 36K10P20 §9.6); maximum `@WIDTH` 512 (R40, P20 §4) vs 5000 (P20 §9.6); `@FORMFEED` described with opposite meanings (C30: not 1 = form feed; P20: 0 = blank lines, default 1). Installed set-up files set `@workspace` explicitly (500 in `rptge1.rpt`, 100 in `rptgen.rpt`) and `@formfeed 0` for the interactive generator. | closed | Not tested (no printer); the set-up files make the defaults irrelevant in practice. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10R40-01EN.md` §2; `knowledge/manuals/IM36K10P20-01EN.md` §3 |
 | ISS-048 | 2026-10-01 | REPORT (ad-hoc parameters) | The prompt `[ITEM:NAME like "CI-Eng-Sample.TANK1.*"]Item for statistics:` (filter form as in IM 36K10C30 §2.1) gives an item tree browser in the Engineering Module generate dialog, but the tree shows all sections, not only `TANK1` items (checked by the user). | open | Answered 2026-10-01 with a temporary report (removed), checked by the user: the filter is an `ITEM_DF` filter joined with `AND` to each tree node. It **does** limit the items: with `NAME like "CI-Eng-Sample.TANK1.*"` only TANK1 items (incl. `CALC.VOLUME`, `JFLOW.sPerMin`, `LEVEL.MAX`) appear and can be picked; sections and objects always stay in the tree, which is what the first check saw. `NAME like "*.L*"` and `DESCRIPTION like "Tank 1*"` also work; `%` is not a wildcard, `NAME = "….*"` matches nothing, `SECTION = …` gives `DSS-E-FLT_SYN_ERR`. Ready to close. | `.claude/skills/reporting/tasks/define-reports.md`; `knowledge/manuals/IM36K10C30-01EN.md` §2; `examples/CI-Eng-Sample/18_report_df.qli` comment |
-| ISS-049 | 2026-10-01 | AUDIT (item option *Audit trailing wanted*) | IM 36K10G10 ch. 9 and the classifier list (IM 36K10L25 App. 1, `ITEM.VALUE.MODIFY.<source>`, `ITEM.HIGH-LIMIT…`) suggest item changes are audited per item when `AUDIT_INFO` = 1. On R1.03.00 none of the tested tools produced an `ITEM.*` event: `itmval -p` writes are not audited at all (with `AUDIT_INFO` 0 or 1); value writes through DSS (`dssqld -m ITEM_VAL`) and Engineering Module *Update value* are audited as dataset events (`ITEM_VAL`, `ITEM_VALUE` / `ITEM_VALUE_STR` / `STATUS`) for every item regardless of `AUDIT_INFO`. Operator-display writes and PROCESS writes (`opc.sup` `AUDIT = YES`, `COMPUTE` classifiers off by default) were not tested (no input field in the sample displays). | open | Test an operator value input on an item with `AUDIT_INFO` 1 (needs a display with an input field) and, if wanted, PROCESS with `AUDIT = YES`. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `.claude/skills/audit-trail/tasks/read-audit-trail.md` §2; `knowledge/manuals/IM36K10L25-01EN.md` §3 |
+| ISS-049 | 2026-10-01 | AUDIT (item option *Audit trailing wanted*) | IM 36K10G10 ch. 9 and the classifier list (IM 36K10L25 App. 1, `ITEM.VALUE.MODIFY.<source>`, `ITEM.HIGH-LIMIT…`) suggest item changes are audited per item when `AUDIT_INFO` = 1. On R1.03.00 none of the tested tools produced an `ITEM.*` event: `itmval -p` writes are not audited at all (with `AUDIT_INFO` 0 or 1); value writes through DSS (`dssqld -m ITEM_VAL`) and Engineering Module *Update value* are audited as dataset events (`ITEM_VAL`, `ITEM_VALUE` / `ITEM_VALUE_STR` / `STATUS`) for every item regardless of `AUDIT_INFO`. Operator-display writes and PROCESS writes (`opc.sup` `AUDIT = YES`, `COMPUTE` classifiers off by default) were not tested (no input field in the sample displays). | open | Answered 2026-10-01: buttons *Manual (0)* / *Auto (1)* added to `CIENG_Tank` (`actionSetItemAttribute`, `ItemValue`). With `AUDIT_INFO` 1 a click stored `ITEM.VALUE.MODIFY.OPER-INTERFACE` (user `ADMIN`, 0 → 1) and `ITEM.STATUS.MODIFY` (13 → 9); with `AUDIT_INFO` 0 the next click (1 → 0) stored nothing. So *Audit trailing wanted* controls operator-write audits; DSS changes are always audited, `itmval` never. Sample: `19b_audit_item_df.qli`. PROCESS with `AUDIT = YES` not tested. Ready to close. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `.claude/skills/audit-trail/tasks/read-audit-trail.md` §2; `knowledge/manuals/IM36K10L25-01EN.md` §3 |
 | ISS-050 | 2026-10-01 | AUDIT (classifier `STORAGE`) | Setting `AUDIT_EVENT_CLAS_DF.STORAGE` = 0 for `DATASET.NULL-ATTR.MODIFY.ENT-ENG-MOD` at 17:01:12 did not stop the next `dssqld -m ITEM_VAL` change from being stored (17:01:12.573). IM 36K10L25 §3.2 explains a per-process cache refreshed every `ECL_REFRESH` s (default 1800); the notifier here is `DSSSDA`, so the change should apply within 30 minutes. | closed | Re-tested: at 17:32:18 (after the 30-minute refresh) the same change was **not** stored, so the flag works with a delay. Set back to 1 at 17:32; the next change was still not stored (the cache works in both directions). Documented: allow up to `ECL_REFRESH` (1800 s) or restart CI Server. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `knowledge/manuals/IM36K10L25-01EN.md` §3 |
 | ISS-051 | 2026-10-01 | AUDIT (manual vs installed) | Differences between IM 36K10L25 and R1.03.00: (1) App. 1 lists subject `F/T-SYSTEM`, the installed classifiers use `CI-SERVER` (logins) and also `EAL OPERATION` (subject and action) and source `VIA-OPC-UAS`, not in the manual; 463 classifiers installed. (2) App. 1 explanations of `SHELVE` and `UN-SHELVE` are swapped. (3) `QUESIZE`: manual default and maximum 200 kB, `adtsys.sup` help default 10 kB, minimum 10 (file sets 200). (4) `TIMEFMT` default: manual `DD/MM/YY hh:mm:ss.ppp`, `adtsys.sup` help without `.ppp`; `ADTLOG` output shows milliseconds (manual right). (5) `dssqld` changes are recorded with source `ENT-ENG-MOD`, not `QUICKLOAD`. (6) The selection expression language is not described in the manual; the compiler listing gives the words and operators (no `LIKE`). (7) `ADT` group lifetime 52 weeks on the test system vs 2 days default when `ADTSTO` creates it (§2.1.1). | closed | Documented in the L25 summary and the `audit-trail` skill. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L25-01EN.md`; `.claude/skills/audit-trail/tasks/*.md` |
 | ISS-052 | 2026-10-01 | GRAPHICS (stale item id) | The HTML display `CIENG_Tank` showed **0** in its number field on `CI-Eng-Sample.TANK1.LEVEL` (live value 50) and the popup `ITM-E-NO_MAIN, No main item found`, in a fresh session after a CI Server restart. The display XML stores `<itemName>` **and** `<itemId>1.1.268.0.0.1.1.7</itemId>` from when it was built; after today's sample reloads the item has `ID_NUMBER` 357. Phase 10 had seen live values after a reload, so the id is not always used, but here it broke the field. | open | Fixed in the sample: removed the `<itemId>` line from `displays/CIENG_Tank.xml`, redeployed; the field shows 50 and the popup is gone (binding by name). Documented in `create-display.md`. Close when the user confirms. | `examples/CI-Eng-Sample/displays/CIENG_Tank.xml`; `.claude/skills/graphics/tasks/create-display.md`; `.claude/skills/graphics/tasks/deploy-displays.md` |

knowledge/manuals/IM36K10L25-01EN.md

@@ -81,8 +81,9 @@ as *dataset* events — `SUBJECT_GROUP` = dataset name (`ITEM_DF`, `ITEM_VAL`, `
 (not `QUICKLOAD`), `LOC-ENG-MOD` for the Engineering Module; every `dssqld` run also adds a
 `CI-SERVER` `LOGIN`/`LOGOUT` pair. `itmval -p` writes are not audited. The item option
 `AUDIT_INFO` (*Audit trailing wanted*, default 0; also on `SUB_ITEM_DF`, `EXTERNAL_ALARM_DF`) made
-no difference for these tools; it is meant for the `ITEM.*` classifiers from operator/PROCESS
+no difference for these tools; it switches the `ITEM.*` events of **operator writes**: a button on
-writes (not tested, ISS-049). A changed `STORAGE` flag takes effect only after the notifying process
+display `CIENG_Tank` stored `ITEM.VALUE.MODIFY.OPER-INTERFACE` (old/new, user) with
+`AUDIT_INFO` 1 and nothing with 0 (verified, ISS-049). A changed `STORAGE` flag takes effect only after the notifying process
 re-reads it (`ECL_REFRESH`, up to 30 minutes, both directions; verified, ISS-050).
 
 ## 4. Setup files (§4.2)