Merge pull request 'Phase 4: CI Portal setup, Setup File Editor, portal-setup skill' (#4) from docs/phase-4-portal-setup into main

Reviewed-on: cliu/ci-server-config#4
2026-09-30 16:45:45 +10:00 · 2026-09-30 16:45:45 +10:00 · 95f0131a95
commit 95f0131a95
parent 9cc154e7a7 84181711b8
8 changed files with 538 additions and 2 deletions
--- a/.claude/skills/portal-setup/SKILL.md
+++ b/.claude/skills/portal-setup/SKILL.md
@ -0,0 +1,39 @@
+---
+name: portal-setup
+description: >-
+  CI Server R1.03 CI Portal, CI View and setup files. Use when the user wants to read, check
+  or change a setup file (.sup) or use the Setup File Editor, write setup file metadata
+  (!KEYWORD, !TAB, !ARG), choose between CI Portal and CI View, set up a CI Portal node
+  (dur.sup host node, copying displays), check the Remote Connect web page or web ports
+  (8080/8443), or tune the operator interface, Engineering Module or Edit Module
+  (jwuiisg.sup, jhmiset.sup, jwuiged.sup) and the WFL processes (wflidi, wfladi, wflcdi,
+  wflgdi, wfla_display), e.g. display cache time, flow control, alarm overview event types.
+  Sources IM 36K10R10-01EN and IM 36K10R20-01EN.
+---
+
+# CI Portal and setup files (R1.03)
+
+Background: `knowledge/manuals/IM36K10R10-01EN.md` (CI Portal Setup: processes, CI Portal vs
+CI View, every user-interface setup file and keyword) and
+`knowledge/manuals/IM36K10R20-01EN.md` (Setup File Editor and metadata keywords).
+Remote Connect installation and firewall: skill `installation-security`.
+
+Rules:
+- Run the `system-check` skill first.
+- Reading setup files is always allowed. Changing one alters CI Server behaviour after the
+  next restart: follow the user's chosen way of working, back up the file first, and
+  confirm before restarting CI Server. In *prepare only* mode, write the changed file to
+  the user's chosen folder and give the deploy steps.
+- Normally only the logon method needs changing in the user-interface setup files; treat
+  other changes as tuning.
+
+| Task | File | Status |
+|---|---|---|
+| Read a setup file: active settings and keyword help | `tasks/read-setup-file.md` | verified (read-only) |
+| Change a setup file safely (back up, edit, restart, verify, restore) | `tasks/change-setup-file.md` | verified |
+| What the Setup File Editor shows for a file (tabs, fields, Changed status) | `tasks/read-setup-file.md`, R20 summary §2 | verified (compared in the GUI) |
+| Login method / login control (moved to `dssana.sup`) | not covered yet (ISS-017) | — |
+| Check web access for CI View (ports, Remote Connect page, `DEPLOY` folder) | `tasks/check-web-access.md` | verified (read-only) |
+| Choose CI Portal or CI View; set up a separate CI Portal node | R10 summary §2–3 | from docs (needs a second node) |
+| Operator interface does not show a changed display/item (cache) | R10 summary §1 | from docs |
+| Write metadata for a custom setup file | R20 summary §3 | from docs |
--- a/.claude/skills/portal-setup/tasks/change-setup-file.md
+++ b/.claude/skills/portal-setup/tasks/change-setup-file.md
@ -0,0 +1,77 @@
+---
+task: Change a setup file safely
+version: R1.03
+source: IM 36K10R20-01EN §1–2; IM 36K10R10-01EN §4
+status: verified on the test system 2026-09-30 (jwuiisg.sup HTTP port 8080 → 8081 and back; wfla_display.sup queue size via the editor and Reset Field)
+---
+
+# Change a setup file safely
+
+Setup files are read only at startup, so every change needs a CI Server restart and should
+be reversible. Follow the user's way of working: in *prepare only* mode do steps 1–3 in the
+user's chosen folder and hand over steps 4–6.
+
+## 1. Read the current state
+
+Task `read-setup-file.md`: active lines and the keyword's `!KEYWORD` block (kind, unit,
+limits). Check the value the user wants is allowed (`!OPTIONS`: `pos`, `min`, `max`, list
+choices).
+
+## 2. Back up
+
+Copy the file before changing it, e.g. to `<name>.sup.<yyyymmdd>.bak` in a folder outside
+`tls\sup` (or keep the copy in the prepare folder). Writing to `tls\sup` needs
+administrator rights.
+
+## 3. Change the value
+
+Either way works:
+
+- **Setup File Editor** (Start menu *CI Server → Setup File Editor*): double-click the file,
+  change the field on its tab and click *OK*: **the file is written at once** (R1.03), so
+  back up before clicking OK. The changed field's label turns blue and the file's Status
+  becomes *Changed* (differs from its `!DEFAULT` block). Toggle Read Only must be off.
+  Keywords placed before the file's first `!TAB` line are on the *General* tab. To go back
+  to the default: cursor in the field, *Reset Field*, *OK*.
+- **Text edit**: change only the active line `KEYWORD = value`; keep the `!` lines, the
+  keyword spelling and the CRLF line endings. Add a line if the keyword is not active yet,
+  using the syntax in its `!KEYWORD` block. The `!DEFAULT` block holds a copy of each
+  line prefixed with `! `: do not change it, or the editor loses the real defaults.
+  Keep double quotes around string values (the editor shows them without quotes).
+  Elevated PowerShell example (active line only, file stays ASCII/CRLF):
+
+  ```powershell
+  $f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
+  $t = [IO.File]::ReadAllText($f)
+  $n = [regex]::Replace($t, '(?m)^NON_SECURE_PORT_NUMBER = \d+(?=\r?$)', 'NON_SECURE_PORT_NUMBER = 8081')
+  [IO.File]::WriteAllText($f, $n)
+  ```
+
+  From a non-elevated shell the write fails with "Access to the path … is denied".
+
+## 4. Restart CI Server
+
+Stop and start CI Server (skill `system-check`, needs administrator rights). Confirm with
+the user first: operator stations and data collection stop during the restart.
+
+## 5. Verify
+
+Check the new behaviour, not just the file (e.g. for a port change: task
+`check-web-access.md`). Check `%TLS_LOG_PATH%\ci_start.log` and `umhlog.log` for errors
+from the program that reads the file.
+
+## 6. Restore (if needed)
+
+Copy the backup back (or set the old value the same way) and restart again. Compare with
+the backup (`Get-FileHash`) to confirm the file is exactly as before.
+
+## Test system (2026-09-30)
+
+- `NON_SECURE_PORT_NUMBER` 8080 → 8081 by text edit, CI Service restarted (elevated):
+  8081 listening, `http://localhost:8081/` returned 200, 8080 refused, no new errors in
+  `ci_start.log`. Restored to 8080 the same way; file hash identical to the backup.
+- `wfla_display.sup` `DUR_QUEUE_SIZE` 1000 → 2000 in the Setup File Editor: *OK* wrote the
+  file at once, Status *Changed*, label blue. *Reset Field* + *OK* wrote 1000 back. Not
+  restarted in between, so never applied.
+- `Stop-Service`/`Start-Service StartCIServer` from a non-elevated shell fails with
+  "Cannot open StartCIServer service".
--- a/.claude/skills/portal-setup/tasks/check-web-access.md
+++ b/.claude/skills/portal-setup/tasks/check-web-access.md
@ -0,0 +1,54 @@
+---
+task: Check web access for CI View (read-only)
+version: R1.03
+source: IM 36K10R10-01EN §2.2, §3.4, §4.3; practiced on the test system 2026-09-30
+status: verified (read-only)
+---
+
+# Check web access for CI View
+
+Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is
+changed. CI Server must be running.
+
+## 1. Configured ports
+
+```powershell
+$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
+Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'
+```
+
+Defaults: HTTPS 8443, HTTP 8080.
+
+## 2. Ports are listening
+
+```powershell
+(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort
+```
+
+Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the
+ports were changed.
+
+## 3. Remote Connect page
+
+```powershell
+(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode
+```
+
+Expect `200`. This is the page CI View users open as `http://<node>:8080/` to download
+Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must
+allow both ports (skill `installation-security`).
+
+## 4. Displays deployed
+
+The operator interface serves displays from
+`%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (`components`, `displays`, `layouts`,
+`locales`, `symbols`, `thresholds`). On a separate CI Portal these must be copied from CI
+Core or another portal, and every portal needs the same copy.
+
+```powershell
+Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')
+```
+
+## Test system (2026-09-30)
+
+8080 and 8443 listening (one process), page returned 200, the six `DEPLOY` folders present.
--- a/.claude/skills/portal-setup/tasks/read-setup-file.md
+++ b/.claude/skills/portal-setup/tasks/read-setup-file.md
@ -0,0 +1,62 @@
+---
+task: Read a setup file (active settings and keyword help)
+version: R1.03
+source: IM 36K10R20-01EN §1, §3; IM 36K10R10-01EN §4; practiced on the test system 2026-09-30
+status: verified (read-only)
+---
+
+# Read a setup file
+
+Shows what the Setup File Editor would show, without opening it. Nothing is changed.
+
+## Where
+
+`%TLS_ROOT_PATH%\tls\sup\<name>.sup` (e.g. `C:\Program Files (x86)\Yokogawa\CIServer\tls\sup`).
+The file list with descriptions is what the Setup File Editor shows on start.
+
+## Active settings
+
+Lines that do not start with `!` are the settings in use:
+
+```powershell
+$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\wflidi.sup'
+Select-String -Path $f -Pattern '^\s*[^!\s]'
+```
+
+Example result (`wflidi.sup`, installed defaults): `FLOW_CONTROL = 30`, `TIMER = 20`,
+`SCAN_TIME = 0`, `RETRY_COUNT = 3`, `QUEUE_BUSY_LEVEL = 10`, `DUR_QUEUE_SIZE = 500`,
+`NODE = -1, 1000, 0.1, 30`, `LOCK_TIMEOUT = 60`.
+
+A keyword that has no active line uses the program's built-in default (see its help).
+
+## Meaning of a keyword
+
+Each keyword is described in a `!KEYWORD : …` block: label and unit (`!ARG1 = label,unit`),
+type (`!KIND`), limits (`!OPTIONS`) and help (`!HELP`/`!KEYHELP`). Show the block:
+
+```powershell
+Select-String -Path $f -Pattern '^!KEYWORD\s*:\s*TIMER\b' -Context 0,10
+```
+
+For `TIMER` this shows label *Clear cache after*, unit *sec*, kind *number*, option *pos*.
+
+## Tabs and description
+
+```powershell
+Select-String -Path $f -Pattern '^!(DESCRIPTION|TAB)\s*='
+```
+
+`!TAB` lines give the editor's tabs; a keyword belongs to the last `!TAB` above it.
+Keywords before the first `!TAB` appear on a *General* tab in the editor (checked on
+`wfla_display.sup`). Active values that differ from the `!DEFAULT` block show as Status
+*Changed* in the editor.
+
+## Notes
+
+- Use the Setup File Editor tabs and labels when talking to the user; the keyword names are
+  what is in the file. Keyword tables for the user-interface files are in
+  `knowledge/manuals/IM36K10R10-01EN.md` §4.
+- Trust the installed file over the manual. The alarm item/display relation file is
+  `wfla_display.sup` (the manual says `wfla_displays.sup`), and some installed values differ
+  from the manual's defaults (see `knowledge/issues.md` ISS-012 to ISS-015).
+- Some files have no `!DESCRIPTION`.
--- a/knowledge/issues.md
+++ b/knowledge/issues.md
@ -31,3 +31,9 @@ development system (see "Test system" in `progress.md`); they do not exist on ot

 | ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | open | Confirm with ITEM Service manuals (IM 36K10L35/L36) in phase 5: is there a scaling option for integrators? | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
 | ISS-011 | 2026-09-30 | ITEM (blocking) | A write to a blocked item with `itmval -p` (without `-o`) is silently ignored: no error message, value unchanged. | open | Check in phase 5 whether any status/return code signals this. | `.claude/skills/system-management/tasks/read-write-item.md` |
+| ISS-012 | 2026-09-30 | CI Portal setup files | IM 36K10R10 §4.4 names the alarm item/display relation setup file `wfla_displays.sup`; the installed file is `wfla_display.sup` (no `s`). | closed | Closed 2026-09-30 (user decision: the installed software and files are the reference). The repo uses `wfla_display.sup`. | `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/tasks/read-setup-file.md` |
+| ISS-013 | 2026-09-30 | CI Portal setup files | Installed values differ from the defaults stated in IM 36K10R10 §4.4: `wfla_display.sup` `DUR_QUEUE_SIZE = 1000` (manual 500 kB); `wflgdi.sup` `DUR_QUEUE_SIZE = 252` (manual 1000 kB); `wfla_display.sup` and `wflcdi.sup` set `TIMER_INTERVAL = 10` (manual: 1 s when not set). | closed | Closed 2026-09-30 (user decision: the installed software and files are the reference). The repo quotes the installed values as defaults. | `knowledge/manuals/IM36K10R10-01EN.md` §4 |
+| ISS-014 | 2026-09-30 | CI Portal setup files | `jwuiisg.sup` has a *Security* tab (`SECURITY_ENABLED`, `CORS_ENTRY`, `HEADER_ENTRY`) that IM 36K10R10 §4.3 does not describe. | closed | Closed 2026-09-30 (user decision: the installed software and files are the reference). Documented from the file's own `!KEYWORD`/`!HELP` text. Installed CORS allows all origins (`allowedOrigins "*"`); tightening it is a site security decision. | `knowledge/manuals/IM36K10R10-01EN.md` §4.3 |
+| ISS-015 | 2026-09-30 | Setup File Editor | In `wfla_display.sup` the seven main keywords (`RELATION_LOCATION` … `TIMER_INTERVAL`) come before the only tab line `!TAB = Debug`. By IM 36K10R20 §3.1, keywords before the first `!TAB` are not shown, yet IM 36K10R10 §4.4.1 shows them on a *General* tab. What the editor really shows is unknown. | closed | Closed 2026-09-30 (checked in the Setup File Editor by the user; installed software is the reference). The editor shows keywords placed before the first `!TAB` on a **General** tab, followed by the defined tabs: `wfla_display.sup` shows *General* (all 7 fields, values as in the file) and *Debug*. The manual's statement that such keywords are ignored does not hold in R1.03. | `knowledge/manuals/IM36K10R20-01EN.md` §3; `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/tasks/change-setup-file.md` |
+| ISS-016 | 2026-09-30 | Setup File Editor | The R1.03 editor has features IM 36K10R20 §2 does not describe: a *Templates* tab next to *Setup Files*; a *Status* column in the file list (e.g. "Default"); *Undo Field* and *Reset Field* buttons on the edit form besides OK/Cancel/Help; a status bar with the selected file's description and the time. | open | Installed software is the reference (user decision). 2026-09-30, tested on `wfla_display.sup` (`DUR_QUEUE_SIZE` 1000 → 2000): clicking **OK writes the file immediately** (only the active line changed; the manual says OK keeps the change in memory until Exit). Status becomes **Changed** when an active value differs from the file's `!DEFAULT` block; the changed field's label turns **blue**. *Reset Field* is enabled when the cursor is in a changed field; *Reset Field* + *OK* put the value back to the `!DEFAULT` value (2000 → 1000) and wrote the file at once (16:22:28); the rest of the file was unchanged. Still to find: what *Templates* holds and what *Undo Field* does. | `knowledge/manuals/IM36K10R20-01EN.md` §2; `.claude/skills/portal-setup/tasks/change-setup-file.md` |
+| ISS-017 | 2026-09-30 | CI Portal setup files | IM 36K10R10 §4 says the logon method is the one user-interface setting normally changed, but the R1.03 `jwuiisg.sup` *Information* tab says the login method and login control settings have moved to `dssana.sup` (authentication and authorization). `dssana.sup` is not described in R10. | open | Installed software is the reference. 2026-09-30: `dssana.sup` ("Authentication and authorization setup") has tabs General, User Interfaces, Clients System Trust, Login control (`LOGIN_METHOD = <client>, <user interface>, <method>, …`), Active Directory, Single Sign On, Password rules, Logging. Manuals mentioning it: IM 36K01A50 (5×), 36K10C10 (6×), 36K10J40 (13×), 36K10L45 (2×), 36K10L50 (3×). Cover it in phase 5 (C10) and phase 13 (J40). | `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/SKILL.md` |
--- a/knowledge/manuals/IM36K10R10-01EN.md
+++ b/knowledge/manuals/IM36K10R10-01EN.md
@ -0,0 +1,187 @@
+---
+manual: IM 36K10R10-01EN
+title: CI Portal Setup
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; setup file names, keywords and default values checked read-only on the test system (2026-09-30)
+---
+
+# CI Portal Setup (R1.03)
+
+How the user-interface programs reach CI Server data, when to use CI Portal or CI View, how
+to set up a CI Portal node, and the setup files of the user interface. Section numbers refer
+to the manual. "Seen on test system" values come from the R1.03.00 test machine
+(standalone node) and are the installed defaults there.
+
+## 1. User-interface processes
+
+**Operator interface (§1.1)**
+- A display is loaded by both the operator interface (`JWUIPOI`) and the Web-HMI server
+  (`JWUIISG`). Only the display being shown gets live updates.
+- `JWUIISG` does not talk to the CI Server processes directly; it goes through the four
+  **WFL** (Web Foundation Layer) processes on the local node:
+  - `WFLADI`: alarms
+  - `WFLIDI`: real-time item values and status
+  - `WFLCDI`: trend/history data
+  - `WFLGDI`: everything else
+- At startup `JWUIISG` reads the component descriptions (XML) in
+  `%TLS_WAP_PATH%\cfg\operatorInterfaces\deploy\components`.
+- Values and alarms are polled every 50 ms (`jwuiisg.sup`, *Tuning*). Configuration data of
+  items on the display (alarm colours, mnemonics, …) is **cached** while the display is
+  open and dropped 20 s after it closes (`wflidi.sup`, *Clear cache after*).
+- **Consequence:** after changing a display (Edit Module) or an item definition
+  (Engineering Module), the operator interface may still show the old data. To see the
+  change: close the display (or the operator interface) for longer than the cache time,
+  restart USER Service from the performance monitor, or restart CI Server. The Edit Module
+  has its own cache (e.g. List Items) that cannot be tuned.
+- From CI View (Remote Connect) the same processes are used; visualisation data passes
+  through a servlet.
+
+**Engineering Module / Edit Module (§1.2)**: opened on CI Portal they read displays and items
+directly from disk; opened from CI View they go through servlets (JDSS, JGIN) to the database.
+
+## 2. CI Portal and CI View
+
+**CI Portal (§2.1)** runs on the CI Core node or on its own node.
+- Needs the CI Server software, a **CI Portal licence** and a **DURM** connection to CI Core.
+- Runs BUS, DATABASE, USER and INTEGRATION Services locally.
+- Connects to **one** CI Core only (except in an enterprise configuration).
+- Advantages over CI View:
+  1. Quick load (`dssqld`) and other command-line tools can be used there (CI View only has
+     the Engineering Module).
+  2. Its own processes, DURM links and disks can be monitored (`int*.sup`).
+  3. After a HAC switchover DURM reconnects to the active server automatically; CI View must
+     be reconnected by hand to the active computer's IP address.
+  4. Display, symbol and layout files are local files (layouts can only be edited as text).
+- Costs: needs a dedicated computer; displays changed on one CI Portal must be copied to
+  every other CI Portal.
+
+**CI View (§2.2)** is any PC with **Remote Connect**, which runs the operator interface, Edit
+Module and Engineering Module as Java applications.
+- Download page: `http://<portal>:8080/`. Traffic is then secured over **8443** (HTTPS) by
+  default; ports are set in `jwuiisg.sup`. `http://localhost:8080/` on the portal itself is
+  not secure. Open both ports in the firewall.
+- Start-menu entries ask for the CI Portal host name or IP address; no port is needed.
+- Each CI Portal includes **one** USER Service client licence, i.e. one operator interface at
+  a time (on the portal or a CI View). More simultaneous operator interfaces need more client
+  licences. Edit and Engineering Modules from CI View need none.
+- CI View plays sound only from a display's sound component, not from ALDACO (which sounds on
+  the CI Core computer).
+
+**Choosing (§2.3)** — rules of thumb:
+
+| System | Recommendation |
+|---|---|
+| < 8000 I/O, no HAC, < 5 operator stations, no portal-only functions | CI View only |
+| < 8000 I/O with HAC | at least one CI Portal (on its own node, so CI Views need not follow switchovers), CI View for the rest |
+| Portal-only functions needed | CI Portal |
+| ≥ 8000 I/O | at least one CI Portal; one portal serves more than 25 CI Views |
+
+## 3. Setting up a CI Portal node
+
+1. Install from the CI Server DVD (setup always installs everything; §3.1).
+2. Apply the **CI Portal licence** with the License Authorization Wizard; the licence decides
+   the package (§3.2).
+3. Configure the DURM line to CI Core and set the **host node** (CI Core node number) in
+   `dur.sup` (`host_node`; 0 on a single-node system) (§3.3).
+4. Restart CI Server on the portal (§3.4).
+5. Copy the visualisations from CI Core or another portal into
+   `%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (sub-folders seen on test system:
+   `components`, `displays`, `layouts`, `locales`, `symbols`, `thresholds`).
+
+DURM lines and node layouts: `IM36K10J10-01EN.md` (system layouts) and phase 7 (BUS Service).
+
+## 4. User-interface setup files (§4)
+
+Edited with the Setup File Editor (`IM36K10R20-01EN.md`); normally only the logon method
+needs changing. Changes take effect after a restart of CI Server (the proxy service needs a
+CI Portal restart). All files are in `%TLS_ROOT_PATH%\tls\sup`.
+
+| File | Program | Tabs | Main keywords (seen on test system) |
+|---|---|---|---|
+| `jhmiset.sup` | Engineering Module | Item Search Utility, Report viewing and printing, Tuning | `JHMI_ISU_ONLY_PA = N` (item search limited to the user's process areas), `VIEW_FONT`/`VIEW_FONT_SIZE = Courier`/`12`, `PRINT_FONT`/`PRINT_FONT_SIZE = Courier`/`8`, `PRINT_ORIENTATION = Portrait`, `JBUS_MSG_FETCH_INTERVAL = 50`, `JDSS_MSG_FETCH_INTERVAL = 100` (ms) |
+| `jwuiged.sup` | Edit Module | Tuning | `JBUS_MSG_FETCH_INTERVAL = 50`, `JDSS_MSG_FETCH_INTERVAL = 100` |
+| `jwuiisg.sup` | Web-HMI server (operator interface, CI View) | Information, General, Client communication, Enterprise, Tuning, Compatibility, Mobile Operator, Proxy Service, Security | see below |
+| `wfla_display.sup` | Alarm item/display relation (§4.4.1) | General, Debug (General = keywords before the first `!TAB`, ISS-015) | `RELATION_LOCATION = Location of item`, `DISPLAY_LOCATION = Location as Relation Location`, `DUR_QUEUE_SIZE = 1000`, `TIME_OUT_SEC = 60`, `TIMER_INTERVAL = 10` |
+| `wfladi.sup` | WFLADI alarm destination (§4.4.2) | General | `EVENTS = alarm,repeat,ackn,deact,info,recov,diag,firstup` |
+| `wflcdi.sup` | WFLCDI trend/history (§4.4.3) | General, Time, Debug | `HIST_NODE = -1`, `BUFFER_SIZE = 50` (MB), `TIME_OUT_SEC = 60`, `TIMER_INTERVAL = 10` |
+| `wflgdi.sup` | WFLGDI miscellaneous (§4.4.4) | none | `ALERT_POPUP = YES`, `REPORT_UNAVAILABLE_ITEMS = YES`, `DUR_QUEUE_SIZE = 252`, `LOGGING_SIZE = 0`, `LOGGING_LEVEL = 0 None`, `DEBUG = NO` |
+| `wflidi.sup` | WFLIDI item information (§4.4.5) | General, Scan | `FLOW_CONTROL = 30`, `TIMER = 20` (clear cache), `LOCK_TIMEOUT = 60`, `SCAN_TIME = 0`, `RETRY_COUNT = 3`, `QUEUE_BUSY_LEVEL = 10`, `DUR_QUEUE_SIZE = 500`, `NODE = -1, 1000, 0.1, 30` |
+
+Where the manual and the installed software differ, this repo follows the **installed
+files** (user decision 2026-09-30):
+- The relation file is `wfla_display.sup`; the manual says `wfla_displays.sup` (ISS-012).
+- Installed values are given as the defaults: `wfla_display` queue 1000 kB (manual 500),
+  `wflgdi` queue 252 kB (manual 1000), `TIMER_INTERVAL = 10` in `wfla_display`/`wflcdi`
+  (manual: 1 s when not set) (ISS-013). `wflcdi` buffer is 50 MB; the manual's 5 MB is only
+  a sizing example.
+- `jwuiisg.sup` has a *Security* tab not in the manual; described below from the file's
+  own help (ISS-014).
+- `wfla_display.sup` defines only a *Debug* tab in the file, but the editor shows the other
+  settings on a *General* tab, as the manual shows (ISS-015, checked in the GUI).
+
+Other `wfl*.sup` files (`wfldts`, `wflini`, `wflmap`, `wflpti`) are not described in the
+manual.
+
+Checked in the Setup File Editor (2026-09-30): `wfla_display.sup`, `wflgdi.sup` and all
+nine tabs of `jwuiisg.sup` show exactly the fields and values in the files, in the order
+of their `!KEYWORD` blocks. String values are shown without their quotes. Both *Tuning*
+fields are labelled "Event fetch interval": the first is `JBUS_MSG_FETCH_INTERVAL`, the
+second `JDSS_MSG_FETCH_INTERVAL`.
+
+### jwuiisg.sup (§4.3)
+
+The file's *Information* tab says the **login method and login control settings have moved
+to `dssana.sup`** (authentication and authorization setup file), so in R1.03 the logon
+setup mentioned in §4 is not in `jwuiisg.sup` (ISS-017).
+
+| Tab | Keyword (test system value) | Meaning |
+|---|---|---|
+| General | `STORE_ITEM_IDS_IN_DISPLAYS = YES` | Store internal item/signal IDs in display and symbol files when validated: faster. Set NO when one portal may be switched between CI Cores that have the same item names (IDs differ per core), so displays need not be re-validated. |
+| Client communication | `SECURE_PORT_NUMBER = 8443`, `NON_SECURE_PORT_NUMBER = 8080` | HTTPS / HTTP ports for clients |
+| | `REQUEST_HEADER_SIZE = 8192` | Request header size |
+| | `CLIENT_QUEUE = 10000` | Messages buffered while a client cannot receive; too small → lost real-time data on reconnect. Check the *Failed* column of `jwuiisg` in the performance monitor. |
+| Enterprise | `PRIMARY_DATA_LOCATION = "$display$"` | Where to look for item attributes/object signals not specified in the display: node name/number, `$host$` (portal the operator interface is connected to) or `$display$` (portal the display was loaded from, default). A secondary location (default none) is used for enterprise displays only. |
+| Tuning | `JBUS_MSG_FETCH_INTERVAL = 50`, `JDSS_MSG_FETCH_INTERVAL = 100` | Polling of BUS Service and DSS event queues (ms) |
+| Compatibility | `R1001_COMPATIBLE_NUMBER_HANDLING = NO`, `APPLY_TEXT_SMOOTHING = NO` | Number handling (from the file's help; the manual gives none): YES = R10.01 behaviour, numbers shown and parsed in Java notation (e.g. `12345.67`) unless a format string is used; NO = the user's locale format. Text smoothing keeps labels in grouped symbols the same size when scaled |
+| Mobile Operator | `MO_CACHE_DISPLAYS = YES`, `MO_CACHE_SYMBOLS = YES`, `MO_SHAPE_RENDERING = AUTO`, `MO_BUFFER_MS = 200` | Browser caching of displays/symbols (memory vs network load). From the file's help (not in the manual): *Shape rendering* is the SVG rendering trade-off — `AUTO` (balanced, favours precision), `OPTIMIZE_SPEED` (may turn off anti-aliasing), `CRISP_EDGES`, `GEOMETRIC_PRECISION`; *Buffer alarms timer* (ms) is how long alarms are buffered before being drawn — raise it for large alarm bursts |
+| Proxy Service | (none set) | Alias, remote WMS URL, optional HTTP proxy address/port for the Edit Module map viewer (IM 36K10C50 §2.37). Needs a portal restart. |
+| Security | `SECURITY_ENABLED = YES`, `CORS_ENTRY = <parameter>, <value>` (repeated), `HEADER_ENTRY = <action>, <header>, <value>` | Not in the manual (ISS-014); from the file's help: YES applies the CORS and header settings, NO uses server defaults. CORS parameters: `allowedOrigins` (installed `"*"` = all origins), `allowedTimingOrigins`, `allowedMethods` (`GET;POST;HEAD`), `allowedHeaders`, `preflightMaxAge` (1800), `allowCredentials`, `exposedHeaders`, `chainPreflight`. Header actions `set`, `add`, `setDate`, `addDate`; installed: `set, X-Frame-Options, "sameorigin"`. A third frame, *Content Security Policy (CSP)* (`CSP_ENTRY = <directive>, <value>`, directives such as `default-src`, `script-src`, `frame-ancestors`), has no entries installed. |
+
+### WFL process files (§4.4)
+
+- **Alarm item/display relation** (`wfla_display.sup`, also set in the Engineering Module;
+  keywords `RELATION_LOCATION`, `RELATION_NODE`, `DISPLAY_LOCATION`, `DISPLAY_NODE`):
+  lets an operator open the display linked to an item from the alarm overview. Choose where
+  the relation database is (location of item, host, CI Portal, or a given node) and where
+  the display is (as the relation, location of item, host, CI Portal, or a given node).
+  Also DUR queue size, response timeout from `ith` (60 s), timer resolution, stdout debug.
+- **Alarm destination** (`wfladi.sup`): which alarm event types an alarm overview shows —
+  DIRECT, ALARM, REPEAT, ACKN, INFO, DEACT, RECOV, DIAG, QUAL, PRIO, FFIRSTUP — plus an
+  optional alarm selection area, the node running the alarm process, and an optional alarm
+  destination manager (node + process). An alarm overview component can point to this
+  file or a copy of it (Edit Module, component property *Advanced*).
+- **Trend/history** (`wflcdi.sup`): default node with the item definitions (blank = host
+  node from `dur.sup`), history node (-1 = host node, used when the storage group names no
+  node), memory pool (5 MB ≈ 100 concurrent requests ≈ 100 pens), timeout and timer.
+- **Miscellaneous** (`wflgdi.sup`): operator alert pop-ups (off → written to the system log
+  instead), reporting of unavailable items when a display opens (alternative: the item
+  *Available* property in the enterprise Edit Module), DUR queue size, debug, and a log file
+  `%TLS_ALLUSERS_PATH%\log\wflgdilog` with size (MB, 0 = none; up to twice the size is used)
+  and level 0–3 (none, basic, + item values, + DUR message dumps).
+- **Item information** (`wflidi.sup`):
+  - *Flow control interval* (30 s): if the portal hears nothing from CI Core in this time,
+    items go offline. 0 = off. Change only for slow links (e.g. satellite).
+  - *Item events* (`NODE = node, buffer size, buffer time, flow control`): how `itm` sends
+    updates to `wflidi`, per node (0 = own, -1 = all). Buffer size/time 0 = send each event;
+    otherwise events are sent when the buffer is full or the time expires.
+  - *DUR queue size* (500 kB), *Clear cache after* (20 s), *Unlock item after* (60 s; item
+    lock used for exclusive faceplates, also checked by the Engineering Module value form).
+  - *Scan* tab: scan interval (0 = event-based; scanning is better for fast-changing items),
+    update retries before logging an error (3), queue busy level (10 messages); the last two
+    apply only with scanning.
+
+## See also
+
+- Remote Connect install and web ports: `IM36K01C10-01EN.md` §2.4; firewall: `IM36K01C30-01EN.md`.
+- Displays, alarm overview component, map viewer: Edit Module (phase 10).
--- a/knowledge/manuals/IM36K10R20-01EN.md
+++ b/knowledge/manuals/IM36K10R20-01EN.md
@ -0,0 +1,106 @@
+---
+manual: IM 36K10R20-01EN
+title: Setup File Editor
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; launcher, file location and metadata keywords checked read-only on the test system (2026-09-30)
+---
+
+# Setup File Editor (R1.03)
+
+What setup files are, how the Setup File Editor shows and changes them, and the comment
+keywords (metadata) inside a setup file that the editor reads to build its forms. Section
+numbers refer to the manual.
+
+## 1. Setup files (§1)
+
+- CI Server reads its setup files (`*.sup`) **at startup**. Installed files hold the default
+  values; change a value, then **restart CI Server** for it to take effect.
+- Location: `%TLS_ROOT_PATH%\tls\sup` (about 200 files on the test system). Plain text.
+- Lines starting with `!` are comments/metadata; the other lines are the active settings,
+  normally `KEYWORD = value[, value…]`.
+- The editor does not handle non-ASCII text (it is shown garbled), so labels cannot be
+  localised.
+
+## 2. Using the editor (§2)
+
+- Start: Start menu *CI Server → Setup File Editor* (on the test system this runs
+  `%TLS_ROOT_PATH%\tls\com\fsuedit.cmd`, a Java program).
+- Main window: tabs *Setup Files* and *Templates* (the latter not in the manual, ISS-016);
+  the list shows file name, description and status: *Default* when the active values equal
+  the file's `!DEFAULT` block, *Changed* when any differs (ISS-016).
+- Double-click a file (or *File → Edit Setup File*) to open its form: one tab per group of
+  entries, with *OK*, *Cancel* and *Help* (help text of the entries). A field whose value
+  differs from its default has a **blue** label. The manual says *OK* keeps changes in
+  memory until *Exit*; in R1.03 **OK writes the file at once** (ISS-016). R1.03 also
+  shows *Undo Field* and *Reset Field*. *Reset Field* is enabled when the cursor is in a
+  changed field and sets it back to its `!DEFAULT` value; *OK* then saves.
+- A keyword that may repeat (`!TIMES = INF`, e.g. `PROXY_ENTRY` in `jwuiisg.sup`) is shown
+  as a frame (its `!LABEL`) with one input per argument and an *Add* button, a table with
+  one row per active line and one column per argument, and icon buttons beside the table
+  (apparently delete, update selected row, move up, move down; not in the manual, seen in
+  R1.03).
+- *File* menu: *Edit Setup File*; *Open File* (opens the raw file in Notepad); *Print…*
+  (preview, then print); *Refresh* (re-read the list, e.g. after changing metadata);
+  *Exit* (per the manual, asks whether to save unsaved changes).
+- *Edit* menu: *Reset to Default* (only for files that define defaults); *Edit Description*
+  (not usable); *Toggle Read Only* (locks a file against editing in the editor; toggle again
+  to unlock).
+- *Help* menu: editor help. Most commands are also on the right-click menu of the list.
+- Unavailable commands are greyed out for a given file.
+
+## 3. Metadata keywords (§3)
+
+The editor builds its forms from comment lines in the setup file. All start with `!`.
+
+**File level (§3.1)**
+
+| Keyword | Purpose |
+|---|---|
+| `!DESCRIPTION = <text>` | Description in the file list (first one wins; missing → "(Unknown)") |
+| `!INFO` … `!ENDINFO` | Text for an *Information* tab |
+| `!TAB = <label>` | Starts a tab; following keywords go on it. Keywords before the first tab (or all, if there are no tabs) go on a *General* tab. The manual says keywords before the first tab are ignored, but the R1.03 editor shows them on *General* (ISS-015). |
+| `!DEFAULT = YES/NO` … `!ENDDEFAULT` | Default settings (each line prefixed with `!`); enables *Reset to Default* |
+
+**Keyword level (§3.2)** — between `!KEYWORD : <syntax>` and `!ENDKEYWORD`:
+
+| Keyword | Purpose |
+|---|---|
+| `!LABEL = <text>` | Frame caption around the arguments; advised with several arguments, repeats or a text argument |
+| `!KEYHELP` … `!ENDKEYHELP` | Help text of the keyword |
+| `!TIMES = <n>/INF` with optional `!MUST = a|b` | How often the setting may appear (default once; 0 or INF = unlimited); values that must be present |
+| `!ARGREPEAT` | The argument list may repeat |
+| `!NUMTIMES = <from>,<to>` | Settings named `NAME_<n>` sharing one definition |
+
+Only one of `TIMES`/`MUST`, `ARGREPEAT` and `NUMTIMES` per keyword.
+
+**Argument level (§3.3)** — `!ARG<n> = <label>` … `!ENDARG<n>` with `!KIND` (required),
+`!OPTIONS` and `!HELP` … `!ENDHELP`.
+
+**Argument kinds (§3.4)**
+
+| KIND | Label | OPTIONS |
+|---|---|---|
+| `number` | "label, unit" | `pos`, `point` (decimals), `must`, `min = n`, `max = n`, `hex` (positive hex; only `must` still applies) |
+| `coord` | "label, x label, y label" | as `number` |
+| `string` | label | default: no spaces/commas, written in double quotes. `noquot`, `onequot`, `must`, `ucase`, `lcase`, `cstring` (newline → `\n`), `space`, `comma`, `nonum`, `format <letters>` |
+| `switch` | text after the check box | `on|off` values (default `YES|NO`); `alone` = keyword present or absent, no value |
+| `list` | label | comma-separated choices; `*` before the first = required |
+| `text` | label | must be the last argument; the end word follows `...` in the syntax (e.g. `... endheader`). `quot`, `must`, `cstring` |
+| `timedate` | "date label, time label" | none; only for `CHANGE` in `time_table.sup` |
+
+A full template and examples are in §3.4 and Appendix 1 (`odbsrv.sup`).
+
+## Test-system notes
+
+- Setup files can be read without the editor: lines not starting with `!` are the active
+  settings; `!KEYWORD`/`!HELP` blocks explain them (task
+  `.claude/skills/portal-setup/tasks/read-setup-file.md`).
+- `wfla_display.sup` puts its main keywords before its only `!TAB = Debug` line; the editor
+  shows them on a *General* tab, with values exactly as in the file (checked in the GUI,
+  ISS-015).
+- The R1.03 editor also has a *Templates* tab, a *Status* column (e.g. "Default"),
+  *Undo Field* / *Reset Field* buttons and a status bar, none of them in the manual
+  (ISS-016).
+- Some installed files have no `!DESCRIPTION` (e.g. `adtini.sup`, `almini.sup`,
+  `durini.sup`, `itmini.sup`); they show as "(Unknown)" in the list.
--- a/knowledge/progress.md
+++ b/knowledge/progress.md
@ -34,8 +34,8 @@ AID is not needed.
 | 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` |
 | 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` |
 | 3 | IM 36K10G10 | Tutorial | summarized ([notes](manuals/IM36K10G10-01EN.md)); command-line equivalents practiced on CI-Eng-Sample |
-| 4 | IM 36K10R10 | CI Portal Setup | not started |
-| 4 | IM 36K10R20 | Setup File Editor | not started |
+| 4 | IM 36K10R10 | CI Portal Setup | done except separate CI Portal node (needs a second node); skill `portal-setup` ([notes](manuals/IM36K10R10-01EN.md)) |
+| 4 | IM 36K10R20 | Setup File Editor | done; Templates tab and Undo Field not explored ([notes](manuals/IM36K10R20-01EN.md), ISS-016) |
 | 5 | IM 36K10C10 | Engineering Module - I/O Processes | not started |
 | 5 | IM 36K10L40 | EQUIPMENT Service - Utilities | not started |
 | 5 | IM 36K10L41 | EQUIPMENT Service - Configuration | not started |
@ -103,3 +103,8 @@ now come before classes and objects (phase 6), and the other interfaces follow a
 | G10 | Authorization group and user creation | not practiced | n/a | Creates CI Server login accounts; left for the user or phase 5. |
 | G10 | Displays, symbols, Operator Interface test | not practiced | pending | GUI (Edit Module); phase 10. |
 | G10 | Lines / stations / points, alarms, reports, audit, RDBMS, history | not practiced | pending | Covered in their own phases (5–12). |
+| R10/R20 | Read a setup file: active settings and keyword help ([task](../.claude/skills/portal-setup/tasks/read-setup-file.md)) | passed | n/a | Read-only. Compared with the Setup File Editor GUI for `wfla_display.sup`, `wflgdi.sup` and all 9 tabs of `jwuiisg.sup`: fields and values identical. Manual differences logged as ISS-012 to ISS-017 (installed software taken as the reference). |
+| R10 | Check web access for CI View: ports, Remote Connect page, `DEPLOY` folder ([task](../.claude/skills/portal-setup/tasks/check-web-access.md)) | passed | n/a | 8080/8443 listening, page 200, six `DEPLOY` folders. |
+| R10/R20 | Change a setup file safely ([task](../.claude/skills/portal-setup/tasks/change-setup-file.md)) | passed | n/a | `jwuiisg.sup` HTTP port 8080 → 8081 (text edit, elevated restart): 8081 served the page, 8080 refused; restored, hash identical to backup. Editor: *OK* writes at once, *Reset Field* restores the default (ISS-016). |
+| R10 | Separate CI Portal node (licence, DURM line, `dur.sup` host node, copy displays) | not practiced | n/a | Needs a second node. |
+| R10 | Login method / login control | not practiced | n/a | Moved to `dssana.sup` (ISS-017); phase 5 (C10) and 13 (J40). |